diff --git a/.agents/skills/test-audit/SKILL.md b/.agents/skills/test-audit/SKILL.md
new file mode 100644
index 0000000000..abb6222771
--- /dev/null
+++ b/.agents/skills/test-audit/SKILL.md
@@ -0,0 +1,81 @@
+---
+name: test-audit
+description: |
+  Load whenever a test is authored, changed, or reviewed. Gates new tests before they are added
+  and audits existing suites for low-value, duplicated, or implementation-coupled coverage across
+  the unit/integration/e2e/live tiers.
+---
+
+# Test Audit
+
+Two modes share one value bar. Authoring gates every new or changed test at write time. Audit
+sweeps existing tests, read-only until each candidate has recorded evidence. Both apply the
+junk patterns and retention bar below. See [Test quality](../../../AGENTS.md#test-quality) for
+tiers, naming, and flake-resistance rules this skill assumes.
+
+## Authoring gate
+
+Before adding any test, answer all four questions. A missing answer means don't add it yet. Apply
+the same questions to review suggestions that add tests or assertions, and push back when they
+protect nothing:
+
+1. What behavior does it protect?
+2. What credible regression makes it fail?
+3. Why doesn't existing coverage already catch that failure?
+4. Does it need a test-only production seam that only exposes internals (an export, flag, or
+   wrapper)? If so, move the test to the real boundary. A controlled clock, or a budget or config
+   value production also reads, is fine.
+
+## Level rule
+
+Each contract gets one primary test at the strongest boundary that can reach it: unit for pure
+logic, integration for handlers and Effect layers, e2e for the subprocess boundary through
+`runSupabase()`, live only when the command must reach the real platform or data plane. A second
+level needs a distinct risk the first can't reach, not the same contract replayed. Command e2e
+stays at one to three golden paths. Prefer a new row in an existing table-driven case over a
+near-duplicate test.
+
+## Junk patterns
+
+Reject a new test, or flag an existing one, that matches any of these:
+
+- the same contract replayed at several tiers (unit, integration, e2e, live all asserting the
+  same branch)
+- mocks or Effect test layers that implement the behavior being asserted, rather than standing in
+  for a real collaborator
+- expected values produced by the helper under test instead of an independent source
+- negative controls that pass for an unrelated reason, such as a different guard rejecting input
+  before the path under test ever runs
+- test names that promise more than the test exercises
+- real-time waits on production timeouts or backoff, such as an `it.live` case sleeping through a
+  retry schedule; use a controlled clock or an injected budget instead
+
+## Retention bar
+
+Always keep the test that gives a public CLI behavior, config, persistence, security, platform,
+or published package contract its distinct proof. Being slow or static is never a reason to delete
+it; a copy at another tier asserting the same thing can still be consolidated.
+
+## Regression tests
+
+A bug-fix test must be shown to fail on the pre-fix code for the intended reason, then pass after
+the fix. A regression test that never demonstrably failed proves the mock, not the fix.
+
+## Audit mode
+
+Discovery stays read-only: no edits until every candidate has recorded evidence. Before touching
+anything, record for each candidate:
+
+- what the test can actually detect
+- the stronger proof that remains, or would remain, without it
+- any test-only production seam its deletion would free
+
+Then mark it in a short ledger, one evidence line per mark:
+
+- `R` retain — names the contract and the regression it catches
+- `F` fix — keep the contract, repair a weak or vacuous assertion
+- `C` consolidate — names the owner absorbing it (a sibling table row, a stronger boundary suite)
+- `D` delete — names the proof that remains, or that no contract exists
+
+Report the ledger in the audit response, or in the campaign's tracking issue when there is one,
+never in a PR description. Prefer a few high-confidence candidates over a large speculative sweep.
diff --git a/.claude/skills/effect b/.claude/skills/effect
new file mode 120000
index 0000000000..dcea07a088
--- /dev/null
+++ b/.claude/skills/effect
@@ -0,0 +1 @@
+../../.agents/skills/effect
\ No newline at end of file
diff --git a/.claude/skills/test-audit b/.claude/skills/test-audit
new file mode 120000
index 0000000000..7fb9bcd8b3
--- /dev/null
+++ b/.claude/skills/test-audit
@@ -0,0 +1 @@
+../../.agents/skills/test-audit
\ No newline at end of file
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 8b94b670bc..adbacd4653 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,33 +1,29 @@
 # Default all repository changes to the CLI team.
 * @supabase/cli
 
-# Dependabot-only dependency surfaces. These ownerless rules override the
-# catch-all above so CI-green Dependabot PRs can be auto-approved and merged.
-/.github/workflows/*.yml
-**/package.json
-**/go.mod
-**/go.sum
-/apps/cli/src/shared/services/Dockerfile
-/pnpm-lock.yaml
-/pnpm-workspace.yaml
+# Files that bots update. Either owner satisfies code-owner review; `supabase-oss` approves only
+# bot-opened PRs, through bot-pr-auto-merge.yml.
+/.github/workflows/*.yml @supabase/cli @supabase-oss
+/package.json @supabase/cli @supabase-oss
+/apps/*/package.json @supabase/cli @supabase-oss
+/packages/*/package.json @supabase/cli @supabase-oss
+/tools/*/package.json @supabase/cli @supabase-oss
+/pnpm-lock.yaml @supabase/cli @supabase-oss
+/pnpm-workspace.yaml @supabase/cli @supabase-oss
+/apps/cli-go/go.mod @supabase/cli @supabase-oss
+/apps/cli-go/go.sum @supabase/cli @supabase-oss
+/apps/cli-go/pkg/go.mod @supabase/cli @supabase-oss
+/apps/cli-go/pkg/go.sum @supabase/cli @supabase-oss
+/apps/cli/src/shared/services/Dockerfile @supabase/cli @supabase-oss
+/apps/cli-go/pkg/config/templates/Dockerfile @supabase/cli @supabase-oss
+/packages/stack/src/Artifacts.ts @supabase/cli @supabase-oss
+/apps/cli-go/api/v1-openapi.yaml @supabase/cli @supabase-oss
+/apps/cli-go/pkg/api/*.gen.go @supabase/cli @supabase-oss
+/packages/api/src/generated/ @supabase/cli @supabase-oss
+/packages/api/scripts/openapi-source.json @supabase/cli @supabase-oss
 
-# The AI review pipeline (workflow, supporting scripts, and prompts/schemas)
-# executes trusted checkout code with API keys and can react to arbitrary
-# comments/PRs; github-scripts-ci.yml tests and type-checks that same code —
-# keep all of it under maintainer review rather than the ownerless Dependabot
-# workflow-files rule above (which would otherwise un-own the two *.yml
-# files here). Last matching pattern wins, so these restore/reassert
-# ownership explicitly, even where the catch-all above already covers a path.
+# These run trusted checkout code with secrets or deploy with admin credentials, so bot PRs
+# touching them still need a maintainer. Last matching pattern wins.
 /.github/workflows/ai-review.yml @supabase/cli
 /.github/workflows/github-scripts-ci.yml @supabase/cli
-/.github/scripts/ai-review/** @supabase/cli
-/.github/ai-review/** @supabase/cli
-
-# The cli-artifacts infra workflow deploys with account-admin credentials from develop;
-# keep it under maintainer review rather than the ownerless workflow-files rule above.
 /.github/workflows/cli-artifacts-infra.yml @supabase/cli
-
-# Generated code. These ownerless rules override the catch-all above so
-# CI-green sync PRs (e.g. Management API OpenAPI spec) can be auto-merged.
-/apps/cli-go/pkg/api/*.gen.go
-/packages/api/src/generated/
diff --git a/.github/scripts/sync-artifacts-catalog.test.ts b/.github/scripts/sync-artifacts-catalog.test.ts
index 1a266d12be..ebc4d8962e 100644
--- a/.github/scripts/sync-artifacts-catalog.test.ts
+++ b/.github/scripts/sync-artifacts-catalog.test.ts
@@ -51,6 +51,25 @@ function matchingS3(
   return async (url) => byUrl.get(url);
 }
 
+/** A `fetchManifest` returning a derived service's `upstream_image`, for every native target. */
+const manifestWithUpstreamImage =
+  (image: string): RevisionIo["fetchManifest"] =>
+  async () =>
+    JSON.stringify({ upstream_image: image });
+
+/** A `fetchProvenance` returning a mirrored service's `source`. */
+const provenanceWithSource =
+  (source: string): RevisionIo["fetchProvenance"] =>
+  async () =>
+    JSON.stringify({ source });
+
+const unusedFetchManifest: RevisionIo["fetchManifest"] = async () => {
+  throw new Error("fetchManifest should not be called for this service");
+};
+const unusedFetchProvenance: RevisionIo["fetchProvenance"] = async () => {
+  throw new Error("fetchProvenance should not be called for this service");
+};
+
 /**
  * Runs the repo's pinned `oxfmt` binary over `source`, the way `slim-release-published.yml`
  * formats the catalog after every write, so parsing tests exercise real formatter output
@@ -281,22 +300,13 @@ describe("planSlimUpdates", () => {
     ]);
   });
 
-  test("both a hotfix and an upgrade can be planned in the same run", () => {
-    const { updates } = planSlimUpdates(plannerFixture, "postgrest", [
+  test("an upgrade on a line suppresses that line's hotfix, warning about the skipped release", () => {
+    const { updates, warnings } = planSlimUpdates(plannerFixture, "postgrest", [
       "postgrest-v16.2-r1",
       "postgrest-v16.4-r0",
     ]);
 
     expect(updates).toEqual([
-      {
-        kind: "hotfix",
-        line: undefined,
-        branch: "slim-hotfix/postgrest",
-        title: "chore(stack): pin postgrest v16.2-r1",
-        fromRelease: "v16.2-r0",
-        toUpstream: "v16.2",
-        toRelease: "v16.2-r1",
-      },
       {
         kind: "upgrade",
         line: undefined,
@@ -307,6 +317,9 @@ describe("planSlimUpdates", () => {
         toRelease: "v16.4-r0",
       },
     ]);
+    expect(warnings).toEqual([
+      "::warning ::postgrest v16.2-r1 hotfix skipped because this line is upgrading to v16.4-r0; run --service postgrest --release v16.2-r1 to pin the hotfix alone.",
+    ]);
   });
 
   test("an older committed upstream is a backlog republish: it plans nothing", () => {
@@ -326,7 +339,7 @@ describe("planSlimUpdates", () => {
     ]);
 
     // The ignored major-18 tag is warned about, but doesn't block the two valid updates
-    // alongside it (P1: a warning must never corrupt or swallow the plan).
+    // alongside it: a warning never corrupts or swallows the plan.
     expect(warnings).toEqual([
       "::warning ::postgres 18.0.0.001 is not on a release line packages/stack/src/Artifacts.ts carries for it; ignoring postgres-18.0.0.001-r0.",
     ]);
@@ -570,7 +583,7 @@ describe("planUpdatesForService (the plan-updates transport's IO seam)", () => {
   });
 });
 
-describe("waitForExpectedRelease (item A's eventual-consistency wait, call counts a subprocess can't assert)", () => {
+describe("waitForExpectedRelease", () => {
   test("visible on the first listing: returns immediately without waiting", async () => {
     let calls = 0;
     const waits: number[] = [];
@@ -645,7 +658,7 @@ describe("waitForExpectedRelease (item A's eventual-consistency wait, call count
 });
 
 describe("runPlanUpdates (the actual plan-updates CLI mode, not just the pure planner)", () => {
-  test("an ignored tag, a valid upgrade, and the expected dispatched release: --output gets exactly the valid record, the warning reaches stdout, and the process exits 0", async () => {
+  test("an ignored tag, a valid upgrade, and the expected dispatched release: --output gets only the valid record, the warning reaches stdout, and the process exits 0", async () => {
     // Real catalog, real "postgrest" pin — a local fixture server stands in for the releases API
     // (`SLIM_SERVICES_RELEASES_API`), so this exercises the real subprocess: the CLI's argv
     // parsing, `--expect-release`'s visibility wait, the network lister, and the file/stdout
@@ -794,7 +807,7 @@ describe("runPlanUpdates (the actual plan-updates CLI mode, not just the pure pl
     }
   });
 
-  test("a newline-bearing --format is rejected, producing exactly one ::error :: line (not JSON.stringify'd; the boundary encoder is what protects it)", async () => {
+  test("a newline-bearing --format is rejected, producing a single ::error :: line (not JSON.stringify'd; the boundary encoder is what protects it)", async () => {
     const dir = await mkdtemp(join(tmpdir(), "plan-updates-bad-format-"));
     const outputPath = join(dir, "slim-updates.tsv");
     try {
@@ -863,6 +876,8 @@ describe("refreshCatalogPin", () => {
       fetchChecksums: async () => checksumsFor("analytics", "v1.50.9-r1", digests),
       imageDigest: async () => digest("h"),
       s3Sha256: matchingS3("analytics", "v1.50.9-r1", digests),
+      fetchManifest: manifestWithUpstreamImage("supabase/logflare:1.50.9"),
+      fetchProvenance: unusedFetchProvenance,
     };
 
     const result = await refreshCatalogPin({ catalog: fixture, service: "analytics", io });
@@ -878,6 +893,7 @@ describe("refreshCatalogPin", () => {
     expect(result.source).toContain(
       `image: "ghcr.io/supabase/cli/analytics:v1.50.9-r1@${digest("h")}"`,
     );
+    expect(result.source).toContain('upstreamImage: "supabase/logflare:1.50.9"');
   });
 
   test("a resolved pin survives real formatting and can be refreshed again", async () => {
@@ -887,6 +903,8 @@ describe("refreshCatalogPin", () => {
       fetchChecksums: async () => checksumsFor("postgrest", "v16.2-r0", first),
       imageDigest: async () => digest("j"),
       s3Sha256: matchingS3("postgrest", "v16.2-r0", first),
+      fetchManifest: manifestWithUpstreamImage("postgrest/postgrest:v16.2"),
+      fetchProvenance: unusedFetchProvenance,
     };
     const written = await refreshCatalogPin({
       catalog: fixture,
@@ -906,6 +924,8 @@ describe("refreshCatalogPin", () => {
       fetchChecksums: async () => checksumsFor("postgrest", "v16.2-r1", second),
       imageDigest: async () => digest("l"),
       s3Sha256: matchingS3("postgrest", "v16.2-r1", second),
+      fetchManifest: manifestWithUpstreamImage("postgrest/postgrest:v16.2"),
+      fetchProvenance: unusedFetchProvenance,
     };
     const refreshed = await refreshCatalogPin({
       catalog: formatted,
@@ -922,6 +942,7 @@ describe("refreshCatalogPin", () => {
     });
     expect(refreshed.source).toContain("revision: 1");
     expect(refreshed.source).toContain(second["darwin-arm64"].archive);
+    expect(refreshed.source).toContain('upstreamImage: "postgrest/postgrest:v16.2"');
   });
 
   test("refreshes the Postgres 15 additional pin, including after formatting", async () => {
@@ -931,6 +952,8 @@ describe("refreshCatalogPin", () => {
       fetchChecksums: async () => checksumsFor("postgres", "15.14.1.168-r0", digests),
       imageDigest: async () => digest("n"),
       s3Sha256: matchingS3("postgres", "15.14.1.168-r0", digests),
+      fetchManifest: manifestWithUpstreamImage("supabase/postgres:15.14.1.168"),
+      fetchProvenance: unusedFetchProvenance,
     };
 
     const written = await refreshCatalogPin({
@@ -956,6 +979,8 @@ describe("refreshCatalogPin", () => {
       fetchChecksums: async () => checksumsFor("postgres", "15.14.1.168-r1", nextDigests),
       imageDigest: async () => digest("p"),
       s3Sha256: matchingS3("postgres", "15.14.1.168-r1", nextDigests),
+      fetchManifest: manifestWithUpstreamImage("supabase/postgres:15.14.1.168"),
+      fetchProvenance: unusedFetchProvenance,
     };
 
     const refreshed = await refreshCatalogPin({
@@ -974,6 +999,7 @@ describe("refreshCatalogPin", () => {
     });
     expect(refreshed.source).toContain(postgres17Image);
     expect(refreshed.source).toContain(nextDigests["linux-arm64"].manifest);
+    expect(refreshed.source).toContain('upstreamImage: "supabase/postgres:15.14.1.168"');
   });
 
   test("moves the Postgres 15 additional pin to a new upstream version, updating its key", async () => {
@@ -983,6 +1009,8 @@ describe("refreshCatalogPin", () => {
       fetchChecksums: async () => checksumsFor("postgres", "15.19.0.002-r0", digests),
       imageDigest: async () => digest("v"),
       s3Sha256: matchingS3("postgres", "15.19.0.002-r0", digests),
+      fetchManifest: manifestWithUpstreamImage("supabase/postgres:15.19.0.002"),
+      fetchProvenance: unusedFetchProvenance,
     };
 
     const written = await refreshCatalogPin({
@@ -1012,6 +1040,8 @@ describe("refreshCatalogPin", () => {
       fetchChecksums: async () => checksumsFor("postgres", "15.19.0.002-r1", nextDigests),
       imageDigest: async () => digest("x"),
       s3Sha256: matchingS3("postgres", "15.19.0.002-r1", nextDigests),
+      fetchManifest: manifestWithUpstreamImage("supabase/postgres:15.19.0.002"),
+      fetchProvenance: unusedFetchProvenance,
     };
     const refreshed = await refreshCatalogPin({
       catalog: formatted,
@@ -1028,6 +1058,7 @@ describe("refreshCatalogPin", () => {
       target: "additional",
     });
     expect(refreshed.source).toContain(nextDigests["linux-arm64"].manifest);
+    expect(refreshed.source).toContain('upstreamImage: "supabase/postgres:15.19.0.002"');
   });
 });
 
@@ -1054,6 +1085,8 @@ describe("resolveRevisionPin waits for the S3 mirror", () => {
         }
         return present(url);
       },
+      fetchManifest: unusedFetchManifest,
+      fetchProvenance: unusedFetchProvenance,
       wait: async (ms) => {
         waits.push(ms);
       },
@@ -1075,6 +1108,8 @@ describe("resolveRevisionPin waits for the S3 mirror", () => {
       fetchChecksums: async () => checksumsFor("postgrest", releaseVersion, digests),
       imageDigest: async () => digest("s3-mismatch-digest"),
       s3Sha256: async () => hex("wrong-bytes"),
+      fetchManifest: unusedFetchManifest,
+      fetchProvenance: unusedFetchProvenance,
       wait: async (ms) => {
         waits.push(ms);
       },
@@ -1097,6 +1132,8 @@ describe("resolveRevisionPin waits for the S3 mirror", () => {
       fetchChecksums: async () => checksumsFor("postgrest", releaseVersion, digests),
       imageDigest: async () => digest("s3-never-digest"),
       s3Sha256: async () => undefined,
+      fetchManifest: unusedFetchManifest,
+      fetchProvenance: unusedFetchProvenance,
       wait: async (ms) => {
         waits.push(ms);
       },
@@ -1113,13 +1150,15 @@ describe("resolveRevisionPin waits for the S3 mirror", () => {
 });
 
 describe("refreshCatalogPin --release", () => {
-  test("pins exactly the requested committed release, not the highest one", async () => {
+  test("pins the requested committed release, not the highest one", async () => {
     const digests = nativeDigests("release-0");
     const io: RevisionIo = {
       listReleaseTags: async () => ["postgrest-v16.2-r0", "postgrest-v16.2-r1"],
       fetchChecksums: async () => checksumsFor("postgrest", "v16.2-r0", digests),
       imageDigest: async () => digest("release-digest-0"),
       s3Sha256: matchingS3("postgrest", "v16.2-r0", digests),
+      fetchManifest: manifestWithUpstreamImage("postgrest/postgrest:v16.2"),
+      fetchProvenance: unusedFetchProvenance,
     };
 
     const result = await refreshCatalogPin({
@@ -1144,6 +1183,8 @@ describe("refreshCatalogPin --release", () => {
       fetchChecksums: async () => undefined,
       imageDigest: async () => undefined,
       s3Sha256: async () => undefined,
+      fetchManifest: unusedFetchManifest,
+      fetchProvenance: unusedFetchProvenance,
     };
 
     await expect(
@@ -1157,6 +1198,8 @@ describe("refreshCatalogPin --release", () => {
       fetchChecksums: async () => undefined,
       imageDigest: async () => undefined,
       s3Sha256: async () => undefined,
+      fetchManifest: unusedFetchManifest,
+      fetchProvenance: unusedFetchProvenance,
     };
 
     await expect(
@@ -1180,6 +1223,7 @@ describe("refreshCatalogPin backfills upstreamImage", () => {
       imageDigest: async () => digest("z"),
       s3Sha256: matchingS3("analytics", "v1.50.9-r1", digests),
       fetchManifest: async () => JSON.stringify({ upstream_image: "supabase/logflare:1.50.9" }),
+      fetchProvenance: unusedFetchProvenance,
     };
 
     const result = await refreshCatalogPin({ catalog: fixture, service: "analytics", io });
@@ -1195,6 +1239,7 @@ describe("refreshCatalogPin backfills upstreamImage", () => {
       imageDigest: async () => digest("ab"),
       s3Sha256: matchingS3("analytics", "v1.50.9-r0", digests),
       fetchManifest: async () => JSON.stringify({ source_image: "supabase/logflare:1.50.9" }),
+      fetchProvenance: unusedFetchProvenance,
     };
 
     const result = await refreshCatalogPin({ catalog: fixture, service: "analytics", io });
@@ -1211,6 +1256,7 @@ describe("refreshCatalogPin backfills upstreamImage", () => {
       s3Sha256: matchingS3("analytics", "v1.50.9-r0", digests),
       fetchManifest: async () =>
         JSON.stringify({ upstream_image: "docker.io/supabase/logflare:1.50.9@sha256:deadbeef" }),
+      fetchProvenance: unusedFetchProvenance,
     };
 
     const result = await refreshCatalogPin({ catalog: fixture, service: "analytics", io });
@@ -1230,6 +1276,7 @@ describe("refreshCatalogPin backfills upstreamImage", () => {
         call += 1;
         return JSON.stringify({ upstream_image: `supabase/logflare:1.50.${call}` });
       },
+      fetchProvenance: unusedFetchProvenance,
     };
 
     await expect(refreshCatalogPin({ catalog: fixture, service: "analytics", io })).rejects.toThrow(
@@ -1244,8 +1291,8 @@ describe("refreshCatalogPin backfills upstreamImage", () => {
       fetchChecksums: async () => checksumsFor("vector", "0.53.0-r0", digests),
       imageDigest: async () => digest("ah"),
       s3Sha256: matchingS3("vector", "0.53.0-r0", digests),
-      fetchProvenance: async () =>
-        JSON.stringify({ source: "docker.io/timberio/vector:0.53.0-alpine" }),
+      fetchManifest: unusedFetchManifest,
+      fetchProvenance: provenanceWithSource("docker.io/timberio/vector:0.53.0-alpine"),
     };
 
     const result = await refreshCatalogPin({ catalog: vectorFixture, service: "vector", io });
@@ -1253,20 +1300,6 @@ describe("refreshCatalogPin backfills upstreamImage", () => {
     expect(result.source).toContain('upstreamImage: "timberio/vector:0.53.0-alpine"');
   });
 
-  test("leaves upstreamImage absent when io has no manifest/provenance fetchers", async () => {
-    const digests = nativeDigests("ai");
-    const io: RevisionIo = {
-      listReleaseTags: async () => ["analytics-v1.50.9-r0"],
-      fetchChecksums: async () => checksumsFor("analytics", "v1.50.9-r0", digests),
-      imageDigest: async () => digest("aj"),
-      s3Sha256: matchingS3("analytics", "v1.50.9-r0", digests),
-    };
-
-    const result = await refreshCatalogPin({ catalog: fixture, service: "analytics", io });
-
-    expect(result.source).not.toContain("upstreamImage");
-  });
-
   test("rejects a manifest upstream_image carrying a quote or template expression, writing nothing", async () => {
     const digests = nativeDigests("ak");
     const io: RevisionIo = {
@@ -1276,6 +1309,7 @@ describe("refreshCatalogPin backfills upstreamImage", () => {
       s3Sha256: matchingS3("analytics", "v1.50.9-r0", digests),
       fetchManifest: async () =>
         JSON.stringify({ upstream_image: 'supabase/logflare:1.50.9"] }; import("evil"); //' }),
+      fetchProvenance: unusedFetchProvenance,
     };
 
     await expect(refreshCatalogPin({ catalog: fixture, service: "analytics", io })).rejects.toThrow(
@@ -1298,6 +1332,8 @@ describe("against the real catalog", () => {
       fetchChecksums: async () => checksumsFor("auth", `${pinnedVersion}-r0`, first),
       imageDigest: async () => digest("r"),
       s3Sha256: matchingS3("auth", `${pinnedVersion}-r0`, first),
+      fetchManifest: manifestWithUpstreamImage(`supabase/gotrue:${pinnedVersion}`),
+      fetchProvenance: unusedFetchProvenance,
     };
     const written = await refreshCatalogPin({ catalog, service: "auth", io: firstIo });
     expect(written.update?.revision).toBe(0);
@@ -1311,6 +1347,8 @@ describe("against the real catalog", () => {
       fetchChecksums: async () => checksumsFor("auth", `${pinnedVersion}-r1`, second),
       imageDigest: async () => digest("t"),
       s3Sha256: matchingS3("auth", `${pinnedVersion}-r1`, second),
+      fetchManifest: manifestWithUpstreamImage(`supabase/gotrue:${pinnedVersion}`),
+      fetchProvenance: unusedFetchProvenance,
     };
     const refreshed = await refreshCatalogPin({
       catalog: formatted,
@@ -1327,5 +1365,6 @@ describe("against the real catalog", () => {
     });
     expect(refreshed.source).toContain("revision: 1");
     expect(refreshed.source).toContain(second["darwin-arm64"].manifest);
+    expect(refreshed.source).toContain(`upstreamImage: "supabase/gotrue:${pinnedVersion}"`);
   });
 });
diff --git a/.github/scripts/sync-artifacts-catalog.ts b/.github/scripts/sync-artifacts-catalog.ts
index 0ec85a6b02..e568e07ab4 100644
--- a/.github/scripts/sync-artifacts-catalog.ts
+++ b/.github/scripts/sync-artifacts-catalog.ts
@@ -1,43 +1,6 @@
 /**
- * Pins `packages/stack/src/Artifacts.ts` to committed `supabase/slim-services`
- * revisions (`<upstream>-r<N>`). Every entry is pinned by content: the GHCR
- * image digest, plus an archive and manifest sha256 per native target.
- *
- * The catalog is the single version table (supabase/cli#6883): the Dockerfile's
- * slim-capable lines are a generated view of it
- * (`apps/cli/scripts/render-service-dockerfile.ts`), never the other way
- * around. Updates land through two modes:
- *
- * Manual mode: refreshes one catalog entry, either to a specific committed
- * release (`--release`) or to the highest committed revision of a given
- * upstream version, or of its currently pinned upstream version when neither
- * is given. `--upstream` and `--release` are mutually exclusive.
- *
- *   bun .github/scripts/sync-artifacts-catalog.ts --service <service> [--upstream <U> | --release <U>-r<N>]
- *
- * Plan-updates mode (used by the `slim-release-published` dispatch workflow):
- * lists a service's committed slim-services releases and computes, per
- * release line, the hotfix and/or upgrade a workflow should apply. Pure
- * planning: `planSlimUpdates` takes the release tag list as an argument,
- * makes no network calls, and never logs — it returns `{ updates, warnings }`.
- * Records go only to `--output <path>` (never stdout); warnings print to
- * stdout as `::warning ::…` lines, so the two channels can't corrupt one
- * another when a caller redirects stdout separately from the records file.
- *
- *   bun .github/scripts/sync-artifacts-catalog.ts plan-updates --service <service> \
- *     --output <path> [--format lines] [--expect-release <U>-r<N>]
- *
- * `--expect-release` handles the releases API lagging behind the dispatch that triggered this
- * run: before planning, the listed committed tags must include `<service>-<release_version>`, or
- * this mode re-lists a bounded number of times before giving up (`waitForExpectedRelease`).
- *
- * Validate-payload mode (used by the same workflow, before anything else):
- * checks an untrusted `slim-release-published` dispatch payload against
- * anchored charsets and prints it back as `key=value` lines, so a value that
- * fails validation is never written to `$GITHUB_OUTPUT` in the first place.
- *
- *   bun .github/scripts/sync-artifacts-catalog.ts validate-payload --service <service> \
- *     --upstream <U> --revision <N> --release <R>
+ * Pins `packages/stack/src/Artifacts.ts` to committed `supabase/slim-services` revisions. See
+ * `docs/adr/0026-slim-artifact-mirrors.md` for the catalog model and this script's three modes.
  */
 
 import {
@@ -54,7 +17,7 @@ export const CATALOG_PATH = "packages/stack/src/Artifacts.ts";
 
 const SLIM_IMAGE_PREFIX = `${SOURCE_REGISTRY}/`;
 
-/** The three native targets the catalog pins per revision. Kept self-contained; see module docs. */
+/** Native targets the catalog pins per revision, in `Artifacts.ts`'s serialization order. */
 const NATIVE_TARGETS = ["darwin-arm64", "linux-amd64", "linux-arm64"] as const;
 type NativeTargetName = (typeof NATIVE_TARGETS)[number];
 
@@ -67,7 +30,7 @@ const RELEASE_DOWNLOAD_BASE = "https://github.com/supabase/slim-services/release
 /** Bounded retry for `waitForExpectedRelease`: 6 attempts, 10s apart, by default. */
 const EXPECT_RELEASE_ATTEMPTS = 6;
 const DEFAULT_EXPECT_RELEASE_INTERVAL_MS = 10_000;
-/** Bounded retry for the S3-mirror wait in `resolveRevisionPin`: ~10 min, covering a native upload of all three targets (`mirror-slim-image.yml`'s `upload-natives-s3`). */
+/** ~10 min for `resolveRevisionPin`'s S3-mirror wait: `upload-natives-s3` for all three targets. */
 const S3_WAIT_ATTEMPTS = 20;
 const DEFAULT_S3_WAIT_INTERVAL_MS = 30_000;
 const MAX_TIMER_DELAY_MS = 2 ** 31 - 1; // setTimeout's own ceiling.
@@ -109,12 +72,7 @@ type BoundedWaitOutcome<T> =
   | { readonly status: "timed-out" }
   | { readonly status: "failed"; readonly message: string };
 
-/**
- * Generic bounded retry-with-wait: `waitForExpectedRelease`'s release-visibility wait and
- * `resolveRevisionPin`'s S3-mirror wait both build on this. Calls `check` up to `attempts`
- * times, `wait`-ing `intervalMs` between, until it reports `"done"` or an unrecoverable
- * `"failed"` (never waited out). Exhausting every attempt on `"retry"` yields `"timed-out"`.
- */
+/** Calls `check` up to `attempts` times, waiting between, until it reports `done` or `failed`. */
 async function boundedWait<T>(
   check: () => Promise<BoundedCheck<T>>,
   wait: (ms: number) => Promise<void>,
@@ -196,21 +154,19 @@ export interface CatalogPinUpdate {
   readonly target: "default" | "additional";
 }
 
-/** Content pin for one resolved `<upstream>-r<N>` revision, ready to serialize into the catalog. */
+/** Content pin for one resolved `<upstream>-r<N>` revision, without its `upstreamImage`. */
 interface ResolvedPin {
   readonly upstreamVersion: string;
   readonly revision: number;
   readonly image: string;
-  /**
-   * The pin's `ArtifactPin.upstreamImage`. Populated by manual mode (`refreshCatalogPin`) via
-   * `resolveUpstreamImage` below, when `io` carries `fetchManifest`/`fetchProvenance`.
-   */
-  readonly upstreamImage?: string;
   readonly natives: Readonly<
     Record<NativeTargetName, { readonly archive: string; readonly manifest: string }>
   >;
 }
 
