diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index ab0832e3c..126759605 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -68,6 +68,12 @@ described in `apps/web/DESIGN.md`. Keep explanations behind help tips, but keep
 errors, warnings and safety notices visible. Browser-derived metrics state their
 coverage, keep missing values missing, bound their fan-out and time, report a failed
 read as failed and never imply deployment-wide or billing totals.
+Sandbox deployment setup, configuration, reset and progress belong to the System
+secondary page (`#system?id=sandbox`). Nodes owns node management; Overview and
+metrics pages link to these owners instead of repeating their controls or details.
+Keep uncommon resource edits and rollout details in dialogs, and avoid repeating
+the same information within or across pages. Core responses remain the source of
+truth for deployment and connection state.
 
 For subsequent alignment and milestone closure batches, the main thread coordinates
 design, shared interface agreements, file ownership, integration and merge. First
diff --git a/apps/web/DESIGN.md b/apps/web/DESIGN.md
index 73d80fc76..ef8ab9f2f 100644
--- a/apps/web/DESIGN.md
+++ b/apps/web/DESIGN.md
@@ -736,7 +736,7 @@ while the deployment cannot be read; Show Getting started, a quiet row above the
 sidebar's account controls, opens it again at any time.
 
 ### Sandbox setup
-Setting up hosted sandboxes is a set of pages inside the Nodes page, one decision each: where sandboxes run (own
+Setting up hosted sandboxes is a set of pages inside System’s Sandbox configuration secondary page, one decision each: where sandboxes run (own
 machines or E2B), then the backend or the E2B account, then the size of each sandbox
 (three presets; E2B skips it, since each sandbox takes the template build's size),
 then a review. Choices are large cards that advance on a click; short indigo dashes
@@ -750,25 +750,53 @@ read-only: it is config.json's `public_url`, and the console never asks for it.
 loopback address carries an amber line under it: only the Core machine reaches it.
 When Core rejects the configuration for it (E2B with a loopback `public_url`), a
 red-tinted block under the review keeps Core's message and adds the config file and
-apply command as copyable values. A save attempt clears the E2B key, so the review
-then says to enter it again, with a link to that step.
+apply command as copyable values. A save attempt clears the transient E2B key. Initial setup then asks for it again,
+with a link to that step; an update may leave it blank to keep the committed key.
 Advanced settings, one link away, hold the complete form: resources (not for
 E2B), the Runtime release and the E2B template. A change keeps the saved size
 and Runtime while the backend stays the same (a saved size outside the presets is
 offered as Current). Same-backend editing starts at size or E2B credentials with
-the provider fixed, and is available only with zero held resources;
-changing the backend requires reset and then a new setup. E2B always needs its key
-again. Optional explanations sit behind help tips; errors and safety consequences
-remain visible.
+the provider fixed. It is an online configuration update, including when older
+sandboxes remain: existing node identities and resource ownership are retained.
+Changing the backend or E2B team requires reset and then a new setup. E2B updates
+can omit the key to retain it; every explicitly entered key takes the verified
+replacement path and advances the target generation on success, including the same
+value. Rejections remain inline with a safe
+reason and a deliberate way back to reset; never infer teams from a key, auto-reset
+or auto-resubmit. Optional explanations sit behind help tips; errors and safety
+consequences remain visible.
+
+### Configuration generations
+A single rollout row opens a details dialog for Core's target generation,
+previous-generation sandboxes and rollout counts. Poll rapidly only while Core reports preparing, or
+while the independent reset is active. Settled is preparation state, not proof that
+all nodes are ready or all older Sessions have ended. Retained old resources alone
+must not keep rapid polling alive. Render failed, update-required and unknown target
+states distinctly. Keep offline/live-provider status separate from a node's durable
+serving-generation pin; the pin alone never means the node is online or ready.
+Node detail shows the serving generation and target preparation; allocation detail
+shows the owned configuration generation. Do not calculate rollout completion from
+these rows or promise immediate placement on the target.
+
+A generation-only update within the same installation/backend lifecycle retains
+compatible previous node/allocation evidence while refreshing. Failed or pending
+reads visibly qualify those observations; never replace them with fabricated zeros.
+Reset, backend and installation lifecycle changes still discard incompatible data.
+The shared deployment query and write ownership below continue to govern navigation,
+late reads, explicit retries and login isolation. This final online experience ships
+only with the qualified node-generation protocol; fixture results alone do not
+establish native online-upgrade capability.
 
 ### Sandbox reset
 The deployment section offers explicit reset rather than maintenance/resume. Reuse
-its existing panels and confirmation dialogs. Auto clear is selected first, with a
+its existing panels and confirmation dialogs. Keep the confirmation to one concise
+consequence paragraph, two mode choices, the auto deadline and footer actions.
+Put cleanup sequencing and preservation details in help tips. Auto clear is selected first, with a
 one-hour deadline editable from 5 minutes to 24 hours; Force clear and escalation
 require destructive confirmation. State directly that hosted work is archived,
 remaining active work may be cancelled, archived Sessions cannot resume and
-unpersisted workspace contents may be lost. Histories and persisted Files/Artifacts
-remain, and self-hosted execution is unaffected. Cancelling an active reset stops
+unpersisted workspace contents may be lost. Details about preserved histories, Files/Artifacts and unaffected self-hosted
+execution live behind the reset impact help tip. Cancelling an active reset stops
 further clearing but cannot undo completed archives.
 
 A persistent progress panel uses Core's busy, idle and cleanup counts, deadline and
@@ -777,19 +805,24 @@ never offer a browser-side force-release shortcut. Poll the deployment every fiv
 seconds only while its reset is non-null. A passed deadline does not establish force
 or completion; only a Core response does. Completion opens the existing setup flow,
 with a new explicit save using the generation read from Core, including zero on a
-fresh install. No automatic configuration replay or online-rollout progress exists.
+fresh install. Reset and online configuration rollout have independent authoritative
+progress; neither automatically replays configuration.
 
 Read deployment progress independently of node details. Partial failures retain
 successful facts with a visible stale/unavailable notice. An uncertain write opens
 the existing recovery dialog and requires a new authoritative read before another
 mutation; refresh reads state and never resubmits the write. The connection's
 QueryClient owns both the authoritative deployment and pending or uncertain writes
-across route transitions. Leaving Nodes cannot cancel or forget a submitted reset,
+across route transitions. Leaving Sandbox configuration cannot cancel or forget a submitted reset,
 and a cached node snapshot cannot replace a newer reset or completion learned on
-Overview or System. Returning to Nodes reads the shared deployment immediately and
+Overview. Returning to Nodes or Sandbox configuration reads the shared deployment immediately and
 refreshes node evidence separately. Only a successful authoritative read begun after
 the write settles can release the mutation block; an earlier or still-pending read
-cannot. Logout clears this connection-scoped state.
+cannot. Submitting consumes the reset confirmation even if its outcome is uncertain;
+recovery uses the separate read-and-review dialog. Observation retries preserve
+applicable non-secret configuration drafts. A changed installation, owner epoch,
+backend, mode or generation discards the prior draft and confirmation. Logout clears
+this connection-scoped state.
 
 ### System page
 Four sections, each saying where it changes. Installation: the public address, API
@@ -801,13 +834,35 @@ a help tip), then the provider's protocol, base URL, whether a key is configured
 token limits when set and the update time, or Not set. Set and Replace open one form
 dialog; the key field is a required password input, never prefilled or shown and
 forgotten when the form closes. Core's rejection stays in red inside the form; Clear
-is a ConfirmDialog. Sandboxes: the shared sandbox configuration, with a "Change on
-the Nodes page" text action in the section header. Startup settings: a line naming
+is a ConfirmDialog. Usage details opens Core’s observations in a separate dialog.
+Sandboxes: one navigation row to the Sandbox configuration secondary page; do not
+repeat its configuration facts on System. Startup settings: a line naming
 the config file and the apply command as copyable chips, with when they were last
 applied, over a table of each setting, its value and the services a change restarts.
 Sensitive settings show only Configured or Not set; Default and Fixed after install
 are neutral pills beside the value.
 
+### One place for each task
+A configuration or operation has one home. Other pages link to it instead of
+repeating the same panel. System links to the Sandbox configuration secondary
+page; Nodes contains node management. Keep the configuration page flat: the
+resource editor is a dialog, and rollout is one status row with a details
+action. Put low-frequency counts and generation metadata in that dialog.
+Explanatory prose belongs in help tips, not rows of small print. Keep actionable
+errors and unresolved state visible without duplicating the whole workflow.
+
+### Diagnostic observations
+Failure reasons belong beside the failed Session or Turn status. Their first
+read uses a skeleton; an unavailable reason names that state and puts the read
+retry beside its help tip. Technical classifications are
+translated through one catalogue, not shown as raw error codes. Trace Timing
+labels Core receipt times separately from tool-reported duration; explanations
+of batched delivery, clock differences and historical gaps live in help tips.
+
+The self-hosted connection panel names Core's observed state, the bound key and
+last heartbeat. The bound-key action follows the existing rotation confirmation
+and one-time credential flow. Stale observations cannot complete Run on host.
+
 ### Loading and motion
 The console has no spinners and no "Loading…" lines. Reads are cached (TanStack
 Query) and prefetched on navigation hover, so revisits show data at once and
diff --git a/apps/web/PRODUCT.md b/apps/web/PRODUCT.md
index 881c7d8f0..af4851e24 100644
--- a/apps/web/PRODUCT.md
+++ b/apps/web/PRODUCT.md
@@ -82,32 +82,21 @@ workbench.
   Creator column naming the creating key. Detail pages show the resource's facts
   and offer Delete.
 - **Platform**: Projects and keys (projects, their assets and usage, named keys,
-  write history), Nodes (sandbox setup as pages — where sandboxes run, the
-  backend (microsandbox by default; Docker only after a confirmation of its weaker
-  isolation) or E2B account, the size of each sandbox (own machines only; E2B takes the
-  template build's), a review, and advanced settings
-  with the complete form — then the node list with each node's capacity (active
-  sandboxes against its limit, for every backend), host figures and allocations,
-  enrollment, renaming, sandbox limits (beside the host's CPUs and memory and at most
-  how many sandboxes of the deployment's size they hold) and removal; Add node
-  asks for the node's sandbox limits before it issues the one-time command, which installs
-  the node with sudo as a system service (a disclosure gives the command without sudo, as a
-  user service); both commands download from the installation's public URL, never the
-  browser's address; it issues none before the installation is read, while the public URL is
-  loopback, or when the console lacks the provider's node files; after Remove, a dialog gives
-  the host's uninstall command, or says none can be given without a usable public URL), System (the
-  installation's public address, API base URL, installation ID and source commit, read-only;
-  each harness's default model provider, set, replaced or cleared there beside its read-only startup
-  state; the sandbox configuration every project shares, with a link to Nodes where it
-  changes; and Core's startup settings from config.json, with the file and the apply command
-  that change them).
+  write history), Nodes (the node list, capacity, host figures, allocations and
+  individual node operations). Add node asks for limits before issuing its
+  one-time command; installers use Core's public URL and require supported node
+  artifacts. Removal offers the host's uninstall command. System owns installation
+  facts, each harness's default model provider, startup settings, and a link to
+  the Sandbox configuration secondary page. That page owns setup, resource edits,
+  rollout details and reset. Setup selects a backend, size and Runtime, then asks
+  for a deliberate save; own-machine setup continues to Add node.
 - A node whose provider is not ready names the reason (Docker unreachable, no Docker
   limits, missing Runtime image, no KVM, missing microsandbox components, a host too
   small) and its fix in the help tip beside its status, wherever that status shows.
 - A node enrolled with an earlier Core address gets no new sandboxes, so on the Nodes
   list and its page its status is Old address, with "Remove and add again", never
   Available.
-- **Sandbox reset** is an explicit administrator operation on Nodes. Auto clear is
+- **Sandbox reset** is an explicit administrator operation in System → Sandbox configuration. Auto clear is
   the default, with a one-hour deadline (5 minutes–24 hours); Force clear requires
   destructive confirmation. Reset stops new hosted Session admission, clears idle,
   suspended and pending hosted work, and waits for busy Turns and file writes until
@@ -117,10 +106,24 @@ workbench.
   without undoing archives. Core alone reports progress and completion, including
   resources blocked on named offline nodes; force does not bypass their cleanup.
   Completion clears the backend configuration and retires old nodes/enrollment
-  credentials. A new configuration is then a separate deliberate save. Same-backend
-  editing currently requires zero held resources; online rollout is not available.
-- **E2B deployments** have no machines: the Nodes entry becomes Sandbox backend,
-  and Overview and Sandbox metrics show the sandboxes Core holds in E2B's cloud
+  credentials. A new configuration is then a separate deliberate save.
+- **Online sandbox configuration** changes the same backend's resources, Runtime
+  or E2B template without retiring existing nodes or changing existing Sessions'
+  resource ownership. New placement follows Core's qualified capacity; saving a
+  target does not promise immediate placement on it. Configuration rollout shows
+  Core's target preparation and retained previous-generation sandbox count. A
+  settled rollout can still have failed, update-required or unknown nodes and old
+  resources. An offline node stays offline even when it has a recorded serving
+  generation. Node and allocation detail distinguish the serving pin, target
+  preparation and each resource's configuration generation.
+- **E2B credential replacement** uses the same configuration form. Setup requires
+  a key; leaving it blank during an update keeps the saved key. An explicit key,
+  even the same value, is verified as a replacement and advances the target generation
+  after successful verification.
+  Another backend or E2B team requires a deliberate reset. A rejected or uncertain
+  replacement never clears the committed configuration or replays the write.
+- **E2B deployments** have no machines: Nodes offers a link to System's sandbox configuration.
+  Overview and Sandbox metrics show the sandboxes Core holds in E2B's cloud
   (running, starting, size, template build) instead of node capacity, with no node column
   or Add node action; a sandbox's dialog adds its disk use.
 - **microsandbox** suspends idle sandboxes into snapshots, so its nodes show how
@@ -164,6 +167,12 @@ workbench.
   page, the console tells developers to set `OPENAI_BASE_URL` (the installation's
   API base URL) and `OPENAI_API_KEY` (a key of the project), with curl and Python
   samples that list Agents and create a Session.
+- **One home for each setting.** System owns sandbox configuration through its
+  Sandbox configuration secondary page. This is the only place to set up,
+  update, reset or inspect deployment rollout. Nodes owns the node list and
+  individual node operations. Overview and metrics link to these owners instead
+  of repeating their configuration or rollout panels. Resource editing uses a
+  dialog; rollout counts and generations appear in its details dialog.
 - **Web API only.** Every read and write goes through `/core/v1/**`. The console
   holds no API key and sends nothing to `/v1`.
 - **No asset writes except delete.** Assets are created and changed only by
@@ -184,6 +193,13 @@ workbench.
   submit that result; environment connection waits stay distinct from function waits.
 - **Session history is read-only.** A Session page reads the Session, its Items and
   Turns and polls while work is in flight; there is no live event stream.
+- **Failure diagnostics.** Failed Session and Turn rows read Core diagnostics and
+  translate its classified reason. The console never infers a cause from raw
+  logs. Unavailable or mismatched diagnostics offer an explicit read retry;
+  refreshing does not replay execution. Trace Timing keeps each Item's Core
+  receipt interval separate from public Turn times and native tool duration.
+  Historical missing timestamps stay unknown, negative clock intervals stay
+  missing, and bounded response truncation remains visible.
 - **Executor credentials.** Only Core issues the credential file a self-hosted
   executor needs, with the deployment's Core key. A Session page whose environment
   is self-hosted has an Executor credentials section: issue a credential (shown
@@ -191,6 +207,18 @@ workbench.
   old one stops working immediately) or revoke it (the executor disconnects and
   won't retry; its container keeps running until stopped). The file lets one
   executor connect for that environment only; it cannot call the Agents API.
+- **Default provider observations.** Each configured harness offers Usage details
+  for Core's last successful use and any newer classified provider error. Missing
+  records remain unknown; an error at or before the last success is no longer
+  actionable. These are best-effort observations, not readiness checks. Failed
+  refreshes qualify retained records, and replacing the provider starts a new
+  observation history.
+- **Host connection.** Core's connection observation and credential metadata
+  share one five-second read while visible. Never connected, connected,
+  disconnected, bound credential revoked, and unknown are distinct; a recent
+  heartbeat alone never proves connectivity. Only a fresh connected read marks
+  Run on host done. Stale or failed reads withhold completion. Recovery rotates
+  the bound key and reruns the same command rather than suggesting a new key.
 - **Connect a host.** When the console serves the self-hosted installer, the
   section also gives the command that installs the executor on the
   administrator's host from Core's `public_url` (checksum-verified, no secret in
@@ -202,6 +230,10 @@ workbench.
   connected. Without a `public_url`, with a loopback one, or when the Session's
   `remote_url` is not `wss://`, the section says why instead of showing a
   command.
+- **Typed write errors.** Known Core codes use shared bilingual copy and safe
+  typed details. Exact Core field paths attach definite refusals to the relevant
+  input. Unknown codes retain Core's fallback message; uncertain write outcomes
+  stay form-level and are never retried automatically.
 - **Read failures.** Overview and Session log distinguish unavailable reads from
   successful empty results. Failed reads have a visible retry; retained or partial
   data says it may be incomplete or out of date, and Session filter totals stay
diff --git a/apps/web/e2e/access.spec.ts b/apps/web/e2e/access.spec.ts
index 63e4e1590..ead3fbd2e 100644
--- a/apps/web/e2e/access.spec.ts
+++ b/apps/web/e2e/access.spec.ts
@@ -128,7 +128,8 @@ test("shows every page empty on a fresh install, and Getting started hides, come
   await openConsole(page, request, "overview", { fresh: true, sandbox: "none", nodes: "none" });
   // What each page shows once its reads are done: an empty state, Core's own figures, or sandbox setup.
   const loaded = (view: string) => view === "core-metrics" ? page.locator(".kpi-strip").first()
-    : view === "nodes" ? page.getByRole("heading", { name: "Where should sandboxes run?" })
+    : view === "nodes" ? page.getByText("Set up sandbox hosting in System before adding nodes.")
+    : view === "system" ? page.getByRole("button", { name: "Manage sandbox configuration" })
     : page.locator(".console-empty").first();
   for (const view of ["core-metrics", "agent-metrics", "sandbox-metrics", "sessions", "agents", "templates", "skills", "files", "vaults", "projects", "nodes", "system", "overview"]) {
     await page.goto(`/#${view}`);
@@ -150,6 +151,7 @@ test("shows every page empty on a fresh install, and Getting started hides, come
   const step = checklist.getByRole("listitem").filter({ hasText: "Get sandboxes ready" });
   await expect(step).toContainText("To do");
   await step.getByRole("button", { name: "Set up sandboxes" }).click();
+  await expect(page).toHaveURL(/#system\?id=sandbox$/);
   await expect(page.getByRole("heading", { name: "Where should sandboxes run?" })).toBeVisible();
 });
 
diff --git a/apps/web/e2e/console.ts b/apps/web/e2e/console.ts
index 82aba5d5b..44b6af91c 100644
--- a/apps/web/e2e/console.ts
+++ b/apps/web/e2e/console.ts
@@ -1,4 +1,4 @@
-import type { SandboxDeployment } from "@agents-core-web/agents-client";
+import type { SandboxDeployment, SandboxNodeRollout } from "@agents-core-web/agents-client";
 import { expect, type APIRequestContext, type Page } from "@playwright/test";
 
 const fixture = `http://127.0.0.1:${process.env.AGENTS_FIXTURE_PORT ?? 18092}`;
@@ -39,7 +39,7 @@ export async function failNext(request: APIRequestContext, failure: { method: st
 }
 
 /** Registers a node, or changes one, as a host running the last enrollment command (or, with its `enrollment_id`, another one) would. */
-export async function setNode(request: APIRequestContext, node: { id: string; name?: string; online?: boolean; provider_ready?: boolean; diagnostic?: string; enrollment_id?: string }) {
+export async function setNode(request: APIRequestContext, node: { id: string; name?: string; online?: boolean; provider_ready?: boolean; diagnostic?: string; enrollment_id?: string; rollout?: SandboxNodeRollout }) {
   await request.post(`${fixture}/__fixture/node`, { data: node });
 }
 
diff --git a/apps/web/e2e/diagnostics.spec.ts b/apps/web/e2e/diagnostics.spec.ts
new file mode 100644
index 000000000..63948f790
--- /dev/null
+++ b/apps/web/e2e/diagnostics.spec.ts
@@ -0,0 +1,92 @@
+import { expect, test } from "@playwright/test";
+
+import { expectManagementBoundary, openConsole, writes } from "./console";
+
+test.afterEach(async ({ request }) => expectManagementBoundary(request));
+
+test("reads classified failures and separate Item receipts without execution writes", async ({ page, request }) => {
+  await page.route("**/core/v1/projects/*/sessions/*/diagnostics", async (route) => {
+    const response = await route.fetch();
+    const data = await response.json();
+    if (data.failure) data.failure = { ...data.failure, code: "authentication_error", params: {} };
+    await route.fulfill({ response, json: data });
+  });
+  await page.route("**/core/v1/projects/*/sessions/*/turns/*/diagnostics", async (route) => {
+    const response = await route.fetch();
+    const data = await response.json();
+    if (data.failure) data.failure = { ...data.failure, code: "authentication_error", params: {} };
+    data.items = data.items.map((item: object) => ({ ...item, started_at: "2026-09-28T09:00:00Z", completed_at: "2026-09-28T09:00:01.250Z", observed_duration_ms: 1250 }));
+    await route.fulfill({ response, json: data });
+  });
+  await openConsole(page, request, "sessions");
+  await page.getByRole("radio", { name: /^Failed/ }).click();
+  const row = page.getByRole("row").filter({ hasText: "The model provider rejected authentication" }).first();
+  await row.getByRole("button", { name: /^Open Session / }).click();
+  await expect(page.getByLabel("Session facts")).toContainText("Check its API key");
+  await page.getByRole("radio", { name: "Trace", exact: true }).click();
+  await page.locator(".trace-ledger-row-tools").first().click();
+  await page.getByRole("tab", { name: "Timing", exact: true }).click();
+  await expect(page.getByLabel("Core receipt times")).toContainText("1.3 s");
+  await expect(page.locator(".trace-detail-timing")).toContainText("Tool-reported duration");
+  await page.screenshot({ path: test.info().outputPath("diagnostics-desktop.png") });
+  await page.setViewportSize({ width: 390, height: 844 });
+  await page.screenshot({ path: test.info().outputPath("diagnostics-mobile.png") });
+  expect(await writes(request)).toEqual([]);
+});
+
+test("shows diagnostics failure honestly and can retry in Chinese", async ({ page, request }) => {
+  let failed = true;
+  await page.route("**/core/v1/projects/*/sessions/*/diagnostics", async (route) => {
+    if (failed) return route.fulfill({ status: 503, json: { error: { code: "internal_error", message: "RAW_SENTINEL", type: "server_error", param: null } } });
+    const response = await route.fetch();
+    const data = await response.json();
+    if (data.failure) data.failure = { ...data.failure, code: "authentication_error", params: {} };
+    await route.fulfill({ response, json: data });
+  });
+  await openConsole(page, request, "sessions");
+  await page.getByRole("radio", { name: /^Failed/ }).click();
+  const row = page.getByRole("row").filter({ hasText: "Failure details unavailable" }).first();
+  await row.getByRole("button", { name: /^Open Session / }).click();
+  await page.getByRole("button", { name: "Language and appearance" }).click();
+  await page.getByRole("menuitemradio", { name: "简体中文" }).click();
+  await expect(page.getByLabel("Session 信息")).toContainText("失败详情不可用");
+  await expect(page.locator("body")).not.toContainText("RAW_SENTINEL");
+  failed = false;
+  await page.getByLabel("Session 信息").getByRole("button", { name: "失败详情", exact: true }).click();
+  await page.getByLabel("Session 信息").getByRole("button", { name: "重试诊断读取", exact: true }).click();
+  await expect(page.getByLabel("Session 信息")).toContainText("模型服务认证失败");
+  expect(await writes(request)).toEqual([]);
+});
+
+test("connection reads govern host completion and bound-key guidance", async ({ page, request }) => {
+  let connected = false;
+  let revoked = false;
+  let unavailable = false;
+  const keyId = "a0000000-0000-4000-8000-000000000001";
+  await page.route("**/core/v1/projects/*/environments/*/executor-credentials", async (route) => {
+    if (route.request().method() !== "GET") return route.continue();
+    if (unavailable) return route.fulfill({ status: 503, json: { error: { code: "internal_error", message: "Unreadable connection", type: "server_error", param: null } } });
+    await route.fulfill({ json: {
+      data: [{ key_id: keyId, created_at: "2026-09-28T08:00:00Z", revoked_at: revoked ? "2026-09-28T09:01:00Z" : null }],
+      connection: { status: connected ? "connected" : "disconnected", bound_key_id: keyId, enrolled_at: "2026-09-28T08:00:01Z", last_seen_at: "2026-09-28T08:59:00Z" },
+    } });
+  });
+  await openConsole(page, request, "sessions");
+  await page.getByRole("row").filter({ hasText: "Self-hosted" }).first().getByRole("button", { name: /^Open Session / }).click();
+  await expect(page.getByRole("region", { name: "Host connection", exact: true })).toContainText("Disconnected");
+  await expect(page.getByText("Run on host · Done", { exact: true })).toHaveCount(0);
+  await expect(page.getByRole("button", { name: "Rotate bound credential", exact: true })).toBeVisible();
+  await expect(page.getByRole("button", { name: /^Rotate credential / })).toHaveCount(0);
+  revoked = true;
+  await expect(page.getByRole("region", { name: "Host connection", exact: true })).toContainText("Bound credential revoked", { timeout: 10_000 });
+  await expect(page.getByRole("button", { name: "Rotate bound credential", exact: true })).toHaveCount(0);
+  await expect(page.getByRole("button", { name: "Rotate to restore", exact: true })).toBeVisible();
+  revoked = false;
+  connected = true;
+  await expect(page.getByRole("region", { name: "Host connection", exact: true })).toContainText("Connected", { timeout: 10_000 });
+  await expect(page.getByText("Run on host · Done", { exact: true })).toBeVisible();
+  unavailable = true;
+  await expect(page.getByRole("region", { name: "Host connection", exact: true })).toContainText("Unknown", { timeout: 10_000 });
+  await expect(page.getByText("Run on host · Done", { exact: true })).toHaveCount(0);
+  expect(await writes(request)).toEqual([]);
+});
diff --git a/apps/web/e2e/fixture-console.mjs b/apps/web/e2e/fixture-console.mjs
index 0c5b51198..b79218fd6 100644
--- a/apps/web/e2e/fixture-console.mjs
+++ b/apps/web/e2e/fixture-console.mjs
@@ -71,26 +71,26 @@ function installation() {
   };
 }
 
-/** Settled generation fields required by the strict client; this fixture does not simulate online preparation. */
-function settledRollout(mode) {
-  const nodes = mode === "nodes" ? { ready: 0, preparing: 0, failed: 0, update_required: 0, unknown: 0 } : null;
-  if (nodes) for (const node of state.nodes) nodes[node.rollout.state] += 1;
-  return { state: "settled", previous_generation_sandboxes: 0, nodes };
+const noNodeRollout = () => ({ state: "settled", previous_generation_sandboxes: 0, nodes: null });
+function nodeRollout(previous = 0) {
+  const nodes = { ready: 0, preparing: 0, failed: 0, update_required: 0, unknown: 0 };
+  for (const node of state.nodes) nodes[node.rollout.state]++;
+  return { state: nodes.preparing > 0 ? "preparing" : "settled", previous_generation_sandboxes: previous, nodes };
 }
 
 function unconfiguredDeployment(generation = 0, ownerEpoch = 3) {
-  return { installation_id: INSTALLATION_ID, provider: "", core_url: publicUrl(), rollout: settledRollout(""), reset: null, owner_epoch: ownerEpoch, generation, mode: "", resources: { allocations: 0, pending: 0 }, suspension: null };
+  return { installation_id: INSTALLATION_ID, provider: "", core_url: publicUrl(), reset: null, rollout: noNodeRollout(), owner_epoch: ownerEpoch, generation, mode: "", resources: { allocations: 0, pending: 0 }, suspension: null };
 }
 
 function configuredDeployment() {
-  return { installation_id: INSTALLATION_ID, provider: "docker", core_url: publicUrl(), rollout: settledRollout("nodes"), reset: null, owner_epoch: 3, generation: 1, mode: "nodes", resources: { allocations: 0, pending: 0 }, specification: { resources: { cpus: 2, memory_mib: 4096 }, runtime: release }, specification_digest: "fixture", suspension: null };
+  return { installation_id: INSTALLATION_ID, provider: "docker", core_url: publicUrl(), reset: null, rollout: nodeRollout(), owner_epoch: 3, generation: 1, mode: "nodes", resources: { allocations: 0, pending: 0 }, specification: { resources: { cpus: 2, memory_mib: 4096 }, runtime: release }, specification_digest: "fixture", suspension: null };
 }
 /** The E2B template build as Core read it when the selection was saved. */
 const templateBuild = { status: "ready", resources: { cpus: 2, memory_mib: 2048, root_disk_mib: 10240 } };
 
 // E2B runs sandboxes in its cloud: no nodes, only what Core holds there.
 function e2bDeployment() {
-  return { ...configuredDeployment(), provider: "e2b", mode: "direct", rollout: settledRollout("direct"), resources: { allocations: 3, pending: 1 }, specification: { resources: { cpus: 2, memory_mib: 2048 } }, e2b: { template: "oac-runtime:0f1e2d3c-4b5a-6978-8a9b-0c1d2e3f4a5b", credential_configured: true, template_build: templateBuild } };
+  return { ...configuredDeployment(), provider: "e2b", mode: "direct", rollout: noNodeRollout(), resources: { allocations: 3, pending: 1 }, specification: { resources: { cpus: 2, memory_mib: 2048 } }, e2b: { template: "oac-runtime:0f1e2d3c-4b5a-6978-8a9b-0c1d2e3f4a5b", credential_configured: true, template_build: templateBuild } };
 }
 
 function reset(mode = "login", fresh = false, sandbox = "configured", nodes = "demo", address = "public", credentials = "configured", installers = true, artifacts = "docker,microsandbox") {
@@ -118,7 +118,7 @@ function reset(mode = "login", fresh = false, sandbox = "configured", nodes = "d
     // The demo deployment's default harness has a default model; a fresh install has none.
     harnesses: {
       claude_sdk: { enabled: true, default: false, provider: null },
-      codex: { enabled: true, default: true, provider: fresh ? null : { object: "core.model_provider", harness: "codex", protocol: "responses", base_url: "https://model.example/v1", api_key_configured: true, updated_at: new Date((now - 86400) * 1000).toISOString().replace(/\.\d{3}Z$/, "Z") } },
+      codex: { enabled: true, default: true, provider: fresh ? null : { object: "core.model_provider", harness: "codex", protocol: "responses", base_url: "https://model.example/v1", api_key_configured: true, last_used_at: null, last_error_code: null, last_error_at: null, updated_at: new Date((now - 86400) * 1000).toISOString().replace(/\.\d{3}Z$/, "Z") } },
       mcode: { enabled: false, default: false, provider: null },
     },
     // "none": the deployment is not configured yet, so the Nodes page offers setup.
@@ -285,6 +285,20 @@ function adminRead(response, path, url) {
     const session = own.sessions.find((entry) => entry.id === m[1]);
     if (!session) return error(response, 404, "No such Session.");
     if (!m[2]) return send(response, 200, session);
+    if (m[2] === "diagnostics") {
+      const failedTurn = (state.turns.get(session.id) ?? []).findLast((turn) => turn.status === "failed");
+      return send(response, 200, { object: "core.session_diagnostics", session_id: session.id, status: session.status,
+        failure: session.status === "failed" ? { source: failedTurn ? "turn" : "environment_input", ...(failedTurn ? { turn_id: failedTurn.id } : {}), code: "internal_error", params: {}, failed_at: null } : null });
+    }
+    const diagnostics = m[2].match(/^turns\/([^/]+)\/diagnostics$/);
+    if (diagnostics) {
+      const turn = (state.turns.get(session.id) ?? []).find((entry) => entry.id === diagnostics[1]);
+      if (!turn) return error(response, 404, "No such Turn.");
+      return send(response, 200, { object: "core.turn_diagnostics", session_id: session.id, turn_id: turn.id, status: turn.status,
+        failure: turn.status === "failed" ? { code: "internal_error", params: {}, failed_at: null } : null,
+        items: (state.items.get(session.id) ?? []).filter((item) => item.turn_id === turn.id).slice(0, 1000).map((item) => ({ item_id: item.id, started_at: new Date((turn.started_at ?? turn.created_at) * 1000).toISOString(), completed_at: null, observed_duration_ms: null })),
+        items_truncated: false });
+    }
     if (m[2] === "turns") return send(response, 200, list([...(state.turns.get(session.id) ?? [])].reverse(), url));
     if (m[2] === "items") return send(response, 200, list([...(state.items.get(session.id) ?? [])].reverse(), url));
     if (m[2] === "runtime-observation") {
@@ -356,19 +370,37 @@ async function sandboxRoute(request, response, path, url) {
     if (input.expected_generation !== state.deployment.generation) return error(response, 409, "The sandbox configuration changed. Refresh before submitting again.", "sandbox_generation_stale");
     if (state.deployment.reset) return error(response, 409, "A sandbox reset is in progress.", "sandbox_reset_in_progress");
     if (!initialize && input.provider !== state.deployment.provider) return error(response, 409, "Reset before changing the sandbox backend.", "sandbox_reset_required");
-    if (!initialize && state.deployment.resources.allocations + state.deployment.resources.pending > 0) return error(response, 409, "Sandbox resources remain.", "sandbox_in_use");
     if (initialize && state.deployment.provider) return error(response, 409, "The sandbox deployment is already configured.", "sandbox_deployment_conflict");
     if (!initialize && !state.deployment.provider) return error(response, 409, "The sandbox deployment is not configured.", "sandbox_deployment_conflict");
     const e2b = input.provider === "e2b";
     if (!e2b && (!input.resources || !input.runtime)) return error(response, 400, "resources and runtime are required.", "invalid_sandbox_configuration");
     // As Core (ErrSandboxPublicURLUnreachable): E2B sandboxes reach Core over the internet, which a loopback public_url cannot serve.
     if (e2b && state.installation === "local") return error(response, 409, "E2B sandboxes reach Core over the internet. Set an HTTPS public URL that is not loopback (public_url in config.json, OAC_PUBLIC_URL for Core).", "sandbox_configuration_error");
+    // Synthetic classifier outcomes only; never persist or echo submitted keys.
+    if (e2b) {
+      if (!input.e2b?.template || (initialize && !input.e2b.api_key) || (Object.hasOwn(input.e2b ?? {}, "api_key") && !input.e2b.api_key)) return error(response, 400, "The E2B API key was rejected.", "e2b_api_key_invalid");
+      if (input.e2b.api_key === "fixture-other-team-key") return error(response, 409, "This E2B key cannot manage the retained deployment. Reset before changing teams.", "e2b_team_mismatch");
+      if (input.e2b.api_key === "fixture-invalid-key") return error(response, 400, "The E2B API key was rejected.", "e2b_api_key_invalid");
+    }
     // As Core: E2B may omit resources and adopt its template build's CPU and memory; only microsandbox suspends.
     const resources = input.resources ?? { cpus: templateBuild.resources.cpus, memory_mib: templateBuild.resources.memory_mib };
+    const previous = state.deployment;
+    const specification = { resources, ...(input.runtime ? { runtime: input.runtime } : {}) };
+    const explicitKey = e2b && Object.hasOwn(input.e2b, "api_key");
+    const sameSelection = !initialize && JSON.stringify(specification) === JSON.stringify(previous.specification) && (!e2b || input.e2b.template === previous.e2b?.template);
+    // Omission can be a no-op; every explicit key, including identical bytes,
+    // takes the verified replacement path and advances the target generation.
+    if (sameSelection && !explicitKey) return send(response, 200, previous);
+    if (!initialize && !e2b) {
+      for (const node of state.nodes) node.rollout = { state: node.online ? "preparing" : "unknown", ready_generation: node.rollout.ready_generation };
+    }
+    const held = initialize ? { allocations: 0, pending: 0 } : previous.resources;
     state.deployment = {
-      ...configuredDeployment(), provider: input.provider, mode: e2b ? "direct" : "nodes", rollout: settledRollout(e2b ? "direct" : "nodes"),
-      generation: state.deployment.generation + 1, owner_epoch: state.deployment.owner_epoch,
-      specification: { resources, ...(input.runtime ? { runtime: input.runtime } : {}) },
+      ...configuredDeployment(), provider: input.provider, mode: e2b ? "direct" : "nodes",
+      generation: previous.generation + 1, owner_epoch: previous.owner_epoch,
+      resources: held,
+      rollout: e2b ? { ...noNodeRollout(), previous_generation_sandboxes: held.allocations + held.pending } : nodeRollout(held.allocations + held.pending),
+      specification,
       ...(e2b ? { e2b: { template: input.e2b?.template ?? "", credential_configured: true, template_build: templateBuild } } : {}),
       suspension: input.provider === "microsandbox" ? { idle_seconds: 300, retention_seconds: 86400 } : null,
     };
@@ -408,7 +440,7 @@ async function sandboxRoute(request, response, path, url) {
     const index = state.nodes.findIndex((node) => node.id === m[1]);
     if (index < 0) return error(response, 404, "No such node.");
     state.nodes.splice(index, 1);
-    state.deployment.rollout = settledRollout(state.deployment.mode);
+    if (state.deployment.mode === "nodes") state.deployment.rollout = nodeRollout(state.deployment.rollout.previous_generation_sandboxes);
     return send(response, 200, { id: m[1], deleted: true });
   }
   return error(response, 404, "Not found.");
@@ -534,6 +566,7 @@ async function harnessRoute(request, response, path) {
     object: "core.model_provider", harness, protocol: input.protocol, base_url: input.base_url, api_key_configured: true,
     ...(input.context_window ? { context_window: input.context_window } : {}),
     ...(input.max_output_tokens ? { max_output_tokens: input.max_output_tokens } : {}),
+    last_used_at: null, last_error_code: null, last_error_at: null,
     updated_at: new Date().toISOString().replace(/\.\d{3}Z$/, "Z"),
   };
   return send(response, 200, entry.provider);
@@ -568,11 +601,14 @@ async function fixtureRoute(request, response, url) {
     let node = state.nodes.find((entry) => entry.id === nodeId);
     if (!node) state.nodes.push(node = registeredNode(nodeId));
     Object.assign(node, fields);
-    if (!fields.rollout) node.rollout = !node.online ? { state: "unknown", ready_generation: node.rollout.ready_generation }
-      : node.provider_ready ? { state: "ready", ready_generation: state.deployment.generation }
-        : node.diagnostic ? { state: "failed", ready_generation: node.rollout.ready_generation, diagnostic: node.diagnostic }
-          : { state: "unknown", ready_generation: node.rollout.ready_generation };
-    state.deployment.rollout = settledRollout(state.deployment.mode);
+    // A control may supply an explicit target observation. Existing enrollment
+    // cases only supply connection facts, so give that newly joined target a pin.
+    if (!fields.rollout && ("online" in fields || "provider_ready" in fields || "diagnostic" in fields)) {
+      node.rollout = !node.online ? { state: "unknown", ready_generation: node.rollout.ready_generation }
+        : node.provider_ready ? { state: "ready", ready_generation: state.deployment.generation }
+        : { state: "failed", ready_generation: node.rollout.ready_generation, diagnostic: node.diagnostic || "provider_unavailable" };
+    }
+    if (state.deployment.mode === "nodes") state.deployment.rollout = nodeRollout(state.deployment.rollout.previous_generation_sandboxes);
     if (!node.diagnostic) delete node.diagnostic;
     return send(response, 200, node);
   }
diff --git a/apps/web/e2e/monitoring.spec.ts b/apps/web/e2e/monitoring.spec.ts
index 26ecb45e2..4e73326f3 100644
--- a/apps/web/e2e/monitoring.spec.ts
+++ b/apps/web/e2e/monitoring.spec.ts
@@ -25,7 +25,7 @@ test("shows the deployment's health on Overview and each monitor page", async ({
   await page.getByRole("button", { name: "Sandbox metrics" }).click();
   await expect(page.getByRole("table").first()).toContainText("core-01");
   // A degraded node names why its provider is not ready.
-  await expect(page.getByRole("button", { name: "Docker limits unsupported" })).toBeVisible();
+  await expect(page.locator(".status-with-help").filter({ hasText: /^Provider not ready/ }).getByRole("button", { name: "Docker limits unsupported", exact: true })).toBeVisible();
 });
 
 test("opens a Session's conversation from the Session log, read-only", async ({ page, request }) => {
@@ -37,7 +37,7 @@ test("opens a Session's conversation from the Session log, read-only", async ({
 });
 
 test("keeps a failed Session's reason in sight in the Session log and on its page", async ({ page, request }) => {
-  const reasons = /Sandbox allocation failed: node unavailable\.|Model provider returned 429 Too Many Requests\.|Tool call timed out after 300 s\./;
+  const reasons = /Execution could not complete\. No specific cause was reported\./;
   await page.setViewportSize({ width: 1280, height: 800 });
   await openConsole(page, request, "sessions");
   await page.getByRole("radio", { name: /^Failed/ }).click();
@@ -182,7 +182,7 @@ test("issues a new executor credential after the unanswered one was rotated from
   await page.unroute("**/executor-credentials");
 
   // The page's refresh lists it; the administrator rotates it from its row.
-  await page.getByRole("button", { name: "Refresh", exact: true }).click();
+  await page.getByRole("button", { name: "Refresh", exact: true }).first().click();
   const credentials = section.getByRole("table", { name: "Executor credentials" });
   await credentials.getByRole("button", { name: /^Rotate credential / }).click();
   // Rotating an active credential disconnects its host until the command is rerun with the new one.
@@ -222,6 +222,7 @@ test("shows E2B's cloud instead of machines", async ({ page, request }) => {
   await expect(page.getByRole("button", { name: "Add node" })).toHaveCount(0);
   await expect(page.getByRole("columnheader", { name: "Node", exact: true })).toHaveCount(0);
 
-  await page.getByRole("navigation").getByRole("button", { name: "Sandbox backend" }).click();
-  await expect(page.getByRole("heading", { name: "Sandbox backend", level: 1 })).toBeVisible();
+  await page.getByRole("navigation").getByRole("button", { name: "Nodes", exact: true }).click();
+  await expect(page.getByRole("heading", { name: "Nodes", level: 1 })).toBeVisible();
+  await expect(page.getByText("E2B runs sandboxes in its cloud. There are no nodes to manage.")).toBeVisible();
 });
diff --git a/apps/web/e2e/nodes.spec.ts b/apps/web/e2e/nodes.spec.ts
index c41f9ba14..0a0f673ba 100644
--- a/apps/web/e2e/nodes.spec.ts
+++ b/apps/web/e2e/nodes.spec.ts
@@ -197,7 +197,7 @@ test("gives the host's uninstall command even when the installation must be read
 });
 
 test("sets up own-machine sandboxes page by page, with the Runtime from the distribution", async ({ page, request }) => {
-  await openConsole(page, request, "nodes", { sandbox: "none" });
+  await openConsole(page, request, "system?id=sandbox", { sandbox: "none" });
   await expect(page.getByRole("heading", { name: "Where should sandboxes run?" })).toBeVisible();
   await page.getByRole("button", { name: "Own machines" }).click();
   await page.getByRole("button", { name: "microsandbox Recommended" }).click();
@@ -205,8 +205,6 @@ test("sets up own-machine sandboxes page by page, with the Runtime from the dist
   await expect(page.getByRole("heading", { name: "Review and save" })).toBeVisible();
   await page.getByRole("button", { name: "Save configuration" }).click();
 
-  // The saved specification carries the Runtime read from the console's manifest.
-  await expect(page.getByText("c0ffee000000")).toBeVisible();
   // Own machines continue straight to adding the first node, at its limits: no command is issued yet.
   await expect(page.getByRole("dialog", { name: "Add node" }).getByLabel("Sandboxes at once")).toBeVisible();
   const add = page.getByRole("dialog", { name: "Add node" });
@@ -216,10 +214,16 @@ test("sets up own-machine sandboxes page by page, with the Runtime from the dist
   const tokenRequested = await page.waitForRequest((sent) => sent.url().endsWith("/core/v1/sandbox/enrollment-tokens"), { timeout: 1000 }).then(() => true, () => false);
   expect(tokenRequested).toBe(false);
   expect(await writes(request)).toEqual(["POST /core/v1/sandbox/deployment"]);
+  await add.getByRole("button", { name: "Close dialog" }).click();
+  await page.getByRole("button", { name: "System", exact: true }).click();
+  await page.getByRole("button", { name: "Manage sandbox configuration", exact: true }).click();
+  // The saved specification carries the Runtime read from the console's manifest.
+  await page.getByRole("button", { name: "Configuration details", exact: true }).click();
+  await expect(page.locator(".help-tip-popover").getByText("c0ffee000000", { exact: true })).toBeVisible();
 });
 
 test("preselects microsandbox and asks once before switching to Docker", async ({ page, request }) => {
-  await openConsole(page, request, "nodes", { sandbox: "none" });
+  await openConsole(page, request, "system?id=sandbox", { sandbox: "none" });
   await page.getByRole("button", { name: "Own machines" }).click();
   const microsandbox = page.getByRole("button", { name: "microsandbox Recommended" });
   const docker = page.getByRole("button", { name: "Docker", exact: true });
@@ -239,7 +243,7 @@ test("preselects microsandbox and asks once before switching to Docker", async (
   await docker.click();
   await confirm.getByRole("button", { name: "Use Docker" }).click();
   await expect(sizeStep).toBeVisible();
-  await page.getByRole("button", { name: "Back" }).click();
+  await page.getByRole("button", { name: "Back", exact: true }).click();
   await expect(docker).toHaveAttribute("aria-pressed", "true");
   await docker.click();
   await expect(sizeStep).toBeVisible();
@@ -247,13 +251,13 @@ test("preselects microsandbox and asks once before switching to Docker", async (
 });
 
 test("saves E2B without opening Add node, as it has no machines", async ({ page, request }) => {
-  await openConsole(page, request, "nodes", { sandbox: "none" });
+  await openConsole(page, request, "system?id=sandbox", { sandbox: "none" });
   await page.getByRole("button", { name: "E2B cloud" }).click();
   await page.getByLabel("E2B API key").fill("fixture-private-key");
   await page.getByLabel("Template build").fill("template:94be54a1-138c-4f30-bc87-b13686272dbe");
   await page.getByRole("button", { name: "Next" }).click();
   await page.getByRole("button", { name: "Save configuration" }).click();
-  await expect(page.getByRole("heading", { name: "Sandbox backend", level: 1 })).toBeVisible();
+  await expect(page.getByRole("heading", { name: "Sandbox configuration", level: 1 })).toBeVisible();
   await expect(page.getByRole("dialog")).toHaveCount(0);
 });
 
