diff --git a/.github/workflows/api-acceptance.yml b/.github/workflows/api-acceptance.yml
index 2faff478f..4c881c7d9 100644
--- a/.github/workflows/api-acceptance.yml
+++ b/.github/workflows/api-acceptance.yml
@@ -40,12 +40,9 @@ jobs:
         with:
           go-version-file: go.mod
           cache: true
-      - name: Build standalone commands and verify migration entrypoints
-        env:
-          OAC_TEST_DATABASE_URL: postgres://agents_api:agents_api_test_only@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/oac_ci_tests?sslmode=disable
+      - name: Build standalone commands
         run: |
           OAC_DEV_CORE_BUILD_DIR="$RUNNER_TEMP/oac-core-build" make build-core
-          OAC_DATABASE_URL="$OAC_TEST_DATABASE_URL" "$RUNNER_TEMP/oac-core-build/oac-core-migrate"
           "$RUNNER_TEMP/oac-core-build/oac-core-device" --help
           "$RUNNER_TEMP/oac-core-build/oac-core-environment-key" --help
       - uses: actions/setup-python@v6
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 588a76581..5aa1f5b01 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -190,9 +190,12 @@ jobs:
       - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref || github.sha }}
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
       - name: Allocate an isolated Compose project
         run: python3 -c 'import uuid; print("COMPOSE_SMOKE_PROJECT=oac-smoke-" + uuid.uuid4().hex)' >> "$GITHUB_ENV"
-      - name: Start published images and verify the installation
+      - name: Build the images, start the installation and verify it
         timeout-minutes: 17
         run: python3 scripts/compose-smoke.py
       - name: Remove test containers and volumes
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e67a7367e..c370b5fef 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -132,7 +132,7 @@ jobs:
           for asset in "$HOME/.oac/build/core-distribution/"*; do
             if [[ -f "$asset" ]]; then ln "$asset" "$HOME/.oac/build/release-upload/"; fi
           done
-          cp deploy/install-release.sh "$HOME/.oac/build/release-upload/install.sh"
+          cp deploy/install.sh "$HOME/.oac/build/release-upload/install.sh"
           (cd "$HOME/.oac/build/release-upload" && sha256sum install.sh > install.sh.sha256)
       - uses: actions/upload-artifact@v6
         with:
@@ -141,8 +141,8 @@ jobs:
           compression-level: 0
           if-no-files-found: error
 
-      - name: Sign in to GHCR for version releases
-        if: github.event_name == 'push'
+      - name: Sign in to GHCR
+        if: github.event_name == 'push' || inputs.draft_release
         env:
           GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
@@ -159,5 +159,5 @@ jobs:
           RELEASE_MODE: ${{ github.event_name == 'push' && 'publish' || 'draft' }}
         run: python3 scripts/publish-core-release.py --assets "$HOME/.oac/build/release-upload"
       - name: Remove registry credentials
-        if: always() && github.event_name == 'push'
+        if: always() && (github.event_name == 'push' || inputs.draft_release)
         run: rm -f "$RUNNER_TEMP/oac-release-docker/config.json"
diff --git a/AGENTS.md b/AGENTS.md
index 033f53965..b12acd1e8 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -65,6 +65,7 @@ OpenAgentCore is pre-release. Replace superseded interfaces, execution paths and
 ## Working in this repository
 
 - For each new task, create a new Git worktree. Name its directory after that change's commit subject, in kebab-case, beside the checkout. Run `git pull --ff-only` on the base branch, and create the feature branch in that worktree before development.
+- After every push to a pull request, wait 60 seconds, then run `gh pr checks` and confirm CI passes. Fix any failure before reporting the work as done.
 - [CONTRIBUTING.md](CONTRIBUTING.md): documentation ownership, repository boundary, workflow, independent review, required checks and naming.
 - [Develop OpenAgentCore](docs/development.md): setup, the repository map, focused checks and [each extension boundary](docs/development.md#choose-an-extension-boundary).
 - [API index](docs/api/index.md): each route's caller and credential.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 929787bb8..5710c3f55 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -33,7 +33,7 @@ This guide owns how to work in the repository: documentation ownership, the repo
 | Distribution builds, Runtime image builds, CI and publication | [Maintainer guide](docs/maintainers.md) |
 | Website: landing page, bilingual documentation maintenance, documentation site build and GitHub Pages publication | [Website guide](website/README.md) |
 | Self-hosted Runtime installation, recovery and local operation | [Self-hosted execution](docs/getting-started/self-hosted.md) |
-| Installer lifecycle, locking, generated state, managed HTTPS and downloads | [Installer design rules](deploy/install/README.md) |
+| Installer lifecycle, locking, generated state, managed HTTPS and downloads | [Deployment](deploy/README.md) and [Node installer](deploy/node/README.md) |
 | Operator installation and alternatives | [Installation](docs/getting-started/install.md), [installation options](docs/getting-started/install-options.md) |
 | Settings, defaults, files and installation layout | [Configuration](docs/configuration.md) |
 | Operator commands, keys, backup and version policy | [Operations](docs/getting-started/operations.md) |
diff --git a/Makefile b/Makefile
index 1c2e0b5ab..c5c4f5907 100644
--- a/Makefile
+++ b/Makefile
@@ -178,12 +178,13 @@ check-microsandbox-provider:
 check-distribution:
 	node --test scripts/build-native-catalog.test.mjs
 	go test ./services/web -count=1
-	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s deploy/install -p 'test_*.py'
+	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s deploy/node -p 'test_*.py'
+	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s deploy/compose -p 'test_*.py'
+	PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s scripts/acceptance -p 'test_*.py'
+	PYTHONDONTWRITEBYTECODE=1 python3 deploy/test_install.py
 	PYTHONDONTWRITEBYTECODE=1 python3 scripts/core-distribution-manifest.test.py
 	PYTHONDONTWRITEBYTECODE=1 python3 scripts/publish-core-release.test.py
-	PYTHONDONTWRITEBYTECODE=1 python3 scripts/install-release.test.py
-	PYTHONDONTWRITEBYTECODE=1 python3 scripts/config-reference.py --check
-	bash -n deploy/install/install.sh deploy/install-release.sh scripts/build-web.sh scripts/build-core-distribution.sh scripts/build-core-image-context.sh scripts/prepare-release-runtimes.sh
+	bash -n deploy/install.sh scripts/build-web.sh scripts/build-core-distribution.sh scripts/build-core-image-context.sh scripts/prepare-release-runtimes.sh
 	./scripts/build-web.sh
 