+/** A `ResolvedPin` plus its `ArtifactPin.upstreamImage`, ready to serialize into the catalog. */
+type CatalogPin = ResolvedPin & { readonly upstreamImage: string };
+
 export type RevisionResolution =
   | { readonly status: "resolved"; readonly pin: ResolvedPin }
   | {
@@ -234,20 +190,18 @@ export interface RevisionIo {
   /**
    * Raw contents of a native target's `.manifest.json` release asset, for a derived service's
    * `upstream_image` (or `source_image` on an image-derived build, e.g. postgrest's Linux
-   * targets). Optional: only manual mode's `upstreamImage` backfill (`resolveUpstreamImage`)
-   * calls this, so a test `io` that doesn't exercise that path can omit it.
+   * targets).
    */
-  readonly fetchManifest?: (
+  readonly fetchManifest: (
     service: string,
     releaseVersion: string,
     target: NativeTargetName,
   ) => Promise<string | undefined>;
   /**
    * Raw contents of a mirrored service's `<service>-<upstreamVersion>.oci-provenance.json`
-   * release asset, whose `source` field is the mirrored upstream image. Optional for the same
-   * reason as `fetchManifest`.
+   * release asset, whose `source` field is the mirrored upstream image.
    */
-  readonly fetchProvenance?: (
+  readonly fetchProvenance: (
     service: string,
     releaseVersion: string,
     upstreamVersion: string,
@@ -266,9 +220,8 @@ function desiredImage(service: string, releaseVersion: string, digest: string):
  * manifest digest, and every native target's archive and manifest sha256, cross-checked against
  * the S3 mirror copy.
  *
- * With `requiredRevision` given, that exact revision must already be committed — this is what
- * pins exactly a planned release (`--release`), never "highest at apply time". Without it, the
- * highest committed revision of `upstream` is used (`--upstream`, and the hotfix/upgrade default).
+ * With `requiredRevision` given (`--release`), that revision must already be committed; it is
+ * never "highest at apply time". Without it, the highest committed revision of `upstream` is used.
  */
 export async function resolveRevisionPin(
   service: string,
@@ -449,7 +402,7 @@ function validateUpstreamImage(image: string, context: string): string {
  * manifest `upstream_image` (falling back to `source_image` for an image-derived build, e.g.
  * postgrest's Linux targets) — cross-checked across every native target, so a derived service
  * whose manifests disagree fails instead of silently picking one. Only manual mode
- * (`refreshCatalogPin`) calls this; `io` must carry `fetchManifest`/`fetchProvenance`.
+ * (`refreshCatalogPin`) calls this.
  */
 async function resolveUpstreamImage(
   service: string,
@@ -458,11 +411,6 @@ async function resolveUpstreamImage(
   io: RevisionIo,
 ): Promise<string> {
   if (MIRROR_MODE_SOURCE_SERVICES.has(service)) {
-    if (io.fetchProvenance === undefined) {
-      throw new InvalidPayloadError(
-        `${service} needs an io.fetchProvenance to resolve upstreamImage.`,
-      );
-    }
     const provenance = await io.fetchProvenance(service, releaseVersion, upstreamVersion);
     if (provenance === undefined) {
       throw new InvalidPayloadError(`${service}-${releaseVersion} has no oci-provenance asset.`);
@@ -476,9 +424,6 @@ async function resolveUpstreamImage(
     return validateUpstreamImage(normalizeUpstreamImage(source), `${service}-${releaseVersion}`);
   }
 
-  if (io.fetchManifest === undefined) {
-    throw new InvalidPayloadError(`${service} needs an io.fetchManifest to resolve upstreamImage.`);
-  }
   const values = new Set<string>();
   for (const target of NATIVE_TARGETS) {
     const manifest = await io.fetchManifest(service, releaseVersion, target);
@@ -513,14 +458,12 @@ async function resolveUpstreamImage(
  * text is written straight into TypeScript source that later gets imported, so an unescaped
  * quote or template expression in any field (release metadata included) would inject code.
  */
-function serializePin(pin: ResolvedPin): string {
+function serializePin(pin: CatalogPin): string {
   const natives = NATIVE_TARGETS.map((target) => {
     const native = pin.natives[target];
     return `${JSON.stringify(target)}: { archive: ${JSON.stringify(native.archive)}, manifest: ${JSON.stringify(native.manifest)} }`;
   }).join(", ");
-  const upstreamImage =
-    pin.upstreamImage === undefined ? "" : ` upstreamImage: ${JSON.stringify(pin.upstreamImage)},`;
-  return `{ upstreamVersion: ${JSON.stringify(pin.upstreamVersion)}, revision: ${pin.revision}, image: ${JSON.stringify(pin.image)},${upstreamImage} natives: { ${natives} } }`;
+  return `{ upstreamVersion: ${JSON.stringify(pin.upstreamVersion)}, revision: ${pin.revision}, image: ${JSON.stringify(pin.image)}, upstreamImage: ${JSON.stringify(pin.upstreamImage)}, natives: { ${natives} } }`;
 }
 
 interface PinSpan {
@@ -568,7 +511,7 @@ const PIN_UPSTREAM_VERSION = /upstreamVersion:\s*"([^"]+)"/;
 const PIN_REVISION = /revision:\s*(\d+)/;
 
 /**
- * Matches a resolved `ArtifactPin` object literal starting exactly at `index`. The span is found
+ * Matches a resolved `ArtifactPin` object literal that starts at `index`. The span is found
  * by bracket balance, then the version is pulled out with a loose field search — so a formatter's
  * whitespace, line breaks, trailing commas, or property order never break matching, only the
  * literal shape itself would.
@@ -729,7 +672,7 @@ const normalizeText = (text: string): string => text.replace(/\s+/g, " ").trim()
 function writePin(
   source: string,
   entry: Extract<SelectedEntry, { kind: "default" | "additional" }>,
-  pin: ResolvedPin,
+  pin: CatalogPin,
 ): { readonly source: string; readonly changed: boolean } {
   const desired = serializePin(pin);
   const current = source.slice(entry.span.start, entry.span.end);
@@ -821,24 +764,10 @@ export interface PlanSlimUpdatesResult {
 const SINGLE_LINE_KEY = "*";
 
 /**
- * The hotfix and/or upgrade a `slim-release-published` run should apply for `service`, computed
- * against `catalog`'s current pins and `releaseTags` (every committed — published, non-draft —
- * slim-services release tag; the caller filters drafts before calling this). Pure: no network, no
- * file I/O, no logging — every diagnostic comes back in `warnings` instead, so a caller (the CLI,
- * or a test) decides where it goes. This matters because `plan-updates` writes `updates` straight
- * into a file the workflow parses as records; a `console.log`'d warning on the same stdout the
- * workflow captures would corrupt that file instead of just being informational.
- *
- * Per release line (the default pin's line, plus one per additional pin — only postgres
- * has more than one) a **hotfix** fires when the pinned upstream has a committed revision higher
- * than the pinned one; an **upgrade** fires when the newest committed upstream on the line is
- * newer than the pinned one (ties, e.g. two Studio builds dated the same day, are not newer).
- * Both can fire in the same run. A service with no additional pins has exactly one line and
- * accepts any comparable upstream on it — a Studio year rollover or a postgrest major bump is
- * the same line moving forward, not a different one, so it is never filtered by `releaseLine`.
- * Only a service that does carry additional pins (postgres) filters a release tag to the line its
- * `releaseLine` names; a tag on no such line, or whose version isn't comparable, is warned about
- * and ignored — it never causes a plan-updates run to fail.
+ * The upgrade or hotfix each of `service`'s release lines should get, planned against `catalog`'s
+ * pins and the committed (non-draft) `releaseTags`; the rules are in ADR 0026, "Hotfix and upgrade
+ * pickup". Never logs: `plan-updates` writes `updates` to a file the workflow parses as records,
+ * so diagnostics come back in `warnings`.
  */
 export function planSlimUpdates(
   catalog: string,
@@ -907,14 +836,8 @@ export function planSlimUpdates(
     const sameUpstreamRevisions = candidates
       .filter((candidate) => candidate.upstream === pinned.upstream)
       .map((candidate) => candidate.revision);
-    if (sameUpstreamRevisions.length > 0) {
-      const highest = Math.max(...sameUpstreamRevisions);
-      if (highest > pinned.revision) {
-        updates.push(
-          buildUpdate("hotfix", service, line, hasLines, pinned, pinned.upstream, highest),
-        );
-      }
-    }
+    const hotfixRevision =
+      sameUpstreamRevisions.length > 0 ? Math.max(...sameUpstreamRevisions) : undefined;
 
     const highestRevisionByUpstream = new Map<string, number>();
     for (const candidate of candidates) {
@@ -940,9 +863,23 @@ export function planSlimUpdates(
         bestUpstream = upstream;
       }
     }
+
     if (bestUpstream !== undefined && compareVersions(bestUpstream, pinned.upstream) === 1) {
       const revision = highestRevisionByUpstream.get(bestUpstream) as number;
       updates.push(buildUpdate("upgrade", service, line, hasLines, pinned, bestUpstream, revision));
+      if (hotfixRevision !== undefined && hotfixRevision > pinned.revision) {
+        const skippedRelease = `${pinned.upstream}-r${hotfixRevision}`;
+        warnings.push(
+          workflowCommand(
+            "warning",
+            `${service} ${skippedRelease} hotfix skipped because this line is upgrading to ${bestUpstream}-r${revision}; run --service ${service} --release ${skippedRelease} to pin the hotfix alone.`,
+          ),
+        );
+      }
+    } else if (hotfixRevision !== undefined && hotfixRevision > pinned.revision) {
+      updates.push(
+        buildUpdate("hotfix", service, line, hasLines, pinned, pinned.upstream, hotfixRevision),
+      );
     }
   }
 
@@ -1009,7 +946,7 @@ export interface CatalogRefreshResult {
 }
 
 /**
- * Refreshes one catalog entry: to exactly the committed release named by `release` (`<U>-r<N>`,
+ * Refreshes one catalog entry: to the committed release named by `release` (`<U>-r<N>`,
  * required to already be committed — never "highest at apply time"), or to the highest committed
  * revision of `upstream` (or, when both are omitted, of the entry's currently pinned upstream
  * version). `upstream` and `release` are mutually exclusive. Pure aside from `io`: callers own
@@ -1059,20 +996,15 @@ export async function refreshCatalogPin(input: {
   if (resolution.status !== "resolved") {
     throw new InvalidPayloadError(resolution.message);
   }
-  // Manual mode also backfills `upstreamImage`, so a plain `io` (most tests) can still exercise
-  // revision resolution without stubbing the extra fetchers.
-  const pin =
-    input.io.fetchManifest === undefined && input.io.fetchProvenance === undefined
-      ? resolution.pin
-      : {
-          ...resolution.pin,
-          upstreamImage: await resolveUpstreamImage(
-            input.service,
-            `${resolution.pin.upstreamVersion}-r${resolution.pin.revision}`,
-            resolvedUpstream,
-            input.io,
-          ),
-        };
+  const pin: CatalogPin = {
+    ...resolution.pin,
+    upstreamImage: await resolveUpstreamImage(
+      input.service,
+      `${resolution.pin.upstreamVersion}-r${resolution.pin.revision}`,
+      resolvedUpstream,
+      input.io,
+    ),
+  };
   const written = writePin(input.catalog, entry, pin);
   if (!written.changed) return { source: input.catalog };
   return {
diff --git a/.github/workflows/api-package-sync.yml b/.github/workflows/api-package-sync.yml
index 14cc9ed34b..d651f7b49d 100644
--- a/.github/workflows/api-package-sync.yml
+++ b/.github/workflows/api-package-sync.yml
@@ -54,7 +54,6 @@ jobs:
 
       - name: Create Pull Request
         if: steps.check.outputs.has_changes == 'true'
-        id: cpr
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -66,10 +65,3 @@ jobs:
             Changes were detected in the upstream OpenAPI documents exposed by `https://api.supabase.com/api/v1-json` and `https://api.supabase.com/api/v2-json`.
           branch: sync/api-package
           base: develop
-
-      - name: Enable Pull Request Automerge
-        if: steps.check.outputs.has_changes == 'true'
-        run: gh pr merge --auto --squash --repo "${{ github.repository }}" "${STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER}"
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml
deleted file mode 100644
index ad1da2f19b..0000000000
--- a/.github/workflows/automerge.yml
+++ /dev/null
@@ -1,46 +0,0 @@
-# Adapted from https://blog.somewhatabstract.com/2021/10/11/setting-up-dependabot-with-github-actions-to-approve-and-merge/
-name: Dependabot auto-merge
-
-on: pull_request
-
-permissions:
-  contents: read
-
-jobs:
-  dependabot:
-    runs-on: ubuntu-latest
-    # Checking the actor will prevent your Action run failing on non-Dependabot
-    # PRs but also ensures that it only does work for Dependabot PRs.
-    if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == github.event.pull_request.head.repo.full_name
-    steps:
-      # This first step will fail if there's no metadata and so the approval
-      # will not occur.
-      - name: Dependabot metadata
-        id: meta
-        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
-        with:
-          github-token: "${{ secrets.GITHUB_TOKEN }}"
-
-      - name: Generate token
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          client-id: ${{ vars.GH_APP_CLIENT_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-          permission-pull-requests: write
-          permission-contents: write
-
-      # Here the PR gets approved.
-      - name: Approve a PR
-        run: gh pr review --approve "${GITHUB_EVENT_PULL_REQUEST_HTML_URL}"
-        env:
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
-          GITHUB_EVENT_PULL_REQUEST_HTML_URL: ${{ github.event.pull_request.html_url }}
-
-      # Finally, this sets the PR to allow auto-merging once all required
-      # checks pass.
-      - name: Enable auto-merge for Dependabot PRs
-        run: gh pr merge --auto --squash "${GITHUB_EVENT_PULL_REQUEST_HTML_URL}"
-        env:
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
-          GITHUB_EVENT_PULL_REQUEST_HTML_URL: ${{ github.event.pull_request.html_url }}
diff --git a/.github/workflows/bot-pr-auto-merge.yml b/.github/workflows/bot-pr-auto-merge.yml
new file mode 100644
index 0000000000..362a12ae41
--- /dev/null
+++ b/.github/workflows/bot-pr-auto-merge.yml
@@ -0,0 +1,58 @@
+name: Bot PR auto-merge
+
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize, ready_for_review]
+    branches: [develop]
+
+permissions: {}
+
+jobs:
+  approve-and-merge:
+    name: Approve and enable auto-merge
+    runs-on: ubuntu-latest
+    # Other apps (coding agents, CI vendors) also open PRs here and still need a maintainer.
+    # Release-notes PRs are published by a maintainer approval and must never merge.
+    if: >-
+      contains(fromJSON('["dependabot[bot]", "supabase-cli-releaser[bot]"]'), github.event.pull_request.user.login) &&
+      contains(fromJSON('["dependabot[bot]", "supabase-cli-releaser[bot]"]'), github.event.sender.login) &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      !github.event.pull_request.draft &&
+      !startsWith(github.event.pull_request.head.ref, 'release-notes/')
+    # Holds `AUTO_APPROVE_PR_PAT`; the environment only deploys from the default branch.
+    environment: auto-approve
+    steps:
+      # pull_request_target is safe here because this job never checks out PR code.
+      - name: Generate token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.GH_APP_CLIENT_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+          permission-pull-requests: write
+          permission-contents: write
+
+      - name: Assign supabase-oss
+        run: gh pr edit --repo "$GITHUB_REPOSITORY" "$PR_NUMBER" --add-assignee supabase-oss
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+
+      # A rewritten PR keeps its approval; skipping it avoids stacking a review per push.
+      - name: Approve pull request
+        run: |
+          set -euo pipefail
+          decision="$(GH_TOKEN="$APP_TOKEN" gh pr view --repo "$GITHUB_REPOSITORY" "$PR_NUMBER" --json reviewDecision --jq .reviewDecision)"
+          if [ "$decision" != "APPROVED" ]; then
+            gh pr review --approve --repo "$GITHUB_REPOSITORY" "$PR_NUMBER"
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.AUTO_APPROVE_PR_PAT }}
+          APP_TOKEN: ${{ steps.app-token.outputs.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+
+      - name: Enable auto-merge
+        run: gh pr merge --auto --squash --repo "$GITHUB_REPOSITORY" "$PR_NUMBER"
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
diff --git a/.github/workflows/cli-go-api-sync.yml b/.github/workflows/cli-go-api-sync.yml
index 7593731443..0ca181493c 100644
--- a/.github/workflows/cli-go-api-sync.yml
+++ b/.github/workflows/cli-go-api-sync.yml
@@ -71,7 +71,6 @@ jobs:
 
       - name: Create Pull Request
         if: steps.check.outputs.has_changes == 'true'
-        id: cpr
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -83,20 +82,6 @@ jobs:
             Changes were detected after refreshing `apps/cli-go/api/v1-openapi.yaml` from the latest spec from infrastructure, and `apps/cli-go/pkg/api` is regenerated from it. The snapshot diff is the upstream API change and is worth reading: it is marked `linguist-generated`, so GitHub collapses it behind a "Load diff" click rather than hiding it.
           branch: sync/api-types
           base: develop
-
-      - name: Approve Pull Request
-        if: steps.check.outputs.has_changes == 'true'
-        run: gh pr review --approve --repo "${{ github.repository }}" "${STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER}"
-        env:
-          GH_TOKEN: ${{ secrets.AUTO_APPROVE_PR_PAT }}
-          STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
-
-      - name: Enable Pull Request Automerge
-        if: steps.check.outputs.has_changes == 'true'
-        run: gh pr merge --auto --squash --repo "${{ github.repository }}" "${STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER}"
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          STEPS_CPR_OUTPUTS_PULL_REQUEST_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
 defaults:
   run:
     working-directory: apps/cli-go
diff --git a/.github/workflows/live-e2e-notify.yml b/.github/workflows/live-e2e-notify.yml
index 5307ebb2ec..66edf219b7 100644
--- a/.github/workflows/live-e2e-notify.yml
+++ b/.github/workflows/live-e2e-notify.yml
@@ -10,25 +10,24 @@ permissions:
   contents: read
 
 jobs:
-  notify:
+  classify:
     if: github.event.workflow_run.conclusion == 'failure' || github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-latest
     timeout-minutes: 5
     continue-on-error: true
+    outputs:
+      suite: ${{ steps.classify.outputs.suite }}
+      startup_failure: ${{ steps.classify.outputs.startup_failure }}
     steps:
-      - name: Notify Slack
+      - name: Classify suite result
+        id: classify
         env:
           GH_TOKEN: ${{ github.token }}
           REPOSITORY: ${{ github.repository }}
           RUN_ID: ${{ github.event.workflow_run.id }}
-          RUN_NUMBER: ${{ github.event.workflow_run.run_number }}
           RUN_ATTEMPT: ${{ github.event.workflow_run.run_attempt }}
-          WORKFLOW_ID: ${{ github.event.workflow_run.workflow_id }}
           WORKFLOW_NAME: ${{ github.event.workflow_run.name }}
-          SHA: ${{ github.event.workflow_run.head_sha }}
-          BRANCH: ${{ github.event.workflow_run.head_branch }}
           CONCLUSION: ${{ github.event.workflow_run.conclusion }}
-          SLACK_WEBHOOK: ${{ secrets.SLACK_RELEASE_WEBHOOK }}
         run: |
           set -euo pipefail
 
@@ -50,74 +49,148 @@ jobs:
           elif [[ "$current_suite" == none || ("$current_suite" == failure && "$WORKFLOW_NAME" == "Release") ]]; then
             # Release's generic notification covers release failures and runs
             # that reused a staging result without creating a suite job.
+            echo "Current ${WORKFLOW_NAME} suite: ${current_suite}; nothing to notify"
             exit 0
           fi
+          echo "Current ${WORKFLOW_NAME} suite: ${current_suite}"
+          {
+            echo "suite=${current_suite}"
+            echo "startup_failure=${startup_failure}"
+          } >> "$GITHUB_OUTPUT"
+
+  notify:
+    needs: classify
+    if: needs.classify.outputs.suite != ''
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    continue-on-error: true
+    # A group keeps one pending job and replaces it when another arrives, so
+    # only real suite results take the lock.
+    concurrency:
+      group: live-e2e-notify-${{ github.event.workflow_run.head_branch }}
+      cancel-in-progress: false
+    steps:
+      - name: Notify Slack
+        id: notify
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
+          WORKFLOW_NAME: ${{ github.event.workflow_run.name }}
+          SHA: ${{ github.event.workflow_run.head_sha }}
+          BRANCH: ${{ github.event.workflow_run.head_branch }}
+          SOURCE_CREATED_AT: ${{ github.event.workflow_run.created_at }}
+          NOTIFY_WORKFLOW_REF: ${{ github.workflow_ref }}
+          CURRENT_SUITE: ${{ needs.classify.outputs.suite }}
+          STARTUP_FAILURE: ${{ needs.classify.outputs.startup_failure }}
+          SLACK_WEBHOOK: ${{ secrets.SLACK_RELEASE_WEBHOOK }}
+        run: |
+          set -euo pipefail
+
+          # The artifact holds the newest applied result and its source run's creation
+          # time, so late older results are ignored. Fork runs can upload the same
+          # artifact name, so only same-repository runs count.
+          branch_digest="$(printf '%s' "$BRANCH" | sha256sum | cut -c1-12)"
+          state_artifact="live-e2e-alert-state-${BRANCH//[^A-Za-z0-9._-]/-}-${branch_digest}"
+          state_dir="${RUNNER_TEMP}/live-e2e-alert-state"
+          mkdir -p "$state_dir"
+
+          artifact_id=""
+          lookup_ok=true
+          for page in $(seq 1 20); do
+            if ! artifacts="$(gh api -X GET "/repos/${REPOSITORY}/actions/artifacts" -f "name=${state_artifact}" -F per_page=100 -F "page=${page}")"; then
+              lookup_ok=false
+              break
+            fi
+            artifact_id="$(jq -r '[.artifacts[]? | select(.expired != true and .workflow_run.repository_id != null and .workflow_run.head_repository_id == .workflow_run.repository_id)] | sort_by(.created_at) | last // empty | .id' <<< "$artifacts")"
+            if [[ -n "$artifact_id" ]] || (( $(jq '.artifacts | length' <<< "$artifacts") < 100 )); then
+              break
+            fi
+          done
 
-          prior_conclusion=""
-          if (( RUN_ATTEMPT > 1 )); then
-            if ! prior_jobs="$(gh api --paginate "/repos/${REPOSITORY}/actions/runs/${RUN_ID}/attempts/$((RUN_ATTEMPT - 1))/jobs?per_page=100")"; then
-              echo "::warning::Could not inspect the prior attempt for ${WORKFLOW_NAME} run ${RUN_ID}; suppressing transition notification."
-              exit 0
+          recorded_state=unknown
+          recorded_at=""
+          if [[ "$lookup_ok" == true && -z "$artifact_id" ]]; then
+            recorded_state=none
+          elif [[ -n "$artifact_id" ]] \
+            && gh api "/repos/${REPOSITORY}/actions/artifacts/${artifact_id}/zip" > "${state_dir}/previous.zip" \
+            && stored="$(unzip -p "${state_dir}/previous.zip" state)"; then
+            stored_state="$(sed -n 1p <<< "$stored")"
+            if [[ "$stored_state" == failing || "$stored_state" == passing ]]; then
+              recorded_state="$stored_state"
+              recorded_at="$(sed -n 2p <<< "$stored")"
             fi
-            prior_conclusion="$(printf '%s\n' "$prior_jobs" | jq -s '{jobs: map(.jobs[])}' | suite_conclusion)"
-            [[ "$prior_conclusion" != none ]] || prior_conclusion=""
           fi
+          echo "Recorded state for ${BRANCH}: ${recorded_state} (source created ${recorded_at:-unknown}); this run's source created ${SOURCE_CREATED_AT}"
 
-          if ! history="$(gh api -X GET "/repos/${REPOSITORY}/actions/workflows/${WORKFLOW_ID}/runs" -f "branch=${BRANCH}" -F per_page=25)"; then
-            if [[ "$current_suite" == success && -z "$prior_conclusion" ]]; then
-              echo "::warning::Could not inspect recent ${WORKFLOW_NAME} history; suppressing recovery notification."
-              exit 0
+          if [[ -n "$recorded_at" && "$SOURCE_CREATED_AT" < "$recorded_at" ]]; then
+            echo "Action: none (a newer suite result is already recorded)"
+            exit 0
+          fi
+
+          # A recorded failure is only saved after its alert was posted, so a
+          # recovery posts at most once per reported failure.
+          header=""
+          if [[ "$CURRENT_SUITE" == success ]]; then
+            new_state=passing
+            if [[ "$recorded_state" == failing ]]; then
+              header="✅ Live E2E recovered"
+              text="Live E2E recovered"
+              detail="Live E2E is passing again after the failure reported earlier."
+            else
+              echo "Action: recorded ${BRANCH} as passing"
             fi
-            echo "::warning::Could not inspect recent ${WORKFLOW_NAME} history; continuing with the confirmed current result."
           else
-            candidates="$(jq -r --argjson current_number "$RUN_NUMBER" --argjson current_attempt "$RUN_ATTEMPT" '(.workflow_runs // []) | map(select((.run_number != $current_number or (.run_attempt // 1) != $current_attempt) and .status == "completed" and (.conclusion == "failure" or .conclusion == "success"))) | sort_by(.run_number, (.run_attempt // 1)) | reverse | .[] | [.id, (.run_attempt // 1), .run_number, .conclusion] | @tsv' <<< "$history")"
-            while IFS=$'\t' read -r candidate_id candidate_attempt candidate_number candidate_conclusion; do
-              [[ -z "$candidate_id" ]] && continue
-              if (( candidate_number > RUN_NUMBER || (candidate_number == RUN_NUMBER && candidate_attempt > RUN_ATTEMPT) )); then
-                relation=newer
-              else
-                relation=older
+            new_state=failing
+            # The lock group replaces a pending notifier when another arrives, and the
+            # replaced run is cancelled; a pass dropped that way would have re-armed this alert.
+            dropped=false
+            if [[ "$recorded_state" == failing && -n "$recorded_at" ]]; then
+              notify_workflow="${NOTIFY_WORKFLOW_REF%@*}"
+              if ! cancelled="$(gh api -X GET "/repos/${REPOSITORY}/actions/workflows/${notify_workflow##*/}/runs" -f status=cancelled -f "created=>=${recorded_at}" -F per_page=1 --jq '.total_count')" \
+                || [[ "$cancelled" != 0 ]]; then
+                dropped=true
               fi
-              if [[ "$relation" == newer || -z "$prior_conclusion" ]]; then
-                if ! candidate_jobs="$(gh api --paginate "/repos/${REPOSITORY}/actions/runs/${candidate_id}/attempts/${candidate_attempt}/jobs?per_page=100")"; then
-                  echo "::warning::Could not inspect candidate run ${candidate_id}; suppressing notification because history is incomplete."
-                  exit 0
-                fi
-                candidate_suite="$(printf '%s\n' "$candidate_jobs" | jq -s '{jobs: map(.jobs[])}' | suite_conclusion)"
-                if [[ "$candidate_suite" == none && "$WORKFLOW_NAME" == "Live E2E" && "$candidate_conclusion" == failure ]]; then
-                  candidate_suite=failure
-                fi
-                if [[ "$candidate_suite" == failure || "$candidate_suite" == success ]]; then
-                  if [[ "$relation" == newer ]]; then
-                    echo "A newer completed relevant suite exists; suppressing stale notification."
-                    exit 0
-                  fi
-                  prior_conclusion="$candidate_suite"
-                  break
-                fi
+            fi
+            if [[ "$recorded_state" == failing && "$dropped" == false ]]; then
+              echo "Action: recorded ${BRANCH} as failing (failure already reported)"
+            else
+              if [[ "$recorded_state" == unknown ]]; then
+                echo "::warning::Could not read ${state_artifact}; posting the failure in case it is new."
+              elif [[ "$dropped" == true ]]; then
+                echo "::warning::A notifier run may have been dropped since the recorded failure; posting the failure in case the suite recovered in between."
+              fi
+              if [[ "$STARTUP_FAILURE" == true ]]; then
+                header="❌ Live E2E failed to start"
+                text="Live E2E failed to start"
+                detail="The Live E2E workflow failed before it produced a Live e2e job."
+              else
+                header="❌ Live E2E failed"
+                text="Live E2E failed"
+                detail="The ${WORKFLOW_NAME} live suite failed."
               fi
-            done <<< "$candidates"
+            fi
           fi
 
-          if [[ "$current_suite" == success ]]; then
-            [[ "$prior_conclusion" == failure ]] || exit 0
-            header="✅ Live E2E recovered"
-            text="Live E2E recovered"
-            detail="The previous relevant ${WORKFLOW_NAME} live suite failed; this run passed."
-          else
-            [[ "$prior_conclusion" != failure ]] || exit 0
-            if [[ "$startup_failure" == true ]]; then
-              header="❌ Live E2E failed to start"
-              text="Live E2E failed to start"
-              detail="The Live E2E workflow failed before it produced a Live e2e job."
-            else
-              header="❌ Live E2E failed"
-              text="Live E2E failed"
-              detail="The ${WORKFLOW_NAME} live suite failed."
-            fi
+          if [[ -n "$header" ]]; then
+            run_url="https://github.com/${REPOSITORY}/actions/runs/${RUN_ID}"
+            commit_url="https://github.com/${REPOSITORY}/commit/${SHA}"
+            payload="$(jq -n --arg text "$text" --arg header "$header" --arg detail "$detail" --arg run_url "$run_url" --arg commit_url "$commit_url" --arg branch "$BRANCH" --arg sha "${SHA:0:7}" '{text:$text,blocks:[{type:"header",text:{type:"plain_text",text:$header,emoji:true}},{type:"section",text:{type:"mrkdwn",text:($detail + "\n*Branch:* `" + $branch + "`\n*Commit:* <" + $commit_url + "|" + $sha + ">\n*Workflow run:* <" + $run_url + "|view logs and failed tests>")}}]}')"
+            curl -fsSL -X POST -H 'Content-type: application/json' --data "$payload" "$SLACK_WEBHOOK"
+            echo "Action: posted ${text}"
           fi
 
-          run_url="https://github.com/${REPOSITORY}/actions/runs/${RUN_ID}"
-          commit_url="https://github.com/${REPOSITORY}/commit/${SHA}"
-          payload="$(jq -n --arg text "$text" --arg header "$header" --arg detail "$detail" --arg run_url "$run_url" --arg commit_url "$commit_url" --arg branch "$BRANCH" --arg sha "${SHA:0:7}" '{text:$text,blocks:[{type:"header",text:{type:"plain_text",text:$header,emoji:true}},{type:"section",text:{type:"mrkdwn",text:($detail + "\n*Branch:* `" + $branch + "`\n*Commit:* <" + $commit_url + "|" + $sha + ">\n*Workflow run:* <" + $run_url + "|view logs and failed tests>")}}]}')"
-          curl -fsSL -X POST -H 'Content-type: application/json' --data "$payload" "$SLACK_WEBHOOK"
+          printf '%s\n%s\n' "$new_state" "$SOURCE_CREATED_AT" > "${state_dir}/state"
+          {
+            echo "state=${new_state}"
+            echo "artifact=${state_artifact}"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Record reported state
+        if: steps.notify.outputs.state != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ${{ steps.notify.outputs.artifact }}
+          path: ${{ runner.temp }}/live-e2e-alert-state/state
+          retention-days: 90
+          if-no-files-found: error
diff --git a/.github/workflows/slim-release-published.yml b/.github/workflows/slim-release-published.yml
index 9e90d9a362..f8520274f1 100644
--- a/.github/workflows/slim-release-published.yml
+++ b/.github/workflows/slim-release-published.yml
@@ -1,23 +1,7 @@
 name: Slim Release Published
 
-# supabase/slim-services sends this dispatch after it mints an immutable release
-# `<service>-<upstream_version>-r<revision>`. The stack catalog
-# (packages/stack/src/Artifacts.ts) is the single version table for the service; this workflow
-# treats the dispatch as a trigger and reconciles the catalog against every committed
-# (published, non-draft) `<service>-...-r<N>` release, opening or updating one pull request per
-# hotfix and/or upgrade it finds (`.github/scripts/sync-artifacts-catalog.ts`'s `planSlimUpdates`).
-#
-# Plan and apply run from the same checkout of the default branch, in a single job: a re-run
-# always recomputes from the latest develop, so a stale plan can never be applied, and a
-# superseded PR's branch is rewritten in place (force-pushed) instead of racing a fresh one. A
-# backlog republish of an older upstream version naturally plans nothing.
-#
-# The payload arrives with whatever authority holds the dispatch token, so it is treated as
-# untrusted: fields are pattern- and shape-checked before use
-# (`validateSlimReleasePublishedPayload`), and never interpolated directly into a `run:` script
-# (only passed through `env:`). Release tag names come from an external API too, so every value
-# `planSlimUpdates` emits is re-validated against the same anchored patterns before it can reach a
-# branch name or PR title.
+# Reconciles the stack catalog against supabase/slim-services releases. See
+# docs/adr/0026-slim-artifact-mirrors.md, "Hotfix and upgrade pickup".
 