@@ -261,7 +265,7 @@ test("edits only the saved backend, preserving a custom size and Runtime", async
   const runtime = { source_commit: "0".repeat(40), image_id: `sha256:${"a".repeat(64)}`, image_manifest_digest: `sha256:${"b".repeat(64)}`,
     microsandbox_ref: `oac-runtime@sha256:${"b".repeat(64)}`, runtime_sha256: "c".repeat(64), firmware_sha256: "d".repeat(64) };
   const current = { resources: { cpus: 7, memory_mib: 8192 }, runtime };
-  let deployment = { rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 0, preparing: 0, failed: 0, update_required: 0, unknown: 0 } }, installation_id: "94be54a1-138c-4f30-bc87-b13686272dbe", provider: "docker", core_url: "https://core.example", reset: null,
+  let deployment = { installation_id: "94be54a1-138c-4f30-bc87-b13686272dbe", provider: "docker", core_url: "https://core.example", reset: null, rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 0, preparing: 0, failed: 0, update_required: 0, unknown: 0 } },
     owner_epoch: 1, generation: 1, mode: "nodes", resources: { allocations: 0, pending: 0 }, specification: current, specification_digest: "e".repeat(64),
     suspension: null };
   let submitted: Record<string, unknown> | null = null;
@@ -273,7 +277,7 @@ test("edits only the saved backend, preserving a custom size and Runtime", async
     await route.fulfill({ json: deployment });
   });
   await page.route("**/core/v1/sandbox/nodes", (route) => route.fulfill({ json: { data: [] } }));
-  await openConsole(page, request, "nodes");
+  await openConsole(page, request, "system?id=sandbox");
   await page.getByRole("button", { name: "Change resources" }).click();
   await expect(page.getByRole("button", { name: "Own machines" })).toHaveCount(0);
   await expect(page.getByRole("button", { name: "E2B cloud" })).toHaveCount(0);
@@ -284,7 +288,7 @@ test("edits only the saved backend, preserving a custom size and Runtime", async
 });
 
 test("keeps the page usable when Core refuses a sandbox change, and shows Core's reason", async ({ page, request }) => {
-  await openConsole(page, request, "nodes", { sandbox: "none" });
+  await openConsole(page, request, "system?id=sandbox", { sandbox: "none" });
   await failNext(request, { method: "POST", path: "/sandbox/deployment", status: 403, message: "This console is read-only." });
   await page.getByRole("button", { name: "Own machines" }).click();
   await page.getByRole("button", { name: "microsandbox Recommended" }).click();
@@ -300,7 +304,13 @@ test("keeps the page usable when Core refuses a sandbox change, and shows Core's
   await expect(page.getByText("Another administrator changed the deployment; it is now at generation 2.")).toBeVisible();
   await expect(page.getByRole("dialog")).toHaveCount(0);
   await save.click();
-  await expect(page.getByText("c0ffee000000")).toBeVisible();
+  const added = page.getByRole("dialog", { name: "Add node" });
+  await expect(added).toBeVisible();
+  await added.getByRole("button", { name: "Close dialog" }).click();
+  await page.getByRole("button", { name: "System", exact: true }).click();
+  await page.getByRole("button", { name: "Manage sandbox configuration", exact: true }).click();
+  await page.getByRole("button", { name: "Configuration details", exact: true }).click();
+  await expect(page.locator(".help-tip-popover").getByText("c0ffee000000", { exact: true })).toBeVisible();
 });
 
 test("renames a node and sets how many sandboxes run on it at once", async ({ page, request }) => {
diff --git a/apps/web/e2e/provider-observations.spec.ts b/apps/web/e2e/provider-observations.spec.ts
new file mode 100644
index 000000000..b3fd750d3
--- /dev/null
+++ b/apps/web/e2e/provider-observations.spec.ts
@@ -0,0 +1,41 @@
+import { expect, test } from "@playwright/test";
+import { expectManagementBoundary, openConsole, writes } from "./console";
+
+test.afterEach(async ({ request }) => expectManagementBoundary(request));
+
+test("default provider observations are optional details and recover only on Core success", async ({ page, request }) => {
+  let observation = { last_used_at: null as string | null, last_error_code: null as string | null, last_error_at: null as string | null };
+  let fail = false;
+  await page.route("**/core/v1/harnesses", async (route) => {
+    if (fail) return route.fulfill({ status: 503, json: { error: { code: "internal_error", message: "Read unavailable", type: "server_error", param: null } } });
+    const response = await route.fetch();
+    const data = await response.json();
+    for (const harness of data.data) if (harness.model_provider) Object.assign(harness.model_provider, observation);
+    await route.fulfill({ response, json: data });
+  });
+  await openConsole(page, request, "system");
+  const card = page.getByRole("article", { name: "Codex", exact: true });
+  await expect(card).not.toContainText("Last successful use");
+  await card.getByRole("button", { name: "Usage details", exact: true }).click();
+  const details = page.getByRole("dialog", { name: "Codex usage details", exact: true });
+  await expect(details).toContainText("Not recorded");
+  await details.getByRole("button", { name: "Close dialog", exact: true }).click();
+  observation = { last_used_at: null, last_error_code: "authentication_error", last_error_at: "2026-09-28T08:01:00Z" };
+  await page.getByRole("button", { name: "Refresh system configuration", exact: true }).click();
+  await expect(card).toContainText("Recent error");
+  await card.getByRole("button", { name: "Usage details", exact: true }).click();
+  await expect(details).toContainText("The model provider rejected authentication");
+  await expect(details).not.toContainText("authentication_error");
+  await details.getByRole("button", { name: "Close dialog", exact: true }).click();
+  observation.last_used_at = "2026-09-28T08:02:00Z";
+  await page.getByRole("button", { name: "Refresh system configuration", exact: true }).click();
+  await expect(card).not.toContainText("Recent error");
+  await card.getByRole("button", { name: "Usage details", exact: true }).click();
+  await expect(details).toContainText("None recorded");
+  await expect(details).not.toContainText("The model provider rejected authentication");
+  await details.getByRole("button", { name: "Close dialog", exact: true }).click();
+  fail = true;
+  await page.getByRole("button", { name: "Refresh system configuration", exact: true }).click();
+  await expect(card).toContainText("Observation unconfirmed");
+  expect(await writes(request)).toEqual([]);
+});
diff --git a/apps/web/e2e/public-url.spec.ts b/apps/web/e2e/public-url.spec.ts
index b406bd4c7..1875a1458 100644
--- a/apps/web/e2e/public-url.spec.ts
+++ b/apps/web/e2e/public-url.spec.ts
@@ -7,7 +7,7 @@ test.afterEach(async ({ request }) => expectManagementBoundary(request));
 test("sets up sandboxes with Core's address read-only, never sending it", async ({ page, request }) => {
   const bodies: string[] = [];
   page.on("request", (sent) => { if (sent.url().includes("/core/v1/sandbox/deployment")) bodies.push(sent.postData() ?? ""); });
-  await openConsole(page, request, "nodes", { sandbox: "none" });
+  await openConsole(page, request, "system?id=sandbox", { sandbox: "none" });
   await page.getByRole("button", { name: "Own machines" }).click();
   await page.getByRole("button", { name: "microsandbox Recommended" }).click();
   await page.getByRole("button", { name: /^Standard/ }).click();
@@ -23,7 +23,7 @@ test("sets up sandboxes with Core's address read-only, never sending it", async
 });
 
 test("explains an E2B rejection in the wizard, with the file to edit and the command to apply it", async ({ page, request }) => {
-  await openConsole(page, request, "nodes", { sandbox: "none", installation: "local" });
+  await openConsole(page, request, "system?id=sandbox", { sandbox: "none", installation: "local" });
   await page.getByRole("button", { name: "E2B cloud" }).click();
   await page.getByLabel("E2B API key").fill("fixture-private-key");
   await page.getByLabel("Template build").fill("template:94be54a1-138c-4f30-bc87-b13686272dbe");
@@ -32,7 +32,7 @@ test("explains an E2B rejection in the wizard, with the file to edit and the com
   await expect(address).toContainText("Only the Core machine can reach this address");
   await page.getByRole("button", { name: "Save configuration" }).click();
   const rejection = page.locator(".wizard-rejection");
-  await expect(rejection).toContainText("E2B sandboxes reach Core over the internet.");
+  await expect(rejection).toContainText("E2B sandboxes need an HTTPS public_url reachable from the internet.");
   await expect(rejection).toContainText("/opt/oac/config.json");
   await expect(rejection).toContainText("sudo oac apply");
   // Nothing was saved and nothing is uncertain: no dialog, and the wizard stays on its review.
diff --git a/apps/web/e2e/sandbox-generation.spec.ts b/apps/web/e2e/sandbox-generation.spec.ts
new file mode 100644
index 000000000..eafd8554b
--- /dev/null
+++ b/apps/web/e2e/sandbox-generation.spec.ts
@@ -0,0 +1,325 @@
+import { expect, test, type Locator, type Page, type TestInfo } from "@playwright/test";
+import type { SandboxAllocation, SandboxDeployment, SandboxNode } from "@agents-core-web/agents-client";
+
+import { expectManagementBoundary, failNext, openConsole, setDeployment, setNode, writes } from "./console";
+
+const deploymentPath = "/core/v1/sandbox/deployment";
+const rollout = (page: Page) => page.getByRole("region", { name: "Configuration rollout", exact: true });
+const fact = (scope: Locator, label: string) => scope.locator("dt").filter({ hasText: new RegExp(`^${label}`) }).locator("..").locator("dd");
+async function inspectRollout(page: Page, values: Record<string, string>) {
+  await rollout(page).getByRole("button", { name: "View rollout details", exact: true }).click();
+  const dialog = page.getByRole("dialog", { name: "Configuration rollout", exact: true });
+  for (const [label, value] of Object.entries(values)) await expect(fact(dialog, label)).toHaveText(value);
+  await dialog.getByRole("button", { name: "Close dialog", exact: true }).click();
+  await expect(dialog).toBeHidden();
+}
+const deploymentRead = (page: Page) => read<SandboxDeployment>(page, deploymentPath);
+async function read<T>(page: Page, path: string): Promise<T> {
+  const response = await page.request.get(new URL(path, page.url()).href);
+  expect(response.ok()).toBe(true);
+  return response.json() as Promise<T>;
+}
+async function inventory(page: Page) {
+  const nodes = (await read<{ data: SandboxNode[] }>(page, "/core/v1/sandbox/nodes")).data;
+  const allocations = (await Promise.all(nodes.map((node) => read<{ data: SandboxAllocation[] }>(page, `/core/v1/sandbox/nodes/${node.id}/allocations`)))).flatMap((result) => result.data);
+  return { nodes, allocations };
+}
+async function saveConfiguration(page: Page) {
+  const sent = page.waitForRequest((request) => request.method() === "PUT" && request.url().endsWith(deploymentPath));
+  const response = page.waitForResponse((response) => response.request().method() === "PUT" && response.url().endsWith(deploymentPath));
+  await page.getByRole("button", { name: "Save configuration", exact: true }).click();
+  return { input: (await sent).postDataJSON(), response: await response };
+}
+async function editE2B(page: Page, key?: string) {
+  await page.getByRole("button", { name: "Change resources", exact: true }).click();
+  await expect(page.getByLabel("E2B API key", { exact: true })).toHaveValue("");
+  if (key !== undefined) await page.getByLabel("E2B API key", { exact: true }).fill(key);
+  await page.getByRole("button", { name: "Next", exact: true }).click();
+}
+
+async function capture(page: Page, info: TestInfo, name: string, scope?: Locator) {
+  const path = info.outputPath(`${name}.png`);
+  if (scope) await scope.screenshot({ path });
+  else await page.screenshot({ path, fullPage: true });
+  await info.attach(name, { path, contentType: "image/png" });
+}
+
+test.afterEach(async ({ request }) => expectManagementBoundary(request));
+
+test("online configuration retains existing resources and stops rapid polling when preparation settles", async ({ page, request }, info) => {
+  await page.setViewportSize({ width: 1280, height: 1000 });
+  await page.emulateMedia({ reducedMotion: "reduce", colorScheme: "light" });
+  const pending = new Set<unknown>();
+  page.on("request", (sent) => { if (sent.method() === "GET" && sent.url().endsWith(deploymentPath)) pending.add(sent); });
+  page.on("requestfinished", (sent) => pending.delete(sent));
+  page.on("requestfailed", (sent) => pending.delete(sent));
+  await openConsole(page, request, "system?id=sandbox");
+  await expect(rollout(page)).toBeVisible();
+  const before = await inventory(page);
+  expect(before.allocations.length).toBeGreaterThan(0);
+  await setDeployment(request, { resources: { allocations: before.allocations.length, pending: 0 } });
+  await page.getByRole("button", { name: "Refresh sandbox state", exact: true }).click();
+  await page.getByRole("button", { name: "Change resources", exact: true }).click();
+  await page.getByRole("button", { name: /^Large/ }).click();
+  const saved = await saveConfiguration(page);
+  expect(saved.response.ok()).toBe(true);
+  expect(saved.input).toMatchObject({ provider: "docker", expected_generation: 1 });
+  const current = await saved.response.json() as SandboxDeployment;
+  expect(current.generation).toBe(2);
+  expect(current.resources.allocations).toBe(before.allocations.length);
+  await inspectRollout(page, { "Core preparation": "Preparing configuration", "Previous-generation sandboxes": String(before.allocations.length) });
+  const after = await inventory(page);
+  expect(after.nodes.map((node) => node.id)).toEqual(before.nodes.map((node) => node.id));
+  expect(after.allocations).toEqual(before.allocations);
+  expect(after.nodes.map((node) => node.rollout.ready_generation)).toEqual(before.nodes.map((node) => node.rollout.ready_generation));
+
+  // Explicit Core observations settle preparation; old Session ownership remains.
+  await setNode(request, { id: "node-local", rollout: { state: "ready", ready_generation: 2 } });
+  await setNode(request, { id: "node-gpu", rollout: { state: "failed", ready_generation: 1, diagnostic: "runtime_image_unavailable" } });
+  await setNode(request, { id: "node-edge", rollout: { state: "unknown", ready_generation: 1 } });
+  await page.getByRole("button", { name: "Refresh sandbox state", exact: true }).click();
+  await expect(rollout(page)).toContainText("Needs attention");
+  await inspectRollout(page, { "Core preparation": "No active preparation", "Previous-generation sandboxes": String(before.allocations.length), "Preparation failed": "1", "Target readiness unknown": "1" });
+  await expect(page.getByRole("button", { name: "Change resources", exact: true })).toBeEnabled();
+  // Watch longer than the five-second preparation interval. Retained resources
+  // are not a reason to keep that interval alive; ordinary thirty-second reads remain.
+  await expect.poll(() => pending.size).toBe(0);
+  const rapidRead = await page.waitForRequest((sent) => sent.method() === "GET" && sent.url().endsWith(deploymentPath), { timeout: 6500 }).then(() => true, () => false);
+  expect(rapidRead).toBe(false);
+  await inspectRollout(page, { "Target generation": "2" });
+  await expect(page.locator("html")).toHaveAttribute("data-theme", "light");
+  await capture(page, info, "generation-settled-en-light-1280");
+  await page.emulateMedia({ colorScheme: "dark" });
+  await page.getByRole("button", { name: "Language and appearance" }).click();
+  await page.getByRole("menuitemradio", { name: "简体中文" }).click();
+  const localized = page.getByRole("region", { name: "配置更新进度", exact: true });
+  await expect(localized).toContainText("需要检查");
+  await localized.getByRole("button", { name: "查看详情", exact: true }).click();
+  const details = page.getByRole("dialog", { name: "配置更新进度", exact: true });
+  await expect(fact(details, "Core 准备状态")).toHaveText("没有正在进行的准备任务");
+  await expect(fact(details, "目标代次")).toHaveText("2");
+  await expect(fact(details, "旧代次沙箱")).toHaveText(String(before.allocations.length));
+  await expect(page.locator("html")).toHaveAttribute("data-theme", "dark");
+  await capture(page, info, "generation-settled-zh-dark-1280");
+  expect(await writes(request)).toEqual([`PUT ${deploymentPath}`]);
+});
+
+test("unknown target preparation preserves live old-generation service while an offline pin stays offline", async ({ page, request }, info) => {
+  await page.setViewportSize({ width: 1280, height: 1000 });
+  await page.emulateMedia({ colorScheme: "light", reducedMotion: "reduce" });
+  await openConsole(page, request, "system?id=sandbox", { fresh: true });
+  await setDeployment(request, { generation: 2 });
+  await setNode(request, { id: "node-local", online: true, provider_ready: true, rollout: { state: "unknown", ready_generation: 1 } });
+  await setNode(request, { id: "node-edge", online: false, provider_ready: true, rollout: { state: "unknown", ready_generation: 1 } });
+  await setNode(request, { id: "node-gpu", rollout: { state: "update_required", ready_generation: 1 } });
+  await page.getByRole("button", { name: "Refresh sandbox state", exact: true }).click();
+  await inspectRollout(page, { "Node software incompatible": "1" });
+  await page.getByRole("button", { name: "Nodes", exact: true }).click();
+  const serving = page.getByRole("row", { name: /core-01/ });
+  await expect(serving).toContainText("Available");
+  await expect(serving).toContainText("Target readiness unknown");
+  const row = page.getByRole("row", { name: /edge-03/ });
+  await expect(row).toContainText("Offline");
+  await expect(row).not.toContainText("Ready for target");
+  await page.getByRole("button", { name: "Open edge-03", exact: true }).click();
+  await expect(page.getByRole("heading", { name: "edge-03", exact: true })).toBeVisible();
+  const facts = page.locator(".resource-facts");
+  await expect(facts.locator("dt").filter({ hasText: /^Serving generation/ }).locator("..").locator("dd")).toHaveText("1");
+  await expect(facts.locator("dt").filter({ hasText: /^Target preparation/ }).locator("..").locator("dd")).toContainText("Target readiness unknown");
+  await expect(facts.locator("dt").filter({ hasText: /^Status$/ }).locator("..")).toContainText("Offline");
+  await page.getByRole("button", { name: "Overview", exact: true }).click();
+  const setup = page.getByRole("region", { name: "Getting started" }).getByRole("listitem").filter({ hasText: "Get sandboxes ready" });
+  await expect(setup).toContainText("Done");
+  await expect(rollout(page)).toHaveCount(0);
+  await page.getByRole("button", { name: "System", exact: true }).click();
+  await expect(rollout(page)).toHaveCount(0);
+  await page.getByRole("button", { name: "Manage sandbox configuration", exact: true }).click();
+  await inspectRollout(page, { "Target generation": "2", "Target readiness unknown": "2", "Node software incompatible": "1" });
+  await capture(page, info, "generation-configuration-summary-en", rollout(page));
+  expect(await writes(request)).toEqual([]);
+});
+
+test("a generation-only change preserves mixed allocation ownership through failed inventory reads", async ({ page, request }) => {
+  await openConsole(page, request, "system?id=sandbox");
+  await expect(rollout(page)).toBeVisible();
+  let expected: { session: string; generation: string }[] = [];
+  await page.route("**/core/v1/sandbox/nodes/node-local/allocations", async (route) => {
+    const response = await route.fetch();
+    const body = await response.json() as { data: SandboxAllocation[] };
+    body.data = body.data.map((allocation, index) => ({ ...allocation, deployment_generation: index % 2 + 1 }));
+    expected = body.data.map((allocation) => ({ session: allocation.session_id, generation: String(allocation.deployment_generation) }));
+    await route.fulfill({ response, json: body });
+  });
+  await setDeployment(request, { generation: 2 });
+  await page.getByRole("button", { name: "Refresh sandbox state", exact: true }).click();
+  await inspectRollout(page, { "Target generation": "2" });
+  await page.getByRole("button", { name: "Nodes", exact: true }).click();
+  await page.getByRole("button", { name: "Open core-01", exact: true }).click();
+  const table = page.getByRole("table", { name: "Sandbox allocations", exact: true });
+  await expect(table.getByRole("columnheader", { name: "Configuration generation", exact: true })).toBeVisible();
+  await expect.poll(() => [...new Set(expected.map((entry) => entry.generation))].sort()).toEqual(["1", "2"]);
+  const ownership = () => table.locator("tbody tr").evaluateAll((rows) => rows.map((row) => ({
+    session: row.querySelector("th code")?.getAttribute("title"),
+    generation: row.querySelector("td")?.textContent,
+  })));
+  await expect.poll(ownership).toEqual(expected);
+  await page.route("**/core/v1/sandbox/nodes", (route) => route.fulfill({ status: 503, json: { error: { type: "server_error", code: null, message: "Node inventory unavailable.", param: null } } }));
+  await setDeployment(request, { generation: 3 });
+  const refreshed = page.waitForResponse((response) => response.request().method() === "GET" && response.url().endsWith(deploymentPath));
+  await page.getByRole("button", { name: "Refresh sandbox state", exact: true }).click();
+  expect((await (await refreshed).json()).generation).toBe(3);
+  await expect(page.getByText("Node state could not be read", { exact: true })).toBeVisible();
+  await expect(page.getByRole("heading", { name: "core-01", exact: true })).toBeVisible();
+  await expect.poll(ownership).toEqual(expected);
+  expect(await writes(request)).toEqual([]);
+});
+
+test("E2B omitted-key updates keep the saved key while explicit same-key replacements each advance generation", async ({ page, request }) => {
+  await openConsole(page, request, "system?id=sandbox", { sandbox: "e2b" });
+  await expect(rollout(page)).toBeVisible();
+  const initial = await deploymentRead(page);
+  await editE2B(page);
+  const omitted = await saveConfiguration(page);
+  expect(omitted.input).toMatchObject({ provider: "e2b", expected_generation: 1, e2b: { template: initial.e2b!.template } });
+  expect(omitted.input.e2b).not.toHaveProperty("api_key");
+  expect((await omitted.response.json()).generation).toBe(1);
+  await expect(page.getByRole("dialog", { name: "Change resources", exact: true })).toBeHidden();
+  const key = "fixture-same-team-key";
+  for (const generation of [1, 2]) {
+    await editE2B(page, key);
+    const explicit = await saveConfiguration(page);
+    expect(explicit.input).toMatchObject({ provider: "e2b", expected_generation: generation, e2b: { template: initial.e2b!.template, api_key: key } });
+    const current = await explicit.response.json() as SandboxDeployment;
+    expect(current.generation).toBe(generation + 1);
+    expect(current.resources).toEqual(initial.resources);
+    await inspectRollout(page, { "Target generation": String(generation + 1) });
+  }
+  const storage = await page.evaluate(() => JSON.stringify({ local: { ...localStorage }, session: { ...sessionStorage } }));
+  expect(storage).not.toContain(key);
+  expect(await page.content()).not.toContain(key);
+  expect(await writes(request)).toEqual(Array(3).fill(`PUT ${deploymentPath}`));
+});
+
+test("a different E2B team leaves the committed configuration intact and requires a deliberate reset", async ({ page, request }) => {
+  await openConsole(page, request, "system?id=sandbox", { sandbox: "e2b" });
+  await expect(rollout(page)).toBeVisible();
+  const before = await deploymentRead(page);
+  await editE2B(page, "fixture-other-team-key");
+  const rejected = await saveConfiguration(page);
+  expect(rejected.response.status()).toBe(409);
+  await expect(page.locator(".wizard-rejection")).toContainText("Reset before changing teams.");
+  await expect(page.locator(".wizard-rejection")).toContainText("the saved configuration is unchanged");
+  expect(await deploymentRead(page)).toEqual(before);
+  await expect(page.getByRole("button", { name: "Save configuration", exact: true })).toBeDisabled();
+  await expect(page.getByRole("button", { name: "Keep saved key", exact: true })).toBeVisible();
+  await expect(page.getByRole("dialog", { name: "Change resources", exact: true })).toBeVisible();
+  await expect(page.getByRole("dialog", { name: "Couldn't confirm the sandbox change" })).toHaveCount(0);
+  expect(await writes(request)).toEqual([`PUT ${deploymentPath}`]);
+  await page.getByRole("button", { name: "Cancel editing", exact: true }).click();
+  await page.getByRole("button", { name: "Reset deployment", exact: true }).click();
+  const reset = page.getByRole("dialog", { name: "Reset sandbox deployment?", exact: true });
+  await expect(reset).toContainText("Hosted Sessions will be archived permanently.");
+  expect(await writes(request)).toEqual([`PUT ${deploymentPath}`]);
+  await reset.getByRole("button", { name: "Back", exact: true }).click();
+  await editE2B(page);
+  expect(await writes(request)).toEqual([`PUT ${deploymentPath}`]);
+});
+
+
+test("uncertain configuration refresh and inventory retry preserve a draft until its generation changes", async ({ page, request }) => {
+  await openConsole(page, request, "system?id=sandbox");
+  await expect(rollout(page)).toBeVisible();
+  const initial = await deploymentRead(page);
+  const committedSize = await fact(page.getByRole("region", { name: "Deployment provider", exact: true }), "Each sandbox").first().innerText();
+  await page.getByRole("button", { name: "Change resources", exact: true }).click();
+  const edit = page.getByRole("dialog", { name: "Change resources", exact: true });
+  await edit.getByRole("button", { name: /^Large/ }).click();
+  const wizard = edit.getByRole("region", { name: "Change the sandbox configuration", exact: true });
+  const draftSize = await fact(wizard, "Each sandbox").innerText();
+  expect(draftSize).not.toBe(committedSize);
+  await failNext(request, { method: "PUT", path: deploymentPath, status: 503, message: "Configuration outcome is unconfirmed." });
+  const result = await saveConfiguration(page);
+  expect(result.response.status()).toBe(503);
+  expect(result.input.expected_generation).toBe(initial.generation);
+  let failInventory = true;
+  await page.route("**/core/v1/sandbox/nodes", (route) => failInventory
+    ? route.fulfill({ status: 503, json: { error: { type: "server_error", code: null, message: "Node inventory unavailable.", param: null } } })
+    : route.continue());
+  await expect(edit).toContainText("The sandbox service is unavailable. Refresh to check the current state.");
+  await expect(edit).toContainText("Refresh sandbox state to confirm whether the change was saved before submitting again.");
+  const failedInventory = page.waitForResponse((response) => response.url().endsWith("/sandbox/nodes") && response.status() === 503);
+  await edit.getByRole("button", { name: "Refresh sandbox state", exact: true }).click();
+  await failedInventory;
+  // Configuration stays authoritative even when the independent node inventory fails.
+  await expect(wizard.getByRole("heading", { name: "Review and save", exact: true })).toBeVisible();
+  await expect(fact(wizard, "Each sandbox")).toHaveText(draftSize);
+  expect((await deploymentRead(page)).generation).toBe(initial.generation);
+  await expect(wizard.getByRole("button", { name: "Save configuration", exact: true })).toBeEnabled();
+  expect(await writes(request)).toEqual([`PUT ${deploymentPath}`]);
+  failInventory = false;
+  const inventoryRecovered = page.waitForResponse((response) => response.url().endsWith("/sandbox/nodes") && response.ok());
+  await edit.getByRole("button", { name: "Refresh sandbox state", exact: true }).click();
+  await inventoryRecovered;
+  await expect(fact(wizard, "Each sandbox")).toHaveText(draftSize);
+  await expect(wizard.getByRole("button", { name: "Save configuration", exact: true })).toBeEnabled();
+  expect(await writes(request)).toEqual([`PUT ${deploymentPath}`]);
+  await setDeployment(request, { generation: initial.generation + 1 });
+  await edit.getByRole("button", { name: "Refresh sandbox state", exact: true }).click();
+  await expect(edit).toBeHidden();
+  await inspectRollout(page, { "Target generation": String(initial.generation + 1) });
+  await expect(wizard).toHaveCount(0);
+  await expect(fact(page.getByRole("region", { name: "Deployment provider", exact: true }), "Each sandbox")).toHaveText(committedSize);
+  await page.getByRole("button", { name: "Change resources", exact: true }).click();
+  await expect(wizard.getByRole("button", { name: /^Large/ })).toBeVisible();
+  await expect(wizard.getByRole("heading", { name: "Review and save", exact: true })).toHaveCount(0);
+  expect(await writes(request)).toEqual([`PUT ${deploymentPath}`]);
+});
+
+
+test("an observed installation change discards the old reset confirmation even at the same generation", async ({ page, request }) => {
+  await openConsole(page, request, "system?id=sandbox");
+  await expect(rollout(page)).toBeVisible();
+  // A genuine preparing projection enables normal five-second observation while
+  // the confirmation is open; the test never clicks through a modal overlay.
+  await setNode(request, { id: "node-local", rollout: { state: "preparing", ready_generation: 1 } });
+  await page.getByRole("button", { name: "Refresh sandbox state", exact: true }).click();
+  await inspectRollout(page, { "Core preparation": "Preparing configuration" });
+  await page.getByRole("button", { name: "Reset deployment", exact: true }).click();
+  const dialog = page.getByRole("dialog", { name: "Reset sandbox deployment?", exact: true });
+  await expect(dialog).toBeVisible();
+  const initial = await deploymentRead(page);
+  await setDeployment(request, { installation_id: `${initial.installation_id}-replacement` });
+  await expect(dialog).toHaveCount(0);
+  await inspectRollout(page, { "Target generation": String(initial.generation) });
+  expect(await writes(request)).toEqual([]);
+  await page.getByRole("button", { name: "Reset deployment", exact: true }).click();
+  await expect(dialog).toBeVisible();
+  await dialog.getByRole("button", { name: "Back", exact: true }).click();
+  expect(await writes(request)).toEqual([]);
+});
+
+
+test("closing an uncertain edit preserves the shared write block until a successful read", async ({ page, request }) => {
+  await openConsole(page, request, "system?id=sandbox");
+  await page.getByRole("button", { name: "Change resources", exact: true }).click();
+  const edit = page.getByRole("dialog", { name: "Change resources", exact: true });
+  await edit.getByRole("button", { name: /^Large/ }).click();
+  await failNext(request, { method: "PUT", path: deploymentPath, status: 503, message: "Configuration outcome is unconfirmed." });
+  let failReads = true;
+  await page.route("**/core/v1/sandbox/deployment", (route) => route.request().method() === "GET" && failReads
+    ? route.fulfill({ status: 503, json: { error: { type: "server_error", code: null, message: "Deployment read unavailable.", param: null } } })
+    : route.continue());
+  const result = await saveConfiguration(page);
+  expect(result.response.status()).toBe(503);
+  await expect(edit).toContainText("The sandbox service is unavailable. Refresh to check the current state.");
+  await edit.getByRole("button", { name: "Refresh sandbox state", exact: true }).click();
+  await expect(edit.getByRole("button", { name: "Save configuration", exact: true })).toBeDisabled();
+  await edit.getByRole("button", { name: "Cancel editing", exact: true }).click();
+  await expect(edit).toBeHidden();
+  await expect(page.getByRole("button", { name: "Change resources", exact: true })).toBeDisabled();
+  expect(await writes(request)).toEqual([`PUT ${deploymentPath}`]);
+  failReads = false;
+  await page.getByRole("button", { name: "Refresh sandbox state", exact: true }).click();
+  await expect(page.getByRole("button", { name: "Change resources", exact: true })).toBeEnabled();
+  expect(await writes(request)).toEqual([`PUT ${deploymentPath}`]);
+});
diff --git a/apps/web/e2e/sandbox-reset.spec.ts b/apps/web/e2e/sandbox-reset.spec.ts
index c7a302f32..c314cd666 100644
--- a/apps/web/e2e/sandbox-reset.spec.ts
+++ b/apps/web/e2e/sandbox-reset.spec.ts
@@ -13,6 +13,16 @@ const observedReset = (clear: "auto" | "force" = "auto"): SandboxReset => ({
   remaining: { busy: 2, idle: 1, cleanup: 1, on_offline_nodes: 2, offline_nodes: [{ node_id: "offline-owned", name: "offline-build-worker", resources: 2 }] },
 });
 const progress = (page: Page) => page.getByRole("region", { name: "Reset in progress" });
+async function openConfiguration(page: Page) {
+  await page.getByRole("button", { name: "System", exact: true }).click();
+  await page.getByRole("button", { name: "Manage sandbox configuration", exact: true }).click();
+}
+async function expectEnrollmentBlocked(page: Page) {
+  await page.getByRole("button", { name: "Nodes", exact: true }).click();
+  await expect(page.getByRole("button", { name: "Add node", exact: true })).toBeDisabled();
+  await openConfiguration(page);
+}
+
 async function openReset(page: Page) {
   await page.getByRole("button", { name: "Reset deployment", exact: true }).click();
   return page.getByRole("dialog", { name: "Reset sandbox deployment?", exact: true });
@@ -31,7 +41,7 @@ test.afterEach(async ({ request }) => {
 test("auto reset requires a bounded deadline, then preserves Core progress past that deadline", async ({ page, request }, info) => {
   await page.setViewportSize({ width: 1280, height: 1000 });
   await page.emulateMedia({ colorScheme: "light", reducedMotion: "reduce" });
-  await openConsole(page, request, "nodes");
+  await openConsole(page, request, "system?id=sandbox");
   await setDeployment(request, { resources: { allocations: 3, pending: 1 } });
   await page.getByRole("button", { name: "Refresh sandbox state", exact: true }).click();
   const dialog = await openReset(page);
@@ -43,14 +53,17 @@ test("auto reset requires a bounded deadline, then preserves Core progress past
   expect(await writes(request)).toEqual([]);
   await entry.press("Enter");
   await expect(dialog).toBeVisible();
-  const deadline = dialog.getByLabel(/Force remaining work after \(seconds\)/);
+  const deadline = dialog.getByLabel(/Wait before forcing \(seconds\)/);
   await expect(deadline).toHaveValue("3600");
   await deadline.fill("299");
   await expect(dialog.getByRole("button", { name: "Reset deployment", exact: true })).toBeDisabled();
   await deadline.fill("86401");
   await expect(dialog.getByRole("button", { name: "Reset deployment", exact: true })).toBeDisabled();
   await deadline.fill("300");
-  await expect(dialog).toContainText("Archived Sessions cannot be resumed");
+  await expect(dialog).toContainText("Hosted Sessions will be archived permanently.");
+  await dialog.getByRole("button", { name: "What reset affects", exact: true }).click();
+  await expect(page.locator(".help-tip-popover")).toContainText("Archived Sessions cannot be resumed");
+  await dialog.getByRole("button", { name: "What reset affects", exact: true }).click();
   await expect(dialog).toContainText("self-hosted");
   await expect(page.locator("html")).toHaveAttribute("data-theme", "light");
   await capture(page, info, "reset-confirm-en-light-1280");
@@ -63,14 +76,14 @@ test("auto reset requires a bounded deadline, then preserves Core progress past
   await page.getByRole("button", { name: "Refresh sandbox state", exact: true }).click();
   await expect(progress(page)).toContainText("offline-build-worker");
   await expect(progress(page)).toContainText("Busy work can finish until the deadline.");
-  await expect(page.getByRole("button", { name: "Add node", exact: true })).toBeDisabled();
+  await expectEnrollmentBlocked(page);
   await expect(page.getByRole("heading", { name: "Where should sandboxes run?" })).toHaveCount(0);
   await capture(page, info, "reset-progress-en-light-1280");
   expect(await writes(request)).toEqual([`POST ${resetPath}`]);
 });
 
 test("escalation and cancellation require explicit confirmation and never undo previous clearing", async ({ page, request }) => {
-  await openConsole(page, request, "nodes");
+  await openConsole(page, request, "system?id=sandbox");
   await setDeployment(request, { resources: { allocations: 3, pending: 1 }, reset: observedReset() });
   await page.reload();
   await progress(page).getByRole("button", { name: "Force reset now" }).click();
@@ -97,7 +110,7 @@ test("escalation and cancellation require explicit confirmation and never undo p
 });
 
 test("force reset requires confirmation and reconfiguration uses the completed generation once", async ({ page, request }) => {
-  await openConsole(page, request, "nodes");
+  await openConsole(page, request, "system?id=sandbox");
   await setDeployment(request, { resources: { allocations: 1, pending: 0 } });
   await page.getByRole("button", { name: "Refresh sandbox state", exact: true }).click();
   const dialog = await openReset(page);
@@ -120,7 +133,7 @@ test("force reset requires confirmation and reconfiguration uses the completed g
 });
 
 test("an applied reset with a lost response stays blocked through failed reads and is never replayed", async ({ page, request }) => {
-  await openConsole(page, request, "nodes");
+  await openConsole(page, request, "system?id=sandbox");
   await expect(page.getByRole("button", { name: "Reset deployment", exact: true })).toBeEnabled();
   await setDeployment(request, { resources: { allocations: 1, pending: 0 } });
   await page.getByRole("button", { name: "Refresh sandbox state", exact: true }).click();
@@ -135,6 +148,7 @@ test("an applied reset with a lost response stays blocked through failed reads a
   await dialog.getByRole("button", { name: "Reset deployment", exact: true }).click();
   const uncertain = page.getByRole("dialog", { name: "Couldn't confirm the sandbox change" });
   await expect(uncertain).toBeVisible();
+  await expect(dialog).toHaveCount(0);
   await uncertain.getByRole("button", { name: "Refresh sandbox state" }).click();
   await expect(page.getByRole("button", { name: "Reset deployment", exact: true })).toBeDisabled();
   expect(await writes(request)).toEqual([`POST ${resetPath}`]);
@@ -146,7 +160,7 @@ test("an applied reset with a lost response stays blocked through failed reads a
 });
 
 test("a stale reset is refused until fresh state is reviewed, with no automatic resubmission", async ({ page, request }) => {
-  await openConsole(page, request, "nodes");
+  await openConsole(page, request, "system?id=sandbox");
   await expect(page.getByRole("button", { name: "Reset deployment", exact: true })).toBeEnabled();
   await setDeployment(request, { generation: 2, resources: { allocations: 3, pending: 1 } });
   const dialog = await openReset(page);
@@ -165,7 +179,7 @@ test("a stale reset is refused until fresh state is reviewed, with no automatic
 
   // The administrator reviews a new confirmation before the next explicit POST.
   const reviewed = await openReset(page);
-  await expect(reviewed).toContainText("Archived Sessions cannot be resumed");
+  await expect(reviewed).toContainText("Hosted Sessions will be archived permanently.");
   expect(await writes(request)).toEqual([`POST ${resetPath}`]);
   const resubmitted = page.waitForRequest((sent) => sent.method() === "POST" && sent.url().endsWith(resetPath));
   await reviewed.getByRole("button", { name: "Reset deployment", exact: true }).click();
@@ -177,7 +191,7 @@ test("a stale reset is refused until fresh state is reviewed, with no automatic
 test("reset progress survives failed node and deployment reads with visible qualifications in Chinese dark mode", async ({ page, request }, info) => {
   await page.setViewportSize({ width: 1280, height: 1000 });
   await page.emulateMedia({ colorScheme: "dark" });
-  await openConsole(page, request, "nodes");
+  await openConsole(page, request, "system?id=sandbox");
   await setDeployment(request, { resources: { allocations: 3, pending: 1 }, reset: observedReset() });
   await page.route("**/core/v1/sandbox/nodes", (route) => route.fulfill(unavailable));
   await page.reload();
@@ -200,7 +214,7 @@ test("reset progress survives failed node and deployment reads with visible qual
 });
 
 test("a pending reset survives navigation and a lost response cannot reopen stale write controls", async ({ page, request }) => {
-  await openConsole(page, request, "nodes");
+  await openConsole(page, request, "system?id=sandbox");
   await expect(page.getByRole("button", { name: "Reset deployment", exact: true })).toBeEnabled();
   await setDeployment(request, { resources: { allocations: 1, pending: 0 } });
   await page.getByRole("button", { name: "Refresh sandbox state", exact: true }).click();
@@ -228,21 +242,21 @@ test("a pending reset survives navigation and a lost response cannot reopen stal
     // A hash navigation keeps the application/query cache alive, unlike a reload.
     await page.evaluate(() => { window.location.hash = "overview"; });
     await expect(page.getByRole("heading", { name: "Overview", level: 1 })).toBeVisible();
-    await page.getByRole("button", { name: "Nodes", exact: true }).click();
+    await openConfiguration(page);
     const resetButton = page.getByRole("button", { name: "Reset deployment", exact: true });
     await expect(resetButton).toBeDisabled();
-    await expect(page.getByRole("button", { name: "Add node", exact: true })).toBeDisabled();
+    await expectEnrollmentBlocked(page);
     expect(Date.now() - cachedAt).toBeLessThan(30_000);
     expect(await writes(request)).toEqual([`POST ${resetPath}`]);
 
     release();
     await responseLost;
     // Ownership survives routing, but a departed page's local error dialog must
-    // not be resurrected on the new Nodes instance when that request settles.
+    // not be resurrected on the new configuration page when that request settles.
     await expect(page.getByRole("dialog", { name: "Couldn't confirm the sandbox change" })).toHaveCount(0);
     await page.getByRole("button", { name: "Overview", exact: true }).click();
     await expect(page.getByRole("heading", { name: "Overview", level: 1 })).toBeVisible();
-    await page.getByRole("button", { name: "Nodes", exact: true }).click();
+    await openConfiguration(page);
     await expect(resetButton).toBeDisabled();
     // An explicit refresh also fails; neither navigation nor failure replays POST.
     await page.getByRole("button", { name: "Refresh sandbox state", exact: true }).click();
@@ -257,22 +271,22 @@ test("a pending reset survives navigation and a lost response cannot reopen stal
   } finally { release(); }
 });
 
-test("Nodes adopts the reset and completion learned on Overview before its cached node data expires", async ({ page, request }) => {
+test("Nodes and configuration adopt reset and completion learned on Overview before cached node data expires", async ({ page, request }) => {
   await openConsole(page, request, "nodes");
-  await expect(page.getByRole("button", { name: "Reset deployment", exact: true })).toBeEnabled();
   await expect(page.getByRole("button", { name: "Add node", exact: true })).toBeEnabled();
+  await openConfiguration(page);
+  await expect(page.getByRole("button", { name: "Reset deployment", exact: true })).toBeEnabled();
   const cachedAt = Date.now();
   await page.getByRole("button", { name: "Overview", exact: true }).click();
   await setDeployment(request, { resources: { allocations: 3, pending: 1 }, reset: observedReset() });
   await page.getByRole("button", { name: "Refresh", exact: true }).click();
   await expect(page.getByRole("heading", { name: "Sandbox reset in progress" })).toBeVisible();
-  await page.getByRole("button", { name: "Nodes", exact: true }).click();
+  await expectEnrollmentBlocked(page);
   await expect(progress(page)).toContainText("offline-build-worker");
-  await expect(page.getByRole("button", { name: "Add node", exact: true })).toBeDisabled();
   await expect(page.getByRole("button", { name: "Change resources", exact: true })).toHaveCount(0);
   expect(Date.now() - cachedAt).toBeLessThan(30_000);
 
-  // No refresh click: the shared active reset starts bounded read-only polling on Nodes.
+  // No refresh click: shared active reset starts bounded read-only polling on configuration.
   const forced = observedReset("force");
   forced.remaining = { busy: 0, idle: 0, cleanup: 1, on_offline_nodes: 1, offline_nodes: [{ node_id: "offline-owned", name: "offline-build-worker", resources: 1 }] };
   await setDeployment(request, { resources: { allocations: 1, pending: 0 }, reset: forced });
@@ -285,6 +299,9 @@ test("Nodes adopts the reset and completion learned on Overview before its cache
   await page.getByRole("button", { name: "Refresh", exact: true }).click();
   await expect(page.getByRole("heading", { name: "Sandbox reset in progress" })).toHaveCount(0);
   await page.getByRole("button", { name: "Nodes", exact: true }).click();
+  await expect(page.getByText("Set up sandbox hosting in System before adding nodes.")).toBeVisible();
+  await expect(page.getByRole("button", { name: "Add node", exact: true })).toHaveCount(0);
+  await openConfiguration(page);
   await expect(page.getByRole("heading", { name: "Where should sandboxes run?" })).toBeVisible();
   await expect(progress(page)).toHaveCount(0);
   expect(Date.now() - completedAt).toBeLessThan(30_000);
@@ -293,7 +310,7 @@ test("Nodes adopts the reset and completion learned on Overview before its cache
 
 
 test("signing out clears pending reset ownership and a late response cannot overwrite the new login", async ({ page, request }) => {
-  await openConsole(page, request, "nodes");
+  await openConsole(page, request, "system?id=sandbox");
   await setDeployment(request, { resources: { allocations: 1, pending: 0 } });
   await page.getByRole("button", { name: "Refresh sandbox state", exact: true }).click();
   const dialog = await openReset(page);
@@ -319,7 +336,7 @@ test("signing out clears pending reset ownership and a late response cannot over
     await page.getByLabel("Core key", { exact: true }).fill(FIXTURE_CORE_KEY);
     await page.getByRole("button", { name: "Sign in", exact: true }).click();
     await expect(page.getByRole("heading", { name: "Overview", level: 1 })).toBeVisible();
-    await page.getByRole("button", { name: "Nodes", exact: true }).click();
+    await openConfiguration(page);
     await page.getByRole("button", { name: "Own machines" }).click();
     await page.getByRole("button", { name: "microsandbox Recommended" }).click();
     await page.getByRole("button", { name: /^Standard/ }).click();
@@ -335,10 +352,12 @@ test("signing out clears pending reset ownership and a late response cannot over
     await (await lateResponse).finished();
     // The old generation-1 reset response cannot restore reset progress, block
     // this login, or show the old route's result/error dialog.
+    await openConfiguration(page);
     const newDialog = await openReset(page);
     await expect(newDialog).toBeVisible();
     await newDialog.getByRole("button", { name: "Back", exact: true }).click();
     await expect(progress(page)).toHaveCount(0);
+    await page.getByRole("button", { name: "Nodes", exact: true }).click();
     await expect(page.getByRole("button", { name: "Add node", exact: true })).toBeEnabled();
     expect(await writes(request)).toEqual([`POST ${resetPath}`, "POST /core/v1/sandbox/deployment"]);
   } finally { release(); }
diff --git a/apps/web/e2e/sandbox-rollout-details.spec.ts b/apps/web/e2e/sandbox-rollout-details.spec.ts
new file mode 100644
index 000000000..7736a555a
--- /dev/null
+++ b/apps/web/e2e/sandbox-rollout-details.spec.ts
@@ -0,0 +1,51 @@
+import { expect, test, type Locator } from "@playwright/test";
+import { expectManagementBoundary, openConsole, writes } from "./console";
+
+const fact = (scope: Locator, label: string) => scope.locator("dt").filter({ hasText: new RegExp(`^${label}`) }).locator("..").locator("dd");
+
+test.afterEach(async ({ request }) => expectManagementBoundary(request));
+
+test("keeps rollout summary brief and opens all Core observations in details", async ({ page, request }) => {
+  await page.route("**/core/v1/sandbox/deployment", async (route) => {
+    const response = await route.fetch();
+    const deployment = await response.json();
+    await route.fulfill({ response, json: { ...deployment, generation: 4, resources: { allocations: 8, pending: 0 }, rollout: { state: "settled", previous_generation_sandboxes: 8, nodes: { ready: 1, preparing: 0, failed: 2, update_required: 3, unknown: 4 } } } });
+  });
+  await openConsole(page, request, "system?id=sandbox");
+  const summary = page.getByRole("region", { name: "Configuration rollout", exact: true });
+  await expect(summary).toContainText("Needs attention");
+  await expect(summary.locator("dl")).toHaveCount(0);
+  await expect(summary.getByText("Target generation", { exact: true })).toHaveCount(0);
+  const details = summary.getByRole("button", { name: "View rollout details", exact: true });
+  await details.click();
+  const dialog = page.getByRole("dialog", { name: "Configuration rollout", exact: true });
+  await expect(fact(dialog, "Core preparation")).toHaveText("No active preparation");
+  await expect(fact(dialog, "Target generation")).toHaveText("4");
+  await expect(fact(dialog, "Previous-generation sandboxes")).toHaveText("8");
+  await expect(fact(dialog, "Preparation failed")).toHaveText("2");
+  await expect(fact(dialog, "Node software incompatible")).toHaveText("3");
+  await expect(fact(dialog, "Target readiness unknown")).toHaveText("4");
+  await page.keyboard.press("Escape");
+  await expect(dialog).not.toBeVisible();
+  await expect(details).toBeFocused();
+  expect(await writes(request)).toEqual([]);
+});
+
+test("labels unknown target readiness without declaring settled nodes ready", async ({ page, request }) => {
+  await page.route("**/core/v1/sandbox/deployment", async (route) => {
+    const response = await route.fetch();
+    const deployment = await response.json();
+    await route.fulfill({ response, json: { ...deployment, rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, update_required: 0, unknown: 1 } } } });
+  });
+  await openConsole(page, request, "system?id=sandbox");
+  const summary = page.getByRole("region", { name: "Configuration rollout", exact: true });
+  await expect(summary).toContainText("Target readiness unknown");
+  await expect(summary).not.toContainText("No active preparation");
+  await page.getByRole("button", { name: "Language and appearance" }).click();
+  await page.getByRole("menuitemradio", { name: "简体中文" }).click();
+  const translated = page.getByRole("region", { name: "配置更新进度", exact: true });
+  await expect(translated).toContainText("目标配置就绪状态未知");
+  await translated.getByRole("button", { name: "查看详情", exact: true }).click();
+  await expect(page.getByRole("dialog", { name: "配置更新进度", exact: true })).toContainText("Core 准备状态");
+  expect(await writes(request)).toEqual([]);
+});
diff --git a/apps/web/e2e/wording.spec.ts b/apps/web/e2e/wording.spec.ts
index bc5020980..3c342b83a 100644
--- a/apps/web/e2e/wording.spec.ts
+++ b/apps/web/e2e/wording.spec.ts
@@ -42,8 +42,8 @@ test("keeps English Session filters and actions visible at 1280 pixels", async (
 
 test("names the E2B backend consistently and explains its two count sources", async ({ page, request }) => {
   await openConsole(page, request, "system", { sandbox: "e2b" });
-  await page.getByRole("button", { name: "Change on the Sandbox backend page" }).click();
-  await expect(page.getByRole("heading", { name: "Sandbox backend", exact: true })).toBeVisible();
+  await page.getByRole("button", { name: "Manage sandbox configuration" }).click();
+  await expect(page.getByRole("heading", { name: "Sandbox configuration", exact: true })).toBeVisible();
   await page.getByRole("button", { name: "Sandbox metrics", exact: true }).click();
   await expect(page.getByText(/These sources have different coverage and refresh separately/)).toBeVisible();
 });
diff --git a/apps/web/src/ConsoleApp.tsx b/apps/web/src/ConsoleApp.tsx
index b68812b63..debc7e9f8 100644
--- a/apps/web/src/ConsoleApp.tsx
+++ b/apps/web/src/ConsoleApp.tsx
@@ -12,13 +12,14 @@ import { SandboxMetricsPage } from "./features/metrics/SandboxMetricsPage";
 import { ConsoleTourContext, ConsoleTourScreen } from "./features/onboarding/ConsoleTour";
 import { withTransition } from "./features/onboarding/view-transition";
 import { OverviewPage } from "./features/overview/OverviewPage";
+import { SandboxDeploymentPage } from "./features/sandbox/SandboxDeploymentPage";
 import { SandboxManagerView } from "./features/sandbox/SandboxManagerView";
 import { SessionLogPage } from "./features/sessions/SessionLogPage";
 import { SessionPage } from "./features/sessions/SessionPage";
 import { SkillsPage } from "./features/skills/SkillsPage";
 import { SystemPage } from "./features/system/SystemPage";
 import { VaultsPage } from "./features/vaults/VaultsPage";
-import { consoleDepth, ConsoleNavigationContext, hashWithParams, routeParamsFromHash, type ConsoleIntent, type RouteParams } from "./lib/console-navigation";
+import { consoleDepth, ConsoleNavigationContext, useConsoleNavigation, hashWithParams, routeParamsFromHash, type ConsoleIntent, type RouteParams } from "./lib/console-navigation";
 import { consoleHashForView, consoleNavParent, consoleViewFromHash, type ConsoleView } from "./lib/console-routes";
 import { ProjectsProvider, useProjects } from "./lib/projects";
 import { collectionQuery, collections, filesCollection, queryClient, type CollectionSpec } from "./lib/queries";
@@ -40,6 +41,7 @@ function readLocation(): { view: ConsoleView; params: RouteParams; intent: Conso
 }
 
 function ConsolePage({ view }: { view: ConsoleView }) {
+  const { params } = useConsoleNavigation();
   switch (view) {
     case "overview": return <OverviewPage />;
     case "core-metrics": return <CoreMetricsPage />;
@@ -54,7 +56,7 @@ function ConsolePage({ view }: { view: ConsoleView }) {
     case "vaults": return <VaultsPage />;
     case "projects": return <ProjectsPage />;
     case "nodes": return <SandboxManagerView />;
-    case "system": return <SystemPage />;
+    case "system": return params.id === "sandbox" ? <SandboxDeploymentPage /> : <SystemPage />;
   }
 }
 
diff --git a/apps/web/src/components/ConsoleSidebar.tsx b/apps/web/src/components/ConsoleSidebar.tsx
index 9f4925704..98cd9b6bd 100644
--- a/apps/web/src/components/ConsoleSidebar.tsx
+++ b/apps/web/src/components/ConsoleSidebar.tsx
@@ -1,7 +1,6 @@
 import {
   Activity,
   Bot,
-  Cloud,
   Cpu,
   FileText,
   FolderKanban,
@@ -20,7 +19,6 @@ import * as m from "motion/react-m";
 import { useTranslation } from "react-i18next";
 
 import { consoleNavGroups, type ConsoleView } from "../lib/console-routes";
-import { useSandboxProvider } from "../features/sandbox/sandbox-queries";
 import { AppearanceMenu } from "./AppearanceMenu";
 import { ConsoleAccountMenu } from "../features/first-run/ConsoleAccess";
 
@@ -55,7 +53,6 @@ export function ConsoleSidebar({
   onGettingStarted: () => void;
 }) {
   const { t } = useTranslation("navigation");
-  const provider = useSandboxProvider();
   return (
     <aside className="app-sidebar">
       <div className="brand-lockup">
@@ -74,10 +71,8 @@ export function ConsoleSidebar({
               {t(`groups.${group.id}`)}
             </p>
             {group.views.map((view) => {
-              // An E2B deployment has no machines: its Nodes entry is the sandbox backend.
-              const cloud = view === "nodes" && provider === "e2b";
-              const Icon = cloud ? Cloud : viewIcons[view];
-              const label = cloud ? t("views.sandboxBackend") : t(`views.${view}`);
+              const Icon = viewIcons[view];
+              const label = t(`views.${view}`);
               return (
                 <button
                   type="button"
diff --git a/apps/web/src/features/api-keys/KeyFlowDialogs.test.tsx b/apps/web/src/features/api-keys/KeyFlowDialogs.test.tsx
index c9dcf003e..e68dd3e1c 100644
--- a/apps/web/src/features/api-keys/KeyFlowDialogs.test.tsx
+++ b/apps/web/src/features/api-keys/KeyFlowDialogs.test.tsx
@@ -3,7 +3,8 @@ import type { ReactElement } from "react";
 import { renderToStaticMarkup } from "react-dom/server";
 import { describe, expect, it } from "vitest";
 
-import type { KeyFlow } from "./key-flows";
+import { AgentCoreError } from "@agents-core-web/agents-client";
+import { flowError, keyFlowReducer, type KeyFlow } from "./key-flows";
 import { KeyFlowDialogs, PendingKeyNotice } from "./KeyFlowDialogs";
 import type { KeyFlowControls } from "./use-key-flow";
 import { type AdminIssuedKey, type Project } from "../../lib/admin-view";
@@ -41,3 +42,15 @@ describe("one-time key display", () => {
     expect(html).toMatch(/<button class="button primary" type="submit" form="key-issue-form" disabled="">/);
   });
 });
+
+
+describe("typed name rejection", () => {
+  it("binds the server error to the name input and leaves a rejected form usable", () => {
+    const flow: KeyFlow = { step: "issue", project, name: "valid", busy: false, error: flowError(new AgentCoreError("raw", 400, "invalid_name", "name", undefined, { max_length: 80 })) };
+    const html = renderToStaticMarkup(<KeyFlowDialogs controls={controls(flow)} taken={[]} />);
+    expect(html).toContain('aria-invalid="true"');
+    expect(html).toContain("80 characters");
+    expect(html).not.toMatch(/form="key-issue-form" disabled/);
+    expect(keyFlowReducer(flow, { type: "setName", name: "corrected" })).toMatchObject({ error: null, busy: false });
+  });
+});
diff --git a/apps/web/src/features/api-keys/KeyFlowDialogs.tsx b/apps/web/src/features/api-keys/KeyFlowDialogs.tsx
index 102e08de3..2077767dc 100644
--- a/apps/web/src/features/api-keys/KeyFlowDialogs.tsx
+++ b/apps/web/src/features/api-keys/KeyFlowDialogs.tsx
@@ -1,6 +1,7 @@
 import { useId } from "react";
 import { useTranslation } from "react-i18next";
 
+import { coreError, coreFieldError } from "../../lib/core-error";
 import { HelpTip } from "../../components/console-ui";
 import { Modal } from "../../components/Modal";
 import { isUsableName, keyNameProblem, normalizeName, type FlowError, type KeyFlow, type NameProblem } from "./key-flows";
@@ -10,13 +11,14 @@ import type { KeyFlowControls } from "./use-key-flow";
 
 export function FlowErrorMessage({ error, name }: { error: FlowError | null; name?: string }) {
   const { t } = useTranslation("keys");
-  if (!error) return null;
-  const text = error.kind === "uncertain" ? t("errors.uncertain") : t("errors.rejected", { message: error.message });
+  const { t: tCommon } = useTranslation("common");
+  if (!error || (name !== undefined && error.kind === "rejected" && coreFieldError(error.cause, "name", tCommon))) return null;
+  const text = error.kind === "uncertain" ? t("errors.uncertain") : t("errors.rejected", { message: error.cause ? coreError(error.cause, tCommon) : error.message });
   return <p className="key-flow-error" role="alert">{text}</p>;
 }
 