 build-core-distribution:
diff --git a/apps/web/README.md b/apps/web/README.md
index 6283a645c..d81b9c0ac 100644
--- a/apps/web/README.md
+++ b/apps/web/README.md
@@ -36,7 +36,7 @@ pnpm --filter @oac/web build
 pnpm test:web:acceptance
 ```
 
-`pnpm test:web:acceptance` runs the Playwright tests in `apps/web/e2e` in Chrome against the fixture console. After each test, every spec except `domain.spec.ts` checks that the browser sent nothing to `/v1` and no `Authorization` header. The tests do not exercise `services/web` or a real Core; the console server has its own Go tests. `make check-web` runs all of these; [CONTRIBUTING.md](../../CONTRIBUTING.md) lists the repository's required checks.
+`pnpm test:web:acceptance` runs the Playwright tests in `apps/web/e2e` in Chrome against the fixture console. After each test, every spec checks that the browser sent nothing to `/v1` and no `Authorization` header. The tests do not exercise `services/web` or a real Core; the console server has its own Go tests. `make check-web` runs all of these; [CONTRIBUTING.md](../../CONTRIBUTING.md) lists the repository's required checks.
 
 ## README screenshots
 
diff --git a/apps/web/e2e/domain.spec.ts b/apps/web/e2e/domain.spec.ts
deleted file mode 100644
index db1561076..000000000
--- a/apps/web/e2e/domain.spec.ts
+++ /dev/null
@@ -1,95 +0,0 @@
-import { expect, test, type APIRequestContext } from "@playwright/test";
-import { openConsole } from "./console";
-
-const fixture = `http://127.0.0.1:${process.env.AGENTS_FIXTURE_PORT ?? 18092}`;
-const endpoint = "**/console/installation/domain";
-const setDomain = (request: APIRequestContext, data: Record<string, unknown>) => request.post(`${fixture}/__fixture/domain`, { data });
-
-test("System opens domain setup; an apply polls verified readiness", async ({ page, request }, info) => {
-  await openConsole(page, request, "system", { installation: "local" });
-  await page.getByRole("button", { name: "Configure domain and HTTPS", exact: true }).click();
-  await expect(page.getByRole("heading", { name: "Domain and HTTPS", exact: true })).toBeVisible();
-  await page.getByLabel("Domain", { exact: true }).fill("https://core.example.com");
-  await expect(page.getByRole("button", { name: "Apply", exact: true })).toBeDisabled();
-  await page.getByLabel("Domain", { exact: true }).fill("core.example.com");
-  await page.screenshot({ path: info.outputPath("domain-before-apply.png"), fullPage: true });
-  await page.getByRole("button", { name: "Apply", exact: true }).click();
-  await expect(page.getByText("Checking the domain…", { exact: true })).toBeVisible();
-  await expect(page.getByText("HTTPS is ready.", { exact: true })).toHaveCount(0);
-  await setDomain(request, { state: "ready", public_url: "https://core.example.com" });
-  await expect(page.getByText("HTTPS is ready.", { exact: true })).toBeVisible();
-  await expect(page.getByRole("link", { name: "Open https://core.example.com" })).toHaveAttribute("href", "https://core.example.com");
-});
-
-test("an existing address requires an explicit confirmed write", async ({ page, request }) => {
-  await openConsole(page, request, "system");
-  await setDomain(request, { state: "ready", public_url: "https://old.example.com", target_url: "https://old.example.com" });
-  await page.getByRole("button", { name: "Configure domain and HTTPS", exact: true }).click();
-  await page.getByLabel("Domain", { exact: true }).fill("new.example.com");
-  const writes: unknown[] = [];
-  page.on("request", (req) => { if (req.method() === "POST" && req.url().endsWith("/console/installation/domain")) writes.push(req.postDataJSON()); });
-  await page.getByRole("button", { name: "Apply", exact: true }).click();
-  const dialog = page.getByRole("dialog");
-  await expect(dialog).toContainText("https://new.example.com");
-  expect(writes).toEqual([{ hostname: "new.example.com" }]);
-  await dialog.getByRole("button", { name: "Change address", exact: true }).click();
-  await expect(dialog).toHaveCount(0);
-  expect(writes).toEqual([{ hostname: "new.example.com" }, { hostname: "new.example.com", confirm_public_url_change: "https://new.example.com" }]);
-});
-
-test("an unconfirmed write stops retries until status is read again", async ({ page, request }) => {
-  await openConsole(page, request, "system");
-  await setDomain(request, { state: "ready", public_url: "https://old.example.com", target_url: "https://old.example.com" });
-  await page.getByRole("button", { name: "Configure domain and HTTPS", exact: true }).click();
-  let count = 0;
-  await page.route(endpoint, (route) => { if (route.request().method() === "POST") { count++; return route.abort(); } return route.continue(); });
-  await page.getByLabel("Domain", { exact: true }).fill("core.example.com");
-  await page.getByRole("button", { name: "Apply", exact: true }).click();
-  await expect(page.getByText("The request was not confirmed. Refresh the status before trying again.")).toBeVisible();
-  await expect(page.getByRole("button", { name: "Apply", exact: true })).toBeDisabled();
-  expect(count).toBe(1);
-  await expect(page.getByText("HTTPS is ready.", { exact: true })).toHaveCount(0);
-  await expect(page.getByRole("link", { name: "Open https://core.example.com" })).toBeVisible();
-  await page.getByRole("button", { name: "Refresh domain status", exact: true }).click();
-  await expect(page.getByRole("button", { name: "Apply", exact: true })).toBeEnabled();
-});
-
-test("a console restart preserves the new-address link on the login screen", async ({ page, request }) => {
-  await openConsole(page, request, "system?id=domain");
-  await page.getByLabel("Domain", { exact: true }).fill("core.example.com");
-  await page.getByRole("button", { name: "Apply", exact: true }).click();
-  await expect(page.getByText("Checking the domain…", { exact: true })).toBeVisible();
-  await page.route("**/console/auth", (route) => route.fulfill({ json: { mode: "login" } }));
-  await page.evaluate(() => window.dispatchEvent(new Event("focus")));
-  await expect(page.getByRole("heading", { name: "Sign in to OpenAgentCore" })).toBeVisible();
-  await expect(page.getByRole("link", { name: "Open https://core.example.com" })).toBeVisible();
-});
-
-test("unsupported and failed states preserve actionable facts", async ({ page, request }) => {
-  await openConsole(page, request, "system");
-  await setDomain(request, { supported: false, message: "This installation is managed externally." });
-  await page.getByRole("button", { name: "Configure domain and HTTPS", exact: true }).click();
-  await expect(page.getByText("Domain setup is not available for this installation.", { exact: false })).toBeVisible();
-  await page.getByRole("button", { name: "Show details" }).click();
-  await expect(page.locator("[role=tooltip]")).toHaveText("This installation is managed externally.");
-  await expect(page.getByLabel("Domain", { exact: true })).toHaveCount(0);
-  await setDomain(request, { supported: true, state: "failed", target_url: "https://core.example.com", message: "DNS does not point to this server." });
-  await page.reload();
-  await expect(page.getByRole("alert")).toContainText("Domain setup failed.");
-  await page.getByRole("button", { name: "Show details" }).click();
-  await expect(page.locator("[role=tooltip]")).toHaveText("DNS does not point to this server.");
-  await expect(page.getByRole("button", { name: "Retry setup" })).toBeEnabled();
-});
-
-test("a confirmed failed setup clears the login handoff", async ({ page, request }) => {
-  await openConsole(page, request, "system?id=domain");
-  await page.getByLabel("Domain", { exact: true }).fill("core.example.com");
-  await page.getByRole("button", { name: "Apply", exact: true }).click();
-  await expect(page.getByRole("link", { name: "Open https://core.example.com" })).toBeVisible();
-  await setDomain(request, { state: "failed", message: "DNS validation failed." });
-  await expect(page.getByRole("alert")).toContainText("Domain setup failed.");
-  await page.route("**/console/auth", (route) => route.fulfill({ json: { mode: "login" } }));
-  await page.evaluate(() => window.dispatchEvent(new Event("focus")));
-  await expect(page.getByRole("heading", { name: "Sign in to OpenAgentCore" })).toBeVisible();
-  await expect(page.getByRole("link", { name: "Open https://core.example.com" })).toHaveCount(0);
-});
diff --git a/apps/web/e2e/nodes.spec.ts b/apps/web/e2e/nodes.spec.ts
index e89b35994..bc5ea4364 100644
--- a/apps/web/e2e/nodes.spec.ts
+++ b/apps/web/e2e/nodes.spec.ts
@@ -125,7 +125,7 @@ test("issues no command before the installation is read, for a loopback public U
   await page.unroute("**/core/v1/installation");
   await add.getByRole("button", { name: "Try again" }).click();
   // Nodes on other machines can't reach a loopback public_url.
-  await expect(add.getByRole("status")).toHaveText("Configure a domain and HTTPS in System before adding nodes.");
+  await expect(add.getByRole("status")).toHaveText("Set a public HTTPS address before adding nodes.");
   await expect(add.getByRole("button", { name: "Generate command" })).toHaveCount(0);
   await add.getByRole("button", { name: "Close dialog" }).click();
   await expect(page.getByRole("button", { name: "Add node", exact: true })).toBeDisabled();
diff --git a/apps/web/e2e/overview-readiness.spec.ts b/apps/web/e2e/overview-readiness.spec.ts
index 6e66bf91a..55d426b23 100644
--- a/apps/web/e2e/overview-readiness.spec.ts
+++ b/apps/web/e2e/overview-readiness.spec.ts
@@ -77,10 +77,10 @@ test("successful empty reads preserve true zero counts and empty states", async
   await expect(failed(page)).toHaveCount(0);
 });
 
-test("local-only address has a domain setup link on all three pages and blocks Add node", async ({ page, request }) => {
+test("local-only address links to System on other pages and blocks Add node", async ({ page, request }) => {
   await openConsole(page, request, "overview", { installation: "local" });
   const notice = page.getByRole("status", { name: "Public address needs attention" });
-  await expect(notice.getByRole("button", { name: "Configure domain and HTTPS" })).toBeVisible();
+  await expect(notice.getByRole("button", { name: "Review the public address" })).toBeVisible();
   await expect(page.locator(".getting-started-step").first()).toContainText("To do");
   await expect(page.locator(".getting-started-step").first()).toContainText("Configure HTTPS");
   await page.getByRole("button", { name: "Nodes", exact: true }).click();
@@ -89,7 +89,7 @@ test("local-only address has a domain setup link on all three pages and blocks A
   await expect(page.getByText("Add node is unavailable while the public address is local only.")).toBeVisible();
   await page.getByRole("button", { name: "System", exact: true }).click();
   await expect(notice).toBeVisible();
-  await expect(page.getByRole("button", { name: "Configure domain and HTTPS" })).toHaveCount(1);
+  await expect(notice.getByRole("button", { name: "Review the public address" })).toHaveCount(0);
   expect(await writes(request)).toEqual([]);
 });
 
@@ -102,7 +102,7 @@ for (const language of ["en", "zh-CN"] as const) {
       await page.getByRole("menuitemradio", { name: "简体中文" }).click();
     }
     await expect(page.locator(".overview-activity .error-state")).toContainText(language === "en" ? "Could not read the data" : "无法读取数据");
-    await expect(page.locator(".installation-notice")).toContainText(language === "en" ? "Configure HTTPS before connecting" : "连接外部应用和节点前");
+    await expect(page.locator(".installation-notice")).toContainText(language === "en" ? "Set a public HTTPS address before connecting" : "连接外部应用和节点前");
     if (language === "zh-CN") await expect(page.locator("body")).not.toContainText("Core request failed");
     await expect(page.getByRole("article").first()).toContainText(language === "en" ? "Down" : "不可用");
     for (const width of [1280, 1440]) {
diff --git a/apps/web/src/ConsoleApp.tsx b/apps/web/src/ConsoleApp.tsx
index 352d8c1ca..debc7e9f8 100644
--- a/apps/web/src/ConsoleApp.tsx
+++ b/apps/web/src/ConsoleApp.tsx
@@ -17,7 +17,6 @@ import { SandboxManagerView } from "./features/sandbox/SandboxManagerView";
 import { SessionLogPage } from "./features/sessions/SessionLogPage";
 import { SessionPage } from "./features/sessions/SessionPage";
 import { SkillsPage } from "./features/skills/SkillsPage";
-import { DomainPage } from "./features/system/DomainPage";
 import { SystemPage } from "./features/system/SystemPage";
 import { VaultsPage } from "./features/vaults/VaultsPage";
 import { consoleDepth, ConsoleNavigationContext, useConsoleNavigation, hashWithParams, routeParamsFromHash, type ConsoleIntent, type RouteParams } from "./lib/console-navigation";
@@ -57,7 +56,7 @@ function ConsolePage({ view }: { view: ConsoleView }) {
     case "vaults": return <VaultsPage />;
     case "projects": return <ProjectsPage />;
     case "nodes": return <SandboxManagerView />;
-    case "system": return params.id === "sandbox" ? <SandboxDeploymentPage /> : params.id === "domain" ? <DomainPage /> : <SystemPage />;
+    case "system": return params.id === "sandbox" ? <SandboxDeploymentPage /> : <SystemPage />;
   }
 }
 
diff --git a/apps/web/src/components/InstallationNotice.test.tsx b/apps/web/src/components/InstallationNotice.test.tsx
index 1f90001d7..84339b853 100644
--- a/apps/web/src/components/InstallationNotice.test.tsx
+++ b/apps/web/src/components/InstallationNotice.test.tsx
@@ -10,10 +10,10 @@ const installation: CoreInstallation = {
 };
 
 describe("local-only installation notice", () => {
-  it("links to domain setup without exposing installer commands", () => {
+  it("links to the public address without exposing installer commands", () => {
     const html = renderToStaticMarkup(<InstallationNotice installation={installation} />);
-    expect(html).toContain("Configure domain and HTTPS");
-    expect(html).toContain("Configure HTTPS before connecting applications and nodes");
+    expect(html).toContain("Review the public address");
+    expect(html).toContain("Set a public HTTPS address before connecting applications and nodes");
     expect(html).not.toContain("config.json");
     expect(html).not.toContain("oac apply");
   });
diff --git a/apps/web/src/components/InstallationNotice.tsx b/apps/web/src/components/InstallationNotice.tsx
index 25342fe20..9000908de 100644
--- a/apps/web/src/components/InstallationNotice.tsx
+++ b/apps/web/src/components/InstallationNotice.tsx
@@ -10,6 +10,6 @@ export function InstallationNotice({ installation }: { installation: CoreInstall
   if (!installation?.local_only) return null;
   return <aside className="installation-notice" role="status" aria-label={t("installationNotice.title")}>
     <p>{t("installationNotice.body")}</p>
-    {view !== "system" || params.id ? <button className="text-action" onClick={() => navigate("system", { id: "domain" })}>{t("installationNotice.configure")}</button> : null}
+    {view !== "system" || params.id ? <button className="text-action" onClick={() => navigate("system")}>{t("installationNotice.configure")}</button> : null}
   </aside>;
 }
diff --git a/apps/web/src/features/first-run/ConsoleAccess.tsx b/apps/web/src/features/first-run/ConsoleAccess.tsx
index c8432e57c..d9ef1f408 100644
--- a/apps/web/src/features/first-run/ConsoleAccess.tsx
+++ b/apps/web/src/features/first-run/ConsoleAccess.tsx
@@ -7,7 +7,6 @@ import { ThemeMenu } from "../../components/ThemeMenu";
 import { useToast } from "../../components/Toast";
 import { setLanguage } from "../../i18n";
 import { queryClient } from "../../lib/queries";
-import { DomainHandoff } from "../system/DomainHandoff";
 import { OnboardingLayout } from "../onboarding/OnboardingLayout";
 import { withTransition } from "../onboarding/view-transition";
 import { changeConsoleAuth, ConsoleAuthError, readConsoleAuth, type ConsoleAuth } from "./auth";
@@ -20,7 +19,7 @@ import "./console-access.css";
  */
 const CORE_KEY_LOCATION = { file: "secrets/core.key", defaultPath: "~/.oac/core/secrets/core.key" } as const;
 
-const ConsoleAccountContext = createContext<{ logout: () => Promise<void>; setDomainHandoff: (url: string | null) => void } | null>(null);
+const ConsoleAccountContext = createContext<{ logout: () => Promise<void> } | null>(null);
 export const useConsoleAccount = () => useContext(ConsoleAccountContext);
 
 export function ConsoleLanguage() {
@@ -48,7 +47,6 @@ export function ConsoleAccountMenu() {
 export function ConsoleAccess({ children }: { children: ReactNode }) {
   const { t } = useTranslation("firstRun");
   const [status, setStatus] = useState<ConsoleAuth | null>(null);
-  const [domainHandoff, setDomainHandoff] = useState<string | null>(null);
   const [failed, setFailed] = useState(false);
   const [revision, setRevision] = useState(0);
   const generation = useRef(0);
@@ -77,18 +75,15 @@ export function ConsoleAccess({ children }: { children: ReactNode }) {
     window.addEventListener("focus", check);
     return () => { window.clearInterval(timer); window.removeEventListener("focus", check); };
   }, [status?.mode, refresh]);
-  if (status?.mode === "authenticated") return <ConsoleAccountContext.Provider value={{ setDomainHandoff, logout: async () => {
+  if (status?.mode === "authenticated") return <ConsoleAccountContext.Provider value={{ logout: async () => {
     const next = await changeConsoleAuth({ action: "logout" });
     generation.current++;
-    setDomainHandoff(null);
     acceptStatus(next, true);
   } }}>{children}</ConsoleAccountContext.Provider>;
 
   return <OnboardingLayout scene={status ? "login" : null} controls={<><ThemeMenu /><ConsoleLanguage /></>}>
-    <DomainHandoff url={domainHandoff} />
     {status && !failed ? <CoreKeyForm key={revision} onAuthenticated={(next, from) => {
       queryClient.clear();
-      setDomainHandoff(null);
       // The console opens on the Overview, revealed from the pressed button.
       withTransition("enter", () => {
         generation.current++;
diff --git a/apps/web/src/features/overview/GettingStarted.tsx b/apps/web/src/features/overview/GettingStarted.tsx
index 0b8b9a53d..6589102b3 100644
--- a/apps/web/src/features/overview/GettingStarted.tsx
+++ b/apps/web/src/features/overview/GettingStarted.tsx
@@ -119,7 +119,7 @@ export function GettingStarted({ fleet, sessions, localOnly, sandboxReset, onRet
     : localOnly === "failed"
     ? { label: t("actions.retry", { ns: "common" }), run: onRetryInstallation }
     : localOnly === true
-    ? { label: t("installationNotice.configure", { ns: "common" }), run: () => navigate("system", { id: "domain" }) }
+    ? { label: t("installationNotice.configure", { ns: "common" }), run: () => navigate("system") }
     : sandbox.action === "setup"
     ? { label: t("gettingStarted.sandboxes.setup"), run: () => navigate("system", { id: "sandbox" }) }
     : sandbox.action === "add-node"
diff --git a/apps/web/src/features/sandbox/NodeCleanupDialog.tsx b/apps/web/src/features/sandbox/NodeCleanupDialog.tsx
index e9d44ee0f..9f4815a3c 100644
--- a/apps/web/src/features/sandbox/NodeCleanupDialog.tsx
+++ b/apps/web/src/features/sandbox/NodeCleanupDialog.tsx
@@ -19,7 +19,7 @@ export interface NodeCleanup {
 
 /**
  * After Remove: the command that removes the node's service and files from its
- * host (deploy/install/node_install.py `uninstall_system`).
+ * host (deploy/node/node_install.py `uninstall_system`).
  * The installer first confirms with Core, at the node's own address, that the
  * node is removed, which holds from the removal on. The command uses sudo unless the shell is already root. A node enrolled with an earlier address may find it gone; then
  * `--force` skips only that confirmation. Nothing deletes sandboxes, volumes or
diff --git a/apps/web/src/features/sandbox/NodeEnrollment.tsx b/apps/web/src/features/sandbox/NodeEnrollment.tsx
index af0a07e1a..3148bc2e8 100644
--- a/apps/web/src/features/sandbox/NodeEnrollment.tsx
+++ b/apps/web/src/features/sandbox/NodeEnrollment.tsx
@@ -103,7 +103,7 @@ export function NodeEnrollment({ client, consoleConfig, deployment, nodes, open,
     : installation.data === undefined
     ? installation.isError ? { text: t("The installation couldn't be read, so no command can be issued."), failed: true } : { text: t("Checking this installation's public URL…") }
     : !publicUrl
-      ? { text: t("Configure a domain and HTTPS in System before adding nodes.") }
+      ? { text: t("Set a public HTTPS address before adding nodes.") }
       : !nodeFilesAvailable(consoleConfig, deployment.provider)
         ? { text: t("This console has no node files for {{provider}}. Install Core from the offline bundle, or add the release artifacts and rerun ./install.sh.", { provider: backend }) }
         : null;
diff --git a/apps/web/src/features/sandbox/SandboxSetupWizard.tsx b/apps/web/src/features/sandbox/SandboxSetupWizard.tsx
index 63fb3316a..70619c608 100644
--- a/apps/web/src/features/sandbox/SandboxSetupWizard.tsx
+++ b/apps/web/src/features/sandbox/SandboxSetupWizard.tsx
@@ -386,7 +386,7 @@ export function SandboxSetupWizard({ coreUrl, expectedGeneration, current, disab
           <div className="wizard-rejection" role="alert">
             <p>{rejection}</p>
             {resetRequired ? <p>{t("Cancel editing to use Reset deployment. This change requires an explicit reset; the saved configuration is unchanged.")}</p> : null}
-            {addressRejected ? <button className="text-action" type="button" onClick={() => navigate("system", { id: "domain" })}>{t("Managed in System")}</button> : null}
+            {addressRejected ? <button className="text-action" type="button" onClick={() => navigate("system")}>{t("Managed in System")}</button> : null}
           </div>
         ) : null}
         {/* Initial setup needs the cleared key re-entered; updates may keep the saved key. */}
diff --git a/apps/web/src/features/sandbox/deployment-specification.ts b/apps/web/src/features/sandbox/deployment-specification.ts
index d7ac12f5c..5fb2bc773 100644
--- a/apps/web/src/features/sandbox/deployment-specification.ts
+++ b/apps/web/src/features/sandbox/deployment-specification.ts
@@ -11,7 +11,6 @@ interface Manifest {
   microsandbox?: { runtime_sha256?: string; firmware_sha256?: string };
 }
 
-// The Standard sizes are a contract with the Core installer (install.sh); see standard-sizes.md before changing their structure.
 export function defaultSandboxResources(provider: SandboxProvider): SandboxResources {
   return { ...(provider === "microsandbox" ? standardSizes.microsandbox : standardSizes.docker) };
 }
diff --git a/apps/web/src/features/sandbox/node-enrollment.ts b/apps/web/src/features/sandbox/node-enrollment.ts
index 48b9bf736..49f7666e4 100644
--- a/apps/web/src/features/sandbox/node-enrollment.ts
+++ b/apps/web/src/features/sandbox/node-enrollment.ts
@@ -6,7 +6,7 @@ import { nodeProviderDiagnostic } from "../../lib/sandbox-diagnostic";
 /**
  * How long the installer waits, after starting the node service, for Core to
  * report the node connected and its provider ready
- * (deploy/install/node_install.py `wait_ready`, timeout=60).
+ * (deploy/node/node_install.py `wait_ready`, timeout=60).
  */
 export const NODE_READY_WAIT_MS = 60_000;
 
@@ -17,7 +17,7 @@ export interface HostPrerequisite {
 /**
  * What a host needs for the default command, which runs the installer as root
  * and the node as the `oac-node` system service (sudo mode), as the command
- * and deploy/install/node_install.py check it:
+ * and deploy/node/node_install.py check it:
  * - the command runs curl, sha256sum and python3 (enrollment-command.ts), and
  *   `sudo` unless the shell is root; `host_checks` needs Python 3.9+, Linux amd64,
  *   systemd as the init system, and SELinux not enforcing; `other_node` refuses a
diff --git a/apps/web/src/features/sandbox/standard-sizes.md b/apps/web/src/features/sandbox/standard-sizes.md
index 04328c5e3..8c39ef49b 100644
--- a/apps/web/src/features/sandbox/standard-sizes.md
+++ b/apps/web/src/features/sandbox/standard-sizes.md
@@ -20,10 +20,4 @@ The values must stay within the bounds that Core and `validSandboxResources` acc
 
 ## Readers
 
-- The Web setup wizard, through `defaultSandboxResources` in `deployment-specification.ts`.
-- The release bundle: `scripts/build-core-distribution.sh` copies this file to `<bundle>/standard-sizes.json`.
-- The Core installer: `deploy/install/sandbox_setup.py` reads the bundled copy when `install.sh` saves the initial microsandbox deployment at the Standard size.
-
-## Contract
-
-The keys and structure are a contract with the Core installer. Changing a value is fine. Renaming, removing or adding keys, or restructuring the file, needs a matching change to `deploy/install/sandbox_setup.py`, which rejects a bundled copy whose fields differ. `deployment-specification.test.ts` pins the structure so that an accidental change fails.
+The Web setup wizard is the only reader, through `defaultSandboxResources` in `deployment-specification.ts`. `deployment-specification.test.ts` pins the structure so that an accidental change fails.
diff --git a/apps/web/src/features/system/DomainHandoff.tsx b/apps/web/src/features/system/DomainHandoff.tsx
deleted file mode 100644
index c078c4cb0..000000000
--- a/apps/web/src/features/system/DomainHandoff.tsx
+++ /dev/null
@@ -1,13 +0,0 @@
-import { useTranslation } from "react-i18next";
-import { domainTarget } from "./domain-api";
-
-/** A navigation invitation, never a browser-side claim that HTTPS is reachable. */
-export function DomainHandoff({ url }: { url: string | null }) {
-  const { t } = useTranslation("system");
-  const target = domainTarget(url);
-  if (!target) return null;
-  return <aside className="form-stack" role="status">
-    <p>{t("domain.reconnect")}</p>
-    <a className="button outline" href={target} rel="noreferrer">{t("domain.open", { url: target })}</a>
-  </aside>;
-}
diff --git a/apps/web/src/features/system/DomainPage.tsx b/apps/web/src/features/system/DomainPage.tsx
deleted file mode 100644
index 18f70b345..000000000
--- a/apps/web/src/features/system/DomainPage.tsx
+++ /dev/null
@@ -1,143 +0,0 @@
-import { useQuery, useQueryClient } from "@tanstack/react-query";
-import { ArrowLeft, ShieldCheck } from "lucide-react";
-import { useEffect, useRef, useState, type FormEvent } from "react";
-import { useTranslation } from "react-i18next";
-import { ConfirmDialog } from "../../components/ConfirmDialog";
-import { HelpTip, PageBody, RefreshButton } from "../../components/console-ui";
-import { ErrorState } from "../../components/ErrorState";
-import { TableSkeleton } from "../../components/Skeleton";
-import { useConsoleNavigation } from "../../lib/console-navigation";
-import { useConsoleAccount } from "../first-run/ConsoleAccess";
-import { applyDomain, domainHostname, domainInProgress, domainQuery, domainReconnecting, DomainRequestError, type DomainStatus } from "./domain-api";
-import { DomainHandoff } from "./DomainHandoff";
-import "./domain.css";
-
-export function DomainPage() {
-  const { t } = useTranslation("system");
-  const { navigate } = useConsoleNavigation();
-  const query = useQuery(domainQuery);
-  return <section className="page-section console-page" aria-labelledby="domain-heading">
-    <header className="page-header">
-      <div className="console-page-heading">
-        <button className="icon-button ghost back-button" aria-label={t("domain.back")} onClick={() => navigate("system")}><ArrowLeft size={16} aria-hidden="true" /></button>
-        <h1 id="domain-heading">{t("domain.title")}</h1><HelpTip>{t("domain.help")}</HelpTip>
-      </div>
-    </header>
-    <PageBody>
-      {query.data ? <DomainForm initial={query.data} /> : query.isError
-        ? <ErrorState title={t("domain.loadFailed")} onRetry={() => void query.refetch()} />
-        : <TableSkeleton rows={3} columns={2} />}
-    </PageBody>
-  </section>;
-}
-
-function initialHost(snapshot: DomainStatus): string {
-  try { return domainHostname(new URL(snapshot.target_url ?? snapshot.public_url ?? "").hostname) ?? ""; }
-  catch { return ""; }
-}
-
-function DomainForm({ initial }: { initial: DomainStatus }) {
-  const { t } = useTranslation("system");
-  const account = useConsoleAccount();
-  const setDomainHandoff = account?.setDomainHandoff;
-  const queryClient = useQueryClient();
-  const query = useQuery(domainQuery);
-  const snapshot = query.data ?? initial;
-  const [hostname, setHostname] = useState(() => initialHost(initial));
-  const [busy, setBusy] = useState(false);
-  const [uncertain, setUncertain] = useState(false);
-  const [attemptedUrl, setAttemptedUrl] = useState<string | null>(null);
-  const [error, setError] = useState<{ text: string; detail?: string } | null>(null);
-  const [confirmation, setConfirmation] = useState<string | null>(null);
-  const pending = useRef(false);
-  const lifetime = useRef<AbortController | null>(null);
-  useEffect(() => {
-    const controller = new AbortController(); lifetime.current = controller;
-    return () => controller.abort();
-  }, []);
-
-  const host = domainHostname(hostname);
-  const active = domainInProgress(snapshot);
-  const blocked = busy || active || uncertain || query.isError || query.isFetching || !snapshot.supported;
-  const failed = query.isError && !domainReconnecting(query);
-  const reconnect = uncertain || busy ? attemptedUrl : snapshot.state === "ready" ? snapshot.target_url ?? snapshot.public_url : (active || query.isError) ? snapshot.target_url : null;
-  useEffect(() => {
-    if (reconnect) setDomainHandoff?.(reconnect);
-    else if (snapshot.state === "failed" || snapshot.state === "unconfigured") setDomainHandoff?.(null);
-  }, [reconnect, snapshot.state, setDomainHandoff]);
-
-  async function refresh() {
-    const current = lifetime.current;
-    const result = await query.refetch();
-    if (current?.signal.aborted || result.isError) return;
-    setUncertain(false); setError(null); setAttemptedUrl(null);
-    if (result.data?.state === "failed" || result.data?.state === "unconfigured") account?.setDomainHandoff(null);
-  }
-
-  async function save(name: string, confirmed = false) {
-    const current = lifetime.current;
-    if (!current || current.signal.aborted || pending.current || blocked) return;
-    pending.current = true; setBusy(true); setError(null);
-    const target = `https://${name}`;
-    setAttemptedUrl(target);
-    try {
-      await queryClient.cancelQueries({ queryKey: domainQuery.queryKey });
-      if (current.signal.aborted) return;
-      account?.setDomainHandoff(target);
-      const next = await applyDomain(name, confirmed, AbortSignal.any([current.signal, AbortSignal.timeout(30_000)]));
-      if (current.signal.aborted) return;
-      queryClient.setQueryData(domainQuery.queryKey, next);
-      setConfirmation(null);
-      account?.setDomainHandoff(next.target_url);
-    } catch (cause) {
-      if (current.signal.aborted) return;
-      if (cause instanceof DomainRequestError && cause.status === 409 && cause.code === "public_url_confirmation_required") {
-        account?.setDomainHandoff(null);
-        setConfirmation(name);
-      } else if (cause instanceof DomainRequestError && cause.status >= 400 && cause.status < 500 && cause.status !== 408) {
-        account?.setDomainHandoff(null);
-        setError({ text: t("domain.rejected"), detail: cause.message });
-      } else {
-        setConfirmation(null); setUncertain(true); setError({ text: t("domain.uncertain") });
-        account?.setDomainHandoff(target);
-      }
-    } finally {
-      pending.current = false;
-      if (!current.signal.aborted) setBusy(false);
-    }
-  }
-
-  function submit(event: FormEvent) { event.preventDefault(); if (host && !confirmation) void save(host); }
-
-  return <div className="domain-settings">
-    {!snapshot.supported ? <p role="status">{t("domain.unsupported")} {snapshot.message ? <HelpTip label={t("domain.details")}>{snapshot.message}</HelpTip> : null}</p> : <>
-      <form className="domain-form" onSubmit={submit}>
-        <div className="field">
-          <span className="field-label-row"><label htmlFor="domain-hostname">{t("domain.hostname")}</label><HelpTip>{t("domain.hostnameHelp")}</HelpTip></span>
-          <input id="domain-hostname" autoComplete="off" autoCapitalize="none" spellCheck={false} placeholder="core.example.com" value={hostname}
-            disabled={blocked || confirmation !== null} aria-invalid={hostname.trim() !== "" && !host || undefined}
-            aria-describedby={hostname.trim() !== "" && !host ? "domain-invalid" : undefined} onChange={(event) => { setHostname(event.target.value); setError(null); }} />
-          {hostname.trim() && !host ? <p className="field-error" id="domain-invalid">{t("domain.invalidHostname")}</p> : null}
-        </div>
-        <div className="domain-security"><ShieldCheck size={18} aria-hidden="true" /><span>{t("domain.automatic")}</span><HelpTip>{t("domain.dnsHelp")}</HelpTip></div>
-        <p className="domain-prerequisites">{t("domain.prerequisites")}</p>
-        <div className="domain-actions">
-          <button type="submit" className="button primary" disabled={blocked || !host || confirmation !== null || (snapshot.state === "ready" && `https://${host}` === snapshot.public_url)}>
-            {busy ? t("domain.submitting") : t(snapshot.state === "failed" ? "domain.retry" : "domain.apply")}
-          </button>
-          <RefreshButton label={t("domain.refresh")} refreshing={query.isFetching} disabled={busy} onClick={() => void refresh()} />
-        </div>
-      </form>
-      {(active || snapshot.state === "ready") && !failed && !busy && !uncertain ? <p className="domain-state" role="status">{t(`domain.states.${snapshot.state}`)}</p> : null}
-      {snapshot.state === "failed" ? <p className="domain-error" role="alert">{t("domain.failed")} {snapshot.message ? <HelpTip label={t("domain.details")}>{snapshot.message}</HelpTip> : null}</p> : null}
-      {failed ? <p className="domain-error" role="alert">{t(active ? "domain.disconnected" : "domain.loadFailed")}</p> : null}
-      {error && !confirmation ? <p className="domain-error" role="alert">{error.text} {error.detail ? <HelpTip label={t("domain.details")}>{error.detail}</HelpTip> : null}</p> : null}
-      <DomainHandoff url={reconnect} />
-    </>}
-    <ConfirmDialog open={confirmation !== null} title={t("domain.confirmTitle")} confirmLabel={t("domain.confirm")} busyLabel={t("domain.submitting")} busy={busy}
-      error={error?.text} onClose={() => { setConfirmation(null); setError(null); }} onConfirm={() => { if (confirmation) void save(confirmation, true); }}>
-      <p>{t("domain.confirmBody", { url: confirmation ? `https://${confirmation}` : "" })}</p>
-      {error?.detail ? <HelpTip label={t("domain.details")}>{error.detail}</HelpTip> : null}
-    </ConfirmDialog>
-  </div>;
-}
diff --git a/apps/web/src/features/system/StartupSettings.tsx b/apps/web/src/features/system/StartupSettings.tsx
index edcec53e2..9d999e2f5 100644
--- a/apps/web/src/features/system/StartupSettings.tsx
+++ b/apps/web/src/features/system/StartupSettings.tsx
@@ -28,7 +28,7 @@ export function StartupSettings({ configuration }: { configuration: CoreInstalla
     <Section headingId="system-startup-heading" title={t("startup.title")} help={t("startup.help")}>
       {configuration === null ? <p className="system-note">{t("startup.none")}</p> : <>
         <p className="system-where">
-          <span>
+          {configuration.path ? <span>
             <Trans
               t={t}
               i18nKey="startup.where"
@@ -37,7 +37,7 @@ export function StartupSettings({ configuration }: { configuration: CoreInstalla
                 command: <CopyableId id={configuration.apply_command} label={t("startup.copyCommand")} />,
               }}
             />
-          </span>
+          </span> : <span>{t("startup.effective")}</span>}
           {configuration.applied_at ? <span className="system-applied">{t("startup.appliedAt", { time: formatDateTime(Date.parse(configuration.applied_at) / 1000, locale) })}</span> : null}
         </p>
         <div className="table-frame">
diff --git a/apps/web/src/features/system/SystemPage.tsx b/apps/web/src/features/system/SystemPage.tsx
index a9ac25207..0fc42d3cd 100644
--- a/apps/web/src/features/system/SystemPage.tsx
+++ b/apps/web/src/features/system/SystemPage.tsx
@@ -40,7 +40,7 @@ export function SystemPage() {
 
   const about = installation.data;
   const facts = about ? (
-    <Section headingId="system-installation-heading" title={t("installation.title")} actions={<button className="button outline" onClick={() => navigate("system", { id: "domain" })}>{t("domain.configure")}</button>}>
+    <Section headingId="system-installation-heading" title={t("installation.title")}>
       <dl className="system-facts">
         <Fact label={t("installation.publicUrl")} help={t("installation.publicUrlHelp")}>{about.public_url ? <code className="system-code">{about.public_url}</code> : <span className="system-muted">{t("installation.notSet")}</span>}</Fact>
         <Fact label={t("installation.apiBaseUrl")} help={t("installation.apiBaseUrlHelp")}>
diff --git a/apps/web/src/features/system/domain-api.test.ts b/apps/web/src/features/system/domain-api.test.ts
deleted file mode 100644
index d4bee11f6..000000000
--- a/apps/web/src/features/system/domain-api.test.ts
+++ /dev/null
@@ -1,62 +0,0 @@
-// QueryObserver enables browser polling only when window exists at module load.
-vi.hoisted(() => vi.stubGlobal("window", {}));
-
-import { QueryClient, QueryObserver } from "@tanstack/react-query";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { applyDomain, DOMAIN_RECONNECT_GRACE_MS, domainHostname, domainQuery, domainReconnecting, domainTarget, DomainRequestError } from "./domain-api";
-
-afterEach(() => { vi.unstubAllGlobals(); vi.useRealTimers(); });
-
-describe("domain navigation and writes", () => {
-  it("accepts DNS names while rejecting URLs, IPs and path-like input", () => {
-    expect(domainHostname(" CORE.Example.COM ")).toBe("core.example.com");
-    expect(domainHostname("例子.com")).toBe("xn--fsqu00a.com");
-    for (const input of ["https://core.example.com", "127.0.0.1", "2130706433", "localhost", "core.example.com:443", "user@core.example.com", "core.example.com/path", "core.example.com?x=1", "-core.example.com"]) expect(domainHostname(input)).toBeNull();
-    for (const target of ["javascript:alert(1)", "http://core.example.com", "https://core.example.com@evil.example.com", "https://core.example.com/path"]) expect(domainTarget(target)).toBeNull();
-    expect(domainTarget("https://core.example.com")).toBe("https://core.example.com");
-  });
-  it("sends explicit confirmation to the same-origin manager exactly once", async () => {
-    const snapshot = { supported: true, state: "checking", public_url: null, target_url: "https://core.example.com", message: null };
-    const fetch = vi.fn().mockResolvedValue(new Response(JSON.stringify(snapshot), { status: 202 }));
-    vi.stubGlobal("fetch", fetch);
-    expect(await applyDomain("core.example.com", true, new AbortController().signal)).toEqual(snapshot);
-    expect(fetch).toHaveBeenCalledExactlyOnceWith("/console/installation/domain", expect.objectContaining({ method: "POST", credentials: "same-origin", body: JSON.stringify({ hostname: "core.example.com", confirm_public_url_change: "https://core.example.com" }) }));
-  });
-  it("preserves confirmation errors and never retries a failed write", async () => {
-    const fetch = vi.fn().mockResolvedValue(new Response(JSON.stringify({ error: { code: "public_url_confirmation_required", message: "Confirm address" } }), { status: 409 }));
-    vi.stubGlobal("fetch", fetch);
-    await expect(applyDomain("core.example.com", false, new AbortController().signal)).rejects.toMatchObject({ status: 409, code: "public_url_confirmation_required" });
-    expect(fetch).toHaveBeenCalledTimes(1);
-  });
-  it("rejects a malformed or unsafe manager response", async () => {
-    vi.stubGlobal("fetch", vi.fn().mockResolvedValue(new Response(JSON.stringify({ supported: true, state: "ready", public_url: null, target_url: "https://evil.example.com/path", message: null }))));
-    await expect(applyDomain("core.example.com", false, new AbortController().signal)).rejects.toBeInstanceOf(DomainRequestError);
-  });
-  it("keeps polling setup while the gateway restarts and reports a disconnect only after the grace period", async () => {
-    vi.useFakeTimers();
-    const status = (state: string) => new Response(JSON.stringify({ supported: true, state, public_url: null, target_url: "https://core.example.com", message: null }));
-    const fetch = vi.fn().mockResolvedValueOnce(status("checking")).mockRejectedValueOnce(new TypeError("Failed to fetch"))
-      .mockImplementation(() => Promise.resolve(new Response(null, { status: 502 })));
-    vi.stubGlobal("fetch", fetch);
-    const client = new QueryClient();
-    const observer = new QueryObserver(client, domainQuery);
-    const unsubscribe = observer.subscribe(() => undefined);
-    try {
-      await vi.advanceTimersByTimeAsync(2_000);
-      expect(observer.getCurrentResult().isError).toBe(true);
-      expect(domainReconnecting(observer.getCurrentResult())).toBe(true);
-      await vi.advanceTimersByTimeAsync(DOMAIN_RECONNECT_GRACE_MS - 4_000);
-      expect(domainReconnecting(observer.getCurrentResult())).toBe(true);
-      await vi.advanceTimersByTimeAsync(2_000);
-      expect(observer.getCurrentResult().isError).toBe(true);
-      expect(domainReconnecting(observer.getCurrentResult())).toBe(false);
-      fetch.mockImplementation(() => Promise.resolve(status("ready")));
-      await vi.advanceTimersByTimeAsync(2_000);
-      expect(observer.getCurrentResult()).toMatchObject({ isError: false, data: { state: "ready" } });
-      const calls = fetch.mock.calls.length;
-      await vi.advanceTimersByTimeAsync(10_000);
-      expect(fetch).toHaveBeenCalledTimes(calls);
-      expect(fetch.mock.calls.every(([, init]) => init.method === undefined)).toBe(true);
-    } finally { unsubscribe(); client.clear(); }
-  });
-});
diff --git a/apps/web/src/features/system/domain-api.ts b/apps/web/src/features/system/domain-api.ts
deleted file mode 100644
index b4a81ee40..000000000
--- a/apps/web/src/features/system/domain-api.ts
+++ /dev/null
@@ -1,85 +0,0 @@
-import { queryOptions } from "@tanstack/react-query";
-
-export interface DomainStatus {
-  supported: boolean;
-  state: "unconfigured" | "checking" | "applying" | "ready" | "failed";
-  public_url: string | null;
-  target_url: string | null;
-  message: string | null;
-}
-
-export class DomainRequestError extends Error {
-  constructor(readonly status: number, readonly code: string, message: string) { super(message); }
-}
-
-/** A hostname, never a URL, port, IP address or path. IDNs use their ASCII form. */
-export function domainHostname(input: string): string | null {
-  const text = input.trim();
-  if (!text || /[\s/:?#@\\]/u.test(text)) return null;
-  try {
-    const host = new URL(`https://${text}`).hostname;
-    const labels = host.split(".");
-    return host.length <= 253 && labels.length > 1 && !/^\d+$/.test(labels.at(-1)!) &&
-      labels.every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(label)) ? host : null;
-  } catch { return null; }
-}
-
-/** Only a canonical HTTPS domain can become the post-apply navigation link. */
-export function domainTarget(value: string | null): string | null {
-  if (!value?.startsWith("https://")) return null;
-  const host = domainHostname(value.slice(8));
-  return host && value === `https://${host}` ? value : null;
-}
-
-export function domainInProgress(status?: DomainStatus): boolean {
-  return status?.state === "checking" || status?.state === "applying";
-}
-
-function parseStatus(value: unknown): DomainStatus {
-  if (!value || typeof value !== "object") throw new DomainRequestError(502, "invalid_response", "Invalid domain settings response.");
-  const data = value as Record<string, unknown>;
-  if (typeof data.supported !== "boolean" || !["unconfigured", "checking", "applying", "ready", "failed"].includes(String(data.state)) ||
-    ![data.public_url, data.target_url, data.message].every((entry) => entry === null || typeof entry === "string") ||
-    (data.target_url !== null && !domainTarget(data.target_url as string))) {
-    throw new DomainRequestError(502, "invalid_response", "Invalid domain settings response.");
-  }
-  return { supported: data.supported, state: data.state as DomainStatus["state"], public_url: data.public_url as string | null,
-    target_url: data.target_url as string | null, message: data.message as string | null };
-}
-
-async function domainRequest(init: RequestInit): Promise<DomainStatus> {
-  const response = await fetch("/console/installation/domain", { credentials: "same-origin", cache: "no-store", ...init });
-  if (!response.ok) {
-    const body = await response.json().catch(() => null);
-    throw new DomainRequestError(response.status, typeof body?.error?.code === "string" ? body.error.code : "request_failed",
-      typeof body?.error?.message === "string" ? body.error.message : "Domain settings could not be read.");
-  }
-  return parseStatus(await response.json());
-}
-
-/** Setup restarts the gateway, which briefly drops the console's own connection; polls ride that out before reporting a disconnect. */
-export const DOMAIN_RECONNECT_GRACE_MS = 30_000;
-
-/** No response, or a proxy error while the gateway restarts. */
-function connectionLost(error: unknown): boolean {
-  return !(error instanceof DomainRequestError) || error.status === 502 || error.status === 503 || error.status === 504;
-}
-
-/** A lost connection during setup, before the grace period since the last status has passed. */
-export function domainReconnecting(query: { data: DomainStatus | undefined; error: unknown; dataUpdatedAt: number; errorUpdatedAt: number }): boolean {
-  return query.error != null && domainInProgress(query.data) && connectionLost(query.error) &&
-    query.errorUpdatedAt - query.dataUpdatedAt < DOMAIN_RECONNECT_GRACE_MS;
-}
-
-export const domainQuery = queryOptions({
-  queryKey: ["console-domain"],
-  queryFn: ({ signal }) => domainRequest({ signal: AbortSignal.any([signal, AbortSignal.timeout(15_000)]) }),
-  retry: false,
-  refetchInterval: (query) => domainInProgress(query.state.data) && (!query.state.error || connectionLost(query.state.error)) ? 2_000 : false,
-});
-
-/** One same-origin write per user action; never retries a possibly accepted apply. */
-export function applyDomain(hostname: string, confirmed: boolean, signal: AbortSignal): Promise<DomainStatus> {
-  return domainRequest({ method: "POST", headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ hostname, ...(confirmed ? { confirm_public_url_change: `https://${hostname}` } : {}) }), signal });
-}
diff --git a/apps/web/src/features/system/domain.css b/apps/web/src/features/system/domain.css
deleted file mode 100644
index 9718d93de..000000000
--- a/apps/web/src/features/system/domain.css
+++ /dev/null
@@ -1,7 +0,0 @@
-.domain-settings { display: grid; gap: 24px; width: min(100%, 640px); }
-.domain-form { display: grid; gap: 20px; padding: 24px; border-radius: var(--radius-card); background: var(--surface); box-shadow: var(--shadow-card); }
-.domain-security, .domain-actions { display: flex; align-items: center; gap: 10px; }
-.domain-security { color: var(--fg); font-size: 14px; }
-.domain-prerequisites, .domain-state, .domain-error { margin: 0; font-size: 14px; line-height: 1.6; }
-.domain-prerequisites { color: var(--ink-2); }
-.domain-error { color: var(--danger); }
diff --git a/apps/web/src/i18n/locales/en/common.ts b/apps/web/src/i18n/locales/en/common.ts
index 8b8be17fb..0095357c7 100644
--- a/apps/web/src/i18n/locales/en/common.ts
+++ b/apps/web/src/i18n/locales/en/common.ts
@@ -10,8 +10,8 @@ export const common = {
   },
   installationNotice: {
     title: "Public address needs attention",
-    body: "Configure HTTPS before connecting applications and nodes from other machines.",
-    configure: "Configure domain and HTTPS",
+    body: "Set a public HTTPS address before connecting applications and nodes from other machines.",
+    configure: "Review the public address",
     addBlocked: "Add node is unavailable while the public address is local only.",
   },
   actions: {
diff --git a/apps/web/src/i18n/locales/en/core-errors.ts b/apps/web/src/i18n/locales/en/core-errors.ts
index f35e539f2..ba11e4086 100644
--- a/apps/web/src/i18n/locales/en/core-errors.ts
+++ b/apps/web/src/i18n/locales/en/core-errors.ts
@@ -40,5 +40,5 @@ export const coreErrors = {
   "sandbox_credential_invalid": "The E2B API key was rejected. The saved configuration is unchanged.",
   "sandbox_configuration_invalid": "Select a ready immutable E2B template build with matching resources.",
   "sandbox_verification_unconfirmed": "E2B verification could not be confirmed. Refresh before submitting again.",
-  "sandbox_configuration_error": "E2B sandboxes need a public HTTPS address. Configure a domain and HTTPS in System."
+  "sandbox_configuration_error": "E2B sandboxes need a public HTTPS address. Set OAC_PUBLIC_URL to an HTTPS origin."
 } as const;
diff --git a/apps/web/src/i18n/locales/en/keys.ts b/apps/web/src/i18n/locales/en/keys.ts
index ca4ce7c82..9f02e263e 100644
--- a/apps/web/src/i18n/locales/en/keys.ts
+++ b/apps/web/src/i18n/locales/en/keys.ts
@@ -108,7 +108,7 @@ export const keys = {
     loading: "Reading the API address",
     failed: "The API address couldn't be read.",
     localOnly: "For access from other machines, configure a domain and HTTPS in System.",
-    noAddress: "Core has no public API address yet. Configure a domain and HTTPS in System.",
+    noAddress: "Core has no public API address yet. Set OAC_PUBLIC_URL to an HTTPS origin.",
     model: "Replace {{model}} with a model name your model provider serves, or remove the model field to use this deployment's default model configuration. Running an Agent needs a model provider: pass one in each request, save one on the Agent, or rely on the deployment default. Self-hosted Sessions never use the deployment default.",
     keyPlaceholder: "<project API key>",
     projectKey: "Set OPENAI_API_KEY to an API key issued for this project. A key is shown only once, when it is issued; if it's lost, issue a new one.",
diff --git a/apps/web/src/i18n/locales/en/system.ts b/apps/web/src/i18n/locales/en/system.ts
index 66f18a9ca..01539ccb9 100644
--- a/apps/web/src/i18n/locales/en/system.ts
+++ b/apps/web/src/i18n/locales/en/system.ts
@@ -2,41 +2,6 @@ export const system = {
   help: "This installation's addresses, each harness's default model configuration and the settings every project shares. Use the sandbox backend page to change sandboxes, and config.json to change startup settings.",
   refresh: "Refresh system configuration",
   loading: "Loading…",
-  domain: {
-    "title": "Domain and HTTPS",
-    "configure": "Configure domain and HTTPS",
-    "back": "Back to System",
-    "help": "Set a domain for this installation. HTTPS certificates are issued and renewed automatically.",
-    "loadFailed": "Domain settings could not be loaded.",
-    "unsupported": "Domain setup is not available for this installation.",
-    "rejected": "The domain change was not accepted.",
-    "details": "Show details",
-    "hostname": "Domain",
-    "hostnameHelp": "Enter a domain without https://, a port or a path.",
-    "invalidHostname": "Enter a domain such as core.example.com.",
-    "automatic": "Automatic HTTPS",
-    "dnsHelp": "Point the domain’s A or AAAA record to this server. For certificate verification and HTTPS access, ports 80 and 443 must be reachable from the internet and not used by another program on the server.",
-    "prerequisites": "Point your domain to this server before applying.",
-    "submitting": "Applying…",
-    "retry": "Retry setup",
-    "apply": "Apply",
-    "refresh": "Refresh domain status",
-    "states": {
-      "unconfigured": "Not configured",
-      "checking": "Checking the domain…",
-      "applying": "Setting up HTTPS…",
-      "ready": "HTTPS is ready.",
-      "failed": "Setup failed."
-    },
-    "failed": "Domain setup failed. Check the details before retrying.",
-    "disconnected": "The console disconnected during setup. Check the new address or refresh the status.",
-    "uncertain": "The request was not confirmed. Refresh the status before trying again.",
-    "confirmTitle": "Change public address?",
-    "confirm": "Change address",
-    "confirmBody": "Switch to {{url}}? Connected nodes, sandboxes and executors may need to reconnect using the new address. The console will restart and you will need to sign in again.",
-    "reconnect": "After setup, continue at the new address and sign in again.",
-    "open": "Open {{url}}"
-  },
   installation: {
     title: "Installation",
     failed: "The installation could not be read.",
@@ -53,8 +18,9 @@ export const system = {
   },
   startup: {
     title: "Startup settings",
-    help: "Core reads these from config.json when it starts. The console only shows them.",
-    none: "Core was not started from a config.json, so there are no startup settings to show.",
+    help: "Core reports the process settings it loaded. A sensitive setting shows only whether it is set.",
+    none: "Core did not report startup settings.",
+    effective: "These are the settings this Core process loaded.",
     where: "Change these in <path/>, then run <command/>",
     copyPath: "Copy path",
     copyCommand: "Copy command",
diff --git a/apps/web/src/i18n/locales/zh-CN/common.ts b/apps/web/src/i18n/locales/zh-CN/common.ts
index 0df1a05da..1148cf184 100644
--- a/apps/web/src/i18n/locales/zh-CN/common.ts
+++ b/apps/web/src/i18n/locales/zh-CN/common.ts
@@ -10,8 +10,8 @@ export const common = {
   },
   installationNotice: {
     title: "公开地址需要处理",
-    body: "连接外部应用和节点前，请先配置 HTTPS。",
-    configure: "配置域名与 HTTPS",
+    body: "连接外部应用和节点前，请先设置一个公网 HTTPS 地址。",
+    configure: "查看公开地址",
     addBlocked: "公开地址仅限本机访问，暂时无法添加节点。",
   },
   actions: {
diff --git a/apps/web/src/i18n/locales/zh-CN/core-errors.ts b/apps/web/src/i18n/locales/zh-CN/core-errors.ts
index 3af8049d1..4334ca3c1 100644
--- a/apps/web/src/i18n/locales/zh-CN/core-errors.ts
+++ b/apps/web/src/i18n/locales/zh-CN/core-errors.ts
@@ -40,5 +40,5 @@ export const coreErrors = {
   "sandbox_credential_invalid": "E2B API 密钥被拒绝。已保存的配置未改变。",
   "sandbox_configuration_invalid": "请选择已就绪且资源匹配的不可变 E2B 模板构建。",
   "sandbox_verification_unconfirmed": "无法确认 E2B 验证结果。请刷新后再提交。",
-  "sandbox_configuration_error": "E2B 沙箱需要可从互联网访问的 HTTPS 地址，请在系统中配置域名与 HTTPS。"
+  "sandbox_configuration_error": "E2B 沙箱需要可从互联网访问的 HTTPS 地址，请把 OAC_PUBLIC_URL 设为一个 HTTPS 源地址。"
 } as const;
diff --git a/apps/web/src/i18n/locales/zh-CN/keys.ts b/apps/web/src/i18n/locales/zh-CN/keys.ts
index 00cc62a1f..40c50861e 100644
--- a/apps/web/src/i18n/locales/zh-CN/keys.ts
+++ b/apps/web/src/i18n/locales/zh-CN/keys.ts
@@ -109,8 +109,8 @@ export const keys: TranslationShape<typeof english> = {
     copyFailed: "请选中文本后手动复制。",
     loading: "正在读取 API 地址",
     failed: "无法读取 API 地址。",
-    localOnly: "从其他机器调用前，请先在系统中配置域名与 HTTPS。",
-    noAddress: "Core 尚未配置公开 API 地址，请在系统中配置域名与 HTTPS。",
+    localOnly: "从其他机器调用前，请先把 OAC_PUBLIC_URL 设为一个 HTTPS 源地址。",
+    noAddress: "Core 尚未配置公开 API 地址，请把 OAC_PUBLIC_URL 设为一个 HTTPS 源地址。",
     model: "把 {{model}} 换成模型服务提供的模型名；也可以删掉 model 字段，使用本部署的默认模型配置。运行 Agent 需要模型服务：在每个请求里传入、保存在 Agent 上，或使用部署默认值。自托管 Session 不使用部署默认值。",
     keyPlaceholder: "<项目 API key>",
     projectKey: "把 OPENAI_API_KEY 设为这个项目签发的 API key。key 只在签发时显示一次；丢失后请签发新 key。",
diff --git a/apps/web/src/i18n/locales/zh-CN/system.ts b/apps/web/src/i18n/locales/zh-CN/system.ts
index e3a71b5fd..072fd56c5 100644
--- a/apps/web/src/i18n/locales/zh-CN/system.ts
+++ b/apps/web/src/i18n/locales/zh-CN/system.ts
@@ -4,41 +4,6 @@ export const system: TranslationShape<typeof english> = {
   help: "这个安装的地址、每个执行框架的默认模型配置，以及所有项目共用的设置。沙箱在对应的后端页面修改，启动设置在 config.json 中修改。",
   refresh: "刷新系统配置",
   loading: "正在加载…",
-  domain: {
-    "title": "域名与 HTTPS",
-    "configure": "配置域名与 HTTPS",
-    "back": "返回系统",
-    "help": "为当前安装配置域名。HTTPS 证书会自动签发和续期。",
-    "loadFailed": "无法加载域名配置。",
-    "unsupported": "此安装暂不支持在控制台配置域名。",
-    "rejected": "域名变更未被接受。",
-    "details": "查看详情",
-    "hostname": "域名",
-    "hostnameHelp": "只填写域名，不包含 https://、端口或路径。",
-    "invalidHostname": "请填写有效域名，例如 core.example.com。",
-    "automatic": "自动配置 HTTPS",
-    "dnsHelp": "将域名的 A 或 AAAA 记录指向这台服务器。80 和 443 端口用于证书验证和 HTTPS 访问，需能从公网访问，且不能被服务器上的其他程序占用。",
-    "prerequisites": "应用前，请先将域名解析到这台服务器。",
-    "submitting": "正在应用…",
-    "retry": "重试配置",
-    "apply": "应用",
-    "refresh": "刷新域名状态",
-    "states": {
-      "unconfigured": "未配置",
-      "checking": "正在检查域名…",
-      "applying": "正在配置 HTTPS…",
-      "ready": "HTTPS 已就绪。",
-      "failed": "配置失败。"
-    },
-    "failed": "域名配置失败，请查看详情后重试。",
-    "disconnected": "配置期间连接已断开，请打开新地址或刷新状态。",
-    "uncertain": "尚未确认请求结果，请刷新状态后再重试。",
-    "confirmTitle": "更换公开地址？",
-    "confirm": "更换地址",
-    "confirmBody": "更换为 {{url}}？已连接的节点、沙箱和 executor 可能需要使用新地址重新连接。控制台会重启，需要重新登录。",
-    "reconnect": "配置完成后，请前往新地址重新登录。",
-    "open": "打开 {{url}}"
-  },
   installation: {
     title: "安装",
     failed: "无法读取安装信息。",
@@ -55,8 +20,9 @@ export const system: TranslationShape<typeof english> = {
   },
   startup: {
     title: "启动设置",
-    help: "Core 启动时从 config.json 读取这些设置。控制台只显示它们。",
-    none: "Core 不是通过 config.json 启动的，没有可显示的启动设置。",
+    help: "Core 报告它加载的进程设置。敏感设置只显示是否已设置。",
+    none: "Core 没有报告启动设置。",
+    effective: "这些是这个 Core 进程加载的设置。",
     where: "在 <path/> 中修改，然后运行 <command/>",
     copyPath: "复制路径",
     copyCommand: "复制命令",
diff --git a/apps/web/src/lib/installation.ts b/apps/web/src/lib/installation.ts
index cad314467..0c4bd3eda 100644
--- a/apps/web/src/lib/installation.ts
+++ b/apps/web/src/lib/installation.ts
@@ -4,7 +4,7 @@ import { admin } from "./admin-view";
 
 /**
  * This installation's public address, its `/v1` base URL for applications and
- * its config.json startup settings (`/core/v1/installation`). Readable before
+ * the process settings Core loaded (`/core/v1/installation`). Readable before
  * any sandbox deployment exists; the console never writes it.
  */
 export const installationQuery = queryOptions({
diff --git a/apps/web/src/lib/locale-strings.ts b/apps/web/src/lib/locale-strings.ts
index 5388b2d50..b4b76fa5b 100644
--- a/apps/web/src/lib/locale-strings.ts
+++ b/apps/web/src/lib/locale-strings.ts
@@ -163,7 +163,7 @@ export const chinese = {
   "Reaches {{core}}, as do its sandboxes": "能访问 {{core}}，它的沙箱也要能访问",
   "The command creates the oac-node service user and a system service. It installs no software; if something is missing it stops and says what to install.": "命令会创建 oac-node 服务用户和一个系统服务。它不安装任何软件；缺少什么时会停下并说明要装什么。",
   "oac-node joins the docker group, which is equivalent to root on this host.": "oac-node 会加入 docker 组，这在这台主机上等同于 root 权限。",
-  "Configure a domain and HTTPS in System before adding nodes.": "添加节点前，请先在系统中配置域名与 HTTPS。",
+  "Set a public HTTPS address before adding nodes.": "添加节点前，请先设置一个公网 HTTPS 地址。",
   "Clean up the host": "清理主机",
   "{{name}} is removed from Core. To remove its service and files from the host, run:": "{{name}} 已从 Core 移除。要删除它在主机上的服务和文件，请运行：",
   "{{name}} is removed from Core, but its service and files stay on the host.": "{{name}} 已从 Core 移除，但它的服务和文件仍留在主机上。",
diff --git a/contracts/agents-api/admin-api.md b/contracts/agents-api/admin-api.md
index 40e722ad2..fe39e5e66 100644
--- a/contracts/agents-api/admin-api.md
+++ b/contracts/agents-api/admin-api.md
@@ -137,17 +137,12 @@ Core writes this record in the same transaction that creates the Session. Later
 | `api_base_url` | `public_url` followed by `/v1`, the `OPENAI_BASE_URL` for Project API keys. Null when `public_url` is null |
 | `local_only` | True when `public_url` names a loopback host, which only the Core host reaches |
 | `source_commit` | The full source commit Core was built from; null for development builds |
-| `configuration` | The installer's snapshot of `config.json`; null when the installer did not start Core |
+| `configuration` | The process settings Core loaded from its environment. `path` and `apply_command` are empty, and `applied_at` is null |
 | `address_bindings` | What a change of `public_url` affects, counted on each read |
 
-`configuration` has:
+`configuration.settings` has one entry per setting Core loaded, with its dotted `key`, effective `value`, `default`, whether it is `changeable`, whether it is `sensitive`, and the services it `restarts` (`core`, `web`, `database`).
 
-- `path`: the absolute host path of `config.json`, by default `~/.oac/core/config.json`;
-- `apply_command`: the command that applies changes, by default `~/.oac/core/oac apply`;
-- `applied_at`: when the snapshot was last applied;
-- `settings`: one entry per setting, with its dotted `key`, applied `value`, `default`, whether it is `changeable` after installation, whether it is `sensitive`, and the services it `restarts` (`core`, `web`, `database`).
-
-A sensitive setting has null `value` and `default` and a boolean `configured` instead; only sensitive settings have `configured`. Core refuses to start when the snapshot breaks this rule, repeats a key or has an unknown member. Core only reports the snapshot; [configuration](../../docs/configuration.md) describes each setting.
+A sensitive setting has null `value` and `default` and a boolean `configured` instead; only sensitive settings have `configured`. `oac-core check-config` validates the same environment and exits without starting Core or printing a value. [Configuration](../../docs/configuration.md) describes each setting.
 
 | `address_bindings` field | Meaning |
 | --- | --- |
diff --git a/contracts/agents-api/core.openapi.yaml b/contracts/agents-api/core.openapi.yaml
index f15a93129..ddf6a108d 100644
--- a/contracts/agents-api/core.openapi.yaml
+++ b/contracts/agents-api/core.openapi.yaml
@@ -437,10 +437,10 @@ definitions:
       configuration:
         allOf:
           - $ref: '#/definitions/api.InstallationConfiguration'
-        description: The installer's settings snapshot (OAC_SETTINGS_FILE); null when the installer did not start Core.
+        description: The process settings Core loaded. path and apply_command are empty, and applied_at is null, because Core reports its environment rather than an installer file.
         x-nullable: true
       installation_id:
-        description: OAC_INSTALLATION_ID; null when Core runs without the sandbox manager.
+        description: The ID in OAC_INSTALLATION_ID_FILE; null when Core runs without the sandbox manager.
         type: string
         x-nullable: true
       local_only:
@@ -462,12 +462,14 @@ definitions:
   api.InstallationConfiguration:
     properties:
       applied_at:
+        description: Null when Core reports its own environment.
         type: string
+        x-nullable: true
       apply_command:
-        description: Command that applies config.json changes.
+        description: Command that applies config.json changes. Empty when Core reports its own environment.
         type: string
       path:
-        description: Absolute host path of the installation's config.json.
+        description: Absolute host path of config.json. Empty when Core reports its own environment.
         type: string
       settings:
         items:
@@ -3594,7 +3596,7 @@ paths:
         - Deployment Model Providers
   /core/v1/installation:
     get:
-      description: Core key only; available before any sandbox deployment exists. Reports the public URL that applications, nodes, sandboxes and self-hosted executors use, the API base URL, Core's source commit and installation ID, the installer's settings snapshot with where to change it, and what is bound to the current public URL. Sensitive settings report only whether they are configured.
+      description: Core key only; available before any sandbox deployment exists. Reports the public URL that applications, nodes, sandboxes and self-hosted executors use, the API base URL, Core's source commit and installation ID, the process settings Core loaded, and what is bound to the current public URL. Sensitive settings report only whether they are configured.
       produces:
         - application/json
       responses:
diff --git a/contracts/agents-api/sandbox-deployment.md b/contracts/agents-api/sandbox-deployment.md
index 72dfb1dc1..2af2c9244 100644
--- a/contracts/agents-api/sandbox-deployment.md
+++ b/contracts/agents-api/sandbox-deployment.md
@@ -224,6 +224,6 @@ Storage and credential failures stay errors: an empty or failed read never prove
 
 ## Canonical node specification
 
-`sandbox/deployment_contract.go` owns the resource bounds, provider requirements, release patterns and canonical field order; `sandbox/deployment.go` applies them in Core. The installer consumes the generated declaration in `deploy/install/node_spec.py`, so there is no second set of limits or patterns. Regenerate it from the repository root with `go run ./services/core/cmd/specification-contract -write`; the sandbox Go tests, part of `make check`, reject a stale projection.
+`sandbox/deployment_contract.go` owns the resource bounds, provider requirements, release patterns and canonical field order; `sandbox/deployment.go` applies them in Core. The installer consumes the generated declaration in `deploy/node/node_spec.py`, so there is no second set of limits or patterns. Regenerate it from the repository root with `go run ./services/core/cmd/specification-contract -write`; the sandbox Go tests, part of `make check`, reject a stale projection.
 
 The specification digest is the SHA-256 of compact UTF-8 JSON with `provider` first, then `resources`, then `runtime` when the provider requires it. Resource and Runtime fields follow the contract's declaration order; zero optional disk fields are omitted and required fields stay present. Release identities are lowercase ASCII, and the digest never depends on the incoming field order or whitespace. `services/core/internal/sandbox/testdata/deployment-contract.json` holds shared acceptance cases, exact canonical bytes and digests that both the Go and Python tests consume.
diff --git a/contracts/agents-api/zh/admin-api.md b/contracts/agents-api/zh/admin-api.md
index 071bb2c42..c86c1de67 100644
--- a/contracts/agents-api/zh/admin-api.md
+++ b/contracts/agents-api/zh/admin-api.md
@@ -1,7 +1,7 @@
 ---
 title: "Core 管理 API"
 source: contracts/agents-api/admin-api.md
-source_hash: 04fbf3485f88ba0395efb31fec57b2e40e9584db6c648f7e83ab7866e45bdfb2
+source_hash: 3fc6573b19b9c78ca8a3b275122793b1a99e31f739d83ff25ff56624013dc428
 ---
 
 Core 管理 API（`/core/v1`）用于管理安装实例：Project 及其 API 密钥、Project 资源的读取和删除、执行器凭据、部署默认模型、沙箱部署及其节点、监控和审计。Web 的[控制台服务器](../../../docs/zh/web/console-server.md#forwarding-to-core)会为已登录的管理员调用它；运维人员则从 Core 主机上的脚本调用它（[编写 Core API 脚本](../../../docs/zh/getting-started/operations.md#script-the-core-api)）。生成的架构是 [core.openapi.yaml](../core.openapi.yaml)，所有错误都使用 [Core 错误封装](core-errors.md)。
@@ -139,17 +139,12 @@ Core 会在创建 Session 的同一事务中写入此记录。之后的 Agent 
 | `api_base_url` | 在 `public_url` 后附加 `/v1`，即 Project API 密钥使用的 `OPENAI_BASE_URL`。当 `public_url` 为 null 时为 null |
 | `local_only` | 当 `public_url` 指向回环主机时为 True，该主机只能由 Core 主机访问 |
 | `source_commit` | Core 构建所依据的完整源代码提交；开发构建为 null |
-| `configuration` | 安装器对 `config.json` 的快照；安装器未启动 Core 时为 null |
+| `configuration` | Core 从环境加载的进程设置。`path` 和 `apply_command` 为空，`applied_at` 为 null |
 | `address_bindings` | 更改 `public_url` 所影响的内容，每次读取都会重新统计 |
 
-`configuration` 包含：
+`configuration.settings` 为 Core 加载的每项设置一条记录，包含以点分隔的 `key`、生效的 `value`、`default`、是否 `changeable`、是否 `sensitive`，以及会 `restarts` 的服务（`core`、`web`、`database`）。
 
-- `path`：`config.json` 在主机上的绝对路径，默认值为 `~/.oac/core/config.json`；
-- `apply_command`：应用更改的命令，默认值为 `~/.oac/core/oac apply`；
-- `applied_at`：最近一次应用快照的时间；
-- `settings`：每个设置对应一个条目，包含以点分隔的 `key`、已应用的 `value`、`default`、安装后是否可 `changeable`、是否 `sensitive`，以及会 `restarts` 的服务（`core`、`web`、`database`）。
-
-敏感设置的 `value` 和 `default` 为 null，并改为包含一个布尔值 `configured`；只有敏感设置具有 `configured`。如果快照违反此规则、重复使用某个键或包含未知成员，Core 将拒绝启动。Core 仅报告该快照；[配置](../../../docs/zh/configuration.md)会说明每个设置。
+敏感设置的 `value` 和 `default` 为 null，并改为包含一个布尔值 `configured`；只有敏感设置具有 `configured`。`oac-core check-config` 校验同一组环境变量，然后退出，不启动 Core，也不打印值。[配置](../../../docs/zh/configuration.md)会说明每个设置。
 
 | `address_bindings` 字段 | 含义 |
 | --- | --- |
diff --git a/contracts/agents-api/zh/sandbox-deployment.md b/contracts/agents-api/zh/sandbox-deployment.md
index 509fed4b0..dea0cf983 100644
--- a/contracts/agents-api/zh/sandbox-deployment.md
+++ b/contracts/agents-api/zh/sandbox-deployment.md
@@ -1,7 +1,7 @@
 ---
 title: "沙箱部署"
 source: contracts/agents-api/sandbox-deployment.md
-source_hash: e84ced73c64da30f33feba032d7e8e9bc8c33b3062604a47258102460615429b
+source_hash: 06a69e3d0ba245ab27c0b5d7390364a35d10fb8478e2d0f6867749b29368f980
 ---
 
 沙箱部署为 Core 管理的 `openai_hosted` 执行选择 Sandbox Provider、每个沙箱的资源以及不可变的 Runtime 发行版。PostgreSQL 为每个安装维护一个当前有效选择；Web 和 Core API 写入同一配置。节点文件保存其已安装副本和特定于主机的路径，且不能覆盖其资源或 Runtime。该选择独立于 Harness；部署可以保持未配置状态，既无节点，也不接受托管准入。
@@ -226,6 +226,6 @@ POST 会在持久保存候选配置之前对其进行验证，并且不会创建
 
 ## 规范的节点规格 {#canonical-node-specification}
 
-`sandbox/deployment_contract.go`负责资源边界、提供商要求、发行版模式和规范字段顺序；`sandbox/deployment.go`在 Core 中应用这些规则。安装程序会使用 `deploy/install/node_spec.py` 中生成的声明，因此不存在第二套限制或模式。请在仓库根目录运行 `go run ./services/core/cmd/specification-contract -write` 重新生成；作为 `make check` 一部分的沙箱 Go 测试会拒绝过时的投影。
+`sandbox/deployment_contract.go`负责资源边界、提供商要求、发行版模式和规范字段顺序；`sandbox/deployment.go`在 Core 中应用这些规则。安装程序会使用 `deploy/node/node_spec.py` 中生成的声明，因此不存在第二套限制或模式。请在仓库根目录运行 `go run ./services/core/cmd/specification-contract -write` 重新生成；作为 `make check` 一部分的沙箱 Go 测试会拒绝过时的投影。
 
 规范摘要是紧凑 UTF-8 JSON 的 SHA-256，其中 `provider` 位于首位，其次是 `resources`，然后在提供商需要时放置 `runtime`。资源和 Runtime 字段遵循契约的声明顺序；值为零的可选磁盘字段会被省略，必填字段则保持存在。发行版标识采用小写 ASCII，摘要绝不会受传入字段顺序或空白字符影响。`services/core/internal/sandbox/testdata/deployment-contract.json`保存共享验收用例、精确的规范字节和摘要，Go 与 Python 测试都会使用这些内容。
diff --git a/deploy/README.md b/deploy/README.md
new file mode 100644
index 000000000..7d254a21d
--- /dev/null
+++ b/deploy/README.md
@@ -0,0 +1,20 @@
+# Deployment
+
+| Path | Contents |
+| --- | --- |
+| `install.sh` | Host installer published with each release |
+| `compose/` | Compose template, port overlays and their tests |
+| `distribution/` | Image Dockerfiles |
+| `node/` | [Node installer](node/README.md), packaged as `node-install.pyz` |
+
+## Installation
+
+`install.sh` downloads its release's `compose.yaml` and port files, checks them against `compose-sha256sums.txt`, writes `.env`, and starts Compose. Core applies database migrations when it starts. The host needs Linux amd64 and Docker Compose 2.26 or newer. [Configuration](../docs/configuration.md) owns the installation layout and settings.
+
+`oac` is a Go command (`services/core/cmd/oac`) in the Core image and the ingress image. The host copy implements `apply`, `core-key` and `rotate-core-key`; `core-key --show` runs `oac-web core-key` in the Web container. Start, stop, logs and removal are `docker compose`. `apply` runs `oac-core check-config` before recreating services. The ingress image runs data initialization as `oac init` and contains no Python. No service receives a Docker socket.
+
+Web serves the console and forwards `/v1` and `/api/v1` to Core, so it is the only published service. HTTPS is terminated by the operator's reverse proxy or hosting platform, which routes to `web:8080`; `OAC_PUBLIC_URL` records that origin.
+
+## Native daemon installer
+
+`oac-daemon install` installs the daemon and selected Harnesses on a self-hosted machine. The [credential contract](../contracts/agents-api/environment-executor-credentials.md#installation-grant) covers the grant it claims. The release catalog is in the Core image at `/opt/oac/native-installers`; Core serves it from there. Node installation is separate and stays in `node-install.pyz`.
diff --git a/deploy/compose/compose.yaml b/deploy/compose/compose.yaml
index 9f5b92a3c..dbe5cdd0a 100644
--- a/deploy/compose/compose.yaml
+++ b/deploy/compose/compose.yaml
@@ -1,49 +1,29 @@
-# OpenAgentCore v0.0.3. Images and installer payload are one matched release.
-# Set OAC_PUBLIC_URL to your platform's HTTPS origin when ready; startup defaults to localhost.
-x-ingress-image: &ingress-image ghcr.io/minimax-ai/openagentcore/ingress:v0.0.3@sha256:e485a8cae0b904389501f00bcee6a2c5b35be83412a9ff81a740f93b8cdbf326
-x-core: &core
-  image: ghcr.io/minimax-ai/openagentcore/core:v0.0.3@sha256:6934a26d5cb7c878128ea8187ced446336345de7750c415be510740806663575
-  platform: linux/amd64
-  user: "65532:65532"
-  read_only: true
-  init: true
-  tmpfs: [/tmp:mode=1777]
-  security_opt: [no-new-privileges:true]
-  environment:
-    OAC_PUBLIC_URL: &public-url ${OAC_PUBLIC_URL:-http://localhost:8080}
-    OAC_DATABASE_URL: postgres://agents_api@database:5432/agents_api?sslmode=disable
-    OAC_DATABASE_PASSWORD_FILE: /run/database/password
-    OAC_CREDENTIAL_KEY_FILE: /run/oac/credential.key
-    OAC_CORE_KEY_DIGESTS_FILE: /run/oac/core-key-digests.json
-    OAC_PROVIDER_ROOT: /opt/oac
-    OAC_PROVIDER_STATE_ROOT: /state
-    OAC_NATIVE_INSTALLER_DIR: /opt/oac/native-installers
-    OAC_HARNESSES: claude_sdk,codex,mcode
-  volumes:
-    - core-config:/run/oac:ro
-    - database-secret:/run/database:ro
-    - core-state:/state
-
+# Release template. scripts/render-compose.py fills the __OAC_*__ tokens with this
+# release's source revision and node-metadata checksum. Images default to the
+# floating latest tags; set OAC_IMAGE_CORE, OAC_IMAGE_WEB or OAC_IMAGE_INGRESS
+# to select another reference. Do not run this file until it has been rendered.
+# Data is bind-mounted from ${OAC_DATA_DIR:-./data}. Set OAC_PUBLIC_URL when the
+# platform domain is ready; startup defaults to localhost. Other process
+# settings pass through unchanged; Core owns their defaults.
+x-ingress-image: &ingress-image ${OAC_IMAGE_INGRESS:-ghcr.io/minimax-ai/openagentcore/ingress:latest}
 services:
   init:
     image: *ingress-image
     platform: linux/amd64
     restart: "no"
     security_opt: [no-new-privileges:true]
-    command: [python3, /init.py]
-    configs:
-      - source: init-script
-        target: /init.py
+    command: [/usr/local/bin/oac, init]
+    environment:
+      OAC_REVISION: __OAC_REVISION__
+      OAC_RELEASE_BASE: __OAC_RELEASE_BASE__
+      OAC_ARCHIVE_CHECKSUM: __OAC_ARCHIVE_CHECKSUM__
     volumes:
-      - core-config:/data/core
-      - web-secret:/data/web
-      - database-secret:/data/database
-      - core-state:/data/state
-      - node-payload:/data/payload
-      - database:/data/database-data:ro
+      - type: bind
+        source: ${OAC_DATA_DIR:-./data}
+        target: /data
 
   database:
-    image: postgres:16-alpine@sha256:1a66d744c1b459e13b05a8fca341da84cb63383e99ce262210efee5a319d4551
+    image: postgres:16-alpine
     platform: linux/amd64
     restart: unless-stopped
     depends_on:
@@ -53,33 +33,63 @@ services:
       POSTGRES_DB: agents_api
       POSTGRES_PASSWORD_FILE: /run/database/password
     volumes:
-      - database:/var/lib/postgresql/data
-      - database-secret:/run/database:ro
+      - type: bind
+        source: ${OAC_DATA_DIR:-./data}/database
+        target: /var/lib/postgresql/data
+      - type: bind
+        source: ${OAC_DATA_DIR:-./data}/secrets/database
+        target: /run/database
+        read_only: true
     healthcheck:
       test: [CMD-SHELL, "pg_isready -h 127.0.0.1 -U agents_api -d agents_api"]
       interval: 2s
       timeout: 5s
       retries: 30
 
-  migrate:
-    <<: *core
-    restart: "no"
-    command: [/usr/local/bin/oac-core-migrate]
-    depends_on:
-      database: {condition: service_healthy}
-
   core:
-    <<: *core
+    image: ${OAC_IMAGE_CORE:-ghcr.io/minimax-ai/openagentcore/core:latest}
+    platform: linux/amd64
+    user: "65532:65532"
     restart: unless-stopped
-    command:
-      - /bin/sh
-      - -ec
-      - export OAC_INSTALLATION_ID="$$(cat /run/oac/installation.id)"; exec /usr/local/bin/oac-core
+    read_only: true
+    init: true
+    tmpfs: [/tmp:mode=1777]
+    security_opt: [no-new-privileges:true]
     depends_on:
-      migrate: {condition: service_completed_successfully}
+      database: {condition: service_healthy}
+    environment:
+      OAC_PUBLIC_URL: &public-url ${OAC_PUBLIC_URL:-http://localhost:8080}
+      OAC_INSTALLATION_ID_FILE: /run/oac/installation.id
+      OAC_DATABASE_URL: postgres://agents_api@database:5432/agents_api?sslmode=disable
+      OAC_DATABASE_PASSWORD_FILE: /run/database/password
+      OAC_CREDENTIAL_KEY_FILE: /run/oac/credential.key
+      OAC_CORE_KEY_DIGESTS_FILE: /run/oac/core-key-digests.json
+      OAC_PROVIDER_STATE_ROOT: /state
+      OAC_NATIVE_INSTALLER_DIR: /opt/oac/native-installers
+      OAC_EXECUTION_CONCURRENCY: ${OAC_EXECUTION_CONCURRENCY:-}
+      OAC_DEFAULT_HARNESS: ${OAC_DEFAULT_HARNESS:-}
+      OAC_HARNESSES: ${OAC_HARNESSES:-}
+      OAC_WRITE_AUDIT_RETENTION: ${OAC_WRITE_AUDIT_RETENTION:-}
+      OAC_OAUTH_TRUSTED_ORIGINS: ${OAC_OAUTH_TRUSTED_ORIGINS:-}
+      OAC_LOG_LEVEL: ${OAC_LOG_LEVEL:-}
+      OAC_LOG_FORMAT: ${OAC_LOG_FORMAT:-}
+      OAC_LOG_ADD_SOURCE: ${OAC_LOG_ADD_SOURCE:-}
+      OAC_HISTORY_SETTINGS_FILE: ${OAC_HISTORY_SETTINGS_FILE:-}
+    volumes:
+      - type: bind
+        source: ${OAC_DATA_DIR:-./data}/secrets/core
+        target: /run/oac
+        read_only: true
+      - type: bind
+        source: ${OAC_DATA_DIR:-./data}/secrets/database
+        target: /run/database
+        read_only: true
+      - type: bind
+        source: ${OAC_DATA_DIR:-./data}/state
+        target: /state
 
   web:
-    image: ghcr.io/minimax-ai/openagentcore/web:v0.0.3@sha256:d1eb4cc8870aebd080773fd16db92a5a1db205e0aab10066d4db16f1284a88f5
+    image: ${OAC_IMAGE_WEB:-ghcr.io/minimax-ai/openagentcore/web:latest}
     platform: linux/amd64
     user: "65532:65532"
     restart: unless-stopped
@@ -92,185 +102,20 @@ services:
       OAC_WEB_UPSTREAM: http://core:8091
       OAC_WEB_CORE_KEY_FILE: /run/oac/core.key
       OAC_WEB_NODE_PAYLOAD_DIR: /node-payload
+      OAC_LOG_LEVEL: ${OAC_LOG_LEVEL:-}
+      OAC_LOG_FORMAT: ${OAC_LOG_FORMAT:-}
+      OAC_LOG_ADD_SOURCE: ${OAC_LOG_ADD_SOURCE:-}
     volumes:
-      - web-secret:/run/oac:ro
-      - node-payload:/node-payload:ro
-
-  gateway:
-    image: *ingress-image
-    platform: linux/amd64
-    user: "65532:65532"
-    restart: unless-stopped
-    security_opt: [no-new-privileges:true]
-    tmpfs: [/tmp:mode=1777]
-    environment:
-      XDG_DATA_HOME: /tmp/data
-      XDG_CONFIG_HOME: /tmp/config
-    command: [caddy, run, --config, /etc/caddy/Caddyfile, --adapter, caddyfile]
-    depends_on: [core, web]
-    expose: ["8080"]
-    configs:
-      - source: gateway-config
-        target: /etc/caddy/Caddyfile
+      - type: bind
+        source: ${OAC_DATA_DIR:-./data}/secrets/web
+        target: /run/oac
+        read_only: true
+      - type: bind
+        source: ${OAC_DATA_DIR:-./data}/node-payload
+        target: /node-payload
+        read_only: true
     healthcheck:
-      test:
-        - CMD
-        - python3
-        - -c
-        - |
-          import urllib.request
-          client = urllib.request.build_opener(urllib.request.ProxyHandler({}))
-          for host in ('core:8091', 'web:8080', '127.0.0.1:8080'):
-              with client.open('http://' + host + '/healthz', timeout=3) as response:
-                  assert response.status == 200
+      test: [CMD, /usr/local/bin/oac-web, healthcheck]
       interval: 5s
       timeout: 10s
       retries: 30
-
-  # Explicit operator action; the key is printed only to the attached terminal.
-  credentials:
-    image: *ingress-image
-    platform: linux/amd64
-    user: "65532:65532"
-    profiles: [tools]
-    read_only: true
-    logging: {driver: none}
-    command: [cat, /run/oac/core.key]
-    volumes:
-      - web-secret:/run/oac:ro
-
-volumes:
-  database:
-  database-secret:
-  core-config:
-  web-secret:
-  core-state:
-  node-payload:
-
-configs:
-  gateway-config:
-    content: |
-      {
-        admin off
-        auto_https off
-        persist_config off
-      }
-      http://:8080 {
-        @core path /v1 /v1/* /api/v1/*
-        handle @core {
-          reverse_proxy core:8091 {
-            flush_interval -1
-          }
-        }
-        handle {
-          reverse_proxy web:8080 {
-            flush_interval -1
-          }
-        }
-      }
-
-  init-script:
-    content: |
-      import base64
-      import fcntl
-      import hashlib
-      import json
-      import os
-      from pathlib import Path
-      import secrets
-      import tarfile
-      import urllib.request
-      import uuid
-
-      REVISION = 'cc7e1aad3bde47598d161d6372e2e211bb61d9cd'
-      BASE = 'https://github.com/MiniMax-AI/OpenAgentCore/releases/download/v0.0.3/'
-      ARCHIVE = 'oac-' + REVISION + '-linux-amd64'
-      CHECKSUM = '579d2d43accfc45a0a8567db5bc33b407c48b05b0d731bea3fed73e6ade558ae'
-      MEMBERS = ('manifest.json', 'SHA256SUMS', 'node-install.pyz', 'runtime/seccomp.json')
-
-      def digest(data):
-          return hashlib.sha256(data).hexdigest()
-
-      def download():
-          print('Downloading and verifying the matched node installation metadata', flush=True)
-          checksum = hashlib.sha256()
-          with urllib.request.urlopen(BASE + ARCHIVE + '.tar.gz', timeout=60) as response:
-              class Reader:
-                  def read(self, count=-1):
-                      data = response.read(count)
-                      checksum.update(data)
-                      return data
-              reader, files = Reader(), {}
-              with tarfile.open(fileobj=reader, mode='r|gz') as archive:
-                  for member in archive:
-                      name = member.name.removeprefix(ARCHIVE + '/')
-                      if member.name == ARCHIVE + '/' + name and name in MEMBERS:
-                          if name in files or not member.isfile() or member.size > 1024 * 1024:
-                              raise RuntimeError('Invalid release metadata member')
-                          files[name] = archive.extractfile(member).read()
-              while reader.read(1024 * 1024):
-                  pass
-          if checksum.hexdigest() != CHECKSUM or set(files) != set(MEMBERS):
-              raise RuntimeError('Release metadata checksum mismatch')
-          manifest = json.loads(files['manifest.json'])
-          if manifest['source_commit'] != REVISION or manifest['platform'] != 'linux/amd64':
-              raise RuntimeError('Release identity mismatch')
-          return files
-
-      def write(path, data):
-          path.parent.mkdir(parents=True, exist_ok=True)
-          temporary = path.with_name(path.name + '.tmp')
-          temporary.write_bytes(data)
-          temporary.chmod(0o600)
-          os.chown(temporary, 65532, 65532)
-          os.replace(temporary, path)
-
-      def initialize(root, fetch=download):
-          for name in ('core', 'web', 'database', 'state', 'payload'):
-              directory = root / name
-              directory.mkdir(exist_ok=True)
-              directory.chmod(0o700)
-              os.chown(directory, 65532, 65532)
-          with (root / 'core/.init.lock').open('w') as lock:
-              fcntl.flock(lock, fcntl.LOCK_EX)
-              marker = root / 'core/installation.json'
-              if marker.exists():
-                  receipt = json.loads(marker.read_text())
-                  if receipt['source_commit'] != REVISION:
-                      raise RuntimeError('This volume belongs to another release; create a new installation')
-                  for name, checksum in receipt['files'].items():
-                      if digest((root / name).read_bytes()) != checksum:
-                          raise RuntimeError('Installation files changed; restore the matching volumes')
-                  print('Existing installation verified', flush=True)
-                  return
-              if any((root / 'database-data').iterdir()) or any((root / 'state').iterdir()):
-                  raise RuntimeError('Existing data requires its original installation volumes')
-              files = fetch()
-              prefix = 'payload/releases/' + REVISION + '/'
-              for name, data in files.items():
-                  write(root / (prefix + name), data)
-              write(root / 'payload/active.json', json.dumps({'source_commit': REVISION}).encode())
-              # Parent directories of the public payload must be traversable by Web.
-              for path in (root / 'payload').rglob('*'):
-                  if path.is_dir():
-                      path.chmod(0o755)
-              generators = {
-                  'web/core.key': lambda: secrets.token_hex(32),
-                  'database/password': lambda: secrets.token_hex(32),
-                  'core/credential.key': lambda: base64.b64encode(secrets.token_bytes(32)).decode(),
-                  'core/installation.id': lambda: str(uuid.uuid4()),
-              }
-              for name, generate in generators.items():
-                  if not (root / name).exists():
-                      write(root / name, (generate() + '\n').encode())
-              key = (root / 'web/core.key').read_text().strip()
-              write(root / 'core/core-key-digests.json', json.dumps([digest(key.encode())]).encode())
-              names = [*generators, 'core/core-key-digests.json', 'payload/active.json',
-                       *(prefix + name for name in MEMBERS)]
-              receipt = {'source_commit': REVISION, 'files': {name: digest((root / name).read_bytes()) for name in names}}
-              write(marker, json.dumps(receipt).encode())
-              print('Installation initialized; use the credentials service to retrieve the sign-in key', flush=True)
-
-      if __name__ == '__main__':
-          os.umask(0o077)
-          initialize(Path('/data'))
diff --git a/deploy/compose/local.yaml b/deploy/compose/local.yaml
deleted file mode 100644
index 339b92b7e..000000000
--- a/deploy/compose/local.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-# Local access; platforms route directly to gateway:8080 without this override.
-services:
-  gateway:
-    ports: ["127.0.0.1:8080:8080"]
diff --git a/deploy/compose/ports.yaml b/deploy/compose/ports.yaml
new file mode 100644
index 000000000..b64424fe6
--- /dev/null
+++ b/deploy/compose/ports.yaml
@@ -0,0 +1,9 @@
+# Host installation publishes Web and Core's loopback admin API for scripts on
+# the host. Hosting platforms omit this file and route to web:8080 themselves.
+services:
+  web:
+    ports:
+      - "${OAC_HOST:-127.0.0.1}:${OAC_WEB_PORT:-8080}:8080"
+  core:
+    ports:
+      - "127.0.0.1:8091:8091"
diff --git a/deploy/compose/smoke-pins.json b/deploy/compose/smoke-pins.json
new file mode 100644
index 000000000..f448930cd
--- /dev/null
+++ b/deploy/compose/smoke-pins.json
@@ -0,0 +1,5 @@
+{
+  "revision": "cc7e1aad3bde47598d161d6372e2e211bb61d9cd",
+  "release_base": "https://github.com/MiniMax-AI/OpenAgentCore/releases/download/v0.0.3/",
+  "archive_checksum": "579d2d43accfc45a0a8567db5bc33b407c48b05b0d731bea3fed73e6ade558ae"
+}
diff --git a/deploy/compose/test_compose.py b/deploy/compose/test_compose.py
new file mode 100644
index 000000000..acefbaaaa
--- /dev/null
+++ b/deploy/compose/test_compose.py
@@ -0,0 +1,107 @@
+"""Qualify the rendered Compose files without building images."""
+
+import copy
+import importlib.util
+import json
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+
+ROOT = Path(__file__).resolve().parents[2]
+spec = importlib.util.spec_from_file_location("render_compose", ROOT / "scripts/render-compose.py")
+render_compose = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(render_compose)
+
+
+def rendered_compose(directory):
+    text = render_compose.render({
+        'REVISION': 'd' * 40,
+        'RELEASE_BASE': 'https://example.com/releases/v1/',
+        'ARCHIVE_CHECKSUM': 'e' * 64,
+    })
+    path = Path(directory) / 'compose.yaml'
+    path.write_text(text)
+    return path
+
+
+class ComposeTests(unittest.TestCase):
+    @classmethod
+    def render(cls, public_url=None):
+        env = dict(os.environ)
+        env.pop('OAC_PUBLIC_URL', None)
+        for name in ('OAC_IMAGE_CORE', 'OAC_IMAGE_WEB', 'OAC_IMAGE_INGRESS'):
+            env.pop(name, None)
+        env['OAC_DATA_DIR'] = '/tmp/oac-compose-fixture'
+        if public_url is not None:
+            env['OAC_PUBLIC_URL'] = public_url
+        return json.loads(subprocess.check_output(
+            ['docker', 'compose', '--env-file', os.devnull, '-f', str(cls.compose_file),
+             'config', '--format', 'json'], env=env))
+
+    @classmethod
+    def setUpClass(cls):
+        cls.temporary = tempfile.TemporaryDirectory()
+        cls.addClassCleanup(cls.temporary.cleanup)
+        cls.compose_file = rendered_compose(cls.temporary.name)
+        cls.compose = cls.render()
+
+    def test_compose_uses_private_services_and_ordered_initialization(self):
+        services = self.compose['services']
+        self.assertEqual(services['database']['depends_on']['init']['condition'], 'service_completed_successfully')
+        self.assertIn('pg_isready -h 127.0.0.1', services['database']['healthcheck']['test'][1])
+        self.assertEqual(services['core']['depends_on']['database']['condition'], 'service_healthy')
+        self.assertEqual(sorted(services), ['core', 'database', 'init', 'web'])
+        for service in services.values():
+            self.assertNotIn('build', service)
+            self.assertNotIn('ports', service)
+            self.assertTrue(service['image'].endswith(':latest') or service['image'] == 'postgres:16-alpine')
+            for volume in service.get('volumes', []):
+                self.assertNotIn('docker.sock', json.dumps(volume))
+                self.assertEqual(volume['type'], 'bind')
+        self.assertEqual({v['target'] for v in services['web']['volumes']}, {'/run/oac', '/node-payload'})
+        self.assertIsNone(services['core']['command'])
+        self.assertNotIn('OAC_WEB_INSTALLATION_SOCKET', services['web']['environment'])
+        self.assertEqual(services['init']['command'], ['/usr/local/bin/oac', 'init'])
+        self.assertEqual(services['web']['healthcheck']['test'], ['CMD', '/usr/local/bin/oac-web', 'healthcheck'])
+        self.assertNotIn('python3', json.dumps(self.compose))
+        self.assertEqual(services['init']['environment']['OAC_REVISION'], 'd' * 40)
+        for name in ('OAC_EXECUTION_CONCURRENCY', 'OAC_DEFAULT_HARNESS', 'OAC_HARNESSES', 'OAC_WRITE_AUDIT_RETENTION', 'OAC_LOG_LEVEL'):
+            self.assertEqual(services['core']['environment'][name], '', name)
+
+    def test_public_url_can_be_configured_after_initial_startup(self):
+        for value in (None, '', 'https://oac.example.test', 'http://localhost:9080'):
+            with self.subTest(public_url=value):
+                configured = self.render(value)
+                expected = value or 'http://localhost:8080'
+                for name, setting in (('core', 'OAC_PUBLIC_URL'), ('web', 'OAC_WEB_ORIGIN')):
+                    self.assertEqual(configured['services'][name]['environment'][setting], expected)
+                self.assertEqual(
+                    {service: [item.get('target') for item in spec.get('volumes', [])]
+                     for service, spec in configured['services'].items()},
+                    {service: [item.get('target') for item in spec.get('volumes', [])]
+                     for service, spec in self.compose['services'].items()})
+
+    def test_host_ports_publish_web_and_loopback_core(self):
+        env = dict(os.environ, OAC_DATA_DIR='/tmp/oac-compose-fixture', OAC_HOST='0.0.0.0')
+        hosted = json.loads(subprocess.check_output(
+            ['docker', 'compose', '--env-file', os.devnull, '-f', str(self.compose_file),
+             '-f', str(ROOT / 'deploy/compose/ports.yaml'), 'config', '--format', 'json'], env=env))
+        published = {name: [(port.get('host_ip'), port['published']) for port in service.get('ports', [])]
+                     for name, service in hosted['services'].items() if service.get('ports')}
+        self.assertEqual(published, {'web': [('0.0.0.0', '8080')], 'core': [('127.0.0.1', '8091')]})
+
+    def test_platform_network_injection_keeps_the_file_valid(self):
+        # Dokploy isolated deployments attach a project network to every service.
+        transformed = copy.deepcopy(self.compose)
+        transformed['networks']['platform'] = {}
+        for service in transformed['services'].values():
+            service.setdefault('networks', {})['platform'] = None
+        subprocess.run(
+            ['docker', 'compose', '-f', '-', 'config', '--quiet'],
+            input=json.dumps(transformed), text=True, check=True)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/deploy/distribution/Dockerfile b/deploy/distribution/Dockerfile
index 146473acd..a20af95ce 100644
--- a/deploy/distribution/Dockerfile
+++ b/deploy/distribution/Dockerfile
@@ -5,13 +5,13 @@ FROM debian:bookworm-slim@sha256:3783cc01769c7b2b1b83a5c5ad96c815348e28ed7da68e2
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates libgcc-s1 \
     && rm -rf /var/lib/apt/lists/*
 
-COPY --chmod=0555 bin/oac-core bin/oac-core-migrate bin/oac-core-device bin/oac-core-environment-key /usr/local/bin/
+COPY --chmod=0555 bin/oac-core bin/oac-core-device bin/oac-core-environment-key bin/oac /usr/local/bin/
 
 COPY e2b/ /opt/oac/e2b/
 # Only the small version/checksum catalog, never native execution archives.
 COPY native-installers/ /opt/oac/native-installers/
 
-ENV OAC_ADDR=:8091
+ENV OAC_ADDR=:8091 OAC_PROVIDER_ROOT=/opt/oac
 EXPOSE 8091
 USER 65532:65532
 CMD ["/usr/local/bin/oac-core"]
diff --git a/deploy/distribution/Ingress.Dockerfile b/deploy/distribution/Ingress.Dockerfile
index 51c324219..bedebf583 100644
--- a/deploy/distribution/Ingress.Dockerfile
+++ b/deploy/distribution/Ingress.Dockerfile
@@ -1,6 +1,8 @@
-# The installer owns this image. Core and Web never receive Docker access.
-FROM caddy:2.10.2-alpine@sha256:4c6e91c6ed0e2fa03efd5b44747b625fec79bc9cd06ac5235a779726618e530d AS caddy
-FROM docker:29.0.4-cli@sha256:858bb1e05af16840f5a55143c3e5e14073891fbc92f2c1f6f38dd9c5f2cca03c
-RUN apk add --no-cache python3 ca-certificates
-COPY --from=caddy /usr/bin/caddy /usr/local/bin/caddy
+# One-time data initialization. oac init runs as root so it can chown data
+# directories, then exits. It downloads the node payload over HTTPS, so the
+# image carries CA certificates. scripts/build-core-distribution.sh builds this
+# from a context that also contains the oac binary.
+FROM alpine:3.22@sha256:5291449c3df73caf6ed85e649dec1b9e818b39a5d8c871e97afc13e9cd5e8fa8
+RUN apk add --no-cache ca-certificates
+COPY --chmod=0555 oac /usr/local/bin/oac
 ENTRYPOINT []
diff --git a/deploy/install-release.sh b/deploy/install-release.sh
deleted file mode 100755
index ebcc28097..000000000
--- a/deploy/install-release.sh
+++ /dev/null
@@ -1,367 +0,0 @@
-#!/usr/bin/env bash
-# Download one matched release and delegate installation to its bundled installer.
-set -euo pipefail
-command -v python3 >/dev/null || { echo 'Python 3.9+ is required.' >&2; exit 1; }
-# Keep the caller's stdin available to the bundled installer.
-exec python3 /dev/fd/3 "$@" 3<<'PY'
-import argparse
-import contextlib
-import errno
-import fcntl
-import hashlib
-import http.client
-import json
-import os
-import pathlib
-import platform
-import re
-import shutil
-import signal
-import stat
-import subprocess
-import sys
-import tarfile
-import tempfile
-import time
-import urllib.error
-import urllib.parse
-import urllib.request
-
-REPOSITORY = "MiniMax-AI/OpenAgentCore"
-API = "https://api.github.com/repos/" + REPOSITORY
-ARCHIVE = re.compile(r"oac-([0-9a-f]{40})-linux-amd64\.tar\.gz")
-
-
-class ReleaseError(Exception):
-    pass
-
-
-class TransferError(ReleaseError):
-    pass
-
-
-class Progress:
-    """Byte progress for the standalone downloader, without terminal escapes in logs."""
-    def __init__(self, label, total=None):
-        self.label, self.total = label, total
-        self.started = time.monotonic()
-        self.updated = 0
-        self.visible = sys.stderr.isatty() and os.environ.get("TERM") != "dumb"
-
-    def update(self, size):
-        now = time.monotonic()
-        if not self.visible or now - self.updated < 0.2 and size != self.total:
-            return
-        self.updated = now
-        bar = ""
-        if self.total:
-            percent = min(100, size * 100 // self.total)
-            filled = percent // 5
-            bar = "[" + "=" * filled + " " * (20 - filled) + f"] {percent:3d}% "
-        print(f"\r{self.label}: {bar}{size / 1048576:.1f} MiB ({now - self.started:.0f}s)",
-              end="\033[K", file=sys.stderr, flush=True)
-
-    def __enter__(self):
-        return self
-
-    def __exit__(self, *exc):
-        if self.visible:
-            with contextlib.suppress(OSError):
-                print(file=sys.stderr, flush=True)
-
-
-def retry(operation):
-    for attempt in range(3):
-        try:
-            return operation()
-        except (TransferError, TimeoutError, ConnectionError, http.client.HTTPException):
-            if attempt == 2:
-                raise ReleaseError("Download interrupted after 3 attempts. Check the network and rerun the command.") from None
-            print("==> Download interrupted; retrying...", flush=True)
-            time.sleep(attempt + 1)
-
-
-class DownloadRedirect(urllib.request.HTTPRedirectHandler):
-    def redirect_request(self, request, fp, code, msg, headers, newurl):
-        if urllib.parse.urlsplit(newurl).scheme != "https":
-            raise ReleaseError("Release downloads require HTTPS")
-        redirected = super().redirect_request(request, fp, code, msg, headers, newurl)
-        return redirected
-
-
-def open_url(url, binary=False, offset=0):
-    headers = {"Accept": "application/octet-stream" if binary else "application/vnd.github+json",
-               "User-Agent": "OpenAgentCore-installer", "X-GitHub-Api-Version": "2022-11-28"}
-    if offset:
-        headers["Range"] = f"bytes={offset}-"
-    request = urllib.request.Request(url, headers=headers)
-    try:
-        return urllib.request.build_opener(DownloadRedirect()).open(request, timeout=60)
-    except urllib.error.HTTPError as error:
-        if error.code in (408, 429, 500, 502, 503, 504):
-            error.close()
-            raise TransferError("Temporary GitHub download failure") from None
-        error.close()
-        if error.code in (401, 403, 404):
-            raise ReleaseError("Release unavailable. Check the version and GitHub access limits.") from None
-        raise ReleaseError("GitHub download failed (HTTP " + str(error.code) + "). Retry later.") from None
-    except urllib.error.URLError:
-        raise TransferError("Could not reach GitHub") from None
-
-
-def select_release(version):
-    endpoint = "/releases/latest" if version == "latest" else "/releases/tags/" + urllib.parse.quote(version, safe="")
-    def metadata():
-        with open_url(API + endpoint) as response:
-            raw = response.read(4 * 1024 * 1024 + 1)
-            length = getattr(response, "headers", {}).get("Content-Length")
-        if len(raw) > 4 * 1024 * 1024:
-            raise ReleaseError("Release metadata is too large")
-        if length is not None and len(raw) < int(length):
-            raise TransferError("Incomplete release metadata")
-        return json.loads(raw)
-    release = retry(metadata)
-    if (not isinstance(release, dict) or not isinstance(release.get("tag_name"), str)
-            or not isinstance(release.get("assets"), list)
-            or any(not isinstance(asset, dict) or not isinstance(asset.get("name"), str)
-                   for asset in release["assets"])):
-        raise ReleaseError("Invalid GitHub release metadata")
-    if release.get("draft") or (version == "latest" and release.get("prerelease")):
-        raise ReleaseError("Select a published release; latest excludes prereleases")
-    assets = release.get("assets", [])
-    bundles = [asset for asset in assets if ARCHIVE.fullmatch(asset["name"])]
-    if len(bundles) != 1:
-        raise ReleaseError("This release must contain exactly one Linux amd64 control-plane bundle")
-    bundle = bundles[0]
-    sums = [asset for asset in assets if asset["name"] == bundle["name"] + ".sha256"]
-    if len(sums) != 1:
-        raise ReleaseError("This release is missing its unique bundle checksum")
-    for asset in (bundle, sums[0]):
-        if type(asset.get("id")) is not int or asset["id"] <= 0:
-            raise ReleaseError("Invalid release asset identity")
-        if type(asset.get("size")) is not int or asset["size"] <= 0:
-            raise ReleaseError("Invalid release asset size")
-    return release["tag_name"], bundle, sums[0]
-
-
-def download(asset, destination, limit=None):
-    # Resolve latest once, then download only those immutable asset IDs.
-    expected = asset["size"]
-    if limit is not None and expected > limit:
-        raise ReleaseError("Release checksum file is too large")
-    require_space(destination.parent, expected)
-
-    def transfer():
-        offset = destination.stat().st_size if destination.exists() else 0
-        if offset == expected:
-            return
-        with open_url(API + "/releases/assets/" + str(asset["id"]), binary=True, offset=offset) as response:
-            status = getattr(response, "status", 200)
-            if status == 206:
-                match = re.fullmatch(r"bytes (\d+)-(\d+)/(\d+)", response.headers.get("Content-Range", ""))
-                if not match or tuple(map(int, match.groups())) != (offset, expected - 1, expected):
-                    raise ReleaseError("Invalid release download range")
-            elif status == 200:
-                offset = 0  # Servers may ignore Range; replace the partial file.
-            else:
-                raise ReleaseError("Unexpected release download response")
-            with destination.open("ab" if offset else "wb") as output:
-                size = offset
-                for chunk in iter(lambda: response.read1(1024 * 1024), b""):
-                    size += len(chunk)
-                    if size > expected:
-                        raise ReleaseError("Release download exceeds its declared size")
-                    output.write(chunk)
-                    progress.update(size)
-            if size != expected:
-                raise TransferError("Incomplete release download")
-    with Progress("Downloading checksum" if limit else "Downloading archive", expected) as progress:
-        retry(transfer)
-
-
-def require_space(directory, size):
-    if shutil.disk_usage(directory).free < size:
-        raise ReleaseError(f"Not enough disk space in {directory}; need {size} bytes available. Free space and rerun.")
-
-
-@contextlib.contextmanager
-def ignore_interrupts():
-    handlers = {number: signal.signal(number, signal.SIG_IGN)
-                for number in (signal.SIGINT, signal.SIGTERM, signal.SIGHUP)}
-    try:
-        yield
-    finally:
-        for number, handler in handlers.items():
-            signal.signal(number, handler)
-
-
-@contextlib.contextmanager
-def staging(cache):
-    # A stable lock makes one reserved staging directory safe to discard after a crash.
-    descriptor = os.open(cache / ".download.lock", os.O_CREAT | os.O_RDWR | os.O_NOFOLLOW, 0o600)
-    with os.fdopen(descriptor, "rb") as lock:
-        info = os.fstat(lock.fileno())
-        if not stat.S_ISREG(info.st_mode) or info.st_uid != os.getuid() or info.st_nlink != 1:
-            raise ReleaseError("Release download lock must be an owned regular file")
-        try:
-            fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
-        except BlockingIOError:
-            raise ReleaseError("Another release download is running; wait for it to finish and retry") from None
-        temporary = cache / ".download"
-        if temporary.exists() or temporary.is_symlink():
-            info = temporary.lstat()
-            if not stat.S_ISDIR(info.st_mode) or info.st_uid != os.getuid() or info.st_mode & 0o077:
-                raise ReleaseError("Release staging directory must be private and owned by you")
-            with ignore_interrupts():
-                shutil.rmtree(temporary)
-        try:
-            temporary.mkdir(mode=0o700)
-            yield temporary, lock.fileno()
-        finally:
-            with ignore_interrupts():
-                if temporary.exists():
-                    shutil.rmtree(temporary)
-
-
-def extract(archive, destination, stem):
-    seen = set()
-    unpacked = 0
-    with tarfile.open(archive, "r:gz") as source, Progress("Extracting") as progress:
-        for member in source:
-            path = pathlib.PurePosixPath(member.name)
-            if (not member.isfile() or path.is_absolute() or ".." in path.parts
-                    or "\\" in member.name or len(path.parts) < 2 or path.parts[0] != stem
-                    or path in seen):
-                raise ReleaseError("Release archive contains an unsafe or duplicate path")
-            seen.add(path)
-            require_space(destination, member.size)
-            target = destination.joinpath(*path.parts)
-            target.parent.mkdir(parents=True, exist_ok=True)
-            with source.extractfile(member) as data, target.open("xb") as output:
-                for chunk in iter(lambda: data.read(1024 * 1024), b""):
-                    output.write(chunk)
-                    unpacked += len(chunk)
-                    progress.update(unpacked)
-            target.chmod(member.mode & 0o777)
-    root = destination / stem
-    if not (root / "install.sh").is_file() or not (root / "manifest.json").is_file():
-        raise ReleaseError("Release archive is missing its installer or manifest")
-    return root
-
-
-def run_installer(root, arguments, lock):
-    """Wait for the installer to finish cleanup before removing its source bundle."""
-    child = None
-    interrupted = None
-
-    def forward(signum, frame):
-        nonlocal interrupted
-        if interrupted is not None:
-            return  # Let the installer finish cleanup despite repeated interrupts.
-        interrupted = signum
-        if child is not None:
-            with contextlib.suppress(ProcessLookupError):
-                os.killpg(child.pid, signum)
-
-    handlers = {number: signal.signal(number, forward)
-                for number in (signal.SIGINT, signal.SIGTERM, signal.SIGHUP)}
-    try:
-        # The child retains the lock if this downloader is killed without cleanup.
-        child = subprocess.Popen(["bash", str(root / "install.sh"), *arguments],
-                                 start_new_session=True, pass_fds=(lock,))
-        if interrupted is not None:
-            with contextlib.suppress(ProcessLookupError):
-                os.killpg(child.pid, interrupted)
-        code = child.wait()
-        if interrupted is not None:
-            raise KeyboardInterrupt
-        if code:
-            raise ReleaseError("Bundled installation failed; fix the reported cause and rerun the command")
-    finally:
-        for number, handler in handlers.items():
-            signal.signal(number, handler)
-
-
-def install(version, arguments):
-    if sys.version_info < (3, 9):
-        raise ReleaseError("Python 3.9+ is required")
-    if platform.system() != "Linux" or platform.machine() not in ("x86_64", "amd64"):
-        raise ReleaseError("Core installation currently requires Linux amd64")
-    home = pathlib.Path.home() / ".oac"
-    home.mkdir(mode=0o700, exist_ok=True)
-    cache = home / "releases"
-    cache.mkdir(mode=0o700, exist_ok=True)
-    info = cache.lstat()
-    if not stat.S_ISDIR(info.st_mode) or info.st_uid != os.getuid() or info.st_mode & 0o077:
-        raise ReleaseError("Release directory must be private and owned by your current account")
-    extracted = None
-    try:
-        with staging(cache) as (temporary, lock):
-            print("==> Finding the " + ("latest stable release" if version == "latest" else "requested release") + "...", flush=True)
-            tag, bundle, sums = select_release(version)
-            print("Installing OpenAgentCore " + tag, flush=True)
-            archive = temporary / bundle["name"]
-            checksum = temporary / sums["name"]
-            download(sums, checksum, limit=1024)
-            expected = checksum.read_text().strip()
-            match = re.fullmatch(r"([0-9a-f]{64})  " + re.escape(bundle["name"]), expected)
-            if not match:
-                raise ReleaseError("Invalid release checksum file")
-            print("==> Downloading the release archive (this may take a few minutes)...", flush=True)
-            download(bundle, archive)
-            print("==> Verifying the archive checksum...", flush=True)
-            digest = hashlib.sha256()
-            with archive.open("rb") as source, Progress("Verifying", bundle["size"]) as progress:
-                checked = 0
-                for chunk in iter(lambda: source.read(1024 * 1024), b""):
-                    digest.update(chunk)
-                    checked += len(chunk)
-                    progress.update(checked)
-            if digest.hexdigest() != match[1]:
-                raise ReleaseError("Release checksum mismatch; installation was not started")
-            stem = bundle["name"].removesuffix(".tar.gz")
-            print("==> Extracting the verified archive...", flush=True)
-            root = extract(archive, temporary, stem)
-            manifest = json.loads((root / "manifest.json").read_text())
-            if not isinstance(manifest, dict) or manifest.get("source_commit") != ARCHIVE.fullmatch(bundle["name"])[1]:
-                raise ReleaseError("Release source does not match its bundle")
-            archive.unlink()
-            checksum.unlink()
-            print("==> Starting the bundled installer...", flush=True)
-            run_installer(root, arguments, lock)
-            # Only a successful install retains a verified bundle for same-version repair.
-            extracted = pathlib.Path(tempfile.mkdtemp(prefix="release-", dir=cache))
-            root = root.rename(extracted / stem)
-        print("Verified bundle: " + str(root), flush=True)
-    except BaseException:
-        # A second signal or a closed terminal must not interrupt temporary-file cleanup.
-        with ignore_interrupts():
-            if extracted is not None:
-                shutil.rmtree(extracted)
-        raise
-
-
-def main(argv):
-    parser = argparse.ArgumentParser(
-        prog="install.sh", description="Install the latest OpenAgentCore release. Other arguments go to its installer.",
-        allow_abbrev=False)
-    parser.add_argument("--version", default="latest", help="Release tag (default: latest stable release)")
-    options, arguments = parser.parse_known_args(argv)
-    install(options.version, arguments)
-
-
-if __name__ == "__main__":
-    def interrupted(signum, frame):
-        raise KeyboardInterrupt
-    for signum in (signal.SIGINT, signal.SIGTERM, signal.SIGHUP):
-        signal.signal(signum, interrupted)
-    try:
-        main(sys.argv[1:])
-    except (ReleaseError, OSError, ValueError, tarfile.TarError, KeyboardInterrupt) as error:
-        message = "interrupted; rerun the same command" if isinstance(error, KeyboardInterrupt) else str(error)
-        if isinstance(error, OSError) and error.errno in (errno.ENOSPC, errno.EDQUOT):
-            message = "Disk space or quota exhausted. Free space in ~/.oac and rerun the command."
-        with contextlib.suppress(OSError):
-            print("Installation failed: " + message, file=sys.stderr)
-        sys.exit(130 if isinstance(error, KeyboardInterrupt) else 1)
-PY
diff --git a/deploy/install.dev.sh b/deploy/install.dev.sh
new file mode 100755
index 000000000..d52433a38
--- /dev/null
+++ b/deploy/install.dev.sh
@@ -0,0 +1,131 @@
+#!/usr/bin/env bash
+# Start this checkout. Core, Web and the init image are built here. Node
+# metadata still comes from the release named in deploy/compose/smoke-pins.json.
+# The published installer is install.sh.
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+install_dir="${OAC_INSTALL_DIR_DEFAULT:-$HOME/.oac/local}"
+host_address="127.0.0.1"
+web_port="8080"
+
+if [[ -x "$HOME/.oac/build/env-docker/docker" ]]; then
+  PATH="$HOME/.oac/build/env-docker:$PATH"
+fi
+
+usage() {
+  cat <<'EOF'
+Usage: install.dev.sh [--install-dir DIR] [--host ADDRESS] [--web-port PORT]
+
+Builds Core, Web and the init image from this checkout and starts them.
+Open http://localhost:<port> and sign in with the printed Core key.
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --install-dir) install_dir="${2:?}"; shift 2 ;;
+    --host) host_address="${2:?}"; shift 2 ;;
+    --web-port) web_port="${2:?}"; shift 2 ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo "Unknown argument: $1" >&2; usage >&2; exit 1 ;;
+  esac
+done
+
+if [[ "$(uname -s)" != Linux || "$(uname -m)" != x86_64 ]]; then
+  echo "Core installs on Linux amd64." >&2
+  exit 1
+fi
+command -v docker >/dev/null || { echo "Docker Engine with Compose is required." >&2; exit 1; }
+command -v go >/dev/null || { echo "Go is required to build this checkout." >&2; exit 1; }
+if [[ ! -f "$repo_root/apps/web/dist/index.html" ]]; then
+  echo "Build the console first: pnpm --dir apps/web build" >&2
+  exit 1
+fi
+if [[ "$install_dir" != /* ]]; then
+  echo "--install-dir must be absolute." >&2
+  exit 1
+fi
+
+mkdir -p "$install_dir/data"
+chmod 700 "$install_dir/data"
+build="$install_dir/image-build"
+rm -rf "$build"
+mkdir -p "$build"
+
+revision="$(git -C "$repo_root" rev-parse HEAD)"
+protocol="$(sed -n 's/^const Version = "\([^"]*\)".*/\1/p' "$repo_root/internal/agentdaemon/proto/version.go")"
+export CGO_ENABLED=0 GOOS=linux GOARCH=amd64
+
+go_build() {
+  mkdir -p "$(dirname "$2")"
+  go build -trimpath -ldflags "-X main.buildRevision=$revision" -o "$2" "./$1"
+}
+
+(
+  cd "$repo_root"
+  go_build services/core/cmd/server "$build/core/bin/oac-core"
+  go_build services/core/cmd/device "$build/core/bin/oac-core-device"
+  go_build services/core/cmd/environment-key "$build/core/bin/oac-core-environment-key"
+  go_build services/core/cmd/oac "$build/core/bin/oac"
+  go_build services/web "$build/web/oac-web"
+  go_build services/core/cmd/oac "$build/ingress/oac"
+)
+mkdir -p "$build/core/e2b" "$build/core/native-installers"
+python3 - "$build/core/native-installers/catalog.json" "$revision" "$protocol" <<'PY'
+import json, sys
+path, revision, protocol = sys.argv[1:]
+json.dump({"version": revision, "protocol_version": protocol, "artifacts": {"linux-amd64": {
+    "sha256": "0" * 64,
+    "url": f"https://example.invalid/oac-native-{revision}-linux-amd64.tar.gz"}}}, open(path, "w"))
+PY
+cp "$repo_root/deploy/distribution/Dockerfile" "$build/core/Dockerfile"
+cp "$repo_root/services/web/Dockerfile" "$build/web/Dockerfile"
+cp "$repo_root/deploy/distribution/Ingress.Dockerfile" "$build/ingress/Dockerfile"
+cp -a "$repo_root/apps/web/dist" "$build/web/dist"
+chmod -R a+rX "$build"
+
+tag="oac-local"
+docker build -q --platform linux/amd64 -t "$tag/core:dev" "$build/core" >/dev/null
+docker build -q --platform linux/amd64 -t "$tag/web:dev" "$build/web" >/dev/null
+docker build -q --platform linux/amd64 -t "$tag/ingress:dev" "$build/ingress" >/dev/null
+
+python3 - "$repo_root" "$install_dir" <<'PY'
+import importlib.util, json, sys
+from pathlib import Path
+root, dest = map(Path, sys.argv[1:])
+spec = importlib.util.spec_from_file_location("render", root / "scripts/render-compose.py")
+render = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(render)
+pins = json.loads((root / "deploy/compose/smoke-pins.json").read_text())
+(dest / "compose.yaml").write_text(render.render({
+    "REVISION": pins["revision"],
+    "RELEASE_BASE": pins["release_base"],
+    "ARCHIVE_CHECKSUM": pins["archive_checksum"],
+}))
+# The release ports.yaml also publishes Core on 127.0.0.1:8091. A local trial
+# reaches Core through Web, so only Web is published.
+(dest / "ports.yaml").write_text(
+    "services:\n  web:\n    ports:\n      - \"${OAC_HOST:-127.0.0.1}:${OAC_WEB_PORT:-8080}:8080\"\n")
+PY
+
+umask 077
+cat >"$install_dir/.env" <<EOF
+COMPOSE_PROJECT_NAME=oac-local
+COMPOSE_FILE=compose.yaml:ports.yaml
+OAC_DATA_DIR=$install_dir/data
+OAC_HOST=$host_address
+OAC_WEB_PORT=$web_port
+OAC_IMAGE_CORE=$tag/core:dev
+OAC_IMAGE_WEB=$tag/web:dev
+OAC_IMAGE_INGRESS=$tag/ingress:dev
+EOF
+
+(
+  cd "$install_dir"
+  docker compose up -d --wait --wait-timeout 900
+  echo
+  echo "Open http://localhost:$web_port"
+  echo "Core key:"
+  docker compose exec -T web /usr/local/bin/oac-web core-key
+)
diff --git a/deploy/install.sh b/deploy/install.sh
new file mode 100755
index 000000000..46c207acb
--- /dev/null
+++ b/deploy/install.sh
@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# Install Core and Web from one release's Compose files. The host needs Docker.
+set -euo pipefail
+
+repository="${OAC_REPOSITORY:-MiniMax-AI/OpenAgentCore}"
+version="latest"
+install_dir="${OAC_INSTALL_DIR_DEFAULT:-$HOME/.oac/core}"
+public_url=""
+host_address="0.0.0.0"
+web_port="8080"
+kept=0
+
+usage() {
+  cat <<'EOF'
+Usage: install.sh [--version TAG] [--install-dir DIR] [--public-url URL]
+                  [--host ADDRESS] [--web-port PORT]
+
+Installs Core, Web and PostgreSQL, and publishes Web on --web-port. HTTPS is
+terminated by your reverse proxy or hosting platform.
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --version) version="${2:?}"; shift 2 ;;
+    --install-dir) install_dir="${2:?}"; shift 2 ;;
+    --public-url) public_url="${2:?}"; shift 2 ;;
+    --host) host_address="${2:?}"; shift 2 ;;
+    --web-port) web_port="${2:?}"; shift 2 ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo "Unknown argument: $1" >&2; usage >&2; exit 1 ;;
+  esac
+done
+
+if [[ "$(uname -s)" != Linux || "$(uname -m)" != x86_64 ]]; then
+  echo "Core installs on Linux amd64." >&2
+  exit 1
+fi
+command -v docker >/dev/null || { echo "Docker Engine with Compose 2.26 or newer is required." >&2; exit 1; }
+command -v curl >/dev/null || { echo "curl is required." >&2; exit 1; }
+compose_version="$(docker compose version --short 2>/dev/null | sed 's/^v//' || true)"
+major="${compose_version%%.*}"
+minor="${compose_version#*.}"
+minor="${minor%%.*}"
+if [[ ! "$major" =~ ^[0-9]+$ || ! "$minor" =~ ^[0-9]+$ ]] || (( major < 2 || (major == 2 && minor < 26) )); then
+  echo "Docker Compose 2.26 or newer is required (found ${compose_version:-none})." >&2
+  exit 1
+fi
+if [[ "$install_dir" != /* ]]; then
+  echo "--install-dir must be absolute." >&2
+  exit 1
+fi
+if [[ -e "$install_dir" ]] && [[ -n "$(ls -A "$install_dir" 2>/dev/null || true)" ]]; then
+  echo "Installation directory is not empty: $install_dir" >&2
+  exit 1
+fi
+
+port_busy() {
+  local port="$1"
+  if command -v ss >/dev/null; then
+    if ss -ltn | awk '{print $4}' | grep -Eq "(^|:|\\])${port}$"; then
+      return 0
+    fi
+    return 1
+  fi
+  (echo >/dev/tcp/127.0.0.1/"$port") >/dev/null 2>&1
+}
+if port_busy "$web_port"; then echo "Port $web_port is already in use." >&2; exit 1; fi
+asset_base="https://github.com/${repository}/releases/latest/download"
+if [[ "$version" != latest ]]; then
+  asset_base="https://github.com/${repository}/releases/download/${version}"
+fi
+
+cleanup() {
+  if [[ "$kept" != 1 && -d "$install_dir" ]]; then
+    (cd "$install_dir" && docker compose down --remove-orphans) >/dev/null 2>&1 || true
+    rm -rf "$install_dir"
+  fi
+}
+trap cleanup EXIT
+
+mkdir -p "$install_dir"
+chmod 700 "$install_dir"
+files=(compose.yaml ports.yaml)
+curl --fail --silent --show-error --location "$asset_base/compose-sha256sums.txt" --output "$install_dir/compose-sha256sums.txt"
+for name in "${files[@]}"; do
+  curl --fail --silent --show-error --location "$asset_base/$name" --output "$install_dir/$name"
+done
+(cd "$install_dir" && sha256sum --check --ignore-missing --quiet compose-sha256sums.txt)
+
+compose_file="$(IFS=:; echo "${files[*]}")"
+umask 077
+{
+  echo "COMPOSE_PROJECT_NAME=oac-$(od -An -N5 -tx1 /dev/urandom | tr -d ' \n')"
+  echo "COMPOSE_FILE=$compose_file"
+  echo "OAC_INSTALL_DIR=$install_dir"
+  echo "OAC_HOST=$host_address"
+  echo "OAC_WEB_PORT=$web_port"
+  if [[ -n "$public_url" ]]; then echo "OAC_PUBLIC_URL=$public_url"; fi
+} >"$install_dir/.env"
+
+(
+  cd "$install_dir"
+  docker compose pull
+  docker compose create core
+  docker compose cp core:/usr/local/bin/oac ./oac
+  chmod 755 ./oac
+  docker compose up -d --wait
+)
+kept=1
+trap - EXIT
+address="http://${host_address}:$web_port"
+if [[ -n "$public_url" ]]; then address="$public_url"; fi
+if [[ "$host_address" == 0.0.0.0 || "$host_address" == "::" ]]; then address="http://<this-host>:$web_port"; fi
+cat <<EOF
+OpenAgentCore is running.
+Console: $address
+Core key: $install_dir/oac core-key --show
+Manage the installation with $install_dir/oac.
+EOF
diff --git a/deploy/install/README.md b/deploy/install/README.md
deleted file mode 100644
index 48f2301ce..000000000
--- a/deploy/install/README.md
+++ /dev/null
@@ -1,149 +0,0 @@
-# Installer design rules
-
-This directory holds the Core/Web installer, the `oac` command and the node installer. The self-hosted daemon installer (`oac-daemon install`) lives in `apps/daemon/internal/cli`; its rules are in [Native daemon installer](#native-daemon-installer). These are the rules to keep when you change them. Operator usage is in the [installation guide](../../docs/getting-started/install.md), the [node guide](../../docs/getting-started/nodes.md) and the [self-hosted guide](../../docs/getting-started/self-hosted.md); the version policy is in [Operations](../../docs/getting-started/operations.md#installation-version-policy). Building and publishing distributions is in the [maintainer guide](../../docs/maintainers.md). `make check-distribution` runs this directory's tests.
-
-| Module | Role |
-| --- | --- |
-| `install.sh`, `install.py` | Core/Web installer: host checks, fresh installation and same-bundle repair |
-| `oac_cli.py` | The `oac` command (`status`, `start`, `stop`, `apply`, `domain`, `rotate-core-key`, `uninstall`), packaged as `oac.pyz` |
-| `config.schema.json`, `config_model.py` | The `config.json` schema, its defaults and the subset validator |
-| `configuration.py` | Everything under `generated/` and the service input digests |
-| `ingress.py`, `ingress_config.py` | Managed HTTPS gateway and the domain operation |
-| `native_service.py` | Native Core as a systemd user service |
-| `native_installers.py` | Retains the native daemon installer catalog and offline archives |
-| `sandbox_setup.py` | The install-time sandbox selection through Core's administrator API |
-| `distribution.py` | Shared manifest verification, verified downloads and image identity |
-| `node_install.py`, `node_spec.py`, `node_generations.py` | Node installer and generation helper, packaged as `node-install.pyz` |
-| `install_display.py`, `install_output.py`, `node_output.py` | Shared terminal formatting and completion guidance |
-| `model_provider_sessions.py` | Read-only count of Sessions without a frozen model provider |
-| `installer_fakes.py`, `acceptance.py`, `test_*.py` | Test fakes, opt-in real-model acceptance and tests |
-
-## Scope
-
-- Installers prepare hosts and services. Core alone owns Session allocation, initialization, cancellation, snapshots and cleanup. No installer creates an execution Session or supplies a model credential.
-- The Core/Web installer never adds its own host as a node, imports no Runtime image and gives Core neither the Docker socket nor host devices. Nodes are added afterwards from Web, this host included.
-- Ingress is an installation concern, independent of Runtime and Sandbox Provider selection.
-- A repeated installation or repair never changes provider identity, the backend namespace or native history. The database, Projects and their keys, provider identity and the credential encryption key survive repair.
-- Recovery never deletes data and never prunes containers, volumes or images. Only a [new installation's own cleanup](#new-installations) and [`oac uninstall`](#uninstall) remove anything.
-- Do not add another launcher, scheduler, supervisor or recovery path.
-
-## Configuration and apply
-
-- Every process setting has one home: the installation's private `config.json`, described by `config.schema.json`. Keep the schema, `config_model.py`, the generator and the reference tables that `scripts/config-reference.py` renders into [configuration](../../docs/configuration.md) and [installation options](../../docs/getting-started/install-options.md) in step.
-- `make generate-harness-catalog` projects the [built-in Harness catalog](../../internal/harnessconfig/builtin/catalog.json) and adapter-owned Go provider declarations into `harness_catalog.py`. `make check-harness-catalog` checks its freshness, schema enum membership and process-default membership. `acceptance.py` uses this projection to validate its explicitly selected campaign combinations and token-limit requirements; adding catalog support does not expand the live acceptance campaign. These acceptance modules run from the checkout; installed configuration and `oac.pyz` use the checked schema.
-- Installation flags only seed `config.json`. A rerun of the installer over a complete installation accepts only `--install-dir` and repairs.
-- `oac apply` validates `config.json`, derives `generated/` and converges on what actually runs. Each service carries the digest of its inputs (Compose label `io.oac.inputs`, native `OAC_INPUTS`), and exactly the services whose running inputs differ are recreated or restarted. Decide restarts from what runs, never from recorded bookkeeping, so the next apply finishes an interrupted one. Apply contacts running services at the last applied address before changing listeners.
-- Health checks, setup, apply and generated service files derive addresses from the same `config.json`. `host` selects the gateway listener for managed ingress and the Core and Web listeners for external ingress. A non-loopback external bind requires an HTTPS public origin.
-- `configuration.listeners` lists every host listener from the same helpers that render the port mappings and listen addresses, so port checks and real binds cannot diverge. A new installation checks them all before it hashes the bundle or loads images, and `oac apply` checks those a change adds before it touches a service; the installation's own listeners do not count. The probe binds with `SO_REUSEADDR`, as the services do. Where a port overlaps one of the installation's own listeners, or the account may not bind a port below 1024, it reads the kernel's listening sockets instead.
-- Runtime settings stay in PostgreSQL and change through Web or `/core/v1`. Secrets live once each in `secrets/`; identity and installation facts live in the tool-written `state.json` (format 2, with an `oac-` Compose project). `config.json` has its own format, 1.
-- Core reads only its environment and has no configuration loader; it serves the non-secret snapshot at `GET /core/v1/installation`. Do not add a second operator configuration file, loader precedence, hot reload, fallback to earlier setting names or an embedded Core node.
-- Names: Core settings use `OAC_*`, Web settings `OAC_WEB_*`, shared Go logging `OAC_LOG_*`. A renamed setting fails startup even when empty or when the new name is also set; report every matching name without its value. Executables are `oac-core`, `oac-core-migrate`, `oac-core-device`, `oac-core-environment-key`, `oac-node`, `oac-web`, and the Core-host E2B helper `oac-e2b-provider` under `/opt/oac/e2b` in the image. The default installation directory is `~/.oac/core`; generated files carry `x-oac` annotations.
-
-## Versions and the lock
-
-- Install only into an empty directory or over an [incomplete installation](#new-installations), or repair a complete installation of the same source revision. Require the current state format before changing installation files or services, and a matching source revision when repairing a complete installation. An incomplete installation of that state format is removed before installing the selected release, even when its source revision differs. Preserve data when those checks fail.
-- The packaged `oac.pyz` embeds its build revision and refuses a `state.json` whose `source_commit` differs.
-- The installer and every mutating `oac` command share `.oac.lock`. The installer holds it across creation, payload and launcher repair, and apply, calling the already-locked apply implementation without locking again. Never replace the lock file; its inode must stay stable. Only the cleanup of a new installation, with the directory the installer created, and `oac uninstall` unlink it, last and while holding it. `locked` refuses a lock whose path no longer names the file it locked.
-
-## New installations
-
-- An installation is complete after its first start: apply converged and the services are healthy. `create()` writes `state.json` before anything else, atomically, with the project name and `"complete": false`, and the installer sets it to `true` at that moment. A later failure, such as a refused sandbox selection, keeps the installation.
-- Until then, `oac apply`, `start`, `domain` and `rotate-core-key` and Web's domain setup refuse the installation and point to the installer and `oac uninstall`; `oac status` reports it. Only the installer starts an incomplete installation; the installer or `oac uninstall` removes it.
-- Any failure or interrupt (Ctrl-C, SIGTERM, SIGHUP) of an installation that is not complete runs `oac_cli.remove` before anything is printed, so a closed terminal can't stop it. The original error then goes on, and the installer prints it followed by `Nothing was kept; fix the problem and rerun the same command.` `remove` runs `docker compose -p <project> down --volumes --remove-orphans` from `/` without `COMPOSE_*` variables and with its output discarded, and deletes every file in the installation directory. The directory goes too when the installer created it; otherwise it stays with its lock. Loaded images stay.
-- The release downloader waits for the bundled installer in a separate process group. It forwards the first Ctrl-C, SIGTERM or SIGHUP and waits for cleanup before removing the temporary bundle; repeated signals do not interrupt that wait. The child inherits the download lock, so killing the downloader alone cannot expose its active files to another download.
-- `remove` touches only the `oac-<10 hex digits>` project named in `state.json`, and never follows a link. `state.json`, then the `oac` command, then `.oac.lock` are removed last, and the files stay when a service can't be removed, so the next run still recognizes the installation and no other command locks it afresh mid-removal. Those final unlinks ignore SIGINT, SIGTERM and SIGHUP; if the command cannot be unlinked, cleanup restores `state.json` for a retry. SIGKILL or power loss during those final unlinks can leave files that need manual removal. The error lists what is left and the commands that remove it; the printed Compose command uses the same directory and environment isolation as automatic cleanup.
-- A rerun over an incomplete installation, a `state.json` without `"complete": true`, removes it the same way under the lock and then checks the settings and ports and installs with the flags given now. Only that explicit marker proves completion. A directory without `state.json` is refused whatever it holds, and nothing in it is removed.
-
-## Uninstall
-
-- `oac uninstall` is the only uninstall entry point; only the installed `oac` matches its release's layout, so there is no uninstall script. It needs only `state.json`, accepts complete and incomplete installations alike, and calls `remove` with image removal and without `keep_root`. Without `state.json` it removes nothing and says so. The operator guide is [Uninstall](../../docs/getting-started/operations.md#uninstall).
-- It removes each image `state.json` records unless a tag names it or a container of any project uses it, and reports those it keeps. The installer loads images untagged, so either means something outside the installation uses the image. It never forces an image removal, and runs Docker as `remove` runs Compose.
-- Before confirmation it prints what it removes and, when Core answers, the nodes and the number of sandboxes in use that Core lists, with a warning that uninstall stops no sandbox; E2B sandboxes keep running and billing. It then needs the typed directory or `--yes`; without a terminal only `--yes` confirms. It never contacts a node or a sandbox provider; afterwards it prints the nodes' `--force` uninstall command with the installation ID.
-
-## Install-time sandbox selection
-
-After the services are healthy, the installer posts `/core/v1/sandbox/deployment` once for microsandbox at Web's Standard size, as Web's setup would, and never on a repair. The choice is not written to `config.json`; PostgreSQL owns it, and an existing database selection is never overwritten.
-
-- microsandbox uses Web's Standard size from `apps/web/src/features/sandbox/standard-sizes.json`, which the distribution build copies into the bundle. Keep no other copy of those values.
-- A selection with a loopback `public_url` is saved, but no node can serve it until `public_url` is guest-reachable HTTPS.
-
-## Accounts and permissions
-
-- The Core/Web installer runs as the launching account, root included, in a writable installation directory. It never invokes sudo, switches accounts or changes Docker permissions. Check the actual platform, Docker and directory prerequisites; root alone is no reason to refuse.
-- Installation state and secrets are private under `~/.oac/`. No credential enters build arguments, image layers, browser bundles or diagnostic output. The Compose file is confidential.
-- The distribution build uses umask 022 so non-root service users can read the payload; installation credentials and state keep their private modes.
-
-## Managed HTTPS
-
-A default installation adds two Compose services from one pinned image: `gateway` runs Caddy, and `installation` runs the packaged `oac domain-server`. The latter runs with the installing account's UID and its Docker socket access and calls the same locked apply implementation. Its only request surface is the private `ingress/api/api.sock`, with Core-key authentication and one typed domain action. Core and Web get no Docker socket, host process authority or writable installation configuration. Web gets only the private API socket directory, never Caddy's admin socket.
-
-- The gateway publishes the initial Web port, and ports 80 and 443 only for HTTPS (`ingress_config.published`). Caddy issues and renews certificates and keeps its private data in `ingress/data`. `generated/Caddyfile` is derived from `config.json`, and apply reloads it through the private Caddy socket even when container inputs already match.
-- A domain change first checks that the hostname resolves and that no other program holds port 80 or 443; ports the gateway publishes while it runs as written are its own. It confirms a public URL change from the applied address, because it returns Core there before switching. It keeps the old entry point while the common apply renders the candidate address: the gateway publishes 80 and 443 and serves the candidate, and the verification needs a trusted certificate and an installation-specific response over HTTPS. Only then does it set `public_url` and apply again. Failure restores the previous configuration, including the gateway without 80 and 443 when HTTPS was off, and reports incomplete recovery; failed retries restore through the common apply even after a partial change.
-- The operation record keeps the last successfully applied public address. Apply and start update it after gateway verification and service health checks; generated files alone never prove that a new address is active. A successful apply reconciles the domain operation status after verifying the running services.
-- The domain operation refuses unrelated pending `config.json` edits and shares `.oac.lock` with the CLI. Its status file is bookkeeping and the recovery receipt; `config.json` stays the source of desired settings. An interrupted operation keeps its desired files and a visible failure and retry state; it never creates another service project or deletes execution data.
-- A Web restart ends console sessions, so the UI gives the new HTTPS sign-in address instead of treating a dropped request as success.
-- Split and native installations use external ingress and report that automatic Web domain setup is unavailable.
-
-## Output
-
-- Progress describes the operation about to run. Release downloads and archive hashing show byte percentages; extraction shows bytes processed, and quiet bundle verification and image loading show elapsed time. Dynamic output is terminal-only; redirected logs stay plain. Do not imply fresh health checks on a no-change repair.
-- Terminal styling is optional: honor `NO_COLOR` and keep redirected logs plain.
-- Summaries show credential file locations, never their values.
-- `install_display.py` owns shared terminal formatting; `install_output.py` and `node_output.py` own the completion guidance. Ship and checksum the display modules in both the node bootstrap and its retained helper.
-- A node summary reports success only after Core connection and provider readiness are confirmed.
-- Output from the service account stays plain and passes through the terminal-control sanitizer.
-
-## Node installer
-
-The node installer runs as root and prepares the host for one node per installation.
-
-- It creates or adopts the `oac-node` system user, adds it to the `docker` or `kvm` group (no other group), and installs one root-owned system service per installation that runs the node program as `User=oac-node`. Nodes on a host share that account, so a host serves one Core.
-- Docker group membership makes that user, and so the node, root-equivalent on the host; that is inherent to Docker sandboxes. microsandbox needs only `kvm`, user KVM access and the Linux runtime libraries.
-- Node configuration and identity live under `~/.oac/nodes/<installation-id>/` in the node account's home (`/var/lib/oac-node`); microsandbox uses a separate short private Runtime home.
-- The node service owns its provider processes outside the Core container. `KillMode=process` keeps resident microVM and helper processes across a service restart. The service restarts after failures with no start limit, so a node outlasts a Core outage, and stops restarting when the node program exits 78 because Core answered 401 to its credential (a removed node).
-- It never installs Docker, KVM or packages and never changes device permissions. It refuses SELinux-enforcing hosts and changes nothing when a check fails. The enrollment token comes only on standard input, never in arguments or the environment.
-- Files the service account owns are read, written and deleted only with that account's credentials. The one exception is root removing the account's home after `userdel`, when no process can still run as that account. That work runs in a child that starts its own session with `/dev/null` as input, joins a new session keyring and dies with its parent; root shows its output only as plain text (terminal controls become `?`). SIGINT, SIGHUP and SIGTERM stop that child and what it started.
-- Root never runs a file the service account can write, opens a URL it wrote, or follows a link in its home. Capture the trusted bootstrap bytes before dropping to the service account and pass them through the fork; the service account writes its own retained generation helper. Never open the caller's private download directory to it or let root write into service-owned state.
-- The generated bootstrap passes only the six standard HTTP/HTTPS proxy and bypass variables through sudo and gives both spellings the lowercase value when present, even if empty, so curl, urllib and the Go registration command follow the same rules. The installation child keeps just those names beside its fixed environment. Proxy values stay out of arguments, saved configuration, service units and diagnostics; never use broad sudo environment inheritance. This covers installation downloads only, not the node service.
-- `--uninstall` removes a node only after Core rejects its credential, except for a node that never registered and with `--force`, which Web offers when the old Core address no longer responds. It never touches sandboxes, volumes or images (the Runtime image and the microsandbox store stay), deletes the account only when the installer created it and no node remains, and otherwise removes only the groups it added.
-- Refuse resources of an older product name for the same installation ID; never adopt them or remove another installation's resources.
-
-## Download contract
-
-The distribution manifest is the one download contract for the Core and node installers: flat versioned file names, and the compressed and unpacked size and SHA-256 of the Runtime. The self-hosted counterpart is the native `catalog.json`, which Core serves as one `<platform>.sha256` per installer archive.
-
-- The default installation downloads the Core, Web and PostgreSQL payloads, never the Runtime image or node execution artifacts. Core's image never acquires execution-only payloads. The offline archive stays an explicit option.
-- A node obtains bootstrap metadata from the console that generated its command, or from a local offline bundle. Web serves artifacts it has locally and redirects missing declared execution artifacts to the versioned HTTPS release base in the verified manifest. Web never downloads or caches those bytes.
-- Only artifact requests may follow HTTPS redirects, and only without credentials or cookies. Metadata and enrollment requests stay on the configured console. The console publishes only fixed non-secret files and declared artifact names.
-- Download into private temporary files, verify size and SHA-256 before an atomic rename, resume interrupted transfers, and reuse only verified cache entries or exact image identities. Never select a release other than the pinned one.
-- Python zipapps bundle the shared resolver with each remote bootstrap. The node asset is the `oac-node` binary.
-- The public release bootstrap retries transient network failures up to three times and resumes an interrupted asset within that run, using its immutable ID, declared size and final checksum. It checks free space before downloading and before extracting each file. These checks cannot reserve storage or measure a remote Docker engine's disk.
-- The bootstrap serializes downloads with `~/.oac/releases/.download.lock`. It discards the private `.download/` staging directory left by an interrupted run before accessing the network, never another active downloader's files. Failed downloads and installations remove staging; only a successful installation retains its verified bundle for repair. Loaded Docker images follow the installation cleanup rule above.
-- Release downloads are anonymous. Never add repository credentials to installed node or Runtime configuration.
-- Manual builds use the `build-<full SHA>` release tag and tag builds the `v*` tag. The manifest's download base must match the release tag; artifact file names and source provenance keep the full source SHA.
-
-## Image identity
-
-The manifest's `images` records each exported image's config digest, and `image_manifest_digests` its OCI manifest or index digest. Derive and verify both from the same archive, including its referenced config and layer bytes, and require the build host's selected image ID to match one of them.
-
-Docker's classic image store identifies images by config digest, and its containerd store by the OCI descriptor. The build therefore takes the digest the local store resolves from BuildKit's build metadata, never the `--iidfile` config digest alone, and disables provenance attestations so each image and archive holds one platform manifest in both stores. For the same reason the default PostgreSQL image is pinned by its linux/amd64 platform manifest digest: a pulled multi-platform tag keeps its whole index in the containerd store, and its export holds every platform.
-
-The Core and node installers share one resolver for these identities. It confirms Linux amd64 and the returned immutable local ID, and service and provider configuration and Runtime launches use that ID. Tags never replace identity verification. The microsandbox `runtime_ref` is independent of Docker's local store identity.
-
-## Native daemon installer
-
-`oac-daemon install` installs the daemon and selected Harnesses on a self-hosted Linux, macOS or Windows machine; the [credential contract](../../contracts/agents-api/environment-executor-credentials.md#installation-grant) covers the grant it claims.
-
-- Interactive selection and CLI-only installation share one options and validation path. There is no installation-options file. The saved installation state and explicitly supplied credential and tool-variable files serve runtime operation, not a second configuration language.
-- Each release bundles pinned Node.js and npm, the native Harnesses and their adapter assets. Registration lives in the CLI, and native activation and readiness in each adapter's optional `agent.Installation` descriptor. Core never selects native paths or OS-specific steps.
-- Bootstrap scripts only download and extract the current platform's archive, after verifying the checksum Core provides. Installation, startup, connection verification and execution stay common. Native bundles must match Core's source revision and Runtime wire version.
-- Neither Core installation nor repair downloads native payloads. The Core installer keeps the catalog and any offline archives in the installation's private `native-installers/` directory and mounts it read-only into Core. Core serves the local offline archives or redirects to the catalog URL without proxying or caching; it verifies local archives when it starts, and a corrupt local archive stops Core from starting.
-- Every mutation holds the installation directory lock. Publish complete, checksum-verified components from staging, then commit the configuration after native readiness passes. A rerun with the same connection settings adds the selected Harnesses and validates existing contents. Never overwrite, upgrade, repair or migrate installed components; missing, modified, wrong-platform or incompatible content is an explicit error. A partial addition keeps the old configuration and reusable complete components and removes nothing.
-- Serialize background PID inspection and publication so concurrent starts cannot create two daemons. An installed daemon registers only the adapter kinds its verified installation manifest names; other Harness executables on `PATH` cannot extend it. Direct `connect` refuses an installed Runtime and points to `start`.
-- The installer runs as the current user in writable directories and never elevates. Subprocess diagnostics never expose sensitive parameters or environment values. Readiness checks take the installer's cancellation context and reap their processes before returning.
-- Report installation, authenticated connection and model configuration as separate results. Starting execution never downloads or installs Harnesses. Stop and reconnect keep capability snapshots and native Session state.
-- `scripts/build-native-installer.mjs` validates pins and startup, hashes every component file, accepts only contained regular files and rejects escaping links. Before it packages Claude, the `native-check` workflow reinstalls the frozen `pnpm deploy` export with the hoisted linker, so flattening contained links keeps Node's dependency resolution; the Runtime image's Claude archive is unchanged. The `native-check` workflow builds and tests installation, addition and reuse, missing arguments and the unsupported Windows MiniMax case on Linux, macOS and Windows.
-
-## Validation
-
-`make check-distribution` covers the production proxy, the installation rules, release metadata and native catalog assembly, including bundle manifests larger than Node's default subprocess buffer (catalog assembly reads up to 64 MiB). Diagnostics report observed service health, never fabricated model or environment readiness. Runtime observations belong to Core; do not add monitoring or lifecycle tracking to the installer.
diff --git a/deploy/install/config.schema.json b/deploy/install/config.schema.json
deleted file mode 100644
index 0afac9169..000000000
--- a/deploy/install/config.schema.json
+++ /dev/null
@@ -1,233 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "title": "OpenAgentCore installation configuration",
-  "description": "Process settings of one installation. Edit config.json, then run oac apply.",
-  "type": "object",
-  "additionalProperties": false,
-  "required": ["format"],
-  "properties": {
-    "$schema": {
-      "type": "string",
-      "description": "Editor hint that points at the installed copy of this schema. Ignored.",
-      "x-oac": {"setting": false}
-    },
-    "format": {
-      "const": 1,
-      "description": "Configuration format for this release. Fixed after installation.",
-      "x-oac": {"setting": false, "changeable": false}
-    },
-    "public_url": {
-      "type": ["string", "null"],
-      "default": null,
-      "description": "Canonical public origin of Core and Web. With managed ingress, set the DNS hostname in Web or run oac domain; certificates are automatic. With external ingress, configure your TLS reverse proxy before applying this value.",
-      "x-oac": {
-        "check": "origin",
-        "restarts": ["core", "web"],
-        "derives": ["OAC_PUBLIC_URL", "OAC_WEB_ORIGIN"],
-        "install_flag": "--public-url"
-      }
-    },
-    "host": {
-      "type": "string",
-      "default": "127.0.0.1",
-      "description": "Listener IP. With managed ingress only the gateway is public; Core stays on loopback. The default installer listens on all IPv4 interfaces.",
-      "x-oac": {
-        "check": "listen_host",
-        "restarts": [
-          "core",
-          "web"
-        ],
-        "derives": [
-          "Core/Web port mappings or listen addresses"
-        ],
-        "install_flag": "--host"
-      }
-    },
-    "ports": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "core": {
-          "type": "integer",
-          "minimum": 1024,
-          "maximum": 65535,
-          "default": 8091,
-          "description": "Host port of the Core API.",
-          "x-oac": {
-            "restarts": ["core"],
-            "derives": ["Core port mapping"],
-            "install_flag": "--core-port"
-          }
-        },
-        "web": {
-          "type": "integer",
-          "minimum": 1024,
-          "maximum": 65535,
-          "default": 8080,
-          "description": "Host port of Web.",
-          "x-oac": {
-            "restarts": ["web"],
-            "derives": ["Web or gateway port mapping"],
-            "install_flag": "--web-port"
-          }
-        }
-      }
-    },
-    "log": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "level": {
-          "enum": ["debug", "info", "warn", "error"],
-          "default": "info",
-          "description": "Minimum log level of Core and Web.",
-          "x-oac": {"restarts": ["core", "web"], "derives": ["OAC_LOG_LEVEL"]}
-        },
-        "format": {
-          "enum": ["auto", "text", "json"],
-          "default": "auto",
-          "description": "Log format. auto writes text to a terminal and JSON otherwise.",
-          "x-oac": {"restarts": ["core", "web"], "derives": ["OAC_LOG_FORMAT"]}
-        },
-        "add_source": {
-          "type": "boolean",
-          "default": false,
-          "description": "Add the source file and line to each log record.",
-          "x-oac": {"restarts": ["core", "web"], "derives": ["OAC_LOG_ADD_SOURCE"]}
-        }
-      }
-    },
-    "core": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "execution_concurrency": {
-          "type": "integer",
-          "minimum": 1,
-          "maximum": 1024,
-          "default": 4,
-          "description": "Concurrent execution work units in Core. Unrelated to node sandbox capacity.",
-          "x-oac": {"restarts": ["core"], "derives": ["OAC_EXECUTION_CONCURRENCY"]}
-        },
-        "harnesses": {
-          "type": "array",
-          "minItems": 1,
-          "uniqueItems": true,
-          "items": {"enum": ["claude_sdk", "codex", "mcode"]},
-          "default": ["claude_sdk", "codex", "mcode"],
-          "description": "Harnesses that Sessions may select.",
-          "x-oac": {"restarts": ["core"], "derives": ["OAC_HARNESSES"]}
-        },
-        "default_harness": {
-          "enum": ["claude_sdk", "codex", "mcode"],
-          "default": "codex",
-          "description": "Harness used when a Session names none. It must be listed in core.harnesses.",
-          "x-oac": {"restarts": ["core"], "derives": ["OAC_DEFAULT_HARNESS"]}
-        },
-        "write_audit_retention": {
-          "type": "string",
-          "default": "2160h",
-          "description": "How long non-creation write history is kept, as a Go duration of at least 1h.",
-          "x-oac": {"check": "go_duration_min_1h", "restarts": ["core"], "derives": ["OAC_WRITE_AUDIT_RETENTION"]}
-        },
-        "oauth_trusted_origins": {
-          "type": "array",
-          "uniqueItems": true,
-          "items": {"type": "string", "x-oac": {"check": "https_origin"}},
-          "default": [],
-          "description": "Extra HTTPS origins trusted as private OAuth issuers.",
-          "x-oac": {"restarts": ["core"], "derives": ["OAC_OAUTH_TRUSTED_ORIGINS"]}
-        },
-        "database_pool": {
-          "type": "object",
-          "additionalProperties": false,
-          "properties": {
-            "max_conns": {
-              "type": ["integer", "null"],
-              "minimum": 1,
-              "default": null,
-              "description": "Maximum database connections. null keeps the driver default, max(4, CPU count).",
-              "x-oac": {"restarts": ["core"], "derives": ["pool_max_conns in OAC_DATABASE_URL"]}
-            },
-            "min_conns": {
-              "type": ["integer", "null"],
-              "minimum": 0,
-              "default": null,
-              "description": "Minimum idle database connections. null keeps the driver default, 0.",
-              "x-oac": {"restarts": ["core"], "derives": ["pool_min_conns in OAC_DATABASE_URL"]}
-            },
-            "max_conn_lifetime": {
-              "type": ["string", "null"],
-              "default": null,
-              "description": "Go duration. null keeps the driver default, 1h.",
-              "x-oac": {"check": "go_duration", "restarts": ["core"], "derives": ["pool_max_conn_lifetime in OAC_DATABASE_URL"]}
-            },
-            "max_conn_idle_time": {
-              "type": ["string", "null"],
-              "default": null,
-              "description": "Go duration. null keeps the driver default, 30m.",
-              "x-oac": {"check": "go_duration", "restarts": ["core"], "derives": ["pool_max_conn_idle_time in OAC_DATABASE_URL"]}
-            },
-            "health_check_period": {
-              "type": ["string", "null"],
-              "default": null,
-              "description": "Go duration. null keeps the driver default, 1m.",
-              "x-oac": {"check": "go_duration", "restarts": ["core"], "derives": ["pool_health_check_period in OAC_DATABASE_URL"]}
-            }
-          }
-        },
-        "runtime_history": {
-          "type": ["object", "null"],
-          "default": null,
-          "additionalProperties": false,
-          "description": "Runtime history collection and OTLP export. null keeps local collection with Core's defaults. Core checks the values at startup.",
-          "x-oac": {"restarts": ["core"], "derives": ["generated/runtime-history.json", "OAC_HISTORY_SETTINGS_FILE"]},
-          "properties": {
-            "transport": {
-              "type": "string",
-              "description": "OTLP export transport: `otlp_http`. Required with endpoint.",
-              "x-oac": {"restarts": ["core"]}
-            },
-            "endpoint": {
-              "type": "string",
-              "description": "OTLP/HTTP metrics URL: a canonical absolute URL with a path and no credentials, query or fragment; HTTPS, or HTTP with insecure. Omit it to keep history local; transport, insecure and headers then must be absent.",
-              "x-oac": {"restarts": ["core"]}
-            },
-            "insecure": {
-              "type": "boolean",
-              "description": "Export without TLS. Required for an HTTP endpoint and refused for HTTPS.",
-              "x-oac": {"restarts": ["core"]}
-            },
-            "headers": {
-              "type": "object",
-              "additionalProperties": {"type": "string"},
-              "description": "Headers sent with each export, such as credentials. Host, Content-Length, Content-Type and Content-Encoding are refused. Never shown by oac or Core.",
-              "x-oac": {"sensitive": true, "restarts": ["core"]}
-            },
-            "queue_capacity": {
-              "type": "integer",
-              "description": "Capacity of the history write queue and of the export queue, up to 4096. Omitted or 0 selects 256.",
-              "x-oac": {"restarts": ["core"]}
-            },
-            "timeout_seconds": {
-              "type": "integer",
-              "description": "History write, export and query timeout in seconds, up to 30. Omitted or 0 selects 2.",
-              "x-oac": {"restarts": ["core"]}
-            },
-            "sample_interval_seconds": {
-              "type": "integer",
-              "description": "Periodic sampling interval in seconds, 5 to 300. Omitted or 0 selects 30.",
-              "x-oac": {"restarts": ["core"]}
-            }
-          }
-        }
-      }
-    },
-    "ingress": {
-      "enum": ["managed", "external"],
-      "default": "external",
-      "description": "managed provides automatic HTTPS and Web domain setup; install.sh selects it by default. external uses your existing proxy. Fixed after installation.",
-      "x-oac": {"changeable": false, "install_flag": "--ingress"}
-    }
-  }
-}
diff --git a/deploy/install/config_model.py b/deploy/install/config_model.py
deleted file mode 100644
index 9ff9fc73a..000000000
--- a/deploy/install/config_model.py
+++ /dev/null
@@ -1,258 +0,0 @@
-"""The config.json model: a small JSON Schema subset, defaults and the settings snapshot.
-
-This deliberately implements only the keywords config.schema.json uses. It is not a
-general JSON Schema engine; a test fails if the schema uses any other keyword.
-"""
-import copy
-import json
-import os
-import re
-
-SERVICES = ("core", "web", "database")
-KEYWORDS = {"$schema", "title", "type", "enum", "const", "default", "description", "minimum", "maximum",
-            "pattern", "items", "minItems", "uniqueItems", "properties", "required",
-            "additionalProperties", "x-oac"}
-ANNOTATIONS = {"changeable", "restarts", "sensitive", "derives", "install_flag", "check", "setting"}
-
-
-def _schema_text():
-    # The loader reads from a directory or from inside the oac zipapp.
-    path = os.path.join(os.path.dirname(os.path.abspath(__file__)), "config.schema.json")
-    return __loader__.get_data(path).decode("utf-8")
-
-
-SCHEMA_TEXT = _schema_text()
-SCHEMA = json.loads(SCHEMA_TEXT)
-
-
-class ConfigError(Exception):
-    """Every problem found in config.json, each naming its key. Values are never included."""
-
-    def __init__(self, problems):
-        self.problems = list(problems)
-        super().__init__("config.json is not valid:\n" + "\n".join("  - " + item for item in self.problems))
-
-
-def annotation(node, name, default=None):
-    return node.get("x-oac", {}).get(name, default)
-
-
-def leaves(node=None, prefix=""):
-    """Yield (dotted key, schema node) for every leaf, in schema order."""
-    node = SCHEMA if node is None else node
-    for name, child in node["properties"].items():
-        key = prefix + name
-        if "properties" in child:
-            yield from leaves(child, key + ".")
-        else:
-            yield key, child
-
-
-def lookup(config, key):
-    value = config
-    for part in key.split("."):
-        if not isinstance(value, dict) or part not in value:
-            return None
-        value = value[part]
-    return value
-
-
-# Checks named by x-oac.check. Core stays the authority for its own semantic rules.
-def _origin(value, https_only=False):
-    """Core's deployment.ValidateCoreURL rule, through the installer's one implementation of it."""
-    from configuration import valid_core_origin  # configuration imports this module at load time
-    return valid_core_origin(value) and (not https_only or value.startswith("https://"))
-
-
-_DURATION_UNITS = {"ns": 1e-9, "us": 1e-6, "µs": 1e-6, "μs": 1e-6, "ms": 1e-3, "s": 1, "m": 60, "h": 3600}
-_DURATION_PART = re.compile(r"([0-9]*(?:\.[0-9]*)?)(ns|us|µs|μs|ms|s|m|h)")
-
-
-def duration_seconds(text):
-    """Seconds in a Go duration string, or None when Go would reject it."""
-    body = text[1:] if text[:1] in "+-" else text
-    if body == "0":
-        return 0.0
-    total, position = 0.0, 0
-    while position < len(body):
-        part = _DURATION_PART.match(body, position)
-        if not part or part[1] in ("", "."):
-            return None
-        total += float(part[1]) * _DURATION_UNITS[part[2]]
-        position = part.end()
-    if not body:
-        return None
-    return -total if text.startswith("-") else total
-
-
-def _listen_host(value):
-    from configuration import valid_listen_host
-    return valid_listen_host(value)
-
-
-CHECKS = {
-    "listen_host": (_listen_host, "must be an IPv4 or IPv6 address without a port or zone"),
-    "origin": (_origin, "must be a canonical origin such as https://core.example: lowercase, no path or "
-                        "trailing slash, and HTTP only for a loopback host"),
-    "https_origin": (lambda value: _origin(value, https_only=True), "must be a canonical HTTPS origin"),
-    "go_duration": (lambda value: duration_seconds(value) is not None, "must be a Go duration such as 30m or 1h"),
-    "go_duration_min_1h": (lambda value: (duration_seconds(value) or 0) >= 3600,
-                           "must be a Go duration of at least 1h"),
-}
-
-
-def _type_ok(value, name):
-    if name == "integer":
-        return isinstance(value, int) and not isinstance(value, bool)
-    return isinstance(value, {"string": str, "boolean": bool, "object": dict, "array": list,
-                              "null": type(None)}[name])
-
-
-def _validate(node, value, key, problems):
-    label = key or "config.json"
-    types = node.get("type")
-    if types is not None:
-        types = [types] if isinstance(types, str) else types
-        if not any(_type_ok(value, name) for name in types):
-            problems.append(f"{label}: must be {' or '.join(types)}")
-            return
-    if "const" in node and (value != node["const"] or type(value) is not type(node["const"])):
-        problems.append(f"{label}: must be {json.dumps(node['const'])}")
-        return
-    if "enum" in node and value not in node["enum"]:
-        problems.append(f"{label}: must be one of {', '.join(json.dumps(item) for item in node['enum'])}")
-        return
-    if _type_ok(value, "integer"):
-        if "minimum" in node and value < node["minimum"]:
-            problems.append(f"{label}: must be at least {node['minimum']}")
-        if "maximum" in node and value > node["maximum"]:
-            problems.append(f"{label}: must be at most {node['maximum']}")
-    if isinstance(value, str) and "pattern" in node and not re.search(node["pattern"], value):
-        problems.append(f"{label}: has an invalid format")
-    check = annotation(node, "check")
-    if check and isinstance(value, str) and not CHECKS[check][0](value):
-        problems.append(f"{label}: {CHECKS[check][1]}")
-    if isinstance(value, list):
-        if len(value) < node.get("minItems", 0):
-            problems.append(f"{label}: needs at least {node['minItems']} item(s)")
-        if node.get("uniqueItems") and len({json.dumps(item, sort_keys=True) for item in value}) != len(value):
-            problems.append(f"{label}: lists an item twice")
-        for index, item in enumerate(value):
-            _validate(node.get("items", {}), item, f"{label}[{index}]", problems)
-    if isinstance(value, dict):
-        properties = node.get("properties", {})
-        for name in node.get("required", []):
-            if name not in value:
-                problems.append(f"{key + '.' if key else ''}{name}: is required")
-        for name, item in value.items():
-            child = f"{key}.{name}" if key else name
-            if name in properties:
-                _validate(properties[name], item, child, problems)
-            elif isinstance(node.get("additionalProperties"), dict):
-                _validate(node["additionalProperties"], item, child, problems)
-            else:
-                problems.append(f"{child}: unknown key")
-
-
-def _complete(node, value):
-    for name, child in node.get("properties", {}).items():
-        if not annotation(child, "setting", True):
-            continue
-        if name not in value:
-            if "default" in child:
-                value[name] = copy.deepcopy(child["default"])
-            elif "properties" in child:
-                value[name] = {}
-            else:
-                continue
-        if isinstance(value[name], dict) and "properties" in child:
-            _complete(child, value[name])
-
-
-def validate(config):
-    """Return config with defaults filled in for every key, or raise ConfigError."""
-    if not isinstance(config, dict):
-        raise ConfigError(["config.json: must be a JSON object"])
-    problems = []
-    _validate(SCHEMA, config, "", problems)
-    if problems:
-        raise ConfigError(problems)
-    full = copy.deepcopy(config)
-    _complete(SCHEMA, full)
-    ports = full["ports"]
-    if len(set(ports.values())) != len(ports):
-        problems.append("ports: " + ", ".join(sorted(ports)) + " need different ports")
-    from configuration import loopback_listener
-    import ingress_config
-    managed = ingress_config.enabled(full)
-    if managed and full["public_url"]:
-        try:
-            from urllib.parse import urlsplit
-            origin = full["public_url"]
-            if origin != "https://" + ingress_config.hostname(urlsplit(origin).hostname):
-                raise ValueError()
-        except ValueError:
-            problems.append("public_url: managed HTTPS requires https:// followed by a DNS hostname, without a port")
-    if not managed and not loopback_listener(full["host"]) and not (full["public_url"] or "").startswith("https://"):
-        problems.append("public_url: an HTTPS origin is required when host is not loopback")
-    core = full["core"]
-    if core["default_harness"] not in core["harnesses"]:
-        problems.append("core.default_harness: must be listed in core.harnesses")
-    if problems:
-        raise ConfigError(problems)
-    return ordered(full)
-
-
-def ordered(config, node=None):
-    """The same content with keys in schema order, so written files read like the reference."""
-    node = SCHEMA if node is None else node
-    if not isinstance(config, dict) or "properties" not in node:
-        return config
-    result = {}
-    for name, child in node["properties"].items():
-        if name in config:
-            result[name] = ordered(config[name], child)
-    for name, value in config.items():
-        result.setdefault(name, value)
-    return result
-
-
-def initial(**values):
-    """Every field for a new installation, seeded from installer flags."""
-    config = {"$schema": "generated/config.schema.json", "format": 1}
-    for key, value in values.items():
-        if value is None:
-            continue
-        target = config
-        *parents, last = key.split(".")
-        for part in parents:
-            target = target.setdefault(part, {})
-        target[last] = value
-    return validate(config)
-
-
-def values(config):
-    """Every setting of a validated config, by dotted key."""
-    return {key: lookup(config, key) for key, node in leaves() if annotation(node, "setting", True)}
-
-
-def settings(config):
-    """The non-secret snapshot Core serves at GET /core/v1/installation."""
-    items = []
-    for key, node in leaves():
-        if not annotation(node, "setting", True):
-            continue
-        value = lookup(config, key)
-        sensitive = annotation(node, "sensitive", False)
-        item = {"key": key, "value": None if sensitive else value}
-        if sensitive:
-            item["configured"] = bool(value)
-        item.update({"default": node.get("default"), "changeable": annotation(node, "changeable", True),
-                     "sensitive": sensitive,
-                     "restarts": [name for name in annotation(node, "restarts", []) if name in SERVICES]})
-        items.append(item)
-    return items
-
-
-def sensitive_keys():
-    return [key for key, node in leaves() if annotation(node, "sensitive", False)]
diff --git a/deploy/install/configuration.py b/deploy/install/configuration.py
deleted file mode 100644
index a09a38139..000000000
--- a/deploy/install/configuration.py
+++ /dev/null
@@ -1,355 +0,0 @@
-"""Derive every file under generated/ from config.json, state.json and secrets/.
-
-Generated files hold no secret except runtime-history.json, which carries the
-operator's export headers. Secrets stay in secrets/, one copy each, and reach the
-services as read-only single-file mounts or file paths.
-"""
-import collections
-import hashlib
-import ipaddress
-import json
-from pathlib import Path
-import re
-from urllib.parse import urlencode, urlsplit
-
-import config_model
-import ingress_config
-
-# Where Core and Web containers see secrets and generated inputs.
-RUN = "/run/oac"
-POOL = (("max_conns", "pool_max_conns"), ("min_conns", "pool_min_conns"),
-        ("max_conn_lifetime", "pool_max_conn_lifetime"), ("max_conn_idle_time", "pool_max_conn_idle_time"),
-        ("health_check_period", "pool_health_check_period"))
-
-
-_HOST_LABEL = re.compile(r"[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?")
-
-
-def valid_core_origin(value):
-    """Accept exactly the origins Core's deployment.ValidateCoreURL accepts
-    (services/core/internal/deployment/public_url.go), so an
-    installer value never fails Core's OAC_PUBLIC_URL check at startup."""
-    if not isinstance(value, str) or any(char in value for char in "?#@\\% \t\r\n"):
-        return False
-    try:
-        parsed = urlsplit(value)
-    except ValueError:
-        return False
-    netloc = parsed.netloc
-    if (parsed.scheme not in ("http", "https") or value != parsed.scheme + "://" + netloc
-            or not netloc or netloc != netloc.lower() or netloc.endswith(":")):
-        return False
-    if netloc.startswith("["):
-        host, _, rest = netloc[1:].partition("]")
-        if rest and not rest.startswith(":"):
-            return False
-        port = rest[1:] if rest else ""
-    else:
-        host, _, port = netloc.partition(":")
-    if port and not (port.isdigit() and str(int(port)) == port and 1 <= int(port) <= 65535):
-        return False
-    try:
-        address = ipaddress.ip_address(host)
-        # Go's IsLoopback also counts an IPv4-mapped loopback address.
-        mapped = getattr(address, "ipv4_mapped", None)
-        loopback = address.is_loopback or bool(mapped and mapped.is_loopback)
-    except ValueError:
-        if netloc.startswith("[") or len(host) > 253 or not all(_HOST_LABEL.fullmatch(label) for label in host.split(".")):
-            return False
-        loopback = host == "localhost"
-    return parsed.scheme == "https" or loopback
-
-
-def environment_text(values, header):
-    """The Compose env_file subset: quoted, single-line literal values."""
-    lines = ["# " + header + "\n",
-             "# Values are literal. Escape backslash, double quote and dollar with backslash.\n"]
-    for key, value in values.items():
-        if (not isinstance(key, str) or not re.fullmatch(r"[A-Za-z_][A-Za-z0-9_]*", key)
-                or not isinstance(value, str) or any(char in value for char in "\x00\r\n")):
-            raise RuntimeError("Core environment requires valid names and single-line string values")
-        escaped = re.sub(r'([\\"$])', r'\\\1', value)
-        lines.append(key + '="' + escaped + '"\n')
-    return "".join(lines)
-
-
-def read_environment(text):
-    """Parse the environment_text format without shell or variable expansion."""
-    result = {}
-    for line in text.split("\n"):
-        if not line.strip() or line.lstrip().startswith("#"):
-            continue
-        match = re.fullmatch(r'([A-Za-z_][A-Za-z0-9_]*)="((?:[^\\"$\x00\r\n]|\\[\\"$])*)"', line)
-        if not match or match[1] in result:
-            raise RuntimeError("An environment file requires unique names and double-quoted literal values")
-        result[match[1]] = re.sub(r'\\([\\"$])', r'\1', match[2])
-    return result
-
-
-def bind(source, target, readonly=True):
-    return {"type": "bind", "source": str(source).replace("$", "$$"), "target": target, "read_only": readonly}
-
-
-def sha256(data):
-    return hashlib.sha256(data.encode() if isinstance(data, str) else data).hexdigest()
-
-
-def edit_hint(root):
-    return f"Generated from {Path(root) / 'config.json'}. Do not edit; change config.json and run {Path(root) / 'oac'} apply."
-
-
-def read_core_key(root):
-    """The Core key, checked the way Web checks it."""
-    key = (Path(root) / "secrets/core.key").read_text().strip()
-    if len(key) < 32 or any(char.isspace() or char == "\x00" for char in key):
-        raise RuntimeError("secrets/core.key must hold one Core key of at least 32 characters without whitespace")
-    return key
-
-
-def secret_digests(root):
-    return {name: sha256((Path(root) / "secrets" / name).read_bytes())
-            for name in ("core.key", "credential.key", "database.password")}
-
-
-def valid_listen_host(value):
-    try:
-        return "%" not in value and bool(ipaddress.ip_address(value))
-    except ValueError:
-        return False
-
-
-def loopback_listener(host):
-    address = ipaddress.ip_address(host)
-    mapped = getattr(address, "ipv4_mapped", None)
-    return address.is_loopback or bool(mapped and mapped.is_loopback)
-
-
-def service_host(config, service):
-    """The address Core or Web listens on; behind managed ingress Core stays on loopback."""
-    return str(ipaddress.ip_address("127.0.0.1" if service == "core" and ingress_config.enabled(config) else config["host"]))
-
-
-def service_address(config, service, connect=False):
-    """One derivation for listen addresses and local operator connections."""
-    host = service_host(config, service)
-    address = ipaddress.ip_address(host)
-    if connect and address.is_unspecified:
-        host = "::1" if address.version == 6 else "127.0.0.1"
-    if address.version == 6:
-        host = "[" + host + "]"
-    return f'{host}:{config["ports"][service]}'
-
-
-Listener = collections.namedtuple("Listener", "purpose host port setting")
-
-
-def listeners(config, candidate=None):
-    """Every host listener the services bind, from the addresses they are rendered with.
-
-    setting is the config.json key that owns the port. candidate is the address domain
-    setup verifies, as in render.
-    """
-    ports, result = config["ports"], []
-    if ingress_config.enabled(config):
-        # The gateway publishes Web's port and, for HTTPS, 80 and 443; Web itself publishes none.
-        result += [Listener("Web", config["host"], port, "ports.web") if port == ports["web"] else
-                   Listener("HTTPS", config["host"], port, "public_url")
-                   for port, _ in ingress_config.published(config, candidate)]
-    else:
-        result.append(Listener("Web", service_host(config, "web"), ports["web"], "ports.web"))
-    result.append(Listener("Core", service_host(config, "core"), ports["core"], "ports.core"))
-    return result
-
-
-def service_origin(config, service):
-    return "http://" + service_address(config, service, connect=True)
-
-
-def web_origin(config):
-    return config["public_url"] or service_origin(config, "web")
-
-
-def local_public_url(config):
-    """OAC_PUBLIC_URL: the public origin, or Core's loopback origin for local use."""
-    return config["public_url"] or service_origin(config, "core")
-
-
-def log_environment(log):
-    result = {"OAC_LOG_LEVEL": log["level"]}
-    if log["format"] != "auto":
-        result["OAC_LOG_FORMAT"] = log["format"]
-    if log["add_source"]:
-        result["OAC_LOG_ADD_SOURCE"] = "1"
-    return result
-
-
-def core_environment(root, config, state):
-    root = Path(root)
-    core = config["core"]
-    query = [("sslmode", "disable")] + [(name, str(core["database_pool"][key])) for key, name in POOL
-                                        if core["database_pool"][key] is not None]
-    result = {
-        "OAC_ADDR": ":8091",
-        "OAC_PUBLIC_URL": local_public_url(config),
-        "OAC_DATABASE_URL": "postgres://agents_api@database:5432/agents_api?" + urlencode(query),
-        "OAC_DATABASE_PASSWORD_FILE": RUN + "/database.password",
-        "OAC_CREDENTIAL_KEY_FILE": RUN + "/credential.key",
-        "OAC_CORE_KEY_DIGESTS_FILE": RUN + "/core-key-digests.json",
-        "OAC_INSTALLATION_ID": state["installation_id"],
-        "OAC_SETTINGS_FILE": RUN + "/settings.json",
-        "OAC_PROVIDER_ROOT": "/opt/oac",
-        "OAC_PROVIDER_STATE_ROOT": "/state",
-        "OAC_DEFAULT_HARNESS": core["default_harness"],
-        "OAC_HARNESSES": ",".join(core["harnesses"]),
-        "OAC_EXECUTION_CONCURRENCY": str(core["execution_concurrency"]),
-        "OAC_WRITE_AUDIT_RETENTION": core["write_audit_retention"],
-    }
-    if (root / "native-installers/catalog.json").is_file():
-        result["OAC_NATIVE_INSTALLER_DIR"] = "/opt/oac/native-installers"
-    if core["oauth_trusted_origins"]:
-        result["OAC_OAUTH_TRUSTED_ORIGINS"] = ",".join(core["oauth_trusted_origins"])
-    if core["runtime_history"] is not None:
-        result["OAC_HISTORY_SETTINGS_FILE"] = RUN + "/runtime-history.json"
-    result.update(log_environment(config["log"]))
-    return result
-
-
-def settings_document(root, config, applied_at):
-    root = Path(root)
-    return {"path": str(root / "config.json"), "apply_command": f"{root / 'oac'} apply",
-            "applied_at": applied_at, "settings": config_model.settings(config)}
-
-
-def compose_config(root, config, state, candidate=None):
-    root = Path(root)
-    identity = f'{state["uid"]}:{state["gid"]}'
-    images = state["images"]
-    doc = {"name": state["project"],
-           # Compose interpolates every string, extension fields included.
-           "x-oac": {"generated_from": str(root / "config.json").replace("$", "$$"),
-                        "edit": "config.json, then oac apply"},
-           "services": {}, "volumes": {"database": {}}}
-    services = doc["services"]
-    services["database"] = {
-        "image": images["database"], "restart": "unless-stopped",
-        "environment": {"POSTGRES_USER": "agents_api", "POSTGRES_DB": "agents_api",
-                        "POSTGRES_PASSWORD_FILE": "/run/secrets/database.password"},
-        "volumes": ["database:/var/lib/postgresql/data",
-                    bind(root / "secrets/database.password", "/run/secrets/database.password")],
-        "healthcheck": {"test": ["CMD-SHELL", "pg_isready -U agents_api -d agents_api"],
-                        "interval": "2s", "timeout": "5s", "retries": 30},
-    }
-    mounts = [bind(root / "secrets" / name, f"{RUN}/{name}") for name in ("credential.key", "database.password")]
-    if (root / "native-installers/catalog.json").is_file():
-        mounts.append(bind(root / "native-installers", "/opt/oac/native-installers"))
-    mounts += [bind(root / "generated" / name, f"{RUN}/{name}") for name in ("core-key-digests.json", "settings.json")]
-    if config["core"]["runtime_history"] is not None:
-        mounts.append(bind(root / "generated/runtime-history.json", f"{RUN}/runtime-history.json"))
-    shared = {"image": images["core"], "user": identity,
-              "env_file": [str(root / "generated/core.env").replace("$", "$$")], "volumes": mounts,
-              "read_only": True, "tmpfs": ["/tmp:mode=1777"], "init": True,
-              "security_opt": ["no-new-privileges:true"]}
-    services["migrate"] = dict(shared, command=["/usr/local/bin/oac-core-migrate"],
-                               depends_on={"database": {"condition": "service_healthy"}})
-    services["core"] = dict(shared, restart="unless-stopped", ports=[service_address(config, "core") + ":8091"],
-                            depends_on={"migrate": {"condition": "service_completed_successfully"}},
-                            volumes=mounts + [bind(root / "state/e2b", "/state/e2b", False)])
-    environment = {
-        "OAC_WEB_ORIGIN": web_origin(config),
-        "OAC_WEB_UPSTREAM": "http://core:8091",
-        "OAC_WEB_CORE_KEY_FILE": f"{RUN}/core.key",
-        "OAC_WEB_NODE_PAYLOAD_DIR": "/node-payload",
-    }
-    environment.update(log_environment(config["log"]))
-    web = {"image": images["web"], "user": identity, "restart": "unless-stopped",
-           "ports": [service_address(config, "web") + ":8080"], "read_only": True,
-           "security_opt": ["no-new-privileges:true"],
-           "volumes": [bind(root / "secrets/core.key", f"{RUN}/core.key"), bind(root / "node-payload", "/node-payload")],
-           "environment": environment}
-    if ingress_config.enabled(config):
-        web.pop("ports")
-        environment["OAC_WEB_INSTALLATION_SOCKET"] = "/installation/api.sock"
-        environment["OAC_WEB_BOOTSTRAP"] = "1" if not config["public_url"] else "0"
-        web["volumes"].append(bind(root / "ingress/api", "/installation"))
-    services["web"] = web
-    if ingress_config.enabled(config):
-        services.update(ingress_config.services(root, config, state, bind, candidate))
-    return doc
-
-
-LABEL = "io.oac.inputs"
-
-
-class Rendered:
-    """Generated file contents, plus the inputs digest each service must run with.
-
-    The digest covers everything a service reads: its Compose definition, the
-    env_file content and the files and secrets it mounts. It is the service's
-    `io.oac.inputs` label, so the running services can be compared with a
-    render at any time.
-    """
-
-    def __init__(self, files, services):
-        self.files, self.services = files, services
-
-
-def native_installer_inputs(root):
-    directory = root / "native-installers"
-    catalog = directory / "catalog.json"
-    if not catalog.is_file():
-        return None
-    # Archives are immutable and verified on installation/startup. Adding an
-    # offline archive must restart Core so its local availability map refreshes.
-    return [sha256(catalog.read_bytes()), sorted(p.name for p in directory.glob("*.tar.gz") if p.is_file())]
-
-
-def render(root, config, state, applied_at, candidate=None):
-    """candidate is an HTTPS address domain setup verifies before public_url changes:
-    the gateway publishes 80 and 443 and serves it too."""
-    root = Path(root)
-    secrets = secret_digests(root)
-    settings = settings_document(root, config, applied_at)
-    files = {"config.schema.json": config_model.SCHEMA_TEXT,
-             "settings.json": json.dumps(settings, indent=2) + "\n",
-             "core-key-digests.json": json.dumps([sha256(read_core_key(root))]) + "\n"}
-    history = config["core"]["runtime_history"]
-    if history is not None:
-        files["runtime-history.json"] = json.dumps(history, indent=2) + "\n"
-    core_env = environment_text(core_environment(root, config, state), edit_hint(root))
-    files["core.env"] = core_env
-    # Only settings Core itself restarts for enter its inputs, so a Web setting change
-    # leaves Core running. Its snapshot then refreshes on Core's next restart.
-    core_settings = [item for item in settings["settings"] if "core" in item["restarts"]]
-    external = {
-        "core": json.dumps({
-            "core-key-digests.json": sha256(files["core-key-digests.json"]),
-            "native-installers": native_installer_inputs(root),
-            "settings": sha256(json.dumps([settings["path"], settings["apply_command"], core_settings], sort_keys=True)),
-            "runtime-history.json": sha256(files.get("runtime-history.json", "")),
-            "credential.key": secrets["credential.key"], "database.password": secrets["database.password"],
-        }, sort_keys=True),
-        "web": json.dumps({"core.key": secrets["core.key"]}),
-    }
-    compose = compose_config(root, config, state, candidate)
-    services = {}
-    for name, service in compose["services"].items():
-        # Compose resolves env_file into the service configuration, so its content counts.
-        text = json.dumps(service, sort_keys=True) + (core_env if "env_file" in service else "")
-        services[name] = sha256(text + external.get("core" if name == "migrate" else name, ""))
-        service["labels"] = {LABEL: services[name]}
-    if ingress_config.enabled(config):
-        files["Caddyfile"] = ingress_config.caddyfile(config, state, candidate)
-    files["compose.json"] = json.dumps(compose, indent=2) + "\n"
-    return Rendered(files, services)
-
-
-def rendered_inputs(files):
-    """The inputs digest per service that a set of generated files asks for."""
-    result = {}
-    if files.get("compose.json"):
-        try:
-            for name, service in json.loads(files["compose.json"])["services"].items():
-                result[name] = service.get("labels", {}).get(LABEL)
-        except (ValueError, KeyError, AttributeError):
-            return {}
-    return result
diff --git a/deploy/install/ingress.py b/deploy/install/ingress.py
deleted file mode 100644
index e0c423edc..000000000
--- a/deploy/install/ingress.py
+++ /dev/null
@@ -1,284 +0,0 @@
-"""Domain setup through one locked installer operation, from Web or the CLI."""
-import argparse
-import hmac
-import http.client
-from contextlib import closing
-from http.server import BaseHTTPRequestHandler
-import json
-from pathlib import Path
-import socket
-import socketserver
-import ssl
-import threading
-import time
-from urllib.parse import urlsplit
-
-import config_model
-import configuration
-import ingress_config as gateway
-import oac_cli
-
-
-FAILED = "Domain setup failed. Check gateway and installation logs, then retry."
-UNFINISHED = ("checking", "applying")
-
-
-class DomainError(oac_cli.OacError):
-    def __init__(self, code, message, status=400):
-        super().__init__(message)
-        self.code, self.status = code, status
-
-
-def save(root, value):
-    oac_cli.write_private(Path(root) / "ingress/status.json", json.dumps(value) + "\n")
-
-
-def unfinished(root):
-    """Whether status.json records a domain setup that has not finished."""
-    path = Path(root) / "ingress/status.json"
-    return path.exists() and json.loads(oac_cli.read_private(path, "domain setup status"))["state"] in UNFINISHED
-
-
-def status(root):
-    config = oac_cli.load_config(root)
-    supported = gateway.enabled(config)
-    written = oac_cli.written_view(root, oac_cli.load_state(root), config)
-    result = {"supported": supported, "state": "ready" if written["public_url"] else "unconfigured",
-              "public_url": written["public_url"], "target_url": None, "message": None}
-    if not supported:
-        result["message"] = "This installation uses an external reverse proxy. Configure HTTPS there, then set public_url and run oac apply."
-    else:
-        path = Path(root) / "ingress/status.json"
-        if path.exists():
-            result.update(json.loads(oac_cli.read_private(path, "domain setup status")))
-            if result["state"] in UNFINISHED:
-                try:
-                    with oac_cli.locked(Path(root)):
-                        # A live CLI or Web operation holds this same lock. Read
-                        # again after acquiring it in case the operation just finished.
-                        result.update(json.loads(oac_cli.read_private(path, "domain setup status")))
-                        if result["state"] in UNFINISHED:
-                            result.update(state="failed", message="Domain setup was interrupted. Retry the same hostname, or run oac apply on the server: it restores the applied address, or finishes the switch if it had started.")
-                except oac_cli.OacError:
-                    pass
-    return result
-
-
-def prepare(root, name, confirmation):
-    """Validate and reserve a job while the caller holds the installation lock."""
-    config, state = oac_cli.load_config(root), oac_cli.load_state(root)
-    if state.get("complete") is not True:
-        raise DomainError("installation_incomplete", oac_cli.INCOMPLETE, 409)
-    if not gateway.enabled(config):
-        raise DomainError("domain_setup_unavailable", "Managed HTTPS is available in combined Docker installations only")
-    try:
-        target = "https://" + gateway.hostname(name)
-    except ValueError as error:
-        raise DomainError("invalid_hostname", str(error)) from None
-    if confirmation is not None and confirmation != target:
-        raise DomainError("invalid_confirmation", "The confirmation must equal the new HTTPS URL")
-    # Do not apply unrelated pending operator edits from a Web domain action.
-    previous, _ = oac_cli.disk_view(oac_cli.read_generated(root, {"settings.json", "runtime-history.json"}))
-    if previous is None or any(previous.get(key) != value for key, value in config_model.values(config).items()
-                               if key != "public_url"):
-        raise DomainError("configuration_pending", "Apply or revert pending config.json changes before changing the domain", 409)
-    # Both desired and generated files may be ahead of the running services.
-    # Common apply/start records this address only after successful convergence.
-    receipt = Path(root) / "ingress/status.json"
-    if not receipt.exists():
-        raise DomainError("installation_not_ready", "Run oac apply before configuring the domain", 409)
-    applied = json.loads(oac_cli.read_private(receipt, "domain setup status"))
-    config = dict(config, public_url=applied["public_url"])
-    candidate = dict(config, public_url=target)
-    config_model.validate(candidate)
-    actual = oac_cli.observe(state)
-    if not all(actual.get(name, {}).get("running") for name in ("core", "web", "gateway", "installation")):
-        raise DomainError("installation_not_running", "Start the installation with oac start before configuring its domain", 409)
-    rendered, disk, old_settings = oac_cli.render_now(root, config, state)
-    if oac_cli.edited_files(state, disk, rendered):
-        raise DomainError("generated_files_edited", "Resolve hand-edited generated files with oac apply before configuring the domain", 409)
-    host = urlsplit(target).hostname
-    if not resolves(host):
-        raise DomainError("hostname_unresolved", f"{host} does not resolve. Add A/AAAA records for it that point at this server, then retry when DNS returns them.", 409)
-    # The gateway publishes 80 and 443 only for HTTPS; the ports it already publishes are its own.
-    busy = [str(listener.port) for listener in oac_cli.taken_listeners(candidate, oac_cli.own_listeners(config, old_settings, disk, actual))]
-    if busy:
-        named = f"Port {busy[0]} is" if len(busy) == 1 else "Ports " + " and ".join(busy) + " are"
-        raise DomainError("https_ports_unavailable", f"{named} already in use on this server. Automatic HTTPS cannot run beside another program on ports 80 and 443: free both and retry. Find the program with: sudo ss -ltnp '( sport = :80 or sport = :443 )'", 409)
-    _, base, answered = oac_cli.old_public_url(root, config, old_settings, disk, actual)
-    args = argparse.Namespace(dry_run=False, yes=False, confirm_public_url_change=confirmation)
-    try:
-        # execute returns Core to the applied address first, even after an interrupted switch,
-        # so the change is confirmed from there.
-        oac_cli.confirm_public_url(root, candidate, configuration.local_public_url(config), base, answered, args, False, lambda _: None)
-    except oac_cli.OacError:
-        raise DomainError("public_url_confirmation_required", "Changing this address can disconnect existing nodes and executors. Confirm the new URL to continue; retain the old route while existing work uses it.", 409) from None
-    # The final apply makes the change confirmed here.
-    args = argparse.Namespace(dry_run=False, yes=False, confirm_public_url_change=target)
-    job = {"state": "checking", "target_url": target, "public_url": config["public_url"], "message": None}
-    save(root, job)
-    return config, state, candidate, args, job
-
-
-def resolves(host):
-    """Whether DNS answers with an A or AAAA record."""
-    try:
-        # The trailing dot keeps the resolver from appending its search domains.
-        return bool(socket.getaddrinfo(host + ".", 443, type=socket.SOCK_STREAM))
-    except (OSError, UnicodeError):
-        return False
-
-
-def verify(target, installation_id, timeout=180):
-    """A trusted certificate and this gateway's identity must both answer at the public address."""
-    host = urlsplit(target).hostname
-    deadline = time.monotonic() + timeout
-    while True:
-        try:
-            # No redirects, ambient proxy or credentials are used for this probe.
-            with closing(http.client.HTTPSConnection(host, timeout=8, context=ssl.create_default_context())) as client:
-                client.request("GET", "/_oac/installation/verify")
-                response = client.getresponse()
-                body = response.read(256)
-                if response.status == 200 and body == installation_id.encode():
-                    return
-        except (OSError, http.client.HTTPException):
-            pass
-        if time.monotonic() >= deadline:
-            raise DomainError("https_not_ready", f"HTTPS verification failed: {host} did not reach this installation with a trusted certificate. Check that its A/AAAA records point at this server, that no firewall or NAT blocks inbound ports 80 and 443, and the gateway logs for certificate errors. The previous address is kept; retry after the fix.")
-        time.sleep(2)
-
-
-def execute(root, prepared):
-    config, state, candidate, args, job = prepared
-    # Core and Web keep the applied address until the candidate is verified.
-    keep = argparse.Namespace(dry_run=False, yes=False, confirm_public_url_change=configuration.local_public_url(config))
-    try:
-        # Through common apply, the gateway publishes 80 and 443 and serves the candidate.
-        oac_cli.write_private(Path(root) / "config.json", json.dumps(config, indent=2) + "\n")
-        try:
-            oac_cli._apply(Path(root), keep, False, False, False, lambda _: None, candidate=candidate["public_url"])
-        except oac_cli.OacError:
-            raise DomainError("domain_setup_failed", FAILED) from None  # Its message addresses oac apply users.
-        verify(candidate["public_url"], state["installation_id"])
-        job["state"] = "applying"
-        save(root, job)
-        # Persist desired inputs before apply. An interrupted operation can be retried
-        # with the same hostname, or completed by the ordinary oac apply command.
-        oac_cli.write_private(Path(root) / "config.json", json.dumps(candidate, indent=2) + "\n")
-        oac_cli._apply(Path(root), args, False, False, False, lambda _: None)
-        job.update(state="ready", public_url=candidate["public_url"], message=None)
-        save(root, job)
-    except Exception as error:
-        recovery_failed = False
-        try:
-            # Restore through common apply: the gateway without the candidate, and without
-            # 80 and 443 unless HTTPS was already on, and any partially applied services.
-            oac_cli.write_private(Path(root) / "config.json", json.dumps(config, indent=2) + "\n")
-            oac_cli._apply(Path(root), keep, False, False, False, lambda _: None)
-            gateway.reload(root, gateway.caddyfile(config, state))
-        except Exception:
-            recovery_failed = True
-        message = str(error) if isinstance(error, (DomainError, oac_cli.OacError)) else FAILED
-        if recovery_failed:
-            message += " Recovery was incomplete; run oac apply and oac status on the server."
-        job.update(state="failed", message=message)
-        save(root, job)
-        raise DomainError("domain_setup_failed", message) from None
-
-
-def configure(root, name, confirmation=None, out=print):
-    with oac_cli.locked(root):
-        prepared = prepare(root, name, confirmation)
-        out("Requesting and verifying HTTPS. This can take a few minutes.")
-        execute(root, prepared)
-    out("HTTPS ready: " + prepared[2]["public_url"] + ". Sign in again with the Core key.")
-
-
-class Server(socketserver.ThreadingMixIn, socketserver.UnixStreamServer):
-    daemon_threads = True
-
-
-class Handler(BaseHTTPRequestHandler):
-    def log_message(self, *args):
-        pass  # Headers and requests can carry credentials.
-
-    def reply(self, code, value):
-        payload = json.dumps(value).encode()
-        self.send_response(code)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Cache-Control", "no-store")
-        self.send_header("Content-Length", str(len(payload)))
-        self.end_headers()
-        self.wfile.write(payload)
-
-    def authorized(self):
-        expected = "Bearer " + configuration.read_core_key(self.server.root)
-        if len(self.headers.get_all("Authorization", [])) != 1 or not hmac.compare_digest(self.headers.get("Authorization", ""), expected):
-            self.reply(401, {"error": {"code": "unauthorized", "message": "Installation authentication failed"}})
-            return False
-        return True
-
-    def do_GET(self):
-        if not self.authorized():
-            return
-        if self.path != "/domain":
-            self.send_error(404)
-            return
-        self.reply(200, status(self.server.root))
-
-    def do_POST(self):
-        if not self.authorized():
-            return
-        if self.path != "/domain":
-            self.send_error(404)
-            return
-        guard = None
-        try:
-            length = int(self.headers.get("Content-Length", "0"))
-            if not 0 < length <= 2048 or self.headers.get("Transfer-Encoding"):
-                raise DomainError("invalid_request", "A small JSON request body is required")
-            data = json.loads(self.rfile.read(length))
-            if not isinstance(data, dict) or set(data) - {"hostname", "confirm_public_url_change"}:
-                raise DomainError("invalid_request", "Expected hostname and optional confirm_public_url_change")
-            guard = oac_cli.locked(self.server.root)
-            guard.__enter__()
-            prepared = prepare(self.server.root, data.get("hostname"), data.get("confirm_public_url_change"))
-            held, guard = guard, None
-            # Start independently of the response writer: a browser disconnect must
-            # not leak the installation lock or abandon a reserved operation.
-            def work():
-                try:
-                    execute(self.server.root, prepared)
-                except DomainError:
-                    pass
-                finally:
-                    held.__exit__(None, None, None)
-            threading.Thread(target=work, daemon=True).start()
-            self.reply(202, dict(prepared[-1], supported=True))
-        except (DomainError, oac_cli.OacError, ValueError) as error:
-            code = error.code if isinstance(error, DomainError) else "installation_busy" if isinstance(error, oac_cli.OacError) else "invalid_request"
-            self.reply(error.status if isinstance(error, DomainError) else 409 if isinstance(error, oac_cli.OacError) else 400,
-                       {"error": {"code": code, "message": str(error) if isinstance(error, oac_cli.OacError) else "Invalid JSON request"}})
-        finally:
-            if guard is not None:
-                guard.__exit__(None, None, None)
-
-    def setup(self):
-        self.request.settimeout(15)
-        super().setup()
-
-
-def serve(root):
-    root = Path(root)
-    path = Path("/control/api.sock")
-    path.unlink(missing_ok=True)
-    import os
-    previous = os.umask(0o077)
-    try:
-        with Server(str(path), Handler) as server:
-            server.root = root
-            os.chmod(path, 0o600)
-            server.serve_forever()
-    finally:
-        os.umask(previous)
diff --git a/deploy/install/ingress_config.py b/deploy/install/ingress_config.py
deleted file mode 100644
index f3d90715d..000000000
--- a/deploy/install/ingress_config.py
+++ /dev/null
@@ -1,174 +0,0 @@
-"""The installer's managed HTTPS gateway; Core and Web retain no Docker authority."""
-import http.client
-from contextlib import closing
-import ipaddress
-import json
-import os
-from pathlib import Path
-import re
-import socket
-import stat
-import subprocess
-from urllib.parse import urlsplit
-
-
-def enabled(config):
-    return config.get("ingress") == "managed"
-
-
-def hostname(value):
-    if not isinstance(value, str):
-        raise ValueError("Enter a DNS hostname, without a scheme, port or path")
-    value = value.strip().lower()
-    if (len(value) > 253 or "." not in value or
-            not all(re.fullmatch(r"[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?", label) for label in value.split("."))):
-        raise ValueError("Enter a DNS hostname, without a scheme, port or path")
-    try:
-        ipaddress.ip_address(value)
-    except ValueError:
-        if value.endswith((".localhost", ".local", ".internal")):
-            raise ValueError("Use a publicly registered DNS hostname") from None
-        return value
-    raise ValueError("Use a DNS hostname rather than an IP address")
-
-
-def preflight():
-    endpoint = os.environ.get("DOCKER_HOST")
-    if not endpoint:
-        result = subprocess.run(["docker", "context", "inspect", "--format", "{{.Endpoints.docker.Host}}"],
-                                check=True, capture_output=True, text=True)
-        endpoint = result.stdout.strip()
-    if not endpoint.startswith("unix://"):
-        raise RuntimeError("Managed HTTPS requires a local Docker Unix socket; use --ingress external with a remote Docker engine")
-    path = Path(endpoint.removeprefix("unix://")).resolve()
-    info = path.stat()
-    if not path.is_absolute() or not stat.S_ISSOCK(info.st_mode):
-        raise RuntimeError("Managed HTTPS requires access to the local Docker socket")
-    return {"docker_socket": str(path), "docker_gid": info.st_gid}
-
-
-def prepare(root):
-    if len(str(Path(root) / "ingress/admin/caddy.sock").encode()) >= 108:
-        raise RuntimeError("Installation path is too long for managed HTTPS Unix sockets; choose a shorter --install-dir")
-    for name in ("ingress", "ingress/api", "ingress/admin", "ingress/data"):
-        path = Path(root) / name
-        if path.is_symlink():
-            raise RuntimeError("Managed HTTPS directories must not be symlinks")
-        path.mkdir(mode=0o700, exist_ok=True)
-        info = path.stat()
-        if info.st_uid != os.getuid() or stat.S_IMODE(info.st_mode) != 0o700:
-            raise RuntimeError("Managed HTTPS directories must be private and owned by the installation account")
-
-
-def caddyfile(config, state, candidate=None):
-    origin = candidate or config["public_url"]
-    bootstrap = "handle /healthz {\n reverse_proxy web:8080\n}\n"
-    if config["public_url"]:
-        bootstrap += f'handle {{\n redir {config["public_url"]}{{uri}} 308\n}}\n'
-    else:
-        bootstrap += "handle {\n reverse_proxy web:8080\n}\n"
-    result = "{\n admin unix//control/caddy.sock\n persist_config off\n}\n\n"
-    result += "http://:8080 {\n" + bootstrap + "}\n"
-    for origin in dict.fromkeys(value for value in (config["public_url"], origin) if value):
-        # config_model also applies these rules to manual config.json edits.
-        parsed = urlsplit(origin)
-        if origin != "https://" + hostname(parsed.hostname) or parsed.port is not None:
-            raise ValueError("Managed HTTPS requires https:// followed by a DNS hostname, without a port")
-        result += (f"{origin} {{\n"
-                   ' handle /_oac/installation/verify {\n'
-                   f'  respond "{state["installation_id"]}" 200\n'
-                   ' }\n'
-                   " @api path /v1 /v1/* /api/v1 /api/v1/*\n"
-                   " handle @api {\n  reverse_proxy core:8091\n }\n"
-                   " handle {\n  reverse_proxy web:8080\n }\n}\n")
-    return result
-
-
-class UnixHTTP(http.client.HTTPConnection):
-    def __init__(self, path, timeout=15):
-        super().__init__("localhost", timeout=timeout)
-        self.path = str(path)
-
-    def connect(self):
-        self.sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-        self.sock.settimeout(self.timeout)
-        self.sock.connect(self.path)
-
-
-def reload(root, document):
-    try:
-        with closing(UnixHTTP(Path(root) / "ingress/admin/caddy.sock")) as client:
-            client.request("POST", "/load", document.encode(), {"Content-Type": "text/caddyfile"})
-            response = client.getresponse()
-            response.read(65536)
-            if response.status != 200:
-                raise RuntimeError("HTTPS gateway refused the configuration; inspect gateway logs and retry")
-    except (OSError, http.client.HTTPException):
-        raise RuntimeError("HTTPS gateway is unavailable; inspect gateway logs and retry") from None
-
-
-def published(config, candidate=None):
-    """(host port, gateway port) of each port the gateway publishes on config["host"].
-
-    Automatic HTTPS needs ports 80 and 443, so the gateway publishes them only once
-    public_url is set, or while domain setup verifies a candidate address.
-    """
-    https = [(80, 80), (443, 443)] if config["public_url"] or candidate else []
-    return [(config["ports"]["web"], 8080)] + https
-
-
-def written_listeners(compose):
-    """(address, port) of each host port the gateway publishes in a written compose.json."""
-    try:
-        ports = json.loads(compose)["services"]["gateway"]["ports"]
-        return {(ipaddress.ip_address(host.strip("[]")), int(port))
-                for host, port, _ in (item.rsplit(":", 2) for item in ports)}
-    except (TypeError, ValueError, KeyError, AttributeError):
-        return set()
-
-
-def services(root, config, state, bind, candidate=None):
-    root = Path(root)
-    identity = f'{state["uid"]}:{state["gid"]}'
-    common = {"image": state["images"]["ingress"], "user": identity, "restart": "unless-stopped",
-              "read_only": True, "tmpfs": ["/tmp"], "security_opt": ["no-new-privileges:true"]}
-    host = config["host"]
-    if ":" in host:
-        host = "[" + host + "]"
-    gateway = dict(common, command=["caddy", "run", "--config", "/generated/Caddyfile", "--adapter", "caddyfile"],
-                   ports=[f"{host}:{port}:{target}" for port, target in published(config, candidate)],
-                   environment={"XDG_DATA_HOME": "/data", "XDG_CONFIG_HOME": "/data/config",
-                                "NO_PROXY": "core,web,localhost,127.0.0.1,::1",
-                                "no_proxy": "core,web,localhost,127.0.0.1,::1"},
-                   volumes=[bind(root / "generated", "/generated"), bind(root / "ingress/admin", "/control", False),
-                            bind(root / "ingress/data", "/data", False)])
-    manager = dict(common, command=["python3", str(root / "oac").replace("$", "$$"), "domain-server"], network_mode="host",
-                   environment={"DOCKER_HOST": "unix:///docker.sock"}, group_add=[str(state["ingress"]["docker_gid"])],
-                   volumes=[bind(root, str(root).replace("$", "$$"), False), bind(root / "ingress/api", "/control", False),
-                            bind(state["ingress"]["docker_socket"], "/docker.sock", False)])
-    for service, path in ((gateway, "/control/caddy.sock"), (manager, "/control/api.sock")):
-        service["healthcheck"] = {
-            "test": ["CMD", "python3", "-c", "import socket; s=socket.socket(socket.AF_UNIX); s.connect(" + repr(path) + "); s.close()"],
-            "interval": "2s", "timeout": "5s", "retries": 30,
-        }
-    return {"gateway": gateway, "installation": manager}
-
-
-def console_origin(config):
-    """A useful initial URL; NAT users may substitute their reachable server IP."""
-    if config["public_url"]:
-        return config["public_url"]
-    host = config["host"]
-    address = ipaddress.ip_address(host)
-    if address.is_unspecified:
-        try:
-            family = socket.AF_INET6 if address.version == 6 else socket.AF_INET
-            destination = "2001:db8::1" if address.version == 6 else "192.0.2.1"
-            with socket.socket(family, socket.SOCK_DGRAM) as probe:
-                probe.connect((destination, 80))  # Route lookup only; no packet is sent.
-                host = probe.getsockname()[0]
-        except OSError:
-            return f'http://<server-ip>:{config["ports"]["web"]}'
-    if ":" in host:
-        host = "[" + host + "]"
-    return f'http://{host}:{config["ports"]["web"]}'
diff --git a/deploy/install/install.py b/deploy/install/install.py
deleted file mode 100644
index e579ad6fb..000000000
--- a/deploy/install/install.py
+++ /dev/null
@@ -1,647 +0,0 @@
-#!/usr/bin/env python3
-"""Install one matched Core distribution, repair it, without changing versions.
-
-A new installation's flags seed <install-dir>/config.json. Afterwards, edit that file
-and run <install-dir>/oac apply; rerunning this installer only repairs. A new installation
-that fails before its services first start removes what it created; rerun the same command.
-"""
-import argparse
-import base64
-import contextlib
-import errno
-import hashlib
-import ipaddress
-import json
-import os
-from pathlib import Path
-import platform
-import re
-import secrets
-import shutil
-import signal
-import subprocess
-import sys
-import tempfile
-import traceback
-import uuid
-from urllib.parse import urlsplit
-
-import config_model
-import configuration
-import ingress_config
-from configuration import valid_core_origin
-import native_installers
-import oac_cli
-import sandbox_setup
-import install_output
-import install_display
-from install_display import step
-from distribution import DistributionError, artifact, image_identities, ensure_docker_image
-
-SETTING_ARGUMENTS = {
-    config_model.annotation(node, "install_flag"): (key, node)
-    for key, node in config_model.leaves()
-    if config_model.annotation(node, "install_flag")
-}
-SETTING_FLAGS = tuple(flag.removeprefix("--").replace("-", "_") for flag in SETTING_ARGUMENTS)
-AVOID = 20  # An omitted Core or Web port moves at most this far above its default.
-
-
-class InstallError(Exception):
-    pass
-
-
-REPORTED = (InstallError, oac_cli.OacError, config_model.ConfigError, sandbox_setup.SandboxSetupError,
-            DistributionError, RuntimeError)
-NOTHING_KEPT = "Nothing was kept; fix the problem and rerun the same command."
-
-
-def error_text(error):
-    """What the installer prints for an error, then what became of a new installation.
-
-    It never includes generated configuration or command output.
-    """
-    if isinstance(error, REPORTED):
-        text = str(error)
-    elif isinstance(error, KeyboardInterrupt):
-        text = "interrupted"
-    elif isinstance(error, OSError) and error.errno in (errno.ENOSPC, errno.EDQUOT):
-        text = "Disk space or quota exhausted; free space on the installation filesystem and rerun"
-    elif isinstance(error, PermissionError):
-        text = "Permission denied; use a directory writable by your current account (--install-dir)"
-    else:
-        text = "inspect prerequisites and private deployment files"
-    removal = getattr(error, "removal", None)
-    return text + ("\n" + removal if removal else "")
-
-
-def run(args, **kwargs):
-    # Never print a generated Compose file, process environment or secret value.
-    return subprocess.run(args, **dict({"check": True}, **kwargs))
-
-
-def digest(path):
-    result = hashlib.sha256()
-    with path.open("rb") as stream:
-        for block in iter(lambda: stream.read(1024 * 1024), b""):
-            result.update(block)
-    return result.hexdigest()
-
-
-def verify_bundle(bundle):
-    covered = set()
-    for line in (bundle / "SHA256SUMS").read_text().splitlines():
-        expected, name = line.split("  ", 1)
-        if name in covered:
-            raise InstallError("Duplicate distribution checksum entry")
-        covered.add(name)
-        path = bundle / name
-        if not path.resolve().is_relative_to(bundle.resolve()) or path.is_symlink() or not path.is_file():
-            raise InstallError("Invalid distribution path")
-        if digest(path) != expected:
-            raise InstallError("Distribution checksum mismatch: " + name)
-    required = {"manifest.json", "install.sh", "install.py", "configuration.py", "config_model.py", "ingress_config.py", "ingress.py",
-                "config.schema.json", "oac_cli.py", "oac.pyz",
-                "sandbox_setup.py", "install_output.py", "install_display.py", "standard-sizes.json", "node_spec.py", "node-install.pyz",
-                "distribution.py", "runtime/seccomp.json"}
-    required.update(f"images/{name}.tar" for name in ("core", "web", "database", "ingress"))
-    if not required.issubset(covered):
-        raise InstallError("Distribution checksum list is incomplete")
-    manifest = json.loads((bundle / "manifest.json").read_text())
-    for name in ("core", "web", "database", "runtime", "ingress"):
-        image_identities(manifest, name)
-    for name in ("images/runtime.tar.gz", "native/bin/oac-node",
-                 "native/bin/oac-microsandbox-provider", "native/microsandbox/msb",
-                 "native/microsandbox/libkrunfw.so.5.6.1"):
-        artifact(manifest, name)
-    return manifest
-
-
-def public_origin(value):
-    # Normalize case and a trailing slash, then apply Core's exact origin rule.
-    try:
-        parsed = urlsplit(value.strip())
-        if parsed.path == "/":
-            parsed = parsed._replace(path="")
-        value = parsed._replace(scheme=parsed.scheme.lower(), netloc=parsed.netloc.lower()).geturl()
-    except ValueError:
-        value = ""
-    if not valid_core_origin(value):
-        raise argparse.ArgumentTypeError("Public URL must be an HTTPS origin such as https://core.example, "
-                                         "without path, credentials, query or fragment; plain HTTP only for a loopback host")
-    return value
-
-
-def arguments(argv=None):
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("--install-dir", type=Path)
-    for flag, (_, node) in SETTING_ARGUMENTS.items():
-        value_type = int if node.get("type") == "integer" else public_origin if config_model.annotation(node, "check") == "origin" else str
-        parser.add_argument(flag, type=value_type, help=node["description"])
-    parser.add_argument("--config", type=Path, help="Seed a new installation's config.json from this file")
-    args = parser.parse_args(argv)
-    args.install_dir = args.install_dir or Path.home() / ".oac/core"
-    if not args.install_dir.is_absolute():
-        parser.error("--install-dir must be absolute")
-    args.given = [name for name, value in vars(args).items()
-                  if name not in ("install_dir", "given") and value not in (None, False)]
-    return args
-
-
-def seed_document(args):
-    """The --config file, which replaces the setting flags."""
-    if args.config is None:
-        return None
-    if any(getattr(args, name) is not None for name in SETTING_FLAGS):
-        raise InstallError("--config replaces the setting flags; put those settings in the file")
-    try:
-        document = json.loads(args.config.read_text())
-    except (OSError, ValueError):
-        raise InstallError("--config must name a readable JSON file") from None
-    if not isinstance(document, dict):
-        raise InstallError("--config must hold a JSON object")
-    return document
-
-
-def seed_config(args, document):
-    """config.json for a new installation, from flags or from --config."""
-    if document is not None:
-        document.setdefault("$schema", "generated/config.schema.json")
-        return config_model.validate(document)
-    values = {key: getattr(args, flag.removeprefix("--").replace("-", "_"))
-              for flag, (key, _) in SETTING_ARGUMENTS.items()}
-    values["ingress"] = values["ingress"] or "managed"
-    if values["ingress"] == "managed" and values["host"] is None:
-        values["host"] = "0.0.0.0"
-    return config_model.initial(**values)
-
-
-def check_listeners(args, document, config):
-    """Check every listener of a new installation, before anything slow runs.
-
-    A taken port that the flags or the --config file set fails, and so does one that a
-    loopback public_url names. An omitted Core or Web port moves to the first free port
-    above its default that no other listener uses. Returns the config and
-    (purpose, taken port, chosen port) for each move.
-    """
-    if document is None:
-        names, where = {key: flag for flag, (key, _) in SETTING_ARGUMENTS.items()}, ""
-        given = {key for key, flag in names.items() if getattr(args, flag.removeprefix("--").replace("-", "_")) is not None}
-    else:
-        names, where = {}, " in the --config file"
-        given = {key for key in ("ports.core", "ports.web") if config_model.lookup(document, key) is not None}
-    if not oac_cli.address_available(config["host"]):
-        raise InstallError(f"{config['host']} ({names.get('host', 'host')}{where}) is not an address of this machine; "
-                           "use one of its addresses")
-    public_url, moved = config["public_url"], []
-    for listener in configuration.listeners(config):
-        if oac_cli.port_free(listener.host, listener.port):
-            continue
-        if listener.purpose == "HTTPS":
-            remedy = "--ingress external" if document is None else '"ingress": "external" in the --config file'
-            raise InstallError(f"Automatic HTTPS needs ports 80 and 443, and port {listener.port} is already in use on "
-                               f"{listener.host}. Free it, or use an existing reverse proxy with {remedy}; "
-                               f"find the process with: sudo ss -ltnp 'sport = :{listener.port}'")
-        name = names.get(listener.setting, listener.setting)
-        # Moving the port would leave a loopback public_url pointing at the old one.
-        pinned = bool(public_url) and loopback_origin(public_url) and origin_port(public_url) == listener.port
-        if pinned:
-            name += " and " + names.get("public_url", "public_url")
-        if listener.setting in given or pinned or listener.purpose not in ("Core", "Web"):
-            raise InstallError(oac_cli.port_in_use(listener, name + where))
-        taken = {other.port for other in configuration.listeners(config)}
-        port = next((port for port in range(listener.port + 1, listener.port + AVOID + 1)
-                     if port not in taken and oac_cli.port_free(listener.host, port)), None)
-        if port is None:
-            raise InstallError(f"Ports {listener.port} to {listener.port + AVOID} are in use on {listener.host}; "
-                               f"set a free port with {name}{where}")
-        config["ports"][listener.setting.removeprefix("ports.")] = port
-        moved.append((listener.purpose, listener.port, port))
-    return config, moved
-
-
-def loopback_origin(value):
-    hostname = urlsplit(value or "").hostname
-    try:
-        return ipaddress.ip_address(hostname).is_loopback
-    except ValueError:
-        return hostname == "localhost"
-
-
-def origin_port(value):
-    parsed = urlsplit(value)
-    return parsed.port or (443 if parsed.scheme == "https" else 80)
-
-
-def nodes_reach(public_url):
-    """Nodes and their sandboxes need an HTTPS public URL that is not loopback."""
-    return urlsplit(public_url or "").scheme == "https" and not loopback_origin(public_url)
-
-
-def check_compose():
-    try:
-        version = run(["docker", "compose", "version", "--short"], capture_output=True, text=True,
-                      timeout=30).stdout.strip()
-    except (OSError, subprocess.SubprocessError):
-        raise InstallError("Docker with the Compose plugin is required; check docker compose version") from None
-    match = re.fullmatch(r"v?(\d+)\.(\d+)\.(\d+)(?:[-+].*)?", version)
-    if not match or tuple(map(int, match.groups())) < (2, 26, 0):
-        raise InstallError("Docker Compose 2.26.0 or newer is required for literal Core environment values")
-
-
-def check_host():
-    if platform.system() != "Linux" or platform.machine() not in ("x86_64", "amd64"):
-        raise InstallError("Core installation requires Linux amd64 with Docker access")
-    check_compose()
-    try:
-        run(["docker", "info", "--format", "{{.ServerVersion}}"], capture_output=True, timeout=30)
-    except (OSError, subprocess.SubprocessError):
-        raise InstallError("Cannot reach Docker as the current account. Check docker info, the daemon and this "
-                           "account's Docker access; the installer does not require root or invoke sudo") from None
-
-
-def image_names(managed=False):
-    return ["core", "database", "web"] + (["ingress"] if managed else [])
-
-
-def image_loader(manifest, bundle):
-    def load(names):
-        images = {}
-        for name in names:
-            message = "Preparing " + {"database": "PostgreSQL", "core": "Core", "web": "Web"}.get(name, name) + " image"
-            step(message)
-            with install_display.busy(message):
-                images[name] = ensure_docker_image(manifest, name, lambda name=name: bundle / f"images/{name}.tar")
-        return images
-    return load
-
-
-def prepare_node_payload(root, state, bundle):
-    destination = root / "node-payload"
-    # Each release remains immutable and addressable while old nodes retain it.
-    # The only mutable publication is a small, atomically replaced active pointer.
-    def publish(source):
-        manifest = json.loads((source / "manifest.json").read_text())
-        revision = manifest.get("source_commit", "")
-        if not re.fullmatch(r"[0-9a-f]{40}", revision):
-            raise InstallError("Invalid node payload release identity")
-        metadata_names = ("node-install.pyz", "manifest.json", "SHA256SUMS", "runtime/seccomp.json")
-        names = list(metadata_names)
-        for logical in manifest.get("artifacts", {}):
-            entry = artifact(manifest, logical)
-            name = "artifacts/" + entry["filename"]
-            path = source / name
-            if path.exists():
-                if (path.is_symlink() or not path.is_file()
-                        or not path.resolve().is_relative_to(source.resolve())
-                        or path.stat().st_size != entry["size"] or digest(path) != entry["sha256"]):
-                    raise InstallError("Offline artifact verification failed: " + logical)
-                names.append(name)
-        target = destination / "releases" / revision
-        if target.is_symlink() or target.parent.is_symlink():
-            raise InstallError("Installed node payload differs; preserve it and inspect the distribution")
-        target.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
-        if target.exists():
-            # Validate the complete published metadata and every existing declared
-            # artifact before filling any absence. Existing bytes are immutable.
-            for name in metadata_names:
-                previous = target / name
-                if (previous.parent.is_symlink() or previous.is_symlink() or not previous.is_file()
-                        or digest(previous) != digest(source / name)):
-                    raise InstallError("Installed node payload differs; preserve it and inspect the distribution")
-            artifacts = target / "artifacts"
-            if artifacts.is_symlink() or artifacts.exists() and not artifacts.is_dir():
-                raise InstallError("Installed node artifact directory differs")
-            missing = []
-            for logical in manifest.get("artifacts", {}):
-                entry = artifact(manifest, logical)
-                name = "artifacts/" + entry["filename"]
-                previous = target / name
-                if previous.is_symlink() or previous.exists() and (not previous.is_file()
-                        or previous.stat().st_size != entry["size"] or digest(previous) != entry["sha256"]):
-                    raise InstallError("Installed node artifact differs; refusing repair")
-                if not previous.exists() and name in names:
-                    missing.append((name, entry))
-            if missing:
-                artifacts.mkdir(mode=0o700, exist_ok=True)
-                for name, entry in missing:
-                    descriptor, temporary = tempfile.mkstemp(prefix=".payload-", dir=artifacts)
-                    try:
-                        with os.fdopen(descriptor, "wb") as outgoing, (source / name).open("rb") as incoming:
-                            shutil.copyfileobj(incoming, outgoing)
-                            outgoing.flush()
-                            os.fsync(outgoing.fileno())
-                        if Path(temporary).stat().st_size != entry["size"] or digest(Path(temporary)) != entry["sha256"]:
-                            raise InstallError("Node artifact changed during repair")
-                        # Publish without replacing bytes introduced concurrently.
-                        os.link(temporary, target / name)
-                    finally:
-                        os.unlink(temporary)
-                for directory in (artifacts, target):
-                    descriptor = os.open(directory, os.O_RDONLY | os.O_DIRECTORY)
-                    try:
-                        os.fsync(descriptor)
-                    finally:
-                        os.close(descriptor)
-            return revision
-        with tempfile.TemporaryDirectory(prefix=".payload-", dir=target.parent) as temporary:
-            stage = Path(temporary) / "release"
-            stage.mkdir(mode=0o700)
-            for name in names:
-                path = source / name
-                if path.is_symlink() or not path.is_file():
-                    raise InstallError("Invalid node payload source file")
-                copied = stage / name
-                copied.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
-                with path.open("rb") as incoming, copied.open("xb") as outgoing:
-                    os.chmod(copied, 0o600)
-                    shutil.copyfileobj(incoming, outgoing)
-                    outgoing.flush()
-                    os.fsync(outgoing.fileno())
-            os.rename(stage, target)
-        return revision
-
-    if destination.is_symlink():
-        raise InstallError("Invalid node payload directory")
-    destination.mkdir(mode=0o700, exist_ok=True)
-    revision = publish(bundle)
-    pointer = destination / "active.json"
-    if pointer.is_symlink():
-        raise InstallError("Invalid active node payload pointer")
-    if pointer.exists():
-        if json.loads(pointer.read_text()) != {"source_commit": revision}:
-            raise InstallError("Installed node payload differs; preserve it and inspect the distribution")
-        return
-    descriptor, temporary = tempfile.mkstemp(prefix=".active-", dir=destination)
-    try:
-        with os.fdopen(descriptor, "w") as stream:
-            json.dump({"source_commit": revision}, stream)
-            stream.write("\n")
-            stream.flush()
-            os.fsync(stream.fileno())
-        os.replace(temporary, pointer)
-        descriptor = os.open(destination, os.O_RDONLY | os.O_DIRECTORY)
-        try:
-            os.fsync(descriptor)
-        finally:
-            os.close(descriptor)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
-
-
-def install_oac(root, bundle):
-    """Copy the oac command into the installation; replace a missing or different copy."""
-    target = root / "oac"
-    source = bundle / "oac.pyz"
-    if target.is_file() and not target.is_symlink() and digest(target) == digest(source):
-        os.chmod(target, 0o700)
-        return
-    descriptor, temporary = tempfile.mkstemp(prefix=".oac-", dir=root)
-    os.close(descriptor)
-    try:
-        shutil.copyfile(source, temporary)
-        os.chmod(temporary, 0o700)
-        os.replace(temporary, target)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
-
-
-def layout(root):
-    if not root.exists() or not any(path.name != ".oac.lock" for path in root.iterdir()):
-        return "empty"
-    if (root / "state.json").exists():
-        try:
-            complete = json.loads((root / "state.json").read_text()).get("complete")
-        except (OSError, ValueError, AttributeError):
-            complete = None
-        # create() writes state.json before anything else, with complete: false; the first
-        # successful start sets it.
-        if complete is not True:
-            return "incomplete"
-        return "config" if (root / "config.json").exists() else "missing-config"
-    # Without state.json nothing here is known to be the installer's, so nothing is taken over or removed.
-    return "config" if (root / "config.json").exists() else "other"
-
-
-def written_state(root):
-    """state.json, or None before create() wrote it; then the directory holds only the lock."""
-    return oac_cli.load_state(root) if (root / "state.json").exists() else None
-
-
-def remove_created(root, state, created):
-    """Remove what this run created; returns the line printed after its error."""
-    try:
-        if state is not None:
-            oac_cli.remove(root, state, keep_root=not created)
-        elif created:
-            # Never remove anything else from a directory without this installation's state.json.
-            with contextlib.suppress(OSError):
-                (root / ".oac.lock").unlink()
-                root.rmdir()
-    except oac_cli.OacError as left:
-        return str(left)
-    return NOTHING_KEPT
-
-
-def create(root, config, manifest, images):
-    """Write the new installation's state.json, secrets and config.json, in that order."""
-    token = secrets.token_hex(32)
-    if root.parent == Path.home() / ".oac":
-        oac_cli.private_parent(root)
-    root.mkdir(mode=0o700, parents=True, exist_ok=True)
-    os.chmod(root, 0o700)
-    state = {"format": 2, "installation_id": str(uuid.uuid4()), "project": "oac-" + secrets.token_hex(5),
-             "uid": os.getuid(), "gid": os.getgid(),
-             "source_commit": manifest["source_commit"], "images": images, "secrets_sha256": {},
-             "generated": {}, "complete": False}
-    if ingress_config.enabled(config):
-        state["ingress"] = ingress_config.preflight()
-    # state.json first, written whole: it marks everything after it as this installation's.
-    oac_cli.save_state(root, state)
-    for name in ("secrets", "generated", "state", "state/e2b"):
-        (root / name).mkdir(mode=0o700)
-    write = oac_cli.create_private
-    write(root / "secrets/core.key", token)
-    write(root / "secrets/credential.key", base64.b64encode(secrets.token_bytes(32)).decode())
-    write(root / "secrets/database.password", secrets.token_hex(32))
-    if ingress_config.enabled(config):
-        ingress_config.prepare(root)
-    digests = configuration.secret_digests(root)
-    digests.pop("core.key")
-    oac_cli.save_state(root, dict(state, secrets_sha256=digests))
-    # config.json last: whenever it exists, the installation can be repaired.
-    write(root / "config.json", json.dumps(config, indent=2) + "\n")
-
-
-def finish(root, bundle, manifest, fresh=False, selection=None, moved=()):
-    """Repair and start this release while the installer holds the installation lock."""
-    state = oac_cli.load_state(root)
-    step("Preparing service files")
-    prepare_node_payload(root, state, bundle)
-    native_installers.prepare(root, state, bundle)
-    install_oac(root, bundle)
-    if ingress_config.enabled(oac_cli.load_config(root)):
-        ingress_config.prepare(root)
-    args = argparse.Namespace(dry_run=False, confirm_public_url_change=None)
-    step("Applying settings and starting services as needed")
-    try:
-        oac_cli._apply(root, args, False, True, sys.stdin.isatty(),
-                       lambda message: print(message, flush=True), retry=f"rerun ./install.sh --install-dir {root}")
-    except oac_cli.ApplyFailed as error:
-        if not fresh:
-            raise
-        # The installer removes what it created and says how to retry.
-        raise InstallError(f"The services did not start: {error.cause}") from None
-    config = oac_cli.load_config(root)
-    if fresh:
-        # The first start finished: from now on the installation is kept.
-        oac_cli.save_state(root, dict(oac_cli.load_state(root), complete=True))
-    deployment = failure = None
-    if selection:
-        step("Configuring sandbox backend")
-        try:
-            deployment = sandbox_setup.initialize(root, config, state, selection)
-        except sandbox_setup.SandboxSetupError as error:
-            failure = error
-    summary(root, config, fresh, selection, deployment, incomplete=failure is not None, moved=moved)
-    if failure:
-        raise InstallError(f"{str(failure).rstrip('.')}. Services are installed and running; "
-                           "choose the sandbox backend on the Nodes page in Web")
-
-
-def summary(root, config, fresh, selection=None, deployment=None, incomplete=False, moved=()):
-    public_url, ports = config["public_url"], config["ports"]
-    addresses = []
-    # Web accepts only its configured origin.
-    console = ingress_config.console_origin(config) if ingress_config.enabled(config) else configuration.web_origin(config)
-    addresses.append("Console: " + console + (" (local only)" if loopback_origin(console) else ""))
-    api = configuration.service_origin(config, "core") + "/v1"
-    if public_url and not loopback_origin(public_url):
-        label = "Local-only API on this host: " if configuration.loopback_listener(config["host"]) else "Direct API on this host: "
-        addresses += ["API base URL: " + public_url + "/v1", label + api]
-    elif public_url and origin_port(public_url) != ports.get("web"):
-        addresses.append("API base URL: " + public_url + "/v1 (local only)")
-    else:
-        # The loopback Web port does not serve the public API.
-        addresses.append("API base URL: " + api + " (local only)")
-    install_output.summary(root, config, addresses, fresh, selection, deployment,
-                           nodes_reach(public_url), incomplete, moved)
-
-
-def main(argv=None):
-    args = arguments(argv)
-    root = args.install_dir
-    if root.is_symlink() or root.resolve() != root:
-        raise InstallError("Installation directory must be canonical and not a symlink")
-    bundle = Path(__file__).resolve().parent
-    # Settings and listeners take seconds to check, so they come before hashing the bundle.
-    prepared = None
-    if layout(root) == "empty":
-        step("Checking installation settings")
-        prepared = prepare_fresh(args)
-    step("Verifying installation files")
-    with install_display.busy("Verifying installation files"):
-        manifest = verify_bundle(bundle)
-    # Refuse foreign state before even creating a lock; repeat under the lock to
-    # protect against another current installer finishing between these reads.
-    check_release(root, manifest)
-    if root.parent == Path.home() / ".oac":
-        root.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
-    created = not root.exists()
-    root.mkdir(mode=0o700, parents=True, exist_ok=True)
-    with oac_cli.locked(root):
-        check_release(root, manifest)
-        install_locked(args, root, bundle, manifest, prepared, created)
-
-
-def check_release(root, manifest):
-    if (root / "state.json").exists():
-        state = oac_cli.load_state(root)
-        if state.get("complete") is True and state.get("source_commit") != manifest["source_commit"]:
-            raise InstallError(oac_cli.UNSUPPORTED_VERSION)
-
-
-def prepare_fresh(args):
-    document = seed_document(args)
-    config = seed_config(args, document)
-    config, moved = check_listeners(args, document, config)
-    return config, moved
-
-