 on:
   repository_dispatch:
@@ -30,13 +14,15 @@ permissions:
 concurrency:
   group: slim-release-published-${{ github.event.client_payload.service }}
   cancel-in-progress: false
+  # The default `single` cancels a pending run when another is queued, losing its release-visibility wait.
+  queue: max
 
 jobs:
   pickup:
     runs-on: ubuntu-latest
     # Setup (~10 min) + release visibility (<1 min) + the S3-mirror wait (up to ~10 min, normally only
-    # for the first planned item) + pin, render and push per item.
-    timeout-minutes: 45
+    # for the first planned item) + pin, render and push per item + the merge-queue wait (up to 30 min).
+    timeout-minutes: 75
     permissions:
       contents: read
     steps:
@@ -46,9 +32,7 @@ jobs:
           ref: ${{ github.event.repository.default_branch }}
           persist-credentials: false
 
-      # Installs the locked workspace dependencies the scripts need: `Artifacts.ts` imports
-      # `effect`, and `render-service-dockerfile.ts` imports `@supabase/stack/internal/artifacts`.
-      # Replaces the bare mise step the pre-single-table version of this workflow used.
+      # `Artifacts.ts` and `render-service-dockerfile.ts` import locked workspace dependencies.
       - name: Setup
         uses: ./.github/actions/setup
         with:
@@ -58,13 +42,7 @@ jobs:
         id: base
         run: echo "sha=$(git rev-parse HEAD)" >>"$GITHUB_OUTPUT"
 
-      # Delegates to `validateSlimReleasePublishedPayload` (sync-artifacts-catalog.ts) so every
-      # field — including `upstream_version` and `release_version`, not just `service` and
-      # `revision` — is checked against an anchored charset before it is ever written to
-      # `$GITHUB_OUTPUT`, a branch name, or a PR title. A value that fails validation makes the
-      # script exit non-zero and print a single `::error ::…` line to stdout (the rejected value
-      # is JSON-escaped in that message, so it can never smuggle in a newline or workflow command),
-      # which this step re-echoes so it still surfaces as an annotation.
+      # Re-echoes a validate-payload failure so its `::error ::…` line surfaces as an annotation.
       - name: Validate payload
         id: validate
         env:
@@ -81,17 +59,7 @@ jobs:
           fi
           echo "$output" >>"$GITHUB_OUTPUT"
 
-      # Reconciles the service against every committed slim-services release (`planSlimUpdates`),
-      # not just the release that triggered this dispatch — this run is idempotent and safe to
-      # receive out of order. Records go only to `--output` (never stdout): each line is
-      # field-separated with `\x1f` (see `updateLine`), which a later step reads directly. Any
-      # `::warning ::…` the planner emits (an ignored tag, say) prints to this step's own stdout
-      # instead, so it can never be mistaken for a malformed record.
-      #
-      # `--expect-release` guards against the releases API lagging behind this very dispatch: it
-      # requires `<service>-<release_version>` to be a listed tag before planning runs at all,
-      # re-listing a bounded number of times first (`waitForExpectedRelease`). Without it, a slow
-      # API would make this run plan without the release that triggered it, and pass quietly.
+      # `--expect-release` waits for the releases API to list the release behind this dispatch.
       - name: Plan updates
         id: plan
         env:
@@ -134,25 +102,20 @@ jobs:
           permission-contents: write
           permission-pull-requests: write
 
-      # One branch per planned item, built fresh from the base commit recorded above (the default
-      # branch's head at the start of this run) — never from wherever a previous loop iteration
-      # left HEAD. Pins exactly the planned release (`--release`, never "highest at apply time"),
-      # so plan and pin agree by construction: a revision minted a second later arrives with its
-      # own dispatch, not by racing this one.
-      #
-      # The app token (contents + pull-requests write) never reaches third-party code or disk:
-      # `git push` takes it only as part of an explicit URL, computed once as `push_url`
-      # (overridable via `PUSH_REMOTE_URL`, the seam a dry run uses to target a local bare repo
-      # instead), and `gh` gets it inline per call. Every `bun`/`pnpm` command below — the sync
-      # script, the Dockerfile generator, the formatter — runs under `env -u APP_TOKEN` so a
-      # compromised transitive dependency of any of them (they import `effect`) can't read it.
+      # One branch per planned item, rebuilt from the recorded base commit, never from a previous
+      # iteration's HEAD; `--release` pins the planned release, never "highest at apply time".
+      # `bun`/`pnpm` run with the tokens unset: only `git push` and `gh` ever see them.
+      # A merge-queued branch rejects pushes; see ADR 0026 "Hotfix and upgrade pickup" for the wait and hand-off.
       - name: Apply planned updates
         if: steps.plan.outputs.count != '0'
         env:
           APP_TOKEN: ${{ steps.app-token.outputs.token }}
           GITHUB_TOKEN: ${{ github.token }}
           SERVICE: ${{ steps.validate.outputs.service }}
+          UPSTREAM_VERSION: ${{ steps.validate.outputs.upstream_version }}
+          REVISION: ${{ steps.validate.outputs.revision }}
           RELEASE_VERSION: ${{ steps.validate.outputs.release_version }}
+          REPLAY: ${{ github.event.client_payload.replay }}
           BASE_SHA: ${{ steps.base.outputs.sha }}
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         run: |
@@ -162,9 +125,16 @@ jobs:
           push_url="${PUSH_REMOTE_URL:-https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}.git}"
           manual_prefix="bun .github/scripts/sync-artifacts-catalog.ts --service ${SERVICE} --release"
 
-          # Read the records on fd 3, not stdin: every command the loop body runs (`bun`, `gh`,
-          # `git`) otherwise shares stdin with the `read`, and any of them consuming a byte of it
-          # would swallow the rest of the file's records.
+          in_merge_queue() {
+            # shellcheck disable=SC2016 # `$owner`, `$name` and `$branch` are GraphQL variables.
+            GH_TOKEN="$APP_TOKEN" gh api graphql \
+              -f query='query($owner: String!, $name: String!, $branch: String!) { repository(owner: $owner, name: $name) { pullRequests(headRefName: $branch, states: OPEN, first: 10) { nodes { isInMergeQueue isCrossRepository } } } }' \
+              -f owner="${GITHUB_REPOSITORY%/*}" -f name="${GITHUB_REPOSITORY#*/}" -f branch="$1" \
+              --jq '[.data.repository.pullRequests.nodes[] | select(.isCrossRepository | not) | .isInMergeQueue] | any'
+          }
+
+          # Reads records on fd 3, not stdin, so commands the loop runs (`bun`, `gh`, `git`) never
+          # consume bytes meant for `read`.
           while IFS=$'\x1f' read -r -u 3 kind branch title release from; do
             if [ -z "$kind" ] || [ -z "$branch" ] || [ -z "$title" ] || [ -z "$release" ] || [ -z "$from" ]; then
               echo "::error ::Malformed plan-updates line: kind='${kind}' branch='${branch}' title='${title}' release='${release}' from='${from}'."
@@ -190,20 +160,63 @@ jobs:
             git add -- "${generated_files[@]}"
             git commit -m "$title"
 
-            if ! git push --force "$push_url" "HEAD:refs/heads/${branch}"; then
-              echo "::error ::Failed to push ${branch}. Run manually: ${manual_prefix} ${release}, regenerate the Dockerfiles with \`bun apps/cli/scripts/render-service-dockerfile.ts\`, then open a pull request by hand."
-              exit 1
+            if ! push_output="$(git push --force "$push_url" "HEAD:refs/heads/${branch}" 2>&1)"; then
+              echo "$push_output"
+              if ! grep -q "queued for merging cannot be updated" <<<"$push_output"; then
+                echo "::error ::Failed to push ${branch}. Run manually: ${manual_prefix} ${release}, regenerate the Dockerfiles with \`bun apps/cli/scripts/render-service-dockerfile.ts\`, then open a pull request by hand."
+                exit 1
+              fi
+              manual_steps="run manually: ${manual_prefix} ${release}, regenerate the Dockerfiles with \`bun apps/cli/scripts/render-service-dockerfile.ts\`, then open a pull request by hand."
+              queued_steps="Once ${branch} leaves the merge queue, ${manual_steps}"
+              # The app token minted just before this step expires after one hour; capping the wait at
+              # 50 minutes into the step leaves room for the lookups and the dispatch that follow it.
+              deadline=$((SECONDS + 1800 < 3000 ? SECONDS + 1800 : 3000))
+              while :; do
+                if ! queued="$(in_merge_queue "$branch")"; then
+                  echo "::error ::Failed to read the merge-queue state of ${branch}. ${queued_steps}"
+                  exit 1
+                fi
+                case "$queued" in
+                  false) break ;;
+                  true) ;;
+                  *)
+                    echo "::error ::Unexpected merge-queue state '${queued}' for ${branch}. ${queued_steps}"
+                    exit 1
+                    ;;
+                esac
+                if [ "$SECONDS" -ge "$deadline" ]; then
+                  echo "::error ::${branch} is still in the merge queue. ${queued_steps}"
+                  exit 1
+                fi
+                sleep 30
+              done
+              # `replay` counts consecutive re-sends; anything but 0-2 stops the chain.
+              if ! [[ "${REPLAY:-0}" =~ ^[0-2]$ ]]; then
+                echo "::error ::Stopped re-dispatching after repeated merge-queue rejections of ${branch}; ${manual_steps}"
+                exit 1
+              fi
+              if ! GH_TOKEN="$APP_TOKEN" gh api "repos/${GITHUB_REPOSITORY}/dispatches" \
+                -f event_type=slim-release-published \
+                -f "client_payload[service]=${SERVICE}" \
+                -f "client_payload[upstream_version]=${UPSTREAM_VERSION}" \
+                -f "client_payload[revision]=${REVISION}" \
+                -f "client_payload[release_version]=${RELEASE_VERSION}" \
+                -f "client_payload[replay]=$((${REPLAY:-0} + 1))"; then
+                echo "::error ::Failed to re-dispatch slim-release-published for ${SERVICE} ${RELEASE_VERSION}. Re-run this job."
+                exit 1
+              fi
+              echo "::warning ::${branch} was held by a merge-queued pull request; re-dispatched slim-release-published so a fresh run re-plans from ${DEFAULT_BRANCH}."
+              exit 0
             fi
+            echo "$push_output"
 
             if [ "$kind" = "upgrade" ]; then
               action="bumps"
             else
               action="pins"
             fi
-            # Names the release this PR actually pins as the subject; the dispatch's triggering
-            # release (RELEASE_VERSION) can differ from it (a hotfix dispatch commonly also
-            # yields an unrelated upgrade on the same line), so it's only mentioned, not implied
-            # to be what changed.
+            # Names the release this PR actually pins, not necessarily RELEASE_VERSION: postgres
+            # can plan a hotfix on one line and an unrelated upgrade on another in one dispatch.
             body="$(printf 'This %s %s from %s to %s.\n\nhttps://github.com/supabase/slim-services/releases/tag/%s-%s\n\nPlanned after supabase/slim-services published %s. This branch is rewritten from %s whenever a newer relevant release arrives.\n' \
               "$action" "$SERVICE" "$from" "$release" "$SERVICE" "$release" "$RELEASE_VERSION" "$DEFAULT_BRANCH")"
 
@@ -218,7 +231,6 @@ jobs:
             elif ! GH_TOKEN="$APP_TOKEN" gh pr create \
               --title "$title" \
               --body "$body" \
-              --assignee jgoux \
               --head "$branch" \
               --base "$DEFAULT_BRANCH"; then
               echo "::error ::Pushed ${branch} but failed to open a pull request. Run manually: ${manual_prefix} ${release}, then open a pull request from ${branch} against ${DEFAULT_BRANCH} by hand."
diff --git a/.gitignore b/.gitignore
index a1d49ff0cf..ff9c4a0605 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,7 +5,8 @@ coverage/
 .env
 .env.*
 !.env.example
-.claude/
+.claude/*
+!.claude/skills
 .agents/.repos/effect-v3
 .repos/slim-services/
 .worktrees/
diff --git a/.oxlintrc.effect.json b/.oxlintrc.effect.json
index 137f3fb227..d4ab0a187a 100644
--- a/.oxlintrc.effect.json
+++ b/.oxlintrc.effect.json
@@ -8,23 +8,10 @@
     "**",
     "!packages/stack/**",
     "!apps/cli/src/commands/**",
-    "!apps/cli/src/shared/auth/**",
-    "!apps/cli/src/shared/compute/**",
-    "!apps/cli/src/shared/config/**",
-    "!apps/cli/src/shared/feedback/**",
-    "!apps/cli/src/shared/functions/functions-docker.ts",
-    "!apps/cli/src/shared/functions/functions-docker.unit.test.ts",
-    "!apps/cli/src/shared/functions/serve.ts",
-    "!apps/cli/src/shared/functions/serve.unit.test.ts",
-    "!apps/cli/src/shared/git/**",
-    "!apps/cli/src/shared/init/**",
-    "!apps/cli/src/shared/issue/**",
-    "!apps/cli/src/shared/output/**",
-    "!apps/cli/src/shared/runtime/**",
-    "!apps/cli/src/shared/services/**",
-    "!apps/cli/src/shared/telemetry/**",
+    "!apps/cli/src/shared/**",
     // Last match wins across the whole list: keep bare re-exclusions after every
     // `!` entry that would otherwise re-include them.
+    "apps/cli/src/shared/cli/bin.ts",
     "apps/cli/src/shared/compute/stacks/**",
     "apps/cli/src/shared/feedback/database.types.ts",
     "!apps/cli/tests/helpers/branches-live.ts",
diff --git a/AGENTS.md b/AGENTS.md
index 7cdec80512..5511ea065b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -38,6 +38,14 @@ The skill is authoritative for Effect coding practices when repository instructi
 Effect linting uses oxlint via `.oxlintrc.effect.json`; run `pnpm lint:effect:check` or
 `pnpm lint:effect:fix` from the repository root.
 
+Instrument by default: when you add or change code that does I/O (HTTP, SQL, filesystem beyond a
+small read, child processes, containers, waits) or millisecond-scale work, give it a named span
+(`Effect.fn("Area.operation")`, or `Effect.withSpan("<command>.<phase>")` for handler phases) and
+annotate outcomes that help debugging, such as counts, cache hits, attempts, and exit codes. Keep
+`Effect.fnUntraced` for pure helpers and per-item loop bodies. Follow the
+[tracing conventions ADR](docs/adr/0027-cli-tracing-conventions.md) for naming, attribute rules,
+and what never to record.
+
 ## Commands, validation, and workflows
 
 Package scripts are the source of truth for leaf workspaces; root-owned Turbo coordinates build,
@@ -137,7 +145,10 @@ limitations over speculative machinery while preserving required safeguards.
 - Assert behavior that matters to consumers, not implementation details. Prefer real parsers and observable outcomes over source-text or registry checks. Exercise shared contracts across supported implementations.
 - Make assertions meaningful: establish prerequisites, check specific failures, and choose matchers that express the intended contract.
 - Keep setup concise with small fixtures. Accept some duplication rather than introducing unnecessary test abstractions.
-- Remove redundant coverage. Push back on review suggestions that add assertions without protecting meaningful behavior.
+
+Follow the [test-audit skill](.agents/skills/test-audit/SKILL.md) whenever a test is written,
+changed, or reviewed: it gates new tests before they land and audits existing ones for redundant,
+mock-driven, or implementation-coupled coverage.
 
 Name tests `*.unit.test.ts`, `*.integration.test.ts`, or `*.e2e.test.ts`; colocate them with source.
 Use `tests/` for shared helpers. For CLI commands, unit-test complex pure logic, integration-test
diff --git a/apps/cli-go/api/v1-openapi.yaml b/apps/cli-go/api/v1-openapi.yaml
index 5c3a40fa29..b65a666863 100644
--- a/apps/cli-go/api/v1-openapi.yaml
+++ b/apps/cli-go/api/v1-openapi.yaml
@@ -20,8 +20,7 @@ paths:
                 example: abcdefghijklmnopqrst
               - type: string
                 format: uuid
-                pattern: >-
-                  ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+                pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
                 deprecated: true
       responses:
         '200':
@@ -71,8 +70,7 @@ paths:
                 example: abcdefghijklmnopqrst
               - type: string
                 format: uuid
-                pattern: >-
-                  ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+                pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
                 deprecated: true
       requestBody:
         required: true
@@ -131,8 +129,7 @@ paths:
                 example: abcdefghijklmnopqrst
               - type: string
                 format: uuid
-                pattern: >-
-                  ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+                pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
                 deprecated: true
         - name: force
           required: false
@@ -192,8 +189,7 @@ paths:
                 example: abcdefghijklmnopqrst
               - type: string
                 format: uuid
-                pattern: >-
-                  ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+                pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
                 deprecated: true
       requestBody:
         required: true
@@ -250,8 +246,7 @@ paths:
                 example: abcdefghijklmnopqrst
               - type: string
                 format: uuid
-                pattern: >-
-                  ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+                pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
                 deprecated: true
       requestBody:
         required: true
@@ -308,8 +303,7 @@ paths:
                 example: abcdefghijklmnopqrst
               - type: string
                 format: uuid
-                pattern: >-
-                  ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+                pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
                 deprecated: true
       requestBody:
         required: true
@@ -366,8 +360,7 @@ paths:
                 example: abcdefghijklmnopqrst
               - type: string
                 format: uuid
-                pattern: >-
-                  ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+                pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
                 deprecated: true
       responses:
         '201':
@@ -421,8 +414,7 @@ paths:
                 example: abcdefghijklmnopqrst
               - type: string
                 format: uuid
-                pattern: >-
-                  ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+                pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
                 deprecated: true
         - name: included_schemas
           required: false
@@ -714,8 +706,7 @@ paths:
           in: query
           schema:
             format: uuid
-            pattern: >-
-              ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+            pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
             example: 66666666-6666-4666-8666-666666666666
             type: string
         - name: response_type
@@ -908,8 +899,7 @@ paths:
           in: query
           schema:
             format: uuid
-            pattern: >-
-              ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+            pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
             example: 66666666-6666-4666-8666-666666666666
             type: string
         - name: response_type
@@ -1054,8 +1044,7 @@ paths:
           in: path
           schema:
             format: uuid
-            pattern: >-
-              ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+            pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
             example: 44444444-4444-4444-8444-444444444444
             type: string
       responses:
@@ -1593,8 +1582,7 @@ paths:
           in: path
           schema:
             format: uuid
-            pattern: >-
-              ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+            pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
             example: 22222222-2222-4222-8222-222222222222
             type: string
         - name: reveal
@@ -1660,8 +1648,7 @@ paths:
           in: path
           schema:
             format: uuid
-            pattern: >-
-              ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+            pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
             example: 22222222-2222-4222-8222-222222222222
             type: string
         - name: reveal
@@ -1723,8 +1710,7 @@ paths:
           in: path
           schema:
             format: uuid
-            pattern: >-
-              ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+            pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
             example: 22222222-2222-4222-8222-222222222222
             type: string
         - name: reveal
@@ -2862,8 +2848,7 @@ paths:
           content:
             application/json:
               schema:
-                $ref: >-
-                  #/components/schemas/PostgrestConfigWithJWTSecretResponse_Output
+                $ref: '#/components/schemas/PostgrestConfigWithJWTSecretResponse_Output'
         '401':
           description: Unauthorized
         '403':
@@ -4269,8 +4254,7 @@ paths:
           in: path
           schema:
             format: uuid
-            pattern: >-
-              ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+            pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
             example: 33333333-3333-4333-8333-333333333333
             type: string
         - name: ref
@@ -4313,8 +4297,7 @@ paths:
           in: path
           schema:
             format: uuid
-            pattern: >-
-              ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+            pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
             example: 33333333-3333-4333-8333-333333333333
             type: string
         - name: ref
@@ -4363,8 +4346,7 @@ paths:
           in: path
           schema:
             format: uuid
-            pattern: >-
-              ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+            pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
             example: 33333333-3333-4333-8333-333333333333
             type: string
         - name: ref
@@ -4605,8 +4587,7 @@ paths:
           in: path
           schema:
             format: uuid
-            pattern: >-
-              ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+            pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
             example: 88888888-8888-4888-8888-888888888888
             type: string
       responses:
@@ -4653,8 +4634,7 @@ paths:
           in: path
           schema:
             format: uuid
-            pattern: >-
-              ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+            pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
             example: 88888888-8888-4888-8888-888888888888
             type: string
       responses:
@@ -4777,8 +4757,7 @@ paths:
           content:
             application/json:
               schema:
-                $ref: >-
-                  #/components/schemas/GetProjectAvailableRestoreVersionsResponse_Output
+                $ref: '#/components/schemas/GetProjectAvailableRestoreVersionsResponse_Output'
         '401':
           description: Unauthorized
         '403':
@@ -5327,8 +5306,7 @@ paths:
           in: query
           schema:
             format: date-time
-            pattern: >-
-              ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
+            pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
             example: '2025-03-01T00:00:00Z'
             type: string
         - name: iso_timestamp_end
@@ -5336,8 +5314,7 @@ paths:
           in: query
           schema:
             format: date-time
-            pattern: >-
-              ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
+            pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
             example: '2025-03-01T23:59:59Z'
             type: string
       responses:
@@ -6485,8 +6462,7 @@ paths:
           in: path
           schema:
             format: uuid
-            pattern: >-
-              ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+            pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
             example: 55555555-5555-4555-8555-555555555555
             type: string
       responses:
@@ -6529,8 +6505,7 @@ paths:
           in: path
           schema:
             format: uuid
-            pattern: >-
-              ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+            pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
             example: 55555555-5555-4555-8555-555555555555
             type: string
       responses:
@@ -7836,8 +7811,7 @@ paths:
           in: path
           schema:
             format: uuid
-            pattern: >-
-              ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+            pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
             example: 77777777-7777-4777-8777-777777777777
             type: string
       responses:
@@ -7888,8 +7862,7 @@ paths:
           in: path
           schema:
             format: uuid
-            pattern: >-
-              ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+            pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
             example: 77777777-7777-4777-8777-777777777777
             type: string
       requestBody:
@@ -7946,8 +7919,7 @@ paths:
           in: path
           schema:
             format: uuid
-            pattern: >-
-              ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+            pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
             example: 77777777-7777-4777-8777-777777777777
             type: string
       responses:
@@ -8833,8 +8805,7 @@ components:
         id:
           type: string
           format: uuid
-          pattern: >-
-            ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+          pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
         name:
           type: string
         project_ref:
@@ -8872,18 +8843,15 @@ components:
         created_at:
           type: string
           format: date-time
-          pattern: >-
-            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
+          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
         updated_at:
           type: string
           format: date-time
-          pattern: >-
-            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
+          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
         review_requested_at:
           type: string
           format: date-time
-          pattern: >-
-            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
+          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
         with_data:
           type: boolean
         notify_url:
@@ -8892,8 +8860,7 @@ components:
         deletion_scheduled_at:
           type: string
           format: date-time
-          pattern: >-
-            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
+          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
         preview_project_status:
           type: string
           enum:
@@ -9457,8 +9424,7 @@ components:
         client_id:
           type: string
           format: uuid
-          pattern: >-
-            ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+          pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
         client_secret:
           type: string
         code:
@@ -9519,8 +9485,7 @@ components:
         client_id:
           type: string
           format: uuid
-          pattern: >-
-            ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+          pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
         client_secret:
           type: string
         refresh_token:
@@ -9956,14 +9921,12 @@ components:
         inserted_at:
           type: string
           format: date-time
-          pattern: >-
-            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
+          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
           nullable: true
         updated_at:
           type: string
           format: date-time
-          pattern: >-
-            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
+          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
           nullable: true
       required:
         - name
@@ -10324,13 +10287,11 @@ components:
         updated_at:
           type: string
           format: date-time
-          pattern: >-
-            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
+          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
         applied_at:
           type: string
           format: date-time
-          pattern: >-
-            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
+          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
       required:
         - entitlement
         - config
@@ -10439,13 +10400,11 @@ components:
         updated_at:
           type: string
           format: date-time
-          pattern: >-
-            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
+          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
         applied_at:
           type: string
           format: date-time
-          pattern: >-
-            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
+          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
         status:
           type: string
           enum:
@@ -11197,8 +11156,7 @@ components:
         id:
           type: string
           format: uuid
-          pattern: >-
-            ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+          pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
         algorithm:
           type: string
           enum:
@@ -11218,13 +11176,11 @@ components:
         created_at:
           type: string
           format: date-time
-          pattern: >-
-            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
+          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
         updated_at:
           type: string
           format: date-time
-          pattern: >-
-            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
+          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
       required:
         - id
         - algorithm
@@ -11254,8 +11210,7 @@ components:
                 kid:
                   type: string
                   format: uuid
-                  pattern: >-
-                    ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+                  pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
                 use:
                   type: string
                   enum:
@@ -11315,8 +11270,7 @@ components:
                 kid:
                   type: string
                   format: uuid
-                  pattern: >-
-                    ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+                  pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
                 use:
                   type: string
                   enum:
@@ -11364,8 +11318,7 @@ components:
                 kid:
                   type: string
                   format: uuid
-                  pattern: >-
-                    ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+                  pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
                 use:
                   type: string
                   enum:
@@ -11410,8 +11363,7 @@ components:
                 kid:
                   type: string
                   format: uuid
-                  pattern: >-
-                    ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+                  pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
                 use:
                   type: string
                   enum:
@@ -11461,8 +11413,7 @@ components:
               id:
                 type: string
                 format: uuid
-                pattern: >-
-                  ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+                pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
               algorithm:
                 type: string
                 enum:
@@ -11482,13 +11433,11 @@ components:
               created_at:
                 type: string
                 format: date-time
-                pattern: >-
-                  ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
+                pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
               updated_at:
                 type: string
                 format: date-time
-                pattern: >-
-                  ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
+                pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
             required:
               - id
               - algorithm
@@ -12074,8 +12023,7 @@ components:
           enum:
             - abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789
             - abcdefghijklmnopqrstuvwxyz:ABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789
-            - >-
-              abcdefghijklmnopqrstuvwxyz:ABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789:!@#$%^&*()_+-=[]{};'\\:"|<>?,./`~
+            - abcdefghijklmnopqrstuvwxyz:ABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789:!@#$%^&*()_+-=[]{};'\\:"|<>?,./`~
             - ''
             - null
           nullable: true
@@ -12213,8 +12161,7 @@ components:
         sms_test_otp_valid_until:
           type: string
           format: date-time
-          pattern: >-
-            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
+          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
           nullable: true
         sms_textlocal_api_key:
           type: string
@@ -12255,8 +12202,7 @@ components:
         smtp_admin_email:
           type: string
           format: email
-          pattern: >-
-            ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$
+          pattern: ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$
           nullable: true
         smtp_host:
           type: string
@@ -12551,8 +12497,7 @@ components:
         smtp_admin_email:
           type: string
           format: email
-          pattern: >-
-            ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$
+          pattern: ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$
           nullable: true
         smtp_host:
           type: string
@@ -12790,8 +12735,7 @@ components:
           enum:
             - abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789
             - abcdefghijklmnopqrstuvwxyz:ABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789
-            - >-
-              abcdefghijklmnopqrstuvwxyz:ABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789:!@#$%^&*()_+-=[]{};'\\:"|<>?,./`~
+            - abcdefghijklmnopqrstuvwxyz:ABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789:!@#$%^&*()_+-=[]{};'\\:"|<>?,./`~
             - ''
             - null
           nullable: true
@@ -12862,8 +12806,7 @@ components:
         sms_test_otp_valid_until:
           type: string
           format: date-time
-          pattern: >-
-            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
+          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
           nullable: true
         sms_textlocal_api_key:
           type: string
@@ -13340,8 +13283,7 @@ components:
         id:
           type: string
           format: uuid
-          pattern: >-
-            ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+          pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
         type:
           type: string
         oidc_issuer_url:
@@ -13669,8 +13611,7 @@ components:
         created_by:
           type: string
           format: uuid
-          pattern: >-
-            ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+          pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
       required:
         - token_alias
         - expires_at
@@ -13690,8 +13631,7 @@ components:
         created_by:
           type: string
           format: uuid
-          pattern: >-
-            ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+          pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
       required:
         - token
         - token_alias
@@ -13811,8 +13751,7 @@ components:
               observed_at:
                 type: string
                 format: date-time
-                pattern: >-
-                  ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
+                pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
             required:
               - name
               - title
@@ -13879,8 +13818,7 @@ components:
               timestamp:
                 type: string
                 format: date-time
-                pattern: >-
-                  ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|))$
+                pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|))$
               total_auth_requests:
                 type: number
               total_realtime_requests:
@@ -14167,8 +14105,7 @@ components:
         user_id:
           type: string
           format: uuid
-          pattern: >-
-            ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+          pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
         user_roles:
           type: array
           items:
@@ -14189,8 +14126,7 @@ components:
                         cidr:
                           type: string
                           format: cidrv4
-                          pattern: >-
-                            ^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$
+                          pattern: ^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$
                       required:
                         - cidr
                   allowed_cidrs_v6:
@@ -14201,8 +14137,7 @@ components:
                         cidr:
                           type: string
                           format: cidrv6
-                          pattern: >-
-                            ^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$
+                          pattern: ^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$
                       required:
                         - cidr
               branches_only:
@@ -14221,12 +14156,10 @@ components:
           anyOf:
             - type: string
               format: ipv4
-              pattern: >-
-                ^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$
+              pattern: ^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$
             - type: string
               format: ipv6
-              pattern: >-
-                ^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$
+              pattern: ^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$
       required:
         - role
         - rhost
@@ -14239,8 +14172,7 @@ components:
         user_id:
           type: string
           format: uuid
-          pattern: >-
-            ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+          pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
         act:
           type: string
         user_role:
@@ -14261,8 +14193,7 @@ components:
                       cidr:
                         type: string
                         format: cidrv4
-                        pattern: >-
-                          ^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$
+                        pattern: ^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$
                     required:
                       - cidr
                 allowed_cidrs_v6:
@@ -14273,8 +14204,7 @@ components:
                       cidr:
                         type: string
                         format: cidrv6
-                        pattern: >-
-                          ^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$
+                        pattern: ^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$
                     required:
                       - cidr
             branches_only:
@@ -14295,8 +14225,7 @@ components:
                   user_id:
                     type: string
                     format: uuid
-                    pattern: >-
-                      ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+                    pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
                   primary_email:
                     type: string
                     nullable: true
@@ -14324,8 +14253,7 @@ components:
                                   cidr:
                                     type: string
                                     format: cidrv4
-                                    pattern: >-
-                                      ^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$
+                                    pattern: ^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$
                                 required:
                                   - cidr
                             allowed_cidrs_v6:
@@ -14336,8 +14264,7 @@ components:
                                   cidr:
                                     type: string
                                     format: cidrv6
-                                    pattern: >-
-                                      ^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$
+                                    pattern: ^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$
                                 required:
                                   - cidr
                         branches_only:
@@ -14359,8 +14286,7 @@ components:
                   invite_id:
                     type: string
                     format: uuid
-                    pattern: >-
-                      ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+                    pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
                   expires_at:
                     type: string
                   user_roles:
@@ -14383,8 +14309,7 @@ components:
                                   cidr:
                                     type: string
                                     format: cidrv4
-                                    pattern: >-
-                                      ^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$
+                                    pattern: ^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$
                                 required:
                                   - cidr
                             allowed_cidrs_v6:
@@ -14395,8 +14320,7 @@ components:
                                   cidr:
                                     type: string
                                     format: cidrv6
-                                    pattern: >-
-                                      ^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$
+                                    pattern: ^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$
                                 required:
                                   - cidr
                         branches_only:
@@ -14418,8 +14342,7 @@ components:
           type: string
           minLength: 1
           format: uuid
-          pattern: >-
-            ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+          pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
         roles:
           type: array
           items:
@@ -14441,8 +14364,7 @@ components:
                         cidr:
                           type: string
                           format: cidrv4
-                          pattern: >-
-                            ^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$
+                          pattern: ^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$
                       required:
                         - cidr
                   allowed_cidrs_v6:
@@ -14453,8 +14375,7 @@ components:
                         cidr:
                           type: string
                           format: cidrv6
-                          pattern: >-
-                            ^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$
+                          pattern: ^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$
                       required:
                         - cidr
               branches_only:
@@ -14480,8 +14401,7 @@ components:
           type: string
           minLength: 1
           format: email
-          pattern: >-
-            ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$
+          pattern: ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$
         roles:
           type: array
           items:
@@ -14503,8 +14423,7 @@ components:
                         cidr:
                           type: string
                           format: cidrv4
-                          pattern: >-
-                            ^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$
+                          pattern: ^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$
                       required:
                         - cidr
                   allowed_cidrs_v6:
@@ -14515,8 +14434,7 @@ components:
                         cidr:
                           type: string
                           format: cidrv6
-                          pattern: >-
-                            ^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$
+                          pattern: ^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$
                       required:
                         - cidr
               branches_only:
@@ -14541,13 +14459,11 @@ components:
         email:
           type: string
           format: email
-          pattern: >-
-            ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$
+          pattern: ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$
         invite_id:
           type: string
           format: uuid
-          pattern: >-
-            ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+          pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
         user_roles:
           type: array
           items:
@@ -14568,8 +14484,7 @@ components:
                         cidr:
                           type: string
                           format: cidrv4
-                          pattern: >-
-                            ^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$
+                          pattern: ^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$
                       required:
                         - cidr
                   allowed_cidrs_v6:
@@ -14580,8 +14495,7 @@ components:
                         cidr:
                           type: string
                           format: cidrv6
-                          pattern: >-
-                            ^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$
+                          pattern: ^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|::|([0-9a-fA-F]{1,4})?::([0-9a-fA-F]{1,4}:?){0,6})\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$
                       required:
                         - cidr
               branches_only:
@@ -14599,8 +14513,7 @@ components:
           type: string
           minLength: 1
           format: email
-          pattern: >-
-            ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$
+          pattern: ^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$
         token:
           type: string
           minLength: 1
@@ -15733,8 +15646,7 @@ components:
         admin_suspended_at:
           type: string
           format: date-time
-          pattern: >-
-            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
+          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
           description: If set, the Realtime service has been suspended by an admin.
           nullable: true
       required:
@@ -16350,8 +16262,7 @@ components:
         completed_on:
           type: string
           format: date-time
-          pattern: >-
-            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
+          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
           nullable: true
       required:
         - name
@@ -16379,8 +16290,7 @@ components:
         updated_at:
           type: string
           format: date-time
-          pattern: >-
-            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
+          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
           description: Timestamp of when the backup schedule was last updated.
           example: '2026-05-04T14:40:44+00:00'
       required:
@@ -16702,8 +16612,7 @@ components:
         created_by:
           type: string
           format: uuid
-          pattern: >-
-            ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
+          pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
       required:
         - project
         - preview
diff --git a/apps/cli-go/pkg/config/templates/Dockerfile b/apps/cli-go/pkg/config/templates/Dockerfile
index aee8c87f83..0f56babd32 100644
--- a/apps/cli-go/pkg/config/templates/Dockerfile
+++ b/apps/cli-go/pkg/config/templates/Dockerfile
@@ -3,29 +3,45 @@
 # postgrest, pgmeta, studio, imgproxy, edgeruntime, vector, supavisor, gotrue, realtime, storage,
 # logflare. Do not hand-edit those tags; a CI drift check enforces this. Run the generator after
 # a catalog update. Everything else in this file (this comment, kong, pg14, the one-shot job
-# images) is hand- or Dependabot-managed.
-FROM supabase/postgres:17.11.0.002 AS pg
-FROM supabase/postgres:15.19.0.002 AS pg15
+# images) is hand- or Dependabot-managed. Keep a line between image lines: git conflicts on edits to
+# adjacent lines, and catalog PRs for neighbouring aliases are often open at the same time.
+FROM supabase/postgres:17.11.0.004 AS pg
+
+FROM supabase/postgres:15.19.0.004 AS pg15
 # Postgres 14 has no slim build; bumped by hand (Dependabot ignores supabase/postgres).
 FROM supabase/postgres:14.1.0.89 AS pg14
 # New always-on service alias: extend SERVICE_IMAGE_ALIASES in
 # shared/services/services.shared.ts and DOCKERFILE_ALIAS_BY_SERVICE in
 # commands/start/start.gates.ts.
 FROM library/kong:2.8.1 AS kong
+
 FROM axllent/mailpit:v1.31.3 AS mailpit
+
 FROM postgrest/postgrest:v16.4 AS postgrest
-FROM supabase/postgres-meta:v0.99.0 AS pgmeta
-FROM supabase/studio:2026.09.28-sha-5e59b60 AS studio
+
+FROM supabase/postgres-meta:v0.100.0 AS pgmeta
+
+FROM supabase/studio:2026.10.05-sha-94b8b06 AS studio
+
 FROM darthsim/imgproxy:v3.26.0 AS imgproxy
-FROM supabase/edge-runtime:v1.77.1 AS edgeruntime
+
+FROM supabase/edge-runtime:v1.77.4 AS edgeruntime
+
 FROM timberio/vector:0.58.0-alpine AS vector
+
 FROM supabase/supavisor:2.9.13 AS supavisor
+
 FROM supabase/gotrue:v2.197.0 AS gotrue
-FROM supabase/realtime:v2.140.3 AS realtime
-FROM supabase/storage-api:v1.79.28 AS storage
-FROM supabase/logflare:1.50.15 AS logflare
+
+FROM supabase/realtime:v2.140.10 AS realtime
+
+FROM supabase/storage-api:v1.79.36 AS storage
+
+FROM supabase/logflare:1.52.0 AS logflare
 # One-shot job images (not started as long-running containers); differ's alias
 # is resolved via dockerfileServiceImage("differ") in commands/db/diff/pgadmin-diff.ts.
 FROM supabase/pgadmin-schema-diff:cli-0.0.5 AS differ
+
 FROM supabase/migra:3.0.1663481299 AS migra
+
 FROM supabase/pg_prove:3.36 AS pgprove
diff --git a/apps/cli/AGENTS.md b/apps/cli/AGENTS.md
index 58cac7c8ef..99426185fb 100644
--- a/apps/cli/AGENTS.md
+++ b/apps/cli/AGENTS.md
@@ -25,8 +25,8 @@ src/commands/<command>/
   SIDE_EFFECTS.md        # required compatibility contract
 ```
 
-Register every command in `src/cli/root.ts`. Keep `.format.ts` and `.encoders.ts` pure. Tracing is
-local observability and span names follow `<command>.<sub>`. Read `src/shared/` and the
+Register every command in `src/cli/root.ts`. Keep `.format.ts` and `.encoders.ts` pure. Handler
+phase spans are named `<command>.<phase>`; see the root tracing rule. Read `src/shared/` and the
 command-level infrastructure under
 `src/config/`, `src/auth/`, `src/telemetry/`, `src/output/`, and `src/command-internal/` before
 adding an equivalent helper.
@@ -116,10 +116,10 @@ contracts remain unchanged. Update tests, generated schemas, and side-effect doc
 > [`src/shared/telemetry/error-tag-stability.unit.test.ts`](src/shared/telemetry/error-tag-stability.unit.test.ts)
 > compares every CLI and `@supabase/config` tag with the committed snapshot.
 
-Native commands use `withCommandTelemetry` from `telemetry/command-telemetry.ts`, not shared
-`withCommandInstrumentation`; pass the handler's `flags`, and pass its own `config` when it has
-choice flags. Preserve the established property shape (`flags`, `is_agent`, and `env_signals`),
-use canonical names and keys from the [event catalog](src/shared/telemetry/event-catalog.ts), and redact sensitive values.
+Native commands use `withCommandTelemetry` from `telemetry/command-telemetry.ts`; pass the
+handler's `flags`, and pass its own `config` when it has choice flags. Preserve the established
+property shape (`flags`, `is_agent`, and `env_signals`), use canonical names and keys from the
+[event catalog](src/shared/telemetry/event-catalog.ts), and redact sensitive values.
 
 `safeFlags` may include only values that carry no user data. Keep the established safe project,
 project-id, org-id, and version cases. When `--project-ref` also accepts branch names, whitelist
diff --git a/apps/cli/README.md b/apps/cli/README.md
index 25f8a27552..5baad3fd81 100644
--- a/apps/cli/README.md
+++ b/apps/cli/README.md
@@ -105,11 +105,11 @@ The CLI is built on `effect/unstable/cli`.
 
 Important areas:
 
-- `src/shared/cli/` for shared runner logic, roots, and global flags
+- `src/shared/cli/` for shared runner logic and roots
 - `src/commands/` for the command tree
 - `src/shared/output/` for text / JSON / NDJSON output policies
 - `src/shared/runtime/` for TTY, stdin, browser, and process-control services
-- `src/shared/auth/` for login-related services
+- `src/auth/` for credential and platform API services; `src/shared/auth/` keeps the JWKS and keyring helpers
 
 The local stack commands use `@supabase/stack` for lifecycle, status, logs, and runtime operations.
 Managed ownership uses stable loopback `GET /owner` and session-fenced `POST /stop`; same-version
diff --git a/apps/cli/docs/analytics.md b/apps/cli/docs/analytics.md
index 5bea4f988a..225713f0fc 100644
--- a/apps/cli/docs/analytics.md
+++ b/apps/cli/docs/analytics.md
@@ -34,18 +34,17 @@ The core pieces are:
 
 - `CurrentAnalyticsContext`
 - `withAnalyticsContext(...)`
-- `withCommandInstrumentation(...)`
+- `withCommandTelemetry(...)`
 
-`CurrentAnalyticsContext` is a `ServiceMap.Reference` that carries the current analytics context
+`CurrentAnalyticsContext` is a `Context.Reference` that carries the current analytics context
 for the running effect scope.
 
-`withCommandInstrumentation(...)` wraps command handlers and installs per-invocation tracing plus
-the per-invocation analytics context such as:
+[`withCommandTelemetry(...)`](../src/telemetry/command-telemetry.ts) wraps command handlers and
+installs the command span plus the per-invocation analytics context:
 
 - `command_run_id`
 - `command`
-- `flags_used`
-- `flag_values`
+- `flags`
 
 That same context is then inherited by milestone events captured inside the command handler, which
 lets one CLI invocation share a single `command_run_id`.
@@ -59,10 +58,10 @@ The primary analytics event is:
 It is emitted once per handled command invocation and includes:
 
 - `command`
-- `flags_used`
-- `flag_values`
+- `flags`
 - `exit_code`
 - `duration_ms`
+- `output_format`
 
 Failed invocations (`exit_code != 0`) handled by the TS shells also carry a
 sanitized error classification:
@@ -87,17 +86,27 @@ they existed never carry them. KPI queries therefore scope to
 reports the classified share of failures so the covered fraction is explicit
 rather than assumed.
 
-Flag capture is intentionally conservative:
+Local-runtime commands also carry properties that split error rates by runtime:
 
-- `flags_used` is always captured
-- `flag_values` defaults to an empty object
-- commands must opt specific flag values in explicitly later if needed
+- `stack_backend` (`legacy` or `stack`) on commands routed by `experimental.stack`; see
+  [backend selection](stack-commands.md)
+- `stack_runtime` (`docker`, `podman`, or `native`): the runtime of the stack a stack-backend
+  command looked up, which for `--db-url` may be the project stack even when the URL targets
+  another database
+- `orioledb` (boolean) once the command resolves local database config, `true` when the project
+  selects an OrioleDB image (`db.orioledb_version` on a 15/17 project). It describes local config
+  only; for linked or `--db-url` targets it says nothing about the remote database
+
+Flag capture is intentionally conservative: `flags` records only flags changed on the command
+line, and redacts each value unless it is boolean, a choice flag, or listed in the command's
+`safeFlags`.
 
 Current milestone events include:
 
 - `cli_login_completed`
 - `cli_project_linked`
 - `cli_stack_started`
+- `cli_upgrade_suggested`
 
 ## Shared Properties and Identity
 
@@ -110,7 +119,8 @@ The analytics layer attaches a base set of properties to every PostHog event:
 - `is_first_run`
 - `is_tty`
 - `is_ci`
-- `ai_tool`
+- `is_agent`
+- `env_signals` (allowlisted agent and terminal environment variables, when any are set)
 - `os`
 - `arch`
 - `cli_version`
diff --git a/apps/cli/docs/code-structure.md b/apps/cli/docs/code-structure.md
index 7c911ed16e..3e91abb16f 100644
--- a/apps/cli/docs/code-structure.md
+++ b/apps/cli/docs/code-structure.md
@@ -54,8 +54,8 @@ Shared concern files:
 