 /** A labelled name input with its rules behind a help tip and its problem underneath. */
-export function NameField({ label, help, value, onChange, problem, problemText, placeholder, disabled = false, autoFocus = false, name }: {
+export function NameField({ label, help, value, onChange, problem, problemText, placeholder, disabled = false, autoFocus = false, name, serverError }: {
   label: string;
   help: string;
   value: string;
@@ -27,8 +29,12 @@ export function NameField({ label, help, value, onChange, problem, problemText,
   disabled?: boolean;
   autoFocus?: boolean;
   name: string;
+  serverError?: FlowError | null;
 }) {
   const id = useId();
+  const { t: tCommon } = useTranslation("common");
+  const remoteProblem = serverError?.kind === "rejected" ? coreFieldError(serverError.cause, "name", tCommon) : null;
+  const visibleProblem = problem ? problemText : remoteProblem;
   return (
     // The label names the input explicitly: it also holds the help tip's button,
     // which would otherwise become the control it labels.
@@ -44,10 +50,10 @@ export function NameField({ label, help, value, onChange, problem, problemText,
         spellCheck={false}
         autoFocus={autoFocus}
         disabled={disabled}
-        aria-invalid={problem ? true : undefined}
-        aria-describedby={`${id}-help${problem ? ` ${id}-problem` : ""}`}
+        aria-invalid={visibleProblem ? true : undefined}
+        aria-describedby={`${id}-help${visibleProblem ? ` ${id}-problem` : ""}`}
       />
-      {problem ? <span id={`${id}-problem`} className="field-error" role="alert">{problemText}</span> : null}
+      {visibleProblem ? <span id={`${id}-problem`} className="field-error" role="alert">{visibleProblem}</span> : null}
     </label>
   );
 }
@@ -64,6 +70,7 @@ export function KeyNameField({ flow, controls, taken, autoFocus = false }: {
   return (
     <NameField
       name="key-name"
+      serverError={flow.error}
       label={t("issueDialog.name")}
       help={t("issueDialog.nameHelp")}
       value={flow.name}
diff --git a/apps/web/src/features/api-keys/ProjectsPage.tsx b/apps/web/src/features/api-keys/ProjectsPage.tsx
index c855e992b..01cf722cc 100644
--- a/apps/web/src/features/api-keys/ProjectsPage.tsx
+++ b/apps/web/src/features/api-keys/ProjectsPage.tsx
@@ -326,10 +326,11 @@ export function ProjectsPage() {
             {dialog.kind === "create" || dialog.kind === "rename" ? (
               <NameField
                 name="project-name"
+                serverError={dialogError}
                 label={t("createDialog.name")}
                 help={t("createDialog.nameHelp")}
                 value={dialog.name}
-                onChange={(name) => setDialog({ ...dialog, name })}
+                onChange={(name) => { setDialog({ ...dialog, name }); setDialogError(null); }}
                 problem={dialogNameProblem}
                 problemText={dialogNameProblem ? t(`createDialog.problems.${dialogNameProblem}`) : ""}
                 placeholder={t("createDialog.placeholder")}
diff --git a/apps/web/src/features/api-keys/key-flows.ts b/apps/web/src/features/api-keys/key-flows.ts
index 029548e56..8205c06f6 100644
--- a/apps/web/src/features/api-keys/key-flows.ts
+++ b/apps/web/src/features/api-keys/key-flows.ts
@@ -67,12 +67,12 @@ export function isArchiveConfirmed(name: string, activeKeys: number, typed: stri
  * ("uncertain": check the list first; never retried automatically).
  */
 export type FlowError =
-  | { kind: "rejected"; status: number; message: string }
+  | { kind: "rejected"; status: number; message: string; cause?: AgentCoreError }
   | { kind: "uncertain" };
 
 export function flowError(error: unknown): FlowError {
   if (error instanceof AgentCoreError) {
-    if (error.status >= 400 && error.status < 500 && error.status !== 408) return { kind: "rejected", status: error.status, message: error.message };
+    if (error.status >= 400 && error.status < 500 && error.status !== 408) return { kind: "rejected", status: error.status, message: error.message, ...(error.code || error.param ? { cause: error } : {}) };
     return { kind: "uncertain" };
   }
   // The client validates names before sending; nothing reached Core.
diff --git a/apps/web/src/features/fleet/FleetReadNotice.tsx b/apps/web/src/features/fleet/FleetReadNotice.tsx
new file mode 100644
index 000000000..9b2bd7565
--- /dev/null
+++ b/apps/web/src/features/fleet/FleetReadNotice.tsx
@@ -0,0 +1,20 @@
+import { useTranslation } from "react-i18next";
+
+import { ReadFailure } from "../../components/ReadFailure";
+import type { FleetState } from "./use-sandbox-fleet";
+
+/** Retained observations stay tied to their original generation and read outcome. */
+export function FleetReadNotice({ state, onRetry }: { state: FleetState; onRetry: () => void }) {
+  const { t } = useTranslation("overview");
+  if (state.status !== "ready") return null;
+  return <>
+    {state.error !== null ? <ReadFailure partial onRetry={onRetry} /> : null}
+    {state.targetGeneration !== state.snapshot.deployment.generation
+      ? <p className="detail-note" role="status">{t("fleet.previousGeneration", { observed: state.snapshot.deployment.generation, target: state.targetGeneration })}</p>
+      : null}
+  </>;
+}
+
+export function fleetObservationStale(state: FleetState): boolean {
+  return state.status === "ready" && (state.error !== null || state.targetGeneration !== state.snapshot.deployment.generation);
+}
diff --git a/apps/web/src/features/fleet/SandboxResetNotice.tsx b/apps/web/src/features/fleet/SandboxResetNotice.tsx
index 75e760da7..28a514771 100644
--- a/apps/web/src/features/fleet/SandboxResetNotice.tsx
+++ b/apps/web/src/features/fleet/SandboxResetNotice.tsx
@@ -15,7 +15,7 @@ export function SandboxResetNotice({ deployment, failed, onRetry }: {
   const { navigate } = useConsoleNavigation();
   return <>
     {failed ? <ReadFailure partial={deployment !== undefined} onRetry={onRetry} /> : null}
-    {deployment?.reset ? <Section headingId="sandbox-reset-notice-heading" title={t("reset.title")} actions={<button className="button outline" type="button" onClick={() => navigate("nodes")}>{t("reset.view")}</button>}>
+    {deployment?.reset ? <Section headingId="sandbox-reset-notice-heading" title={t("reset.title")} actions={<button className="button outline" type="button" onClick={() => navigate("system", { id: "sandbox" })}>{t("reset.view")}</button>}>
       <div role="status"><StatusDot tone="warning" label={t(`reset.${deployment.reset.clear}`)} /></div>
       <p>{t("reset.body")}</p>
     </Section> : null}
diff --git a/apps/web/src/features/fleet/fleet-model.ts b/apps/web/src/features/fleet/fleet-model.ts
index c7007ff35..c62946126 100644
--- a/apps/web/src/features/fleet/fleet-model.ts
+++ b/apps/web/src/features/fleet/fleet-model.ts
@@ -13,6 +13,11 @@ export function nodeHealth(node: SandboxNode): NodeHealth {
   return node.provider_ready && !node.diagnostic ? "available" : "degraded";
 }
 
+/** Live provider evidence is independent of target preparation and durable serving pins. */
+export function nodeServingReady(node: SandboxNode): boolean {
+  return node.online && node.provider_ready;
+}
+
 export interface CapacitySummary {
   nodes: number;
   online: number;
diff --git a/apps/web/src/features/fleet/use-sandbox-fleet.test.tsx b/apps/web/src/features/fleet/use-sandbox-fleet.test.tsx
index 38a4eba9d..d81903d95 100644
--- a/apps/web/src/features/fleet/use-sandbox-fleet.test.tsx
+++ b/apps/web/src/features/fleet/use-sandbox-fleet.test.tsx
@@ -8,6 +8,7 @@ import { node } from "../overview/test-fixtures";
 import type { SandboxConsoleConfig } from "../sandbox/console-config";
 import { sandboxDeploymentQuery } from "../sandbox/sandbox-queries";
 import { consoleConfigQuery, fleetQuery, type FleetSnapshot } from "./fleet-queries";
+import { FleetReadNotice } from "./FleetReadNotice";
 import { fleetSnapshot, useSandboxFleet } from "./use-sandbox-fleet";
 
 const configured: SandboxDeployment = { rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, update_required: 0, unknown: 0 } }, installation_id: "i", provider: "docker", core_url: "http://core", reset: null, owner_epoch: 1, generation: 1, mode: "nodes", resources: { allocations: 1, pending: 0 }, suspension: null };
@@ -16,16 +17,17 @@ function Probe() {
   const { state, deployment } = useSandboxFleet();
   const snapshot = fleetSnapshot(state);
   const sandboxes = gettingStartedSteps({ fleet: state, sandboxReset: deployment.data ? deployment.data.reset !== null : undefined, localOnly: false, projects: [], sessions: 0, harnesses: [] }).sandboxes;
-  return <div data-fleet={state.status} data-sandbox={sandboxes.state ?? "checking"}>{snapshot ? `${snapshot.nodes.length} nodes / ${snapshot.deployment.resources.allocations} allocations` : "No current fleet evidence"}</div>;
+  return <div data-fleet={state.status} data-sandbox={sandboxes.state ?? "checking"}>{snapshot ? `${snapshot.nodes.length} nodes / ${snapshot.deployment.resources.allocations} allocations` : "No current fleet evidence"}<FleetReadNotice state={state} onRetry={() => {}} /></div>;
 }
 
-function render(latest: SandboxDeployment, previous = configured) {
+function render(latest: SandboxDeployment, previous = configured, failed = false) {
   const cache = new QueryClient({ defaultOptions: { queries: { retry: false } } });
   const snapshot: FleetSnapshot = { deployment: previous, nodes: [node("n1")], allocations: [], loadedAt: 1 };
   const config: SandboxConsoleConfig = { sandbox_admin: true, node_installer: false, node_installer_sha256: "", self_hosted_installer: false, self_hosted_installer_sha256: "" };
   cache.setQueryData<SandboxConsoleConfig | null>(consoleConfigQuery.queryKey, () => config);
   cache.setQueryData(fleetQuery(false).queryKey, snapshot);
   cache.setQueryData(sandboxDeploymentQuery.queryKey, latest);
+  if (failed) cache.getQueryCache().find({ queryKey: fleetQuery(false).queryKey })?.setState({ status: "error", error: new Error("inventory read failed") });
   const html = renderToStaticMarkup(<QueryClientProvider client={cache}><Probe /></QueryClientProvider>);
   cache.clear();
   return html;
@@ -43,11 +45,35 @@ describe("fleet evidence after deployment changes", () => {
   });
 
   it("also rejects prior installation, owner and provider evidence", () => {
-    for (const change of [{ installation_id: "next" }, { owner_epoch: 2 }, { provider: "e2b" as const }, { generation: 2 }]) {
+    for (const change of [{ installation_id: "next" }, { owner_epoch: 2 }, { provider: "e2b" as const }]) {
       const html = render({ ...configured, ...change });
       expect(html).toContain('data-fleet="loading"');
       expect(html).not.toContain('data-sandbox="done"');
     }
     expect(render(configured)).toContain('data-sandbox="done"');
   });
+
+  it("retains older resource evidence across an online generation change with an explicit qualification", () => {
+    const html = render({ ...configured, generation: 2, rollout: { state: "preparing", previous_generation_sandboxes: 1, nodes: { ready: 0, preparing: 1, failed: 0, update_required: 0, unknown: 0 } } });
+    expect(html).toContain('data-fleet="ready"');
+    expect(html).toContain("1 nodes / 1 allocations");
+    expect(html).toContain("configuration generation 1; the current target is 2");
+    expect(html).toContain('data-sandbox="done"');
+  });
+
+  it("discards inventory across reset start even when provider and generation match", () => {
+    const html = render({ ...configured, reset: { clear: "auto", requested_at: "2026-09-27T10:00:00Z", deadline_at: "2026-09-27T11:00:00Z", forced_at: null, remaining: { busy: 1, idle: 0, cleanup: 0, on_offline_nodes: 0, offline_nodes: [] } } });
+    expect(html).toContain('data-fleet="loading"');
+    expect(html).not.toContain("1 allocations");
+    expect(html).toContain('data-sandbox="todo"');
+  });
+
+  it("keeps both generation and read-failure qualifications when an online refresh fails", () => {
+    const html = render({ ...configured, generation: 2 }, configured, true);
+    expect(html).toContain("1 nodes / 1 allocations");
+    expect(html).toContain("configuration generation 1; the current target is 2");
+    expect(html).toContain("Retry");
+    expect(html).toContain('data-sandbox="unknown"');
+  });
+
 });
diff --git a/apps/web/src/features/fleet/use-sandbox-fleet.ts b/apps/web/src/features/fleet/use-sandbox-fleet.ts
index f28706d95..2f1c59cb9 100644
--- a/apps/web/src/features/fleet/use-sandbox-fleet.ts
+++ b/apps/web/src/features/fleet/use-sandbox-fleet.ts
@@ -12,7 +12,7 @@ export type FleetState =
   /** The console has no sandbox administration credential. */
   | { status: "unconfigured" }
   | { status: "loading" }
-  | { status: "ready"; snapshot: FleetSnapshot; refreshing: boolean; error: unknown | null }
+  | { status: "ready"; snapshot: FleetSnapshot; targetGeneration: number; refreshing: boolean; error: unknown | null }
   | { status: "failed"; error: unknown };
 
 export const FLEET_REFRESH_MS = 30_000;
@@ -36,20 +36,22 @@ export function useSandboxFleet({ poll = true, allocations = false }: { poll?: b
     refetchIntervalInBackground: false,
   });
 
-  const differentDeployment = fleet.data !== undefined && deployment.data !== undefined && !fleetMatchesDeployment(fleet.data, deployment.data);
+  const differentDeployment = fleet.data !== undefined && deployment.data !== undefined && !fleetMatchesLifecycle(fleet.data, deployment.data);
+  const changedGeneration = fleet.data !== undefined && deployment.data !== undefined && fleet.data.deployment.generation !== deployment.data.generation;
   const { refetch: refetchFleet } = fleet;
   // A reset/configuration change can arrive through the faster deployment poll.
-  // Never attach the earlier generation's nodes or counts to that new truth.
+  // Compatible prior-generation inventory remains visible as an older observation.
+  // A reset or backend lifecycle change makes that earlier inventory invalid.
   useEffect(() => {
-    if (adminAvailable === true && differentDeployment) void refetchFleet();
-  }, [adminAvailable, differentDeployment, deployment.data?.installation_id, deployment.data?.owner_epoch, deployment.data?.generation, deployment.data?.provider, refetchFleet]);
+    if (adminAvailable === true && (differentDeployment || changedGeneration)) void refetchFleet();
+  }, [adminAvailable, differentDeployment, changedGeneration, deployment.data?.installation_id, deployment.data?.owner_epoch, deployment.data?.generation, deployment.data?.provider, deployment.data?.mode, deployment.data?.reset?.requested_at, refetchFleet]);
 
   let state: FleetState;
   if (configFailed) state = config.isFetching ? { status: "checking" } : { status: "failed", error: config.error };
   else if (adminAvailable === null) state = { status: "checking" };
   else if (!adminAvailable) state = { status: "unconfigured" };
   else if (differentDeployment) state = fleet.isError && !fleet.isFetching ? { status: "failed", error: fleet.error } : { status: "loading" };
-  else if (fleet.data) state = { status: "ready", snapshot: fleet.data, refreshing: fleet.isFetching, error: fleet.isError ? fleet.error : null };
+  else if (fleet.data) state = { status: "ready", snapshot: fleet.data, targetGeneration: deployment.data?.generation ?? fleet.data.deployment.generation, refreshing: fleet.isFetching, error: fleet.isError ? fleet.error : null };
   else if (fleet.isError && !fleet.isFetching) state = { status: "failed", error: fleet.error };
   else state = { status: "loading" };
 
@@ -65,9 +67,10 @@ export function fleetSnapshot(state: FleetState): FleetSnapshot | null {
   return state.status === "ready" ? state.snapshot : null;
 }
 
-/** Nodes and resource counts only describe the deployment generation they were read with. */
-function fleetMatchesDeployment(snapshot: FleetSnapshot, deployment: SandboxDeployment): boolean {
+/** Online configuration updates preserve ownership; reset/backend lifecycle changes do not. */
+function fleetMatchesLifecycle(snapshot: FleetSnapshot, deployment: SandboxDeployment): boolean {
   const previous = snapshot.deployment;
   return previous.installation_id === deployment.installation_id && previous.owner_epoch === deployment.owner_epoch &&
-    previous.generation === deployment.generation && previous.provider === deployment.provider;
+    previous.provider === deployment.provider && previous.mode === deployment.mode &&
+    previous.reset?.requested_at === deployment.reset?.requested_at;
 }
diff --git a/apps/web/src/features/metrics/CoreMetricsPage.tsx b/apps/web/src/features/metrics/CoreMetricsPage.tsx
index 2ec728614..08ede6ea6 100644
--- a/apps/web/src/features/metrics/CoreMetricsPage.tsx
+++ b/apps/web/src/features/metrics/CoreMetricsPage.tsx
@@ -10,6 +10,7 @@ import { DashboardSkeleton, TableSkeleton } from "../../components/Skeleton";
 import { useFailureToast } from "../../components/Toast";
 import { EmptyState, Kpi, KpiStrip, PageBody, PageHeader, RefreshButton, Section, SegmentedControl, StatusDot, type Tone } from "../../components/console-ui";
 import { formatBucket, formatBytes, formatClock, formatDuration, formatInteger, formatRelative, MISSING } from "../../lib/format";
+import { FleetReadNotice } from "../fleet/FleetReadNotice";
 import { fleetSnapshot, useSandboxFleet } from "../fleet/use-sandbox-fleet";
 import { coreMetricsQuery } from "./metrics-queries";
 import "./MetricsView.css";
@@ -123,7 +124,8 @@ function CoreMetricsBody({ metrics }: { metrics: CoreMetrics }) {
   const integer = (value: number) => formatInteger(value, locale);
   const slotsFull = execution.slots_in_use !== null && execution.slots_total !== null && execution.slots_in_use >= execution.slots_total;
   // Sandbox nodes hold their own connection to Core, as daemons do; E2B deployments have none.
-  const fleet = fleetSnapshot(useSandboxFleet({ poll: true }).state);
+  const { state: fleetState, refresh: refreshFleet } = useSandboxFleet({ poll: true });
+  const fleet = fleetSnapshot(fleetState);
   const nodeBacked = fleet ? fleet.deployment.mode === "nodes" : false;
   const online = fleet ? fleet.nodes.filter((node) => node.online).length : null;
 
@@ -166,6 +168,7 @@ function CoreMetricsBody({ metrics }: { metrics: CoreMetrics }) {
           tone={nearLimit(process.rss_bytes, process.memory_limit_bytes, 0.85) ? "warning" : undefined}
         />
       </KpiStrip>
+      <FleetReadNotice state={fleetState} onRetry={refreshFleet} />
 
       <Section
         headingId="core-execution-heading"
diff --git a/apps/web/src/features/metrics/MetricsView.css b/apps/web/src/features/metrics/MetricsView.css
index 77cf52bb4..81e0d9fc1 100644
--- a/apps/web/src/features/metrics/MetricsView.css
+++ b/apps/web/src/features/metrics/MetricsView.css
@@ -81,3 +81,5 @@
   outline: 2px solid var(--accent);
   outline-offset: 2px;
 }
+
+.metrics-node-status { display: grid; gap: 4px; }
diff --git a/apps/web/src/features/metrics/SandboxMetricsPage.tsx b/apps/web/src/features/metrics/SandboxMetricsPage.tsx
index 4d48ac2f8..8af46433b 100644
--- a/apps/web/src/features/metrics/SandboxMetricsPage.tsx
+++ b/apps/web/src/features/metrics/SandboxMetricsPage.tsx
@@ -32,6 +32,8 @@ import { RUNTIME_SNAPSHOT_REFRESH_MS } from "../dashboard/runtime-snapshot";
 import { DiagnosticTip } from "../fleet/DiagnosticTip";
 import { capacitySummary, nodeHealth, suspendedSandboxes, type NodeHealth } from "../fleet/fleet-model";
 import { nodeDetailQuery } from "../fleet/fleet-queries";
+import { NodeRolloutStatus } from "../sandbox/NodeRolloutStatus";
+import { FleetReadNotice, fleetObservationStale } from "../fleet/FleetReadNotice";
 import { SandboxResetNotice } from "../fleet/SandboxResetNotice";
 import { fleetSnapshot, useSandboxFleet, type FleetState } from "../fleet/use-sandbox-fleet";
 import { sandboxSize, templateBuildStatus } from "../sandbox/deployment-specification";
@@ -130,6 +132,7 @@ export function SandboxMetricsPage() {
       />
       <PageBody>
         <SandboxResetNotice deployment={deployment.data} failed={deployment.isError} onRetry={() => void deployment.refetch()} />
+        <FleetReadNotice state={fleetState} onRetry={refreshFleet} />
         {cloud && fleet ? <CloudSection deployment={fleet.deployment} /> : <Section
           headingId="node-capacity-heading"
           title={t("sandbox.node")}
@@ -156,7 +159,7 @@ export function SandboxMetricsPage() {
                   {fleet.nodes.map((node) => (
                     <tr key={node.id} className="clickable-row" onClick={() => setOpenNode(node.id)}>
                       <th scope="row"><NameCell name={node.name} id={node.id} onOpen={() => setOpenNode(node.id)} openLabel={t("sandbox.nodeDialog.openLabel", { name: node.name || node.id })} /></th>
-                      <td><NodeHealthStatus node={node} /></td>
+                      <td><div className="metrics-node-status"><NodeHealthStatus node={node} /><NodeRolloutStatus node={node} stale={fleetObservationStale(fleetState)} /></div></td>
                       <td>
                         <span className="table-meter">
                           <Meter value={node.active} limit={node.max_active} label={t("sandbox.slotsOf", { name: node.name })} />
@@ -187,7 +190,7 @@ export function SandboxMetricsPage() {
               <EmptyState
                 icon={Server}
                 title={t("sandbox.notSetUpTitle")}
-                action={<button className="button primary" type="button" onClick={() => navigate("nodes")}>{t("sandbox.setUp")}</button>}
+                action={<button className="button primary" type="button" onClick={() => navigate("system", { id: "sandbox" })}>{t("sandbox.setUp")}</button>}
               />
             )
           ) : fleetState.status === "checking" || fleetState.status === "loading"
@@ -200,6 +203,7 @@ export function SandboxMetricsPage() {
       <NodeDialog
         node={fleet?.nodes.find((node) => node.id === openNode) ?? null}
         rows={rows}
+        stale={fleetObservationStale(fleetState)}
         load={runtimeState.load}
         range={range}
         onClose={() => setOpenNode(null)}
@@ -239,7 +243,7 @@ function CloudSection({ deployment }: { deployment: SandboxDeployment }) {
       headingId="cloud-heading"
       title={t("sandbox.cloud.title")}
       help={t("sandbox.cloud.help")}
-      actions={<button className="button outline" type="button" onClick={() => navigate("nodes")}>{t("sandbox.cloud.manage")}</button>}
+      actions={<button className="button outline" type="button" onClick={() => navigate("system", { id: "sandbox" })}>{t("sandbox.cloud.manage")}</button>}
     >
       <p className="detail-note">{t("sandbox.cloud.counts")}</p>
       <KpiStrip label={t("sandbox.cloud.title")}>
@@ -445,7 +449,8 @@ function useLast<T>(value: T | null): T | null {
  * A node in a dialog: the host figures it reports with each heartbeat, and
  * CPU and memory of the hosted sandboxes placed on it over the page's range.
  */
-function NodeDialog({ node, rows, load, range, onClose }: {
+function NodeDialog({ node, rows, load, range, stale, onClose }: {
+  stale: boolean;
   node: SandboxNode | null;
   rows: readonly HostedRuntimeRow[];
   load: HostedRuntimeLoad | null;
@@ -493,8 +498,11 @@ function NodeDialog({ node, rows, load, range, onClose }: {
     >
       {shown ? (
         <div className="metrics-dialog">
+          {stale ? <p className="detail-note" role="status">{t("sandbox.nodeObservationStale")}</p> : null}
           <dl className="resource-facts" aria-label={t("sandbox.nodeDialog.facts")}>
             <div><dt>{t("sandbox.status")}</dt><dd><NodeHealthStatus node={shown} /></dd></div>
+            <div><dt>{t("sandbox.targetPreparation")}</dt><dd><NodeRolloutStatus node={shown} stale={stale} /></dd></div>
+            <div><dt>{t("sandbox.servingGeneration")}</dt><dd><span className="status-with-help">{shown.rollout.ready_generation ?? MISSING}<HelpTip>{t("sandbox.servingGenerationHelp")}</HelpTip></span></dd></div>
             <div><dt>{t("sandbox.slots")}</dt><dd>{formatInteger(shown.active, locale)} / {formatInteger(shown.max_active, locale)}</dd></div>
             {shown.provider === "microsandbox" ? <div><dt>{t("sandbox.suspended")}</dt><dd>{formatInteger(suspendedSandboxes(shown), locale)}</dd></div> : null}
             {shown.provider === "microsandbox" ? <div><dt>{t("sandbox.nodeDialog.retainedSlots")}</dt><dd>{formatInteger(shown.retained, locale)} / {formatInteger(shown.max_retained, locale)}</dd></div> : null}
@@ -548,6 +556,7 @@ function RuntimeDialog({ row, showNode, onClose }: { row: HostedRuntimeRow | nul
             <div><dt>{tCommon("project.column")}</dt><dd><ProjectName project={byId.get(observation.project_id)} /></dd></div>
             {showNode ? <div><dt>{t("sandbox.node")}</dt><dd>{shown.node ? shown.node.name || shown.node.id : MISSING}</dd></div> : null}
             <div><dt>{t("sandbox.status")}</dt><dd><StatusDot tone={lifecycleTone(shown)} label={lifecycleLabel(shown, t)} /></dd></div>
+            <div><dt>{t("sandbox.configurationGeneration")}</dt><dd>{shown.deploymentGeneration ?? MISSING}</dd></div>
             <div><dt>{t("sandbox.uptime")}</dt><dd>{formatDuration(shown.uptimeSeconds)}</dd></div>
             {/* Only E2B reports a sandbox's disk. */}
             {observation.disk ? <div><dt>{t("sandbox.disk")}</dt><dd>{formatBytes(observation.disk.usage_bytes)} / {formatBytes(observation.disk.limit_bytes)}</dd></div> : null}
diff --git a/apps/web/src/features/metrics/sandbox-runtime.test.ts b/apps/web/src/features/metrics/sandbox-runtime.test.ts
index abf38709f..de4690a72 100644
--- a/apps/web/src/features/metrics/sandbox-runtime.test.ts
+++ b/apps/web/src/features/metrics/sandbox-runtime.test.ts
@@ -65,10 +65,12 @@ describe("hosted Runtime projections", () => {
   });
 
   it("places each Runtime on its host and derives uptime only from a current sample", () => {
-    const allocation = { id: "alloc_a", node_id: "n1", deployment_generation: 1 } as SandboxAllocation;
+    const allocation = { id: "alloc_a", node_id: "n1", deployment_generation: 3 } as SandboxAllocation;
     const rows = hostedRuntimeRows(load, "", { nodes: [node("n1", { name: "core-01" })], allocations: [allocation] });
     expect(rows.map((row) => [row.observation.session_id, row.node?.name ?? null, row.uptimeSeconds])).toEqual([["a", "core-01", 600], ["b", null, 600], ["c", null, null]]);
     expect(hostedRuntimeRows(load, "", null)[0]?.node).toBeNull();
+    expect(rows.map((row) => row.deploymentGeneration)).toEqual([3, null, null]);
+    expect(hostedRuntimeRows(load, "", null)[0]?.deploymentGeneration).toBeNull();
     expect(matchesRuntime(rows[0]!, "nightly")).toBe(true);
     expect(matchesRuntime(rows[0]!, "core-01")).toBe(true);
     expect(matchesRuntime(rows[2]!, "nightly")).toBe(false);
diff --git a/apps/web/src/features/metrics/sandbox-runtime.ts b/apps/web/src/features/metrics/sandbox-runtime.ts
index c68cb4b16..372d47cef 100644
--- a/apps/web/src/features/metrics/sandbox-runtime.ts
+++ b/apps/web/src/features/metrics/sandbox-runtime.ts
@@ -130,6 +130,8 @@ export interface HostedRuntimeRow {
   session: AgentSession | null;
   /** The host of the Runtime's allocation, when the fleet lists it. */
   node: SandboxNode | null;
+  /** Ownership generation from a matching allocation, never the deployment target or node pin. */
+  deploymentGeneration: number | null;
   /** Seconds from the Runtime's start to its last sample. */
   uptimeSeconds: number | null;
 }
@@ -140,6 +142,7 @@ export function hostedRuntimeRows(
   fleet: { nodes: readonly SandboxNode[]; allocations: readonly SandboxAllocation[] } | null,
 ): HostedRuntimeRow[] {
   const nodes = new Map((fleet?.nodes ?? []).map((node) => [node.id, node]));
+  const generations = new Map((fleet?.allocations ?? []).map((allocation) => [allocation.id, allocation.deployment_generation]));
   const nodeOfAllocation = new Map((fleet?.allocations ?? []).map((allocation) => [allocation.id, nodes.get(allocation.node_id) ?? null]));
   return load.observations
     .filter((observation) => !projectId || observation.project_id === projectId)
@@ -147,6 +150,7 @@ export function hostedRuntimeRows(
       observation,
       session: load.sessions.get(observation.session_id) ?? null,
       node: observation.instance.allocation_id ? nodeOfAllocation.get(observation.instance.allocation_id) ?? null : null,
+      deploymentGeneration: observation.instance.allocation_id ? generations.get(observation.instance.allocation_id) ?? null : null,
       uptimeSeconds: observation.status === "observed" && observation.started_at !== null && observation.observed_at !== null && observation.observed_at >= observation.started_at
         ? observation.observed_at - observation.started_at
         : null,
diff --git a/apps/web/src/features/overview/FleetTopology.tsx b/apps/web/src/features/overview/FleetTopology.tsx
index 4f6545b6e..c1398c148 100644
--- a/apps/web/src/features/overview/FleetTopology.tsx
+++ b/apps/web/src/features/overview/FleetTopology.tsx
@@ -5,12 +5,13 @@ import type { ReactNode } from "react";
 import { useTranslation } from "react-i18next";
 
 import { ConsolePopover } from "../../components/console-popover";
-import { StatusDot, type Tone } from "../../components/console-ui";
+import { HelpTip, StatusDot, type Tone } from "../../components/console-ui";
 import { formatBytes, formatDateTime, formatDuration, formatInteger, formatRelative, MISSING } from "../../lib/format";
 import { nodeProviderDiagnostic } from "../../lib/sandbox-diagnostic";
 import { DiagnosticTip } from "../fleet/DiagnosticTip";
 import { nodeHealth, suspendedSandboxes, type NodeHealth } from "../fleet/fleet-model";
 import { coreMetricsQuery } from "../metrics/metrics-queries";
+import { NodeRolloutStatus } from "../sandbox/NodeRolloutStatus";
 import { seconds } from "../sandbox/NodeList";
 
 /** Row pitch of the node columns, in pixels. */
@@ -50,7 +51,7 @@ export function FleetTopology({ nodes, cloud, coreLabel, coreTone, stale, onOpen
   onOpenBackend?: () => void;
   coreLabel: string;
   coreTone: Tone;
-  /** The last refresh failed: keep the picture, stop implying live traffic. */
+  /** Older generation or failed refresh: retain observations without implying live traffic. */
   stale: boolean;
   onOpenNode: (node: SandboxNode) => void;
   onOpenSandboxMetrics: () => void;
@@ -161,7 +162,7 @@ export function FleetTopology({ nodes, cloud, coreLabel, coreTone, stale, onOpen
               <button className="text-action" type="button" onClick={() => onOpenNode(node)}>{t("fleet.openNode")}</button>
             </>}
           >
-            <NodeGlance node={node} health={health} />
+            <NodeGlance node={node} health={health} stale={stale} />
           </ConsolePopover>
         );
       })}
@@ -178,7 +179,7 @@ function Fact({ label, children }: { label: string; children: ReactNode }) {
 }
 
 /** A node at a glance: reachability (with the reason a degraded provider is not ready), sandbox slots and what the node has left. */
-function NodeGlance({ node, health }: { node: SandboxNode; health: NodeHealth }) {
+function NodeGlance({ node, health, stale }: { node: SandboxNode; health: NodeHealth; stale: boolean }) {
   const { t, i18n } = useTranslation("overview");
   const locale = i18n.resolvedLanguage;
   const now = Math.floor(Date.now() / 1000);
@@ -193,6 +194,8 @@ function NodeGlance({ node, health }: { node: SandboxNode; health: NodeHealth })
           {diagnostic ? <DiagnosticTip code={diagnostic} /> : null}
         </span>
       </Fact>
+      <Fact label={t("fleet.targetPreparation")}><NodeRolloutStatus node={node} stale={stale} /></Fact>
+      <Fact label={t("fleet.servingGeneration")}><span className="status-with-help">{node.rollout.ready_generation ?? MISSING}<HelpTip>{t("fleet.servingGenerationHelp")}</HelpTip></span></Fact>
       <Fact label={t("fleet.facts.lastSeen")}><span title={seen === null ? undefined : formatDateTime(seen, locale)}>{seen === null ? t("fleet.facts.never") : formatRelative(seen, now, locale)}</span></Fact>
       <Fact label={t("fleet.facts.active")}>{count(node.active)}<span className="kpi-unit">/ {count(node.max_active)}</span></Fact>
       {node.provider === "microsandbox" ? <Fact label={t("fleet.facts.suspended")}>{count(suspendedSandboxes(node))}</Fact> : null}
diff --git a/apps/web/src/features/overview/GettingStarted.tsx b/apps/web/src/features/overview/GettingStarted.tsx
index 5960e5954..9b4fc92eb 100644
--- a/apps/web/src/features/overview/GettingStarted.tsx
+++ b/apps/web/src/features/overview/GettingStarted.tsx
@@ -114,14 +114,14 @@ export function GettingStarted({ fleet, sessions, localOnly, sandboxReset, onRet
   const done = states.filter((state) => state === "done").length;
   const sandbox = steps.sandboxes;
   const sandboxAction = sandboxReset === true
-    ? { label: t("reset.view"), run: () => navigate("nodes") }
+    ? { label: t("reset.view"), run: () => navigate("system", { id: "sandbox" }) }
     : localOnly === "failed"
     ? { label: t("actions.retry", { ns: "common" }), run: onRetryInstallation }
     : sandbox.action === "setup"
-    ? { label: t("gettingStarted.sandboxes.setup"), run: () => navigate("nodes") }
+    ? { label: t("gettingStarted.sandboxes.setup"), run: () => navigate("system", { id: "sandbox" }) }
     : sandbox.action === "add-node"
       ? { label: t("gettingStarted.sandboxes.addNode"), run: () => navigate("nodes", {}, "add-node") }
-      : { label: t(sandbox.cloud ? "gettingStarted.sandboxes.backend" : "gettingStarted.sandboxes.nodes"), run: () => navigate("nodes") };
+      : { label: t(sandbox.cloud ? "gettingStarted.sandboxes.backend" : "gettingStarted.sandboxes.nodes"), run: () => sandbox.cloud ? navigate("system", { id: "sandbox" }) : navigate("nodes") };
   const keyProject = steps.key.project;
   const keyAction = keyProject
     ? { label: t("gettingStarted.key.issue"), run: () => navigate("projects", { id: keyProject.id }, "issue-key") }
diff --git a/apps/web/src/features/overview/OverviewPage.tsx b/apps/web/src/features/overview/OverviewPage.tsx
index 8d0a514be..d6a2e3707 100644
--- a/apps/web/src/features/overview/OverviewPage.tsx
+++ b/apps/web/src/features/overview/OverviewPage.tsx
@@ -26,10 +26,12 @@ import { useConsoleNavigation } from "../../lib/console-navigation";
 import { formatClock, formatCompact, formatInteger, formatPercent, formatRelative, MISSING } from "../../lib/format";
 import { ProjectName, useProjects } from "../../lib/projects";
 import { capacitySummary, coreStatus, type CoreStatus } from "../fleet/fleet-model";
+import { FleetReadNotice, fleetObservationStale } from "../fleet/FleetReadNotice";
 import { SandboxResetNotice } from "../fleet/SandboxResetNotice";
 import { fleetSnapshot, useSandboxFleet, type FleetSnapshot, type FleetState } from "../fleet/use-sandbox-fleet";
 import { type InProject } from "../metrics/project-sessions";
 import { FleetTopology, TOPOLOGY_LIMIT, type CloudHost } from "./FleetTopology";
+import { SessionFailure } from "../sessions/session-diagnostics";
 import { useWaitingFor } from "../sessions/SessionStatus";
 import { GettingStarted } from "./GettingStarted";
 import { type OverviewData } from "./overview-loader";
@@ -173,6 +175,7 @@ export function OverviewPage() {
       />
       <PageBody>
         <SandboxResetNotice deployment={deployment.data} failed={deployment.isError} onRetry={() => void deployment.refetch()} />
+        <FleetReadNotice state={fleetState} onRetry={refreshFleet} />
         <InstallationNotice installation={installation.data} />
         {installation.isError ? <ReadFailure onRetry={() => void installation.refetch()} partial={installation.data !== undefined} /> : null}
         <GettingStarted sandboxReset={deployment.isError ? "failed" : deployment.data ? deployment.data.reset !== null : undefined} fleet={fleetState} sessions={sessionCount} localOnly={installation.isError ? "failed" : installation.data?.local_only} onRetryInstallation={() => void installation.refetch()} />
@@ -336,9 +339,9 @@ function FleetCard({ fleetState, core, localOnly }: { fleetState: FleetState; co
         </div>
         {fleetState.status === "ready" ? (
           !fleet?.deployment.provider
-            ? <button className="button outline" type="button" onClick={() => navigate("nodes")}>{t("fleet.setUp")}</button>
+            ? <button className="button outline" type="button" onClick={() => navigate("system", { id: "sandbox" })}>{t("fleet.setUp")}</button>
             : cloud || hosts.length
-              ? <button className="button outline" type="button" onClick={() => navigate("nodes")}>{cloud ? t("fleet.cloud.openBackend") : t("fleet.manageNodes")}</button>
+              ? <button className="button outline" type="button" onClick={() => cloud ? navigate("system", { id: "sandbox" }) : navigate("nodes")}>{cloud ? t("fleet.cloud.openBackend") : t("fleet.manageNodes")}</button>
               : <button className="button outline" type="button" onClick={() => navigate("nodes", {}, localOnly ? undefined : "add-node")}>{t(localOnly ? "fleet.manageNodes" : "fleet.addNode")}</button>
         ) : null}
       </header>
@@ -346,10 +349,10 @@ function FleetCard({ fleetState, core, localOnly }: { fleetState: FleetState; co
         <FleetTopology
           nodes={hosts}
           cloud={cloud}
-          onOpenBackend={() => navigate("nodes")}
+          onOpenBackend={() => navigate("system", { id: "sandbox" })}
           coreLabel={t(`coreStatus.${core}`)}
           coreTone={coreTone[core]}
-          stale={fleetState.status === "ready" && fleetState.error !== null}
+          stale={fleetObservationStale(fleetState)}
           onOpenNode={(node) => navigate("nodes", { id: node.id })}
           onOpenSandboxMetrics={() => navigate("sandbox-metrics")}
           onOpenCoreMetrics={() => navigate("core-metrics")}
@@ -498,7 +501,7 @@ function AttentionTable({ sessions, expected, unread, truncated, now, onOpen }:
                 </th>
                 <td><ProjectName project={entry.project} /></td>
                 <td><StatusDot tone={failed ? "danger" : "neutral"} label={t(`sessions.${failed ? "failed" : "requires_action"}`)} /></td>
-                <td className="table-truncate" title={failed ? session.error ?? undefined : waitingFor(session).join(" · ")}>{failed ? session.error || t("attention.noError") : waitingFor(session).join(" · ")}</td>
+                <td className="table-truncate" onClick={(event) => event.stopPropagation()}>{failed ? <SessionFailure projectId={entry.project.id} session={session} truncate /> : waitingFor(session).join(" · ")}</td>
                 <td className="numeric">{formatRelative(session.last_active_at, now, locale)}</td>
               </tr>
             );
diff --git a/apps/web/src/features/overview/getting-started.test.ts b/apps/web/src/features/overview/getting-started.test.ts
index fe62021a9..84e2ed166 100644
--- a/apps/web/src/features/overview/getting-started.test.ts
+++ b/apps/web/src/features/overview/getting-started.test.ts
@@ -9,12 +9,23 @@ const deployment = (overrides: Partial<SandboxDeployment> = {}): SandboxDeployme
   rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: { ready: 1, preparing: 0, failed: 0, update_required: 0, unknown: 0 } }, installation_id: "i", provider: "docker", core_url: "http://core", reset: null, owner_epoch: 1, generation: 1, mode: "nodes",
   resources: { allocations: 0, pending: 0 }, suspension: null, ...overrides,
 });
-const fleet = (value: SandboxDeployment, nodes = [node("n1")]): FleetState => ({ status: "ready", snapshot: { deployment: value, nodes, allocations: [], loadedAt: 0 }, refreshing: false, error: null });
+const fleet = (value: SandboxDeployment, nodes = [node("n1")]): FleetState => ({ status: "ready", snapshot: { deployment: value, nodes, allocations: [], loadedAt: 0 }, targetGeneration: value.generation, refreshing: false, error: null });
 const sandboxes = (state: FleetState) => gettingStartedSteps({ sandboxReset: false, fleet: state, localOnly: false, projects: [], sessions: 0, harnesses: [] }).sandboxes;
 const provider = { object: "core.model_provider", protocol: "responses", base_url: "https://model.example/v1", api_key_configured: true, last_used_at: null, last_error_code: null, last_error_at: null, updated_at: "2026-09-25T00:00:00Z" } as const;
 const harness = (id: CoreHarness["id"], fields: Partial<CoreHarness> = {}): CoreHarness => ({ object: "core.harness", id, enabled: true, default: false, model_provider: null, ...fields });
 
 describe("Getting started steps", () => {
+  it("uses live provider readiness independently of target state or a durable pin", () => {
+    for (const state of ["preparing", "failed", "update_required", "unknown"] as const) {
+      const serving = node("n1", { rollout: { state, ready_generation: 1 } });
+      expect(sandboxes(fleet(deployment({ generation: 2 }), [serving])).state).toBe("done");
+      expect(sandboxes(fleet(deployment({ generation: 2 }), [{ ...serving, provider_ready: false }])).state).toBe("todo");
+    }
+    expect(sandboxes(fleet(deployment(), [node("n1", { online: false, rollout: { state: "unknown", ready_generation: 1 } })])).state).toBe("todo");
+    expect(sandboxes(fleet(deployment(), [node("n1", { rollout: { state: "unknown", ready_generation: 1 } })])).state).toBe("done");
+    expect(sandboxes(fleet(deployment(), [node("n1", { provider_ready: false, rollout: { state: "preparing", ready_generation: null } })])).state).toBe("todo");
+  });
+
   it("does not report ready during reset or an unreadable deployment, even with ready nodes", () => {
     for (const backend of ["docker", "e2b"] as const) {
       const input = { fleet: fleet(deployment({ provider: backend })), localOnly: false, projects: [project("p")], sessions: 1,
diff --git a/apps/web/src/features/overview/getting-started.ts b/apps/web/src/features/overview/getting-started.ts
index 36f3a8436..1d1758964 100644
--- a/apps/web/src/features/overview/getting-started.ts
+++ b/apps/web/src/features/overview/getting-started.ts
@@ -1,6 +1,7 @@
 import type { CoreHarness } from "@agents-core-web/agents-client";
 
 import { type Project } from "../../lib/admin-view";
+import { nodeServingReady } from "../fleet/fleet-model";
 import { type FleetState } from "../fleet/use-sandbox-fleet";
 import { templateBuildStatus } from "../sandbox/deployment-specification";
 
@@ -70,7 +71,7 @@ function sandboxStep(fleet: FleetState): GettingStartedSteps["sandboxes"] {
   if (deployment.provider === "e2b") {
     return { state: templateBuildStatus(deployment.e2b?.template_build) === "notReady" ? "todo" : "done", action: "nodes", cloud: true };
   }
-  if (nodes.some((node) => node.online && node.provider_ready)) return { state: "done", action: "nodes", cloud: false };
+  if (nodes.some(nodeServingReady)) return { state: "done", action: "nodes", cloud: false };
   return { state: "todo", action: nodes.length ? "nodes" : "add-node", cloud: false };
 }
 
diff --git a/apps/web/src/features/sandbox/NodeDetail.tsx b/apps/web/src/features/sandbox/NodeDetail.tsx
index b0423fd0f..24ed17056 100644
--- a/apps/web/src/features/sandbox/NodeDetail.tsx
+++ b/apps/web/src/features/sandbox/NodeDetail.tsx
@@ -8,6 +8,7 @@ import { formatDateTime, formatInteger, formatRelative, formatSpan, MISSING } fr
 import { nodeProviderDiagnostic, sandboxDiagnosticMessage } from "../../lib/sandbox-diagnostic";
 import { sandboxStateLabel } from "../../lib/sandbox-labels";
 import { DiagnosticTip } from "../fleet/DiagnosticTip";
+import { NodeRolloutStatus } from "./NodeRolloutStatus";
 import { phaseTiming } from "./allocation-phase";
 import { nodeState, NodeStatus, OldAddressHint, seconds } from "./NodeList";
 
@@ -36,11 +37,12 @@ function PhaseTime({ allocation, retentionSeconds, now }: { allocation: SandboxA
   return <td className="nodes-nowrap" title={formatDateTime(timing.since, locale)}>{text}</td>;
 }
 
-export function NodeDetail({ node, allocations, coreUrl, stale, suspension }: {
+export function NodeDetail({ node, allocations, coreUrl, targetGeneration, stale, suspension }: {
   node: SandboxNode;
   allocations: readonly SandboxAllocation[];
   /** The deployment's address; a node enrolled with another one is on an old address. */
   coreUrl: string;
+  targetGeneration?: number;
   stale: boolean;
   /** The deployment's idle suspension policy; only microsandbox has one. */
   suspension: SandboxDeployment["suspension"];
@@ -75,6 +77,9 @@ export function NodeDetail({ node, allocations, coreUrl, stale, suspension }: {
             {node.last_seen_at ? formatRelative(seconds(node.last_seen_at), now, locale) : t("Never")}
           </dd>
         </div>
+        <div><dt>{t("Target generation")}</dt><dd>{targetGeneration ?? MISSING}</dd></div>
+        <div><dt>{t("Target preparation")}</dt><dd><NodeRolloutStatus node={node} stale={stale} /></dd></div>
+        <div><dt>{t("Serving generation")}<HelpTip>{t("The saved serving generation is not proof that this node is online, ready or has free capacity.")}</HelpTip></dt><dd>{node.rollout.ready_generation ?? MISSING}</dd></div>
         <div><dt>{t("Added")}</dt><dd>{formatDateTime(seconds(node.created_at), locale)}</dd></div>
       </dl>
 