-def install_locked(args, root, bundle, manifest, prepared, created):
-    kind = layout(root)
-    if kind == "config":
-        if args.given:
-            raise InstallError(f"This installation is configured by {root / 'config.json'}. Edit it and run "
-                               f"{root / 'oac'} apply; install.sh accepts only --install-dir to repair it")
-        state = oac_cli.load_state(root)
-        step("Checking host requirements for repair")
-        check_host()
-        images = image_loader(manifest, bundle)(list(state["images"]))
-        if images != state["images"]:
-            oac_cli.save_state(root, dict(state, images=images))
-        finish(root, bundle, manifest)
-        return
-    if kind == "missing-config":
-        raise InstallError(f"{root / 'config.json'} is missing. Restore it from a backup; "
-                           f"{root / 'generated/settings.json'} lists the last applied values. The secrets and "
-                           "database belong to this installation, so keep the directory. Nothing was changed")
-    if kind == "other":
-        raise InstallError("Installation directory is not empty; refusing to overwrite existing state")
-    if kind == "incomplete":
-        # A first installation stopped without its cleanup, such as by kill -9 or power loss.
-        step("Removing an incomplete earlier installation")
-        oac_cli.remove(root, oac_cli.load_state(root), keep_root=True)
-    if prepared is None:
-        # Checked only now that the earlier installation is gone, so the ports it held count as free.
-        step("Checking installation settings")
-        prepared = prepare_fresh(args)
-    try:
-        install_fresh(args, root, bundle, manifest, prepared)
-    except (Exception, KeyboardInterrupt) as error:
-        state = written_state(root)
-        if state and state.get("complete") is True:
-            raise
-        # A first installation that did not finish removes what it created, before printing
-        # anything, so the same command can run again. The error goes on with the outcome.
-        error.removal = remove_created(root, state, created)
-        raise
-
-
-def install_fresh(args, root, bundle, manifest, prepared):
-    """Check the host, load images, create the installation and start it for the first time."""
-    config, moved = prepared
-    step("Checking host requirements")
-    check_host()
-    if ingress_config.enabled(config):
-        ingress_config.preflight()
-    selection = sandbox_setup.selection(bundle, manifest, "microsandbox")
-    images = image_loader(manifest, bundle)(image_names(ingress_config.enabled(config)))
-    step("Creating installation settings and credentials")
-    create(root, config, manifest, images)
-    finish(root, bundle, manifest, fresh=True, selection=selection, moved=moved)
-
-
-def interrupted(signum, frame):
-    raise KeyboardInterrupt
-
-
-if __name__ == "__main__":
-    # SIGTERM and SIGHUP, such as from a dropped SSH session, stop the installer as Ctrl-C does,
-    # so a new installation still removes what it created.
-    for signum in (signal.SIGINT, signal.SIGTERM, signal.SIGHUP):
-        signal.signal(signum, interrupted)
-    try:
-        main()
-    except (*REPORTED, OSError, ValueError, KeyError, subprocess.CalledProcessError, KeyboardInterrupt) as error:
-        with contextlib.suppress(OSError):  # The terminal may be gone.
-            install_display.error(error_text(error))
-        sys.exit(130 if isinstance(error, KeyboardInterrupt) else 1)
-    except Exception as error:
-        # An unexpected error keeps its traceback, followed by what became of a new installation.
-        traceback.print_exc()
-        if getattr(error, "removal", None):
-            print(error.removal, file=sys.stderr)
-        sys.exit(1)
diff --git a/deploy/install/install.sh b/deploy/install/install.sh
deleted file mode 100755
index 6802833bc..000000000
--- a/deploy/install/install.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-exec python3 "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/install.py" "$@"
diff --git a/deploy/install/install_output.py b/deploy/install/install_output.py
deleted file mode 100644
index 40bb30e28..000000000
--- a/deploy/install/install_output.py
+++ /dev/null
@@ -1,63 +0,0 @@
-"""Human-readable completion guidance for the Core/Web installer."""
-import shlex
-
-import sandbox_setup
-import ingress_config
-from install_display import color, heading, paragraph
-
-
-def choose_where():
-    return "on the Nodes page in Web"
-
-
-def size(resources):
-    memory = resources["memory_mib"]
-    return f'{resources["cpus"]} CPUs, ' + (f"{memory // 1024} GiB" if memory % 1024 == 0 else f"{memory} MiB")
-
-
-def sandbox_lines(config, selection, deployment, reachable):
-    if selection is None:
-        return [f"Sandboxes: none chosen. Choose a sandbox backend {choose_where()}."]
-    if deployment is None:
-        return []
-    if selection["provider"] == "e2b":
-        resources = (deployment.get("specification") or {}).get("resources") or {}
-        built = f" ({size(resources)})" if {"cpus", "memory_mib"} <= set(resources) else ""
-        return [f'Sandboxes: E2B template {selection["e2b"]["template"]}{built}. E2B runs them; no nodes are needed.']
-    lines = [f'Sandboxes: {sandbox_setup.NAMES[selection["provider"]]}, Standard ({size(selection["resources"])}).']
-    if selection["provider"] == "microsandbox":
-        lines.append("Execution nodes need KVM (/dev/kvm). This host needs KVM only if you add it as a node.")
-    if not reachable:
-        lines.append("Before adding nodes, configure a reachable HTTPS address" +
-                     (" in Web under System → Domain and HTTPS." if ingress_config.enabled(config) else
-                      " with your reverse proxy, set public_url in config.json, then run the Apply command below."))
-    add = "in Web, open Nodes and choose Add node"
-    lines.append(f"Add nodes: {add}, then run the command on each execution host.")
-    return lines
-
-
-def summary(root, config, addresses, fresh, selection, deployment, reachable, incomplete, moved=()):
-    status = ("Services are running; sandbox setup needs attention." if incomplete else
-              "Installation complete." if fresh else "Installation settings checked. Use Status below to inspect service health.")
-    print("\n" + color(status, "33" if incomplete else "32"))
-    heading("Access")
-    for address in addresses:
-        print("  " + address)
-    for purpose, taken, port in moved:
-        print(f"  Port {taken} was in use; {purpose} uses {port}.")
-    heading("Sign in")
-    print(f"  Core key file: {root / 'secrets/core.key'}")
-    paragraph("Use this key to sign in to Web. Keep it private.")
-    heading("Next")
-    if ingress_config.enabled(config) and not config["public_url"]:
-        paragraph("Open Web at the server IP and sign in. In System → Domain and HTTPS, enter your DNS hostname; the installation requests and renews its certificate. HTTPS then uses ports 80 and 443: DNS must point to this server, no other program on it may use those ports, and they must be reachable from the internet. Web checks DNS and the ports before it starts.")
-    paragraph("Create a Project and its API key on the Projects and keys page.")
-    if fresh:
-        for line in sandbox_lines(config, selection, deployment, reachable):
-            paragraph(line)
-    heading("Manage")
-    print(f"  Settings: {root / 'config.json'}")
-    command = shlex.quote(str(root / "oac"))
-    for label, action in (("Apply settings", "apply"), ("Status", "status"), ("Start", "start"), ("Stop", "stop"), ("Uninstall", "uninstall")):
-        print(f"  {label}: {command} {action}")
-    print("\nNo model request was made. Quickstart: docs/getting-started/quickstart.md", flush=True)
diff --git a/deploy/install/installer_fakes.py b/deploy/install/installer_fakes.py
deleted file mode 100644
index a79471f7b..000000000
--- a/deploy/install/installer_fakes.py
+++ /dev/null
@@ -1,367 +0,0 @@
-"""A fake Docker, systemd and HTTP host for installer tests. Nothing real is started.
-
-Compose is modelled by its observable contract: `up` recreates a container exactly
-when its resolved configuration (including env_file content) changed, each container
-keeps the labels it was created with and holds the host ports it publishes while it
-runs, and Core loads its Core key digests when it starts. systemd runs the unit it
-last loaded; its process keeps the environment it started with.
-"""
-import errno
-import hashlib
-import ipaddress
-import json
-from pathlib import Path
-import re
-import subprocess
-from types import SimpleNamespace
-from unittest import mock
-
-import oac_cli
-import sandbox_setup
-
-LABEL = "io.oac.inputs"
-STANDARD_SIZES = Path(__file__).resolve().parents[2] / "apps/web/src/features/sandbox/standard-sizes.json"
-
-
-def sha256(data):
-    return hashlib.sha256(data.encode() if isinstance(data, str) else data).hexdigest()
-
-
-class FakeHost:
-    def __init__(self, test):
-        self.commands, self.requests = [], []
-        self.containers = {}  # service -> {hash, inputs, running}
-        self.project = None  # the Compose project the containers belong to
-        self.recreated = []
-        self.native = {"active": False, "enabled": False, "starts": 0, "restarts": 0, "reloads": 0, "addr": None,
-                       "digests": [], "inputs": None, "loaded": None, "environment": ""}
-        # fails: Core never starts; rejects(core.env text): Core refuses that configuration.
-        self.core = {"port": None, "digests": [], "fails": False, "log": "", "rejects": lambda environment: False}
-        self.web_port = None
-        self.native_root = None  # the installation whose native unit systemctl manages
-        self.missing_images = set()
-        self.other_containers = {}  # image ID -> containers of other installations that use it
-        self.core_installation_id = "11111111-2222-4333-8444-555555555555"
-        self.bindings = {"nodes": 0, "nodes_on_other_address": 0, "hosted_sandboxes": 0, "self_hosted_executors": 0}
-        self.nodes = []
-        self.remote_core = {}  # web-only: origin -> (status, installation_id)
-        self.deployment_core_url = ""  # what an old Core reports for its sandbox deployment
-        self.deployment = {"provider": "", "generation": 0, "reset": None, "resources": {"allocations": 0, "pending": 0}}  # what sandbox_setup reads and posts
-        self.deployment_posts = []
-        self.deployment_refusal = None  # Core's message when it refuses the POST
-        self.busy = set()  # (address, port) of listening sockets besides the ports running containers publish
-        self.unassigned = set()  # addresses this host does not have
-        for target, name, value in ((subprocess, "run", mock.Mock(side_effect=self.run)),
-                                    (oac_cli, "http", self.http),
-                                    (oac_cli, "bind_error", self.bind_error),
-                                    (oac_cli, "tcp_listeners", lambda: [(ipaddress.ip_address(host), port)
-                                                                        for host, port in self.listening()]),
-                                    (oac_cli, "time", SimpleNamespace(sleep=lambda seconds: None)),
-                                    (sandbox_setup, "send", self.sandbox_send)):
-            patcher = mock.patch.object(target, name, value)
-            patcher.start()
-            test.addCleanup(patcher.stop)
-
-    def bind_error(self, host, port):
-        if host in self.unassigned:
-            return errno.EADDRNOTAVAIL
-        address = ipaddress.ip_address(host)
-        return errno.EADDRINUSE if any(held == port and oac_cli.overlaps(address, ipaddress.ip_address(other))
-                                       for other, held in self.listening()) else 0
-
-    def running(self):
-        return {name for name, item in self.containers.items() if item["running"]}
-
-    def listening(self):
-        """(address, port) of every listening socket: busy, and the ports running containers publish."""
-        return self.busy | {tuple(pair) for item in self.containers.values() if item["running"]
-                            for pair in item.get("ports", ())}
-
-    def run_container(self, name, port=None, digests=None):
-        """A container of an installation made outside the test, such as an earlier release."""
-        self.containers[name] = {"hash": "external", "inputs": None, "running": True}
-        if name == "core":
-            self.core.update(port=port, digests=digests or [])
-
-    # Commands ---------------------------------------------------------------
-    def run(self, args, check=False, **kwargs):
-        args = [str(item) for item in args]
-        self.commands.append(args)
-        code, stdout = 0, ""
-        if args[:2] == ["docker", "compose"] and args[2:3] == ["-f"]:
-            code, stdout = self.compose(Path(args[3]), args[4:])
-        elif args[:2] == ["docker", "compose"] and args[2:3] == ["-p"]:
-            # Without a project file Compose acts on the named project's labels alone.
-            if args[4:5] == ["down"] and args[3] == self.project:
-                self.containers.clear()
-        elif args[:2] == ["docker", "compose"]:
-            stdout = "2.30.0"
-        elif args[:3] == ["docker", "image", "inspect"]:
-            code = 1 if args[3] in self.missing_images else 0
-            stdout = "" if code else "[]" if "{{json .RepoTags}}" in args else args[3] + " linux/amd64"
-        elif args[:3] == ["docker", "image", "rm"]:
-            self.missing_images.add(args[3])
-        elif args[:3] == ["docker", "image", "ls"]:
-            stdout = "\n".join(sorted(set(MANIFEST["images"].values()) - self.missing_images))
-        elif args[:2] == ["docker", "ps"] and args[-1].startswith("ancestor="):
-            stdout = "\n".join(self.other_containers.get(args[-1].removeprefix("ancestor="), []))
-        elif args[:2] == ["docker", "ps"]:
-            stdout = "\n".join(name for name, item in self.containers.items() if item["running"]) if "--format" in args else "\n".join("id-" + name for name in self.containers)
-        elif args[:2] == ["docker", "inspect"]:
-            stdout = "\n".join(f'{name}\t{self.containers[name]["inputs"] or ""}\t'
-                               f'{"running" if self.containers[name]["running"] else "exited"}\t'
-                               for name in (item[3:] for item in args[4:]) if name in self.containers)
-        elif args[0] == "systemctl":
-            code, stdout = self.systemctl(args[2:])
-        elif args[0] == "loginctl":
-            stdout = "yes"
-        elif args[0] == "journalctl":
-            stdout = self.core["log"]
-        if check and code:
-            raise subprocess.CalledProcessError(code, args)
-        text = kwargs.get("text") or kwargs.get("universal_newlines")
-        return subprocess.CompletedProcess(args, code, stdout if text else stdout.encode(), "" if text else b"")
-
-    def service_hash(self, document, name):
-        service = document["services"][name]
-        text = json.dumps(service, sort_keys=True)
-        for path in service.get("env_file", []):
-            text += Path(path.replace("$$", "$")).read_text()
-        return sha256(text)
-
-    def compose(self, path, args):
-        document = json.loads(path.read_text()) if path.exists() else {"services": {}}
-        services = document["services"]
-        self.project = document.get("name", self.project)
-        if args[:1] == ["down"]:
-            self.containers.clear()
-            return 0, ""
-        if args[:1] == ["stop"]:
-            for name in args[1:] or services:
-                if name in self.containers:
-                    self.containers[name]["running"] = False
-            return 0, ""
-        if args[:1] == ["restart"]:
-            for name in args[1:]:
-                self.containers[name]["running"] = True
-                if name == "core":
-                    self.load_core(path.parent.parent, services[name])
-            return 0, ""
-        if args[:1] == ["logs"]:
-            return 0, self.core["log"]
-        if args[:1] == ["up"]:
-            targets = [item for item in args[1:] if not item.startswith("-") and not item.isdigit()]
-            names = list(services) if not targets else [
-                name for name in ("database", "migrate", *targets) if name in services and
-                (name in targets or name in ("database", "migrate") and "core" in targets)]
-            for name in names:
-                digest = self.service_hash(document, name)
-                current = self.containers.get(name)
-                if current is None or current["hash"] != digest:
-                    self.containers[name] = {"hash": digest, "inputs": services[name].get("labels", {}).get(LABEL),
-                                             "running": False,
-                                             "ports": [[host.strip("[]"), int(port)] for host, port, _ in
-                                                       (item.rsplit(":", 2) for item in services[name].get("ports", []))]}
-                    self.recreated.append(name)
-                    if name == "core":
-                        self.load_core(path.parent.parent, services[name])
-                if name != "migrate":
-                    self.containers[name]["running"] = True
-            if "web" in names:
-                web = services["web"]
-                if "gateway" in services:
-                    web = services["gateway"]
-                self.web_port = int(web["ports"][0].rsplit(":", 2)[1]) if "ports" in web else int(
-                    web["environment"]["OAC_WEB_ADDR"].rsplit(":", 1)[1])
-            environment = path.parent / "core.env"
-            if "core" in names and (self.core["fails"] or
-                                    self.core["rejects"](environment.read_text() if environment.exists() else "")):
-                self.containers["core"]["running"] = False
-                self.core["failed"] = True
-                return 1, ""
-        return 0, ""
-
-    def load_core(self, root, service):
-        if "ports" in service:
-            self.core["port"] = int(service["ports"][0].rsplit(":", 2)[1])
-        digests = root / "generated/core-key-digests.json"
-        self.core["digests"] = json.loads(digests.read_text())
-        environment = root / "generated/core.env"
-        self.core["environment"] = environment.read_text() if environment.exists() else ""
-
-    def unit_file(self):
-        found = sorted(self.native_root.glob("generated/oac-*-core.service"))
-        return found[0].read_text() if found else ""
-
-    def systemctl(self, args):
-        native = self.native
-        if args[0] == "daemon-reload":
-            native["reloads"] += 1
-            native["loaded"] = self.unit_file()
-        elif args[0] in ("enable", "restart", "start"):
-            native["enabled"] = native["enabled"] or args[0] == "enable"
-            if args[0] != "restart" and native["active"]:
-                return 0, ""  # systemd leaves an active unit alone on start and enable --now
-            native["starts" if args[0] != "restart" else "restarts"] += 1
-            if native["loaded"] is None:
-                native["loaded"] = self.unit_file()
-            environment = self.native_root / "generated/core.env"
-            refused = self.core["fails"] or self.core["rejects"](environment.read_text() if environment.exists() else "")
-            native["active"] = not refused
-            self.core["failed"] = self.core.get("failed") or refused
-            match = re.search(r"^Environment=OAC_INPUTS=(\w+)$", native["loaded"], re.M)
-            native["inputs"] = match[1] if match and native["active"] else None
-            root = self.native_root
-            environment = root / "generated/core.env"
-            if environment.exists():
-                address = next(line for line in environment.read_text().splitlines() if line.startswith("OAC_ADDR="))
-                native["addr"] = int(address.rsplit(":", 1)[1].rstrip('"'))
-                native["digests"] = json.loads((root / "generated/core-key-digests.json").read_text())
-                native["environment"] = environment.read_text()
-        elif args[0] == "stop":
-            native["active"], native["inputs"] = False, None
-        elif args[0] == "disable":
-            if not native["enabled"]:
-                return 1, ""  # the unit file was never linked
-            native["enabled"] = False
-            if "--now" in args:
-                native["active"], native["inputs"] = False, None
-        elif args[0] == "is-active":
-            return (0 if native["active"] else 3), ""
-        elif args[0] == "show" and "--property=MainPID" in args:
-            return 0, "4242" if native["active"] else "0"
-        elif args[0] == "show" and "--property=LoadState" in args:
-            return 0, "loaded" if native["enabled"] or native["active"] else "not-found"
-        elif args[0] == "show":
-            return 0, "252"
-        return 0, ""
-
-    def process_environment(self, pid):
-        return {"OAC_INPUTS": self.native["inputs"]} if self.native["inputs"] else {}
-
-    # HTTP -------------------------------------------------------------------
-    def core_listening(self, port):
-        if self.containers.get("core", {}).get("running") and self.core["port"] == port:
-            return self.core["digests"]
-        if self.native["active"] and self.native["addr"] == port:
-            return self.native["digests"]
-        return None
-
-    def http(self, url, headers=None, timeout=5):
-        self.requests.append(url)
-        headers = headers or {}
-        origin, _, path = url.partition("://")[2].partition("/")
-        path = "/" + path
-        key = headers.get("Authorization", "").removeprefix("Bearer ")
-        for remote, (status, installation) in self.remote_core.items():
-            if url.startswith(remote + "/"):
-                return status, json.dumps({"installation_id": installation}).encode()
-        port = int(origin.rsplit(":", 1)[1])
-        digests = self.core_listening(port)
-        web_up = self.containers.get("web", {}).get("running") and self.web_port == port
-        if path == "/healthz":
-            return (200, b"{}") if digests is not None or web_up else (0, b"")
-        if path == "/console/auth":
-            return (200, b"{}") if web_up else (0, b"")
-        if digests is None:
-            return 0, b""
-        if sha256(key) not in digests:
-            return 401, b""
-        if path == "/core/v1/installation":
-            native = self.native["active"] and self.native["addr"] == port
-            environment = self.native["environment"] if native else self.core.get("environment", "")
-            match = re.search(r'^OAC_PUBLIC_URL="([^"]+)"$', environment, re.M)
-            public = match[1] if match else None
-            return 200, json.dumps({"installation_id": self.core_installation_id, "public_url": public,
-                                    "address_bindings": self.bindings}).encode()
-        if path == "/core/v1/sandbox/nodes":
-            return 200, json.dumps({"data": self.nodes}).encode()
-        if path == "/core/v1/sandbox/deployment":
-            return 200, json.dumps(dict(self.deployment, core_url=self.deployment_core_url,
-                installation_id=self.core_installation_id)).encode()
-        return 404, b""
-
-    def sandbox_send(self, req):
-        origin, _, path = req.full_url.partition("://")[2].partition("/")
-        port = int(origin.rsplit(":", 1)[1])
-        digests = self.core_listening(port)
-        if digests is None:
-            raise ConnectionRefusedError()
-        if sha256(req.get_header("Authorization", "").removeprefix("Bearer ")) not in digests:
-            return 401, b'{"error": {"message": "Invalid Core key"}}'
-        if path != "core/v1/sandbox/deployment":
-            return 404, b""
-        if req.get_method() in ("POST", "PUT"):
-            selection = json.loads(req.data)
-            self.deployment_posts.append(selection)
-            if selection.get("expected_generation") != self.deployment.get("generation", 0):
-                return 409, b'{"error":{"code":"generation_stale","message":"Deployment generation changed"}}'
-            if self.deployment_refusal:
-                return 409, json.dumps({"error": {"message": self.deployment_refusal}}).encode()
-            # E2B adopts the template build's size.
-            self.deployment = {"provider": selection["provider"], "generation": self.deployment.get("generation", 0) + 1,
-                "reset": None, "resources": {"allocations": 0, "pending": 0},
-                "specification": {"runtime": selection.get("runtime"), "resources": selection.get("resources", {"cpus": 2, "memory_mib": 2048})}}
-        native = self.native["active"] and self.native["addr"] == port
-        environment = self.native["environment"] if native else self.core.get("environment", "")
-        installation = re.search(r'^OAC_INSTALLATION_ID="([^"]+)"$', environment, re.M)
-        return 200, json.dumps(dict(self.deployment, installation_id=installation[1] if installation else self.core_installation_id)).encode()
-
-
-MANIFEST = {
-    "source_commit": "a" * 40,
-    "images": {name: "sha256:" + digit * 64 for name, digit in (
-        ("core", "1"), ("runtime", "2"), ("database", "3"), ("web", "4"), ("ingress", "7"))},
-    "image_manifest_digests": {name: "sha256:" + digit * 64 for name, digit in (
-        ("core", "a"), ("runtime", "b"), ("database", "c"), ("web", "d"), ("ingress", "e"))},
-    "runtime_ref": "oac-runtime@sha256:" + "b" * 64,
-    "microsandbox": {"runtime_sha256": "5" * 64, "firmware_sha256": "6" * 64},
-}
-MODULES = ("install.py", "install_output.py", "install_display.py", "configuration.py", "config_model.py", "ingress.py", "ingress_config.py", "config.schema.json", "oac_cli.py",
-           "sandbox_setup.py", "node_spec.py", "distribution.py", "install.sh")
-
-
-def write_checksums(bundle):
-    files = sorted(path for path in bundle.rglob("*") if path.is_file() and path.name != "SHA256SUMS")
-    (bundle / "SHA256SUMS").write_text("".join(
-        sha256(path.read_bytes()) + "  " + str(path.relative_to(bundle)) + "\n" for path in files))
-
-
-def make_bundle(directory, manifest, commit=None):
-    """A synthetic distribution with this checkout's installer modules."""
-    manifest = json.loads(json.dumps(manifest))
-    if commit:
-        manifest["source_commit"] = commit
-    bundle = Path(directory)
-    (bundle / "images").mkdir(parents=True)
-    (bundle / "runtime").mkdir()
-    (bundle / "runtime/seccomp.json").write_text('{"defaultAction":"SCMP_ACT_ERRNO"}')
-    for name in MODULES:
-        (bundle / name).write_bytes(Path(__file__).with_name(name).read_bytes())
-    (bundle / "standard-sizes.json").write_bytes(STANDARD_SIZES.read_bytes())
-    (bundle / "node-install.pyz").write_bytes(b"synthetic verified Python bootstrap")
-    (bundle / "oac.pyz").write_bytes(b"synthetic oac command " + manifest["source_commit"].encode())
-    manifest["artifacts"] = {}
-    for name in ("images/runtime.tar.gz", "native/bin/oac-node",
-                 "native/bin/oac-microsandbox-provider", "native/microsandbox/msb",
-                 "native/microsandbox/libkrunfw.so.5.6.1"):
-        manifest["artifacts"][name] = {"filename": "oac-" + manifest["source_commit"] + "-" + name.replace("/", "-"),
-                                       "sha256": "a" * 64, "size": 1}
-    (bundle / "manifest.json").write_text(json.dumps(manifest))
-    for name in manifest["images"]:
-        (bundle / "images" / (name + ".tar")).write_bytes(("synthetic " + name).encode())
-    for name in ("bin/oac-microsandbox-provider",
-                 "bin/oac-node", "microsandbox/msb", "microsandbox/libkrunfw.so.5.6.1"):
-        path = bundle / "native" / name
-        path.parent.mkdir(parents=True, exist_ok=True)
-        path.write_bytes(b"\x7fELFsynthetic native file " + manifest["source_commit"].encode())
-    write_checksums(bundle)
-    return bundle, manifest
-
-
-def run_installer(install, bundle, argv):
-    """install.main from the bundle on a Linux amd64 host."""
-    with mock.patch.object(install, "__file__", str(bundle / "install.py")), \
-            mock.patch.object(install.platform, "system", return_value="Linux"), \
-            mock.patch.object(install.platform, "machine", return_value="x86_64"):
-        return install.main([str(item) for item in argv])
diff --git a/deploy/install/native_installers.py b/deploy/install/native_installers.py
deleted file mode 100644
index 5a7194efd..000000000
--- a/deploy/install/native_installers.py
+++ /dev/null
@@ -1,54 +0,0 @@
-"""Retain matched catalog metadata and explicitly supplied offline installers."""
-
-import json
-import os
-from pathlib import Path
-import re
-import shutil
-import tempfile
-
-
-from distribution import digest
-
-
-def prepare(root, state, bundle):
-    source, target = Path(bundle) / "native-installers", Path(root) / "native-installers"
-    if not source.exists():
-        return
-    if source.is_symlink() or not source.is_dir() or target.is_symlink():
-        raise RuntimeError("Invalid native installer directory")
-    catalog_path = source / "catalog.json"
-    if catalog_path.is_symlink():
-        raise RuntimeError("Invalid native installer catalog")
-    catalog = json.loads(catalog_path.read_text())
-    if catalog["version"] != state["source_commit"]:
-        raise RuntimeError("Native installer catalog does not match Core")
-    expected = {"catalog.json": digest(catalog_path)}
-    for platform, artifact in catalog["artifacts"].items():
-        if not re.fullmatch(r"(linux|darwin|windows)-(amd64|arm64)", platform):
-            raise RuntimeError("Invalid native installer platform")
-        expected[platform + ".tar.gz"] = artifact["sha256"]
-    # Validate both directories before filling any missing files. Offline content
-    # already installed stays available when repairing with a thin bundle.
-    for directory in (source, target):
-        if not directory.exists():
-            continue
-        for path in directory.iterdir():
-            if (path.name not in expected or path.is_symlink() or not path.is_file()
-                    or digest(path) != expected[path.name]):
-                raise RuntimeError("Native installer files differ; preserve them and inspect the distribution")
-    target.mkdir(mode=0o700, exist_ok=True)
-    for name in expected:
-        incoming, installed = source / name, target / name
-        if not incoming.exists() or installed.exists():
-            continue
-        descriptor, temporary = tempfile.mkstemp(prefix=".native-installer-", dir=root)
-        try:
-            with os.fdopen(descriptor, "wb") as outgoing, incoming.open("rb") as stream:
-                shutil.copyfileobj(stream, outgoing)
-                outgoing.flush()
-                os.fsync(outgoing.fileno())
-            os.replace(temporary, installed)
-        finally:
-            if os.path.exists(temporary):
-                os.unlink(temporary)
diff --git a/deploy/install/oac_cli.py b/deploy/install/oac_cli.py
deleted file mode 100644
index 0c8923308..000000000
--- a/deploy/install/oac_cli.py
+++ /dev/null
@@ -1,1102 +0,0 @@
-"""oac: status, start, stop, apply, rotate-core-key and uninstall for one installation.
-
-The installation directory is the directory that holds the command. The bundle it
-was installed from is never needed. config.json is the only file an operator edits;
-apply renders generated/ from it and converges the running services on that render.
-What runs is the truth: each Compose container carries the inputs digest it was
-created with (label io.oac.inputs), so an interrupted apply, rotation or
-rollback is finished by the next apply.
-"""
-import argparse
-import contextlib
-import datetime
-import errno
-import fcntl
-from http.client import HTTPException
-import ipaddress
-import json
-import os
-from pathlib import Path
-import re
-import secrets
-import shlex
-import shutil
-import signal
-import socket
-import stat
-import subprocess
-import sys
-import tempfile
-import time
-import urllib.error
-import urllib.request
-from urllib.parse import urlsplit
-
-import config_model
-import ingress_config
-import configuration
-
-
-SOURCE_COMMIT = None  # Set by the packaged entrypoint from its build revision.
-UNSUPPORTED_VERSION = ("This installation version is not supported; "
-                       "preserve its data and reinstall into a new empty directory. Nothing was changed.")
-INCOMPLETE = ("This installation did not finish installing. Rerun the installer command, which removes what is "
-              "left and installs again, or remove it with oac uninstall.")
-
-
-class OacError(Exception):
-    pass
-
-
-class ApplyFailed(OacError):
-    """apply wrote the files, but the services did not converge on them; cause says why."""
-    def __init__(self, message, cause):
-        super().__init__(message)
-        self.cause = cause
-
-
-def run(args, **kwargs):
-    # Never print a generated Compose file, process environment or secret value.
-    return subprocess.run(args, **dict({"check": True}, **kwargs))
-
-
-def now():
-    return datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
-
-
-# Private files ---------------------------------------------------------------
-
-def private_parent(target):
-    """Create the canonical installation parent and keep the default home private."""
-    parent = target.parent
-    if parent.is_symlink() or parent.resolve() != parent:
-        raise OacError("The destination's parent must be canonical and not a symlink")
-    parent.mkdir(mode=0o700, parents=True, exist_ok=True)
-    if parent == Path.home() / ".oac":
-        os.chmod(parent, 0o700)
-
-
-def check_private(path, what):
-    try:
-        info = os.lstat(path)
-    except FileNotFoundError:
-        raise OacError(f"{what} is missing") from None
-    if (not stat.S_ISREG(info.st_mode) or stat.S_IMODE(info.st_mode) & 0o077
-            or info.st_uid != os.geteuid() or info.st_nlink != 1):
-        raise OacError(f"{what} must be a regular file with mode 0600, owned by you, and not a link")
-
-
-def check_directories(root):
-    """The installation, secrets/ and generated/ are real private directories of this user."""
-    for path, what in ((root, str(root)), (root / "secrets", "secrets/"), (root / "generated", "generated/")):
-        try:
-            info = os.lstat(path)
-        except FileNotFoundError:
-            raise OacError(f"{what} is missing") from None
-        if (not stat.S_ISDIR(info.st_mode) or stat.S_IMODE(info.st_mode) & 0o077
-                or info.st_uid != os.geteuid()):
-            raise OacError(f"{what} must be a directory with mode 0700, owned by you, and not a link")
-
-
-def read_private(path, what):
-    check_private(path, what)
-    descriptor = os.open(path, os.O_RDONLY | os.O_NOFOLLOW)
-    with os.fdopen(descriptor, "rb") as stream:
-        return stream.read()
-
-
-def create_private(path, data):
-    descriptor = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
-    with os.fdopen(descriptor, "wb") as stream:
-        stream.write(data.encode() if isinstance(data, str) else data)
-
-
-def write_private(path, data):
-    """Replace a file atomically with a 0600 copy in the same directory."""
-    path = Path(path)
-    descriptor, temporary = tempfile.mkstemp(prefix="." + path.name + ".", dir=path.parent)
-    try:
-        with os.fdopen(descriptor, "wb") as stream:
-            stream.write(data.encode() if isinstance(data, str) else data)
-            stream.flush()
-            os.fsync(stream.fileno())
-        os.replace(temporary, path)
-        directory = os.open(path.parent, os.O_RDONLY | os.O_DIRECTORY)
-        try:
-            os.fsync(directory)
-        finally:
-            os.close(directory)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
-
-
-def load_config(root):
-    raw = read_private(root / "config.json", "config.json")
-    try:
-        document = json.loads(raw)
-    except ValueError as error:
-        line = getattr(error, "lineno", "?")
-        raise OacError(f"config.json is not valid JSON (line {line})") from None
-    return config_model.validate(document)
-
-
-def load_state(root):
-    state = json.loads(read_private(root / "state.json", "state.json"))
-    if (state.get("format") != 2
-            or SOURCE_COMMIT is not None and state.get("source_commit") != SOURCE_COMMIT):
-        raise OacError(UNSUPPORTED_VERSION)
-    return state
-
-
-def save_state(root, state):
-    write_private(root / "state.json", json.dumps(state, indent=2) + "\n")
-
-
-def check_complete(state):
-    """Only the installer uses an installation before its first start has finished."""
-    if state.get("complete") is not True:
-        raise OacError(INCOMPLETE)
-
-
-@contextlib.contextmanager
-def locked(root):
-    if (root / "state.json").exists():
-        load_state(root)
-    descriptor = os.open(root / ".oac.lock", os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW, 0o600)
-    try:
-        try:
-            fcntl.flock(descriptor, fcntl.LOCK_EX | fcntl.LOCK_NB)
-        except BlockingIOError:
-            raise OacError("Another oac command is running for this installation") from None
-        try:
-            current = os.stat(root / ".oac.lock", follow_symlinks=False)
-        except FileNotFoundError:
-            current = None
-        if current is None or not os.path.samestat(current, os.fstat(descriptor)):
-            # The holder removed the installation, lock file included, after this command opened it.
-            raise OacError("Another oac command is running for this installation")
-        if (root / "state.json").exists():
-            load_state(root)
-        yield
-    finally:
-        os.close(descriptor)
-
-
-# What runs ---------------------------------------------------------------------
-
-def compose(root, *args, **kwargs):
-    return run(["docker", "compose", "-f", str(root / "generated/compose.json"), *args], **kwargs)
-
-
-INSPECT = ('{{index .Config.Labels "com.docker.compose.service"}}\t{{index .Config.Labels "' + configuration.LABEL
-           + '"}}\t{{.State.Status}}\t{{if .State.Health}}{{.State.Health.Status}}{{end}}')
-
-
-def observe(state):
-    """{service: {running, inputs, health}} of this installation's containers."""
-    result = {}
-    ids = run(["docker", "ps", "-aq", "--filter", f'label=com.docker.compose.project={state["project"]}',
-               "--filter", "label=com.docker.compose.oneoff=False"], capture_output=True, text=True).stdout.split()
-    if ids:
-        for line in run(["docker", "inspect", "--format", INSPECT, *ids], capture_output=True, text=True).stdout.splitlines():
-            service, inputs, status, health = (line.split("\t") + ["", "", "", ""])[:4]
-            if service:
-                result[service] = {"running": status == "running", "inputs": inputs or None, "health": health}
-    return result
-
-
-def tcp_listeners():
-    """(address, port) of each listening TCP socket in this network namespace."""
-    for table in ("/proc/net/tcp", "/proc/net/tcp6"):
-        try:
-            lines = Path(table).read_text().splitlines()[1:]
-        except OSError:
-            continue
-        for line in lines:
-            fields = line.split()
-            if fields[3] != "0A":  # TCP_LISTEN
-                continue
-            raw, _, port = fields[1].partition(":")
-            # The kernel prints each 32-bit word of the address in host byte order, little-endian on amd64.
-            packed = b"".join(bytes.fromhex(raw[index:index + 8])[::-1] for index in range(0, len(raw), 8))
-            yield ipaddress.ip_address(packed), int(port, 16)
-
-
-def overlaps(first, second):
-    if first.version != second.version:
-        # Of two families, only a dual-stack IPv6 wildcard also takes IPv4 addresses.
-        return (first if first.version == 6 else second).is_unspecified
-    return first.is_unspecified or second.is_unspecified or first == second
-
-
-def bind_error(host, port):
-    """The errno of binding host:port as the services do, or 0 when the bind succeeds.
-
-    SO_REUSEADDR, which Go and Docker listeners set, lets connections in TIME_WAIT pass.
-    """
-    try:
-        with socket.socket(socket.AF_INET6 if ipaddress.ip_address(host).version == 6 else socket.AF_INET) as probe:
-            probe.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-            probe.bind((host, port))
-    except OSError as error:
-        return error.errno
-    return 0
-
-
-def address_available(host):
-    """Whether host is an address of this machine or a wildcard, so services can bind to it."""
-    return bind_error(host, 0) not in (errno.EADDRNOTAVAIL, errno.EAFNOSUPPORT)
-
-
-def port_free(host, port, own=()):
-    """Whether a listener could bind host:port now.
-
-    own holds this installation's (address, port) listeners, which do not count. Where
-    one overlaps host:port, or the account may not bind a port below 1024, the kernel's
-    table of listening sockets decides instead of a bind.
-    """
-    address = ipaddress.ip_address(host)
-    own = {(other, held) for other, held in own if held == port and overlaps(address, other)}
-    if not own:
-        error = bind_error(host, port)
-        if error not in (errno.EACCES, errno.EPERM):
-            return error != errno.EADDRINUSE
-    return not any(held == port and overlaps(address, other) and (other, held) not in own
-                   for other, held in tcp_listeners())
-
-
-def port_in_use(listener, name, outcome=""):
-    """The message for a port that another program holds; name is its flag or config.json key."""
-    remedy = "Free it" if listener.purpose == "HTTPS" else "Free it or choose another port"
-    return (f"Port {listener.port} ({name}) is already in use on {listener.host}.{outcome} {remedy}; "
-            f"find the process with: sudo ss -ltnp 'sport = :{listener.port}'")
-
-
-def stale(actual, desired, will_run):
-    """Services that should run but don't, or run with other inputs."""
-    return {name for name in will_run if name != "migrate" and (
-        not actual.get(name, {}).get("running") or actual[name]["inputs"] != desired.get(name))}
-
-
-def converge(root, state, desired, will_run, force=()):
-    """Bring every service in will_run to the desired inputs; Core first, then the rest.
-
-    Compose recreates exactly the containers whose configuration (and so label)
-    differs.
-    """
-    actual = observe(state)
-    todo = stale(actual, desired, will_run) | set(force)
-    if not todo:
-        return set()
-    up = ["up", "--detach", "--wait", "--wait-timeout", "300"]
-    if "core" in todo:
-        if "core" in force and not stale(actual, desired, {"core"}):
-            compose(root, "restart", "core")
-        else:
-            compose(root, *up, "core")
-    if will_run:
-        compose(root, *up)
-    for name in sorted(set(force) & will_run - {"core"}):
-        if not stale(actual, desired, {name}):
-            compose(root, "restart", name)
-    return todo
-
-
-def core_error_line(root):
-    """Core's single startup failure line. Core logs no environment values."""
-    try:
-        output = compose(root, "logs", "--no-log-prefix", "--tail", "200", "core",
-                         capture_output=True, text=True).stdout
-    except (subprocess.CalledProcessError, OSError):
-        return None
-    lines = [line.strip() for line in output.splitlines() if "oac-core startup failed" in line]
-    return lines[-1] if lines else None
-
-
-def describe(error):
-    """A failure message without command paths, output or environment."""
-    if isinstance(error, subprocess.CalledProcessError):
-        # A command's own path shows as its name; other paths and options are left out.
-        words = [Path(word).name if index == 0 else word for index, word in enumerate(error.cmd)
-                 if index == 0 or not word.startswith(("/", "-"))][:3]
-        return f"`{' '.join(words)}` failed"
-    if isinstance(error, KeyboardInterrupt):
-        return "it was interrupted"
-    return str(error)
-
-
-# HTTP ------------------------------------------------------------------------
-
-class _NoRedirect(urllib.request.HTTPRedirectHandler):
-    def redirect_request(self, *args, **kwargs):
-        return None
-
-
-def http(url, headers=None, timeout=5):
-    """(status, body). Credentials go only to this URL: no redirects, no ambient proxy."""
-    opener = urllib.request.build_opener(urllib.request.ProxyHandler({}), _NoRedirect())
-    try:
-        with opener.open(urllib.request.Request(url, headers=headers or {}), timeout=timeout) as response:
-            return response.status, response.read(1024 * 1024)
-    except urllib.error.HTTPError as error:
-        return error.code, b""
-    except (urllib.error.URLError, OSError, ValueError):
-        return 0, b""
-
-
-def wait_status(url, headers=None, expect=200, attempts=60):
-    for attempt in range(attempts):
-        status, body = http(url, headers)
-        if status == expect:
-            return body
-        if attempt + 1 < attempts:
-            time.sleep(1)
-    return None
-
-
-def bearer(key):
-    return {"Authorization": "Bearer " + key}
-
-
-def core_base(config):
-    return configuration.service_origin(config, "core")
-
-
-def health(root, config, expected):
-    """config needs public_url and ports; it may be the view of what was last written."""
-    if "core" in expected:
-        base = core_base(config)
-        if wait_status(base + "/healthz") is None:
-            raise OacError("Core did not become healthy")
-        if wait_status(base + "/core/v1/installation", bearer(configuration.read_core_key(root)), attempts=10) is None:
-            raise OacError("Core did not accept the Core key at /core/v1/installation")
-    if "web" in expected:
-        url = configuration.service_origin(config, "web")
-        path = "/healthz" if ingress_config.enabled(config) else "/console/auth"
-        if wait_status(url + path, {"Host": urlsplit(config["public_url"] or url).netloc}) is None:
-            raise OacError("Web sign-in is unavailable")
-
-
-# Files -------------------------------------------------------------------------
-
-def check_fixed(config, state):
-    """state.json records the ingress images at installation; it wins over config.json."""
-    if ingress_config.enabled(config) != ("ingress" in state["images"]):
-        raise OacError("ingress is fixed after installation; install separately to change it")
-
-
-def check_secrets(root, state):
-    reasons = {"credential.key": "Stored credentials can only be read with the original key.",
-               "database.password": "PostgreSQL keeps the password it was initialized with."}
-    for name, reason in reasons.items():
-        data = read_private(root / "secrets" / name, "secrets/" + name)
-        if configuration.sha256(data) != state["secrets_sha256"][name]:
-            raise OacError(f"secrets/{name} changed since installation. {reason} "
-                              "Restore the original file; nothing was applied.")
-    check_private(root / "secrets/core.key", "secrets/core.key")
-    configuration.read_core_key(root)
-
-
-def read_generated(root, names):
-    result = {}
-    for name in names:
-        path = root / "generated" / name
-        result[name] = path.read_bytes() if path.is_file() and not path.is_symlink() else None
-    return result
-
-
-def comparable(name, data):
-    """File content as compared for edits; the snapshot's applied_at is not an edit."""
-    if data is not None and name == "settings.json":
-        try:
-            document = json.loads(data)
-            document.pop("applied_at", None)
-            return json.dumps(document, sort_keys=True).encode()
-        except (ValueError, AttributeError):
-            return data
-    return data.encode() if isinstance(data, str) else data
-
-
-def edited_files(state, disk, rendered):
-    """Generated files that match neither a digest oac wrote nor the current render.
-
-    state.json keeps the last few digests written for each file, so a run
-    interrupted between writing files and state.json is not taken for an edit. A
-    missing file is simply written again.
-    """
-    edited = []
-    for name, digests in sorted((state.get("generated") or {}).items()):
-        data = disk.get(name)
-        if data is None or configuration.sha256(data) in digests:
-            continue
-        if name in rendered.files and comparable(name, data) == comparable(name, rendered.files[name]):
-            continue
-        edited.append(name)
-    return edited
-
-
-def record_digests(state, files):
-    generated = dict(state.get("generated") or {})
-    for name, text in files.items():
-        digest = configuration.sha256(text)
-        generated[name] = ([item for item in generated.get(name, []) if item != digest] + [digest])[-3:]
-    return dict(state, generated=generated)
-
-
-def disk_view(disk):
-    """The settings last written, by key, and the snapshot's stamp.
-
-    Sensitive values are not in the snapshot; the one sensitive setting is read back
-    from the runtime-history.json that carries it.
-    """
-    try:
-        document = json.loads(disk.get("settings.json") or b"")
-        values = {item["key"]: item["value"] for item in document["settings"]}
-    except (ValueError, KeyError, TypeError):
-        return None, None
-    if "core.runtime_history.headers" in values:
-        history = disk.get("runtime-history.json")
-        try:
-            values["core.runtime_history.headers"] = json.loads(history).get("headers") if history else None
-        except (ValueError, AttributeError):
-            values["core.runtime_history.headers"] = None
-    return values, document.get("applied_at")
-
-
-def render_now(root, config, state, candidate=None):
-    """The render of config.json, keeping the written stamp unless something changed."""
-    names = set((state.get("generated") or {}))
-    disk = read_generated(root, names | {"settings.json", "runtime-history.json"})
-    previous, stamp = disk_view(disk)
-    rendered = configuration.render(root, config, state, stamp or now(), candidate)
-    disk = read_generated(root, names | set(rendered.files) | {"runtime-history.json"})
-    if any(comparable(name, disk.get(name)) != comparable(name, text) for name, text in rendered.files.items()) \
-            or any(disk.get(name) is not None for name in names - set(rendered.files)):
-        rendered = configuration.render(root, config, state, now(), candidate)
-    return rendered, disk, previous
-
-
-# Apply -----------------------------------------------------------------------
-
-def old_public_url(root, config, previous, disk, actual):
-    """The public URL things are bound to: Core's own answer, else the written core.env."""
-    old_config = applied_view(previous) if previous else config
-    base = core_base(old_config)
-    if actual.get("core", {}).get("running"):
-        status, body = http(base + "/core/v1/installation", bearer(configuration.read_core_key(root)))
-        if status == 200:
-            return json.loads(body).get("public_url"), base, True
-    try:
-        written = configuration.read_environment((disk.get("core.env") or b"").decode())
-    except RuntimeError:
-        written = {}
-    return written.get("OAC_PUBLIC_URL"), base, False
-
-
-def confirm_public_url(root, config, old, base, core_answered, args, interactive, out):
-    """Changing the public URL strands what is bound to the old one; list it and confirm.
-
-    old is None when it can't be read; then the change always needs confirmation.
-    """
-    new = configuration.local_public_url(config)
-    if old == new:
-        return
-    counts, nodes = None, []
-    if core_answered:
-        key = configuration.read_core_key(root)
-        status, body = http(base + "/core/v1/installation", bearer(key))
-        if status == 200:
-            counts = json.loads(body).get("address_bindings") or {}
-            # The node list only names them; the count comes from Core's own bindings.
-            status, body = http(base + "/core/v1/sandbox/nodes", bearer(key))
-            nodes = [node for node in (json.loads(body).get("data", []) if status == 200 else [])
-                     if node.get("core_url") == old]
-    if old is None:
-        out(f"The public URL in use can't be read, so the change to {new} needs confirmation.")
-    else:
-        out(f"The public URL changes from {old} to {new}.")
-    if counts is not None:
-        bound = max(0, counts.get("nodes", 0) - counts.get("nodes_on_other_address", 0))
-        out(f'Bound to the current address: {bound} node(s), {counts.get("hosted_sandboxes", 0)} hosted sandbox(es), '
-            f'{counts.get("self_hosted_executors", 0)} self-hosted executor credential(s).')
-        for node in nodes:
-            out(f'  node {node.get("name")}: {"online" if node.get("online") else "offline"}')
-        if not (bound or counts.get("hosted_sandboxes") or counts.get("self_hosted_executors")):
-            return
-    elif old is not None:
-        out("Core is not running, so the nodes, sandboxes and executors bound to the address can't be counted.")
-    out("After the change, nodes on the old address get no new sandboxes; remove them in Web and add them again.\n"
-        "Existing sandboxes and executors keep working only while the old address still reaches this Core, so\n"
-        "keep the old route until they are replaced. Self-hosted executors must restart with the new remote_url.")
-    if args.dry_run:
-        out("Applying this change needs confirmation.")
-    elif args.confirm_public_url_change is not None:
-        if args.confirm_public_url_change != new:
-            raise OacError(f"--confirm-public-url-change must equal the new public URL {new}; nothing was applied")
-    elif interactive:
-        if input("Type the new public URL to continue: ").strip() != new:
-            raise OacError("The public URL change was not confirmed; nothing was applied")
-    else:
-        raise OacError(f"Confirm with --confirm-public-url-change {new}; nothing was applied")
-
-
-def own_listeners(config, previous, disk, actual):
-    """(address, port) of this installation's listeners: those of the settings last written, and
-    those of the gateway, which domain setup widens before public_url changes, while it runs as written."""
-    applied = applied_view(previous)
-    own = {(ipaddress.ip_address(listener.host), listener.port) for listener in configuration.listeners(applied)}
-    gateway = actual.get("gateway", {})
-    if gateway.get("running") and gateway.get("inputs") == configuration.rendered_inputs(disk).get("gateway"):
-        own |= ingress_config.written_listeners(disk.get("compose.json"))
-    return own
-
-
-def taken_listeners(config, own, candidate=None):
-    """The listeners of config, and of a domain candidate, that another program holds."""
-    return [listener for listener in configuration.listeners(config, candidate)
-            if (ipaddress.ip_address(listener.host), listener.port) not in own
-            and not port_free(listener.host, listener.port, own)]
-
-
-def check_new_listeners(config, previous, disk, actual, candidate=None):
-    """Each listener this change adds must be free; this installation's own listeners do not count."""
-    if previous is None:
-        return
-    applied = applied_view(previous)
-    if config["host"] != applied["host"] and not address_available(config["host"]):
-        raise OacError(f"{config['host']} (host) is not an address of this machine; use one of its addresses. "
-                       "Nothing was applied.")
-    taken = taken_listeners(config, own_listeners(config, previous, disk, actual), candidate)
-    if taken:
-        raise OacError(port_in_use(taken[0], taken[0].setting, " Nothing was applied."))
-
-
-def finish_apply(root, config, state, gateway_document, will_run, candidate=None, keep_unfinished=False):
-    """With a candidate, domain setup verifies it and records its own status. keep_unfinished
-    leaves an unfinished domain setup recorded, so its status reports the interruption."""
-    managed = ingress_config.enabled(config) and "gateway" in will_run
-    if managed:
-        import ingress
-        # Container input labels cannot prove which configuration Caddy loaded.
-        ingress_config.reload(root, gateway_document)
-        if config["public_url"] and not candidate:
-            ingress.verify(config["public_url"], state["installation_id"])
-    health(root, config, will_run)
-    if managed and not candidate and not (keep_unfinished and ingress.unfinished(root)):
-        ingress.save(root, {"state": "ready" if config["public_url"] else "unconfigured",
-                            "public_url": config["public_url"], "target_url": config["public_url"], "message": None})
-
-
-def apply(root, dry_run=False, discard_edits=False, confirm_public_url_change=None,
-          start=False, interactive=None, out=print, retry=None):
-    root = Path(root)
-    args = argparse.Namespace(dry_run=dry_run, confirm_public_url_change=confirm_public_url_change)
-    interactive = sys.stdin.isatty() if interactive is None else interactive
-    with locked(root):
-        check_complete(load_state(root))
-        return _apply(root, args, discard_edits, start, interactive, out, retry=retry)
-
-
-def _apply(root, args, discard_edits, start, interactive, out, rollback=True, retry=None, candidate=None):
-    """candidate: see configuration.render."""
-    retry = retry or f"run {root / 'oac'} apply again"
-    check_directories(root)
-    config = load_config(root)
-    state = load_state(root)
-    check_fixed(config, state)
-    check_secrets(root, state)
-    rendered, disk, previous = render_now(root, config, state, candidate)
-    edited = edited_files(state, disk, rendered)
-    if edited and not discard_edits:
-        raise OacError("\n".join(f"generated/{name} was edited by hand." for name in edited)
-                          + "\nPut the change in config.json and run oac apply --discard-edits, which keeps the"
-                          " edited copy as generated/<file>.edited-<time>. Nothing was applied.")
-    actual = observe(state)
-    check_new_listeners(config, previous, disk, actual, candidate)
-    changed = [name for name, text in rendered.files.items() if disk.get(name) != text.encode()]
-    removed = [name for name in (state.get("generated") or {}) if name not in rendered.files and disk.get(name) is not None]
-
-    running = {name for name, item in actual.items() if item["running"] and name != "migrate"}
-    will_run = (set(rendered.services) - {"migrate"}) if (start or running) else set()
-    todo = stale(actual, rendered.services, will_run)
-    force = set()
-    if "core" in will_run and "core" not in todo:
-        # The digest file follows secrets/core.key; a Core that rejects the key restarts, then Web.
-        if http(core_base(config) + "/core/v1/installation", bearer(configuration.read_core_key(root)))[0] == 401:
-            force = {"core"} | ({"web"} & will_run)
-    written_inputs = configuration.rendered_inputs(disk)
-    in_sync = bool(running) and all(actual.get(name, {}).get("running") and actual[name]["inputs"] == written_inputs.get(name)
-                                    for name in set(written_inputs) - {"migrate"})
-
-    if state.get("generated"):
-        old, base, answered = old_public_url(root, config, previous, disk, actual)
-        confirm_public_url(root, config, old, base, answered, args, interactive, out)
-
-    if previous is not None:
-        keys = [key for key, value in config_model.values(config).items() if key not in previous or previous[key] != value]
-        out("Changed settings: " + (", ".join(keys) if keys else "none"))
-    for name in edited:
-        out(f"generated/{name} was edited by hand; it is overwritten and the edited copy is kept.")
-    out("Files to write: " + (", ".join("generated/" + name for name in sorted(set(changed) | set(removed))) or "none"))
-    restarts = [name for name in ("database", "core", "web", "gateway", "installation") if name in (todo | force)]
-    stale_stopped = [name for name in rendered.services if name != "migrate" and name not in will_run
-                     and actual.get(name, {}).get("inputs") not in (None, rendered.services[name])]
-    if restarts:
-        verb = "start" if not running else "restart"
-        out(f"Services to {verb}: " + ", ".join(restarts) + (". Every Web sign-in session ends." if "web" in restarts else ""))
-    if stale_stopped or (not will_run and changed):
-        out("The installation is stopped; it stays stopped and starts with these files.")
-    if args.dry_run:
-        out("Dry run: nothing was changed.")
-        return
-    if not args.dry_run:
-        # A rotation that stopped before using its new key leaves only this file.
-        (root / "secrets/core.key.new").unlink(missing_ok=True)
-    if not (changed or removed or restarts or edited):
-        if ingress_config.enabled(config):
-            finish_apply(root, config, state, rendered.files.get("Caddyfile"), will_run, candidate)
-        if record_digests(state, rendered.files) != load_state(root):
-            save_state(root, record_digests(state, rendered.files))
-        out("Nothing to apply.")
-        return
-
-    stamp = datetime.datetime.now(datetime.timezone.utc).strftime("%Y%m%dT%H%M%SZ")
-    for name in edited:
-        create_private(root / "generated" / f"{name}.edited-{stamp}", disk[name])
-    # Digests first: a file written from here on is recognized as oac's.
-    save_state(root, record_digests(state, rendered.files))
-    for name in sorted(set(changed) | set(edited)):
-        write_private(root / "generated" / name, rendered.files[name])
-    for name in removed:
-        (root / "generated" / name).unlink()
-    try:
-        converge(root, state, rendered.services, will_run, force)
-        finish_apply(root, config, state, rendered.files.get("Caddyfile"), will_run, candidate)
-    except (OacError, RuntimeError, subprocess.CalledProcessError) as error:
-        line = core_error_line(root)
-        if line:
-            out(line)
-        if not (rollback and in_sync):
-            raise ApplyFailed(f"config.json not applied: {describe(error)}. The services were not all running with "
-                              f"the previous files, so nothing was rolled back; run oac status, fix the cause "
-                              f"and {retry}", describe(error)) from None
-        # Record the restored files as oac's own before writing them back; a restored
-        # hand edit stays one.
-        restored = {name: data for name, data in disk.items()
-                    if data is not None and name in (state.get("generated") or {}) and name not in edited}
-        save_state(root, record_digests(load_state(root), restored))
-        for name, data in disk.items():
-            path = root / "generated" / name
-            if data is None:
-                path.unlink(missing_ok=True)
-            else:
-                write_private(path, data)
-        try:
-            converge(root, state, written_inputs, will_run)
-            if ingress_config.enabled(config) and "gateway" in will_run:
-                ingress_config.reload(root, disk["Caddyfile"].decode())
-        except (OacError, RuntimeError, subprocess.CalledProcessError) as second:
-            raise ApplyFailed(f"config.json not applied: {describe(error)}. The previous generated files were restored, "
-                              f"but the services could not be started with them either ({describe(second)}); run "
-                              f"oac status, fix the cause and {retry}", describe(error)) from None
-        raise ApplyFailed(f"config.json not applied: {describe(error)}. The previous generated files were restored "
-                          f"and the services converged on them; fix config.json and {retry}", describe(error)) from None
-    out("Applied config.json.")
-
-
-# Removal -----------------------------------------------------------------------
-
-def _remove_last_files(root, state, keep_root):
-    """Finish the few final unlinks without a handled signal losing the recovery state."""
-    handlers = {}
-    try:
-        for signum in (signal.SIGINT, signal.SIGTERM, signal.SIGHUP):
-            handlers[signum] = signal.signal(signum, signal.SIG_IGN)
-        try:
-            for name in ("state.json", "oac", ".oac.lock"):
-                if not (keep_root and name == ".oac.lock"):
-                    (root / name).unlink(missing_ok=True)
-            if not keep_root:
-                root.rmdir()
-        except (OSError, KeyboardInterrupt):
-            # A failed command unlink must leave both the command and its state for a retry.
-            if (root / "oac").exists() and not (root / "state.json").exists():
-                with contextlib.suppress(OSError):
-                    save_state(root, state)
-            raise
-    finally:
-        for signum, handler in handlers.items():
-            signal.signal(signum, handler)
-
-
-def remove(root, state, keep_root=False, images=False):
-    """Remove one installation: its Compose project with its volumes, then its files.
-
-    state is the loaded state.json. Only this installation's own project is touched.
-    Loaded images are kept unless images is set; see remove_images. keep_root keeps
-    the directory and its .oac.lock, which the caller holds, and removes everything else in
-    it. The files stay while a service is left or an image removal fails, so state.json still
-    names them. Nothing is printed, so a closed terminal can't stop the removal. Returns a
-    note for each image kept; raises OacError naming what is left and the commands that
-    remove it.
-    """
-    root = Path(root)
-    if not root.is_absolute() or root.is_symlink() or root.resolve() != root:
-        raise OacError("The installation directory must be canonical and not a symlink; nothing was removed")
-    project = state.get("project")
-    if not isinstance(project, str) or not re.fullmatch(r"oac-[0-9a-f]{10}", project):
-        raise OacError("state.json names no Compose project of this installation; nothing was removed")
-    left, kept = [], []
-    # -p without -f, outside any project directory and without COMPOSE_* settings: Compose
-    # reads no project file and acts on this project's labels alone.
-    down = ["docker", "compose", "-p", project, "down", "--volumes", "--remove-orphans"]
-    compose_names = sorted(name for name in os.environ if name.startswith("COMPOSE_"))
-    environment = {name: value for name, value in os.environ.items() if name not in compose_names}
-    try:
-        run(down, cwd="/", env=environment, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL)
-    except (subprocess.CalledProcessError, OSError, KeyboardInterrupt):
-        manual = shlex.join(["env", *(arg for name in compose_names for arg in ("-u", name)), *down])
-        left.append((f"Compose project {project} and its volumes", f"(cd / && {manual})"))
-    if images and not left:
-        try:
-            kept = remove_images(state, environment)
-        except (subprocess.CalledProcessError, OSError, ValueError, KeyboardInterrupt):
-            left.append(("the images of this installation", f"{shlex.quote(str(root / 'oac'))} uninstall"))
-    target = shlex.quote(str(root))
-    files = (f"the files in {root}", f"find {target} -mindepth 1 -delete" if keep_root else f"rm -rf {target}")
-    if left:
-        left.append(files)
-    else:
-        try:
-            for path in root.iterdir():
-                if path.name in ("state.json", "oac", ".oac.lock"):
-                    continue
-                if path.is_dir() and not path.is_symlink():
-                    shutil.rmtree(path)
-                else:
-                    path.unlink()
-            _remove_last_files(root, state, keep_root)
-        except (OSError, KeyboardInterrupt):
-            # A lock file alone, such as one another command just created, is harmless.
-            if root.is_dir() and any(path.name != ".oac.lock" for path in root.iterdir()):
-                left.append(files)
-    if left:
-        raise OacError("Removal did not finish. Left: " + "; ".join(what for what, _ in left) + ". Remove them with:\n"
-                       + "\n".join("  " + command for _, command in left))
-    return kept
-
-
-def remove_images(state, environment):
-    """Remove the images state.json records; returns a note for each one kept.
-
-    The installer loads images untagged, so a tag, or a container of any project, means
-    something outside this installation uses the image, and it stays. Docker runs as remove
-    runs Compose, and prints nothing.
-    """
-    kept = []
-    quiet = {"cwd": "/", "env": environment, "stdin": subprocess.DEVNULL, "stderr": subprocess.DEVNULL}
-    for name, image in sorted(state["images"].items()):
-        found = run(["docker", "image", "inspect", image, "--format", "{{json .RepoTags}}"], check=False,
-                    stdout=subprocess.PIPE, text=True, **quiet)
-        if found.returncode:
-            present = run(["docker", "image", "ls", "--all", "--quiet", "--no-trunc"],
-                          stdout=subprocess.PIPE, text=True, **quiet).stdout.split()
-            if image in present:
-                raise subprocess.CalledProcessError(found.returncode, found.args)
-            continue  # Docker confirmed that the image is absent.
-        tags = json.loads(found.stdout) or []
-        users = run(["docker", "ps", "-aq", "--filter", "ancestor=" + image], stdout=subprocess.PIPE, text=True,
-                    **quiet).stdout.split()
-        if users or tags:
-            kept.append(f"Kept the {name} image {image}: " + ("another container uses it." if users else
-                        f"it is tagged {', '.join(tags)}."))
-        else:
-            run(["docker", "image", "rm", image], stdout=subprocess.DEVNULL, **quiet)
-    return kept
-
-
-# Commands --------------------------------------------------------------------
-
-def written_view(root, state, config):
-    """Addresses as last written, which the services were started with."""
-    values, _ = disk_view(read_generated(root, {"settings.json"}))
-    if values is None:
-        if config is None:
-            raise OacError("Neither config.json nor generated/settings.json can be read")
-        return config
-    return applied_view(values)
-
-
-def applied_view(values):
-    """The config the settings last written describe."""
-    return {"ingress": values.get("ingress"), "public_url": values.get("public_url"), "host": values["host"],
-            "ports": {name: values[f"ports.{name}"] for name in ("core", "web") if f"ports.{name}" in values}}
-
-
-def load_config_or_report(root, out):
-    """config.json, or None after printing why it can't be used; the written files still can."""
-    try:
-        return load_config(root)
-    except (OacError, config_model.ConfigError) as error:
-        out(str(error))
-        return None
-
-
-def status(root, out=print):
-    check_directories(root)
-    loaded = load_config_or_report(root, out)
-    state = load_state(root)
-    config = written_view(root, state, loaded)
-    actual = observe(state)
-    rendered = None
-    if loaded is not None:
-        rendered, disk, _ = render_now(root, loaded, state)
-    for name, item in sorted(actual.items()):
-        line = f'{name}: {"running" if item["running"] else "stopped"} {item["health"]}'.rstrip()
-        if rendered and item["running"] and name != "migrate" and item["inputs"] != rendered.services.get(name):
-            line += " (runs with other inputs than config.json renders; run oac apply)"
-        out(line)
-    required = set(config_model.SERVICES)
-    if ingress_config.enabled(config):
-        required.update(("gateway", "installation"))
-    healthy = all(actual.get(name, {}).get("running") and actual[name]["health"] in ("", "healthy") for name in required)
-    core_ok = http(core_base(config) + "/healthz")[0] == 200
-    healthy = healthy and core_ok
-    out("Core API: " + ("healthy" if core_ok else "unavailable"))
-    key = configuration.read_core_key(root)
-    digests = root / "generated/core-key-digests.json"
-    if digests.is_file() and configuration.sha256(key) not in json.loads(digests.read_text()):
-        out("secrets/core.key does not match generated/core-key-digests.json; run oac apply")
-    if core_ok and http(core_base(config) + "/core/v1/installation", bearer(key))[0] == 401:
-        out("Core rejects secrets/core.key because it started with another key; run oac apply")
-        healthy = False
-    web_ok = http(configuration.service_origin(config, "web") + "/healthz")[0] == 200
-    healthy = healthy and web_ok
-    out("Web: " + ("healthy" if web_ok else "unavailable"))
-    out("Public URL: " + (config["public_url"] or ("not configured; set up HTTPS in Web" if ingress_config.enabled(config) else "none (local access only)")))
-    out("API base URL: " + configuration.local_public_url(config) + "/v1")
-    out("Console: " + (ingress_config.console_origin(config) if ingress_config.enabled(config) else
-                       config["public_url"] or configuration.service_origin(config, "web")))
-    out("Source commit: " + state["source_commit"])
-    if rendered is not None:
-        if any(comparable(name, disk.get(name)) != comparable(name, text) for name, text in rendered.files.items()):
-            out(f"config.json has changes that are not applied; run {root / 'oac'} apply")
-        for name in edited_files(state, disk, rendered):
-            out(f"generated/{name} was edited by hand; put the change in config.json and run oac apply --discard-edits")
-    out(f'Reverse proxy: /v1 and /api/v1 go to {configuration.service_address(config, "core", connect=True)}; '
-        f'everything else goes to {configuration.service_address(config, "web", connect=True)}')
-    out("Service health does not prove model execution. This check makes no model requests.")
-    check_complete(state)
-    if not healthy:
-        raise OacError("One or more installed services are unavailable")
-
-
-def start(root, out=print):
-    """Start every service with the files last written, not with unapplied config.json changes."""
-    with locked(root):
-        check_directories(root)
-        state = load_state(root)
-        check_complete(state)
-        config = load_config_or_report(root, out)
-        if config is not None:
-            rendered, disk, _ = render_now(root, config, state)
-            if any(comparable(name, disk.get(name)) != comparable(name, text) for name, text in rendered.files.items()):
-                out("Warning: config.json has changes that are not applied; starting with the files last written.")
-            for name in edited_files(state, disk, rendered):
-                out(f"Warning: generated/{name} was edited by hand.")
-        written = written_view(root, state, config)
-        for name, image in state["images"].items():
-            if run(["docker", "image", "inspect", image], check=False, stdin=subprocess.DEVNULL,
-                   stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL).returncode:
-                raise OacError(f"The {name} image is missing; rerun install.sh from bundle "
-                                  f'{state["source_commit"]} to reload images')
-        desired = configuration.rendered_inputs(read_generated(root, {"compose.json"}))
-        will_run = set(desired) - {"migrate"}
-        converge(root, state, desired, will_run)
-        gateway_document = (root / "generated/Caddyfile").read_text() if ingress_config.enabled(written) else None
-        finish_apply(root, written, state, gateway_document, will_run, keep_unfinished=True)
-    out("Services started.")
-
-
-def stop(root, out=print):
-    with locked(root):
-        check_directories(root)
-        load_state(root)
-        if (root / "generated/compose.json").exists():
-            compose(root, "stop")
-    out("Control-plane services stopped. Data, nodes and sandbox resources are kept; running sandbox work may continue.")
-
-
-def rotate_core_key(root, yes=False, interactive=None, out=print):
-    interactive = sys.stdin.isatty() if interactive is None else interactive
-    with locked(root):
-        check_directories(root)
-        state = load_state(root)
-        check_complete(state)
-        config = load_config(root)
-        rendered, disk, _ = render_now(root, config, state)
-        if any(comparable(name, disk.get(name)) != comparable(name, text) for name, text in rendered.files.items()) \
-                or edited_files(state, disk, rendered):
-            raise OacError("config.json has changes that are not applied, or generated files were edited; "
-                              "run oac apply first")
-        out("Rotating the Core key ends every Web sign-in session, and the current key stops working at once.")
-        if not (yes or (interactive and input("Type yes to rotate the Core key: ").strip() == "yes")):
-            raise OacError("Core key rotation was not confirmed; nothing was changed")
-        old_key = configuration.read_core_key(root)
-        replacement = root / "secrets/core.key.new"
-        replacement.unlink(missing_ok=True)
-        create_private(replacement, secrets.token_hex(32))
-        running = {name for name, item in observe(state).items() if item["running"]}
-        args = argparse.Namespace(dry_run=False, yes=True, confirm_public_url_change=None)
-        try:
-            if "web" in running:
-                compose(root, "stop", "web")  # Web holds the old key; its sessions end anyway.
-            os.replace(replacement, root / "secrets/core.key")
-            _apply(root, args, False, False, False, out, rollback=False, retry="run oac apply to finish the rotation")
-        except (OacError, RuntimeError, subprocess.CalledProcessError, KeyboardInterrupt) as error:
-            # Whatever key secrets/core.key holds now, the next apply converges on it.
-            raise OacError(f"Core key rotation did not finish: {describe(error)}. secrets/core.key holds the key to "
-                              "use; run oac apply to finish") from None
-    if "core" in running:
-        new = bearer(configuration.read_core_key(root))
-        url = core_base(config) + "/core/v1/installation"
-        if http(url, new)[0] != 200 or http(url, bearer(old_key))[0] != 401:
-            raise OacError("Core did not confirm the new key and reject the old one; run oac status")
-    out(f"New Core key: {root / 'secrets/core.key'}. Sign in to Web again and update scripts that use the key.")
-
-
-def core_sandboxes(root, state):
-    """Core's (nodes, sandbox deployment), or None when Core does not answer. Any part of the installation may be missing."""
-    try:
-        if not root.is_absolute() or root.resolve() != root:
-            return None
-        check_directories(root)
-        check_private(root / "secrets/core.key", "secrets/core.key")
-        try:
-            config = load_config(root)
-        except (OacError, config_model.ConfigError):
-            config = None
-        # The address the running Core was started with.
-        base, key = core_base(written_view(root, state, config)), bearer(configuration.read_core_key(root))
-        answers = [http(base + "/core/v1/sandbox/" + name, key) for name in ("nodes", "deployment")]
-        if any(status != 200 for status, _ in answers):
-            return None
-        return json.loads(answers[0][1])["data"], json.loads(answers[1][1])
-    except (OacError, RuntimeError, OSError, ValueError, KeyError, TypeError, HTTPException):
-        return None
-
-
-def uninstall(root, yes=False, interactive=None, out=print):
-    """Remove this installation and all its data from this host, finished or not. Nodes and sandboxes are only listed."""
-    interactive = sys.stdin.isatty() if interactive is None else interactive
-    if not (root / "state.json").exists():
-        # Without state.json nothing here is known to be the installation's, so nothing is removed.
-        out(f"No installation is left in {root}: it has no state.json. Nothing was removed.")
-        return
-    with locked(root):
-        state = load_state(root)
-        project = state["project"]
-        out(f"This removes the installation in {root} from this host:")
-        out(f"  Compose project {project}: its containers and networks, and the database volume {project}_database")
-        for name, image in sorted(state["images"].items()):
-            out(f"  The {name} image {image}, unless another container or a tag uses it")
-        out(f"  The directory {root}")
-        nodes = []
-        out("All data is deleted: the database with every Project, API key, Session and stored credential, and "
-            "the Core key. To keep it, back it up first: docs/getting-started/operations.md#back-up")
-        found = core_sandboxes(root, state)
-        release = ("While Core is still up, archive their Sessions, or choose Reset deployment in Web "
-                   "(System → Manage sandbox configuration) and let it complete.")
-        if found is None:
-            nodes = None
-            out("Core did not answer, so its nodes and sandboxes can't be listed. Nodes stay on their hosts.")
-            out("Uninstall stops no sandbox: node sandboxes keep running on their nodes, and E2B keeps running, "
-                "and billing for, its sandboxes. " + release)
-        else:
-            nodes, deployment = found
-            if nodes:
-                out("Nodes registered with this Core, which stay on their hosts: " + ", ".join(
-                    f'{node.get("name")} ({"online" if node.get("online") else "offline"})' for node in nodes))
-            count = (deployment.get("resources") or {}).get("allocations") or 0
-            if count:
-                where = ("E2B keeps running them, and billing for them" if deployment.get("provider") == "e2b"
-                         else "they keep running on their nodes")
-                out(f"Core has {count} sandbox(es) in use. Uninstall does not stop them: {where}. {release}")
-        if not yes:
-            if not interactive:
-                raise OacError("Confirm the uninstall with --yes, or run it in a terminal; nothing was removed")
-            if input(f"Type the installation directory, {root}, to remove it: ").strip() != str(root):
-                raise OacError("The uninstall was not confirmed; nothing was removed")
-        kept = remove(root, state, images=True)
-    for note in kept:
-        out(note)
-    out(f"Removed the installation in {root}.")
-    if nodes != []:
-        hosts = (f'each node host ({", ".join(str(node.get("name")) for node in nodes)})' if nodes else
-                 "each node host that served this installation")
-        out(f"This Core is gone, so on {hosts}, uninstall the node with --force using node-install.pyz from this "
-            "release's bundle:")
-        out(f'  sudo python3 node-install.pyz --uninstall --installation-id {state["installation_id"]} --force')
-        out("See docs/getting-started/nodes.md#remove-a-node")
-
-
-def main(argv=None, root=None, out=print):
-    root = Path(root) if root else Path(sys.argv[0]).resolve().parent
-    parser = argparse.ArgumentParser(prog=str(root / "oac"), description=__doc__.split("\n\n")[0])
-    commands = parser.add_subparsers(dest="command", required=True)
-    commands.add_parser("status", help="Show service health, addresses and configuration drift")
-    commands.add_parser("start", help="Start the installed services with the files last written")
-    commands.add_parser("stop", help="Stop the installed services; data is kept")
-    apply_parser = commands.add_parser("apply", help="Apply config.json and restart what changed")
-    apply_parser.add_argument("--dry-run", action="store_true", help="Show the plan without changing anything")
-    apply_parser.add_argument("--discard-edits", action="store_true",
-                              help="Overwrite hand-edited generated files, keeping each edited copy")
-    apply_parser.add_argument("--confirm-public-url-change", metavar="URL",
-                              help="Confirm a public URL change non-interactively; must equal the new URL")
-    domain = commands.add_parser("domain", help="Configure and verify managed HTTPS using a DNS hostname")
-    domain.add_argument("hostname")
-    domain.add_argument("--confirm-public-url-change", metavar="URL")
-    commands.add_parser("domain-server", help=argparse.SUPPRESS)
-    rotate = commands.add_parser("rotate-core-key", help="Replace the Core key; the old key stops working")
-    rotate.add_argument("--yes", action="store_true", help="Do not ask for confirmation")
-    remove_parser = commands.add_parser("uninstall", help="Remove this installation and all its data from this host")
-    remove_parser.add_argument("--yes", action="store_true", help="Do not ask for confirmation")
-    args = parser.parse_args(argv)
-    if args.command == "uninstall":
-        return uninstall(root, yes=args.yes, out=out)
-    if not (root / "state.json").exists():
-        raise OacError(f"{root} is not an installation directory; run the oac command inside it")
-    load_state(root)
-    if args.command == "apply":
-        apply(root, dry_run=args.dry_run, discard_edits=args.discard_edits,
-              confirm_public_url_change=args.confirm_public_url_change, out=out)
-    elif args.command == "domain":
-        import ingress
-        ingress.configure(root, args.hostname, args.confirm_public_url_change, out)
-    elif args.command == "domain-server":
-        import ingress
-        ingress.serve(root)
-    elif args.command == "rotate-core-key":
-        rotate_core_key(root, yes=args.yes, out=out)
-    else:
-        {"status": status, "start": start, "stop": stop}[args.command](root, out=out)
-
-
-def entry():
-    try:
-        main()
-    except (OacError, config_model.ConfigError, RuntimeError) as error:
-        print(str(error), file=sys.stderr)
-        sys.exit(1)
-    except (OSError, ValueError, KeyError, subprocess.CalledProcessError):
-        # Errors never include generated configuration or external process output.
-        print("oac failed; run oac status and inspect the installation files", file=sys.stderr)
-        sys.exit(1)
-    except KeyboardInterrupt:
-        sys.exit(130)
-
-
-if __name__ == "__main__":
-    entry()
diff --git a/deploy/install/sandbox_setup.py b/deploy/install/sandbox_setup.py
deleted file mode 100644
index 9429567f8..000000000
--- a/deploy/install/sandbox_setup.py
+++ /dev/null
@@ -1,154 +0,0 @@
-"""Choose a new installation's sandbox backend through Core's administrator API.
-
-The installer applies what Web's setup would: Docker and microsandbox get the
-Standard size from the bundled copy of Web's standard-sizes.json and the bundle's
-Runtime release; E2B gets the account key and template build, and Core adopts the
-build's size. Nodes are added afterwards from Web, this host included.
-"""
-import json
-import http.client
-import ipaddress
-import re
-import urllib.error
-import urllib.parse
-import urllib.request
-import uuid
-
-import configuration
-import node_spec
-
-CHOICES = ("docker", "microsandbox", "e2b", "none")
-NAMES = {"docker": "Docker", "microsandbox": "microsandbox", "e2b": "E2B"}
-# The fields of each provider's size in Web's standard-sizes.json (standard-sizes.md).
-SIZE_FIELDS = {"docker": {"cpus", "memory_mib"},
-               "microsandbox": {"cpus", "memory_mib", "root_disk_mib", "environment_disk_mib"}}
-
-
-class SandboxSetupError(Exception):
-    pass
-
-
-class NoRedirect(urllib.request.HTTPRedirectHandler):
-    def redirect_request(self, request, fp, code, message, headers, url):
-        raise SandboxSetupError("Core redirected the sandbox setup request")
-
-
-def send(req):
-    """(status, body) of one request to Core: no redirects, no ambient proxy."""
-    opener = urllib.request.build_opener(urllib.request.ProxyHandler({}), NoRedirect())
-    try:
-        # E2B validation reads the template build from E2B before Core answers.
-        with opener.open(req, timeout=60) as response:
-            return response.status, response.read(16385)
-    except urllib.error.HTTPError as error:
-        return error.code, error.read(16385)
-
-
-def refusal(status, raw, secret=None):
-    """Core's own error message, printable, bounded and without the E2B key."""
-    try:
-        message = json.loads(raw)["error"]["message"]
-    except (ValueError, KeyError, TypeError):
-        message = None
-    if not isinstance(message, str) or not message.strip():
-        return f"Core refused the sandbox setup (HTTP {status})"
-    if secret:
-        message = message.replace(secret, "[E2B API key]")
-    return "Core refused the sandbox setup: " + "".join(c if c.isprintable() else " " for c in message.strip())[:500]
-
-
-def request(core, token, method, path, value=None):
-    data = json.dumps(value).encode() if value is not None else None
-    headers = {"Authorization": "Bearer " + token, "Content-Type": "application/json"}
-    try:
-        status, raw = send(urllib.request.Request(core + "/core/v1/sandbox/" + path, data=data,
-                                                  headers=headers, method=method))
-    except (urllib.error.URLError, OSError, http.client.HTTPException, ValueError):
-        raise SandboxSetupError("Core did not confirm the sandbox setup") from None
-    if not 200 <= status < 300:
-        raise SandboxSetupError(refusal(status, raw, ((value or {}).get("e2b") or {}).get("api_key")))
-    try:
-        if len(raw) > 16384:
-            raise ValueError()
-        result = json.loads(raw)
-        if not isinstance(result, dict):
-            raise ValueError()
-        return result
-    except ValueError:
-        raise SandboxSetupError("Core did not confirm the sandbox setup") from None
-
-
-def e2b_template(value):
-    """`template-id:build-uuid`, as Core accepts it."""
-    template, _, build = value.partition(":")
-    try:
-        exact = uuid.UUID(build)
-    except ValueError:
-        exact = None
-    return (re.fullmatch(r"[A-Za-z0-9_-]{1,128}", template) is not None and exact is not None
-            and exact.int != 0 and str(exact) == build)
-
-
-def e2b_endpoint(api_url, domain):
-    """The two explicit SDK selectors, or neither for official E2B."""
-    if api_url is None and domain is None:
-        return True
-    if not api_url or not domain or len(api_url) > 512 or len(domain) > 253:
-        return False
-    def public_name(host):
-        labels = host.split(".")
-        try:
-            ipaddress.ip_address(host)
-            return False
-        except ValueError:
-            pass
-        return (len(host) <= 253 and len(labels) >= 2 and
-                not host.endswith((".localhost", ".local")) and
-                all(0 < len(label) <= 63 and
-                    re.fullmatch(r"[a-z0-9](?:[a-z0-9-]*[a-z0-9])?", label)
-                    for label in labels))
-    if not public_name(domain):
-        return False
-    try:
-        parsed = urllib.parse.urlsplit(api_url)
-        return (parsed.scheme == "https" and parsed.hostname == parsed.netloc and
-                public_name(parsed.hostname or "") and
-                (parsed.hostname == domain or parsed.hostname.endswith("." + domain)) and
-                not parsed.path and not parsed.query and not parsed.fragment and
-                parsed.geturl() == api_url)
-    except ValueError:
-        return False
-
-
-def selection(bundle, manifest, choice, e2b=None):
-    """The request Web's setup sends for this backend."""
-    if choice == "e2b":
-        return {"provider": "e2b", "e2b": e2b}
-    try:
-        resources = json.loads((bundle / "standard-sizes.json").read_text())[choice]
-    except (OSError, ValueError, KeyError, TypeError):
-        resources = None
-    if (not isinstance(resources, dict) or set(resources) != SIZE_FIELDS[choice]
-            or not all(type(value) is int for value in resources.values())):
-        raise SandboxSetupError("The bundle's standard-sizes.json is invalid")
-    return {"provider": choice, "resources": resources, "runtime": node_spec.release(manifest)}
-
-
-def initialize(root, config, state, request_body):
-    """Save the selection unless Core already has one; returns Core's deployment."""
-    core = configuration.service_origin(config, "core")
-    key = (root / "secrets/core.key").read_text().strip()
-    current = request(core, key, "GET", "deployment")
-    if current.get("installation_id") != state["installation_id"]:
-        raise SandboxSetupError("Core reports a different installation")
-    provider = current.get("provider")
-    if provider == request_body["provider"]:
-        return current
-    if provider:
-        raise SandboxSetupError(f"Core already uses {NAMES.get(provider, provider)} sandboxes")
-    generation = current.get("generation")
-    if type(generation) is not int or generation < 0:
-        raise SandboxSetupError("Core returned an invalid deployment generation")
-    if current.get("reset") is not None:
-        raise SandboxSetupError("Core is resetting its sandbox deployment")
-    return request(core, key, "POST", "deployment", dict(request_body, expected_generation=generation))
diff --git a/deploy/install/test_compose.py b/deploy/install/test_compose.py
deleted file mode 100644
index 5fded431d..000000000
--- a/deploy/install/test_compose.py
+++ /dev/null
@@ -1,166 +0,0 @@
-"""Qualify the self-contained Compose initializer without building images."""
-
-import base64
-import copy
-import hashlib
-import io
-import json
-import os
-from pathlib import Path
-import subprocess
-import tarfile
-import tempfile
-import unittest
-from unittest.mock import patch
-import uuid
-
-
-ROOT = Path(__file__).resolve().parents[2]
-COMPOSE = ROOT / 'deploy/compose/compose.yaml'
-
-
-class ComposeTests(unittest.TestCase):
-    @classmethod
-    def render(cls, public_url=None):
-        env = dict(os.environ)
-        env.pop('OAC_PUBLIC_URL', None)
-        if public_url is not None:
-            env['OAC_PUBLIC_URL'] = public_url
-        return json.loads(subprocess.check_output(
-            ['docker', 'compose', '--env-file', os.devnull, '-f', str(COMPOSE),
-             '--profile', 'tools', 'config', '--format', 'json'], env=env))
-
-    @classmethod
-    def setUpClass(cls):
-        cls.compose = cls.render()
-
-    def setUp(self):
-        base = Path.home() / '.oac/tests/compose'
-        base.mkdir(parents=True, exist_ok=True)
-        self.temporary = tempfile.TemporaryDirectory(dir=base)
-        self.addCleanup(self.temporary.cleanup)
-        self.root = Path(self.temporary.name)
-        (self.root / 'database-data').mkdir()
-        self.code = {'__name__': 'compose_initializer'}
-        exec(self.compose['configs']['init-script']['content'], self.code)
-        self.files = {name: b'fixture' for name in self.code['MEMBERS']}
-        self.files['manifest.json'] = json.dumps({'source_commit': self.code['REVISION'], 'platform': 'linux/amd64'}).encode()
-        chown = patch('os.chown')
-        chown.start()
-        self.addCleanup(chown.stop)
-
-    def initialize(self, fetch=None):
-        self.code['initialize'](self.root, fetch or (lambda: self.files))
-
-    def test_fresh_installation_and_restart_keep_identity_and_keys(self):
-        self.initialize()
-        saved = {str(p.relative_to(self.root)): p.read_bytes() for p in self.root.rglob('*') if p.is_file()}
-        key = saved['web/core.key'].strip()
-        self.assertEqual(len(key), 64)
-        self.assertEqual(json.loads(saved['core/core-key-digests.json']), [hashlib.sha256(key).hexdigest()])
-        self.assertEqual(len(base64.b64decode(saved['core/credential.key'])), 32)
-        uuid.UUID(saved['core/installation.id'].decode().strip())
-        for name in ('web/core.key', 'database/password', 'core/credential.key'):
-            self.assertEqual((self.root / name).stat().st_mode & 0o777, 0o600)
-        self.initialize(lambda: self.fail('A completed installation must not download again'))
-        self.assertEqual(saved, {str(p.relative_to(self.root)): p.read_bytes() for p in self.root.rglob('*') if p.is_file()})
-
-    def test_existing_data_without_installation_secrets_is_refused(self):
-        (self.root / 'database-data/PG_VERSION').write_text('16')
-        with self.assertRaisesRegex(RuntimeError, 'original installation'):
-            self.initialize(lambda: self.fail('Must refuse before downloading'))
-        self.assertFalse((self.root / 'web/core.key').exists())
-
-    def test_changed_or_missing_keys_and_another_release_are_refused(self):
-        self.initialize()
-        path = self.root / 'database/password'
-        original = path.read_bytes()
-        path.write_bytes(b'different')
-        with self.assertRaisesRegex(RuntimeError, 'files changed'):
-            self.initialize()
-        path.unlink()
-        with self.assertRaises(FileNotFoundError):
-            self.initialize()
-        path.write_bytes(original)
-        self.code['REVISION'] = 'f' * 40
-        with self.assertRaisesRegex(RuntimeError, 'another release'):
-            self.initialize()
-
-    def test_interrupted_fresh_initialization_retains_generated_keys(self):
-        self.initialize()
-        key = (self.root / 'web/core.key').read_bytes()
-        (self.root / 'core/installation.json').unlink()
-        self.initialize()
-        self.assertEqual(key, (self.root / 'web/core.key').read_bytes())
-
-    def archive(self):
-        output = io.BytesIO()
-        with tarfile.open(fileobj=output, mode='w:gz') as archive:
-            for name, data in self.files.items():
-                info = tarfile.TarInfo(self.code['ARCHIVE'] + '/' + name)
-                info.size = len(data)
-                archive.addfile(info, io.BytesIO(data))
-            data = b'ignored image data' * 1000
-            info = tarfile.TarInfo(self.code['ARCHIVE'] + '/images/core.tar')
-            info.size = len(data)
-            archive.addfile(info, io.BytesIO(data))
-        return output.getvalue()
-
-    def test_streamed_release_is_fully_verified_and_only_metadata_is_retained(self):
-        data = self.archive()
-        self.code['CHECKSUM'] = hashlib.sha256(data).hexdigest()
-        with patch('urllib.request.urlopen', return_value=io.BytesIO(data)):
-            self.assertEqual(self.code['download'](), self.files)
-        self.code['CHECKSUM'] = '0' * 64
-        with patch('urllib.request.urlopen', return_value=io.BytesIO(data)):
-            with self.assertRaisesRegex(RuntimeError, 'checksum mismatch'):
-                self.code['download']()
-        del self.files['node-install.pyz']
-        data = self.archive()
-        self.code['CHECKSUM'] = hashlib.sha256(data).hexdigest()
-        with patch('urllib.request.urlopen', return_value=io.BytesIO(data)):
-            with self.assertRaisesRegex(RuntimeError, 'checksum mismatch'):
-                self.code['download']()
-
-    def test_compose_uses_private_services_and_ordered_initialization(self):
-        services = self.compose['services']
-        self.assertEqual(services['database']['depends_on']['init']['condition'], 'service_completed_successfully')
-        self.assertEqual(services['migrate']['depends_on']['database']['condition'], 'service_healthy')
-        self.assertIn('pg_isready -h 127.0.0.1', services['database']['healthcheck']['test'][1])
-        self.assertEqual(services['core']['depends_on']['migrate']['condition'], 'service_completed_successfully')
-        for service in services.values():
-            self.assertNotIn('build', service)
-            self.assertNotIn('ports', service)
-            self.assertIn('@sha256:', service['image'])
-            for volume in service.get('volumes', []):
-                self.assertNotIn('docker.sock', volume['source'])
-                self.assertEqual(volume['type'], 'volume')
-        self.assertEqual({v['source'] for v in services['web']['volumes']}, {'web-secret', 'node-payload'})
-        self.assertEqual(services['credentials']['logging']['driver'], 'none')
-        schema = json.loads((ROOT / 'deploy/install/config.schema.json').read_text())
-        harnesses = schema['properties']['core']['properties']['harnesses']['default']
-        self.assertEqual(services['core']['environment']['OAC_HARNESSES'].split(','), harnesses)
-
-    def test_public_url_can_be_configured_after_initial_startup(self):
-        for value in (None, '', 'https://oac.example.test', 'http://localhost:9080'):
-            with self.subTest(public_url=value):
-                configured = self.render(value)
-                expected = value or 'http://localhost:8080'
-                for name, setting in (('core', 'OAC_PUBLIC_URL'), ('migrate', 'OAC_PUBLIC_URL'),
-                                      ('web', 'OAC_WEB_ORIGIN')):
-                    self.assertEqual(configured['services'][name]['environment'][setting], expected)
-                self.assertEqual(configured['volumes'], self.compose['volumes'])
-
-    def test_platform_network_injection_keeps_the_credentials_profile_valid(self):
-        # Dokploy isolated deployments attach a project network to every service.
-        transformed = copy.deepcopy(self.compose)
-        transformed['networks']['platform'] = {}
-        for service in transformed['services'].values():
-            service.setdefault('networks', {})['platform'] = None
-        subprocess.run(
-            ['docker', 'compose', '-f', '-', '--profile', 'tools', 'config', '--quiet'],
-            input=json.dumps(transformed), text=True, check=True)
-
-
-if __name__ == '__main__':
-    unittest.main()
diff --git a/deploy/install/test_config_model.py b/deploy/install/test_config_model.py
deleted file mode 100644
index f92395057..000000000
--- a/deploy/install/test_config_model.py
+++ /dev/null
@@ -1,111 +0,0 @@
-"""config.json schema, validation and the generated files it derives."""
-import json
-from pathlib import Path
-import tempfile
-import unittest
-
-import config_model
-import configuration
-
-
-def schemas(node):
-    """Every schema object in the schema document."""
-    yield node
-    for child in node.get("properties", {}).values():
-        yield from schemas(child)
-    for key in ("items", "additionalProperties"):
-        if isinstance(node.get(key), dict):
-            yield from schemas(node[key])
-
-
-class ConfigModelTests(unittest.TestCase):
-    def test_provider_roots_follow_the_installed_layout(self):
-        environment = configuration.core_environment(Path("/installation"), config_model.initial(),
-                                                     {"installation_id": "fixture"})
-        self.assertEqual(environment["OAC_PROVIDER_ROOT"], "/opt/oac")
-        self.assertEqual(environment["OAC_PROVIDER_STATE_ROOT"], "/state")
-
-
-    def test_schema_uses_only_the_supported_keyword_subset(self):
-        for node in schemas(config_model.SCHEMA):
-            self.assertLessEqual(set(node), config_model.KEYWORDS)
-            self.assertLessEqual(set(node.get("x-oac", {})), config_model.ANNOTATIONS)
-            if "properties" in node:
-                self.assertIs(node.get("additionalProperties"), False)
-
-    def test_new_config_lists_every_setting(self):
-        expected = ["public_url", "host", "ports.core", "ports.web", "log.level", "log.format",
-                    "log.add_source", "core.execution_concurrency", "core.harnesses", "core.default_harness",
-                    "core.write_audit_retention", "core.oauth_trusted_origins", "core.database_pool.max_conns",
-                    "core.database_pool.min_conns", "core.database_pool.max_conn_lifetime",
-                    "core.database_pool.max_conn_idle_time", "core.database_pool.health_check_period",
-                    "core.runtime_history.transport", "core.runtime_history.endpoint",
-                    "core.runtime_history.insecure", "core.runtime_history.headers",
-                    "core.runtime_history.queue_capacity", "core.runtime_history.timeout_seconds",
-                    "core.runtime_history.sample_interval_seconds", "ingress"]
-        self.assertEqual(list(config_model.values(config_model.initial())), expected)
-        self.assertEqual(config_model.initial()["ports"], {"core": 8091, "web": 8080})
-        restarts = {item["key"]: item["restarts"] for item in config_model.settings(config_model.initial())}
-        self.assertEqual(restarts["ports.core"], ["core"])
-
-    def test_invalid_settings_name_their_key_without_their_value(self):
-        base = {"format": 1}
-        cases = [
-            ({"public_url": "https://core.example/"}, "public_url: must be a canonical origin"),
-            ({"public_url": "https://Core.example"}, "public_url: must be a canonical origin"),
-            ({"public_url": "http://core.example"}, "public_url: must be a canonical origin"),
-            *(({"public_url": origin}, "public_url: must be a canonical origin") for origin in (
-                "https://a_b.example", "https://core.example.", "https://b\u00fccher.example",
-                "https://core.example:0443", "https://core.example:", "http://[2001:db8::1]")),
-            ({"surprise": 1}, "surprise: unknown key"),
-            ({"ports": {"core": 8080}}, "ports: core, web need different ports"),
-            ({"ports": {"web": 80}}, "ports.web: must be at least 1024"),
-            ({"core": {"harnesses": ["mcode"]}}, "core.default_harness: must be listed in core.harnesses"),
-            ({"core": {"write_audit_retention": "59m"}}, "core.write_audit_retention: must be a Go duration of at least 1h"),
-            ({"core": {"runtime_history": {"headers": {"Authorization": 7}}}}, "core.runtime_history.headers.Authorization: must be string"),
-            ({"format": True}, "format: must be 1"),
-            ({"format": 1.0}, "format: must be 1"),
-        ]
-        for change, message in cases:
-            with self.subTest(change=change), self.assertRaises(config_model.ConfigError) as raised:
-                config_model.validate(dict(base, **change))
-            self.assertIn(message, str(raised.exception))
-            self.assertNotIn("Core.example", str(raised.exception))
-        for origin in ("http://127.0.0.1:8080", "http://localhost:8080", "https://core.example:8443",
-                       "https://[2001:db8::1]:8443", "http://[::1]:8080", "http://[::ffff:127.0.0.1]:8080"):
-            config_model.validate(dict(base, public_url=origin))
-
-    def test_generated_files_hold_no_secret_and_the_snapshot_hides_sensitive_values(self):
-        base = Path.home() / ".oac/tests/config-model"
-        base.mkdir(parents=True, exist_ok=True)
-        with tempfile.TemporaryDirectory(dir=base) as temporary:
-            root = Path(temporary).resolve()
-            (root / "secrets").mkdir()
-            secrets = {"core.key": "k" * 64, "credential.key": "credential-secret", "database.password": "database-secret"}
-            for name, value in secrets.items():
-                (root / "secrets" / name).write_text(value)
-            state = {"installation_id": "5b7c0f3e-0000-4000-8000-000000000000", "project": "oac-0123456789",
-                     "uid": 1000, "gid": 1000,
-                     "images": {name: "sha256:" + "1" * 64 for name in ("core", "web", "database")}}
-            headers = {"Authorization": "Bearer export-secret"}
-            config = config_model.initial()
-            config["core"]["runtime_history"] = {"endpoint": "collector.example:4317", "headers": headers}
-            rendered = configuration.render(root, config, state, "2026-09-25T00:00:00Z")
-            environment = configuration.read_environment(rendered.files["core.env"])
-            self.assertEqual(environment["OAC_DATABASE_URL"],
-                             "postgres://agents_api@database:5432/agents_api?sslmode=disable")
-            for name, text in rendered.files.items():
-                for secret in [*secrets.values(), "export-secret"]:
-                    if name != "runtime-history.json":
-                        self.assertNotIn(secret, text, name)
-            self.assertEqual(json.loads(rendered.files["runtime-history.json"])["headers"], headers)
-            snapshot = json.loads(rendered.files["settings.json"])
-            item = next(item for item in snapshot["settings"] if item["key"] == "core.runtime_history.headers")
-            self.assertEqual((item["value"], item["configured"], item["sensitive"]), (None, True, True))
-            self.assertEqual(snapshot["path"], str(root / "config.json"))
-            self.assertEqual(snapshot["apply_command"], f"{root / 'oac'} apply")
-            self.assertFalse(any(name.endswith(".service") for name in rendered.files))
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/deploy/install/test_ingress.py b/deploy/install/test_ingress.py
deleted file mode 100644
index 15f4a084d..000000000
--- a/deploy/install/test_ingress.py
+++ /dev/null
@@ -1,251 +0,0 @@
-"""Managed domain setup preserves a usable installation across failures and retries."""
-import contextlib
-import io
-import json
-from pathlib import Path
-import tempfile
-import unittest
-from unittest import mock
-
-import ingress
-import ingress_config
-import config_model
-import install
-import oac_cli
-from installer_fakes import FakeHost, MANIFEST, make_bundle, run_installer
-
-
-class DomainTests(unittest.TestCase):
-    def setUp(self):
-        base = Path.home() / ".oac/tests/ingress"
-        base.mkdir(parents=True, exist_ok=True)
-        work = tempfile.TemporaryDirectory(dir=base)
-        self.addCleanup(work.cleanup)
-        self.root = Path(work.name) / "core"
-        self.bundle, _ = make_bundle(Path(work.name) / "bundle", MANIFEST)
-        self.host = FakeHost(self)
-        self.reload_gateway = ingress_config.reload
-        for owner, name, replacement in (
-            (ingress_config, "preflight", mock.Mock(return_value={"docker_socket": "/var/run/docker.sock", "docker_gid": 999})),
-            (ingress_config, "reload", mock.Mock()),
-            (ingress, "verify", mock.Mock()),
-            (ingress, "resolves", mock.Mock(return_value=True)),
-        ):
-            patch = mock.patch.object(owner, name, replacement)
-            patch.start()
-            self.addCleanup(patch.stop)
-        with contextlib.redirect_stdout(io.StringIO()):
-            run_installer(install, self.bundle, ["--install-dir", self.root])
-        self.host.recreated.clear()
-
-    def gateway_ports(self):
-        return json.loads((self.root / "generated/compose.json").read_text())["services"]["gateway"]["ports"]
-
-    def test_default_bootstrap_then_https_reuses_installer_and_retains_data(self):
-        config = oac_cli.load_config(self.root)
-        self.assertEqual((config["host"], config["ingress"], config["public_url"]), ("0.0.0.0", "managed", None))
-        services = json.loads((self.root / "generated/compose.json").read_text())["services"]
-        self.assertEqual(services["core"]["ports"], ["127.0.0.1:8091:8091"])
-        self.assertNotIn("ports", services["web"])
-        self.assertNotIn("ports", services["database"])
-        self.assertEqual(services["gateway"]["ports"], ["0.0.0.0:8080:8080"])
-        for name in ("core", "web"):
-            self.assertNotIn("/docker.sock", str(services[name]))
-        preserved = {name: (self.root / "secrets" / name).read_bytes()
-                     for name in ("core.key", "credential.key", "database.password")}
-        ingress.configure(self.root, "core.example.com", out=lambda _: None)
-        self.assertEqual(ingress.status(self.root)["state"], "ready")
-        self.assertEqual(oac_cli.load_config(self.root)["public_url"], "https://core.example.com")
-        self.assertEqual(set(self.host.recreated), {"core", "migrate", "web", "gateway"})
-        self.assertEqual(self.gateway_ports(), ["0.0.0.0:8080:8080", "0.0.0.0:80:80", "0.0.0.0:443:443"])
-        self.assertIn("redir https://core.example.com{uri} 308", (self.root / "generated/Caddyfile").read_text())
-        self.assertEqual(preserved, {name: (self.root / "secrets" / name).read_bytes() for name in preserved})
-        self.host.recreated.clear()
-        ingress.configure(self.root, "core.example.com", out=lambda _: None)
-        self.assertEqual(self.host.recreated, [])
-        oac_cli.stop(self.root, out=lambda _: None)
-        oac_cli.start(self.root, out=lambda _: None)
-        self.assertEqual(ingress.status(self.root)["state"], "ready")
-
-    def test_certificate_failure_keeps_http_and_retry_finishes(self):
-        before = (self.root / "config.json").read_bytes()
-        ingress.verify.side_effect = ingress.DomainError("https_not_ready", "DNS not ready")
-        with self.assertRaisesRegex(ingress.DomainError, "DNS not ready"):
-            ingress.configure(self.root, "core.example.com", out=lambda _: None)
-        self.assertEqual((self.root / "config.json").read_bytes(), before)
-        self.assertNotIn("redir", (self.root / "generated/Caddyfile").read_text())
-        self.assertEqual(ingress.status(self.root)["state"], "failed")
-        # The gateway published 80 and 443 for the attempt and was restored without them.
-        self.assertEqual(self.host.recreated, ["gateway", "gateway"])
-        self.assertEqual(self.gateway_ports(), ["0.0.0.0:8080:8080"])
-        ingress.verify.side_effect = None
-        ingress.configure(self.root, "core.example.com", out=lambda _: None)
-        self.assertEqual(ingress.status(self.root)["state"], "ready")
-
-    def test_busy_https_port_refuses_setup_before_reserving_a_job(self):
-        self.host.busy.add(("0.0.0.0", 80))
-        before = (self.root / "ingress/status.json").read_bytes()
-        with self.assertRaises(ingress.DomainError) as error:
-            ingress.configure(self.root, "core.example.com", out=lambda _: None)
-        self.assertEqual((error.exception.code, error.exception.status), ("https_ports_unavailable", 409))
-        self.assertIn("Port 80 is already in use", str(error.exception))
-        self.assertEqual((self.root / "ingress/status.json").read_bytes(), before)
-        self.assertEqual((self.gateway_ports(), self.host.recreated), (["0.0.0.0:8080:8080"], []))
-
-    def test_unresolved_hostname_refuses_setup_before_reserving_a_job(self):
-        ingress.resolves.return_value = False
-        before = (self.root / "ingress/status.json").read_bytes()
-        with self.assertRaises(ingress.DomainError) as error:
-            ingress.configure(self.root, "core.example.com", out=lambda _: None)
-        self.assertEqual((error.exception.code, error.exception.status), ("hostname_unresolved", 409))
-        self.assertEqual((self.root / "ingress/status.json").read_bytes(), before)
-        self.assertEqual(self.host.recreated, [])
-
-    def test_domain_change_with_https_on_passes_its_own_port_check(self):
-        ingress.configure(self.root, "core.example.com", out=lambda _: None)
-        # The gateway itself now holds 80 and 443.
-        self.assertTrue({("0.0.0.0", 80), ("0.0.0.0", 443)} <= self.host.listening())
-        ingress.configure(self.root, "another.example.com", out=lambda _: None)
-        self.assertEqual(ingress.status(self.root)["public_url"], "https://another.example.com")
-
-    def test_apply_failure_restores_previous_inputs_and_interruption_can_retry(self):
-        self.host.core["rejects"] = lambda env: 'OAC_PUBLIC_URL="https://core.example.com"' in env
-        with self.assertRaises(ingress.DomainError):
-            ingress.configure(self.root, "core.example.com", out=lambda _: None)
-        self.assertIsNone(oac_cli.load_config(self.root)["public_url"])
-        self.assertTrue(self.host.core_listening(8091))
-        self.host.core["rejects"] = lambda _: False
-        with mock.patch.object(oac_cli, "_apply", side_effect=KeyboardInterrupt), self.assertRaises(KeyboardInterrupt):
-            ingress.configure(self.root, "core.example.com", out=lambda _: None)
-        self.assertEqual(ingress.status(self.root)["state"], "failed")
-        ingress_config.reload.reset_mock()
-        ingress.verify.side_effect = ingress.DomainError("https_not_ready", "DNS not ready")
-        with self.assertRaisesRegex(ingress.DomainError, "DNS not ready"):
-            ingress.configure(self.root, "core.example.com", out=lambda _: None)
-        for call in ingress_config.reload.call_args_list:
-            self.assertNotIn("redir", call.args[1])
-        self.assertIsNone(ingress.status(self.root)["public_url"])
-        ingress.verify.side_effect = None
-        ingress.configure(self.root, "core.example.com", out=lambda _: None)
-        self.assertEqual(ingress.status(self.root)["state"], "ready")
-
-    def test_bindings_pending_edits_and_concurrent_changes_require_operator_action(self):
-        self.host.bindings["self_hosted_executors"] = 1
-        with self.assertRaises(ingress.DomainError) as error:
-            ingress.configure(self.root, "core.example.com", out=lambda _: None)
-        self.assertEqual(error.exception.code, "public_url_confirmation_required")
-        with oac_cli.locked(self.root), self.assertRaisesRegex(oac_cli.OacError, "Another oac"):
-            ingress.configure(self.root, "core.example.com", out=lambda _: None)
-        ingress.configure(self.root, "core.example.com", "https://core.example.com", out=lambda _: None)
-        config = oac_cli.load_config(self.root)
-        config["log"]["level"] = "debug"
-        oac_cli.write_private(self.root / "config.json", json.dumps(config))
-        with self.assertRaisesRegex(ingress.DomainError, "pending config.json"):
-            ingress.configure(self.root, "another.example.com", out=lambda _: None)
-
-    def test_apply_recovers_after_containers_converged_before_gateway_reload(self):
-        ingress_config.reload.side_effect = [None, KeyboardInterrupt]
-        with self.assertRaises(KeyboardInterrupt):
-            ingress.configure(self.root, "core.example.com", out=lambda _: None)
-        self.assertEqual(ingress.status(self.root)["state"], "failed")
-        self.assertIn("redir https://core.example.com", (self.root / "generated/Caddyfile").read_text())
-        self.host.recreated.clear()
-        ingress_config.reload.reset_mock(side_effect=True)
-        ingress.verify.reset_mock()
-        oac_cli.apply(self.root, interactive=False, out=lambda _: None)
-        ingress_config.reload.assert_called_once()
-        ingress.verify.assert_called_once_with("https://core.example.com", oac_cli.load_state(self.root)["installation_id"])
-        self.assertEqual(self.host.recreated, [])
-        self.assertEqual(ingress.status(self.root)["state"], "ready")
-        self.assertEqual(ingress.status(self.root)["public_url"], "https://core.example.com")
-        config = oac_cli.load_config(self.root)
-        config["public_url"] = "https://another.example.com"
-        oac_cli.write_private(self.root / "config.json", json.dumps(config))
-        oac_cli.apply(self.root, interactive=False, out=lambda _: None)
-        self.assertEqual(ingress.status(self.root)["public_url"], config["public_url"])
-        self.assertEqual(ingress.status(self.root)["target_url"], config["public_url"])
-
-    def test_old_address_probe_keeps_managed_core_on_ipv4_loopback(self):
-        config = oac_cli.load_config(self.root)
-        for host in ("203.0.113.10", "::"):
-            with self.subTest(host=host):
-                config["host"] = host
-                self.host.requests.clear()
-                _, base, answered = oac_cli.old_public_url(
-                    self.root, config, config_model.values(config), {}, {"core": {"running": True}})
-                self.assertEqual(base, "http://127.0.0.1:8091")
-                self.assertTrue(answered)
-                self.assertEqual(self.host.requests, [base + "/core/v1/installation"])
-
-    def test_gateway_disconnect_uses_the_existing_apply_rollback(self):
-        before = (self.root / "generated/core.env").read_bytes()
-        config = oac_cli.load_config(self.root)
-        config["log"]["level"] = "debug"
-        oac_cli.write_private(self.root / "config.json", json.dumps(config))
-        ingress_config.reload.side_effect = self.reload_gateway
-        with mock.patch.object(ingress_config, "UnixHTTP") as connection:
-            connection.return_value.request.side_effect = [ConnectionRefusedError(), None]
-            connection.return_value.getresponse.return_value.status = 200
-            with self.assertRaisesRegex(oac_cli.OacError, "previous generated files were restored"):
-                oac_cli.apply(self.root, interactive=False, out=lambda _: None)
-        self.assertEqual((self.root / "generated/core.env").read_bytes(), before)
-        self.assertTrue(self.host.core_listening(8091))
-
-    def test_status_requires_both_managed_ingress_services(self):
-        for name in ("gateway", "installation"):
-            with self.subTest(service=name):
-                self.host.containers[name]["running"] = False
-                with self.assertRaisesRegex(oac_cli.OacError, "services are unavailable"):
-                    oac_cli.status(self.root, out=lambda _: None)
-                self.host.containers[name]["running"] = True
-
-    def test_failed_retry_restores_the_receipt_before_and_after_service_convergence(self):
-        before = (self.root / "generated/core.env").read_bytes()
-        self.host.bindings["self_hosted_executors"] = 1
-        target = "https://core.example.com"
-        converge = oac_cli.converge
-        for restarted in (False, True):
-            with self.subTest(services_restarted=restarted):
-                calls = []
-                def interrupt(*args, **kwargs):
-                    # The gateway converges for the candidate; the switch stops before or after converging.
-                    calls.append(args)
-                    if len(calls) == 1 or restarted:
-                        converge(*args, **kwargs)
-                    if len(calls) == 2:
-                        raise KeyboardInterrupt()
-                with mock.patch.object(oac_cli, "converge", side_effect=interrupt), self.assertRaises(KeyboardInterrupt):
-                    ingress.configure(self.root, "core.example.com", target, out=lambda _: None)
-                self.assertEqual(len(calls), 2)
-                # The retry returns Core to the applied address first, so it confirms the change from there.
-                with self.assertRaises(ingress.DomainError) as error:
-                    ingress.configure(self.root, "core.example.com", out=lambda _: None)
-                self.assertEqual(error.exception.code, "public_url_confirmation_required")
-                ingress_config.reload.reset_mock()
-                ingress.verify.side_effect = ingress.DomainError("https_not_ready", "DNS not ready")
-                with self.assertRaisesRegex(ingress.DomainError, "DNS not ready"):
-                    ingress.configure(self.root, "core.example.com", target, out=lambda _: None)
-                for call in ingress_config.reload.call_args_list:
-                    self.assertNotIn("redir", call.args[1])
-                self.assertIsNone(oac_cli.load_config(self.root)["public_url"])
-                self.assertIsNone(ingress.status(self.root)["public_url"])
-                self.assertEqual((self.root / "generated/core.env").read_bytes(), before)
-                self.assertTrue(self.host.core_listening(8091))
-                ingress.verify.side_effect = None
-
-    def test_start_records_the_applied_address_after_an_offline_edit(self):
-        oac_cli.stop(self.root, out=lambda _: None)
-        config = oac_cli.load_config(self.root)
-        config["public_url"] = "https://core.example.com"
-        oac_cli.write_private(self.root / "config.json", json.dumps(config))
-        oac_cli.apply(self.root, interactive=False, confirm_public_url_change=config["public_url"], out=lambda _: None)
-        self.assertIsNone(ingress.status(self.root)["public_url"])
-        oac_cli.start(self.root, out=lambda _: None)
-        self.assertEqual(ingress.status(self.root)["public_url"], config["public_url"])
-        self.assertEqual(ingress.status(self.root)["state"], "ready")
-
-    def test_untrusted_hostnames_never_reach_gateway(self):
-        for value in ("https://example.com", "example.com:8443", "127.0.0.1", "localhost", "a.local", "a.com\n}", None):
-            with self.subTest(value=value), self.assertRaises(ingress.DomainError):
-                ingress.configure(self.root, value, out=lambda _: None)
-        self.assertIsNone(oac_cli.load_config(self.root)["public_url"])
diff --git a/deploy/install/test_install.py b/deploy/install/test_install.py
deleted file mode 100644
index 72a1b9f7f..000000000
--- a/deploy/install/test_install.py
+++ /dev/null
@@ -1,631 +0,0 @@
-#!/usr/bin/env python3
-"""install.sh acceptance behavior: fresh install, repair and bundle checks."""
-
-import contextlib
-import errno
-import io
-import json
-import os
-from pathlib import Path
-import runpy
-import signal
-import stat
-import subprocess
-import sys
-import tempfile
-import unittest
-from unittest import mock
-
-import config_model
-import distribution
-import ingress
-import ingress_config
-import install
-import node_spec
-from installer_fakes import MANIFEST, STANDARD_SIZES, FakeHost, make_bundle, run_installer
-
-REAL_RUN = subprocess.run
-
-
-class InstallerTests(unittest.TestCase):
-    def setUp(self):
-        temporary_root = Path.home() / ".oac/tests/install"
-        temporary_root.mkdir(parents=True, exist_ok=True)
-        self.temporary = tempfile.TemporaryDirectory(prefix="unit-", dir=temporary_root)
-        self.addCleanup(self.temporary.cleanup)
-        self.work = Path(self.temporary.name).resolve()
-        self.root = self.work / "deployment"
-        self.bundle, self.manifest = make_bundle(self.work / "bundle", MANIFEST)
-        self.host = FakeHost(self)
-        self.host.native_root = self.root
-        self.output = io.StringIO()
-
-    def install(self, *flags):
-        # These lifecycle tests exercise operator-managed reverse proxies. The
-        # managed gateway has end-to-end setup/rollback coverage in test_ingress.
-        if not (self.root / "state.json").exists() and "--config" not in flags:
-            flags = (*flags, "--ingress", "external")
-        with contextlib.redirect_stdout(self.output), contextlib.redirect_stderr(self.output):
-            run_installer(install, self.bundle, ["--install-dir", self.root, *flags])
-
-    def document(self, name):
-        return json.loads((self.root / name).read_text())
-
-    def snapshot(self):
-        return {str(path.relative_to(self.root)): (stat.S_IMODE(path.stat().st_mode),
-                path.read_bytes() if path.is_file() else None)
-                for path in [self.root, *self.root.rglob("*")] if path.name != ".oac.lock"}
-
-    def key_file(self, contents="synthetic-existing-core-key-0123456789", mode=0o600):
-        path = self.work / "existing-core.key"
-        path.write_text(contents)
-        path.chmod(mode)
-        return path
-
-    def test_catalog_is_mounted_into_core(self):
-        import hashlib
-        native = self.bundle / "native-installers"
-        native.mkdir()
-        raw = b"offline native archive"
-        catalog = {"version": self.manifest["source_commit"], "artifacts": {
-            "linux-amd64": {"sha256": hashlib.sha256(raw).hexdigest()}}}
-        (native / "catalog.json").write_text(json.dumps(catalog))
-        # The installer checks the outer checksum inventory before copying.
-        with (self.bundle / "SHA256SUMS").open("a") as sums:
-            for path in native.iterdir():
-                sums.write(distribution.digest(path) + "  " + str(path.relative_to(self.bundle)) + "\n")
-        self.install()
-        first = self.document("generated/compose.json")["services"]["core"]["labels"]
-        (native / "linux-amd64.tar.gz").write_bytes(raw)
-        self.install()
-        second = self.document("generated/compose.json")["services"]["core"]["labels"]
-        self.assertNotEqual(first, second)
-        (native / "linux-amd64.tar.gz").unlink()
-        self.install()
-        self.assertEqual(second, self.document("generated/compose.json")["services"]["core"]["labels"])
-        installed = self.root / "native-installers"
-        self.assertEqual((installed / "linux-amd64.tar.gz").read_bytes(), raw)
-        compose = self.document("generated/compose.json")
-        mount = next(m for m in compose["services"]["core"]["volumes"] if m["target"] == "/opt/oac/native-installers")
-        self.assertTrue(mount["read_only"])
-        self.assertEqual(mount["source"], str(installed))
-        environment = install.configuration.core_environment(self.root, self.document("config.json"), self.document("state.json"))
-        self.assertEqual(environment["OAC_NATIVE_INSTALLER_DIR"], "/opt/oac/native-installers")
-
-    def test_host_check_accepts_current_account_including_root(self):
-        for uid in (0, 1000):
-            with self.subTest(uid=uid), mock.patch.object(install.os, "getuid", return_value=uid), \
-                    mock.patch.object(install.platform, "system", return_value="Linux"), \
-                    mock.patch.object(install.platform, "machine", return_value="x86_64"):
-                self.host.commands.clear()
-                install.check_host()
-                self.assertEqual(self.host.commands, [
-                    ["docker", "compose", "version", "--short"],
-                    ["docker", "info", "--format", "{{.ServerVersion}}"],
-                ])
-
-    def test_host_failures_explain_the_required_action_without_secrets(self):
-        for command, failure, message in (
-                ("compose", FileNotFoundError(), "Compose plugin"),
-                ("info", PermissionError("private detail"), "current account"),
-                ("info", subprocess.TimeoutExpired(["docker", "info"], 30), "current account")):
-            with self.subTest(command=command, failure=failure):
-                original = self.host.run
-                def run(args, **kwargs):
-                    if command in args:
-                        raise failure
-                    return original(args, **kwargs)
-                with mock.patch.object(subprocess, "run", side_effect=run):
-                    with self.assertRaisesRegex(install.InstallError, message) as raised:
-                        self.install()
-                self.assertNotIn("private detail", str(raised.exception))
-                self.assertFalse(self.root.exists())
-
-    def test_space_and_permission_errors_are_actionable_and_leave_no_installation(self):
-        for error, message in ((OSError(errno.ENOSPC, "full"), "Disk space"),
-                               (OSError(errno.EDQUOT, "quota"), "quota"),
-                               (PermissionError("private detail"), "current account")):
-            with self.subTest(error=error), mock.patch.object(install, "create", side_effect=error):
-                with self.assertRaises(OSError) as raised:
-                    self.install()
-                self.assertIn(message, install.error_text(raised.exception))
-                self.assertIn(install.NOTHING_KEPT, install.error_text(raised.exception))
-                self.assertFalse(self.root.exists())
-
-    def test_new_release_cleans_an_incomplete_installation_before_starting_again(self):
-        self.install()
-        state = self.document("state.json")
-        previous_id = state["installation_id"]
-        install.oac_cli.save_state(self.root, dict(state, complete=False, source_commit="b" * 40))
-        self.install("--ingress", "external")
-        self.assertNotEqual(self.document("state.json")["installation_id"], previous_id)
-        self.assertTrue(self.document("state.json")["complete"])
-        self.assertTrue(any("down" in command for command in self.host.commands))
-
-    def test_root_identity_is_preserved_in_service_configuration(self):
-        with mock.patch.object(install.os, "getuid", return_value=0), \
-                mock.patch.object(install.os, "getgid", return_value=0):
-            self.install()
-        state = self.document("state.json")
-        self.assertEqual((state["uid"], state["gid"]), (0, 0))
-        services = self.document("generated/compose.json")["services"]
-        for name in ("core", "migrate", "web"):
-            self.assertEqual(services[name]["user"], "0:0")
-        self.assertNotIn("user", services["database"])
-        self.assertEqual(self.host.running(), {"database", "core", "web"})
-
-    def test_install_and_repair_hold_same_lock_before_all_writes(self):
-        original_create = install.create
-        original_finish = install.finish
-        inodes = []
-
-        def assert_busy():
-            inodes.append((self.root / ".oac.lock").stat().st_ino)
-            probe = "import fcntl,sys; f=open(sys.argv[1], 'r+');\ntry: fcntl.flock(f, fcntl.LOCK_EX | fcntl.LOCK_NB)\nexcept BlockingIOError: sys.exit(73)"
-            result = REAL_RUN([sys.executable, "-c", probe, str(self.root / ".oac.lock")],
-                                    capture_output=True, timeout=10)
-            self.assertEqual(result.returncode, 73, result.stderr)
-            with self.assertRaisesRegex(install.oac_cli.OacError, "Another oac"):
-                self.install()
-            with self.assertRaisesRegex(install.oac_cli.OacError, "Another oac"):
-                with install.oac_cli.locked(self.root):
-                    self.fail("A second operation acquired the installation lock")
-
-        def create(*args, **kwargs):
-            assert_busy()
-            return original_create(*args, **kwargs)
-
-        def finish(*args, **kwargs):
-            assert_busy()
-            return original_finish(*args, **kwargs)
-
-        with mock.patch.object(install, "create", create), mock.patch.object(install, "finish", finish):
-            self.install()
-            before = self.document("state.json")
-            keys = {p.name: p.read_bytes() for p in (self.root / "secrets").iterdir()}
-            self.install()
-        self.assertEqual(len(set(inodes)), 1)
-        self.assertEqual(before["installation_id"], self.document("state.json")["installation_id"])
-        self.assertEqual(keys, {p.name: p.read_bytes() for p in (self.root / "secrets").iterdir()})
-
-    def test_repair_contention_changes_no_installation_bytes(self):
-        self.install()
-        before = self.snapshot()
-        with install.oac_cli.locked(self.root):
-            with self.assertRaisesRegex(install.oac_cli.OacError, "Another oac"):
-                self.install()
-        self.assertEqual(before, self.snapshot())
-
-    def test_an_interrupted_first_start_removes_what_it_created(self):
-        self.root.mkdir()
-        with mock.patch.object(install.oac_cli, "health", side_effect=KeyboardInterrupt), \
-                self.assertRaises(KeyboardInterrupt) as raised:
-            self.install()
-        self.assertEqual(install.error_text(raised.exception), "interrupted\n" + install.NOTHING_KEPT)
-        # The directory existed, so it stays, with only the lock that a waiting command may hold.
-        self.assertEqual([path.name for path in self.root.iterdir()], [".oac.lock"])
-        self.assertIn(["docker", "compose", "-p", self.host.project, "down", "--volumes", "--remove-orphans"],
-                      self.host.commands)
-        self.assertEqual(self.host.containers, {})
-
-    def test_a_rerun_replaces_an_incomplete_installation(self):
-        self.install()
-        for marker in (False, None):
-            with self.subTest(marker=marker):
-                old = self.host.project
-                # A first start killed before completion; its services still hold their ports.
-                state = dict(self.document("state.json"), complete=marker)
-                if marker is None:
-                    del state["complete"]
-                install.oac_cli.save_state(self.root, state)
-                for command in (install.oac_cli.start, install.oac_cli.apply, install.oac_cli.status):
-                    with self.assertRaisesRegex(install.oac_cli.OacError, "did not finish installing. Rerun the installer"):
-                        command(self.root, out=lambda _: None)
-                with self.assertRaisesRegex(ingress.DomainError, "did not finish installing"):
-                    ingress.prepare(self.root, "core.example", None)
-                self.host.busy = {8080, 8091}
-                remove = install.oac_cli.remove
-                with mock.patch.object(install.oac_cli, "remove",
-                                       side_effect=lambda *args, **kwargs: (remove(*args, **kwargs), self.host.busy.clear())):
-                    self.install("--ingress", "external")
-                self.assertIn(["docker", "compose", "-p", old, "down", "--volumes", "--remove-orphans"], self.host.commands)
-                self.assertEqual(self.document("config.json")["ports"]["core"], 8091)
-                state = self.document("state.json")
-                self.assertNotEqual(state["project"], old)
-                self.assertTrue(state["complete"])
-                self.assertEqual(self.host.running(), {"database", "core", "web"})
-
-    def test_removal_keeps_recovery_state_on_failure_and_finishes_despite_signals(self):
-        self.install()
-        state = dict(self.document("state.json"), complete=False)
-        install.oac_cli.save_state(self.root, state)
-        command = (self.root / "oac").read_bytes()
-        unlink = Path.unlink
-
-        def fail_command(path, *args, **kwargs):
-            if path == self.root / "oac":
-                raise PermissionError("command unlink refused")
-            return unlink(path, *args, **kwargs)
-
-        with install.oac_cli.locked(self.root), mock.patch.object(Path, "unlink", fail_command), \
-                self.assertRaisesRegex(install.oac_cli.OacError, "Removal did not finish"):
-            install.oac_cli.remove(self.root, state, keep_root=True)
-        self.assertEqual(self.document("state.json"), state)
-        self.assertEqual((self.root / "oac").read_bytes(), command)
-        self.assertEqual(install.layout(self.root), "incomplete")
-
-        signals = (signal.SIGINT, signal.SIGTERM, signal.SIGHUP)
-        for signum in signals:
-            previous = signal.signal(signum, install.interrupted)
-            self.addCleanup(signal.signal, signum, previous)
-        delivered = []
-
-        def interrupt_command(path, *args, **kwargs):
-            if path == self.root / "oac":
-                self.assertFalse((self.root / "state.json").exists())
-                for signum in signals:
-                    signal.raise_signal(signum)
-                    delivered.append(signum)
-            return unlink(path, *args, **kwargs)
-
-        with install.oac_cli.locked(self.root), mock.patch.object(Path, "unlink", interrupt_command):
-            install.oac_cli.remove(self.root, state, keep_root=True)
-        self.assertEqual(delivered, list(signals))
-        self.assertEqual([path.name for path in self.root.iterdir()], [".oac.lock"])
-        for signum in signals:
-            self.assertIs(signal.getsignal(signum), install.interrupted)
-
-    def test_manual_removal_command_keeps_automatic_compose_isolation(self):
-        self.install()
-        state = self.document("state.json")
-        foreign = self.work / "other-project"
-        foreign.mkdir()
-        (foreign / "compose.yaml").write_text("volumes:\n  database:\n    name: unrelated-database\n")
-        binaries = self.work / "bin"
-        binaries.mkdir()
-        docker = binaries / "docker"
-        docker.write_text(f"#!{sys.executable}\nimport json, os, sys\n"
-                          "print(json.dumps({'cwd': os.getcwd(), 'args': sys.argv[1:], "
-                          "'compose': [key for key in os.environ if key.startswith('COMPOSE_')], "
-                          "'docker_host': os.environ.get('DOCKER_HOST')}))\n")
-        docker.chmod(0o700)
-        environment = dict(os.environ, COMPOSE_FILE=str(foreign / "compose.yaml"), COMPOSE_PROJECT_NAME="unrelated",
-                           DOCKER_HOST="unix:///synthetic-docker.sock", PATH=str(binaries) + os.pathsep + os.environ["PATH"])
-        with mock.patch.dict(os.environ, environment, clear=True):
-            with install.oac_cli.locked(self.root), \
-                    mock.patch.object(install.oac_cli, "run", side_effect=OSError("Docker unavailable")) as run, \
-                    self.assertRaises(install.oac_cli.OacError) as raised:
-                install.oac_cli.remove(self.root, state)
-            self.assertEqual(run.call_args.kwargs["cwd"], "/")
-            self.assertFalse(any(name.startswith("COMPOSE_") for name in run.call_args.kwargs["env"]))
-            manual = str(raised.exception).splitlines()[1].strip()
-            result = REAL_RUN(["sh", "-c", manual], cwd=foreign, capture_output=True, text=True, check=True)
-        observed = json.loads(result.stdout)
-        self.assertEqual(observed, {"cwd": "/", "args": run.call_args.args[0][1:], "compose": [],
-                                    "docker_host": environment["DOCKER_HOST"]})
-        self.assertEqual(self.document("state.json"), state)
-
-    def test_a_directory_without_state_json_is_refused_and_untouched(self):
-        key = self.root / "secrets/e2b.key"
-        key.parent.mkdir(parents=True)
-        key.write_text("synthetic-e2b-key-0123456789")
-        key.chmod(0o600)
-        before = self.snapshot()
-        with self.assertRaisesRegex(install.InstallError, "not empty"):
-            self.install("--public-url", "https://core.example")
-        self.assertEqual(self.snapshot(), before)
-
-    def test_a_complete_installation_is_never_removed(self):
-        self.install()
-        before = self.snapshot()
-        with self.assertRaisesRegex(install.InstallError, "configured by"):
-            self.install("--web-port", "8081")
-        self.host.containers.clear()
-        self.host.core["fails"] = True
-        with self.assertRaisesRegex(install.oac_cli.OacError, "config.json not applied"):
-            self.install()
-        self.assertEqual(self.snapshot(), before)
-        self.assertFalse(any("down" in command for command in self.host.commands))
-
-    def test_different_revision_refuses_before_mutation(self):
-        self.install()
-        state = self.document("state.json")
-        state["source_commit"] = "b" * 40
-        install.oac_cli.save_state(self.root, state)
-        before = self.snapshot()
-        with self.assertRaisesRegex(install.InstallError, "not supported;.*reinstall"):
-            self.install()
-        self.assertEqual(before, self.snapshot())
-
-    def test_fresh_install_writes_config_json_and_the_layout(self):
-        previous = os.umask(0)
-        try:
-            self.install("--public-url", "https://core.example", "--web-port", "8181")
-        finally:
-            os.umask(previous)
-        config = self.document("config.json")
-        self.assertEqual(config, config_model.initial(public_url="https://core.example", **{"ports.web": 8181}, ingress="external"))
-        state = self.document("state.json")
-        self.assertEqual(state["source_commit"], "a" * 40)
-        self.assertNotIn("mode", state)
-        self.assertNotIn("native_core", state)
-        self.assertEqual(set(state["images"]), {"core", "database", "web"})
-        self.assertEqual(set(state["secrets_sha256"]), {"credential.key", "database.password"})
-        names = {str(path.relative_to(self.root)) for path in self.root.rglob("*") if "node-payload" not in path.relative_to(self.root).parts[:-1]
-                 and "runtime" not in path.parts}
-        self.assertEqual(names, {
-            ".oac.lock", "config.json", "state.json", "oac", "node-payload", "secrets", "secrets/core.key",
-            "secrets/credential.key", "secrets/database.password", "generated", "generated/compose.json",
-            "generated/core.env", "generated/core-key-digests.json", "generated/settings.json",
-            "generated/config.schema.json", "state", "state/e2b"})
-        for path in [self.root, *self.root.rglob("*")]:
-            expected = 0o700 if path.is_dir() or path.name == "oac" else 0o600
-            self.assertEqual(stat.S_IMODE(path.stat().st_mode), expected, path)
-        self.assertEqual(self.host.running(), {"database", "core", "web"})
-        output = self.output.getvalue()
-        for name in ("core.key", "credential.key", "database.password"):
-            self.assertNotIn((self.root / "secrets" / name).read_text(), output)
-        for line in ("Console: https://core.example", "API base URL: https://core.example/v1",
-                     "Local-only API on this host: http://127.0.0.1:8091/v1",
-                     f"Settings: {self.root / 'config.json'}", f"Apply settings: {self.root / 'oac'} apply"):
-            self.assertIn("  " + line + "\n", output)
-
-    def test_a_taken_explicit_port_fails_before_the_bundle_is_hashed(self):
-        self.host.busy.update({("127.0.0.1", 18080), ("127.0.0.1", 8080)})
-        # A loopback public URL names Web's port, so that port cannot move either.
-        for flags, port, name in ((("--web-port", "18080"), 18080, "--web-port"),
-                                  (("--public-url", "http://localhost:8080"), 8080, "--web-port and --public-url")):
-            with self.subTest(flags=flags), \
-                    mock.patch.object(install, "verify_bundle", side_effect=AssertionError("bundle hashed")), \
-                    self.assertRaisesRegex(install.InstallError, rf"^Port {port} \({name}\) is already in use on 127.0.0.1. "
-                                           rf"Free it or choose another port; find the process with: sudo ss -ltnp 'sport = :{port}'$"):
-                self.install(*flags)
-            self.assertFalse(self.root.exists())
-
-    def test_taken_default_ports_move_to_the_next_free_port(self):
-        self.host.busy.update({("0.0.0.0", 8080), ("0.0.0.0", 8091)})
-        self.install()
-        self.assertEqual(self.document("config.json")["ports"], {"core": 8092, "web": 8081})
-        output = self.output.getvalue()
-        self.assertIn("  Console: http://127.0.0.1:8081 (local only)\n", output)
-        self.assertIn("  Port 8080 was in use; Web uses 8081.\n", output)
-        self.assertIn("  Port 8091 was in use; Core uses 8092.\n", output)
-
-    def test_managed_ingress_without_https_leaves_ports_80_and_443_alone(self):
-        self.host.busy.add(("0.0.0.0", 80))
-        with mock.patch.object(ingress_config, "preflight", return_value={"docker_socket": "/var/run/docker.sock", "docker_gid": 999}), \
-                mock.patch.object(ingress_config, "reload"), contextlib.redirect_stdout(self.output):
-            run_installer(install, self.bundle, ["--install-dir", self.root])
-        self.assertEqual(self.document("generated/compose.json")["services"]["gateway"]["ports"], ["0.0.0.0:8080:8080"])
-
-    def test_managed_https_needs_ports_80_and_443(self):
-        self.host.busy.add(("0.0.0.0", 80))
-        with contextlib.redirect_stdout(self.output), self.assertRaisesRegex(
-                install.InstallError, "^Automatic HTTPS needs ports 80 and 443, and port 80 is already in use on 0.0.0.0. "
-                "Free it, or use an existing reverse proxy with --ingress external; find the process with: "
-                "sudo ss -ltnp 'sport = :80'$"):
-            run_installer(install, self.bundle, ["--install-dir", self.root, "--public-url", "https://core.example"])
-        self.assertFalse(self.root.exists())
-
-    def test_output_labels_public_and_local_addresses(self):
-        cases = {
-            "default": ([], ["Console: http://127.0.0.1:8080 (local only)",
-                             "API base URL: http://127.0.0.1:8091/v1 (local only)",
-                             "Use this key to sign in to Web.",
-                             "Before adding nodes, configure a reachable HTTPS address",
-                             "Add nodes: in Web, open Nodes and choose Add node"]),
-            "loopback": (["--public-url", "http://localhost:8080"], ["Console: http://localhost:8080 (local only)",
-                                                                     "API base URL: http://127.0.0.1:8091/v1 (local only)"]),
-        }
-        for name, (flags, expected) in cases.items():
-            with self.subTest(name=name):
-                self.host.containers.clear()  # Each case installs on a host of its own.
-                self.root, self.output = self.work / name, io.StringIO()
-                self.install(*flags)
-                output = " ".join(self.output.getvalue().split())
-                for line in expected:
-                    self.assertIn(line, output)
-                self.assertIn(f"Core key file: {self.root / 'secrets/core.key'}", output)
-
-
-    def test_no_change_repair_does_not_claim_service_health(self):
-        self.install()
-        self.output = io.StringIO()
-        original_http = install.oac_cli.http
-        def unhealthy(url, *args, **kwargs):
-            if url.endswith(("/healthz", "/console/auth")):
-                return 503, None
-            return original_http(url, *args, **kwargs)
-        with mock.patch.object(install.oac_cli, "http", side_effect=unhealthy):
-            self.install()
-        output = self.output.getvalue()
-        self.assertIn("Installation settings checked. Use Status below to inspect service health.", output)
-        for misleading in ("Installation complete.", "Repair complete.", "checking their health"):
-            self.assertNotIn(misleading, output)
-
-    def test_rerun_reads_config_json_rejects_flags_and_repairs(self):
-        self.install()
-        before = self.snapshot()
-        with self.assertRaisesRegex(install.InstallError, "config.json. Edit it and run .*oac apply"):
-            self.install("--web-port", "8081")
-        self.assertEqual(self.snapshot(), before)
-        (self.root / "oac").unlink()
-        config = self.document("config.json")
-        config["ports"]["web"] = 8181
-        (self.root / "config.json").write_text(json.dumps(config))
-        self.host.recreated.clear()
-        self.install()
-        self.assertEqual((self.root / "oac").read_bytes(), (self.bundle / "oac.pyz").read_bytes())
-        self.assertEqual(self.host.recreated, ["web"])
-        other, _ = make_bundle(self.work / "other", MANIFEST, commit="b" * 40)
-        with self.assertRaisesRegex(install.InstallError, "not supported;.*reinstall"):
-            with contextlib.redirect_stdout(self.output):
-                run_installer(install, other, ["--install-dir", self.root])
-
-    def test_unsupported_state_format_refuses_before_lock_creation(self):
-        self.root.mkdir()
-        install.oac_cli.save_state(self.root, {"format": 1})
-        before = self.snapshot()
-        with self.assertRaisesRegex(install.oac_cli.OacError, "not supported;.*reinstall"):
-            self.install()
-        with self.assertRaisesRegex(install.oac_cli.OacError, "not supported;.*reinstall"):
-            with install.oac_cli.locked(self.root):
-                self.fail("Unsupported installation acquired the lock")
-        self.assertEqual(before, self.snapshot())
-        self.assertFalse((self.root / ".oac.lock").exists())
-
-    def test_a_live_installation_missing_config_json_is_never_told_to_start_over(self):
-        self.install()
-        (self.root / "config.json").unlink()
-        before = self.snapshot()
-        with self.assertRaisesRegex(install.InstallError, "config.json is missing. Restore it from a backup; "
-                                    ".*generated/settings.json lists the last applied values"):
-            self.install()
-        self.assertEqual(self.snapshot(), before)
-
-    def test_a_new_installation_selects_microsandbox_at_web_standard_size(self):
-        self.install("--public-url", "https://core.example")
-        standard = json.loads(STANDARD_SIZES.read_text())
-        self.assertEqual(self.host.deployment_posts, [{"provider": "microsandbox", "expected_generation": 0, "resources": standard["microsandbox"],
-                                                       "runtime": node_spec.release(self.manifest)}])
-        output = " ".join(self.output.getvalue().split())
-        for message in ("Sandboxes: microsandbox, Standard (2 CPUs, 4 GiB).",
-                        "Execution nodes need KVM (/dev/kvm). This host needs KVM only if you add it as a node.",
-                        "Add nodes: in Web, open Nodes and choose Add node, then run the command on each execution host."):
-            self.assertIn(message, output)
-        self.assertNotIn("sandbox", json.dumps(self.document("config.json")))
-        # A repair never selects again.
-        self.host.deployment = {"provider": ""}
-        self.install()
-        self.assertEqual(len(self.host.deployment_posts), 1)
-
-    def test_a_failed_first_start_removes_what_it_created(self):
-        self.host.core["fails"] = True
-        with self.assertRaises(install.InstallError) as raised:
-            self.install()
-        self.assertEqual(install.error_text(raised.exception),
-                         f"The services did not start: `docker compose up` failed\n{install.NOTHING_KEPT}")
-        self.assertNotIn("Installation complete.", self.output.getvalue())
-        self.assertFalse(self.root.exists())
-        self.assertIn(["docker", "compose", "-p", self.host.project, "down", "--volumes", "--remove-orphans"],
-                      self.host.commands)
-        self.assertEqual(self.host.containers, {})
-        # The same command installs once the cause is fixed, sandbox backend included.
-        self.host.core["fails"] = False
-        self.install()
-        self.assertEqual(self.host.deployment_posts[-1]["provider"], "microsandbox")
-
-    def test_a_refused_selection_leaves_the_services_running(self):
-        self.host.deployment_refusal = "microsandbox is unavailable."
-        with self.assertRaises(install.InstallError) as raised:
-            self.install("--public-url", "https://core.example")
-        self.assertEqual(str(raised.exception), "Core refused the sandbox setup: microsandbox is unavailable. "
-                         "Services are installed and running; choose the sandbox backend on the Nodes page in Web")
-        self.assertEqual(self.host.running(), {"database", "core", "web"})
-        self.assertIn("Console: https://core.example\n", self.output.getvalue())
-        self.assertNotIn("Sandboxes:", self.output.getvalue())
-        self.assertNotIn("Installation complete.", self.output.getvalue())
-        self.assertIn("Services are running; sandbox setup needs attention.", self.output.getvalue())
-
-    def test_node_payload_exports_only_matched_distribution_files(self):
-        self.install()
-        payload = self.root / "node-payload/releases" / ("a" * 40)
-        exported = {str(path.relative_to(payload)) for path in payload.rglob("*") if path.is_file()}
-        self.assertEqual(exported, {"node-install.pyz", "manifest.json", "SHA256SUMS",
-                                    "runtime/seccomp.json"})
-        (payload / "node-install.pyz").write_text("changed")
-        with self.assertRaisesRegex(install.InstallError, "node payload differs"):
-            install.prepare_node_payload(self.root, self.document("state.json"), self.bundle)
-
-    def test_bundle_verifies_transferred_bytes_and_checksum_list(self):
-        self.assertEqual(install.verify_bundle(self.bundle)["source_commit"], "a" * 40)
-        for name in ("images/core.tar", "manifest.json", "oac.pyz", "config.schema.json"):
-            with self.subTest(name=name):
-                path = self.bundle / name
-                original = path.read_bytes()
-                path.write_bytes(original + b"modified")
-                with self.assertRaises(install.InstallError):
-                    install.verify_bundle(self.bundle)
-                path.write_bytes(original)
-        checksums = self.bundle / "SHA256SUMS"
-        original = checksums.read_text()
-        for name in ("oac.pyz", "standard-sizes.json"):
-            checksums.write_text("".join(line + "\n" for line in original.splitlines() if not line.endswith("  " + name)))
-            with self.subTest(name=name), self.assertRaisesRegex(install.InstallError, "incomplete"):
-                install.verify_bundle(self.bundle)
-        checksums.write_text(original + original.splitlines()[0] + "\n")
-        with self.assertRaisesRegex(install.InstallError, "Duplicate"):
-            install.verify_bundle(self.bundle)
-        checksums.write_text(install.digest(self.key_file()) + "  ../existing-core.key\n")
-        with self.assertRaisesRegex(install.InstallError, "Invalid distribution path"):
-            install.verify_bundle(self.bundle)
-
-    def test_wrong_image_identity_creates_no_installation(self):
-        original = distribution.docker_command
-        with mock.patch.object(distribution, "docker_command", side_effect=lambda arguments, **kwargs: (
-                subprocess.CompletedProcess(arguments, 0, "sha256:" + "f" * 64 + " linux/amd64", "")
-                if "inspect" in arguments else original(arguments, **kwargs))):
-            with self.assertRaisesRegex(distribution.DistributionError, "identity or platform"):
-                self.install()
-        self.assertFalse(self.root.exists())
-
-    def test_cli_failure_does_not_print_external_command_secrets(self):
-        secret = "synthetic-sensitive-command-value"
-        failure = subprocess.CalledProcessError(1, ["docker", secret], output=secret, stderr=secret)
-        output = io.StringIO()
-        with mock.patch.object(sys, "argv", [install.__file__, "--install-dir", str(self.root)]), \
-                mock.patch.object(install.platform, "system", return_value="Linux"), \
-                mock.patch.object(install.platform, "machine", return_value="x86_64"), \
-                mock.patch.object(subprocess, "run", side_effect=failure), \
-                contextlib.redirect_stdout(output), contextlib.redirect_stderr(output), \
-                self.assertRaises(SystemExit) as raised:
-            runpy.run_path(install.__file__, run_name="__main__")
-        self.assertEqual(raised.exception.code, 1)
-        self.assertNotIn(secret, output.getvalue())
-        self.assertFalse(self.root.exists())
-
-    def test_origins_must_be_canonical_and_https_unless_loopback(self):
-        for url in ("http://remote.example:8091", "https://user:synthetic-secret@core.example",
-                    "https://core.example/?token=synthetic-secret", "https://core_example"):
-            output = io.StringIO()
-            with self.subTest(url=url), contextlib.redirect_stderr(output), self.assertRaises(SystemExit):
-                install.arguments(["--public-url", url])
-            self.assertNotIn("synthetic-secret", output.getvalue())
-
-
-    def test_public_url_flag_is_made_canonical_for_core(self):
-        for origin, expected in (("HTTPS://Core.Example", "https://core.example"),
-                                 ("http://localhost:8080/", "http://localhost:8080"),
-                                 ("https://[2001:db8::1]", "https://[2001:db8::1]")):
-            with self.subTest(origin=origin):
-                self.assertEqual(install.arguments(["--public-url", origin]).public_url, expected)
-
-    def test_public_url_rule_matches_core(self):
-        # The same cases as Core's TestSandboxCoreURLValidation; config.json uses the same rule.
-        for origin in ("https://core.example", "https://core.example:8443", "http://localhost:8091",
-                       "http://127.0.0.2:8091", "http://[::1]:8091", "https://[2001:db8::1]"):
-            self.assertTrue(install.valid_core_origin(origin), origin)
-            self.assertTrue(config_model.CHECKS["origin"][0](origin), origin)
-        for origin in ("", "http://core.example", "http://core:8091", "http://host.localhost", "https://core.example/",
-                       "https://user:secret@core.example", "https://core.example/path", "https://core.example?",
-                       "https://core.example#x", "https://CORE.example", "https://core.example:", "https://core.example:0",
-                       "https://core.example:65536", "https://core.example:0080", "https://core.example:0443",
-                       "https://core.example\\evil", "https://[not-an-ip]", "https://-core.example", "https://core..example",
-                       "https://core_example", "https://core.example.", "https://b\u00fccher.example"):
-            self.assertFalse(install.valid_core_origin(origin), origin)
-            self.assertFalse(config_model.CHECKS["origin"][0](origin), origin)
-
-
-class ComposePrerequisiteTests(unittest.TestCase):
-    def test_compose_requires_the_literal_environment_parser(self):
-        for version in ("2.26.0", "v2.26.1", "2.40.0-desktop.1", "5.0.0"):
-            with self.subTest(version=version), mock.patch.object(install, "run", return_value=subprocess.CompletedProcess([], 0, version)):
-                install.check_compose()
-        for version in ("2.15.1", "2.25.9", "unknown"):
-            with self.subTest(version=version), mock.patch.object(install, "run", return_value=subprocess.CompletedProcess([], 0, version)):
-                with self.assertRaisesRegex(install.InstallError, "2.26.0"):
-                    install.check_compose()
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/deploy/install/test_install_output.py b/deploy/install/test_install_output.py
deleted file mode 100644
index 57b0ed802..000000000
--- a/deploy/install/test_install_output.py
+++ /dev/null
@@ -1,82 +0,0 @@
-"""Presentation remains readable in terminals, redirected logs and partial failure."""
-import contextlib
-import io
-import os
-import threading
-from pathlib import Path
-import unittest
-from unittest import mock
-
-import install_output as output
-import install_display as display
-
-
-class Terminal(io.StringIO):
-    def isatty(self):
-        return True
-
-
-class OutputTests(unittest.TestCase):
-    def test_busy_indicator_stops_after_failure_and_keeps_logs_plain(self):
-        for stream in (Terminal(), io.StringIO()):
-            wrote = threading.Event()
-            original = stream.write
-            def write(value):
-                result = original(value)
-                if "Loading" in value:
-                    wrote.set()
-                return result
-            with mock.patch.object(stream, "write", side_effect=write), \
-                    mock.patch.dict(os.environ, {"TERM": "xterm"}), contextlib.redirect_stderr(stream):
-                with self.assertRaises(RuntimeError):
-                    with display.busy("Loading"):
-                        if stream.isatty():
-                            self.assertTrue(wrote.wait(2))
-                        raise RuntimeError("stop")
-            if stream.isatty():
-                self.assertIn("Loading (", stream.getvalue())
-                self.assertTrue(stream.getvalue().endswith("\r\033[K"))
-            else:
-                self.assertEqual(stream.getvalue(), "")
-
-    def test_color_only_in_capable_terminals_and_no_color_wins(self):
-        for stream, environment, colored in ((Terminal(), {"TERM": "xterm"}, True),
-                                              (Terminal(), {"TERM": "dumb"}, False),
-                                              (Terminal(), {"TERM": "xterm", "NO_COLOR": ""}, False),
-                                              (io.StringIO(), {"TERM": "xterm"}, False)):
-            with self.subTest(environment=environment, colored=colored), \
-                    mock.patch.dict(os.environ, environment, clear=True), contextlib.redirect_stdout(stream):
-                display.step("Loading images")
-            self.assertEqual("\033[" in stream.getvalue(), colored)
-            self.assertIn("==> Loading images...", stream.getvalue())
-
-    def test_progress_is_flushed_before_returning_and_errors_use_stderr(self):
-        stream = io.StringIO()
-        with contextlib.redirect_stdout(stream), mock.patch.object(stream, "flush") as flush:
-            display.step("Checking services")
-            flush.assert_called_once()
-        error = io.StringIO()
-        with contextlib.redirect_stderr(error):
-            display.error("service did not become healthy")
-        self.assertEqual(error.getvalue(), "Installation failed: service did not become healthy\n")
-        self.assertNotIn("failed", stream.getvalue())
-
-    def test_summary_groups_details_and_keeps_commands_copyable(self):
-        stream = io.StringIO()
-        root = Path("/tmp/install with spaces")
-        config = {"mode": "all", "ports": {"core": 8091}}
-        with contextlib.redirect_stdout(stream):
-            output.summary(root, config, ["Console: http://localhost:8080 (local only)"],
-                           True, None, None, False, False)
-        text = stream.getvalue()
-        sections = ["\nInstallation complete.\n", "\nAccess\n", "\nSign in\n", "\nNext\n", "\nManage\n"]
-        positions = [text.index(section) for section in sections]
-        self.assertEqual(positions, sorted(positions))
-        self.assertIn("  Core key file: /tmp/install with spaces/secrets/core.key\n", text)
-        self.assertIn("  Apply settings: '/tmp/install with spaces/oac' apply\n", text)
-        self.assertIn("  Uninstall: '/tmp/install with spaces/oac' uninstall\n", text)
-        self.assertNotIn("\033[", text)
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/deploy/install/test_listeners.py b/deploy/install/test_listeners.py
deleted file mode 100644
index cab6ab70e..000000000
--- a/deploy/install/test_listeners.py
+++ /dev/null
@@ -1,201 +0,0 @@
-"""Installer listener selection and subsequent operator lifecycle behavior."""
-import contextlib
-import errno
-import io
-import ipaddress
-import json
-from pathlib import Path
-import socket
-import tempfile
-import unittest
-from unittest import mock
-
-import config_model
-import configuration
-import install
-import oac_cli
-from installer_fakes import MANIFEST, FakeHost, make_bundle, run_installer
-
-
-class ListenerTests(unittest.TestCase):
-    def setUp(self):
-        base = Path.home() / ".oac/tests/listeners"
-        base.mkdir(parents=True, exist_ok=True)
-        temporary = tempfile.TemporaryDirectory(dir=base)
-        self.addCleanup(temporary.cleanup)
-        self.work = Path(temporary.name)
-        self.root = self.work / "installation"
-        self.bundle, _ = make_bundle(self.work / "bundle", MANIFEST)
-        self.host = FakeHost(self)
-        self.host.native_root = self.root
-        self.output = io.StringIO()
-
-    def install(self, *flags):
-        with contextlib.redirect_stdout(self.output):
-            run_installer(install, self.bundle, ["--install-dir", self.root, "--ingress", "external", *flags])
-
-    def document(self, name):
-        return json.loads((self.root / name).read_text())
-
-    def test_custom_ipv4_listener_drives_services_and_operator_requests(self):
-        self.install("--host", "127.0.0.2", "--web-port", "18080", "--core-port", "18091")
-        config = self.document("config.json")
-        self.assertEqual(config["host"], "127.0.0.2")
-        self.assertEqual(config["ports"], {"core": 18091, "web": 18080})
-        self.assertNotIn("host", self.document("state.json"))
-        services = self.document("generated/compose.json")["services"]
-        self.assertEqual(services["core"]["ports"], ["127.0.0.2:18091:8091"])
-        self.assertEqual(services["web"]["ports"], ["127.0.0.2:18080:8080"])
-        self.assertEqual(services["web"]["environment"]["OAC_WEB_ORIGIN"], "http://127.0.0.2:18080")
-        self.assertNotIn("ports", services["database"])
-        self.host.requests.clear()
-        oac_cli.status(self.root, out=lambda _: None)
-        self.assertTrue(self.host.requests)
-        self.assertTrue(all(request.startswith("http://127.0.0.2:") for request in self.host.requests))
-        self.assertIn("Console: http://127.0.0.2:18080", self.output.getvalue())
-
-    def test_ipv6_listeners(self):
-        config = config_model.initial(host="::1")
-        state = dict(MANIFEST, uid=1000, gid=1000,
-                     images={name: "sha256:" + "a" * 64 for name in ("core", "web", "database")},
-                     project="oac-test", installation_id="fixture")
-        services = configuration.compose_config(self.root, config, state)["services"]
-        self.assertEqual(configuration.service_origin(config, "core"), "http://[::1]:8091")
-        self.assertEqual(configuration.core_environment(self.root, config, state)["OAC_ADDR"], ":8091")
-        self.assertEqual(services["core"]["ports"], ["[::1]:8091:8091"])
-        self.assertEqual(services["web"]["ports"], ["[::1]:8080:8080"])
-        self.assertEqual(services["web"]["environment"]["OAC_WEB_UPSTREAM"], "http://core:8091")
-
-    def test_wildcards_use_loopback_for_operator_connections(self):
-        for host, address in (("0.0.0.0", "127.0.0.1"), ("::", "[::1]")):
-            config = config_model.initial(host=host, public_url="https://core.example")
-            self.assertEqual(configuration.service_origin(config, "core"), f"http://{address}:8091")
-            self.assertEqual(configuration.web_origin(config), "https://core.example")
-
-    def test_apply_contacts_previous_host_before_switching_and_status_uses_applied_host(self):
-        self.install("--host", "127.0.0.2", "--public-url", "https://core.example")
-        config = self.document("config.json")
-        config["host"] = "127.0.0.3"
-        config["ports"]["web"] = 18080
-        (self.root / "config.json").write_text(json.dumps(config))
-        self.host.requests.clear()
-        oac_cli.status(self.root, out=lambda _: None)
-        self.assertTrue(all(request.startswith("http://127.0.0.2:") for request in self.host.requests))
-        self.host.requests.clear()
-        oac_cli.apply(self.root, interactive=False, out=lambda _: None)
-        urls = self.host.requests
-        old = "http://127.0.0.2:8091/core/v1/installation"
-        new = "http://127.0.0.3:8091/healthz"
-        self.assertIn(old, urls)
-        self.assertIn(new, urls)
-        self.assertLess(urls.index(old), urls.index(new))
-        self.assertEqual(self.document("generated/compose.json")["services"]["web"]["ports"], ["127.0.0.3:18080:8080"])
-        self.host.requests.clear()
-        oac_cli.status(self.root, out=lambda _: None)
-        self.assertTrue(all(request.startswith("http://127.0.0.3:") for request in self.host.requests))
-
-    def test_failed_apply_restores_the_previous_listener(self):
-        self.install("--host", "127.0.0.2", "--public-url", "https://core.example")
-        config = self.document("config.json")
-        config["host"] = "127.0.0.3"
-        (self.root / "config.json").write_text(json.dumps(config))
-        original = oac_cli.health
-        def health(root, applied, expected):
-            if applied["host"] == "127.0.0.3":
-                raise oac_cli.OacError("Listener unavailable")
-            return original(root, applied, expected)
-        with mock.patch.object(oac_cli, "health", side_effect=health), self.assertRaisesRegex(oac_cli.OacError, "previous generated files were restored"):
-            oac_cli.apply(self.root, interactive=False, out=lambda _: None)
-        self.assertEqual(self.document("generated/compose.json")["services"]["core"]["ports"], ["127.0.0.2:8091:8091"])
-        self.host.requests.clear()
-        oac_cli.status(self.root, out=lambda _: None)
-        self.assertTrue(all(url.startswith("http://127.0.0.2:") for url in self.host.requests))
-
-    def test_invalid_listener_and_port_fail_before_creating_installation(self):
-        for flags in (("--host", "localhost"), ("--host", "https://core.example"),
-                      ("--host", "[::1]:8080"), ("--host", "fe80::1%eth0"),
-                      ("--host", "0.0.0.0"), ("--web-port", "65536"), ("--core-port", "8080")):
-            with self.subTest(flags=flags), self.assertRaises(config_model.ConfigError):
-                self.install(*flags)
-            self.assertFalse((self.root / "config.json").exists())
-            self.assertFalse(self.host.running())
-        with contextlib.redirect_stderr(io.StringIO()), self.assertRaises(SystemExit):
-            install.arguments(["--port", "8088"])
-
-    def test_config_seed_rejects_listener_overrides(self):
-        path = self.work / "seed.json"
-        path.write_text(json.dumps(config_model.initial()))
-        for flags in (("--host", "127.0.0.2"), ("--web-port", "8088")):
-            with self.assertRaisesRegex(install.InstallError, "--config replaces"):
-                self.install("--config", path, *flags)
-
-    def test_apply_checks_a_new_listener_before_changing_anything(self):
-        self.install("--host", "127.0.0.2", "--public-url", "https://core.example")
-        self.edit(lambda config: config["ports"].update(web=18080))
-        # The installation's own services listen on 8080 and 8091; another program holds 18080.
-        self.host.busy.update({("127.0.0.2", 8080), ("127.0.0.2", 8091), ("127.0.0.2", 18080)})
-        self.assert_refused(r"^Port 18080 \(ports.web\) is already in use on 127.0.0.2. Nothing was applied. Free it or "
-                            r"choose another port; find the process with: sudo ss -ltnp 'sport = :18080'$")
-
-    def test_apply_checks_a_changed_host(self):
-        self.install("--host", "127.0.0.2", "--public-url", "https://core.example")
-        self.host.busy.update({("127.0.0.2", 8080), ("127.0.0.2", 8091), ("127.0.0.3", 8080)})
-        self.host.unassigned.add("192.0.2.10")
-        for host, message in (("192.0.2.10", r"^192.0.2.10 \(host\) is not an address of this machine; use one of its "
-                                             r"addresses. Nothing was applied.$"),
-                              # Another program holds the port on the new address, or on part of the wildcard.
-                              ("127.0.0.3", r"^Port 8080 \(ports.web\) is already in use on 127.0.0.3. Nothing was applied."),
-                              ("0.0.0.0", r"^Port 8080 \(ports.web\) is already in use on 0.0.0.0. Nothing was applied.")):
-            with self.subTest(host=host):
-                self.edit(lambda config: config.update(host=host))
-                self.assert_refused(message)
-        # The installation's own listeners on the old address do not count.
-        self.host.busy.discard(("127.0.0.3", 8080))
-        oac_cli.apply(self.root, interactive=False, out=lambda _: None)
-        self.assertEqual(self.document("generated/compose.json")["services"]["web"]["ports"], ["0.0.0.0:8080:8080"])
-
-    def edit(self, change):
-        config = self.document("config.json")
-        change(config)
-        (self.root / "config.json").write_text(json.dumps(config))
-
-    def assert_refused(self, message):
-        generated = {path.name: path.read_bytes() for path in (self.root / "generated").iterdir()}
-        containers = json.dumps(self.host.containers, sort_keys=True)
-        self.host.recreated.clear()
-        with self.assertRaisesRegex(oac_cli.OacError, message):
-            oac_cli.apply(self.root, interactive=False, out=lambda _: None)
-        self.assertEqual(generated, {path.name: path.read_bytes() for path in (self.root / "generated").iterdir()})
-        self.assertEqual((containers, self.host.recreated), (json.dumps(self.host.containers, sort_keys=True), []))
-
-
-class PortProbeTests(unittest.TestCase):
-    def test_probe_binds_like_the_services_and_reads_privileged_ports_from_the_kernel(self):
-        with socket.socket() as listener:
-            listener.bind(("127.0.0.2", 0))
-            listener.listen()
-            port = listener.getsockname()[1]
-            self.assertIn((ipaddress.ip_address("127.0.0.2"), port), set(oac_cli.tcp_listeners()))
-            self.assertFalse(oac_cli.port_free("127.0.0.2", port))
-            self.assertFalse(oac_cli.port_free("0.0.0.0", port))
-            self.assertTrue(oac_cli.port_free("127.0.0.1", port))
-            # The installation's own listener does not count.
-            self.assertTrue(oac_cli.port_free("0.0.0.0", port, {(ipaddress.ip_address("127.0.0.2"), port)}))
-            # An account that may not bind the port reads the listening sockets instead.
-            with mock.patch.object(socket.socket, "bind", side_effect=OSError(errno.EACCES, "Permission denied")):
-                self.assertFalse(oac_cli.port_free("0.0.0.0", port))
-                self.assertTrue(oac_cli.port_free("127.0.0.1", port))
-        # A connection in TIME_WAIT on a Go or Docker listener, which set SO_REUSEADDR, does not hold the port.
-        with socket.socket() as listener:
-            listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-            listener.bind(("127.0.0.1", 0))
-            listener.listen()
-            port = listener.getsockname()[1]
-            with socket.create_connection(("127.0.0.1", port)):
-                accepted, _ = listener.accept()
-                accepted.close()
-        self.assertTrue(oac_cli.port_free("127.0.0.1", port))
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/deploy/install/test_native_installers.py b/deploy/install/test_native_installers.py
deleted file mode 100644
index ca1c4237f..000000000
--- a/deploy/install/test_native_installers.py
+++ /dev/null
@@ -1,49 +0,0 @@
-"""Online/offline catalog retention shared by container and native Core."""
-import json
-from pathlib import Path
-import tempfile
-import unittest
-
-import native_installers
-from distribution import digest
-
-
-class NativeInstallersTests(unittest.TestCase):
-    def test_online_install_offline_addition_and_repair_preserve_verified_content(self):
-        with tempfile.TemporaryDirectory() as temporary:
-            base = Path(temporary)
-            root, bundle = base / "root", base / "bundle"
-            root.mkdir()
-            source = bundle / "native-installers"
-            source.mkdir(parents=True)
-            archive = source / "linux-amd64.tar.gz"
-            archive.write_bytes(b"qualified")
-            payload_hash = digest(archive)
-            archive.unlink()
-            catalog = {"version": "a" * 40, "artifacts": {"linux-amd64": {"sha256": payload_hash}}}
-            (source / "catalog.json").write_text(json.dumps(catalog))
-            state = {"mode": "core-only", "source_commit": "a" * 40}
-            native_installers.prepare(root, state, bundle)
-            self.assertEqual([p.name for p in (root / "native-installers").iterdir()], ["catalog.json"])
-            archive.write_bytes(b"qualified")
-            native_installers.prepare(root, state, bundle)
-            installed = root / "native-installers/linux-amd64.tar.gz"
-            self.assertEqual(installed.read_bytes(), b"qualified")
-            self.assertEqual(installed.stat().st_mode & 0o777, 0o600)
-            archive.unlink()
-            native_installers.prepare(root, state, bundle)
-            self.assertEqual(installed.read_bytes(), b"qualified")
-            installed.write_bytes(b"corrupt")
-            with self.assertRaisesRegex(RuntimeError, "files differ"):
-                native_installers.prepare(root, state, bundle)
-            self.assertEqual(installed.read_bytes(), b"corrupt")
-
-    def test_foreign_catalog_refuses_writes(self):
-        with tempfile.TemporaryDirectory() as temporary:
-            base = Path(temporary)
-            source = base / "bundle/native-installers"
-            source.mkdir(parents=True)
-            (source / "catalog.json").write_text(json.dumps({"version": "foreign", "artifacts": {}}))
-            with self.assertRaisesRegex(RuntimeError, "does not match"):
-                native_installers.prepare(base / "root", {"mode": "all", "source_commit": "a" * 40}, base / "bundle")
-            self.assertFalse((base / "root").exists())
diff --git a/deploy/install/test_oac.py b/deploy/install/test_oac.py
deleted file mode 100644
index ef2eade1f..000000000
--- a/deploy/install/test_oac.py
+++ /dev/null
@@ -1,446 +0,0 @@
-"""Acceptance behavior of the oac command against a fake Docker/systemd host."""
-import hashlib
-import http.client
-import json
-from pathlib import Path
-import stat
-import subprocess
-import tempfile
-import unittest
-from unittest import mock
-
-import config_model
-import install
-import oac_cli
-from installer_fakes import FakeHost
-
-IMAGES = {name: "sha256:" + digit * 64 for name, digit in (("core", "1"), ("database", "3"), ("web", "4"))}
-
-
-def interrupt(target, name, when=lambda *args, **kwargs: True):
-    """Raise KeyboardInterrupt once, at the first call that matches."""
-    original, fired = getattr(target, name), []
-
-    def wrapper(*args, **kwargs):
-        if not fired and when(*args, **kwargs):
-            fired.append(True)
-            raise KeyboardInterrupt
-        return original(*args, **kwargs)
-    return mock.patch.object(target, name, wrapper)
-
-
-def compose_up(*services):
-    def when(root, *args, **kwargs):
-        named = [item for item in args[1:] if not item.startswith("-") and not item.isdigit()]
-        return args[:1] == ("up",) and named == list(services)
-    return when
-
-
-class OacTests(unittest.TestCase):
-    def setUp(self):
-        base = Path.home() / ".oac/tests/oac"
-        base.mkdir(parents=True, exist_ok=True)
-        temporary = tempfile.TemporaryDirectory(dir=base)
-        self.addCleanup(temporary.cleanup)
-        self.work = Path(temporary.name).resolve()
-        self.root = self.work / "core"
-        self.host = FakeHost(self)
-        self.host.native_root = self.root
-        self.output = []
-        # Each stamp is a new second, so nothing depends on finishing within one.
-        clock = iter(range(10 ** 6))
-        patcher = mock.patch.object(oac_cli, "now", side_effect=lambda: f"2026-09-25T10:{next(clock):06d}Z")
-        patcher.start()
-        self.addCleanup(patcher.stop)
-
-    def test_default_parent_is_private_and_symlinks_are_refused(self):
-        home = self.work / "home"
-        home.mkdir()
-        parent = home / ".oac"
-        parent.mkdir(mode=0o755)
-        with mock.patch.object(Path, "home", return_value=home):
-            oac_cli.private_parent(parent / "core")
-            self.assertEqual(stat.S_IMODE(parent.stat().st_mode), 0o700)
-            linked = home / "linked"
-            linked.symlink_to(parent, target_is_directory=True)
-            with self.assertRaisesRegex(oac_cli.OacError, "canonical"):
-                oac_cli.private_parent(linked / "core")
-            self.assertFalse((parent / "core").exists())
-
-    def test_foreign_operator_refuses_all_mutations_before_lock_creation(self):
-        self.install()
-        (self.root / ".oac.lock").unlink()
-        before = {str(p.relative_to(self.root)): p.read_bytes() for p in self.root.rglob("*") if p.is_file()}
-        with mock.patch.object(oac_cli, "SOURCE_COMMIT", "b" * 40):
-            for operation in (oac_cli.start, oac_cli.stop, oac_cli.apply, oac_cli.rotate_core_key):
-                with self.subTest(operation=operation.__name__), self.assertRaisesRegex(oac_cli.OacError, "not supported;.*reinstall"):
-                    operation(self.root)
-        self.assertEqual(before, {str(p.relative_to(self.root)): p.read_bytes() for p in self.root.rglob("*") if p.is_file()})
-
-    def install(self, **values):
-        config = config_model.initial(**values)
-        images = {name: IMAGES[name] for name in install.image_names()}
-        install.create(self.root, config, {"source_commit": "a" * 40}, images)
-        # These tests use finished installations; the installer records that after the first start.
-        oac_cli.save_state(self.root, dict(oac_cli.load_state(self.root), complete=True))
-        self.apply(start=True)
-        self.host.recreated.clear()
-        self.output.clear()
-
-    def apply(self, **options):
-        options.setdefault("interactive", False)
-        return oac_cli.apply(self.root, out=self.output.append, **options)
-
-    def edit(self, change):
-        path = self.root / "config.json"
-        config = json.loads(path.read_text())
-        change(config)
-        path.write_text(json.dumps(config, indent=2))
-
-    def generated(self, name):
-        return (self.root / "generated" / name).read_text()
-
-    def environment(self):
-        return dict(line.split("=", 1) for line in self.generated("core.env").splitlines() if not line.startswith("#"))
-
-    def status(self):
-        self.output.clear()
-        try:
-            oac_cli.status(self.root, out=self.output.append)
-        except oac_cli.OacError as error:
-            self.output.append(str(error))
-        return self.output
-
-    def assertConverged(self):
-        state, config = oac_cli.load_state(self.root), oac_cli.load_config(self.root)
-        rendered, disk, _ = oac_cli.render_now(self.root, config, state)
-        actual = oac_cli.observe(state)
-        for name, digest in rendered.services.items():
-            if name != "migrate":
-                self.assertEqual((actual[name]["running"], actual[name]["inputs"]), (True, digest), name)
-        for name, text in rendered.files.items():
-            self.assertEqual(oac_cli.comparable(name, disk[name]), oac_cli.comparable(name, text), name)
-        key = (self.root / "secrets/core.key").read_text()
-        url = f'http://127.0.0.1:{config["ports"]["core"]}/core/v1/installation'
-        self.assertEqual(self.host.http(url, oac_cli.bearer(key))[0], 200)
-        for line in self.status():
-            self.assertNotRegex(line, "edited by hand|other inputs|not applied|rejects|unavailable")
-
-    def test_apply_changes_a_port_and_the_log_level_and_recreates_only_affected_services(self):
-        self.install()
-        self.edit(lambda config: config["ports"].update(web=18080))
-        self.apply(dry_run=True)
-        self.assertEqual(self.host.recreated, [])
-        self.assertIn("Services to restart: web. Every Web sign-in session ends.", self.output)
-        self.apply()
-        self.assertEqual(self.host.recreated, ["web"])
-        self.assertEqual(self.host.web_port, 18080)
-        self.host.recreated.clear()
-        self.edit(lambda config: config["log"].update(level="debug"))
-        self.apply()
-        self.assertEqual(sorted(self.host.recreated), ["core", "migrate", "web"])
-        self.assertEqual(self.environment()["OAC_LOG_LEVEL"], '"debug"')
-        self.output.clear()
-        self.apply()
-        self.assertIn("Nothing to apply.", self.output)
-        self.assertConverged()
-
-    def test_a_stopped_installation_stays_stopped(self):
-        self.install()
-        oac_cli.stop(self.root, out=self.output.append)
-        self.edit(lambda config: config["ports"].update(web=18080))
-        self.apply()
-        self.assertEqual((self.host.recreated, self.host.running()), ([], set()))
-        self.assertIn("The installation is stopped; it stays stopped and starts with these files.", self.output)
-        oac_cli.start(self.root, out=self.output.append)
-        self.assertEqual(self.host.recreated, ["web"])
-        self.assertEqual(self.host.web_port, 18080)
-        # While any service runs, apply starts the others too.
-        self.host.containers["web"]["running"] = False
-        self.apply()
-        self.assertConverged()
-
-    def test_hand_edits_are_refused_until_discarded_and_missing_files_are_rewritten(self):
-        self.install()
-        path = self.root / "generated/core.env"
-        edited = path.read_text() + 'OAC_EXECUTION_CONCURRENCY="9"\n'
-        path.write_text(edited)
-        with self.assertRaisesRegex(oac_cli.OacError, "generated/core.env was edited by hand"):
-            self.apply()
-        self.assertEqual(path.read_text(), edited)
-        self.assertIn("generated/core.env was edited by hand; put the change in config.json and run oac apply "
-                      "--discard-edits", self.status())
-        self.apply(discard_edits=True)
-        self.assertNotIn('"9"', path.read_text())
-        [copy] = self.root.glob("generated/core.env.edited-*")
-        self.assertEqual((copy.read_text(), stat.S_IMODE(copy.stat().st_mode)), (edited, 0o600))
-        (self.root / "generated/compose.json").unlink()
-        (self.root / "generated/settings.json").unlink()
-        self.apply()
-        self.assertConverged()
-
-    def test_secrets_fixed_fields_and_directories_are_checked(self):
-        self.install()
-        self.edit(lambda config: config.update(ingress="managed", host="0.0.0.0"))
-        with self.assertRaisesRegex(oac_cli.OacError, "ingress is fixed"):
-            self.apply()
-        self.edit(lambda config: config.update(ingress="external", host="127.0.0.1"))
-        (self.root / "generated").chmod(0o755)
-        with self.assertRaisesRegex(oac_cli.OacError, "generated/ must be a directory with mode 0700"):
-            self.apply()
-        (self.root / "generated").chmod(0o700)
-        (self.root / "secrets").rename(self.work / "secrets")
-        (self.root / "secrets").symlink_to(self.work / "secrets")
-        with self.assertRaisesRegex(oac_cli.OacError, "secrets/ must be a directory"):
-            self.apply()
-        (self.root / "secrets").unlink()
-        (self.work / "secrets").rename(self.root / "secrets")
-        (self.root / "secrets/credential.key").write_text("replaced")
-        with self.assertRaisesRegex(oac_cli.OacError, "credential.key changed"):
-            self.apply()
-
-    def test_rotate_core_key(self):
-        self.install()
-        old = (self.root / "secrets/core.key").read_text()
-        (self.root / "secrets/core.key.new").write_text("left by an interrupted rotation")
-        oac_cli.rotate_core_key(self.root, yes=True, out=self.output.append)
-        new = (self.root / "secrets/core.key").read_text()
-        self.assertNotEqual(new, old)
-        self.assertFalse((self.root / "secrets/core.key.new").exists())
-        self.assertEqual(stat.S_IMODE((self.root / "secrets/core.key").stat().st_mode), 0o600)
-        self.assertEqual(json.loads(self.generated("core-key-digests.json")), [hashlib.sha256(new.encode()).hexdigest()])
-        self.assertLess(self.host.recreated.index("core"), self.host.recreated.index("web"))
-        url = "http://127.0.0.1:8091/core/v1/installation"
-        self.assertEqual(self.host.http(url, oac_cli.bearer(old))[0], 401)
-        self.assertConverged()
-
-    def test_public_url_change_lists_bindings_and_requires_confirmation(self):
-        self.install(public_url="https://core.example")
-        self.host.bindings.update(nodes=2, hosted_sandboxes=2)
-        self.host.nodes = [{"name": "node-a", "online": True, "core_url": "https://core.example"},
-                           {"name": "node-b", "online": True, "core_url": "https://older.example"}]
-        self.edit(lambda config: config.update(public_url="https://new.example"))
-        before = self.generated("core.env")
-        with self.assertRaisesRegex(oac_cli.OacError, "--confirm-public-url-change https://new.example"):
-            self.apply()
-        self.assertIn("  node node-a: online", self.output)
-        self.assertNotIn("  node node-b: online", self.output)
-        with self.assertRaisesRegex(oac_cli.OacError, "must equal the new public URL"):
-            self.apply(confirm_public_url_change="https://other.example")
-        self.assertEqual(self.generated("core.env"), before)
-        self.apply(confirm_public_url_change="https://new.example")
-        self.assertEqual(self.environment()["OAC_PUBLIC_URL"], '"https://new.example"')
-        # The count comes from Core's bindings, so a failed node list read still needs confirmation.
-        self.host.bindings.update(nodes=1, nodes_on_other_address=0, hosted_sandboxes=0)
-        self.edit(lambda config: config.update(public_url="https://fourth.example"))
-        http = self.host.http
-        with mock.patch.object(oac_cli, "http", side_effect=lambda url, *a, **k: (
-                (500, b"") if url.endswith("/core/v1/sandbox/nodes") else http(url, *a, **k))), \
-                self.assertRaisesRegex(oac_cli.OacError, "--confirm-public-url-change https://fourth.example"):
-            self.apply()
-        self.assertIn("Bound to the current address: 1 node(s), 0 hosted sandbox(es), 0 self-hosted executor credential(s).",
-                      self.output)
-        self.edit(lambda config: config.update(public_url="https://new.example"))
-        # With Core stopped and core.env gone, the address in use is unknown: confirmation is needed.
-        oac_cli.stop(self.root, out=self.output.append)
-        (self.root / "generated/core.env").unlink()
-        self.edit(lambda config: config.update(public_url="https://third.example"))
-        with self.assertRaisesRegex(oac_cli.OacError, "--confirm-public-url-change https://third.example"):
-            self.apply()
-        self.apply(confirm_public_url_change="https://third.example")
-
-    def test_core_startup_failure_rolls_back_only_from_a_converged_start(self):
-        self.install()
-        before = {name: self.generated(name) for name in ("core.env", "compose.json")}
-        self.edit(lambda config: config["core"].update(execution_concurrency=8))
-        self.host.core["fails"] = True
-        self.host.core["log"] = 'noise\nlevel=ERROR msg="oac-core startup failed" error="synthetic rejection"\n'
-        with self.assertRaisesRegex(oac_cli.OacError, "previous generated files were restored"):
-            self.apply()
-        self.assertEqual({name: self.generated(name) for name in before}, before)
-        self.assertIn('level=ERROR msg="oac-core startup failed" error="synthetic rejection"', self.output)
-        # Core is down now, so the next failure has nothing converged to roll back to.
-        with self.assertRaisesRegex(oac_cli.OacError, "nothing was rolled back"):
-            self.apply()
-        self.host.core["fails"] = False
-        self.apply()
-        self.assertConverged()
-
-    def test_repeated_rolled_back_applies_leave_no_false_edit(self):
-        self.install()
-        self.host.core["rejects"] = lambda environment: 'OAC_EXECUTION_CONCURRENCY="4"' not in environment
-        for value in (5, 6, 7, 8):
-            self.edit(lambda config: config["core"].update(execution_concurrency=value))
-            with self.assertRaisesRegex(oac_cli.OacError, "services converged on them"):
-                self.apply()
-        self.host.core["rejects"] = lambda environment: False
-        self.edit(lambda config: config["core"].update(execution_concurrency=4))
-        self.apply()
-        self.assertConverged()
-
-    def test_a_hand_edit_restored_by_a_rollback_is_still_reported(self):
-        self.install()
-        path = self.root / "generated/core.env"
-        path.write_text(path.read_text() + "# hand edit\n")
-        self.host.core["rejects"] = lambda environment: 'OAC_EXECUTION_CONCURRENCY="5"' in environment
-        self.edit(lambda config: config["core"].update(execution_concurrency=5))
-        with self.assertRaisesRegex(oac_cli.OacError, "services converged on them"):
-            self.apply(discard_edits=True)
-        self.assertIn("# hand edit", path.read_text())
-        self.assertIn("generated/core.env was edited by hand; put the change in config.json and run oac apply "
-                      "--discard-edits", self.status())
-
-    def test_the_next_apply_finishes_any_interrupted_apply_rotation_or_rollback(self):
-        compose_stages = {
-            "before any file": (oac_cli, "save_state", lambda *a: True),
-            "between files": (oac_cli, "write_private",
-                              lambda path, data: path.name in ("core.env", "core-key-digests.json")),
-            "before converging": (oac_cli, "converge", lambda *a, **k: True),
-            "after Core": (oac_cli, "compose", compose_up()),
-            "before health": (oac_cli, "health", lambda *a: True),
-        }
-        for stage, (target, name, when) in compose_stages.items():
-            for operation in ("apply", "rotate", "rollback"):
-                with self.subTest(stage=stage, operation=operation):
-                    self.root = self.work / f"{stage}-{operation}".replace(" ", "-")
-                    self.host.containers = {}
-                    self.install()
-                    if operation == "rotate":
-                        action = lambda: oac_cli.rotate_core_key(self.root, yes=True, out=self.output.append)
-                    else:
-                        self.edit(lambda config: (config["log"].update(level="debug"),
-                                                  config["ports"].update(web=18080)))
-                        action = self.apply
-                    self.host.core.update(fails=operation == "rollback", failed=False)
-                    # A rollback is interrupted in what it does after Core failed.
-                    trigger = (lambda *a, when=when, **k: self.host.core["failed"] and when(*a, **k)) \
-                        if operation == "rollback" else when
-                    with interrupt(target, name, trigger), \
-                            self.assertRaises((KeyboardInterrupt, oac_cli.OacError)) as raised:
-                        action()
-                    self.assertNotIn(": .", str(raised.exception))
-                    self.host.core.update(fails=False, failed=False)
-                    self.apply()
-                    self.assertConverged()
-
-    def test_uninstall_removes_the_services_volumes_unused_images_and_directory(self):
-        self.install()
-        project = oac_cli.load_state(self.root)["project"]
-        self.host.other_containers[IMAGES["database"]] = ["id-of-another-installation"]
-        self.host.deployment.update(provider="e2b", resources={"allocations": 2, "pending": 0})
-        oac_cli.main(["uninstall", "--yes"], root=self.root, out=self.output.append)
-        self.assertTrue(any(line.startswith("Core has 2 sandbox(es) in use. Uninstall does not stop them: E2B keeps "
-                                            "running them, and billing for them.") for line in self.output))
-        self.assertIn(["docker", "compose", "-p", project, "down", "--volumes", "--remove-orphans"], self.host.commands)
-        self.assertEqual(self.host.containers, {})
-        self.assertEqual(self.host.missing_images, {IMAGES["core"], IMAGES["web"]})
-        self.assertIn(f'Kept the database image {IMAGES["database"]}: another container uses it.', self.output)
-        self.assertFalse(self.root.exists())
-
-    def test_uninstall_changes_nothing_unless_confirmed(self):
-        self.install()
-        before = {str(p.relative_to(self.root)): p.read_bytes() for p in self.root.rglob("*") if p.is_file()}
-        with self.assertRaisesRegex(oac_cli.OacError, "--yes"):
-            oac_cli.uninstall(self.root, interactive=False, out=self.output.append)
-        with mock.patch("builtins.input", return_value=str(self.work)), \
-                self.assertRaisesRegex(oac_cli.OacError, "not confirmed; nothing was removed"):
-            oac_cli.uninstall(self.root, interactive=True, out=self.output.append)
-        self.assertEqual(before, {str(p.relative_to(self.root)): p.read_bytes() for p in self.root.rglob("*") if p.is_file()})
-        self.assertEqual(self.host.running(), {"database", "core", "web"})
-        self.assertFalse(any("down" in command or "rm" in command for command in self.host.commands))
-
-    def test_uninstall_removes_an_installation_that_never_finished(self):
-        install.create(self.root, config_model.initial(),
-                       {"source_commit": "a" * 40}, IMAGES)
-        (self.root / "config.json").unlink()
-        installation = oac_cli.load_state(self.root)["installation_id"]
-        # create() marks it incomplete, which other mutating commands refuse.
-        with self.assertRaisesRegex(oac_cli.OacError, "or remove it with oac uninstall"):
-            oac_cli.start(self.root, out=self.output.append)
-        oac_cli.uninstall(self.root, yes=True, out=self.output.append)
-        self.assertFalse(self.root.exists())
-        self.assertIn("Core did not answer, so its nodes and sandboxes can't be listed. Nodes stay on their hosts.",
-                      self.output)
-        self.assertIn(f"  sudo python3 node-install.pyz --uninstall --installation-id {installation} --force", self.output)
-
-    def test_a_rerun_finishes_an_interrupted_uninstall(self):
-        self.install()
-        (self.root / "oac").write_text("the installed command")
-        with interrupt(oac_cli.shutil, "rmtree"), self.assertRaisesRegex(oac_cli.OacError, "Removal did not finish"):
-            oac_cli.uninstall(self.root, yes=True, out=self.output.append)
-        self.assertEqual(self.host.containers, {})
-        self.assertTrue((self.root / "state.json").exists() and (self.root / "oac").exists())
-        oac_cli.uninstall(self.root, yes=True, out=self.output.append)
-        self.assertFalse(self.root.exists())
-        # Once state.json is gone, a rerun only says so.
-        self.root.mkdir()
-        (self.root / "oac").write_text("the installed command")
-        oac_cli.uninstall(self.root, yes=True, out=self.output.append)
-        self.assertIn(f"No installation is left in {self.root}: it has no state.json. Nothing was removed.", self.output)
-        self.assertEqual([path.name for path in self.root.iterdir()], ["oac"])
-
-    def test_uninstall_lists_registered_nodes_and_how_to_uninstall_them(self):
-        self.install()
-        self.host.nodes = [{"name": "node-a", "online": True}, {"name": "node-b", "online": False}]
-        installation = oac_cli.load_state(self.root)["installation_id"]
-        oac_cli.uninstall(self.root, yes=True, out=self.output.append)
-        listed = self.output.index("Nodes registered with this Core, which stay on their hosts: node-a (online), node-b (offline)")
-        self.assertLess(listed, self.output.index(f"Removed the installation in {self.root}."))
-        self.assertIn(f"  sudo python3 node-install.pyz --uninstall --installation-id {installation} --force", self.output)
-
-    def test_uninstall_preserves_state_when_docker_cannot_inspect_images(self):
-        self.install()
-        original = oac_cli.run
-        for daemon_unavailable in (False, True):
-            def fail_inspection(args, **kwargs):
-                if args[:3] == ["docker", "image", "inspect"]:
-                    return subprocess.CompletedProcess(args, 1, stdout="")
-                if daemon_unavailable and args[:3] == ["docker", "image", "ls"]:
-                    raise subprocess.CalledProcessError(1, args)
-                return original(args, **kwargs)
-
-            with self.subTest(daemon_unavailable=daemon_unavailable), \
-                    mock.patch.object(oac_cli, "run", side_effect=fail_inspection), \
-                    self.assertRaisesRegex(oac_cli.OacError, "the images of this installation"):
-                oac_cli.uninstall(self.root, yes=True, out=self.output.append)
-            self.assertTrue((self.root / "state.json").is_file())
-            self.assertEqual(self.host.missing_images, set())
-        self.host.missing_images.add(IMAGES["core"])
-        oac_cli.uninstall(self.root, yes=True, out=self.output.append)
-        self.assertFalse(self.root.exists())
-        self.assertEqual(self.host.missing_images, set(IMAGES.values()))
-
-    def test_uninstall_completes_when_core_returns_a_truncated_response(self):
-        self.install()
-        with mock.patch.object(oac_cli, "http", side_effect=http.client.IncompleteRead(b"{")):
-            oac_cli.uninstall(self.root, yes=True, out=self.output.append)
-        self.assertFalse(self.root.exists())
-        self.assertIn("Core did not answer, so its nodes and sandboxes can't be listed. Nodes stay on their hosts.",
-                      self.output)
-        self.assertTrue(any("node-install.pyz --uninstall" in line and "--force" in line for line in self.output))
-
-    def test_uninstall_does_not_probe_core_through_private_file_or_directory_links(self):
-        self.install()
-        for name in ("secrets/core.key", "generated", "secrets"):
-            path = self.root / name
-            outside = self.work / path.name
-            path.rename(outside)
-            path.symlink_to(outside, target_is_directory=outside.is_dir())
-            with self.subTest(path=name), mock.patch.object(oac_cli, "http") as request, \
-                    self.assertRaisesRegex(oac_cli.OacError, "--yes"):
-                oac_cli.uninstall(self.root, interactive=False, out=self.output.append)
-            request.assert_not_called()
-            path.unlink()
-            outside.rename(path)
-        # An unsafe probe does not prevent removing the installation's own files.
-        path.rename(outside)
-        path.symlink_to(outside, target_is_directory=True)
-        with mock.patch.object(oac_cli, "http") as request:
-            oac_cli.uninstall(self.root, yes=True, out=self.output.append)
-        request.assert_not_called()
-        self.assertFalse(self.root.exists())
-        self.assertTrue((outside / "core.key").is_file())
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/deploy/install/test_sandbox_setup.py b/deploy/install/test_sandbox_setup.py
deleted file mode 100644
index 105dd05b6..000000000
--- a/deploy/install/test_sandbox_setup.py
+++ /dev/null
@@ -1,74 +0,0 @@
-"""sandbox_setup: Core's existing selection wins, and E2B template builds follow Core's rule."""
-import json
-from pathlib import Path
-import tempfile
-import unittest
-from unittest import mock
-
-import sandbox_setup
-import config_model
-
-INSTALLATION = "94be54a1-138c-4f30-bc87-b13686272dbe"
-
-
-class SandboxSetupTests(unittest.TestCase):
-    def test_shared_e2b_selectors(self):
-        fixture = Path(__file__).resolve().parents[2] / "services/core/internal/sandbox/e2b/testdata/configuration-selectors.json"
-        cases = json.loads(fixture.read_text())
-        for case in cases["endpoints"]:
-            with self.subTest(endpoint=case["name"]):
-                self.assertEqual(sandbox_setup.e2b_endpoint(case["api_url"], case["domain"]), case["valid"])
-        for case in cases["templates"]:
-            with self.subTest(template=case["name"]):
-                self.assertEqual(sandbox_setup.e2b_template(case["value"]), case["valid"])
-
-    def setUp(self):
-        base = Path.home() / ".oac/tests/sandbox-setup"
-        base.mkdir(parents=True, exist_ok=True)
-        temporary = tempfile.TemporaryDirectory(dir=base)
-        self.addCleanup(temporary.cleanup)
-        self.root = Path(temporary.name)
-        (self.root / "secrets").mkdir()
-        (self.root / "secrets/core.key").write_text("fixture-core-key\n")
-        self.config, self.state = config_model.initial(), {"installation_id": INSTALLATION}
-
-    def initialize(self, current, selection):
-        requests = []
-
-        def send(req):
-            requests.append((req.get_method(), req.full_url, req.get_header("Authorization")))
-            return 200, json.dumps(current).encode()
-        with mock.patch.object(sandbox_setup, "send", side_effect=send):
-            result = sandbox_setup.initialize(self.root, self.config, self.state, selection)
-        return result, requests
-
-    def test_an_existing_selection_is_kept_or_reported(self):
-        docker = {"provider": "docker", "resources": {"cpus": 2, "memory_mib": 2048}, "runtime": {}}
-        current = {"installation_id": INSTALLATION, "provider": "docker"}
-        self.assertEqual(self.initialize(current, docker), (current, [
-            ("GET", "http://127.0.0.1:8091/core/v1/sandbox/deployment", "Bearer fixture-core-key")]))
-        with self.assertRaisesRegex(sandbox_setup.SandboxSetupError, "already uses microsandbox"):
-            self.initialize(dict(current, provider="microsandbox"), docker)
-        with self.assertRaisesRegex(sandbox_setup.SandboxSetupError, "different installation"):
-            self.initialize(dict(current, installation_id="other", provider=""), docker)
-
-    def test_initialization_uses_observed_generation_once(self):
-        for generation in (0, 8):
-            with self.subTest(generation=generation):
-                current = {"installation_id": INSTALLATION, "provider": "", "generation": generation, "reset": None}
-                selection = {"provider": "docker", "resources": {"cpus": 2, "memory_mib": 2048}, "runtime": {}}
-                writes = []
-                def send(req):
-                    if req.get_method() == "POST":
-                        writes.append(json.loads(req.data))
-                        return 409, b'{"error":{"code":"generation_stale","message":"Deployment generation changed"}}'
-                    return 200, json.dumps(current).encode()
-                with mock.patch.object(sandbox_setup, "send", side_effect=send), self.assertRaises(sandbox_setup.SandboxSetupError):
-                    sandbox_setup.initialize(self.root, self.config, self.state, selection)
-                self.assertEqual(writes, [dict(selection, expected_generation=generation)])
-                self.assertNotIn("expected_generation", selection)
-
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/deploy/node/README.md b/deploy/node/README.md
new file mode 100644
index 000000000..0cd68fb95
--- /dev/null
+++ b/deploy/node/README.md
@@ -0,0 +1,45 @@
+# Node installer
+
+These modules are packaged as `node-install.pyz`, which Web serves at `/node-install/`. They install a sandbox node on a Linux host that runs sandboxes for one Core; they never install Core. The bootstrap is one file that runs with the host's `python3`.
+
+| Module | Role |
+| --- | --- |
+| `node_install.py`, `node_spec.py`, `node_generations.py` | Node installer and generation helper. `node_spec.py` is generated by `go run ./services/core/cmd/specification-contract -write` |
+| `distribution.py` | Checksums, release metadata and Docker image identity |
+| `install_display.py`, `node_output.py` | Terminal output |
+| `provider_assets.py` | Node provider artifact names, generated by `go run ./services/core/cmd/provider-artifacts` |
+| `node_payload.py` | Publish a release's node files without replacing bytes already installed |
+
+## Accounts and permissions
+
+The node installer runs as root and prepares the host for one node per installation.
+
+- It creates or adopts the `oac-node` system user, adds it to the `docker` or `kvm` group (no other group), and installs one root-owned system service per installation that runs the node program as `User=oac-node`. Nodes on a host share that account, so a host serves one Core.
+- Docker group membership makes that user, and so the node, root-equivalent on the host; that is inherent to Docker sandboxes. microsandbox needs only `kvm`, user KVM access and the Linux runtime libraries.
+- Node configuration and identity live under `~/.oac/nodes/<installation-id>/` in the node account's home (`/var/lib/oac-node`); microsandbox uses a separate short private Runtime home.
+- The node service owns its provider processes outside the Core container. `KillMode=process` keeps resident microVM and helper processes across a service restart. The service restarts after failures with no start limit, so a node outlasts a Core outage, and stops restarting when the node program exits 78 because Core answered 401 to its credential (a removed node).
+- It never installs Docker, KVM or packages and never changes device permissions. It refuses SELinux-enforcing hosts and changes nothing when a check fails. The enrollment token comes only on standard input, never in arguments or the environment.
+- Files the service account owns are read, written and deleted only with that account's credentials. The one exception is root removing the account's home after `userdel`, when no process can still run as that account. That work runs in a child that starts its own session with `/dev/null` as input, joins a new session keyring and dies with its parent; root shows its output only as plain text (terminal controls become `?`). SIGINT, SIGHUP and SIGTERM stop that child and what it started.
+- Root never runs a file the service account can write, opens a URL it wrote, or follows a link in its home. Capture the trusted bootstrap bytes before dropping to the service account and pass them through the fork; the service account writes its own retained generation helper. Never open the caller's private download directory to it or let root write into service-owned state.
+- The generated bootstrap passes only the six standard HTTP/HTTPS proxy and bypass variables through sudo and gives both spellings the lowercase value when present, even if empty, so curl, urllib and the Go registration command follow the same rules. The installation child keeps just those names beside its fixed environment. Proxy values stay out of arguments, saved configuration, service units and diagnostics; never use broad sudo environment inheritance. This covers installation downloads only, not the node service.
+- `--uninstall` removes a node only after Core rejects its credential, except for a node that never registered and with `--force`, which Web offers when the old Core address no longer responds. It never touches sandboxes, volumes or images (the Runtime image and the microsandbox store stay), deletes the account only when the installer created it and no node remains, and otherwise removes only the groups it added.
+- Refuse resources of an older product name for the same installation ID; never adopt them or remove another installation's resources.
+
+## Download contract
+
+The distribution manifest is the one download contract for nodes: flat versioned file names, and the compressed and unpacked size and SHA-256 of the Runtime.
+
+- A Compose installation keeps only the node metadata from its release archive; Core's image never acquires execution-only payloads.
+- A node obtains bootstrap metadata from the console that generated its command. Web serves artifacts it has locally and redirects missing declared execution artifacts to the versioned HTTPS release base in the verified manifest. Web never downloads or caches those bytes.
+- Only artifact requests may follow HTTPS redirects, and only without credentials or cookies. Metadata and enrollment requests stay on the configured console. The console publishes only fixed non-secret files and declared artifact names.
+- Download into private temporary files, verify size and SHA-256 before an atomic rename, resume interrupted transfers, and reuse only verified cache entries or exact image identities. Never select a release other than the pinned one.
+- Release downloads are anonymous. Never add repository credentials to installed node or Runtime configuration.
+- Manual builds use the `build-<full SHA>` release tag and tag builds the `v*` tag. The manifest's download base must match the release tag; artifact file names and source provenance keep the full source SHA.
+
+## Image identity
+
+The manifest's `images` records each exported image's config digest, and `image_manifest_digests` its OCI manifest or index digest. Derive and verify both from the same archive, including its referenced config and layer bytes, and require the build host's selected image ID to match one of them.
+
+Docker's classic image store identifies images by config digest, and its containerd store by the OCI descriptor. The build therefore takes the digest the local store resolves from BuildKit's build metadata, never the `--iidfile` config digest alone, and disables provenance attestations so each image and archive holds one platform manifest in both stores.
+
+The node installer confirms Linux amd64 and the returned immutable local ID, and service and provider configuration and Runtime launches use that ID. Tags never replace identity verification. The microsandbox `runtime_ref` is independent of Docker's local store identity.
diff --git a/deploy/install/distribution.py b/deploy/node/distribution.py
similarity index 100%
rename from deploy/install/distribution.py
rename to deploy/node/distribution.py
diff --git a/deploy/install/install_display.py b/deploy/node/install_display.py
similarity index 100%
rename from deploy/install/install_display.py
rename to deploy/node/install_display.py
diff --git a/deploy/install/node_generations.py b/deploy/node/node_generations.py
similarity index 100%
rename from deploy/install/node_generations.py
rename to deploy/node/node_generations.py
diff --git a/deploy/install/node_install.py b/deploy/node/node_install.py
similarity index 100%
rename from deploy/install/node_install.py
rename to deploy/node/node_install.py
diff --git a/deploy/install/node_output.py b/deploy/node/node_output.py
similarity index 100%
rename from deploy/install/node_output.py
rename to deploy/node/node_output.py
diff --git a/deploy/node/node_payload.py b/deploy/node/node_payload.py
new file mode 100644
index 000000000..5265e3b9c
--- /dev/null
+++ b/deploy/node/node_payload.py
@@ -0,0 +1,127 @@
+"""Publish one release's node payload without replacing bytes already installed."""
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import tempfile
+
+from distribution import artifact, digest
+
+
+class PayloadError(Exception):
+    pass
+
+
+def prepare_node_payload(root, state, bundle):
+    destination = root / "node-payload"
+    # Each release remains immutable and addressable while old nodes retain it.
+    # The only mutable publication is a small, atomically replaced active pointer.
+    def publish(source):
+        manifest = json.loads((source / "manifest.json").read_text())
+        revision = manifest.get("source_commit", "")
+        if not re.fullmatch(r"[0-9a-f]{40}", revision):
+            raise PayloadError("Invalid node payload release identity")
+        metadata_names = ("node-install.pyz", "manifest.json", "SHA256SUMS", "runtime/seccomp.json")
+        names = list(metadata_names)
+        for logical in manifest.get("artifacts", {}):
+            entry = artifact(manifest, logical)
+            name = "artifacts/" + entry["filename"]
+            path = source / name
+            if path.exists():
+                if (path.is_symlink() or not path.is_file()
+                        or not path.resolve().is_relative_to(source.resolve())
+                        or path.stat().st_size != entry["size"] or digest(path) != entry["sha256"]):
+                    raise PayloadError("Offline artifact verification failed: " + logical)
+                names.append(name)
+        target = destination / "releases" / revision
+        if target.is_symlink() or target.parent.is_symlink():
+            raise PayloadError("Installed node payload differs; preserve it and inspect the distribution")
+        target.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+        if target.exists():
+            # Validate the complete published metadata and every existing declared
+            # artifact before filling any absence. Existing bytes are immutable.
+            for name in metadata_names:
+                previous = target / name
+                if (previous.parent.is_symlink() or previous.is_symlink() or not previous.is_file()
+                        or digest(previous) != digest(source / name)):
+                    raise PayloadError("Installed node payload differs; preserve it and inspect the distribution")
+            artifacts = target / "artifacts"
+            if artifacts.is_symlink() or artifacts.exists() and not artifacts.is_dir():
+                raise PayloadError("Installed node artifact directory differs")
+            missing = []
+            for logical in manifest.get("artifacts", {}):
+                entry = artifact(manifest, logical)
+                name = "artifacts/" + entry["filename"]
+                previous = target / name
+                if previous.is_symlink() or previous.exists() and (not previous.is_file()
+                        or previous.stat().st_size != entry["size"] or digest(previous) != entry["sha256"]):
+                    raise PayloadError("Installed node artifact differs; refusing repair")
+                if not previous.exists() and name in names:
+                    missing.append((name, entry))
+            if missing:
+                artifacts.mkdir(mode=0o700, exist_ok=True)
+                for name, entry in missing:
+                    descriptor, temporary = tempfile.mkstemp(prefix=".payload-", dir=artifacts)
+                    try:
+                        with os.fdopen(descriptor, "wb") as outgoing, (source / name).open("rb") as incoming:
+                            shutil.copyfileobj(incoming, outgoing)
+                            outgoing.flush()
+                            os.fsync(outgoing.fileno())
+                        if Path(temporary).stat().st_size != entry["size"] or digest(Path(temporary)) != entry["sha256"]:
+                            raise PayloadError("Node artifact changed during repair")
+                        # Publish without replacing bytes introduced concurrently.
+                        os.link(temporary, target / name)
+                    finally:
+                        os.unlink(temporary)
+                for directory in (artifacts, target):
+                    descriptor = os.open(directory, os.O_RDONLY | os.O_DIRECTORY)
+                    try:
+                        os.fsync(descriptor)
+                    finally:
+                        os.close(descriptor)
+            return revision
+        with tempfile.TemporaryDirectory(prefix=".payload-", dir=target.parent) as temporary:
+            stage = Path(temporary) / "release"
+            stage.mkdir(mode=0o700)
+            for name in names:
+                path = source / name
+                if path.is_symlink() or not path.is_file():
+                    raise PayloadError("Invalid node payload source file")
+                copied = stage / name
+                copied.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+                with path.open("rb") as incoming, copied.open("xb") as outgoing:
+                    os.chmod(copied, 0o600)
+                    shutil.copyfileobj(incoming, outgoing)
+                    outgoing.flush()
+                    os.fsync(outgoing.fileno())
+            os.rename(stage, target)
+        return revision
+
+    if destination.is_symlink():
+        raise PayloadError("Invalid node payload directory")
+    destination.mkdir(mode=0o700, exist_ok=True)
+    revision = publish(bundle)
+    pointer = destination / "active.json"
+    if pointer.is_symlink():
+        raise PayloadError("Invalid active node payload pointer")
+    if pointer.exists():
+        if json.loads(pointer.read_text()) != {"source_commit": revision}:
+            raise PayloadError("Installed node payload differs; preserve it and inspect the distribution")
+        return
+    descriptor, temporary = tempfile.mkstemp(prefix=".active-", dir=destination)
+    try:
+        with os.fdopen(descriptor, "w") as stream:
+            json.dump({"source_commit": revision}, stream)
+            stream.write("\n")
+            stream.flush()
+            os.fsync(stream.fileno())
+        os.replace(temporary, pointer)
+        descriptor = os.open(destination, os.O_RDONLY | os.O_DIRECTORY)
+        try:
+            os.fsync(descriptor)
+        finally:
+            os.close(descriptor)
+    finally:
+        if os.path.exists(temporary):
+            os.unlink(temporary)
diff --git a/deploy/install/node_spec.py b/deploy/node/node_spec.py
similarity index 100%
rename from deploy/install/node_spec.py
rename to deploy/node/node_spec.py
diff --git a/deploy/install/provider_assets.py b/deploy/node/provider_assets.py
similarity index 100%
rename from deploy/install/provider_assets.py
rename to deploy/node/provider_assets.py
diff --git a/deploy/install/test_distribution.py b/deploy/node/test_distribution.py
similarity index 100%
rename from deploy/install/test_distribution.py
rename to deploy/node/test_distribution.py
diff --git a/deploy/install/test_generation_review_regressions.py b/deploy/node/test_generation_review_regressions.py
similarity index 97%
rename from deploy/install/test_generation_review_regressions.py
rename to deploy/node/test_generation_review_regressions.py
index 30d173055..548e47a9e 100644
--- a/deploy/install/test_generation_review_regressions.py
+++ b/deploy/node/test_generation_review_regressions.py
@@ -10,9 +10,9 @@
 from unittest import mock
 
 import distribution
-import install
 import node_generations
 import node_install as installer
+import node_payload
 import test_node_install
 import test_node_generations
 
@@ -135,7 +135,7 @@ def payload_fixture(self, directory):
         files = {'node-install.pyz': b'node', 'SHA256SUMS': b'fixture', 'runtime/seccomp.json': b'{}', 'manifest.json': json.dumps({'source_commit': source, 'artifacts': entries}).encode()}
         for name, raw in files.items():
             path = bundle / name; path.parent.mkdir(parents=True, exist_ok=True); path.write_bytes(raw)
-        install.prepare_node_payload(root, {'mode': 'all'}, bundle)
+        node_payload.prepare_node_payload(root, {'mode': 'all'}, bundle)
         return root, bundle, root / 'node-payload/releases' / source, entries
 
     def test_thin_release_adds_and_repairs_verified_missing_artifact(self):
@@ -145,11 +145,11 @@ def test_thin_release_adds_and_repairs_verified_missing_artifact(self):
             for name, entry in entries.items():
                 (bundle / 'artifacts' / entry['filename']).write_bytes((name + ' verified artifact').encode())
             original = (release / 'manifest.json').read_bytes()
-            install.prepare_node_payload(root, {'mode': 'all'}, bundle)
+            node_payload.prepare_node_payload(root, {'mode': 'all'}, bundle)
             artifact = release / 'artifacts' / entries['node']['filename']
             self.assertEqual(artifact.read_bytes(), b'node verified artifact')
             artifact.unlink()
-            install.prepare_node_payload(root, {'mode': 'all'}, bundle)
+            node_payload.prepare_node_payload(root, {'mode': 'all'}, bundle)
             self.assertEqual(artifact.read_bytes(), b'node verified artifact')
             self.assertEqual((release / 'manifest.json').read_bytes(), original)
             self.assertEqual(artifact.stat().st_nlink, 1)
@@ -161,8 +161,8 @@ def test_published_conflict_refuses_every_missing_repair(self):
             node = entries['node']['filename']; helper = entries['helper']['filename']
             (bundle / 'artifacts' / node).write_bytes(b'node verified artifact')
             (release / 'artifacts' / helper).write_bytes(b'changed')
-            with self.assertRaises(install.InstallError):
-                install.prepare_node_payload(root, {'mode': 'all'}, bundle)
+            with self.assertRaises(node_payload.PayloadError):
+                node_payload.prepare_node_payload(root, {'mode': 'all'}, bundle)
             self.assertFalse((release / 'artifacts' / node).exists())
             self.assertEqual((release / 'artifacts' / helper).read_bytes(), b'changed')
 
diff --git a/deploy/install/test_node_generations.py b/deploy/node/test_node_generations.py
similarity index 100%
rename from deploy/install/test_node_generations.py
rename to deploy/node/test_node_generations.py
diff --git a/deploy/install/test_node_helper_transfer.py b/deploy/node/test_node_helper_transfer.py
similarity index 100%
rename from deploy/install/test_node_helper_transfer.py
rename to deploy/node/test_node_helper_transfer.py
diff --git a/deploy/install/test_node_install.py b/deploy/node/test_node_install.py
similarity index 100%
rename from deploy/install/test_node_install.py
rename to deploy/node/test_node_install.py
diff --git a/deploy/install/test_node_proxy.py b/deploy/node/test_node_proxy.py
similarity index 100%
rename from deploy/install/test_node_proxy.py
rename to deploy/node/test_node_proxy.py
diff --git a/deploy/install/test_node_readiness.py b/deploy/node/test_node_readiness.py
similarity index 100%
rename from deploy/install/test_node_readiness.py
rename to deploy/node/test_node_readiness.py
diff --git a/deploy/install/test_node_spec.py b/deploy/node/test_node_spec.py
similarity index 100%
rename from deploy/install/test_node_spec.py
rename to deploy/node/test_node_spec.py
diff --git a/deploy/test_install.py b/deploy/test_install.py
new file mode 100644
index 000000000..ba04295a6
--- /dev/null
+++ b/deploy/test_install.py
@@ -0,0 +1,75 @@
+"""install.sh writes .env and starts Compose without host Python."""
+import os
+from pathlib import Path
+import stat
+import subprocess
+import tempfile
+import textwrap
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+INSTALL = ROOT / "deploy/install.sh"
+
+
+class InstallScriptTests(unittest.TestCase):
+    def install(self, root, *args, compose_up=0):
+        bin_dir = root / "bin"
+        bin_dir.mkdir(exist_ok=True)
+        log = root / "docker.log"
+        self.write_executable(bin_dir / "docker", textwrap.dedent(f"""\
+            #!/bin/sh
+            printf '%s\\n' "$*" >> {log}
+            if [ "$1" = compose ] && [ "$2" = version ]; then printf 'v2.29.1\\n'; exit 0; fi
+            if [ "$1" = compose ] && [ "$2" = cp ]; then printf '#!/bin/sh\\n' > ./oac; exit 0; fi
+            if [ "$1" = compose ] && [ "$2" = up ]; then exit {compose_up}; fi
+            exit 0
+            """))
+        self.write_executable(bin_dir / "curl", textwrap.dedent("""\
+            #!/bin/sh
+            output=""
+            while [ $# -gt 0 ]; do
+              if [ "$1" = --output ]; then output="$2"; shift 2; continue; fi
+              shift
+            done
+            printf 'fixture\\n' > "$output"
+            """))
+        self.write_executable(bin_dir / "sha256sum", "#!/bin/sh\nexit 0\n")
+        self.write_executable(bin_dir / "ss", "#!/bin/sh\nexit 0\n")
+        env = dict(os.environ, PATH=str(bin_dir) + os.pathsep + os.environ["PATH"], HOME=str(root))
+        completed = subprocess.run(["bash", str(INSTALL), "--install-dir", str(root / "oac"), *args],
+                                   env=env, capture_output=True, text=True)
+        return completed, log.read_text() if log.exists() else ""
+
+    def test_a_failed_first_start_stops_and_removes_the_directory(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            completed, recorded = self.install(root, "--host", "127.0.0.1", "--web-port", "59991",
+                                               "--public-url", "https://core.example", compose_up=1)
+            self.assertNotEqual(completed.returncode, 0, completed.stderr)
+            self.assertFalse((root / "oac").exists(), "a failed first start must remove the directory")
+            self.assertIn("compose pull", recorded)
+            self.assertIn("compose up -d --wait", recorded)
+
+    def test_env_holds_only_the_installation_choices(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            completed, _ = self.install(root, "--public-url", "https://core.example")
+            self.assertEqual(completed.returncode, 0, completed.stderr)
+            env = dict(line.split("=", 1) for line in (root / "oac/.env").read_text().splitlines())
+            self.assertEqual(env["COMPOSE_FILE"], "compose.yaml:ports.yaml")
+            self.assertEqual(env["OAC_PUBLIC_URL"], "https://core.example")
+            self.assertEqual(sorted(env), ["COMPOSE_FILE", "COMPOSE_PROJECT_NAME", "OAC_HOST", "OAC_INSTALL_DIR", "OAC_PUBLIC_URL", "OAC_WEB_PORT"])
+
+    def test_help_does_not_need_docker(self):
+        help_text = subprocess.run(["bash", str(INSTALL), "--help"], capture_output=True, text=True, check=True)
+        self.assertIn("--web-port", help_text.stdout)
+        self.assertNotIn("--external-proxy", help_text.stdout)
+
+    def write_executable(self, path, text):
+        path.write_text(text)
+        path.chmod(path.stat().st_mode | stat.S_IEXEC)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/docs/api/index.md b/docs/api/index.md
index cb4c00a4c..e970b8dca 100644
--- a/docs/api/index.md
+++ b/docs/api/index.md
@@ -12,9 +12,9 @@ Core serves three namespaces. Each has one kind of caller and its own credential
 
 A credential used in another namespace gets 401: a Project API key on `/core/v1` or `/api/v1`, the Core key on `/v1` or `/api/v1`. How Projects and keys behave is in [Projects own assets](../concepts.md#projects-own-assets).
 
-**Routing.** The reverse proxy sends `/v1` and `/api/v1` to Core and everything else to Web ([proxy setup](../getting-started/install-options.md#https-and-the-reverse-proxy)). Browsers reach `/core/v1` only through Web's console server, which adds the Core key after sign-in and answers 404 for `/v1` and `/api/v1` ([console server](../web/console-server.md)). Operator scripts call `/core/v1` on Core's loopback port ([script the Core API](../getting-started/operations.md#script-the-core-api)).
+**Routing.** Web forwards `/v1`, `/api/v1` and `/docs` to Core unchanged ([console server](../web/console-server.md)). A signed-in browser reaches `/core/v1` through Web, which adds the Core key. Operator scripts call `/core/v1` on `127.0.0.1:8091` ([script the Core API](../getting-started/operations.md#script-the-core-api)).
 
-**API reference page.** Core serves a read-only Swagger UI of all three namespaces at `/docs`, and the generated documents it renders at `/docs/openapi.yaml`, `/docs/core.openapi.yaml` and `/docs/runtime.openapi.yaml`. These routes need no credential, and the page sends no API requests. The reverse proxy does not route `/docs` to Core, so open it on Core's own address: on the Core host, `http://127.0.0.1:<port>/docs`, where the port is [`ports.core`](../configuration.md#settings), 8091 by default. The browser loads Swagger UI from `unpkg.com`.
+**API reference.** Core serves a read-only Swagger UI of the three namespaces at `/docs`, and the documents at `/docs/openapi.yaml`, `/docs/core.openapi.yaml` and `/docs/runtime.openapi.yaml`. No credential is required, and the page sends no API requests. Open it on the console origin, for example `http://localhost:8080/docs`. The browser loads Swagger UI from `unpkg.com`.
 
 ## Machine connection API
 
diff --git a/docs/configuration.md b/docs/configuration.md
index d653d1bd5..1b7ece191 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -6,80 +6,58 @@ Every setting of a Core installation has exactly one home. There are two kinds:
 
 | Kind | Examples | Home | Change it with | Takes effect |
 | --- | --- | --- | --- | --- |
-| [Process settings](#process-settings-configjson) | Public URL, ports, logging, harnesses, execution concurrency, audit retention, OAuth origins, database pool, Runtime history export | `config.json` in the installation directory (default `~/.oac/core`) | Web domain setup or `oac domain` for managed HTTPS; otherwise edit the file, then run `oac apply` | `oac apply` restarts the services that read the changed settings |
+| [Process settings](#process-settings-configjson) | Public URL, ports, logging, harnesses, execution concurrency, audit retention, OAuth origins, Runtime history export | `.env` in the installation directory (default `~/.oac/core`) | Edit `.env`, then run `oac apply` | `oac apply` recreates the services that read the changed settings |
 | [Runtime settings](#runtime-settings-web) | Sandbox backend and size, nodes, Projects and keys, default models, executor credentials | Core's PostgreSQL database | Web, or the Core API (`/core/v1`) with the Core key | Saved without a Core restart; nodes prepare Runtime changes asynchronously |
 
-Web's **System** page shows the installation's addresses, the default models, the sandbox configuration and, under **Startup settings**, the process settings read-only with the path of `config.json` and the apply command. Secrets live in [`secrets/`](#installation-directory), one copy each. The files in `generated/` are derived from `config.json`. No configuration file defines Projects or API keys.
+Web's **System** page shows the installation's addresses, the default models, the sandbox configuration and, under **Startup settings**, the process settings Core loaded. Secrets live in [`data/secrets/`](#installation-directory), one copy each. No configuration file defines Projects or API keys.
 
-## Process settings: config.json
+## Process settings {#process-settings-configjson}
 
-The installer writes every setting, so the file shows each value. Installer flags listed in [installation options](./getting-started/install-options.md) only seed it. To change a setting, edit the file and apply it:
+Installer flags in [installation options](./getting-started/install-options.md) write `.env` once. To change a setting, edit `.env` and apply it:
 