 ```text
 auth/
-  credentials.service.ts
-  credentials.layer.ts
+  command-credentials.service.ts
+  command-credentials.layer.ts
   errors.ts
 ```
 
@@ -66,13 +66,13 @@ Rules:
 - Shared service files use `<topic>.service.ts`.
 - Shared layer files use `<topic>.layer.ts`.
 - Do not prefix leaf files with the slice name.
-  - `tracing.layer.ts`, not `telemetry.tracing.layer.ts`
-  - `credentials.service.ts`, not `auth.credentials.service.ts`
+  - `trace-export.layer.ts`, not `telemetry.trace-export.layer.ts`
+  - `command-credentials.service.ts`, not `auth.command-credentials.service.ts`
 
 ## Symbol Naming
 
-- Service symbols are plain nouns: `Credentials`, `Tracing`, `Output`.
-- Layer exports use concrete `*Layer` names: `credentialsLayer`, `tracingLayer`, `outputLayer`.
+- Service symbols are plain nouns: `Tty`, `Analytics`, `Output`.
+- Layer exports use concrete `*Layer` names: `ttyLayer`, `analyticsLayer`, `outputLayer`.
 - Do not use `.Default`.
 - Do not rely on `static layer` as the default pattern for shared concern slices.
 
@@ -134,8 +134,8 @@ If a command needs private DI, prefer colocated `*.service.ts` and `*.layer.ts`
 
 Examples where comments are expected:
 
-- `telemetry/tracing.layer.ts`
+- `telemetry/trace-export.layer.ts`
 - `output/output.layer.ts`
-- `auth/credentials.layer.ts`
+- `auth/command-credentials.layer.ts`
 
 Consistency does not mean every service or layer file needs a header. The goal is high-signal comments on important boundaries.
diff --git a/apps/cli/docs/stack-commands.md b/apps/cli/docs/stack-commands.md
index dd8cbdd896..bbe4ab9e02 100644
--- a/apps/cli/docs/stack-commands.md
+++ b/apps/cli/docs/stack-commands.md
@@ -16,7 +16,7 @@ and password-reconciliation connection uses that administrative role, so a nativ
 | `supabase stack prepare` | Download artifacts without starting services.                                     |
 | `supabase stack start`   | Create or resume the project's stack.                                             |
 | `supabase stack status`  | Show identity, readiness, and drift, or export connection variables with `--env`. |
-| `supabase stack logs`    | Stream live stack logs.                                                           |
+| `supabase stack logs`    | Print retained stack logs; `-f` streams new lines.                                |
 | `supabase stack restart` | Restart an existing stack using its saved effective configuration.                |
 | `supabase stack stop`    | Stop a stack while retaining its data.                                            |
 
@@ -124,8 +124,9 @@ The stack backend rejects every explicit legacy `-o/--output` value: `env`, `pre
 project, branch, runtime, and owner availability. Registry entries that cannot be read or decoded
 are skipped with a warning on stderr identifying each stack; only a failure to read the stacks
 directory itself fails discovery.
-The text table shortens readable IDs for scanning; use `--output-format json` or
-`--output-format stream-json` for the complete structured inventory with full IDs.
+The text table shortens readable IDs for scanning; every `--stack-id` accepts that short ID, or any
+unique prefix of at least 4 characters. Use `--output-format json` or `--output-format stream-json`
+for the complete structured inventory with full IDs.
 
 Listing is global and has no checkout filter. Owner availability is not service lifecycle or health;
 use `supabase stack status` for live state. Registry directories without a state file are ignored
@@ -160,7 +161,7 @@ Other values are rejected. The override is applied before reading the project co
 
 `supabase services` follows the same backend selection. In stack mode it lists image versions and
 canonical `ghcr.io/supabase/cli/...` names from the installed CLI's artifact catalog, including
-Mailpit and Vector. PostgreSQL uses the selected major version (15 or 17); invalid configuration
+Mailpit. PostgreSQL uses the selected major version (15 or 17); invalid configuration
 or an unsupported PostgreSQL major warns with the cause and uses catalog defaults. This inventory describes the
 CLI catalog, not running containers, downloaded images, or service health. The Docker and native
 stack runtimes use the same catalog versions, though a running stack launched by another CLI
@@ -237,18 +238,25 @@ lint transaction (always rolled back). It does not launch a client binary.
 
 ## Reading stack logs
 
-`supabase stack logs` streams live stdout/stderr from composition members without
-starting an owner or service. Select `--stack <name>` or `--stack-id <id>`;
-`--service <kind-or-instance-id>` can include standalone services too. The command
-requires a reachable owner and streams until interrupted. Ctrl-C leaves services
-running. There is no retained history, `--tail`, or `--follow` flag.
-
-Text uses `<timestamp> <service>/<instance-id>/<stream>: <line>` and strips terminal
-control sequences. For automation use `--output-format stream-json`: each
-`log-entry` contains `timestamp`, `service`, `instance_id`, `stream`, `line`, and
-`source: "live"`. Finite JSON output is not supported. Delivery is best effort;
-stdout/stderr and different services may interleave. Missing stacks, unavailable
-owners, and unmatched services fail with status 1; interruption exits 130.
+`supabase stack logs` prints the retained stdout/stderr of composition members and
+exits; `-f/--follow` then streams new lines until interrupted. Select `--stack <name>`
+or `--stack-id <id>`; the repeatable `--service <kind-or-instance-id>` can include
+standalone services too. History is read from the persisted log files, so it works
+while the stack is stopped; `--follow` requires a running owner and fails before
+printing anything without one. Neither mode starts an owner or service, and Ctrl-C
+leaves services running.
+
+`--tail N` (default 200) keeps the newest lines across the selected services and
+`--since` takes a duration (`10m`, `1h30m`), an ISO-8601 time, or `start` for each
+service's latest launch. Text uses `<service> | <HH:MM:SS.mmm> <line>` with aligned
+labels, shows launches and lost output as dim separators, strips terminal control
+sequences, and notes on stderr when the tail hides older lines. For automation use
+`--output-format stream-json`: each `log-entry` contains `timestamp`, `service`,
+`instance_id`, `stream`, `line`, and `source` (`history` or `live`), and markers are
+`log-marker` events with `kind` and, for lost output, `count`. `--output-format json`
+prints the history as one array and does not accept `--follow`. Missing stacks,
+unmatched services, and `--follow` without an owner fail with status 1; interruption
+exits 130.
 
 ## Data and configuration
 
diff --git a/apps/cli/docs/supabase-home.md b/apps/cli/docs/supabase-home.md
index b40e2c7217..4e5507407a 100644
--- a/apps/cli/docs/supabase-home.md
+++ b/apps/cli/docs/supabase-home.md
@@ -52,8 +52,8 @@ Managed stack documents and runtime artifacts are shared through the global CLI
 ```text
 <SUPABASE_HOME>/
   access-token
+  cli-latest
   telemetry.json
-  traces/
   bin/
   stacks/
     <stack-id>/
@@ -116,6 +116,16 @@ Auth, telemetry, traces, and downloaded binaries remain machine-global under `SU
 Legacy installer artifacts may coexist under that root, but they are not part of managed stack
 coordination.
 
+## Release check cache
+
+After a successful command, the upgrade notice compares the running version with the latest
+GitHub release. The release tag is cached for ten hours in `supabase/.temp/cli-latest` when the
+project directory has a real `supabase/` directory, and in `<SUPABASE_HOME>/cli-latest`
+otherwise. `--version` and `--help` check only the current directory, so from a project
+subdirectory they use `<SUPABASE_HOME>/cli-latest`. A failed fetch writes an empty file, which
+suppresses the notice and further fetches until it expires. The cache is skipped when the file,
+`supabase/.temp`, or `SUPABASE_HOME` is a symlink. `SUPABASE_NO_UPDATE_NOTIFIER=1` disables the check.
+
 ## Related docs
 
 - [CLI Code Structure](./code-structure.md)
diff --git a/apps/cli/docs/tracing-monitoring.md b/apps/cli/docs/tracing-monitoring.md
index 6c39ddcc07..a9cf43b439 100644
--- a/apps/cli/docs/tracing-monitoring.md
+++ b/apps/cli/docs/tracing-monitoring.md
@@ -1,110 +1,169 @@
 # CLI Tracing and Monitoring
 
-This document describes the CLI tracing path: spans, local trace export, and how this
-observability path is intended to relate to Sentry.
+Every CLI run can produce one span tree rooted at `cli.run`. Use it to find where time goes in a
+command. Tracing is off unless you turn it on for a run; the conventions for adding spans live in
+[ADR 0027](../../../docs/adr/0027-cli-tracing-conventions.md).
 
 For product analytics and command usage events, see [analytics.md](./analytics.md).
 
-For where CLI-owned global state lives, including telemetry state under `SUPABASE_HOME`, see
-[supabase-home.md](./supabase-home.md).
+## Turning tracing on
 
-## Purpose
+Pick one destination per run:
 
-Tracing answers observability questions such as:
+| Variable                 | Effect                                                                   |
+| ------------------------ | ------------------------------------------------------------------------ |
+| `SUPABASE_TRACE_FILE`    | Appends one OTLP/JSON batch per line to this file (`0600` when allowed). |
+| `SUPABASE_OTLP_ENDPOINT` | Posts OTLP/HTTP JSON to `<endpoint>/v1/traces`.                          |
+| `SUPABASE_OTLP_HEADERS`  | Extra collector headers as `key=value,key2=value2` (percent-encoded).    |
+| `TRACEPARENT`            | W3C trace context adopted as the parent of `cli.run` when a sink is set. |
 
-- which command ran
-- how long major phases took
-- whether the command succeeded or failed
-- what happened inside a command span tree
+Tracing never stops a command. When both `SUPABASE_TRACE_FILE` and `SUPABASE_OTLP_ENDPOINT` are
+set, the endpoint or headers are malformed, or the sink cannot start (for example, the trace
+file's directory is missing or the path is not a regular file, such as `/dev/null`), the CLI
+prints one `Warning: tracing disabled: <reason>` line on stderr and runs the command untraced with
+the same exit code and stdout. A relative `SUPABASE_TRACE_FILE` resolves against the directory the
+CLI started in. The generic `OTEL_EXPORTER_OTLP_*`, `OTEL_SERVICE_NAME`, and
+`OTEL_RESOURCE_ATTRIBUTES` variables are ignored. A sink records the run even when `TRACEPARENT`
+is marked unsampled.
 
-This path is span-based. It is intentionally separate from PostHog analytics, which is event-based
-and optimized for product questions rather than operational traces.
+`SUPABASE_DEBUG=1` or `SUPABASE_TELEMETRY_DEBUG=1`, set in the environment or the project's
+`supabase/.env`, also prints finished command spans to stderr: top-level spans, their children and
+grandchildren, plus every failed span at any depth. Spans that end before CLI settings load, and
+`cli.run` itself, are not printed. The `--debug` flag does not print spans.
 
-The tracing implementation is currently owned by the `Tracing` service and
-[`src/shared/telemetry/tracing.layer.ts`](../src/shared/telemetry/tracing.layer.ts).
+Without a sink or debug variable, spans are no-ops and the CLI does no tracing I/O. The
+implementation lives in
+[`src/shared/telemetry/trace-export.layer.ts`](../src/shared/telemetry/trace-export.layer.ts).
 
-## What Happens Today
+## Local trace file
 
-The CLI builds a custom Effect tracer and attaches a fixed set of global attributes to every span:
-
-- `schema_version`
-- `device_id`
-- `session_id`
-- `is_first_run`
-- `is_tty`
-- `is_ci`
-- `os`
-- `arch`
-- `cli_version`
-
-Commands then use normal Effect tracing primitives such as `Effect.withSpan(...)` and
-`Effect.annotateCurrentSpan(...)` to create and enrich spans.
-
-Today, tracing is exported in two ways:
+```sh
+SUPABASE_TRACE_FILE=/tmp/supabase-trace.jsonl supabase db diff
+bun apps/cli/scripts/trace-report.ts /tmp/supabase-trace.jsonl
+```
 
-- NDJSON files under `SUPABASE_HOME/traces/`
-- optional debug console output when telemetry debug is enabled
+The report prints the heaviest path from `cli.run`, the top span names by self time, repeated span
+names with counts and total time, and failed spans. Docker and Podman spans are labeled with their
+verb, such as `ContainerCli.spawn (run)`. Pass `--top N` to change list lengths and
+`--json` for machine-readable output. The file appends across runs; the report covers the run that
+ended last, or the one passed with `--trace-id`.
 
-The NDJSON exporter is the durable local trace sink. The debug console exporter is only for
-interactive inspection while developing or debugging the CLI.
+## Benchmarking
 
-## Consent and State
+`apps/cli/scripts/bench-cli.ts` compares wall time between two CLI binaries, for example a release
+build against a branch build:
 
-Tracing follows the shared telemetry consent model used by the CLI:
+```sh
+bun apps/cli/scripts/bench-cli.ts --base /tmp/cli-base/apps/cli/dist/supabase --branch apps/cli/dist/supabase \
+  --runs 10 --warmup 2 --command "--version" --command "status" --cwd-setup init --trace
+```
 
-- consent is user-level CLI state stored in `SUPABASE_HOME/telemetry.json`
-- environment overrides can still disable telemetry in CI or sandboxed runs
-- consent is not stored in `supabase/config.*`
-- consent is not stored in repo-local `.supabase/`
+It alternates launches (`base`, `branch`, `base`, `branch`, ...) so neither binary runs consistently
+warmer, discards the first `--warmup` pairs, and gives each launch an isolated `SUPABASE_HOME` and
+environment. For each command it reports the base and branch median, min, max, and p90 wall time in
+milliseconds, plus the branch-minus-base delta in ms and percent. With `--trace`, each measured
+launch is followed by an untimed launch with `SUPABASE_TRACE_FILE` set, so tracing never inflates
+the wall times, and the report adds, per span name, the median total duration and count for
+each build, sorted by the largest absolute delta; a span name present in only one build is flagged
+rather than compared. `--command` splits on whitespace and does not support shell quoting; repeat the
+flag for more than one command, and use `--cwd-setup init` when a command, such as `status`, needs to
+run inside an initialized project. Pass `--json` for a machine-readable report, `--out <file>` to
+also write the raw per-run samples, and `--cpu-prof` to capture a Bun CPU profile of one untimed
+branch launch (`BUN_OPTIONS=--cpu-prof`), printing its `.cpuprofile` path. Launches set
+`SUPABASE_NO_UPDATE_NOTIFIER=1`; pass `--update-check` to include the release check. Each launch's
+fresh `SUPABASE_HOME` has no cached release tag, so the check calls GitHub on every launch, except
+with `--cwd-setup init`, where the setup `init` caches the tag in the project before the measured
+command runs. The extra traced launches add machine load, so take wall-time conclusions from a run
+without `--trace`.
+
+To build a base binary from another commit without disturbing this worktree:
+
+```sh
+mkdir /tmp/cli-base && git archive <sha> | tar -x -C /tmp/cli-base
+rm -f /tmp/cli-base/mise.toml /tmp/cli-base/mise.lock # if mise refuses the untrusted config
+(cd /tmp/cli-base && pnpm install && pnpm exec turbo run supabase#build)
+```
 
-The consent read/write logic lives in [`src/shared/telemetry/consent.ts`](../src/shared/telemetry/consent.ts),
-and the runtime view of telemetry state is built in
-[`src/shared/telemetry/runtime.layer.ts`](../src/shared/telemetry/runtime.layer.ts).
+## Grafana, Tempo, or Jaeger
 
-When consent is not granted, the tracing layer does not initialize the NDJSON exporter. Debug
-output is gated separately by the telemetry debug flags.
+Run a local OpenTelemetry stack, for example Grafana's all-in-one image:
 
-## Local Storage Layout
+```sh
+docker run --rm -p 3000:3000 -p 4318:4318 grafana/otel-lgtm
+SUPABASE_OTLP_ENDPOINT=http://localhost:4318 supabase start
+```
 
-The tracing path writes local files under:
+Open Grafana at `http://localhost:3000`, choose the Tempo data source, and search with TraceQL:
 
 ```text
-SUPABASE_HOME/
-  telemetry.json
-  traces/
-    <date>.ndjson
+{ resource.service.name = "supabase-cli" && name = "cli.run" }
+{ resource.service.name = "supabase-cli" && duration > 1s }
+{ resource.service.name = "supabase-cli" && status = error }
 ```
 