@@ -100,6 +105,7 @@ export function NodeDetail({ node, allocations, coreUrl, stale, suspension }: {
               <thead>
                 <tr>
                   <th scope="col">{t("Session")}</th>
+                  <th scope="col">{t("Configuration generation")}</th>
                   <th scope="col">{t("Recorded state")}</th>
                   <th scope="col">{t("Recorded compute")}</th>
                   {/* Only microsandbox changes compute phase; under Docker it is always disabled. */}
@@ -112,6 +118,7 @@ export function NodeDetail({ node, allocations, coreUrl, stale, suspension }: {
                 {own.map((allocation) => (
                   <tr key={allocation.id}>
                     <th scope="row"><CopyableId id={allocation.session_id} label={t("Session")} /></th>
+                    <td>{allocation.deployment_generation}</td>
                     <td>{sandboxStateLabel(allocation.state, shortLocale)}</td>
                     <td>{allocation.compute_phase ? sandboxStateLabel(allocation.compute_phase, shortLocale) : MISSING}</td>
                     {suspension ? <PhaseTime allocation={allocation} retentionSeconds={suspension.retention_seconds} now={now} /> : null}
diff --git a/apps/web/src/features/sandbox/NodeEditDialog.tsx b/apps/web/src/features/sandbox/NodeEditDialog.tsx
index d6c1c22c8..662f3dca3 100644
--- a/apps/web/src/features/sandbox/NodeEditDialog.tsx
+++ b/apps/web/src/features/sandbox/NodeEditDialog.tsx
@@ -5,6 +5,7 @@ import { useTranslation } from "react-i18next";
 
 import { HelpTip } from "../../components/console-ui";
 import { Modal } from "../../components/Modal";
+import { coreFieldError } from "../../lib/core-error";
 import { formatBytes } from "../../lib/format";
 import { sandboxRequestError } from "../../lib/sandbox-labels";
 import { nodeDetailQuery } from "../fleet/fleet-queries";
@@ -28,12 +29,13 @@ export function NodeEditDialog({ client, node, size, onClose, onSaved }: {
 }) {
   const { t, i18n } = useTranslation("sandbox");
   const locale = i18n.resolvedLanguage?.startsWith("zh") ? "zh" : "en";
+  const { t: tCommon } = useTranslation("common");
   const id = useId();
   const [name, setName] = useState(node?.name ?? "");
   const [active, setActive] = useState(String(node?.max_active ?? 2));
   const [retained, setRetained] = useState(String(node?.max_retained ?? 8));
   const [busy, setBusy] = useState(false);
-  const [error, setError] = useState<string | null>(null);
+  const [error, setError] = useState<unknown>(null);
   const suspends = node?.provider === "microsandbox";
   const whole = (value: string) => (/^\d+$/.test(value.trim()) ? Number(value.trim()) : null);
   const activeLimit = whole(active);
@@ -42,6 +44,9 @@ export function NodeEditDialog({ client, node, size, onClose, onSaved }: {
   const nameProblem = !name.trim() || new TextEncoder().encode(name.trim()).length > 128 ? t("Enter a shorter name.") : null;
   const activeProblem = activeLimit === null || activeLimit < 1 || activeLimit > 1_000_000 ? t("Enter a whole number from 1 to 1,000,000.") : null;
   const retainedProblem = suspends && (retainedLimit === null || activeLimit === null || retainedLimit < activeLimit || retainedLimit > 1_000_000) ? t("Enter at least the number of sandboxes at once.") : null;
+  const nameError = coreFieldError(error, "name", tCommon, "bytes") ?? (name ? nameProblem : null);
+  const activeError = coreFieldError(error, "max_active", tCommon) ?? activeProblem;
+  const retainedError = coreFieldError(error, "max_retained", tCommon) ?? retainedProblem;
   const ready = node !== null && !nameProblem && !activeProblem && !retainedProblem && !busy;
   // The node detail read adds the host's total memory to its CPU count.
   const detail = useQuery({ ...nodeDetailQuery(node?.id ?? "", "1h"), enabled: node !== null });
@@ -65,7 +70,7 @@ export function NodeEditDialog({ client, node, size, onClose, onSaved }: {
       onSaved();
     } catch (reason) {
       // Keep the form with Core's reason; nothing changed unless Core confirmed it.
-      setError(sandboxRequestError(reason, locale));
+      setError(reason);
     } finally {
       setBusy(false);
     }
@@ -84,23 +89,23 @@ export function NodeEditDialog({ client, node, size, onClose, onSaved }: {
       <form className="form-stack" onSubmit={(event) => { event.preventDefault(); void save(); }}>
         <label className="field" htmlFor={`${id}-name`}>
           <span>{t("Name")}</span>
-          <input id={`${id}-name`} value={name} onChange={(event) => setName(event.target.value)} autoComplete="off" aria-invalid={Boolean(name && nameProblem)} />
-          {name && nameProblem ? <span className="field-error">{nameProblem}</span> : null}
+          <input id={`${id}-name`} value={name} onChange={(event) => { setName(event.target.value); setError(null); }} autoComplete="off" aria-invalid={Boolean(nameError)} aria-describedby={nameError ? `${id}-name-error` : undefined} />
+          {nameError ? <span id={`${id}-name-error`} className="field-error">{nameError}</span> : null}
         </label>
         <div className="field">
           <span className="field-label-row"><label htmlFor={`${id}-active`}>{t("Sandboxes at once")}</label><HelpTip>{t("The most sandboxes Core places on this node at the same time.")}</HelpTip></span>
-          <input id={`${id}-active`} inputMode="numeric" value={active} onChange={(event) => setActive(event.target.value)} aria-invalid={Boolean(activeProblem)} aria-describedby={hostFacts ? `${id}-host` : undefined} />
-          {activeProblem ? <span className="field-error">{activeProblem}</span> : null}
+          <input id={`${id}-active`} inputMode="numeric" value={active} onChange={(event) => { setActive(event.target.value); setError(null); }} aria-invalid={Boolean(activeError)} aria-errormessage={activeError ? `${id}-active-error` : undefined} aria-describedby={hostFacts ? `${id}-host` : undefined} />
+          {activeError ? <span id={`${id}-active-error`} className="field-error">{activeError}</span> : null}
           {hostFacts ? <small id={`${id}-host`}>{hostFacts}</small> : null}
         </div>
         {suspends ? (
           <div className="field">
             <span className="field-label-row"><label htmlFor={`${id}-retained`}>{t("Retained sandboxes")}</label><HelpTip>{t("Sandboxes kept on this node for resuming, the running ones included. At least the number at once.")}</HelpTip></span>
-            <input id={`${id}-retained`} inputMode="numeric" value={retained} onChange={(event) => setRetained(event.target.value)} aria-invalid={Boolean(retainedProblem)} />
-            {retainedProblem ? <span className="field-error">{retainedProblem}</span> : null}
+            <input id={`${id}-retained`} inputMode="numeric" value={retained} onChange={(event) => { setRetained(event.target.value); setError(null); }} aria-invalid={Boolean(retainedError)} aria-errormessage={retainedError ? `${id}-retained-error` : undefined} />
+            {retainedError ? <span id={`${id}-retained-error`} className="field-error">{retainedError}</span> : null}
           </div>
         ) : null}
-        {error ? <p className="confirm-dialog-error" role="alert">{error}</p> : null}
+        {error !== null ? <p className="confirm-dialog-error" role="alert">{sandboxRequestError(error, locale)}</p> : null}
       </form>
     </Modal>
   );
diff --git a/apps/web/src/features/sandbox/NodeEnrollment.tsx b/apps/web/src/features/sandbox/NodeEnrollment.tsx
index 2b624ee04..c2033bbc9 100644
--- a/apps/web/src/features/sandbox/NodeEnrollment.tsx
+++ b/apps/web/src/features/sandbox/NodeEnrollment.tsx
@@ -5,6 +5,7 @@ import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { useTranslation } from "react-i18next";
 import { HelpTip, StatusDot, type Tone } from "../../components/console-ui";
 import { Modal } from "../../components/Modal";
+import { coreFieldError } from "../../lib/core-error";
 import { formatBytes } from "../../lib/format";
 import { useConsoleNavigation } from "../../lib/console-navigation";
 import { installationQuery } from "../../lib/installation";
@@ -69,6 +70,7 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
 }) {
   const { t, i18n } = useTranslation("sandbox");
   const locale = i18n.resolvedLanguage?.startsWith("zh") ? "zh" : "en";
+  const { t: tCommon } = useTranslation("common");
   const id = useId();
   const [active, setActive] = useState(DEFAULT_ACTIVE);
   const [retained, setRetained] = useState(DEFAULT_RETAINED);
@@ -118,6 +120,8 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
   const retainedProblem = !suspends ? null
     : !inRange(retainedLimit) ? t("Enter a whole number from 1 to 1,000,000.")
     : inRange(activeLimit) && retainedLimit < activeLimit ? t("Enter at least the number of sandboxes at once.") : null;
+  const activeError = coreFieldError(error, "max_active", tCommon) ?? activeProblem;
+  const retainedError = coreFieldError(error, "max_retained", tCommon) ?? retainedProblem;
   const limitsReady = !activeProblem && !retainedProblem;
   const node = enrollment ? enrolledNode(nodes, enrollment) : null;
   const progress = enrollmentProgress(node, node && appeared?.id === node.id ? appeared.at : undefined, now);
@@ -277,14 +281,14 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
           <p>{t("Set the sandbox limits for the host you want to add.")}</p>
           <div className="field">
             <span className="field-label-row"><label htmlFor={`${id}-active`}>{t("Sandboxes at once")}</label><HelpTip>{t("The most sandboxes Core places on this node at the same time.")}</HelpTip></span>
-            <input id={`${id}-active`} inputMode="numeric" autoComplete="off" autoFocus={open} value={active} onChange={(event) => setActive(event.target.value)} aria-invalid={Boolean(activeProblem)} />
-            {activeProblem ? <span className="field-error">{activeProblem}</span> : null}
+            <input id={`${id}-active`} inputMode="numeric" autoComplete="off" autoFocus={open} value={active} onChange={(event) => { setActive(event.target.value); setError(null); }} aria-invalid={Boolean(activeError)} aria-errormessage={activeError ? `${id}-active-error` : undefined} />
+            {activeError ? <span id={`${id}-active-error`} className="field-error">{activeError}</span> : null}
           </div>
           {suspends ? (
             <div className="field">
               <span className="field-label-row"><label htmlFor={`${id}-retained`}>{t("Retained sandboxes")}</label><HelpTip>{t("Sandboxes kept on this node for resuming, the running ones included. At least the number at once.")}</HelpTip></span>
-              <input id={`${id}-retained`} inputMode="numeric" autoComplete="off" value={retained} onChange={(event) => setRetained(event.target.value)} aria-invalid={Boolean(retainedProblem)} />
-              {retainedProblem ? <span className="field-error">{retainedProblem}</span> : null}
+              <input id={`${id}-retained`} inputMode="numeric" autoComplete="off" value={retained} onChange={(event) => { setRetained(event.target.value); setError(null); }} aria-invalid={Boolean(retainedError)} aria-errormessage={retainedError ? `${id}-retained-error` : undefined} />
+              {retainedError ? <span id={`${id}-retained-error`} className="field-error">{retainedError}</span> : null}
             </div>
           ) : null}
           {error !== null ? <p role="alert" className="sandbox-error">{sandboxRequestError(error, locale)}</p> : null}
diff --git a/apps/web/src/features/sandbox/NodeList.test.ts b/apps/web/src/features/sandbox/NodeList.test.ts
index 6750fd415..338fafef1 100644
--- a/apps/web/src/features/sandbox/NodeList.test.ts
+++ b/apps/web/src/features/sandbox/NodeList.test.ts
@@ -9,6 +9,14 @@ const allocation = (nodeId: string, diagnostic: SandboxAllocation["diagnostic"])
 const core = "https://core.example";
 
 describe("node state", () => {
+  it("keeps live serving health independent of target preparation and durable pins", () => {
+    for (const state of ["unknown", "preparing", "failed", "update_required"] as const) {
+      const serving = node("a", { online: true, provider_ready: true, rollout: { state, ready_generation: 1 } });
+      expect(nodeState(serving, [], false, core)).toBe("available");
+      expect(nodeState({ ...serving, online: false }, [], false, core)).toBe("offline");
+    }
+  });
+
   it("reports stale data, an old address and reachability before anything else", () => {
     expect(nodeState(node("a", { online: false }), [], true, core)).toBe("unconfirmed");
     expect(nodeState(node("a", { core_url: "https://core-old.example" }), [], false, core)).toBe("old_address");
diff --git a/apps/web/src/features/sandbox/NodeList.tsx b/apps/web/src/features/sandbox/NodeList.tsx
index 11498f163..0efe7699a 100644
--- a/apps/web/src/features/sandbox/NodeList.tsx
+++ b/apps/web/src/features/sandbox/NodeList.tsx
@@ -9,6 +9,8 @@ import { nodeProviderDiagnostic } from "../../lib/sandbox-diagnostic";
 import { DiagnosticTip } from "../fleet/DiagnosticTip";
 import { nodeHealth, suspendedSandboxes } from "../fleet/fleet-model";
 
+import { NodeRolloutStatus } from "./NodeRolloutStatus";
+
 export type NodeState = "unconfirmed" | "old_address" | "offline" | "degraded" | "attention" | "available";
 
 /**
@@ -102,7 +104,10 @@ export function NodeList({ nodes, allocations, coreUrl, stale, disabled, suspend
                   <NameCell name={node.name} id={node.id} onOpen={() => onOpen(node)} openLabel={t("Open {{name}}", { name })} idLabel={t("Node ID")} />
                 </th>
                 <td>
-                  <span className="status-with-help"><NodeStatus state={state} />{diagnostic ? <DiagnosticTip code={diagnostic} /> : null}</span>
+                  <div className="node-statuses">
+                    <span className="status-with-help"><NodeStatus state={state} />{diagnostic ? <DiagnosticTip code={diagnostic} /> : null}</span>
+                    <NodeRolloutStatus node={node} stale={stale} />
+                  </div>
                   {state === "old_address" ? <OldAddressHint /> : null}
                 </td>
                 <td className="numeric">{node.active} / {node.max_active}</td>
diff --git a/apps/web/src/features/sandbox/NodeRolloutStatus.tsx b/apps/web/src/features/sandbox/NodeRolloutStatus.tsx
new file mode 100644
index 000000000..6e3004086
--- /dev/null
+++ b/apps/web/src/features/sandbox/NodeRolloutStatus.tsx
@@ -0,0 +1,19 @@
+import type { SandboxNode, SandboxNodeRollout } from "@agents-core-web/agents-client";
+import { useTranslation } from "react-i18next";
+import { HelpTip, StatusDot, type Tone } from "../../components/console-ui";
+import type { MessageKey } from "../../lib/locale-strings";
+import { DiagnosticTip } from "../fleet/DiagnosticTip";
+
+const labels: Record<SandboxNodeRollout["state"], MessageKey> = { ready: "Ready for target", preparing: "Preparing target", failed: "Preparation failed", update_required: "Node software incompatible", unknown: "Target readiness unknown" };
+const tones: Record<SandboxNodeRollout["state"], Tone> = { ready: "ok", preparing: "neutral", failed: "warning", update_required: "warning", unknown: "neutral" };
+
+/** A serving pin is historical ownership, not proof of a live connection or capacity. */
+export function NodeRolloutStatus({ node, stale = false }: { node: SandboxNode; stale?: boolean }) {
+  const { t } = useTranslation("sandbox");
+  const state = stale || !node.online ? "unknown" : node.rollout.state;
+  return <span className="status-with-help">
+    <StatusDot tone={tones[state]} label={t(labels[state])} />
+    {state === "failed" && node.rollout.diagnostic ? <DiagnosticTip code={node.rollout.diagnostic} /> : null}
+    {state === "update_required" ? <HelpTip>{t("In-place upgrades from older project versions are not supported. Reinstall using the current version. Existing data is not removed automatically.")}</HelpTip> : null}
+  </span>;
+}
diff --git a/apps/web/src/features/sandbox/SandboxDeploymentPage.tsx b/apps/web/src/features/sandbox/SandboxDeploymentPage.tsx
new file mode 100644
index 000000000..3e44cb9d9
--- /dev/null
+++ b/apps/web/src/features/sandbox/SandboxDeploymentPage.tsx
@@ -0,0 +1,115 @@
+import { useEffect, useRef, useState, type ReactNode } from "react";
+import type { InitializeSandboxDeployment, UpdateSandboxDeployment, SandboxDeployment, StartSandboxReset } from "@agents-core-web/agents-client";
+import { useQueryClient } from "@tanstack/react-query";
+import { ArrowLeft } from "lucide-react";
+import { useTranslation } from "react-i18next";
+import { TableSkeleton } from "../../components/Skeleton";
+import { HelpTip, RefreshButton } from "../../components/console-ui";
+import { ErrorDialog } from "../../components/ErrorDialog";
+import { ErrorState } from "../../components/ErrorState";
+import { InstallationNotice } from "../../components/InstallationNotice";
+import { useFailureToast, useToast } from "../../components/Toast";
+import { useConsoleNavigation } from "../../lib/console-navigation";
+import { sandboxConfigurationRejection, sandboxRequestError, sandboxWriteUncertain } from "../../lib/sandbox-labels";
+import { sandboxAdmin } from "./sandbox-queries";
+import { SandboxPageAccess } from "./SandboxPageAccess";
+import { useSandboxPageState } from "./use-sandbox-page-state";
+import { sandboxWriteOwnershipQuery } from "./sandbox-write-ownership";
+import { writeSandboxDeployment } from "./sandbox-deployment-write";
+import { SandboxSetupWizard } from "./SandboxSetupWizard";
+import { SandboxDeploymentSettings } from "./SandboxDeploymentSettings";
+import "./SandboxManagerView.css";
+
+function DeploymentHeader({ actions }: { actions?: ReactNode }) {
+  const { t } = useTranslation("sandboxNavigation");
+  const { navigate } = useConsoleNavigation();
+  return <header className="page-header">
+    <div className="console-page-heading">
+      <button type="button" className="icon-button ghost back-button" aria-label={t("back")} title={t("back")} onClick={() => navigate("system")}><ArrowLeft size={16} strokeWidth={1.6} aria-hidden="true" /></button>
+      <h1>{t("title")}</h1><HelpTip>{t("help")}</HelpTip>
+    </div>
+    {actions ? <div className="page-actions">{actions}</div> : null}
+  </header>;
+}
+
+/** System's secondary page is the sole owner of deployment configuration controls. */
+export function SandboxDeploymentPage() {
+  const { i18n } = useTranslation("sandbox");
+  return <section className="page-section console-page sandbox-manager sandbox-manager-page" lang={i18n.resolvedLanguage?.startsWith("zh") ? "zh" : "en"}>
+    <SandboxPageAccess header={<DeploymentHeader />}>{() => <DeploymentConfiguration />}</SandboxPageAccess>
+  </section>;
+}
+
+function DeploymentConfiguration() {
+  const { t, i18n } = useTranslation("sandbox");
+  const { t: tNavigation } = useTranslation("sandboxNavigation");
+  const locale = i18n.resolvedLanguage?.startsWith("zh") ? "zh" : "en";
+  const { navigate } = useConsoleNavigation();
+  const queryClient = useQueryClient();
+  const { deploymentQuery, snapshot, installation, loading, busy, setupNeedsRefresh, confirmed, fresh, refresh, configurationKey } = useSandboxPageState();
+  const error: unknown = deploymentQuery.error;
+  const toast = useToast();
+  const [writeFailure, setWriteFailure] = useState<{ error: unknown; open: boolean; editing: boolean } | null>(null);
+  const lifetime = useRef<AbortController | null>(null);
+  useEffect(() => {
+    const controller = new AbortController(); lifetime.current = controller;
+    return () => { controller.abort(); lifetime.current = null; };
+  }, []);
+  const refreshByUser = () => {
+    void refresh().then((result) => {
+      if (!result.isError && queryClient.getQueryData(sandboxWriteOwnershipQuery.queryKey)?.phase === "idle") setWriteFailure(null);
+      if (result.isError && result.data) toast.show(t("Refresh failed; showing the last loaded state."), { tone: "error", detail: sandboxRequestError(result.error, locale), key: "sandbox-read" });
+    });
+  };
+  useFailureToast(snapshot && deploymentQuery.isError ? sandboxRequestError(deploymentQuery.error, locale) : null, t("Refresh failed; showing the last loaded state."), "sandbox-read");
+
+  // The shared mutation owner outlives this page. Leaving only suppresses local UI effects.
+  async function changeDeployment(operation: (signal: AbortSignal) => Promise<SandboxDeployment>, fromWizard = false, editing = false): Promise<boolean> {
+    const controller = lifetime.current;
+    if (!controller || busy || loading || setupNeedsRefresh || !fresh) return false;
+    setWriteFailure(null);
+    try {
+      const deployment = await writeSandboxDeployment(queryClient, operation);
+      return deployment !== null && !controller.signal.aborted;
+    } catch (error) {
+      if (!controller.signal.aborted) {
+        if (fromWizard && sandboxConfigurationRejection(error) !== null) throw error;
+        if (sandboxWriteUncertain(error)) setWriteFailure({ error, open: true, editing });
+        else toast.show(t("Core rejected the sandbox change"), { tone: "error", detail: sandboxRequestError(error, locale), key: "sandbox-write" });
+      }
+    }
+    return false;
+  }
+  async function initialize(input: InitializeSandboxDeployment) {
+    if (await changeDeployment((signal) => sandboxAdmin.initializeDeployment(input, { signal }), true) && input.provider !== "e2b" && !installation.data?.local_only) navigate("nodes", {}, "add-node");
+  }
+  async function update(input: UpdateSandboxDeployment) {
+    return changeDeployment((signal) => sandboxAdmin.updateDeployment({ ...input, expected_generation: snapshot!.deployment.generation }, { signal }), true, true);
+  }
+  const startReset = (input: StartSandboxReset) => changeDeployment((signal) => sandboxAdmin.startReset(input, { signal }));
+  const cancelReset = (expectedGeneration: number) => changeDeployment((signal) => sandboxAdmin.cancelReset(expectedGeneration, { signal }));
+  const unknownWrite = writeFailure?.open ? <div className="form-stack" role="alert">
+    <p>{sandboxRequestError(writeFailure.error, locale)}</p>
+    <p>{t("Refresh sandbox state to confirm whether the change was saved before submitting again.")}</p>
+  </div> : null;
+
+  return <>
+    <DeploymentHeader actions={<>
+      {snapshot?.deployment.provider && snapshot.deployment.provider !== "e2b" ? <button type="button" className="button outline" onClick={() => navigate("nodes")}>{tNavigation("nodes")}</button> : null}
+      <RefreshButton onClick={refreshByUser} refreshing={loading} disabled={busy} label={t("Refresh sandbox state")} />
+    </>} />
+    <div className="console-page-body sandbox-content">
+      <InstallationNotice installation={installation.data} />
+      {!snapshot && (loading || deploymentQuery.isPending) ? <TableSkeleton label={t("Loading sandbox state…")} rows={3} columns={2} /> : null}
+      {snapshot && deploymentQuery.isError ? <p role="alert" className="sandbox-error">{t("Refresh failed; showing the last loaded state.")}</p> : null}
+      {setupNeedsRefresh ? <p role="alert" className="sandbox-error">{t("Refresh sandbox state to confirm whether the change was saved before submitting again.")}</p> : null}
+      {busy ? <span role="status">{t("Saving sandbox change…")}</span> : null}
+      {!snapshot && error !== null ? <ErrorState title={t("Sandbox state couldn't be read")} detail={sandboxRequestError(error, locale)} onRetry={refresh} /> : null}
+      {snapshot && !snapshot.deployment.provider && !snapshot.deployment.reset ? <SandboxSetupWizard key={configurationKey} coreUrl={snapshot.deployment.core_url} expectedGeneration={snapshot.deployment.generation} disabled={busy || loading || setupNeedsRefresh || error !== null} onSubmit={initialize} /> : null}
+      {snapshot?.deployment.provider || snapshot?.deployment.reset ? <SandboxDeploymentSettings key={configurationKey} deployment={snapshot.deployment} fresh={confirmed} disabled={busy || loading || !fresh || setupNeedsRefresh} onReset={startReset} onCancelReset={cancelReset} onUpdate={update} onRefresh={refreshByUser} refreshing={loading} pending={busy} writeFailure={writeFailure?.editing ? unknownWrite : null} /> : null}
+    </div>
+    <ErrorDialog action={{ label: t("Refresh sandbox state"), onClick: refreshByUser }} open={Boolean(writeFailure?.open && !writeFailure.editing)} title={t("Couldn't confirm the sandbox change")} onClose={() => setWriteFailure((failure) => failure && { ...failure, open: false })}>
+      {unknownWrite}
+    </ErrorDialog>
+  </>;
+}
diff --git a/apps/web/src/features/sandbox/SandboxDeploymentSettings.tsx b/apps/web/src/features/sandbox/SandboxDeploymentSettings.tsx
index 65ddbe8dd..3bfb8f463 100644
--- a/apps/web/src/features/sandbox/SandboxDeploymentSettings.tsx
+++ b/apps/web/src/features/sandbox/SandboxDeploymentSettings.tsx
@@ -1,56 +1,65 @@
-import { useState } from "react";
-import type { InitializeSandboxDeployment, SandboxDeployment, StartSandboxReset } from "@agents-core-web/agents-client";
+import { useState, type ReactNode } from "react";
+import type { UpdateSandboxDeployment, SandboxDeployment, StartSandboxReset } from "@agents-core-web/agents-client";
 import { useTranslation } from "react-i18next";
-import { HelpTip } from "../../components/console-ui";
+import { Modal } from "../../components/Modal";
+import { HelpTip, RefreshButton } from "../../components/console-ui";
 import { formatBytes, formatPeriod, MISSING } from "../../lib/format";
 import type { MessageKey } from "../../lib/locale-strings";
 import { sandboxProviderLabel } from "../../lib/sandbox-labels";
 import { sandboxSize, templateBuildSize, templateBuildStatus } from "./deployment-specification";
+import { SandboxRolloutSummary } from "./SandboxRolloutSummary";
 import { SandboxResetControls } from "./SandboxResetControls";
 import { SandboxSetupWizard } from "./SandboxSetupWizard";
 
 const MIB = 2 ** 20;
 const buildStatusLabel: Record<ReturnType<typeof templateBuildStatus>, MessageKey> = { ready: "Ready", notReady: "Not ready", unknown: "Unknown state" };
 
-export function SandboxDeploymentSettings({ deployment, disabled, fresh, onReset, onCancelReset, onUpdate }: {
+export function SandboxDeploymentSettings({ deployment, disabled, fresh, onReset, onCancelReset, onUpdate, writeFailure, onRefresh, refreshing, pending }: {
   deployment: SandboxDeployment;
   disabled: boolean;
   fresh: boolean;
   onReset: (input: StartSandboxReset) => Promise<boolean>;
   onCancelReset: (expectedGeneration: number) => Promise<boolean>;
-  onUpdate: (input: InitializeSandboxDeployment) => Promise<void>;
+  onUpdate: (input: UpdateSandboxDeployment) => Promise<boolean>;
+  writeFailure?: ReactNode;
+  onRefresh: () => void;
+  refreshing: boolean;
+  pending: boolean;
 }) {
   const { t, i18n } = useTranslation("sandbox");
+  const { t: tNavigation } = useTranslation("sandboxNavigation");
   const locale = i18n.resolvedLanguage?.startsWith("zh") ? "zh" : "en";
   const [changing, setChanging] = useState(false);
+  const [editKey, setEditKey] = useState(0);
   const spec = deployment.specification;
   // An E2B selection may adopt its template build's size instead of saving one.
   const size = sandboxSize(deployment);
   const build = deployment.e2b?.template_build;
   const buildSize = templateBuildSize(deployment);
   const sizeLabel = (value: { cpus: number; memory_mib: number }) => t("{{cpus}} CPU · {{memory}}", { cpus: value.cpus, memory: formatBytes(value.memory_mib * MIB) });
-  const clean = fresh && !deployment.reset && deployment.resources?.allocations === 0 && deployment.resources?.pending === 0;
+  const canEdit = fresh && !deployment.reset;
   return <section className="sandbox-provider-settings form-stack" aria-labelledby="sandbox-provider-heading">
     <div className="sandbox-provider-title">
       <h2 id="sandbox-provider-heading">{t("Deployment provider")}</h2>
-      <HelpTip>
+      <HelpTip label={tNavigation("details")}>
         {t("One provider serves this deployment. Reset it before choosing a different backend.")}
         {deployment.provider === "e2b" ? ` ${t("Core creates E2B sandboxes directly. No node enrollment is needed.")} ${t("Saved configuration does not confirm execution readiness. Session and Environment state report actual execution.")}` : ""}
+        <dl className="sandbox-summary">
+      {spec?.runtime ? <div><dt>{t("Runtime")}</dt><dd><code title={spec.runtime.source_commit}>{spec.runtime.source_commit.slice(0, 12)}</code></dd></div> : null}
+      {deployment.suspension ? <div><dt>{t("Idle suspension")}</dt><dd>{t("After {{idle}} · kept {{retention}}", { idle: formatPeriod(deployment.suspension.idle_seconds, i18n.resolvedLanguage), retention: formatPeriod(deployment.suspension.retention_seconds, i18n.resolvedLanguage) })}</dd></div> : null}
+      <div><dt>{t("Allocated resources")}</dt><dd>{deployment.resources?.allocations ?? t("Unknown state")}</dd></div>
+      <div><dt>{t("Pending environments")}</dt><dd>{deployment.resources?.pending ?? t("Unknown state")}</dd></div>
+        </dl>
       </HelpTip>
     </div>
     <dl className="sandbox-summary">
       <div><dt>{t("Provider")}</dt><dd>{sandboxProviderLabel(deployment.provider, locale)}</dd></div>
       <div><dt>{t("Each sandbox")}</dt><dd>{size ? `${sizeLabel(size)}${size.root_disk_mib ? ` · ${t("Root disk {{root}} · data disk {{data}}", { root: formatBytes(size.root_disk_mib * MIB), data: formatBytes((size.environment_disk_mib ?? 0) * MIB) })}` : ""}` : MISSING}</dd></div>
-      {spec?.runtime ? <div><dt>{t("Runtime")}</dt><dd><code title={spec.runtime.source_commit}>{spec.runtime.source_commit.slice(0, 12)}</code></dd></div> : null}
-      {deployment.suspension ? <div><dt>{t("Idle suspension")}</dt><dd>{t("After {{idle}} · kept {{retention}}", { idle: formatPeriod(deployment.suspension.idle_seconds, i18n.resolvedLanguage), retention: formatPeriod(deployment.suspension.retention_seconds, i18n.resolvedLanguage) })}</dd></div> : null}
-      <div><dt>{t("Allocated resources")}</dt><dd>{deployment.resources?.allocations ?? t("Unknown state")}</dd></div>
-      <div><dt>{t("Pending environments")}</dt><dd>{deployment.resources?.pending ?? t("Unknown state")}</dd></div>
     </dl>
     {deployment.provider === "e2b" ? <div className="sandbox-cloud-summary">
       <dl className="sandbox-summary">
-        <div><dt>{t("Immutable Runtime template")}</dt><dd>{deployment.e2b?.template || t("Unknown state")}</dd></div>
         <div>
-          <dt>{t("Template build")}</dt>
+          <dt>{t("Template build")}<HelpTip>{deployment.e2b?.template || t("Unknown state")}</HelpTip></dt>
           <dd>{[
             t(buildStatusLabel[templateBuildStatus(build)]),
             ...(buildSize ? [sizeLabel(buildSize)] : []),
@@ -60,24 +69,25 @@ export function SandboxDeploymentSettings({ deployment, disabled, fresh, onReset
         <div><dt>{t("E2B credential")}</dt><dd>{t(deployment.e2b?.credential_configured ? "Configured" : "Not configured")}</dd></div>
       </dl>
     </div> : null}
+    <SandboxRolloutSummary deployment={deployment} stale={!fresh} />
     {!deployment.reset ? <>
       <div className="sandbox-actions">
-        <button type="button" className="button outline" disabled={disabled || !clean || changing} onClick={() => setChanging(true)}>{t("Change resources")}</button>
-        <HelpTip>{t("Editing keeps the current provider and requires zero allocated resources and pending environments. It is not an online upgrade.")}</HelpTip>
+        <button type="button" className="button outline" disabled={disabled || !canEdit || changing} onClick={() => { setEditKey((key) => key + 1); setChanging(true); }}>{t("Change resources")}</button>
+        <HelpTip>{t("Changes keep this backend and existing Sessions and nodes. Core prepares the new target for future work; placement may continue on qualified earlier generations.")}</HelpTip>
       </div>
-      {!clean ? <p>{t("Changes require Core to confirm that no hosted resources remain.")}</p> : null}
-      {changing ? <>
+
+      <Modal open={changing} title={t("Change resources")} wide onClose={() => { if (!pending) setChanging(false); }} footer={<><RefreshButton onClick={onRefresh} refreshing={refreshing} disabled={pending} label={t("Refresh sandbox state")} /><button type="button" className="button outline" disabled={pending} onClick={() => setChanging(false)}>{t("Cancel editing")}</button></>}>
         <SandboxSetupWizard
+          key={editKey}
           coreUrl={deployment.core_url}
           expectedGeneration={deployment.generation}
           current={deployment.provider ? { provider: deployment.provider, specification: deployment.specification, e2bTemplate: deployment.e2b?.template } : undefined}
-          disabled={disabled || !clean}
+          disabled={disabled || !canEdit}
           editing
-          onSubmit={onUpdate}
+          onSubmit={async (input) => { if (await onUpdate(input)) setChanging(false); }}
         />
-        <p>{t(deployment.provider === "e2b" ? "Saving changes only this provider's configuration; it does not confirm execution readiness." : "Saving retires existing node identities and enrollment commands. Add the nodes again after saving.")}</p>
-        <button type="button" className="button outline" disabled={disabled} onClick={() => setChanging(false)}>{t("Cancel")}</button>
-      </> : null}
+        {writeFailure}
+      </Modal>
     </> : null}
     <SandboxResetControls deployment={deployment} disabled={disabled || (changing && !deployment.reset)} stale={!fresh} onStart={onReset} onCancel={onCancelReset} />
   </section>;
diff --git a/apps/web/src/features/sandbox/SandboxManagerView.css b/apps/web/src/features/sandbox/SandboxManagerView.css
index 3eeeb1eef..fd37909b0 100644
--- a/apps/web/src/features/sandbox/SandboxManagerView.css
+++ b/apps/web/src/features/sandbox/SandboxManagerView.css
@@ -110,3 +110,15 @@
 .sandbox-reset-options > label:not(.field) { display: flex; align-items: center; gap: 8px; }
 .sandbox-reset-options input[type="number"] { max-width: 180px; }
 .sandbox-reset-dialog p { line-height: 1.6; }
+
+/* Shared rollout summaries keep target facts ahead of the secondary node partition. */
+.sandbox-rollout { min-width: 0; gap: 12px; }
+.sandbox-rollout h3 { margin: 0; font-size: 13px; font-weight: 600; }
+.sandbox-rollout p { margin: 0; font-size: 13px; color: var(--fg-muted); }
+.sandbox-rollout > .text-action { align-self: flex-start; }
+.sandbox-rollout-compact .sandbox-summary { display: flex; flex-wrap: wrap; gap: 8px 24px; }
+.sandbox-rollout-compact .sandbox-summary > div { display: flex; align-items: baseline; gap: 6px; }
+.sandbox-rollout-compact .sandbox-summary dt { margin: 0; }
+.sandbox-rollout-nodes { border-top: 1px solid var(--line); padding-top: 12px; }
+
+.node-statuses { display: grid; gap: 4px; }
diff --git a/apps/web/src/features/sandbox/SandboxManagerView.tsx b/apps/web/src/features/sandbox/SandboxManagerView.tsx
index b6fcc0c7e..003414a27 100644
--- a/apps/web/src/features/sandbox/SandboxManagerView.tsx
+++ b/apps/web/src/features/sandbox/SandboxManagerView.tsx
@@ -1,23 +1,20 @@
 import { useCallback, useEffect, useRef, useState, type ReactNode, type RefObject } from "react";
-import { type InitializeSandboxDeployment, type SandboxDeployment, type SandboxNode, type StartSandboxReset } from "@agents-core-web/agents-client";
-import { useQuery, useQueryClient } from "@tanstack/react-query";
+import { type SandboxNode } from "@agents-core-web/agents-client";
+import { useQueryClient } from "@tanstack/react-query";
 import { ArrowLeft, Pencil, Plus, Server, Trash2 } from "lucide-react";
 import { useTranslation } from "react-i18next";
 import { ConfirmDialog } from "../../components/ConfirmDialog";
 import { EmptyState, HelpTip, RefreshButton } from "../../components/console-ui";
-import { ErrorDialog } from "../../components/ErrorDialog";
 import { ErrorState } from "../../components/ErrorState";
 import { useFailureToast, useToast } from "../../components/Toast";
 import { useConsoleIntent, useConsoleNavigation } from "../../lib/console-navigation";
 import { InstallationNotice } from "../../components/InstallationNotice";
 import { installationQuery } from "../../lib/installation";
-import { sandboxConfigurationRejection, sandboxRequestError, sandboxWriteUncertain } from "../../lib/sandbox-labels";
+import { sandboxRequestError } from "../../lib/sandbox-labels";
 import type { SandboxConsoleConfig } from "./console-config";
-import { sandboxAdmin, sandboxConsoleConfigQuery } from "./sandbox-queries";
-import { useSandboxManagerState } from "./use-sandbox-manager-state";
-import { writeSandboxDeployment } from "./sandbox-deployment-write";
-import { SandboxSetupWizard } from "./SandboxSetupWizard";
-import { SandboxDeploymentSettings } from "./SandboxDeploymentSettings";
+import { sandboxAdmin } from "./sandbox-queries";
+import { useSandboxPageState } from "./use-sandbox-page-state";
+import { SandboxPageAccess } from "./SandboxPageAccess";
 import { NodeEnrollment } from "./NodeEnrollment";
 import { NodeList, onOldAddress } from "./NodeList";
 import { NodeDetail } from "./NodeDetail";
@@ -26,53 +23,40 @@ import { NodeCleanupDialog, type NodeCleanup } from "./NodeCleanupDialog";
 import { sandboxSize } from "./deployment-specification";
 import "./SandboxManagerView.css";
 
-/** Nodes: the deployment provider, the node list and one node's detail (`#nodes?id=…`). */
+/** Nodes owns node enrollment, the list and individual node management. */
 export function SandboxManagerView() {
   const { i18n } = useTranslation("sandbox");
   const locale = i18n.resolvedLanguage?.startsWith("zh") ? "zh" : "en";
   return <section className="page-section console-page sandbox-manager sandbox-manager-page" lang={locale}>
-    <SandboxAccess />
+    <SandboxPageAccess header={<NodesPageHeader />}>{(config) => <SandboxManager consoleConfig={config} />}</SandboxPageAccess>
   </section>;
 }
 
-/** The page header; an E2B deployment has no machines, so the page is its sandbox backend. */
-function NodesPageHeader({ title, count, back, actions, cloud = false, headingRef }: { title?: ReactNode; count?: number; back?: () => void; actions?: ReactNode; cloud?: boolean; headingRef?: RefObject<HTMLHeadingElement | null> }) {
+/** Node list and node detail share one header. */
+function NodesPageHeader({ title, count, back, actions, headingRef }: { title?: ReactNode; count?: number; back?: () => void; actions?: ReactNode; headingRef?: RefObject<HTMLHeadingElement | null> }) {
   const { t } = useTranslation("sandbox");
   return <header className="page-header">
     <div className="console-page-heading">
       {back ? <button type="button" className="icon-button ghost back-button" aria-label={t("Back")} title={t("Back")} onClick={back}><ArrowLeft size={16} strokeWidth={1.6} aria-hidden="true" /></button> : null}
-      <h1 ref={headingRef} tabIndex={headingRef ? -1 : undefined}>{title ?? t(cloud ? "Sandbox backend" : "Nodes")}</h1>
+      <h1 ref={headingRef} tabIndex={headingRef ? -1 : undefined}>{title ?? t("Nodes")}</h1>
       {count === undefined ? null : <span className="heading-count">{count}</span>}
-      {back ? null : <HelpTip>{t(cloud ? "E2B runs this deployment's sandboxes in its cloud. There are no machines to add." : "Your hosts for running sandboxes.")}</HelpTip>}
+      {back ? null : <HelpTip>{t("Your hosts for running sandboxes.")}</HelpTip>}
     </div>
     {actions ? <div className="page-actions">{actions}</div> : null}
   </header>;
 }
 
-function SandboxAccess() {
-  const { t } = useTranslation("sandbox");
-  const { data: config, isPending: checking, isFetching, isError, refetch } = useQuery(sandboxConsoleConfigQuery);
-  if (isError && config === undefined) return <><NodesPageHeader /><div className="console-page-body"><p role="alert">{t("The console configuration could not be read. Refresh to try again.")}</p><button type="button" className="button outline" disabled={isFetching} onClick={() => { void refetch(); }}>{t("Refresh sandbox state")}</button></div></>;
-  if (checking) return <><NodesPageHeader /><div className="console-page-body"><p role="status">{t("Connecting to this console's Core…")}</p></div></>;
-  if (!config?.sandbox_admin) return <><NodesPageHeader /><div className="console-page-body"><p role="alert">{t("Sandbox administration is not configured on this console.")}</p><button type="button" className="button outline" disabled={isFetching} onClick={() => { void refetch(); }}>{t("Refresh sandbox state")}</button></div></>;
-  return <SandboxManager consoleConfig={config} />;
-}
-
 function SandboxManager({ consoleConfig }: { consoleConfig: SandboxConsoleConfig }) {
   const { t, i18n } = useTranslation("sandbox");
   const locale = i18n.resolvedLanguage?.startsWith("zh") ? "zh" : "en";
   const { params, navigate, back: goBack } = useConsoleNavigation();
   const client = sandboxAdmin;
   const queryClient = useQueryClient();
-  const { ownership, deploymentQuery, query, deployment, compatible, inventoryLoading, snapshot } = useSandboxManagerState();
-  const { refetch: refetchSnapshot } = query;
-  const installation = useQuery(installationQuery);
+  const { deploymentQuery, query, compatible, inventoryOlder, inventoryLoading, snapshot, installation, loading, busy, setupNeedsRefresh, confirmed, fresh, refetch, refresh } = useSandboxPageState();
+  const { t: tSandboxNav } = useTranslation("sandboxNavigation");
   const localOnly = installation.data?.local_only === true;
   const { t: tCommon } = useTranslation("common");
-  const loading = deploymentQuery.isFetching;
   const error: unknown = deploymentQuery.error;
-  const busy = ownership.data.phase === "pending";
-  const [revision, setRevision] = useState(0);
   const [removeTarget, setRemoveTarget] = useState<SandboxNode | null>(null);
   const [editTarget, setEditTarget] = useState<SandboxNode | null>(null);
   // The Add node dialog; it stays mounted with the page so its command survives closing.
@@ -81,27 +65,6 @@ function SandboxManager({ consoleConfig }: { consoleConfig: SandboxConsoleConfig
   const [removeError, setRemoveError] = useState<string | null>(null);
   // After a removal, the host's uninstall command; it stays for the closing animation.
   const [cleanup, setCleanup] = useState<{ node: NodeCleanup; open: boolean } | null>(null);
-  // QueryClient owns this across route lifetimes. Only a successful authoritative
-  // read begun after settlement releases uncertain/pending mutation ownership.
-  const setupNeedsRefresh = ownership.data.phase === "reconcile";
-  const confirmed = deployment !== undefined && !deploymentQuery.isError && ownership.data.phase === "idle";
-  // Writes additionally wait for any read in flight.
-  const fresh = confirmed && !loading;
-  // A write with an uncertain outcome opens a dialog with the reason; the error stays for the closing animation.
-  const [writeFailure, setWriteFailure] = useState<{ error: unknown; open: boolean } | null>(null);
-  const { refetch: refetchDeployment } = deploymentQuery;
-  const refetch = useCallback(async () => {
-    const result = await refetchDeployment();
-    if (!result.isError) await refetchSnapshot();
-    return result;
-  }, [refetchDeployment, refetchSnapshot]);
-  const refresh = useCallback(() => {
-    // Each refresh starts a new read (cancelling one in flight) and resets the forms, as a reload did.
-    setRevision((value) => value + 1);
-    // The wizard reads the address and config file from the installation.
-    void queryClient.invalidateQueries({ queryKey: installationQuery.queryKey });
-    return refetch();
-  }, [queryClient, refetch]);
   // The enrollment dialog's reads: the node list alone, every few seconds while it waits. It settles
   // when the read does, which the dialog waits for before calling a command expired.
   const refreshNodes = useCallback(() => refetch(), [refetch]);
@@ -111,7 +74,6 @@ function SandboxManager({ consoleConfig }: { consoleConfig: SandboxConsoleConfig
   // A refresh the administrator asks for reports its failure even while an earlier one is still unconfirmed;
   // the enrollment dialog's own repeated refreshes do not.
   const refreshByUser = () => {
-    setRevision((value) => value + 1);
     void queryClient.invalidateQueries({ queryKey: installationQuery.queryKey });
     void refetch().then((result) => {
       if (result.isError && result.data) toast.show(t("Refresh failed; showing the last loaded state."), { tone: "error", detail: sandboxRequestError(result.error, locale), key: "sandbox-read" });
@@ -122,41 +84,6 @@ function SandboxManager({ consoleConfig }: { consoleConfig: SandboxConsoleConfig
     const controller = new AbortController(); lifetime.current = controller;
     return () => { controller.abort(); lifetime.current = null; };
   }, []);
-  /** Whether Core confirmed the change. `fromWizard`: a configuration Core rejects is thrown back to the wizard that sent it. */
-  async function changeDeployment(operation: (signal: AbortSignal) => Promise<SandboxDeployment>, fromWizard = false): Promise<boolean> {
-    const controller = lifetime.current;
-    if (!controller || busy || loading || setupNeedsRefresh || !fresh) return false;
-    setWriteFailure(null);
-    try {
-      const deployment = await writeSandboxDeployment(queryClient, operation);
-      return deployment !== null && !controller.signal.aborted;
-    } catch (error) {
-      if (!controller.signal.aborted) {
-        if (fromWizard && sandboxConfigurationRejection(error) !== null) throw error;
-        if (sandboxWriteUncertain(error)) setWriteFailure({ error, open: true });
-        else toast.show(t("Core rejected the sandbox change"), { tone: "error", detail: sandboxRequestError(error, locale), key: "sandbox-write" });
-      }
-    }
-    return false;
-  }
-  /** First setup; own machines continue straight to adding the first node. */
-  async function initialize(input: InitializeSandboxDeployment) {
-    if (await changeDeployment((signal) => client.initializeDeployment(input, { signal }), true) && input.provider !== "e2b" && !localOnly) setAdding(true);
-  }
-  async function update(input: InitializeSandboxDeployment) {
-    await changeDeployment((signal) => client.updateDeployment({ ...input, expected_generation: snapshot!.deployment.generation }, { signal }), true);
-  }
-  const startReset = (input: StartSandboxReset) => changeDeployment((signal) => client.startReset(input, { signal }));
-  const cancelReset = (expectedGeneration: number) => changeDeployment((signal) => client.cancelReset(expectedGeneration, { signal }));
-  const writeDialog = <ErrorDialog
-    open={writeFailure?.open ?? false}
-    title={t("Couldn't confirm the sandbox change")}
-    action={{ label: t("Refresh sandbox state"), onClick: refreshByUser }}
-    onClose={() => setWriteFailure((failure) => failure && { ...failure, open: false })}
-  >
-    <p>{writeFailure ? sandboxRequestError(writeFailure.error, locale) : null}</p>
-    <p>{t("Refresh sandbox state to confirm whether the change was saved before submitting again.")}</p>
-  </ErrorDialog>;
   const askRemove = (node: SandboxNode) => { setRemoveError(null); setRemoveTarget(node); };
   async function remove() {
     const controller = lifetime.current;
@@ -185,7 +112,7 @@ function SandboxManager({ consoleConfig }: { consoleConfig: SandboxConsoleConfig
     } finally { if (!controller.signal.aborted) setRemoving(false); }
   }
 
-  const nodesConfirmed = confirmed && compatible && !query.isError && !snapshot?.nodesError;
+  const nodesConfirmed = confirmed && compatible && !inventoryOlder && !query.isError && !snapshot?.nodesError;
   const nodes = snapshot?.nodes ?? [];
   const allocations = snapshot?.allocations ?? [];
   const hostedNodes = Boolean(snapshot?.deployment.provider && snapshot.deployment.provider !== "e2b");
@@ -206,6 +133,7 @@ function SandboxManager({ consoleConfig }: { consoleConfig: SandboxConsoleConfig
   const status = <>
     <InstallationNotice installation={installation.data} />
     {!snapshot && (loading || deploymentQuery.isPending) ? <p role="status">{t("Loading sandbox state…")}</p> : null}
+    {inventoryOlder ? <p role="status" className="sandbox-notice">{t("Node observations are from an earlier configuration generation. Refreshing does not change their owned sandboxes.")}</p> : null}
     {snapshot?.nodesError ? <ErrorState title={t("Node state could not be read")} detail={sandboxRequestError(snapshot.nodesError, locale)} onRetry={refresh} /> : null}
     {snapshot && deploymentQuery.isError ? <p role="alert" className="sandbox-error">{t("Refresh failed; showing the last loaded state.")}</p> : null}
     {setupNeedsRefresh ? <p role="alert" className="sandbox-error">{t("Refresh sandbox state to confirm whether the change was saved before submitting again.")}</p> : null}
@@ -250,13 +178,12 @@ function SandboxManager({ consoleConfig }: { consoleConfig: SandboxConsoleConfig
       />
       <div className="console-page-body sandbox-content">
         {status}
-        {selected ? <NodeDetail node={selected} allocations={allocations} coreUrl={snapshot?.deployment.core_url ?? ""} stale={!nodesConfirmed} suspension={snapshot?.deployment.suspension ?? null} /> : snapshot && nodesConfirmed && !loading ? (
+        {selected ? <NodeDetail node={selected} allocations={allocations} coreUrl={snapshot?.deployment.core_url ?? ""} targetGeneration={snapshot?.deployment.generation} stale={!nodesConfirmed} suspension={snapshot?.deployment.suspension ?? null} /> : snapshot && nodesConfirmed && !loading ? (
           <EmptyState icon={Server} title={t("Node not found")} hint={t("This node is not registered. It may have been removed.")} action={<button type="button" className="button outline" onClick={back}>{t("Back")}</button>} />
         ) : null}
       </div>
       {dialog}
       {cleanupDialog}
-      {writeDialog}
       <NodeEditDialog
         key={editTarget?.id ?? "closed"}
         client={client}
@@ -278,20 +205,21 @@ function SandboxManager({ consoleConfig }: { consoleConfig: SandboxConsoleConfig
 
   const actions = <>
     {localOnly && hostedNodes ? <span id="add-node-blocked" className="muted">{tCommon("installationNotice.addBlocked")}</span> : null}
+    {hostedNodes ? <button className="button outline" type="button" onClick={() => navigate("system", { id: "sandbox" })}>{tSandboxNav("open")}</button> : null}
     {refreshButton}
     {hostedNodes && snapshot ? <button type="button" className="button primary" disabled={busy || loading || !fresh || !nodesConfirmed || Boolean(snapshot.deployment.reset) || localOnly} aria-describedby={localOnly ? "add-node-blocked" : undefined} onClick={() => setAdding(true)}><Plus size={16} />{t("Add node")}</button> : null}
   </>;
   return <>
     {enrollment}
-    <NodesPageHeader headingRef={heading} count={hostedNodes && nodesConfirmed ? nodes.length : undefined} actions={actions} cloud={snapshot?.deployment.provider === "e2b"} />
+    <NodesPageHeader headingRef={heading} count={hostedNodes && nodesConfirmed ? nodes.length : undefined} actions={actions} />
     <div className="console-page-body sandbox-content">
       {status}
-      {snapshot && !snapshot.deployment.provider && !snapshot.deployment.reset ? <SandboxSetupWizard key={`${snapshot.deployment.generation}:${revision}`} coreUrl={snapshot.deployment.core_url} expectedGeneration={snapshot.deployment.generation} disabled={busy || loading || setupNeedsRefresh || error !== null} onSubmit={initialize} /> : null}
+      {snapshot && !hostedNodes ? <EmptyState icon={Server} title={tSandboxNav(snapshot.deployment.provider === "e2b" ? "cloud" : "unconfigured")} action={<button className="button outline" type="button" onClick={() => navigate("system", { id: "sandbox" })}>{tSandboxNav("open")}</button>} /> : null}
+      {snapshot?.deployment.reset && hostedNodes ? <p role="status">{tSandboxNav("reset")}</p> : null}
       {snapshot?.deployment.provider ? <>
         {staleNodes.length ? <p className="sandbox-notice sandbox-address-warning" role="status">{staleNodes.length === 1
           ? t("{{name}} is still bound to an old Core address. Remove it and add it again.", { name: staleNodes[0] })
           : t("{{count}} nodes are still bound to an old Core address: {{names}}. Remove them and add them again.", { count: staleNodes.length, names: new Intl.ListFormat(i18n.resolvedLanguage, { type: "conjunction" }).format(staleNodes) })}</p> : null}
-        <SandboxDeploymentSettings key={`${snapshot.deployment.generation}:${revision}`} deployment={snapshot.deployment} fresh={confirmed} disabled={busy || loading || !fresh || setupNeedsRefresh} onReset={startReset} onCancelReset={cancelReset} onUpdate={update} />
         {hostedNodes ? <section aria-label={t("Sandbox nodes")}>
           {nodes.length
             ? <NodeList nodes={nodes} allocations={allocations} coreUrl={snapshot.deployment.core_url} stale={!nodesConfirmed} disabled={busy || loading || removing || !nodesConfirmed} suspends={snapshot.deployment.provider === "microsandbox"} onOpen={(node) => navigate("nodes", { id: node.id })} onRemove={askRemove} />
@@ -301,6 +229,5 @@ function SandboxManager({ consoleConfig }: { consoleConfig: SandboxConsoleConfig
     </div>
     {dialog}
     {cleanupDialog}
-    {writeDialog}
   </>;
 }
diff --git a/apps/web/src/features/sandbox/SandboxPageAccess.tsx b/apps/web/src/features/sandbox/SandboxPageAccess.tsx
new file mode 100644
index 000000000..277d8867b
--- /dev/null
+++ b/apps/web/src/features/sandbox/SandboxPageAccess.tsx
@@ -0,0 +1,15 @@
+import type { ReactNode } from "react";
+import { useQuery } from "@tanstack/react-query";
+import { useTranslation } from "react-i18next";
+import type { SandboxConsoleConfig } from "./console-config";
+import { sandboxConsoleConfigQuery } from "./sandbox-queries";
+
+/** Both sandbox pages use the same console capability gate. */
+export function SandboxPageAccess({ header, children }: { header: ReactNode; children: (config: SandboxConsoleConfig) => ReactNode }) {
+  const { t } = useTranslation("sandbox");
+  const { data: config, isPending: checking, isFetching, isError, refetch } = useQuery(sandboxConsoleConfigQuery);
+  if (isError && config === undefined) return <>{header}<div className="console-page-body"><p role="alert">{t("The console configuration could not be read. Refresh to try again.")}</p><button type="button" className="button outline" disabled={isFetching} onClick={() => { void refetch(); }}>{t("Refresh sandbox state")}</button></div></>;
+  if (checking) return <>{header}<div className="console-page-body"><p role="status">{t("Connecting to this console's Core…")}</p></div></>;
+  if (!config?.sandbox_admin) return <>{header}<div className="console-page-body"><p role="alert">{t("Sandbox administration is not configured on this console.")}</p><button type="button" className="button outline" disabled={isFetching} onClick={() => { void refetch(); }}>{t("Refresh sandbox state")}</button></div></>;
+  return children(config);
+}
diff --git a/apps/web/src/features/sandbox/SandboxResetControls.tsx b/apps/web/src/features/sandbox/SandboxResetControls.tsx
index 2ba4c8fad..ba67215de 100644
--- a/apps/web/src/features/sandbox/SandboxResetControls.tsx
+++ b/apps/web/src/features/sandbox/SandboxResetControls.tsx
@@ -4,6 +4,7 @@ import { useTranslation } from "react-i18next";
 import { HelpTip } from "../../components/console-ui";
 import { Modal } from "../../components/Modal";
 import { formatDateTime, formatInteger } from "../../lib/format";
+import "./reset-confirmation.css";
 import { validResetDeadline } from "./sandbox-reset";
 