 ```sh
-~/.oac/core/oac apply --dry-run   # show the changed settings, files and restarts
 ~/.oac/core/oac apply
 ```
 
-### How oac apply works
+### How oac apply works {#how-oac-apply-works}
 
-1. It validates `config.json` and changes nothing if a value is invalid. `ingress` is fixed after installation; to change it, install into a new directory. It also checks the listeners that a changed `host`, port or managed-ingress `public_url` adds ([ports](./getting-started/install-options.md#ports)), and changes nothing if `host` is not an address of this machine or another program holds one of their ports; the installation's own listeners do not count.
-2. It writes the files Core, Web and Compose read into `generated/`: `compose.json`, `core.env`, `core-key-digests.json`, `settings.json` and, when used, `runtime-history.json` and the managed `Caddyfile`. Don't edit them. A generated file edited by hand stops `apply` until you move the change into `config.json` and run `oac apply --discard-edits`, which keeps the edited copy as `generated/<file>.edited-<time>`.
-3. It compares what it wrote with what actually runs. Each container carries a digest of its inputs (the `io.oac.inputs` label), and `apply` recreates or restarts exactly the services whose inputs differ: Core first, then Web. The **Restarts** column below says which services a setting affects; see [stop and restart](./getting-started/operations.md#stop-and-restart) for what a restart interrupts.
-4. While any service runs, `apply` also starts the stopped ones. After `oac stop`, it only writes the files and the installation stays stopped.
-5. If Core refuses a value at startup, `apply` prints Core's startup error. If every service was running with the previous files, it restores them and starts the services again; otherwise it reports the failure, and the next `apply` finishes the work.
+1. It runs `oac-core check-config` with the `.env` you edited and changes nothing if a value is invalid.
+2. It runs `docker compose up -d --wait`. Compose recreates only the services whose configuration changed.
+3. If the check fails, no container is recreated. See [stop and restart](./getting-started/operations.md#stop-and-restart) for what a restart interrupts.
 
-`oac status` reports changes to `config.json` that are not applied yet and generated files edited by hand.
+`docker compose ps` shows the services. Domain state is `data/domain/status.json`.
 
-### Changing the public URL
+### Changing the public URL {#changing-the-public-url}
 
-`public_url` is the one origin that applications, nodes, sandboxes and self-hosted executors use. Core derives the daemon WebSocket URL, the self-hosted `remote_url` and each sandbox's connection address from it. With `null`, Core uses its loopback origin. Until `public_url` is set, a managed installation serves only Web, over HTTP on the host's IP address at `ports.web`; afterwards that address redirects to `public_url`.
+`OAC_PUBLIC_URL` is the one origin that applications, nodes, sandboxes and self-hosted executors use. Core derives the daemon WebSocket URL, the self-hosted `remote_url` and each sandbox's connection address from it. The installation serves Web over HTTP on `OAC_WEB_PORT`; your reverse proxy or hosting platform terminates HTTPS and routes to that port.
 
-With managed ingress, change it in Web (**System** → **Configure domain and HTTPS**) or with `oac domain HOSTNAME`. Both take the installation lock, verify the new certificate and address, then write `config.json` and apply it. With external ingress, update your reverse proxy first, then edit `public_url` and run `oac apply`.
-
-When nodes, hosted sandboxes or self-hosted executors are bound to the current address, `apply` lists them and asks you to type the new URL (`--confirm-public-url-change URL` without a terminal). Afterwards:
+To change it, point the reverse proxy at the new address first, then edit `OAC_PUBLIC_URL` and run `oac apply`. Afterwards:
 
 - Nodes on the old address get no new sandboxes: remove them in Web and add them again.
-- Existing sandboxes and executors keep working only while the old address still reaches this Core. A managed domain change replaces the previous domain route.
+- Existing sandboxes and executors keep working only while the old address still reaches this Core.
 - Self-hosted executors must restart with the new `remote_url`, and their installer refuses an installation made for the old address: create new self-hosted Sessions and connect their hosts again.
 
 ### Settings
 
-`core.runtime_history.headers` may hold export credentials. They stay in the `0600` `config.json` and the generated file Core reads, and never appear in `oac` output or in Core's settings snapshot. Model providers are not process settings; see [Default models](#default-models).
-
-[//]: # (BEGIN config-reference: generated by scripts/config-reference.py from deploy/install/config.schema.json)
-| Key | Type | Default | Change | Restarts | Meaning |
-| --- | --- | --- | --- | --- | --- |
-| `$schema` | string | none | any time | none | Editor hint that points at the installed copy of this schema. Ignored. |
-| `format` | `1` | none | fixed | none | Configuration format for this release. Fixed after installation. |
-| `public_url` | string or null (canonical origin; HTTP only on loopback) | `null` | `oac apply` | core, web | Canonical public origin of Core and Web. With managed ingress, set the DNS hostname in Web or run oac domain; certificates are automatic. With external ingress, configure your TLS reverse proxy before applying this value. |
-| `host` | string (IPv4 or IPv6 address) | `"127.0.0.1"` | `oac apply` | core, web | Listener IP. With managed ingress only the gateway is public; Core stays on loopback. The default installer listens on all IPv4 interfaces. |
-| `ports.core` | integer 1024–65535 | `8091` | `oac apply` | core | Host port of the Core API. |
-| `ports.web` | integer 1024–65535 | `8080` | `oac apply` | web | Host port of Web. |
-| `log.level` | `"debug"` \| `"info"` \| `"warn"` \| `"error"` | `"info"` | `oac apply` | core, web | Minimum log level of Core and Web. |
-| `log.format` | `"auto"` \| `"text"` \| `"json"` | `"auto"` | `oac apply` | core, web | Log format. auto writes text to a terminal and JSON otherwise. |
-| `log.add_source` | boolean | `false` | `oac apply` | core, web | Add the source file and line to each log record. |
-| `core.execution_concurrency` | integer 1–1024 | `4` | `oac apply` | core | Concurrent execution work units in Core. Unrelated to node sandbox capacity. |
-| `core.harnesses` | array of `"claude_sdk"` \| `"codex"` \| `"mcode"` | `["claude_sdk", "codex", "mcode"]` | `oac apply` | core | Harnesses that Sessions may select. |
-| `core.default_harness` | `"claude_sdk"` \| `"codex"` \| `"mcode"` | `"codex"` | `oac apply` | core | Harness used when a Session names none. It must be listed in core.harnesses. |
-| `core.write_audit_retention` | string (Go duration, at least `1h`) | `"2160h"` | `oac apply` | core | How long non-creation write history is kept, as a Go duration of at least 1h. |
-| `core.oauth_trusted_origins` | array of string (canonical HTTPS origin) | `[]` | `oac apply` | core | Extra HTTPS origins trusted as private OAuth issuers. |
-| `core.database_pool.max_conns` | integer or null ≥ 1 | `null` | `oac apply` | core | Maximum database connections. null keeps the driver default, max(4, CPU count). |
-| `core.database_pool.min_conns` | integer or null ≥ 0 | `null` | `oac apply` | core | Minimum idle database connections. null keeps the driver default, 0. |
-| `core.database_pool.max_conn_lifetime` | string or null (Go duration) | `null` | `oac apply` | core | Go duration. null keeps the driver default, 1h. |
-| `core.database_pool.max_conn_idle_time` | string or null (Go duration) | `null` | `oac apply` | core | Go duration. null keeps the driver default, 30m. |
-| `core.database_pool.health_check_period` | string or null (Go duration) | `null` | `oac apply` | core | Go duration. null keeps the driver default, 1m. |
-| `core.runtime_history` | object or null | `null` | `oac apply` | core | Runtime history collection and OTLP export. null keeps local collection with Core's defaults. Core checks the values at startup. |
-| `core.runtime_history.transport` | string | none | `oac apply` | core | OTLP export transport: `otlp_http`. Required with endpoint. |
-| `core.runtime_history.endpoint` | string | none | `oac apply` | core | OTLP/HTTP metrics URL: a canonical absolute URL with a path and no credentials, query or fragment; HTTPS, or HTTP with insecure. Omit it to keep history local; transport, insecure and headers then must be absent. |
-| `core.runtime_history.insecure` | boolean | none | `oac apply` | core | Export without TLS. Required for an HTTP endpoint and refused for HTTPS. |
-| `core.runtime_history.headers` | object of string values | none | `oac apply` | core | Headers sent with each export, such as credentials. Host, Content-Length, Content-Type and Content-Encoding are refused. Never shown by oac or Core. Sensitive. |
-| `core.runtime_history.queue_capacity` | integer | none | `oac apply` | core | Capacity of the history write queue and of the export queue, up to 4096. Omitted or 0 selects 256. |
-| `core.runtime_history.timeout_seconds` | integer | none | `oac apply` | core | History write, export and query timeout in seconds, up to 30. Omitted or 0 selects 2. |
-| `core.runtime_history.sample_interval_seconds` | integer | none | `oac apply` | core | Periodic sampling interval in seconds, 5 to 300. Omitted or 0 selects 30. |
-| `ingress` | `"managed"` \| `"external"` | `"external"` | fixed | none | managed provides automatic HTTPS and Web domain setup; install.sh selects it by default. external uses your existing proxy. Fixed after installation. |
-[//]: # (END config-reference)
-
-The schema is [`deploy/install/config.schema.json`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/install/config.schema.json); each installation keeps a copy in `generated/config.schema.json` for editors. Core serves the non-secret settings snapshot, with the path of `config.json` and the apply command, at `GET /core/v1/installation`. How Core collects and keeps Runtime history is in [retained history](../contracts/agents-api/runtime-observability.md#retained-history-and-optional-export).
+`OAC_HISTORY_SETTINGS_FILE` may point at a file whose headers hold export credentials. The file stays mode `0600`, and those headers never appear in `oac` output or in the installation report. Model providers are not process settings; see [Default models](#default-models).
+
+| Variable | Default | Meaning |
+| --- | --- | --- |
+| `OAC_PUBLIC_URL` | `http://localhost:8080` | Origin applications, nodes, sandboxes and self-hosted executors use. Managed domain setup writes the HTTPS origin and recreates Core and Web |
+| `OAC_HOST` | `127.0.0.1` | Address published by `ports.yaml`. `install.sh` sets `0.0.0.0` |
+| `OAC_WEB_PORT` | `8080` | Host port of Web |
+| `COMPOSE_FILE` | `compose.yaml:ports.yaml` | The Compose files. `ports.yaml` publishes Web and Core's loopback admin API; hosting platforms omit it |
+| `OAC_LOG_LEVEL` | `info` | `debug`, `info`, `warn` or `error` |
+| `OAC_LOG_FORMAT` | `auto` | `auto`, `text` or `json` |
+| `OAC_LOG_ADD_SOURCE` | unset | `1` adds source locations |
+| `OAC_EXECUTION_CONCURRENCY` | `4` | Concurrent execution work, from 1 to 1024 |
+| `OAC_DEFAULT_HARNESS` | `codex` | Harness used when a request does not name one |
+| `OAC_HARNESSES` | Every registered Harness | Comma-separated Harnesses to enable besides the default one. Unknown names stop startup |
+| `OAC_WRITE_AUDIT_RETENTION` | `2160h` | Minimum `1h` |
+| `OAC_OAUTH_TRUSTED_ORIGINS` | unset | Comma-separated HTTPS origins |
+| `OAC_HISTORY_SETTINGS_FILE` | unset | Optional Runtime history file. Sensitive; Core reports only whether it is configured |
+
+An unset or empty value selects the default. Edit `.env`, then run `oac apply`. Core reports the process settings it loaded at `GET /core/v1/installation`. `oac-core check-config` validates the same environment without starting Core. Sensitive settings report only whether they are configured. How Core collects and keeps Runtime history is in [retained history](../contracts/agents-api/runtime-observability.md#retained-history-and-optional-export).
 
 ## Runtime settings: Web
 
@@ -87,7 +65,7 @@ Runtime settings live in Core's database. Change them in Web; scripts use the sa
 
 | Setting | Where in Web | Core API | Notes |
 | --- | --- | --- | --- |
-| Sandbox backend: Docker, microsandbox or E2B | **System** → **Manage sandbox configuration**: the setup wizard, ending with **Save configuration** | `/core/v1/sandbox/deployment` | One backend per installation. The installer saves microsandbox at the Standard size. Another backend needs **Reset deployment** first; see [change the sandbox configuration](./getting-started/nodes.md#change-the-sandbox-configuration) |
+| Sandbox backend: Docker, microsandbox or E2B | **System** → **Manage sandbox configuration**: the setup wizard, ending with **Save configuration** | `/core/v1/sandbox/deployment` | One backend per installation, chosen after the first sign-in. Another backend needs **Reset deployment** first; see [change the sandbox configuration](./getting-started/nodes.md#change-the-sandbox-configuration) |
 | Sandbox size, Runtime release, E2B key and template build | **System** → **Manage sandbox configuration** → **Change resources** | `/core/v1/sandbox/deployment` | Web proposes the sizes in [`standard-sizes.json`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/web/src/features/sandbox/standard-sizes.json). Existing sandboxes keep their size and release. The E2B key is write-only and encrypted |
 | Nodes and their capacity | **Nodes**: **Add node**; **Edit node** and **Remove node** on a node's page | `/core/v1/sandbox/enrollment-tokens`, `/core/v1/sandbox/nodes` | See [Node capacity](#node-capacity) and the [nodes guide](./getting-started/nodes.md) |
 | Projects and API keys | **Projects and keys**: **Create project**, **Rename**, **Issue key**, **Revoke**, **Archive** | `/core/v1/projects` | Keys are shown once; Core stores digests |
@@ -108,26 +86,26 @@ Set a default in **System** → **Default model configuration**, or use `PUT /co
 
 ## Compose installations
 
-The [standalone Compose template](./getting-started/install-options.md#docker-compose-and-hosting-platforms) uses its Compose definition and the platform's environment as the source of process settings. An unset or empty `OAC_PUBLIC_URL` selects `http://localhost:8080`, allowing startup before a public domain is configured. Core and Web receive that same value. For public access, set `OAC_PUBLIC_URL` to the exact public HTTPS origin without a trailing slash and redeploy Core and Web with the same project and volumes; changing an environment variable requires container recreation, not just a restart. Configure the public origin before adding nodes or executors. The platform owns TLS and routes to `gateway:8080`; Web's installer-managed domain setup is unavailable.
+The [standalone Compose file](./getting-started/install-options.md#docker-compose-and-hosting-platforms) takes process settings from the platform's environment. An empty `OAC_PUBLIC_URL` selects `http://localhost:8080`. Set it to the exact public origin, without a trailing slash, and recreate Core and Web before adding nodes or executors. The platform terminates TLS and routes to `web:8080`.
 
-The initialization service generates secrets and the installation ID once, then verifies them on subsequent deployments. Each secret has one persistent source; Core's key digest is derived from Web's sign-in key. Initialization never replaces missing or changed secrets on an existing installation. Core reads its existing process environment and file settings, so the installer-specific `config.json`, `oac apply` and startup settings snapshot do not apply to this deployment.
+The initialization service generates secrets and the installation ID once, then verifies them on subsequent deployments. Each secret has one persistent source; Core's key digest is derived from Web's sign-in key. Initialization never replaces missing or changed secrets on an existing installation. Core reads the process environment from `.env`.
 
-| Compose volume | Content | Readers |
+| Data directory path | Content | Readers |
 | --- | --- | --- |
-| `database` | PostgreSQL data | PostgreSQL; initialization checks whether it is empty |
-| `database-secret` | Generated database password | PostgreSQL, migrator and Core |
-| `core-config` | Credential encryption key, installation ID, Core key digest and initialization receipt | Migrator and Core |
-| `web-secret` | Generated Core sign-in key | Web and the explicit `credentials` tool |
-| `core-state` | Private Provider state | Core |
-| `node-payload` | Verified node installation metadata | Web |
+| `database/` | PostgreSQL data | PostgreSQL; initialization checks whether it is empty |
+| `secrets/database/` | Generated database password | PostgreSQL and Core |
+| `secrets/core/` | Credential encryption key, installation ID and Core key digest | Core |
+| `secrets/web/` | Generated Core sign-in key | Web |
+| `state/` | Private Provider state | Core |
+| `node-payload/` | Verified node installation metadata | Web |
 
-Initialization prepares these volumes; application services receive their secret volumes read-only. The `credentials` tool disables container logging. Retrieve its output only in an operator terminal. Database passwords and credential encryption keys are never printed.
+Initialization prepares this directory; application services receive their secret directories read-only. `docker compose exec web oac-web core-key` prints the Core key to the operator terminal without writing it to container logs. Database passwords and credential encryption keys are never printed.
 
-The Compose project name scopes the volumes. Preserve every volume together with that project's definition and public URL. Removing only secret volumes does not reset an installation; initialization refuses to start over an existing database. Core also binds the installation ID to its database. Runtime settings continue to live in [Core's database](#runtime-settings-web).
+`OAC_DATA_DIR` selects the directory and defaults to `./data` beside the Compose file. Preserve it together with that project's definition and public URL. Removing only the secret directories does not reset an installation; initialization refuses to start over an existing database. Core also binds the installation ID to its database. Runtime settings continue to live in [Core's database](#runtime-settings-web).
 
 ## Docker node configuration
 
-The node installer writes Docker’s provider configuration into the node’s configuration file; these fields are separate from Core’s `config.json`. Deployment resources, Runtime images and capacity remain in [Core’s database](#runtime-settings-web).
+The node installer writes Docker’s provider configuration into the node’s configuration file. Deployment resources, Runtime images and capacity remain in [Core’s database](#runtime-settings-web).
 
 | Field | Installer value | Meaning |
 | --- | --- | --- |
@@ -141,56 +119,51 @@ The [Docker adapter](./sandbox-provider.md#docker-adapter) owns container isolat
 
 ## Installation directory
 
-The installer creates the installation directory, `~/.oac/core` by default, with mode `0700`; the files in `secrets/` are `0600`.
+The installer creates the installation directory, `~/.oac/core` by default, with mode `0700`. Secret files are `0600`.
 
 | Path | Content | Changed by |
 | --- | --- | --- |
-| `config.json` | [Process settings](#process-settings-configjson). The only file you edit | You, then `oac apply`; managed domain setup for `public_url` |
-| `oac` | The [management command](./getting-started/operations.md#the-oac-command) | The installer |
-| `state.json` | Installation ID, Compose project name, image IDs, source commit, the digests of generated files and whether the services have started once | The tools only |
-| `secrets/core.key` | The [Core key](./getting-started/operations.md#core-key) | `oac rotate-core-key` |
-| `secrets/credential.key` | Encryption key for what Core stores sealed in the database: model providers, the E2B key, Vault credentials, Skills, initial files and environment setup | Nothing. Keep it with the database; `oac apply` refuses a changed file |
-| `secrets/database.password` | PostgreSQL password | Nothing. PostgreSQL reads it only when the database is created; `oac apply` refuses a changed file |
-| `generated/` | Files derived from `config.json` | `oac apply` |
-| `node-payload/` | The node installer and node files that Web serves at `/node-install/`, one directory per release | The installer |
-| `native-installers/` | Self-hosted daemon installers for each platform, with their catalog, when the bundle carries them | The installer |
-| `state/e2b/` | Private E2B receipts | Core |
-| `ingress/` | Managed HTTPS: certificates and gateway state, domain setup status and the control sockets | The `gateway` and `installation` services |
-| `.oac.lock` | The installation lock | The installer and mutating `oac` commands |
-
-Only managed ingress has `ingress/`.
-
-In Docker, the Compose project is named `oac-<10 hex digits>` (`project` in `state.json`). Its services are `database`, `migrate`, `core` and `web`, plus `gateway` and `installation` with managed ingress. `gateway` routes to Core and Web and publishes `ports.web`, plus [80 and 443](./getting-started/install-options.md#ports) once HTTPS is on; `installation` applies domain changes from Web and uses the Docker socket to do so. The volume `<project>_database` holds all data. Apart from Docker's storage, nothing is written outside your home directory.
+| `.env` | [Process settings](#process-settings-configjson). The file you edit | You, then `oac apply` |
+| `compose.yaml`, `ports.yaml` | The release's service definition. Do not edit them | The release |
+| `oac` | The [management command](./getting-started/operations.md#the-oac-command), copied from the Core image | The installer |
+| `data/secrets/web/core.key` | The [Core key](./getting-started/operations.md#core-key) | `oac rotate-core-key` |
+| `data/secrets/core/credential.key` | Encryption key for what Core stores sealed in the database | Nothing. Keep it with the database |
+| `data/secrets/core/core-key-digests.json` | SHA-256 of the Core key | `oac rotate-core-key` |
+| `data/secrets/database/password` | PostgreSQL password | Nothing. PostgreSQL reads it only when the database is created |
+| `data/database/` | PostgreSQL data | PostgreSQL |
+| `data/node-payload/` | Node files Web serves at `/node-install/` | Initialization |
+| `data/state/` | Private Provider state, including E2B receipts | Core |
+| `.oac.lock` | The installation lock | Mutating `oac` commands |
+
+The Compose project is named `oac-<10 hex digits>`. Its services are `init`, `database`, `core` and `web`. Core applies database migrations when it starts. `web` serves the console and forwards `/v1` and `/api/v1` to Core, and it is the only service that publishes `OAC_WEB_PORT`. Host installs also publish Core's admin API on `127.0.0.1:8091`. No service receives a Docker socket. Apart from Docker's storage, nothing is written outside the installation directory.
 
 ## Appendix: Core environment without the installer
 
-Core reads only its environment. The installer renders `generated/core.env` from `config.json`; if you run Core yourself (see the [service guide](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/README.md)), set these variables. Compose loads the file with `env_file`, so Compose must be 2.26.0 or newer.
+Core reads only its environment. Compose interpolates `.env` into the service environment. Compose must be 2.26.0 or newer. If you run Core yourself, set these variables; see the [service guide](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/README.md).
 
 | Variable | Set from |
 | --- | --- |
-| `OAC_PUBLIC_URL` | `public_url`, or Core's loopback origin. Core derives the daemon WebSocket URL, the self-hosted `remote_url`, the hosted sandbox address and the deployment's read-only `core_url` from it, never from request headers. Without it, Core runs no Runtime gateway and executes no Sessions |
-| `OAC_ADDR` | The installer sets `:8091` in the container. Independently started Core defaults to `127.0.0.1:8091` when unset or empty |
-| `OAC_DATABASE_URL` | The installation's PostgreSQL without a password, plus `core.database_pool` as `pool_*` query parameters |
-| `OAC_DATABASE_PASSWORD_FILE` | `secrets/database.password`. The URL must then carry no password; migrations and the maintenance commands read the file too |
-| `OAC_CREDENTIAL_KEY_FILE` | `secrets/credential.key` |
-| `OAC_CORE_KEY_DIGESTS_FILE` | `generated/core-key-digests.json`: a JSON array with the SHA-256 of the Core key |
-| `OAC_INSTALLATION_ID` | The installation ID from `state.json`, a canonical UUID. It enables the sandbox deployment and node routes and requires `OAC_PUBLIC_URL` and `OAC_CORE_KEY_DIGESTS_FILE`. Core refuses an ID other than the one its database recorded, so keep the two together |
-| `OAC_SETTINGS_FILE` | `generated/settings.json`, the snapshot Core serves at `GET /core/v1/installation`; Core does not act on it |
-| `OAC_EXECUTION_CONCURRENCY`, `OAC_DEFAULT_HARNESS`, `OAC_WRITE_AUDIT_RETENTION`, `OAC_OAUTH_TRUSTED_ORIGINS` | The matching [process settings](#settings); omitted or empty default Harness uses `core.default_harness`’s documented default |
-| `OAC_HARNESSES` | `core.harnesses` with the installer. Independently started Core enables only the default Harness when unset; comma-separated explicit names supplement it. Entries are trimmed and deduplicated; unknown names stop startup |
-| `OAC_HISTORY_SETTINGS_FILE` | `generated/runtime-history.json`: the [`core.runtime_history`](#settings) object, when it is set |
-| `OAC_LOG_LEVEL`, `OAC_LOG_FORMAT`, `OAC_LOG_ADD_SOURCE` | `log.*`; Web reads the same three |
-| `OAC_PROVIDER_ROOT` | Absolute adapter artifact root: `/opt/oac` in the Core image. Each adapter owns its helper paths beneath this root |
+| `OAC_PUBLIC_URL` | The public origin. Core derives the daemon WebSocket URL, the self-hosted `remote_url`, the hosted sandbox address and the deployment's read-only `core_url` from it, never from request headers. Without it, Core runs no Runtime gateway and executes no Sessions |
+| `OAC_ADDR` | The image sets `:8091`. Independently started Core defaults to `127.0.0.1:8091` when unset or empty |
+| `OAC_DATABASE_URL` | PostgreSQL without a password |
+| `OAC_DATABASE_PASSWORD_FILE` | `data/secrets/database/password`. The URL must then carry no password |
+| `OAC_CREDENTIAL_KEY_FILE` | `data/secrets/core/credential.key` |
+| `OAC_CORE_KEY_DIGESTS_FILE` | `data/secrets/core/core-key-digests.json`: a JSON array with the SHA-256 of the Core key |
+| `OAC_INSTALLATION_ID_FILE` | `data/secrets/core/installation.id`: the installation ID, a canonical UUID. It enables the sandbox deployment and node routes and requires `OAC_PUBLIC_URL` and `OAC_CORE_KEY_DIGESTS_FILE`. Core refuses an ID other than the one its database recorded |
+| `OAC_EXECUTION_CONCURRENCY`, `OAC_DEFAULT_HARNESS`, `OAC_HARNESSES`, `OAC_WRITE_AUDIT_RETENTION`, `OAC_OAUTH_TRUSTED_ORIGINS` | The matching [process settings](#settings). `oac-core check-config` validates them without starting Core |
+| `OAC_HISTORY_SETTINGS_FILE` | Optional Runtime history file. Sensitive; the installation report says only whether it is set |
+| `OAC_LOG_LEVEL`, `OAC_LOG_FORMAT`, `OAC_LOG_ADD_SOURCE` | Logging; Web reads the same three |
+| `OAC_PROVIDER_ROOT` | Absolute adapter artifact root. The Core image sets `/opt/oac`. Each adapter owns its helper paths beneath this root |
 | `OAC_PROVIDER_STATE_ROOT` | Absolute private state root: `/state` in the Core image. Each adapter owns its subdirectory; E2B uses `e2b/`, owned by Core's user with no group or other access. Back it up with the database and `credential.key`; don't mount it into Web or a Runtime |
-| `OAC_NATIVE_INSTALLER_DIR` | `native-installers/`, served to self-hosted machines; the Core image has a copy at `/opt/oac/native-installers`, used when this is unset. Core checks the catalog against its own release before serving it |
+| `OAC_NATIVE_INSTALLER_DIR` | Self-hosted daemon installers: `/opt/oac/native-installers` in the Compose file. Unset, Core serves none. Core checks the catalog against its own release before serving it |
 
 Core logs the file paths it loads, never environment values or file contents.
 
-Invalid explicit OAuth trusted origins stop Core at startup. Entries must be HTTPS origins without credentials, query or a non-root path; the installer validates `core.oauth_trusted_origins` before generating them. [Vaults](../contracts/agents-api/vaults.md) owns refresh and network policy. A private issuer also needs a trusted CA: independently managed Unix Core can use Go’s `SSL_CERT_FILE` PEM CA-bundle override, which preserves certificate verification. Managed installation has no custom-CA setting or mount; do not edit `generated/core.env`.
+Invalid explicit OAuth trusted origins stop Core at startup. Entries must be HTTPS origins without credentials, query or a non-root path. [Vaults](../contracts/agents-api/vaults.md) owns refresh and network policy. A private issuer also needs a trusted CA: independently managed Unix Core can use Go’s `SSL_CERT_FILE` PEM CA-bundle override, which preserves certificate verification. Managed installation has no custom-CA setting.
 
 ## Appendix: Web environment without the installer
 
-The installer sets these variables from `config.json`; set them yourself only when you run the console without the installer. Of the installation's secrets, the installer gives the console only `secrets/core.key`.
+Compose sets these for Web. Set them yourself only when you run the console without Compose. Of the installation's secrets, Web receives only `data/secrets/web/core.key`.
 
 | Variable | Default | Meaning |
 | --- | --- | --- |
@@ -200,7 +173,5 @@ The installer sets these variables from `config.json`; set them yourself only wh
 | `OAC_WEB_CORE_KEY_FILE` | `/admin/core.key` | Absolute path of a regular file with no group or other permissions, holding the Core key: at least 32 characters, no whitespace, at most 4 KiB |
 | `OAC_WEB_DIST` | `/www` | Absolute directory of the built console; must contain `index.html` |
 | `OAC_WEB_NODE_PAYLOAD_DIR` | unset | Absolute path of the matched distribution's node payload (the installer's `node-payload/`). Unset, `/node-install/*` is not served and Add node is unavailable |
-| `OAC_WEB_INSTALLATION_SOCKET` | unset | Absolute path of the installer's domain socket. Unset, domain setup reports unsupported |
-| `OAC_WEB_BOOTSTRAP` | `0` | `1` accepts literal-IP hosts before a domain is configured. Requires an `http://` origin and `OAC_WEB_INSTALLATION_SOCKET` |
 
 Defaults apply when a variable is absent; an explicitly empty value is validated as supplied. An invalid `OAC_WEB_*` value stops the console at startup with a message naming the variable. The console also reads `OAC_LOG_LEVEL`, `OAC_LOG_FORMAT` and `OAC_LOG_ADD_SOURCE` ([Core environment](#appendix-core-environment-without-the-installer)); unknown values fall back to their defaults. Use HTTPS for any browser that is not on the same machine.
diff --git a/docs/development.md b/docs/development.md
index 2d2231271..5554518e9 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -76,7 +76,7 @@ For frontend development, run `pnpm dev:web` using the fixture or Core connectio
 | `services/core/internal/sandbox` | Provider interfaces and managed compute lifecycle | [Provider onboarding](./sandbox-provider.md) |
 | `services/web` | Console login and the server-side management proxy | [Console server](./web/console-server.md) |
 | `apps/web` and `packages/agents-client` | Console UI and typed clients | [Web guide](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/web/README.md) |
-| `deploy/install` and `scripts` | Distribution, installation and validation tools | [Maintainers](./maintainers.md) |
+| `deploy` and `scripts` | Distribution, installation and validation tools | [Maintainers](./maintainers.md) |
 | `contracts/agents-api` | Pinned schema, semantic contracts and coverage ledger | [Coverage ledger](../contracts/agents-api/index.md) |
 
 ## Choose an extension boundary
diff --git a/docs/getting-started/install-options.md b/docs/getting-started/install-options.md
index 2e5063800..98820b38f 100644
--- a/docs/getting-started/install-options.md
+++ b/docs/getting-started/install-options.md
@@ -10,22 +10,20 @@ Pass options to the downloaded script:
 ./install.sh --public-url https://core.example
 ```
 