-`telemetry.json` stores telemetry state such as consent, device identity, and session identity.
-`traces/` stores exported spans.
-
-This keeps monitoring data in machine-global CLI state rather than project config.
-
-## Relation to Sentry
-
-Sentry belongs on the tracing and monitoring side, not the PostHog analytics side.
-
-Current state:
-
-- the CLI already has a span-based tracing path
-- that path exports locally to NDJSON
-- it is not yet using Sentry as the live exporter
-
-Intended direction:
-
-- Sentry should consume the tracing path as an observability backend
-- PostHog should continue to receive curated analytics events separately
-
-That separation matters because traces and analytics solve different problems and have different
-volume, retention, and schema needs.
-
-## What Tracing Is Not
-
-Tracing is intentionally not used for:
-
-- product analytics funnels
-- command adoption reporting
-- organization or project group analytics
-- user-facing milestone events such as `cli_login_completed`
-
-Those concerns belong to the analytics path described in [analytics.md](./analytics.md).
+Any collector that accepts OTLP/HTTP JSON works; pass credentials with `SUPABASE_OTLP_HEADERS`.
+
+## What a trace contains
+
+- Resource: `service.name=supabase-cli`, `service.version`, `os`, `arch`, `is_ci`,
+  `service.instance.id` (a random id per run).
+- `cli.run`: `process.boot_ms`, the time from process start to CLI entry, and
+  `process.exit_code`, the code the CLI exits with. A non-zero code ends `cli.run` with error
+  status and a `CliNonZeroExit` exception type.
+- Failed spans: `error.type`, the failing error's tag, when it has one.
+- Command span (`command.<path>`): `command` and `command_run_id`. When telemetry consent is
+  granted, also `device_id`, `session_id`, and `is_first_run`.
+- Layer spans such as `CliSettings.load`, `CliProjectContext.load`, and `ProjectLinkState.load`.
+- `UpgradeNotice.check`, the post-command release check: `cache.location` (`project`, `user`, or
+  `disabled` when a symlink blocks the cache) and `cache.hit`. A cache miss adds an
+  `UpgradeNotice.fetch` child for the GitHub request.
+- HTTP client spans with method, host, path, status, and allowlisted headers.
+- Process spans with the executable basename, argument count, exit code, and for docker or
+  podman the verb (such as `container inspect`). Children receive a
+  `TRACEPARENT` pointing at their span when a sink is active.
+
+## What is removed before export
+
+Traces carry no free-form error or log text. Every batch and every console line is sanitized:
+
+- Exception events keep only `exception.type`, the error class or tag name such as `SqlError`; a
+  name that is not an identifier is exported as `Error`. Error messages and stack traces are
+  dropped. A failed span records the Postgres SQLSTATE, when the error carries one, as
+  `db.response.status_code`.
+- Span status messages are dropped; the status code remains.
+- Log events are renamed `log` and keep only `effect.logLevel`.
+- `db.query.text` is replaced by `db.operation.name`, `db.query.hash`, and `db.query.length`. The
+  hash is keyed by a random salt drawn once per run, so repeated statements share a hash within a
+  run but hashes from different runs cannot be compared.
+- `url.full` keeps only scheme, host, and path; `url.query` is dropped.
+- Storage object paths in `url.full` and `url.path` keep the operation, such as `sign`, and replace
+  the bucket and object name with `<redacted>`. Bucket routes (`/storage/v1/bucket/…` and
+  `/storage/v1/iceberg/bucket/…`) replace the bucket name the same way.
+- Only `content-type`, `content-length`, `user-agent`, `x-request-id`, `cf-ray`, and `retry-after`
+  headers are kept.
+- String values under keys that mention tokens, passwords, secrets, API keys, authorization, or
+  cookies are dropped; numeric and boolean values such as counts are kept.
+- Remaining string attributes lose URL credentials (everything before the last `@`), bearer tokens, JWTs, Supabase keys and access
+  tokens, password pairs, single-quoted SQL literals, and constraint key values such as
+  `Key (email)=(…)`, and are capped at 2 KB.
+
+The terminal still shows the full error text.
+
+HTTP requests never carry `traceparent` or `b3` headers.
+
+## Lifecycle
+
+The trace scope closes before the process exits. The final flush is uninterruptible and capped at
+2 seconds, so a slow collector cannot hold the CLI open. The file sink always acknowledges a
+batch, so a local write failure never triggers retries or duplicate lines.
+
+## Old trace files
+
+Earlier versions wrote NDJSON files under `SUPABASE_HOME/traces/`. The CLI no longer writes or
+cleans that directory; it is safe to delete.
+
+## What tracing is not
+
+Tracing is not used for product analytics funnels, command adoption reporting, organization or
+project analytics, or milestone events such as `cli_login_completed`. Those belong to the
+analytics path described in [analytics.md](./analytics.md).
diff --git a/apps/cli/package.json b/apps/cli/package.json
index c0251fc102..f5550975df 100644
--- a/apps/cli/package.json
+++ b/apps/cli/package.json
@@ -57,11 +57,11 @@
     "@napi-rs/keyring": "^1.3.0",
     "@supabase/api": "workspace:*",
     "@supabase/config": "workspace:*",
-    "@supabase/pg-delta": "1.0.0-alpha.56",
-    "@supabase/pg-topo": "1.0.0-alpha.7",
+    "@supabase/pg-delta": "1.0.0-alpha.57",
+    "@supabase/pg-topo": "1.0.0-alpha.8",
     "@supabase/stack": "workspace:*",
     "@supabase/supabase-js": "catalog:",
-    "@supabase/typegen": "0.2.1",
+    "@supabase/typegen": "0.2.2",
     "@tsconfig/bun": "catalog:",
     "@types/bun": "catalog:",
     "@types/pg": "^8.23.1",
diff --git a/apps/cli/scripts/bench-cli.ts b/apps/cli/scripts/bench-cli.ts
new file mode 100644
index 0000000000..94e77f2da2
--- /dev/null
+++ b/apps/cli/scripts/bench-cli.ts
@@ -0,0 +1,601 @@
+/**
+ * A/B wall-time benchmark for two CLI binaries. Alternates launches between `--base` and
+ * `--branch` so neither build runs consistently warmer, isolates each launch's environment, and
+ * optionally compares per-span trace totals when `SUPABASE_TRACE_FILE` tracing is available. Run
+ * as `bun scripts/bench-cli.ts --base <path> --branch <path> [options]`.
+ */
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { resolve as resolvePath } from "node:path";
+import process from "node:process";
+import { parseArgs } from "node:util";
+import { BunRuntime, BunServices } from "@effect/platform-bun";
+import { Clock, Console, Effect, FileSystem, Path, Ref, Stdio } from "effect";
+import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
+import { readSpans, type ReportSpan } from "./trace-report.ts";
+
+const USAGE =
+  'usage: bun scripts/bench-cli.ts --base <path> --branch <path> [--runs N] [--warmup N] [--command "<args>"]... [--cwd-setup init] [--trace] [--json] [--out <file>] [--cpu-prof] [--update-check]\n' +
+  "  --command splits on whitespace; it does not support shell quoting.\n" +
+  "  --update-check keeps the GitHub release check, which otherwise adds network time to every launch.";
+
+export type Build = "base" | "branch";
+
+export interface BenchOptions {
+  readonly base: string;
+  readonly branch: string;
+  readonly runs: number;
+  readonly warmup: number;
+  readonly commands: ReadonlyArray<ReadonlyArray<string>>;
+  readonly cwdSetupInit: boolean;
+  readonly trace: boolean;
+  readonly json: boolean;
+  readonly out: string | undefined;
+  readonly cpuProf: boolean;
+  readonly updateCheck: boolean;
+}
+
+const DEFAULT_COMMANDS: ReadonlyArray<ReadonlyArray<string>> = [["--version"], ["--help"]];
+
+/** Whether `--help`/`-h` is passed as a flag rather than as a `--command` value. */
+export function wantsHelp(argv: ReadonlyArray<string>): boolean {
+  return argv.some(
+    (arg, index) => (arg === "--help" || arg === "-h") && argv[index - 1] !== "--command",
+  );
+}
+
+/** Parses argv into {@link BenchOptions}; throws on missing `--base`/`--branch` or bad numbers. */
+export function parseBenchArgs(argv: ReadonlyArray<string>): BenchOptions {
+  // `parseArgs` rejects a separate value that starts with `-`, but CLI commands usually do.
+  const args: Array<string> = [];
+  for (let index = 0; index < argv.length; index++) {
+    const arg = argv[index]!;
+    const value = argv[index + 1];
+    if (arg === "--command" && value !== undefined) {
+      args.push(`--command=${value}`);
+      index++;
+    } else {
+      args.push(arg);
+    }
+  }
+  const { values } = parseArgs({
+    args,
+    options: {
+      base: { type: "string" },
+      branch: { type: "string" },
+      runs: { type: "string", default: "10" },
+      warmup: { type: "string", default: "2" },
+      command: { type: "string", multiple: true },
+      "cwd-setup": { type: "string" },
+      trace: { type: "boolean", default: false },
+      json: { type: "boolean", default: false },
+      out: { type: "string" },
+      "cpu-prof": { type: "boolean", default: false },
+      "update-check": { type: "boolean", default: false },
+    },
+  });
+
+  if (values.base === undefined || values.branch === undefined) {
+    throw new Error(USAGE);
+  }
+  const runs = Number(values.runs);
+  const warmup = Number(values.warmup);
+  if (!Number.isInteger(runs) || runs < 1) {
+    throw new Error("--runs must be a positive integer");
+  }
+  if (!Number.isInteger(warmup) || warmup < 0) {
+    throw new Error("--warmup must be a non-negative integer");
+  }
+  if (values["cwd-setup"] !== undefined && values["cwd-setup"] !== "init") {
+    throw new Error('--cwd-setup only supports "init"');
+  }
+
+  return {
+    // Each launch spawns with a per-run `cwd`, which also resolves a relative command path; a
+    // path given relative to the invocation directory must become absolute before that happens.
+    base: resolvePath(values.base),
+    branch: resolvePath(values.branch),
+    runs,
+    warmup,
+    commands:
+      values.command === undefined || values.command.length === 0
+        ? DEFAULT_COMMANDS
+        : values.command.map((raw) => raw.split(/\s+/u).filter((part) => part.length > 0)),
+    cwdSetupInit: values["cwd-setup"] === "init",
+    trace: values.trace ?? false,
+    json: values.json ?? false,
+    out: values.out,
+    cpuProf: values["cpu-prof"] ?? false,
+    updateCheck: values["update-check"] ?? false,
+  };
+}
+
+const ENV_PREFIX = /^(?:SUPABASE_|OTEL_)/u;
+
+/**
+ * Starts from `ambient`, drops every `SUPABASE_*`/`OTEL_*` variable and `TRACEPARENT` so no
+ * consent, trace, or endpoint state leaks between launches, then applies `overrides`.
+ */
+export function isolatedEnv(
+  ambient: Readonly<Record<string, string | undefined>>,
+  overrides: Readonly<Record<string, string>>,
+): Record<string, string | undefined> {
+  const env: Record<string, string | undefined> = {};
+  for (const [key, value] of Object.entries(ambient)) {
+    if (key === "TRACEPARENT" || ENV_PREFIX.test(key)) continue;
+    env[key] = value;
+  }
+  return { ...env, ...overrides };
+}
+
+export interface PlannedRun {
+  readonly build: Build;
+  readonly warmup: boolean;
+  readonly iteration: number;
+}
+
+/** Alternates base/branch launches per iteration; the first `warmup` iterations are discarded. */
+export function buildRunPlan(runs: number, warmup: number): ReadonlyArray<PlannedRun> {
+  const plan: Array<PlannedRun> = [];
+  for (let iteration = 0; iteration < runs + warmup; iteration++) {
+    const isWarmup = iteration < warmup;
+    plan.push({ build: "base", warmup: isWarmup, iteration });
+    plan.push({ build: "branch", warmup: isWarmup, iteration });
+  }
+  return plan;
+}
+
+const round = (value: number): number => Math.round(value * 100) / 100;
+
+export function median(values: ReadonlyArray<number>): number {
+  if (values.length === 0) return 0;
+  const sorted = [...values].sort((a, b) => a - b);
+  const mid = Math.floor(sorted.length / 2);
+  return sorted.length % 2 === 0 ? (sorted[mid - 1]! + sorted[mid]!) / 2 : sorted[mid]!;
+}
+
+export function percentile(values: ReadonlyArray<number>, p: number): number {
+  if (values.length === 0) return 0;
+  const sorted = [...values].sort((a, b) => a - b);
+  const rank = Math.min(Math.max(Math.ceil((p / 100) * sorted.length) - 1, 0), sorted.length - 1);
+  return sorted[rank]!;
+}
+
+export interface TimingSummary {
+  readonly median: number;
+  readonly min: number;
+  readonly max: number;
+  readonly p90: number;
+}
+
+export function summarizeTimings(values: ReadonlyArray<number>): TimingSummary {
+  const sorted = [...values].sort((a, b) => a - b);
+  return {
+    median: round(median(sorted)),
+    min: round(sorted[0] ?? 0),
+    max: round(sorted[sorted.length - 1] ?? 0),
+    p90: round(percentile(sorted, 90)),
+  };
+}
+
+export interface Delta {
+  readonly ms: number;
+  readonly pct: number;
+}
+
+/** `branch - base`; `pct` is `0` when `baseMedian` is `0` rather than `Infinity`. */
+export function deltaOf(baseMedian: number, branchMedian: number): Delta {
+  const ms = branchMedian - baseMedian;
+  return { ms: round(ms), pct: baseMedian === 0 ? 0 : round((ms / baseMedian) * 100) };
+}
+
+export interface SpanRunSummary {
+  readonly totalMs: number;
+  readonly count: number;
+}
+
+/** Sums duration and counts occurrences of each span name within one run's decoded spans. */
+export function summarizeSpanRun(spans: ReadonlyArray<ReportSpan>): Record<string, SpanRunSummary> {
+  const result: Record<string, SpanRunSummary> = {};
+  for (const span of spans) {
+    const entry = result[span.name] ?? { totalMs: 0, count: 0 };
+    result[span.name] = {
+      totalMs: entry.totalMs + (span.endMs - span.startMs),
+      count: entry.count + 1,
+    };
+  }
+  return result;
+}
+
+export interface SpanAggregate {
+  readonly medianMs: number;
+  readonly medianCount: number;
+}
+
+/** Medians each span name's per-run total duration and count across runs; missing runs count as 0. */
+export function aggregateSpanRuns(
+  runs: ReadonlyArray<Record<string, SpanRunSummary>>,
+): Record<string, SpanAggregate> {
+  const names = new Set<string>();
+  for (const run of runs) for (const name of Object.keys(run)) names.add(name);
+  const result: Record<string, SpanAggregate> = {};
+  for (const name of names) {
+    result[name] = {
+      medianMs: round(median(runs.map((run) => run[name]?.totalMs ?? 0))),
+      medianCount: round(median(runs.map((run) => run[name]?.count ?? 0))),
+    };
+  }
+  return result;
+}
+
+export interface SpanComparison {
+  readonly name: string;
+  readonly base: SpanAggregate | undefined;
+  readonly branch: SpanAggregate | undefined;
+  readonly deltaMs: number | undefined;
+  readonly onlyIn: Build | undefined;
+}
+
+function spanSortKey(entry: SpanComparison): number {
+  return entry.deltaMs !== undefined
+    ? Math.abs(entry.deltaMs)
+    : (entry.branch?.medianMs ?? entry.base?.medianMs ?? 0);
+}
+
+/** Pairs base/branch span aggregates by name, sorted by `|delta|` descending; flags one-sided spans. */
+export function compareSpans(
+  base: Record<string, SpanAggregate>,
+  branch: Record<string, SpanAggregate>,
+): ReadonlyArray<SpanComparison> {
+  const names = new Set([...Object.keys(base), ...Object.keys(branch)]);
+  const comparisons = [...names].map((name): SpanComparison => {
+    const baseEntry = base[name];
+    const branchEntry = branch[name];
+    return {
+      name,
+      base: baseEntry,
+      branch: branchEntry,
+      deltaMs:
+        baseEntry !== undefined && branchEntry !== undefined
+          ? round(branchEntry.medianMs - baseEntry.medianMs)
+          : undefined,
+      onlyIn: baseEntry === undefined ? "branch" : branchEntry === undefined ? "base" : undefined,
+    };
+  });
+  return comparisons.sort((a, b) => spanSortKey(b) - spanSortKey(a));
+}
+
+/** Whether the builds exited differently, which makes their timings measure different work. */
+export function exitCodesDiffer(
+  base: ReadonlyArray<number>,
+  branch: ReadonlyArray<number>,
+): boolean {
+  const codes = (values: ReadonlyArray<number>) =>
+    [...new Set(values)].sort((a, b) => a - b).join(",");
+  return codes(base) !== codes(branch);
+}
+
+interface BuildTimingSummary extends TimingSummary {
+  readonly exitCodes: ReadonlyArray<number>;
+}
+
+export interface CommandReport {
+  readonly command: ReadonlyArray<string>;
+  readonly base: BuildTimingSummary;
+  readonly branch: BuildTimingSummary;
+  readonly deltaMs: number;
+  readonly deltaPct: number;
+  readonly spans: ReadonlyArray<SpanComparison> | undefined;
+  readonly traceEmptyFor: ReadonlyArray<Build>;
+  readonly exitCodesDiffer: boolean;
+}
+
+interface RawSample {
+  readonly command: ReadonlyArray<string>;
+  readonly build: Build;
+  readonly wallMs: number;
+  readonly exitCode: number;
+  readonly spans: Record<string, SpanRunSummary> | undefined;
+}
+
+interface LaunchResult {
+  readonly wallMs: number;
+  readonly exitCode: number;
+}
+
+const runLaunch = (params: {
+  readonly binary: string;
+  readonly args: ReadonlyArray<string>;
+  readonly cwd: string;
+  readonly env: Record<string, string | undefined>;
+}) =>
+  Effect.gen(function* () {
+    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const start = yield* Clock.currentTimeNanos;
+    const exitCode = yield* spawner.exitCode(
+      ChildProcess.make(params.binary, params.args, {
+        cwd: params.cwd,
+        env: params.env,
+        extendEnv: false,
+        stdin: "ignore",
+        stdout: "ignore",
+        stderr: "ignore",
+      }),
+    );
+    const end = yield* Clock.currentTimeNanos;
+    return {
+      wallMs: Number(end - start) / 1_000_000,
+      exitCode: Number(exitCode),
+    } satisfies LaunchResult;
+  });
+
+const baseLaunchEnv = (supabaseHome: string, updateCheck: boolean): Record<string, string> => ({
+  SUPABASE_HOME: supabaseHome,
+  DO_NOT_TRACK: "1",
+  SUPABASE_NO_KEYRING: "1",
+  ...(updateCheck ? {} : { SUPABASE_NO_UPDATE_NOTIFIER: "1" }),
+});
+
+/** A fresh project directory and `SUPABASE_HOME`, initialized when `--cwd-setup init` is set. */
+const prepareLaunch = (options: BenchOptions, binary: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const projectDir = yield* fs.makeTempDirectoryScoped({ prefix: "supabase-bench-cwd-" });
+    const supabaseHome = yield* fs.makeTempDirectoryScoped({ prefix: "supabase-bench-home-" });
+    if (options.cwdSetupInit) {
+      const init = yield* runLaunch({
+        binary,
+        args: ["init"],
+        cwd: projectDir,
+        env: isolatedEnv(process.env, baseLaunchEnv(supabaseHome, options.updateCheck)),
+      });
+      if (init.exitCode !== 0) {
+        yield* Console.error(
+          `warning: ${binary} init exited ${init.exitCode} in ${projectDir}; the run may not reflect a real project`,
+        );
+      }
+    }
+    return { projectDir, supabaseHome };
+  });
+
+const runCommandBench = (
+  options: BenchOptions,
+  command: ReadonlyArray<string>,
+  profiled: Ref.Ref<boolean>,
+) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const plan = buildRunPlan(options.runs, options.warmup);
+
+    const samples: Record<Build, Array<number>> = { base: [], branch: [] };
+    const exitCodes: Record<Build, Array<number>> = { base: [], branch: [] };
+    const spanRuns: Record<Build, Array<Record<string, SpanRunSummary>>> = { base: [], branch: [] };
+    const raw: Array<RawSample> = [];
+    let cpuProfilePath: string | undefined;
+
+    for (const planned of plan) {
+      const binary = planned.build === "base" ? options.base : options.branch;
+
+      yield* Effect.scoped(
+        Effect.gen(function* () {
+          const { projectDir, supabaseHome } = yield* prepareLaunch(options, binary);
+          const result = yield* runLaunch({
+            binary,
+            args: command,
+            cwd: projectDir,
+            env: isolatedEnv(process.env, baseLaunchEnv(supabaseHome, options.updateCheck)),
+          });
+
+          if (planned.warmup) return;
+
+          samples[planned.build].push(result.wallMs);
+          exitCodes[planned.build].push(result.exitCode);
+
+          // Tracing and profiling slow the launch they observe, so they run in an extra, untimed
+          // launch in fresh directories. Both builds get traced launches; only one branch launch
+          // is profiled.
+          const traceFile = options.trace
+            ? yield* fs.makeTempFileScoped({ prefix: "supabase-bench-trace-", suffix: ".jsonl" })
+            : undefined;
+          let bunOptions: string | undefined;
+          if (options.cpuProf && planned.build === "branch") {
+            const alreadyProfiled = yield* Ref.getAndSet(profiled, true);
+            if (!alreadyProfiled) {
+              const profileDir = tmpdir();
+              const profileName = `supabase-bench-branch-${randomUUID()}.cpuprofile`;
+              cpuProfilePath = path.join(profileDir, profileName);
+              bunOptions = `--cpu-prof --cpu-prof-dir=${profileDir} --cpu-prof-name=${profileName}`;
+            }
+          }
+          if (traceFile !== undefined || bunOptions !== undefined) {
+            const observed = yield* prepareLaunch(options, binary);
+            yield* runLaunch({
+              binary,
+              args: command,
+              cwd: observed.projectDir,
+              env: isolatedEnv(process.env, {
+                ...baseLaunchEnv(observed.supabaseHome, options.updateCheck),
+                ...(traceFile === undefined ? {} : { SUPABASE_TRACE_FILE: traceFile }),
+                ...(bunOptions === undefined ? {} : { BUN_OPTIONS: bunOptions }),
+              }),
+            });
+          }
+
+          const spans =
+            traceFile === undefined
+              ? undefined
+              : summarizeSpanRun(
+                  // Trace data is optional; a missing or unreadable file must not discard timings.
+                  (yield* readSpans(traceFile).pipe(
+                    Effect.orElseSucceed(() => ({ spans: [], skippedLines: 0 })),
+                  )).spans,
+                );
+          if (spans !== undefined) spanRuns[planned.build].push(spans);
+
+          raw.push({
+            command,
+            build: planned.build,
+            wallMs: result.wallMs,
+            exitCode: result.exitCode,
+            spans,
+          });
+        }),
+      );
+    }
+
+    const base = summarizeTimings(samples.base);
+    const branch = summarizeTimings(samples.branch);
+    const delta = deltaOf(base.median, branch.median);
+
+    const spans = options.trace
+      ? compareSpans(aggregateSpanRuns(spanRuns.base), aggregateSpanRuns(spanRuns.branch))
+      : undefined;
+    const traceEmptyFor: ReadonlyArray<Build> = options.trace
+      ? (["base", "branch"] as const).filter(
+          (build) =>
+            spanRuns[build].length > 0 &&
+            spanRuns[build].every((run) => Object.keys(run).length === 0),
+        )
+      : [];
+
+    const report: CommandReport = {
+      command,
+      base: { ...base, exitCodes: exitCodes.base },
+      branch: { ...branch, exitCodes: exitCodes.branch },
+      deltaMs: delta.ms,
+      deltaPct: delta.pct,
+      spans,
+      traceEmptyFor,
+      exitCodesDiffer: exitCodesDiffer(exitCodes.base, exitCodes.branch),
+    };
+    return { report, raw, cpuProfilePath };
+  });
+
+interface Report {
+  readonly base: string;
+  readonly branch: string;
+  readonly runs: number;
+  readonly warmup: number;
+  readonly trace: boolean;
+  readonly cwdSetup: "init" | undefined;
+  readonly commands: ReadonlyArray<CommandReport>;
+  readonly cpuProfilePath: string | undefined;
+}
+
+function formatSpanLine(span: SpanComparison): string {
+  if (span.onlyIn !== undefined) {
+    const only = span.onlyIn === "base" ? span.base : span.branch;
+    return `    ${span.onlyIn} only  ${span.name}  ${only?.medianMs}ms x${only?.medianCount}`;
+  }
+  const sign = (span.deltaMs ?? 0) >= 0 ? "+" : "";
+  return (
+    `    ${sign}${span.deltaMs}ms  ${span.name}  ` +
+    `base ${span.base?.medianMs}ms x${span.base?.medianCount}  branch ${span.branch?.medianMs}ms x${span.branch?.medianCount}`
+  );
+}
+
+function formatCommandReport(commandReport: CommandReport): ReadonlyArray<string> {
+  const sign = (value: number) => (value >= 0 ? "+" : "");
+  const lines = [
+    `command: ${commandReport.command.join(" ") || "(no args)"}`,
+    `  base:   median ${commandReport.base.median}ms  min ${commandReport.base.min}ms  max ${commandReport.base.max}ms  p90 ${commandReport.base.p90}ms  exits [${commandReport.base.exitCodes.join(",")}]`,
+    `  branch: median ${commandReport.branch.median}ms  min ${commandReport.branch.min}ms  max ${commandReport.branch.max}ms  p90 ${commandReport.branch.p90}ms  exits [${commandReport.branch.exitCodes.join(",")}]`,
+    `  delta:  ${sign(commandReport.deltaMs)}${commandReport.deltaMs}ms (${sign(commandReport.deltaPct)}${commandReport.deltaPct}%)`,
+  ];
+  if (commandReport.exitCodesDiffer) {
+    lines.push("  warning: exit codes differ between builds, so the timings are not comparable");
+  }
+  for (const build of ["base", "branch"] as const) {
+    const codes = commandReport[build].exitCodes;
+    const failed = codes.filter((code) => code !== 0).length;
+    if (failed > 0) {
+      lines.push(
+        `  warning: ${build} exited non-zero in ${failed}/${codes.length} runs, so its timings measure a failing invocation`,
+      );
+    }
+  }
+  if (commandReport.traceEmptyFor.length > 0) {
+    lines.push(`  trace: no spans captured for ${commandReport.traceEmptyFor.join(", ")}`);
+  }
+  if (commandReport.spans !== undefined && commandReport.spans.length > 0) {
+    lines.push("  spans (delta ms, or one-sided median ms x count):");
+    for (const span of commandReport.spans) lines.push(formatSpanLine(span));
+  }
+  lines.push("");
+  return lines;
+}
+
+function formatReport(report: Report): string {
+  const lines = [
+    `base:   ${report.base}`,
+    `branch: ${report.branch}`,
+    `runs: ${report.runs}  warmup: ${report.warmup}` +
+      (report.cwdSetup === undefined ? "" : `  cwd-setup: ${report.cwdSetup}`),
+    "",
+  ];
+  for (const commandReport of report.commands) lines.push(...formatCommandReport(commandReport));
+  if (report.cpuProfilePath !== undefined) {
+    lines.push(`cpu profile (one untimed branch launch): ${report.cpuProfilePath}`);
+  }
+  return lines.join("\n");
+}
+
+const main = Effect.gen(function* () {
+  const stdio = yield* Stdio.Stdio;
+  const argv = yield* stdio.args;
+  if (wantsHelp(argv)) {
+    yield* Console.log(USAGE);
+    return;
+  }
+  const options = yield* Effect.try({
+    try: () => parseBenchArgs(argv),
+    catch: (cause) => (cause instanceof Error ? cause.message : String(cause)),
+  }).pipe(
+    Effect.catch((message) =>
+      Console.error(message === USAGE ? USAGE : `${message}\n${USAGE}`).pipe(
+        Effect.andThen(
+          Effect.sync(() => {
+            process.exitCode = 2;
+          }),
+        ),
+        Effect.as(undefined),
+      ),
+    ),
+  );
+  if (options === undefined) return;
+
+  const profiled = yield* Ref.make(false);
+  const commands: Array<CommandReport> = [];
+  const samples: Array<RawSample> = [];
+  let cpuProfilePath: string | undefined;
+
+  for (const command of options.commands) {
+    const result = yield* runCommandBench(options, command, profiled);
+    commands.push(result.report);
+    samples.push(...result.raw);
+    if (result.cpuProfilePath !== undefined) cpuProfilePath = result.cpuProfilePath;
+  }
+
+  const report: Report = {
+    base: options.base,
+    branch: options.branch,
+    runs: options.runs,
+    warmup: options.warmup,
+    trace: options.trace,
+    cwdSetup: options.cwdSetupInit ? "init" : undefined,
+    commands,
+    cpuProfilePath,
+  };
+
+  if (options.out !== undefined) {
+    const fs = yield* FileSystem.FileSystem;
+    yield* fs.writeFileString(options.out, JSON.stringify({ report, samples }, null, 2));
+  }
+
+  yield* Console.log(options.json ? JSON.stringify(report, null, 2) : formatReport(report));
+});
+
+if (import.meta.main) {
+  BunRuntime.runMain(main.pipe(Effect.provide(BunServices.layer)));
+}
diff --git a/apps/cli/scripts/bench-cli.unit.test.ts b/apps/cli/scripts/bench-cli.unit.test.ts
new file mode 100644
index 0000000000..d991afdc32
--- /dev/null
+++ b/apps/cli/scripts/bench-cli.unit.test.ts
@@ -0,0 +1,173 @@
+import { describe, expect, it } from "vitest";
+import {
+  aggregateSpanRuns,
+  buildRunPlan,
+  compareSpans,
+  deltaOf,
+  exitCodesDiffer,
+  isolatedEnv,
+  parseBenchArgs,
+  wantsHelp,
+  summarizeSpanRun,
+  summarizeTimings,
+} from "./bench-cli.ts";
+import type { SpanRunSummary } from "./bench-cli.ts";
+import type { ReportSpan } from "./trace-report.ts";
+
+const span = (name: string, startMs: number, endMs: number): ReportSpan => ({
+  traceId: "t",
+  spanId: `${name}-${startMs}`,
+  parentSpanId: undefined,
+  name,
+  startMs,
+  endMs,
+  failed: false,
+  errorType: undefined,
+});
+
+describe("parseBenchArgs", () => {
+  it("accepts commands that start with a dash and keeps update checks off by default", () => {
+    const options = parseBenchArgs([
+      "--base",
+      "/bin/a",
+      "--branch",
+      "/bin/b",
+      "--command",
+      "--version",
+      "--command",
+      "db diff --local",
+    ]);
+
+    expect(options.commands).toEqual([["--version"], ["db", "diff", "--local"]]);
+    expect(options.updateCheck).toBe(false);
+  });
+});
+
+describe("wantsHelp", () => {
+  it("treats --help as a flag only when it is not a --command value", () => {
+    expect(wantsHelp(["--help"])).toBe(true);
+    expect(wantsHelp(["--base", "/a", "--branch", "/b", "--command", "--help"])).toBe(false);
+  });
+});
+
+describe("summarizeTimings", () => {
+  it("computes median, min, max, and p90", () => {
+    expect(summarizeTimings([10, 20, 30, 40, 50])).toEqual({
+      median: 30,
+      min: 10,
+      max: 50,
+      p90: 50,
+    });
+  });
+});
+
+describe("buildRunPlan", () => {
+  it("alternates base and branch and discards the first warmup iterations", () => {
+    const plan = buildRunPlan(2, 1);
+
+    expect(plan.map((run) => [run.build, run.warmup])).toEqual([
+      ["base", true],
+      ["branch", true],
+      ["base", false],
+      ["branch", false],
+      ["base", false],
+      ["branch", false],
+    ]);
+  });
+});
+
+describe("exitCodesDiffer", () => {
+  it("flags builds that exit differently but not shared failures", () => {
+    expect(exitCodesDiffer([1, 1], [1, 1])).toBe(false);
+    expect(exitCodesDiffer([0, 0], [1, 0])).toBe(true);
+  });
+});
+
+describe("deltaOf", () => {
+  it("reports branch minus base in ms and percent", () => {
+    expect(deltaOf(100, 110)).toEqual({ ms: 10, pct: 10 });
+  });
+
+  it("reports a zero percent delta instead of Infinity when base is zero", () => {
+    expect(deltaOf(0, 5)).toEqual({ ms: 5, pct: 0 });
+  });
+});
+
+describe("span aggregation", () => {
+  it("sums duration and counts per span name within one run", () => {
+    const run = [span("Config.load", 0, 10), span("Db.query", 10, 20), span("Db.query", 20, 50)];
+
+    expect(summarizeSpanRun(run)).toEqual({
+      "Config.load": { totalMs: 10, count: 1 },
+      "Db.query": { totalMs: 40, count: 2 },
+    });
+  });
+
+  it("medians per-span totals and counts across runs, treating an absent span as zero", () => {
+    const runs: ReadonlyArray<Record<string, SpanRunSummary>> = [
+      { "Db.query": { totalMs: 40, count: 2 } },
+      { "Db.query": { totalMs: 60, count: 2 } },
+      {},
+    ];
+
+    expect(aggregateSpanRuns(runs)).toEqual({
+      "Db.query": { medianMs: 40, medianCount: 2 },
+    });
+  });
+});
+
+describe("compareSpans", () => {
+  it("flags spans found in only one build and sorts by absolute delta", () => {
+    const base = {
+      "Config.load": { medianMs: 10, medianCount: 1 },
+      "Credentials.load": { medianMs: 5, medianCount: 1 },
+    };
+    const branch = {
+      "Config.load": { medianMs: 40, medianCount: 1 },
+      "Otlp.flush": { medianMs: 3, medianCount: 1 },
+    };
+
+    expect(compareSpans(base, branch)).toEqual([
+      {
+        name: "Config.load",
+        base: { medianMs: 10, medianCount: 1 },
+        branch: { medianMs: 40, medianCount: 1 },
+        deltaMs: 30,
+        onlyIn: undefined,
+      },
+      {
+        name: "Credentials.load",
+        base: { medianMs: 5, medianCount: 1 },
+        branch: undefined,
+        deltaMs: undefined,
+        onlyIn: "base",
+      },
+      {
+        name: "Otlp.flush",
+        base: undefined,
+        branch: { medianMs: 3, medianCount: 1 },
+        deltaMs: undefined,
+        onlyIn: "branch",
+      },
+    ]);
+  });
+});
+
+describe("isolatedEnv", () => {
+  it("strips SUPABASE_*, OTEL_*, and TRACEPARENT while keeping other ambient variables", () => {
+    const ambient = {
+      HOME: "/home/person",
+      PATH: "/usr/bin",
+      SUPABASE_ACCESS_TOKEN: "secret",
+      OTEL_EXPORTER_OTLP_ENDPOINT: "http://collector",
+      TRACEPARENT: "00-...-01",
+    };
+
+    expect(isolatedEnv(ambient, { SUPABASE_HOME: "/tmp/home", DO_NOT_TRACK: "1" })).toEqual({
+      HOME: "/home/person",
+      PATH: "/usr/bin",
+      SUPABASE_HOME: "/tmp/home",
+      DO_NOT_TRACK: "1",
+    });
+  });
+});
diff --git a/apps/cli/scripts/build-binary.ts b/apps/cli/scripts/build-binary.ts
index f2dcb02b00..28ed04fee9 100644
--- a/apps/cli/scripts/build-binary.ts
+++ b/apps/cli/scripts/build-binary.ts
@@ -1,3 +1,4 @@
+import { Effect } from "effect";
 import { bundleServeMainTemplate } from "../src/shared/functions/serve-main-bundler.ts";
 import { compileOptions, stackReleaseDefine } from "./compile-options.ts";
 
@@ -23,7 +24,9 @@ const result = await Bun.build({
   define: {
     SUPABASE_CLI_VERSION: JSON.stringify(packageJson.version),
     ...(await stackReleaseDefine()),
-    SUPABASE_FUNCTIONS_SERVE_MAIN_TEMPLATE: JSON.stringify(await bundleServeMainTemplate()),
+    SUPABASE_FUNCTIONS_SERVE_MAIN_TEMPLATE: JSON.stringify(
+      await Effect.runPromise(bundleServeMainTemplate()),
+    ),
     // Skips msgpackr's native addon probe at the build host's path, which can hang macOS startup.
     "process.env.MSGPACKR_NATIVE_ACCELERATION_DISABLED": JSON.stringify("true"),
   },
diff --git a/apps/cli/scripts/build.ts b/apps/cli/scripts/build.ts
index 87131b408e..52ee98efff 100644
--- a/apps/cli/scripts/build.ts
+++ b/apps/cli/scripts/build.ts
@@ -4,6 +4,7 @@ import { copyFile, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
 import process from "node:process";
 import { parseArgs } from "node:util";
+import { Effect } from "effect";
 import { bundleServeMainTemplate } from "../src/shared/functions/serve-main-bundler.ts";
 import { compileOptions, stackReleaseDefine } from "./compile-options.ts";
 import { darwinBinaries, MACOS_IDENTIFIERS } from "./macos-signing.ts";
@@ -89,7 +90,9 @@ const distDir = path.join(root, "dist");
 const goSource = path.resolve(root, "apps/cli-go");
 const buildDefines = {
   ...(await stackReleaseDefine()),
-  SUPABASE_FUNCTIONS_SERVE_MAIN_TEMPLATE: JSON.stringify(await bundleServeMainTemplate()),
+  SUPABASE_FUNCTIONS_SERVE_MAIN_TEMPLATE: JSON.stringify(
+    await Effect.runPromise(bundleServeMainTemplate()),
+  ),
   SUPABASE_CLI_POSTHOG_KEY: JSON.stringify(process.env.POSTHOG_API_KEY ?? ""),
   SUPABASE_CLI_POSTHOG_HOST: JSON.stringify(process.env.POSTHOG_ENDPOINT ?? ""),
   // Skips msgpackr's startup probe for its native addon at the build host's store path, which
diff --git a/apps/cli/scripts/render-service-dockerfile.rules.unit.test.ts b/apps/cli/scripts/render-service-dockerfile.rules.unit.test.ts
index 73080b1628..f0e554551c 100644
--- a/apps/cli/scripts/render-service-dockerfile.rules.unit.test.ts
+++ b/apps/cli/scripts/render-service-dockerfile.rules.unit.test.ts
@@ -3,9 +3,9 @@ import { describe, expect, test, vi } from "vitest";
 import { renderDockerfile } from "./render-service-dockerfile.ts";
 