 type Action = "start" | "force" | "cancel";
@@ -34,11 +35,15 @@ export function SandboxResetControls({ deployment, disabled, stale, onStart, onC
     if (!dialog || blocked) return;
     setSubmitting(true);
     try {
-      const confirmed = dialog.action === "cancel"
-        ? await onCancel(dialog.generation)
-        : await onStart({ expected_generation: dialog.generation, clear: dialog.action === "force" ? "force" : clear, ...(dialog.action === "start" && clear === "auto" ? { deadline_seconds: Number(deadline) } : {}) });
-      if (confirmed) setDialog(null);
-    } finally { setSubmitting(false); }
+      await (dialog.action === "cancel"
+        ? onCancel(dialog.generation)
+        : onStart({ expected_generation: dialog.generation, clear: dialog.action === "force" ? "force" : clear, ...(dialog.action === "start" && clear === "auto" ? { deadline_seconds: Number(deadline) } : {}) }));
+    } finally {
+      // A submitted confirmation is consumed even if its outcome is uncertain.
+      // The shared write owner and error dialog govern reconciliation and retry.
+      setDialog(null);
+      setSubmitting(false);
+    }
   }
   const title = t(dialog?.action === "cancel" ? "Cancel reset?" : dialog?.action === "force" ? "Force reset now?" : "Reset sandbox deployment?");
   const label = t(dialog?.action === "cancel" ? "Cancel reset" : dialog?.action === "force" ? "Force reset now" : "Reset deployment");
@@ -71,19 +76,16 @@ export function SandboxResetControls({ deployment, disabled, stale, onStart, onC
     </>}>
       <div className="confirm-dialog-body sandbox-reset-dialog">
         {dialog?.action === "cancel" ? <p>{t("Stop the reset and allow new hosted Sessions again. Sessions already archived stay archived and cannot be resumed.")}</p> : <>
-          <p>{t("Reset archives this deployment's hosted Sessions. Archived Sessions cannot be resumed. History, Files and Artifacts are kept; self-hosted Sessions are unchanged.")}</p>
-          <p>{t("Unsaved workspace contents may be lost.")}</p>
-          <p>{t("After cleanup, Core clears the provider and saved E2B credential, retires nodes and enrollment commands, and returns to setup.")}</p>
+          <p>{t("Hosted Sessions will be archived permanently. Deployment configuration and node registrations will be cleared. Unsaved workspace contents may be lost.")} <HelpTip label={t("What reset affects")}>{t("Reset archives this deployment's hosted Sessions. Archived Sessions cannot be resumed. History, Files and Artifacts are kept; self-hosted Sessions are unchanged.")} {t("After cleanup, Core clears the provider and saved E2B credential, retires nodes and enrollment commands, and returns to setup.")}</HelpTip></p>
           {dialog?.action === "force" ? <p>{t("Force immediately cancels remaining work. Offline resources can still block cleanup.")}</p> : <fieldset className="sandbox-reset-options" disabled={submitting || disabled}>
             <legend>{t("Clear hosted work")}</legend>
-            <label><input type="radio" name={`${id}-clear`} value="auto" checked={clear === "auto"} onChange={() => setClear("auto")} />{t("Auto — let busy work finish")}</label>
-            <p>{t("Idle, suspended and queued Sessions are archived immediately. Running or waiting Turns and file writes may finish until the deadline; then Core forces the rest.")}</p>
+            <div className="sandbox-reset-choice"><label><input type="radio" name={`${id}-clear`} value="auto" checked={clear === "auto"} onChange={() => setClear("auto")} />{t("Auto — let busy work finish")}</label><HelpTip label={t("How automatic reset works")}>{t("Idle, suspended and queued Sessions are archived immediately. Running or waiting Turns and file writes may finish until the deadline; then Core forces the rest.")}</HelpTip></div>
+            <div className="sandbox-reset-choice"><label><input type="radio" name={`${id}-clear`} value="force" checked={clear === "force"} onChange={() => setClear("force")} />{t("Force — cancel remaining work now")}</label><HelpTip>{t("Force immediately cancels remaining work. Offline resources can still block cleanup.")}</HelpTip></div>
             {clear === "auto" ? <label className="field" htmlFor={`${id}-deadline`}>
-              <span>{t("Force remaining work after (seconds)")}<HelpTip>{t("Default: 1 hour. Choose a whole number from 300 to 86400 seconds (5 minutes to 24 hours).")}</HelpTip></span>
+              <span>{t("Wait before forcing (seconds)")}<HelpTip>{t("Default: 1 hour. Choose a whole number from 300 to 86400 seconds (5 minutes to 24 hours).")}</HelpTip></span>
               <input id={`${id}-deadline`} type="number" min={300} max={86400} step={1} value={deadline} onChange={(event) => setDeadline(event.target.value)} aria-invalid={!validResetDeadline(deadline)} />
               {!validResetDeadline(deadline) ? <span role="alert" className="field-error">{t("Enter a whole number from 300 to 86400 seconds.")}</span> : null}
             </label> : null}
-            <label><input type="radio" name={`${id}-clear`} value="force" checked={clear === "force"} onChange={() => setClear("force")} />{t("Force — cancel remaining work now")}</label>
             {clear === "force" ? <p>{t("Force immediately cancels remaining work. Offline resources can still block cleanup.")}</p> : null}
           </fieldset>}
         </>}
diff --git a/apps/web/src/features/sandbox/SandboxRolloutSummary.css b/apps/web/src/features/sandbox/SandboxRolloutSummary.css
new file mode 100644
index 000000000..d391aa1bf
--- /dev/null
+++ b/apps/web/src/features/sandbox/SandboxRolloutSummary.css
@@ -0,0 +1,10 @@
+.sandbox-rollout-row { display: flex; align-items: center; gap: 16px; flex-wrap: wrap; min-width: 0; }
+.sandbox-rollout-row h3 { margin: 0; font-size: 13px; font-weight: 600; }
+.sandbox-rollout-row > .text-action { margin-left: auto; }
+.sandbox-rollout-detail { display: grid; gap: 16px; }
+.sandbox-rollout-detail-status { display: flex; align-items: center; gap: 6px; flex-wrap: wrap; }
+.sandbox-rollout-facts { margin: 0; }
+.sandbox-rollout-facts > div { display: flex; align-items: baseline; justify-content: space-between; gap: 20px; padding: 12px 0; border-bottom: 1px solid var(--line); }
+.sandbox-rollout-facts > div:last-child { border-bottom: 0; }
+.sandbox-rollout-facts dt { display: flex; align-items: center; gap: 4px; font-size: 13px; color: var(--ink-muted); }
+.sandbox-rollout-facts dd { margin: 0; font-size: 13px; font-variant-numeric: tabular-nums; color: var(--ink); }
diff --git a/apps/web/src/features/sandbox/SandboxRolloutSummary.test.tsx b/apps/web/src/features/sandbox/SandboxRolloutSummary.test.tsx
new file mode 100644
index 000000000..45751c532
--- /dev/null
+++ b/apps/web/src/features/sandbox/SandboxRolloutSummary.test.tsx
@@ -0,0 +1,62 @@
+import type { SandboxDeployment } from "@agents-core-web/agents-client";
+import { renderToStaticMarkup } from "react-dom/server";
+import { describe, expect, it } from "vitest";
+import { node } from "../overview/test-fixtures";
+import { SandboxRolloutSummary } from "./SandboxRolloutSummary";
+import { NodeRolloutStatus } from "./NodeRolloutStatus";
+import { SandboxDeploymentSettings } from "./SandboxDeploymentSettings";
+
+const deployment: SandboxDeployment = { installation_id: "i", owner_epoch: 1, generation: 4, provider: "docker", mode: "nodes", core_url: "https://core.example", resources: { allocations: 8, pending: 2 }, reset: null, suspension: null,
+  rollout: { state: "settled", previous_generation_sandboxes: 8, nodes: { ready: 1, preparing: 0, failed: 2, update_required: 3, unknown: 4 } } };
+
+describe("authoritative configuration rollout", () => {
+  it("keeps attention visible while moving detailed counts off the main page", () => {
+    const html = renderToStaticMarkup(<SandboxRolloutSummary deployment={deployment} />);
+    expect(html).toContain("Needs attention");
+    expect(html).toContain("View rollout details");
+    expect(html).not.toContain("<dl");
+    expect(html).not.toContain("Target generation");
+    expect(html).not.toContain("Previous-generation sandboxes");
+    expect(html).not.toContain("Review affected nodes");
+    expect(html).not.toContain("No active preparation");
+  });
+
+  it("makes stale state explicit instead of repeating the last preparation state", () => {
+    const html = renderToStaticMarkup(<SandboxRolloutSummary deployment={{ ...deployment, rollout: { ...deployment.rollout, state: "preparing" } }} stale />);
+    expect(html).toContain('role="alert"');
+    expect(html).toContain("Rollout state unconfirmed");
+    expect(html).not.toContain("Preparing configuration");
+  });
+
+  it("does not call settled nodes ready when Core reports unknown target readiness", () => {
+    const html = renderToStaticMarkup(<SandboxRolloutSummary deployment={{ ...deployment, rollout: { ...deployment.rollout, nodes: { ready: 2, preparing: 0, failed: 0, update_required: 0, unknown: 1 } } }} compact />);
+    expect(html).toContain("Target readiness unknown");
+    expect(html).not.toContain("No active preparation");
+    expect(html).not.toContain("Ready for target");
+  });
+
+  it("reports preparing and settled without turning settled into readiness", () => {
+    const quiet = { ...deployment, rollout: { state: "settled" as const, previous_generation_sandboxes: 0, nodes: { ready: 2, preparing: 0, failed: 0, update_required: 0, unknown: 0 } } };
+    expect(renderToStaticMarkup(<SandboxRolloutSummary deployment={quiet} compact />)).toContain("No active preparation");
+    expect(renderToStaticMarkup(<SandboxRolloutSummary deployment={{ ...quiet, rollout: { ...quiet.rollout, state: "preparing" } }} />)).toContain("Preparing configuration");
+    expect(renderToStaticMarkup(<SandboxRolloutSummary deployment={{ ...quiet, provider: "" }} />)).toBe("");
+  });
+
+  it("never promotes an offline durable serving pin into ready target status", () => {
+    const pinned = { ...node("offline"), online: false, rollout: { state: "ready" as const, ready_generation: 4 } };
+    const html = renderToStaticMarkup(<NodeRolloutStatus node={pinned} />);
+    expect(html).toContain("Target readiness unknown");
+    expect(html).not.toContain("Ready for target");
+    expect(renderToStaticMarkup(<NodeRolloutStatus node={{ ...pinned, online: true }} stale />)).toContain("Target readiness unknown");
+  });
+
+  it("allows same-provider online editing with held resources but keeps reset active as a boundary", () => {
+    const render = (value: SandboxDeployment) => renderToStaticMarkup(<SandboxDeploymentSettings deployment={value} fresh disabled={false} onReset={async () => true} onCancelReset={async () => true} onUpdate={async () => true} onRefresh={() => undefined} refreshing={false} pending={false} />);
+    const html = render(deployment);
+    expect(html).toMatch(/<button[^>]*class="button outline"[^>]*>Change resources<\/button>/);
+    expect(html).not.toMatch(/<button[^>]*disabled[^>]*>Change resources<\/button>/);
+    expect(html).not.toContain("Add the nodes again after saving");
+    const reset = { clear: "force" as const, requested_at: "2026-09-27T10:00:00Z", deadline_at: null, forced_at: "2026-09-27T10:00:00Z", remaining: { busy: 0, idle: 0, cleanup: 1, on_offline_nodes: 0, offline_nodes: [] } };
+    expect(render({ ...deployment, reset })).not.toContain("Change resources");
+  });
+});
diff --git a/apps/web/src/features/sandbox/SandboxRolloutSummary.tsx b/apps/web/src/features/sandbox/SandboxRolloutSummary.tsx
new file mode 100644
index 000000000..e2a7abc46
--- /dev/null
+++ b/apps/web/src/features/sandbox/SandboxRolloutSummary.tsx
@@ -0,0 +1,51 @@
+import type { SandboxDeployment } from "@agents-core-web/agents-client";
+import { useId, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { HelpTip, StatusDot, type Tone } from "../../components/console-ui";
+import { Modal } from "../../components/Modal";
+import { formatInteger } from "../../lib/format";
+import "./SandboxRolloutSummary.css";
+
+/** Core's projection is authoritative; node lists never establish rollout completion. */
+export function SandboxRolloutSummary({ deployment, stale = false, onOpen }: { deployment: SandboxDeployment; stale?: boolean; compact?: boolean; onOpen?: () => void }) {
+  const { t, i18n } = useTranslation("sandbox");
+  const id = useId();
+  const [open, setOpen] = useState(false);
+  if (!deployment.provider || deployment.reset) return null;
+  const { rollout } = deployment;
+  const needsAttention = !!rollout.nodes && (rollout.nodes.failed > 0 || rollout.nodes.update_required > 0);
+  const unknown = !!rollout.nodes && rollout.nodes.unknown > 0;
+  const label = stale ? "Rollout state unconfirmed" : needsAttention ? "Needs attention" : unknown ? "Target readiness unknown" : rollout.state === "preparing" ? "Preparing configuration" : "No active preparation";
+  const tone: Tone = stale || needsAttention || unknown ? "warning" : rollout.state === "preparing" ? "pending" : "neutral";
+  const count = (value: number) => formatInteger(value, i18n.resolvedLanguage);
+  return <>
+    <section className="sandbox-rollout-row" aria-labelledby={id}>
+      <h3 id={id}>{t("Configuration rollout")}</h3>
+      <span role={stale ? "alert" : "status"}><StatusDot tone={tone} label={t(label)} /></span>
+      <button type="button" className="text-action" onClick={() => setOpen(true)}>{t("View rollout details")}</button>
+    </section>
+    <Modal open={open} title={t("Configuration rollout")} onClose={() => setOpen(false)} footer={onOpen ? <button type="button" className="button outline" onClick={() => { setOpen(false); onOpen(); }}>{t("Review nodes")}</button> : undefined}>
+      <div className="sandbox-rollout-detail">
+        <div className="sandbox-rollout-detail-status">
+          <StatusDot tone={tone} label={t(label)} />
+          <HelpTip>
+            {t(stale ? "Rollout state is unconfirmed. These are the last confirmed observations." : rollout.state === "settled" ? "Core reports no active preparation. This does not mean every node is ready." : "Core is preparing the target configuration.")}
+            {needsAttention || unknown ? ` ${t("Review affected nodes for preparation errors, incompatible node software or an unconfirmed connection. Qualified earlier generations may still serve work.")}` : null}
+          </HelpTip>
+        </div>
+        <dl className="sandbox-rollout-facts">
+          <div><dt>{t("Core preparation")}</dt><dd>{t(rollout.state === "preparing" ? "Preparing configuration" : "No active preparation")}</dd></div>
+          <div><dt>{t("Target generation")}<HelpTip>{t("Existing sandboxes keep their configuration generation. Saving does not move them or prove the target is ready.")}</HelpTip></dt><dd>{count(deployment.generation)}</dd></div>
+          <div><dt>{t("Previous-generation sandboxes")}</dt><dd>{count(rollout.previous_generation_sandboxes)}</dd></div>
+          {rollout.nodes ? <>
+            <div><dt>{t("Ready for target")}</dt><dd>{count(rollout.nodes.ready)}</dd></div>
+            <div><dt>{t("Preparing target")}</dt><dd>{count(rollout.nodes.preparing)}</dd></div>
+            <div><dt>{t("Preparation failed")}</dt><dd>{count(rollout.nodes.failed)}</dd></div>
+            <div><dt>{t("Node software incompatible")}</dt><dd>{count(rollout.nodes.update_required)}</dd></div>
+            <div><dt>{t("Target readiness unknown")}</dt><dd>{count(rollout.nodes.unknown)}</dd></div>
+          </> : null}
+        </dl>
+      </div>
+    </Modal>
+  </>;
+}
diff --git a/apps/web/src/features/sandbox/SandboxSetupWizard.tsx b/apps/web/src/features/sandbox/SandboxSetupWizard.tsx
index 8ab6f9a43..0a35f2977 100644
--- a/apps/web/src/features/sandbox/SandboxSetupWizard.tsx
+++ b/apps/web/src/features/sandbox/SandboxSetupWizard.tsx
@@ -1,4 +1,4 @@
-import type { InitializeSandboxDeployment, SandboxProvider, SandboxResources, SandboxRuntimeRelease, SandboxSpecification } from "@agents-core-web/agents-client";
+import { AgentCoreError, type InitializeSandboxDeployment, type UpdateSandboxDeployment, type SandboxProvider, type SandboxResources, type SandboxRuntimeRelease, type SandboxSpecification } from "@agents-core-web/agents-client";
 import { useQuery } from "@tanstack/react-query";
 import { AnimatePresence } from "motion/react";
 import * as m from "motion/react-m";
@@ -10,11 +10,13 @@ import { useTranslation } from "react-i18next";
 import { HelpTip } from "../../components/console-ui";
 import { Modal } from "../../components/Modal";
 import { CopyableId } from "../../components/list-ui";
+import { coreFieldError } from "../../lib/core-error";
 import { formatBytes } from "../../lib/format";
 import { installationQuery } from "../../lib/installation";
 import type { MessageKey } from "../../lib/locale-strings";
 import { sandboxConfigurationRejection } from "../../lib/sandbox-labels";
 import { defaultSandboxResources, distributionRuntime, savedSpecification, validSandboxResources } from "./deployment-specification";
+import { e2bKeyReady, e2bUpdateSelection } from "./sandbox-update";
 import { isRuntimeRelease, isRuntimeReleaseField, RUNTIME_RELEASE_FIELDS } from "./runtime-release";
 import "./sandbox-wizard.css";
 
@@ -70,23 +72,23 @@ function presetOf(provider: SandboxProvider, resources: SandboxResources): Prese
  * release comes from this console's distribution manifest when it serves one.
  * `current` pre-selects the saved choices when a deployment changes. Keeping
  * the backend keeps its saved size and Runtime; another backend starts from its
- * defaults and this console's Runtime. An E2B key must be entered again.
+ * defaults and this console's Runtime. E2B updates can retain the saved key.
  * Docker isolates less than microsandbox, so choosing it takes a confirmation,
  * once per wizard session; a saved Docker deployment has already made it.
  * Core's address is config.json's `public_url`: the review only shows it, and
  * a configuration Core rejects for it is explained here, where it was saved.
  */
-export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disabled, editing = false, onSubmit }: {
-  /** The deployment's read-only Core address. */
+type WizardProps = {
   coreUrl: string;
   expectedGeneration: number;
   current?: { provider: SandboxProvider; specification?: SandboxSpecification; e2bTemplate?: string };
   disabled: boolean;
-  /** PR-R edits only the saved provider; changing backend requires reset first. */
-  editing?: boolean;
-  onSubmit: (input: InitializeSandboxDeployment) => Promise<void>;
-}) {
-  const { t } = useTranslation("sandbox");
+} & ({ editing: true; onSubmit: (input: UpdateSandboxDeployment) => Promise<void> } |
+  { editing?: false; onSubmit: (input: InitializeSandboxDeployment) => Promise<void> });
+
+export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disabled, editing, onSubmit }: WizardProps) {
+  const { t, i18n } = useTranslation("sandbox");
+  const { t: tCommon } = useTranslation("common");
   const id = useId();
   const [step, setStep] = useState<Step>(editing ? current?.provider === "e2b" ? "e2b" : "size" : "where");
   const [where, setWhere] = useState<Where | null>(current ? (current.provider === "e2b" ? "direct" : "nodes") : null);
@@ -95,6 +97,7 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
   const [resources, setResources] = useState<SandboxResources>(current?.specification?.resources ?? defaultSandboxResources("docker"));
   const [size, setSize] = useState<Size>(current?.specification ? presetOf(current.provider, current.specification.resources) ?? "current" : "standard");
   const [apiKey, setApiKey] = useState("");
+  const [replacementRequested, setReplacementRequested] = useState(false);
   const [template, setTemplate] = useState(current?.e2bTemplate ?? "");
   const [runtime, setRuntime] = useState<Partial<SandboxRuntimeRelease>>({});
   const [busy, setBusy] = useState(false);
@@ -103,6 +106,10 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
   const keepMicrosandbox = useRef<HTMLButtonElement>(null);
   // Core's reason for rejecting the saved configuration, such as E2B with a loopback public_url.
   const [rejection, setRejection] = useState<string | null>(null);
+  const [fieldRejection, setFieldRejection] = useState<unknown>(null);
+  const fieldError = (param: string) => coreFieldError(fieldRejection, param, tCommon);
+  const [resetRequired, setResetRequired] = useState(false);
+  const [addressRejected, setAddressRejected] = useState(false);
   const installation = useQuery(installationQuery);
   const address = coreUrl || installation.data?.public_url || null;
   const configuration = installation.data?.configuration ?? null;
@@ -114,8 +121,9 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
 
   const needsRuntime = provider === "docker" || provider === "microsandbox";
   const runtimeReady = !needsRuntime || isRuntimeRelease(release);
-  // Core keeps no key across a change: E2B always needs one.
-  const e2bReady = provider !== "e2b" || (apiKey.trim().length > 0 && validTemplate(template.trim()));
+  // Initial setup requires a key; an update may retain the committed key.
+  const keyReady = e2bKeyReady(Boolean(editing), replacementRequested, apiKey);
+  const e2bReady = provider !== "e2b" || (keyReady && validTemplate(template.trim()));
   // Core sizes E2B sandboxes from the template build, so E2B sends no resources.
   const sized = provider !== null && provider !== "e2b";
   const sizeReady = provider !== null && (!sized || validSandboxResources(provider, resources));
@@ -147,20 +155,27 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
   async function save(event?: FormEvent) {
     event?.preventDefault();
     if (!ready || !provider) return;
-    setBusy(true); setRejection(null);
+    setBusy(true); setRejection(null); setFieldRejection(null);
     try {
-      await onSubmit({
-        provider,
-        expected_generation: expectedGeneration,
+      const selection = {
+        provider, expected_generation: expectedGeneration,
         ...(sized ? { resources } : {}),
         ...(needsRuntime ? { runtime: release as SandboxRuntimeRelease } : {}),
-        ...(provider === "e2b" ? { e2b: { api_key: apiKey.trim(), template: template.trim() } } : {}),
-      });
+      };
+      if (editing) await onSubmit({ ...selection, ...(provider === "e2b" ? { e2b: e2bUpdateSelection(template, apiKey) } : {}) });
+      else await onSubmit({ ...selection, ...(provider === "e2b" ? { e2b: { api_key: apiKey.trim(), template: template.trim() } } : {}) });
     } catch (error) {
       // A configuration Core rejected is explained here; the page reports every other failure.
-      const reason = sandboxConfigurationRejection(error);
+      const reason = sandboxConfigurationRejection(error, i18n.resolvedLanguage?.startsWith("zh") ? "zh" : "en");
       if (reason === null) throw error;
       setRejection(reason);
+      setFieldRejection(error);
+      if (error instanceof AgentCoreError && error.param) {
+        if (["e2b.api_key", "e2b.template"].includes(error.param) && error.code !== "e2b_team_mismatch") setStep("e2b");
+        else if (error.param === "runtime" || error.param.startsWith("resources.")) setStep("advanced");
+      }
+      setResetRequired(error instanceof AgentCoreError && ["e2b_team_mismatch", "sandbox_reset_required"].includes(error.code ?? ""));
+      setAddressRejected(error instanceof AgentCoreError && error.code === "sandbox_configuration_error");
     } finally {
       setApiKey("");
       setBusy(false);
@@ -194,11 +209,11 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
     page = (
       <Question title={t("Connect E2B")}>
         <div className="wizard-fields">
-          <Field id={`${id}-key`} label={t("E2B API key")} help={t("The key is write-only: Core encrypts it and never shows it again.")}>
-            <input id={`${id}-key`} type="password" autoComplete="off" spellCheck={false} value={apiKey} onChange={(event) => setApiKey(event.target.value)} />
+          <Field id={`${id}-key`} error={fieldError("e2b.api_key")} label={t("E2B API key")} help={t(editing ? "Leave blank to keep the saved key. Any key you enter is verified as a replacement, even if unchanged." : "The key is write-only: Core encrypts it and never shows it again.")}>
+            <input id={`${id}-key`} type="password" autoComplete="off" spellCheck={false} value={apiKey} aria-invalid={Boolean(fieldError("e2b.api_key"))} aria-describedby={fieldError("e2b.api_key") ? `${id}-key-error` : undefined} onChange={(event) => { setApiKey(event.target.value); setFieldRejection(null); setReplacementRequested(Boolean(event.target.value.trim())); }} />
           </Field>
-          <Field id={`${id}-template`} label={t("Template build")} help={t("The exact ready build, as template-id:build-uuid. A template alias alone is not enough. Each sandbox gets the build's CPU and memory.")} error={template && !validTemplate(template.trim()) ? t("Enter a template ID and build UUID separated by a colon.") : null}>
-            <input id={`${id}-template`} value={template} onChange={(event) => setTemplate(event.target.value)} placeholder="oac-runtime:0f1e2d3c-4b5a-6978-8a9b-0c1d2e3f4a5b" autoComplete="off" spellCheck={false} aria-invalid={Boolean(template && !validTemplate(template.trim()))} />
+          <Field id={`${id}-template`} label={t("Template build")} help={t("The exact ready build, as template-id:build-uuid. A template alias alone is not enough. Each sandbox gets the build's CPU and memory.")} error={fieldError("e2b.template") ?? (template && !validTemplate(template.trim()) ? t("Enter a template ID and build UUID separated by a colon.") : null)}>
+            <input id={`${id}-template`} value={template} onChange={(event) => { setTemplate(event.target.value); setFieldRejection(null); }} placeholder="oac-runtime:0f1e2d3c-4b5a-6978-8a9b-0c1d2e3f4a5b" autoComplete="off" spellCheck={false} aria-invalid={Boolean(fieldError("e2b.template") || (template && !validTemplate(template.trim())))} aria-describedby={`${id}-template-error`} />
           </Field>
         </div>
         <Nav onBack={back} onNext={() => setStep("review")} nextDisabled={!e2bReady} t={t} />
@@ -210,7 +225,7 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
     const kept = saved && provider && presetOf(provider, saved.resources) === null ? saved.resources : null;
     const disks = (value: SandboxResources) => (provider === "microsandbox" ? diskLabel(value) : undefined);
     page = (
-      <Question title={t("How big is each sandbox?")} help={t("Every sandbox of this deployment gets these limits. How many run at once on a machine is set per node.")}>
+      <Question title={t("How big is each sandbox?")} help={t("These limits apply to the selected configuration generation. Existing sandboxes keep their limits. Concurrency is set per node.")}>
         <div className={kept ? "wizard-choices wizard-choices-4" : "wizard-choices wizard-choices-3"}>
           {kept ? <Choice title={t("Current")} value={sizeLabel(kept)} detail={disks(kept)} selected={size === "current"} onClick={() => { setSize("current"); setResources(kept); setStep("review"); }} /> : null}
           {(Object.keys(options) as Preset[]).map((key) => (
@@ -237,9 +252,10 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
           <div><dt>{t("Sandboxes run on")}</dt><dd>{where === "direct" ? t("E2B cloud") : `${t("Own machines")} · ${provider === "docker" ? "Docker" : "microsandbox"}`}</dd></div>
           <div><dt>{t("Each sandbox")}</dt><dd>{sized ? sizeLabel(resources) : t("From the template build")}{provider === "microsandbox" ? <span className="wizard-review-sub">{diskLabel(resources)}</span> : null}</dd></div>
           {provider === "e2b" ? <div><dt>{t("Template build")}</dt><dd><code>{template || "—"}</code></dd></div> : null}
+          {provider === "e2b" && editing ? <div><dt>{t("E2B credential")}</dt><dd>{t(replacementRequested ? "Replace saved key" : "Keep saved key")}</dd></div> : null}
           {needsRuntime ? (
             <div>
-              <dt>{t("Runtime")}<HelpTip>{t("The Runtime release every node runs: the saved one while the backend stays the same, otherwise the one this console distributes.")}</HelpTip></dt>
+              <dt>{t("Runtime")}<HelpTip>{t("The target Runtime release. Existing sandboxes keep their owned release while nodes prepare the target.")}</HelpTip></dt>
               <dd>{runtimeReady ? <code>{release.source_commit!.slice(0, 12)}</code> : <span className="wizard-missing">{t("Runtime release needed")}<HelpTip>{t("This console serves no Runtime manifest. Enter the release under advanced settings.")}</HelpTip></span>}</dd>
             </div>
           ) : null}
@@ -255,7 +271,8 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
         {rejection ? (
           <div className="wizard-rejection" role="alert">
             <p>{rejection}</p>
-            {configuration ? (
+            {resetRequired ? <p>{t("Cancel editing to use Reset deployment. This change requires an explicit reset; the saved configuration is unchanged.")}</p> : null}
+            {addressRejected && configuration ? (
               <dl>
                 <div><dt>{t("Config file")}</dt><dd><CopyableId id={configuration.path} label={t("Copy path")} /></dd></div>
                 <div><dt>{t("Then run")}</dt><dd><CopyableId id={configuration.apply_command} label={t("Copy command")} /></dd></div>
@@ -263,11 +280,12 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
             ) : null}
           </div>
         ) : null}
-        {/* Every save attempt clears the E2B key, so a second one needs it entered again. */}
-        {provider === "e2b" && !apiKey.trim() ? (
+        {/* Initial setup needs the cleared key re-entered; updates may keep the saved key. */}
+        {provider === "e2b" && !keyReady ? (
           <p className="wizard-key-again">
             {t("Enter the E2B key again to save.")}
             <button className="wizard-link" type="button" onClick={() => setStep("e2b")}>{t("Enter the key")}</button>
+            {editing ? <button className="wizard-link" type="button" onClick={() => setReplacementRequested(false)}>{t("Keep saved key")}</button> : null}
           </p>
         ) : null}
         <button className="wizard-link" type="button" onClick={() => setStep("advanced")}>
@@ -288,30 +306,31 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
           {sized ? <fieldset className="wizard-group">
             <legend>{t("Each sandbox")}<HelpTip>{t("1–255 CPUs, 512–1048576 MiB of memory. microsandbox disks are at least 1024 MiB.")}</HelpTip></legend>
             <div className="wizard-grid">
-              <NumberField id={`${id}-cpus`} label={t("CPUs")} value={resources.cpus} onChange={(cpus) => { setSize("custom"); setResources({ ...resources, cpus }); }} />
-              <NumberField id={`${id}-memory`} label={t("Memory (MiB)")} value={resources.memory_mib} onChange={(memory_mib) => { setSize("custom"); setResources({ ...resources, memory_mib }); }} />
+              <NumberField error={fieldError("resources.cpus")} id={`${id}-cpus`} label={t("CPUs")} value={resources.cpus} onChange={(cpus) => { setSize("custom"); setResources({ ...resources, cpus }); setFieldRejection(null); }} />
+              <NumberField error={fieldError("resources.memory_mib")} id={`${id}-memory`} label={t("Memory (MiB)")} value={resources.memory_mib} onChange={(memory_mib) => { setSize("custom"); setResources({ ...resources, memory_mib }); setFieldRejection(null); }} />
               {provider === "microsandbox" ? <>
-                <NumberField id={`${id}-root`} label={t("Root disk (MiB)")} value={resources.root_disk_mib ?? 0} onChange={(root_disk_mib) => setResources({ ...resources, root_disk_mib })} />
-                <NumberField id={`${id}-data`} label={t("Data disk at /environment (MiB)")} value={resources.environment_disk_mib ?? 0} onChange={(environment_disk_mib) => setResources({ ...resources, environment_disk_mib })} />
+                <NumberField error={fieldError("resources.root_disk_mib")} id={`${id}-root`} label={t("Root disk (MiB)")} value={resources.root_disk_mib ?? 0} onChange={(root_disk_mib) => { setResources({ ...resources, root_disk_mib }); setFieldRejection(null); }} />
+                <NumberField error={fieldError("resources.environment_disk_mib")} id={`${id}-data`} label={t("Data disk at /environment (MiB)")} value={resources.environment_disk_mib ?? 0} onChange={(environment_disk_mib) => { setResources({ ...resources, environment_disk_mib }); setFieldRejection(null); }} />
               </> : null}
             </div>
           </fieldset> : null}
           {needsRuntime ? (
             <fieldset className="wizard-group">
               <legend>{t("Runtime release")}<HelpTip>{t("Filled in from this console's distribution when it serves one. Otherwise copy these from the distribution manifest that matches your nodes; image configuration IDs and manifest digests are different values.")}</HelpTip></legend>
+              {fieldError("runtime") ? <p id={`${id}-runtime-error`} className="field-error" role="alert">{fieldError("runtime")}</p> : null}
               {RUNTIME_RELEASE_FIELDS.map((field) => {
                 const value = release[field] ?? "";
                 return (
                   <Field key={field} id={`${id}-${field}`} label={t(releaseLabels[field])} error={value && !isRuntimeReleaseField(field, value) ? t("Check this value") : null}>
-                    <input id={`${id}-${field}`} value={value} spellCheck={false} autoComplete="off" onChange={(event) => setRuntime({ ...release, [field]: event.target.value.trim() })} />
+                    <input id={`${id}-${field}`} value={value} spellCheck={false} autoComplete="off" aria-invalid={Boolean(fieldError("runtime"))} aria-describedby={fieldError("runtime") ? `${id}-runtime-error` : undefined} onChange={(event) => { setRuntime({ ...release, [field]: event.target.value.trim() }); setFieldRejection(null); }} />
                   </Field>
                 );
               })}
             </fieldset>
           ) : null}
           {provider === "e2b" ? (
-            <Field id={`${id}-template-advanced`} label={t("Template build")} error={template && !validTemplate(template.trim()) ? t("Enter a template ID and build UUID separated by a colon.") : null}>
-              <input id={`${id}-template-advanced`} value={template} onChange={(event) => setTemplate(event.target.value)} autoComplete="off" spellCheck={false} />
+            <Field id={`${id}-template-advanced`} label={t("Template build")} error={fieldError("e2b.template") ?? (template && !validTemplate(template.trim()) ? t("Enter a template ID and build UUID separated by a colon.") : null)}>
+              <input id={`${id}-template-advanced`} value={template} onChange={(event) => { setTemplate(event.target.value); setFieldRejection(null); }} autoComplete="off" spellCheck={false} />
             </Field>
           ) : null}
           <div className="wizard-nav">
@@ -391,15 +410,15 @@ function Field({ id, label, help, error, children }: { id: string; label: string
     <div className="field wizard-field">
       <span className="field-label-row"><label htmlFor={id}>{label}</label>{help ? <HelpTip>{help}</HelpTip> : null}</span>
       {children}
-      {error ? <span className="field-error" role="alert">{error}</span> : null}
+      {error ? <span id={`${id}-error`} className="field-error" role="alert">{error}</span> : null}
     </div>
   );
 }
 
-function NumberField({ id, label, value, onChange }: { id: string; label: string; value: number; onChange: (value: number) => void }) {
+function NumberField({ id, label, value, onChange, error }: { error?: string | null; id: string; label: string; value: number; onChange: (value: number) => void }) {
   return (
-    <Field id={id} label={label}>
-      <input id={id} type="number" inputMode="numeric" min={1} step={1} value={Number.isFinite(value) ? value : ""} onChange={(event) => onChange(Number.parseInt(event.target.value, 10))} />
+    <Field id={id} label={label} error={error}>
+      <input id={id} aria-invalid={Boolean(error)} aria-describedby={error ? `${id}-error` : undefined} type="number" inputMode="numeric" min={1} step={1} value={Number.isFinite(value) ? value : ""} onChange={(event) => onChange(Number.parseInt(event.target.value, 10))} />
     </Field>
   );
 }
diff --git a/apps/web/src/features/sandbox/reset-confirmation.css b/apps/web/src/features/sandbox/reset-confirmation.css
new file mode 100644
index 000000000..ca8bd8205
--- /dev/null
+++ b/apps/web/src/features/sandbox/reset-confirmation.css
@@ -0,0 +1,4 @@
+.sandbox-reset-choice { display: flex; align-items: center; gap: 8px; }
+.sandbox-reset-options .sandbox-reset-choice label { display: inline-flex; align-items: center; gap: 10px; margin: 0; }
+.sandbox-reset-options .field { margin-top: 8px; }
+.sandbox-reset-options .field input { max-width: 220px; }
diff --git a/apps/web/src/features/sandbox/sandbox-page-ownership.test.tsx b/apps/web/src/features/sandbox/sandbox-page-ownership.test.tsx
new file mode 100644
index 000000000..adb03fd2c
--- /dev/null
+++ b/apps/web/src/features/sandbox/sandbox-page-ownership.test.tsx
@@ -0,0 +1,78 @@
+import type { ReactElement } from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import type { SandboxDeployment } from "@agents-core-web/agents-client";
+import { describe, expect, it, vi } from "vitest";
+import type { SandboxConsoleConfig } from "./console-config";
+import { SandboxManagerView } from "./SandboxManagerView";
+import { SandboxDeploymentPage } from "./SandboxDeploymentPage";
+import { SystemPage } from "../system/SystemPage";
+import { sandboxConsoleConfigQuery, sandboxDeploymentQuery, sandboxSnapshotQuery } from "./sandbox-queries";
+import { beginSandboxWrite, settleSandboxWrite } from "./sandbox-write-ownership";
+
+// Portaled interactive flows are covered by browser acceptance; identify their page owner here.
+vi.mock("./SandboxSetupWizard", () => ({ SandboxSetupWizard: () => <div>setup-flow</div> }));
+vi.mock("./NodeEnrollment", () => ({ NodeEnrollment: () => <div>node-enrollment</div> }));
+
+function cache(provider: SandboxDeployment["provider"]) {
+  const client = new QueryClient({ defaultOptions: { queries: { enabled: false, retry: false, gcTime: Infinity } } });
+  const deployment: SandboxDeployment = {
+    installation_id: "install", owner_epoch: 1, generation: 2, provider, core_url: "https://core.example",
+    mode: provider === "e2b" ? "direct" : "nodes", reset: null, resources: { allocations: 0, pending: 0 }, suspension: null,
+    rollout: { state: "settled", previous_generation_sandboxes: 0, nodes: null },
+  };
+  const config: SandboxConsoleConfig = { sandbox_admin: true, node_installer: false, node_installer_sha256: "", self_hosted_installer: false, self_hosted_installer_sha256: "" };
+  client.setQueryData(sandboxConsoleConfigQuery.queryKey, () => config);
+  client.setQueryData(sandboxDeploymentQuery.queryKey, deployment);
+  client.setQueryData(sandboxSnapshotQuery.queryKey, { deployment, nodes: [], allocations: [], nodesError: null, readAt: 0 });
+  return client;
+}
+const render = (page: ReactElement, client: QueryClient) => renderToStaticMarkup(<QueryClientProvider client={client}>{page}</QueryClientProvider>);
+
+describe("sandbox page ownership", () => {
+  it("keeps setup in System's secondary page and sends empty Nodes there", () => {
+    const client = cache("");
+    const nodes = render(<SandboxManagerView />, client);
+    expect(nodes).not.toContain("setup-flow");
+    expect(nodes).toContain("Set up sandbox hosting in System before adding nodes.");
+    expect(nodes).toContain("Manage sandbox configuration");
+    const configuration = render(<SandboxDeploymentPage />, client);
+    expect(configuration).toContain("setup-flow");
+    expect(configuration).toContain("Back to System");
+    expect(configuration).not.toContain("node-enrollment");
+  });
+
+  it("keeps Nodes as a node page for both cloud and host deployments", () => {
+    const cloud = render(<SandboxManagerView />, cache("e2b"));
+    expect(cloud).toContain("Nodes</h1>");
+    expect(cloud).toContain("There are no nodes to manage.");
+    expect(cloud).not.toContain("Change resources");
+    const hosts = render(<SandboxManagerView />, cache("docker"));
+    expect(hosts).toContain("node-enrollment");
+    expect(hosts).toContain("Add your first node");
+    expect(hosts).not.toContain("Reset deployment");
+  });
+
+  it("opens editing deliberately and keeps the System landing page to one entry", () => {
+    const client = cache("docker");
+    const configuration = render(<SandboxDeploymentPage />, client);
+    expect(configuration).toContain("Change resources");
+    expect(configuration).toContain("Reset deployment");
+    expect(configuration).not.toContain("setup-flow");
+    const system = render(<SystemPage />, client);
+    expect(system).toContain("Manage sandbox configuration");
+    expect(system).not.toContain("Change resources");
+    expect(system).not.toContain("Reset deployment");
+  });
+
+  it("shares pending and uncertain write ownership across both pages", () => {
+    const client = cache("docker");
+    const attempt = beginSandboxWrite(client)!;
+    expect(render(<SandboxManagerView />, client)).toContain("Saving sandbox change");
+    expect(render(<SandboxDeploymentPage />, client)).toContain("Saving sandbox change");
+    settleSandboxWrite(client, attempt);
+    for (const page of [<SandboxManagerView />, <SandboxDeploymentPage />]) {
+      expect(render(page, client)).toContain("Refresh sandbox state to confirm whether the change was saved before submitting again.");
+    }
+  });
+});
diff --git a/apps/web/src/features/sandbox/sandbox-queries.test.ts b/apps/web/src/features/sandbox/sandbox-queries.test.ts
index 7e55c70b9..5268392cf 100644
--- a/apps/web/src/features/sandbox/sandbox-queries.test.ts
+++ b/apps/web/src/features/sandbox/sandbox-queries.test.ts
@@ -2,7 +2,7 @@ import { QueryClient } from "@tanstack/react-query";
 import type { SandboxDeployment, SandboxReset } from "@agents-core-web/agents-client";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { node } from "../overview/test-fixtures";
-import { sandboxAdmin, sandboxResetPollInterval, sandboxSnapshotQuery, sandboxScope } from "./sandbox-queries";
+import { sandboxAdmin, sandboxDeploymentQuery, sandboxResetPollInterval, sandboxSnapshotQuery, sandboxScope } from "./sandbox-queries";
 
 const reset: SandboxReset = {
   clear: "auto", requested_at: "2026-09-27T10:00:00Z", deadline_at: "2026-09-27T11:00:00Z", forced_at: null,
@@ -17,6 +17,32 @@ const cache = () => { const client = new QueryClient({ defaultOptions: { queries
 afterEach(() => { for (const client of clients.splice(0)) client.clear(); vi.restoreAllMocks(); });
 
 describe("sandbox reset reads", () => {
+  it("polls only Core preparation or reset, never settled old resources or failed/unknown nodes", () => {
+    const settled = deployment({ reset: null, rollout: { state: "settled", previous_generation_sandboxes: 9, nodes: { ready: 0, preparing: 0, failed: 2, update_required: 1, unknown: 3 } } });
+    expect(sandboxResetPollInterval(settled)).toBe(false);
+    expect(sandboxResetPollInterval({ ...settled, rollout: { ...settled.rollout, state: "preparing" } })).toBe(5000);
+    expect(sandboxResetPollInterval({ ...settled, reset })).toBe(5000);
+  });
+
+  it("keeps owned node and allocation evidence when an online generation's inventory cannot be refreshed", async () => {
+    const client = cache(); const first = deployment({ reset: null });
+    const read = vi.spyOn(sandboxAdmin, "retrieveDeployment").mockResolvedValue(first);
+    const nodes = vi.spyOn(sandboxAdmin, "listNodes").mockResolvedValue({ data: [node("node-a")] });
+    const allocation = { id: "owned", node_id: "node-a", tenant_id: "tenant", session_id: "session", environment_id: "environment", state: "active", compute_phase: "running", compute_phase_changed_at: null, diagnostic: "" as const, initialization: "ready", created_at: "2026-09-27T10:00:00Z", deployment_generation: first.generation };
+    vi.spyOn(sandboxAdmin, "listAllocations").mockResolvedValue({ data: [allocation] });
+    await client.fetchQuery(sandboxSnapshotQuery);
+    read.mockResolvedValue({ ...first, generation: first.generation + 1 });
+    nodes.mockRejectedValue(new Error("node read unavailable"));
+    const observed = await client.fetchQuery(sandboxSnapshotQuery);
+    expect(observed.nodes).toHaveLength(1); expect(observed.allocations).toEqual([allocation]);
+    expect(observed.deployment.generation).toBe(first.generation);
+    expect(observed.nodesError).toBeInstanceOf(Error);
+    expect(client.getQueryData(sandboxDeploymentQuery.queryKey)?.generation).toBe(first.generation + 1);
+    read.mockResolvedValue({ ...first, owner_epoch: 2 });
+    const replaced = await client.fetchQuery(sandboxSnapshotQuery);
+    expect(replaced.nodes).toEqual([]); expect(replaced.allocations).toEqual([]);
+  });
+
   it("keeps Core reset and offline blockers when nodes cannot be read", async () => {
     const saved = deployment(); const error = new Error("offline");
     vi.spyOn(sandboxAdmin, "retrieveDeployment").mockResolvedValue(saved);
diff --git a/apps/web/src/features/sandbox/sandbox-queries.ts b/apps/web/src/features/sandbox/sandbox-queries.ts
index 78348ddf8..0d31c78fb 100644
--- a/apps/web/src/features/sandbox/sandbox-queries.ts
+++ b/apps/web/src/features/sandbox/sandbox-queries.ts
@@ -38,9 +38,9 @@ export const sandboxDeploymentQuery = queryOptions<SandboxDeployment>({
   refetchIntervalInBackground: false,
 });
 
-/** Reset progress is Core-owned; a completed or absent reset needs no polling. */
+/** Only Core reports active work; retained older sandboxes do not keep polling alive. */
 export function sandboxResetPollInterval(deployment: SandboxDeployment | undefined): 5000 | false {
-  return deployment?.reset ? 5000 : false;
+  return deployment?.reset || deployment?.rollout.state === "preparing" ? 5000 : false;
 }
 
 /**
@@ -81,6 +81,12 @@ export const sandboxSnapshotQuery = queryOptions<SandboxSnapshot>({
       return { deployment, nodes, allocations: allocations.flatMap((page) => page.data), nodesError: null, readAt };
     } catch (nodesError) {
       signal.throwIfAborted();
+      const previous = client.getQueryData(sandboxSnapshotQuery.queryKey);
+      if (previous && sandboxSnapshotMatchesDeployment(previous, deployment)) {
+        // Online updates retain older ownership. A failed supplemental refresh
+        // keeps that evidence visibly stale; it cannot erase existing resources.
+        return { ...previous, nodesError };
+      }
       return { deployment, nodes, allocations: [], nodesError, readAt };
     }
   },
@@ -90,7 +96,7 @@ export const sandboxSnapshotQuery = queryOptions<SandboxSnapshot>({
 export function sandboxSnapshotMatchesDeployment(snapshot: SandboxSnapshot, deployment: SandboxDeployment): boolean {
   const previous = snapshot.deployment;
   return previous.installation_id === deployment.installation_id && previous.owner_epoch === deployment.owner_epoch &&
-    previous.generation === deployment.generation && previous.provider === deployment.provider &&
+    previous.provider === deployment.provider && previous.mode === deployment.mode &&
     previous.reset?.requested_at === deployment.reset?.requested_at && previous.reset?.clear === deployment.reset?.clear &&
     previous.reset?.forced_at === deployment.reset?.forced_at;
 }
diff --git a/apps/web/src/features/sandbox/sandbox-update.test.ts b/apps/web/src/features/sandbox/sandbox-update.test.ts
new file mode 100644
index 000000000..da2644f9b
--- /dev/null
+++ b/apps/web/src/features/sandbox/sandbox-update.test.ts
@@ -0,0 +1,20 @@
+import { describe, expect, it } from "vitest";
+import { e2bKeyReady, e2bUpdateSelection } from "./sandbox-update";
+
+describe("E2B update selection", () => {
+  it("omits a retained key while keeping the complete template selection", () => {
+    expect(e2bUpdateSelection(" template:build ", "   ")).toEqual({ template: "template:build" });
+    expect(e2bKeyReady(true, false, "")).toBe(true);
+    expect(e2bKeyReady(false, false, "")).toBe(false);
+  });
+
+  it("always sends an explicit replacement, including repeated identical values", () => {
+    for (let attempt = 0; attempt < 2; attempt++) expect(e2bUpdateSelection("template:build", " test-key ")).toEqual({ template: "template:build", api_key: "test-key" });
+  });
+
+  it("does not silently turn a cleared replacement secret into retained-key resubmission", () => {
+    expect(e2bKeyReady(true, true, "")).toBe(false);
+    expect(e2bKeyReady(true, true, "replacement")).toBe(true);
+    expect(e2bKeyReady(true, false, "")).toBe(true);
+  });
+});
diff --git a/apps/web/src/features/sandbox/sandbox-update.ts b/apps/web/src/features/sandbox/sandbox-update.ts
new file mode 100644
index 000000000..3eb4a5a2c
--- /dev/null
+++ b/apps/web/src/features/sandbox/sandbox-update.ts
@@ -0,0 +1,12 @@
+import type { UpdateSandboxDeployment } from "@agents-core-web/agents-client";
+
+/** Omission preserves the credential; every explicit key follows Core's replacement path. */
+export function e2bUpdateSelection(template: string, apiKey: string): NonNullable<UpdateSandboxDeployment["e2b"]> {
+  const key = apiKey.trim();
+  return { template: template.trim(), ...(key ? { api_key: key } : {}) };
+}
+
+/** Clearing a submitted secret must not silently convert replacement into retention. */
+export function e2bKeyReady(editing: boolean, replacementRequested: boolean, apiKey: string): boolean {
+  return apiKey.trim().length > 0 || (editing && !replacementRequested);
+}
diff --git a/apps/web/src/features/sandbox/use-sandbox-manager-state.test.tsx b/apps/web/src/features/sandbox/use-sandbox-manager-state.test.tsx
index c2bb89243..77e416818 100644
--- a/apps/web/src/features/sandbox/use-sandbox-manager-state.test.tsx
+++ b/apps/web/src/features/sandbox/use-sandbox-manager-state.test.tsx
@@ -16,7 +16,7 @@ function cache() {
 }
 function Probe() {
   const state = useSandboxManagerState();
-  return <div data-read={state.deploymentQuery.isError ? "failed" : "confirmed"} data-compatible={String(state.compatible)} data-owner={state.ownership.data.phase} data-inventory-loading={String(state.inventoryLoading)} data-inventory-failed={String(Boolean(state.snapshot?.nodesError))}>
+  return <div data-read={state.deploymentQuery.isError ? "failed" : "confirmed"} data-compatible={String(state.compatible)} data-older={String(state.inventoryOlder)} data-owner={state.ownership.data.phase} data-inventory-loading={String(state.inventoryLoading)} data-inventory-failed={String(Boolean(state.snapshot?.nodesError))}>
     {state.snapshot?.deployment.provider || "setup"}/{state.snapshot?.deployment.reset?.clear ?? "none"}/{state.snapshot?.nodes.length ?? 0}
   </div>;
 }
@@ -65,10 +65,13 @@ describe("Nodes shared deployment evidence", () => {
     expect(client.getQueryState(sandboxSnapshotQuery.queryKey)?.status).toBe("success");
   });
 
-  it("retains nodes only within the same installation, owner, generation and reset lifecycle", () => {
+  it("retains older generation nodes but rejects a different installation, owner, provider or reset lifecycle", () => {
     const client = cache(); client.setQueryData(sandboxDeploymentQuery.queryKey, configured);
     expect(render(client)).toContain("docker/none/1");
-    for (const change of [{ installation_id: "next" }, { owner_epoch: 2 }, { generation: 2 }, { provider: "e2b" as const }]) {
+    client.setQueryData(sandboxDeploymentQuery.queryKey, { ...configured, generation: 2 });
+    expect(render(client)).toContain("docker/none/1");
+    expect(render(client)).toContain('data-older="true"');
+    for (const change of [{ installation_id: "next" }, { owner_epoch: 2 }, { mode: "direct" as const }, { provider: "e2b" as const }]) {
       client.setQueryData(sandboxDeploymentQuery.queryKey, { ...configured, ...change });
       expect(render(client)).toContain('data-compatible="false"');
     }
diff --git a/apps/web/src/features/sandbox/use-sandbox-manager-state.ts b/apps/web/src/features/sandbox/use-sandbox-manager-state.ts
index f4697936d..35e1db9ce 100644
--- a/apps/web/src/features/sandbox/use-sandbox-manager-state.ts
+++ b/apps/web/src/features/sandbox/use-sandbox-manager-state.ts
@@ -1,23 +1,24 @@
 import { useEffect } from "react";
 import { useQuery } from "@tanstack/react-query";
-import { sandboxDeploymentQuery, sandboxSnapshotMatchesDeployment, sandboxSnapshotQuery, type SandboxSnapshot } from "./sandbox-queries";
+import { sandboxDeploymentQuery, sandboxResetPollInterval, sandboxSnapshotMatchesDeployment, sandboxSnapshotQuery, type SandboxSnapshot } from "./sandbox-queries";
 import { sandboxWriteOwnershipQuery } from "./sandbox-write-ownership";
 