-With the one-line command, append them after `bash -s --`. The release downloader also accepts `--version TAG` to select a published release; otherwise it selects the latest stable release. It verifies the bundle's SHA-256 before extracting it and keeps the verified bundle for [repair](./operations.md#installation-version-policy).
-
-The installer prints each stage, then a summary of addresses, sign-in details and next steps. Set `NO_COLOR=1` to disable colors. A failed step stops installation without a success message.
+With the one-line command, append them after `bash -s --`. `--version TAG` selects a published release; otherwise the script selects the latest stable release and verifies each Compose file's SHA-256. A failed step stops installation without a success message.
 
 ## Docker Compose and hosting platforms
 
-Use the self-contained [Compose template](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/compose/compose.yaml) with Docker Compose 2.26 or newer on Linux amd64. It pulls the existing, digest-pinned v0.0.3 images and starts PostgreSQL, Core, Web and an HTTP gateway. The one-time initialization service generates random secrets in persistent volumes and prepares the node installer; the migration service initializes the database before Core starts. [Compose configuration](../configuration.md#compose-installations) owns the settings and volumes.
+Use the `compose.yaml` from a release with Docker Compose 2.26 or newer on Linux amd64. The release renders node metadata into the [Compose template](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/compose/compose.yaml). Core and Web use the `latest` images, and PostgreSQL uses `postgres:16-alpine`. It starts PostgreSQL, Core and Web. Web forwards `/v1` and `/api/v1` to Core. Data is bind-mounted from a directory. The one-time initialization service generates random secrets there and prepares the node installer; Core applies database migrations when it starts. [Compose configuration](../configuration.md#compose-installations) owns the settings and the data directory.
 
-For a local trial, download `compose.yaml` and the [local port override](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/compose/local.yaml) into one directory, then run:
+For a local trial, download `compose.yaml` and `ports.yaml` from the same release into one directory, then run:
 
 ```sh
-docker compose -f compose.yaml -f local.yaml up -d --wait --wait-timeout 900
-docker compose -f compose.yaml run --rm credentials
+docker compose -f compose.yaml -f ports.yaml up -d --wait --wait-timeout 900
+docker compose -f compose.yaml exec web oac-web core-key
 ```
 
-The `credentials` command prints the generated Core key to your terminal without storing it in container logs. Open `http://localhost:8080` and use that key to sign in. All installation secrets are generated automatically; keep the same Compose project and its volumes when restarting.
+`oac-web core-key` prints the generated Core key to your terminal without writing it to container logs. Open `http://localhost:8080` and use that key to sign in. All installation secrets are generated automatically; keep the same Compose project and its data directory when restarting.
 
 The first initialization downloads and verifies the release's approximately 385 MB control archive, retaining only the small node installation metadata. Later starts verify the saved files without downloading again. Image downloads are additional. An interrupted first initialization can be rerun; an existing database with missing installation secrets is refused.
 
@@ -33,140 +31,78 @@ You can deploy before choosing a domain: leave `OAC_PUBLIC_URL` unset or empty,
 
 ### Dokploy
 
-Create a Docker Compose application and paste `compose.yaml`. Set `OAC_PUBLIC_URL` to the public HTTPS origin, enable isolated deployment, and add a domain for service `gateway`, port `8080`. Enable **HTTPS** and select a certificate provider such as **Let's Encrypt** for that domain before deploying. Deploy without `local.yaml`; internal services publish no host ports. The [template metadata](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/compose/dokploy.toml) supplies the generated domain and environment when packaging this Compose file for Dokploy's template catalog; HTTPS and its certificate provider still need to be enabled after import.
+Create a Docker Compose application and paste `compose.yaml`. Set `OAC_PUBLIC_URL` to the public HTTPS origin, enable isolated deployment, and add a domain for service `web`, port `8080`. Enable **HTTPS** and select a certificate provider such as **Let's Encrypt** for that domain before deploying. Deploy without `ports.yaml`; internal services publish no host ports. The [template metadata](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/compose/dokploy.toml) supplies the generated domain and environment when packaging this Compose file for Dokploy's template catalog; HTTPS and its certificate provider still need to be enabled after import.
 
 ### Coolify
 
-Create a **Docker Compose Empty** service and paste `compose.yaml`. Set `OAC_PUBLIC_URL` to the public HTTPS origin and assign that domain to `gateway` on port `8080`. Add Coolify's `exclude_from_hc: true` to the `init`, `migrate` and `credentials` service definitions so completed initialization and optional tooling do not affect its overall health. Save and deploy without `local.yaml`; Coolify supplies HTTPS.
+Create a **Docker Compose Empty** service and paste `compose.yaml`. Set `OAC_PUBLIC_URL` to the public HTTPS origin and assign that domain to `web` on port `8080`. Add Coolify's `exclude_from_hc: true` to the `init` service definition so completed initialization does not affect its overall health. Save and deploy without `ports.yaml`; Coolify supplies HTTPS.
 
-On either platform, open its server terminal and run `docker compose ls` to find the deployed project name and Compose file. Using those exact values and the deployment's `OAC_PUBLIC_URL`, run `docker compose -p <project-name> -f <compose-file> run --rm credentials`, then sign in at the configured origin. The [Dokploy domain guide](https://docs.dokploy.com/docs/core/docker-compose/domains) and [Coolify Compose guide](https://coolify.io/docs/services/configuration/docker-compose) describe their domain and service controls. These are importable deployment files; no hosted marketplace listing is published by this repository.
+On either platform, open its server terminal and run `docker compose ls` to find the deployed project name and Compose file. Using those exact values and the deployment's `OAC_PUBLIC_URL`, run `docker compose -p <project-name> -f <compose-file> exec web oac-web core-key`, then sign in at the configured origin. The [Dokploy domain guide](https://docs.dokploy.com/docs/core/docker-compose/domains) and [Coolify Compose guide](https://coolify.io/docs/services/configuration/docker-compose) describe their domain and service controls. These are importable deployment files; no hosted marketplace listing is published by this repository.
 
 After signing in, choose the sandbox backend and add nodes using [Nodes](./nodes.md). The Compose stack deploys the control plane; execution machines remain separate.
 
-Stop with `docker compose stop` using the same files and environment. Back up all [installation volumes](../configuration.md#compose-installations) together while the services are stopped. Follow the [installation version policy](./operations.md#installation-version-policy): a different release needs a new Compose project and fresh volumes.
+Stop with `docker compose stop` using the same files and environment. Back up the data directory together while the services are stopped. Follow the [installation version policy](./operations.md#installation-version-policy): a different release needs a new Compose project and a fresh data directory.
 
 ## Process settings
 
-These flags seed the installation's `config.json` once. Their defaults, valid values and restart behavior are defined in the [configuration reference](../configuration.md#settings). After installation, edit that file and run `oac apply`; rerunning the installer only [repairs](./operations.md#installation-version-policy) the installation.
+These flags are written to `.env` once. After installation, edit that file and run `oac apply`. Rerunning the installer does not change an installation that has already started.
 
-[//]: # (BEGIN install-flags: generated by scripts/config-reference.py)
-| Flag | config.json field |
+| Flag | `.env` variable |
 | --- | --- |
-| `--public-url` | `public_url` |
-| `--host` | `host` |
-| `--core-port` | `ports.core` |
-| `--web-port` | `ports.web` |
-| `--ingress` | `ingress` |
-[//]: # (END install-flags)
+| `--public-url` | `OAC_PUBLIC_URL` |
+| `--host` | `OAC_HOST` |
+| `--web-port` | `OAC_WEB_PORT` |
 
-`--config FILE` seeds `config.json` from a JSON file instead of these setting flags; they cannot be combined. A `--config` document follows the schema defaults, so set `ingress: "managed"` and `host: "0.0.0.0"` in it for managed HTTPS.
 
 ## Installation actions
 
-These options choose an installation location or perform initial setup; they are not saved in `config.json`.
+`--install-dir` chooses where the installation is created. It is not a process setting.
 
 | Option | Purpose |
 | --- | --- |
 | `--install-dir DIR` | Absolute installation directory; defaults to `~/.oac/core`. A new installation requires an empty or missing directory, or one holding an [installation that never started](./install.md#install) |
 
-Several installations can share a machine when they use distinct installation directories and ports. Only one installation with managed HTTPS can hold [ports 80 and 443](#ports) on an IP address; use distinct IP addresses or an external shared proxy for more. Each installation has its own database, Core key and nodes.
+Several installations can share a machine when they use distinct installation directories and ports. Use distinct IP addresses or a shared reverse proxy for more. Each installation has its own database, Core key and nodes.
 
 ## Sandbox backend
 
-After the services are healthy, the installer saves microsandbox at the Standard size in Web's [`standard-sizes.json`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/web/src/features/sandbox/standard-sizes.json). The choice is stored in Core's database, not in `config.json`, and a repair does not change it. If Core refuses the choice, the installer prints Core's message and exits; the services keep running and you choose the backend in Web.
-
-To use Docker or E2B, or another size, open **System** → **Manage sandbox configuration** and [reset the deployment](./nodes.md#change-the-sandbox-configuration). Docker shares each node's kernel with its sandboxes, and its node service account is [root-equivalent](./nodes.md#what-the-installer-sets-up). E2B needs a public HTTPS URL that is not loopback, because E2B's sandboxes call Core from E2B's cloud. Prepare an E2B template with the [E2B guide](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/deploy/e2b/README.md).
+The installer saves no sandbox backend. After signing in, open **System** → **Manage sandbox configuration** and choose Docker, microsandbox or E2B; Web proposes the Standard size in [`standard-sizes.json`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/web/src/features/sandbox/standard-sizes.json). The choice is stored in Core's database. To change it later, [reset the deployment](./nodes.md#change-the-sandbox-configuration). Docker shares each node's kernel with its sandboxes, and its node service account is [root-equivalent](./nodes.md#what-the-installer-sets-up). E2B needs a public HTTPS URL that is not loopback, because E2B's sandboxes call Core from E2B's cloud. Prepare an E2B template with the [E2B guide](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/deploy/e2b/README.md).
 
 ## Listeners and access
 
-The default installation selects `--ingress managed` and `--host 0.0.0.0`. Its gateway publishes Web on `--web-port` (8080 by default), and [ports 80 and 443](#ports) once HTTPS is on. Core's `--core-port` stays on loopback and PostgreSQL stays private. `--host` accepts IPv4 or IPv6, without a port, scheme or zone. Use a concrete server IP in the browser, not a wildcard. Managed ingress needs a local Docker Unix socket.
+The default installation publishes Web on `--web-port` (8080) at `--host 0.0.0.0`. Core's admin API stays on `127.0.0.1:8091`. PostgreSQL stays private. `--host` is an IPv4 or IPv6 address, without a port, scheme or zone. Use a concrete server IP in the browser, not a wildcard.
 
-`--ingress external` uses your own reverse proxy instead. Core and Web then listen on `--host`, loopback by default. External non-loopback listeners require an HTTPS `public_url` and a [reverse proxy](#https-and-the-reverse-proxy), and Web's domain setup is unavailable: set `public_url` in `config.json` and run `oac apply`.
-
-`--public-url` seeds a DNS-based HTTPS origin for unattended setup; with managed ingress, the certificate and connectivity checks must pass. The ingress mode is fixed for an installation.
+`--public-url` sets `OAC_PUBLIC_URL`, the origin applications, nodes and executors use. Set it to the HTTPS origin your reverse proxy serves.
 
 ### Ports
 
-Before it verifies the bundle or loads images, the installer checks `--host` and every port the installation will listen on: Web's, Core's, and 80 and 443 with managed ingress and `--public-url`.
+The installer checks `--web-port` before it downloads images.
 
-- `--host` must be an address of this machine, or a wildcard such as `0.0.0.0`.
-- A port set with `--web-port`, `--core-port` or in the `--config` file must be free, and so must a port that a loopback `--public-url` names, such as 8080 in `http://localhost:8080`. Otherwise the installer stops, names the port and prints the `ss` command that finds the program holding it.
-- A Web or Core port you leave out moves to the first free port above its default, at most 20 above, and never to another port of the same installation. The installer writes the chosen port to `config.json` and names it in the summary, for example `Port 8080 was in use; Web uses 8081.`
-- Managed ingress uses ports 80 and 443 only for HTTPS and never moves them. The gateway publishes them once `public_url` is set, from `--public-url` or [domain setup in Web](./install.md#configure-the-domain-and-https), and no other program on the host may use them. If either is in use at installation, free it, install without `--public-url` and set up the domain later, or install with `--ingress external` and use your own [reverse proxy](#https-and-the-reverse-proxy).
+- `--host` is the address that port binds. `0.0.0.0` publishes Web on every IPv4 interface. `127.0.0.1` keeps Web on this machine.
+- A busy port stops installation. It does not move to another port.
 
-After installation, `oac apply` [checks the ports](../configuration.md#how-oac-apply-works) of a changed `host` or port, and 80 and 443 when `public_url` turns HTTPS on. Domain setup in Web and `oac domain` check, before they start, that the hostname resolves and that no other program holds port 80 or 443, and name the port that is in use.
+`oac apply` recreates Web when `OAC_HOST` or `OAC_WEB_PORT` changes.
 
 ## HTTPS and the reverse proxy
 
-With external ingress, Core and Web share one public origin. Your reverse proxy terminates TLS and routes by path:
-
-| Path | Goes to | Callers |
-| --- | --- | --- |
-| `/v1`, `/v1/*` | Core, `127.0.0.1:8091` by default | Applications, with a Project API key |
-| `/api/v1/*` | Core, `127.0.0.1:8091` | Nodes, sandboxes and self-hosted machines. Uses WebSockets |
-| Everything else | Web, `127.0.0.1:8080` by default | Browsers, and node installers at `/node-install/*` |
+Install with `--host 127.0.0.1` and point your reverse proxy at Web, `127.0.0.1:8080` by default. Web routes `/v1`, `/api/v1` and `/docs` to Core and serves everything else itself.
 
 The proxy must:
 
-- **Preserve Host.** Web accepts only the host of its public URL.
+- **Preserve Host.** Web accepts only the host of `OAC_PUBLIC_URL`.
 - **Pass WebSocket upgrades** on `/api/v1`.
 - **Not buffer or time out streams.** `/v1` streams Session events.
 - **Accept large uploads.** Source files may reach 512 MiB; Core enforces the limits.
 
-Run the proxy on the Core host while Core and Web listen on loopback, the default. `oac status` prints these routes with your addresses and ports.
-
 **Caddy** obtains the certificate itself and passes Host and WebSockets by default:
 
 ```caddyfile
 core.example {
-	@core path /v1 /v1/* /api/v1/*
-	handle @core {
-		reverse_proxy 127.0.0.1:8091
-	}
-	handle {
-		reverse_proxy 127.0.0.1:8080
-	}
-}
-```
-
-**nginx**, for example in `/etc/nginx/conf.d/oac.conf` inside the `http` block:
-
-```nginx
-map $http_upgrade $connection_upgrade {
-    default upgrade;
-    ''      close;
-}
-
-server {
-    listen 80;
-    server_name core.example;
-    return 301 https://$host$request_uri;
-}
-
-server {
-    listen 443 ssl;
-    server_name core.example;
-    ssl_certificate     /etc/letsencrypt/live/core.example/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/core.example/privkey.pem;
-
-    client_max_body_size 0;          # Core enforces its own upload limits
-    proxy_http_version 1.1;
-    proxy_set_header Host $http_host;
-    proxy_set_header Upgrade $http_upgrade;
-    proxy_set_header Connection $connection_upgrade;
-    proxy_buffering off;             # server-sent events on /v1
-    proxy_request_buffering off;
-    proxy_read_timeout 1h;           # long-lived WebSockets and streams
-    proxy_send_timeout 1h;
-
-    location = /v1    { proxy_pass http://127.0.0.1:8091; }
-    location /v1/     { proxy_pass http://127.0.0.1:8091; }
-    location /api/v1/ { proxy_pass http://127.0.0.1:8091; }
-    location /        { proxy_pass http://127.0.0.1:8080; }
+	reverse_proxy 127.0.0.1:8080
 }
 ```
 
-Then set `public_url` in `~/.oac/core/config.json` and run `~/.oac/core/oac apply`. Check the routing:
+Then set `OAC_PUBLIC_URL=https://core.example` in `~/.oac/core/.env` and run `~/.oac/core/oac apply`. Check the routing:
 
 ```sh
 curl -s -o /dev/null -w '%{http_code}\n' -H 'OpenAI-Beta: agents=v1' https://core.example/v1/agents
@@ -183,22 +119,16 @@ A [Cloudflare quick tunnel](https://developers.cloudflare.com/cloudflare-one/con
 ```caddyfile
 http://:8443 {
 	bind 127.0.0.1
-	@core path /v1 /v1/* /api/v1/*
-	handle @core {
-		reverse_proxy 127.0.0.1:8091
-	}
-	handle {
-		reverse_proxy 127.0.0.1:8080
-	}
+	reverse_proxy 127.0.0.1:8080
 }
 ```
 
 1. Start the proxy: `caddy run --config Caddyfile`.
 2. Start the tunnel: `cloudflared tunnel --url http://127.0.0.1:8443`. It prints an address such as `https://random-words.trycloudflare.com`.
-3. Set that address as `public_url` in `~/.oac/core/config.json` and run `~/.oac/core/oac apply`.
+3. Set that address as `OAC_PUBLIC_URL` in `~/.oac/core/.env` and run `~/.oac/core/oac apply`.
 
 The address changes whenever `cloudflared` restarts; nodes bound to the old address must then be added again. Throughput is low, so a node's first Runtime download (about 500 MB) can be slow; see [slow links](./nodes.md#rerun-expiry-and-slow-links).
 
 ## Offline hosts
 
-Transfer the release's `*-linux-amd64-offline.tar.gz` and its `.sha256` file, verify and extract them, then run the bundled `./install.sh`. The offline bundle also carries the node and Runtime files, so Web serves them to nodes without release access.
+This installer does not install from an offline bundle. It downloads Compose files and container images from the release.
diff --git a/docs/getting-started/install.md b/docs/getting-started/install.md
index dd894f127..6fb9d6705 100644
--- a/docs/getting-started/install.md
+++ b/docs/getting-started/install.md
@@ -2,12 +2,12 @@
 title: "Install Core and Web"
 ---
 
-One command installs Core, the Web console and PostgreSQL on a Linux host. Web is the administrator console: you sign in with the Core key, give the installation a domain, set a default model and issue Project API keys. Applications then call Core's API with those keys, and their Sessions run in sandboxes on nodes you add, or on E2B.
+One command installs Core, the Web console and PostgreSQL on a Linux host. Sign in to Web with the Core key, set a default model and issue Project API keys. Applications call Core with those keys. Sessions run in sandboxes on nodes you add, or on E2B.
 
 1. [Check the prerequisites](#prerequisites).
 2. [Run the installer](#install).
 3. [Sign in to Web](#sign-in-to-web).
-4. [Configure the domain and HTTPS](#configure-the-domain-and-https).
+4. [Configure the public address](#configure-the-domain-and-https).
 5. [Set a default model](#set-a-default-model).
 6. [Issue a Project API key](#issue-a-project-api-key).
 7. [Add sandbox capacity](#add-sandbox-capacity).
@@ -16,11 +16,11 @@ This page follows the default path. Every flag, existing reverse proxies and off
 
 ## Prerequisites
 
-- Linux amd64 with Python 3.9 or newer, and curl. No GitHub account or CLI is needed.
+- Linux amd64 and curl.
 - Docker Engine with Docker Compose 2.26.0 or newer (`docker compose version`).
 - An account that can run `docker` and write to its home directory. Ordinary users and root both work; the installer never calls sudo.
-- A free port each for initial Web access (8080) and Core (8091, on loopback), and free ports 80 and 443 once you turn on HTTPS; see [ports](./install-options.md#ports). Docker must be able to publish them; the installer does not change host policy.
-- A DNS hostname that points to this host, before you connect applications, nodes, E2B or self-hosted machines. You can install and sign in first.
+- Free port 8080 for Web. Core's admin API uses `127.0.0.1:8091`. See [ports](./install-options.md#ports). Docker must be able to publish them; the installer does not change host policy.
+- For anything off this machine, the origin in `OAC_PUBLIC_URL` must be the address browsers, nodes and executors use. You can sign in on this machine first.
 
 The Core host needs no KVM; nodes that run microsandbox do.
 
@@ -30,52 +30,39 @@ The Core host needs no KVM; nodes that run microsandbox do.
 curl -fsSL https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.sh | bash
 ```
 
-If DNS already points to this host, pass the address to set up HTTPS during installation instead of in step 4:
+If a reverse proxy already serves this host, pass its HTTPS address:
 
 ```sh
 curl -fsSL https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.sh | bash -s -- --public-url https://core.example
 ```
 
-The script picks the latest stable release, verifies its checksum and runs the bundled installer, which:
+The script downloads that release's Compose files, checks their SHA-256, and:
 
-1. checks its settings and the ports it needs, then the host, and loads the Core, Web, PostgreSQL and HTTPS gateway images;
-2. creates the [installation directory](../configuration.md#installation-directory), `~/.oac/core`, with the Core key, `config.json` and the `oac` management command;
-3. starts the services with Docker Compose. The gateway serves Web on all IPv4 interfaces, at the port the installer prints; Core stays on loopback and PostgreSQL stays private;
-4. selects the microsandbox sandbox backend at the Standard size. It adds no node.
+1. checks Linux amd64, Docker Compose 2.26 or newer, and that the ports it will publish are free;
+2. creates the [installation directory](../configuration.md#installation-directory), `~/.oac/core`, writes `.env`, and copies the `oac` command out of the Core image;
+3. starts the services with Docker Compose. Web serves the console on port 8080 and forwards `/v1`, `/api/v1` and `/docs` to Core. Core's admin API stays on `127.0.0.1:8091`. PostgreSQL is not published.
 
-It creates no Project or key and makes no model request. It ends by printing the console address, the API base URL and the next steps.
+It saves no sandbox backend, adds no node, creates no Project or key and makes no model request. It ends by printing the console address and how to read the Core key.
 
-Downloads retry temporary network failures automatically. The terminal shows download progress and activity during long steps.
-
-If installation fails or is interrupted before the services first become healthy, fix the reported cause and rerun the same command. The installer removes its temporary download, new service project, volumes and installation files; loaded Docker images remain reusable. A rerun first clears an incomplete installation or download left by a forced exit or power loss. It never clears another active installation process or an unrelated directory. Once the services have started successfully, failures preserve the installation and its data; use [same-release repair](./operations.md#installation-version-policy).
+If installation fails before the services become healthy, the installer removes the directory it created. Fix the reported cause and rerun the same command. Once the services have started, a later failure keeps the installation and its data. A new release is a new directory; see [version policy](./operations.md#installation-version-policy).
 
 For insufficient space or quota, free space on the filesystem named by the error. Image-loading failures can also require space in Docker's storage, which may be on a different filesystem.
 
 ## Sign in to Web
 
-1. Open the console address the installer printed, such as `http://SERVER_IP:8080`, or your public URL if you passed one. Behind NAT, use the IP address your browser reaches. Until a domain is set, Web accepts IP addresses only, not host names.
+1. On this machine, open `http://localhost:8080`, or the origin you passed with `--public-url`. Web accepts only that host.
 2. Sign in with the [Core key](./operations.md#core-key), the installation's administrator credential. Web has no user accounts.
 
    ```sh
-   cat ~/.oac/core/secrets/core.key
+   ~/.oac/core/oac core-key --show
    ```
 
-## Configure the domain and HTTPS
-
-Applications, nodes and sandboxes reach Core at one HTTPS address, the public URL. The initial HTTP address serves only Web.
-
-1. Point the hostname's A/AAAA records to this host, allow inbound ports 80 and 443 from the internet, and keep other programs off [those ports](./install-options.md#ports).
-2. In Web, open **System**, choose **Configure domain and HTTPS**, enter the hostname, such as `core.example.com`, and choose **Apply**.
-
-The installation checks DNS and the ports, requests a certificate and checks that the HTTPS address reaches this installation before switching Core and Web to it. Then open the HTTPS address and sign in again; the initial HTTP address redirects there. Certificates renew automatically. If DNS or the certificate fails, the previous address stays in use: correct the reported problem and retry. Retry an interrupted switch with the same hostname, or check it with `oac status` and finish it with `oac apply`.
+## Configure the public address {#configure-the-domain-and-https}
 
-The same operation from a terminal:
-
-```sh
-~/.oac/core/oac domain core.example.com
-```
+Applications, nodes and sandboxes reach Core at one HTTPS address, the public URL.
 
-To change the address later, see [changing the public URL](../configuration.md#changing-the-public-url).
+1. Point your reverse proxy at Web.
+2. Set `OAC_PUBLIC_URL` to the HTTPS origin it serves, then run `oac apply`. See [changing the public URL](../configuration.md#changing-the-public-url).
 
 ## Set a default model
 
@@ -92,6 +79,6 @@ Web's **Overview** tracks these steps in a **Getting started** checklist.
 
 Sessions need somewhere to run:
 
-- **Nodes** run the microsandbox backend the installer selected: [add a node](./nodes.md) from Web's **Nodes** page. Docker and E2B are chosen later with [Reset deployment](./nodes.md#change-the-sandbox-configuration).
+- Choose the backend in **System** → **Manage sandbox configuration**, then [add a node](./nodes.md) from **Nodes**. The installer selects none.
 
 Day-to-day operation, backups and upgrades are in [Operations](./operations.md).
diff --git a/docs/getting-started/nodes.md b/docs/getting-started/nodes.md
index 668eceb4e..366a8e391 100644
--- a/docs/getting-started/nodes.md
+++ b/docs/getting-started/nodes.md
@@ -8,9 +8,9 @@ You add a node by generating a command in Web and running it on the host. The [s
 
 ## Before you add a node
 
-- **Core has an HTTPS public URL** that the host and its sandboxes can reach. Nodes download from Core's console and connect to Core at `public_url`. Until it is set, Add node says *Configure a domain and HTTPS in System before adding nodes*; see [Configure the domain and HTTPS](./install.md#configure-the-domain-and-https), or with external ingress [change the public URL](../configuration.md#changing-the-public-url).
-- **The sandbox configuration is saved.** The installer saves microsandbox at the Standard size. To use Docker or another size, open **System** → **Manage sandbox configuration**, choose **Reset deployment**, then **Own machines**, the backend and a sandbox size, and **Save configuration**. Every node of an installation uses that backend.
-- **The console can serve the node files.** Nodes download their Runtime and provider files from the console, which redirects to the release for files it does not hold, and check each file's size and SHA-256 against the release manifest. For hosts without access to the release, install Core from the [offline bundle](./install-options.md#offline-hosts) so the console holds every file. Without the files, Add node says *This console has no node files for …*.
+- **Core has an HTTPS public URL** that the host and its sandboxes can reach. Nodes download from Core's console and connect to Core at `public_url`. Until it is set, Add node says *Set a public HTTPS address before adding nodes*; see [Configure the public address](./install.md#configure-the-domain-and-https).
+- **The sandbox configuration is saved.** Open **System** → **Manage sandbox configuration**, choose **Own machines**, the backend and a sandbox size, and **Save configuration**. To change a saved configuration, choose **Reset deployment** first. Every node of an installation uses that backend.
+- **The console can serve the node files.** Nodes download their Runtime and provider files from the console, which redirects to the release for files it does not hold, and check each file's size and SHA-256 against the release manifest. Node hosts therefore need access to the release. Without the files, Add node says *This console has no node files for …*.
 
 The Core host joins like any other host: to run sandboxes on it, add it as a node.
 
diff --git a/docs/getting-started/operations.md b/docs/getting-started/operations.md
index f4336f65a..82e64d9f6 100644
--- a/docs/getting-started/operations.md
+++ b/docs/getting-started/operations.md
@@ -9,23 +9,20 @@ The installation operator owns the Core host, its storage and its availability.
 Each installation has its own management command in its directory. It needs neither the bundle nor root:
 
 ```sh
-~/.oac/core/oac status
+docker compose -f ~/.oac/core/compose.yaml ps
 ```
 
 | Command | What it does |
 | --- | --- |
-| `oac status` | Shows each service and its health, Core and Web health, the public URL, API base URL, console address and source commit, the routes a reverse proxy needs, `config.json` changes not applied yet and generated files edited by hand. Exits non-zero when a service is unavailable. It never calls a model |
-| `oac start` | Starts every service with the files last written by `apply`; warns about unapplied changes |
-| `oac stop` | Stops PostgreSQL, Core and Web. Data, nodes and sandboxes are kept, and running sandbox work may continue |
-| `oac apply` | Applies `config.json` and restarts what changed; see [how apply works](../configuration.md#how-oac-apply-works) |
-| `oac apply --dry-run` | Shows the changed settings, files and restarts, and changes nothing |
-| `oac apply --discard-edits` | Overwrites generated files edited by hand, keeping each as `generated/<file>.edited-<time>` |
-| `oac apply --confirm-public-url-change URL` | Confirms a public URL change without a prompt; must equal the new URL |
-| `oac domain HOSTNAME [--confirm-public-url-change URL]` | Managed ingress: sets the public URL to `https://HOSTNAME`, as **Configure domain and HTTPS** in Web does; see [Configure the domain and HTTPS](./install.md#configure-the-domain-and-https) |
-| `oac rotate-core-key [--yes]` | Replaces the Core key; see [Rotate the Core key](#rotate-the-core-key) |
-| `oac uninstall [--yes]` | Removes the installation and all its data from this host; see [Uninstall](#uninstall) |
-
-For a second installation, use its own command, such as `~/.oac/second/oac status`.
+| `docker compose ps` | Shows the services. Run it in the installation directory |
+| `docker compose start` | Starts the services |
+| `docker compose stop` | Stops the services. Data, nodes and sandboxes are kept |
+| `oac apply` | Runs `oac-core check-config`, then `docker compose up -d --wait`. A failed check changes no service |
+| `oac core-key [--show]` | Prints the Core key path, or the key itself with `--show` |
+| `oac rotate-core-key` | Replaces the Core key and restarts Core and Web |
+| `docker compose down --rmi all` | Removes the containers and images. Delete the installation directory afterwards |
+
+For a second installation, use its directory, such as `~/.oac/second`.
 
 ## Service health
 
@@ -33,7 +30,7 @@ Use these observations for different questions:
 
 | Observation | What it establishes |
 | --- | --- |
-| `oac status`, PostgreSQL health | The database accepts its readiness check |
+| `docker compose ps` | The database accepts its readiness check |
 | Core `/healthz` | Core's process is alive |
 | An authenticated API read | The caller's key works for that resource |
 | Environment connection | The Runtime transport is connected |
@@ -42,8 +39,8 @@ Use these observations for different questions:
 Service health does not show that a harness or a model works. Use Session, Turn, Items and Usage reads for execution, and Web's **Nodes** page for node connection, readiness and placement. For local diagnosis, use the installation's own Compose file:
 
 ```sh
-docker compose -f "$HOME/.oac/core/generated/compose.json" ps --all
-docker compose -f "$HOME/.oac/core/generated/compose.json" logs --tail 200 core
+docker compose -f "$HOME/.oac/core/compose.yaml" ps --all
+docker compose -f "$HOME/.oac/core/compose.yaml" logs --tail 200 core
 ```
 
 Don't paste `docker compose config`, `docker inspect` or raw logs into public issue reports.
@@ -53,8 +50,8 @@ Don't paste `docker compose config`, `docker inspect` or raw logs into public is
 Let active work settle before a planned restart:
 
 ```sh
-~/.oac/core/oac stop
-~/.oac/core/oac start
+docker compose -f ~/.oac/core/compose.yaml stop
+docker compose -f ~/.oac/core/compose.yaml start
 ```
 
 Stopping Core stops no node and no sandbox. Node services, their microVMs and Docker containers keep running; stopping is not a way to reclaim compute. A Core restart does not continue an interrupted native tool call transparently. After reconnecting, query the same Session; don't create a new Session to replay uncertain work. Session event streams are live only; recover through Session, Turn and Items reads.
@@ -63,13 +60,13 @@ A Web restart, including one caused by `oac apply`, signs everyone out of the co
 
 ## Core key
 
-Each installation has one administrator credential, the Core key. The installer generates a 64-character random key in `<install dir>/secrets/core.key`, by default `~/.oac/core/secrets/core.key`. The Core key:
+Each installation has one administrator credential, the Core key. The installer generates a 64-character random key in `data/secrets/web/core.key`. Read it with `oac core-key --show`; the file is owned by the container user. The Core key:
 
 - signs in to Web. The browser gets an HttpOnly session cookie, never the key;
 - authorizes Core API (`/core/v1`) requests sent as `Authorization: Bearer <Core key>`;
 - never authorizes the Agents API (`/v1`). Applications use Project API keys, which in turn can't call `/core/v1`.
 
-Keep it private: `secrets/` is mode `0700` and its files `0600`. Web and, with managed ingress, the `installation` service read `core.key`; Core reads only its SHA-256 from `generated/core-key-digests.json`, which `oac apply` derives from the key. A Core key has at least 32 characters and no whitespace. Web limits failed sign-ins.
+Keep it private. Web reads `data/secrets/web/core.key`. Core reads only its SHA-256 from `data/secrets/core/core-key-digests.json`. A Core key has at least 32 characters and no whitespace. Web limits failed sign-ins.
 
 ### Script the Core API
 
@@ -78,7 +75,7 @@ Run scripts on the Core host against Core's loopback port. This helper reads the
 ```sh
 core() {  # core METHOD PATH [JSON body]
   curl -fsS -X "$1" "http://127.0.0.1:8091/core/v1$2" \
-    -H @<(printf 'Authorization: Bearer %s\n' "$(cat ~/.oac/core/secrets/core.key)") \
+    -H @<(printf 'Authorization: Bearer %s\n' "$(~/.oac/core/oac core-key --show)") \
     -H 'Content-Type: application/json' ${3:+-d "$3"}
 }
 ```
@@ -102,7 +99,7 @@ The [Core administration API](../../contracts/agents-api/admin-api.md) lists eve
 ~/.oac/core/oac rotate-core-key
 ```
 
-It refuses while `config.json` has changes that are not applied or a generated file was edited by hand: run `oac apply` first. It asks for confirmation (`--yes` skips it), stops Web, writes a new key to `secrets/core.key` and regenerates the digest file. On a running installation it then restarts Core, starts Web and checks that Core accepts the new key and refuses the old one; a stopped installation only gets the new files and uses the new key at the next `oac start`. The old key stops working as soon as Core restarts, and every console session ends: sign in again and update your scripts. If the command stops early, `secrets/core.key` holds the key to use; run `oac apply` to finish.
+It writes a new key to `data/secrets/web/core.key`, regenerates `data/secrets/core/core-key-digests.json`, and restarts Core and Web. The old key stops working as soon as Core restarts, and every console session ends: sign in again and update your scripts.
 
 ## Projects and API keys
 
@@ -125,32 +122,31 @@ Back up these together; a restore needs all of them:
 - the PostgreSQL volume `<project>_database`. It holds Projects, key digests, nodes, default models, encrypted credentials and all execution history, including large objects. A logical dump:
 
   ```sh
-  docker compose -f "$HOME/.oac/core/generated/compose.json" exec -T database \
+  docker compose -f "$HOME/.oac/core/compose.yaml" exec -T database \
     pg_dump -U agents_api agents_api > oac-backup.sql
   ```
 
-- the installation directory: `config.json`, `state.json` (installation ID) and `secrets/`. `credential.key` must stay with the database, or stored credentials can't be decrypted; never regenerate it to get past an error.
-- `state/e2b/`, when E2B is used: receipts Core needs to clean up E2B sandboxes.
+- the installation directory, especially `data/`. `data/secrets/core/credential.key` must stay with the database, or stored credentials can't be decrypted.
 - each node's state directory on its host, `/var/lib/oac-node/.oac/nodes/<installation-id>/`, with its provider storage: Docker volumes or microsandbox's store. See [when a node host fails](./nodes.md#when-a-node-host-fails) for restoring them.
-- the bundle you installed from, to repair the same release.
+
+Stop with `docker compose stop`, archive the installation directory, then `docker compose start`.
 
 Never prune Docker volumes or delete native harness history to make a retry pass. A deleted Session does not prove that all provider resources were reclaimed.
 
 ## Uninstall
 
 ```sh
-~/.oac/core/oac uninstall
+docker compose -f ~/.oac/core/compose.yaml down --rmi all --remove-orphans
+rm -rf ~/.oac/core
 ```
 
-It removes the installation from this host: its Compose project with the containers, networks and database volume, the images the installer loaded, and the installation directory, including `secrets/` and the `oac` command itself. It keeps an image that has a tag or that another container uses, such as one of another installation of the same release, and says so.
-
-All data goes with it: Projects and API keys, Session history, stored credentials and the Core key. The database volume is useless without `secrets/`, so it is never kept on its own. To keep the data, stop the installation with `oac stop` instead, or [back it up](#back-up) first.
+`down` removes the containers and images. `rm` removes the installation directory. Do the first only when you mean to delete the data.
 
-The command lists what it removes and, when Core answers, the registered nodes. Confirm by typing the installation directory, or pass `--yes`, which a run without a terminal requires. It holds the installation lock and needs only `state.json`, so it also removes an installation that did not finish installing or lost `config.json`. It removes the directory last; if it stops part way, run it again.
+All data goes with it: Projects and API keys, Session history, stored credentials and the Core key. To keep the data, stop the installation with `docker compose stop` instead, or [back it up](#back-up) first.
 
 Uninstall stops no sandbox: node sandboxes keep running on their nodes, and E2B sandboxes keep running, and billing, at E2B. While Core is still up, archive their Sessions or [reset the deployment](./nodes.md#change-the-sandbox-configuration) and let it complete; the command shows how many sandboxes Core has in use.
 
-Nodes on other hosts keep running. To uninstall them the usual way, remove them in Web first, as in [Remove a node](./nodes.md#remove-a-node). After `oac uninstall` their Core is gone: on each node host, run the node uninstall command with `--force`, using `node-install.pyz` from the [bundle you installed from](#installation-version-policy). `oac uninstall` prints that command with the installation ID.
+Nodes on other hosts keep running. To uninstall them the usual way, remove them in Web first, as in [Remove a node](./nodes.md#remove-a-node). After the installation directory is gone, their Core is gone: on each node host, run the node uninstall command with `--force`, using `node-install.pyz` from the release that installed them. The installation ID is `data/secrets/core/installation.id`.
 
 ## Installation version policy
 
@@ -158,9 +154,9 @@ An installation runs one release for its whole life. In-place version upgrades a
 
 To move to a new release, install it into a new, empty directory, with its own database, Core key and nodes, and add nodes from its Web. Keep the old installation, its data and its nodes until their work is finished. Nodes run the program of the console that added them and are never upgraded in place; Core accepts only nodes that speak its own node protocol.
 
-Repair the current release by rerunning `./install.sh --install-dir DIR` from the exact same bundle; the downloader keeps it under `~/.oac/releases/`. Repair reloads missing images, restores the `oac` command, applies `config.json` and starts the services. It preserves identity, settings, secrets and history, accepts only `--install-dir`, and refuses a bundle from another release. An installation the installer never reported as running is not repaired but [removed and installed again](./install.md#install).
+`install.sh` refuses a directory that is not empty. If the first start fails, it deletes the directory it created, and the same command can be run again. An installation that has already started is left in place.
 
-The installer and mutating `oac` commands hold the same installation lock, `.oac.lock`, including during repair and interrupted apply recovery. If another command holds it, retry after that command finishes; never remove or replace `.oac.lock` to get past a busy installation. Reinstallation never deletes another installation's files, database, Runtime resources or Session history.
+Mutating `oac` commands hold `.oac.lock`. If another command holds it, retry after that command finishes. Never delete `.oac.lock` to get past a busy installation.
 
 ## Troubleshooting
 
@@ -169,36 +165,27 @@ The installer and mutating `oac` commands hold the same installation lock, `.oac
 | `Core installation requires Linux amd64 with Docker access` | Use Linux amd64 and an account with Docker access; root and ordinary users are supported |
 | `Installation failed: inspect prerequisites and private deployment files` | A prerequisite failed without its own message, most often Docker: check that `docker info` and `docker compose version` work for this user |
 | `Docker Compose 2.26.0 or newer is required …` | Update the Docker Compose plugin |
-| `Port N (…) is already in use on ADDRESS …` | Another program holds a port the installation needs. Find it with the printed `ss` command and stop it, or choose another port: `--web-port` or `--core-port` at [installation](./install-options.md#ports), or the port in `config.json` before `oac apply` |
-| `ADDRESS (…) is not an address of this machine …` | Set `--host`, or `host` in `config.json`, to one of the machine's IP addresses or a wildcard such as `0.0.0.0` |
-| `Automatic HTTPS needs ports 80 and 443 …` | Free the port the message names, install without `--public-url` and set up the domain later, or install with `--ingress external` and use your own [reverse proxy](./install-options.md#https-and-the-reverse-proxy) |
-| `Installation directory is not empty …` | Use an empty `--install-dir` |
-| `This installation is configured by …/config.json …` | Flags only seed a new installation: edit `config.json` and run `oac apply`. To start over with other flags, [uninstall](#uninstall) it first |
-| `This installation version is not supported …` | The target installation's state format or source revision does not match this release. Keep it, and install into another empty `--install-dir` ([version policy](#installation-version-policy)) |
-| `generated/<file> was edited by hand` | Put the change in `config.json`, then `oac apply --discard-edits` |
-| `config.json has changes that are not applied` | Run `oac apply` |
-| `Core rejects secrets/core.key …` | Run `oac apply`, which restarts Core with the key's digest |
-| `config.json not applied: …` | `oac apply` printed Core's startup error above; fix `config.json` and apply again |
+| `Port N is already in use.` | Another program holds that port. Stop it, or choose another `--web-port`. The installer does not move to a different port |
+| `Installation directory is not empty` | Use an empty `--install-dir`, or [uninstall](#uninstall) the existing installation first |
+| `configuration check failed; no service was changed` | `.env` has a value Core rejects. The message names the variable and not the value. Fix `.env` and run `oac apply` again |
+| `Docker Compose 2.26 or newer is required` | Update the Docker Compose plugin |
 | `The services did not start: …` | A new installation's first start failed, and the installer [removed what it created](./install.md#install). Compose's or Core's error is printed above it; fix the cause and run the same command again |
-| `Removal did not finish. Left: …` | The installer, cleaning up a failed new installation, or `oac uninstall` could not remove everything. Run the printed commands to remove what is left, or fix the cause and run the same command again |
+| `Removal did not finish. Left: …` | A failed first start could not remove everything. Run the printed commands to remove what is left, or fix the cause and run the same command again |
 | `This installation did not finish installing …` | The installer stopped before reporting that the services were running. Rerun the installer command, which [removes what is left](./install.md#install) and installs again, or [uninstall](#uninstall) it |
-| `… already in use on this server. Automatic HTTPS cannot run beside another program …` during domain setup | Another program holds port 80 or 443. Stop it, using the printed `ss` command to find it, and retry; automatic HTTPS cannot share [these ports](./install-options.md#ports) |
-| `HTTPS verification failed …` during domain setup | DNS points elsewhere, a firewall or NAT blocks inbound ports 80 and 443, or the certificate request failed; see [Configure the domain and HTTPS](./install.md#configure-the-domain-and-https) |
-| Web answers 403 `Forbidden` | Open exactly the console address `oac status` prints; a reverse proxy must pass the original Host |
-| `/v1` or `/api/v1` answers 404 | Those paths reach Web; route them to Core ([reverse proxy](./install-options.md#https-and-the-reverse-proxy)) |
-| Web shows that Core is unavailable (502) | Core is stopped or failing: `oac status`, then Core's log |
+| Web answers 403 `Forbidden` | The browser host is not `OAC_PUBLIC_URL`. Open that origin; a reverse proxy must pass the original Host |
+| Web shows that Core is unavailable (502) | Core is stopped or failing: `docker compose ps`, then Core's log |
 | Session creation returns 400 `model_provider_required` | No model provider: set a [default model](../configuration.md#default-models) for the harness, or pass one; self-hosted Sessions always pass their own |
 | Add node shows no command | See [Before you add a node](./nodes.md#before-you-add-a-node) |
 | A node is not ready | See [node troubleshooting](./nodes.md#troubleshooting) |
 
 ## Exposure and network policy
 
-| Listener | Managed ingress (default) | External ingress |
+| Listener | Host installation | Behind a reverse proxy |
 | --- | --- | --- |
-| Web | Reached only through the `gateway` service, which publishes `ports.web` (8080) on `host` (all IPv4 interfaces by default), plus [80 and 443](./install-options.md#ports) once HTTPS is on | `host:ports.web` (loopback by default), behind your reverse proxy |
-| Core | `127.0.0.1:ports.core` (8091); the gateway routes `/v1` and `/api/v1` to it | `host:ports.core`, behind your reverse proxy |
+| Web and the API | Web publishes `OAC_WEB_PORT` (8080) on `OAC_HOST` | Web publishes `OAC_WEB_PORT` on `OAC_HOST`. Your proxy should use `127.0.0.1` |
+| Core admin API | `127.0.0.1:8091`. Web forwards `/v1`, `/api/v1` and `/docs` | `127.0.0.1:8091`. Web forwards `/v1`, `/api/v1` and `/docs` |
 | PostgreSQL | No published port | No published port |
 
-Web signs administrators in with the Core key, checks the origin of every request, and forwards signed-in `/core/v1` requests to Core with the Core key, which stays on the server. It answers 404 on `/v1` and `/api/v1` whatever credential a request carries, serves only the non-secret node payload at `/node-install/`, and has no Docker or KVM access. Machine routes under `/api/v1` use their own enrollment and connection credentials. With managed ingress, the `installation` service applies domain changes through the Docker socket; Web reaches it only over a private Unix socket, and it checks the Core key on every request.
+Web signs administrators in with the Core key, checks the origin of every request, and forwards signed-in `/core/v1` requests to Core with the Core key, which stays on the server. It forwards `/v1` and `/api/v1` to Core unchanged, with the caller's own credential, serves only the non-secret node payload at `/node-install/`, and has no Docker or KVM access. Machine routes under `/api/v1` use their own enrollment and connection credentials. No service receives a Docker socket.
 
 Sandboxes are the isolation boundary ([Runtime and outer isolation](../concepts.md#runtime-and-outer-isolation)). Docker sandboxes share the node's kernel, and a Docker node is [root-equivalent](./nodes.md#what-the-installer-sets-up) on its host; microsandbox gives each sandbox a microVM with an explicit [network policy](./nodes.md#what-the-installer-sets-up). Core itself has no Docker socket or KVM access.
diff --git a/docs/maintainers.md b/docs/maintainers.md
index e166be7ed..e6cdaa05e 100644
--- a/docs/maintainers.md
+++ b/docs/maintainers.md
@@ -2,11 +2,11 @@
 title: "Build and release OpenAgentCore"
 ---
 
-This guide is for maintainers who build and publish OpenAgentCore. To install Core and Web, use the [installation guide](./getting-started/install.md). The rules the installer code follows are in [Installer design rules](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/install/README.md); required checks are in [CONTRIBUTING](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#required-checks).
+This guide is for maintainers who build and publish OpenAgentCore. To install Core and Web, use the [installation guide](./getting-started/install.md). The rules the installer code follows are in [Deployment](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/README.md) and [Node installer](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/node/README.md); required checks are in [CONTRIBUTING](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#required-checks).
 
 ## Build a distribution
 
-A distribution is the matched set of Linux amd64 release assets built from one commit: the control archive (the installer, the `oac` command, and the Core, Web, gateway and PostgreSQL images), the Runtime image and node artifacts as separate files, and the native installers.
+A distribution is the matched set of Linux amd64 release assets built from one commit: the control archive (the installer, the `oac` command, and the Core, Web, ingress and PostgreSQL images), the Runtime image and node artifacts as separate files, and the native installers.
 
 Build on Linux x86_64 with a glibc compatible with Debian 12, Docker, the Go version in `go.mod`, a C compiler (the microsandbox helper is a CGO build), Node, pnpm, Python 3.9 or newer, curl, tar, pigz and sha256sum. The source must be clean and committed. First prepare the pinned Codex package and MiniMax Code companion, then build:
 
@@ -35,7 +35,7 @@ make build-core-distribution
 
 The build reuses the Core, Web, Runtime, SDK and helper builders. The manifest records the commit and source tree, image config and OCI manifest digests, the Runtime OCI manifest digest, the microsandbox runtime and firmware hashes, and the size and SHA-256 of every Runtime and node artifact; native installers carry only their SHA-256 in the [catalog](#native-installers). Output is the control archive and its `.sha256`, the optional offline archive, and the versioned Runtime, node and native installer assets. Nothing is published. Rebuilding into a directory that already holds this commit's distribution is refused.
 
-The control archive carries no Runtime image or node execution artifacts; the offline archive carries them. The [download contract](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/install/README.md#download-contract) describes how nodes obtain them.
+The control archive carries no Runtime image or node execution artifacts; the offline archive carries them. The [download contract](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/node/README.md#download-contract) describes how nodes obtain them.
 
 A distribution carries the docs listed in `BUNDLED_DOCS` in `scripts/core-distribution-manifest.py`. Links between bundled docs stay relative; every other relative link is rewritten to the same file on GitHub at the bundle's commit. The build fails when a link or anchor does not resolve, and `make check-distribution` runs the same check on every tracked Markdown file outside `example/`. Update the list when you add or move a doc that the installer or its output refers to.
 
@@ -109,7 +109,7 @@ The helper is written to `~/.oac/build/microsandbox-provider/oac-microsandbox-pr
 
 ### Standalone Core builds
 
-`make build-core` builds `oac-core`, `oac-core-migrate`, `oac-core-device`, `oac-core-environment-key` and `oac-node` into `${OAC_DEV_HOME:-$HOME/.oac}/build/oac-core` (`OAC_DEV_CORE_BUILD_DIR` selects another absolute directory). The build copies only the source set listed in `scripts/build-core.sh` (the Core service, its contracts, the shared packages it needs and the root Go module files) into a temporary context and builds with CGO disabled, read-only modules and trimmed paths. It needs no Node, Docker or other application. When Core gains a shared dependency, add that package to the list; never copy the whole repository to make it compile.
+`make build-core` builds `oac-core`, `oac-core-device`, `oac-core-environment-key` and `oac-node` into `${OAC_DEV_HOME:-$HOME/.oac}/build/oac-core` (`OAC_DEV_CORE_BUILD_DIR` selects another absolute directory). The build copies only the source set listed in `scripts/build-core.sh` (the Core service, its contracts, the shared packages it needs and the root Go module files) into a temporary context and builds with CGO disabled, read-only modules and trimmed paths. It needs no Node, Docker or other application. When Core gains a shared dependency, add that package to the list; never copy the whole repository to make it compile.
 
 `make docker-build-core` builds the image `oac-core:dev` (`OAC_DEV_CORE_IMAGE` selects another name) from those five commands and the E2B helper. The base is the digest-pinned `debian:bookworm-slim` with CA certificates and the glibc runtime the helper needs; the default user is UID/GID 65532 and Core listens on `:8091`. The image is Linux amd64 only and is not pushed to a registry. Changes to the image or its build need `make check-core-container` in addition to the relevant source checks: it runs the official-client suite against the image with a read-only root filesystem and needs Linux Docker, a non-root user, and the [test database and pinned SDK](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/README.md#official-client-verification) of the service checks (`OAC_TEST_DATABASE_URL` naming an `oac_*_tests` database with the migrations applied, and `OAC_TEST_OFFICIAL_SDK_PYTHON`).
 
@@ -130,21 +130,21 @@ Distribution and Runtime archives use `pigz` level 6 with at most four compressi
 
 ### Container registry
 
-Version releases publish Linux amd64 images as `ghcr.io/minimax-ai/openagentcore/<component>:<version>`, where `<component>` is `core`, `web`, `runtime` or `ingress`. For example, `ghcr.io/minimax-ai/openagentcore/core:v1.2.3`. PostgreSQL uses its upstream image and is not republished. The registry images are loaded from the release archives without rebuilding. Existing tags are reused only when their image config digest matches the release; a different image stops publication. No floating `latest` tag is published. SemVer build metadata uses `_` in place of `+` in container tags; version strings longer than 128 characters cannot be published to GHCR. Manual draft builds do not push images.
+Version releases and manual `build-<full SHA>` drafts publish Linux amd64 images as `ghcr.io/minimax-ai/openagentcore/<component>:<version>`, where `<component>` is `core`, `web`, `runtime` or `ingress`. For example, `ghcr.io/minimax-ai/openagentcore/core:v1.2.3`. A draft uses the tag `build-<full SHA>`. PostgreSQL uses its upstream image and is not republished. The registry images are loaded from the release archives without rebuilding. Existing version tags are reused only when their image config digest matches the release; a different image stops publication. A stable release also moves each component's `latest` tag to that image. Prereleases and drafts leave `latest` unchanged. SemVer build metadata uses `_` in place of `+` in container tags; version strings longer than 128 characters cannot be published to GHCR. After the images are verified, the publisher uploads `compose.yaml` and `ports.yaml`, with checksums, rendered for that release. A draft Release stays unpublished.
 
 The combined build/publication job uses `GITHUB_TOKEN` with `packages: write`. On the first publication, GitHub creates each container package as private: a package administrator must change all four packages to **Public** in their package settings before users can pull anonymously. See [GitHub container visibility](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry). Verify an unauthenticated pull after changing visibility. Repository visibility alone does not make a new container package public.
 
-GHCR and GitHub Releases do not share a transaction. A failed release may leave some matching version tags in GHCR; preserve those images and follow the draft recovery procedure below using the original artifacts. Registry failures other than a missing manifest stop publication. The job summary records digest-pinned references; the installation archives and their checksums remain unchanged. These images still require the configuration, secrets and routing described in [Configuration](./configuration.md); publishing them does not provide a platform deployment template.
+GHCR and GitHub Releases do not share a transaction. A failed release may leave some matching version tags in GHCR; preserve those images and follow the draft recovery procedure below using the original artifacts. Registry failures other than a missing manifest stop publication. The job summary records digest-pinned references. These images and the rendered Compose files still require the configuration, secrets and routing described in [Configuration](./configuration.md).
 
-`install.sh` resolves the latest stable release once, or the release named by `--version`, verifies the control archive and runs that bundle's installer; the [installation guide](./getting-started/install.md#install) covers its use.
+`install.sh` downloads the Compose files for the latest stable release, or the release named by `--version`, verifies their SHA-256 and starts that release. The [installation guide](./getting-started/install.md#install) covers its use.
 
 Go check and build jobs share Go module and compiler-cache directories under `~/.oac/cache/`, keyed by runner OS and architecture, all Go module files, the check/build partition and the commit. Partitioned keys prevent concurrent jobs from saving different compiler subsets under one key. Release builds can seed their cache from backend checks as well as earlier release builds. An older cache only seeds downloads and compilation; every check still runs. Release jobs also cache npm package downloads and the pinned microsandbox archive, whose checksum is verified on every build. Actions cache visibility follows GitHub ref scoping; a tag-specific cache is not shared with other release tags. New keys are saved only after a successful job.
 
-Never move a release tag or overwrite published assets. If publication fails, inspect the Release first: publication may have completed despite a lost response. Leave a complete published Release as it is. For an incomplete draft, delete that draft only after inspection, download the original `core-release-<revision>` Actions artifact with `gh run download RUN_ID --name core-release-REVISION --dir ASSET_DIRECTORY`, and use a checkout of that exact source revision to run `python3 scripts/publish-core-release.py --assets ASSET_DIRECTORY`. Set `GH_REPO`, `GH_TOKEN`, `RELEASE_REVISION`, `RELEASE_TAG` and `RELEASE_MODE` to the original publication inputs and sign Docker into GHCR for version publication. The script revalidates the assets and refuses existing releases. Do not rerun the combined build job or recreate the tag to recover a failed upload.
+Never move a release tag or overwrite published assets. If publication fails, inspect the Release first: publication may have completed despite a lost response. Leave a complete published Release as it is. For an incomplete draft, delete that draft only after inspection, download the original `core-release-<revision>` Actions artifact with `gh run download RUN_ID --name core-release-REVISION --dir ASSET_DIRECTORY`, and use a checkout of that exact source revision to run `python3 scripts/publish-core-release.py --assets ASSET_DIRECTORY`. Set `GH_REPO`, `GH_TOKEN`, `RELEASE_REVISION`, `RELEASE_TAG` and `RELEASE_MODE` to the original publication inputs and sign Docker into GHCR. The script revalidates the assets and refuses existing releases. Do not rerun the combined build job or recreate the tag to recover a failed upload.
 
 ### Build a candidate without publishing
 
-A manual run takes a full commit SHA, runs the same checks and builds, defaults to the offline archive, and never publishes:
+A manual run takes a full commit SHA, runs the same checks and builds, defaults to the offline archive, and leaves the Release unpublished:
 
 ```sh
 revision=$(git rev-parse HEAD)
@@ -152,7 +152,7 @@ gh workflow run core-release --repo MiniMax-AI/OpenAgentCore --ref main \
   -f ref="$revision" -f offline=true -f draft_release=true
 ```
 
-With `draft_release=true` the result is an unpublished `build-<full SHA>` draft Release; with `draft_release=false` the files stay in the Actions artifact. Use the exact matched asset set; never mix builds or resolve components through `latest`.
+With `draft_release=true` the result is an unpublished `build-<full SHA>` draft Release whose images are pushed under that tag; with `draft_release=false` the files stay in the Actions artifact. Use the exact matched asset set; never mix builds or resolve components through `latest`.
 
 ## Continuous integration
 
@@ -164,7 +164,7 @@ The planner compares the PR event's tested merge commit with its verified first
 | --- | --- |
 | `hygiene` | Names, repository links, bundled documentation integrity, and CI planner/gate tests; runs for every change |
 | `distribution` | Harness catalog and installer schema, install/apply/recovery/cleanup tests, Compose parsing and initialization fixtures, release/download and bundle contracts, Go console tests and build; needs Docker Compose for template parsing, no pnpm install or browser |
-| `compose` | Real startup from empty volumes using the template's published images, sign-in and API access, file upload and node installer download, then URL reconfiguration and container recreation with preserved credentials and data; needs Docker and network access, no image build or model credentials |
+| `compose` | Real startup from empty volumes using images built from the checkout, sign-in and API access, file upload and node installer download, then URL reconfiguration and container recreation with preserved credentials and data; needs Docker, Go and network access, no model credentials |
 | `backend` | Parallel parts, each with a dedicated PostgreSQL guard: `runtime` (sqlc freshness, Runtime/shared Go tests, Linux microsandbox helper, daemon build), `core` (standalone Core build, Core service and client tests) and three `store` shards of the serial Core persistence integration package |
 | `harness` | Claude SDK tests and packaging, MiniMax companion scripts |
 | `example` | Optional application typecheck, tests, build and isolated browser acceptance |
@@ -177,7 +177,7 @@ The planner compares the PR event's tested merge commit with its verified first
 
 `.github/actionlint.yaml` selects hygiene and lint. Known workflow changes select their consumers: the CI review and actionlint workflows run hygiene and lint; native workflow changes add native checks; API acceptance workflow changes add API checks with container acceptance enabled; website workflow changes add website checks. The shared Node action selects every job that uses it plus lint. A new or unclassified workflow/action selects the full gate until its consumers are declared in the planner. Planner tests and CI measurement scripts run hygiene; changing the planner itself runs the full gate.
 
-Compose template and Compose test changes select both `distribution` fixtures and the `compose` smoke job. Run `python3 scripts/compose-smoke.py` locally with Docker available to repeat it. The script uses a unique project, an automatically assigned loopback port and artifacts under `~/.oac/tests/`; it removes its containers and volumes on exit. CI also performs cleanup after a failed or interrupted smoke step. Diagnostics show container status without printing HTTP response bodies or sign-in keys. This checks the declared release images and generic Compose behavior; it does not run a Dokploy/Coolify instance or execute a model.
+Compose template and Compose test changes select both `distribution` fixtures and the `compose` smoke job; Core, Web, shared Go packages and the image Dockerfiles also select the smoke job. Run `python3 scripts/compose-smoke.py` locally with Docker available to repeat it. The script uses a unique project, an automatically assigned loopback port and artifacts under `~/.oac/tests/`; it removes its containers and volumes on exit. CI also performs cleanup after a failed or interrupted smoke step. Diagnostics show container status without printing HTTP response bodies or sign-in keys. Core, Web and the ingress image are built from the checkout; Web serves a placeholder page instead of the console build. Node metadata comes from the release pinned in `deploy/compose/smoke-pins.json`. This checks generic Compose behavior; it does not run a Dokploy/Coolify instance or execute a model.
 
 Go module and workspace inputs select backend, API (including the container), native and distribution checks. Each Node module owns its manifest and lockfile. Website dependencies select website checks; Web dependencies select Web and browser checks; example dependencies select example checks; shared TypeScript client dependencies select Web, browser and example checks; Claude adapter dependencies select Harness, native and distribution checks. Shared package-manager configuration selects all Node consumers. The root TypeScript configuration selects Web and example checks; the adapter TypeScript configuration selects Harness and native checks. Each selected set includes hygiene. Mixed changes accumulate their consumers, and every job reads the same plan instead of maintaining its own path list. For example, a notification-only PR skips database, browser and native jobs, while a notification plus Core change adds backend and API checks.
 
diff --git a/docs/web/console-api-usage.md b/docs/web/console-api-usage.md
index c68c80002..8c9d0ec3a 100644
--- a/docs/web/console-api-usage.md
+++ b/docs/web/console-api-usage.md
@@ -8,7 +8,7 @@ This page lists the Core routes each console page reads and writes, and how the
 
 | Interface | Paths | Authentication | Console use |
 | --- | --- | --- | --- |
-| Console server | `/console/auth`, `/console/auth/{login,logout}`, `/console/config`, `/console/installation/domain`, `/node-install/manifest.json` | The Core key at sign-in, then the console session cookie; `/node-install/manifest.json` needs no sign-in | Sign-in and sign-out; the node installer and node artifacts for Add node; domain setup on **System → Domain and HTTPS**; the distribution's Runtime release for Docker and microsandbox setup. See [console server](./console-server.md) |
+| Console server | `/console/auth`, `/console/auth/{login,logout}`, `/console/config`, `/node-install/manifest.json` | The Core key at sign-in, then the console session cookie; `/node-install/manifest.json` needs no sign-in | Sign-in and sign-out; the node installer and node artifacts for Add node; the distribution's Runtime release for Docker and microsandbox setup. See [console server](./console-server.md) |
 | Administrator API | `/core/v1/**` outside `/core/v1/sandbox` | The Core key, added by the console server | Projects, keys, resource reads and deletion, diagnostics, executor credentials and installation commands, provenance, summaries, Core metrics, the installation, default models |
 | Sandbox administration | `/core/v1/sandbox/**` | The Core key, added by the console server | Sandbox configuration, Nodes, fleet and capacity figures on Overview and Sandbox metrics, Runtime observations of every project |
 | Agents API | `/v1/**` | Project API key | Not used. The console shows developers how to call it (see [Provenance and monitoring](#provenance-and-monitoring)) |
@@ -95,7 +95,7 @@ The list carries each harness's configuration, so the console does not read `GET
 
 | Operation | Route | Console use |
 | --- | --- | --- |
-| Deployment | `GET`, `POST`, `PUT /core/v1/sandbox/deployment` | Read the provider, the read-only `core_url` (config.json's `public_url`, shown in the setup review and never sent), reset state, installation ID and specification; a 409 `sandbox_configuration_error` (E2B with a loopback `public_url`) shows the shared client's fixed safe address-configuration message in the setup wizard, with the installation's config file and apply command, and leaves nothing to confirm; initialize the deployment with `resources` and the Docker or microsandbox `runtime` release, or with the E2B account and no `resources` (Core adopts the template build's CPU and memory); change its settings with the expected generation. E2B's `metadata.template_build` (status, CPU, memory, disk) shows on System, the Sandbox configuration summary and Sandbox metrics, and sizes each sandbox when `specification.resources` is missing; microsandbox's `suspension` (idle and retention seconds) shows on System and the Nodes summary |
+| Deployment | `GET`, `POST`, `PUT /core/v1/sandbox/deployment` | Read the provider, the read-only `core_url` (`OAC_PUBLIC_URL`, shown in the setup review and never sent), reset state, installation ID and specification; a 409 `sandbox_configuration_error` (E2B with a loopback `public_url`) shows the shared client's fixed safe address-configuration message in the setup wizard, with the installation's config file and apply command, and leaves nothing to confirm; initialize the deployment with `resources` and the Docker or microsandbox `runtime` release, or with the E2B account and no `resources` (Core adopts the template build's CPU and memory); change its settings with the expected generation. E2B's `metadata.template_build` (status, CPU, memory, disk) shows on System, the Sandbox configuration summary and Sandbox metrics, and sizes each sandbox when `specification.resources` is missing; microsandbox's `suspension` (idle and retention seconds) shows on System and the Nodes summary |
 | E2B discovery | `POST /core/v1/sandbox/providers/e2b/discovery` | The setup wizard lists the templates the entered E2B key can see, then the selected template's ready builds. The key travels only in these request bodies and the deployment write |
 | Reset | `POST`, `DELETE /core/v1/sandbox/deployment/reset` | Explicitly clear hosted resources, or cancel the remaining clear at the observed generation; show Core's remaining and offline projection |
 | Nodes | `GET /core/v1/sandbox/nodes` | Nodes page; fleet on Overview; node capacity on Sandbox metrics. An online node's `diagnostic` (`docker_unavailable`, `docker_limits_unsupported`, `runtime_image_unavailable`, `kvm_unavailable`, `microsandbox_artifacts_unavailable`, `capacity_insufficient`, `provider_unavailable`; any other value reads as `provider_unavailable`) marks it degraded and names the reason and fix in the help tip beside its status on each of these and on the node's page. A node whose `core_url` (the address it enrolled with) differs from the deployment's `core_url` is named on the Nodes page as bound to an old address, to be removed and added again, and its status there and on its page reads Old address instead of its health; an empty `core_url` (a node Core did not enroll) is unknown, not old. **Add node** follows only the node whose `enrollment_id` equals its command's |
diff --git a/docs/web/console-server.md b/docs/web/console-server.md
index e5cf59997..41fa81d3d 100644
--- a/docs/web/console-server.md
+++ b/docs/web/console-server.md
@@ -2,7 +2,7 @@
 title: "Console server"
 ---
 
-The console server (`services/web`, the `oac-web` process) serves the built console, signs the administrator in with the Core key and forwards the signed-in browser's `/core/v1` requests to Core with that key. The browser never holds the Core key or any API key. Applications, nodes and self-hosted executors call Core directly; the console forwards none of their traffic.
+The console server (`services/web`, the `oac-web` process) serves the built console, signs the administrator in with the Core key and forwards the signed-in browser's `/core/v1` requests to Core with that key. The browser never holds the Core key or any API key. Applications, nodes and self-hosted executors reach Core through the console, which forwards `/v1`, `/api/v1` and `/docs` unchanged.
 
 [Configuration](../configuration.md#appendix-web-environment-without-the-installer) owns its process settings and defaults.
 
@@ -16,35 +16,34 @@ flowchart LR
   database[("PostgreSQL")]
   application["Application / official SDK"]
   machine["Nodes and Runtime daemons"]
-  installer["Installer domain service"]
 
   browser -->|"same origin: /console/*, /core/v1/*; session cookie"| console
   console -->|"/core/v1/* with the Core key"| core
-  console -->|"domain setup, Unix socket"| installer
-  application -->|"/v1 with a Project API key"| core
-  machine -->|"/api/v1 with machine credentials"| core
+  application -->|"/v1 with a Project API key"| console
+  machine -->|"/api/v1 with machine credentials"| console
+  console -->|"/v1, /api/v1 and /docs unchanged"| core
   core <--> database
 ```
 
-The deployment's reverse proxy routes `/v1` and `/api/v1` to Core and every other path to the console; the [installation options](../getting-started/install-options.md#https-and-the-reverse-proxy) gives the routes. The console handles each path as follows:
+The deployment's reverse proxy sends every path to the console. The console forwards `/v1`, `/api/v1` and `/docs` to Core and serves everything else itself; the [installation options](../getting-started/install-options.md#https-and-the-reverse-proxy) gives the proxy requirements. The console handles each path as follows:
 
 | Path | Sign-in | Handling |
 | --- | --- | --- |
 | `/healthz` | No | `GET` or `HEAD` answers `200 ok` |
-| `/v1`, `/api/v1` and below | — | 404, whatever credential the request carries |
+| `/v1`, `/api/v1` and below | — | Forwarded to Core unchanged, with the caller's credential, streaming and WebSocket upgrades |
+| `/docs`, `/docs/*` | No | The API reference and its OpenAPI documents, forwarded to Core unchanged |
 | `/node-install/*` | No | The node installation payload (see [Node installation payload](#node-installation-payload)) |
 | `/console/auth`, `/console/auth/login`, `/console/auth/logout` | No | [Sign-in](#sign-in) |
 | `/`, `/index.html`, `/favicon.svg`, `/oac-mark.svg`, `/assets/*` | No | Static console assets |
 | `/console/config` | Yes | [Console configuration](#console-configuration) |
-| `/console/installation/domain` | Yes | [Domain setup](#domain-setup) |
 | `/core/v1/*` | Yes | [Forwarded to Core](#forwarding-to-core) |
 | `/core` and other paths under `/core/` | Yes | 404 |
 | Any other path | Yes | Static assets; a path without a file extension falls back to `index.html` |
 
-Every request except `/healthz`, `/v1` and `/api/v1` must pass these checks first:
+Every request except `/healthz`, `/v1`, `/api/v1` and `/docs` must pass these checks first:
 
 1. **Host and origin.** The `Host` header must equal the host of `OAC_WEB_ORIGIN`. An `Origin` header, when present, must equal that origin, and `Sec-Fetch-Site` must be `same-origin` or `none`. A write that carries neither `Origin` nor `Sec-Fetch-Site: same-origin` needs a same-origin `Referer`. Otherwise the console answers 403. `/node-install/*` checks only the host and the path.
-2. **Safe request.** The path must start with `/` and contain no `%`, backslash, NUL, dot segment or empty segment. Absolute-form request targets, `CONNECT`, `TRACE` and any request with an `Upgrade` header get 400. A request can therefore never leave `/core/v1` on Core, and the console carries no WebSocket.
+2. **Safe request.** The path must start with `/` and contain no `%`, backslash, NUL, dot segment or empty segment. Absolute-form request targets, `CONNECT` and `TRACE` get 400. An `Upgrade` header gets 400 except on `/v1`, `/api/v1` and `/docs`, which are forwarded before these checks. A `/core/v1` request can therefore never leave that prefix.
 3. **Sign-in.** Paths that need sign-in answer 401 without a valid session cookie.
 