 // A minimal fixture catalog covering every slim-capable alias, so `renderDockerfile`'s
-// "every alias needs exactly one line" check is satisfied by default; each test only mutates
-// what it's exercising. `vi.mock` factories are hoisted above every other top-level statement,
-// so the fixture pins are built inline here rather than imported from an outer module.
+// one-line-per-alias check is satisfied by default; each test only mutates what it's
+// exercising. `vi.mock` factories are hoisted above every other top-level statement, so the
+// fixture pins are built inline here rather than imported from an outer module.
 vi.mock("@supabase/stack/internal/artifacts", () => {
   const nativePin = { archive: "a".repeat(64), manifest: "b".repeat(64) };
   const natives = { "darwin-arm64": nativePin, "linux-amd64": nativePin, "linux-arm64": nativePin };
diff --git a/apps/cli/scripts/render-service-dockerfile.unit.test.ts b/apps/cli/scripts/render-service-dockerfile.unit.test.ts
index 0c4f9036d9..029a235af8 100644
--- a/apps/cli/scripts/render-service-dockerfile.unit.test.ts
+++ b/apps/cli/scripts/render-service-dockerfile.unit.test.ts
@@ -21,8 +21,7 @@ describe("renderDockerfile against the real catalog and Dockerfile", () => {
   });
 
   // The Go tree still `go:embed`s its own copy for a dependency that hasn't been removed yet;
-  // this is the single place that keeps the two copies in sync (folded from the former
-  // dockerfile-go-sync.unit.test.ts), until apps/cli-go is deleted.
+  // this is the single place that keeps the two copies in sync until apps/cli-go is deleted.
   test("the Go tree's embedded Dockerfile is a byte copy of the TS-owned one", () => {
     const goDockerfile = readFileSync(GO_DOCKERFILE_PATH, "utf8");
     expect(goDockerfile).toBe(currentTsDockerfile);
diff --git a/apps/cli/scripts/trace-report.ts b/apps/cli/scripts/trace-report.ts
new file mode 100644
index 0000000000..29cb80c39d
--- /dev/null
+++ b/apps/cli/scripts/trace-report.ts
@@ -0,0 +1,312 @@
+/**
+ * Summarizes a `SUPABASE_TRACE_FILE` trace: heaviest path, top self time, repeated span names,
+ * and failures. Run as `bun scripts/trace-report.ts <trace-file> [--top N] [--json]`.
+ */
+import { BunRuntime, BunServices } from "@effect/platform-bun";
+import { Console, Effect, FileSystem, Schema, Stdio } from "effect";
+
+const KeyValues = Schema.Array(
+  Schema.Struct({
+    key: Schema.String,
+    value: Schema.Struct({ stringValue: Schema.optional(Schema.String) }),
+  }),
+);
+
+const stringAttribute = (attributes: typeof KeyValues.Type | undefined, key: string) =>
+  attributes?.find((attribute) => attribute.key === key)?.value.stringValue;
+
+/** Labels container CLI spans with their verb so `pull` and `run` report separately. */
+export function reportSpanName(name: string, subcommand: string | undefined): string {
+  return subcommand === undefined ? name : `${name} (${subcommand})`;
+}
+
+const OtlpSpan = Schema.Struct({
+  traceId: Schema.String,
+  spanId: Schema.String,
+  parentSpanId: Schema.optional(Schema.String),
+  name: Schema.String,
+  startTimeUnixNano: Schema.String,
+  endTimeUnixNano: Schema.String,
+  status: Schema.Struct({ code: Schema.Number }),
+  attributes: Schema.optional(KeyValues),
+  events: Schema.optional(
+    Schema.Array(Schema.Struct({ name: Schema.String, attributes: KeyValues })),
+  ),
+});
+
+const TraceBatch = Schema.fromJsonString(
+  Schema.Struct({
+    resourceSpans: Schema.Array(
+      Schema.Struct({
+        scopeSpans: Schema.Array(Schema.Struct({ spans: Schema.Array(OtlpSpan) })),
+      }),
+    ),
+  }),
+);
+
+export interface ReportSpan {
+  readonly traceId: string;
+  readonly spanId: string;
+  readonly parentSpanId: string | undefined;
+  readonly name: string;
+  readonly startMs: number;
+  readonly endMs: number;
+  readonly failed: boolean;
+  readonly errorType: string | undefined;
+}
+
+export interface TraceReport {
+  readonly spanCount: number;
+  readonly criticalPath: ReadonlyArray<{ readonly name: string; readonly durationMs: number }>;
+  readonly topSelfTime: ReadonlyArray<{ readonly name: string; readonly selfMs: number }>;
+  readonly repeated: ReadonlyArray<{
+    readonly name: string;
+    readonly count: number;
+    readonly totalMs: number;
+  }>;
+  readonly failures: ReadonlyArray<{
+    readonly name: string;
+    readonly errorType: string | undefined;
+  }>;
+}
+
+const STATUS_ERROR = 2;
+const nanosToMs = (value: string) => Number(BigInt(value) / 1_000n) / 1_000;
+const round = (value: number) => Math.round(value * 100) / 100;
+
+function coveredMs(intervals: ReadonlyArray<readonly [number, number]>): number {
+  const sorted = [...intervals].sort((a, b) => a[0] - b[0]);
+  let total = 0;
+  let current: [number, number] | undefined;
+  for (const [start, end] of sorted) {
+    if (current === undefined || start > current[1]) {
+      if (current !== undefined) total += current[1] - current[0];
+      current = [start, end];
+    } else {
+      current[1] = Math.max(current[1], end);
+    }
+  }
+  return current === undefined ? total : total + current[1] - current[0];
+}
+
+/** Builds the report from decoded spans. */
+export function analyzeTrace(spans: ReadonlyArray<ReportSpan>, top: number): TraceReport {
+  const ids = new Set(spans.map((span) => span.spanId));
+  const children = new Map<string, Array<ReportSpan>>();
+  for (const span of spans) {
+    if (span.parentSpanId === undefined || !ids.has(span.parentSpanId)) continue;
+    const siblings = children.get(span.parentSpanId) ?? [];
+    siblings.push(span);
+    children.set(span.parentSpanId, siblings);
+  }
+
+  const roots = spans
+    .filter((span) => span.parentSpanId === undefined || !ids.has(span.parentSpanId))
+    .sort((a, b) => b.endMs - b.startMs - (a.endMs - a.startMs));
+  const criticalPath: Array<{ name: string; durationMs: number }> = [];
+  let node = roots[0];
+  while (node !== undefined) {
+    criticalPath.push({ name: node.name, durationMs: round(node.endMs - node.startMs) });
+    const next = children.get(node.spanId);
+    node = next?.reduce((longest, child) =>
+      child.endMs - child.startMs > longest.endMs - longest.startMs ? child : longest,
+    );
+  }
+
+  const selfByName = new Map<string, number>();
+  const repeatedByName = new Map<string, { count: number; totalMs: number }>();
+  for (const span of spans) {
+    const duration = span.endMs - span.startMs;
+    // A child entirely outside its parent clips to an inverted interval that covers nothing.
+    const childIntervals = (children.get(span.spanId) ?? [])
+      .map(
+        (child) =>
+          [Math.max(child.startMs, span.startMs), Math.min(child.endMs, span.endMs)] as const,
+      )
+      .filter(([start, end]) => end > start);
+    const self = Math.max(0, duration - coveredMs(childIntervals));
+    selfByName.set(span.name, (selfByName.get(span.name) ?? 0) + self);
+    const entry = repeatedByName.get(span.name) ?? { count: 0, totalMs: 0 };
+    repeatedByName.set(span.name, { count: entry.count + 1, totalMs: entry.totalMs + duration });
+  }
+
+  return {
+    spanCount: spans.length,
+    criticalPath,
+    topSelfTime: [...selfByName]
+      .map(([name, selfMs]) => ({ name, selfMs: round(selfMs) }))
+      .sort((a, b) => b.selfMs - a.selfMs)
+      .slice(0, top),
+    repeated: [...repeatedByName]
+      .filter(([, entry]) => entry.count > 1)
+      .map(([name, entry]) => ({ name, count: entry.count, totalMs: round(entry.totalMs) }))
+      .sort((a, b) => b.count - a.count)
+      .slice(0, top),
+    failures: spans
+      .filter((span) => span.failed)
+      .map((span) => ({ name: span.name, errorType: span.errorType })),
+  };
+}
+
+function formatReport(report: TraceReport): string {
+  const lines = [`spans: ${report.spanCount}`, "", "critical path:"];
+  report.criticalPath.forEach((step, depth) =>
+    lines.push(`  ${"  ".repeat(depth)}${step.name} ${step.durationMs}ms`),
+  );
+  lines.push("", "top self time:");
+  for (const entry of report.topSelfTime) lines.push(`  ${entry.selfMs}ms  ${entry.name}`);
+  lines.push("", "repeated spans:");
+  for (const entry of report.repeated) {
+    lines.push(`  ${entry.count}x  ${entry.totalMs}ms  ${entry.name}`);
+  }
+  lines.push("", "failures:");
+  if (report.failures.length === 0) lines.push("  none");
+  for (const failure of report.failures) {
+    lines.push(
+      `  ${failure.name}${failure.errorType === undefined ? "" : `: ${failure.errorType}`}`,
+    );
+  }
+  return lines.join("\n");
+}
+
+/**
+ * Decodes a `SUPABASE_TRACE_FILE`'s OTLP/JSON lines into flat spans, skipping lines that do not
+ * decode, such as a batch truncated by an interrupted run.
+ */
+export const readSpans = Effect.fnUntraced(function* (file: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const text = yield* fs.readFileString(file);
+  const spans: Array<ReportSpan> = [];
+  let skippedLines = 0;
+  for (const line of text.split("\n")) {
+    if (line.trim().length === 0) continue;
+    const decoded = yield* Schema.decodeUnknownEffect(TraceBatch)(line).pipe(Effect.option);
+    if (decoded._tag === "None") {
+      skippedLines += 1;
+      continue;
+    }
+    const batch = decoded.value;
+    for (const resource of batch.resourceSpans) {
+      for (const scope of resource.scopeSpans) {
+        for (const span of scope.spans) {
+          spans.push({
+            traceId: span.traceId,
+            spanId: span.spanId,
+            parentSpanId: span.parentSpanId,
+            name: reportSpanName(span.name, stringAttribute(span.attributes, "process.subcommand")),
+            startMs: nanosToMs(span.startTimeUnixNano),
+            endMs: nanosToMs(span.endTimeUnixNano),
+            failed: span.status.code === STATUS_ERROR,
+            errorType: stringAttribute(
+              span.events?.find((event) => event.name === "exception")?.attributes,
+              "exception.type",
+            ),
+          });
+        }
+      }
+    }
+  }
+  return { spans, skippedLines };
+});
+
+const USAGE = "usage: bun scripts/trace-report.ts <trace-file> [--top N] [--trace-id ID] [--json]";
+
+/** One trace from a file that may hold several runs: `traceId`, or else the one that ended last. */
+export function selectTrace(
+  spans: ReadonlyArray<ReportSpan>,
+  traceId: string | undefined,
+):
+  | {
+      readonly traceId: string;
+      readonly traceCount: number;
+      readonly spans: ReadonlyArray<ReportSpan>;
+    }
+  | undefined {
+  const byTrace = new Map<string, Array<ReportSpan>>();
+  for (const span of spans) {
+    const group = byTrace.get(span.traceId) ?? [];
+    group.push(span);
+    byTrace.set(span.traceId, group);
+  }
+  const lastEnd = (group: ReadonlyArray<ReportSpan>) =>
+    Math.max(...group.map((span) => span.endMs));
+  const chosen =
+    traceId ?? [...byTrace].sort(([, a], [, b]) => lastEnd(b) - lastEnd(a)).map(([id]) => id)[0];
+  const group = chosen === undefined ? undefined : byTrace.get(chosen);
+  return chosen === undefined || group === undefined
+    ? undefined
+    : { traceId: chosen, traceCount: byTrace.size, spans: group };
+}
+
+export interface TraceReportOptions {
+  readonly file: string;
+  readonly top: number;
+  readonly traceId: string | undefined;
+  readonly json: boolean;
+}
+
+/** Parses argv into {@link TraceReportOptions}; throws on a missing file or a bad `--top`. */
+export function parseTraceReportArgs(args: ReadonlyArray<string>): TraceReportOptions {
+  const topIndex = args.indexOf("--top");
+  const top = topIndex === -1 ? 15 : Number(args[topIndex + 1]);
+  if (!Number.isInteger(top) || top < 1) {
+    throw new Error("--top must be a positive integer");
+  }
+  const traceIdIndex = args.indexOf("--trace-id");
+  const traceId = traceIdIndex === -1 ? undefined : args[traceIdIndex + 1];
+  if (traceIdIndex !== -1 && (traceId === undefined || traceId.startsWith("--"))) {
+    throw new Error("--trace-id needs a trace id");
+  }
+  const valueIndexes = new Set([topIndex, traceIdIndex].filter((i) => i !== -1).map((i) => i + 1));
+  const file = args.find((arg, index) => !arg.startsWith("--") && !valueIndexes.has(index));
+  if (file === undefined) throw new Error(USAGE);
+  return { file, top, traceId, json: args.includes("--json") };
+}
+
+const main = Effect.gen(function* () {
+  const stdio = yield* Stdio.Stdio;
+  const args = yield* stdio.args;
+  const options = yield* Effect.try({
+    try: () => parseTraceReportArgs(args),
+    catch: (cause) => (cause instanceof Error ? cause.message : String(cause)),
+  }).pipe(
+    Effect.catch((message) =>
+      Console.error(message === USAGE ? USAGE : `${message}\n${USAGE}`).pipe(
+        Effect.andThen(
+          Effect.sync(() => {
+            process.exitCode = 2;
+          }),
+        ),
+        Effect.as(undefined),
+      ),
+    ),
+  );
+  if (options === undefined) return;
+  const { spans, skippedLines } = yield* readSpans(options.file);
+  if (skippedLines > 0) {
+    yield* Console.error(`warning: skipped ${skippedLines} trace line(s) that did not decode`);
+  }
+  const trace = selectTrace(spans, options.traceId);
+  if (trace === undefined) {
+    yield* Console.error(
+      options.traceId === undefined
+        ? "no spans in the trace file"
+        : `trace ${options.traceId} is not in the trace file`,
+    );
+    yield* Effect.sync(() => {
+      process.exitCode = 1;
+    });
+    return;
+  }
+  const report = analyzeTrace(trace.spans, options.top);
+  const header = `trace: ${trace.traceId}${trace.traceCount > 1 ? ` (latest of ${trace.traceCount}; choose one with --trace-id)` : ""}`;
+  yield* Console.log(
+    options.json
+      ? JSON.stringify({ traceId: trace.traceId, traceCount: trace.traceCount, ...report }, null, 2)
+      : `${header}\n${formatReport(report)}`,
+  );
+});
+
+if (import.meta.main) {
+  BunRuntime.runMain(main.pipe(Effect.provide(BunServices.layer)));
+}
diff --git a/apps/cli/scripts/trace-report.unit.test.ts b/apps/cli/scripts/trace-report.unit.test.ts
new file mode 100644
index 0000000000..66e7bb5140
--- /dev/null
+++ b/apps/cli/scripts/trace-report.unit.test.ts
@@ -0,0 +1,179 @@
+import { BunServices } from "@effect/platform-bun";
+import { Effect, FileSystem } from "effect";
+import { describe, expect, it } from "vitest";
+import {
+  analyzeTrace,
+  parseTraceReportArgs,
+  readSpans,
+  reportSpanName,
+  selectTrace,
+  type ReportSpan,
+} from "./trace-report.ts";
+
+const span = (
+  spanId: string,
+  parentSpanId: string | undefined,
+  name: string,
+  startMs: number,
+  endMs: number,
+  failed = false,
+): ReportSpan => ({
+  traceId: "t",
+  spanId,
+  parentSpanId,
+  name,
+  startMs,
+  endMs,
+  failed,
+  errorType: failed ? "SqlError" : undefined,
+});
+
+describe("analyzeTrace", () => {
+  const spans = [
+    span("root", undefined, "cli.run", 0, 100),
+    span("a", "root", "Config.load", 0, 10),
+    span("b", "root", "Db.query", 10, 40),
+    span("c", "root", "Db.query", 40, 90, true),
+    span("d", "c", "Db.connect", 40, 80),
+  ];
+
+  it("follows the longest child from the root", () => {
+    expect(analyzeTrace(spans, 5).criticalPath.map((step) => step.name)).toEqual([
+      "cli.run",
+      "Db.query",
+      "Db.connect",
+    ]);
+  });
+
+  it("subtracts child time from self time", () => {
+    const self = Object.fromEntries(
+      analyzeTrace(spans, 5).topSelfTime.map((entry) => [entry.name, entry.selfMs]),
+    );
+
+    expect(self).toEqual({ "cli.run": 10, "Config.load": 10, "Db.query": 40, "Db.connect": 40 });
+  });
+
+  it("reports repeated names and failures", () => {
+    const report = analyzeTrace(spans, 5);
+
+    expect(report.repeated).toEqual([{ name: "Db.query", count: 2, totalMs: 80 }]);
+    expect(report.failures).toEqual([{ name: "Db.query", errorType: "SqlError" }]);
+  });
+
+  it("ignores a child that ends outside its parent when computing self time", () => {
+    const report = analyzeTrace(
+      [
+        span("root", undefined, "cli.run", 0, 100),
+        span("late", "root", "Analytics.flush", 150, 200),
+        span("inner", "root", "Db.query", 20, 50),
+      ],
+      5,
+    );
+    const self = Object.fromEntries(report.topSelfTime.map((entry) => [entry.name, entry.selfMs]));
+
+    expect(self["cli.run"]).toBe(70);
+  });
+});
+
+describe("parseTraceReportArgs", () => {
+  it("reads the trace file, --top, and --json", () => {
+    expect(parseTraceReportArgs(["trace.jsonl", "--top", "3", "--json"])).toEqual({
+      file: "trace.jsonl",
+      top: 3,
+      json: true,
+    });
+  });
+
+  it("defaults --top to 15", () => {
+    expect(parseTraceReportArgs(["trace.jsonl"]).top).toBe(15);
+  });
+
+  it.each([["0"], ["-2"], ["1.5"], ["abc"]])("rejects --top %s", (value) => {
+    expect(() => parseTraceReportArgs(["trace.jsonl", "--top", value])).toThrow(
+      "--top must be a positive integer",
+    );
+  });
+
+  it("rejects --top without a value", () => {
+    expect(() => parseTraceReportArgs(["trace.jsonl", "--top"])).toThrow(
+      "--top must be a positive integer",
+    );
+  });
+
+  it("requires a trace file", () => {
+    expect(() => parseTraceReportArgs(["--json"])).toThrow("usage:");
+  });
+});
+
+describe("reportSpanName", () => {
+  it("separates container CLI verbs and leaves other spans unchanged", () => {
+    expect(reportSpanName("ContainerCli.spawn", "image inspect")).toBe(
+      "ContainerCli.spawn (image inspect)",
+    );
+    expect(reportSpanName("Db.query", undefined)).toBe("Db.query");
+  });
+});
+
+describe("readSpans", () => {
+  it("keeps decodable batches and counts lines that do not decode", async () => {
+    const batch = JSON.stringify({
+      resourceSpans: [
+        {
+          scopeSpans: [
+            {
+              spans: [
+                {
+                  traceId: "t",
+                  spanId: "s",
+                  name: "cli.run",
+                  startTimeUnixNano: "0",
+                  endTimeUnixNano: "1000000",
+                  status: { code: 1 },
+                },
+              ],
+            },
+          ],
+        },
+      ],
+    });
+
+    const result = await Effect.runPromise(
+      Effect.scoped(
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const file = yield* fs.makeTempFileScoped({ suffix: ".jsonl" });
+          yield* fs.writeFileString(file, `${batch}\n{"resourceSpans": [\n`);
+          return yield* readSpans(file);
+        }),
+      ).pipe(Effect.provide(BunServices.layer)),
+    );
+
+    expect(result.spans.map((span) => span.name)).toEqual(["cli.run"]);
+    expect(result.skippedLines).toBe(1);
+  });
+});
+
+describe("selectTrace", () => {
+  const twoRuns = [
+    { ...span("a1", undefined, "cli.run", 0, 100), traceId: "first" },
+    { ...span("b1", undefined, "cli.run", 200, 260), traceId: "second" },
+    { ...span("b2", "b1", "Db.query", 210, 250), traceId: "second" },
+  ];
+
+  it("reports the run that ended last unless a trace id is given", () => {
+    expect(selectTrace(twoRuns, undefined)).toMatchObject({
+      traceId: "second",
+      traceCount: 2,
+      spans: [{ spanId: "b1" }, { spanId: "b2" }],
+    });
+    expect(selectTrace(twoRuns, "first")?.spans.map((s) => s.spanId)).toEqual(["a1"]);
+    expect(selectTrace(twoRuns, "missing")).toBeUndefined();
+  });
+
+  it("parses --trace-id without mistaking its value for the file", () => {
+    expect(parseTraceReportArgs(["--trace-id", "abc", "trace.jsonl"])).toMatchObject({
+      file: "trace.jsonl",
+      traceId: "abc",
+    });
+  });
+});
diff --git a/apps/cli/src/auth/command-credentials.layer.ts b/apps/cli/src/auth/command-credentials.layer.ts
index 61abed0833..8701566a7c 100644
--- a/apps/cli/src/auth/command-credentials.layer.ts
+++ b/apps/cli/src/auth/command-credentials.layer.ts
@@ -383,49 +383,51 @@ const readFallbackFile = (
  * construction. Fails with the same validation error as `resolveAccessToken` and propagates
  * credential storage failures.
  */
-export const accessTokenForProfile = Effect.fnUntraced(function* (profileAccount: string) {
-  const fs = yield* FileSystem.FileSystem;
-  const path = yield* Path.Path;
-  const runtimeInfo = yield* RuntimeInfo;
-  const cliSettings = yield* CommandSettings;
-  const configProvider = yield* ConfigProvider.ConfigProvider;
-  // Keeps the logger optional — a no-op outside the real CLI tree.
-  const debugLogger: DebugLoggerShape = Option.getOrElse(
-    yield* Effect.serviceOption(DebugLogger),
-    () => ({ debug: () => Effect.void, http: () => Effect.void }),
-  );
+export const accessTokenForProfile = Effect.fn("CommandCredentials.accessTokenForProfile")(
+  function* (profileAccount: string) {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const runtimeInfo = yield* RuntimeInfo;
+    const cliSettings = yield* CommandSettings;
+    const configProvider = yield* ConfigProvider.ConfigProvider;
+    // Keeps the logger optional — a no-op outside the real CLI tree.
+    const debugLogger: DebugLoggerShape = Option.getOrElse(
+      yield* Effect.serviceOption(DebugLogger),
+      () => ({ debug: () => Effect.void, http: () => Effect.void }),
+    );
 
-  if (Option.isSome(cliSettings.accessToken)) {
-    yield* debugLogger.debug("Using access token from env var...");
-    yield* validateAccessToken(Redacted.value(cliSettings.accessToken.value));
-    return Option.some(cliSettings.accessToken.value);
-  }
+    if (Option.isSome(cliSettings.accessToken)) {
+      yield* debugLogger.debug("Using access token from env var...");
+      yield* validateAccessToken(Redacted.value(cliSettings.accessToken.value));
+      return Option.some(cliSettings.accessToken.value);
+    }
 
-  const noKeyring = yield* Config.option(Config.string("SUPABASE_NO_KEYRING")).parse(
-    configProvider,
-  );
-  const keyringModule = yield* loadKeyringModule(fs, noKeyring);
-  const keyringValue = yield* readKeyringForAccount(
-    keyringModule,
-    profileAccount,
-    runtimeInfo.platform,
-    debugLogger,
-  );
-  if (Option.isSome(keyringValue)) {
-    yield* validateAccessToken(keyringValue.value);
-    return Option.some(Redacted.make(keyringValue.value));
-  }
+    const noKeyring = yield* Config.option(Config.string("SUPABASE_NO_KEYRING")).parse(
+      configProvider,
+    );
+    const keyringModule = yield* loadKeyringModule(fs, noKeyring);
+    const keyringValue = yield* readKeyringForAccount(
+      keyringModule,
+      profileAccount,
+      runtimeInfo.platform,
+      debugLogger,
+    );
+    if (Option.isSome(keyringValue)) {
+      yield* validateAccessToken(keyringValue.value);
+      return Option.some(Redacted.make(keyringValue.value));
+    }
 
-  const fallbackPath = path.join(cliSettings.supabaseHome, "access-token");
-  const fileValue = yield* readFallbackFile(fs, fallbackPath);
-  if (Option.isSome(fileValue)) {
-    yield* debugLogger.debug(`Using access token from file: ${fallbackPath}`);
-    yield* validateAccessToken(fileValue.value);
-    return Option.some(Redacted.make(fileValue.value));
-  }
+    const fallbackPath = path.join(cliSettings.supabaseHome, "access-token");
+    const fileValue = yield* readFallbackFile(fs, fallbackPath);
+    if (Option.isSome(fileValue)) {
+      yield* debugLogger.debug(`Using access token from file: ${fallbackPath}`);
+      yield* validateAccessToken(fileValue.value);
+      return Option.some(Redacted.make(fileValue.value));
+    }
 
-  return Option.none<Redacted.Redacted<string>>();
-});
+    return Option.none<Redacted.Redacted<string>>();
+  },
+);
 
 const makeCommandCredentials = Effect.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
@@ -444,6 +446,7 @@ const makeCommandCredentials = Effect.gen(function* () {
   const fallbackPath = path.join(fallbackDir, "access-token");
 
   const keyringModule = yield* loadKeyringModule(fs, noKeyring);
+  yield* Effect.annotateCurrentSpan({ "keyring.enabled": Option.isSome(keyringModule) });
 
   const readKeyring = readKeyringForAccount(
     keyringModule,
@@ -459,6 +462,7 @@ const makeCommandCredentials = Effect.gen(function* () {
       if (Option.isSome(cliSettings.accessToken)) {
         yield* debugLogger.debug("Using access token from env var...");
         yield* validateAccessToken(Redacted.value(cliSettings.accessToken.value), "env");
+        yield* Effect.annotateCurrentSpan({ "credential.source": "env" });
         return Option.some(cliSettings.accessToken.value);
       }
 
@@ -466,6 +470,7 @@ const makeCommandCredentials = Effect.gen(function* () {
       const keyringValue = yield* readKeyring;
       if (Option.isSome(keyringValue)) {
         yield* validateAccessToken(keyringValue.value, "stored");
+        yield* Effect.annotateCurrentSpan({ "credential.source": "keyring" });
         return Option.some(Redacted.make(keyringValue.value));
       }
 
@@ -473,29 +478,34 @@ const makeCommandCredentials = Effect.gen(function* () {
       if (Option.isSome(fileValue)) {
         yield* debugLogger.debug(`Using access token from file: ${fallbackPath}`);
         yield* validateAccessToken(fileValue.value, "stored");
+        yield* Effect.annotateCurrentSpan({ "credential.source": "file" });
         return Option.some(Redacted.make(fileValue.value));
       }
 
+      yield* Effect.annotateCurrentSpan({ "credential.source": "none" });
       return Option.none();
-    }),
+    }).pipe(Effect.withSpan("CommandCredentials.getAccessToken")),
 
-    saveAccessToken: (token: string) =>
-      Effect.gen(function* () {
-        yield* validateAccessToken(token);
-        if (Option.isSome(keyringModule)) {
-          const ok = yield* tryKeyringWrite(
-            keyringModule.value,
-            profileAccount,
-            token,
-            runtimeInfo.platform,
-          );
-          if (ok) return;
+    saveAccessToken: Effect.fn("CommandCredentials.saveAccessToken")(function* (token: string) {
+      yield* validateAccessToken(token);
+      if (Option.isSome(keyringModule)) {
+        const ok = yield* tryKeyringWrite(
+          keyringModule.value,
+          profileAccount,
+          token,
+          runtimeInfo.platform,
+        );
+        if (ok) {
+          yield* Effect.annotateCurrentSpan({ "credential.destination": "keyring" });
+          return;
         }
-        // The containing directory is world-readable (0755); only the token file itself must
-        // be private (0600).
-        yield* fs.makeDirectory(fallbackDir, { recursive: true, mode: 0o755 });
-        yield* fs.writeFileString(fallbackPath, token, { mode: 0o600 });
-      }),
+      }
+      // The containing directory is world-readable (0755); only the token file itself must
+      // be private (0600).
+      yield* fs.makeDirectory(fallbackDir, { recursive: true, mode: 0o755 });
+      yield* fs.writeFileString(fallbackPath, token, { mode: 0o600 });
+      yield* Effect.annotateCurrentSpan({ "credential.destination": "file" });
+    }),
 
     deleteAccessToken: Effect.gen(function* () {
       // Removes the fallback token file first; a missing file is ignored, but any other
@@ -531,24 +541,21 @@ const makeCommandCredentials = Effect.gen(function* () {
       if (outcome === "notFound") {
         return yield* new NotLoggedInError({ message: NOT_LOGGED_IN_MESSAGE });
       }
-    }),
+    }).pipe(Effect.withSpan("CommandCredentials.deleteAccessToken")),
 
     deleteAllProjectCredentials: Effect.gen(function* () {
       if (Option.isNone(keyringModule)) return;
       yield* deleteAllKeyringEntries(keyringModule.value, runtimeInfo.platform);
+    }).pipe(Effect.withSpan("CommandCredentials.deleteAllProjectCredentials")),
+
+    deleteProjectCredential: Effect.fn("CommandCredentials.deleteProjectCredential")(function* (
+      projectRef: string,
+    ) {
+      // WSL or no keyring module: no-op success, nothing to delete.
+      if (Option.isNone(keyringModule)) return false;
+      return yield* deleteKeyringEntryStrict(keyringModule.value, projectRef, runtimeInfo.platform);
     }),
-
-    deleteProjectCredential: (projectRef: string) =>
-      Effect.gen(function* () {
-        // WSL or no keyring module: no-op success, nothing to delete.
-        if (Option.isNone(keyringModule)) return false;
-        return yield* deleteKeyringEntryStrict(
-          keyringModule.value,
-          projectRef,
-          runtimeInfo.platform,
-        );
-      }),
   });
-});
+}).pipe(Effect.withSpan("CommandCredentials.load"));
 
 export const commandCredentialsLayer = Layer.effect(CommandCredentials, makeCommandCredentials);
diff --git a/apps/cli/src/auth/command-platform-api.layer.ts b/apps/cli/src/auth/command-platform-api.layer.ts
index 9e4fdbbd53..d0bc9f2a46 100644
--- a/apps/cli/src/auth/command-platform-api.layer.ts
+++ b/apps/cli/src/auth/command-platform-api.layer.ts
@@ -69,6 +69,6 @@ export const makeCommandPlatformApi = Effect.gen(function* () {
       transformClient,
     },
   );
-});
+}).pipe(Effect.withSpan("CommandPlatformApi.build"));
 
 export const commandPlatformApiLayer = Layer.effect(CommandPlatformApi, makeCommandPlatformApi);
diff --git a/apps/cli/src/auth/command-platform-api.layer.unit.test.ts b/apps/cli/src/auth/command-platform-api.layer.unit.test.ts
index cec5494de0..84dc920389 100644
--- a/apps/cli/src/auth/command-platform-api.layer.unit.test.ts
+++ b/apps/cli/src/auth/command-platform-api.layer.unit.test.ts
@@ -77,9 +77,7 @@ function mockTelemetryRuntime(
     TelemetryRuntime,
     TelemetryRuntime.of({
       configDir: opts.configDir ?? "/tmp/supabase-cli-test-home",
-      tracesDir: path.join(opts.configDir ?? "/tmp/supabase-cli-test-home", "traces"),
       consent: "granted",
-      showDebug: false,
       deviceId: opts.deviceId ?? "device-123",
       sessionId: "session-123",
       identity: makeTelemetryIdentity(opts.distinctId),
diff --git a/apps/cli/src/cli/complete.ts b/apps/cli/src/cli/complete.ts
index 0898836706..c305a00051 100644
--- a/apps/cli/src/cli/complete.ts
+++ b/apps/cli/src/cli/complete.ts
@@ -19,7 +19,10 @@ import {
   PropExitCode,
   PropOutputFormat,
 } from "../shared/telemetry/event-catalog.ts";
-import { standaloneAnalyticsConfigLayer } from "../shared/telemetry/standalone-analytics-config.layer.ts";
+import { cliProjectContextLayer } from "../shared/config/cli-project-context.layer.ts";
+import { cliSettingsLayer } from "../shared/config/cli-settings.layer.ts";
+import { runtimeInfoLayer } from "../shared/runtime/runtime-info.layer.ts";
+import { ttyLayer } from "../shared/runtime/tty.layer.ts";
 import { cliConfigProviderLayer } from "../shared/config/cli-config-provider.layer.ts";
 import { analyticsLayer } from "../telemetry/analytics.layer.ts";
 import { formatCliError, normalizeCliError } from "../shared/output/normalize-error.ts";
@@ -1113,11 +1116,16 @@ export function captureCompleteTelemetryEffect(
 
 const COMPLETE_TELEMETRY_TIMEOUT = "2 seconds";
 