 /** All pages share deployment truth. Nodes are supplemental evidence from the same lifecycle. */
 export function useSandboxManagerState() {
   const ownership = useQuery(sandboxWriteOwnershipQuery);
   const deploymentQuery = useQuery({ ...sandboxDeploymentQuery, refetchOnMount: "always" });
-  const query = useQuery(sandboxSnapshotQuery);
+  const query = useQuery({ ...sandboxSnapshotQuery, refetchInterval: sandboxResetPollInterval(deploymentQuery.data) });
   const inventory = query.data;
   const deployment = deploymentQuery.data;
   const compatible = Boolean(inventory && deployment && sandboxSnapshotMatchesDeployment(inventory, deployment));
   // An arrival intent must wait for its supplemental read, rather than treating
   // absent/previous-lifecycle inventory as a confirmed inability to add a node.
   const inventoryLoading = query.isPending || query.isFetching || (!compatible && !query.isError);
+  const inventoryOlder = compatible && inventory!.deployment.generation !== deployment!.generation;
   const { refetch } = query;
   useEffect(() => {
-    if (inventory && deployment && !compatible) void refetch();
-  }, [compatible, deployment?.installation_id, deployment?.owner_epoch, deployment?.generation, deployment?.provider, deployment?.reset?.requested_at, deployment?.reset?.clear, deployment?.reset?.forced_at, refetch]);
+    if (inventory && deployment && (!compatible || inventoryOlder || inventory.deployment.rollout.state !== deployment.rollout.state)) void refetch();
+  }, [compatible, inventoryOlder, deployment?.installation_id, deployment?.owner_epoch, deployment?.generation, deployment?.provider, deployment?.reset?.requested_at, deployment?.reset?.clear, deployment?.reset?.forced_at, deployment?.rollout.state, refetch]);
   const snapshot: SandboxSnapshot | null = deployment ? {
     deployment,
     nodes: compatible ? inventory!.nodes : [],
@@ -25,5 +26,5 @@ export function useSandboxManagerState() {
     nodesError: query.isError ? query.error : compatible ? inventory!.nodesError : null,
     readAt: compatible ? inventory!.readAt : 0,
   } : null;
-  return { ownership, deploymentQuery, query, deployment, compatible, inventoryLoading, snapshot };
+  return { ownership, deploymentQuery, query, deployment, compatible, inventoryOlder, inventoryLoading, snapshot };
 }
diff --git a/apps/web/src/features/sandbox/use-sandbox-page-state.ts b/apps/web/src/features/sandbox/use-sandbox-page-state.ts
new file mode 100644
index 000000000..2df7d6b6c
--- /dev/null
+++ b/apps/web/src/features/sandbox/use-sandbox-page-state.ts
@@ -0,0 +1,32 @@
+import { useCallback } from "react";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
+import { installationQuery } from "../../lib/installation";
+import { useSandboxManagerState } from "./use-sandbox-manager-state";
+
+/** Shared observations and write admission survive navigation through the query cache. */
+export function useSandboxPageState() {
+  const state = useSandboxManagerState();
+  const queryClient = useQueryClient();
+  const installation = useQuery(installationQuery);
+  const { ownership, deploymentQuery, deployment, query } = state;
+  const loading = deploymentQuery.isFetching;
+  const busy = ownership.data.phase === "pending";
+  const setupNeedsRefresh = ownership.data.phase === "reconcile";
+  const confirmed = deployment !== undefined && !deploymentQuery.isError && ownership.data.phase === "idle";
+  const fresh = confirmed && !loading;
+  const { refetch: refetchDeployment } = deploymentQuery;
+  const { refetch: refetchSnapshot } = query;
+  const refetch = useCallback(async () => {
+    const result = await refetchDeployment();
+    if (!result.isError) await refetchSnapshot();
+    return result;
+  }, [refetchDeployment, refetchSnapshot]);
+  const refresh = useCallback(() => {
+    void queryClient.invalidateQueries({ queryKey: installationQuery.queryKey });
+    return refetch();
+  }, [queryClient, refetch]);
+  const configurationKey = deployment
+    ? `${deployment.installation_id}:${deployment.owner_epoch}:${deployment.provider}:${deployment.mode}:${deployment.generation}`
+    : undefined;
+  return { ...state, installation, loading, busy, setupNeedsRefresh, confirmed, fresh, refetch, refresh, configurationKey };
+}
diff --git a/apps/web/src/features/sessions/ExecutorConnectionPanel.tsx b/apps/web/src/features/sessions/ExecutorConnectionPanel.tsx
new file mode 100644
index 000000000..fd5f0ad04
--- /dev/null
+++ b/apps/web/src/features/sessions/ExecutorConnectionPanel.tsx
@@ -0,0 +1,37 @@
+import type { ExecutorCredentialList } from "@agents-core-web/agents-client";
+import { useId } from "react";
+import { useTranslation } from "react-i18next";
+
+import { HelpTip, RefreshButton, StatusDot } from "../../components/console-ui";
+import { formatDateTime } from "../../lib/format";
+import { executorConnectionState } from "./executor-connection";
+import "./executor-connection.css";
+
+export function ExecutorConnectionPanel({ read, stale, failed, refreshing, onRefresh }: {
+  read: ExecutorCredentialList | undefined;
+  stale: boolean;
+  failed: boolean;
+  refreshing: boolean;
+  onRefresh: () => void;
+}) {
+  const { t, i18n } = useTranslation("sessions");
+  const { t: tCommon } = useTranslation("common");
+  const headingId = useId();
+  const state = executorConnectionState(read, stale);
+  const connection = read?.connection;
+  return (
+    <section className="executor-connection" aria-labelledby={headingId}>
+      <div className="executor-connection-heading">
+        <h3 id={headingId}>{t("executor.connection.title")}</h3>
+        <StatusDot tone={state === "connected" ? "ok" : state === "revoked" || state === "disconnected" ? "warning" : "neutral"} label={t(`executor.connection.status.${state}`)} />
+        <HelpTip>
+          {t("executor.connection.help")}<br />
+          {t("executor.connection.lastSeen")}: {connection?.last_seen_at ? formatDateTime(Date.parse(connection.last_seen_at) / 1000, i18n.resolvedLanguage) : t(connection ? "executor.connection.noHeartbeat" : "executor.connection.status.unknown")}
+        </HelpTip>
+        <RefreshButton onClick={onRefresh} refreshing={refreshing} label={`${tCommon("actions.refresh")} · ${t("executor.connection.title")}`} />
+      </div>
+      {stale && read ? <p className="executor-connection-warning" role="status">{t(failed ? "executor.connection.stale" : "executor.connection.refreshing")}</p> : null}
+      {!read && failed ? <p className="executor-connection-warning" role="status">{t("executor.connection.failed")}</p> : null}
+    </section>
+  );
+}
diff --git a/apps/web/src/features/sessions/ExecutorCredentialsSection.tsx b/apps/web/src/features/sessions/ExecutorCredentialsSection.tsx
index 97346fb07..5930adfc7 100644
--- a/apps/web/src/features/sessions/ExecutorCredentialsSection.tsx
+++ b/apps/web/src/features/sessions/ExecutorCredentialsSection.tsx
@@ -1,11 +1,11 @@
 import { AgentCoreError, type ExecutorCredential, type IssuedExecutorCredential } from "@agents-core-web/agents-client";
 import { useQuery } from "@tanstack/react-query";
-import { Check, Copy, Download, Plus } from "lucide-react";
-import { useEffect, useRef, useState } from "react";
-import { Trans, useTranslation } from "react-i18next";
+import { Plus } from "lucide-react";
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
 
 import { ConfirmDialog } from "../../components/ConfirmDialog";
-import { EmptyState, Section, StatusDot } from "../../components/console-ui";
+import { EmptyState, HelpTip, Section, StatusDot } from "../../components/console-ui";
 import { ErrorDialog } from "../../components/ErrorDialog";
 import { CopyableId, RowActions } from "../../components/list-ui";
 import { Modal } from "../../components/Modal";
@@ -14,10 +14,11 @@ import { failedLast, useFailureToast, useToast } from "../../components/Toast";
 import { useDeleteFlow } from "../../lib/delete-flow";
 import { formatDateTime, shortId } from "../../lib/format";
 import { admin, useProjects } from "../../lib/projects";
-import { useCopy } from "../api-keys/IssuedKey";
-import { saveBlob } from "../skills/skill-operations";
-import { ExecutorInstallPanel, InstallCommand, useExecutorInstall, useSelectWhenCopyFails } from "./ExecutorInstallPanel";
-import { executorCredentialsQuery } from "./session-queries";
+import { ExecutorInstallPanel, useExecutorInstall } from "./ExecutorInstallPanel";
+import { CredentialFile } from "./executor-credential-file";
+import { executorConnectionQuery } from "./executor-connection-query";
+import { boundExecutorCredential, executorConnectionState } from "./executor-connection";
+import { ExecutorConnectionPanel } from "./ExecutorConnectionPanel";
 
 /** An issuance that gets no answer in this time has an unknown outcome. */
 const WRITE_TIMEOUT_MS = 30_000;
@@ -32,17 +33,6 @@ function newKeyId(): string {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 
-/**
- * The self-hosted executor's credential as one line of JSON. The installer
- * also accepts it pretty-printed, but a one-line paste survives terminals that
- * warn about or bracket multi-line pastes; `--credential-file` reads the same
- * JSON from the downloaded file.
- */
-function credentialText(credential: IssuedExecutorCredential): string {
-  const { key_id, environment_id, executor_token } = credential;
-  return JSON.stringify({ key_id, environment_id, executor_token });
-}
-
 /**
  * A write either failed before Core acted ("rejected", with Core's reason) or
  * has an unknown outcome: no answer, a timeout, a 5xx or an unreadable reply.
@@ -92,8 +82,11 @@ export function ExecutorCredentialsSection({ projectId, sessionId, environmentId
   const install = useExecutorInstall(environmentId, remoteUrl);
   // The one-time dialog repeats the command, so it is copied and run before the credential is pasted.
   const command = install.kind === "ready" ? install.command : null;
-  const query = useQuery(executorCredentialsQuery(projectId, sessionId, environmentId));
-  const credentials = query.data ?? null;
+  const query = useQuery(executorConnectionQuery(projectId, sessionId, environmentId));
+  const credentials = query.data?.data ?? null;
+  const connectionStale = failedLast(query) || query.isStale;
+  const connectionState = executorConnectionState(query.data, connectionStale);
+  const boundCredential = boundExecutorCredential(query.data);
   const { refetch } = query;
   const reread = () => { void refetch(); };
   useFailureToast(credentials && failedLast(query) ? message(query.error) : null, t("executor.refreshFailed"), "executor-credentials-read");
@@ -140,7 +133,7 @@ export function ExecutorCredentialsSection({ projectId, sessionId, environmentId
   const findListed = async (keyId: string): Promise<ExecutorCredential | null | undefined> => {
     const result = await refetch();
     if (!result.data || result.isError) return undefined;
-    return result.data.find((credential) => sameKey(credential.key_id, keyId)) ?? null;
+    return result.data.data.find((credential) => sameKey(credential.key_id, keyId)) ?? null;
   };
   // An issued key ID whose secret never arrived is rotated for a fresh one, if it is still active.
   const recoverLost = (found: ExecutorCredential): boolean => {
@@ -232,7 +225,7 @@ export function ExecutorCredentialsSection({ projectId, sessionId, environmentId
   let body;
   if (!credentials) {
     body = query.isError
-      ? <EmptyState title={t("executor.loadFailed")} description={message(query.error)} action={<button className="button outline" type="button" onClick={reread}>{t("detail.retry")}</button>} />
+      ? <EmptyState title={t("executor.loadFailed")} description={message(query.error)} />
       : <TableSkeleton label={t("executor.loading")} rows={2} columns={4} />;
   } else if (!credentials.length) {
     body = <EmptyState title={t("executor.empty")} />;
@@ -251,10 +244,17 @@ export function ExecutorCredentialsSection({ projectId, sessionId, environmentId
           <tbody>
             {credentials.map((credential) => {
               const revoked = credential.revoked_at !== null;
+              const bound = boundCredential?.key_id === credential.key_id;
               const id = shortId(credential.key_id);
               return (
                 <tr key={credential.key_id} className={revoked ? "executor-credential-revoked" : undefined}>
-                  <th scope="row"><span className="name-cell"><CopyableId id={credential.key_id} compact label={t("executor.copyKeyId")} /></span></th>
+                  <th scope="row"><span className="name-cell">
+                    <CopyableId id={credential.key_id} compact label={t("executor.copyKeyId")} />
+                    {bound ? <span className="executor-credential-binding">
+                      <span className="pill">{t("executor.connection.boundKey")}</span>
+                      <HelpTip>{t(revoked ? "executor.connection.restore" : "executor.connection.bound", { id })}</HelpTip>
+                    </span> : null}
+                  </span></th>
                   <td className="session-nowrap">{formatDateTime(seconds(credential.created_at), locale)}</td>
                   <td>
                     <span className="executor-credential-status">
@@ -266,8 +266,8 @@ export function ExecutorCredentialsSection({ projectId, sessionId, environmentId
                     {revoked && archived ? null : (
                       <RowActions>
                         {archived ? null : (
-                          <button className="text-action" type="button" aria-label={t(revoked ? "executor.restoreLabel" : "executor.rotateLabel", { id })} disabled={busy} onClick={() => openRotation(credential.key_id, revoked ? "revoked" : "active")}>
-                            {t(revoked ? "executor.restore" : "executor.rotate")}
+                          <button className="text-action" type="button" aria-label={bound ? t(revoked ? "executor.connection.rotateRestore" : "executor.connection.rotateBound") : t(revoked ? "executor.restoreLabel" : "executor.rotateLabel", { id })} disabled={busy || (bound && connectionStale)} onClick={() => openRotation(credential.key_id, revoked ? "revoked" : "active")}>
+                            {bound ? t(revoked ? "executor.connection.rotateRestore" : "executor.connection.rotateBound") : t(revoked ? "executor.restore" : "executor.rotate")}
                           </button>
                         )}
                         {revoked ? null : (
@@ -300,8 +300,9 @@ export function ExecutorCredentialsSection({ projectId, sessionId, environmentId
           <div><button className="button outline" type="button" onClick={finishShown}>{t("executor.issued.done")}</button></div>
         </section>
       ) : null}
+      <ExecutorConnectionPanel read={query.data} stale={connectionStale} failed={failedLast(query)} refreshing={query.isFetching} onRefresh={reread} />
       {body}
-      <ExecutorInstallPanel install={install} archived={archived} />
+      <ExecutorInstallPanel install={install} archived={archived} connected={connectionState === "connected"} />
       <Modal
         open={shown?.open ?? false}
         title={t("executor.issued.title")}
@@ -358,48 +359,3 @@ export function ExecutorCredentialsSection({ projectId, sessionId, environmentId
     </Section>
   );
 }
-
-/**
- * The one-time credential: copied to paste at the installer's hidden prompt,
- * or downloaded as a file for automation (`--credential-file`). What to do
- * next comes first: in the dialog, run the install command shown with it; on
- * the page, run the Connect a host command below; without the installer, save
- * the credential.
- */
-function CredentialFile({ credential, next, command = null }: { credential: IssuedExecutorCredential; next: "inline" | "panel" | "save"; command?: string | null }) {
-  const { t } = useTranslation("sessions");
-  const text = credentialText(credential);
-  const { state, copy } = useCopy(text);
-  const file = useRef<HTMLPreElement>(null);
-  useSelectWhenCopyFails(state, file);
-  // A downloaded credential's object URL goes with the credential: on Done or when this leaves the page.
-  const downloads = useRef<(() => void)[]>([]);
-  useEffect(() => {
-    const revokes = downloads.current;
-    return () => { for (const revoke of revokes.splice(0)) revoke(); };
-  }, []);
-  const download = () => {
-    downloads.current.push(saveBlob(new Blob([`${text}\n`], { type: "application/json" }), `executor-credential-${credential.environment_id.slice(0, 8)}.json`));
-  };
-  return (
-    <div className="executor-credential">
-      <p className="executor-credential-notice">{t("executor.issued.notice")}</p>
-      <p className="executor-credential-next">{t(`executor.issued.next.${next}`)}</p>
-      {command ? <InstallCommand value={command} /> : null}
-      <div role="region" aria-label={t("executor.issued.fileLabel")}><pre ref={file} className="executor-credential-file"><code>{text}</code></pre></div>
-      <div className="executor-credential-actions">
-        <button className="button primary" type="button" onClick={() => void copy()}>
-          {state === "copied" ? <Check size={14} aria-hidden="true" /> : <Copy size={14} aria-hidden="true" />}
-          {state === "copied" ? t("executor.issued.copied") : t("executor.issued.copy")}
-        </button>
-        <button className="button outline" type="button" onClick={download}>
-          <Download size={14} aria-hidden="true" />{t("executor.issued.download")}
-        </button>
-      </div>
-      {state === "failed" ? <p className="executor-credential-error" role="alert">{t("executor.issued.copyFailed")}</p> : null}
-      <p className="executor-credential-hint">
-        <Trans t={t} i18nKey={next === "save" ? "executor.issued.downloadHint.installer" : "executor.issued.downloadHint.command"} components={{ chmod: <code>chmod 600 &lt;file&gt;</code>, flag: <code>--credential-file &lt;absolute path&gt;</code> }} />
-      </p>
-    </div>
-  );
-}
diff --git a/apps/web/src/features/sessions/ExecutorInstallPanel.tsx b/apps/web/src/features/sessions/ExecutorInstallPanel.tsx
index 0365f483b..344f63bcf 100644
--- a/apps/web/src/features/sessions/ExecutorInstallPanel.tsx
+++ b/apps/web/src/features/sessions/ExecutorInstallPanel.tsx
@@ -35,7 +35,7 @@ export function useExecutorInstall(environmentId: string, remoteUrl: string): Ex
  * for a credential from the section above at a hidden prompt. Shown only when
  * the console serves the self-hosted installer with a verified digest.
  */
-export function ExecutorInstallPanel({ install, archived }: { install: ExecutorInstallRead; archived: boolean }) {
+export function ExecutorInstallPanel({ install, archived, connected = false }: { install: ExecutorInstallRead; archived: boolean; connected?: boolean }) {
   const { t } = useTranslation("sessions");
   const { t: tCommon } = useTranslation("common");
   const headingId = useId();
@@ -69,6 +69,10 @@ export function ExecutorInstallPanel({ install, archived }: { install: ExecutorI
       <div className="executor-install-title">
         <h3 id={headingId}>{t("executor.install.title")}</h3>
         <HelpTip>{t("executor.install.lifecycle")}</HelpTip>
+        <span className={`executor-install-progress${connected ? " is-done" : ""}`}>
+          {connected ? <Check size={14} aria-hidden="true" /> : null}
+          {t(connected ? "executor.install.hostDone" : "executor.install.hostPending")}
+        </span>
       </div>
       {body}
     </section>
diff --git a/apps/web/src/features/sessions/SessionLogPage.tsx b/apps/web/src/features/sessions/SessionLogPage.tsx
index 12c2d9517..2038e2b64 100644
--- a/apps/web/src/features/sessions/SessionLogPage.tsx
+++ b/apps/web/src/features/sessions/SessionLogPage.tsx
@@ -282,7 +282,7 @@ function SessionLogRow({
         <NameCell name={session.agent.name} id={session.id} fallback={t("common.untitledAgent")} onOpen={open} openLabel={t("log.open", { id: session.id })} />
       </th>
       {projectCell}
-      <td onClick={(event) => event.stopPropagation()}><SessionStatus session={session} truncate /></td>
+      <td onClick={(event) => event.stopPropagation()}><SessionStatus projectId={row.project.id} session={session} truncate /></td>
       <td><code>{session.agent.model || MISSING}</code></td>
       <td className="session-nowrap">{t(`environment.${environmentKind(session)}`)}</td>
       <td className="numeric" title={session.usage ? t("log.exactTokens", { tokens: session.usage.total_tokens.toLocaleString(locale) }) : undefined}>
diff --git a/apps/web/src/features/sessions/SessionPage.tsx b/apps/web/src/features/sessions/SessionPage.tsx
index 22edb299f..66d62003f 100644
--- a/apps/web/src/features/sessions/SessionPage.tsx
+++ b/apps/web/src/features/sessions/SessionPage.tsx
@@ -15,6 +15,7 @@ import { collections } from "../../lib/queries";
 import { forgetDeleted } from "../resources/detail-queries";
 import { ExecutorCredentialsSection } from "./ExecutorCredentialsSection";
 import { SessionDeleteDialog, type SessionDeleteTarget } from "./SessionDeleteDialog";
+import { DiagnosticScope } from "./session-diagnostics";
 import { sessionKey } from "./session-queries";
 import { isSessionActive, turnAnchorId } from "./session-history";
 import { environmentKind, isDeletable } from "./session-log";
@@ -81,6 +82,7 @@ export function SessionPage() {
   const refresh = () => {
     setRefreshToken((value) => value + 1);
     history.refresh();
+    if (projectId && sessionId) void queryClient.invalidateQueries({ queryKey: [...sessionKey(projectId, sessionId), "diagnostics"] });
     if (projectId && sessionId) void queryClient.invalidateQueries({ queryKey: [...sessionKey(projectId, sessionId), "executor-credentials"] });
   };
   const time = loadedAt ? formatClock(loadedAt, locale) : MISSING;
@@ -118,13 +120,13 @@ export function SessionPage() {
     const harness = session.agent.x_agents_core?.harness;
     const environment = session.environment as { type: string; id?: unknown; remote_url?: unknown };
     body = (
-      <>
+      <DiagnosticScope.Provider value={{ projectId, sessionId: session.id }}>
         {history.gone ? <p className="coverage-note coverage-note-error" role="alert">{t("detail.gone", { time })}</p> : null}
         <dl className="resource-facts session-facts" aria-label={t("detail.facts")}>
           <div><dt>{t("detail.id")}</dt><dd><CopyableId id={session.id} /></dd></div>
           <div><dt>{t("detail.project")}</dt><dd><ProjectName project={project} /></dd></div>
           <div><dt>{t("detail.creator")}</dt><dd><CreatorCell creator={creators.creatorOf(projectId, session.id)} /></dd></div>
-          <div><dt>{t("detail.status")}</dt><dd><SessionStatus session={session} /></dd></div>
+          <div><dt>{t("detail.status")}</dt><dd><SessionStatus projectId={projectId} session={session} /></dd></div>
           <div>
             <dt>{t("detail.agent")}</dt>
             <dd className="session-fact-stack">
@@ -223,7 +225,7 @@ export function SessionPage() {
             refreshToken={refreshToken}
           />
         ) : null}
-      </>
+      </DiagnosticScope.Provider>
     );
   }
 
diff --git a/apps/web/src/features/sessions/SessionStatus.tsx b/apps/web/src/features/sessions/SessionStatus.tsx
index b3c24e82f..de679bc46 100644
--- a/apps/web/src/features/sessions/SessionStatus.tsx
+++ b/apps/web/src/features/sessions/SessionStatus.tsx
@@ -2,6 +2,7 @@ import type { AgentSession } from "@agents-core-web/agents-client";
 import { useTranslation } from "react-i18next";
 
 import { HelpTip, StatusDot, type Tone } from "../../components/console-ui";
+import { SessionFailure } from "./session-diagnostics";
 import { statusKey } from "./session-log";
 
 export const sessionStatusTone: Record<string, Tone> = { in_progress: "pending", requires_action: "warning", failed: "danger", idle: "neutral" };
@@ -18,7 +19,7 @@ export function useWaitingFor() {
  * Failures stay visible under the status, truncated only in lists. Required
  * actions appear here in lists and in their own facts on the Session page.
  */
-export function SessionStatus({ session, truncate = false }: { session: AgentSession; truncate?: boolean }) {
+export function SessionStatus({ session, truncate = false, projectId }: { session: AgentSession; truncate?: boolean; projectId?: string }) {
   const { t } = useTranslation("sessions");
   const waitingFor = useWaitingFor()(session);
   const key = statusKey(session.status);
@@ -29,6 +30,7 @@ export function SessionStatus({ session, truncate = false }: { session: AgentSes
       {truncate && session.required_actions.some((action) => action.type === "function_call") ? <HelpTip label={t("log.waitingLabel")}>{t("detail.applicationAction")}</HelpTip> : null}
     </span>
   );
+  if (session.status === "failed" && projectId) return <span className={truncate ? "session-status session-status-truncated" : "session-status"}>{status}<SessionFailure projectId={projectId} session={session} truncate={truncate} /></span>;
   if (!reason) return status;
   return (
     <span className={truncate ? "session-status session-status-truncated" : "session-status"}>
diff --git a/apps/web/src/features/sessions/SessionTranscript.tsx b/apps/web/src/features/sessions/SessionTranscript.tsx
index 739d22c1f..3c79156d8 100644
--- a/apps/web/src/features/sessions/SessionTranscript.tsx
+++ b/apps/web/src/features/sessions/SessionTranscript.tsx
@@ -2,6 +2,7 @@ import type { AgentTurn, SessionItem } from "@agents-core-web/agents-client";
 import { useMemo } from "react";
 import { useTranslation } from "react-i18next";
 
+import { TurnFailure } from "./session-diagnostics";
 import { StatusDot } from "../../components/console-ui";
 import { formatDateTime, formatDuration, formatInteger } from "../../lib/format";
 import { ThreadItems } from "./items/ItemRenderers";
@@ -38,7 +39,8 @@ export function SessionTranscript({ turns, items, agentName }: { turns: readonly
             ) : null}
             {group.items.length || turn?.error || (turn && activityOf(turn.status)) ? (
               <div className="chat-stack">
-                <ThreadItems items={group.items} agentName={agentName} error={turn?.error?.message ?? null} activity={turn ? activityOf(turn.status) : null} />
+                <ThreadItems items={group.items} agentName={agentName} activity={turn ? activityOf(turn.status) : null} />
+                {turn ? <TurnFailure turn={turn} /> : null}
               </div>
             ) : null}
           </li>
diff --git a/apps/web/src/features/sessions/SessionTurnsTable.tsx b/apps/web/src/features/sessions/SessionTurnsTable.tsx
index 8769e3b8b..741898d2b 100644
--- a/apps/web/src/features/sessions/SessionTurnsTable.tsx
+++ b/apps/web/src/features/sessions/SessionTurnsTable.tsx
@@ -2,9 +2,10 @@ import type { AgentTurn, SessionItem } from "@agents-core-web/agents-client";
 import { useEffect, useMemo, useState } from "react";
 import { useTranslation } from "react-i18next";
 
-import { EmptyState, HelpTip, StatusDot, type Tone } from "../../components/console-ui";
+import { EmptyState, StatusDot, type Tone } from "../../components/console-ui";
 import { CopyableId } from "../../components/list-ui";
 import { formatDateTime, formatDuration, formatInteger, MISSING } from "../../lib/format";
+import { TurnFailure } from "./session-diagnostics";
 import { itemsPerTurn, turnAnchorId, turnDurationSeconds } from "./session-history";
 
 export const turnTone: Record<AgentTurn["status"], Tone> = {
@@ -61,8 +62,8 @@ export function SessionTurnsTable({ turns, items, failure = null }: { turns: rea
                   <td>
                     <span className="status-with-help">
                       <StatusDot tone={turnTone[turn.status] ?? "neutral"} label={t(`status.${turn.status}`)} />
-                      {turn.error ? <HelpTip label={t("turnTable.errorLabel")}>{turn.error.message}</HelpTip> : null}
                     </span>
+                    <TurnFailure turn={turn} />
                   </td>
                   <td className="session-nowrap">{turn.started_at === null ? MISSING : formatDateTime(turn.started_at, locale)}</td>
                   <td className="numeric">{formatDuration(turnDurationSeconds(turn, now))}</td>
diff --git a/apps/web/src/features/sessions/executor-connection-query.ts b/apps/web/src/features/sessions/executor-connection-query.ts
new file mode 100644
index 000000000..6441f6bda
--- /dev/null
+++ b/apps/web/src/features/sessions/executor-connection-query.ts
@@ -0,0 +1,22 @@
+import type { ExecutorCredentialList } from "@agents-core-web/agents-client";
+import { queryOptions } from "@tanstack/react-query";
+
+import { admin } from "../../lib/projects";
+import { sessionKey } from "./session-queries";
+
+export const EXECUTOR_CONNECTION_POLL_MS = 5_000;
+
+/** Metadata and Core's connection observation share one read; secrets never enter this cache. */
+export function executorConnectionQuery(projectId: string, sessionId: string, environmentId: string) {
+  return queryOptions<ExecutorCredentialList>({
+    queryKey: [...sessionKey(projectId, sessionId), "executor-connection", environmentId],
+    queryFn: async ({ signal }) => {
+      const { data, connection } = await admin.listExecutorCredentials(projectId, environmentId, { signal });
+      return { connection, data: [...data].sort((a, b) => Number(a.revoked_at !== null) - Number(b.revoked_at !== null) || Date.parse(b.created_at) - Date.parse(a.created_at)) };
+    },
+    staleTime: EXECUTOR_CONNECTION_POLL_MS,
+    refetchInterval: EXECUTOR_CONNECTION_POLL_MS,
+    refetchIntervalInBackground: false,
+    retry: false,
+  });
+}
diff --git a/apps/web/src/features/sessions/executor-connection.css b/apps/web/src/features/sessions/executor-connection.css
new file mode 100644
index 000000000..6e2829853
--- /dev/null
+++ b/apps/web/src/features/sessions/executor-connection.css
@@ -0,0 +1,8 @@
+.executor-connection { padding: 16px; border-bottom: 1px solid var(--line); }
+.executor-connection-heading { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; }
+.executor-connection-heading h3 { margin: 0; font-size: 13px; font-weight: 600; }
+.executor-connection-heading .refresh-button { margin-left: auto; }
+.executor-connection-warning { margin: 10px 0 0; color: var(--warning); }
+.executor-install-progress { display: inline-flex; align-items: center; gap: 6px; margin-left: auto; color: var(--ink-muted); }
+.executor-install-progress.is-done { color: var(--success); }
+.executor-credential-binding { display: inline-flex; align-items: center; gap: 6px; }
diff --git a/apps/web/src/features/sessions/executor-connection.test.ts b/apps/web/src/features/sessions/executor-connection.test.ts
new file mode 100644
index 000000000..cd21fe1d7
--- /dev/null
+++ b/apps/web/src/features/sessions/executor-connection.test.ts
@@ -0,0 +1,77 @@
+import type { ExecutorCredentialList } from "@agents-core-web/agents-client";
+import { QueryClient } from "@tanstack/react-query";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { boundExecutorCredential, executorConnectionState } from "./executor-connection";
+import { executorConnectionQuery, EXECUTOR_CONNECTION_POLL_MS } from "./executor-connection-query";
+
+const list = vi.hoisted(() => vi.fn());
+vi.mock("../../lib/projects", () => ({ admin: { listExecutorCredentials: list } }));
+
+const active = { key_id: "bound-key", created_at: "2026-09-28T01:00:00Z", revoked_at: null };
+function read(status: ExecutorCredentialList["connection"]["status"] = "disconnected"): ExecutorCredentialList {
+  return { data: [active], connection: { status, bound_key_id: status === "never_enrolled" ? null : "BOUND-KEY", enrolled_at: status === "never_enrolled" ? null : "2026-09-28T01:00:00Z", last_seen_at: null } };
+}
+
+afterEach(() => vi.clearAllMocks());
+
+describe("executor connection evidence", () => {
+  it("never treats an active credential or a recent heartbeat as a connection", () => {
+    expect(executorConnectionState(read("never_enrolled"), false)).toBe("never_enrolled");
+    const disconnected = read();
+    disconnected.connection.last_seen_at = new Date().toISOString();
+    expect(executorConnectionState(disconnected, false)).toBe("disconnected");
+  });
+  it("accepts Core connectivity even without a recorded heartbeat", () => {
+    expect(executorConnectionState(read("connected"), false)).toBe("connected");
+  });
+  it("distinguishes bound-key revocation from unrelated revoked keys", () => {
+    const result = read();
+    result.data.push({ ...active, key_id: "unrelated", revoked_at: "2026-09-28T02:00:00Z" });
+    expect(executorConnectionState(result, false)).toBe("disconnected");
+    result.data[0] = { ...active, revoked_at: "2026-09-28T02:00:00Z" };
+    expect(boundExecutorCredential(result)?.key_id).toBe("bound-key");
+    expect(executorConnectionState(result, false)).toBe("revoked");
+    result.connection.status = "connected";
+    expect(executorConnectionState(result, false)).toBe("connected");
+  });
+  it("does not guess a binding from credential order", () => {
+    const result = read();
+    result.connection.bound_key_id = null;
+    expect(boundExecutorCredential(result)).toBeUndefined();
+    expect(executorConnectionState(result, false)).toBe("disconnected");
+  });
+  it("withholds connected completion on stale or unread evidence", () => {
+    expect(executorConnectionState(read("connected"), true)).toBe("unknown");
+    expect(executorConnectionState(undefined, false)).toBe("unknown");
+  });
+});
+
+describe("executor connection read", () => {
+  it("keeps the list and connection together, retains failed reads, and recovers without writes", async () => {
+    const client = new QueryClient();
+    try {
+      const options = executorConnectionQuery("project", "session", "environment");
+      const response = read("connected");
+      response.data.unshift({ ...active, key_id: "old-revoked", revoked_at: "2026-09-28T02:00:00Z" });
+      list.mockResolvedValueOnce(response);
+      const result = await client.fetchQuery(options);
+      expect(result.connection).toEqual(response.connection);
+      expect(result.data.map((credential) => credential.key_id)).toEqual(["bound-key", "old-revoked"]);
+      expect(response.data[0]?.key_id).toBe("old-revoked");
+      list.mockRejectedValueOnce(new Error("unavailable"));
+      await expect(client.fetchQuery({ ...options, staleTime: 0 })).rejects.toThrow("unavailable");
+      expect(client.getQueryData(options.queryKey)).toEqual(result);
+      expect(list).toHaveBeenCalledTimes(2);
+      list.mockResolvedValueOnce(read("disconnected"));
+      expect((await client.fetchQuery({ ...options, staleTime: 0 })).connection.status).toBe("disconnected");
+    } finally { client.clear(); }
+  });
+  it("bounds polling to five seconds and disables background polls and retries", () => {
+    const options = executorConnectionQuery("project", "session", "environment");
+    expect(EXECUTOR_CONNECTION_POLL_MS).toBeGreaterThanOrEqual(5_000);
+    expect(options.refetchInterval).toBe(EXECUTOR_CONNECTION_POLL_MS);
+    expect(options.refetchIntervalInBackground).toBe(false);
+    expect(options.retry).toBe(false);
+  });
+});
diff --git a/apps/web/src/features/sessions/executor-connection.ts b/apps/web/src/features/sessions/executor-connection.ts
new file mode 100644
index 000000000..85e309ee9
--- /dev/null
+++ b/apps/web/src/features/sessions/executor-connection.ts
@@ -0,0 +1,15 @@
+import type { ExecutorCredentialList } from "@agents-core-web/agents-client";
+
+export type ExecutorConnectionState = "never_enrolled" | "connected" | "disconnected" | "revoked" | "unknown";
+
+export function boundExecutorCredential(read: ExecutorCredentialList | undefined) {
+  const boundId = read?.connection.bound_key_id;
+  return boundId ? read.data.find((credential) => credential.key_id.toLowerCase() === boundId.toLowerCase()) : undefined;
+}
+
+/** Core alone decides connectivity; a revoked matching row adds the recovery reason. */
+export function executorConnectionState(read: ExecutorCredentialList | undefined, stale: boolean): ExecutorConnectionState {
+  if (!read || stale) return "unknown";
+  if (read.connection.status === "disconnected" && boundExecutorCredential(read)?.revoked_at) return "revoked";
+  return read.connection.status;
+}
diff --git a/apps/web/src/features/sessions/executor-credential-file.tsx b/apps/web/src/features/sessions/executor-credential-file.tsx
new file mode 100644
index 000000000..a686c1169
--- /dev/null
+++ b/apps/web/src/features/sessions/executor-credential-file.tsx
@@ -0,0 +1,64 @@
+import type { IssuedExecutorCredential } from "@agents-core-web/agents-client";
+import { Check, Copy, Download } from "lucide-react";
+import { useEffect, useRef } from "react";
+import { Trans, useTranslation } from "react-i18next";
+
+import { useCopy } from "../api-keys/IssuedKey";
+import { saveBlob } from "../skills/skill-operations";
+import { InstallCommand, useSelectWhenCopyFails } from "./ExecutorInstallPanel";
+
+/**
+ * The self-hosted executor's credential as one line of JSON. The installer
+ * also accepts it pretty-printed, but a one-line paste survives terminals that
+ * warn about or bracket multi-line pastes; `--credential-file` reads the same
+ * JSON from the downloaded file.
+ */
+function credentialText(credential: IssuedExecutorCredential): string {
+  const { key_id, environment_id, executor_token } = credential;
+  return JSON.stringify({ key_id, environment_id, executor_token });
+}
+
+/**
+ * The one-time credential: copied to paste at the installer's hidden prompt,
+ * or downloaded as a file for automation (`--credential-file`). What to do
+ * next comes first: in the dialog, run the install command shown with it; on
+ * the page, run the Connect a host command below; without the installer, save
+ * the credential.
+ */
+export function CredentialFile({ credential, next, command = null }: { credential: IssuedExecutorCredential; next: "inline" | "panel" | "save"; command?: string | null }) {
+  const { t } = useTranslation("sessions");
+  const text = credentialText(credential);
+  const { state, copy } = useCopy(text);
+  const file = useRef<HTMLPreElement>(null);
+  useSelectWhenCopyFails(state, file);
+  // A downloaded credential's object URL goes with the credential: on Done or when this leaves the page.
+  const downloads = useRef<(() => void)[]>([]);
+  useEffect(() => {
+    const revokes = downloads.current;
+    return () => { for (const revoke of revokes.splice(0)) revoke(); };
+  }, []);
+  const download = () => {
+    downloads.current.push(saveBlob(new Blob([`${text}\n`], { type: "application/json" }), `executor-credential-${credential.environment_id.slice(0, 8)}.json`));
+  };
+  return (
+    <div className="executor-credential">
+      <p className="executor-credential-notice">{t("executor.issued.notice")}</p>
+      <p className="executor-credential-next">{t(`executor.issued.next.${next}`)}</p>
+      {command ? <InstallCommand value={command} /> : null}
+      <div role="region" aria-label={t("executor.issued.fileLabel")}><pre ref={file} className="executor-credential-file"><code>{text}</code></pre></div>
+      <div className="executor-credential-actions">
+        <button className="button primary" type="button" onClick={() => void copy()}>
+          {state === "copied" ? <Check size={14} aria-hidden="true" /> : <Copy size={14} aria-hidden="true" />}
+          {state === "copied" ? t("executor.issued.copied") : t("executor.issued.copy")}
+        </button>
+        <button className="button outline" type="button" onClick={download}>
+          <Download size={14} aria-hidden="true" />{t("executor.issued.download")}
+        </button>
+      </div>
+      {state === "failed" ? <p className="executor-credential-error" role="alert">{t("executor.issued.copyFailed")}</p> : null}
+      <p className="executor-credential-hint">
+        <Trans t={t} i18nKey={next === "save" ? "executor.issued.downloadHint.installer" : "executor.issued.downloadHint.command"} components={{ chmod: <code>chmod 600 &lt;file&gt;</code>, flag: <code>--credential-file &lt;absolute path&gt;</code> }} />
+      </p>
+    </div>
+  );
+}
diff --git a/apps/web/src/features/sessions/executor-credential-ownership.test.tsx b/apps/web/src/features/sessions/executor-credential-ownership.test.tsx
new file mode 100644
index 000000000..b8b7fef13
--- /dev/null
+++ b/apps/web/src/features/sessions/executor-credential-ownership.test.tsx
@@ -0,0 +1,84 @@
+import type { ExecutorCredentialList } from "@agents-core-web/agents-client";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { renderToStaticMarkup } from "react-dom/server";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import i18n from "../../i18n";
+import { ExecutorCredentialsSection } from "./ExecutorCredentialsSection";
+import { executorConnectionQuery } from "./executor-connection-query";
+
+const project = vi.hoisted(() => ({ archived: false }));
+vi.mock("../../lib/projects", async (original) => ({
+  ...await original<typeof import("../../lib/projects")>(),
+  useProjects: () => ({ byId: new Map([["project", { status: project.archived ? "archived" : "active" }]]), refresh: () => undefined }),
+}));
+vi.mock("./ExecutorInstallPanel", () => ({
+  useExecutorInstall: () => ({ kind: "unavailable" }),
+  ExecutorInstallPanel: ({ connected }: { connected: boolean }) => <span data-host-connected={String(connected)} />,
+}));
+
+const boundId = "10000000-0000-4000-8000-000000000001";
+const newId = "20000000-0000-4000-8000-000000000002";
+function read(revoked = false): ExecutorCredentialList {
+  return {
+    data: [
+      { key_id: boundId, created_at: "2026-09-28T01:00:00Z", revoked_at: revoked ? "2026-09-28T02:00:00Z" : null },
+      { key_id: newId, created_at: "2026-09-28T03:00:00Z", revoked_at: null },
+    ],
+    connection: { status: "disconnected", bound_key_id: boundId, enrolled_at: "2026-09-28T01:00:00Z", last_seen_at: "2026-09-28T01:30:00Z" },
+  };
+}
+function render(value: ExecutorCredentialList | null, failed = false) {
+  const client = new QueryClient({ defaultOptions: { queries: { enabled: false, retry: false, gcTime: Infinity } } });
+  const options = executorConnectionQuery("project", "session", "environment");
+  if (value) client.setQueryData(options.queryKey, value);
+  else client.getQueryCache().build(client, { queryKey: options.queryKey });
+  if (failed) client.getQueryCache().find({ queryKey: options.queryKey })!.setState({ status: "error", error: new Error("unavailable"), errorUpdatedAt: Date.now() + 1_000 });
+  const html = renderToStaticMarkup(<QueryClientProvider client={client}><ExecutorCredentialsSection projectId="project" sessionId="session" environmentId="environment" remoteUrl="wss://core.example" /></QueryClientProvider>);
+  client.clear();
+  return html;
+}
+afterEach(async () => { project.archived = false; await i18n.changeLanguage("en"); });
+
+describe("executor credential display ownership", () => {
+  it("shows binding and its single rotation action only on the matching credential row", () => {
+    const html = render(read());
+    const panel = html.match(/<section class="executor-connection"[\s\S]*?<\/section>/)?.[0] ?? "";
+    expect(panel).not.toContain(boundId);
+    expect(panel).not.toContain("Rotate");
+    expect(panel).toContain("Refresh · Host connection");
+    expect(panel).not.toContain("executor-connection-facts");
+    expect(html.match(/aria-label="Copy credential ID"/g)).toHaveLength(2);
+    expect(html.match(/aria-label="Rotate bound credential"/g)).toHaveLength(1);
+    const rows = html.split("<tr");
+    expect(rows.find((row) => row.includes(boundId))).toContain("Bound credential</span>");
+    expect(rows.find((row) => row.includes(newId))).not.toContain("Bound credential</span>");
+  });
+
+  it("keeps restore on the bound revoked row and hides it for an archived Project", () => {
+    const html = render(read(true));
+    expect(html.match(/aria-label="Rotate to restore"/g)).toHaveLength(1);
+    expect(html).not.toContain(`aria-label="Restore credential`);
+    project.archived = true;
+    expect(render(read(true))).not.toContain('aria-label="Rotate to restore"');
+  });
+
+  it("retains stale binding while disabling its action and withholding host completion", () => {
+    const value = read(); value.connection.status = "connected";
+    expect(render(value)).toContain('data-host-connected="true"');
+    const stale = render(value, true);
+    expect(stale).toContain("Refresh failed. Showing the last loaded binding");
+    expect(stale).toContain('aria-label="Rotate bound credential" disabled=""');
+    expect(stale).toContain('data-host-connected="false"');
+    expect(render(null, true)).toContain("The connection could not be read");
+    expect(render(null, true)).not.toContain(">Retry</button>");
+  });
+
+  it("uses the same row ownership and recovery wording in Chinese", async () => {
+    await i18n.changeLanguage("zh-CN");
+    const html = render(read(true));
+    expect(html).toContain("绑定凭证</span>");
+    expect(html.match(/aria-label="轮换以恢复"/g)).toHaveLength(1);
+    expect(html).toContain("刷新 · 主机连接");
+    expect(html).toContain('data-host-connected="false"');
+  });
+});
diff --git a/apps/web/src/features/sessions/session-diagnostics.test.tsx b/apps/web/src/features/sessions/session-diagnostics.test.tsx
new file mode 100644
index 000000000..0057c4c00
--- /dev/null
+++ b/apps/web/src/features/sessions/session-diagnostics.test.tsx
@@ -0,0 +1,80 @@
+import type { AgentSession, AgentTurn, DiagnosticFailure, SessionDiagnostics, TurnDiagnostics } from "@agents-core-web/agents-client";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { renderToStaticMarkup } from "react-dom/server";
+import { afterEach, describe, expect, it } from "vitest";
+
+import i18n from "../../i18n";
+import { diagnosticFailure } from "../../lib/diagnostic-failure";
+import { DiagnosticScope, SessionFailure, TurnFailure, sessionDiagnosticsQuery, turnDiagnosticsQuery } from "./session-diagnostics";
+import { ItemReceiptTiming } from "./trace/ItemReceiptTiming";
+
+const scope = { projectId: "project", sessionId: "session" };
+const session = { id: "session", status: "failed", last_active_at: 20 } as AgentSession;
+const turn = { id: "turn", session_id: "session", status: "failed", completed_at: 20, error: { code: "internal_error", message: "PRIVATE_NATIVE_SENTINEL" } } as AgentTurn;
+const failure: DiagnosticFailure = { code: "authentication_error", params: {}, failed_at: null };
+const sessionData: SessionDiagnostics = { object: "core.session_diagnostics", session_id: "session", status: "failed", failure: { ...failure, source: "turn", turn_id: "turn" } };
+const turnData: TurnDiagnostics = { object: "core.turn_diagnostics", session_id: "session", turn_id: "turn", status: "failed", failure, items: [], items_truncated: false };
+
+afterEach(() => { void i18n.changeLanguage("en"); });
+
+function render(kind: "session" | "turn", data: SessionDiagnostics | TurnDiagnostics, error = false) {
+  const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  const key = kind === "session" ? sessionDiagnosticsQuery(scope.projectId, session).queryKey : turnDiagnosticsQuery(scope, turn).queryKey;
+  client.setQueryData(key, data);
+  if (error) client.getQueryCache().find({ queryKey: key })!.setState({ status: "error", error: new Error("PRIVATE_READ_SENTINEL") });
+  const html = renderToStaticMarkup(<QueryClientProvider client={client}><DiagnosticScope.Provider value={scope}>
+    {kind === "session" ? <SessionFailure projectId={scope.projectId} session={session} truncate={false} /> : <TurnFailure turn={turn} />}
+  </DiagnosticScope.Provider></QueryClientProvider>);
+  client.clear();
+  return html;
+}
+
+describe("Core diagnostics in the console", () => {
+  it("renders safe classified Session and root Turn failures in both languages", async () => {
+    expect(render("session", sessionData)).toContain("Check its API key");
+    expect(render("turn", turnData)).toContain("Check its API key");
+    await i18n.changeLanguage("zh-CN");
+    expect(render("session", sessionData)).toContain("模型服务认证失败");
+    expect(render("turn", turnData)).not.toContain("PRIVATE_NATIVE_SENTINEL");
+  });
+
+  it("withholds old causes after a failed read or mismatched status", () => {
+    expect(render("session", sessionData, true)).toContain("Failure details unavailable");
+    expect(render("turn", { ...turnData, status: "completed", failure: null })).not.toContain("Check its API key");
+    expect(render("turn", turnData, true)).not.toContain("PRIVATE_READ_SENTINEL");
+  });
+
+  it("does not read healthy Sessions, and separates projects, status changes and Turns", () => {
+    expect(sessionDiagnosticsQuery("project", { ...session, status: "idle" }).enabled).toBe(false);
+    expect(sessionDiagnosticsQuery("other", session).queryKey).not.toEqual(sessionDiagnosticsQuery("project", session).queryKey);
+    expect(turnDiagnosticsQuery(scope, { ...turn, status: "in_progress" }).refetchInterval).toBe(5000);
+    expect(turnDiagnosticsQuery(scope, turn).refetchInterval).toBe(false);
+    expect(turnDiagnosticsQuery(scope, turn).retry).toBe(false);
+  });
+
+  it("renders only typed provisioning metadata and does not guess a timeout", () => {
+    const t = i18n.getFixedT("en", "diagnostics");
+    const text = diagnosticFailure({ code: "environment_provisioning_failed", params: { step: "setup", index: 0, exit_code: 7 }, failed_at: null }, t);
+    expect(text).toContain("Setup command 1");
+    expect(text).toContain("Exit code 7");
+    expect(diagnosticFailure({ code: "harness_error", params: {}, failed_at: null }, t)).not.toContain("timed out");
+    expect(diagnosticFailure({ code: "connection_failed", params: { http_status: 429 }, failed_at: null }, t)).toContain("HTTP 429");
+  });
+
+  it("keeps call/result receipt intervals distinct and historical settlement missing", () => {
+    const client = new QueryClient();
+    client.setQueryData(turnDiagnosticsQuery(scope, turn).queryKey, { ...turnData, items: [
+      { item_id: "CALL", started_at: "2026-09-28T00:00:00Z", completed_at: null, observed_duration_ms: null },
+      { item_id: "RESULT", started_at: "2026-09-28T00:00:02Z", completed_at: "2026-09-28T00:00:01Z", observed_duration_ms: -1000 },
+    ], items_truncated: true });
+    const html = renderToStaticMarkup(<QueryClientProvider client={client}><DiagnosticScope.Provider value={scope}>
+      <ItemReceiptTiming turn={turn} items={[{ id: "call" }, { id: "result" }] as never} />
+    </DiagnosticScope.Provider></QueryClientProvider>);
+    expect(html).toContain("Core receipt times");
+    expect(html).toContain("first 1,000 Items");
+    expect(html).toContain("clock moved backwards");
+    expect(html).not.toContain("0 ms");
+    expect(html).toContain("—");
+    client.clear();
+  });
+});
diff --git a/apps/web/src/features/sessions/session-diagnostics.tsx b/apps/web/src/features/sessions/session-diagnostics.tsx
new file mode 100644
index 000000000..2bee28d8d
--- /dev/null
+++ b/apps/web/src/features/sessions/session-diagnostics.tsx
@@ -0,0 +1,64 @@
+import type { AgentSession, AgentTurn } from "@agents-core-web/agents-client";
+import { queryOptions, useQuery } from "@tanstack/react-query";
+import { createContext, useContext } from "react";
+import { useTranslation } from "react-i18next";
+
+import { HelpTip } from "../../components/console-ui";
+import { diagnosticFailure } from "../../lib/diagnostic-failure";
+import { admin } from "../../lib/projects";
+import { sessionKey } from "./session-queries";
+
+type Scope = { projectId: string; sessionId: string };
+export const DiagnosticScope = createContext<Scope | null>(null);
+
+export function sessionDiagnosticsQuery(projectId: string, session: AgentSession) {
+  return queryOptions({
+    queryKey: [...sessionKey(projectId, session.id), "diagnostics", "session", session.status, session.last_active_at],
+    queryFn: ({ signal }) => admin.retrieveSessionDiagnostics(projectId, session.id, { signal }),
+    enabled: session.status === "failed",
+    retry: false,
+    staleTime: 5_000,
+  });
+}
+
+export function turnDiagnosticsQuery(scope: Scope, turn: AgentTurn) {
+  return queryOptions({
+    queryKey: [...sessionKey(scope.projectId, scope.sessionId), "diagnostics", "turn", turn.id, turn.status, turn.completed_at],
+    queryFn: ({ signal }) => admin.retrieveTurnDiagnostics(scope.projectId, scope.sessionId, turn.id, { signal }),
+    retry: false,
+    staleTime: 5_000,
+    refetchInterval: ["queued", "in_progress", "waiting"].includes(turn.status) ? 5_000 : false,
+  });
+}
+
+export function DiagnosticsUnavailable({ pending, retry }: { pending: boolean; retry: () => void }) {
+  const { t } = useTranslation("diagnostics");
+  return <span className="status-with-help" role="status">
+    {pending ? <span className="skeleton-bar" aria-label={t("checking")} /> : <span>{t("unavailable")}</span>}
+    {!pending ? <><HelpTip label={t("failureLabel")}>{t("unavailableHelp")}</HelpTip><button className="text-action" type="button" onClick={retry}>{t("retry")}</button></> : null}
+  </span>;
+}
+
+/** Mounted for failed rows on the current page only; no fan-out over hidden Sessions. */
+export function SessionFailure({ projectId, session, truncate }: { projectId: string; session: AgentSession; truncate: boolean }) {
+  const { t } = useTranslation("diagnostics");
+  const query = useQuery(sessionDiagnosticsQuery(projectId, session));
+  const failure = !query.isError && query.data?.status === session.status ? query.data.failure : null;
+  const reason = failure ? diagnosticFailure(failure, t) : null;
+  return <span className="session-status-reason" title={truncate && reason ? reason : undefined}>
+    {reason ?? <DiagnosticsUnavailable pending={query.isPending} retry={() => void query.refetch()} />}
+  </span>;
+}
+
+function ScopedTurnFailure({ turn, scope }: { turn: AgentTurn; scope: Scope }) {
+  const { t } = useTranslation("diagnostics");
+  const query = useQuery(turnDiagnosticsQuery(scope, turn));
+  const failure = !query.isError && query.data?.status === turn.status ? query.data.failure : null;
+  return <span className="session-status-reason">{failure ? diagnosticFailure(failure, t) : <DiagnosticsUnavailable pending={query.isPending} retry={() => void query.refetch()} />}</span>;
+}
+
+export function TurnFailure({ turn }: { turn: AgentTurn }) {
+  const scope = useContext(DiagnosticScope);
+  if (turn.status !== "failed") return null;
+  return scope ? <ScopedTurnFailure scope={scope} turn={turn} /> : <span className="session-status-reason">{turn.error?.message}</span>;
+}
diff --git a/apps/web/src/features/sessions/session-queries.ts b/apps/web/src/features/sessions/session-queries.ts
index 69cd14324..219442e0c 100644
--- a/apps/web/src/features/sessions/session-queries.ts
+++ b/apps/web/src/features/sessions/session-queries.ts
@@ -1,7 +1,7 @@
-import { AgentCoreError, type AgentSession, type ExecutorCredential, type RuntimeObservation } from "@agents-core-web/agents-client";
+import { AgentCoreError, type AgentSession, type RuntimeObservation } from "@agents-core-web/agents-client";
 import { queryOptions } from "@tanstack/react-query";
 