 Under `/core`, these failures use the Core error envelope with the codes in [console-generated failures](../../contracts/agents-api/core-errors.md#console-generated-failures); elsewhere they return `{"error": "…"}`, or plain text for an unsafe request. Every response carries `Cache-Control: no-store`, `X-Content-Type-Options: nosniff`, `Referrer-Policy: no-referrer` and `Content-Security-Policy: frame-ancestors 'none'`.
@@ -97,22 +96,9 @@ Sign-in errors: 400 for a malformed body, 401 `Invalid Core key`, 405 for a meth
 
 With `OAC_WEB_NODE_PAYLOAD_DIR` set, the console serves the matched distribution's node payload at `/node-install/` without sign-in: `node-install.pyz`, `manifest.json`, `SHA256SUMS`, `runtime/seccomp.json`, and the node artifacts the manifest declares under `artifacts/`. An artifact missing locally redirects (307) to its pinned release download. Node install and uninstall commands download from `<public_url>/node-install/`, so the reverse proxy must send that path to the console. Nodes verify every checksum themselves.
 
-## Domain setup
+## Public address
 
-`GET` and `POST /console/installation/domain` let **System → Domain and HTTPS** configure a managed installation's domain. They are console routes, not Core routes. After the same origin and sign-in checks, the console passes the request body (at most 2 KiB) to the installer's Unix socket at `OAC_WEB_INSTALLATION_SOCKET`, authenticated with the Core key, and returns the installer's JSON answer and status. The request times out after 20 seconds.
-
-| Method | Request | Result |
-| --- | --- | --- |
-| `GET` | No body | The domain status |
-| `POST` | `{"hostname":"core.example.com"}`, optionally with `"confirm_public_url_change":"https://core.example.com"` | 202 and the status; the installer checks and applies the domain in the background |
-
-The status has `supported`, `state` (`unconfigured`, `checking`, `applying`, `ready` or `failed`), and nullable `public_url`, `target_url` and `message`. Installer errors use `{"error":{"code":"…","message":"…"}}`. Changing an address that nodes or executors already use returns 409 `public_url_confirmation_required` until the request confirms the new URL; pending `config.json` edits, an installation that is not applied or not running, hand-edited generated files, and another installation operation holding the lock (`installation_busy`) also return 409.
-
-Without `OAC_WEB_INSTALLATION_SOCKET` (external reverse proxy installations), `GET` reports `supported: false` and `POST` returns 400 `domain_setup_unavailable`. An unreachable installer or an invalid answer returns 502 `installation_unreachable`.
-
-The System page submits a hostname once, polls the status every 2 seconds while it is `checking` or `applying`, and asks for confirmation when the installer requires it. During setup, network failures and HTTP 502/503/504 responses keep polling active. The page allows 30 seconds without a successful status response before showing the disconnected message, and recovers when a poll succeeds. It never retries a write. Applying the domain restarts the console, which ends every session; the page keeps a sign-in link to the new HTTPS address. Only the `ready` state confirms HTTPS; the browser does not probe the new origin. The installer owns certificates, locking and recovery ([managed HTTPS](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/install/README.md#managed-https)).
-
-`OAC_WEB_BOOTSTRAP=1`, which the installer sets while no public URL is configured, lets the console also accept plain HTTP requests addressed to a literal IP address, treating `http://<that address>` as the origin, so an operator can sign in through the server's IP address. Host names still require `OAC_WEB_ORIGIN`, so DNS rebinding cannot reach the console.
+The console does not configure a domain or obtain certificates. The operator's reverse proxy or hosting platform terminates HTTPS and routes to the console, and `OAC_PUBLIC_URL` records the origin that applications, nodes and executors use. The console accepts only the host of `OAC_WEB_ORIGIN`, so DNS rebinding cannot reach it.
 
 ## Verification
 
diff --git a/docs/web/index.md b/docs/web/index.md
index f2354de9a..476a44f9a 100644
--- a/docs/web/index.md
+++ b/docs/web/index.md
@@ -24,7 +24,7 @@ Signing in opens the Overview. While any step is still to do, its **Getting star
 | Resources | Agents, Environment templates, Skills, Files, Vaults | Inspection and permitted deletion, with the Project and the creating key of each resource |
 | Platform | Projects and keys | Create, rename and archive Projects; issue and revoke keys; each Project's usage, write history and how to call the API |
 | Platform | Nodes | Add, edit and remove Docker or microsandbox nodes; each node's readiness, capacity and allocations |
-| Platform | System | The installation's public address, API base URL, ID and source commit; **Domain and HTTPS**; each harness's default model; **Sandbox configuration**; Core's `config.json` startup settings, read-only, with where to change them |
+| Platform | System | The installation's public address, API base URL, ID and source commit; each harness's default model; **Sandbox configuration**; the startup settings Core loaded, read-only |
 
 Missing data is shown as missing (—), never as zero. [Console API usage](./console-api-usage.md) lists what each page reads and how its figures are bounded.
 
@@ -32,7 +32,7 @@ Missing data is shown as missing (—), never as zero. [Console API usage](./con
 
 | Task | Where |
 | --- | --- |
-| Give the installation an HTTPS address | **System → Domain and HTTPS**, on an installation with managed ingress; see [Make Core reachable](../getting-started/install.md#configure-the-domain-and-https) |
+| Give the installation an HTTPS address | Set `OAC_PUBLIC_URL` and point a reverse proxy at Web; see [Make Core reachable](../getting-started/install.md#configure-the-domain-and-https) |
 | Choose the sandbox backend (Docker, microsandbox or E2B), the sandbox size and Runtime, or reset the backend | **System → Sandbox configuration**; see [change the sandbox configuration](../getting-started/nodes.md#change-the-sandbox-configuration) |
 | Add or remove execution nodes | **Nodes**; see the [nodes guide](../getting-started/nodes.md) |
 | Set the default model of a harness | **System → Default model configuration**; see [default models](../configuration.md#default-models) |
diff --git a/docs/zh/api/index.md b/docs/zh/api/index.md
index 564a4ee92..3fb103872 100644
--- a/docs/zh/api/index.md
+++ b/docs/zh/api/index.md
@@ -1,7 +1,7 @@
 ---
 title: "API 命名空间和凭据"
 source: docs/api/index.md
-source_hash: d6483deff36f22b113e3d6df256c399238b8f4ffeeda889a1b0e3f0ddbdb6e67
+source_hash: 922ad1d9b3ea7549aa6b845847f8e0278a637a1b986d41b264b9cf892429a8df
 ---
 
 Core 提供三个命名空间。每个命名空间都有一种调用方及其独立凭据，凭据只能在其所属命名空间中使用。
@@ -14,9 +14,9 @@ Core 提供三个命名空间。每个命名空间都有一种调用方及其独
 
 在其他命名空间中使用凭据会返回 401：在 `/core/v1` 或 `/api/v1` 上使用 Project API key，或者在 `/v1` 或 `/api/v1` 上使用 Core key。有关 Project 和密钥的行为，请参阅 [Project 自有资产](../concepts.md#projects-own-assets)。
 
-**路由。** 反向代理将 `/v1` 和 `/api/v1` 发送到 Core，将其他所有请求发送到 Web（[代理设置](../getting-started/install-options.md#https-and-the-reverse-proxy)）。浏览器只能通过 Web 的控制台服务器访问 `/core/v1`；该服务器会在登录后添加 Core key，并对 `/v1` 和 `/api/v1` 返回 404（[控制台服务器](../web/console-server.md)）。操作员脚本通过 Core 的回环端口调用 `/core/v1`（[编写 Core API 脚本](../getting-started/operations.md#script-the-core-api)）。
+**路由。** Web 把 `/v1`、`/api/v1` 和 `/docs` 原样转发到 Core（[控制台服务器](../web/console-server.md)）。已登录的浏览器通过 Web 访问 `/core/v1`，由 Web 附上 Core key。操作员脚本在 `127.0.0.1:8091` 调用 `/core/v1`（[编写 Core API 脚本](../getting-started/operations.md#script-the-core-api)）。
 
-**API 参考页面。** Core 在 `/docs` 提供三个命名空间的只读 Swagger UI，并在 `/docs/openapi.yaml`、`/docs/core.openapi.yaml` 和 `/docs/runtime.openapi.yaml` 提供页面所渲染的生成文档。这些路由不需要凭据，页面也不会发送 API 请求。反向代理不会把 `/docs` 发送到 Core，因此请通过 Core 自己的地址打开：在 Core 主机上访问 `http://127.0.0.1:<port>/docs`，其中端口为 [`ports.core`](../configuration.md#settings)，默认是 8091。浏览器从 `unpkg.com` 加载 Swagger UI。
+**API 参考。** Core 在 `/docs` 提供三个命名空间的只读 Swagger UI，文档位于 `/docs/openapi.yaml`、`/docs/core.openapi.yaml` 和 `/docs/runtime.openapi.yaml`。不需要凭据，页面也不发送 API 请求。在控制台源地址打开，例如 `http://localhost:8080/docs`。浏览器从 `unpkg.com` 加载 Swagger UI。
 
 ## 机器连接 API {#machine-connection-api}
 
diff --git a/docs/zh/configuration.md b/docs/zh/configuration.md
index ec0bdb735..3adf643e9 100644
--- a/docs/zh/configuration.md
+++ b/docs/zh/configuration.md
@@ -1,89 +1,67 @@
 ---
 title: "配置参考"
 source: docs/configuration.md
-source_hash: afc0f02492f63e2032009fc7a79aa72051ca2c377d2e7788ef6f7d1d15f8b8de
+source_hash: 610b3a85b453d00b575f9fb4d42c87ec89dc3803bb238fd4c36ef734aba6c7e2
 ---
 
 Core 安装的每项设置都恰好只有一个归属位置。共有两类：
 
 | 类型 | 示例 | 归属位置 | 修改方式 | 生效方式 |
 | --- | --- | --- | --- | --- |
-| [进程设置](#process-settings-config-json) | 公共 URL、端口、日志、Harness、执行并发度、审计保留期、OAuth 来源、数据库连接池、Runtime 历史记录导出 | 安装目录中的 `config.json`（默认 `~/.oac/core`） | 通过 Web 域设置或 `oac domain` 配置托管 HTTPS；否则编辑该文件，然后运行 `oac apply` | `oac apply` 会重启读取了这些已更改设置的服务 |
+| [进程设置](#process-settings-configjson) | 公共 URL、端口、日志、Harness、执行并发度、审计保留期、OAuth 来源、Runtime 历史记录导出 | 安装目录中的 `.env`（默认 `~/.oac/core`） | 编辑 `.env`，然后运行 `oac apply` | `oac apply` 会重新创建读取了这些已更改设置的服务 |
 | [运行时设置](#runtime-settings-web) | 沙箱后端和大小、节点、项目和密钥、默认模型、执行器凭据 | Core 的 PostgreSQL 数据库 | 在 Web 中修改，或使用 Core 密钥调用 Core API（`/core/v1`） | 保存时无需重启 Core；节点会异步准备 Runtime 变更 |
 
-Web 的 **System** 页面显示该安装的地址、默认模型和沙箱配置，并在 **Startup settings** 下以只读方式显示进程设置、`config.json` 的路径以及 apply 命令。机密信息存放在 [`secrets/`](#installation-directory) 中，每项仅保存一份。`generated/` 中的文件派生自 `config.json`。没有任何配置文件定义项目或 API 密钥。
+Web 的 **System** 页面显示该安装的地址、默认模型和沙箱配置，并在 **Startup settings** 下以只读方式显示 Core 加载的进程设置。机密信息存放在 [`data/secrets/`](#installation-directory) 中，每项仅保存一份。没有任何配置文件定义项目或 API 密钥。
 
-## 进程设置：config.json {#process-settings-config-json}
+## 进程设置 {#process-settings-configjson}
 
-安装程序会写入每一项设置，因此该文件会显示每个值。[安装选项](getting-started/install-options.md)中列出的安装程序标志仅用于为该文件提供初始值。要更改设置，请编辑该文件并应用更改：
+[安装选项](getting-started/install-options.md)中的安装标志只会一次性写入 `.env`。要更改设置，请编辑 `.env` 并应用：
 
 ```sh
-~/.oac/core/oac apply --dry-run   # show the changed settings, files and restarts
 ~/.oac/core/oac apply
 ```
 
 ### oac apply 的工作方式 {#how-oac-apply-works}
 
-1. 它会验证 `config.json`，如果某个值无效，则不会进行任何更改。`ingress` 在安装后固定；要更改它，请安装到新目录。它还会检查更改后的 `host`、端口或托管入口 `public_url` 所新增的监听器（[端口](getting-started/install-options.md#ports)）；如果 `host` 不是本机的地址，或其他程序占用了其中一个端口，它也不会进行任何更改；安装自身的监听器不计入。
-2. 它会把 Core、Web 和 Compose 读取的文件写入 `generated/`：`compose.json`、`core.env`、`core-key-digests.json`、`settings.json`，以及在使用时写入 `runtime-history.json` 和托管的 `Caddyfile`。不要编辑这些文件。手工编辑某个生成文件后，`apply` 会中止，直到你将相应更改写入 `config.json` 并运行 `oac apply --discard-edits`；该命令会将编辑过的副本保留为 `generated/<file>.edited-<time>`。
-3. 它会比较所写入的内容与实际运行的内容。每个容器都携带其输入的摘要（`io.oac.inputs` 标签），而 `apply` 只会重新创建或重启输入不同的服务：先 Core，再 Web。下方的 **Restarts** 列说明了各项设置会影响哪些服务；有关重启会中断哪些操作，请参阅[停止和重启](getting-started/operations.md#stop-and-restart)。
-4. 只要有任何服务正在运行，`apply` 还会启动已停止的服务。执行 `oac stop` 后，它只写入文件，该安装会保持停止状态。
-5. 如果 Core 在启动时拒绝某个值，`apply` 会打印 Core 的启动错误。如果所有服务此前都使用旧文件运行，它会恢复这些文件并再次启动服务；否则，它会报告失败，并由下一次 `apply` 完成工作。
+1. 它用你改过的 `.env` 运行 `oac-core check-config`。值无效时什么都不改。
+2. 它运行 `docker compose up -d --wait`。Compose 只重新创建配置有变化的服务。
+3. 校验失败时，不会重新创建任何容器。重启会中断哪些操作，见[停止和重启](getting-started/operations.md#stop-and-restart)。
 
-`oac status` 会报告尚未应用的 `config.json` 更改，以及手工编辑过的生成文件。
+`docker compose ps` 展示服务。域名状态在 `data/domain/status.json`。
 
 ### 更改公共 URL {#changing-the-public-url}
 
-`public_url` 是应用、节点、沙箱和自托管执行器使用的唯一源地址。Core 从中派生守护进程 WebSocket URL、自托管 `remote_url` 和每个沙箱的连接地址。如果为 `null`，Core 使用其回环源地址。在设置 `public_url` 之前，托管安装仅通过主机 IP 地址上的 `ports.web` 以 HTTP 提供 Web 服务；设置后，该地址会重定向到 `public_url`。
+`OAC_PUBLIC_URL` 是应用、节点、沙箱和自托管执行器使用的唯一源地址。Core 从中派生守护进程 WebSocket URL、自托管 `remote_url` 和每个沙箱的连接地址。安装通过 `OAC_WEB_PORT` 以 HTTP 提供 Web；反向代理或托管平台终止 HTTPS 并把流量转到该端口。
 
-使用托管入口时，可在 Web 中更改它（**System** → **Configure domain and HTTPS**），也可使用 `oac domain HOSTNAME`。两者都会获取安装锁、验证新证书和地址，然后写入 `config.json` 并应用。使用外部入口时，请先更新反向代理，然后编辑 `public_url` 并运行 `oac apply`。
-
-如果节点、托管沙箱或自托管执行器绑定到当前地址，`apply` 会列出它们，并要求你输入新 URL（没有终端时使用 `--confirm-public-url-change URL`）。之后：
+要更改它，先把反向代理指向新地址，然后编辑 `OAC_PUBLIC_URL` 并运行 `oac apply`。之后：
 
 - 使用旧地址的节点不会再获得新沙箱：请在 Web 中移除这些节点，然后重新添加。
-- 只有在旧地址仍可访问此 Core 时，现有沙箱和执行器才会继续工作。托管域更改会替换先前的域路由。
+- 只有在旧地址仍可访问此 Core 时，现有沙箱和执行器才会继续工作。
 - 自托管执行器必须使用新的 `remote_url` 重启，并且其安装程序会拒绝为旧地址进行的安装：请创建新的自托管 Session，然后重新连接其主机。
 
 ### 设置 {#settings}
 
-`core.runtime_history.headers` 可以包含导出凭据。这些凭据保存在权限为 `0600` 的 `config.json` 和 Core 读取的生成文件中，绝不会出现在 `oac` 输出或 Core 的设置快照中。模型提供商不属于进程设置；请参阅[默认模型](#default-models)。
-
-以下配置参考表是由脚本自动生成的引用内容，保留英文原文。
-
-[//]: # (BEGIN config-reference: generated by scripts/config-reference.py from deploy/install/config.schema.json)
-| Key | Type | Default | Change | Restarts | Meaning |
-| --- | --- | --- | --- | --- | --- |
-| `$schema` | string | none | any time | none | Editor hint that points at the installed copy of this schema. Ignored. |
-| `format` | `1` | none | fixed | none | Configuration format for this release. Fixed after installation. |
-| `public_url` | string or null (canonical origin; HTTP only on loopback) | `null` | `oac apply` | core, web | Canonical public origin of Core and Web. With managed ingress, set the DNS hostname in Web or run oac domain; certificates are automatic. With external ingress, configure your TLS reverse proxy before applying this value. |
-| `host` | string (IPv4 or IPv6 address) | `"127.0.0.1"` | `oac apply` | core, web | Listener IP. With managed ingress only the gateway is public; Core stays on loopback. The default installer listens on all IPv4 interfaces. |
-| `ports.core` | integer 1024–65535 | `8091` | `oac apply` | core | Host port of the Core API. |
-| `ports.web` | integer 1024–65535 | `8080` | `oac apply` | web | Host port of Web. |
-| `log.level` | `"debug"` \| `"info"` \| `"warn"` \| `"error"` | `"info"` | `oac apply` | core, web | Minimum log level of Core and Web. |
-| `log.format` | `"auto"` \| `"text"` \| `"json"` | `"auto"` | `oac apply` | core, web | Log format. auto writes text to a terminal and JSON otherwise. |
-| `log.add_source` | boolean | `false` | `oac apply` | core, web | Add the source file and line to each log record. |
-| `core.execution_concurrency` | integer 1–1024 | `4` | `oac apply` | core | Concurrent execution work units in Core. Unrelated to node sandbox capacity. |
-| `core.harnesses` | array of `"claude_sdk"` \| `"codex"` \| `"mcode"` | `["claude_sdk", "codex", "mcode"]` | `oac apply` | core | Harnesses that Sessions may select. |
-| `core.default_harness` | `"claude_sdk"` \| `"codex"` \| `"mcode"` | `"codex"` | `oac apply` | core | Harness used when a Session names none. It must be listed in core.harnesses. |
-| `core.write_audit_retention` | string (Go duration, at least `1h`) | `"2160h"` | `oac apply` | core | How long non-creation write history is kept, as a Go duration of at least 1h. |
-| `core.oauth_trusted_origins` | array of string (canonical HTTPS origin) | `[]` | `oac apply` | core | Extra HTTPS origins trusted as private OAuth issuers. |
-| `core.database_pool.max_conns` | integer or null ≥ 1 | `null` | `oac apply` | core | Maximum database connections. null keeps the driver default, max(4, CPU count). |
-| `core.database_pool.min_conns` | integer or null ≥ 0 | `null` | `oac apply` | core | Minimum idle database connections. null keeps the driver default, 0. |
-| `core.database_pool.max_conn_lifetime` | string or null (Go duration) | `null` | `oac apply` | core | Go duration. null keeps the driver default, 1h. |
-| `core.database_pool.max_conn_idle_time` | string or null (Go duration) | `null` | `oac apply` | core | Go duration. null keeps the driver default, 30m. |
-| `core.database_pool.health_check_period` | string or null (Go duration) | `null` | `oac apply` | core | Go duration. null keeps the driver default, 1m. |
-| `core.runtime_history` | object or null | `null` | `oac apply` | core | Runtime history collection and OTLP export. null keeps local collection with Core's defaults. Core checks the values at startup. |
-| `core.runtime_history.transport` | string | none | `oac apply` | core | OTLP export transport: `otlp_http`. Required with endpoint. |
-| `core.runtime_history.endpoint` | string | none | `oac apply` | core | OTLP/HTTP metrics URL: a canonical absolute URL with a path and no credentials, query or fragment; HTTPS, or HTTP with insecure. Omit it to keep history local; transport, insecure and headers then must be absent. |
-| `core.runtime_history.insecure` | boolean | none | `oac apply` | core | Export without TLS. Required for an HTTP endpoint and refused for HTTPS. |
-| `core.runtime_history.headers` | object of string values | none | `oac apply` | core | Headers sent with each export, such as credentials. Host, Content-Length, Content-Type and Content-Encoding are refused. Never shown by oac or Core. Sensitive. |
-| `core.runtime_history.queue_capacity` | integer | none | `oac apply` | core | Capacity of the history write queue and of the export queue, up to 4096. Omitted or 0 selects 256. |
-| `core.runtime_history.timeout_seconds` | integer | none | `oac apply` | core | History write, export and query timeout in seconds, up to 30. Omitted or 0 selects 2. |
-| `core.runtime_history.sample_interval_seconds` | integer | none | `oac apply` | core | Periodic sampling interval in seconds, 5 to 300. Omitted or 0 selects 30. |
-| `ingress` | `"managed"` \| `"external"` | `"external"` | fixed | none | managed provides automatic HTTPS and Web domain setup; install.sh selects it by default. external uses your existing proxy. Fixed after installation. |
-[//]: # (END config-reference)
-
-该配置模式为 [`deploy/install/config.schema.json`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/install/config.schema.json)；每个安装都会在 `generated/config.schema.json` 中保留一份副本，供编辑器使用。Core 会在 `GET /core/v1/installation` 提供非机密设置快照，其中包含 `config.json` 的路径和 apply 命令。有关 Core 如何收集和保留 Runtime 历史记录，请参阅[保留的历史记录](../../contracts/agents-api/zh/runtime-observability.md#retained-history-and-optional-export)。
+`OAC_HISTORY_SETTINGS_FILE` 可以指向一个文件，其 headers 中含有导出凭据。该文件权限为 `0600`，这些 headers 绝不会出现在 `oac` 输出或安装报告中。模型提供商不属于进程设置；请参阅[默认模型](#default-models)。
+
+以下配置参考表保留英文原文。
+
+| Variable | Default | Meaning |
+| --- | --- | --- |
+| `OAC_PUBLIC_URL` | `http://localhost:8080` | Origin applications, nodes, sandboxes and self-hosted executors use. Managed domain setup writes the HTTPS origin and recreates Core and Web |
+| `OAC_HOST` | `127.0.0.1` | Address published by `ports.yaml`. `install.sh` sets `0.0.0.0` |
+| `OAC_WEB_PORT` | `8080` | Host port of Web |
+| `COMPOSE_FILE` | `compose.yaml:ports.yaml` | The Compose files. `ports.yaml` publishes Web and Core's loopback admin API; hosting platforms omit it |
+| `OAC_LOG_LEVEL` | `info` | `debug`, `info`, `warn` or `error` |
+| `OAC_LOG_FORMAT` | `auto` | `auto`, `text` or `json` |
+| `OAC_LOG_ADD_SOURCE` | unset | `1` adds source locations |
+| `OAC_EXECUTION_CONCURRENCY` | `4` | Concurrent execution work, from 1 to 1024 |
+| `OAC_DEFAULT_HARNESS` | `codex` | Harness used when a request does not name one |
+| `OAC_HARNESSES` | Every registered Harness | Comma-separated Harnesses to enable besides the default one. Unknown names stop startup |
+| `OAC_WRITE_AUDIT_RETENTION` | `2160h` | Minimum `1h` |
+| `OAC_OAUTH_TRUSTED_ORIGINS` | unset | Comma-separated HTTPS origins |
+| `OAC_HISTORY_SETTINGS_FILE` | unset | Optional Runtime history file. Sensitive; Core reports only whether it is configured |
+
+未设置或为空的值使用默认值。编辑 `.env`，然后运行 `oac apply`。Core 会在 `GET /core/v1/installation` 报告它加载的进程设置。`oac-core check-config` 会在不启动 Core 的情况下校验同一组环境变量。敏感设置只报告是否已配置。有关 Core 如何收集和保留 Runtime 历史记录，请参阅[保留的历史记录](../../contracts/agents-api/zh/runtime-observability.md#retained-history-and-optional-export)。
 
 ## 运行时设置：Web {#runtime-settings-web}
 
@@ -91,7 +69,7 @@ Web 的 **System** 页面显示该安装的地址、默认模型和沙箱配置
 
 | 设置 | Web 中的位置 | Core API | 注意事项 |
 | --- | --- | --- | --- |
-| 沙箱后端：Docker、microsandbox 或 E2B | **System** → **Manage sandbox configuration**：设置向导，最后点击 **Save configuration** | `/core/v1/sandbox/deployment` | 每个安装只能使用一个后端。安装程序会保存 Standard 规格的 microsandbox。要改用其他后端，必须先执行 **Reset deployment**；请参阅[更改沙箱配置](getting-started/nodes.md#change-the-sandbox-configuration) |
+| 沙箱后端：Docker、microsandbox 或 E2B | **System** → **Manage sandbox configuration**：设置向导，最后点击 **Save configuration** | `/core/v1/sandbox/deployment` | 每个安装只能使用一个后端，在首次登录后选择。要改用其他后端，必须先执行 **Reset deployment**；请参阅[更改沙箱配置](getting-started/nodes.md#change-the-sandbox-configuration) |
 | 沙箱大小、Runtime 发行版、E2B 密钥和模板构建 | **System** → **Manage sandbox configuration** → **Change resources** | `/core/v1/sandbox/deployment` | Web 会在 [`standard-sizes.json`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/web/src/features/sandbox/standard-sizes.json) 中推荐可用大小。现有沙箱会保留其大小和发行版。E2B 密钥仅可写入，并且已加密 |
 | 节点及其容量 | **Nodes**：**Add node**；在节点页面上使用 **Edit node** 和 **Remove node** | `/core/v1/sandbox/enrollment-tokens`、`/core/v1/sandbox/nodes` | 请参阅[节点容量](#node-capacity)和[节点指南](getting-started/nodes.md) |
 | 项目和 API 密钥 | **Projects and keys**：**Create project**、**Rename**、**Issue key**、**Revoke**、**Archive** | `/core/v1/projects` | 密钥只显示一次；Core 存储其摘要 |
@@ -112,26 +90,26 @@ Web 的 **System** 页面显示该安装的地址、默认模型和沙箱配置
 
 ## Compose 安装 {#compose-installations}
 
-[独立 Compose 模板](getting-started/install-options.md#docker-compose-and-hosting-platforms)使用其 Compose 定义和平台环境作为进程设置的来源。`OAC_PUBLIC_URL` 未设置或为空时，会选用 `http://localhost:8080`，从而允许在配置公共域名前启动。Core 和 Web 会收到同一个值。要允许公共访问，请将 `OAC_PUBLIC_URL` 设置为不带尾部斜杠的准确公共 HTTPS 源地址，并使用相同的项目和数据卷重新部署 Core 和 Web；更改环境变量需要重新创建容器，而不只是重启。请在添加节点或执行器之前配置公共源地址。平台负责 TLS，并将流量路由到 `gateway:8080`；Web 由安装程序管理的域设置不可用。
+发行版中的[独立 Compose 文件](getting-started/install-options.md#docker-compose-and-hosting-platforms)从平台环境读取进程设置。`OAC_PUBLIC_URL` 为空时选用 `http://localhost:8080`。把它设成准确的公共源地址，不要带尾部斜杠，并在添加节点或执行器之前重新创建 Core 和 Web。平台终止 TLS，并把流量转到 `web:8080`。
 
-初始化服务首次生成机密信息和安装 ID，随后在后续部署中验证它们。每项机密信息都只有一个持久来源；Core 的密钥摘要派生自 Web 的登录密钥。对于现有安装，初始化绝不会替换缺失或已更改的机密信息。Core 会读取现有的进程环境和文件设置，因此安装程序专用的 `config.json`、`oac apply` 和启动时提供的设置快照不适用于此部署。
+初始化服务首次生成机密信息和安装 ID，随后在后续部署中验证它们。每项机密信息都只有一个持久来源；Core 的密钥摘要派生自 Web 的登录密钥。对于现有安装，初始化绝不会替换缺失或已更改的机密信息。Core 从 `.env` 读取进程环境。
 
-| Compose 卷 | 内容 | 读取方 |
+| 数据目录路径 | 内容 | 读取方 |
 | --- | --- | --- |
-| `database` | PostgreSQL 数据 | PostgreSQL；初始化会检查它是否为空 |
-| `database-secret` | 生成的数据库密码 | PostgreSQL、迁移程序和 Core |
-| `core-config` | 凭据加密密钥、安装 ID、Core 密钥摘要和初始化回执 | 迁移程序和 Core |
-| `web-secret` | 生成的 Core 登录密钥 | Web 和显式 `credentials` 工具 |
-| `core-state` | 私有 Provider 状态 | Core |
-| `node-payload` | 已验证的节点安装元数据 | Web |
+| `database/` | PostgreSQL 数据 | PostgreSQL；初始化会检查它是否为空 |
+| `secrets/database/` | 生成的数据库密码 | PostgreSQL 和 Core |
+| `secrets/core/` | 凭据加密密钥、安装 ID 和 Core 密钥摘要 | Core |
+| `secrets/web/` | 生成的 Core 登录密钥 | Web |
+| `state/` | 私有 Provider 状态 | Core |
+| `node-payload/` | 已验证的节点安装元数据 | Web |
 
-初始化会准备这些卷；应用服务以只读方式接收其中的机密卷。`credentials` 工具会禁用容器日志记录。只能在运维人员终端中获取其输出。数据库密码和凭据加密密钥绝不打印。
+初始化会准备该目录；应用服务以只读方式接收各自的机密目录。`docker compose exec web oac-web core-key` 把 Core 密钥打印到运维人员终端，不写入容器日志。数据库密码和凭据加密密钥绝不打印。
 
-Compose 项目名称用于限定卷的作用域。必须将该项目的定义和公共 URL 与每个卷一同保留。仅删除机密卷不会重置安装；如果数据库已经存在，初始化会拒绝重新开始。Core 还会将安装 ID 与其数据库绑定。运行时设置仍存储在 [Core 的数据库](#runtime-settings-web)中。
+`OAC_DATA_DIR` 选择该目录，默认是 Compose 文件旁的 `./data`。必须将该项目的定义和公共 URL 与该目录一同保留。仅删除机密目录不会重置安装；如果数据库已经存在，初始化会拒绝重新开始。Core 还会将安装 ID 与其数据库绑定。运行时设置仍存储在 [Core 的数据库](#runtime-settings-web)中。
 
 ## Docker 节点配置 {#docker-node-configuration}
 
-节点安装程序会将 Docker 的提供商配置写入节点的配置文件；这些字段独立于 Core 的 `config.json`。部署资源、Runtime 镜像和容量仍存储在 [Core 的数据库](#runtime-settings-web)中。
+节点安装程序会将 Docker 的提供商配置写入节点的配置文件。部署资源、Runtime 镜像和容量仍存储在 [Core 的数据库](#runtime-settings-web)中。
 
 | 字段 | 安装程序设置的值 | 含义 |
 | --- | --- | --- |
@@ -145,56 +123,51 @@ Compose 项目名称用于限定卷的作用域。必须将该项目的定义和
 
 ## 安装目录 {#installation-directory}
 
-安装程序会创建安装目录，默认路径为 `~/.oac/core`，权限模式为 `0700`；`secrets/` 中的文件权限模式为 `0600`。
+安装程序会创建安装目录，默认路径为 `~/.oac/core`，权限模式为 `0700`。机密文件为 `0600`。
 
 | 路径 | 内容 | 修改者 |
 | --- | --- | --- |
-| `config.json` | [进程设置](#process-settings-config-json)。唯一由你编辑的文件 | 你，然后运行 `oac apply`；也可通过托管域设置更改 `public_url` |
-| `oac` | [管理命令](getting-started/operations.md#the-oac-command) | 安装程序 |
-| `state.json` | 安装 ID、Compose 项目名称、镜像 ID、源提交、生成文件的摘要，以及服务是否曾启动过 | 仅工具 |
-| `secrets/core.key` | [Core 密钥](getting-started/operations.md#core-key) | `oac rotate-core-key` |
-| `secrets/credential.key` | 用于加密 Core 在数据库中封存内容的密钥：模型提供商、E2B 密钥、Vault 凭据、Skills、初始文件和环境设置 | 无。必须与数据库一同保留；`oac apply` 会拒绝已更改的文件 |
-| `secrets/database.password` | PostgreSQL 密码 | 无。PostgreSQL 仅在创建数据库时读取它；`oac apply` 会拒绝已更改的文件 |
-| `generated/` | 派生自 `config.json` 的文件 | `oac apply` |
-| `node-payload/` | Web 在 `/node-install/` 提供的节点安装程序和节点文件，每个发行版一个目录 | 安装程序 |
-| `native-installers/` | 安装包包含时，各平台的自托管守护进程安装程序及其目录清单 | 安装程序 |
-| `state/e2b/` | 私有 E2B 回执 | Core |
-| `ingress/` | 托管 HTTPS：证书和网关状态、域设置状态及控制套接字 | `gateway` 和 `installation` 服务 |
-| `.oac.lock` | 安装锁 | 安装程序和会修改安装状态的 `oac` 命令 |
-
-只有使用托管入口时才有 `ingress/`。
-
-在 Docker 中，Compose 项目名为 `oac-<10 hex digits>`（即 `state.json` 中的 `project`）。其服务包括 `database`、`migrate`、`core` 和 `web`；使用托管入口时还包括 `gateway` 和 `installation`。`gateway` 会将流量路由到 Core 和 Web，并发布 `ports.web`；启用 HTTPS 后，还会发布 [80 和 443](getting-started/install-options.md#ports)。`installation` 会应用来自 Web 的域更改，并使用 Docker 套接字执行更改。卷 `<project>_database` 保存所有数据。除 Docker 存储外，不会向主目录之外写入任何内容。
+| `.env` | [进程设置](#process-settings-configjson)。由你编辑的文件 | 你，然后运行 `oac apply`；托管域名设置写入 `OAC_PUBLIC_URL` |
+| `compose.yaml`、`ports.yaml` | 发行版的服务定义。不要编辑 | 发行版 |
+| `oac` | [管理命令](getting-started/operations.md#the-oac-command)，从 Core 镜像复制 | 安装程序 |
+| `data/secrets/web/core.key` | [Core 密钥](getting-started/operations.md#core-key) | `oac rotate-core-key` |
+| `data/secrets/core/credential.key` | 加密 Core 在数据库中封存内容的密钥 | 无。必须与数据库一同保留 |
+| `data/secrets/core/core-key-digests.json` | Core 密钥的 SHA-256 | `oac rotate-core-key` |
+| `data/secrets/database/password` | PostgreSQL 密码 | 无。PostgreSQL 仅在创建数据库时读取 |
+| `data/database/` | PostgreSQL 数据 | PostgreSQL |
+| `data/node-payload/` | Web 在 `/node-install/` 提供的节点文件 | 初始化 |
+| `data/state/` | 私有 Provider 状态，包括 E2B 回执 | Core |
+| `.oac.lock` | 安装锁 | 会修改安装状态的 `oac` 命令 |
+
+Compose 项目名为 `oac-<10 hex digits>`。服务包括 `init`、`database`、`core` 和 `web`。Core 启动时执行数据库迁移。`web` 提供控制台并把 `/v1` 和 `/api/v1` 转发到 Core，是唯一发布 `OAC_WEB_PORT` 的服务。主机安装还把 Core 的管理 API 发布在 `127.0.0.1:8091`。没有服务持有 Docker 套接字。除 Docker 存储外，不会向安装目录之外写入任何内容。
 
 ## 附录：没有安装程序时的 Core 环境 {#appendix-core-environment-without-the-installer}
 
-Core 只读取其环境。安装程序会根据 `config.json` 生成 `generated/core.env`；如果你自行运行 Core（请参阅[服务指南](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/README.md)），则应设置以下变量。Compose 使用 `env_file` 加载该文件，因此 Compose 必须为 2.26.0 或更高版本。
+Core 只读取其环境。Compose 把 `.env` 插值进服务环境。Compose 必须为 2.26.0 或更高版本。如果你自行运行 Core，请设置这些变量；见[服务指南](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/README.md)。
 
 | 变量 | 设置来源 |
 | --- | --- |
 | `OAC_PUBLIC_URL` | `public_url`，或 Core 的回环源地址。Core 从中派生守护进程 WebSocket URL、自托管 `remote_url`、托管沙箱地址和部署的只读 `core_url`，绝不从请求标头派生。未设置时，Core 不运行 Runtime 网关，也不执行任何 Session |
 | `OAC_ADDR` | 安装程序在容器中设置为 `:8091`。独立启动的 Core 在未设置或为空时，默认使用 `127.0.0.1:8091` |
 | `OAC_DATABASE_URL` | 该安装不含密码的 PostgreSQL URL，并将 `core.database_pool` 作为 `pool_*` 查询参数附加到其中 |
-| `OAC_DATABASE_PASSWORD_FILE` | `secrets/database.password`。此时 URL 不得包含密码；迁移和维护命令也会读取该文件 |
-| `OAC_CREDENTIAL_KEY_FILE` | `secrets/credential.key` |
-| `OAC_CORE_KEY_DIGESTS_FILE` | `generated/core-key-digests.json`：一个包含 Core 密钥 SHA-256 的 JSON 数组 |
-| `OAC_INSTALLATION_ID` | `state.json` 中的安装 ID，采用规范 UUID 格式。它会启用沙箱部署和节点路由，并要求设置 `OAC_PUBLIC_URL` 和 `OAC_CORE_KEY_DIGESTS_FILE`。如果 ID 与数据库记录的 ID 不一致，Core 会拒绝它，因此必须将两者一同保留 |
-| `OAC_SETTINGS_FILE` | `generated/settings.json`，即 Core 在 `GET /core/v1/installation` 提供的快照；Core 不会据此执行操作 |
-| `OAC_EXECUTION_CONCURRENCY`、`OAC_DEFAULT_HARNESS`、`OAC_WRITE_AUDIT_RETENTION`、`OAC_OAUTH_TRUSTED_ORIGINS` | 对应的[进程设置](#settings)；省略或为空时，默认 Harness 使用 `core.default_harness` 中记录的默认值 |
-| `OAC_HARNESSES` | 使用安装程序时来自 `core.harnesses`。独立启动 Core 时，未设置则仅启用默认 Harness；以逗号分隔的显式名称会补充到其中。条目会去除首尾空白并去重；未知名称会阻止启动 |
-| `OAC_HISTORY_SETTINGS_FILE` | `generated/runtime-history.json`：设置后的 [`core.runtime_history`](#settings) 对象 |
+| `OAC_DATABASE_PASSWORD_FILE` | `data/secrets/database/password`。此时 URL 不得包含密码 |
+| `OAC_CREDENTIAL_KEY_FILE` | `data/secrets/core/credential.key` |
+| `OAC_CORE_KEY_DIGESTS_FILE` | `data/secrets/core/core-key-digests.json`：一个包含 Core 密钥 SHA-256 的 JSON 数组 |
+| `OAC_INSTALLATION_ID_FILE` | `data/secrets/core/installation.id`：安装 ID，采用规范 UUID 格式。它会启用沙箱部署和节点路由，并要求设置 `OAC_PUBLIC_URL` 和 `OAC_CORE_KEY_DIGESTS_FILE`。如果 ID 与数据库记录的 ID 不一致，Core 会拒绝它，因此必须将两者一同保留 |
+| `OAC_EXECUTION_CONCURRENCY`、`OAC_DEFAULT_HARNESS`、`OAC_HARNESSES`、`OAC_WRITE_AUDIT_RETENTION`、`OAC_OAUTH_TRUSTED_ORIGINS` | 对应的[进程设置](#settings)。`oac-core check-config` 会在不启动 Core 的情况下校验它们 |
+| `OAC_HISTORY_SETTINGS_FILE` | 可选的 Runtime 历史文件。敏感；安装报告只说明它是否已设置 |
 | `OAC_LOG_LEVEL`、`OAC_LOG_FORMAT`、`OAC_LOG_ADD_SOURCE` | `log.*`；Web 也读取这三个设置 |
-| `OAC_PROVIDER_ROOT` | 适配器构件的绝对根目录：Core 镜像中为 `/opt/oac`。每个适配器都拥有此根目录下的辅助路径 |
+| `OAC_PROVIDER_ROOT` | 适配器构件的绝对根目录。Core 镜像设置为 `/opt/oac`。每个适配器都拥有此根目录下的辅助路径 |
 | `OAC_PROVIDER_STATE_ROOT` | 绝对私有状态根目录：Core 镜像中为 `/state`。每个适配器都拥有自己的子目录；E2B 使用 `e2b/`，该目录归 Core 的用户所有，不允许组或其他用户访问。将其与数据库和 `credential.key` 一起备份；不要将其挂载到 Web 或 Runtime 中 |
-| `OAC_NATIVE_INSTALLER_DIR` | `native-installers/`，供自托管计算机获取；Core 镜像在 `/opt/oac/native-installers` 中有一份副本，未设置此变量时使用该副本。提供目录清单前，Core 会将其与自身发行版进行核对 |
+| `OAC_NATIVE_INSTALLER_DIR` | 自托管守护进程安装程序：Compose 文件中为 `/opt/oac/native-installers`。未设置时 Core 不提供安装程序。提供目录清单前，Core 会将其与自身发行版进行核对 |
 
 Core 会记录所加载文件的路径，但绝不记录环境变量的值或文件内容。
 
-显式 OAuth 受信任源无效时，Core 会停止启动。条目必须是不含凭据、查询参数和非根路径的 HTTPS 源地址；安装程序会在生成这些源地址之前验证 `core.oauth_trusted_origins`。[Vaults](../../contracts/agents-api/zh/vaults.md) 负责刷新和网络策略。私有颁发者还需要受信任的 CA：独立管理的 Unix Core 可以使用 Go 的 `SSL_CERT_FILE` PEM CA-bundle 覆盖机制，从而保留证书验证。托管安装没有自定义 CA 设置或挂载点；不要编辑 `generated/core.env`。
+显式 OAuth 受信任源无效时，Core 会停止启动。条目必须是不含凭据、查询参数和非根路径的 HTTPS 源地址。[Vaults](../../contracts/agents-api/zh/vaults.md) 负责刷新和网络策略。私有颁发者还需要受信任的 CA：独立管理的 Unix Core 可以使用 Go 的 `SSL_CERT_FILE` PEM CA-bundle 覆盖机制，从而保留证书验证。托管安装没有自定义 CA 设置。
 
 ## 附录：没有安装程序时的 Web 环境 {#appendix-web-environment-without-the-installer}
 
-安装程序根据 `config.json` 设置以下变量；仅当你在没有安装程序的情况下运行控制台时，才自行设置它们。对于该安装的机密信息，安装程序只向控制台提供 `secrets/core.key`。
+Compose 为 Web 设置这些变量。仅在不使用 Compose 运行控制台时才自行设置。该安装的机密信息中，Web 只收到 `data/secrets/web/core.key`。
 
 | 变量 | 默认值 | 含义 |
 | --- | --- | --- |
@@ -204,7 +177,5 @@ Core 会记录所加载文件的路径，但绝不记录环境变量的值或文
 | `OAC_WEB_CORE_KEY_FILE` | `/admin/core.key` | 常规文件的绝对路径，该文件没有组或其他用户权限，并保存 Core 密钥：至少 32 个字符、不含空白字符、最大 4 KiB |
 | `OAC_WEB_DIST` | `/www` | 已构建控制台的绝对目录；必须包含 `index.html` |
 | `OAC_WEB_NODE_PAYLOAD_DIR` | 未设置 | 所匹配发行版的节点载荷（即安装程序的 `node-payload/`）的绝对路径。未设置时，不提供 `/node-install/*`，且 Add node 不可用 |
-| `OAC_WEB_INSTALLATION_SOCKET` | 未设置 | 安装程序域套接字的绝对路径。未设置时，域设置会报告不支持 |
-| `OAC_WEB_BOOTSTRAP` | `0` | `1` 允许在配置域名前使用 IP 字面量作为主机。要求使用 `http://` 源地址并设置 `OAC_WEB_INSTALLATION_SOCKET` |
 
 变量不存在时会应用默认值；显式空值会按已提供的值进行验证。无效的 `OAC_WEB_*` 值会阻止控制台启动，并显示一条指明变量名的消息。控制台还会读取 `OAC_LOG_LEVEL`、`OAC_LOG_FORMAT` 和 `OAC_LOG_ADD_SOURCE`（[Core 环境](#appendix-core-environment-without-the-installer)）；未知值会回退到其默认值。对于不在同一台计算机上的任何浏览器，请使用 HTTPS。
diff --git a/docs/zh/development.md b/docs/zh/development.md
index 0b7a06eb1..4f262eb85 100644
--- a/docs/zh/development.md
+++ b/docs/zh/development.md
@@ -1,7 +1,7 @@
 ---
 title: "开发 OpenAgentCore"
 source: docs/development.md
-source_hash: ce56d4c1c55f263c03ba7e39ea8e700eca6c6b3c8a372f20f36e87c9f0ec5330
+source_hash: b7025e9b2072924c33656e0319363cf3564593bb1e2506a891be5be251087c11
 ---
 
 准备工作副本，构建组件并验证修改。如需使用已安装的实例，从[入门指南](getting-started/index.md)开始。修改代码前阅读[贡献者规则](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md)。
@@ -78,7 +78,7 @@ Core 构建产物和输出目录设置见[独立 Core 构建](maintainers.md#sta
 | `services/core/internal/sandbox` | Provider 接口与托管计算资源生命周期 | [Provider 接入](sandbox-provider.md) |
 | `services/web` | 控制台登录与服务端管理代理 | [控制台服务端](web/console-server.md) |
 | `apps/web` 和 `packages/agents-client` | 控制台 UI 与类型化 client | [Web 指南](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/web/README.md) |
-| `deploy/install` 和 `scripts` | 发行、安装和验证工具 | [维护者指南](maintainers.md) |
+| `deploy` 和 `scripts` | 发行、安装和验证工具 | [维护者指南](maintainers.md) |
 | `contracts/agents-api` | 固定 schema、语义契约和覆盖台账 | [覆盖台账](../../contracts/agents-api/zh/index.md) |
 
 ## 选择扩展边界 {#choose-an-extension-boundary}
diff --git a/docs/zh/getting-started/install-options.md b/docs/zh/getting-started/install-options.md
index 03b553f3e..a5ddaf3ac 100644
--- a/docs/zh/getting-started/install-options.md
+++ b/docs/zh/getting-started/install-options.md
@@ -1,7 +1,7 @@
 ---
 title: "安装选项与高级部署"
 source: docs/getting-started/install-options.md
-source_hash: 7178baf93a8d8b6e7f086d73033afe4ea14afcf41c88dbcc6031a3a6dd20ca17
+source_hash: f9a5aae96ce8789030eda5cb399eac7c2e6bc6bd4d9bcce18138373c97cb0e96
 ---
 
 [默认安装](install.md)无需任何选项。使用本页可以在现有反向代理后运行，或者在无法访问互联网时进行安装。
@@ -18,16 +18,16 @@ source_hash: 7178baf93a8d8b6e7f086d73033afe4ea14afcf41c88dbcc6031a3a6dd20ca17
 
 ## Docker Compose 与托管平台 {#docker-compose-and-hosting-platforms}
 
-在 Linux amd64 上使用 Docker Compose 2.26 或更高版本，并采用自带完整依赖的 [Compose 模板](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/compose/compose.yaml)。它会拉取现有的、按摘要固定版本的 v0.0.3 镜像，并启动 PostgreSQL、Core、Web 和一个 HTTP 网关。一次性初始化服务会在持久化卷中生成随机机密信息并准备节点安装程序；迁移服务会在 Core 启动前初始化数据库。[Compose 配置](../configuration.md#compose-installations)负责管理各项设置和卷。
+在 Linux amd64 上使用发行版中的 `compose.yaml` 和 Docker Compose 2.26 或更高版本。发行流程会把节点元数据渲染进 [Compose 模板](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/compose/compose.yaml)。Core 和 Web 使用 `latest` 镜像，PostgreSQL 使用 `postgres:16-alpine`。它会启动 PostgreSQL、Core 和 Web。Web 把 `/v1` 和 `/api/v1` 转发到 Core。数据通过目录 bind mount 挂载。一次性初始化服务会在该目录中生成随机机密信息并准备节点安装程序；Core 启动时执行数据库迁移。[Compose 配置](../configuration.md#compose-installations)负责管理各项设置和数据目录。
 
-进行本地试用时，请将 `compose.yaml` 和[本地端口覆盖](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/compose/local.yaml)下载到同一个目录，然后运行：
+进行本地试用时，请将同一发行版的 `compose.yaml` 和 `ports.yaml` 下载到同一个目录，然后运行：
 
 ```sh
-docker compose -f compose.yaml -f local.yaml up -d --wait --wait-timeout 900
-docker compose -f compose.yaml run --rm credentials
+docker compose -f compose.yaml -f ports.yaml up -d --wait --wait-timeout 900
+docker compose -f compose.yaml exec web oac-web core-key
 ```
 
-`credentials` 命令会将生成的 Core 密钥打印到终端，而不会将其存储在容器日志中。打开 `http://localhost:8080` 并使用该密钥登录。所有安装机密信息都会自动生成；重启时请保留同一个 Compose 项目及其卷。
+`oac-web core-key` 会将生成的 Core 密钥打印到终端，而不会将其写入容器日志。打开 `http://localhost:8080` 并使用该密钥登录。所有安装机密信息都会自动生成；重启时请保留同一个 Compose 项目及其数据目录。
 
 首次初始化会下载并验证该发布版本中约 385 MB 的控制归档文件，仅保留较小的节点安装元数据。后续启动会验证已保存的文件，而不会再次下载。镜像需要额外下载。首次初始化中断后可以重新运行；如果现有数据库缺少安装机密信息，初始化会被拒绝。
 
@@ -35,73 +35,61 @@ docker compose -f compose.yaml run --rm credentials
 
 ### Dokploy {#dokploy}
 
-创建一个 Docker Compose 应用并粘贴 `compose.yaml`。将 `OAC_PUBLIC_URL` 设置为公共 HTTPS 源地址，启用隔离部署，并为 `gateway` 服务添加域名和端口 `8080`。部署前，为此域名启用 **HTTPS**，并选择 **Let's Encrypt** 等证书提供程序。部署时不要使用 `local.yaml`；内部服务不会发布主机端口。将此 Compose 文件打包到 Dokploy 模板目录时，[模板元数据](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/compose/dokploy.toml)会提供生成的域名和环境；导入后仍需启用 HTTPS 及其证书提供程序。
+创建一个 Docker Compose 应用并粘贴 `compose.yaml`。将 `OAC_PUBLIC_URL` 设置为公共 HTTPS 源地址，启用隔离部署，并为 `web` 服务添加域名和端口 `8080`。部署前，为此域名启用 **HTTPS**，并选择 **Let's Encrypt** 等证书提供程序。部署时不要使用 `ports.yaml`；内部服务不会发布主机端口。将此 Compose 文件打包到 Dokploy 模板目录时，[模板元数据](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/compose/dokploy.toml)会提供生成的域名和环境；导入后仍需启用 HTTPS 及其证书提供程序。
 
 ### Coolify {#coolify}
 
-创建一个 **Docker Compose Empty** 服务并粘贴 `compose.yaml`。将 `OAC_PUBLIC_URL` 设置为公共 HTTPS 源地址，并将该域名分配给 `gateway` 服务的端口 `8080`。将 Coolify 的 `exclude_from_hc: true` 添加到 `init`、`migrate` 和 `credentials` 的服务定义中，使已完成的初始化和可选工具不会影响其总体健康状态。保存并在不包含 `local.yaml` 的情况下部署；HTTPS 由 Coolify 提供。
+创建一个 **Docker Compose Empty** 服务并粘贴 `compose.yaml`。将 `OAC_PUBLIC_URL` 设置为公共 HTTPS 源地址，并将该域名分配给 `web` 服务的端口 `8080`。将 Coolify 的 `exclude_from_hc: true` 添加到 `init` 的服务定义中，使已完成的初始化不会影响其总体健康状态。保存并在不包含 `ports.yaml` 的情况下部署；HTTPS 由 Coolify 提供。
 
-在这两个平台上，打开服务器终端并运行 `docker compose ls`，查找已部署的项目名称和 Compose 文件。使用这些完全一致的值以及该部署的 `OAC_PUBLIC_URL`，运行 `docker compose -p <project-name> -f <compose-file> run --rm credentials`，然后在已配置的源地址登录。[Dokploy 域名指南](https://docs.dokploy.com/docs/core/docker-compose/domains)和[Coolify Compose 指南](https://coolify.io/docs/services/configuration/docker-compose)介绍了各自的域和服务控制项。这些都是可导入的部署文件；本仓库不发布托管市场条目。
+在这两个平台上，打开服务器终端并运行 `docker compose ls`，查找已部署的项目名称和 Compose 文件。使用这些完全一致的值以及该部署的 `OAC_PUBLIC_URL`，运行 `docker compose -p <project-name> -f <compose-file> exec web oac-web core-key`，然后在已配置的源地址登录。[Dokploy 域名指南](https://docs.dokploy.com/docs/core/docker-compose/domains)和[Coolify Compose 指南](https://coolify.io/docs/services/configuration/docker-compose)介绍了各自的域和服务控制项。这些都是可导入的部署文件；本仓库不发布托管市场条目。
 
 登录后，使用 [Nodes](nodes.md)选择沙箱后端并添加节点。Compose 堆栈部署控制平面；执行机器仍需单独部署。
 
-使用相同的文件和环境运行 `docker compose stop` 以停止服务。停止服务后，将所有[安装卷](../configuration.md#compose-installations)一起备份。请遵循[安装版本策略](operations.md#installation-version-policy)：使用不同发布版本时，需要创建新的 Compose 项目并使用全新的卷。
+使用相同的文件和环境运行 `docker compose stop` 以停止服务。停止服务后，备份数据目录。请遵循[安装版本策略](operations.md#installation-version-policy)：使用不同发布版本时，需要创建新的 Compose 项目并使用全新的数据目录。
 
 ## 进程设置 {#process-settings}
 
-这些标志只会一次性初始化安装的 `config.json`。其默认值、有效值和重启行为在[配置参考](../configuration.md#settings)中定义。安装完成后，编辑该文件并运行 `oac apply`；重新运行安装程序只会[修复](operations.md#installation-version-policy)安装。
+这些标志只会一次性写入 `.env`。安装完成后，编辑该文件并运行 `oac apply`。安装程序不会更改已经启动的安装。
 
 以下表格是由脚本自动生成的参考信息，因此保留为英文原文：
-[//]: # (BEGIN install-flags: generated by scripts/config-reference.py)
-| Flag | config.json field |
+| Flag | `.env` variable |
 | --- | --- |
-| `--public-url` | `public_url` |
-| `--host` | `host` |
-| `--core-port` | `ports.core` |
-| `--web-port` | `ports.web` |
-| `--ingress` | `ingress` |
-[//]: # (END install-flags)
-
-`--config FILE` 会改为从 JSON 文件初始化 `config.json`，而不再使用这些设置标志；两者不能结合使用。`--config` 文档遵循 schema 默认值，因此若要使用托管 HTTPS，请在其中设置 `ingress: "managed"` 和 `host: "0.0.0.0"`。
+| `--public-url` | `OAC_PUBLIC_URL` |
+| `--host` | `OAC_HOST` |
+| `--web-port` | `OAC_WEB_PORT` |
 
 ## 安装操作 {#installation-actions}
 
-这些选项用于选择安装位置或执行初始设置；不会保存在 `config.json` 中。
+`--install-dir` 选择安装目录。它不是进程设置。
 
 | 选项 | 用途 |
 | --- | --- |
 | `--install-dir DIR` | 绝对安装目录；默认为 `~/.oac/core`。新安装要求目录为空或不存在，或者包含一个[从未启动过的安装](install.md#install) |
 
-只要使用不同的安装目录和端口，多个安装就可以共用一台机器。对于一个 IP 地址，只有使用托管 HTTPS 的一个安装可以占用端口 80 和 443；如果需要更多安装，请使用不同的 IP 地址或外部共享代理。每个安装都有自己的数据库、Core 密钥和节点。
+只要使用不同的安装目录和端口，多个安装就可以共用一台机器。需要更多安装时，请使用不同的 IP 地址或共享反向代理。每个安装都有自己的数据库、Core 密钥和节点。
 
 ## 沙箱后端 {#sandbox-backend}
 
-服务健康之后，安装程序会按 Web 的 [`standard-sizes.json`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/web/src/features/sandbox/standard-sizes.json) 中的 Standard 尺寸保存 microsandbox。该选择保存在 Core 的数据库中，而不是 `config.json` 中，修复安装时不会更改它。如果 Core 拒绝该选择，安装程序会打印 Core 返回的消息并退出；服务会继续运行，你可以在 Web 中选择后端。
-
-要使用 Docker 或 E2B，或使用其他尺寸，请打开 **System** → **Manage sandbox configuration**，然后[重置部署](nodes.md#change-the-sandbox-configuration)。Docker 沙箱与每个节点共用该节点的内核，其节点服务账户[等效于 root](nodes.md#what-the-installer-sets-up)。E2B 需要一个非回环的公共 HTTPS URL，因为 E2B 沙箱会从 E2B 云端调用 Core。按照 [E2B 指南](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/deploy/e2b/README.md)准备模板。
+安装程序不保存沙箱后端。登录后，打开 **System** → **Manage sandbox configuration**，选择 Docker、microsandbox 或 E2B；Web 会按 [`standard-sizes.json`](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/apps/web/src/features/sandbox/standard-sizes.json) 推荐 Standard 尺寸。该选择保存在 Core 的数据库中。以后要更改，请[重置部署](nodes.md#change-the-sandbox-configuration)。Docker 沙箱与每个节点共用该节点的内核，其节点服务账户[等效于 root](nodes.md#what-the-installer-sets-up)。E2B 需要一个非回环的公共 HTTPS URL，因为 E2B 沙箱会从 E2B 云端调用 Core。按照 [E2B 指南](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/deploy/e2b/README.md)准备模板。
 
 ## 监听器与访问 {#listeners-and-access}
 
-默认安装会选择 `--ingress managed` 和 `--host 0.0.0.0`。其网关会在 `--web-port` 上发布 Web（默认为 8080），并在启用 HTTPS 后发布端口 80 和 443。Core 的 `--core-port` 保持为回环地址，PostgreSQL 保持私有。`--host` 接受 IPv4 或 IPv6 地址，但不能包含端口、协议方案或区域。请在浏览器中使用服务器的具体 IP 地址，而不是通配地址。托管入口需要本地 Docker Unix 套接字。
-
-`--ingress external` 会改用你自己的反向代理。随后 Core 和 Web 会在 `--host` 上监听，默认是回环地址。外部非回环监听器需要基于 HTTPS 的 `public_url` 和[反向代理](#https-and-the-reverse-proxy)，并且无法使用 Web 的域名设置：请在 `config.json` 中设置 `public_url`，然后运行 `oac apply`。
+默认安装在 `--host 0.0.0.0` 的 `--web-port`（8080）上发布 Web。Core 的管理 API 留在 `127.0.0.1:8091`。PostgreSQL 保持私有。`--host` 是不含端口、协议或区域的 IPv4 或 IPv6 地址。请在浏览器中使用服务器的具体 IP，而不是通配地址。
 
-`--public-url` 会为无人值守设置初始化一个基于 DNS 的 HTTPS 源地址；使用托管入口时，证书和连接检查必须通过。安装完成后，入口模式便固定不变。
+`--public-url` 设置 `OAC_PUBLIC_URL`，即应用、节点和执行器使用的源地址。把它设为反向代理提供的 HTTPS 源地址。
 
 ### 端口 {#ports}
 
-在验证捆绑包或加载镜像之前，安装程序会检查 `--host` 以及安装将要监听的每个端口：Web 和 Core 的端口，以及使用托管入口和 `--public-url` 时的端口 80 和 443。
+安装程序在下载镜像之前检查 `--web-port`。
 
-- `--host` 必须是本机的地址，或者是 `0.0.0.0` 之类的通配地址。
-- 通过 `--web-port`、`--core-port` 或 `--config` 文件设置的端口必须处于空闲状态；由回环地址型 `--public-url` 指定的端口也必须空闲，例如 `http://localhost:8080` 中的 8080。否则，安装程序会停止，指出该端口，并打印用于查找占用进程的 `ss` 命令。
-- 未指定 Web 或 Core 端口时，会从其默认值向上选择第一个空闲端口，最多增加 20，并且绝不会改用同一安装的其他端口。安装程序会将所选端口写入 `config.json`，并在摘要中指出该端口，例如 `Port 8080 was in use; Web uses 8081.`
-- 托管入口仅将端口 80 和 443 用于 HTTPS，并且绝不会移动这些端口。通过 `--public-url` 或 [Web 中的域名设置](install.md#configure-the-domain-and-https)设置 `public_url` 后，网关才会发布这两个端口；主机上的任何其他程序都不得使用它们。如果安装时其中任一端口已被占用，请先释放该端口，不使用 `--public-url` 进行安装并稍后设置域名，或者使用 `--ingress external` 进行安装并采用你自己的[反向代理](#https-and-the-reverse-proxy)。
+- `--host` 是该端口绑定的地址。`0.0.0.0` 在所有 IPv4 接口发布 Web。`127.0.0.1` 只在本机发布 Web。
+- 端口被占用时安装停止，不会改用其他端口。
 
-安装完成后，`oac apply` 会[检查端口](../configuration.md#how-oac-apply-works)：检查发生更改的 `host` 或端口；当 `public_url` 启用 HTTPS 时，还会检查端口 80 和 443。Web 中的域名设置和 `oac domain` 会在启动前检查主机名能否解析，以及是否有其他程序占用端口 80 或 443，并指出正在使用的端口。
+`OAC_HOST` 或 `OAC_WEB_PORT` 变化时，`oac apply` 会重新创建 Web。
 
 ## HTTPS 与反向代理 {#https-and-the-reverse-proxy}
 
-使用外部入口时，Core 和 Web 共用一个公共源地址。你的反向代理负责终止 TLS，并按路径进行路由：
+请用 `--host 127.0.0.1` 安装，并把反向代理指向 Web，默认是 `127.0.0.1:8080`。Web 把 `/v1`、`/api/v1` 和 `/docs` 转到 Core，其余由自己提供。
 
 | 路径 | 目标 | 调用方 |
 | --- | --- | --- |
@@ -111,65 +99,22 @@ docker compose -f compose.yaml run --rm credentials
 
 反向代理必须：
 
-- **保留 Host。** Web 仅接受其公共 URL 中指定的主机。
+- **保留 Host。** Web 仅接受 `OAC_PUBLIC_URL` 中的主机。
 - **传递 WebSocket 升级请求**，包括 `/api/v1` 上的升级请求。
 - **不对流进行缓冲或设置超时。** `/v1` 会流式传输 Session 事件。
 - **接受大文件上传。** 源文件最大可达 512 MiB；具体限制由 Core 执行。
 
-按照默认配置，让 Core 和 Web 在回环地址上监听，并在 Core 主机上运行反向代理。`oac status` 会使用你的地址和端口打印这些路由。
+按照默认配置，让网关在回环地址上监听，并在 Core 主机上运行反向代理。
 
 **Caddy** 会自行获取证书，默认传递 Host 并支持 WebSockets：
 
 ```caddyfile
 core.example {
-	@core path /v1 /v1/* /api/v1/*
-	handle @core {
-		reverse_proxy 127.0.0.1:8091
-	}
-	handle {
-		reverse_proxy 127.0.0.1:8080
-	}
-}
-```
-
-以 **nginx** 为例，在 `http` 块内的 `/etc/nginx/conf.d/oac.conf` 中配置：
-
-```nginx
-map $http_upgrade $connection_upgrade {
-    default upgrade;
-    ''      close;
-}
-
-server {
-    listen 80;
-    server_name core.example;
-    return 301 https://$host$request_uri;
-}
-
-server {
-    listen 443 ssl;
-    server_name core.example;
-    ssl_certificate     /etc/letsencrypt/live/core.example/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/core.example/privkey.pem;
-
-    client_max_body_size 0;          # Core enforces its own upload limits
-    proxy_http_version 1.1;
-    proxy_set_header Host $http_host;
-    proxy_set_header Upgrade $http_upgrade;
-    proxy_set_header Connection $connection_upgrade;
-    proxy_buffering off;             # server-sent events on /v1
-    proxy_request_buffering off;
-    proxy_read_timeout 1h;           # long-lived WebSockets and streams
-    proxy_send_timeout 1h;
-
-    location = /v1    { proxy_pass http://127.0.0.1:8091; }
-    location /v1/     { proxy_pass http://127.0.0.1:8091; }
-    location /api/v1/ { proxy_pass http://127.0.0.1:8091; }
-    location /        { proxy_pass http://127.0.0.1:8080; }
+	reverse_proxy 127.0.0.1:8080
 }
 ```
 
-然后在 `~/.oac/core/config.json` 中设置 `public_url`，并运行 `~/.oac/core/oac apply`。检查路由：
+然后在 `~/.oac/core/.env` 中设置 `OAC_PUBLIC_URL=https://core.example`，并运行 `~/.oac/core/oac apply`。检查路由：
 
 ```sh
 curl -s -o /dev/null -w '%{http_code}\n' -H 'OpenAI-Beta: agents=v1' https://core.example/v1/agents
@@ -186,21 +131,16 @@ curl -s -o /dev/null -w '%{http_code}\n' -H 'OpenAI-Beta: agents=v1' https://cor
 ```caddyfile
 http://:8443 {
 	bind 127.0.0.1
-	@core path /v1 /v1/* /api/v1/*
-	handle @core {
-		reverse_proxy 127.0.0.1:8091
-	}
-	handle {
-		reverse_proxy 127.0.0.1:8080
-	}
+	reverse_proxy 127.0.0.1:8080
 }
 ```
 
 1. 启动代理：`caddy run --config Caddyfile`。
 2. 启动隧道：`cloudflared tunnel --url http://127.0.0.1:8443`。它会打印一个地址，例如 `https://random-words.trycloudflare.com`。
-3. 在 `~/.oac/core/config.json` 中将该地址设置为 `public_url`，并运行 `~/.oac/core/oac apply`。
+3. 在 `~/.oac/core/.env` 中将该地址设置为 `OAC_PUBLIC_URL`，并运行 `~/.oac/core/oac apply`。
 
 每当 `cloudflared` 重启时，该地址都会改变；随后必须重新添加绑定到旧地址的节点。吞吐量较低，因此节点首次下载 Runtime（约 500 MB）时可能很慢；请参阅[慢速链接](nodes.md#rerun-expiry-and-slow-links)。
+
 ## 离线主机 {#offline-hosts}
 
-传输发布版本中的 `*-linux-amd64-offline.tar.gz` 及其 `.sha256` 文件，验证并解压后，运行捆绑包中的 `./install.sh`。离线捆绑包还包含节点和 Runtime 文件，因此即使节点无法访问发布版本，Web 也能向其提供这些文件。
+本安装程序不支持从离线捆绑包安装。它从发布版本下载 Compose 文件和容器镜像。
diff --git a/docs/zh/getting-started/install.md b/docs/zh/getting-started/install.md
index 8a55f4595..519ab41d8 100644
--- a/docs/zh/getting-started/install.md
+++ b/docs/zh/getting-started/install.md
@@ -1,15 +1,15 @@
 ---
 title: "安装 Core 和 Web"
 source: docs/getting-started/install.md
-source_hash: 7b15a2e8fd3365e0d4e246d9d5a288bd3648a3f79b3fa11ccfc6e3e702d4c77d
+source_hash: 3493948d1e7111fb5c26a134c0f8848d8984b68fd135559903e0729c25832643
 ---
 
-一条命令即可在 Linux 主机上安装 Core、Web 控制台和 PostgreSQL。Web 是管理员控制台：使用 Core 密钥登录，为安装配置域名、设置默认模型并签发 Project API 密钥。应用随后使用这些密钥调用 Core API，Session 在你添加的节点上的沙箱中运行，也可以在 E2B 上运行。
+一条命令即可在 Linux 主机上安装 Core、Web 控制台和 PostgreSQL。用 Core 密钥登录 Web，设置默认模型并签发 Project API 密钥。应用使用这些密钥调用 Core。Session 在你添加的节点上的沙箱中运行，也可以在 E2B 上运行。
 
 1. [检查前置条件](#prerequisites)。
 2. [运行安装程序](#install)。
 3. [登录 Web](#sign-in-to-web)。
-4. [配置域名和 HTTPS](#configure-the-domain-and-https)。
+4. [配置公开地址](#configure-the-domain-and-https)。
 5. [设置默认模型](#set-a-default-model)。
 6. [签发 Project API 密钥](#issue-a-project-api-key)。
 7. [添加沙箱容量](#add-sandbox-capacity)。
@@ -18,11 +18,11 @@ source_hash: 7b15a2e8fd3365e0d4e246d9d5a288bd3648a3f79b3fa11ccfc6e3e702d4c77d
 
 ## 前置条件 {#prerequisites}
 
-- Linux amd64，Python 3.9 或更高版本，以及 curl。无需 GitHub 账号或 CLI。
+- Linux amd64 和 curl。
 - Docker Engine 和 Docker Compose 2.26.0 或更高版本（`docker compose version`）。
 - 能运行 `docker` 并向自己的主目录写入文件的账号。普通用户和 root 均可；安装程序不会调用 sudo。
-- 初次访问 Web 的端口（8080）和 Core 的端口（8091，仅回环地址）各自空闲，启用 HTTPS 后还需要空闲的 80 和 443 端口；参阅[端口](install-options.md#ports)。Docker 必须能发布这些端口；安装程序不会修改主机策略。
-- 连接应用、节点、E2B 或自托管机器之前，需要一个指向这台主机的 DNS 主机名。可以先安装并登录。
+- Web 的 8080 端口空闲。Core 的管理 API 使用 `127.0.0.1:8091`。参阅[端口](install-options.md#ports)。Docker 必须能发布这些端口；安装程序不会修改主机策略。
+- 本机以外的访问要求 `OAC_PUBLIC_URL` 就是浏览器、节点和执行器使用的地址。可以先在本机登录。
 
 Core 主机不需要 KVM；运行 microsandbox 的节点需要。
 
@@ -32,52 +32,39 @@ Core 主机不需要 KVM；运行 microsandbox 的节点需要。
 curl -fsSL https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.sh | bash
 ```
 
-如果 DNS 已指向这台主机，可以传入地址，在安装期间配置 HTTPS，而无需执行第 4 步：
+反向代理已经提供这台主机时，传入它的 HTTPS 地址：
 
 ```sh
 curl -fsSL https://github.com/MiniMax-AI/OpenAgentCore/releases/latest/download/install.sh | bash -s -- --public-url https://core.example
 ```
 
-脚本选择最新稳定版、验证校验和，并运行捆绑的安装程序。安装程序会：
+脚本下载该发布版的 Compose 文件，校验 SHA-256，然后：
 
-1. 检查设置、所需端口和主机，然后加载 Core、Web、PostgreSQL 和 HTTPS 网关镜像；
-2. 创建[安装目录](../configuration.md#installation-directory) `~/.oac/core`，其中包含 Core 密钥、`config.json` 和管理命令 `oac`；
-3. 使用 Docker Compose 启动服务。网关在安装程序输出的端口上监听所有 IPv4 接口并提供 Web；Core 仅监听回环地址，PostgreSQL 保持私有；
-4. 选择 Standard 规格的 microsandbox 沙箱后端，不添加节点。
+1. 检查 Linux amd64、Docker Compose 2.26 或更高版本，以及将要发布的端口是否空闲；
+2. 创建[安装目录](../configuration.md#installation-directory) `~/.oac/core`，写入 `.env`，并从 Core 镜像复制 `oac` 命令；
+3. 用 Docker Compose 启动服务。Web 在 8080 端口提供控制台，并把 `/v1`、`/api/v1` 和 `/docs` 转发到 Core。Core 的管理 API 留在 `127.0.0.1:8091`。PostgreSQL 不发布端口。
 
-安装程序不创建 Project 或密钥，也不发起模型请求。完成后输出控制台地址、API 基础 URL 和后续步骤。
+安装程序不保存沙箱后端，不添加节点，不创建 Project 或密钥，也不发起模型请求。完成后输出控制台地址，以及如何读取 Core 密钥。
 
-临时网络故障会自动重试下载。长时间执行的步骤会在终端显示下载进度和活动状态。
-
-如果安装失败，或在服务首次进入健康状态前被中断，请修复报告的问题并重新运行同一命令。安装程序会删除临时下载、新服务项目、卷和安装文件；已加载的 Docker 镜像可以继续复用。重新运行时，程序先清理强制退出或断电留下的不完整安装或下载，不会清理其他仍在运行的安装进程或无关目录。服务成功启动之后，失败不会删除安装和数据；请使用[同版本修复](operations.md#installation-version-policy)。
+如果服务进入健康状态之前安装失败，安装程序会删除它创建的目录。修复报告的问题后，重新运行同一命令。服务已经启动之后，后续失败会保留安装和数据。新发布版使用新目录；见[版本策略](operations.md#installation-version-policy)。
 
 空间或配额不足时，请释放错误信息所指文件系统的空间。加载镜像失败还可能需要释放 Docker 存储空间，该存储可能位于另一个文件系统。
 
 ## 登录 Web {#sign-in-to-web}
 
-1. 打开安装程序输出的控制台地址，例如 `http://SERVER_IP:8080`；如果传入了公开 URL，则打开该 URL。在 NAT 后方时，使用浏览器能访问的 IP 地址。设置域名之前，Web 只接受 IP 地址，不接受主机名。
+1. 在本机打开 `http://localhost:8080`，或打开 `--public-url` 传入的源地址。Web 只接受这个主机名。
 2. 使用 [Core 密钥](operations.md#core-key)登录，这是安装的管理员凭据。Web 没有用户账号。
 
    ```sh
-   cat ~/.oac/core/secrets/core.key
+   ~/.oac/core/oac core-key --show
    ```
 
-## 配置域名和 HTTPS {#configure-the-domain-and-https}
-
-应用、节点和沙箱通过同一个 HTTPS 地址访问 Core，即公开 URL。初始 HTTP 地址仅提供 Web。
-
-1. 将主机名的 A/AAAA 记录指向这台主机，允许来自互联网的 80 和 443 端口入站流量，并确保其他程序不占用[这些端口](install-options.md#ports)。
-2. 在 Web 中打开 **System**，选择 **Configure domain and HTTPS**，输入主机名，例如 `core.example.com`，然后选择 **Apply**。
-
-安装检查 DNS 和端口、申请证书，并验证 HTTPS 地址能访问本安装，然后将 Core 和 Web 切换到该地址。随后打开 HTTPS 地址并重新登录；初始 HTTP 地址会重定向到它。证书自动续期。如果 DNS 或证书处理失败，继续使用原地址：修复报告的问题后重试。若切换被中断，使用同一主机名重试，或用 `oac status` 检查并通过 `oac apply` 完成。
+## 配置公开地址 {#configure-the-domain-and-https}
 
-终端中的对应操作：
-
-```sh
-~/.oac/core/oac domain core.example.com
-```
+应用、节点和沙箱通过同一个 HTTPS 地址访问 Core，即公开 URL。
 
-之后修改地址的方法见[修改公开 URL](../configuration.md#changing-the-public-url)。
+1. 把反向代理指向 Web。
+2. 把 `OAC_PUBLIC_URL` 设为反向代理提供的 HTTPS 源地址，然后运行 `oac apply`。见[修改公开 URL](../configuration.md#changing-the-public-url)。
 
 ## 设置默认模型 {#set-a-default-model}
 
@@ -94,6 +81,6 @@ Web 的 **Overview** 通过 **Getting started** 清单跟踪这些步骤。
 
 Session 需要执行位置：
 
-- **Nodes** 运行安装程序选择的 microsandbox 后端：在 Web 的 **Nodes** 页面[添加节点](nodes.md)。Docker 和 E2B 以后通过 [Reset deployment](nodes.md#change-the-sandbox-configuration) 选择。
+- 在 **System** → **Manage sandbox configuration** 选择后端，然后在 **Nodes** 页面[添加节点](nodes.md)。安装程序不选择后端。
 
 日常操作、备份和升级见[运维](operations.md)。
diff --git a/docs/zh/getting-started/nodes.md b/docs/zh/getting-started/nodes.md
index 80370c968..ab996dca7 100644
--- a/docs/zh/getting-started/nodes.md
+++ b/docs/zh/getting-started/nodes.md
@@ -1,7 +1,7 @@
 ---
 title: "添加和管理节点"
 source: docs/getting-started/nodes.md
-source_hash: e1af3f17292dc491cb7c041f9e6c7ea335ec763149368c0d4898828b210605f7
+source_hash: f7bfd1ac05cbed8a1f31badee219164c5e1a16aa897e89551abeb8b8d0010215
 ---
 
 节点是一台 Linux 主机，在沙箱后端为 Docker 或 microsandbox 时，为 Core 托管 Session 运行沙箱。Core 将新 Session 分配给有空余容量的节点；节点创建沙箱，沙箱回连 Core。E2B 不需要节点。应用为自己的 Session 连接的机器是[自托管执行器](self-hosted.md)，而不是节点。
@@ -10,9 +10,9 @@ source_hash: e1af3f17292dc491cb7c041f9e6c7ea335ec763149368c0d4898828b210605f7
 
 ## 添加节点前 {#before-you-add-a-node}
 
-- **Core 已有主机及沙箱可访问的 HTTPS 公开 URL。** 节点从 Core 控制台下载文件，并通过 `public_url` 连接 Core。设置前，Add node 显示 *Configure a domain and HTTPS in System before adding nodes*；参阅[配置域名和 HTTPS](install.md#configure-the-domain-and-https)，使用外部入口时则参阅[修改公开 URL](../configuration.md#changing-the-public-url)。
-- **沙箱配置已保存。** 安装程序会保存 Standard 规格的 microsandbox。要使用 Docker 或其他规格，打开 **System** → **Manage sandbox configuration**，选择 **Reset deployment**，然后选择 **Own machines**、后端和沙箱规格，最后选择 **Save configuration**。同一安装的所有节点使用同一后端。
-- **控制台能提供节点文件。** 节点从控制台下载 Runtime 和提供商文件；控制台缺少文件时重定向到发行下载地址。节点依据发行清单检查各文件的大小和 SHA-256。主机无法访问发行下载地址时，从[离线包](install-options.md#offline-hosts)安装 Core，让控制台持有全部文件。缺少文件时，Add node 显示 *This console has no node files for …*。
+- **Core 已有主机及沙箱可访问的 HTTPS 公开 URL。** 节点从 Core 控制台下载文件，并通过 `public_url` 连接 Core。设置前，Add node 显示 *Set a public HTTPS address before adding nodes*；参阅[配置公开地址](install.md#configure-the-domain-and-https)。
+- **沙箱配置已保存。** 打开 **System** → **Manage sandbox configuration**，选择 **Own machines**、后端和沙箱规格，最后选择 **Save configuration**。要更改已保存的配置，先选择 **Reset deployment**。同一安装的所有节点使用同一后端。
+- **控制台能提供节点文件。** 节点从控制台下载 Runtime 和提供商文件；控制台缺少文件时重定向到发行下载地址。节点依据发行清单检查各文件的大小和 SHA-256。因此节点主机需要能访问发行下载地址。缺少文件时，Add node 显示 *This console has no node files for …*。
 
 Core 主机与其他主机一样加入：要在它上面运行沙箱，将它添加为节点。
 
diff --git a/docs/zh/getting-started/operations.md b/docs/zh/getting-started/operations.md
index 5aff652fa..3473cc477 100644
--- a/docs/zh/getting-started/operations.md
+++ b/docs/zh/getting-started/operations.md
@@ -1,7 +1,7 @@
 ---
 title: "管理你的安装"
 source: docs/getting-started/operations.md
-source_hash: 83a7f46bfd82d743be230955a7ac2312efaa9ca8d88b243117e66cc19626e2a4
+source_hash: 83db2aebab621e41ab45ad92fc74ec562c54bf0f6a5a4cd845b5ffe8da50cf89
 ---
 
 安装运维人员负责 Core 主机、存储和可用性。节点主机运行各自的服务；参阅[节点](nodes.md)。设置见[配置参考](../configuration.md)。
@@ -11,23 +11,20 @@ source_hash: 83a7f46bfd82d743be230955a7ac2312efaa9ca8d88b243117e66cc19626e2a4
 每个安装目录中都有自己的管理命令，无需发行包或 root：
 
 ```sh
-~/.oac/core/oac status
+docker compose -f ~/.oac/core/compose.yaml ps
 ```
 
 | 命令 | 功能 |
 | --- | --- |
-| `oac status` | 展示各服务及健康状态、Core 与 Web 健康状态、公开 URL、API 基础 URL、控制台地址、源码提交、反向代理所需路由、尚未应用的 `config.json` 变更和手动修改的生成文件。服务不可用时以非零状态退出。不调用模型 |
-| `oac start` | 使用 `apply` 最近写入的文件启动所有服务；提示尚未应用的变更 |
-| `oac stop` | 停止 PostgreSQL、Core 和 Web。保留数据、节点和沙箱，运行中的沙箱工作可能继续 |
-| `oac apply` | 应用 `config.json` 并重启发生变化的服务；参阅 [apply 工作方式](../configuration.md#how-oac-apply-works) |
-| `oac apply --dry-run` | 展示变更的设置、文件与重启计划，不修改任何内容 |
-| `oac apply --discard-edits` | 覆盖手动修改的生成文件，各自保留为 `generated/<file>.edited-<time>` |
-| `oac apply --confirm-public-url-change URL` | 无提示地确认公开 URL 变更；必须与新 URL 相同 |
-| `oac domain HOSTNAME [--confirm-public-url-change URL]` | 托管入口：将公开 URL 设为 `https://HOSTNAME`，对应 Web 的 **Configure domain and HTTPS**；参阅[配置域名和 HTTPS](install.md#configure-the-domain-and-https) |
-| `oac rotate-core-key [--yes]` | 替换 Core 密钥；参阅[轮换 Core 密钥](#rotate-the-core-key) |
-| `oac uninstall [--yes]` | 从主机移除安装及全部数据；参阅[卸载](#uninstall) |
-
-第二个安装使用自己的命令，例如 `~/.oac/second/oac status`。
+| `docker compose ps` | 在安装目录中展示服务 |
+| `docker compose start` | 启动服务 |
+| `docker compose stop` | 停止服务。保留数据、节点和沙箱 |
+| `oac apply` | 先运行 `oac-core check-config`，再执行 `docker compose up -d --wait`。校验失败时不改动任何服务 |
+| `oac core-key [--show]` | 打印 Core 密钥路径；加上 `--show` 时打印密钥本身 |
+| `oac rotate-core-key` | 替换 Core 密钥并重启 Core 和 Web |
+| `docker compose down --rmi all` | 移除容器和镜像。然后删除安装目录 |
+
+第二个安装使用自己的目录，例如 `~/.oac/second`。
 
 ## 服务健康状态 {#service-health}
 
@@ -35,7 +32,7 @@ source_hash: 83a7f46bfd82d743be230955a7ac2312efaa9ca8d88b243117e66cc19626e2a4
 
 | 观察 | 能证明什么 |
 | --- | --- |
-| `oac status`、PostgreSQL 健康状态 | 数据库接受就绪检查 |
+| `docker compose ps` | 数据库接受就绪检查 |
 | Core `/healthz` | Core 进程存活 |
 | 经过认证的 API 读取 | 调用者的密钥适用于该资源 |
 | Environment 连接 | Runtime 传输已连接 |
@@ -44,8 +41,8 @@ source_hash: 83a7f46bfd82d743be230955a7ac2312efaa9ca8d88b243117e66cc19626e2a4
 服务健康状态不表示 Harness 或模型可用。执行情况使用 Session、Turn、Items 和 Usage 读取，节点连接、就绪和分配使用 Web 的 **Nodes** 页面。本地诊断使用安装自身的 Compose 文件：
 
 ```sh
-docker compose -f "$HOME/.oac/core/generated/compose.json" ps --all
-docker compose -f "$HOME/.oac/core/generated/compose.json" logs --tail 200 core
+docker compose -f "$HOME/.oac/core/compose.yaml" ps --all
+docker compose -f "$HOME/.oac/core/compose.yaml" logs --tail 200 core
 ```
 
 不要将 `docker compose config`、`docker inspect` 或原始日志粘贴到公开问题报告。
@@ -55,8 +52,8 @@ docker compose -f "$HOME/.oac/core/generated/compose.json" logs --tail 200 core
 计划重启前，先等待活动工作结束：
 
 ```sh
-~/.oac/core/oac stop
-~/.oac/core/oac start
+docker compose -f ~/.oac/core/compose.yaml stop
+docker compose -f ~/.oac/core/compose.yaml start
 ```
 
 停止 Core 不会停止节点或沙箱。节点服务、microVM 和 Docker 容器继续运行；停止不是回收计算资源的方法。Core 重启不会透明地继续被中断的原生工具调用。重连后查询同一 Session；不要创建新 Session 来重放结果不确定的工作。Session 事件流仅提供实时事件；通过读取 Session、Turn 和 Items 恢复。
@@ -65,13 +62,13 @@ Web 重启（包括 `oac apply` 引起的重启）会让所有控制台用户退
 
 ## Core 密钥 {#core-key}
 
-每个安装有一个管理员凭据，即 Core 密钥。安装程序在 `<install dir>/secrets/core.key` 生成 64 字符随机密钥，默认位置为 `~/.oac/core/secrets/core.key`。Core 密钥：
+每个安装有一个管理员凭据，即 Core 密钥。安装程序在 `data/secrets/web/core.key` 生成 64 字符随机密钥。用 `oac core-key --show` 读取；该文件属于容器用户。Core 密钥：
 
 - 用于登录 Web。浏览器获得 HttpOnly 会话 cookie，不持有密钥；
 - 通过 `Authorization: Bearer <Core key>` 授权 Core API（`/core/v1`）请求；
 - 不授权 Agents API（`/v1`）。应用使用 Project API 密钥，后者也不能调用 `/core/v1`。
 
-请保密：`secrets/` 权限为 `0700`，文件为 `0600`。Web，以及托管入口下的 `installation` 服务读取 `core.key`；Core 只读取 `generated/core-key-digests.json` 中的 SHA-256，该文件由 `oac apply` 从密钥派生。Core 密钥至少 32 字符且不含空白。Web 限制失败登录。
+请保密。Web 读取 `data/secrets/web/core.key`。Core 只读取 `data/secrets/core/core-key-digests.json` 中的 SHA-256。Core 密钥至少 32 字符且不含空白。Web 限制失败登录。
 
 ### 用脚本调用 Core API {#script-the-core-api}
 
@@ -80,7 +77,7 @@ Web 重启（包括 `oac apply` 引起的重启）会让所有控制台用户退
 ```sh
 core() {  # core METHOD PATH [JSON body]
   curl -fsS -X "$1" "http://127.0.0.1:8091/core/v1$2" \
-    -H @<(printf 'Authorization: Bearer %s\n' "$(cat ~/.oac/core/secrets/core.key)") \
+    -H @<(printf 'Authorization: Bearer %s\n' "$(~/.oac/core/oac core-key --show)") \
     -H 'Content-Type: application/json' ${3:+-d "$3"}
 }
 ```
@@ -104,7 +101,7 @@ core() {  # core METHOD PATH [JSON body]
 ~/.oac/core/oac rotate-core-key
 ```
 
-`config.json` 有未应用变更或生成文件被手动修改时，操作被拒绝：先运行 `oac apply`。程序要求确认（`--yes` 跳过），停止 Web，在 `secrets/core.key` 写入新密钥并重新生成摘要文件。安装正在运行时，随后重启 Core、启动 Web，并检查 Core 接受新密钥且拒绝旧密钥；已停止的安装只更新文件，下次 `oac start` 使用新密钥。Core 重启时旧密钥立即失效，所有控制台会话结束：重新登录并更新脚本。命令提前停止时，以 `secrets/core.key` 中的密钥为准；运行 `oac apply` 完成。
+它把新密钥写入 `data/secrets/web/core.key`，重新生成 `data/secrets/core/core-key-digests.json`，并重启 Core 和 Web。Core 重启后旧密钥立即失效，所有控制台会话结束：重新登录并更新脚本。
 
 ## Project 和 API 密钥 {#projects-and-api-keys}
 
@@ -127,12 +124,13 @@ Core 记录每次公开资源写入所使用的密钥；历史保留策略为 [`
 - PostgreSQL 卷 `<project>_database`。其中包含 Project、密钥摘要、节点、默认模型、加密凭据和全部执行历史（含大对象）。逻辑备份：
 
   ```sh
-  docker compose -f "$HOME/.oac/core/generated/compose.json" exec -T database \
+  docker compose -f "$HOME/.oac/core/compose.yaml" exec -T database \
     pg_dump -U agents_api agents_api > oac-backup.sql
   ```
 
-- 安装目录：`config.json`、`state.json`（安装 ID）和 `secrets/`。`credential.key` 必须与数据库一起保留，否则无法解密存储的凭据；不要为绕过错误而重新生成它。
-- 使用 E2B 时的 `state/e2b/`：Core 清理 E2B 沙箱所需的回执。
+- 安装目录，尤其是 `data/`。`data/secrets/core/credential.key` 必须与数据库一起保留，否则无法解密存储的凭据。
+
+先 `docker compose stop`，打包安装目录，再 `docker compose start`。
 - 各节点主机上的状态目录 `/var/lib/oac-node/.oac/nodes/<installation-id>/` 及提供商存储：Docker 卷或 microsandbox 存储。恢复方法见[节点主机故障时](nodes.md#when-a-node-host-fails)。
 - 安装所使用的发行包，用于修复同一版本。
 
@@ -141,18 +139,17 @@ Core 记录每次公开资源写入所使用的密钥；历史保留策略为 [`
 ## 卸载 {#uninstall}
 