-// `analyticsLayer` needs `CliSettings`/`RuntimeInfo`/`Tty` plus a platform layer;
-// `standaloneAnalyticsConfigLayer` packages that small set for a caller outside the full
-// CLI runtime tree.
+// Completion telemetry fires before `runCli` builds its layer tree, so the
+// `CliSettings`/`RuntimeInfo`/`Tty` set that `analyticsLayer` needs is resolved here.
 const completeAnalyticsLayer = analyticsLayer.pipe(
-  Layer.provide(standaloneAnalyticsConfigLayer),
+  Layer.provide(
+    Layer.mergeAll(
+      cliSettingsLayer.pipe(Layer.provide(cliProjectContextLayer), Layer.provide(runtimeInfoLayer)),
+      runtimeInfoLayer,
+      ttyLayer,
+    ),
+  ),
   Layer.provide(FetchHttpClient.layer),
   Layer.provide(cliConfigProviderLayer),
   Layer.provide(BunServices.layer),
diff --git a/apps/cli/src/cli/main.ts b/apps/cli/src/cli/main.ts
index 6f946e73f0..f6c506c85d 100644
--- a/apps/cli/src/cli/main.ts
+++ b/apps/cli/src/cli/main.ts
@@ -40,9 +40,11 @@ if (
     defaultCompleteDeps(Exit.isSuccess(selectionExit) ? selectedRoot : undefined, selectionCause),
   ))
 ) {
-  await runCli(selectedRoot, {
-    analyticsLayer: analyticsLayer.pipe(Layer.provide(FetchHttpClient.layer)),
-    afterSuccess: upgradeNoticeHook,
-    ...(selectionCause ? { beforeParse: Effect.failCause(selectionCause) } : {}),
-  });
+  await Effect.runPromise(
+    runCli(selectedRoot, {
+      analyticsLayer: analyticsLayer.pipe(Layer.provide(FetchHttpClient.layer)),
+      afterSuccess: upgradeNoticeHook,
+      ...(selectionCause ? { beforeParse: Effect.failCause(selectionCause) } : {}),
+    }),
+  );
 }
diff --git a/apps/cli/src/cli/root.ts b/apps/cli/src/cli/root.ts
index 058401a9fd..620d42231f 100644
--- a/apps/cli/src/cli/root.ts
+++ b/apps/cli/src/cli/root.ts
@@ -51,7 +51,6 @@ import { telemetryCommand } from "../commands/telemetry/telemetry.command.ts";
 import { unlinkCommand } from "../commands/unlink/unlink.command.ts";
 import { vanitySubdomainsCommand } from "../commands/vanity-subdomains/vanity-subdomains.command.ts";
 import { whoamiCommand } from "../commands/whoami/whoami.command.ts";
-import { OutputFormatFlag } from "../shared/cli/global-flags.ts";
 import { CLI_VERSION, cliBuildChannel } from "../shared/cli/version.ts";
 import { outputLayerFor } from "../shared/output/output.layer.ts";
 import { quietProgressTextOutputLayer } from "../output/quiet-progress-text-output.layer.ts";
@@ -71,6 +70,7 @@ import {
   ExperimentalFlag,
   NetworkIdFlag,
   OutputFlag,
+  OutputFormatFlag,
   ProfileFlag,
   WorkdirFlag,
   YesFlag,
@@ -145,7 +145,7 @@ export const rootCommandForFeatures = (
     readonly stackBackend?: StackBackend;
     readonly computeEnabled?: boolean;
   } = {},
-): CliRootCommand =>
+) =>
   Command.make("supabase").pipe(
     Command.withDescription(rootDescription(CLI_VERSION)),
     Command.withSubcommands([
@@ -245,7 +245,9 @@ export const rootCommandForFeatures = (
             : outputLayerFor(outputFormat);
 
           return Layer.mergeAll(
-            stackBackendLayer(options.stackBackend ?? "legacy"),
+            options.stackBackend === undefined
+              ? Layer.empty
+              : stackBackendLayer(options.stackBackend),
             outputLayer,
             makeGoProxyLayer({ globalArgs, parentOwnsCapturedSuccessTail: true }),
           );
@@ -253,6 +255,6 @@ export const rootCommandForFeatures = (
       ),
     ),
     Command.withGlobalFlags([OutputFormatFlag, ...GLOBAL_FLAGS]),
-  );
+  ) satisfies CliRootCommand;
 
-export const rootCommand: CliRootCommand = rootCommandForFeatures();
+export const rootCommand = rootCommandForFeatures();
diff --git a/apps/cli/src/command-internal/branch-ref.resolver.ts b/apps/cli/src/command-internal/branch-ref.resolver.ts
index 36d3564653..b5e2e6a570 100644
--- a/apps/cli/src/command-internal/branch-ref.resolver.ts
+++ b/apps/cli/src/command-internal/branch-ref.resolver.ts
@@ -40,22 +40,28 @@ export function resolveBranchProjectRef<EGet, EFind, EParent = never, RParent =
 ) {
   return Effect.gen(function* () {
     if (BRANCH_PROJECT_REF_PATTERN.test(input)) {
+      yield* Effect.annotateCurrentSpan("branch_ref.input_kind", "project_ref");
       return input;
     }
 
     const api = yield* CommandPlatformApi;
 
     if (BRANCH_UUID_PATTERN.test(input)) {
+      yield* Effect.annotateCurrentSpan("branch_ref.input_kind", "branch_id");
       const detail = yield* api.v1
         .getABranchConfig({ branch_id_or_ref: input })
         .pipe(Effect.catch(mappers.mapGetError));
       return detail.ref;
     }
 
+    yield* Effect.annotateCurrentSpan("branch_ref.input_kind", "branch_name");
     const parentRef = typeof projectRef === "string" ? projectRef : yield* projectRef;
     const branch = yield* api.v1
       .getABranch({ ref: parentRef, name: input })
       .pipe(Effect.catch(mappers.mapFindError));
     return branch.project_ref;
-  });
+  }).pipe(
+    Effect.tap((ref) => Effect.annotateCurrentSpan("project.ref", ref)),
+    Effect.withSpan("BranchRef.resolve"),
+  );
 }
diff --git a/apps/cli/src/command-internal/branch-target.ts b/apps/cli/src/command-internal/branch-target.ts
index 8481b4c21d..1733f7a1b2 100644
--- a/apps/cli/src/command-internal/branch-target.ts
+++ b/apps/cli/src/command-internal/branch-target.ts
@@ -109,7 +109,7 @@ export const BRANCH_LOOKUP_TIMEOUT = Duration.seconds(5);
  * timeout degrades like any other failure. Spinner cleanup runs via `Effect.ensuring` so it
  * still fires when the timeout interrupts the in-flight listing call.
  */
-export const findBranchName = Effect.fnUntraced(function* (
+export const findBranchName = Effect.fn("BranchTarget.findName")(function* (
   parentRef: string,
   linkedRef: string,
   options: { readonly spinnerLabel?: string } = {},
@@ -135,7 +135,12 @@ export const findBranchName = Effect.fnUntraced(function* (
     Effect.catch(() => Effect.succeed(Option.none<BranchLookupBranches>())),
   );
 
-  return Option.isSome(branchesOption)
+  const name = Option.isSome(branchesOption)
     ? branchesOption.value.find((branch) => branch.project_ref === linkedRef)?.name
     : undefined;
+  yield* Effect.annotateCurrentSpan(
+    "branch_lookup.outcome",
+    Option.isNone(branchesOption) ? "unavailable" : name === undefined ? "not_found" : "found",
+  );
+  return name;
 });
diff --git a/apps/cli/src/command-internal/bundled-postgres-client.ts b/apps/cli/src/command-internal/bundled-postgres-client.ts
index df9476e09b..8495a41661 100644
--- a/apps/cli/src/command-internal/bundled-postgres-client.ts
+++ b/apps/cli/src/command-internal/bundled-postgres-client.ts
@@ -26,6 +26,7 @@ import { ProcessControl } from "../shared/runtime/process-control.service.ts";
 import { RuntimeInfo } from "../shared/runtime/runtime-info.service.ts";
 import { Output } from "../shared/output/output.service.ts";
 import { CommandSettings } from "../config/command-settings.service.ts";
+import { withProcessSpanScoped } from "../shared/telemetry/spans.ts";
 
 const BUNDLED_CLIENT_SUGGESTION =
   "Re-download the Postgres artifact, or create a new stack that uses a container runtime.";
@@ -141,20 +142,23 @@ const nativeRun = Effect.fn("BundledPostgresClient.nativeRun")(function* <E>(
     ...options.env,
     PATH: `${path.join(artifactRoot, "bin")}:${Option.getOrElse(inheritedPath, () => "")}`,
   };
-  const child = yield* spawner
-    .spawn(
-      ChildProcess.make(tool, args, {
-        cwd: options.cwd,
-        env,
-        extendEnv: true,
-        stdin: "ignore",
-        stdout: "pipe",
-        stderr: "pipe",
-        killSignal: command === "pg_prove" ? "SIGKILL" : undefined,
-        forceKillAfter: "5 seconds",
-      }),
-    )
-    .pipe(Effect.mapError(mapSpawnError));
+  const child = yield* withProcessSpanScoped(
+    "BundledPostgresClient.spawn",
+    { executable: tool, argCount: args.length },
+    (traceEnv) =>
+      spawner.spawn(
+        ChildProcess.make(tool, args, {
+          cwd: options.cwd,
+          env: { ...env, ...traceEnv },
+          extendEnv: true,
+          stdin: "ignore",
+          stdout: "pipe",
+          stderr: "pipe",
+          killSignal: command === "pg_prove" ? "SIGKILL" : undefined,
+          forceKillAfter: "5 seconds",
+        }),
+      ),
+  ).pipe(Effect.mapError(mapSpawnError));
   let stderr = "";
   const stderrDecoder = new TextDecoder();
   yield* Effect.all(
diff --git a/apps/cli/src/command-internal/colors.ts b/apps/cli/src/command-internal/colors.ts
index 50addc7657..b1b6933cf1 100644
--- a/apps/cli/src/command-internal/colors.ts
+++ b/apps/cli/src/command-internal/colors.ts
@@ -77,3 +77,18 @@ export function green(text: string, stream: ColorStream = process.stderr): strin
 export function gray(text: string, stream: ColorStream = process.stderr): string {
   return supportsColor(stream) ? styleText("gray", text, { validateStream: false }) : text;
 }
+
+/** Renders in magenta. */
+export function magenta(text: string, stream: ColorStream = process.stderr): string {
+  return supportsColor(stream) ? styleText("magenta", text, { validateStream: false }) : text;
+}
+
+/** Renders in blue. */
+export function blue(text: string, stream: ColorStream = process.stderr): string {
+  return supportsColor(stream) ? styleText("blue", text, { validateStream: false }) : text;
+}
+
+/** Renders dimmed. */
+export function dim(text: string, stream: ColorStream = process.stderr): string {
+  return supportsColor(stream) ? styleText("dim", text, { validateStream: false }) : text;
+}
diff --git a/apps/cli/src/command-internal/config-pull-run.ts b/apps/cli/src/command-internal/config-pull-run.ts
index 9395168666..8327855dba 100644
--- a/apps/cli/src/command-internal/config-pull-run.ts
+++ b/apps/cli/src/command-internal/config-pull-run.ts
@@ -571,7 +571,7 @@ export interface ConfigPullSource {
  * read, silently becoming the accepted baseline while the plan below is computed against the
  * now-stale parsed values.
  */
-export const openConfigPullSource = Effect.fnUntraced(function* () {
+export const openConfigPullSource = Effect.fn("ConfigPull.openSource")(function* () {
   const cliSettings = yield* CommandSettings;
   const { loadConfig, toRelativeConfigPath } = makeConfigLoader(cliSettings);
 
@@ -597,7 +597,9 @@ export const openConfigPullSource = Effect.fnUntraced(function* () {
  * writes, or calls `output.success`; the caller decides what to do with the returned
  * {@link ConfigPullRunPlan}.
  */
-export const planConfigPullRun = Effect.fnUntraced(function* (request: ConfigPullPlanRequest) {
+export const planConfigPullRun = Effect.fn("ConfigPull.plan")(function* (
+  request: ConfigPullPlanRequest,
+) {
   const output = yield* Output;
   const api = yield* CommandPlatformApi;
   const cliSettings = yield* CommandSettings;
@@ -625,6 +627,10 @@ export const planConfigPullRun = Effect.fnUntraced(function* (request: ConfigPul
     });
   }
   const destination = scopeResult.destination;
+  yield* Effect.annotateCurrentSpan({
+    "project.ref": ref,
+    "config.destination.kind": destination.kind,
+  });
   yield* output.raw(configPullDestinationLine({ projectRef: ref, branch }, destination), "stderr");
 
   // A brand-new block has nothing to overlay yet.
@@ -723,6 +729,11 @@ export const planConfigPullRun = Effect.fnUntraced(function* (request: ConfigPul
   // reach the git guard/confirmation like any other write.
   const hasBlockToCreate = finalPlan.createdTable !== undefined;
   const hasWork = finalPlan.writes.length > 0 || hasBlockToCreate;
+  yield* Effect.annotateCurrentSpan({
+    "change.count": changeSet.changes.length,
+    "config.write_count": finalPlan.writes.length,
+    "config.skip_count": finalPlan.skipped.length,
+  });
 
   return {
     changeSet,
@@ -739,12 +750,13 @@ export const planConfigPullRun = Effect.fnUntraced(function* (request: ConfigPul
  * while the confirmation prompt was on screen), `applyConfigEdits`, and the atomic write. No
  * emission — the caller renders the final summary/payload once this succeeds.
  */
-export const applyConfigPullRun = Effect.fnUntraced(function* (input: {
+export const applyConfigPullRun = Effect.fn("ConfigPull.apply")(function* (input: {
   readonly runPlan: ConfigPullRunPlan;
   readonly source: ConfigPullSource;
 }) {
   const fs = yield* FileSystem.FileSystem;
   const { plan, context, configFilePath } = input.runPlan;
+  yield* Effect.annotateCurrentSpan("config.write_count", plan.writes.length);
 
   const currentText = yield* fs.readFileString(configFilePath).pipe(
     Effect.catchTag(
diff --git a/apps/cli/src/command-internal/container-cli.ts b/apps/cli/src/command-internal/container-cli.ts
index 71d8cabe65..8ea7a0addc 100644
--- a/apps/cli/src/command-internal/container-cli.ts
+++ b/apps/cli/src/command-internal/container-cli.ts
@@ -2,6 +2,11 @@ import { Data, Effect, Stream } from "effect";
 import * as ChildProcess from "effect/unstable/process/ChildProcess";
 import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
 
+import {
+  withChildTraceEnv,
+  withProcessSpan,
+  withProcessSpanScoped,
+} from "../shared/telemetry/spans.ts";
 import {
   actionability,
   type CliErrorActionabilityDeclaration,
@@ -54,10 +59,10 @@ export const spawnContainerCliWithRuntime = (
   args: ReadonlyArray<string>,
   options?: ChildProcess.CommandOptions,
 ) =>
-  spawner.spawn(ChildProcess.make("docker", args, options)).pipe(
+  spawnRuntime(spawner, dockerRuntime, args, options).pipe(
     Effect.map((handle) => ({ handle, runtime: dockerRuntime })),
     Effect.catch(() =>
-      spawner.spawn(ChildProcess.make("podman", args, options)).pipe(
+      spawnRuntime(spawner, podmanRuntime, args, options).pipe(
         Effect.map((handle) => ({ handle, runtime: podmanRuntime })),
         Effect.catch(() =>
           Effect.fail(
@@ -73,6 +78,78 @@ export const spawnContainerCliWithRuntime = (
 const dockerRuntime: ContainerRuntime = "docker";
 const podmanRuntime: ContainerRuntime = "podman";
 
+const MANAGEMENT_COMMANDS: ReadonlySet<string> = new Set([
+  "container",
+  "context",
+  "image",
+  "network",
+  "system",
+  "volume",
+]);
+const COMMANDS: ReadonlySet<string> = new Set([
+  "build",
+  "cp",
+  "create",
+  "exec",
+  "images",
+  "info",
+  "inspect",
+  "kill",
+  "load",
+  "logs",
+  "ls",
+  "ps",
+  "prune",
+  "pull",
+  "restart",
+  "rm",
+  "run",
+  "save",
+  "start",
+  "stop",
+  "tag",
+  "version",
+  "wait",
+]);
+
+function containerSubcommand(args: ReadonlyArray<string>): string {
+  const [first, second] = args;
+  if (first === undefined) return "none";
+  if (MANAGEMENT_COMMANDS.has(first)) {
+    return second !== undefined && COMMANDS.has(second) ? `${first} ${second}` : first;
+  }
+  return COMMANDS.has(first) ? first : "other";
+}
+
+const processTarget = (runtime: ContainerRuntime, args: ReadonlyArray<string>) => ({
+  executable: runtime,
+  argCount: args.length,
+  subcommand: containerSubcommand(args),
+  hasFallback: runtime === dockerRuntime,
+});
+
+function spawnRuntime(
+  spawner: Spawner,
+  runtime: ContainerRuntime,
+  args: ReadonlyArray<string>,
+  options?: ChildProcess.CommandOptions,
+) {
+  return withProcessSpanScoped("ContainerCli.spawn", processTarget(runtime, args), (traceEnv) =>
+    spawner.spawn(ChildProcess.make(runtime, args, withChildTraceEnv(options, traceEnv))),
+  );
+}
+
+function runtimeExitCode(
+  spawner: Spawner,
+  runtime: ContainerRuntime,
+  args: ReadonlyArray<string>,
+  options?: ChildProcess.CommandOptions,
+) {
+  return withProcessSpan("ContainerCli.run", processTarget(runtime, args), (traceEnv) =>
+    spawner.exitCode(ChildProcess.make(runtime, args, withChildTraceEnv(options, traceEnv))),
+  );
+}
+
 /**
  * Spawn a container-CLI command and return the process handle. Use when the
  * caller needs to read stdout/stderr or await the exit code itself.
@@ -95,9 +172,9 @@ export const containerCliExitCode = (
   options?: ChildProcess.CommandOptions,
   podmanArgs?: ReadonlyArray<string>,
 ) =>
-  spawner.exitCode(ChildProcess.make("docker", args, options)).pipe(
+  runtimeExitCode(spawner, dockerRuntime, args, options).pipe(
     Effect.catch(() =>
-      spawner.exitCode(ChildProcess.make("podman", podmanArgs ?? args, options)).pipe(
+      runtimeExitCode(spawner, podmanRuntime, podmanArgs ?? args, options).pipe(
         Effect.catch(() =>
           Effect.fail(
             new ContainerRuntimeNotFoundError({
@@ -188,9 +265,9 @@ export const containerCliExitCodeAndStdout = (
         stdout: "pipe",
         stderr: "ignore",
       } satisfies ChildProcess.CommandOptions;
-      const handle = yield* spawner.spawn(ChildProcess.make("docker", args, options)).pipe(
+      const handle = yield* spawnRuntime(spawner, dockerRuntime, args, options).pipe(
         Effect.catch(() =>
-          spawner.spawn(ChildProcess.make("podman", podmanArgs ?? args, options)).pipe(
+          spawnRuntime(spawner, podmanRuntime, podmanArgs ?? args, options).pipe(
             Effect.catch(() =>
               Effect.fail(
                 new ContainerRuntimeNotFoundError({
diff --git a/apps/cli/src/command-internal/container-cli.unit.test.ts b/apps/cli/src/command-internal/container-cli.unit.test.ts
index 5cc719f1d0..26d92e53ca 100644
--- a/apps/cli/src/command-internal/container-cli.unit.test.ts
+++ b/apps/cli/src/command-internal/container-cli.unit.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "@effect/vitest";
-import { Deferred, Effect, PlatformError, Sink, Stream } from "effect";
+import { Deferred, Effect, Exit, PlatformError, Sink, Stream, Tracer } from "effect";
 import { ChildProcessSpawner } from "effect/unstable/process";
 
 import {
@@ -127,6 +127,102 @@ describe("containerCliExitCode", () => {
   });
 });
 
+describe("container CLI process spans", () => {
+  const recordedAttributes = (args: ReadonlyArray<string>) =>
+    Effect.gen(function* () {
+      const spans: Array<Tracer.NativeSpan> = [];
+      const tracer = Tracer.make({
+        span: (options) => {
+          const span = new Tracer.NativeSpan(options);
+          spans.push(span);
+          return span;
+        },
+      });
+      yield* containerCliExitCode(mockSpawner().spawner, args).pipe(
+        Effect.withTracer(tracer),
+        Effect.withTracerEnabled(true),
+      );
+      return Object.fromEntries(spans.find((span) => span.name === "ContainerCli.run")!.attributes);
+    });
+
+  it.live("records the docker verb but no free-form arguments", () =>
+    recordedAttributes(["container", "inspect", "supabase_db_secret-project"]).pipe(
+      Effect.map((attributes) => {
+        expect(attributes).toEqual({
+          "process.executable.name": "docker",
+          "process.arg_count": 3,
+          "process.subcommand": "container inspect",
+          "process.exit_code": 0,
+        });
+      }),
+    ),
+  );
+
+  it.live("labels an unknown leading argument as other", () =>
+    recordedAttributes(["--context", "my-private-context", "ps"]).pipe(
+      Effect.map((attributes) => {
+        expect(attributes["process.subcommand"]).toBe("other");
+      }),
+    ),
+  );
+
+  it.live("records a missing docker as a failed attempt, not a failed span, on podman hosts", () =>
+    Effect.gen(function* () {
+      const spans: Array<Tracer.NativeSpan> = [];
+      const tracer = Tracer.make({
+        span: (options) => {
+          const span = new Tracer.NativeSpan(options);
+          spans.push(span);
+          return span;
+        },
+      });
+      const mock = mockSpawner({ dockerMissing: true });
+
+      yield* containerCliExitCode(mock.spawner, ["ps"]).pipe(
+        Effect.andThen(spawnContainerCli(mock.spawner, ["ps"]).pipe(Effect.scoped)),
+        Effect.withTracer(tracer),
+        Effect.withTracerEnabled(true),
+      );
+
+      const docker = spans.filter(
+        (span) => span.attributes.get("process.executable.name") === "docker",
+      );
+      expect(docker.map((span) => span.name)).toEqual(["ContainerCli.run", "ContainerCli.spawn"]);
+      expect(docker.map((span) => span.attributes.get("process.attempt_failed"))).toEqual([
+        true,
+        true,
+      ]);
+      expect(
+        spans.map((span) => span.status._tag === "Ended" && Exit.isSuccess(span.status.exit)),
+      ).toEqual([true, true, true, true]);
+    }),
+  );
+
+  it.live("fails the podman span when neither runtime can be spawned", () =>
+    Effect.gen(function* () {
+      const spans: Array<Tracer.NativeSpan> = [];
+      const tracer = Tracer.make({
+        span: (options) => {
+          const span = new Tracer.NativeSpan(options);
+          spans.push(span);
+          return span;
+        },
+      });
+
+      yield* containerCliExitCode(mockSpawner({ bothMissing: true }).spawner, ["ps"]).pipe(
+        Effect.ignore,
+        Effect.withTracer(tracer),
+        Effect.withTracerEnabled(true),
+      );
+
+      const podman = spans.find(
+        (span) => span.attributes.get("process.executable.name") === "podman",
+      );
+      expect(podman?.status._tag === "Ended" && Exit.isFailure(podman.status.exit)).toBe(true);
+    }),
+  );
+});
+
 describe("dockerSupportsVolumePruneAllFlag", () => {
   it.live("returns true when the daemon reports an API version at or above 1.42", () => {
     const mock = mockSpawner({ stdout: "1.42" });
diff --git a/apps/cli/src/command-internal/db-bootstrap/container-lifecycle.ts b/apps/cli/src/command-internal/db-bootstrap/container-lifecycle.ts
index 3a68a3fe22..bc078643c8 100644
--- a/apps/cli/src/command-internal/db-bootstrap/container-lifecycle.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/container-lifecycle.ts
@@ -725,5 +725,13 @@ export function createContainer(
     );
     yield* dockerStartContainer(spawner, containerId, finalSpec);
     return containerId;
-  });
+  }).pipe(
+    Effect.withSpan("ContainerLifecycle.createContainer", {
+      attributes: {
+        "container.name": spec.containerName,
+        "image.name": spec.image,
+        "container.pre_start_archive_count": spec.preStartArchives?.length ?? 0,
+      },
+    }),
+  );
 }
diff --git a/apps/cli/src/command-internal/db-bootstrap/db-setup.ts b/apps/cli/src/command-internal/db-bootstrap/db-setup.ts
index 08ba19d556..4ad1081f39 100644
--- a/apps/cli/src/command-internal/db-bootstrap/db-setup.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/db-setup.ts
@@ -387,7 +387,7 @@ const startInitSchemaPre15 = Effect.fnUntraced(function* (
  * long-running containers' own ambient-only resolver never sees `opts.projectEnvValues`, and
  * neither caller pre-pulls these three images as a batch.
  */
-const runStartMigrateJob = Effect.fnUntraced(function* (
+const runStartMigrateJob = Effect.fn("DbSetup.runMigrateJob")(function* (
   spawner: Spawner,
   opts: {
     readonly image: string;
@@ -400,6 +400,7 @@ const runStartMigrateJob = Effect.fnUntraced(function* (
     readonly debug: boolean;
   },
 ) {
+  yield* Effect.annotateCurrentSpan("image.name", opts.image);
   const docker = yield* DockerRun;
   const runtimeInfo = yield* RuntimeInfo;
   const resolvedImages = yield* ensureImagesCached(spawner, [opts.image], opts.projectEnvValues);
@@ -591,11 +592,12 @@ const startInitSchema15 = Effect.fnUntraced(function* (
  * Branches on `majorVersion`. The setup banner prints from {@link resolveDbSetupPrelude}, the
  * caller-side step that runs immediately before this one, not from here.
  */
-const startInitSchema = Effect.fnUntraced(function* (
+const startInitSchema = Effect.fn("DbSetup.initSchema")(function* (
   spawner: Spawner,
   input: SetupDatabaseInput,
   tmpDir: string,
 ) {
+  yield* Effect.annotateCurrentSpan("db.major_version", input.majorVersion);
   if (input.majorVersion <= 14) {
     yield* startInitSchemaPre15(input.session, input.fs, input.path, tmpDir, input.majorVersion);
     return;
@@ -779,7 +781,11 @@ export const applyDatabaseOverlay = (
         (message) => new DbSetupError({ message, reason: "database" }),
       );
     }
-  });
+  }).pipe(
+    Effect.withSpan("DbSetup.applyOverlay", {
+      attributes: { "vault.secret_count": overlay.vault.length },
+    }),
+  );
 
 /**
  * Runs schema init through the custom-roles seed; see {@link SetupDatabaseInput} for exactly
@@ -830,7 +836,7 @@ export const setupDatabase = (
       vault: input.vault,
       webhooks: options.webhooks,
     });
-  });
+  }).pipe(Effect.withSpan("DbSetup.setupDatabase"));
 
 /**
  * Runs the full setup sequence described in this module's header. Call once, right after the
@@ -913,8 +919,10 @@ const connectLocalPostgres = (input: {
 }) =>
   Effect.gen(function* () {
     const dbConnection = yield* DbConnection;
-    return yield* dbConnection
-      .connect(
+    let attempts = 0;
+    return yield* Effect.suspend(() => {
+      attempts += 1;
+      return dbConnection.connect(
         {
           host: input.hostname,
           port: input.dbPort,
@@ -923,14 +931,17 @@ const connectLocalPostgres = (input: {
           database: "postgres",
         },
         { isLocal: true, dnsResolver: "native" },
-      )
-      .pipe(
-        Effect.retry({
-          schedule: Schedule.max([Schedule.spaced("1 seconds"), Schedule.recurs(10)]),
-          while: (error) => error.retryable === true,
-        }),
       );
-  });
+    }).pipe(
+      Effect.retry({
+        schedule: Schedule.max([Schedule.spaced("1 seconds"), Schedule.recurs(10)]),
+        while: (error) => error.retryable === true,
+      }),
+      Effect.ensuring(
+        Effect.suspend(() => Effect.annotateCurrentSpan("retry.attempt_count", attempts)),
+      ),
+    );
+  }).pipe(Effect.withSpan("DbSetup.connectLocalPostgres"));
 
 /** Converges pg_net while preserving extensions installed by user migrations. */
 export const runDatabaseWebhooksSetup = (input: {
@@ -980,6 +991,10 @@ export const runDatabaseWebhooksSetup = (input: {
       }
       yield* applyDatabaseWebhooks(session, input.fs, input.path, tmpDir, input.enabled);
     }),
+  ).pipe(
+    Effect.withSpan("DbSetup.runDatabaseWebhooksSetup", {
+      attributes: { "webhooks.enabled": input.enabled },
+    }),
   );
 
 /**
@@ -1049,4 +1064,8 @@ export const runFreshDbSetup = <E>(
         seedFlags: input.seedFlags,
       });
     }),
+  ).pipe(
+    Effect.withSpan("DbSetup.runFreshDbSetup", {
+      attributes: { "db.major_version": input.setup.majorVersion },
+    }),
   );
diff --git a/apps/cli/src/command-internal/db-bootstrap/health-check.ts b/apps/cli/src/command-internal/db-bootstrap/health-check.ts
index c2bd3dabff..c8420daf07 100644
--- a/apps/cli/src/command-internal/db-bootstrap/health-check.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/health-check.ts
@@ -15,6 +15,7 @@ import {
   type CliErrorActionabilityDeclaration,
   ErrorActionabilityId,
 } from "../../shared/telemetry/error-actionability.ts";
+import { ChildTracePropagation } from "../../shared/telemetry/spans.ts";
 import { spawnContainerCliWithRuntime, type ContainerRuntime } from "../container-cli.ts";
 import { DbConnection, type PgConnInput } from "../db-connection.service.ts";
 import { inspectContainerState } from "../docker-lifecycle.ts";
@@ -288,11 +289,13 @@ export function waitForHealthyServices(
   return Effect.gen(function* () {
     const timeoutSeconds = opts.timeoutSeconds ?? (yield* HealthCheckTimeoutSeconds);
     let stillWatching = containerIds;
+    let attempts = 0;
 
     // Each round narrows `stillWatching` to just the containers that failed, so a container
     // that becomes healthy mid-run stops being probed on later rounds.
     const probe: Effect.Effect<void, HealthCheckProbeError, HttpClient.HttpClient> = Effect.gen(
       function* () {
+        attempts += 1;
         const outcomes = yield* Effect.forEach(
           stillWatching,
           (containerId) =>
@@ -315,7 +318,7 @@ export function waitForHealthyServices(
           return yield* Effect.fail(new HealthCheckProbeError({ failures }));
         }
       },
-    );
+    ).pipe(Effect.withTracerEnabled(false), Effect.provideService(ChildTracePropagation, false));
 
     // A 1-second constant delay, capped at `timeoutSeconds` retries after the initial attempt.
     const schedule = Schedule.max([Schedule.spaced("1 seconds"), Schedule.recurs(timeoutSeconds)]);
@@ -350,8 +353,20 @@ export function waitForHealthyServices(
           );
         }),
       ),
+      Effect.ensuring(
+        Effect.suspend(() =>
+          Effect.annotateCurrentSpan({
+            "retry.attempt_count": attempts,
+            "health.unhealthy_count": stillWatching.length,
+          }),
+        ),
+      ),
     );
-  });
+  }).pipe(
+    Effect.withSpan("HealthCheck.waitHealthyServices", {
+      attributes: { "health.container_count": containerIds.length },
+    }),
+  );
 }
 