-import { admin, projectClient } from "../../lib/projects";
+import { projectClient } from "../../lib/projects";
 import { retryTransient } from "../resources/detail-queries";
 import { loadSessionHistory, nextPollDelay, type SessionHistory } from "./session-history";
 import { loadSessionRuntimeHistory, type SessionRuntimeHistory, type SessionRuntimeRange } from "./session-runtime";
@@ -100,19 +100,3 @@ export function sessionRuntimeHistoryQuery(projectId: string, session: AgentSess
     retry: retryTransient,
   });
 }
-
-/**
- * The executor credentials of a self-hosted Session's environment, active
- * first, then newest first. Only metadata: an issued credential never enters
- * the cache.
- */
-export function executorCredentialsQuery(projectId: string, sessionId: string, environmentId: string) {
-  return queryOptions<ExecutorCredential[]>({
-    queryKey: [...sessionKey(projectId, sessionId), "executor-credentials", environmentId],
-    queryFn: async ({ signal }) => {
-      const { data } = await admin.listExecutorCredentials(projectId, environmentId, { signal });
-      return [...data].sort((a, b) => Number(a.revoked_at !== null) - Number(b.revoked_at !== null) || Date.parse(b.created_at) - Date.parse(a.created_at));
-    },
-    retry: retryTransient,
-  });
-}
diff --git a/apps/web/src/features/sessions/trace/ItemReceiptTiming.tsx b/apps/web/src/features/sessions/trace/ItemReceiptTiming.tsx
new file mode 100644
index 000000000..6173794a4
--- /dev/null
+++ b/apps/web/src/features/sessions/trace/ItemReceiptTiming.tsx
@@ -0,0 +1,43 @@
+import "./receipt-timing.css";
+
+import type { AgentTurn, SessionItem } from "@agents-core-web/agents-client";
+import { useQuery } from "@tanstack/react-query";
+import { useContext } from "react";
+import { useTranslation } from "react-i18next";
+
+import { HelpTip } from "../../../components/console-ui";
+import { CopyableId } from "../../../components/list-ui";
+import { formatDateTime, formatDuration, MISSING } from "../../../lib/format";
+import { DiagnosticScope, turnDiagnosticsQuery } from "../session-diagnostics";
+
+/** Read only the selected root Turn, keeping merged call/result receipts distinct. */
+export function ItemReceiptTiming({ turn, items }: { turn: AgentTurn | null; items: readonly SessionItem[] }) {
+  const scope = useContext(DiagnosticScope);
+  const { t } = useTranslation("diagnostics");
+  return scope && turn
+    ? <ReceiptRead scope={scope} turn={turn} items={items} />
+    : <p>{t("receiptMissing")}</p>;
+}
+
+function ReceiptRead({ scope, turn, items }: { scope: { projectId: string; sessionId: string }; turn: AgentTurn; items: readonly SessionItem[] }) {
+  const { t, i18n } = useTranslation("diagnostics");
+  const query = useQuery(turnDiagnosticsQuery(scope, turn));
+  if (query.isPending) return <div className="skeleton-bar" role="status" aria-label={t("checking")} />;
+  if (query.isError || query.data.status !== turn.status) return <p role="status">{t("receiptUnavailable")} <button type="button" className="text-action" onClick={() => void query.refetch()}>{t("retry")}</button></p>;
+  const date = (value: string | null) => value === null ? MISSING : formatDateTime(Date.parse(value) / 1000, i18n.resolvedLanguage);
+  return <section className="trace-receipt-timing" aria-label={t("receiptTitle")}>
+    <p className="status-with-help">{t("receiptTitle")}<HelpTip>{t("receiptHelp")}</HelpTip></p>
+    {items.map((item) => {
+      const timing = query.data.items.find((entry) => entry.item_id.toLowerCase() === item.id.toLowerCase());
+      return <div className="trace-receipt-item" key={item.id}>
+        {items.length > 1 ? <CopyableId id={item.id} compact /> : null}
+        {timing ? <dl>
+          <div><dt>{t("receiptStarted")}</dt><dd>{date(timing.started_at)}</dd></div>
+          <div><dt>{t("receiptCompleted")}</dt><dd>{date(timing.completed_at)}</dd></div>
+          <div><dt>{t("receiptDuration")}</dt><dd>{formatDuration(timing.observed_duration_ms === null ? null : timing.observed_duration_ms / 1000)}{timing.observed_duration_ms !== null && timing.observed_duration_ms < 0 ? <HelpTip>{t("clockChange")}</HelpTip> : null}</dd></div>
+        </dl> : <p>{t("receiptMissing")}</p>}
+      </div>;
+    })}
+    {query.data.items_truncated ? <p role="status">{t("truncated")}</p> : null}
+  </section>;
+}
diff --git a/apps/web/src/features/sessions/trace/TraceTimingPanel.tsx b/apps/web/src/features/sessions/trace/TraceTimingPanel.tsx
new file mode 100644
index 000000000..820a317c7
--- /dev/null
+++ b/apps/web/src/features/sessions/trace/TraceTimingPanel.tsx
@@ -0,0 +1,21 @@
+import { useTranslation } from "react-i18next";
+
+import { formatDateTime, formatDuration, MISSING } from "../../../lib/format";
+import { ItemReceiptTiming } from "./ItemReceiptTiming";
+import type { TraceGroup, TraceRow } from "./trace-model";
+
+/** Native tool duration, public Turn times and Core receipts remain separate. */
+export function TraceTimingPanel({ row, group }: { row: TraceRow; group: TraceGroup }) {
+  const { t, i18n } = useTranslation("sessions");
+  const duration = row.durationMs.state === "available" && row.durationMs.value !== null
+    ? formatDuration(row.durationMs.value / 1000) : t(row.durationMs.state === "unknown" ? "common.unknown" : "common.unavailable");
+  return <div className="trace-detail-timing">
+    <dl>
+      <div><dt>{t("trace.turnStarted")}</dt><dd>{formatDateTime(group.turn?.started_at, i18n.resolvedLanguage)}</dd></div>
+      <div><dt>{t("trace.turnCompleted")}</dt><dd>{formatDateTime(group.turn?.completed_at, i18n.resolvedLanguage)}</dd></div>
+      <div><dt>{t("trace.turnWallClock")}</dt><dd>{group.turnWallClockDurationMs.value === null ? MISSING : formatDuration(group.turnWallClockDurationMs.value / 1000)}</dd></div>
+      <div><dt>{t("trace.toolReportedDuration")}</dt><dd>{duration}</dd></div>
+    </dl>
+    <ItemReceiptTiming turn={group.turn} items={row.sourceItems} />
+  </div>;
+}
diff --git a/apps/web/src/features/sessions/trace/TraceView.tsx b/apps/web/src/features/sessions/trace/TraceView.tsx
index cf27957f7..afcf495e7 100644
--- a/apps/web/src/features/sessions/trace/TraceView.tsx
+++ b/apps/web/src/features/sessions/trace/TraceView.tsx
@@ -25,6 +25,8 @@ import type {
   SessionItem,
 } from "@agents-core-web/agents-client";
 
+import { TraceTimingPanel } from "./TraceTimingPanel";
+import { TurnFailure } from "../session-diagnostics";
 import { HelpTip } from "../../../components/console-ui";
 import { MessageMarkdown } from "../../../components/MessageMarkdown";
 import { StatusIcon, type StatusKind } from "../../../components/StatusIcon";
@@ -268,23 +270,6 @@ function TracePreviewPanel({ row }: { row: TraceRow }) {
   return <pre className="trace-detail-text">{row.text.value}</pre>;
 }
 
-function TraceTimingPanel({ row, group }: { row: TraceRow; group: TraceGroup }) {
-  const { t, i18n } = useTranslation("sessions");
-  const translate = t as Translate;
-  const locale = i18n.resolvedLanguage || "en";
-  return (
-    <div className="trace-detail-timing">
-      <dl>
-        <div><dt>{t("trace.turnStarted")}</dt><dd>{formatTimestamp(group.turn?.started_at, locale, t("common.unknown"))}</dd></div>
-        <div><dt>{t("trace.turnCompleted")}</dt><dd>{formatTimestamp(group.turn?.completed_at, locale, t("common.unknown"))}</dd></div>
-        <div><dt>{t("trace.turnWallClock")}</dt><dd>{valueLabel(group.turnWallClockDurationMs, translate, (value) => formatDuration(value, locale))}</dd></div>
-        <div><dt className="trace-dt-help">{t("trace.itemStarted")}<HelpTip>{t("trace.timingBoundary")}</HelpTip></dt><dd>{t("trace.notProvidedByCore")}</dd></div>
-        <div><dt>{t("trace.itemCompleted")}</dt><dd>{t("trace.notProvidedByCore")}</dd></div>
-        <div><dt>{t("trace.toolReportedDuration")}</dt><dd>{durationDetailLabel(row.durationMs, translate, locale)}</dd></div>
-      </dl>
-    </div>
-  );
-}
 
 function ApplyPatchPreview({ row }: { row: TraceRow }) {
   const item = applyPatchItem(row);
@@ -470,6 +455,7 @@ export function TraceView({
                   <span className="trace-group-duration" title={t("trace.turnWallClockDuration")}>{turnDurationLabel(group.turnWallClockDurationMs, translate, locale)}</span>
                 ) : null}
               </header>
+              {group.turn ? <TurnFailure turn={group.turn} /> : null}
               {group.rows.length ? (
                 <ol>
                   {group.rows.map((row) => {
diff --git a/apps/web/src/features/sessions/trace/receipt-timing.css b/apps/web/src/features/sessions/trace/receipt-timing.css
new file mode 100644
index 000000000..8a1c92063
--- /dev/null
+++ b/apps/web/src/features/sessions/trace/receipt-timing.css
@@ -0,0 +1,5 @@
+.trace-receipt-timing { margin-top: 18px; padding-top: 14px; border-top: 1px solid var(--line); }
+.trace-detail-timing .trace-receipt-timing > p { margin: 0 0 12px; }
+.trace-receipt-item + .trace-receipt-item { margin-top: 16px; }
+.trace-receipt-item dl { display: grid; gap: 8px; margin: 8px 0 0; }
+.trace-receipt-item dl > div { display: grid; grid-template-columns: minmax(110px, 38%) minmax(0, 1fr); gap: 12px; }
diff --git a/apps/web/src/features/system/DefaultModelsSection.tsx b/apps/web/src/features/system/DefaultModelsSection.tsx
index fa22b6cc7..3575f2ab3 100644
--- a/apps/web/src/features/system/DefaultModelsSection.tsx
+++ b/apps/web/src/features/system/DefaultModelsSection.tsx
@@ -4,17 +4,18 @@ import { useCallback, useId, useRef, useState, type ReactNode } from "react";
 import { useTranslation } from "react-i18next";
 
 import { ConfirmDialog } from "../../components/ConfirmDialog";
-import { EmptyState, HelpTip, revealInPageBody, Section, StatusDot } from "../../components/console-ui";
+import { EmptyState, HelpTip, revealInPageBody, Section } from "../../components/console-ui";
 import { ErrorState } from "../../components/ErrorState";
 import { Modal } from "../../components/Modal";
 import { TableSkeleton } from "../../components/Skeleton";
 import { failedLast, useFailureToast, useToast } from "../../components/Toast";
+import { coreError, coreFieldError } from "../../lib/core-error";
 import { useDeleteFlow } from "../../lib/delete-flow";
-import { formatDateTime, formatInteger } from "../../lib/format";
+import { formatInteger } from "../../lib/format";
 import { useConsoleIntent } from "../../lib/console-navigation";
 import { harnessNames, protocolNames } from "../../lib/harness-labels";
 import { admin } from "../../lib/projects";
-import { Fact } from "./Fact";
+import { HarnessCard } from "./HarnessCard";
 import { harnessesQuery } from "./harness-queries";
 
 /** A write that gets no answer in this time has an unknown outcome. */
@@ -101,7 +102,7 @@ export function DefaultModelsSection() {
     body = (
       <div className="system-models">
         {harnesses.map((harness) => (
-          <HarnessCard key={harness.id} harness={harness} busy={clear.busy} onEdit={() => setEditing(harness.id)} onClear={() => clear.ask(harness.id)} />
+          <HarnessCard key={harness.id} harness={harness} busy={clear.busy} stale={failedLast(query)} onEdit={() => setEditing(harness.id)} onClear={() => clear.ask(harness.id)} />
         ))}
       </div>
     );
@@ -143,57 +144,15 @@ export function DefaultModelsSection() {
   );
 }
 
-function HarnessCard({ harness, busy, onEdit, onClear }: { harness: CoreHarness; busy: boolean; onEdit: () => void; onClear: () => void }) {
-  const { t, i18n } = useTranslation("system");
-  const locale = i18n.resolvedLanguage;
-  const headingId = useId();
-  const name = harnessNames[harness.id];
-  const provider = harness.model_provider;
-  return (
-    <article className="system-model" aria-labelledby={headingId} data-default={harness.default ? "" : undefined}>
-      <header className="system-model-header">
-        <h3 id={headingId}>{name}</h3>
-        <div className="system-model-actions">
-          {/* A disabled harness may still be configured; Core keeps the provider until it is enabled. */}
-          <button className="button outline" type="button" aria-label={t(provider ? "models.replaceLabel" : "models.setLabel", { harness: name })} disabled={busy} onClick={onEdit}>
-            {provider ? t("models.replace") : t("models.set")}
-          </button>
-          {provider ? (
-            <button className="button outline" type="button" aria-label={t("models.clearLabel", { harness: name })} disabled={busy} onClick={onClear}>
-              {t("models.clear")}
-            </button>
-          ) : null}
-        </div>
-      </header>
-      <dl className="system-model-facts">
-        <Fact label={t("models.harness")} help={t("models.startupHelp")}>
-          <span className="system-model-state">
-            <StatusDot tone={harness.enabled ? "ok" : "neutral"} label={harness.enabled ? t("models.enabled") : t("models.disabled")} />
-            {harness.default ? <span className="pill">{t("models.default")}</span> : null}
-          </span>
-        </Fact>
-        {provider ? <>
-          <Fact label={t("models.protocol")}>{protocolNames[provider.protocol]}</Fact>
-          <Fact label={t("models.baseUrl")}><code className="system-code">{provider.base_url}</code></Fact>
-          <Fact label={t("models.apiKey")}>{provider.api_key_configured ? t("models.keyConfigured") : t("models.keyNotConfigured")}</Fact>
-          {provider.context_window !== undefined ? <Fact label={t("models.contextWindow")}>{formatInteger(provider.context_window, locale)}</Fact> : null}
-          {provider.max_output_tokens !== undefined ? <Fact label={t("models.maxOutputTokens")}>{formatInteger(provider.max_output_tokens, locale)}</Fact> : null}
-          <Fact label={t("models.updated")}>{formatDateTime(Math.floor(Date.parse(provider.updated_at) / 1000), locale)}</Fact>
-        </> : (
-          <Fact label={t("models.provider")}><span className="system-muted">{t("models.notSet")}</span></Fact>
-        )}
-      </dl>
-    </article>
-  );
-}
+
 
 /**
  * Sets or replaces one harness's provider. Non-secret fields start from the
  * current provider; the API key never does. The protocol is the one Core
  * accepts for the harness. The form checks the HTTPS provider URL and whole-number
  * limits within Core's range, with max output no larger than the context window.
- * Core's other rules come back as its 400 message, shown
- * beside the form. Enter saves; a save in flight blocks another.
+ * Core's typed rejection is shown beside its field, or beside the form
+ * when no editable field applies. Enter saves; a save in flight blocks another.
  */
 function ModelProviderDialog({ harness, onClose, onSaved, onReread }: {
   harness: CoreHarness | null;
@@ -213,6 +172,8 @@ function ModelProviderDialog({ harness, onClose, onSaved, onReread }: {
   const [busy, setBusy] = useState(false);
   const saving = useRef(false);
   const [error, setError] = useState<string | null>(null);
+  const [rejection, setRejection] = useState<unknown>(null);
+  const fieldError = (param: string) => coreFieldError(rejection, param, tCommon);
 
   const name = harness ? harnessNames[harness.id] : "";
   const protocol = harness ? harnessProtocol[harness.id] : "responses";
@@ -231,7 +192,7 @@ function ModelProviderDialog({ harness, onClose, onSaved, onReread }: {
     if (!ready || !harness || saving.current) return;
     saving.current = true;
     setBusy(true);
-    setError(null);
+    setError(null); setRejection(null);
     try {
       await admin.setHarnessModelProvider(harness.id, {
         protocol, base_url: url, api_key: apiKey.trim(),
@@ -242,7 +203,8 @@ function ModelProviderDialog({ harness, onClose, onSaved, onReread }: {
     } catch (caught) {
       // Never retried: a rejection shows Core's reason; an unknown outcome is read again first.
       if (caught instanceof AgentCoreError && caught.status >= 400 && caught.status < 500 && caught.status !== 408) {
-        setError(caught.message);
+        setRejection(caught);
+        setError(coreError(caught, tCommon));
       } else if (caught instanceof AgentCoreError && caught.code === "credential_storage_unavailable") {
         // A deployment without a credential key stores nothing: a configuration error, not an unknown outcome.
         setError(t("models.form.noCredentialKey"));
@@ -258,6 +220,7 @@ function ModelProviderDialog({ harness, onClose, onSaved, onReread }: {
 
   const limitField = (field: "context" | "output", value: string, setValue: (value: string) => void, problem: string | null) => {
     const inputId = `${id}-${field}`;
+    problem = problem ?? fieldError(field === "context" ? "context_window" : "max_output_tokens");
     return (
       <div className="field">
         <span className="field-label-row">
@@ -269,7 +232,7 @@ function ModelProviderDialog({ harness, onClose, onSaved, onReread }: {
           inputMode="numeric"
           autoComplete="off"
           value={value}
-          onChange={(event) => setValue(event.target.value)}
+          onChange={(event) => { setValue(event.target.value); setRejection(null); setError(null); }}
           aria-required={limitsRequired}
           aria-invalid={problem ? true : undefined}
           aria-describedby={`${inputId}-help${problem ? ` ${inputId}-problem` : ""}`}
@@ -279,6 +242,9 @@ function ModelProviderDialog({ harness, onClose, onSaved, onReread }: {
     );
   };
 
+  const baseUrlError = urlProblem ?? fieldError("base_url");
+  const apiKeyError = fieldError("api_key");
+  const fieldRejected = ["base_url", "api_key", "context_window", "max_output_tokens", "protocol"].some((param) => fieldError(param));
   return (
     <Modal
       open={harness !== null}
@@ -292,39 +258,40 @@ function ModelProviderDialog({ harness, onClose, onSaved, onReread }: {
       )}
     >
       <form id={formId} className="form-stack" autoComplete="off" onSubmit={(event) => { event.preventDefault(); void save(); }}>
-        <p className="detail-note">{t("models.form.modelName")}</p>
         <div className="field">
           <span className="field-label-row">
             <span>{t("models.protocol")}</span>
-            <HelpTip>{t("models.form.protocolHelp")}</HelpTip>
+            <HelpTip>{t("models.form.protocolHelp")} {t("models.form.modelName")}</HelpTip>
           </span>
           <p className="system-model-protocol">{protocolNames[protocol]}</p>
+          {fieldError("protocol") ? <span className="field-error" role="alert">{fieldError("protocol")}</span> : null}
         </div>
         <div className="field">
           <span className="field-label-row"><label htmlFor={`${id}-url`}>{t("models.baseUrl")}</label></span>
           <input
             id={`${id}-url`}
             value={baseUrl}
-            onChange={(event) => setBaseUrl(event.target.value)}
+            onChange={(event) => { setBaseUrl(event.target.value); setRejection(null); setError(null); }}
             autoComplete="off"
             spellCheck={false}
-            aria-invalid={urlProblem ? true : undefined}
-            aria-describedby={urlProblem ? `${id}-url-problem` : undefined}
+            aria-invalid={baseUrlError ? true : undefined}
+            aria-describedby={baseUrlError ? `${id}-url-problem` : undefined}
           />
-          {urlProblem ? <span id={`${id}-url-problem`} className="field-error">{urlProblem}</span> : null}
+          {baseUrlError ? <span id={`${id}-url-problem`} className="field-error">{baseUrlError}</span> : null}
         </div>
         <div className="field">
           <span className="field-label-row">
             <label htmlFor={`${id}-key`}>{t("models.apiKey")}</label>
             <HelpTip id={`${id}-key-help`}>{t("models.form.apiKeyHelp")}</HelpTip>
           </span>
-          <input id={`${id}-key`} type="password" autoComplete="off" spellCheck={false} value={apiKey} onChange={(event) => setApiKey(event.target.value)} aria-required="true" aria-describedby={`${id}-key-help`} />
+          <input id={`${id}-key`} type="password" autoComplete="off" spellCheck={false} value={apiKey} onChange={(event) => { setApiKey(event.target.value); setRejection(null); setError(null); }} aria-required="true" aria-invalid={apiKeyError ? true : undefined} aria-describedby={`${id}-key-help${apiKeyError ? ` ${id}-key-problem` : ""}`} />
+          {apiKeyError ? <span id={`${id}-key-problem`} className="field-error">{apiKeyError}</span> : null}
         </div>
         <div className="system-model-limits">
           {limitField("context", contextWindow, setContextWindow, contextProblem)}
           {limitField("output", maxOutputTokens, setMaxOutputTokens, outputProblem)}
         </div>
-        {error ? <p className="confirm-dialog-error" role="alert">{error}</p> : null}
+        {error && !fieldRejected ? <p className="confirm-dialog-error" role="alert">{error}</p> : null}
       </form>
     </Modal>
   );
diff --git a/apps/web/src/features/system/HarnessCard.tsx b/apps/web/src/features/system/HarnessCard.tsx
new file mode 100644
index 000000000..90f7391e5
--- /dev/null
+++ b/apps/web/src/features/system/HarnessCard.tsx
@@ -0,0 +1,53 @@
+import type { CoreHarness } from "@agents-core-web/agents-client";
+import { useId } from "react";
+import { useTranslation } from "react-i18next";
+import { StatusDot } from "../../components/console-ui";
+import { formatDateTime, formatInteger } from "../../lib/format";
+import { harnessNames, protocolNames } from "../../lib/harness-labels";
+import { Fact } from "./Fact";
+import { ProviderObservations } from "./ProviderObservations";
+
+export function HarnessCard({ harness, busy, stale, onEdit, onClear }: { harness: CoreHarness; busy: boolean; stale: boolean; onEdit: () => void; onClear: () => void }) {
+  const { t, i18n } = useTranslation("system");
+  const locale = i18n.resolvedLanguage;
+  const headingId = useId();
+  const name = harnessNames[harness.id];
+  const provider = harness.model_provider;
+  return (
+    <article className="system-model" aria-labelledby={headingId} data-default={harness.default ? "" : undefined}>
+      <header className="system-model-header">
+        <h3 id={headingId}>{name}</h3>
+        <div className="system-model-actions">
+          {/* A disabled harness may still be configured; Core keeps the provider until it is enabled. */}
+          <button className="button outline" type="button" aria-label={t(provider ? "models.replaceLabel" : "models.setLabel", { harness: name })} disabled={busy} onClick={onEdit}>
+            {provider ? t("models.replace") : t("models.set")}
+          </button>
+          {provider ? (
+            <button className="button outline" type="button" aria-label={t("models.clearLabel", { harness: name })} disabled={busy} onClick={onClear}>
+              {t("models.clear")}
+            </button>
+          ) : null}
+        </div>
+      </header>
+      <dl className="system-model-facts">
+        <Fact label={t("models.harness")} help={t("models.startupHelp")}>
+          <span className="system-model-state">
+            <StatusDot tone={harness.enabled ? "ok" : "neutral"} label={harness.enabled ? t("models.enabled") : t("models.disabled")} />
+            {harness.default ? <span className="pill">{t("models.default")}</span> : null}
+          </span>
+        </Fact>
+        {provider ? <>
+          <Fact label={t("models.protocol")}>{protocolNames[provider.protocol]}</Fact>
+          <Fact label={t("models.baseUrl")}><code className="system-code">{provider.base_url}</code></Fact>
+          <Fact label={t("models.apiKey")}>{provider.api_key_configured ? t("models.keyConfigured") : t("models.keyNotConfigured")}</Fact>
+          {provider.context_window !== undefined ? <Fact label={t("models.contextWindow")}>{formatInteger(provider.context_window, locale)}</Fact> : null}
+          {provider.max_output_tokens !== undefined ? <Fact label={t("models.maxOutputTokens")}>{formatInteger(provider.max_output_tokens, locale)}</Fact> : null}
+          <Fact label={t("models.updated")}>{formatDateTime(Math.floor(Date.parse(provider.updated_at) / 1000), locale)}</Fact>
+        </> : (
+          <Fact label={t("models.provider")}><span className="system-muted">{t("models.notSet")}</span></Fact>
+        )}
+      </dl>
+      {provider ? <ProviderObservations provider={provider} name={name} stale={stale} /> : null}
+    </article>
+  );
+}
diff --git a/apps/web/src/features/system/ProviderObservations.tsx b/apps/web/src/features/system/ProviderObservations.tsx
new file mode 100644
index 000000000..ccb97d1b7
--- /dev/null
+++ b/apps/web/src/features/system/ProviderObservations.tsx
@@ -0,0 +1,36 @@
+import type { HarnessModelProvider } from "@agents-core-web/agents-client";
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import { HelpTip, StatusDot } from "../../components/console-ui";
+import { Modal } from "../../components/Modal";
+import { diagnosticFailure } from "../../lib/diagnostic-failure";
+import { formatDateTime } from "../../lib/format";
+import { Fact } from "./Fact";
+
+/** Only a newer Core error remains actionable after a successful use. */
+export function activeProviderError(provider: HarnessModelProvider) {
+  return provider.last_error_code !== null && provider.last_error_at !== null &&
+    (provider.last_used_at === null || Date.parse(provider.last_error_at) > Date.parse(provider.last_used_at));
+}
+
+export function ProviderObservations({ provider, name, stale }: { provider: HarnessModelProvider; name: string; stale: boolean }) {
+  const { t, i18n } = useTranslation("diagnostics");
+  const [open, setOpen] = useState(false);
+  const activeError = activeProviderError(provider);
+  const date = (value: string | null) => value === null ? t("providerUnknown") : formatDateTime(Date.parse(value) / 1000, i18n.resolvedLanguage);
+  return <>
+    <div className="system-model-observations">
+      {stale ? <StatusDot tone="neutral" label={t("providerStale")} /> : activeError ? <StatusDot tone="warning" label={t("providerError")} /> : null}
+      <button type="button" className="text-action" onClick={() => setOpen(true)}>{t("providerDetails")}</button>
+    </div>
+    <Modal open={open} title={t("providerTitle", { name })} onClose={() => setOpen(false)}>
+      <dl className="system-facts">
+        <Fact label={t("providerLastUsed")} help={t("providerHelp")}>{date(provider.last_used_at)}</Fact>
+        <Fact label={t("providerLastError")}>
+          {activeError && provider.last_error_code ? <>{diagnosticFailure({ code: provider.last_error_code, params: {}, failed_at: provider.last_error_at }, t)} <HelpTip>{date(provider.last_error_at)}</HelpTip></> : t("providerNoError")}
+        </Fact>
+      </dl>
+      {stale ? <p role="status">{t("providerStaleHelp")}</p> : null}
+    </Modal>
+  </>;
+}
diff --git a/apps/web/src/features/system/SystemPage.tsx b/apps/web/src/features/system/SystemPage.tsx
index efeba825b..208ef252a 100644
--- a/apps/web/src/features/system/SystemPage.tsx
+++ b/apps/web/src/features/system/SystemPage.tsx
@@ -1,29 +1,19 @@
-import type { SandboxResources } from "@agents-core-web/agents-client";
 import { useQuery } from "@tanstack/react-query";
-import { Server } from "lucide-react";
-import type { ReactNode } from "react";
 import { useTranslation } from "react-i18next";
 
-import { EmptyState, PageBody, PageHeader, RefreshButton, Section, StatusDot } from "../../components/console-ui";
+import { PageBody, PageHeader, RefreshButton, Section } from "../../components/console-ui";
 import { ErrorState } from "../../components/ErrorState";
 import { CopyableId } from "../../components/list-ui";
 import { TableSkeleton } from "../../components/Skeleton";
 import { useConsoleNavigation } from "../../lib/console-navigation";
-import { formatBytes, formatPeriod } from "../../lib/format";
 import { InstallationNotice } from "../../components/InstallationNotice";
 import { installationQuery } from "../../lib/installation";
-import { sandboxSize, templateBuildSize, templateBuildStatus } from "../sandbox/deployment-specification";
-import { sandboxDeploymentQuery } from "../sandbox/sandbox-queries";
-import { SandboxResetNotice } from "../fleet/SandboxResetNotice";
 import { DefaultModelsSection } from "./DefaultModelsSection";
 import { Fact } from "./Fact";
 import { harnessesQuery } from "./harness-queries";
 import { StartupSettings } from "./StartupSettings";
 import "./system.css";
 
-const MIB = 2 ** 20;
-const providerNames: Record<string, string> = { docker: "Docker", microsandbox: "microsandbox" };
-
 /** A facts card before its first read; the page announces its loading once. */
 function FactsSkeleton({ facts }: { facts: number }) {
   return (
@@ -38,78 +28,15 @@ function FactsSkeleton({ facts }: { facts: number }) {
   );
 }
 
-/**
- * Platform › System: this installation's addresses; each harness's default
- * model for Core-hosted Sessions and Sessions without an environment, set
- * here; the sandbox configuration every project shares — where sandboxes run,
- * how big each one is, the Runtime or E2B template build they run,
- * microsandbox's idle suspension and sandbox reset progress — and Core's startup
- * settings. Each says where it is changed: sandboxes on the Nodes page,
- * startup settings in config.json.
- */
+/** System owns installation settings and the entry to sandbox configuration. */
 export function SystemPage() {
-  const { t, i18n } = useTranslation("system");
-  const locale = i18n.resolvedLanguage;
+  const { t } = useTranslation("system");
+  const { t: tSandboxNav } = useTranslation("sandboxNavigation");
   const { t: tNav } = useTranslation("navigation");
   const { navigate } = useConsoleNavigation();
-  const deployment = useQuery(sandboxDeploymentQuery);
   const installation = useQuery(installationQuery);
   const harnesses = useQuery(harnessesQuery);
-  const data = deployment.data ?? null;
-  const refresh = () => { void deployment.refetch(); void installation.refetch(); void harnesses.refetch(); };
-  const spec = data?.specification ?? null;
-  // An E2B selection may adopt its template build's size instead of saving one.
-  const each = data ? sandboxSize(data) : null;
-  const build = data?.e2b?.template_build;
-  const buildSize = data ? templateBuildSize(data) : null;
-  const buildStatus = templateBuildStatus(build);
-  const size = (resources: SandboxResources) => t("sandbox.size", { count: resources.cpus, memory: formatBytes(resources.memory_mib * MIB) });
-
-  let body: ReactNode;
-  if (!data) {
-    body = deployment.isError && !deployment.isFetching
-      ? <ErrorState title={t("sandbox.deploymentFailed")} onRetry={refresh} />
-      : <FactsSkeleton facts={5} />;
-  } else if (!data.provider) {
-    body = (
-      <EmptyState
-        icon={Server}
-        title={t("sandbox.unconfigured")}
-        action={<button className="button outline" type="button" onClick={() => navigate("nodes")}>{t("sandbox.setUp")}</button>}
-      />
-    );
-  } else {
-    body = (
-      <Section headingId="system-sandbox-heading" title={t("sandbox.title")} actions={<button className="text-action" type="button" onClick={() => navigate("nodes")}>{t(data.provider === "e2b" ? "sandbox.changeCloud" : "sandbox.change")}</button>}>
-        <dl className="system-facts">
-          <Fact label={t("sandbox.runsOn")}>{data.provider === "e2b" ? t("sandbox.e2b") : t("sandbox.ownMachines", { provider: providerNames[data.provider] ?? data.provider })}</Fact>
-          {each ? (
-            <Fact label={t("sandbox.each")}>
-              {size(each)}
-              {each.root_disk_mib ? <span className="system-sub">{t("sandbox.disks", { root: formatBytes(each.root_disk_mib * MIB), data: formatBytes((each.environment_disk_mib ?? 0) * MIB) })}</span> : null}
-            </Fact>
-          ) : null}
-          {spec?.runtime ? <Fact label={t("sandbox.runtime")} help={t("sandbox.runtimeHelp")}><code className="system-code" title={spec.runtime.source_commit}>{spec.runtime.source_commit.slice(0, 12)}</code></Fact> : null}
-          {data.e2b?.template ? <Fact label={t("sandbox.e2bTemplate")}><code className="system-code">{data.e2b.template}</code></Fact> : null}
-          {data.e2b ? (
-            <Fact label={t("sandbox.templateBuild")} help={t("sandbox.templateBuildHelp")}>
-              {buildStatus === "notReady" ? <StatusDot tone="warning" label={t("sandbox.buildStatus.notReady")} /> : t(`sandbox.buildStatus.${buildStatus}`)}
-              {buildSize ? (
-                <span className="system-sub">
-                  {size(buildSize)}
-                  {build?.resources.root_disk_mib != null ? ` · ${t("sandbox.buildDisk", { disk: formatBytes(build.resources.root_disk_mib * MIB) })}` : null}
-                </span>
-              ) : null}
-            </Fact>
-          ) : null}
-          {data.suspension ? <>
-            <Fact label={t("sandbox.suspendAfter")} help={t("sandbox.suspendAfterHelp")}>{formatPeriod(data.suspension.idle_seconds, locale)}</Fact>
-            <Fact label={t("sandbox.keepSuspended")} help={t("sandbox.keepSuspendedHelp")}>{formatPeriod(data.suspension.retention_seconds, locale)}</Fact>
-          </> : null}
-        </dl>
-      </Section>
-    );
-  }
+  const refresh = () => { void installation.refetch(); void harnesses.refetch(); };
 
   const about = installation.data;
   const facts = about ? (
@@ -128,7 +55,7 @@ export function SystemPage() {
     ? <ErrorState title={t("installation.failed")} onRetry={() => void installation.refetch()} />
     : <FactsSkeleton facts={4} />;
   // One announcement while either first read is still out; each slot shows only its own placeholder.
-  const reading = (!data && !(deployment.isError && !deployment.isFetching)) || (!about && !(installation.isError && !installation.isFetching)) ||
+  const reading = (!about && !(installation.isError && !installation.isFetching)) ||
     (!harnesses.data && !(harnesses.isError && !harnesses.isFetching));
 
   return (
@@ -137,15 +64,16 @@ export function SystemPage() {
         headingId="system-heading"
         title={tNav("views.system")}
         help={t("help")}
-        actions={<RefreshButton onClick={refresh} refreshing={deployment.isFetching || installation.isFetching || harnesses.isFetching} label={t("refresh")} />}
+        actions={<RefreshButton onClick={refresh} refreshing={installation.isFetching || harnesses.isFetching} label={t("refresh")} />}
       />
       <PageBody>
         <InstallationNotice installation={about} />
         {reading ? <p className="visually-hidden" role="status">{t("loading")}</p> : null}
         {facts}
         <DefaultModelsSection />
-        <SandboxResetNotice deployment={deployment.data} failed={deployment.isError && !!deployment.data} onRetry={() => void deployment.refetch()} />
-        {body}
+        <Section headingId="system-sandbox-heading" title={tSandboxNav("title")} help={tSandboxNav("help")}>
+          <button className="button outline" type="button" onClick={() => navigate("system", { id: "sandbox" })}>{tSandboxNav("open")}</button>
+        </Section>
         {about ? <StartupSettings configuration={about.configuration} /> : installation.isError ? null : <TableSkeleton rows={4} columns={3} />}
       </PageBody>
     </section>
diff --git a/apps/web/src/features/system/provider-observations.test.tsx b/apps/web/src/features/system/provider-observations.test.tsx
new file mode 100644
index 000000000..7a0534780
--- /dev/null
+++ b/apps/web/src/features/system/provider-observations.test.tsx
@@ -0,0 +1,29 @@
+import type { HarnessModelProvider } from "@agents-core-web/agents-client";
+import { renderToStaticMarkup } from "react-dom/server";
+import { afterEach, describe, expect, it } from "vitest";
+import i18n from "../../i18n";
+import { activeProviderError, ProviderObservations } from "./ProviderObservations";
+
+const provider: HarnessModelProvider = { object: "core.model_provider", harness: "codex", protocol: "responses", base_url: "https://model.example/v1", api_key_configured: true, updated_at: "2026-09-28T08:00:00Z", last_used_at: null, last_error_at: null, last_error_code: null };
+afterEach(() => { void i18n.changeLanguage("en"); });
+
+describe("default provider observations", () => {
+  it("keeps missing records unknown and only flags errors newer than success", () => {
+    expect(activeProviderError(provider)).toBe(false);
+    const error = { ...provider, last_error_code: "authentication_error" as const, last_error_at: "2026-09-28T08:01:00Z" };
+    expect(activeProviderError(error)).toBe(true);
+    expect(activeProviderError({ ...error, last_used_at: "2026-09-28T08:00:30Z" })).toBe(true);
+    expect(activeProviderError({ ...error, last_used_at: error.last_error_at })).toBe(false);
+    expect(activeProviderError({ ...error, last_used_at: "2026-09-28T08:02:00Z" })).toBe(false);
+  });
+  it("keeps low-frequency details out of the card and qualifies failed reads", async () => {
+    const html = renderToStaticMarkup(<ProviderObservations provider={provider} name="Codex" stale={false} />);
+    expect(html).toContain("Usage details");
+    expect(html).not.toContain("Last successful use");
+    expect(html).not.toContain("Recent error");
+    await i18n.changeLanguage("zh-CN");
+    const stale = renderToStaticMarkup(<ProviderObservations provider={{ ...provider, last_error_code: "server_error", last_error_at: provider.updated_at }} name="Codex" stale />);
+    expect(stale).toContain("记录尚未确认");
+    expect(stale).not.toContain("近期错误");
+  });
+});
diff --git a/apps/web/src/features/system/system.css b/apps/web/src/features/system/system.css
index f2033cb28..63aa654c8 100644
--- a/apps/web/src/features/system/system.css
+++ b/apps/web/src/features/system/system.css
@@ -153,6 +153,15 @@
   gap: 6px;
 }
 
