Each connection joins a client to one environment over HTTP and WebSocket. The environment owns providers, execution, files, and durable state. Direct access, Tailscale, SSH, and T3 Connect change how the client reaches that server; they do not introduce another execution model. See remote access for setup.
An environment keeps its ID across server restarts and endpoint changes. Saved connections are local to a client profile; the server's identity and state are not. A repository identity can correlate clones across environments, but never routes work between them. A project and its threads belong to one environment.
Environment ID initialization must publish a complete ID atomically. Repair of an empty ID file retains a recovery file so concurrent or delayed initializers choose the same winner. Removing that recovery state as ordinary temporary-file cleanup can change the identity underneath an already-running server.
Advertised endpoints are reachability hints. Only the connecting device can prove that a route works. In particular, a host's loopback address refers to a different machine when another device opens it. Endpoint selection must not silently fall back to loopback when a shareable endpoint is unavailable.
The hosted web app stores its connection catalog in the browser and connects directly to each environment. It does not proxy traffic or hold server-side pairing state. Hosting the UI over HTTPS therefore cannot make a plain HTTP LAN backend accessible from that browser context.
A hosted pairing URL identifies the backend in its query and carries the pairing secret in its fragment. Fragments stay out of requests to the hosted origin. The browser exchanges the secret with the environment and strips it from its history. Moving the token into a query parameter would disclose it to the wrong origin.
Tailscale supplies an endpoint for ordinary pairing, so it needs no separate environment type. Authentication remains the environment's responsibility for every route. See environment authentication and the T3 Connect trust boundary.
SSH can launch a server as well as forward a port. Desktop main owns that lifecycle because it can spawn SSH and handle authentication prompts. The renderer uses the forwarded endpoint through the shared connection runtime. SSH cleanup stops a remote server only if the launcher owns it; a server it discovered already running must survive a client disconnect. Reconnection restores the forward before opening the application transport.
Remote servers can outlive several client releases. Clients must use advertised capabilities and handle their absence, rather than assume their own version describes the server. Process replacement belongs to the launcher's update protocol; the connection runtime handles the resulting disconnect.