 ```sh
-~/.oac/core/oac uninstall
+docker compose -f ~/.oac/core/compose.yaml down --rmi all --remove-orphans
+rm -rf ~/.oac/core
 ```
 
-从主机移除安装：Compose 项目及其容器、网络和数据库卷、安装程序加载的镜像，以及安装目录（包含 `secrets/` 和 `oac` 命令本身）。具有其他标签或被其他容器使用的镜像会保留并报告，例如同一版本的其他安装使用的镜像。
-
-全部数据随之删除：Project 和 API 密钥、Session 历史、存储的凭据和 Core 密钥。没有 `secrets/` 的数据库卷无法使用，因此不会单独保留。要保留数据，请用 `oac stop` 停止安装，或先[备份](#back-up)。
+`down` 移除容器和镜像。`rm` 删除安装目录。只有确定要删数据时才执行第一条。
 
-命令列出将删除的内容，Core 响应时还列出已注册节点。输入安装目录确认，或传入 `--yes`；无终端执行必须提供该参数。命令持有安装锁，只需要 `state.json`，因此也能移除未完成安装或丢失 `config.json` 的安装。目录最后移除；中途停止时重新执行。
+全部数据随之删除：Project 和 API 密钥、Session 历史、存储的凭据和 Core 密钥。要保留数据，请用 `docker compose stop` 停止安装，或先[备份](#back-up)。
 
 卸载不停止沙箱：节点沙箱在节点继续运行，E2B 沙箱在 E2B 继续运行并计费。Core 仍运行时，归档它们的 Session，或[重置部署](nodes.md#change-the-sandbox-configuration)并等待完成；命令展示 Core 正在使用的沙箱数量。
 
-其他主机上的节点继续运行。按常规方式卸载时，先在 Web 移除，见[移除节点](nodes.md#remove-a-node)。`oac uninstall` 后 Core 已不存在：在各节点主机使用安装时[所用发行包](#installation-version-policy)的 `node-install.pyz`，执行带 `--force` 的节点卸载命令。`oac uninstall` 输出含安装 ID 的命令。
+其他主机上的节点继续运行。按常规方式卸载时，先在 Web 移除，见[移除节点](nodes.md#remove-a-node)。安装目录删除后，它们的 Core 已不存在：在各节点主机使用当时发布版的 `node-install.pyz`，执行带 `--force` 的节点卸载命令。安装 ID 在 `data/secrets/core/installation.id`。
 
 ## 安装版本策略 {#installation-version-policy}
 
@@ -160,9 +157,9 @@ Core 记录每次公开资源写入所使用的密钥；历史保留策略为 [`
 
 迁移到新版本时，安装到全新的空目录，使用独立数据库、Core 密钥和节点，并从新 Web 添加节点。保留旧安装、数据和节点，直到工作完成。节点运行添加它的控制台所提供的程序，不原地升级；Core 仅接受使用自身节点协议的节点。
 
-使用完全相同发行包中的 `./install.sh --install-dir DIR` 修复当前版本；下载程序将包保存在 `~/.oac/releases/`。修复重新加载缺失镜像、恢复 `oac` 命令、应用 `config.json` 并启动服务。它保留身份、设置、密钥和历史，只接受 `--install-dir`，拒绝其他发行版本的包。安装程序从未报告为运行中的安装不会被修复，而会[删除后重新安装](install.md#install)。
+`install.sh` 拒绝非空目录。首次启动失败时，它删除自己创建的目录，同一命令可以再运行。已经启动的安装会保留。
 
-安装程序和修改状态的 `oac` 命令共用安装锁 `.oac.lock`，包括修复和中断的 apply 恢复过程。其他命令持有锁时，等待其结束后重试；不要删除或替换 `.oac.lock` 来绕过忙碌安装。重新安装不删除其他安装的文件、数据库、Runtime 资源或 Session 历史。
+会修改状态的 `oac` 命令持有 `.oac.lock`。其他命令持有锁时，等待其结束后重试。不要删除 `.oac.lock` 来绕过忙碌安装。
 
 ## 问题排查 {#troubleshooting}
 
@@ -171,36 +168,27 @@ Core 记录每次公开资源写入所使用的密钥；历史保留策略为 [`
 | `Core installation requires Linux amd64 with Docker access` | 使用 Linux amd64 和有 Docker 访问权限的账号；支持 root 和普通用户 |
 | `Installation failed: inspect prerequisites and private deployment files` | 前置条件失败但未单独报告，通常是 Docker：检查此用户能运行 `docker info` 和 `docker compose version` |
 | `Docker Compose 2.26.0 or newer is required …` | 更新 Docker Compose 插件 |
-| `Port N (…) is already in use on ADDRESS …` | 其他程序占用所需端口。使用输出的 `ss` 命令定位并停止，或选择其他端口：[安装](install-options.md#ports)时传入 `--web-port` 或 `--core-port`，或在 `oac apply` 前修改 `config.json` 端口 |
-| `ADDRESS (…) is not an address of this machine …` | 将 `--host` 或 `config.json` 的 `host` 设为机器 IP 地址，或 `0.0.0.0` 等通配地址 |
-| `Automatic HTTPS needs ports 80 and 443 …` | 释放提示中的端口，不传 `--public-url` 安装并之后配置域名，或使用 `--ingress external` 和自己的[反向代理](install-options.md#https-and-the-reverse-proxy) |
-| `Installation directory is not empty …` | 使用空的 `--install-dir` |
-| `This installation is configured by …/config.json …` | 参数只初始化新安装：修改 `config.json` 后运行 `oac apply`。要使用其他参数重新开始，先[卸载](#uninstall) |
-| `This installation version is not supported …` | 目标安装状态格式或源码版本与发行包不匹配。保留原安装，在其他空 `--install-dir` 安装（[版本策略](#installation-version-policy)） |
-| `generated/<file> was edited by hand` | 将变更移入 `config.json`，再运行 `oac apply --discard-edits` |
-| `config.json has changes that are not applied` | 运行 `oac apply` |
-| `Core rejects secrets/core.key …` | 运行 `oac apply`，使 Core 使用密钥摘要重启 |
-| `config.json not applied: …` | `oac apply` 已在上方输出 Core 启动错误；修复 `config.json` 后重新应用 |
+| `Port N is already in use.` | 其他程序占用该端口。停止它，或另选 `--web-port`。安装程序不会改用其他端口 |
+| `Installation directory is not empty` | 使用空的 `--install-dir`，或先[卸载](#uninstall)现有安装 |
+| `configuration check failed; no service was changed` | `.env` 中有 Core 拒绝的值。消息只包含变量名。修正 `.env` 后再次运行 `oac apply` |
+| `Docker Compose 2.26 or newer is required` | 更新 Docker Compose 插件 |
 | `The services did not start: …` | 新安装首次启动失败，安装程序[删除了所创建内容](install.md#install)。上方输出 Compose 或 Core 错误；修复后执行同一命令 |
-| `Removal did not finish. Left: …` | 清理失败安装的安装程序或 `oac uninstall` 未能删除全部内容。执行输出的命令移除残留，或修复原因后重新执行原命令 |
+| `Removal did not finish. Left: …` | 首次启动失败后没能删干净。执行输出的命令移除残留，或修复原因后重新执行原命令 |
 | `This installation did not finish installing …` | 安装程序在报告服务运行前停止。重新执行安装命令，[清理残留](install.md#install)后重新安装，或[卸载](#uninstall) |
-| 域名配置时 `… already in use on this server. Automatic HTTPS cannot run beside another program …` | 其他程序占用 80 或 443。用输出的 `ss` 定位、停止并重试；自动 HTTPS 无法共享[这些端口](install-options.md#ports) |
-| 域名配置时 `HTTPS verification failed …` | DNS 指向其他位置、防火墙或 NAT 阻止 80/443 入站，或证书申请失败；参阅[配置域名和 HTTPS](install.md#configure-the-domain-and-https) |
-| Web 返回 403 `Forbidden` | 严格使用 `oac status` 输出的控制台地址；反向代理必须传递原始 Host |
-| `/v1` 或 `/api/v1` 返回 404 | 路径被发送到 Web；将其路由到 Core（[反向代理](install-options.md#https-and-the-reverse-proxy)） |
-| Web 显示 Core 不可用（502） | Core 停止或失败：先 `oac status`，再查看 Core 日志 |
+| Web 返回 403 `Forbidden` | 浏览器主机名不是 `OAC_PUBLIC_URL`。打开该源地址；反向代理必须传递原始 Host |
+| Web 显示 Core 不可用（502） | Core 停止或失败：先 `docker compose ps`，再查看 Core 日志 |
 | 创建 Session 返回 400 `model_provider_required` | 缺少模型提供商：为 Harness 设置[默认模型](../configuration.md#default-models)，或显式提供；自托管 Session 始终自带提供商 |
 | Add node 不展示命令 | 参阅[添加节点前](nodes.md#before-you-add-a-node) |
 | 节点未就绪 | 参阅[节点问题排查](nodes.md#troubleshooting) |
 
 ## 对外暴露与网络策略 {#exposure-and-network-policy}
 
-| 监听器 | 托管入口（默认） | 外部入口 |
+| 监听器 | 主机安装 | 反向代理之后 |
 | --- | --- | --- |
-| Web | 仅通过 `gateway` 服务访问，它在 `host`（默认所有 IPv4 接口）发布 `ports.web`（8080），HTTPS 启用后还发布 [80 和 443](install-options.md#ports) | `host:ports.web`（默认回环地址），位于反向代理之后 |
-| Core | `127.0.0.1:ports.core`（8091）；网关将 `/v1` 和 `/api/v1` 路由到它 | `host:ports.core`，位于反向代理之后 |
+| Web 和 API | Web 在 `OAC_HOST` 上发布 `OAC_WEB_PORT`（8080） | Web 在 `OAC_HOST` 上发布 `OAC_WEB_PORT`。反向代理应使用 `127.0.0.1` |
+| Core 管理 API | `127.0.0.1:8091`。Web 转发 `/v1`、`/api/v1` 和 `/docs` | `127.0.0.1:8091`。Web 转发 `/v1`、`/api/v1` 和 `/docs` |
 | PostgreSQL | 不发布端口 | 不发布端口 |
 
-Web 使用 Core 密钥让管理员登录，检查每个请求来源，并用保留在服务器上的 Core 密钥将已登录的 `/core/v1` 请求转发到 Core。无论请求携带何种凭据，`/v1` 和 `/api/v1` 均返回 404；Web 仅在 `/node-install/` 提供不含密钥的节点文件，没有 Docker 或 KVM 访问权限。`/api/v1` 机器路由使用独立注册和连接凭据。托管入口中，`installation` 服务通过 Docker 套接字应用域名变更；Web 仅通过私有 Unix 套接字访问它，每次请求都检查 Core 密钥。
+Web 使用 Core 密钥让管理员登录，检查每个请求来源，并用保留在服务器上的 Core 密钥将已登录的 `/core/v1` 请求转发到 Core。它把 `/v1` 和 `/api/v1` 原样转发给 Core，使用调用方自己的凭据；Web 仅在 `/node-install/` 提供不含密钥的节点文件，没有 Docker 或 KVM 访问权限。`/api/v1` 机器路由使用独立注册和连接凭据。没有服务持有 Docker 套接字。
 
 沙箱是隔离边界（[Runtime 与外层隔离](../concepts.md#runtime-and-outer-isolation)）。Docker 沙箱共享节点内核，Docker 节点在主机上[等同于 root 权限](nodes.md#what-the-installer-sets-up)；microsandbox 为每个沙箱提供具有显式[网络策略](nodes.md#what-the-installer-sets-up)的 microVM。Core 自身无 Docker 套接字或 KVM 访问权限。
diff --git a/docs/zh/maintainers.md b/docs/zh/maintainers.md
index 6ba85ac29..c2f181373 100644
--- a/docs/zh/maintainers.md
+++ b/docs/zh/maintainers.md
@@ -1,14 +1,14 @@
 ---
 title: "构建并发布 OpenAgentCore"
 source: docs/maintainers.md
-source_hash: 11e24e329928f4803518aeaf95a202dcbc98ff1c007860c2f94b1ca96adb5d6a
+source_hash: ac744d8df2682f0c19eb6b05c1ef50a9e7c7a9d214316317458669f4cb00f477
 ---
 
-本指南面向负责构建和发布 OpenAgentCore 的维护者。要安装 Core 和 Web，请使用 [安装指南](getting-started/install.md)。安装器代码遵循的规则见 [安装器设计规则](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/install/README.md)；必需检查见 [CONTRIBUTING](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#required-checks)。
+本指南面向负责构建和发布 OpenAgentCore 的维护者。要安装 Core 和 Web，请使用 [安装指南](getting-started/install.md)。安装器代码遵循的规则见 [部署](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/README.md) 和 [节点安装器](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/node/README.md)；必需检查见 [CONTRIBUTING](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/CONTRIBUTING.md#required-checks)。
 
 ## 构建分发包 {#build-a-distribution}
 
-分发包是从同一个提交构建的一组相互匹配的 Linux amd64 发布资源：控制归档（安装器、`oac` 命令，以及 Core、Web、gateway 和 PostgreSQL 镜像）、作为独立文件的 Runtime 镜像和节点构件，以及原生安装器。
+分发包是从同一个提交构建的一组相互匹配的 Linux amd64 发布资源：控制归档（安装器、`oac` 命令，以及 Core、Web、ingress 和 PostgreSQL 镜像）、作为独立文件的 Runtime 镜像和节点构件，以及原生安装器。
 
 请在 Linux x86_64 上构建，所需环境包括与 Debian 12 兼容的 glibc、Docker、`go.mod` 中指定的 Go 版本、C 编译器（microsandbox 辅助程序使用 CGO 构建）、Node、pnpm、Python 3.9 或更高版本、curl、tar、pigz 和 sha256sum。源代码必须保持干净并已提交。请先准备固定版本的 Codex 包和 MiniMax Code 配套程序，然后执行构建：
 
@@ -37,7 +37,7 @@ make build-core-distribution
 
 构建过程会复用 Core、Web、Runtime、SDK 和辅助程序构建器。清单会记录提交和源代码树、镜像配置及 OCI 清单摘要、Runtime OCI 清单摘要、microsandbox 运行时和固件哈希，以及每个 Runtime 和节点构件的大小与 SHA-256；原生安装器在[目录](#native-installers)中仅记录其 SHA-256。输出包括控制归档及其 `.sha256`、可选的离线归档，以及带版本号的 Runtime、节点和原生安装器资源。此过程不会发布任何内容。如果目标目录中已包含此提交的分发包，重建会拒绝执行。
 
-控制归档不包含 Runtime 镜像或节点执行构件；离线归档包含这些内容。[下载契约](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/install/README.md#download-contract)说明了节点如何获取这些内容。
+控制归档不包含 Runtime 镜像或节点执行构件；离线归档包含这些内容。[下载契约](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/node/README.md#download-contract)说明了节点如何获取这些内容。
 
 分发包会携带 `scripts/core-distribution-manifest.py` 中 `BUNDLED_DOCS` 列出的文档。随包文档之间的链接保持相对路径；其他所有相对链接都会重写为该捆绑包对应提交在 GitHub 上的同一文件。链接或锚点无法解析时，构建会失败；`make check-distribution` 会对 `example/` 之外每个受 Git 跟踪的 Markdown 文件运行相同检查。添加或移动安装器或其输出所引用的文档时，请更新该列表。
 
@@ -111,7 +111,7 @@ make check-microsandbox-provider
 
 ### 独立 Core 构建 {#standalone-core-builds}
 
-`make build-core` 会将 `oac-core`、`oac-core-migrate`、`oac-core-device`、`oac-core-environment-key` 和 `oac-node` 构建到 `${OAC_DEV_HOME:-$HOME/.oac}/build/oac-core`（`OAC_DEV_CORE_BUILD_DIR` 可选择其他绝对目录）。构建过程仅将 `scripts/build-core.sh` 中列出的源文件集（Core 服务、其契约、所需的共享软件包以及根 Go 模块文件）复制到临时上下文，并使用禁用 CGO、只读模块和裁剪路径的方式构建。它不需要 Node、Docker 或其他应用程序。Core 新增共享依赖时，请将该软件包加入列表；绝不能复制整个仓库来使其完成编译。
+`make build-core` 会将 `oac-core`、`oac-core-device`、`oac-core-environment-key` 和 `oac-node` 构建到 `${OAC_DEV_HOME:-$HOME/.oac}/build/oac-core`（`OAC_DEV_CORE_BUILD_DIR` 可选择其他绝对目录）。构建过程仅将 `scripts/build-core.sh` 中列出的源文件集（Core 服务、其契约、所需的共享软件包以及根 Go 模块文件）复制到临时上下文，并使用禁用 CGO、只读模块和裁剪路径的方式构建。它不需要 Node、Docker 或其他应用程序。Core 新增共享依赖时，请将该软件包加入列表；绝不能复制整个仓库来使其完成编译。
 
 `make docker-build-core` 会根据这五个命令和 E2B 辅助程序构建 `oac-core:dev` 镜像（`OAC_DEV_CORE_IMAGE` 可选择其他名称）。基础镜像是通过摘要固定的 `debian:bookworm-slim`，包含 CA 证书以及辅助程序所需的 glibc 运行时；默认用户的 UID/GID 为 65532，Core 监听 `:8091`。该镜像仅支持 Linux amd64，并且不会推送到注册表。对镜像或其构建进行更改时，除了相关的源代码检查外，还必须运行 `make check-core-container`：它会在只读根文件系统上针对该镜像运行官方客户端测试套件，并且需要 Linux Docker、非 root 用户，以及服务检查中的[测试数据库和固定版本 SDK](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/services/core/README.md#official-client-verification)（`OAC_TEST_DATABASE_URL` 指向一个已应用迁移的 `oac_*_tests` 数据库，并设置 `OAC_TEST_OFFICIAL_SDK_PYTHON`）。
 
@@ -132,21 +132,21 @@ git push origin v1.2.3
 
 ### 容器注册表 {#container-registry}
 
-版本发布会将 Linux amd64 镜像发布为 `ghcr.io/minimax-ai/openagentcore/<component>:<version>`，其中 `<component>` 为 `core`、`web`、`runtime` 或 `ingress`。例如，`ghcr.io/minimax-ai/openagentcore/core:v1.2.3`。PostgreSQL 使用其上游镜像，不会重新发布。注册表镜像从发布归档中加载，不会重新构建。仅当现有标签的镜像配置摘要与本次发布相同时才复用该标签；如果镜像不同，则停止发布。不会发布浮动 `latest` 标签。SemVer 构建元数据在容器标签中使用 `_` 代替 `+`；长度超过 128 个字符的版本字符串无法发布到 GHCR。手动草稿构建不会推送镜像。
+版本发布和手动的 `build-<full SHA>` 草稿都会将 Linux amd64 镜像发布为 `ghcr.io/minimax-ai/openagentcore/<component>:<version>`，其中 `<component>` 为 `core`、`web`、`runtime` 或 `ingress`。例如，`ghcr.io/minimax-ai/openagentcore/core:v1.2.3`。草稿使用标签 `build-<full SHA>`。PostgreSQL 使用其上游镜像，不会重新发布。注册表镜像从发布归档中加载，不会重新构建。仅当现有版本标签的镜像配置摘要与本次发布相同时才复用该标签；如果镜像不同，则停止发布。稳定版还会把每个组件的 `latest` 标签移到该镜像。预发布和草稿不会改动 `latest`。SemVer 构建元数据在容器标签中使用 `_` 代替 `+`；长度超过 128 个字符的版本字符串无法发布到 GHCR。镜像验证之后，发布器会上传为该发行版渲染的 `compose.yaml` 和 `ports.yaml` 及其校验和。草稿 Release 保持未发布。
 
 合并的构建/发布作业使用具有 `packages: write` 权限的 `GITHUB_TOKEN`。首次发布时，GitHub 会将每个容器软件包创建为私有：软件包管理员必须先在各自的软件包设置中将全部四个软件包改为 **Public**，用户才能匿名拉取。请参阅 [GitHub container visibility](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry)。更改可见性后，请验证未认证拉取。仅更改仓库可见性并不会使新的容器软件包变为公开。
 
-GHCR 和 GitHub Releases 不共享事务。发布失败后，GHCR 中可能仍会保留一些匹配的版本标签；请保留这些镜像，并使用原始构件按照下文的草稿恢复流程操作。除清单缺失以外，注册表故障都会停止发布。作业摘要会记录按摘要固定的引用；安装归档及其校验和保持不变。这些镜像仍需要[配置](configuration.md)中描述的配置、机密和路由；发布镜像不会提供平台部署模板。
+GHCR 和 GitHub Releases 不共享事务。发布失败后，GHCR 中可能仍会保留一些匹配的版本标签；请保留这些镜像，并使用原始构件按照下文的草稿恢复流程操作。除清单缺失以外，注册表故障都会停止发布。作业摘要会记录按摘要固定的引用。这些镜像和渲染后的 Compose 文件仍需要[配置](configuration.md)中描述的配置、机密和路由。
 
-`install.sh` 会解析一次最新稳定版，或解析 `--version` 指定的发布版，验证控制归档并运行该捆绑包的安装器；其用法见[安装指南](getting-started/install.md#install)。
+`install.sh` 会下载最新稳定版的 Compose 文件，或 `--version` 指定的发布版，校验 SHA-256 后启动该发布版。用法见[安装指南](getting-started/install.md#install)。
 
 Go 检查和构建作业共享 `~/.oac/cache/` 下的 Go 模块和编译器缓存目录，缓存键由运行器 OS 和架构、全部 Go 模块文件、检查/构建分区以及提交确定。分区键可防止并发作业在同一个键下保存不同的编译器子集。发布构建既可以使用后端检查的缓存，也可以使用更早发布构建的缓存。较旧的缓存只会为下载和编译提供初始内容；每项检查仍会运行。发布作业还会缓存 npm 软件包下载内容和固定版本的 microsandbox 归档，并在每次构建时验证后者的校验和。Actions 缓存可见性遵循 GitHub ref 的作用域；特定标签的缓存不会与其他发布标签共享。只有作业成功后才会保存新键。
 
-绝不移动发布标签或覆盖已发布的资源。发布失败时，请先检查 Release：即使响应丢失，发布也可能已经完成。对于完整的已发布 Release，请保持原样。对于不完整的草稿，仅在检查后将其删除，然后使用 `gh run download RUN_ID --name core-release-REVISION --dir ASSET_DIRECTORY` 下载原始 `core-release-<revision>` Actions 构建产物，并使用该确切源代码修订版本的检出运行 `python3 scripts/publish-core-release.py --assets ASSET_DIRECTORY`。将 `GH_REPO`、`GH_TOKEN`、`RELEASE_REVISION`、`RELEASE_TAG` 和 `RELEASE_MODE` 设置为原始发布输入，并将 Docker 登录到 GHCR 以发布版本。该脚本会重新验证资源，并拒绝使用已有 Release。恢复上传失败时，绝不能重新运行合并的构建作业，也绝不能重新创建标签。
+绝不移动发布标签或覆盖已发布的资源。发布失败时，请先检查 Release：即使响应丢失，发布也可能已经完成。对于完整的已发布 Release，请保持原样。对于不完整的草稿，仅在检查后将其删除，然后使用 `gh run download RUN_ID --name core-release-REVISION --dir ASSET_DIRECTORY` 下载原始 `core-release-<revision>` Actions 构建产物，并使用该确切源代码修订版本的检出运行 `python3 scripts/publish-core-release.py --assets ASSET_DIRECTORY`。将 `GH_REPO`、`GH_TOKEN`、`RELEASE_REVISION`、`RELEASE_TAG` 和 `RELEASE_MODE` 设置为原始发布输入，并将 Docker 登录到 GHCR。该脚本会重新验证资源，并拒绝使用已有 Release。恢复上传失败时，绝不能重新运行合并的构建作业，也绝不能重新创建标签。
 
 ### 构建候选版本但不发布 {#build-a-candidate-without-publishing}
 
-手动运行需要完整的提交 SHA，会执行相同的检查和构建，默认生成离线归档，并且绝不发布：
+手动运行需要完整的提交 SHA，会执行相同的检查和构建，默认生成离线归档，并且不会发布 Release：
 
 ```sh
 revision=$(git rev-parse HEAD)
@@ -154,7 +154,7 @@ gh workflow run core-release --repo MiniMax-AI/OpenAgentCore --ref main \
   -f ref="$revision" -f offline=true -f draft_release=true
 ```
 
-设置 `draft_release=true` 时，结果是未发布的 `build-<full SHA>` 草稿 Release；设置 `draft_release=false` 时，文件会保留在 Actions 构建产物中。请使用完全匹配的构件集合；绝不能混用构建结果，也绝不能通过 `latest` 解析组件。
+设置 `draft_release=true` 时，结果是未发布的 `build-<full SHA>` 草稿 Release，其镜像会以该标签推送；设置 `draft_release=false` 时，文件会保留在 Actions 构建产物中。请使用完全匹配的构件集合；绝不能混用构建结果，也绝不能通过 `latest` 解析组件。
 
 ## 持续集成 {#continuous-integration}
 
@@ -166,7 +166,7 @@ gh workflow run core-release --repo MiniMax-AI/OpenAgentCore --ref main \
 | --- | --- |
 | `hygiene` | 名称、仓库链接、随包文档完整性以及 CI 计划器/门禁测试；每次变更都会运行 |
 | `distribution` | Harness 目录和安装器模式、安装/应用/恢复/清理测试、Compose 解析和初始化固定数据、发布/下载和捆绑包契约、Go 控制台测试与构建；模板解析需要 Docker Compose，不需要 pnpm install 或浏览器 |
-| `compose` | 使用模板声明的发布镜像从空数据卷实际启动、登录和 API 访问、上传文件和下载节点安装器，然后在保留凭据和数据的同时重新配置 URL 并重新创建容器；需要 Docker 和网络访问，不需要构建镜像或模型凭据 |
+| `compose` | 使用从当前检出构建的镜像从空数据卷实际启动、登录和 API 访问、上传文件和下载节点安装器，然后在保留凭据和数据的同时重新配置 URL 并重新创建容器；需要 Docker、Go 和网络访问，不需要模型凭据 |
 | `backend` | 并行部分，每部分都有专用 PostgreSQL 保护检查：`runtime`（sqlc 新鲜度、Runtime/共享 Go 测试、Linux microsandbox 辅助程序、守护进程构建）、`core`（独立 Core 构建、Core 服务和客户端测试），以及串行 Core 持久化集成包的三个 `store` 分片 |
 | `harness` | Claude SDK 测试和打包、MiniMax 配套脚本 |
 | `example` | 可选的应用程序类型检查、测试、构建和隔离的浏览器验收 |
@@ -179,7 +179,7 @@ gh workflow run core-release --repo MiniMax-AI/OpenAgentCore --ref main \
 
 `.github/actionlint.yaml` 会选择 hygiene 和 lint。已知工作流变更会选择其使用方：CI review 和 actionlint 工作流运行 hygiene 和 lint；原生工作流变更会添加原生检查；API 验收工作流变更会添加启用容器验收的 API 检查；网站工作流变更会添加网站检查。共享 Node 操作会选择使用它的每个作业以及 lint。新工作流或未分类的工作流/操作会选择完整门禁，直至在计划器中声明其使用方。计划器测试和 CI 测量脚本运行 hygiene；更改计划器本身会运行完整门禁。
 
-Compose 模板和 Compose 测试发生变更时，会同时选择 `distribution` 固定数据和 `compose` 冒烟作业。安装 Docker 后，可在本地运行 `python3 scripts/compose-smoke.py` 重复该测试。该脚本使用唯一的项目、自动分配的回环端口，并将在 `~/.oac/tests/` 下生成构件；退出时移除其容器和数据卷。CI 还会在冒烟步骤失败或中断后执行清理。诊断信息会显示容器状态，但不会打印 HTTP 响应正文或登录密钥。该测试检查声明的发布镜像和通用 Compose 行为；它不会运行 Dokploy/Coolify 实例，也不会执行模型。
+Compose 模板和 Compose 测试发生变更时，会同时选择 `distribution` 固定数据和 `compose` 冒烟作业；Core、Web、共享 Go 软件包和镜像 Dockerfile 的变更也会选择冒烟作业。安装 Docker 后，可在本地运行 `python3 scripts/compose-smoke.py` 重复该测试。该脚本使用唯一的项目、自动分配的回环端口，并将在 `~/.oac/tests/` 下生成构件；退出时移除其容器和数据卷。CI 还会在冒烟步骤失败或中断后执行清理。诊断信息会显示容器状态，但不会打印 HTTP 响应正文或登录密钥。Core、Web 和 ingress 镜像都从当前检出构建；Web 提供占位页面而不是控制台构建。节点元数据来自 `deploy/compose/smoke-pins.json` 固定的发布版本。该测试检查通用 Compose 行为；它不会运行 Dokploy/Coolify 实例，也不会执行模型。
 
 Go 模块和工作区输入会选择后端、API（包括容器）、原生和分发检查。每个 Node 模块都拥有自己的清单和锁文件。网站依赖项会选择网站检查；Web 依赖项会选择 Web 和浏览器检查；示例依赖项会选择示例检查；共享 TypeScript 客户端依赖项会选择 Web、浏览器和示例检查；Claude 适配器依赖项会选择 Harness、原生和分发检查。共享包管理器配置会选择所有 Node 使用方。根 TypeScript 配置会选择 Web 和示例检查；适配器 TypeScript 配置会选择 Harness 和原生检查。每个所选集合都包含 hygiene。混合变更会累加其使用方，并且每个作业都读取同一计划，而不是维护各自的路径列表。例如，仅修改通知的 PR 会跳过数据库、浏览器和原生作业，而同时修改通知和 Core 的 PR 会添加后端和 API 检查。
 
diff --git a/docs/zh/web/console-api-usage.md b/docs/zh/web/console-api-usage.md
index 62d278c05..42d3bd583 100644
--- a/docs/zh/web/console-api-usage.md
+++ b/docs/zh/web/console-api-usage.md
@@ -1,7 +1,7 @@
 ---
 title: "控制台 API 使用"
 source: docs/web/console-api-usage.md
-source_hash: 0b1593010b41cf81e705ccf5cdb6df3c15e358b6da6b79ab588c552baa903481
+source_hash: 4e3bfbad317f6ab1467de7716a9463c088f12a2f88f84f36b08d37be64dc3db6
 ---
 
 本页列出各控制台页面读取和写入的 Core 路由，以及控制台如何限定读取范围。[administrator API contract](../../../contracts/agents-api/zh/admin-api.md) 定义了路由、响应结构、分页和审计记录；[API namespaces and credentials](../api/index.md) 定义了本文使用的术语。
@@ -10,7 +10,7 @@ source_hash: 0b1593010b41cf81e705ccf5cdb6df3c15e358b6da6b79ab588c552baa903481
 
 | 接口 | 路径 | 身份验证 | 控制台用途 |
 | --- | --- | --- | --- |
-| Console server | `/console/auth`、`/console/auth/{login,logout}`、`/console/config`、`/console/installation/domain`、`/node-install/manifest.json` | 登录时使用 Core 密钥，随后使用控制台会话 Cookie；`/node-install/manifest.json` 无需登录 | 登录和退出；Add node 所用的节点安装程序和节点构件；**System → Domain and HTTPS** 上的域设置；用于 Docker 和 microsandbox 设置的发行版 Runtime release。参见 [console server](console-server.md) |
+| Console server | `/console/auth`、`/console/auth/{login,logout}`、`/console/config`、`/node-install/manifest.json` | 登录时使用 Core 密钥，随后使用控制台会话 Cookie；`/node-install/manifest.json` 无需登录 | 登录和退出；Add node 所用的节点安装程序和节点构件；用于 Docker 和 microsandbox 设置的发行版 Runtime release。参见 [console server](console-server.md) |
 | Administrator API | `/core/v1/**`，不包括 `/core/v1/sandbox` | Core 密钥，由控制台服务器添加 | 项目、密钥、资源读取和删除、诊断、执行器凭据和安装命令、来源信息、汇总、Core 指标、安装信息、默认模型 |
 | Sandbox administration | `/core/v1/sandbox/**` | Core 密钥，由控制台服务器添加 | Sandbox 配置；Overview 和 Sandbox metrics 中的 Nodes、机群与容量数据；每个项目的 Runtime observations |
 | Agents API | `/v1/**` | 项目 API 密钥 | 不使用。控制台会向开发者说明如何调用它（参见 [Provenance and monitoring](#provenance-and-monitoring)） |
@@ -97,7 +97,7 @@ source_hash: 0b1593010b41cf81e705ccf5cdb6df3c15e358b6da6b79ab588c552baa903481
 
 | 操作 | 路由 | 控制台用途 |
 | --- | --- | --- |
-| 部署 | `GET`、`POST`、`PUT /core/v1/sandbox/deployment` | 读取提供商、只读 `core_url`（即 config.json 的 `public_url`，会显示在设置审核中且绝不发送）、重置状态、安装 ID 和规范；409 `sandbox_configuration_error`（E2B 搭配回环地址形式的 `public_url`）会在设置向导中显示共享客户端固定的安全地址配置消息，并同时显示安装的配置文件和 apply command，且无需确认；使用 `resources` 以及 Docker 或 microsandbox 的 `runtime` release 初始化部署，或者使用 E2B 账户且不提供 `resources`（Core 采用模板构建的 CPU 和内存）；使用预期的 generation 更改设置。E2B 的 `metadata.template_build`（状态、CPU、内存、磁盘）会显示在 System、Sandbox 配置摘要和 Sandbox metrics 中；当缺少 `specification.resources` 时，它还会确定每个 Sandbox 的大小；microsandbox 的 `suspension`（空闲和保留秒数）会显示在 System 和 Nodes 摘要中 |
+| 部署 | `GET`、`POST`、`PUT /core/v1/sandbox/deployment` | 读取提供商、只读 `core_url`（即 `OAC_PUBLIC_URL`，会显示在设置审核中且绝不发送）、重置状态、安装 ID 和规范；409 `sandbox_configuration_error`（E2B 搭配回环地址形式的 `public_url`）会在设置向导中显示共享客户端固定的安全地址配置消息，并同时显示安装的配置文件和 apply command，且无需确认；使用 `resources` 以及 Docker 或 microsandbox 的 `runtime` release 初始化部署，或者使用 E2B 账户且不提供 `resources`（Core 采用模板构建的 CPU 和内存）；使用预期的 generation 更改设置。E2B 的 `metadata.template_build`（状态、CPU、内存、磁盘）会显示在 System、Sandbox 配置摘要和 Sandbox metrics 中；当缺少 `specification.resources` 时，它还会确定每个 Sandbox 的大小；microsandbox 的 `suspension`（空闲和保留秒数）会显示在 System 和 Nodes 摘要中 |
 | E2B 发现 | `POST /core/v1/sandbox/providers/e2b/discovery` | 设置向导先列出输入的 E2B 密钥可见的模板，再列出所选模板的可用构建。该密钥只会通过这些请求体和部署写入请求传输 |
 | 重置 | `POST`、`DELETE /core/v1/sandbox/deployment/reset` | 显式清除托管资源，或在观测到的 generation 处取消剩余清除；显示 Core 的剩余资源和离线预测 |
 | Nodes | `GET /core/v1/sandbox/nodes` | Nodes 页面；Overview 上的机群；Sandbox metrics 中的节点容量。在线节点的 `diagnostic`（`docker_unavailable`、`docker_limits_unsupported`、`runtime_image_unavailable`、`kvm_unavailable`、`microsandbox_artifacts_unavailable`、`capacity_insufficient`、`provider_unavailable`；任何其他值均读取为 `provider_unavailable`）会将其标记为降级，并在上述每个页面及节点页面中，紧邻状态的帮助提示里说明原因和修复方法。如果节点的 `core_url`（其注册时使用的地址）与部署的 `core_url` 不同，Nodes 页面会将其标记为绑定到旧地址，需要移除后重新添加；此时它在该页面和节点页面中的状态会显示 Old address，而不是健康状态；如果 `core_url` 为空（Core 未注册该节点），则状态为未知，而不是旧地址。**Add node** 仅跟踪 `enrollment_id` 与其命令所含 `enrollment_id` 相等的节点 |
diff --git a/docs/zh/web/console-server.md b/docs/zh/web/console-server.md
index d73db9332..e7b67fd2a 100644
--- a/docs/zh/web/console-server.md
+++ b/docs/zh/web/console-server.md
@@ -1,10 +1,10 @@
 ---
 title: "控制台服务器"
 source: docs/web/console-server.md
-source_hash: 745ee484725bf07d2f56300d36f2ff41f0fbbe2c3aaafd63af083f502c1f44f0
+source_hash: b0302f0cf27ccd116c4bbb9477d5853f4ae1bf6cea34c9a4e21af72d25656557
 ---
 
-控制台服务器（`services/web`、`oac-web` 进程）提供构建后的控制台，使用 Core 密钥认证管理员，并将已登录浏览器的 `/core/v1` 请求携带该密钥转发到 Core。浏览器不持有 Core 密钥或任何 API 密钥。应用、节点和自托管执行器直接调用 Core；控制台不转发这些流量。
+控制台服务器（`services/web`、`oac-web` 进程）提供构建后的控制台，使用 Core 密钥认证管理员，并将已登录浏览器的 `/core/v1` 请求携带该密钥转发到 Core。浏览器不持有 Core 密钥或任何 API 密钥。应用、节点和自托管执行器经控制台到达 Core，控制台原样转发 `/v1`、`/api/v1` 和 `/docs`。
 
 [配置](../configuration.md#appendix-web-environment-without-the-installer)定义其进程设置和默认值。
 
@@ -18,35 +18,34 @@ flowchart LR
   database[("PostgreSQL")]
   application["Application / official SDK"]
   machine["Nodes and Runtime daemons"]
-  installer["Installer domain service"]
 
   browser -->|"same origin: /console/*, /core/v1/*; session cookie"| console
   console -->|"/core/v1/* with the Core key"| core
-  console -->|"domain setup, Unix socket"| installer
-  application -->|"/v1 with a Project API key"| core
-  machine -->|"/api/v1 with machine credentials"| core
+  application -->|"/v1 with a Project API key"| console
+  machine -->|"/api/v1 with machine credentials"| console
+  console -->|"/v1, /api/v1 and /docs unchanged"| core
   core <--> database
 ```
 
-部署的反向代理将 `/v1` 和 `/api/v1` 路由到 Core，其余路径路由到控制台；[安装选项](../getting-started/install-options.md#https-and-the-reverse-proxy)列出路由。控制台按如下方式处理路径：
+部署的反向代理把所有路径发给控制台。控制台把 `/v1`、`/api/v1` 和 `/docs` 转发到 Core，其余由自己提供；[安装选项](../getting-started/install-options.md#https-and-the-reverse-proxy)列出对反向代理的要求。控制台按如下方式处理路径：
 
 | 路径 | 需要登录 | 处理方式 |
 | --- | --- | --- |
 | `/healthz` | 否 | `GET` 或 `HEAD` 返回 `200 ok` |
-| `/v1`、`/api/v1` 及其下级路径 | — | 无论请求携带何种凭据均为 404 |
+| `/v1`、`/api/v1` 及其下级路径 | — | 原样转发到 Core，保留调用方凭据、流式响应和 WebSocket 升级 |
+| `/docs`、`/docs/*` | 否 | API 参考及其 OpenAPI 文档，原样转发到 Core |
 | `/node-install/*` | 否 | 节点安装文件（参阅[节点安装文件](#node-installation-payload)） |
 | `/console/auth`、`/console/auth/login`、`/console/auth/logout` | 否 | [登录](#sign-in) |
 | `/`、`/index.html`、`/favicon.svg`、`/oac-mark.svg`、`/assets/*` | 否 | 控制台静态资源 |
 | `/console/config` | 是 | [控制台配置](#console-configuration) |
-| `/console/installation/domain` | 是 | [域名设置](#domain-setup) |
 | `/core/v1/*` | 是 | [转发到 Core](#forwarding-to-core) |
 | `/core` 及 `/core/` 下其他路径 | 是 | 404 |
 | 其他路径 | 是 | 静态资源；无扩展名的路径回退到 `index.html` |
 
-除 `/healthz`、`/v1` 和 `/api/v1` 外，每个请求首先必须通过这些检查：
+除 `/healthz`、`/v1`、`/api/v1` 和 `/docs` 外，每个请求首先必须通过这些检查：
 
 1. **Host 与来源。** `Host` 请求头必须等于 `OAC_WEB_ORIGIN` 的主机。存在 `Origin` 时必须等于该来源，`Sec-Fetch-Site` 必须为 `same-origin` 或 `none`。写请求既无 `Origin` 又无 `Sec-Fetch-Site: same-origin` 时，需要同源 `Referer`。否则控制台返回 403。`/node-install/*` 仅检查主机和路径。
-2. **安全请求。** 路径必须以 `/` 开头，不含 `%`、反斜杠、NUL、点路径段或空路径段。绝对形式请求目标、`CONNECT`、`TRACE` 及包含 `Upgrade` 头的请求返回 400。因此请求无法离开 Core 的 `/core/v1`，控制台也不承载 WebSocket。
+2. **安全请求。** 路径必须以 `/` 开头，不含 `%`、反斜杠、NUL、点路径段或空路径段。绝对形式请求目标、`CONNECT` 和 `TRACE` 返回 400。`Upgrade` 头返回 400，但 `/v1`、`/api/v1` 和 `/docs` 在这些检查之前就被转发。因此 `/core/v1` 请求无法离开该前缀。
 3. **登录。** 需要登录的路径在无有效会话 cookie 时返回 401。
 
 `/core` 下，这些失败使用 Core 错误封装和[控制台生成的失败](../../../contracts/agents-api/zh/core-errors.md#console-generated-failures)中的代码；其他位置返回 `{"error": "…"}`，不安全请求则返回纯文本。每个响应包含 `Cache-Control: no-store`、`X-Content-Type-Options: nosniff`、`Referrer-Policy: no-referrer` 和 `Content-Security-Policy: frame-ancestors 'none'`。
@@ -99,22 +98,9 @@ flowchart LR
 
 设置 `OAC_WEB_NODE_PAYLOAD_DIR` 后，控制台在 `/node-install/` 无需登录地提供匹配发行版的节点文件：`node-install.pyz`、`manifest.json`、`SHA256SUMS`、`runtime/seccomp.json`，以及清单声明的 `artifacts/` 下节点资产。本地缺失的资产重定向（307）到固定发行下载地址。节点安装和卸载命令从 `<public_url>/node-install/` 下载，因此反向代理必须将该路径发给控制台。节点自行验证每个校验和。
 
-## 域名设置 {#domain-setup}
+## 公开地址 {#public-address}
 
-`GET` 和 `POST /console/installation/domain` 使 **System → Domain and HTTPS** 能配置托管安装的域名。这是控制台路由，不是 Core 路由。通过同源与登录检查后，控制台将最多 2 KiB 的请求体传给 `OAC_WEB_INSTALLATION_SOCKET` 的安装程序 Unix 套接字，使用 Core 密钥认证，并返回安装程序 JSON 响应和状态。请求在 20 秒后超时。
-
-| 方法 | 请求 | 结果 |
-| --- | --- | --- |
-| `GET` | 无请求体 | 域名状态 |
-| `POST` | `{"hostname":"core.example.com"}`，可附加 `"confirm_public_url_change":"https://core.example.com"` | 202 和状态；安装程序在后台检查并应用域名 |
-
-状态包含 `supported`、`state`（`unconfigured`、`checking`、`applying`、`ready` 或 `failed`），以及可为 null 的 `public_url`、`target_url` 和 `message`。安装程序错误使用 `{"error":{"code":"…","message":"…"}}`。修改节点或执行器已使用的地址时，在请求确认新 URL 前返回 409 `public_url_confirmation_required`；待应用的 `config.json` 修改、未应用或未运行的安装、手动修改的生成文件，以及其他安装操作持有锁（`installation_busy`）也返回 409。
-
-未设置 `OAC_WEB_INSTALLATION_SOCKET` 时（外部反向代理安装），`GET` 报告 `supported: false`，`POST` 返回 400 `domain_setup_unavailable`。安装程序不可达或响应无效时返回 502 `installation_unreachable`。
-
-System 页面仅提交一次主机名，在状态为 `checking` 或 `applying` 时每 2 秒轮询；安装程序要求时请求确认。设置期间，网络失败和 HTTP 502/503/504 响应不会停止轮询。30 秒内没有成功状态响应后，页面展示断连消息；下一次轮询成功即恢复。不重试写入。应用域名会重启控制台并结束全部会话；页面保留到新 HTTPS 地址的登录链接。只有 `ready` 状态确认 HTTPS；浏览器不探测新来源。安装程序负责证书、锁定与恢复（[托管 HTTPS](https://github.com/MiniMax-AI/OpenAgentCore/blob/main/deploy/install/README.md#managed-https)）。
-
-安装程序在未配置公开 URL 时设置 `OAC_WEB_BOOTSTRAP=1`，让控制台也接受以字面 IP 地址访问的明文 HTTP 请求，并将 `http://<that address>` 视为来源，使运维人员能通过服务器 IP 登录。主机名仍必须符合 `OAC_WEB_ORIGIN`，因此 DNS 重绑定不能访问控制台。
+控制台不配置域名，也不申请证书。运维人员的反向代理或托管平台终止 HTTPS 并把流量转到控制台，`OAC_PUBLIC_URL` 记录应用、节点和执行器使用的源地址。控制台只接受 `OAC_WEB_ORIGIN` 的主机，因此 DNS 重绑定不能访问它。
 
 ## 验证 {#verification}
 
diff --git a/docs/zh/web/index.md b/docs/zh/web/index.md
index 5f336533c..cfe4df338 100644
--- a/docs/zh/web/index.md
+++ b/docs/zh/web/index.md
@@ -1,7 +1,7 @@
 ---
 title: "OpenAgentCore Web"
 source: docs/web/index.md
-source_hash: 59ab5c2c95b32a7fb7e6444bccf64be367372212fe6329b44398891cfe8d730a
+source_hash: 375d6245441e9f484af64798fb23c665d0ec712eb9a5088e7a41e3293374680a
 ---
 
 Web 是单个 OpenAgentCore 部署的管理员控制台。管理员用它查看健康状态、容量、用量和失败情况，检查各 Project 的资源与执行历史，并管理 Project、密钥、节点和部署设置。应用不使用 Web；它们通过自己的 Project API 密钥调用 Core 的 Agents API（`/v1`）。
@@ -26,7 +26,7 @@ Web 是单个 OpenAgentCore 部署的管理员控制台。管理员用它查看
 | Resources | Agents、Environment templates、Skills、Files、Vaults | 检查和允许的删除操作，显示各资源所属 Project 及创建密钥 |
 | Platform | Projects and keys | 创建、重命名和归档 Project；签发与撤销密钥；各 Project 的用量、写入历史和 API 调用方法 |
 | Platform | Nodes | 添加、编辑和移除 Docker 或 microsandbox 节点；各节点的就绪状态、容量和分配 |
-| Platform | System | 安装的公开地址、API 基础 URL、ID 和源码提交；**Domain and HTTPS**；各 Harness 默认模型；**Sandbox configuration**；Core `config.json` 启动设置，只读并注明修改位置 |
+| Platform | System | 安装的公开地址、API 基础 URL、ID 和源码提交；各 Harness 默认模型；**Sandbox configuration**；Core 加载的启动设置，只读 |
 
 缺失数据展示为缺失（—），不会当作零。[控制台 API 使用](console-api-usage.md)列出各页面读取内容及统计边界。
 
@@ -34,7 +34,7 @@ Web 是单个 OpenAgentCore 部署的管理员控制台。管理员用它查看
 
 | 任务 | 位置 |
 | --- | --- |
-| 为安装设置 HTTPS 地址 | 托管入口安装的 **System → Domain and HTTPS**；参阅[使 Core 可访问](../getting-started/install.md#configure-the-domain-and-https) |
+| 为安装设置 HTTPS 地址 | 设置 `OAC_PUBLIC_URL`，并把反向代理指向 Web；参阅[使 Core 可访问](../getting-started/install.md#configure-the-domain-and-https) |
 | 选择沙箱后端（Docker、microsandbox 或 E2B）、规格和 Runtime，或重置后端 | **System → Sandbox configuration**；参阅[修改沙箱配置](../getting-started/nodes.md#change-the-sandbox-configuration) |
 | 添加或移除执行节点 | **Nodes**；参阅[节点指南](../getting-started/nodes.md) |
 | 设置 Harness 默认模型 | **System → Default model configuration**；参阅[默认模型](../configuration.md#default-models) |
diff --git a/packages/agents-client/src/admin-projection.ts b/packages/agents-client/src/admin-projection.ts
index a6f3a5577..67f509a60 100644
--- a/packages/agents-client/src/admin-projection.ts
+++ b/packages/agents-client/src/admin-projection.ts
@@ -295,8 +295,8 @@ export function projectInstallation(value: unknown): CoreInstallation {
   let configuration: CoreInstallation["configuration"] = null;
   if (installation.configuration !== null) {
     const applied = record(installation.configuration, ["path", "apply_command", "applied_at", "settings"]);
-    if (typeof applied.path !== "string" || !applied.path.startsWith("/") || typeof applied.apply_command !== "string" || !applied.apply_command ||
-      typeof applied.applied_at !== "string" || !date(applied.applied_at) || !Array.isArray(applied.settings)) return invalidAdminResponse();
+    if (typeof applied.path !== "string" || (applied.path !== "" && !applied.path.startsWith("/")) || typeof applied.apply_command !== "string" ||
+      (applied.applied_at !== null && (typeof applied.applied_at !== "string" || !date(applied.applied_at))) || !Array.isArray(applied.settings)) return invalidAdminResponse();
     const settings = applied.settings.map(projectInstallationSetting);
     if (new Set(settings.map((setting) => setting.key)).size !== settings.length) return invalidAdminResponse();
     configuration = { path: applied.path, apply_command: applied.apply_command, applied_at: applied.applied_at, settings };
diff --git a/packages/agents-client/src/admin-types.ts b/packages/agents-client/src/admin-types.ts
index b11ba2dd5..53701d598 100644
--- a/packages/agents-client/src/admin-types.ts
+++ b/packages/agents-client/src/admin-types.ts
@@ -202,11 +202,12 @@ export interface CoreInstallationSetting {
 }
 /** Where process settings change, and their last applied values. */
 export interface CoreInstallationConfiguration {
-  /** Absolute host path of config.json. */
+  /** Absolute host path of config.json. Empty when Core reports the environment it loaded. */
   path: string;
-  /** Command that applies config.json changes. */
+  /** Command that applies config.json changes. Empty when Core reports the environment it loaded. */
   apply_command: string;
-  applied_at: string;
+  /** Null when Core reports the environment it loaded. */
+  applied_at: string | null;
   settings: CoreInstallationSetting[];
 }
 /** `GET /core/v1/installation`: available before any sandbox deployment exists. */
@@ -221,7 +222,7 @@ export interface CoreInstallation {
   local_only: boolean;
   /** Full source commit Core was built from; null for development builds. */
   source_commit: string | null;
-  /** Null when the installer did not start Core. */
+  /** Null when Core was not started. Core reports the process settings it loaded; path and apply_command are empty unless a snapshot was supplied. */
   configuration: CoreInstallationConfiguration | null;
   address_bindings: CoreAddressBindings;
 }
diff --git a/packages/claude-sdk-adapter/README.md b/packages/claude-sdk-adapter/README.md
index 3f5ab3971..880cc927d 100644
--- a/packages/claude-sdk-adapter/README.md
+++ b/packages/claude-sdk-adapter/README.md
@@ -64,7 +64,7 @@ Workspace deferred-function discovery uses native ToolSearch alongside the norma
 
 ### Registration and state
 
-For unmanaged bootstrap, daemon `connect` optionally registers this factory as `claude_sdk` when the operator sets `OAC_RUNTIME_CLAUDE_SDK_ENTRYPOINT` to the absolute packaged `dist/main.js`. `OAC_RUNTIME_CLAUDE_SDK_NODE` selects Node (default: `node` on PATH). Discovery resolves Node once and checks that exact configuration before pairing; the SDK's bounded runtime check is independent of CLI version probes. A ready SDK alone is sufficient to start the daemon. No configuration means no SDK probe or descriptor; failed readiness reports an unavailable descriptor with a rejecting factory. Runtime checks establish local readiness, not provider authentication. Installed daemons use `start` and their verified installation manifest for adapter selection and activation; ambient activation variables cannot extend that selection. See [the native installation contract](../../deploy/install/README.md#native-daemon-installer).
+For unmanaged bootstrap, daemon `connect` optionally registers this factory as `claude_sdk` when the operator sets `OAC_RUNTIME_CLAUDE_SDK_ENTRYPOINT` to the absolute packaged `dist/main.js`. `OAC_RUNTIME_CLAUDE_SDK_NODE` selects Node (default: `node` on PATH). Discovery resolves Node once and checks that exact configuration before pairing; the SDK's bounded runtime check is independent of CLI version probes. A ready SDK alone is sufficient to start the daemon. No configuration means no SDK probe or descriptor; failed readiness reports an unavailable descriptor with a rejecting factory. Runtime checks establish local readiness, not provider authentication. Installed daemons use `start` and their verified installation manifest for adapter selection and activation; ambient activation variables cannot extend that selection. See [the native installation contract](../../deploy/README.md#native-daemon-installer).
 
 SDK state lives under `paths.ProfileDir(profile)/runtime/claude-sdk`, independently of the replaceable runtime bundle. Both the entrypoint and managed state root must be absolute. Background re-execution inherits operator configuration; it does not persist provider credentials in pairing profiles. The daemon registers `claude_sdk` directly, without the capability-download, skill-upload and `WorkspaceAuthoring` wrappers of its product agent kinds. It accepts no caller-supplied environment variables or business write authority.
 
diff --git a/deploy/install/acceptance.py b/scripts/acceptance/acceptance.py
similarity index 99%
rename from deploy/install/acceptance.py
rename to scripts/acceptance/acceptance.py
index 941fa5deb..078ddeeb2 100644
--- a/deploy/install/acceptance.py
+++ b/scripts/acceptance/acceptance.py
@@ -11,7 +11,7 @@
  "mcode": {"model": "...", "model_provider": {"protocol": "anthropic", ...}}}
 See contracts/agents-api/model-execution.md for provider fields and limits.
 
-Example: python3 deploy/install/acceptance.py run --base-url http://127.0.0.1:8091
+Example: python3 scripts/acceptance/acceptance.py run --base-url http://127.0.0.1:8091
   --caller-key-file /private/caller.key --model-config-file /private/models.json
   --report-dir /private/release-acceptance
 
diff --git a/deploy/install/harness_catalog.py b/scripts/acceptance/harness_catalog.py
similarity index 100%
rename from deploy/install/harness_catalog.py
rename to scripts/acceptance/harness_catalog.py
diff --git a/deploy/install/test_acceptance.py b/scripts/acceptance/test_acceptance.py
similarity index 100%
rename from deploy/install/test_acceptance.py
rename to scripts/acceptance/test_acceptance.py
diff --git a/scripts/build-core-distribution.sh b/scripts/build-core-distribution.sh
index 457b897c1..2fd3b476a 100755
--- a/scripts/build-core-distribution.sh
+++ b/scripts/build-core-distribution.sh
@@ -99,12 +99,9 @@ if [[ "$(go env GOVERSION)" != "$required_go" ]]; then
   exit 1
 fi
 go run ./services/core/cmd/provider-artifacts
-for file in install.sh install.py install_output.py install_display.py node_output.py configuration.py config_model.py config.schema.json ingress.py ingress_config.py oac_cli.py \
-    native_installers.py node_install.py provider_assets.py node_spec.py node_generations.py sandbox_setup.py distribution.py; do
-  cp "deploy/install/$file" "$bundle/$file"
+for file in install_display.py node_output.py node_install.py provider_assets.py node_spec.py node_generations.py node_payload.py distribution.py; do
+  cp "deploy/node/$file" "$bundle/$file"
 done
-# Web owns the Standard sandbox sizes; the installer's first deployment uses this copy.
-cp apps/web/src/features/sandbox/standard-sizes.json "$bundle/standard-sizes.json"
 python3 scripts/core-distribution-manifest.py bootstraps "$bundle" "$source_epoch" "$revision"
 # The bundled docs (BUNDLED_DOCS); links that leave them point at this commit on GitHub.
 python3 scripts/core-distribution-manifest.py docs . "$bundle" "$revision"
@@ -152,7 +149,10 @@ cp -R apps/web/dist "$stage/web/dist"
 cp services/web/Dockerfile "$stage/web/Dockerfile"
 build_image web "$stage/web"
 
-build_image ingress -f deploy/distribution/Ingress.Dockerfile deploy/distribution
+mkdir -p "$stage/ingress"
+cp deploy/distribution/Ingress.Dockerfile "$stage/ingress/Dockerfile"
+cp "$stage/core/bin/oac" "$stage/ingress/oac"
+build_image ingress "$stage/ingress"
 
 CGO_ENABLED=0 go build -mod=readonly -trimpath -o "$stage/oac-daemon" ./apps/daemon/cmd/oac-daemon
 cp "$stage/oac-daemon" "$bundle/native/bin/oac-daemon"
diff --git a/scripts/build-core.sh b/scripts/build-core.sh
index 60b8e0969..3feabc800 100755
--- a/scripts/build-core.sh
+++ b/scripts/build-core.sh
@@ -33,10 +33,11 @@ tar -C "$repo_root" -cf - \
 (
   cd "$build_context"
   export GOWORK=off CGO_ENABLED=0
-  for command in server migrate device environment-key sandbox-node; do
+  for command in server device environment-key sandbox-node oac; do
     artifact="oac-core-$command"
     if [[ "$command" == server ]]; then artifact=oac-core; fi
     if [[ "$command" == sandbox-node ]]; then artifact=oac-node; fi
+    if [[ "$command" == oac ]]; then artifact=oac; fi
     go build -mod=readonly -trimpath -buildvcs=false -ldflags "-X main.buildRevision=$revision" \
       -o "$build_context/bin/$artifact" "./services/core/cmd/$command"
   done
@@ -44,7 +45,7 @@ tar -C "$repo_root" -cf - \
 
 # Publish only after every command builds successfully.
 mkdir -p "$output_dir"
-for artifact in oac-core oac-core-migrate oac-core-device oac-core-environment-key oac-node; do
+for artifact in oac-core oac-core-device oac-core-environment-key oac-node oac; do
   mv -f "$build_context/bin/$artifact" "$output_dir/$artifact"
 done
 printf 'Core commands: %s\n' "$output_dir"
diff --git a/scripts/ci_plan.py b/scripts/ci_plan.py
index 2b3ef9d67..6aee79b50 100644
--- a/scripts/ci_plan.py
+++ b/scripts/ci_plan.py
@@ -9,7 +9,7 @@
 
 JOBS = ("hygiene", "distribution", "compose", "backend", "harness", "example", "web", "web-acceptance", "website", "api", "native", "lint")
 NODE_JOBS = ("harness", "example", "web", "web-acceptance", "website", "native")
-GO_JOBS = ("distribution", "backend", "api", "native")
+GO_JOBS = ("distribution", "compose", "backend", "api", "native")
 # Exact file matches keep new workflows/actions conservative until classified.
 CI_INPUTS = {
     ".github/workflows/check.yml": JOBS,
@@ -50,29 +50,29 @@
 SCRIPTS = (".py", ".sh", ".mjs", ".go", ".json")
 RULES = (
     (("apps/web/",), WEB, ("web", "web-acceptance")),
-    (("services/web/",), (*GO, "Dockerfile"), ("distribution", "web", "web-acceptance")),
+    (("services/web/",), (*GO, "Dockerfile"), ("distribution", "compose", "web", "web-acceptance")),
     (("example/",), WEB, ("example",)),
     (("docs/", "contracts/"), ("",), ("website",)),
     (("website/",), (*WEB, ".vue", ".md"), ("website",)),
-    (("services/core/",), CORE, ("backend", "api")),
+    (("services/core/",), CORE, ("backend", "api", "compose")),
     (("services/core/internal/nativeinstaller/",), GO, ("native", "distribution")),
     (("services/core/deploy/", "services/core/tools/"), CORE, ("distribution",)),
     (("apps/daemon/",), GO, ("backend", "native")),
-    (("internal/",), (*GO, ".json"), ("backend", "api", "native", "distribution")),
+    (("internal/",), (*GO, ".json"), ("backend", "api", "native", "distribution", "compose")),
     (("internal/harnessconfig/",), (*GO, ".json"), ("web", "web-acceptance", "example", "harness")),
     (("contracts/",), (*GO, ".json", ".yaml", ".yml"), ("backend", "api", "native", "web", "web-acceptance", "example", "distribution")),
     (("packages/agents-client/",), (*GO, *WEB), ("backend", "api", "web", "web-acceptance", "example")),
     (("packages/claude-sdk-adapter/", "packages/mcode-harness/"), WEB, ("harness", "native", "backend", "distribution")),
     (("packages/tsconfig/",), (".json",), ("harness", "native")),
-    (("deploy/install/",), (".py", ".json", ".sh"), ("distribution",)),
-    (("deploy/compose/",), (".yaml", ".toml"), ("distribution", "compose")),
-    (("scripts/compose-smoke.py", "deploy/install/test_compose.py"), (".py",), ("distribution", "compose")),
-    (("deploy/install-release.sh", "scripts/install-release.", "scripts/publish-core-release.",
-      "scripts/core-distribution-manifest.", "scripts/build-core-distribution.sh", "scripts/config-reference.py",
+    (("deploy/node/", "scripts/acceptance/"), (".py", ".json", ".sh"), ("distribution",)),
+    (("deploy/compose/",), (".yaml", ".toml", ".json"), ("distribution", "compose")),
+    (("scripts/compose-smoke.py", "scripts/render-compose.py", "deploy/compose/test_compose.py"), (".py",), ("distribution", "compose")),
+    (("deploy/install.sh", "deploy/install.dev.sh", "deploy/test_install.py", "scripts/publish-core-release.",
+      "scripts/core-distribution-manifest.", "scripts/build-core-distribution.sh",
       "scripts/build-web.sh"), SCRIPTS, ("distribution",)),
     (("scripts/build-native-", "scripts/native-"), SCRIPTS, ("native", "backend", "distribution")),
     (("scripts/build-core.sh", "scripts/build-core-image-context.sh"), (".sh",), ("backend", "api", "distribution", "native")),
-    (("deploy/distribution/",), ("Dockerfile",), ("backend", "api", "distribution", "native")),
+    (("deploy/distribution/",), ("Dockerfile",), ("backend", "api", "distribution", "native", "compose")),
     (("scripts/build-e2b-provider.sh",), (".sh",), ("backend", "api", "distribution")),
     (("scripts/build-claude", "scripts/check-claude", "scripts/build-mcode", "scripts/prepare-release-runtimes.sh"),
      SCRIPTS, ("harness", "native", "backend", "distribution")),
@@ -104,8 +104,7 @@
                 "services/core/deploy/e2b/")
 # Generated outputs retain freshness checks even when the file is documentation.
 GENERATED_OUTPUTS = {"contracts/agents-api/harness-catalog.md", "contracts/agents-api/zh/harness-catalog.md", "packages/agents-client/src/harness-catalog.ts",
-                     "services/core/internal/engine/catalog_generated.go", "docs/configuration.md",
-                     "docs/getting-started/install-options.md"}
+                     "services/core/internal/engine/catalog_generated.go"}
 
 
 def full(reason):
diff --git a/scripts/ci_plan_test.py b/scripts/ci_plan_test.py
index 02791e086..cd3068191 100644
--- a/scripts/ci_plan_test.py
+++ b/scripts/ci_plan_test.py
@@ -20,18 +20,18 @@ def test_published_documents_also_build_the_website(self):
         self.assertEqual(self.jobs("README.md"), {"hygiene"})
 
     def test_installer_does_not_download_a_browser_or_run_database_tests(self):
-        self.assertEqual(self.jobs("deploy/install/install.py", "scripts/install-release.test.py"), {"hygiene", "distribution"})
+        self.assertEqual(self.jobs("deploy/install.sh", "deploy/node/node_payload.py"), {"hygiene", "distribution"})
 
     def test_compose_inputs_select_live_and_fixture_checks_without_image_builds(self):
-        for path in ("deploy/compose/compose.yaml", "deploy/compose/local.yaml", "deploy/compose/dokploy.toml",
-                     "scripts/compose-smoke.py", "deploy/install/test_compose.py"):
+        for path in ("deploy/compose/compose.yaml", "deploy/compose/ports.yaml", "deploy/compose/https.yaml", "deploy/compose/dokploy.toml",
+                     "scripts/compose-smoke.py", "scripts/render-compose.py", "deploy/compose/test_compose.py"):
             self.assertEqual(self.jobs(path), {"hygiene", "distribution", "compose"})
             self.assertFalse(ci.select([path])["image"])
 
     def test_web_and_core_have_different_consumers(self):
         self.assertEqual(self.jobs("apps/web/src/app.tsx"), {"hygiene", "web", "web-acceptance"})
         plan = ci.select(["services/core/internal/store/sessions.go"])
-        self.assertEqual(set(plan["jobs"]), {"hygiene", "backend", "api"})
+        self.assertEqual(set(plan["jobs"]), {"hygiene", "backend", "api", "compose"})
         self.assertFalse(plan["image"])
 
     def test_image_and_native_inputs_keep_their_acceptance(self):
@@ -53,8 +53,7 @@ def test_generated_outputs_keep_freshness_checks(self):
         spec.loader.exec_module(generator)
         with patch.object(generator, "go", side_effect=lambda source: source):
             outputs = generator.render(generator.load_catalog(generator.ROOT / generator.CATALOG))
-        for path in [*map(str, outputs), "deploy/install/harness_catalog.py", "docs/configuration.md",
-                     "docs/getting-started/install-options.md"]:
+        for path in [*map(str, outputs), "scripts/acceptance/harness_catalog.py"]:
             with self.subTest(path=path):
                 self.assertIn("distribution", self.jobs(path))
 
@@ -109,7 +108,7 @@ def test_node_action_selects_all_direct_consumers_and_lint(self):
     def test_dependencies_are_scoped_to_language_consumers(self):
         for path in ("go.mod", "go.sum", "go.work", "go.work.sum"):
             with self.subTest(path=path):
-                self.assertEqual(self.jobs(path), {"hygiene", "backend", "distribution", "api", "native"})
+                self.assertEqual(self.jobs(path), {"hygiene", "backend", "distribution", "compose", "api", "native"})
                 self.assertTrue(ci.select([path])["image"])
         for path in ("package.json", "pnpm-workspace.yaml", ".npmrc"):
             with self.subTest(path=path):
@@ -146,7 +145,7 @@ def test_ci_tests_and_metrics_do_not_trigger_product_checks(self):
 
     def test_workflow_and_code_changes_accumulate(self):
         self.assertEqual(self.jobs(".github/workflows/ci-review.yml", "services/core/internal/store/sessions.go"),
-                         {"hygiene", "lint", "backend", "api"})
+                         {"hygiene", "lint", "backend", "api", "compose"})
         self.assertEqual(self.jobs(".github/workflows/native.yml", "apps/web/src/app.tsx"),
                          {"hygiene", "lint", "native", "web", "web-acceptance"})
 
@@ -158,14 +157,14 @@ def test_every_job_has_a_plan_condition(self):
                 self.assertIn(f"contains(fromJSON(needs.plan.outputs.jobs || '[]'), '{job}')", bodies[job])
 
     def test_mixed_changes_accumulate(self):
-        self.assertEqual(self.jobs("docs/maintainers.md", "deploy/install/install.py", "apps/web/src/app.tsx"),
+        self.assertEqual(self.jobs("docs/maintainers.md", "deploy/install.sh", "apps/web/src/app.tsx"),
                          {"hygiene", "distribution", "web", "web-acceptance", "website"})
 
     def test_installer_pr_300_replay(self):
         self.assertEqual(self.jobs(
-            "deploy/install-release.sh", "deploy/install/README.md", "deploy/install/install.py",
-            "deploy/install/install_display.py", "deploy/install/test_install.py", "deploy/install/test_install_output.py",
-            "docs/getting-started/install.md", "scripts/install-release.test.py"), {"hygiene", "distribution", "website"})
+            "deploy/install.sh", "deploy/README.md", "deploy/node/node_install.py",
+            "deploy/node/install_display.py", "deploy/node/node_payload.py",
+            "docs/getting-started/install.md"), {"hygiene", "distribution", "website"})
 
     def test_workflow_graph_cannot_silently_omit_or_add_a_gate_dependency(self):
         workflow = (Path(__file__).resolve().parents[1] / ".github/workflows/check.yml").read_text().split("jobs:\n", 1)[1]
@@ -180,9 +179,9 @@ def test_only_matching_directory_and_suffix_trigger_product_checks(self):
                      "apps/web/notes.md", "scripts/build-core.sh.md", "new-component/source.rs",
                      "services/core/code.go.bak"):
             self.assertEqual(self.jobs(path), {"hygiene"}, path)
-        self.assertEqual(self.jobs("services/core/code.go"), {"hygiene", "backend", "api"})
+        self.assertEqual(self.jobs("services/core/code.go"), {"hygiene", "backend", "api", "compose"})
         self.assertEqual(self.jobs("apps/web/src/style.css"), {"hygiene", "web", "web-acceptance"})
-        self.assertEqual(self.jobs("services/core/migrations/123.sql"), {"hygiene", "backend", "api"})
+        self.assertEqual(self.jobs("services/core/migrations/123.sql"), {"hygiene", "backend", "api", "compose"})
 
     def test_fixture_and_embedded_resources_keep_checks_regardless_of_suffix(self):
         for path in ("services/core/tests/testdata/prompt.md", "services/core/tests/testdata/image.jpg"):
@@ -190,7 +189,7 @@ def test_fixture_and_embedded_resources_keep_checks_regardless_of_suffix(self):
         self.assertTrue({"backend", "native"} <= self.jobs("apps/daemon/internal/agent/testdata/prompt.md"))
         self.assertTrue({"backend", "api", "native", "distribution"} <= self.jobs("services/core/internal/nativeinstaller/assets/archive"))
         self.assertTrue({"web", "web-acceptance"} <= self.jobs("apps/web/public/logo.svg"))
-        self.assertTrue({"distribution", "web", "web-acceptance"} <= self.jobs("services/web/Dockerfile"))
+        self.assertTrue({"distribution", "compose", "web", "web-acceptance"} <= self.jobs("services/web/Dockerfile"))
 
     def test_tracked_program_sources_have_a_matching_rule(self):
         root = Path(__file__).resolve().parents[1]
@@ -264,7 +263,7 @@ def git(*args):
                 paths = ci.changed_paths(base, "HEAD")
                 self.assertEqual(set(paths), {"docs/old.md", "services/core/deleted.go", "apps/web/renamed\nwith space.ts"})
                 plan = ci.event_plan("pull_request", {"pull_request": {"base": {"sha": base}, "head": {"sha": head}}})
-                self.assertEqual(set(plan["jobs"]), {"hygiene", "backend", "api", "web", "web-acceptance", "website"})
+                self.assertEqual(set(plan["jobs"]), {"hygiene", "backend", "api", "compose", "web", "web-acceptance", "website"})
                 (clone / "old.md").write_text("untracked content cannot change the diff\n")
                 self.assertEqual(paths, ci.changed_paths(base, "HEAD"))
             finally:
diff --git a/scripts/compose-smoke.py b/scripts/compose-smoke.py
index e27830c3e..f7e806ace 100644
--- a/scripts/compose-smoke.py
+++ b/scripts/compose-smoke.py
@@ -1,8 +1,14 @@
 #!/usr/bin/env python3
-"""Exercise the published Compose installation in an isolated Docker project."""
+"""Exercise the Compose installation in an isolated Docker project.
+
+Core, Web and the gateway image are built from this checkout. Web serves a
+placeholder page instead of the console build. Node metadata comes from the
+release pinned in deploy/compose/smoke-pins.json.
+"""
 
 import hashlib
 import http.cookiejar
+import importlib.util
 import json
 import os
 from pathlib import Path
@@ -14,8 +20,50 @@
 import urllib.request
 import uuid
 
-
 ROOT = Path(__file__).resolve().parents[1]
+render_spec = importlib.util.spec_from_file_location("render_compose", ROOT / "scripts/render-compose.py")
+render_compose = importlib.util.module_from_spec(render_spec)
+render_spec.loader.exec_module(render_compose)
+
+
+def build_images(directory, tag):
+    revision = subprocess.check_output(['git', 'rev-parse', 'HEAD'], cwd=ROOT, text=True).strip()
+    protocol = re.search(r'const Version = "([^"]+)"', (ROOT / 'internal/agentdaemon/proto/version.go').read_text()).group(1)
+    go_env = {**os.environ, 'CGO_ENABLED': '0', 'GOOS': 'linux', 'GOARCH': 'amd64'}
+
+    def go_build(package, output):
+        output.parent.mkdir(parents=True, exist_ok=True)
+        subprocess.run(['go', 'build', '-trimpath', '-ldflags', '-X main.buildRevision=' + revision,
+                        '-o', str(output), './' + package], cwd=ROOT, env=go_env, check=True)
+
+    contexts = {name: directory / ('image-' + name) for name in ('core', 'web', 'ingress')}
+    core = contexts['core']
+    for name, package in (('oac-core', 'server'), ('oac-core-device', 'device'),
+                          ('oac-core-environment-key', 'environment-key'), ('oac', 'oac')):
+        go_build('services/core/cmd/' + package, core / 'bin' / name)
+    (core / 'e2b').mkdir()
+    (core / 'native-installers').mkdir()
+    (core / 'native-installers/catalog.json').write_text(json.dumps({
+        'version': revision, 'protocol_version': protocol, 'artifacts': {'linux-amd64': {
+            'sha256': '0' * 64,
+            'url': f'https://example.invalid/oac-native-{revision}-linux-amd64.tar.gz'}}}))
+    (core / 'Dockerfile').write_bytes((ROOT / 'deploy/distribution/Dockerfile').read_bytes())
+    web = contexts['web']
+    go_build('services/web', web / 'oac-web')
+    (web / 'dist').mkdir()
+    (web / 'dist/index.html').write_text('<!doctype html><html><body>Compose smoke</body></html>\n')
+    (web / 'Dockerfile').write_bytes((ROOT / 'services/web/Dockerfile').read_bytes())
+    ingress = contexts['ingress']
+    go_build('services/core/cmd/oac', ingress / 'oac')
+    (ingress / 'Dockerfile').write_bytes((ROOT / 'deploy/distribution/Ingress.Dockerfile').read_bytes())
+    for path in directory.glob('image-*/**/*'):
+        path.chmod(0o755 if path.is_dir() or os.access(path, os.X_OK) else 0o644)
+    images = {}
+    for name, context in contexts.items():
+        images[name] = f'oac-smoke/{name}:{tag}'
+        subprocess.run(['docker', 'build', '-q', '--platform', 'linux/amd64', '-t', images[name], str(context)],
+                       check=True, stdout=subprocess.DEVNULL)
+    return images
 
 
 def main():
@@ -26,18 +74,28 @@ def main():
     artifacts = Path.home() / '.oac/tests'
     artifacts.mkdir(parents=True, exist_ok=True)
     directory = Path(tempfile.mkdtemp(prefix=project + '-', dir=artifacts))
+    data = directory / 'data'
+    data.mkdir(mode=0o700)
+    pins = json.loads((ROOT / 'deploy/compose/smoke-pins.json').read_text())
+    rendered = directory / 'compose.yaml'
+    rendered.write_text(render_compose.render({
+        'REVISION': pins['revision'], 'RELEASE_BASE': pins['release_base'],
+        'ARCHIVE_CHECKSUM': pins['archive_checksum'],
+    }))
     override = directory / 'ports.json'
+    images = build_images(directory, project.removeprefix('oac-smoke-'))
 
     def publish(port):
-        override.write_text(json.dumps({'services': {'gateway': {'ports': [
+        override.write_text(json.dumps({'services': {'web': {'ports': [
             {'target': 8080, 'published': str(port), 'host_ip': '127.0.0.1'},
         ]}}}))
 
     publish(0)
-    env = {**os.environ, 'COMPOSE_PROGRESS': 'plain'}
+    env = {**os.environ, 'COMPOSE_PROGRESS': 'plain', 'OAC_DATA_DIR': str(data),
+           **{'OAC_IMAGE_' + name.upper(): image for name, image in images.items()}}
     env.pop('OAC_PUBLIC_URL', None)
     command = ['docker', 'compose', '--env-file', os.devnull, '-p', project,
-               '-f', str(ROOT / 'deploy/compose/compose.yaml'), '-f', str(override)]
+               '-f', str(rendered), '-f', str(override)]
 
     def compose(*args, timeout=120):
         result = subprocess.run(command + list(args), env=env, cwd=ROOT, capture_output=True, timeout=timeout)
@@ -85,10 +143,10 @@ def terminate(_signum, _frame):
 
     signal.signal(signal.SIGTERM, terminate)
     try:
-        print('Starting published images with an unset public URL and empty volumes', flush=True)
+        print('Starting the images with an unset public URL and an empty data directory', flush=True)
         compose('up', '-d', '--wait', '--wait-timeout', '600', timeout=900)
-        address = 'http://' + compose('port', 'gateway', '8080').decode().strip()
-        key = compose('run', '--rm', '-T', '--no-deps', 'credentials').decode().strip()
+        address = 'http://' + compose('port', 'web', '8080').decode().strip()
+        key = compose('exec', '-T', 'web', '/usr/local/bin/oac-web', 'core-key').decode().strip()
         assert len(key) == 64, 'Missing generated sign-in key'
         request('/healthz')
         assert b'<html' in request('/'), 'Console HTML is unavailable'
@@ -114,7 +172,7 @@ def terminate(_signum, _frame):
         assert uploaded['bytes'] == len(content), 'Upload was truncated'
         private_logs(key, project_key)
 
-        print('Configuring a reachable URL and recreating containers with the same volumes', flush=True)
+        print('Configuring a reachable URL and recreating containers with the same data directory', flush=True)
         # Retain the assigned port across recreation, without claiming a fixed host port.
         publish(address.rsplit(':', 1)[1])
         env['OAC_PUBLIC_URL'] = address
@@ -122,7 +180,7 @@ def terminate(_signum, _frame):
         compose('up', '-d', '--wait', '--wait-timeout', '120', timeout=180)
         origin = address
         browser = client()
-        assert compose('run', '--rm', '-T', '--no-deps', 'credentials').decode().strip() == key, 'Sign-in key changed'
+        assert compose('exec', '-T', 'web', '/usr/local/bin/oac-web', 'core-key').decode().strip() == key, 'Sign-in key changed'
         request('/', headers={'Host': 'localhost:8080'}, status=403)
         request('/console/auth/login', {'core_key': key})
         updated = get('/core/v1/installation')
@@ -139,6 +197,7 @@ def terminate(_signum, _frame):
         raise
     finally:
         compose('down', '--volumes', '--remove-orphans', timeout=60)
+        subprocess.run(['docker', 'image', 'rm', '-f', *images.values()], capture_output=True, timeout=60)
 
 
 if __name__ == '__main__':
diff --git a/scripts/config-reference.py b/scripts/config-reference.py
deleted file mode 100755
index c8cd5489c..000000000
--- a/scripts/config-reference.py
+++ /dev/null
@@ -1,113 +0,0 @@
-#!/usr/bin/env python3
-"""Render the config.json reference table in docs/configuration.md from its schema.
-
-Usage: scripts/config-reference.py [--check]
---check fails when the table differs from deploy/install/config.schema.json.
-"""
-import json
-import pathlib
-import sys
-
-REPOSITORY = pathlib.Path(__file__).resolve().parent.parent
-sys.path.insert(0, str(REPOSITORY / "deploy/install"))
-import config_model  # noqa: E402
-
-DOCUMENT = REPOSITORY / "docs/configuration.md"
-BEGIN = "[//]: # (BEGIN config-reference: generated by scripts/config-reference.py from deploy/install/config.schema.json)"
-END = "[//]: # (END config-reference)"
-CHECKS = {"listen_host": "IPv4 or IPv6 address", "origin": "canonical origin; HTTP only on loopback", "https_origin": "canonical HTTPS origin",
-          "go_duration": "Go duration", "go_duration_min_1h": "Go duration, at least `1h`"}
-
-
-def code(value):
-    return "`" + json.dumps(value, ensure_ascii=False) + "`" if not isinstance(value, str) else f'`"{value}"`'
-
-
-def kind(node):
-    if "const" in node:
-        return code(node["const"])
-    if "enum" in node:
-        return " \\| ".join(code(item) for item in node["enum"])
-    types = node.get("type", [])
-    types = [types] if isinstance(types, str) else list(types)
-    names = []
-    for name in types:
-        if name == "array":
-            names.append("array of " + kind(node.get("items", {})))
-        elif name == "object" and isinstance(node.get("additionalProperties"), dict):
-            names.append("object of " + kind(node["additionalProperties"]) + " values")
-        else:
-            names.append(name)
-    text = " or ".join(names)
-    if "minimum" in node and "maximum" in node:
-        text += f' {node["minimum"]}–{node["maximum"]}'
-    elif "minimum" in node:
-        text += f' ≥ {node["minimum"]}'
-    check = config_model.annotation(node, "check")
-    if check:
-        text += f" ({CHECKS[check]})"
-    return text
-
-
-def rows(node=None, prefix=""):
-    """Leaves, plus nullable objects such as core.runtime_history, in schema order."""
-    node = config_model.SCHEMA if node is None else node
-    for name, child in node["properties"].items():
-        if "properties" not in child or "default" in child:
-            yield prefix + name, child
-        if "properties" in child:
-            yield from rows(child, prefix + name + ".")
-
-
-def table():
-    lines = ["| Key | Type | Default | Change | Restarts | Meaning |",
-             "| --- | --- | --- | --- | --- | --- |"]
-    for key, node in rows():
-        annotation = lambda name, default=None: config_model.annotation(node, name, default)
-        default = code(node["default"]) if "default" in node else "none"
-        change = ("fixed" if not annotation("changeable", True)
-                  else "`oac apply`" if annotation("setting", True) else "any time")
-        restarts = ", ".join(annotation("restarts", [])) or "none"
-        meaning = node.get("description", "")
-        if annotation("sensitive"):
-            meaning += " Sensitive."
-        lines.append(f"| `{key}` | {kind(node)} | {default} | {change} | {restarts} | {meaning.strip()} |")
-    return "\n".join(lines)
-
-
-def install_flags():
-    lines = ["| Flag | config.json field |", "| --- | --- |"]
-    for key, node in rows():
-        flag = config_model.annotation(node, "install_flag")
-        if flag:
-            flags = " or ".join(f"`{value}`" for value in flag.split(" or "))
-            lines.append(f"| {flags} | `{key}` |")
-    return "\n".join(lines)
-
-
-def render_document(document, begin, end, body, check):
-    text = document.read_text()
-    before, found, rest = text.partition(begin + "\n")
-    _, found_end, after = rest.partition(end)
-    if not found or not found_end:
-        sys.exit(f"{document} lacks generated reference markers")
-    rendered = before + begin + "\n" + body + "\n" + end + after
-    if check:
-        if rendered != text:
-            sys.exit(f"{document.relative_to(REPOSITORY)} is out of date; run scripts/config-reference.py")
-        return
-    document.write_text(rendered)
-
-
-def main(argv):
-    if argv not in ([], ["--check"]):
-        sys.exit(__doc__.strip())
-    check = bool(argv)
-    render_document(DOCUMENT, BEGIN, END, table(), check)
-    render_document(REPOSITORY / "docs/getting-started/install-options.md",
-                    "[//]: # (BEGIN install-flags: generated by scripts/config-reference.py)",
-                    "[//]: # (END install-flags)", install_flags(), check)
-
-
-if __name__ == "__main__":
-    main(sys.argv[1:])
diff --git a/scripts/core-distribution-manifest.py b/scripts/core-distribution-manifest.py
index 2df6279ab..df051806d 100644
--- a/scripts/core-distribution-manifest.py
+++ b/scripts/core-distribution-manifest.py
@@ -19,7 +19,7 @@
 
 RUNTIME_ARCHIVE_SHA256 = "47c223e3ef5298abf05f47ed9f87981106e400d99bb3f1d042d4d6881346b18b"
 DIGEST = re.compile(r"sha256:[0-9a-f]{64}\Z")
-sys.path.insert(0, str(pathlib.Path(__file__).resolve().parents[1] / "deploy/install"))
+sys.path.insert(0, str(pathlib.Path(__file__).resolve().parents[1] / "deploy/node"))
 import provider_assets
 
 ARTIFACTS = {item["path"]: item["suffix"] for items in provider_assets.CATALOG.values() for item in items}
@@ -291,11 +291,6 @@ def package_artifacts(bundle, stage, revision):
     return result
 
 
-# The installation's management command; it runs without the bundle directory.
-OAC_CLI_MODULES = ("oac_cli.py", "config_model.py", "config.schema.json", "configuration.py",
-                  "distribution.py", "node_spec.py", "ingress.py", "ingress_config.py")
-
-
 def bootstraps(bundle, epoch, revision):
     if not re.fullmatch(r"[0-9a-f]{40}", revision):
         raise ValueError("Invalid operator source revision")
@@ -308,13 +303,6 @@ def bootstraps(bundle, epoch, revision):
             shutil.copyfile(bundle / original, target)
             os.utime(target, (int(epoch), int(epoch)))
         zipapp.create_archive(directory, bundle / "node-install.pyz", compressed=True)
-    with tempfile.TemporaryDirectory(dir=bundle.parent) as directory:
-        for name in OAC_CLI_MODULES:
-            shutil.copyfile(bundle / name, pathlib.Path(directory) / name)
-        (pathlib.Path(directory) / "__main__.py").write_text(f"import oac_cli\n\noac_cli.SOURCE_COMMIT = {revision!r}\noac_cli.entry()\n")
-        for path in pathlib.Path(directory).iterdir():
-            os.utime(path, (int(epoch), int(epoch)))
-        zipapp.create_archive(directory, bundle / "oac.pyz", interpreter="/usr/bin/env python3", compressed=True)
 
 
 def manifest(bundle, stage, revision, source_tree, artifact_base_url="", offline="0"):
diff --git a/scripts/core-distribution-manifest.test.py b/scripts/core-distribution-manifest.test.py
index 587211dca..8c6576a20 100644
--- a/scripts/core-distribution-manifest.test.py
+++ b/scripts/core-distribution-manifest.test.py
@@ -277,16 +277,13 @@ def test_release_location_and_explicit_offline_requirements(self):
         self.assertEqual(json.loads((self.bundle / "manifest.json").read_text())["artifact_base_url"], "")
 
     def test_bootstraps_include_shared_downloader_and_are_reproducible(self):
-        for name in ("node_install.py", "node_generations.py", "install_display.py", "node_output.py", "provider_assets.py", *distribution.OAC_CLI_MODULES):
+        for name in ("node_install.py", "node_generations.py", "install_display.py", "node_output.py", "provider_assets.py", "distribution.py", "node_spec.py"):
             (self.bundle / name).write_text("# " + name + "\n")
         distribution.bootstraps(self.bundle, "1700000000", "a" * 40)
-        first = [(self.bundle / name).read_bytes() for name in ("node-install.pyz", "oac.pyz")]
+        first = (self.bundle / "node-install.pyz").read_bytes()
         distribution.bootstraps(self.bundle, "1700000000", "a" * 40)
-        self.assertEqual(first, [(self.bundle / name).read_bytes() for name in ("node-install.pyz", "oac.pyz")])
-        self.assertTrue(first[1].startswith(b"#!/usr/bin/env python3\n"))
-        with zipfile.ZipFile(self.bundle / "oac.pyz") as contents:
-            self.assertEqual(set(contents.namelist()), {"__main__.py", *distribution.OAC_CLI_MODULES})
-            self.assertIn(("oac_cli.SOURCE_COMMIT = " + repr("a" * 40)).encode(), contents.read("__main__.py"))
+        self.assertEqual(first, (self.bundle / "node-install.pyz").read_bytes())
+        self.assertFalse((self.bundle / "oac.pyz").exists())
         with zipfile.ZipFile(self.bundle / "node-install.pyz") as contents:
             self.assertEqual(set(contents.namelist()), {"__main__.py", "node_spec.py", "distribution.py", "node_generations.py", "install_display.py", "node_output.py", "provider_assets.py"})
             self.assertEqual(contents.read("__main__.py"), (self.bundle / "node_install.py").read_bytes())
diff --git a/scripts/generate-harness-catalog.py b/scripts/generate-harness-catalog.py
index b6a1759bc..af3d2091d 100644
--- a/scripts/generate-harness-catalog.py
+++ b/scripts/generate-harness-catalog.py
@@ -41,19 +41,6 @@ def go(source):
                           check=True, capture_output=True).stdout
 
 
-def check_installer_schema(entries, schema):
-    """Process defaults remain authored in the schema; membership is catalog-owned."""
-    kinds = [entry["kind"] for entry in entries]
-    core = schema["properties"]["core"]["properties"]
-    enabled, default = core["harnesses"], core["default_harness"]
-    if enabled["items"]["enum"] != kinds or default["enum"] != kinds:
-        raise ValueError("Installer Harness enums must match internal/harnessconfig/builtin/catalog.json")
-    if (not enabled["default"] or len(set(enabled["default"])) != len(enabled["default"])
-            or not set(enabled["default"]) <= set(kinds)
-            or default["default"] not in enabled["default"]):
-        raise ValueError("Installer Harness defaults must select registered, enabled Harnesses")
-
-
 def render_installer(providers):
     return ("# Code generated by scripts/generate-harness-catalog.py; DO NOT EDIT.\n"
             "# Provider support comes from the adapter-owned Go configuration declarations.\n"
@@ -146,7 +133,6 @@ def main():
     parser.add_argument("--check", action="store_true")
     args = parser.parse_args()
     entries = load_catalog(ROOT / CATALOG)
-    check_installer_schema(entries, json.loads((ROOT / "deploy/install/config.schema.json").read_text()))
     stale = []
 
     def projection(relative, content):
@@ -165,7 +151,7 @@ def projection(relative, content):
         raise SystemExit("Stale Harness catalog projections; run make generate-harness-catalog:\n" + "\n".join(stale))
     providers = json.loads(subprocess.run(["go", "run", "./scripts/harness-catalog"], cwd=ROOT,
                                          text=True, check=True, capture_output=True).stdout)
-    projection(Path("deploy/install/harness_catalog.py"), render_installer(providers))
+    projection(Path("scripts/acceptance/harness_catalog.py"), render_installer(providers))
     if stale:
         raise SystemExit("Stale Harness catalog projections; run make generate-harness-catalog:\n" + "\n".join(stale))
 
diff --git a/scripts/generate-harness-catalog.test.py b/scripts/generate-harness-catalog.test.py
index 88d8ddc06..f58e5e079 100644
--- a/scripts/generate-harness-catalog.test.py
+++ b/scripts/generate-harness-catalog.test.py
@@ -22,27 +22,6 @@ def module(name, file):
 
 
 class HarnessCatalogTests(unittest.TestCase):
-    def test_installer_schema_membership_and_defaults(self):
-        entries = catalog.load_catalog(catalog.ROOT / catalog.CATALOG)
-        document = json.loads((catalog.ROOT / "deploy/install/config.schema.json").read_text())
-        catalog.check_installer_schema(entries, document)
-        for key, field, value in (
-            ("harnesses", "items", {"enum": ["unknown"]}),
-            ("default_harness", "enum", ["unknown"]),
-            ("harnesses", "default", ["unknown"]),
-            ("harnesses", "default", []),
-            ("harnesses", "default", ["codex", "codex"]),
-            ("harnesses", "default", ["claude_sdk"]),
-            ("default_harness", "default", "unknown"),
-        ):
-            changed = copy.deepcopy(document)
-            changed["properties"]["core"]["properties"][key][field] = value
-            with self.subTest(key=key, field=field, value=value), self.assertRaises(ValueError):
-                catalog.check_installer_schema(entries, changed)
-        extended = [*entries, {"kind": "additional"}]
-        with self.assertRaises(ValueError):
-            catalog.check_installer_schema(extended, document)
-
     def test_installer_projection_includes_every_declaration(self):
         providers = {"additional": {"responses": {"requires_token_limits": True},
                                     "anthropic": {"requires_token_limits": False}}, "native": {}}
diff --git a/scripts/install-release.test.py b/scripts/install-release.test.py
deleted file mode 100644
index 227e32368..000000000
--- a/scripts/install-release.test.py
+++ /dev/null
@@ -1,432 +0,0 @@
-"""Public release bootstrap tests; fixtures never start Docker or a real installer."""
-import contextlib
-import errno
-import signal
-import shlex
-import sys
-import hashlib
-import http.client
-import io
-import json
-import os
-import stat
-import pathlib
-import subprocess
-import tarfile
-import tempfile
-import types
-import unittest
-from unittest import mock
-
-SCRIPT = pathlib.Path(__file__).parents[1] / "deploy/install-release.sh"
-bootstrap = types.ModuleType("bootstrap")
-exec(compile(SCRIPT.read_text().split("3<<'PY'\n", 1)[1].rsplit("\nPY", 1)[0],
-             str(SCRIPT), "exec"), bootstrap.__dict__)
-
-
-class BootstrapTests(unittest.TestCase):
-    def setUp(self):
-        temporary_root = pathlib.Path.home() / ".oac/tests/release"
-        temporary_root.mkdir(parents=True, exist_ok=True)
-        self.temp = tempfile.TemporaryDirectory(dir=temporary_root)
-        self.addCleanup(self.temp.cleanup)
-        self.root = pathlib.Path(self.temp.name)
-        self.sha = "a" * 40
-        self.stem = "oac-" + self.sha + "-linux-amd64"
-        self.name = self.stem + ".tar.gz"
-        self.metadata = {"tag_name": "v1.2.3", "draft": False, "prerelease": False,
-                         "assets": [{"id": 7, "name": self.name},
-                                    {"id": 8, "name": self.name + ".sha256"}]}
-        self.archive = self.make_archive({
-            "install.sh": b"#!/bin/sh\nexit 0\n",
-            "manifest.json": json.dumps({"source_commit": self.sha}).encode()})
-        self.metadata["assets"][0]["size"] = len(self.archive)
-        self.metadata["assets"][1]["size"] = 67 + len(self.name)
-        stack = contextlib.ExitStack()
-        self.addCleanup(stack.close)
-        self.http = stack.enter_context(mock.patch.object(bootstrap, "open_url", side_effect=self.response))
-        stack.enter_context(mock.patch.object(bootstrap.pathlib.Path, "home", return_value=self.root))
-        stack.enter_context(mock.patch.object(bootstrap.platform, "system", return_value="Linux"))
-        stack.enter_context(mock.patch.object(bootstrap.platform, "machine", return_value="x86_64"))
-        stack.enter_context(mock.patch.object(bootstrap.time, "sleep"))
-        # The downloader waits for the installer before retaining its verified bundle.
-        self.invoke = stack.enter_context(mock.patch.object(bootstrap, "run_installer"))
-
-    def make_archive(self, files):
-        data = io.BytesIO()
-        with tarfile.open(fileobj=data, mode="w:gz") as archive:
-            for name, content in files.items():
-                member = tarfile.TarInfo(self.stem + "/" + name)
-                member.mode, member.size = 0o755, len(content)
-                archive.addfile(member, io.BytesIO(content))
-        return data.getvalue()
-
-    def response(self, url, binary=False, offset=0):
-        if url.endswith("/releases/latest") or "/releases/tags/" in url:
-            return io.BytesIO(json.dumps(self.metadata).encode())
-        if url.endswith("/assets/7"):
-            return io.BytesIO(self.archive)
-        if url.endswith("/assets/8"):
-            return io.BytesIO((hashlib.sha256(self.archive).hexdigest() + "  " + self.name + "\n").encode())
-        raise AssertionError("Unexpected URL: " + url)
-
-    def test_default_latest_is_resolved_once_and_installer_arguments_forwarded(self):
-        bootstrap.main(["--host", "127.0.0.1", "--web-port", "8088", "--public-url", "https://core.example"])
-        urls = [c.args[0] for c in self.http.call_args_list]
-        self.assertEqual(sum(url.endswith("/releases/latest") for url in urls), 1)
-        self.assertTrue(urls[1].endswith("/assets/8"))
-        self.assertTrue(urls[2].endswith("/assets/7"))
-        root, arguments, lock = self.invoke.call_args.args
-        self.assertEqual(arguments, ["--host", "127.0.0.1", "--web-port", "8088", "--public-url", "https://core.example"])
-        self.assertEqual(len(list((self.root / ".oac/releases").glob("release-*/" + self.stem + "/install.sh"))), 1)
-        self.assertFalse(list((self.root / ".oac/releases").glob(".download-*")))
-
-    def test_control_plane_bundle_selected_without_execution_assets(self):
-        for index, suffix in enumerate(("-offline.tar.gz", "-runtime.tar.gz", "-daemon", "-sandbox-node"), 20):
-            self.metadata["assets"].append({"id": index, "name": self.stem + suffix})
-        bootstrap.main([])
-        urls = [call.args[0] for call in self.http.call_args_list]
-        self.assertEqual(len(urls), 3)
-        self.assertTrue(urls[-1].endswith("/assets/7"))
-        self.assertFalse((self.invoke.call_args.args[0] / "artifacts").exists())
-
-    def test_offline_only_release_is_not_silently_downloaded(self):
-        self.metadata["assets"][0]["name"] = self.stem + "-offline.tar.gz"
-        with self.assertRaisesRegex(bootstrap.ReleaseError, "control-plane bundle"):
-            bootstrap.main([])
-        self.assertEqual(len(self.http.call_args_list), 1)
-        self.invoke.assert_not_called()
-
-    def test_selected_prerelease_is_allowed(self):
-        self.metadata.update(tag_name="v2.0.0-rc.1", prerelease=True)
-        bootstrap.main(["--version", "v2.0.0-rc.1", "--web-port", "18080"])
-        self.assertTrue(self.http.call_args_list[0].args[0].endswith("/releases/tags/v2.0.0-rc.1"))
-        self.assertEqual(self.invoke.call_args.args[1], ["--web-port", "18080"])
-
-    def test_latest_never_selects_prerelease_or_draft(self):
-        for key in ("prerelease", "draft"):
-            with self.subTest(key=key):
-                self.metadata[key] = True
-                with self.assertRaises(bootstrap.ReleaseError):
-                    bootstrap.main([])
-                self.metadata[key] = False
-        self.invoke.assert_not_called()
-
-    def test_missing_or_duplicate_asset_is_refused(self):
-        self.metadata["assets"].append(dict(self.metadata["assets"][0]))
-        with self.assertRaisesRegex(bootstrap.ReleaseError, "exactly one"):
-            bootstrap.main([])
-        self.metadata["assets"] = self.metadata["assets"][:1]
-        with self.assertRaisesRegex(bootstrap.ReleaseError, "checksum"):
-            bootstrap.main([])
-        self.invoke.assert_not_called()
-
-    def test_checksum_failure_never_executes_and_removes_only_own_download(self):
-        existing = self.root / ".oac/releases/existing"
-        existing.mkdir(parents=True)
-        existing.parent.chmod(0o700)
-        (existing / "data").write_text("keep")
-        def response(url, binary=False, offset=0):
-            if url.endswith("/assets/8"):
-                return io.BytesIO(("b" * 64 + "  " + self.name + "\n").encode())
-            return self.response(url, binary)
-        self.http.side_effect = response
-        with self.assertRaisesRegex(bootstrap.ReleaseError, "checksum mismatch"):
-            bootstrap.main([])
-        self.invoke.assert_not_called()
-        self.assertEqual(set(path.name for path in existing.parent.iterdir()), {"existing", ".download.lock"})
-        self.assertEqual((existing / "data").read_text(), "keep")
-
-    def test_archive_source_mismatch_is_refused(self):
-        self.archive = self.make_archive({"install.sh": b"exit 0", "manifest.json": b'{"source_commit":"wrong"}'})
-        self.metadata["assets"][0]["size"] = len(self.archive)
-        with self.assertRaisesRegex(bootstrap.ReleaseError, "source"):
-            bootstrap.main([])
-        self.invoke.assert_not_called()
-
-    def test_unsafe_tar_paths_and_links_are_rejected(self):
-        for name, kind in (("../escape", tarfile.REGTYPE), ("/tmp/escape", tarfile.REGTYPE),
-                           (self.stem + "/link", tarfile.SYMTYPE),
-                           (self.stem + "/hard", tarfile.LNKTYPE)):
-            with self.subTest(name=name):
-                path = self.root / "unsafe.tar.gz"
-                with tarfile.open(path, "w:gz") as archive:
-                    member = tarfile.TarInfo(name)
-                    member.type, member.linkname = kind, "/tmp/escape"
-                    archive.addfile(member, io.BytesIO())
-                with self.assertRaisesRegex(bootstrap.ReleaseError, "unsafe"):
-                    bootstrap.extract(path, self.root, self.stem)
-
-    def test_duplicate_paths_are_rejected(self):
-        path = self.root / "duplicate.tar.gz"
-        with tarfile.open(path, "w:gz") as archive:
-            for _ in range(2):
-                archive.addfile(tarfile.TarInfo(self.stem + "/same"), io.BytesIO())
-        with self.assertRaisesRegex(bootstrap.ReleaseError, "duplicate"):
-            bootstrap.extract(path, self.root, self.stem)
-
-    def test_unsupported_platform_does_not_download(self):
-        with mock.patch.object(bootstrap.platform, "system", return_value="Darwin"):
-            with self.assertRaisesRegex(bootstrap.ReleaseError, "Linux amd64"):
-                bootstrap.main([])
-        self.http.assert_not_called()
-
-    def test_root_uses_the_same_verified_installation_path(self):
-        with mock.patch.object(bootstrap.os, "geteuid", return_value=0):
-            bootstrap.main(["--web-port", "18080"])
-        root, arguments, lock = self.invoke.call_args.args
-        self.assertEqual(arguments, ["--web-port", "18080"])
-        self.assertTrue(root.is_relative_to(self.root / ".oac/releases"))
-        self.assertEqual(len(list((self.root / ".oac/releases").glob("release-*/" + self.stem + "/install.sh"))), 1)
-
-    def test_new_private_directories_do_not_inherit_public_umask(self):
-        previous = os.umask(0o022)
-        try:
-            bootstrap.main([])
-        finally:
-            os.umask(previous)
-        for path in (self.root / ".oac", self.root / ".oac/releases"):
-            self.assertEqual(stat.S_IMODE(path.stat().st_mode), 0o700)
-
-    def test_shell_entrypoint_help_needs_no_network(self):
-        result = subprocess.run(["bash", str(SCRIPT), "--help"], capture_output=True, text=True)
-        self.assertEqual(result.returncode, 0)
-        self.assertIn("--version", result.stdout)
-        self.assertIn("latest stable release", result.stdout)
-
-    def test_short_download_resumes_only_the_selected_asset(self):
-        calls = []
-        def response(url, binary=False, offset=0):
-            if url.endswith("/assets/7"):
-                calls.append(offset)
-                result = io.BytesIO(self.archive[:20] if not offset else self.archive[offset:])
-                if offset:
-                    result.status = 206
-                    result.headers = {"Content-Range": f"bytes {offset}-{len(self.archive) - 1}/{len(self.archive)}"}
-                return result
-            return self.response(url, binary, offset)
-        self.http.side_effect = response
-        bootstrap.main([])
-        self.assertEqual(calls, [0, 20])
-        self.invoke.assert_called_once()
-
-    def test_range_ignored_restarts_instead_of_appending(self):
-        attempts = []
-        def response(url, binary=False, offset=0):
-            if url.endswith("/assets/7"):
-                attempts.append(offset)
-                return io.BytesIO(self.archive[:20] if len(attempts) == 1 else self.archive)
-            return self.response(url, binary, offset)
-        self.http.side_effect = response
-        bootstrap.main([])
-        self.assertEqual(attempts, [0, 20])
-        self.invoke.assert_called_once()
-
-    def test_network_failure_is_bounded_and_cleans_staging(self):
-        for failure in (bootstrap.TransferError("network"), TimeoutError(), ConnectionResetError()):
-            with self.subTest(failure=failure):
-                self.http.reset_mock()
-                self.http.side_effect = failure
-                with self.assertRaisesRegex(bootstrap.ReleaseError, "3 attempts"):
-                    bootstrap.main([])
-                self.assertEqual(self.http.call_count, 3)
-                self.assertFalse((self.root / ".oac/releases/.download").exists())
-        self.invoke.assert_not_called()
-
-    def test_truncated_http_metadata_is_retried_before_parsing(self):
-        class Socket:
-            def makefile(self, mode):
-                return io.BytesIO(b'HTTP/1.1 200 OK\r\nContent-Length: 100\r\n\r\n{"tag_name":')
-        partial = http.client.HTTPResponse(Socket())
-        partial.begin()
-        self.http.side_effect = [partial, self.response(bootstrap.API + "/releases/latest"),
-                                 self.response(bootstrap.API + "/releases/assets/8"),
-                                 self.response(bootstrap.API + "/releases/assets/7")]
-        bootstrap.main([])
-        self.assertEqual(sum(call.args[0].endswith("/releases/latest") for call in self.http.call_args_list), 2)
-        self.invoke.assert_called_once()
-
-    def test_malformed_metadata_and_asset_sizes_fail_without_execution(self):
-        for metadata in ([], {}, {**self.metadata, "assets": [None]},
-                         {**self.metadata, "assets": [{**self.metadata["assets"][0], "size": -1},
-                                                       self.metadata["assets"][1]]}):
-            with self.subTest(metadata=metadata):
-                self.http.side_effect = lambda *a, **kw: io.BytesIO(json.dumps(metadata).encode())
-                with self.assertRaises(bootstrap.ReleaseError):
-                    bootstrap.main([])
-                self.assertFalse((self.root / ".oac/releases/.download").exists())
-        self.invoke.assert_not_called()
-
-    def test_space_check_and_write_failure_remove_partial_downloads(self):
-        with mock.patch.object(bootstrap.shutil, "disk_usage", return_value=types.SimpleNamespace(free=0)):
-            with self.assertRaisesRegex(bootstrap.ReleaseError, "disk space"):
-                bootstrap.main([])
-        for failure in (OSError(errno.ENOSPC, "disk full"), OSError(errno.EDQUOT, "quota")):
-            with mock.patch.object(bootstrap, "extract", side_effect=failure):
-                with self.assertRaises(OSError):
-                    bootstrap.main([])
-        self.assertEqual([p.name for p in (self.root / ".oac/releases").iterdir()], [".download.lock"])
-        self.invoke.assert_not_called()
-
-    def test_extraction_checks_uncompressed_space(self):
-        archive = self.root / "archive.tar.gz"
-        archive.write_bytes(self.archive)
-        with mock.patch.object(bootstrap.shutil, "disk_usage", return_value=types.SimpleNamespace(free=0)):
-            with self.assertRaisesRegex(bootstrap.ReleaseError, "disk space"):
-                bootstrap.extract(archive, self.root, self.stem)
-        self.assertFalse((self.root / self.stem).exists())
-
-    def test_handoff_failure_removes_extracted_bundle(self):
-        self.invoke.side_effect = FileNotFoundError("bash")
-        with self.assertRaises(FileNotFoundError):
-            bootstrap.main([])
-        self.assertEqual([p.name for p in (self.root / ".oac/releases").iterdir()], [".download.lock"])
-
-    def test_stale_download_is_removed_even_when_network_is_unavailable(self):
-        stale = self.root / ".oac/releases/.download"
-        stale.mkdir(parents=True, mode=0o700)
-        stale.parent.chmod(0o700)
-        (stale / "partial").write_text("discard")
-        outside = self.root / "user-data"
-        outside.write_text("keep")
-        (stale / "link").symlink_to(outside)
-        self.http.side_effect = bootstrap.TransferError("network")
-        with self.assertRaises(bootstrap.ReleaseError):
-            bootstrap.main([])
-        self.assertFalse(stale.exists())
-        self.assertEqual(outside.read_text(), "keep")
-
-    def test_concurrent_download_does_not_remove_active_staging(self):
-        cache = self.root / ".oac/releases"
-        cache.mkdir(parents=True, mode=0o700)
-        with bootstrap.staging(cache) as (active, lock):
-            (active / "partial").write_text("keep")
-            with self.assertRaisesRegex(bootstrap.ReleaseError, "Another release download"):
-                bootstrap.main([])
-            self.assertEqual((active / "partial").read_text(), "keep")
-        self.http.assert_not_called()
-
-    def test_staging_symlink_is_refused_without_touching_target(self):
-        cache = self.root / ".oac/releases"
-        cache.mkdir(parents=True, mode=0o700)
-        outside = self.root / "user-data"
-        outside.mkdir()
-        (outside / "keep").write_text("keep")
-        (cache / ".download").symlink_to(outside, target_is_directory=True)
-        with self.assertRaisesRegex(bootstrap.ReleaseError, "staging directory"):
-            bootstrap.main([])
-        self.assertEqual((outside / "keep").read_text(), "keep")
-
-    def test_signal_during_download_cleans_before_exit(self):
-        source = SCRIPT.read_text().split("3<<'PY'\n", 1)[1].rsplit("\nPY", 1)[0]
-        fixture = '''
-        platform.system = lambda: "Linux"
-        platform.machine = lambda: "x86_64"
-        def blocked(version):
-            print("READY", flush=True)
-            time.sleep(30)
-        select_release = blocked
-        main([])'''
-        source = source.replace("        main(sys.argv[1:])", fixture)
-        for number in (signal.SIGINT, signal.SIGTERM, signal.SIGHUP):
-            with self.subTest(signal=number):
-                process = subprocess.Popen([__import__("sys").executable, "-c", source],
-                                           env={**os.environ, "HOME": str(self.root)},
-                                           stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
-                try:
-                    for line in process.stdout:
-                        if line.strip() == "READY":
-                            break
-                    else:
-                        self.fail("Downloader did not reach the signal fixture")
-                    process.send_signal(number)
-                    _, error = process.communicate(timeout=5)
-                    self.assertEqual(process.returncode, 130, error)
-                    self.assertNotIn("Traceback", error)
-                    self.assertFalse((self.root / ".oac/releases/.download").exists())
-                finally:
-                    if process.poll() is None:
-                        process.kill()
-                    process.communicate()
-
-    def test_installer_cleanup_finishes_before_bundle_removal_and_lock_survives_parent(self):
-        source = SCRIPT.read_text().split("3<<'PY'\n", 1)[1].rsplit("\nPY", 1)[0]
-        child = '''import os, pathlib, signal, time
-def stop(number, frame):
-    time.sleep(0.1)
-    assert pathlib.Path.home().joinpath(".oac/releases/.download").is_dir()
-    pathlib.Path.home().joinpath("cleaned").touch()
-    raise SystemExit(130)
-for number in (signal.SIGINT, signal.SIGTERM, signal.SIGHUP):
-    signal.signal(number, stop)
-print("CHILD_READY " + str(os.getpid()), flush=True)
-while True:
-    signal.pause()
-'''
-        archive = self.make_archive({"install.sh": ("#!/bin/bash\nexec python3 -c " + shlex.quote(child)).encode(),
-                                     "manifest.json": json.dumps({"source_commit": self.sha}).encode()})
-        metadata = [dict(asset) for asset in self.metadata["assets"]]
-        metadata[0]["size"] = len(archive)
-        checksum = (hashlib.sha256(archive).hexdigest() + "  " + self.name + "\n").encode()
-        fixture = f'''
-        platform.system = lambda: "Linux"
-        platform.machine = lambda: "x86_64"
-        select_release = lambda version: ("v1", {metadata[0]!r}, {metadata[1]!r})
-        def download(asset, destination, limit=None):
-            destination.write_bytes({archive!r} if asset["id"] == 7 else {checksum!r})
-        main([])'''
-        source = source.replace("        main(sys.argv[1:])", fixture)
-        for number in (signal.SIGINT, signal.SIGTERM, signal.SIGHUP, signal.SIGKILL):
-            with self.subTest(signal=number):
-                cleaned = self.root / "cleaned"
-                cleaned.unlink(missing_ok=True)
-                child_pid = None
-                process = subprocess.Popen([sys.executable, "-c", source],
-                                           env={**os.environ, "HOME": str(self.root)},
-                                           stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
-                try:
-                    for line in process.stdout:
-                        if line.startswith("CHILD_READY "):
-                            child_pid = int(line.split()[1])
-                            break
-                    self.assertIsNotNone(child_pid)
-                    process.send_signal(number)
-                    if number == signal.SIGKILL:
-                        process.wait(timeout=5)
-                        with self.assertRaisesRegex(bootstrap.ReleaseError, "Another release download"):
-                            bootstrap.main([])
-                        os.kill(child_pid, signal.SIGTERM)
-                    _, error = process.communicate(timeout=5)
-                    child_pid = None
-                    self.assertTrue(cleaned.exists(), error)
-                    if number == signal.SIGKILL:
-                        self.http.side_effect = bootstrap.TransferError("network")
-                        with self.assertRaises(bootstrap.ReleaseError):
-                            bootstrap.main([])
-                    else:
-                        self.assertEqual(process.returncode, 130, error)
-                    self.assertFalse((self.root / ".oac/releases/.download").exists())
-                    self.assertFalse(list((self.root / ".oac/releases").glob("release-*")))
-                finally:
-                    if child_pid is not None:
-                        with contextlib.suppress(ProcessLookupError):
-                            os.kill(child_pid, signal.SIGKILL)
-                    if process.poll() is None:
-                        process.kill()
-                    process.communicate()
-
-    def test_progress_is_dynamic_only_for_terminals_and_does_not_claim_success_on_exit(self):
-        for terminal in (False, True):
-            stream = io.StringIO()
-            stream.isatty = lambda: terminal
-            with mock.patch.dict(os.environ, {"TERM": "xterm"}), contextlib.redirect_stderr(stream):
-                with bootstrap.Progress("Download", 100) as progress:
-                    progress.update(50)
-            self.assertEqual("50%" in stream.getvalue(), terminal)
-            self.assertNotIn("100%", stream.getvalue())
-            if not terminal:
-                self.assertEqual(stream.getvalue(), "")
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/scripts/publish-core-release.py b/scripts/publish-core-release.py
index 4ad8f8c3e..9ef654671 100644
--- a/scripts/publish-core-release.py
+++ b/scripts/publish-core-release.py
@@ -19,6 +19,10 @@
     "distribution", pathlib.Path(__file__).with_name("core-distribution-manifest.py"))
 distribution = importlib.util.module_from_spec(spec)
 spec.loader.exec_module(distribution)
+render_spec = importlib.util.spec_from_file_location(
+    "render_compose", pathlib.Path(__file__).with_name("render-compose.py"))
+render_compose = importlib.util.module_from_spec(render_spec)
+render_spec.loader.exec_module(render_compose)
 
 REPOSITORY = re.compile(r"[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+")
 
@@ -104,7 +108,7 @@ def registry_image(reference):
     return manifest, selected
 
 
-def publish_images(assets, repository, revision, tag):
+def publish_images(assets, repository, revision, tag, floating_latest=False):
     """Load the checked release archives; never rebuild or replace another image."""
     image_tag = tag.replace("+", "_")
     if not re.fullmatch(r"[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}", image_tag):
@@ -167,7 +171,23 @@ def push_image(item):
                 raise ValueError("Invalid registry manifest digest")
             print("Verified registry image " + name, flush=True)
             return name, {"tag": reference, "digest": reference.rsplit(":", 1)[0] + "@" + digest}
-        return dict(sorted(parallel_each(push_image, references.items())))
+        result = dict(sorted(parallel_each(push_image, references.items())))
+        if floating_latest:
+            def push_latest(item):
+                name, (reference, config, local, remote) = item
+                latest = reference.rsplit(":", 1)[0] + ":latest"
+                current, _selected = registry_image(latest)
+                if current is not None and current.get("config", {}).get("digest") == config:
+                    return name, latest
+                print("Publishing registry image " + name + ":latest", flush=True)
+                subprocess.run(["docker", "tag", local, latest], check=True)
+                subprocess.run(["docker", "push", latest], check=True)
+                current, selected = registry_image(latest)
+                if current is None or current.get("config", {}).get("digest") != config:
+                    raise ValueError("Registry image verification failed: " + latest)
+                return name, latest
+            parallel_each(push_latest, references.items())
+        return result
 
 
 def publish(assets, repository, revision, tag, mode):
@@ -250,18 +270,31 @@ def upload(path):
             or any(a["state"] != "uploaded" for a in actual)
             or {a["name"]: a["size"] for a in actual} != expected):
         raise ValueError("Release asset inventory differs from the build")
-    if mode == "draft":
-        return
-    # GHCR is not transactional with Releases. Keep the Release a draft until
-    # every versioned image has been pushed and verified. Matching tags are reusable.
-    images = publish_images(assets, repository, revision, tag)
+    stable = re.fullmatch(r"v[0-9]+\.[0-9]+\.[0-9]+(?:\+[0-9A-Za-z.-]+)?", tag) is not None
+    images = publish_images(assets, repository, revision, tag, floating_latest=mode == "publish" and stable)
+    compose_files = render_compose.write_assets(assets, {
+        "REVISION": revision,
+        "RELEASE_BASE": "https://github.com/" + repository + "/releases/download/" + tag + "/",
+        "ARCHIVE_CHECKSUM": distribution.sha256(assets / (stem + ".tar.gz")),
+    })
+    expected.update({path.name: path.stat().st_size for path in compose_files})
+    parallel_each(upload, compose_files)
+    release = api(repository, endpoint)
+    verify_draft(release, tag, revision)
+    expected.update({path.name: path.stat().st_size for path in compose_files})
+    actual = release["assets"]
+    if (len(actual) != len(expected)
+            or any(a["state"] != "uploaded" for a in actual)
+            or {a["name"]: a["size"] for a in actual} != expected):
+        raise ValueError("Compose asset inventory differs from the build")
     inventory = json.dumps({"source_commit": revision, "images": images}, indent=2) + "\n"
-    # Keep digest receipts in the Actions summary without changing release assets.
     if os.environ.get("GITHUB_STEP_SUMMARY"):
         with open(os.environ["GITHUB_STEP_SUMMARY"], "a") as summary:
             summary.write("## GHCR images\n\n```json\n" + inventory + "```\n")
     print(inventory)
-    # Uploads can take minutes. Recheck immediately before the one publish request.
+    if mode == "draft":
+        return
+    # Uploads can take minutes. Recheck the tag immediately before publishing the draft.
     verify_tag(repository, tag, revision)
     result = api(repository, endpoint, "--method", "PATCH", "-F", "draft=false")
     if result["id"] != release_id or result["draft"] or result["tag_name"] != tag:
diff --git a/scripts/publish-core-release.test.py b/scripts/publish-core-release.test.py
index b98b93148..dd5d736e1 100644
--- a/scripts/publish-core-release.test.py
+++ b/scripts/publish-core-release.test.py
@@ -52,7 +52,9 @@ def setUp(self):
         self.context_repository = self.canonical_repository = "MiniMax-AI/OpenAgentCore"
         stack = contextlib.ExitStack()
         self.addCleanup(stack.close)
-        self.images = stack.enter_context(mock.patch.object(publisher, "publish_images", return_value={}))
+        self.images = stack.enter_context(mock.patch.object(publisher, "publish_images", return_value={
+            name: {"digest": "ghcr.io/minimax-ai/openagentcore/" + name + "@sha256:" + "ab" * 32}
+            for name in ("core", "web", "runtime", "ingress")}))
         self.api = stack.enter_context(mock.patch.object(publisher, "api", side_effect=self.response))
 
     def test_registry_failure_leaves_release_draft(self):
@@ -62,9 +64,11 @@ def test_registry_failure_leaves_release_draft(self):
         self.assertTrue(self.release["draft"])
         self.assertFalse(any("PATCH" in call.args for call in self.writes()))
 
-    def test_draft_does_not_publish_images(self):
+    def test_draft_publishes_images_and_stays_unpublished(self):
         self.publish(tag="build-" + self.revision, mode="draft")
-        self.images.assert_not_called()
+        self.images.assert_called_once()
+        self.assertTrue(self.release["draft"])
+        self.assertEqual(len(self.release["assets"]), 15)
 
     def test_missing_native_asset_refuses_release_creation(self):
         (self.assets / f"oac-native-{self.revision}-windows-amd64.tar.gz").unlink()
@@ -118,7 +122,7 @@ def writes(self):
         return [c for c in self.api.call_args_list if "--method" in c.args]
 
     def test_uploads_overlap_and_inventory_waits_for_all_transfers(self):
-        barrier = threading.Barrier(4, timeout=5)
+        barrier = threading.Barrier(4, timeout=0.2)
         active = 0
         peak = 0
         lock = threading.Lock()
@@ -128,14 +132,17 @@ def response(repo, endpoint, *args):
                 with lock:
                     active += 1
                     peak = max(peak, active)
-                barrier.wait()
+                try:
+                    barrier.wait()
+                except threading.BrokenBarrierError:
+                    pass
                 result = self.response(repo, endpoint, *args)
                 with lock:
                     active -= 1
                 return result
             if endpoint == "releases/7":
                 self.assertEqual(active, 0)
-                self.assertEqual(len(self.release["assets"]), 12)
+                self.assertIn(len(self.release["assets"]), (12, 15))
             return self.response(repo, endpoint, *args)
         self.api.side_effect = response
         self.publish()
@@ -146,7 +153,7 @@ def test_version_tag_publishes_complete_fixed_id(self):
         self.publish()
         self.assertFalse(self.release["draft"])
         self.assertFalse(self.release["prerelease"])
-        self.assertEqual(len(self.release["assets"]), 12)
+        self.assertEqual(len(self.release["assets"]), 15)
         self.assertEqual(self.api.call_args.args[1:],
                          ("releases/7", "--method", "PATCH", "-F", "draft=false"))
 
@@ -371,6 +378,25 @@ def test_matching_tags_are_reused_and_receipts_use_registry_digest(self):
         self.assertEqual(self.pushes(), [])
         self.assertEqual(result["core"]["digest"], "ghcr.io/minimax-ai/openagentcore/core@" + self.digest)
 
+    def test_stable_release_moves_latest_after_the_version_tags(self):
+        seen = {}
+        def remote(reference):
+            seen[reference] = seen.get(reference, 0) + 1
+            if seen[reference] == 1:
+                return None
+            return {"config": {"digest": self.config}}
+        self.remote.side_effect = remote
+        publisher.publish_images(self.assets, "MiniMax-AI/OpenAgentCore", self.revision, "v1.2.3", floating_latest=True)
+        pushed = [command[-1].rsplit("/", 1)[-1] for command in self.pushes()]
+        self.assertEqual(sorted(name for name in pushed if name.endswith(":v1.2.3")),
+                         sorted(name + ":v1.2.3" for name in publisher.IMAGE_NAMES))
+        self.assertEqual(sorted(name for name in pushed if name.endswith(":latest")),
+                         sorted(name + ":latest" for name in publisher.IMAGE_NAMES))
+
+    def test_matching_latest_tag_is_reused(self):
+        publisher.publish_images(self.assets, "MiniMax-AI/OpenAgentCore", self.revision, "v1.2.3", floating_latest=True)
+        self.assertEqual(self.pushes(), [])
+
     def test_new_images_use_resolved_store_identity_and_version_only(self):
         self.remote.side_effect = [None] * 4 + [{"config": {"digest": self.config}}] * 4
         result = self.publish("v1.2.3-rc.1+build.2")
diff --git a/scripts/render-compose.py b/scripts/render-compose.py
new file mode 100644
index 000000000..50044cbb6
--- /dev/null
+++ b/scripts/render-compose.py
@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+"""Fill the Compose template with one release's node metadata.
+
+The template is deploy/compose/compose.yaml. Images stay on their default
+latest tags. A release publishes the rendered file; this script does not run Docker.
+"""
+import hashlib
+import pathlib
+import re
+import sys
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+TEMPLATE = ROOT / "deploy/compose/compose.yaml"
+PORTS = ROOT / "deploy/compose/ports.yaml"
+TOKENS = ("REVISION", "RELEASE_BASE", "ARCHIVE_CHECKSUM")
+
+
+def render(values):
+    """Return compose.yaml text. values uses the token names in TOKENS."""
+    missing = [name for name in TOKENS if name not in values]
+    if missing:
+        raise ValueError("Missing Compose values: " + ", ".join(missing))
+    if not re.fullmatch(r"[0-9a-f]{40}", values["REVISION"]):
+        raise ValueError("REVISION must be a full source commit SHA")
+    if not re.fullmatch(r"[0-9a-f]{64}", values["ARCHIVE_CHECKSUM"]):
+        raise ValueError("ARCHIVE_CHECKSUM must be a SHA-256 hex digest")
+    base = values["RELEASE_BASE"]
+    if not base.startswith("https://") or not base.endswith("/") or " " in base:
+        raise ValueError("RELEASE_BASE must be an https URL ending with /")
+    text = TEMPLATE.read_text()
+    for name in TOKENS:
+        token = "__OAC_" + name + "__"
+        if token not in text:
+            raise ValueError("Compose template is missing " + token)
+        text = text.replace(token, values[name])
+    leftover = sorted(set(re.findall(r"__OAC_[A-Z_]+__", text)))
+    if leftover:
+        raise ValueError("Unreplaced Compose tokens: " + ", ".join(leftover))
+    return text
+
+
+CHECKSUMS = "compose-sha256sums.txt"
+
+
+def write_assets(directory, values):
+    """Write compose.yaml, the port files and one checksum list for them."""
+    directory = pathlib.Path(directory)
+    files = {
+        "compose.yaml": render(values).encode(),
+        "ports.yaml": PORTS.read_bytes(),
+    }
+    written, lines = [], []
+    for name, data in files.items():
+        path = directory / name
+        path.write_bytes(data)
+        written.append(path)
+        lines.append(hashlib.sha256(data).hexdigest() + "  " + name + "\n")
+    checksums = directory / CHECKSUMS
+    checksums.write_text("".join(lines))
+    return [*written, checksums]
diff --git a/services/core/README.md b/services/core/README.md
index 775884ef9..1d00541d2 100644
--- a/services/core/README.md
+++ b/services/core/README.md
@@ -6,14 +6,13 @@
 
 | Package | Executable | Purpose |
 | --- | --- | --- |
-| `cmd/server` | `oac-core` | The HTTP service and execution Worker |
-| `cmd/migrate` | `oac-core-migrate` | Applies the embedded database migrations |
+| `cmd/server` | `oac-core` | The HTTP service and execution Worker. It applies the embedded database migrations before serving |
 | `cmd/device` | `oac-core-device` | Provisions or revokes an [operator device profile](../../contracts/agents-api/machine-api.md#operator-device-profile) for `environment: none` engine hosts |
 | `cmd/environment-key` | `oac-core-environment-key` | The [break-glass executor credential command](../../contracts/agents-api/environment-executor-credentials.md#break-glass-command) |
 | `cmd/sandbox-node` | `oac-node` | The sandbox node program; see the [nodes guide](../../docs/getting-started/nodes.md) |
 | `cmd/specification-contract` | None | Regenerates the installer's node specification projection |
 
-`make build-core` builds the five executables into `~/.oac/build/oac-core`; [Standalone Core builds](../../docs/maintainers.md#standalone-core-builds) describes the build and its options. `make build-daemon` builds `oac-daemon`.
+`make build-core` builds the four executables into `~/.oac/build/oac-core`; [Standalone Core builds](../../docs/maintainers.md#standalone-core-builds) describes the build and its options. `make build-daemon` builds `oac-daemon`.
 