+.system-model-observations {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+  padding: 8px 12px;
+  border-top: 1px solid var(--grid-line);
+}
+
 .system-model-facts {
   margin: 0;
 }
diff --git a/apps/web/src/i18n/locales/en/common.ts b/apps/web/src/i18n/locales/en/common.ts
index fd37ba613..9550d3963 100644
--- a/apps/web/src/i18n/locales/en/common.ts
+++ b/apps/web/src/i18n/locales/en/common.ts
@@ -1,4 +1,7 @@
+import { coreErrors } from "./core-errors";
+
 export const common = {
+  coreErrors,
   readFailure: {
     title: "Could not read the data",
     partial: "Some reads failed. Any figures and rows shown cover only data already read; they may be incomplete or out of date.",
diff --git a/apps/web/src/i18n/locales/en/core-errors.ts b/apps/web/src/i18n/locales/en/core-errors.ts
new file mode 100644
index 000000000..0cf22dc9c
--- /dev/null
+++ b/apps/web/src/i18n/locales/en/core-errors.ts
@@ -0,0 +1,43 @@
+export const coreErrors = {
+  "invalid_admin_key": "The console's Core key was rejected. Update secrets/core.key on the Core host and run oac apply.",
+  "console_sign_in_required": "Sign in to the console again.",
+  "console_origin_rejected": "Open the console at its configured address.",
+  "console_request_invalid": "The console request was rejected. Reload the page.",
+  "core_unreachable": "Core is unreachable. Check the Core service, then refresh.",
+  "invalid_name": "Enter a nonempty name without control characters.",
+  "nameLimit": "Enter a name of at most {{max}} characters without control characters.",
+  "nodeNameLimit": "Enter a name of at most {{max}} UTF-8 bytes.",
+  "invalid_node_capacity": "Enter a valid whole-number capacity; retained capacity must be at least active capacity.",
+  "capacityRange": "Enter a whole number from {{min}} to {{max}}; retained capacity must be at least active capacity.",
+  "invalid_model_provider": "Enter the complete model provider configuration.",
+  "model_provider_base_url_invalid": "Use an HTTPS URL without credentials, query parameters or a fragment.",
+  "model_provider_protocol_unsupported": "This protocol is not supported by the harness.",
+  "protocols": "Allowed protocols: {{protocols}}.",
+  "model_provider_api_key_invalid": "Enter a valid API key without control characters.",
+  "keyLimit": "Enter a valid API key of at most {{max}} characters.",
+  "model_provider_token_limits_invalid": "Use valid token limits; output cannot exceed context, and required limits must be positive.",
+  "invalid_sandbox_configuration": "Check the sandbox resources and Runtime release.",
+  "resourceRange": "Enter a whole number from {{min}} to {{max}}.",
+  "resourceMin": "Enter a whole number of at least {{min}}.",
+  "runtime": "Use a valid immutable Runtime release for this backend.",
+  "project_archived": "This Project is archived.",
+  "project_exists": "A Project with this name already exists.",
+  "project_api_key_exists": "An active API key with this name already exists.",
+  "executor_credential_exists": "An executor credential with this name already exists.",
+  "credential_storage_unavailable": "Core credential storage is unavailable. Check its credential encryption configuration.",
+  "diagnostics_unavailable": "Core diagnostics are unavailable.",
+  "internal_error": "Core could not complete the request.",
+  "sandbox_generation_stale": "Core has a newer sandbox configuration. Refresh and review it before submitting again.",
+  "sandbox_reset_required": "Reset the sandbox deployment before changing this configuration.",
+  "sandbox_reset_in_progress": "A sandbox reset is in progress. Refresh to see its current progress.",
+  "sandbox_not_configured": "The sandbox deployment is not configured. Refresh to start setup.",
+  "sandbox_in_use": "Hosted resources remain. Wait for confirmed cleanup before changing the configuration.",
+  "runtime_node_in_use": "The node has active allocations or retained resources. Clear allocations, snapshots, reservations and pending cleanup before removal.",
+  "runtime_node_unavailable": "The selected sandbox node is unavailable or has no capacity.",
+  "sandbox_admin_not_configured": "Sandbox administration is not configured on this console.",
+  "e2b_team_mismatch": "This E2B key cannot manage the retained deployment. Reset before changing teams.",
+  "e2b_api_key_invalid": "The E2B API key was rejected. The saved configuration is unchanged.",
+  "e2b_template_build_invalid": "Select a ready immutable E2B template build with matching resources.",
+  "e2b_request_unconfirmed": "E2B verification could not be confirmed. Refresh before submitting again.",
+  "sandbox_configuration_error": "E2B sandboxes need an HTTPS public_url reachable from the internet. Update config.json and apply it on the Core host."
+} as const;
diff --git a/apps/web/src/i18n/locales/en/diagnostics.ts b/apps/web/src/i18n/locales/en/diagnostics.ts
new file mode 100644
index 000000000..03d741940
--- /dev/null
+++ b/apps/web/src/i18n/locales/en/diagnostics.ts
@@ -0,0 +1,58 @@
+export const diagnostics = {
+  providerUnknown: "Not recorded",
+  providerStale: "Observation unconfirmed",
+  providerError: "Recent error",
+  providerDetails: "Usage details",
+  providerTitle: "{{name}} usage details",
+  providerLastUsed: "Last successful use",
+  providerLastError: "Error since last success",
+  providerNoError: "None recorded",
+  providerHelp: "Core records outcomes from hosted Turns using this deployment default. Records are best effort and may lag; missing records do not prove the provider is ready or unused. Replacing the default starts a new observation history.",
+  providerStaleHelp: "The latest read failed. These are the last confirmed observations.",
+  failure: {
+    authentication_error: "The model provider rejected authentication. Check its API key.",
+    rate_limit_exceeded: "The model provider's rate limit was reached.",
+    usage_limit_exceeded: "The model provider's usage limit was reached. Check its quota.",
+    server_overloaded: "The model provider is overloaded.",
+    server_error: "The model provider reported a server error.",
+    invalid_request: "The model provider rejected the request. Check the model and input.",
+    resource_not_found: "The model provider could not find the requested resource. Check the model.",
+    request_timeout: "The model provider request timed out.",
+    context_length_exceeded: "The input exceeds the model's context limit.",
+    cyber_policy: "The model provider rejected the input under its safety policy.",
+    connection_failed: "The connection to the model provider failed.",
+    harness_error: "The harness could not complete execution. No specific cause was reported.",
+    model_provider_required: "No model provider is configured for this Session.",
+    runtime_unavailable: "The Runtime is unavailable. Check the execution host.",
+    runtime_disconnected: "The Runtime connection was lost during execution.",
+    runtime_preparation_failed: "The Runtime could not prepare execution.",
+    execution_interrupted: "Execution was interrupted by Core recovery.",
+    delivery_unconfirmed: "Core could not confirm delivery. Check the result before sending it again.",
+    input_rejected: "The executor did not accept the input.",
+    executor_protocol_error: "The executor returned an unsupported or invalid response.",
+    core_storage_failed: "Core could not persist execution data.",
+    internal_error: "Execution could not complete. No specific cause was reported.",
+    environment_connection_timeout: "The executor did not connect before the input deadline.",
+    environment_unavailable: "The Session's environment is unavailable.",
+    environment_provisioning_failed: "The environment could not be prepared.",
+  },
+  provisioningStep: "Environment preparation failed at {{step}}.",
+  setupIndex: "Setup command {{number}}.",
+  exitCode: "Exit code {{code}}.",
+  httpStatus: "HTTP {{status}}.",
+  step: { setup: "setup", python: "Python dependencies", npm: "npm dependencies", system: "system packages", file: "file preparation", skill: "Skill preparation" },
+  unavailable: "Failure details unavailable",
+  unavailableHelp: "The diagnostics read failed or no longer matches this status. Refresh to check again.",
+  checking: "Checking failure details",
+  retry: "Retry diagnostics",
+  failureLabel: "Failure details",
+  receiptTitle: "Core receipt times",
+  receiptHelp: "When Core first recorded this Item and recorded its settlement. Event batching and clock changes affect this interval; it is not the tool's execution time. Historical Items may have no settlement time.",
+  receiptStarted: "First recorded",
+  receiptCompleted: "Settlement recorded",
+  receiptDuration: "Observed interval",
+  receiptUnavailable: "Receipt times unavailable",
+  receiptMissing: "No receipt timing was reported for this Item.",
+  truncated: "Core returned timing for the first 1,000 Items only.",
+  clockChange: "The clock moved backwards; this interval is unavailable.",
+} as const;
diff --git a/apps/web/src/i18n/locales/en/metrics.ts b/apps/web/src/i18n/locales/en/metrics.ts
index bdf3792fa..dce21cf33 100644
--- a/apps/web/src/i18n/locales/en/metrics.ts
+++ b/apps/web/src/i18n/locales/en/metrics.ts
@@ -177,6 +177,11 @@ export const metrics = {
     },
   },
   sandbox: {
+    nodeObservationStale: "These node facts are earlier observations. Refresh the fleet to confirm its current state.",
+    servingGeneration: "Serving generation",
+    servingGenerationHelp: "Core retains this generation for the node. The pin alone does not confirm a live connection, available capacity or readiness for the target.",
+    targetPreparation: "Target configuration",
+    configurationGeneration: "Sandbox configuration generation",
     title: "Sandbox metrics",
     description: "Host capacity of the whole deployment, and the hosted Runtimes of every project.",
     cloudDescription: "Sandboxes Core holds in E2B’s cloud, and hosted Runtime observations across projects.",
diff --git a/apps/web/src/i18n/locales/en/overview.ts b/apps/web/src/i18n/locales/en/overview.ts
index 7906b544c..bb9c2ab7a 100644
--- a/apps/web/src/i18n/locales/en/overview.ts
+++ b/apps/web/src/i18n/locales/en/overview.ts
@@ -113,6 +113,10 @@ export const overview = {
     offline: "Offline",
   },
   fleet: {
+    servingGeneration: "Serving generation",
+    servingGenerationHelp: "Core retains this generation for the node. The pin alone does not confirm a live connection, available capacity or readiness for the target.",
+    previousGeneration: "Inventory was read for configuration generation {{observed}}; the current target is {{target}}. These are earlier observations.",
+    targetPreparation: "Target configuration",
     title: "Fleet",
     cloudHelp: "Core and the sandboxes it holds in E2B’s cloud. Select Core or E2B for a summary.",
     help: "Core and its connection to each sandbox node: solid lines are online, dashed lines offline. The figure on a node is active sandboxes / limit. Select Core or a node for a summary.",
diff --git a/apps/web/src/i18n/locales/en/sandbox-navigation.ts b/apps/web/src/i18n/locales/en/sandbox-navigation.ts
new file mode 100644
index 000000000..a912d4e16
--- /dev/null
+++ b/apps/web/src/i18n/locales/en/sandbox-navigation.ts
@@ -0,0 +1,11 @@
+export const sandboxNavigation = {
+  "title": "Sandbox configuration",
+  "help": "Manage the deployment backend, sandbox size and reset here. Nodes manages your machines.",
+  "open": "Manage sandbox configuration",
+  "back": "Back to System",
+  "nodes": "Open Nodes",
+  "unconfigured": "Set up sandbox hosting in System before adding nodes.",
+  "cloud": "E2B runs sandboxes in its cloud. There are no nodes to manage.",
+  "reset": "Node enrollment is paused during reset. View progress in System.",
+  "details": "Configuration details"
+} as const;
diff --git a/apps/web/src/i18n/locales/en/sessions.ts b/apps/web/src/i18n/locales/en/sessions.ts
index 57325a59d..113e36758 100644
--- a/apps/web/src/i18n/locales/en/sessions.ts
+++ b/apps/web/src/i18n/locales/en/sessions.ts
@@ -148,6 +148,22 @@ export const sessions = {
     historyLoading: "Loading runtime history…",
   },
   executor: {
+    connection: {
+      title: "Host connection",
+      help: "Core reports a connection only while the executor has current authority and a live connection. Last seen is the last recorded heartbeat and may lag. This does not confirm model or harness readiness.",
+      status: { never_enrolled: "Never connected", connected: "Connected", disconnected: "Disconnected", revoked: "Bound credential revoked", unknown: "Unknown" },
+      boundKey: "Bound credential",
+      lastSeen: "Last seen",
+      notBound: "Not bound",
+      noHeartbeat: "No heartbeat recorded",
+      stale: "Refresh failed. Showing the last loaded binding; the current connection is unknown.",
+      refreshing: "Refreshing the last loaded binding; the current connection is not yet confirmed.",
+      failed: "The connection could not be read. Refresh to try again.",
+      bound: "This Environment is bound to credential {{id}}. Issuing a new credential will not replace it. Rotate the bound credential to reconnect.",
+      restore: "Bound credential {{id}} is revoked. Rotate it to restore, then rerun the host installer. Issuing a new credential will not replace the binding.",
+      rotateRestore: "Rotate to restore",
+      rotateBound: "Rotate bound credential",
+    },
     title: "Executor credentials",
     help: "A credential lets one self-hosted executor connect to Core for this environment only. It cannot call the Agents API. Paste it into the installer on the executor host and keep it private. Core shows each credential once; rotate a credential to replace a lost one.",
     issue: "Issue credential",
@@ -189,6 +205,8 @@ export const sessions = {
       done: "Done",
     },
     install: {
+      hostDone: "Run on host · Done",
+      hostPending: "Run on host · Awaiting connection",
       title: "Connect a host",
       lifecycle: "After the credential is revoked or rotated, the host's executor disconnects with a single message and won't retry; its container keeps running. To reconnect, rotate that same credential, rerun the same command and paste the rotated credential; issuing a new credential doesn't reconnect an Environment that has already connected. To remove the Runtime, stop its container.",
       steps: "Run this command on the host. At its hidden prompt, paste a credential from this section: it's shown once, after Issue credential or Rotate. The same command is safe to rerun.",
diff --git a/apps/web/src/i18n/locales/en/system.ts b/apps/web/src/i18n/locales/en/system.ts
index 93c473134..9c5aedb70 100644
--- a/apps/web/src/i18n/locales/en/system.ts
+++ b/apps/web/src/i18n/locales/en/system.ts
@@ -106,7 +106,7 @@ export const system = {
     size: "{{count}} CPU · {{memory}}", size_one: "{{count}} CPU · {{memory}}", size_other: "{{count}} CPUs · {{memory}}",
     disks: "Root disk {{root}} · data disk {{data}} at /environment",
     runtime: "Runtime",
-    runtimeHelp: "The Runtime release every node runs; nodes accept no other.",
+    runtimeHelp: "The target Runtime release. Existing sandboxes keep their owned release while nodes prepare the target.",
     e2bTemplate: "E2B template",
     templateBuild: "Template build",
     templateBuildHelp: "The fixed E2B build every sandbox starts from, as Core read it when the selection was saved. Each sandbox gets its CPU, memory and disk.",
diff --git a/apps/web/src/i18n/locales/zh-CN/common.ts b/apps/web/src/i18n/locales/zh-CN/common.ts
index 7bee55676..23bc80e58 100644
--- a/apps/web/src/i18n/locales/zh-CN/common.ts
+++ b/apps/web/src/i18n/locales/zh-CN/common.ts
@@ -1,4 +1,7 @@
+import { coreErrors } from "./core-errors";
+
 export const common = {
+  coreErrors,
   readFailure: {
     title: "无法读取数据",
     partial: "部分读取失败。当前数字和列表仅来自已读取的数据，可能不完整或已过期。",
diff --git a/apps/web/src/i18n/locales/zh-CN/core-errors.ts b/apps/web/src/i18n/locales/zh-CN/core-errors.ts
new file mode 100644
index 000000000..138fe5bce
--- /dev/null
+++ b/apps/web/src/i18n/locales/zh-CN/core-errors.ts
@@ -0,0 +1,43 @@
+export const coreErrors = {
+  "invalid_admin_key": "控制台的 Core Key 被拒绝。请更新 Core 主机上的 secrets/core.key，再运行 oac apply。",
+  "console_sign_in_required": "请重新登录控制台。",
+  "console_origin_rejected": "请通过配置的地址打开控制台。",
+  "console_request_invalid": "控制台请求被拒绝，请重新加载页面。",
+  "core_unreachable": "无法连接 Core。请检查 Core 服务后刷新。",
+  "invalid_name": "请输入非空名称，不要包含控制字符。",
+  "nameLimit": "名称最多 {{max}} 个字符，且不能包含控制字符。",
+  "nodeNameLimit": "节点名称最多 {{max}} 个 UTF-8 字节。",
+  "invalid_node_capacity": "请输入有效的整数容量；保留容量不能小于运行容量。",
+  "capacityRange": "请输入 {{min}} 到 {{max}} 的整数；保留容量不能小于运行容量。",
+  "invalid_model_provider": "请填写完整的模型服务配置。",
+  "model_provider_base_url_invalid": "请使用 HTTPS 地址，不要包含凭证、查询参数或片段。",
+  "model_provider_protocol_unsupported": "此执行引擎不支持该协议。",
+  "protocols": "支持的协议：{{protocols}}。",
+  "model_provider_api_key_invalid": "请输入有效的 API Key，不要包含控制字符。",
+  "keyLimit": "请输入有效的 API Key，长度最多 {{max}} 个字符。",
+  "model_provider_token_limits_invalid": "请填写有效的 token 限制；输出不能超过上下文，必填限制必须大于零。",
+  "invalid_sandbox_configuration": "请检查沙箱资源和 Runtime 版本。",
+  "resourceRange": "请输入 {{min}} 到 {{max}} 的整数。",
+  "resourceMin": "请输入不小于 {{min}} 的整数。",
+  "runtime": "请使用适用于此后端的有效不可变 Runtime 版本。",
+  "project_archived": "此项目已归档。",
+  "project_exists": "此项目名称已被使用。",
+  "project_api_key_exists": "此名称已被使用中的 API Key 占用。",
+  "executor_credential_exists": "此名称的执行器凭证已存在。",
+  "credential_storage_unavailable": "Core 凭证存储不可用，请检查凭证加密配置。",
+  "diagnostics_unavailable": "Core 诊断暂不可用。",
+  "internal_error": "Core 未能完成请求。",
+  "sandbox_generation_stale": "Core 的沙箱配置已更新。请刷新并检查后再提交。",
+  "sandbox_reset_required": "请先重置沙箱部署，再更改此配置。",
+  "sandbox_reset_in_progress": "沙箱正在重置。请刷新查看当前进度。",
+  "sandbox_not_configured": "沙箱部署尚未配置。请刷新以开始配置。",
+  "sandbox_in_use": "仍有托管资源。请等待 Core 确认清理完成后再修改配置。",
+  "runtime_node_in_use": "节点仍有活跃分配或保留资源。请先清理资源分配、快照、预留资源和待清理项，再移除节点。",
+  "runtime_node_unavailable": "所选沙箱节点不可用或容量不足。",
+  "sandbox_admin_not_configured": "此控制台尚未配置沙箱管理权限。",
+  "e2b_team_mismatch": "此 E2B 密钥无法管理当前保留的部署。更换团队前请先重置。",
+  "e2b_api_key_invalid": "E2B API 密钥被拒绝。已保存的配置未改变。",
+  "e2b_template_build_invalid": "请选择已就绪且资源匹配的不可变 E2B 模板构建。",
+  "e2b_request_unconfirmed": "无法确认 E2B 验证结果。请刷新后再提交。",
+  "sandbox_configuration_error": "E2B 沙箱需要可从互联网访问的 HTTPS public_url。请更新 config.json 并在 Core 主机上应用配置。"
+} as const;
diff --git a/apps/web/src/i18n/locales/zh-CN/diagnostics.ts b/apps/web/src/i18n/locales/zh-CN/diagnostics.ts
new file mode 100644
index 000000000..e0a5e1769
--- /dev/null
+++ b/apps/web/src/i18n/locales/zh-CN/diagnostics.ts
@@ -0,0 +1,58 @@
+export const diagnostics = {
+  providerUnknown: "暂无记录",
+  providerStale: "记录尚未确认",
+  providerError: "近期错误",
+  providerDetails: "使用详情",
+  providerTitle: "{{name}} 使用详情",
+  providerLastUsed: "最近成功使用",
+  providerLastError: "成功后发生的错误",
+  providerNoError: "暂无记录",
+  providerHelp: "Core 记录使用此部署默认配置的托管 Turn 结果。记录可能延迟或缺失；暂无记录不代表服务已就绪或从未使用。替换默认配置后会重新记录。",
+  providerStaleHelp: "最新读取失败，当前显示上次确认的记录。",
+  failure: {
+    authentication_error: "模型服务认证失败，请检查 API key。",
+    rate_limit_exceeded: "已达到模型服务的请求频率上限。",
+    usage_limit_exceeded: "已达到模型服务的用量上限，请检查额度。",
+    server_overloaded: "模型服务当前负载过高。",
+    server_error: "模型服务发生了服务器错误。",
+    invalid_request: "模型服务拒绝了请求，请检查模型和输入。",
+    resource_not_found: "模型服务未找到请求的资源，请检查模型。",
+    request_timeout: "模型服务请求超时。",
+    context_length_exceeded: "输入超出模型的上下文上限。",
+    cyber_policy: "模型服务因安全策略拒绝了输入。",
+    connection_failed: "与模型服务的连接失败。",
+    harness_error: "Harness 未能完成执行，未报告具体原因。",
+    model_provider_required: "此 Session 未配置模型服务。",
+    runtime_unavailable: "Runtime 不可用，请检查执行主机。",
+    runtime_disconnected: "执行过程中 Runtime 连接中断。",
+    runtime_preparation_failed: "Runtime 未能完成执行准备。",
+    execution_interrupted: "Core 恢复过程中执行被中断。",
+    delivery_unconfirmed: "Core 无法确认是否送达，请先检查结果再决定是否重发。",
+    input_rejected: "执行器未接受输入。",
+    executor_protocol_error: "执行器返回了不支持或无效的响应。",
+    core_storage_failed: "Core 未能保存执行数据。",
+    internal_error: "执行未能完成，未报告具体原因。",
+    environment_connection_timeout: "执行器未在输入截止时间前连接。",
+    environment_unavailable: "此 Session 的环境不可用。",
+    environment_provisioning_failed: "环境准备失败。",
+  },
+  provisioningStep: "环境准备在{{step}}阶段失败。",
+  setupIndex: "第 {{number}} 条设置命令。",
+  exitCode: "退出码 {{code}}。",
+  httpStatus: "HTTP {{status}}。",
+  step: { setup: "设置", python: "Python 依赖", npm: "npm 依赖", system: "系统软件包", file: "文件准备", skill: "Skill 准备" },
+  unavailable: "失败详情不可用",
+  unavailableHelp: "诊断读取失败或与当前状态不一致，请刷新后重试。",
+  checking: "正在读取失败详情",
+  retry: "重试诊断读取",
+  failureLabel: "失败详情",
+  receiptTitle: "Core 接收时间",
+  receiptHelp: "Core 首次记录此 Item 及记录其结束状态的时间。事件批量写入和时钟变化会影响间隔，它不等同于工具执行耗时。历史 Item 可能没有结束记录时间。",
+  receiptStarted: "首次记录",
+  receiptCompleted: "结束状态记录",
+  receiptDuration: "记录间隔",
+  receiptUnavailable: "接收时间不可用",
+  receiptMissing: "Core 未报告此 Item 的接收时间。",
+  truncated: "Core 仅返回了前 1,000 个 Item 的时间。",
+  clockChange: "时钟曾向后调整，此间隔不可用。",
+} as const;
diff --git a/apps/web/src/i18n/locales/zh-CN/metrics.ts b/apps/web/src/i18n/locales/zh-CN/metrics.ts
index 1a50040ef..7d7584065 100644
--- a/apps/web/src/i18n/locales/zh-CN/metrics.ts
+++ b/apps/web/src/i18n/locales/zh-CN/metrics.ts
@@ -177,6 +177,11 @@ export const metrics = {
     },
   },
   sandbox: {
+    nodeObservationStale: "这些节点数据是较早的观测，请刷新节点清单以确认当前状态。",
+    servingGeneration: "保留的服务代次",
+    servingGenerationHelp: "Core 为该节点保留的配置代次。仅凭此记录不能确认当前连接、可用容量或目标配置就绪。",
+    targetPreparation: "目标配置",
+    configurationGeneration: "沙箱配置代次",
     title: "沙箱监控",
     description: "整个部署的宿主机容量，以及所有项目的托管运行时。",
     cloudDescription: "Core 在 E2B 云端持有的沙箱，以及各项目的托管 Runtime 观测。",
diff --git a/apps/web/src/i18n/locales/zh-CN/overview.ts b/apps/web/src/i18n/locales/zh-CN/overview.ts
index 70b37580f..b9536682d 100644
--- a/apps/web/src/i18n/locales/zh-CN/overview.ts
+++ b/apps/web/src/i18n/locales/zh-CN/overview.ts
@@ -113,6 +113,10 @@ export const overview = {
     offline: "离线",
   },
   fleet: {
+    servingGeneration: "保留的服务代次",
+    servingGenerationHelp: "Core 为该节点保留的配置代次。仅凭此记录不能确认当前连接、可用容量或目标配置就绪。",
+    previousGeneration: "资源清单读取于配置代次 {{observed}}，当前目标为 {{target}}。这里保留的是较早的观测。",
+    targetPreparation: "目标配置",
     title: "机群",
     cloudHelp: "Core 与它在 E2B 云端持有的沙箱。选择 Core 或 E2B 可查看摘要。",
     help: "Core 与各沙箱节点的连接：实线为在线，虚线为离线。节点上的数字是活跃沙箱 / 上限。点击 Core 或节点查看概况。",
diff --git a/apps/web/src/i18n/locales/zh-CN/sandbox-navigation.ts b/apps/web/src/i18n/locales/zh-CN/sandbox-navigation.ts
new file mode 100644
index 000000000..5c9a5431c
--- /dev/null
+++ b/apps/web/src/i18n/locales/zh-CN/sandbox-navigation.ts
@@ -0,0 +1,11 @@
+export const sandboxNavigation = {
+  "title": "沙箱配置",
+  "help": "在这里管理部署后端、沙箱规格和重置；主机在节点页面管理。",
+  "open": "管理沙箱配置",
+  "back": "返回系统",
+  "nodes": "打开节点",
+  "unconfigured": "请先在系统中配置沙箱托管，再添加节点。",
+  "cloud": "E2B 在云端运行沙箱，无需管理节点。",
+  "reset": "重置期间暂停添加节点，请在系统中查看进度。",
+  "details": "配置详情"
+} as const;
diff --git a/apps/web/src/i18n/locales/zh-CN/sessions.ts b/apps/web/src/i18n/locales/zh-CN/sessions.ts
index ab7d2dbb8..d14fd6a1c 100644
--- a/apps/web/src/i18n/locales/zh-CN/sessions.ts
+++ b/apps/web/src/i18n/locales/zh-CN/sessions.ts
@@ -145,6 +145,22 @@ export const sessions = {
     historyLoading: "正在加载运行时历史…",
   },
   executor: {
+    connection: {
+      title: "主机连接",
+      help: "只有执行器仍具备有效权限且连接存活时，Core 才报告已连接。最后在线时间来自最近一次心跳，可能有延迟；它不代表模型或运行引擎已就绪。",
+      status: { never_enrolled: "尚未连接", connected: "已连接", disconnected: "已断开", revoked: "绑定凭证已撤销", unknown: "未知" },
+      boundKey: "绑定凭证",
+      lastSeen: "最后在线",
+      notBound: "尚未绑定",
+      noHeartbeat: "尚无心跳记录",
+      stale: "刷新失败。当前显示上次读取的绑定信息，连接状态未知。",
+      refreshing: "正在刷新上次读取的绑定信息，尚未确认当前连接。",
+      failed: "无法读取连接状态，请刷新重试。",
+      bound: "此 Environment 已绑定凭证 {{id}}，签发新凭证不会替换绑定。请轮换绑定凭证以重新连接。",
+      restore: "绑定凭证 {{id}} 已撤销。请轮换以恢复，再在主机上重跑安装命令；签发新凭证不会替换绑定。",
+      rotateRestore: "轮换以恢复",
+      rotateBound: "轮换绑定凭证",
+    },
     title: "Executor 凭据",
     help: "凭据让一个自托管 executor 连接 Core，只对这个环境有效，不能调用 Agents API。请在 executor 所在的主机上把它粘贴给安装程序，并妥善保管。每份凭据只显示一次；丢失时，轮换凭据即可换一份新的。",
     issue: "签发凭据",
@@ -186,6 +202,8 @@ export const sessions = {
       done: "完成",
     },
     install: {
+      hostDone: "在主机上运行 · 已完成",
+      hostPending: "在主机上运行 · 等待连接",
       title: "连接主机",
       lifecycle: "凭据被撤销或轮换后，主机上的 executor 会断开连接，只给出一条提示且不再重试；它的容器会继续运行。要重新连接，请轮换同一份凭据，重新运行同一条命令并粘贴轮换后的凭据；签发一份新凭据无法让已经连接过的环境重新连接。要移除 Runtime，停止它的容器即可。",
       steps: "在主机上运行这条命令，并在隐藏的输入提示处粘贴本区域的凭据：凭据只在签发或轮换后显示一次。同一条命令可以放心重复运行。",
diff --git a/apps/web/src/i18n/locales/zh-CN/system.ts b/apps/web/src/i18n/locales/zh-CN/system.ts
index 8a12a07c7..3ce3c2b8b 100644
--- a/apps/web/src/i18n/locales/zh-CN/system.ts
+++ b/apps/web/src/i18n/locales/zh-CN/system.ts
@@ -108,7 +108,7 @@ export const system: TranslationShape<typeof english> = {
     size: "{{count}} 核 · {{memory}}", size_one: "{{count}} 核 · {{memory}}", size_other: "{{count}} 核 · {{memory}}",
     disks: "根盘 {{root}} · 数据盘 {{data}}（/environment）",
     runtime: "Runtime",
-    runtimeHelp: "每个节点运行的 Runtime 版本；节点只接受这一个。",
+    runtimeHelp: "目标 Runtime 版本。节点准备目标配置时，已有沙箱保留其所属版本。",
     e2bTemplate: "E2B 模板",
     templateBuild: "模板构建",
     templateBuildHelp: "每个沙箱启动时使用的固定 E2B 构建，是保存选择时 Core 读到的信息。每个沙箱按它分配 CPU、内存和磁盘。",
diff --git a/apps/web/src/i18n/resources.ts b/apps/web/src/i18n/resources.ts
index 2c0735866..d4774c8b1 100644
--- a/apps/web/src/i18n/resources.ts
+++ b/apps/web/src/i18n/resources.ts
@@ -1,3 +1,7 @@
+import { sandboxNavigation as enSandboxNavigation } from "./locales/en/sandbox-navigation";
+import { sandboxNavigation as zhSandboxNavigation } from "./locales/zh-CN/sandbox-navigation";
+import { diagnostics as enDiagnostics } from "./locales/en/diagnostics";
+import { diagnostics as zhDiagnostics } from "./locales/zh-CN/diagnostics";
 import { common as enCommon } from "./locales/en/common";
 import { navigation as enNavigation } from "./locales/en/navigation";
 import { pages as enPages } from "./locales/en/pages";
@@ -56,12 +60,14 @@ export const resources = {
     files: enFiles,
     dashboard: enDashboard,
     sessions: enSessions,
+    diagnostics: enDiagnostics,
     overview: enOverview,
     metrics: enMetrics,
     skills: enSkills,
     keys: enKeys,
     system: enSystem,
     sandbox: enSandbox,
+    sandboxNavigation: enSandboxNavigation,
     firstRun: enFirstRun,
     onboarding: enOnboarding,
   },
@@ -75,12 +81,14 @@ export const resources = {
     files: zhCNFiles,
     dashboard: zhCNDashboard,
     sessions: zhCNSessions,
+    diagnostics: zhDiagnostics,
     overview: zhCNOverview,
     metrics: zhCNMetrics,
     skills: zhCNSkills,
     keys: zhCNKeys,
     system: zhCNSystem,
     sandbox: zhCNSandbox,
+    sandboxNavigation: zhSandboxNavigation,
     firstRun: zhCNFirstRun,
     onboarding: zhCNOnboarding,
   },
diff --git a/apps/web/src/lib/core-error.test.ts b/apps/web/src/lib/core-error.test.ts
new file mode 100644
index 000000000..19b6d765d
--- /dev/null
+++ b/apps/web/src/lib/core-error.test.ts
@@ -0,0 +1,57 @@
+import { AgentCoreError } from "@agents-core-web/agents-client";
+import { describe, expect, it } from "vitest";
+import i18n from "../i18n";
+import { coreErrors as english } from "../i18n/locales/en/core-errors";
+import { coreErrors as chinese } from "../i18n/locales/zh-CN/core-errors";
+import { coreError, coreFieldError, knownCoreError } from "./core-error";
+import { readError } from "./read-error";
+
+const en = i18n.getFixedT("en", "common");
+const zh = i18n.getFixedT("zh-CN", "common");
+const failure = (code: string, param?: string, details?: AgentCoreError["details"], status = 400) => new AgentCoreError("unparsed backend prose", status, code, param, undefined, details);
+
+describe("Core error catalog localization", () => {
+  it("covers both languages, without relying on backend prose", () => {
+    expect(Object.keys(chinese).sort()).toEqual(Object.keys(english).sort());
+    for (const code of ["invalid_admin_key", "console_sign_in_required", "console_origin_rejected", "console_request_invalid", "core_unreachable", "invalid_name", "invalid_node_capacity", "invalid_model_provider", "model_provider_base_url_invalid", "model_provider_protocol_unsupported", "model_provider_api_key_invalid", "model_provider_token_limits_invalid", "invalid_sandbox_configuration", "e2b_api_key_invalid", "e2b_template_build_invalid", "e2b_team_mismatch", "e2b_request_unconfirmed", "sandbox_generation_stale", "sandbox_admin_not_configured", "project_archived", "project_exists", "project_api_key_exists"]) {
+      expect(knownCoreError(failure(code), en)).not.toBeNull();
+      expect(coreError(failure(code), en)).not.toContain("backend prose");
+      expect(coreError(failure(code), zh)).toMatch(/[\u4e00-\u9fff]/);
+    }
+    expect(coreError(failure("console_sign_in_required"), en)).not.toEqual(coreError(failure("invalid_admin_key"), en));
+  });
+
+  it("uses only typed bounds and exact resource field paths", () => {
+    expect(coreError(failure("invalid_name", "name", { max_length: 80, ignored: "SECRET" }), en)).toContain("80 characters");
+    expect(coreFieldError(failure("invalid_name", "name", { max_length: 128 }), "name", en, "bytes")).toContain("128 UTF-8 bytes");
+    expect(coreError(failure("invalid_node_capacity", "max_retained", { min: 1, max: 1000000 }), zh)).toContain("1000000");
+    expect(coreError(failure("invalid_sandbox_configuration", "resources.cpus", { min: 1, max: 255 }), en)).toContain("1 to 255");
+    expect(coreError(failure("invalid_sandbox_configuration", "resources.root_disk_mib", { min: 1024 }), en)).toContain("at least 1024");
+    for (const max_length of ["SECRET", NaN, Infinity, -1, 1.5, null, ["SECRET"]]) {
+      expect(coreError(failure("invalid_name", "name", { max_length }), en)).toBe(english.invalid_name);
+    }
+    expect(coreError(failure("invalid_sandbox_configuration", "unknown", { min: 99, max: 100 }), en)).toBe(english.invalid_sandbox_configuration);
+    expect(coreError(failure("invalid_sandbox_configuration", "resources.cpus", { min: 255, max: 1 }), en)).toBe(english.invalid_sandbox_configuration);
+  });
+
+  it("allows catalog protocol values and never reflects arbitrary detail text", () => {
+    expect(coreError(failure("model_provider_protocol_unsupported", "protocol", { allowed_protocols: ["responses"] }), en)).toBe("Allowed protocols: responses.");
+    expect(coreError(failure("model_provider_protocol_unsupported", "protocol", { allowed_protocols: ["SECRET"], harness: "SECRET" }), en)).toBe(english.model_provider_protocol_unsupported);
+  });
+
+  it("attaches exact rejected fields without treating unknown outcomes as field validation", () => {
+    const error = failure("model_provider_base_url_invalid", "base_url");
+    expect(coreFieldError(error, "base_url", zh)).toBe(chinese.model_provider_base_url_invalid);
+    expect(coreFieldError(error, "api_key", zh)).toBeNull();
+    for (const status of [0, 408, 502]) expect(coreFieldError(failure("invalid_name", "name", undefined, status), "name", en)).toBeNull();
+    expect(coreFieldError(failure("new_code", "name"), "name", en)).toBe("unparsed backend prose");
+    expect(coreFieldError(new Error("invalid_name name"), "name", en)).toBeNull();
+  });
+
+  it("retains unknown-code messages without parsing them", () => {
+    const error = failure("future_error", undefined, { max_length: 999 });
+    expect(coreError(error, zh)).toBe(error.message);
+    expect(readError(error, zh)).toBe(error.message);
+    expect(coreError(new Error("private transport data"), zh)).not.toContain("private");
+  });
+});
diff --git a/apps/web/src/lib/core-error.ts b/apps/web/src/lib/core-error.ts
new file mode 100644
index 000000000..ea1eb3544
--- /dev/null
+++ b/apps/web/src/lib/core-error.ts
@@ -0,0 +1,49 @@
+import { AgentCoreError } from "@agents-core-web/agents-client";
+import type { TFunction } from "i18next";
+import type { coreErrors } from "../i18n/locales/en/core-errors";
+
+const codes = new Set<keyof typeof coreErrors>([
+  "e2b_team_mismatch", "e2b_api_key_invalid", "e2b_template_build_invalid", "e2b_request_unconfirmed", "sandbox_configuration_error",
+  "sandbox_generation_stale", "sandbox_reset_required", "sandbox_reset_in_progress", "sandbox_not_configured", "sandbox_in_use", "runtime_node_in_use", "runtime_node_unavailable", "sandbox_admin_not_configured",
+  "invalid_admin_key", "console_sign_in_required", "console_origin_rejected", "console_request_invalid", "core_unreachable",
+  "invalid_name", "invalid_node_capacity", "invalid_model_provider", "model_provider_base_url_invalid",
+  "model_provider_protocol_unsupported", "model_provider_api_key_invalid", "model_provider_token_limits_invalid",
+  "invalid_sandbox_configuration", "project_archived", "project_exists", "project_api_key_exists",
+  "executor_credential_exists", "credential_storage_unavailable", "diagnostics_unavailable", "internal_error",
+]);
+
+/** Only catalogued, correctly typed detail keys can enter localized text. */
+export function knownCoreError(error: unknown, t: TFunction<"common">, nameUnit: "characters" | "bytes" = "characters"): string | null {
+  if (!(error instanceof AgentCoreError) || !codes.has(error.code as keyof typeof coreErrors)) return null;
+  const number = (key: string) => {
+    const value = error.details?.[key];
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : undefined;
+  };
+  const maxLength = number("max_length");
+  if (error.code === "invalid_name" && maxLength !== undefined) return t(nameUnit === "bytes" ? "coreErrors.nodeNameLimit" : "coreErrors.nameLimit", { max: maxLength });
+  if (error.code === "model_provider_api_key_invalid" && maxLength !== undefined) return t("coreErrors.keyLimit", { max: maxLength });
+  const min = number("min"), max = number("max");
+  if (error.code === "invalid_node_capacity" && min !== undefined && max !== undefined && min <= max) return t("coreErrors.capacityRange", { min, max });
+  if (error.code === "invalid_sandbox_configuration") {
+    if (error.param === "runtime") return t("coreErrors.runtime");
+    if (["resources.cpus", "resources.memory_mib", "resources.root_disk_mib", "resources.environment_disk_mib"].includes(error.param ?? "") && min !== undefined) {
+      if (max !== undefined && min <= max) return t("coreErrors.resourceRange", { min, max });
+      if (max === undefined) return t("coreErrors.resourceMin", { min });
+    }
+  }
+  if (error.code === "model_provider_protocol_unsupported") {
+    const protocols = error.details?.allowed_protocols;
+    if (Array.isArray(protocols) && protocols.length > 0 && protocols.every((value) => ["responses", "anthropic"].includes(value))) return t("coreErrors.protocols", { protocols: protocols.join(", ") });
+  }
+  return t(`coreErrors.${error.code as keyof typeof coreErrors}`);
+}
+
+export function coreError(error: unknown, t: TFunction<"common">): string {
+  return knownCoreError(error, t) ?? (error instanceof AgentCoreError && error.message ? error.message : t("readFailure.unknown"));
+}
+
+/** Exact field paths only; timeouts and unknown write outcomes are form-level errors. */
+export function coreFieldError(error: unknown, param: string, t: TFunction<"common">, nameUnit: "characters" | "bytes" = "characters"): string | null {
+  if (!(error instanceof AgentCoreError) || error.status < 400 || error.status >= 500 || error.status === 408 || error.param !== param) return null;
+  return knownCoreError(error, t, nameUnit) ?? error.message;
+}
diff --git a/apps/web/src/lib/diagnostic-failure.ts b/apps/web/src/lib/diagnostic-failure.ts
new file mode 100644
index 000000000..0017e6cdb
--- /dev/null
+++ b/apps/web/src/lib/diagnostic-failure.ts
@@ -0,0 +1,16 @@
+import type { DiagnosticFailure } from "@agents-core-web/agents-client";
+import type { TFunction } from "i18next";
+
+/** Translate the catalog, never native error text or guessed message categories. */
+export function diagnosticFailure(failure: DiagnosticFailure, t: TFunction<"diagnostics">): string {
+  let message: string = t(`failure.${failure.code}`, { defaultValue: t("failure.internal_error") });
+  if (failure.code === "environment_provisioning_failed" && "step" in failure.params && failure.params.step) {
+    message = t("provisioningStep", { step: t(`step.${failure.params.step}`) });
+    if (failure.params.index !== null) message += ` ${t("setupIndex", { number: failure.params.index + 1 })}`;
+    if (failure.params.exit_code !== null) message += ` ${t("exitCode", { code: failure.params.exit_code })}`;
+  }
+  if (failure.code === "connection_failed" && "http_status" in failure.params && failure.params.http_status !== null) {
+    message += ` ${t("httpStatus", { status: failure.params.http_status })}`;
+  }
+  return message;
+}
diff --git a/apps/web/src/lib/locale-strings.ts b/apps/web/src/lib/locale-strings.ts
index 8d8be3bea..c81da3bca 100644
--- a/apps/web/src/lib/locale-strings.ts
+++ b/apps/web/src/lib/locale-strings.ts
@@ -1,13 +1,51 @@
 import { consoleAuthChinese } from "./console-auth-strings";
 export const chinese = {
   ...consoleAuthChinese,
+  "Hosted Sessions will be archived permanently. Deployment configuration and node registrations will be cleared. Unsaved workspace contents may be lost.": "托管 Session 将归档且无法恢复，部署配置与节点注册将清除。未保存的工作区内容可能丢失。",
+  "What reset affects": "重置影响范围",
+  "How automatic reset works": "自动清理规则",
+  "Wait before forcing (seconds)": "等待时长（秒）",
+  "No active preparation": "没有正在进行的准备任务",
+  "Review nodes": "检查节点",
+  "Configuration rollout": "配置更新进度",
+  "View rollout details": "查看详情",
+  "Preparing configuration": "正在准备配置",
+  "Rollout state unconfirmed": "配置更新状态未确认",
+  "Core preparation": "Core 准备状态",
+  "Target generation": "目标代次",
+  "Previous-generation sandboxes": "旧代次沙箱",
+  "Ready for target": "目标配置已就绪",
+  "Preparing target": "正在准备目标配置",
+  "Preparation failed": "目标配置准备失败",
+  "Node software incompatible": "节点程序不兼容",
+  "Target readiness unknown": "目标配置就绪状态未知",
+  "Target preparation": "目标配置准备状态",
+  "Serving generation": "服务代次",
+  "Configuration generation": "配置代次",
+  "Cancel editing": "取消编辑",
+  "Replace saved key": "替换已保存的密钥",
+  "Keep saved key": "保留已保存的密钥",
+  "Core is preparing the target configuration.": "Core 正在准备目标配置。",
+  "Core reports no active preparation. This does not mean every node is ready.": "Core 报告当前没有正在进行的准备任务。这不代表所有节点都已就绪。",
+  "Rollout state is unconfirmed. These are the last confirmed observations.": "配置更新状态尚未确认。当前显示的是上次确认的状态。",
+  "Review affected nodes for preparation errors, incompatible node software or an unconfirmed connection. Qualified earlier generations may still serve work.": "请检查相关节点的准备错误、不兼容的节点程序或尚未确认的连接。符合条件的旧代次仍可提供服务。",
+  "Existing sandboxes keep their configuration generation. Saving does not move them or prove the target is ready.": "现有沙箱保留所属配置代次。保存不会迁移沙箱，也不代表目标配置已就绪。",
+  "Changes keep this backend and existing Sessions and nodes. Core prepares the new target for future work; placement may continue on qualified earlier generations.": "修改会保留当前后端、现有 Session 和节点。Core 为后续任务准备新目标配置，期间仍可能将任务分配到符合条件的旧代次。",
+  "In-place upgrades from older project versions are not supported. Reinstall using the current version. Existing data is not removed automatically.": "不支持旧项目版本原地升级，请使用当前版本重新安装。现有数据不会自动删除。",
+  "The saved serving generation is not proof that this node is online, ready or has free capacity.": "已保存的服务代次不代表节点当前在线、已就绪或有空闲容量。",
+  "Node observations are from an earlier configuration generation. Refreshing does not change their owned sandboxes.": "节点观测来自较早的配置代次。刷新不会改变节点所属的沙箱。",
+  "Leave blank to keep the saved key. Any key you enter is verified as a replacement, even if unchanged.": "留空可保留已保存的密钥。填写的密钥都会作为替换密钥进行验证，即使内容未变。",
+  "These limits apply to the selected configuration generation. Existing sandboxes keep their limits. Concurrency is set per node.": "这些限制适用于所选配置代次。现有沙箱保留原有限制。并发数量按节点设置。",
+  "The target Runtime release. Existing sandboxes keep their owned release while nodes prepare the target.": "目标 Runtime 版本。节点准备目标版本时，现有沙箱仍使用其所属版本。",
+  "This E2B key cannot manage the retained deployment. Reset before changing teams.": "此 E2B 密钥无法管理当前保留的部署。更换团队前请先重置。",
+  "The E2B API key was rejected. The saved configuration is unchanged.": "E2B API 密钥被拒绝。已保存的配置未改变。",
+  "Select a ready immutable E2B template build with matching resources.": "请选择已就绪且资源匹配的不可变 E2B 模板构建。",
+  "E2B verification could not be confirmed. Refresh before submitting again.": "无法确认 E2B 验证结果。请刷新后再提交。",
+  "Cancel editing to use Reset deployment. This change requires an explicit reset; the saved configuration is unchanged.": "取消编辑后可使用“重置部署”。此更改需要明确重置；已保存的配置未改变。",
+
   "Sandbox state is unconfirmed. Refresh before issuing a node command.": "沙箱状态尚未确认。请刷新后再生成节点命令。",
   "Change resources": "修改资源",
   "One provider serves this deployment. Reset it before choosing a different backend.": "整个部署使用一个运行后端。请先重置，再选择其他后端。",
-  "Editing keeps the current provider and requires zero allocated resources and pending environments. It is not an online upgrade.": "修改会保留当前运行后端，并要求已分配资源和待处理 Environment 都为零。这不是在线升级。",
-  "Changes require Core to confirm that no hosted resources remain.": "只有 Core 确认没有剩余托管资源后，才能修改配置。",
-  "Saving changes only this provider's configuration; it does not confirm execution readiness.": "保存只修改当前后端的配置，不代表执行已就绪。",
-  "Saving retires existing node identities and enrollment commands. Add the nodes again after saving.": "保存会作废现有节点身份和注册命令。保存后请重新添加节点。",
   "Reset sandbox deployment?": "重置沙箱部署？",
   "Reset deployment": "重置部署",
   "Reset in progress": "正在重置",
@@ -44,7 +82,7 @@ export const chinese = {
   "Node enrollment is paused while reset is in progress.": "重置过程中暂停注册节点。",
   "Unsaved workspace contents may be lost.": "尚未保存的工作区内容可能丢失。",
   "Core has a newer sandbox configuration. Refresh and review it before submitting again.": "Core 的沙箱配置已更新。请刷新并检查后再提交。",
-  "Reset the sandbox deployment before changing its backend.": "请先重置沙箱部署，再更换运行后端。",
+  "Reset the sandbox deployment before changing this configuration.": "请先重置沙箱部署，再更改此配置。",
   "A sandbox reset is in progress. Refresh to see its current progress.": "沙箱正在重置。请刷新查看当前进度。",
   "The sandbox deployment is not configured. Refresh to start setup.": "沙箱部署尚未配置。请刷新以开始配置。",
   "Hosted resources remain. Wait for confirmed cleanup before changing the configuration.": "仍有托管资源。请等待 Core 确认清理完成后再修改配置。",
@@ -262,6 +300,8 @@ export const chinese = {
   "The node can't reach the Docker daemon. Check that Docker is running and the node can use its socket.": "节点连不上 Docker 守护进程。请确认 Docker 正在运行，且节点能访问它的 socket。",
   "Docker limits unsupported": "Docker 无法限制资源",
   "Docker on this host doesn't enforce CPU and memory limits. Enable cgroup limits.": "这台主机上的 Docker 不能限制 CPU 和内存。请启用 cgroup 限制。",
+  "Runtime download failed": "Runtime 下载失败",
+  "Runtime files could not be downloaded or verified. Check the node's network access and the configured Runtime release.": "Runtime 文件下载或验证失败。请检查节点网络连接及配置的 Runtime 发布版本。",
   "Runtime image missing": "缺少 Runtime 镜像",
   "The pinned Runtime image isn't on the host. Run the install command again.": "主机上没有指定版本的 Runtime 镜像。请重新运行安装命令。",
   "KVM unavailable": "KVM 不可用",
@@ -304,7 +344,6 @@ export const chinese = {
   "Check cleanup": "检查清理状态",
   "Core reports no remaining execution resources. You can choose the next provider.": "Core 确认已无剩余执行资源，可以选择下一个运行后端。",
   "Provider changes are blocked until Core confirms complete cleanup.": "Core 确认清理完成前无法更改运行后端。",
-  "Saving retires old node identities and enrollment credentials. It does not migrate Sessions or resume placement automatically.": "保存后旧节点身份和注册凭据将失效。不会迁移会话或自动恢复分配。",
   "Cancel": "取消",
   "Resume hosted placement": "恢复托管分配",
   "Refresh sandbox state to confirm whether the change was saved before submitting again.": "再次提交前，请刷新沙箱状态以确认更改是否已保存。",
@@ -335,7 +374,6 @@ export const chinese = {
   "microsandbox, the recommended default, runs each sandbox as a lightweight virtual machine: stronger isolation and its own root and data disks with size limits, but the host needs KVM. Docker runs each sandbox as a container on the host's kernel: CPU and memory limits but no disk quota, for trusted workloads or hosts without KVM.": "microsandbox（推荐的默认后端）：每个沙箱是一个轻量虚拟机，隔离更强，有独立的根盘和数据盘并能限制大小，但主机需要支持 KVM。Docker：每个沙箱是一个共用主机内核的容器，能限制 CPU 和内存，但没有磁盘配额，只适合可信的工作负载或没有 KVM 的主机。",
   "E2B runs sandboxes in its cloud: no machines to manage, billed by E2B. Own machines run them on hosts you add, with microsandbox (recommended) or Docker.": "E2B 云端：沙箱跑在 E2B 的云上，不用管理机器，由 E2B 计费。自有机器：沙箱跑在你添加的主机上，用 microsandbox（推荐）或 Docker。",
   "Each sandbox": "每个沙箱",
-  "Every sandbox of this deployment gets these limits. How many run at once on a machine is set per node.": "这个部署里的每个沙箱都用这组限额；一台机器上同时运行几个沙箱，在各个节点上单独设置。",
   "Filled in from this console's distribution when it serves one. Otherwise copy these from the distribution manifest that matches your nodes; image configuration IDs and manifest digests are different values.": "控制台提供发行清单时会自动填好；否则从与节点配套的发行清单里复制。镜像配置 ID 和清单摘要是两个不同的值。",
   "Firmware SHA-256": "固件 SHA-256",
   "How big is each sandbox?": "每个沙箱多大？",
@@ -363,7 +401,6 @@ export const chinese = {
   "From the template build": "按模板构建",
   "Idle suspension": "空闲挂起",
   "After {{idle}} · kept {{retention}}": "{{idle}}后 · 保留 {{retention}}",
-  "The Runtime release every node runs: the saved one while the backend stays the same, otherwise the one this console distributes.": "所有节点运行的 Runtime 版本：后端不变时沿用已保存的版本，否则使用此控制台分发的版本。",
   "Current": "当前规格",
   "The exact ready build, as template-id:build-uuid. A template alias alone is not enough. Each sandbox gets the build's CPU and memory.": "精确的已就绪构建，格式为 template-id:build-uuid，只填模板别名不行。每个沙箱按这个构建分配 CPU 和内存。",
   "The key is write-only: Core encrypts it and never shows it again.": "key 只写入：Core 加密保存，之后不再显示。",
diff --git a/apps/web/src/lib/locale.test.ts b/apps/web/src/lib/locale.test.ts
index 79023a9d3..e25a2e28e 100644
--- a/apps/web/src/lib/locale.test.ts
+++ b/apps/web/src/lib/locale.test.ts
@@ -20,7 +20,7 @@ describe("sandbox localization", () => {
   });
   it("localizes all diagnostic labels and advice", () => {
     for (const code of ["node_unavailable", "resource_missing", "compute_unconfirmed", "ownership_mismatch", "provider_unavailable", "docker_unavailable",
-      "docker_limits_unsupported", "runtime_image_unavailable", "kvm_unavailable", "microsandbox_artifacts_unavailable", "capacity_insufficient", "unknown"]) {
+      "docker_limits_unsupported", "runtime_download_failed", "runtime_image_unavailable", "kvm_unavailable", "microsandbox_artifacts_unavailable", "capacity_insufficient", "unknown"]) {
       const message = sandboxDiagnosticMessage(code, "zh");
       expect(message?.label).toMatch(/[\u4e00-\u9fff]/);
       expect(message?.advice).toMatch(/[\u4e00-\u9fff]/);
diff --git a/apps/web/src/lib/read-error.ts b/apps/web/src/lib/read-error.ts
index 59e421a80..83a56c320 100644
--- a/apps/web/src/lib/read-error.ts
+++ b/apps/web/src/lib/read-error.ts
@@ -1,8 +1,8 @@
 import { AgentCoreError } from "@agents-core-web/agents-client";
 import type { TFunction } from "i18next";
+import { coreError } from "./core-error";
 
 export function readError(error: unknown, t: TFunction<"common">): string {
-  return error instanceof AgentCoreError
-    ? t("readFailure.request", { status: error.status })
-    : t("readFailure.unknown");
+  if (error instanceof AgentCoreError) return error.code ? coreError(error, t) : t("readFailure.request", { status: error.status });
+  return t("readFailure.unknown");
 }
diff --git a/apps/web/src/lib/sandbox-diagnostic.test.ts b/apps/web/src/lib/sandbox-diagnostic.test.ts
index 25d8d0eb3..61670f9ac 100644
--- a/apps/web/src/lib/sandbox-diagnostic.test.ts
+++ b/apps/web/src/lib/sandbox-diagnostic.test.ts
@@ -28,4 +28,23 @@ describe("sandbox diagnostics", () => {
     expect(message?.label).toBe("Sandbox state needs attention");
     expect(JSON.stringify(message)).not.toContain("private-provider-error");
   });
+  it("preserves the typed download diagnostic on an online node and suppresses stale offline health", () => {
+    const diagnostic: SandboxNodeDiagnostic = "runtime_download_failed";
+    expect(nodeProviderDiagnostic({ online: true, provider_ready: false, diagnostic })).toBe(diagnostic);
+    expect(nodeProviderDiagnostic({ online: false, provider_ready: false, diagnostic })).toBe("");
+  });
+  it("explains download and verification failures separately from provider image failures in both languages", () => {
+    const diagnostic: SandboxNodeDiagnostic = "runtime_download_failed";
+    expect(sandboxDiagnosticMessage(diagnostic, "en")).toEqual({
+      label: "Runtime download failed",
+      advice: "Runtime files could not be downloaded or verified. Check the node's network access and the configured Runtime release.",
+    });
+    expect(sandboxDiagnosticMessage(diagnostic, "zh")).toEqual({
+      label: "Runtime 下载失败",
+      advice: "Runtime 文件下载或验证失败。请检查节点网络连接及配置的 Runtime 发布版本。",
+    });
+    for (const locale of ["en", "zh"] as const) {
+      expect(sandboxDiagnosticMessage(diagnostic, locale)).not.toEqual(sandboxDiagnosticMessage("runtime_image_unavailable", locale));
+    }
+  });
 });
diff --git a/apps/web/src/lib/sandbox-diagnostic.ts b/apps/web/src/lib/sandbox-diagnostic.ts
index 186854da6..8475ba66c 100644
--- a/apps/web/src/lib/sandbox-diagnostic.ts
+++ b/apps/web/src/lib/sandbox-diagnostic.ts
@@ -24,7 +24,7 @@ const diagnostics: Record<string, { label: MessageKey; advice: MessageKey }> = {
     label: "Sandbox provider unavailable",
     advice: "Restore the provider on the assigned node, then refresh. A connected node alone does not confirm that its sandbox provider is ready.",
   },
-  // The first readiness check a node's provider failed; the node sends only the code.
+  // Fixed Runtime preparation and provider readiness diagnostics; Core sends only the code.
   docker_unavailable: {
     label: "Docker unavailable",
     advice: "The node can't reach the Docker daemon. Check that Docker is running and the node can use its socket.",
@@ -33,6 +33,10 @@ const diagnostics: Record<string, { label: MessageKey; advice: MessageKey }> = {
     label: "Docker limits unsupported",
     advice: "Docker on this host doesn't enforce CPU and memory limits. Enable cgroup limits.",
   },
+  runtime_download_failed: {
+    label: "Runtime download failed",
+    advice: "Runtime files could not be downloaded or verified. Check the node's network access and the configured Runtime release.",
+  },
   runtime_image_unavailable: {
     label: "Runtime image missing",
     advice: "The pinned Runtime image isn't on the host. Run the install command again.",
@@ -56,6 +60,7 @@ const nodeDiagnostics: ReadonlySet<string> = new Set([
   "provider_unavailable",
   "docker_unavailable",
   "docker_limits_unsupported",
+  "runtime_download_failed",
   "runtime_image_unavailable",
   "kvm_unavailable",
   "microsandbox_artifacts_unavailable",
diff --git a/apps/web/src/lib/sandbox-labels.test.ts b/apps/web/src/lib/sandbox-labels.test.ts
index 9503655d7..7405b0ed1 100644
--- a/apps/web/src/lib/sandbox-labels.test.ts
+++ b/apps/web/src/lib/sandbox-labels.test.ts
@@ -1,9 +1,20 @@
 import { AgentCoreError } from "@agents-core-web/agents-client";
 import { describe, expect, it } from "vitest";
 
-import { sandboxRequestError, sandboxWriteUncertain } from "./sandbox-labels";
+import { sandboxConfigurationRejection, sandboxRequestError, sandboxWriteUncertain } from "./sandbox-labels";
 
 describe("sandbox write outcome", () => {
+  it("uses fixed bilingual E2B errors without reflecting provider text or secrets", () => {
+    for (const [code, status] of [["e2b_team_mismatch", 409], ["e2b_api_key_invalid", 400], ["e2b_template_build_invalid", 400], ["e2b_request_unconfirmed", 503]] as const) {
+      const error = new AgentCoreError("secret-provider-response", status, code);
+      for (const locale of ["en", "zh"] as const) {
+        expect(sandboxRequestError(error, locale)).not.toContain("secret-provider-response");
+        if (status < 500) expect(sandboxConfigurationRejection(error, locale)).toBe(sandboxRequestError(error, locale));
+        else expect(sandboxConfigurationRejection(error, locale)).toBeNull();
+      }
+    }
+  });
+
   it("is uncertain without a response, on a timeout or a 5xx, and certain on any other 4xx, a withheld E2B reason included", () => {
     expect(sandboxWriteUncertain(new TypeError("Failed to fetch"))).toBe(true);
     expect(sandboxWriteUncertain(new AgentCoreError("Unavailable.", 503))).toBe(true);
@@ -17,6 +28,12 @@ describe("sandbox write outcome", () => {
 
 
 describe("reset conflict recovery", () => {
+  it("explains reset-required configuration changes without assuming a different backend or team", () => {
+    const error = new AgentCoreError("untrusted-provider-detail", 409, "sandbox_reset_required");
+    expect(sandboxConfigurationRejection(error, "en")).toBe("Reset the sandbox deployment before changing this configuration.");
+    expect(sandboxRequestError(error, "zh")).toBe("请先重置沙箱部署，再更改此配置。");
+  });
+
   it("gives bilingual safe recovery for known state conflicts without reflecting a server payload", () => {
     for (const code of ["sandbox_generation_stale", "sandbox_reset_required", "sandbox_reset_in_progress", "sandbox_not_configured", "sandbox_in_use"]) {
       const error = new AgentCoreError("untrusted-secret-like-payload", 409, code);
diff --git a/apps/web/src/lib/sandbox-labels.ts b/apps/web/src/lib/sandbox-labels.ts
index fb1511896..4fc5c1320 100644
--- a/apps/web/src/lib/sandbox-labels.ts
+++ b/apps/web/src/lib/sandbox-labels.ts
@@ -1,4 +1,6 @@
 import { AgentCoreError, type SandboxNode, type SandboxProvider } from "@agents-core-web/agents-client";
+import i18n from "../i18n";
+import { knownCoreError } from "./core-error";
 import { translate, type Locale } from "./locale";
 import type { MessageKey } from "./locale-strings";
 
@@ -10,30 +12,15 @@ const states: Record<string, MessageKey> = {
 export function sandboxStateLabel(state: string, locale: Locale): string {
   return translate(locale, Object.hasOwn(states, state) ? states[state]! : "Unknown state");
 }
-/**
- * What to say about a failed sandbox request. A refusal (a 4xx other than 401
- * and a 408 timeout) is Core's to explain, so its message shows as sent: one
- * code, such as a 409 conflict, covers several reasons. Only codes with one
- * exact, stable meaning get the console's own words: an unconfigured console,
- * and a node that still holds sandboxes or is unavailable. An E2B configuration
- * whose reason the client withheld, since it may echo the key, is named as
- * refused without it.
- */
+/** Localized catalog errors first; unknown refusals retain Core’s message. */
 export function sandboxRequestError(error: unknown, locale: Locale): string {
+  const known = knownCoreError(error, i18n.getFixedT(locale === "zh" ? "zh-CN" : "en", "common"), "bytes");
+  if (known) return known;
   let key: MessageKey = "The sandbox request failed. Refresh to check the current state before trying again.";
   if (error instanceof AgentCoreError) {
     const refused = !sandboxWriteUncertain(error);
-    if (error.code === "sandbox_admin_not_configured") key = "Sandbox administration is not configured on this console.";
-    else if (error.status === 401) key = "Sign in to the console again to access sandbox management.";
-    else if (error.code === "sandbox_configuration_unconfirmed") { if (refused) key = "Core rejected the E2B configuration."; }
+    if (error.code === "sandbox_configuration_unconfirmed") { if (refused) key = "Core rejected the E2B configuration."; }
     else if (refused) {
-      if (error.code === "sandbox_generation_stale") return translate(locale, "Core has a newer sandbox configuration. Refresh and review it before submitting again.");
-      if (error.code === "sandbox_reset_required") return translate(locale, "Reset the sandbox deployment before changing its backend.");
-      if (error.code === "sandbox_reset_in_progress") return translate(locale, "A sandbox reset is in progress. Refresh to see its current progress.");
-      if (error.code === "sandbox_not_configured") return translate(locale, "The sandbox deployment is not configured. Refresh to start setup.");
-      if (error.code === "sandbox_in_use") return translate(locale, "Hosted resources remain. Wait for confirmed cleanup before changing the configuration.");
-      if (error.code === "runtime_node_in_use") return translate(locale, "The node has active allocations or retained resources. Clear allocations, snapshots, reservations and pending cleanup before removal.");
-      if (error.code === "runtime_node_unavailable") return translate(locale, "The selected sandbox node is unavailable or has no capacity.");
       if (error.message) return error.message;
       key = "The sandbox request was rejected. Refresh to check the current state.";
     } else if (error.status >= 500) key = "The sandbox service is unavailable. Refresh to check the current state.";
@@ -58,7 +45,11 @@ export function sandboxWriteUncertain(error: unknown): boolean {
  * such as E2B with a loopback public_url; null for any other failure. Nothing
  * was saved, so the administrator corrects the cause and saves again.
  */
-export function sandboxConfigurationRejection(error: unknown): string | null {
+export function sandboxConfigurationRejection(error: unknown, locale: Locale = "en"): string | null {
+  if (error instanceof AgentCoreError && !sandboxWriteUncertain(error) && error.code) {
+    const known = knownCoreError(error, i18n.getFixedT(locale === "zh" ? "zh-CN" : "en", "common"));
+    if (known) return known;
+  }
   return error instanceof AgentCoreError && error.status === 409 && error.code === "sandbox_configuration_error" && error.message ? error.message : null;
 }