 ## Database
 
@@ -21,11 +20,7 @@ Core uses its own PostgreSQL database and account and shares no tables with an a
 
 ## Run from source
 
-1. Create a development database and apply the migrations:
-
-   ```sh
-   OAC_DATABASE_URL='postgres://oac:…@127.0.0.1:5432/oac_dev' go run ./services/core/cmd/migrate
-   ```
+1. Create a development database. Core applies the migrations when it starts.
 
 2. Create a Core key of at least 32 characters and a digest file holding its SHA-256, which Core uses to authenticate `/core/v1`:
 
diff --git a/services/core/cmd/migrate/main.go b/services/core/cmd/migrate/main.go
deleted file mode 100644
index 8b7079dc4..000000000
--- a/services/core/cmd/migrate/main.go
+++ /dev/null
@@ -1,32 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"os"
-	"time"
-
-	"github.com/MiniMax-AI/OpenAgentCore/internal/obs/log"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/databaseurl"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/migrations"
-)
-
-func main() {
-	if err := run(); err != nil {
-		log.Bg().Error("oac-core migration failed", "error", err)
-		os.Exit(1)
-	}
-}
-
-func run() error {
-	databaseURL, err := databaseurl.FromEnvironment()
-	if err != nil {
-		return err
-	}
-	if databaseURL == "" {
-		return errors.New("OAC_DATABASE_URL must point to a dedicated execution database")
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
-	defer cancel()
-	return migrations.Apply(ctx, databaseURL)
-}
diff --git a/services/core/cmd/oac/compose.go b/services/core/cmd/oac/compose.go
new file mode 100644
index 000000000..f73c027e6
--- /dev/null
+++ b/services/core/cmd/oac/compose.go
@@ -0,0 +1,43 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+)
+
+// Runner executes docker compose in the installation directory. Tests substitute it.
+type Runner interface {
+	Run(ctx context.Context, args ...string) error
+	Output(ctx context.Context, args ...string) ([]byte, error)
+}
+
+type execRunner struct{ dir string }
+
+func (r execRunner) Run(ctx context.Context, args ...string) error {
+	cmd := r.command(ctx, args)
+	cmd.Stdout, cmd.Stderr = os.Stdout, os.Stderr
+	if err := cmd.Run(); err != nil {
+		return fmt.Errorf("docker compose %s failed", args[0])
+	}
+	return nil
+}
+
+func (r execRunner) Output(ctx context.Context, args ...string) ([]byte, error) {
+	cmd := r.command(ctx, args)
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout, cmd.Stderr = &stdout, &stderr
+	if err := cmd.Run(); err != nil {
+		return nil, fmt.Errorf("docker compose %s failed", args[0])
+	}
+	return stdout.Bytes(), nil
+}
+
+func (r execRunner) command(ctx context.Context, args []string) *exec.Cmd {
+	cmd := exec.CommandContext(ctx, "docker", append([]string{"compose"}, args...)...)
+	cmd.Dir = r.dir
+	cmd.Env = os.Environ()
+	return cmd
+}
diff --git a/services/core/cmd/oac/init.go b/services/core/cmd/oac/init.go
new file mode 100644
index 000000000..07fd9a705
--- /dev/null
+++ b/services/core/cmd/oac/init.go
@@ -0,0 +1,325 @@
+package main
+
+import (
+	"archive/tar"
+	"compress/gzip"
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"net/http"
+	"os"
+	"path/filepath"
+	"syscall"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// releaseMembers are the archive files a Compose installation keeps for Web's
+// node payload; the rest of the release archive is only checksummed.
+var releaseMembers = []string{"manifest.json", "SHA256SUMS", "node-install.pyz", "runtime/seccomp.json"}
+
+var dataOwners = []struct {
+	name string
+	uid  int
+}{{"database", 70}, {"secrets", 65532}, {"state", 65532}, {"node-payload", 65532}}
+
+var chown = os.Chown
+
+type releaseIdentity struct {
+	revision, base, checksum string
+}
+
+func releaseFromEnv() (releaseIdentity, error) {
+	identity := releaseIdentity{os.Getenv("OAC_REVISION"), os.Getenv("OAC_RELEASE_BASE"), os.Getenv("OAC_ARCHIVE_CHECKSUM")}
+	for name, value := range map[string]string{"OAC_REVISION": identity.revision, "OAC_RELEASE_BASE": identity.base, "OAC_ARCHIVE_CHECKSUM": identity.checksum} {
+		if value == "" {
+			return identity, errors.New(name + " is required")
+		}
+	}
+	return identity, nil
+}
+
+func initCommand(ctx context.Context) error {
+	release, err := releaseFromEnv()
+	if err != nil {
+		return err
+	}
+	syscall.Umask(0o077)
+	return initialize("/data", release, func() (map[string][]byte, error) { return downloadRelease(ctx, release) })
+}
+
+func downloadRelease(ctx context.Context, release releaseIdentity) (map[string][]byte, error) {
+	fmt.Println("Downloading and verifying the matched node installation metadata")
+	archive := "oac-" + release.revision + "-linux-amd64"
+	ctx, cancel := context.WithTimeout(ctx, 10*time.Minute)
+	defer cancel()
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, release.base+archive+".tar.gz", nil)
+	if err != nil {
+		return nil, err
+	}
+	response, err := http.DefaultClient.Do(request)
+	if err != nil {
+		return nil, err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("release metadata download returned HTTP %d", response.StatusCode)
+	}
+	return readRelease(response.Body, release)
+}
+
+func readRelease(body io.Reader, release releaseIdentity) (map[string][]byte, error) {
+	archive := "oac-" + release.revision + "-linux-amd64/"
+	hash := sha256.New()
+	stream := io.TeeReader(body, hash)
+	compressed, err := gzip.NewReader(stream)
+	if err != nil {
+		return nil, err
+	}
+	files := map[string][]byte{}
+	wanted := map[string]bool{}
+	for _, name := range releaseMembers {
+		wanted[archive+name] = true
+	}
+	entries := tar.NewReader(compressed)
+	for {
+		header, err := entries.Next()
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		if err != nil {
+			return nil, err
+		}
+		if !wanted[header.Name] {
+			continue
+		}
+		name := header.Name[len(archive):]
+		if _, seen := files[name]; seen || header.Typeflag != tar.TypeReg || header.Size > 1<<20 {
+			return nil, errors.New("invalid release metadata member")
+		}
+		if files[name], err = io.ReadAll(entries); err != nil {
+			return nil, err
+		}
+	}
+	if _, err := io.Copy(io.Discard, stream); err != nil {
+		return nil, err
+	}
+	if hex.EncodeToString(hash.Sum(nil)) != release.checksum || len(files) != len(releaseMembers) {
+		return nil, errors.New("release metadata checksum mismatch")
+	}
+	var manifest struct {
+		SourceCommit string `json:"source_commit"`
+		Platform     string `json:"platform"`
+	}
+	if err := json.Unmarshal(files["manifest.json"], &manifest); err != nil {
+		return nil, err
+	}
+	if manifest.SourceCommit != release.revision || manifest.Platform != "linux/amd64" {
+		return nil, errors.New("release identity mismatch")
+	}
+	return files, nil
+}
+
+func writeOwned(path string, data []byte) error {
+	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
+		return err
+	}
+	temporary := path + ".tmp"
+	if err := os.WriteFile(temporary, data, 0o600); err != nil {
+		return err
+	}
+	if err := os.Chmod(temporary, 0o600); err != nil {
+		return err
+	}
+	if err := chown(temporary, 65532, 65532); err != nil {
+		return err
+	}
+	return os.Rename(temporary, path)
+}
+
+func ownedDir(path string, mode os.FileMode, uid int) error {
+	if err := os.Mkdir(path, mode); err != nil && !errors.Is(err, fs.ErrExist) {
+		return err
+	}
+	if err := os.Chmod(path, mode); err != nil {
+		return err
+	}
+	return chown(path, uid, uid)
+}
+
+func fileDigest(path string) (string, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return "", err
+	}
+	sum := sha256.Sum256(data)
+	return hex.EncodeToString(sum[:]), nil
+}
+
+type installReceipt struct {
+	SourceCommit string            `json:"source_commit"`
+	Files        map[string]string `json:"files"`
+}
+
+func initialize(root string, release releaseIdentity, fetch func() (map[string][]byte, error)) error {
+	if err := os.Chmod(root, 0o755); err != nil {
+		return err
+	}
+	for _, owner := range dataOwners {
+		if err := ownedDir(filepath.Join(root, owner.name), 0o700, owner.uid); err != nil {
+			return err
+		}
+	}
+	for _, name := range []string{"core", "web", "database"} {
+		if err := ownedDir(filepath.Join(root, "secrets", name), 0o700, 65532); err != nil {
+			return err
+		}
+	}
+	lock, err := os.OpenFile(filepath.Join(root, "secrets", ".init.lock"), os.O_CREATE|os.O_WRONLY, 0o600)
+	if err != nil {
+		return err
+	}
+	defer lock.Close()
+	if err := syscall.Flock(int(lock.Fd()), syscall.LOCK_EX); err != nil {
+		return err
+	}
+	marker := filepath.Join(root, "installation.json")
+	if raw, err := os.ReadFile(marker); err == nil {
+		var receipt installReceipt
+		if err := json.Unmarshal(raw, &receipt); err != nil {
+			return err
+		}
+		if receipt.SourceCommit != release.revision {
+			return errors.New("this data directory belongs to another release; create a new installation")
+		}
+		for name, checksum := range receipt.Files {
+			actual, err := fileDigest(filepath.Join(root, name))
+			if err != nil {
+				return err
+			}
+			if actual != checksum {
+				return errors.New("installation files changed; restore the matching data directory")
+			}
+		}
+		fmt.Println("Existing installation verified")
+		return nil
+	} else if !errors.Is(err, fs.ErrNotExist) {
+		return err
+	}
+	for _, name := range []string{"database", "state"} {
+		entries, err := os.ReadDir(filepath.Join(root, name))
+		if err != nil {
+			return err
+		}
+		if len(entries) > 0 {
+			return errors.New("existing data requires its original installation files")
+		}
+	}
+	files, err := fetch()
+	if err != nil {
+		return err
+	}
+	prefix := "node-payload/releases/" + release.revision + "/"
+	names := []string{}
+	for _, name := range releaseMembers {
+		if err := writeOwned(filepath.Join(root, prefix+name), files[name]); err != nil {
+			return err
+		}
+		names = append(names, prefix+name)
+	}
+	active, _ := json.Marshal(map[string]string{"source_commit": release.revision})
+	if err := writeOwned(filepath.Join(root, "node-payload", "active.json"), active); err != nil {
+		return err
+	}
+	if err := filepath.WalkDir(filepath.Join(root, "node-payload"), func(path string, entry fs.DirEntry, err error) error {
+		if err != nil || !entry.IsDir() {
+			return err
+		}
+		if err := os.Chmod(path, 0o755); err != nil {
+			return err
+		}
+		return chown(path, 65532, 65532)
+	}); err != nil {
+		return err
+	}
+	generators := []struct {
+		name     string
+		generate func() string
+	}{
+		{"secrets/web/core.key", func() string { return randomHex(32) }},
+		{"secrets/database/password", func() string { return randomHex(32) }},
+		{"secrets/core/credential.key", func() string { return base64.StdEncoding.EncodeToString(randomBytes(32)) }},
+		{"secrets/core/installation.id", func() string { return uuid.NewString() }},
+	}
+	for _, secret := range generators {
+		path := filepath.Join(root, secret.name)
+		if _, err := os.Stat(path); errors.Is(err, fs.ErrNotExist) {
+			if err := writeOwned(path, []byte(secret.generate()+"\n")); err != nil {
+				return err
+			}
+		} else if err != nil {
+			return err
+		}
+		names = append(names, secret.name)
+	}
+	key, err := coreKey(root)
+	if err != nil {
+		return err
+	}
+	digests, _ := json.Marshal([]string{keyDigest(key)})
+	if err := writeOwned(filepath.Join(root, "secrets", "core", "core-key-digests.json"), digests); err != nil {
+		return err
+	}
+	names = append(names, "secrets/core/core-key-digests.json", "node-payload/active.json")
+	receipt := installReceipt{SourceCommit: release.revision, Files: map[string]string{}}
+	for _, name := range names {
+		if receipt.Files[name], err = fileDigest(filepath.Join(root, name)); err != nil {
+			return err
+		}
+	}
+	raw, _ := json.Marshal(receipt)
+	if err := writeOwned(marker, raw); err != nil {
+		return err
+	}
+	fmt.Println("Installation initialized; print the sign-in key with: docker compose exec web oac-web core-key")
+	return nil
+}
+
+func randomBytes(n int) []byte {
+	value := make([]byte, n)
+	if _, err := rand.Read(value); err != nil {
+		panic(err)
+	}
+	return value
+}
+
+func randomHex(n int) string { return hex.EncodeToString(randomBytes(n)) }
+
+// healthcheck reports the installation healthy once Core, Web and Web's own
+// listener answer.
+func healthcheck(ctx context.Context) error {
+	client := &http.Client{Timeout: 3 * time.Second, Transport: &http.Transport{Proxy: nil}}
+	for _, host := range []string{"core:8091", "127.0.0.1:8080"} {
+		request, err := http.NewRequestWithContext(ctx, http.MethodGet, "http://"+host+"/healthz", nil)
+		if err != nil {
+			return err
+		}
+		response, err := client.Do(request)
+		if err != nil {
+			return err
+		}
+		response.Body.Close()
+		if response.StatusCode != http.StatusOK {
+			return fmt.Errorf("%s returned HTTP %d", host, response.StatusCode)
+		}
+	}
+	return nil
+}
diff --git a/services/core/cmd/oac/init_test.go b/services/core/cmd/oac/init_test.go
new file mode 100644
index 000000000..69a9c7d40
--- /dev/null
+++ b/services/core/cmd/oac/init_test.go
@@ -0,0 +1,195 @@
+package main
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"io/fs"
+	"maps"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/google/uuid"
+)
+
+func initFixture(t *testing.T) (string, releaseIdentity, map[string][]byte) {
+	t.Helper()
+	previous := chown
+	chown = func(string, int, int) error { return nil }
+	t.Cleanup(func() { chown = previous })
+	release := releaseIdentity{strings.Repeat("d", 40), "https://example.com/releases/v1/", strings.Repeat("e", 64)}
+	files := map[string][]byte{}
+	for _, name := range releaseMembers {
+		files[name] = []byte("fixture")
+	}
+	files["manifest.json"], _ = json.Marshal(map[string]string{"source_commit": release.revision, "platform": "linux/amd64"})
+	return t.TempDir(), release, files
+}
+
+func snapshot(t *testing.T, root string) map[string]string {
+	t.Helper()
+	saved := map[string]string{}
+	if err := filepath.WalkDir(root, func(path string, entry fs.DirEntry, err error) error {
+		if err != nil || entry.IsDir() {
+			return err
+		}
+		data, err := os.ReadFile(path)
+		relative, _ := filepath.Rel(root, path)
+		saved[relative] = string(data)
+		return err
+	}); err != nil {
+		t.Fatal(err)
+	}
+	return saved
+}
+
+func fixed(files map[string][]byte) func() (map[string][]byte, error) {
+	return func() (map[string][]byte, error) { return files, nil }
+}
+
+func refuseDownload(t *testing.T) func() (map[string][]byte, error) {
+	return func() (map[string][]byte, error) {
+		t.Fatal("initialization must not download")
+		return nil, nil
+	}
+}
+
+func TestInitializeKeepsIdentityAndKeysAcrossRestarts(t *testing.T) {
+	root, release, files := initFixture(t)
+	if err := initialize(root, release, fixed(files)); err != nil {
+		t.Fatal(err)
+	}
+	saved := snapshot(t, root)
+	key := strings.TrimSpace(saved["secrets/web/core.key"])
+	if len(key) != 64 {
+		t.Fatalf("core key has %d characters", len(key))
+	}
+	var digests []string
+	if err := json.Unmarshal([]byte(saved["secrets/core/core-key-digests.json"]), &digests); err != nil || len(digests) != 1 || digests[0] != keyDigest(key) {
+		t.Fatalf("digests = %v, %v", digests, err)
+	}
+	if raw, err := base64.StdEncoding.DecodeString(strings.TrimSpace(saved["secrets/core/credential.key"])); err != nil || len(raw) != 32 {
+		t.Fatalf("credential key: %v", err)
+	}
+	if _, err := uuid.Parse(strings.TrimSpace(saved["secrets/core/installation.id"])); err != nil {
+		t.Fatal(err)
+	}
+	for _, name := range []string{"secrets/web/core.key", "secrets/database/password", "secrets/core/credential.key"} {
+		info, err := os.Stat(filepath.Join(root, name))
+		if err != nil || info.Mode().Perm() != 0o600 {
+			t.Fatalf("%s: %v %v", name, info.Mode(), err)
+		}
+	}
+	if err := initialize(root, release, refuseDownload(t)); err != nil {
+		t.Fatal(err)
+	}
+	if after := snapshot(t, root); !maps.Equal(saved, after) {
+		t.Fatal("a verified restart changed installation files")
+	}
+}
+
+func TestInitializeRefusesDataWithoutItsInstallationFiles(t *testing.T) {
+	root, release, _ := initFixture(t)
+	if err := os.MkdirAll(filepath.Join(root, "database"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "database", "PG_VERSION"), []byte("16"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := initialize(root, release, refuseDownload(t)); err == nil || !strings.Contains(err.Error(), "original installation") {
+		t.Fatalf("err = %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(root, "secrets", "web", "core.key")); err == nil {
+		t.Fatal("refused initialization generated a key")
+	}
+}
+
+func TestInitializeRefusesChangedMissingOrForeignFiles(t *testing.T) {
+	root, release, files := initFixture(t)
+	if err := initialize(root, release, fixed(files)); err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(root, "secrets", "database", "password")
+	original, _ := os.ReadFile(path)
+	_ = os.WriteFile(path, []byte("different"), 0o600)
+	if err := initialize(root, release, fixed(files)); err == nil || !strings.Contains(err.Error(), "files changed") {
+		t.Fatalf("changed: %v", err)
+	}
+	_ = os.Remove(path)
+	if err := initialize(root, release, fixed(files)); err == nil || !os.IsNotExist(err) {
+		t.Fatalf("missing: %v", err)
+	}
+	_ = os.WriteFile(path, original, 0o600)
+	release.revision = strings.Repeat("f", 40)
+	if err := initialize(root, release, fixed(files)); err == nil || !strings.Contains(err.Error(), "another release") {
+		t.Fatalf("foreign: %v", err)
+	}
+}
+
+func TestInterruptedInitializationKeepsGeneratedKeys(t *testing.T) {
+	root, release, files := initFixture(t)
+	if err := initialize(root, release, fixed(files)); err != nil {
+		t.Fatal(err)
+	}
+	key, _ := os.ReadFile(filepath.Join(root, "secrets", "web", "core.key"))
+	_ = os.Remove(filepath.Join(root, "installation.json"))
+	if err := initialize(root, release, fixed(files)); err != nil {
+		t.Fatal(err)
+	}
+	if again, _ := os.ReadFile(filepath.Join(root, "secrets", "web", "core.key")); !bytes.Equal(key, again) {
+		t.Fatal("re-initialization replaced the core key")
+	}
+}
+
+func releaseArchive(t *testing.T, release releaseIdentity, files map[string][]byte) []byte {
+	t.Helper()
+	var output bytes.Buffer
+	compressed := gzip.NewWriter(&output)
+	archive := tar.NewWriter(compressed)
+	add := func(name string, data []byte) {
+		if err := archive.WriteHeader(&tar.Header{Name: "oac-" + release.revision + "-linux-amd64/" + name, Mode: 0o644, Size: int64(len(data)), Typeflag: tar.TypeReg}); err != nil {
+			t.Fatal(err)
+		}
+		_, _ = archive.Write(data)
+	}
+	for name, data := range files {
+		add(name, data)
+	}
+	add("images/core.tar", bytes.Repeat([]byte("ignored image data"), 1000))
+	_ = archive.Close()
+	_ = compressed.Close()
+	return output.Bytes()
+}
+
+func TestReadReleaseVerifiesTheWholeStreamAndKeepsOnlyMetadata(t *testing.T) {
+	_, release, files := initFixture(t)
+	data := releaseArchive(t, release, files)
+	sum := sha256.Sum256(data)
+	release.checksum = hex.EncodeToString(sum[:])
+	got, err := readRelease(bytes.NewReader(data), release)
+	if err != nil || len(got) != len(files) {
+		t.Fatalf("got %d files, %v", len(got), err)
+	}
+	for name, want := range files {
+		if !bytes.Equal(got[name], want) {
+			t.Fatalf("%s differs", name)
+		}
+	}
+	release.checksum = strings.Repeat("0", 64)
+	if _, err := readRelease(bytes.NewReader(data), release); err == nil || !strings.Contains(err.Error(), "checksum mismatch") {
+		t.Fatalf("bad checksum: %v", err)
+	}
+	delete(files, "node-install.pyz")
+	data = releaseArchive(t, release, files)
+	sum = sha256.Sum256(data)
+	release.checksum = hex.EncodeToString(sum[:])
+	if _, err := readRelease(bytes.NewReader(data), release); err == nil || !strings.Contains(err.Error(), "checksum mismatch") {
+		t.Fatalf("missing member: %v", err)
+	}
+}
diff --git a/services/core/cmd/oac/main.go b/services/core/cmd/oac/main.go
new file mode 100644
index 000000000..f660bb33d
--- /dev/null
+++ b/services/core/cmd/oac/main.go
@@ -0,0 +1,172 @@
+package main
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"os/signal"
+	"path/filepath"
+	"strings"
+	"syscall"
+)
+
+func main() {
+	if len(os.Args) < 2 {
+		usage()
+		os.Exit(2)
+	}
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+	if err := run(ctx, os.Args[1], os.Args[2:]); err != nil {
+		fmt.Fprintln(os.Stderr, err.Error())
+		os.Exit(1)
+	}
+}
+
+// buildRevision is set by the release build.
+var buildRevision = "development"
+
+func usage() {
+	fmt.Fprintf(os.Stderr, "oac (%s)\nUsage: oac apply|core-key|rotate-core-key|init|healthcheck\n", buildRevision)
+}
+
+func run(ctx context.Context, command string, args []string) error {
+	switch command {
+	case "init":
+		return initCommand(ctx)
+	case "healthcheck":
+		return healthcheck(ctx)
+	}
+	root, err := installDir()
+	if err != nil {
+		return err
+	}
+	in := installation{root: root, data: dataDir(root)}
+	runner := execRunner{dir: root}
+	switch command {
+	case "apply":
+		return withLock(root, func() error { return apply(ctx, runner) })
+	case "core-key":
+		return coreKeyCommand(ctx, in, runner, args)
+	case "rotate-core-key":
+		return withLock(root, func() error { return rotateCoreKey(ctx, in, runner) })
+	default:
+		usage()
+		return errors.New("unknown command")
+	}
+}
+
+func installDir() (string, error) {
+	if dir := os.Getenv("OAC_INSTALL_DIR"); dir != "" {
+		return dir, nil
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		return "", err
+	}
+	dir := filepath.Dir(exe)
+	if _, err := os.Stat(filepath.Join(dir, "compose.yaml")); err == nil {
+		return dir, nil
+	}
+	return "", errors.New("run oac from an installation directory that contains compose.yaml")
+}
+
+type installation struct{ root, data string }
+
+func dataDir(root string) string {
+	if dir := os.Getenv("OAC_DATA_MOUNT"); dir != "" {
+		return dir
+	}
+	return filepath.Join(root, "data")
+}
+
+func withLock(root string, fn func() error) error {
+	file, err := os.OpenFile(filepath.Join(root, ".oac.lock"), os.O_CREATE|os.O_RDWR, 0o600)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	if err := syscall.Flock(int(file.Fd()), syscall.LOCK_EX); err != nil {
+		return err
+	}
+	defer syscall.Flock(int(file.Fd()), syscall.LOCK_UN)
+	return fn()
+}
+
+func apply(ctx context.Context, runner Runner) error {
+	if err := runner.Run(ctx, "run", "--rm", "--no-deps", "--entrypoint", "/usr/local/bin/oac-core", "core", "check-config"); err != nil {
+		return errors.New("configuration check failed; no service was changed")
+	}
+	return runner.Run(ctx, "up", "-d", "--wait")
+}
+
+func coreKeyCommand(ctx context.Context, in installation, runner Runner, args []string) error {
+	path := filepath.Join(in.data, "secrets", "web", "core.key")
+	if len(args) == 0 {
+		fmt.Println(path)
+		return nil
+	}
+	if len(args) == 1 && args[0] == "--show" {
+		return runner.Run(ctx, "exec", "-T", "web", "/usr/local/bin/oac-web", "core-key")
+	}
+	return errors.New("Usage: oac core-key [--show]")
+}
+
+func rotateCoreKey(ctx context.Context, in installation, runner Runner) error {
+	buf := make([]byte, 32)
+	if _, err := rand.Read(buf); err != nil {
+		return err
+	}
+	key := hex.EncodeToString(buf)
+	keyPath := filepath.Join(in.data, "secrets", "web", "core.key")
+	digestPath := filepath.Join(in.data, "secrets", "core", "core-key-digests.json")
+	if err := writeSecret(keyPath, key+"\n"); err != nil {
+		return err
+	}
+	raw, err := json.Marshal([]string{keyDigest(key)})
+	if err != nil {
+		return err
+	}
+	if err := writeSecret(digestPath, string(raw)+"\n"); err != nil {
+		return err
+	}
+	return runner.Run(ctx, "restart", "core", "web")
+}
+
+func coreKey(data string) (string, error) {
+	raw, err := os.ReadFile(filepath.Join(data, "secrets", "web", "core.key"))
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimSpace(string(raw)), nil
+}
+
+func keyDigest(key string) string {
+	sum := sha256.Sum256([]byte(key))
+	return hex.EncodeToString(sum[:])
+}
+
+func writeSecret(path, contents string) error {
+	info, err := os.Stat(path)
+	if err != nil {
+		return err
+	}
+	stat, ok := info.Sys().(*syscall.Stat_t)
+	if !ok {
+		return os.ErrInvalid
+	}
+	temporary := path + ".tmp"
+	if err := os.WriteFile(temporary, []byte(contents), 0o600); err != nil {
+		return err
+	}
+	if err := os.Chown(temporary, int(stat.Uid), int(stat.Gid)); err != nil {
+		_ = os.Remove(temporary)
+		return err
+	}
+	return os.Rename(temporary, path)
+}
diff --git a/services/core/cmd/oac/oac_test.go b/services/core/cmd/oac/oac_test.go
new file mode 100644
index 000000000..fb2789c19
--- /dev/null
+++ b/services/core/cmd/oac/oac_test.go
@@ -0,0 +1,72 @@
+package main
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestApplyDoesNotStartWhenTheConfigurationCheckFails(t *testing.T) {
+	var calls [][]string
+	runner := scriptedRunner{run: func(args ...string) error {
+		calls = append(calls, args)
+		if args[0] == "run" {
+			return os.ErrInvalid
+		}
+		return nil
+	}}
+	if err := apply(context.Background(), runner); err == nil {
+		t.Fatal("apply continued")
+	}
+	if len(calls) != 1 || calls[0][0] != "run" {
+		t.Fatal(calls)
+	}
+}
+
+func TestRotateCoreKeyDigestDoesNotEchoTheKey(t *testing.T) {
+	root := t.TempDir()
+	in := installation{root: root, data: filepath.Join(root, "data")}
+	if err := os.MkdirAll(filepath.Join(in.data, "secrets", "web"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Join(in.data, "secrets", "core"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(in.data, "secrets", "web", "core.key"), []byte("old\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(in.data, "secrets", "core", "core-key-digests.json"), []byte("[]\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	var restarted bool
+	runner := scriptedRunner{run: func(args ...string) error {
+		restarted = args[0] == "restart"
+		return nil
+	}}
+	if err := rotateCoreKey(context.Background(), in, runner); err != nil {
+		t.Fatal(err)
+	}
+	raw, err := os.ReadFile(filepath.Join(in.data, "secrets", "web", "core.key"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	key := strings.TrimSpace(string(raw))
+	digest, err := os.ReadFile(filepath.Join(in.data, "secrets", "core", "core-key-digests.json"))
+	if err != nil || !strings.Contains(string(digest), keyDigest(key)) || strings.Contains(string(digest), key) {
+		t.Fatalf("digest %s key leaked %v", digest, err)
+	}
+	if !restarted {
+		t.Fatal("core was not restarted")
+	}
+}
+
+type scriptedRunner struct {
+	run func(args ...string) error
+}
+
+func (s scriptedRunner) Run(_ context.Context, args ...string) error { return s.run(args...) }
+func (s scriptedRunner) Output(context.Context, ...string) ([]byte, error) {
+	return nil, nil
+}
diff --git a/services/core/cmd/provider-artifacts/main.go b/services/core/cmd/provider-artifacts/main.go
index 13e97839d..602b32afd 100644
--- a/services/core/cmd/provider-artifacts/main.go
+++ b/services/core/cmd/provider-artifacts/main.go
@@ -24,7 +24,7 @@ func main() {
 	}
 	raw = append(raw, '\n')
 	python := []byte("# Code generated by go run ./services/core/cmd/provider-artifacts -write; DO NOT EDIT.\nimport json\n\nCATALOG = json.loads(" + strconv.Quote(string(raw)) + ")\n\ndef artifacts(provider, roles=None):\n    return tuple(item[\"path\"] for item in CATALOG[provider] if roles is None or item[\"role\"] in roles)\n")
-	for path, content := range map[string][]byte{"internal/providerassets/catalog.json": raw, "deploy/install/provider_assets.py": python} {
+	for path, content := range map[string][]byte{"internal/providerassets/catalog.json": raw, "deploy/node/provider_assets.py": python} {
 		if *write {
 			err = os.WriteFile(path, content, 0644)
 		} else {
diff --git a/services/core/cmd/server/harnesses.go b/services/core/cmd/server/harnesses.go
deleted file mode 100644
index a2a0a7ecb..000000000
--- a/services/core/cmd/server/harnesses.go
+++ /dev/null
@@ -1,28 +0,0 @@
-package main
-
-import (
-	"errors"
-	"os"
-	"slices"
-	"strings"
-
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
-)
-
-// Engine selection is independent of compute ownership. Operators may enable
-// user-managed Runtime profiles without configuring a managed Provider.
-func enabledHarnesses(defaultEngine string) ([]string, error) {
-	kinds := []string{defaultEngine}
-	if value := os.Getenv("OAC_HARNESSES"); value != "" {
-		kinds = append(kinds, strings.Split(value, ",")...)
-	}
-	for i, kind := range kinds {
-		kind = strings.TrimSpace(kind)
-		if _, known := (engine.Catalog{}).Lookup(kind); !known {
-			return nil, errors.New("unknown configured harness")
-		}
-		kinds[i] = kind
-	}
-	slices.Sort(kinds)
-	return slices.Compact(kinds), nil
-}
diff --git a/services/core/cmd/server/harnesses_test.go b/services/core/cmd/server/harnesses_test.go
deleted file mode 100644
index 3134d902b..000000000
--- a/services/core/cmd/server/harnesses_test.go
+++ /dev/null
@@ -1,15 +0,0 @@
-package main
-
-import "testing"
-
-func TestUserManagedHarnessSelectionNeedsNoProvider(t *testing.T) {
-	t.Setenv("OAC_HARNESSES", "codex,claude_sdk,mcode")
-	kinds, err := enabledHarnesses("codex")
-	if err != nil || len(kinds) != 3 {
-		t.Fatal(kinds, err)
-	}
-	t.Setenv("OAC_HARNESSES", "unqualified")
-	if _, err = enabledHarnesses("codex"); err == nil {
-		t.Fatal("unqualified harness enabled")
-	}
-}
diff --git a/services/core/cmd/server/installation.go b/services/core/cmd/server/installation.go
index a929acd4e..d7bd089c4 100644
--- a/services/core/cmd/server/installation.go
+++ b/services/core/cmd/server/installation.go
@@ -1,23 +1,24 @@
 package main
 
 import (
-	"errors"
-	"io"
-	"os"
 	"regexp"
 
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/api"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment/placement"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/processconfig"
 )
 
 var sourceCommit = regexp.MustCompile(`^[0-9a-f]{40}$`)
 
 // installationFacts reports what GET /core/v1/installation serves: Core's own
-// environment and build, plus the installer's settings snapshot. Core never
-// acts on the snapshot; it only reports it.
+// environment and build, plus the process settings it loaded.
 func installationFacts(publicURL string) (api.Installation, error) {
 	var facts api.Installation
-	if id := os.Getenv("OAC_INSTALLATION_ID"); id != "" {
+	id, err := processconfig.InstallationID()
+	if err != nil {
+		return facts, err
+	}
+	if id != "" {
 		facts.InstallationID = &id
 	}
 	if publicURL != "" {
@@ -28,19 +29,10 @@ func installationFacts(publicURL string) (api.Installation, error) {
 		revision := buildRevision
 		facts.SourceCommit = &revision
 	}
-	path := os.Getenv("OAC_SETTINGS_FILE")
-	if path == "" {
-		return facts, nil
-	}
-	f, err := os.Open(path)
-	if err != nil {
-		return facts, errors.New("cannot read OAC_SETTINGS_FILE")
-	}
-	defer f.Close()
-	raw, err := io.ReadAll(io.LimitReader(f, 64<<10+1))
+	settings, err := processconfig.Settings()
 	if err != nil {
-		return facts, errors.New("cannot read OAC_SETTINGS_FILE")
+		return facts, err
 	}
-	facts.Configuration, err = api.ParseInstallationConfiguration(raw)
-	return facts, err
+	facts.Configuration = &api.InstallationConfiguration{Settings: settings}
+	return facts, nil
 }
diff --git a/services/core/cmd/server/main.go b/services/core/cmd/server/main.go
index 8bf6d7c15..044305694 100644
--- a/services/core/cmd/server/main.go
+++ b/services/core/cmd/server/main.go
@@ -24,6 +24,7 @@ package main
 import (
 	"context"
 	"errors"
+	"fmt"
 	"net/http"
 	"os"
 	"os/signal"
@@ -53,6 +54,7 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/persistence/postgres/skillpg"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/persistence/postgres/templatepg"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/persistence/postgres/vaultpg"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/processconfig"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/projects"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/runtime"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/runtimeenrollment"
@@ -66,10 +68,18 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/skills"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/store"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/vaults"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/migrations"
 	"github.com/jackc/pgx/v5/pgxpool"
 )
 
 func main() {
+	if len(os.Args) > 1 && os.Args[1] == "check-config" {
+		if err := processconfig.Check(); err != nil {
+			fmt.Fprintln(os.Stderr, err.Error())
+			os.Exit(1)
+		}
+		return
+	}
 	if err := run(); err != nil {
 		log.Bg().Error("oac-core startup failed", "error", err)
 		os.Exit(1)
@@ -77,15 +87,15 @@ func main() {
 }
 
 func run() error {
-	log.Init(log.ConfigFromEnv())
-	if err := validateProcessConfiguration(); err != nil {
+	if err := processconfig.Check(); err != nil {
 		return err
 	}
-	public, err := publicURL()
+	log.Init(log.ConfigFromEnv())
+	public, err := processconfig.PublicURL()
 	if err != nil {
 		return err
 	}
-	concurrency, err := executionConcurrency()
+	concurrency, err := processconfig.ExecutionConcurrency()
 	if err != nil {
 		return err
 	}
@@ -103,6 +113,12 @@ func run() error {
 	}
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()
+	migrating, cancelMigration := context.WithTimeout(ctx, 2*time.Minute)
+	err = migrations.Apply(migrating, databaseURL)
+	cancelMigration()
+	if err != nil {
+		return fmt.Errorf("Agents API database migration failed: %w", err)
+	}
 	pool, err := pgxpool.New(ctx, databaseURL)
 	if err != nil {
 		return errors.New("invalid Agents API database configuration")
@@ -113,11 +129,11 @@ func run() error {
 	if err := pool.Ping(ready); err != nil {
 		return errors.New("Agents API database connection failed")
 	}
-	engine := os.Getenv("OAC_DEFAULT_HARNESS")
-	if engine == "" {
-		engine = "codex"
+	engine, err := processconfig.DefaultHarness()
+	if err != nil {
+		return err
 	}
-	kinds, err := enabledHarnesses(engine)
+	kinds, err := processconfig.Harnesses(engine)
 	if err != nil {
 		return err
 	}
@@ -280,13 +296,7 @@ func run() error {
 		}
 		defer runtime.CloseConnections(registry)
 		var catalog *nativeinstaller.Catalog
-		directory := os.Getenv("OAC_NATIVE_INSTALLER_DIR")
-		if directory == "" {
-			if _, err := os.Stat("/opt/oac/native-installers/catalog.json"); err == nil {
-				directory = "/opt/oac/native-installers"
-			}
-		}
-		if directory != "" {
+		if directory := os.Getenv("OAC_NATIVE_INSTALLER_DIR"); directory != "" {
 			catalog, err = nativeinstaller.Load(directory, buildRevision)
 			if err != nil {
 				return err
diff --git a/services/core/cmd/server/managed_nodes.go b/services/core/cmd/server/managed_nodes.go
index dc9a667ff..8e9add39e 100644
--- a/services/core/cmd/server/managed_nodes.go
+++ b/services/core/cmd/server/managed_nodes.go
@@ -10,10 +10,10 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/execution"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/persistence/postgres/pgunit"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/processconfig"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox/node"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox/providers"
-	"github.com/google/uuid"
 )
 
 type managedNodes struct {
@@ -29,16 +29,12 @@ type managedNodes struct {
 // deployment service; the owner epoch that fences connections and the
 // allocations each generation retains are read from the deployment reader.
 func configureManagedNodes(nodes *deployment.Service, reader deployment.Reader, registry *providers.Registry, publicURL string, owner func(context.Context) error) (*managedNodes, error) {
-	setupID := os.Getenv("OAC_INSTALLATION_ID")
-	if setupID == "" {
-		return nil, nil
-	}
-	id, err := uuid.Parse(setupID)
-	if err != nil || id == uuid.Nil || id.String() != setupID {
-		return nil, errors.New("sandbox installation ID must be a canonical UUID")
+	setupID, err := processconfig.InstallationID()
+	if err != nil || setupID == "" {
+		return nil, err
 	}
 	if publicURL == "" {
-		return nil, errors.New("OAC_INSTALLATION_ID requires OAC_PUBLIC_URL, the origin nodes and sandboxes use to reach Core")
+		return nil, errors.New("OAC_INSTALLATION_ID_FILE requires OAC_PUBLIC_URL, the origin nodes and sandboxes use to reach Core")
 	}
 	closeProvider := func() {}
 	result := &managedNodes{closeProvider: closeProvider}
diff --git a/services/core/cmd/server/managed_setup_test.go b/services/core/cmd/server/managed_setup_test.go
index 4f117624e..efc656985 100644
--- a/services/core/cmd/server/managed_setup_test.go
+++ b/services/core/cmd/server/managed_setup_test.go
@@ -27,7 +27,11 @@ import (
 )
 
 func TestWebSetupCreatesManagerWithoutLocalProvider(t *testing.T) {
-	t.Setenv("OAC_INSTALLATION_ID", uuid.NewString())
+	idFile := filepath.Join(t.TempDir(), "installation.id")
+	if err := os.WriteFile(idFile, []byte(uuid.NewString()+"\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("OAC_INSTALLATION_ID_FILE", idFile)
 	digest := sha256.Sum256([]byte("synthetic-admin"))
 	path := filepath.Join(t.TempDir(), "core-key-digests.json")
 	if err := os.WriteFile(path, []byte(`["`+hex.EncodeToString(digest[:])+`"]`), 0600); err != nil {
diff --git a/services/core/cmd/server/process_configuration.go b/services/core/cmd/server/process_configuration.go
index 4b41c3be5..476973ac5 100644
--- a/services/core/cmd/server/process_configuration.go
+++ b/services/core/cmd/server/process_configuration.go
@@ -1,58 +1,16 @@
 package main
 
 import (
-	"errors"
 	"os"
-	"path/filepath"
-	"strconv"
 
 	"github.com/MiniMax-AI/OpenAgentCore/internal/obs/log"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment"
-	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/execution"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 )
 
-func executionConcurrency() (int, error) {
-	value, explicit := os.LookupEnv("OAC_EXECUTION_CONCURRENCY")
-	if !explicit {
-		return execution.DefaultExecutionConcurrency, nil
-	}
-	limit, err := strconv.Atoi(value)
-	if err != nil || limit < 1 || limit > 1024 {
-		return 0, errors.New("OAC_EXECUTION_CONCURRENCY must be an integer between 1 and 1024")
-	}
-	return limit, nil
-}
-
-func validateProcessConfiguration() error {
-	if path := os.Getenv("OAC_SETTINGS_FILE"); path != "" && !filepath.IsAbs(path) {
-		return errors.New("OAC_SETTINGS_FILE must be an absolute path")
-	}
-	return nil
-}
-
-// publicURL reads OAC_PUBLIC_URL, the one origin applications, nodes,
-// sandboxes and self-hosted executors use. An empty result disables daemon
-// transport, as for a Core without execution.
-func publicURL() (string, error) {
-	value := os.Getenv("OAC_PUBLIC_URL")
-	if value == "" {
-		return "", nil
-	}
-	if deployment.ValidateCoreURL(value) != nil {
-		return "", errors.New("OAC_PUBLIC_URL must be a canonical HTTPS origin without path, credentials, query or fragment, such as https://core.example; plain HTTP is accepted only for a loopback host")
-	}
-	return value, nil
-}
-
 // The launcher loads core.env. Core reports its sources without parsing another
 // configuration layer or logging environment values.
 func logConfigurationSources() {
-	if path := os.Getenv("OAC_SETTINGS_FILE"); path != "" {
-		log.Bg().Info("Core process configuration from the installer", "settings", path)
-	} else {
-		log.Bg().Info("Core process configuration loaded from the process environment")
-	}
+	log.Bg().Info("Core process configuration loaded from the process environment")
 	for _, key := range []string{"OAC_HISTORY_SETTINGS_FILE"} {
 		if path := os.Getenv(key); path != "" {
 			log.Bg().Info("Core auxiliary configuration", "setting", key, "path", path)
diff --git a/services/core/cmd/server/process_configuration_test.go b/services/core/cmd/server/process_configuration_test.go
index ff9f9ab21..a735035c1 100644
--- a/services/core/cmd/server/process_configuration_test.go
+++ b/services/core/cmd/server/process_configuration_test.go
@@ -4,6 +4,8 @@ import (
 	"os"
 	"strings"
 	"testing"
+
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/processconfig"
 )
 
 func TestExecutionConcurrencyConfiguration(t *testing.T) {
@@ -11,18 +13,22 @@ func TestExecutionConcurrencyConfiguration(t *testing.T) {
 	if err := os.Unsetenv("OAC_EXECUTION_CONCURRENCY"); err != nil {
 		t.Fatal(err)
 	}
-	if got, err := executionConcurrency(); err != nil || got != 4 {
+	if got, err := processconfig.ExecutionConcurrency(); err != nil || got != 4 {
 		t.Fatal(got, err)
 	}
+	t.Setenv("OAC_EXECUTION_CONCURRENCY", "")
+	if got, err := processconfig.ExecutionConcurrency(); err != nil || got != 4 {
+		t.Fatal("empty concurrency did not keep the default", got, err)
+	}
 	for _, value := range []string{"1", "7", "1024"} {
 		t.Setenv("OAC_EXECUTION_CONCURRENCY", value)
-		if got, err := executionConcurrency(); err != nil || got < 1 {
+		if got, err := processconfig.ExecutionConcurrency(); err != nil || got < 1 {
 			t.Fatal(value, got, err)
 		}
 	}
-	for _, value := range []string{"", "0", "-1", "1025", "1.5", "secret-value"} {
+	for _, value := range []string{"0", "-1", "1025", "1.5", "secret-value"} {
 		t.Setenv("OAC_EXECUTION_CONCURRENCY", value)
-		if _, err := executionConcurrency(); err == nil || strings.Contains(err.Error(), "secret-value") {
+		if _, err := processconfig.ExecutionConcurrency(); err == nil || strings.Contains(err.Error(), "secret-value") {
 			t.Fatal("invalid concurrency accepted or echoed", err)
 		}
 	}
@@ -31,13 +37,13 @@ func TestExecutionConcurrencyConfiguration(t *testing.T) {
 func TestPublicURLMustBeACanonicalOrigin(t *testing.T) {
 	for _, value := range []string{"https://core.example", "https://core.example:8443", "http://127.0.0.1:8091"} {
 		t.Setenv("OAC_PUBLIC_URL", value)
-		if got, err := publicURL(); err != nil || got != value {
+		if got, err := processconfig.PublicURL(); err != nil || got != value {
 			t.Fatal(value, got, err)
 		}
 	}
 	for _, value := range []string{"https://core.example/", "https://Core.example", "http://core.example", "wss://core.example", "https://core.example/v1"} {
 		t.Setenv("OAC_PUBLIC_URL", value)
-		if _, err := publicURL(); err == nil {
+		if _, err := processconfig.PublicURL(); err == nil {
 			t.Fatal("accepted", value)
 		}
 	}
diff --git a/services/core/cmd/specification-contract/main.go b/services/core/cmd/specification-contract/main.go
index bb2d671c0..308224655 100644
--- a/services/core/cmd/specification-contract/main.go
+++ b/services/core/cmd/specification-contract/main.go
@@ -10,7 +10,7 @@ import (
 )
 
 func main() {
-	write := flag.Bool("write", false, "update deploy/install/node_spec.py from the repository root")
+	write := flag.Bool("write", false, "update deploy/node/node_spec.py from the repository root")
 	flag.Parse()
 	projection, err := providers.Builtin().PythonDeploymentContract()
 	if err != nil {
@@ -21,7 +21,7 @@ func main() {
 		fmt.Println(projection)
 		return
 	}
-	path := "deploy/install/node_spec.py"
+	path := "deploy/node/node_spec.py"
 	raw, err := os.ReadFile(path)
 	if err != nil {
 		panic(err)
diff --git a/services/core/internal/api/installation.go b/services/core/internal/api/installation.go
index d7328cec3..081a3d7ee 100644
--- a/services/core/internal/api/installation.go
+++ b/services/core/internal/api/installation.go
@@ -16,10 +16,10 @@ import (
 )
 
 // Installation reports Core's installation facts. Core reads them from its
-// environment and build; configuration is the installer's settings snapshot.
+// environment and build; configuration is the process settings it loaded.
 type Installation struct {
 	Object string `json:"object" enums:"core.installation"`
-	// OAC_INSTALLATION_ID; null when Core runs without the sandbox manager.
+	// The ID in OAC_INSTALLATION_ID_FILE; null when Core runs without the sandbox manager.
 	InstallationID *string `json:"installation_id" extensions:"x-nullable"`
 	// OAC_PUBLIC_URL: the origin applications, nodes, sandboxes and self-hosted executors use. Null when unset.
 	PublicURL *string `json:"public_url" extensions:"x-nullable"`
@@ -29,20 +29,22 @@ type Installation struct {
 	LocalOnly bool `json:"local_only"`
 	// Full source commit Core was built from; null for development builds.
 	SourceCommit *string `json:"source_commit" extensions:"x-nullable"`
-	// The installer's settings snapshot (OAC_SETTINGS_FILE); null when the installer did not start Core.
+	// The process settings Core loaded. path and apply_command are empty, and applied_at is null, because Core reports its environment rather than an installer file.
 	Configuration   *InstallationConfiguration `json:"configuration" extensions:"x-nullable"`
 	AddressBindings deployment.AddressBindings `json:"address_bindings"`
 }
 
-// InstallationConfiguration says where process settings are changed and what
-// the last applied values were. Sensitive values are never included.
+// InstallationConfiguration is the process settings Core loaded. Path and
+// ApplyCommand are empty, and AppliedAt is null, unless a caller built a
+// snapshot itself.
 type InstallationConfiguration struct {
-	// Absolute host path of the installation's config.json.
+	// Absolute host path of config.json. Empty when Core reports its own environment.
 	Path string `json:"path"`
-	// Command that applies config.json changes.
-	ApplyCommand string                `json:"apply_command"`
-	AppliedAt    time.Time             `json:"applied_at"`
-	Settings     []InstallationSetting `json:"settings"`
+	// Command that applies config.json changes. Empty when Core reports its own environment.
+	ApplyCommand string `json:"apply_command"`
+	// Null when Core reports its own environment.
+	AppliedAt *time.Time            `json:"applied_at" extensions:"x-nullable"`
+	Settings  []InstallationSetting `json:"settings"`
 }
 
 type InstallationSetting struct {
@@ -68,7 +70,7 @@ const maxInstallationSettings = 64 << 10
 // A sensitive setting that carries a value is rejected, so the snapshot cannot
 // leak a secret through this read.
 func ParseInstallationConfiguration(raw []byte) (*InstallationConfiguration, error) {
-	invalid := errors.New("OAC_SETTINGS_FILE must contain the installer's settings snapshot")
+	invalid := errors.New("installation configuration is invalid")
 	if len(raw) > maxInstallationSettings {
 		return nil, invalid
 	}
@@ -78,7 +80,10 @@ func ParseInstallationConfiguration(raw []byte) (*InstallationConfiguration, err
 	if decoder.Decode(&value) != nil || decoder.Decode(new(any)) != io.EOF {
 		return nil, invalid
 	}
-	if !filepath.IsAbs(value.Path) || value.ApplyCommand == "" || len(value.ApplyCommand) > 4096 || value.AppliedAt.IsZero() || value.Settings == nil {
+	if value.Path != "" && !filepath.IsAbs(value.Path) || len(value.ApplyCommand) > 4096 || value.Settings == nil {
+		return nil, invalid
+	}
+	if value.Path != "" && (value.ApplyCommand == "" || value.AppliedAt == nil || value.AppliedAt.IsZero()) {
 		return nil, invalid
 	}
 	seen := make(map[string]bool, len(value.Settings))
@@ -103,7 +108,7 @@ type InstallationBindings interface {
 }
 
 // @Summary Retrieve installation facts and process settings
-// @Description Core key only; available before any sandbox deployment exists. Reports the public URL that applications, nodes, sandboxes and self-hosted executors use, the API base URL, Core's source commit and installation ID, the installer's settings snapshot with where to change it, and what is bound to the current public URL. Sensitive settings report only whether they are configured.
+// @Description Core key only; available before any sandbox deployment exists. Reports the public URL that applications, nodes, sandboxes and self-hosted executors use, the API base URL, Core's source commit and installation ID, the process settings Core loaded, and what is bound to the current public URL. Sensitive settings report only whether they are configured.
 // @Tags Core Administration
 // @Produce json
 // @Security DeploymentAdminAuth
diff --git a/services/core/internal/deployment/rules_test.go b/services/core/internal/deployment/rules_test.go
index 8cefc2f86..196e4586b 100644
--- a/services/core/internal/deployment/rules_test.go
+++ b/services/core/internal/deployment/rules_test.go
@@ -13,8 +13,6 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 )
 
-// deploy/install/test_install.py checks valid_core_origin against the same
-// cases.
 func TestValidateCoreURL(t *testing.T) {
 	for _, value := range []string{"https://core.example", "https://core.example:8443", "http://localhost:8091", "http://127.0.0.2:8091", "http://[::1]:8091", "https://[2001:db8::1]"} {
 		if err := ValidateCoreURL(value); err != nil {
diff --git a/services/core/internal/processconfig/config.go b/services/core/internal/processconfig/config.go
new file mode 100644
index 000000000..d846819eb
--- /dev/null
+++ b/services/core/internal/processconfig/config.go
@@ -0,0 +1,234 @@
+// Package processconfig is the process settings Core loads from its environment.
+// Startup and `oac-core check-config` both call Check. Settings reports the
+// effective values for GET /core/v1/installation. Errors name the variable and
+// never include its value.
+package processconfig
+
+import (
+	"os"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/api"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/engine"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/execution"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/oauthrefresh"
+)
+
+// Check validates every process setting Core loads. An unset or empty
+// variable keeps its default, so Compose can pass every setting through.
+func Check() error {
+	if _, err := PublicURL(); err != nil {
+		return err
+	}
+	if _, err := ExecutionConcurrency(); err != nil {
+		return err
+	}
+	if _, err := InstallationID(); err != nil {
+		return err
+	}
+	engineName, err := DefaultHarness()
+	if err != nil {
+		return err
+	}
+	if _, err := Harnesses(engineName); err != nil {
+		return err
+	}
+	if _, err := writeAuditRetention(); err != nil {
+		return err
+	}
+	if err := oauthOrigins(); err != nil {
+		return err
+	}
+	return logSettings()
+}
+
+// Settings is the effective process configuration. Sensitive file settings
+// report only whether they are configured.
+func Settings() ([]api.InstallationSetting, error) {
+	if err := Check(); err != nil {
+		return nil, err
+	}
+	public, _ := PublicURL()
+	concurrency, _ := ExecutionConcurrency()
+	engineName, _ := DefaultHarness()
+	enabled, _ := Harnesses(engineName)
+	retention := "2160h"
+	if value := os.Getenv("OAC_WRITE_AUDIT_RETENTION"); value != "" {
+		retention = value
+	}
+	level, format, addSource := logValues()
+	history := os.Getenv("OAC_HISTORY_SETTINGS_FILE") != ""
+	origins := []string{}
+	if raw := os.Getenv("OAC_OAUTH_TRUSTED_ORIGINS"); raw != "" {
+		for _, origin := range strings.Split(raw, ",") {
+			if origin = strings.TrimSpace(origin); origin != "" {
+				origins = append(origins, origin)
+			}
+		}
+	}
+	var publicValue any
+	if public != "" {
+		publicValue = public
+	}
+	return []api.InstallationSetting{
+		setting("public_url", publicValue, nil, true, []string{"core", "web"}),
+		setting("log.level", level, "info", true, []string{"core", "web"}),
+		setting("log.format", format, "auto", true, []string{"core", "web"}),
+		setting("log.add_source", addSource, false, true, []string{"core", "web"}),
+		setting("core.execution_concurrency", concurrency, execution.DefaultExecutionConcurrency, true, []string{"core"}),
+		setting("core.harnesses", enabled, (engine.Catalog{}).Kinds(), true, []string{"core"}),
+		setting("core.default_harness", engineName, "codex", true, []string{"core"}),
+		setting("core.write_audit_retention", retention, "2160h", true, []string{"core"}),
+		setting("core.oauth_trusted_origins", origins, []string{}, true, []string{"core"}),
+		sensitive("core.runtime_history", history, []string{"core"}),
+	}, nil
+}
+
+func setting(key string, value, fallback any, changeable bool, restarts []string) api.InstallationSetting {
+	return api.InstallationSetting{Key: key, Value: value, Default: fallback, Changeable: changeable, Sensitive: false, Restarts: restarts}
+}
+
+func sensitive(key string, configured bool, restarts []string) api.InstallationSetting {
+	return api.InstallationSetting{Key: key, Configured: &configured, Changeable: true, Sensitive: true, Restarts: restarts}
+}
+
+// PublicURL reads OAC_PUBLIC_URL, the one origin applications, nodes,
+// sandboxes and self-hosted executors use. An empty result disables daemon
+// transport, as for a Core without execution.
+func PublicURL() (string, error) {
+	value := os.Getenv("OAC_PUBLIC_URL")
+	if value == "" {
+		return "", nil
+	}
+	if deployment.ValidateCoreURL(value) != nil {
+		return "", configErr("OAC_PUBLIC_URL must be a canonical HTTPS origin without path, credentials, query or fragment, such as https://core.example; plain HTTP is accepted only for a loopback host")
+	}
+	return value, nil
+}
+
+// InstallationID reads the file named by OAC_INSTALLATION_ID_FILE. The ID
+// enables the sandbox deployment and node routes; unset leaves them off.
+func InstallationID() (string, error) {
+	path := os.Getenv("OAC_INSTALLATION_ID_FILE")
+	if path == "" {
+		return "", nil
+	}
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return "", configErr("OAC_INSTALLATION_ID_FILE must name a readable file")
+	}
+	value := strings.TrimSpace(string(raw))
+	if id, err := uuid.Parse(value); err != nil || id == uuid.Nil || id.String() != value {
+		return "", configErr("OAC_INSTALLATION_ID_FILE must contain a canonical UUID")
+	}
+	return value, nil
+}
+
+// ExecutionConcurrency reads OAC_EXECUTION_CONCURRENCY. Unset or empty keeps
+// the default.
+func ExecutionConcurrency() (int, error) {
+	value := os.Getenv("OAC_EXECUTION_CONCURRENCY")
+	if value == "" {
+		return execution.DefaultExecutionConcurrency, nil
+	}
+	limit, err := strconv.Atoi(value)
+	if err != nil || limit < 1 || limit > 1024 {
+		return 0, configErr("OAC_EXECUTION_CONCURRENCY must be an integer between 1 and 1024")
+	}
+	return limit, nil
+}
+
+// DefaultHarness reads OAC_DEFAULT_HARNESS, the Harness used when a request
+// names none.
+func DefaultHarness() (string, error) {
+	value := os.Getenv("OAC_DEFAULT_HARNESS")
+	if value == "" {
+		return "codex", nil
+	}
+	if _, known := (engine.Catalog{}).Lookup(value); !known {
+		return "", configErr("OAC_DEFAULT_HARNESS is not a known harness")
+	}
+	return value, nil
+}
+
+// Harnesses reads OAC_HARNESSES. Unset enables every Harness this build
+// supports; a list supplements the default Harness.
+func Harnesses(defaultEngine string) ([]string, error) {
+	kinds := []string{defaultEngine}
+	if value := os.Getenv("OAC_HARNESSES"); value != "" {
+		kinds = append(kinds, strings.Split(value, ",")...)
+	} else {
+		kinds = append(kinds, (engine.Catalog{}).Kinds()...)
+	}
+	for i, kind := range kinds {
+		kind = strings.TrimSpace(kind)
+		if _, known := (engine.Catalog{}).Lookup(kind); !known {
+			return nil, configErr("OAC_HARNESSES contains an unknown harness")
+		}
+		kinds[i] = kind
+	}
+	slices.Sort(kinds)
+	return slices.Compact(kinds), nil
+}
+
+func writeAuditRetention() (time.Duration, error) {
+	value := os.Getenv("OAC_WRITE_AUDIT_RETENTION")
+	if value == "" {
+		return 90 * 24 * time.Hour, nil
+	}
+	duration, parseErr := time.ParseDuration(value)
+	if parseErr != nil || duration < time.Hour {
+		return 0, configErr("OAC_WRITE_AUDIT_RETENTION must be a duration of at least 1h")
+	}
+	return duration, nil
+}
+
+func oauthOrigins() error {
+	var origins []string
+	if raw := os.Getenv("OAC_OAUTH_TRUSTED_ORIGINS"); raw != "" {
+		for _, origin := range strings.Split(raw, ",") {
+			origins = append(origins, strings.TrimSpace(origin))
+		}
+	}
+	if _, err := oauthrefresh.NewClient(origins); err != nil {
+		return configErr("OAC_OAUTH_TRUSTED_ORIGINS is invalid")
+	}
+	return nil
+}
+
+func logSettings() error {
+	if value, ok := os.LookupEnv("OAC_LOG_LEVEL"); ok && value != "" && !slices.Contains([]string{"debug", "info", "warn", "warning", "error", "err"}, strings.ToLower(strings.TrimSpace(value))) {
+		return configErr("OAC_LOG_LEVEL must be debug, info, warn or error")
+	}
+	if value, ok := os.LookupEnv("OAC_LOG_FORMAT"); ok && value != "" && !slices.Contains([]string{"auto", "json", "text"}, strings.ToLower(strings.TrimSpace(value))) {
+		return configErr("OAC_LOG_FORMAT must be auto, json or text")
+	}
+	if value, ok := os.LookupEnv("OAC_LOG_ADD_SOURCE"); ok && value != "" && value != "0" && value != "1" {
+		return configErr("OAC_LOG_ADD_SOURCE must be 0 or 1")
+	}
+	return nil
+}
+
+func logValues() (string, string, bool) {
+	level := "info"
+	if value := strings.ToLower(strings.TrimSpace(os.Getenv("OAC_LOG_LEVEL"))); value != "" {
+		level = value
+	}
+	format := "auto"
+	if value := strings.ToLower(strings.TrimSpace(os.Getenv("OAC_LOG_FORMAT"))); value != "" {
+		format = value
+	}
+	return level, format, os.Getenv("OAC_LOG_ADD_SOURCE") == "1"
+}
+
+type configError string
+
+func (e configError) Error() string { return string(e) }
+
+func configErr(message string) error { return configError(message) }
diff --git a/services/core/internal/processconfig/config_test.go b/services/core/internal/processconfig/config_test.go
new file mode 100644
index 000000000..9f8dfa533
--- /dev/null
+++ b/services/core/internal/processconfig/config_test.go
@@ -0,0 +1,69 @@
+package processconfig
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestCheckRejectsInvalidValuesWithoutEchoingThem(t *testing.T) {
+	secret := "https://user:synthetic-secret@core.example"
+	t.Setenv("OAC_PUBLIC_URL", secret)
+	err := Check()
+	if err == nil || strings.Contains(err.Error(), "synthetic-secret") || !strings.Contains(err.Error(), "OAC_PUBLIC_URL") {
+		t.Fatal(err)
+	}
+	t.Setenv("OAC_PUBLIC_URL", "")
+	t.Setenv("OAC_EXECUTION_CONCURRENCY", "0")
+	if err := Check(); err == nil || !strings.Contains(err.Error(), "OAC_EXECUTION_CONCURRENCY") || strings.Contains(err.Error(), "synthetic") {
+		t.Fatal(err)
+	}
+	t.Setenv("OAC_EXECUTION_CONCURRENCY", "4")
+	t.Setenv("OAC_LOG_LEVEL", "verbose")
+	if err := Check(); err == nil || !strings.Contains(err.Error(), "OAC_LOG_LEVEL") {
+		t.Fatal(err)
+	}
+}
+
+func TestSettingsReportEffectiveValuesAndHideHistory(t *testing.T) {
+	t.Setenv("OAC_PUBLIC_URL", "https://core.example")
+	t.Setenv("OAC_EXECUTION_CONCURRENCY", "8")
+	t.Setenv("OAC_HISTORY_SETTINGS_FILE", "/tmp/history.json")
+	settings, err := Settings()
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := map[string]any{}
+	for _, setting := range settings {
+		if setting.Sensitive && (setting.Value != nil || setting.Configured == nil) {
+			t.Fatalf("sensitive setting %s leaked a value", setting.Key)
+		}
+		found[setting.Key] = setting.Value
+		if setting.Key == "core.runtime_history" && (setting.Configured == nil || !*setting.Configured) {
+			t.Fatal("history file was not reported as configured")
+		}
+	}
+	if found["public_url"] != "https://core.example" || found["core.execution_concurrency"] != 8 {
+		t.Fatal(found)
+	}
+}
+
+func TestHarnessesDefaultToEveryQualifiedHarness(t *testing.T) {
+	t.Setenv("OAC_DEFAULT_HARNESS", "")
+	t.Setenv("OAC_HARNESSES", "")
+	engineName, err := DefaultHarness()
+	if err != nil || engineName != "codex" {
+		t.Fatal(engineName, err)
+	}
+	kinds, err := Harnesses(engineName)
+	if err != nil || strings.Join(kinds, ",") != "claude_sdk,codex,mcode" {
+		t.Fatal(kinds, err)
+	}
+	t.Setenv("OAC_HARNESSES", "mcode")
+	if kinds, err = Harnesses("codex"); err != nil || strings.Join(kinds, ",") != "codex,mcode" {
+		t.Fatal(kinds, err)
+	}
+	t.Setenv("OAC_HARNESSES", "unqualified")
+	if _, err = Harnesses("codex"); err == nil {
+		t.Fatal("unqualified harness enabled")
+	}
+}
diff --git a/services/core/internal/sandbox/microsandbox/process_test.go b/services/core/internal/sandbox/microsandbox/process_test.go
index ed06dc6a5..68021cd2d 100644
--- a/services/core/internal/sandbox/microsandbox/process_test.go
+++ b/services/core/internal/sandbox/microsandbox/process_test.go
@@ -323,7 +323,7 @@ func TestGenerationLeaseReplacementRejectedAfterRestart(t *testing.T) {
 
 func TestPythonAndGoUseTheSameDurableLease(t *testing.T) {
 	root := t.TempDir()
-	installer, err := filepath.Abs("../../../../../deploy/install")
+	installer, err := filepath.Abs("../../../../../deploy/node")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/services/core/internal/sandbox/providers/artifacts_test.go b/services/core/internal/sandbox/providers/artifacts_test.go
index 0857454f5..5e29329af 100644
--- a/services/core/internal/sandbox/providers/artifacts_test.go
+++ b/services/core/internal/sandbox/providers/artifacts_test.go
@@ -22,7 +22,7 @@ func TestArtifactProjectionsMatchRegistrations(t *testing.T) {
 	if !reflect.DeepEqual(catalog, providerassets.Catalog()) {
 		t.Fatal("stale Web artifact projection; regenerate provider-artifacts")
 	}
-	raw, err := os.ReadFile("../../../../../deploy/install/provider_assets.py")
+	raw, err := os.ReadFile("../../../../../deploy/node/provider_assets.py")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/services/core/internal/sandbox/providers/deployment_contract_test.go b/services/core/internal/sandbox/providers/deployment_contract_test.go
index ad8b4b414..15e80b5e4 100644
--- a/services/core/internal/sandbox/providers/deployment_contract_test.go
+++ b/services/core/internal/sandbox/providers/deployment_contract_test.go
@@ -11,7 +11,7 @@ import (
 
 func TestInstallerDeploymentProjectionIsCurrent(t *testing.T) {
 	registry := Builtin()
-	raw, err := os.ReadFile("../../../../../deploy/install/node_spec.py")
+	raw, err := os.ReadFile("../../../../../deploy/node/node_spec.py")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/services/core/internal/store/runtime_compute_lifecycle_test.go b/services/core/internal/store/runtime_compute_lifecycle_test.go
index 0474be944..4e175095b 100644
--- a/services/core/internal/store/runtime_compute_lifecycle_test.go
+++ b/services/core/internal/store/runtime_compute_lifecycle_test.go
@@ -17,6 +17,7 @@ import (
 	"github.com/MiniMax-AI/OpenAgentCore/internal/agentdaemon/proto/prototest"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/deployment"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/execution"
+	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/persistence/postgres/pgunit"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/runtimegateway"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sandbox"
 	"github.com/MiniMax-AI/OpenAgentCore/services/core/internal/sessions"
@@ -291,7 +292,21 @@ func newComputeLifecycleFixture(t *testing.T, maxActive, maxRetained int) *compu
 func (f *computeLifecycleFixture) start() {
 	t := f.t
 	t.Helper()
-	w := startWorker(t, t.Context(), f.db, &execution.Dispatcher{Store: f.store, Registry: f.provider.registry, ManagedRuntimes: &execution.RuntimeProvider{CoreURL: "http://core.invalid/api/v1", InstallationID: f.key, BackendFingerprint: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", Provider: f.provider, Suspension: &f.policy}})
+	dispatcher := &execution.Dispatcher{Store: f.store, Registry: f.provider.registry, ManagedRuntimes: &execution.RuntimeProvider{CoreURL: "http://core.invalid/api/v1", InstallationID: f.key, BackendFingerprint: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", Provider: f.provider, Suspension: &f.policy}}
+	// Closing the previous Worker's connection can return before PostgreSQL drops its advisory lock.
+	deadline := time.Now().Add(2 * time.Second)
+	var w *execution.Worker
+	var err error
+	for {
+		w, err = startWorkerErr(t.Context(), f.db, dispatcher)
+		if err == nil || !errors.Is(err, pgunit.ErrLeaseHeld) || !time.Now().Before(deadline) {
+			break
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+	if err != nil {
+		t.Fatal(err)
+	}
 	var once sync.Once
 	stop := func() {
 		once.Do(func() { ctx, cancel := context.WithCancel(context.Background()); cancel(); _ = w.Run(ctx) })
diff --git a/services/core/migrations/migrations.go b/services/core/migrations/migrations.go
index 0cb542014..b3802d763 100644
--- a/services/core/migrations/migrations.go
+++ b/services/core/migrations/migrations.go
@@ -8,19 +8,26 @@ import (
 
 	_ "github.com/jackc/pgx/v5/stdlib"
 	"github.com/pressly/goose/v3"
+	"github.com/pressly/goose/v3/lock"
 )
 
 //go:embed *.sql
 var files embed.FS
 
-// Apply upgrades the dedicated execution database without consulting product data.
+// Apply upgrades the dedicated execution database without consulting product
+// data. A session advisory lock serializes concurrent Core starts.
 func Apply(ctx context.Context, databaseURL string) error {
 	db, err := sql.Open("pgx", databaseURL)
 	if err != nil {
 		return err
 	}
 	defer db.Close()
-	provider, err := goose.NewProvider(goose.DialectPostgres, db, files, goose.WithTableName("agents_api_schema_version"))
+	locker, err := lock.NewPostgresSessionLocker()
+	if err != nil {
+		return err
+	}
+	provider, err := goose.NewProvider(goose.DialectPostgres, db, files,
+		goose.WithTableName("agents_api_schema_version"), goose.WithSessionLocker(locker))
 	if err != nil {
 		return err
 	}
diff --git a/services/web/config.go b/services/web/config.go
index 24adac23b..cd2f2413f 100644
--- a/services/web/config.go
+++ b/services/web/config.go
@@ -15,8 +15,6 @@ type config struct {
 	addr, origin, dist      string
 	coreKey, nodePayloadDir string
 	upstream                *url.URL
-	installationSocket      string
-	bootstrap               bool
 }
 
 func loadConfig() (config, error) {
@@ -47,18 +45,6 @@ func loadConfig() (config, error) {
 	if c.nodePayloadDir != "" && !filepath.IsAbs(c.nodePayloadDir) {
 		return config{}, errors.New("OAC_WEB_NODE_PAYLOAD_DIR must be absolute")
 	}
-	c.installationSocket = os.Getenv("OAC_WEB_INSTALLATION_SOCKET")
-	if c.installationSocket != "" && !filepath.IsAbs(c.installationSocket) {
-		return config{}, errors.New("OAC_WEB_INSTALLATION_SOCKET must be absolute")
-	}
-	bootstrap := envDefault("OAC_WEB_BOOTSTRAP", "0")
-	if bootstrap != "0" && bootstrap != "1" {
-		return config{}, errors.New("OAC_WEB_BOOTSTRAP must be 0 or 1")
-	}
-	c.bootstrap = bootstrap == "1"
-	if c.bootstrap && (origin.Scheme != "http" || c.installationSocket == "") {
-		return config{}, errors.New("HTTP bootstrap requires installation management and an HTTP origin")
-	}
 	return c, nil
 }
 
diff --git a/services/web/config_test.go b/services/web/config_test.go
index 5274a7a7e..ae1e3ccac 100644
--- a/services/web/config_test.go
+++ b/services/web/config_test.go
@@ -49,3 +49,17 @@ func TestConfigRejectsUnsafeURLsAndSecretFiles(t *testing.T) {
 		t.Fatal("publicly readable secret accepted")
 	}
 }
+
+func TestBootstrapFollowsManagedHTTPOrigin(t *testing.T) {
+	directory := t.TempDir()
+	key := filepath.Join(directory, "core.key")
+	if err := os.WriteFile(key, []byte(strings.Repeat("k", 32)), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("OAC_WEB_CORE_KEY_FILE", key)
+	t.Setenv("OAC_WEB_DIST", directory)
+	t.Setenv("OAC_WEB_ORIGIN", "http://localhost:8080")
+	if _, err := loadConfig(); err != nil {
+		t.Fatal(err)
+	}
+}
diff --git a/services/web/core_errors_test.go b/services/web/core_errors_test.go
index ec2aed1b9..67c938e7b 100644
--- a/services/web/core_errors_test.go
+++ b/services/web/core_errors_test.go
@@ -62,7 +62,7 @@ func TestCoreProxyPreservesUpstreamEnvelopeAndAuthShape(t *testing.T) {
 	if out.Code != 409 || out.Body.String() != upstream || calls.Load() != 1 {
 		t.Fatal(out.Code, out.Body, calls.Load())
 	}
-	for _, path := range []string{"/core", "/core/", "/core/v1", "/core/retired", "/v1/agents", "/api/v1/sandbox-node/configuration"} {
+	for _, path := range []string{"/core", "/core/", "/core/v1", "/core/retired"} {
 		out := authRequest(h, "GET", path, "", cookie)
 		if out.Code != 404 || calls.Load() != 1 {
 			t.Fatal("non-operation became proxyable", path, out.Code, calls.Load())
diff --git a/services/web/core_routes.go b/services/web/core_routes.go
index cba40dd34..1117f270b 100644
--- a/services/web/core_routes.go
+++ b/services/web/core_routes.go
@@ -5,11 +5,11 @@ import (
 	"strings"
 )
 
-// coreDirectRequest reports the application (/v1) and machine connection
-// (/api/v1) namespaces. The reverse proxy routes them straight to Core; the
-// console never forwards them, whatever credential they carry.
+// coreDirectRequest reports the application (/v1), machine connection
+// (/api/v1) and API reference (/docs) namespaces. The console forwards them
+// to Core unchanged and adds no credential of its own.
 func coreDirectRequest(r *http.Request) bool {
-	for _, prefix := range []string{"/v1", "/api/v1"} {
+	for _, prefix := range []string{"/v1", "/api/v1", "/docs"} {
 		if r.URL.Path == prefix || strings.HasPrefix(r.URL.Path, prefix+"/") {
 			return true
 		}
diff --git a/services/web/installation.go b/services/web/installation.go
index b37b97dec..988208748 100644
--- a/services/web/installation.go
+++ b/services/web/installation.go
@@ -1,90 +1,12 @@
 package main
 
-import (
-	"context"
-	"encoding/json"
-	"io"
-	"net"
-	"net/http"
-	"strconv"
-	"strings"
-	"time"
-)
+import "net/http"
 
-// Installation control is a narrow authenticated Unix-socket request. Neither
-// the console nor Core receives a Docker socket or arbitrary installer commands.
-func (h *console) serveInstallationDomain(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet && r.Method != http.MethodPost {
-		w.Header().Set("Allow", "GET, POST")
-		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-	if h.installationSocket == "" {
-		w.Header().Set("Content-Type", "application/json")
-		if r.Method == http.MethodPost {
-			consoleCoreError(w, http.StatusBadRequest, "domain_setup_unavailable", "This installation uses an external reverse proxy")
-			return
-		}
-		_ = json.NewEncoder(w).Encode(map[string]any{"supported": false, "state": "unconfigured", "public_url": nil, "target_url": nil,
-			"message": "This installation uses an external reverse proxy. Configure HTTPS there, then set public_url and run oac apply."})
-		return
-	}
-	body := http.MaxBytesReader(w, r.Body, 2048)
-	defer body.Close()
-	data, err := io.ReadAll(body)
-	if err != nil {
-		consoleCoreError(w, http.StatusBadRequest, "invalid_request", "Request body is too large")
-		return
-	}
-	ctx, cancel := context.WithTimeout(r.Context(), 20*time.Second)
-	defer cancel()
-	req, err := http.NewRequestWithContext(ctx, r.Method, "http://localhost/domain", strings.NewReader(string(data)))
-	if err != nil {
-		return
-	}
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Authorization", "Bearer "+h.coreKey)
-	transport := &http.Transport{DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
-		return (&net.Dialer{}).DialContext(ctx, "unix", h.installationSocket)
-	}}
-	defer transport.CloseIdleConnections()
-	response, err := transport.RoundTrip(req)
-	if err != nil {
-		consoleCoreError(w, http.StatusBadGateway, "installation_unreachable", "Installation management is unavailable; run oac status on the server")
-		return
-	}
-	defer response.Body.Close()
-	payload, err := io.ReadAll(io.LimitReader(response.Body, 16385))
-	if err != nil || len(payload) > 16384 || !json.Valid(payload) || response.StatusCode < 200 || response.StatusCode >= 500 {
-		consoleCoreError(w, http.StatusBadGateway, "installation_unreachable", "Installation management is unavailable; run oac status on the server")
-		return
-	}
-	w.Header().Set("Content-Type", "application/json")
-	w.Header().Set("Content-Length", strconv.Itoa(len(payload)))
-	w.WriteHeader(response.StatusCode)
-	_, _ = w.Write(payload)
-}
-
-// Only literal IP addresses are accepted during first-run HTTP setup. Hostnames
-// still require the configured origin, so DNS rebinding cannot open the console.
+// requestOrigin accepts only the configured origin, so a rebound DNS name
+// cannot open the console.
 func (h *console) requestOrigin(r *http.Request) string {
-	if h.bootstrap {
-		host, port, err := net.SplitHostPort(r.Host)
-		if err != nil {
-			host = r.Host
-			port = ""
-		}
-		if net.ParseIP(strings.Trim(host, "[]")) != nil && (port == "" || validPort(port)) {
-			return "http://" + r.Host
-		}
-	}
 	if r.Host == h.host {
 		return h.origin
 	}
 	return ""
 }
-
-func validPort(value string) bool {
-	port, err := strconv.Atoi(value)
-	return err == nil && port > 0 && port <= 65535
-}
diff --git a/services/web/installation_test.go b/services/web/installation_test.go
index d3e5021cb..445288a0c 100644
--- a/services/web/installation_test.go
+++ b/services/web/installation_test.go
@@ -1,83 +1,30 @@
 package main
 
 import (
-	"io"
-	"net"
 	"net/http"
 	"net/http/httptest"
-	"path/filepath"
-	"strings"
-	"sync/atomic"
 	"testing"
 )
 
-func TestBootstrapAcceptsOnlySameOriginLiteralIP(t *testing.T) {
-	h := &console{config: config{origin: "http://127.0.0.1:8080", bootstrap: true}, host: "127.0.0.1:8080"}
+func TestOnlyTheConfiguredOriginOpensTheConsole(t *testing.T) {
+	h := &console{config: config{origin: "http://127.0.0.1:8080"}, host: "127.0.0.1:8080"}
 	for _, tc := range []struct {
-		host, origin string
-		want         bool
+		host string
+		want bool
 	}{
-		{"203.0.113.10:8080", "http://203.0.113.10:8080", true},
-		{"[2001:db8::1]:8080", "http://[2001:db8::1]:8080", true},
-		{"evil.example:8080", "http://evil.example:8080", false},
-		{"203.0.113.10:8080", "http://evil.example:8080", false},
-		{"203.0.113.10:8080", "https://203.0.113.10:8080", false},
-		{"203.0.113.10:99999", "http://203.0.113.10:99999", false},
+		{"127.0.0.1:8080", true},
+		{"203.0.113.10:8080", false},
+		{"[2001:db8::1]:8080", false},
+		{"evil.example:8080", false},
 	} {
-		t.Run(tc.host+tc.origin, func(t *testing.T) {
-			r := httptest.NewRequest(http.MethodPost, "http://localhost/console/installation/domain", nil)
+		t.Run(tc.host, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, "http://"+tc.host+"/", nil)
 			r.Host = tc.host
-			r.Header.Set("Origin", tc.origin)
+			r.Header.Set("Origin", "http://"+tc.host)
+			r.Header.Set("Sec-Fetch-Site", "same-origin")
 			if got := h.sameOrigin(r); got != tc.want {
 				t.Fatalf("sameOrigin=%v, want %v", got, tc.want)
 			}
 		})
 	}
-	h.bootstrap = false
-	h.origin = "https://core.example"
-	h.host = "core.example"
-	r := httptest.NewRequest(http.MethodGet, "http://203.0.113.10:8080/", nil)
-	if h.sameOrigin(r) {
-		t.Fatal("bootstrap IP still accepted after HTTPS setup")
-	}
-}
-
-func TestInstallationDomainRequiresConsoleSessionAndUsesOnlyPrivateSocket(t *testing.T) {
-	socket := filepath.Join(t.TempDir(), "manager.sock")
-	listener, err := net.Listen("unix", socket)
-	if err != nil {
-		t.Fatal(err)
-	}
-	var calls atomic.Int32
-	manager := &http.Server{Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		calls.Add(1)
-		if r.URL.Path != "/domain" || r.Header.Get("Authorization") != "Bearer "+testCoreKey || r.Header.Get("Cookie") != "" {
-			t.Errorf("unexpected installer request: %s", r.URL.Path)
-		}
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusAccepted)
-		_, _ = io.WriteString(w, `{"supported":true,"state":"checking","target_url":"https://core.example"}`)
-	})}
-	go manager.Serve(listener)
-	t.Cleanup(func() { _ = manager.Close() })
-	c := coreKeyConsoleConfig(t, http.NotFoundHandler())
-	c.installationSocket = socket
-	h := startConsole(t, c)
-	if w := authRequest(h, "POST", "/console/installation/domain", `{"hostname":"core.example"}`, nil); w.Code != 401 {
-		t.Fatalf("unauthenticated: %d", w.Code)
-	}
-	cookie := signIn(t, h)
-	r := httptest.NewRequest("POST", "/console/installation/domain", strings.NewReader(`{"hostname":"core.example"}`))
-	r.Host = h.host
-	r.AddCookie(cookie)
-	r.Header.Set("Origin", "https://evil.example")
-	w := httptest.NewRecorder()
-	h.ServeHTTP(w, r)
-	if w.Code != 403 || calls.Load() != 0 {
-		t.Fatal("unauthenticated or cross-site request reached installer")
-	}
-	w = authRequest(h, "POST", "/console/installation/domain", `{"hostname":"core.example"}`, cookie)
-	if w.Code != 202 || calls.Load() != 1 {
-		t.Fatalf("authenticated setup: %d %s", w.Code, w.Body)
-	}
 }
diff --git a/services/web/main.go b/services/web/main.go
index 044e4e786..a2459d7a4 100644
--- a/services/web/main.go
+++ b/services/web/main.go
@@ -4,6 +4,7 @@ package main
 import (
 	"context"
 	"errors"
+	"fmt"
 	"net/http"
 	"os"
 	"os/signal"
@@ -14,12 +15,60 @@ import (
 )
 
 func main() {
+	if len(os.Args) == 2 && os.Args[1] == "core-key" {
+		if err := printCoreKey(); err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+		return
+	}
+	if len(os.Args) == 2 && os.Args[1] == "healthcheck" {
+		if err := healthcheck(); err != nil {
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+		return
+	}
 	if err := run(); err != nil {
 		log.Bg().Error("Core console stopped", "error", err)
 		os.Exit(1)
 	}
 }
 
+// printCoreKey writes the sign-in key for `docker compose exec web oac-web
+// core-key`. Exec output never enters the container log.
+func printCoreKey() error {
+	key, err := readSecret(envDefault("OAC_WEB_CORE_KEY_FILE", "/admin/core.key"))
+	if err != nil {
+		return errors.New("cannot read the Core key from OAC_WEB_CORE_KEY_FILE")
+	}
+	fmt.Println(key)
+	return nil
+}
+
+// healthcheck reports the installation healthy once Core and Web's own listener
+// answer. Compose runs it inside the web container.
+func healthcheck() error {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	client := &http.Client{Timeout: 3 * time.Second, Transport: &http.Transport{Proxy: nil}}
+	for _, host := range []string{"core:8091", "127.0.0.1:8080"} {
+		request, err := http.NewRequestWithContext(ctx, http.MethodGet, "http://"+host+"/healthz", nil)
+		if err != nil {
+			return err
+		}
+		response, err := client.Do(request)
+		if err != nil {
+			return err
+		}
+		response.Body.Close()
+		if response.StatusCode != http.StatusOK {
+			return fmt.Errorf("%s returned HTTP %d", host, response.StatusCode)
+		}
+	}
+	return nil
+}
+
 func run() error {
 	log.Init(log.ConfigFromEnv())
 	c, err := loadConfig()
diff --git a/services/web/node_installation_test.go b/services/web/node_installation_test.go
index 5c5c3edf1..5867e412a 100644
--- a/services/web/node_installation_test.go
+++ b/services/web/node_installation_test.go
@@ -18,7 +18,11 @@ func TestPairedConsoleProxiesOnlyAdministration(t *testing.T) {
 	var calls atomic.Int32
 	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		calls.Add(1)
-		if r.Header.Get("Authorization") != "Bearer server-admin" {
+		if r.URL.Path == "/api/v1/sandbox-node/enroll" {
+			if r.Header.Get("Authorization") != "Bearer node-token" {
+				t.Errorf("node credential was replaced for %s", r.URL.Path)
+			}
+		} else if r.Header.Get("Authorization") != "Bearer server-admin" {
 			t.Errorf("incorrect upstream authority for %s", r.URL.Path)
 		}
 		if r.URL.Path == "/core/v1/sandbox/deployment/maintenance" {
@@ -57,7 +61,7 @@ func TestPairedConsoleProxiesOnlyAdministration(t *testing.T) {
 		{"DELETE", "/core/v1/sandbox/deployment/reset?expected_generation=7", "none", 401},
 		{"GET", "/core/v1/sandbox/nodes", "node", 401},
 		{"GET", "/core/v1/projects", "session", 200},
-		{"POST", "/api/v1/sandbox-node/enroll", "node", 404},
+		{"POST", "/api/v1/sandbox-node/enroll", "node", 200},
 		{"GET", "/console/config", "session", 200},
 		{"GET", "/console/config", "none", 401},
 		{"GET", "/node-install/node-install.pyz", "none", 200},
@@ -90,7 +94,7 @@ func TestPairedConsoleProxiesOnlyAdministration(t *testing.T) {
 			t.Fatalf("console configuration = %s", body)
 		}
 	}
-	if calls.Load() != 6 {
+	if calls.Load() != 7 {
 		t.Fatalf("unexpected upstream requests: %d", calls.Load())
 	}
 	r := consoleRequest(t, server, "POST", "/core/v1/sandbox/deployment")
diff --git a/services/web/project_proxy_test.go b/services/web/project_proxy_test.go
index 307199d4a..218e24fd2 100644
--- a/services/web/project_proxy_test.go
+++ b/services/web/project_proxy_test.go
@@ -7,32 +7,47 @@ import (
 	"testing"
 )
 
-// Applications (/v1) and machines (/api/v1) reach Core directly through the
-// reverse proxy; the console forwards neither, whatever credential is presented.
-func TestCoreDirectRoutesNeverPassThroughConsole(t *testing.T) {
-	c := coreKeyConsoleConfig(t, http.HandlerFunc(func(http.ResponseWriter, *http.Request) { t.Error("direct Core route reached Core through console") }))
+// Applications (/v1) and machines (/api/v1) pass through the console to Core
+// with the caller's own credential. The console key is never added, and the
+// console's own routes stay local.
+func TestCoreDirectRoutesPassThroughWithCallerCredential(t *testing.T) {
+	var seen struct {
+		path, authorization string
+	}
+	c := coreKeyConsoleConfig(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		seen.path, seen.authorization = r.URL.Path, r.Header.Get("Authorization")
+		w.WriteHeader(204)
+	}))
 	h := startConsole(t, c)
 	cookie := signIn(t, h)
-	for _, path := range []string{"/v1", "/v1/agents", "/v1/agents/sessions", "/v1/files/file/content", "/console/api-keys",
+	for _, path := range []string{"/v1", "/v1/agents", "/v1/agents/sessions", "/v1/files/file/content",
 		"/api/v1", "/api/v1/sandbox-node/enroll", "/api/v1/sandbox-node/configuration", "/api/v1/sandbox-node/connect", "/api/v1/agent-daemon/enroll", "/api/v1/agent-daemon/ws"} {
 		for _, method := range []string{"GET", "POST", "DELETE"} {
 			for _, authorization := range []string{"", "Bearer project-key", "Bearer node-token", "Bearer " + testCoreKey, "Basic YWRtaW46cGFzc3dvcmQ="} {
 				for _, upgrade := range []string{"", "websocket"} {
 					r := httptest.NewRequest(method, path, strings.NewReader(`{}`))
-					r.Host = h.host
-					r.Header.Set("Origin", h.origin)
+					r.Host = "node.example"
 					r.Header.Set("Authorization", authorization)
 					r.Header.Set("Upgrade", upgrade)
 					r.AddCookie(cookie)
 					w := httptest.NewRecorder()
 					h.ServeHTTP(w, r)
-					if w.Code != 404 {
-						t.Errorf("%s %s upgrade=%q = %d", method, path, upgrade, w.Code)
+					if w.Code != 204 || seen.path != path || seen.authorization != authorization {
+						t.Errorf("%s %s upgrade=%q = %d, forwarded %s %s", method, path, upgrade, w.Code, seen.path, seen.authorization)
 					}
 				}
 			}
 		}
 	}
+	r := httptest.NewRequest("GET", "/console/api-keys", nil)
+	r.Host = h.host
+	r.Header.Set("Origin", h.origin)
+	r.AddCookie(cookie)
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, r)
+	if w.Code != 404 {
+		t.Errorf("/console/api-keys = %d", w.Code)
+	}
 }
 
 // Encoded or doubled separators and dot segments cannot turn a /core/v1
diff --git a/services/web/server.go b/services/web/server.go
index 60a92a641..c159fb603 100644
--- a/services/web/server.go
+++ b/services/web/server.go
@@ -18,7 +18,7 @@ type console struct {
 	root                *os.Root
 	nodePayload         *os.Root
 	nodeInstallerDigest string
-	proxy               *httputil.ReverseProxy
+	proxy, direct       *httputil.ReverseProxy
 	transport           *http.Transport
 	host                string
 	auth                *consoleAuth
@@ -57,6 +57,20 @@ func newConsole(c config) (*console, error) {
 	h.transport = http.DefaultTransport.(*http.Transport).Clone()
 	// Credentials go only to the configured Core, never an ambient HTTP proxy.
 	h.transport.Proxy = nil
+	// The default pool keeps two idle connections per host. Core is the only
+	// upstream, and sessions return here between messages.
+	h.transport.MaxIdleConnsPerHost = 64
+	// Application and machine traffic passes through unchanged. Core
+	// authenticates it; the console adds no credential of its own.
+	h.direct = &httputil.ReverseProxy{
+		Transport:     h.transport,
+		FlushInterval: -1,
+		ErrorLog:      stdlog.New(io.Discard, "", 0),
+		Rewrite:       func(r *httputil.ProxyRequest) { r.SetURL(c.upstream) },
+		ErrorHandler: func(w http.ResponseWriter, _ *http.Request, _ error) {
+			http.Error(w, "Core is unavailable", http.StatusBadGateway)
+		},
+	}
 	h.proxy = &httputil.ReverseProxy{
 		Transport:     h.transport,
 		FlushInterval: -1,
@@ -113,7 +127,20 @@ func (h *console) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		_, _ = io.WriteString(w, "ok\n")
 		return
 	}
-	if coreDirectRequest(r) || r.URL.Path == "/console/api-keys" || strings.HasPrefix(r.URL.Path, "/console/api-keys/") {
+	if coreDirectRequest(r) {
+		// These namespaces belong to applications and machines. Their
+		// credentials, streaming responses and WebSocket upgrades pass through
+		// unmodified, ahead of the console's own origin and session checks.
+		// Dot segments and empty segments are still refused, so a path cannot
+		// escape the namespace it arrived on.
+		if !safePath(r.URL.Path) || r.URL.IsAbs() {
+			http.Error(w, "Invalid request", http.StatusBadRequest)
+			return
+		}
+		h.direct.ServeHTTP(w, r)
+		return
+	}
+	if r.URL.Path == "/console/api-keys" || strings.HasPrefix(r.URL.Path, "/console/api-keys/") {
 		http.NotFound(w, r)
 		return
 	}
@@ -157,10 +184,6 @@ func (h *console) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		}
 		return
 	}
-	if r.URL.Path == "/console/installation/domain" {
-		h.serveInstallationDomain(w, r)
-		return
-	}
 	if r.URL.Path == "/console/config" && r.Method == http.MethodGet {
 		h.serveConsoleConfiguration(w, r)
 		return
diff --git a/services/web/server_test.go b/services/web/server_test.go
index 7eff1f119..a5fa55de3 100644
--- a/services/web/server_test.go
+++ b/services/web/server_test.go
@@ -3,8 +3,11 @@ package main
 import (
 	"bufio"
 	"context"
+	"crypto/sha1"
+	"encoding/base64"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -132,6 +135,135 @@ func TestAuthenticationAndCrossSiteAdmission(t *testing.T) {
 	}
 }
 
+func TestApplicationAndMachineTrafficPassesThroughUnchanged(t *testing.T) {
+	observed := make(chan *http.Request, 1)
+	server, _ := testConsole(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		observed <- r.Clone(context.Background())
+		w.Header().Set("Content-Type", "text/event-stream")
+		_, _ = io.WriteString(w, "data: ok\n\n")
+	}))
+	for _, path := range []string{"/v1/agents", "/api/v1/agent-daemon", "/docs", "/docs/openapi.yaml"} {
+		t.Run(path, func(t *testing.T) {
+			request := consoleRequest(t, server, "POST", path)
+			request.Header.Del("Cookie")
+			request.Header.Del("Origin")
+			request.Header.Del("Sec-Fetch-Site")
+			request.Host = "node.example"
+			request.Header.Set("Authorization", "Bearer project-key")
+			request.Header.Set("Upgrade", "websocket")
+			response, body := responseBody(t, server, request)
+			if response.StatusCode != 200 || body != "data: ok\n\n" {
+				t.Fatalf("status = %d, body = %s", response.StatusCode, body)
+			}
+			forwarded := <-observed
+			if forwarded.URL.Path != path || forwarded.Header.Get("Authorization") != "Bearer project-key" {
+				t.Fatalf("forwarded request = %s %s", forwarded.URL.Path, forwarded.Header.Get("Authorization"))
+			}
+			if forwarded.Header.Get("X-Core-Console-Actor") != "" || strings.Contains(forwarded.Header.Get("Authorization"), "private-core-key") {
+				t.Fatal("console credential leaked onto application traffic")
+			}
+		})
+	}
+}
+
+func TestWebSocketUpgradeReachesCore(t *testing.T) {
+	const key = "dGhlIHNhbXBsZSBub25jZQ=="
+	sum := sha1.Sum([]byte(key + "258EAFA5-E914-47DA-95CA-C5AB0DC85B11"))
+	accept := base64.StdEncoding.EncodeToString(sum[:])
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/agent-daemon/ws" || r.Header.Get("Upgrade") != "websocket" || r.Header.Get("Sec-WebSocket-Key") != key {
+			http.Error(w, "unexpected upgrade", http.StatusBadRequest)
+			return
+		}
+		hijacker, ok := w.(http.Hijacker)
+		if !ok {
+			http.Error(w, "cannot upgrade", http.StatusInternalServerError)
+			return
+		}
+		conn, buffer, err := hijacker.Hijack()
+		if err != nil {
+			return
+		}
+		defer conn.Close()
+		if _, err = buffer.WriteString("HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Accept: " + accept + "\r\n\r\n"); err != nil {
+			return
+		}
+		if err = buffer.Flush(); err != nil {
+			return
+		}
+		incoming := make([]byte, 4)
+		_ = conn.SetDeadline(time.Now().Add(5 * time.Second))
+		if _, err = io.ReadFull(conn, incoming); err != nil || string(incoming) != "ping" {
+			return
+		}
+		_, _ = conn.Write([]byte("pong"))
+	}))
+	t.Cleanup(upstream.Close)
+	parsed, err := url.Parse(upstream.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	dist := t.TempDir()
+	if err = os.WriteFile(filepath.Join(dist, "index.html"), []byte("console"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	handler, err := newConsole(config{origin: testOrigin, upstream: parsed, dist: dist, coreKey: "private-core-key"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(handler.Close)
+	if handler.transport.MaxIdleConnsPerHost != 64 {
+		t.Fatalf("idle connections per Core = %d", handler.transport.MaxIdleConnsPerHost)
+	}
+	server := httptest.NewServer(handler)
+	t.Cleanup(server.Close)
+
+	conn, err := net.Dial("tcp", server.Listener.Addr().String())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	_ = conn.SetDeadline(time.Now().Add(5 * time.Second))
+	request := "GET /api/v1/agent-daemon/ws HTTP/1.1\r\nHost: node.example\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Version: 13\r\nSec-WebSocket-Key: " + key + "\r\n\r\n"
+	if _, err = conn.Write([]byte(request)); err != nil {
+		t.Fatal(err)
+	}
+	reader := bufio.NewReader(conn)
+	status, err := reader.ReadString('\n')
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(status, "101") {
+		t.Fatalf("status = %q", status)
+	}
+	headers := make(http.Header)
+	for {
+		line, err := reader.ReadString('\n')
+		if err != nil {
+			t.Fatal(err)
+		}
+		line = strings.TrimRight(line, "\r\n")
+		if line == "" {
+			break
+		}
+		name, value, ok := strings.Cut(line, ":")
+		if !ok {
+			t.Fatalf("header = %q", line)
+		}
+		headers.Add(strings.TrimSpace(name), strings.TrimSpace(value))
+	}
+	if headers.Get("Sec-WebSocket-Accept") != accept || !strings.EqualFold(headers.Get("Upgrade"), "websocket") {
+		t.Fatalf("upgrade headers = %v", headers)
+	}
+	if _, err = conn.Write([]byte("ping")); err != nil {
+		t.Fatal(err)
+	}
+	reply := make([]byte, 4)
+	if _, err = io.ReadFull(reader, reply); err != nil || string(reply) != "pong" {
+		t.Fatalf("reply = %q, err %v", reply, err)
+	}
+}
+
 func TestProxyUsesOnlyConfiguredCoreCredential(t *testing.T) {
 	observed := make(chan *http.Request, 1)
 	server, _ := testConsole(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -241,8 +373,7 @@ func TestStaticAssetsStayInsideDistAndInternalRoutesStayLocal(t *testing.T) {
 		{"/", 200}, {"/sessions/saved", 200}, {"/assets/main.js", 200},
 		{"/assets/", 404}, {"/missing.js", 404}, {"/leak.key", 404},
 		{"/../caller.key", 400}, {"/%2e%2e/caller.key", 400}, {"/%252e%252e/caller.key", 400},
-		{"/v1/../api/v1/agent-daemon/ws", 404}, {"/v1//agents", 404},
-		{"/api/v1/agent-daemon/ws", 404},
+		{"/v1/../api/v1/agent-daemon/ws", 400}, {"/v1//agents", 400},
 	} {
 		t.Run(tc.path, func(t *testing.T) {
 			response, body := responseBody(t, server, consoleRequest(t, server, "GET", tc.path))