 /** Caps a hung dial so one probe cannot swallow the whole poll budget. */
@@ -422,8 +437,10 @@ export function waitForShadowReady(
     // Per-evaluation state: the retry rounds within one evaluation share the latest failure for
     // the timeout diagnostic, while re-evaluating the returned Effect starts from a fresh slot.
     let lastFailure: ShadowReadyFailure | undefined;
+    let attempts = 0;
 
     const probe: Effect.Effect<void, ShadowReadyFailure, DbConnection> = Effect.gen(function* () {
+      attempts += 1;
       const state = yield* inspectContainerState(spawner, containerId).pipe(
         Effect.mapError((cause) => shadowNotReady(cause.message)),
       );
@@ -435,6 +452,8 @@ export function waitForShadowReady(
       }
       yield* probeShadowConnect(connConfig);
     }).pipe(
+      Effect.withTracerEnabled(false),
+      Effect.provideService(ChildTracePropagation, false),
       Effect.tapError((failure) =>
         Effect.sync(() => {
           lastFailure = failure;
@@ -472,6 +491,9 @@ export function waitForShadowReady(
           );
         }),
       ),
+      Effect.ensuring(
+        Effect.suspend(() => Effect.annotateCurrentSpan("retry.attempt_count", attempts)),
+      ),
     );
-  });
+  }).pipe(Effect.withSpan("HealthCheck.waitShadowReady"));
 }
diff --git a/apps/cli/src/command-internal/db-bootstrap/health-check.unit.test.ts b/apps/cli/src/command-internal/db-bootstrap/health-check.unit.test.ts
index 8c0a2cda72..2e45bbcc4f 100644
--- a/apps/cli/src/command-internal/db-bootstrap/health-check.unit.test.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/health-check.unit.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "@effect/vitest";
-import { Deferred, Effect, Exit, Fiber, Layer, Sink, Stream } from "effect";
+import { Deferred, Effect, Exit, Fiber, Layer, Sink, Stream, Tracer } from "effect";
 import * as PlatformError from "effect/PlatformError";
 import { ChildProcessSpawner } from "effect/unstable/process";
 import * as HttpClient from "effect/unstable/http/HttpClient";
@@ -656,6 +656,36 @@ describe("waitForHealthyServices", () => {
         ]);
       }),
     );
+
+    it.effect("records the probe count on the wait span instead of a span per HTTP probe", () =>
+      Effect.gen(function* () {
+        const spans: Array<Tracer.NativeSpan> = [];
+        const tracer = Tracer.make({
+          span: (options) => {
+            const span = new Tracer.NativeSpan(options);
+            spans.push(span);
+            return span;
+          },
+        });
+        const mock = mockHealthSpawner(() => runningHealthy);
+
+        const fiber = yield* waitForHealthyServices(mock.spawner, ["supabase_rest_proj"], {
+          timeoutSeconds: 1,
+          postgrest: postgrestGateway("sb_secret_local"),
+        }).pipe(
+          Effect.provide(httpLayer(503, () => {})),
+          Effect.withTracer(tracer),
+          Effect.withTracerEnabled(true),
+          Effect.forkChild({ startImmediately: true }),
+        );
+        yield* TestClock.adjust("1 seconds");
+        yield* Fiber.await(fiber);
+
+        const wait = spans.find((span) => span.name === "HealthCheck.waitHealthyServices");
+        expect(spans.map((span) => span.name)).not.toContain("http.client HEAD");
+        expect(wait?.attributes.get("retry.attempt_count")).toBe(2);
+      }),
+    );
   });
 
   describe("Edge Runtime HTTP-HEAD readiness", () => {
diff --git a/apps/cli/src/command-internal/db-bootstrap/image-prepull.ts b/apps/cli/src/command-internal/db-bootstrap/image-prepull.ts
index 54480f63d3..2aabd6536d 100644
--- a/apps/cli/src/command-internal/db-bootstrap/image-prepull.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/image-prepull.ts
@@ -56,7 +56,12 @@ export function ensureImagesCached(
 
   return Effect.gen(function* () {
     const results = yield* Effect.all(
-      uniqueImages.map((image) => resolveImage(image).pipe(Effect.result)),
+      uniqueImages.map((image) =>
+        resolveImage(image).pipe(
+          Effect.result,
+          Effect.withSpan("ImagePrepull.resolveImage", { attributes: { "image.name": image } }),
+        ),
+      ),
       { concurrency: "unbounded" },
     );
 
@@ -86,6 +91,7 @@ export function ensureImagesCached(
       resolved.set(image, result.success);
     }
 
+    yield* Effect.annotateCurrentSpan("image.failed_count", failures.length);
     if (failures.length > 0) {
       // The install hint is appended once after every resolve finishes, rather than emitted
       // from inside the resolver, to avoid duplicate hints from concurrent failures.
@@ -99,5 +105,9 @@ export function ensureImagesCached(
     }
 
     return resolved;
-  });
+  }).pipe(
+    Effect.withSpan("ImagePrepull.ensureImagesCached", {
+      attributes: { "image.count": uniqueImages.length },
+    }),
+  );
 }
diff --git a/apps/cli/src/command-internal/db-bootstrap/local-container-inputs.ts b/apps/cli/src/command-internal/db-bootstrap/local-container-inputs.ts
index 185b34966f..ce589339a3 100644
--- a/apps/cli/src/command-internal/db-bootstrap/local-container-inputs.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/local-container-inputs.ts
@@ -253,4 +253,8 @@ export const buildLocalDbContainerInputs = (
       experimental,
       setup,
     };
-  });
+  }).pipe(
+    Effect.withSpan("DbBootstrap.buildLocalDbContainerInputs", {
+      attributes: { "config.preloaded": preloadedContext !== undefined },
+    }),
+  );
diff --git a/apps/cli/src/command-internal/db-bootstrap/local-db-running.ts b/apps/cli/src/command-internal/db-bootstrap/local-db-running.ts
index 4fa01f37a2..bc873b6c43 100644
--- a/apps/cli/src/command-internal/db-bootstrap/local-db-running.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/local-db-running.ts
@@ -340,6 +340,10 @@ export function isLocalDbRunning(
       // Engine probe first; `Option.none()` falls through to the CLI spawn below.
       const engine = yield* LocalDockerEngine;
       const engineAnswer = yield* engine.containerExists(containerId);
+      yield* Effect.annotateCurrentSpan(
+        "probe.method",
+        Option.isSome(engineAnswer) ? "engine" : "cli",
+      );
       if (Option.isSome(engineAnswer)) return engineAnswer.value;
       // Discard stdout (the inspect JSON) so the unconsumed pipe can never
       // deadlock; only the exit code + stderr matter.
@@ -388,5 +392,5 @@ export function isLocalDbRunning(
       }
       return false;
     }),
-  );
+  ).pipe(Effect.withSpan("LocalDb.isRunning"));
 }
diff --git a/apps/cli/src/command-internal/db-bootstrap/messages.ts b/apps/cli/src/command-internal/db-bootstrap/messages.ts
deleted file mode 100644
index 5da0dc466e..0000000000
--- a/apps/cli/src/command-internal/db-bootstrap/messages.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-/**
- * Stderr progress messages for the Postgres container bootstrap, shared by `supabase start` and
- * `db start`.
- */
-
-/** Printed when no existing volume is found (a brand-new, first-ever start). */
-export const START_STARTING_DATABASE_MESSAGE = "Starting database...\n";
-
-/**
- * Printed instead of {@link START_STARTING_DATABASE_MESSAGE} when an existing volume is reused.
- * Despite the wording, this is unrelated to the `--from-backup` flag; it only reflects that the
- * volume already exists.
- */
-export const START_STARTING_DATABASE_FROM_BACKUP_MESSAGE = "Starting database from backup...\n";
diff --git a/apps/cli/src/command-internal/db-bootstrap/messages.unit.test.ts b/apps/cli/src/command-internal/db-bootstrap/messages.unit.test.ts
deleted file mode 100644
index aa51b12eef..0000000000
--- a/apps/cli/src/command-internal/db-bootstrap/messages.unit.test.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import {
-  START_STARTING_DATABASE_FROM_BACKUP_MESSAGE,
-  START_STARTING_DATABASE_MESSAGE,
-} from "./messages.ts";
-
-describe("START_STARTING_DATABASE_MESSAGE", () => {
-  it("matches Go's exact stderr line, with a single trailing newline", () => {
-    expect(START_STARTING_DATABASE_MESSAGE).toBe("Starting database...\n");
-  });
-});
-
-describe("START_STARTING_DATABASE_FROM_BACKUP_MESSAGE", () => {
-  it("matches Go's exact stderr line, with a single trailing newline", () => {
-    expect(START_STARTING_DATABASE_FROM_BACKUP_MESSAGE).toBe("Starting database from backup...\n");
-  });
-});
diff --git a/apps/cli/src/command-internal/db-bootstrap/pgdata-snapshot.ts b/apps/cli/src/command-internal/db-bootstrap/pgdata-snapshot.ts
index 4cf3f85a21..8bf6d9d4b0 100644
--- a/apps/cli/src/command-internal/db-bootstrap/pgdata-snapshot.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/pgdata-snapshot.ts
@@ -202,7 +202,10 @@ export const exportPgDataTar = (
           pgDataSnapshotUnavailable(`failed to publish ${tarPath}: ${cause.message}`),
         ),
       );
-  }).pipe(Effect.onError(() => fs.remove(tempPath).pipe(Effect.orElseSucceed(() => undefined))));
+  }).pipe(
+    Effect.onError(() => fs.remove(tempPath).pipe(Effect.orElseSucceed(() => undefined))),
+    Effect.withSpan("PgDataSnapshot.export"),
+  );
 };
 
 /** POSIX tar's fixed block size: headers, file content, and the end marker are all multiples of it. */
@@ -507,6 +510,13 @@ export const validatePgDataArchive = (
     Effect.mapError((cause) =>
       pgDataSnapshotUnavailable(`failed to read ${tarPath}: ${cause.message}`),
     ),
+    Effect.tap((problem) =>
+      Effect.annotateCurrentSpan(
+        "snapshot.problem",
+        Option.isSome(problem) ? problem.value._tag : "none",
+      ),
+    ),
+    Effect.withSpan("PgDataSnapshot.validate"),
   );
 
 /** {@link validatePgDataArchive}'s verdict, split out so it is pure and directly testable. */
diff --git a/apps/cli/src/command-internal/db-bootstrap/recreate-local-database.ts b/apps/cli/src/command-internal/db-bootstrap/recreate-local-database.ts
index 2be34aba41..148166dbeb 100644
--- a/apps/cli/src/command-internal/db-bootstrap/recreate-local-database.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/recreate-local-database.ts
@@ -143,7 +143,9 @@ const PG_INVALID_CATALOG_NAME = "3D000";
  * Disables new connections to `postgres`/`_supabase`, terminates existing backends, then waits
  * for WAL senders to drop their replication slots (1-second backoff, 10 retries max).
  */
-export const resetDisconnectClients = Effect.fnUntraced(function* (session: DbSession) {
+export const resetDisconnectClients = Effect.fn("DbBootstrap.disconnectClients")(function* (
+  session: DbSession,
+) {
   // Must run sequentially, unwrapped: looping these in a transaction is unsupported, and
   // Effect's short-circuit-on-failure stops at the first bad statement.
   const disconnectResult = yield* Effect.forEach(
@@ -197,11 +199,19 @@ export const resetDisconnectClients = Effect.fnUntraced(function* (session: DbSe
           : Effect.void;
       }),
     );
-  yield* countReplicationSlots.pipe(
+  let slotChecks = 0;
+  yield* Effect.suspend(() => {
+    slotChecks += 1;
+    return countReplicationSlots;
+  }).pipe(
+    Effect.withTracerEnabled(false),
     Effect.retry({
       schedule: Schedule.max([Schedule.spaced("1 seconds"), Schedule.recurs(10)]),
       while: (error) => error.retryable,
     }),
+    Effect.ensuring(
+      Effect.suspend(() => Effect.annotateCurrentSpan("retry.attempt_count", slotChecks)),
+    ),
   );
 });
 
@@ -221,7 +231,9 @@ const RESET_RECREATE_DATABASES_STATEMENTS = [
  * statements. Roles are not dropped here since they are cluster-level entities — use stop then
  * start instead.
  */
-const resetRecreateDatabases = Effect.fnUntraced(function* (session: DbSession) {
+const resetRecreateDatabases = Effect.fn("DbBootstrap.recreateDatabases")(function* (
+  session: DbSession,
+) {
   yield* resetDisconnectClients(session);
   for (const [index, statement] of RESET_RECREATE_DATABASES_STATEMENTS.entries()) {
     yield* session.exec(statement).pipe(
@@ -361,7 +373,7 @@ const recreateLocalDatabase14 = <E>(
         yield* applyApiPrivileges(session, fs, path, tmpDir, toml.baseline.apiAutoExposeNewTables);
         yield* applyDatabaseWebhooks(session, fs, path, tmpDir, toml.webhooksEnabled);
       }),
-    );
+    ).pipe(Effect.withSpan("DbBootstrap.initSchema14"));
 
     // "Restarting containers..." first, then an actual restart of the `db` container itself
     // (pg_cron must restart after `pg_terminate_backend`); not tolerant of "not found", unlike
@@ -407,6 +419,11 @@ export const recreateLocalDatabase = <E>(
   | FileSystem.FileSystem
   | Path.Path
 > =>
-  input.setup.majorVersion <= 14
+  (input.setup.majorVersion <= 14
     ? recreateLocalDatabase14(spawner, input)
-    : recreateLocalDatabase15(spawner, input);
+    : recreateLocalDatabase15(spawner, input)
+  ).pipe(
+    Effect.withSpan("DbBootstrap.recreateLocalDatabase", {
+      attributes: { "db.major_version": input.setup.majorVersion },
+    }),
+  );
diff --git a/apps/cli/src/command-internal/db-bootstrap/reset-local-database.ts b/apps/cli/src/command-internal/db-bootstrap/reset-local-database.ts
index 2cb21499ce..cb61d07cf2 100644
--- a/apps/cli/src/command-internal/db-bootstrap/reset-local-database.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/reset-local-database.ts
@@ -118,6 +118,7 @@ export const resetLocalDatabase = Effect.fn("DbBootstrap.resetLocalDatabase")(fu
 
   // Abort on a bad config before wiping the local database.
   yield* checkDbToml(fs, path, workdir);
+  yield* Effect.annotateCurrentSpan("stack.backend", backend.kind);
 
   if (backend.kind === "stack") {
     const opened = yield* stackOpenReadyProject;
@@ -156,18 +157,20 @@ export const resetLocalDatabase = Effect.fn("DbBootstrap.resetLocalDatabase")(fu
         )
       : catalogDatabaseServices(members);
     yield* output.raw(`Resetting local database${toLogMessage(input.version)}\n`, "stderr");
-    yield* opened.value.stack.composition.stop.pipe(
-      Effect.mapError((cause) => resetFailed(`failed to stop local stack: ${cause.message}`)),
-    );
-    yield* opened.value.database.resetData.pipe(
-      Effect.mapError((cause) => resetFailed(`failed to reset local database: ${cause.message}`)),
-    );
-    yield* opened.value.database.start.pipe(
-      Effect.mapError((cause) => resetFailed(`failed to start local database: ${cause.message}`)),
-    );
-    yield* opened.value.database.ready.pipe(
-      Effect.mapError((cause) => resetFailed(`failed to ready local database: ${cause.message}`)),
-    );
+    yield* Effect.gen(function* () {
+      yield* opened.value.stack.composition.stop.pipe(
+        Effect.mapError((cause) => resetFailed(`failed to stop local stack: ${cause.message}`)),
+      );
+      yield* opened.value.database.resetData.pipe(
+        Effect.mapError((cause) => resetFailed(`failed to reset local database: ${cause.message}`)),
+      );
+      yield* opened.value.database.start.pipe(
+        Effect.mapError((cause) => resetFailed(`failed to start local database: ${cause.message}`)),
+      );
+      yield* opened.value.database.ready.pipe(
+        Effect.mapError((cause) => resetFailed(`failed to ready local database: ${cause.message}`)),
+      );
+    }).pipe(Effect.withSpan("DbBootstrap.resetStackDatabase"));
     yield* initializeStackDatabase({
       target: {
         stack: opened.value.stack,
@@ -237,7 +240,10 @@ export const resetLocalDatabase = Effect.fn("DbBootstrap.resetLocalDatabase")(fu
         projectEnvValues: projectEnv,
         workdir,
       });
-    }).pipe(Effect.catch((error) => skipSeeding(error.message, suggestionOf(error))));
+    }).pipe(
+      Effect.catch((error) => skipSeeding(error.message, suggestionOf(error))),
+      Effect.withSpan("DbBootstrap.seedStorageBuckets"),
+    );
     const branch = yield* detectGitBranch(workdir);
     yield* output.raw(
       `Finished ${aqua("supabase db reset")}${branchClause(branch, aqua)}.\n`,
@@ -312,8 +318,10 @@ export const resetLocalDatabase = Effect.fn("DbBootstrap.resetLocalDatabase")(fu
 
   // Seed objects from supabase/buckets when storage is up; summary is suppressed since reset
   // emits its own result. See docs/stack-commands.md#storage-and-bucket-seeding.
-  const storageReady = yield* awaitStorageReady(spawner, projectId);
-  if (storageReady) {
+  yield* Effect.gen(function* () {
+    const storageReady = yield* awaitStorageReady(spawner, projectId);
+    yield* Effect.annotateCurrentSpan("storage.ready", storageReady);
+    if (!storageReady) return;
     // Non-interactive: overwrite/prune confirmations never open a TTY prompt. In text mode
     // each still prints its label and scans one stdin line (bounded) — a parsed y/n answer
     // wins, otherwise its default applies (overwrite → yes, prune → no); machine formats take
@@ -343,7 +351,7 @@ export const resetLocalDatabase = Effect.fn("DbBootstrap.resetLocalDatabase")(fu
         ),
       ),
     );
-  }
+  }).pipe(Effect.withSpan("DbBootstrap.seedStorageBuckets"));
 
   const branch = yield* detectGitBranch(workdir);
   yield* output.raw(
diff --git a/apps/cli/src/command-internal/db-bootstrap/restart-services.ts b/apps/cli/src/command-internal/db-bootstrap/restart-services.ts
index a81619a12b..ef7a370b04 100644
--- a/apps/cli/src/command-internal/db-bootstrap/restart-services.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/restart-services.ts
@@ -123,7 +123,7 @@ function restartSatelliteServices(
     if (failures.length > 0) {
       return yield* Effect.fail(new RestartServicesError({ message: failures.join("\n") }));
     }
-  });
+  }).pipe(Effect.withSpan("RestartServices.restartSatellites"));
 }
 
 /** Gateway-recovery hint, rendered as a `Suggestion:` line by `Output.fail`. */
@@ -217,7 +217,7 @@ function reloadKong(spawner: Spawner, projectId: string): Effect.Effect<void, Ko
         }),
       );
     }
-  });
+  }).pipe(Effect.withSpan("RestartServices.reloadKong"));
 }
 
 /**
@@ -231,5 +231,5 @@ export function restartServicesAndReloadKong(
   return Effect.gen(function* () {
     yield* restartSatelliteServices(spawner, projectId);
     yield* reloadKong(spawner, projectId);
-  });
+  }).pipe(Effect.withSpan("RestartServices.restartAndReloadKong"));
 }
diff --git a/apps/cli/src/command-internal/db-bootstrap/rollback.ts b/apps/cli/src/command-internal/db-bootstrap/rollback.ts
index ecdd260287..dbe0127373 100644
--- a/apps/cli/src/command-internal/db-bootstrap/rollback.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/rollback.ts
@@ -52,5 +52,10 @@ export const rollbackStart = (
         }),
       ),
     );
+    yield* Effect.annotateCurrentSpan("container.removed_count", removedContainers.length);
     yield* cleanupStartSecrets(removedContainers, workdir);
-  });
+  }).pipe(
+    Effect.withSpan("DbBootstrap.rollbackStart", {
+      attributes: { "rollback.delete_volumes": deleteVolumes },
+    }),
+  );
diff --git a/apps/cli/src/command-internal/db-bootstrap/shadow-cache.ts b/apps/cli/src/command-internal/db-bootstrap/shadow-cache.ts
index 7945658358..1ffe855cc4 100644
--- a/apps/cli/src/command-internal/db-bootstrap/shadow-cache.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/shadow-cache.ts
@@ -334,7 +334,7 @@ const resolveShadowCacheKeyInputs = <E>(
         },
       },
     } satisfies ShadowCacheKeyInputs);
-  });
+  }).pipe(Effect.withSpan("ShadowCache.resolveKeyInputs"));
 
 /** Filename prefix shared by every key's snapshot — the handle the retention sweep enumerates by. */
 const SHADOW_BASELINE_TAR_PREFIX = "shadow-baseline-";
@@ -481,12 +481,17 @@ const sweepShadowBaselineRetention = <E>(
       if (mtime === undefined) continue;
       entries.push({ fileName, mtimeMs: mtime.getTime() });
     }
+    const evicted = shadowBaselineTarsToEvict(entries, now, { retainFileName });
+    yield* Effect.annotateCurrentSpan({
+      "cache.entry_count": entries.length,
+      "cache.evicted_count": evicted.length,
+    });
     yield* Effect.forEach(
-      shadowBaselineTarsToEvict(entries, now, { retainFileName }),
+      evicted,
       (fileName) => forgetShadowBaselineTar(input.fs, input.path.join(cacheDir, fileName)),
       { discard: true },
     );
-  });
+  }).pipe(Effect.withSpan("ShadowCache.sweepRetention"));
 
 /** Refresh mtime on a warm hit so frequently used keys survive LRU/TTL. Best-effort. */
 const touchShadowBaselineTar = (fs: FileSystem.FileSystem, tarPath: string): Effect.Effect<void> =>
@@ -637,6 +642,7 @@ const exportShadowBaseline = <E>(
           }),
       ),
     );
+    yield* Effect.annotateCurrentSpan("cache.published", Result.isSuccess(exported));
     if (Result.isFailure(exported)) {
       const output = yield* Output;
       yield* output.raw(
@@ -644,7 +650,7 @@ const exportShadowBaseline = <E>(
         "stderr",
       );
     }
-  });
+  }).pipe(Effect.withSpan("ShadowCache.export"));
 
 export interface ShadowCacheOpts {
   /** `sync --no-cache`: neither restore nor publish, regardless of the env gate. */
@@ -694,12 +700,13 @@ export const peekShadowBaseline = <E>(
       shadowBaselineTarFileName(key),
     );
     const cached = yield* input.fs.exists(tarPath).pipe(Effect.orElseSucceed(() => false));
+    yield* Effect.annotateCurrentSpan("cache.hit", cached);
     return {
       state: cached ? ("warm" as const) : ("cold" as const),
       key,
       keyInputs: keyInputs.value,
     };
-  });
+  }).pipe(Effect.withSpan("ShadowCache.peek"));
 
 /**
  * What `acquireUseRelease`'s `acquire` hands the `use` phase: the container, whether its cluster
@@ -840,7 +847,10 @@ const warmShadow = <E>(
       snapshotRequired: false,
       snapshotBaseline: Effect.void,
     } satisfies ShadowAcquiredHandle;
-  });
+  }).pipe(Effect.withSpan("ShadowCache.restore"));
+
+const annotateCacheState = (state: "disabled" | "ineligible" | "unwritable" | "cold" | "warm") =>
+  Effect.annotateCurrentSpan("cache.state", state);
 
 /**
  * `Effect.acquireUseRelease`'s `acquire` for every shadow that runs the platform baseline (`db
@@ -862,6 +872,7 @@ export const acquireShadowDatabase = <E>(
         whenUnset: true,
       })
     ) {
+      yield* annotateCacheState("disabled");
       return yield* uncachedShadow(spawner, input);
     }
 
@@ -871,7 +882,10 @@ export const acquireShadowDatabase = <E>(
         ? Effect.succeed(Option.some(opts.precomputedKeyInputs))
         : resolveShadowCacheKeyInputs(input, opts),
     );
-    if (Option.isNone(keyInputs)) return yield* uncachedShadow(spawner, input);
+    if (Option.isNone(keyInputs)) {
+      yield* annotateCacheState("ineligible");
+      return yield* uncachedShadow(spawner, input);
+    }
 
     // The cache root must be usable before committing to the cached lifecycle: the cold path
     // drops `--rm` and pays a stop/export/restart cycle that's already doomed if this directory
@@ -890,6 +904,7 @@ export const acquireShadowDatabase = <E>(
         `Warning: shadow baseline cache unavailable (cannot write ${cacheDir}: ${cacheRoot.failure.message}); continuing uncached.\n`,
         "stderr",
       );
+      yield* annotateCacheState("unwritable");
       return yield* uncachedShadow(spawner, input);
     }
 
@@ -897,8 +912,11 @@ export const acquireShadowDatabase = <E>(
     const tarPath = input.path.join(cacheDir, shadowBaselineTarFileName(key));
 
     const cached = yield* input.fs.exists(tarPath).pipe(Effect.orElseSucceed(() => false));
-    if (!cached)
+    if (!cached) {
+      yield* annotateCacheState("cold");
       return yield* coldCachedShadow(spawner, input, key, tarPath, keyInputs.value.rolesSql, true);
+    }
+    yield* annotateCacheState("warm");
 
     // Warm hits refresh mtime and sweep leftovers the cold path would otherwise never see again.
     yield* touchShadowBaselineTar(input.fs, tarPath);
@@ -916,6 +934,10 @@ export const acquireShadowDatabase = <E>(
           // Delete only when the failure implicates the tar's contents — see
           // {@link ShadowCacheUnavailable.tarSuspect}; an infra failure leaves it in place, since
           // the cold fallback's own export republishes over a genuinely bad tar anyway.
+          yield* Effect.annotateCurrentSpan({
+            "cache.state": "warm_fallback",
+            "cache.tar_suspect": cause.tarSuspect === true,
+          });
           if (cause.tarSuspect === true) {
             yield* forgetShadowBaselineTar(input.fs, tarPath);
           }
@@ -930,7 +952,7 @@ export const acquireShadowDatabase = <E>(
         }),
       ),
     );
-  });
+  }).pipe(Effect.withSpan("ShadowCache.acquire"));
 
 /**
  * Acquire/use/release for a platform-baseline shadow. `acquireUseRelease` registers removal in
diff --git a/apps/cli/src/command-internal/db-bootstrap/shadow-database.ts b/apps/cli/src/command-internal/db-bootstrap/shadow-database.ts
index 8ad2daee30..9451314dc1 100644
--- a/apps/cli/src/command-internal/db-bootstrap/shadow-database.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/shadow-database.ts
@@ -143,11 +143,18 @@ export const connectShadowDatabase = (
 ): Effect.Effect<DbSession, ShadowDbError, DbConnection | Scope.Scope> =>
   Effect.gen(function* () {
     const dbConnection = yield* DbConnection;
-    return yield* dbConnection.connect(cfg, { isLocal: true, dnsResolver: "native" }).pipe(
+    let attempts = 0;
+    return yield* Effect.suspend(() => {
+      attempts += 1;
+      return dbConnection.connect(cfg, { isLocal: true, dnsResolver: "native" });
+    }).pipe(
       Effect.mapError((cause) => new ShadowDbError({ message: cause.message, reason: "connect" })),
       Effect.retry({ schedule: SHADOW_CONNECT_SCHEDULE }),
+      Effect.ensuring(
+        Effect.suspend(() => Effect.annotateCurrentSpan("retry.attempt_count", attempts)),
+      ),
     );
-  });
+  }).pipe(Effect.withSpan("ShadowDatabase.connect"));
 
 /**
  * Input to {@link createShadowDatabase} — the subset of the real `db` container's own bootstrap
@@ -237,7 +244,11 @@ export const createShadowDatabase = (
       ),
     );
     return { containerId };
-  });
+  }).pipe(
+    Effect.withSpan("ShadowDatabase.create", {
+      attributes: { "shadow.restore_archive": input.restoreArchive !== undefined },
+    }),
+  );
 
 /**
  * `docker rm -f -v <id>`. Best-effort for the overall operation — a removal failure must never
@@ -600,6 +611,10 @@ export const setupShadowDatabase = <E>(
         ),
       );
     }),
+  ).pipe(
+    Effect.withSpan("ShadowDatabase.setup", {
+      attributes: { "shadow.baseline_state": shadowBaselineStateName(baseline) },
+    }),
   );
 
 /**
@@ -640,6 +655,9 @@ const SHADOW_BASELINE_COLD: ShadowBaselineState = {
   snapshotBaseline: Effect.void,
 };
 
+const shadowBaselineStateName = (baseline: ShadowBaselineState): string =>
+  baseline.baselinePresent ? "warm" : baseline.snapshotRequired ? "cold_snapshot" : "cold";
+
 /**
  * Lists local migrations first, so a bad migrations directory fails before any DB connection,
  * then connects, resolves the setup prelude, and runs the platform baseline before applying
@@ -669,6 +687,7 @@ const migrateShadowDatabaseWith = <E>(
           (cause) => new ShadowDbError({ message: cause.message, reason: "filesystem" }),
         ),
       );
+      yield* Effect.annotateCurrentSpan("migration.count", pending.length);
 
       if (!baseline.baselinePresent && baseline.snapshotRequired) {
         // Own scope: the baseline session must be closed before `snapshotBaseline` — see this
@@ -725,6 +744,10 @@ const migrateShadowDatabaseWith = <E>(
         ),
       );
     }),
+  ).pipe(
+    Effect.withSpan("ShadowDatabase.migrate", {
+      attributes: { "shadow.baseline_state": shadowBaselineStateName(baseline) },
+    }),
   );
 
 /**
diff --git a/apps/cli/src/command-internal/db-bootstrap/start-database.ts b/apps/cli/src/command-internal/db-bootstrap/start-database.ts
index 78adf0bc54..a5f52cca2f 100644
--- a/apps/cli/src/command-internal/db-bootstrap/start-database.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/start-database.ts
@@ -45,15 +45,15 @@ import {
 } from "./db-setup.ts";
 import type { ImagePrepullError } from "./image-prepull.ts";
 import { waitForHealthyServices, type HealthCheckTimeoutError } from "./health-check.ts";
-import {
-  START_STARTING_DATABASE_FROM_BACKUP_MESSAGE,
-  START_STARTING_DATABASE_MESSAGE,
-} from "./messages.ts";
 import {
   buildPostgresStartContainerSpec,
   type PostgresStartServiceInput,
 } from "./postgres.service.ts";
 
+const START_STARTING_DATABASE_MESSAGE = "Starting database...\n";
+// Printed when an existing volume is reused; unrelated to `--from-backup`.
+const START_STARTING_DATABASE_FROM_BACKUP_MESSAGE = "Starting database from backup...\n";
+
 type Spawner = ChildProcessSpawner["Service"];
 
 /**
@@ -142,6 +142,10 @@ export const startDatabase = <E>(
     // guard below is about to reject.
     const isFreshVolume = !(yield* volumeExists(spawner, input.dbContainerId));
     const fromBackup = input.postgresSpec.fromBackup;
+    yield* Effect.annotateCurrentSpan({
+      "db.fresh_volume": isFreshVolume,
+      "db.from_backup": fromBackup !== undefined,
+    });
 
     if (!isFreshVolume && fromBackup !== undefined) {
       // Refused before any container or network is created, and before freshness is published,
@@ -226,4 +230,8 @@ export const startDatabase = <E>(
     // Reached on every path that doesn't already return or fail above: a fresh volume, a
     // non-fresh restart, and a swallowed `fromBackup` health-check timeout.
     yield* startInitCurrentBranch(input.fs, input.path, input.workdir);
-  });
+  }).pipe(
+    Effect.withSpan("DbBootstrap.startDatabase", {
+      attributes: { "db.major_version": input.setup.majorVersion },
+    }),
+  );
diff --git a/apps/cli/src/command-internal/db-bootstrap/start-local-database.ts b/apps/cli/src/command-internal/db-bootstrap/start-local-database.ts
index d1670d8103..db9961f353 100644
--- a/apps/cli/src/command-internal/db-bootstrap/start-local-database.ts
+++ b/apps/cli/src/command-internal/db-bootstrap/start-local-database.ts
@@ -93,7 +93,9 @@ interface StartLocalDatabaseResult {
  * before being passed in; the declarative seam's `ensureLocalDatabaseStarted` always calls with
  * no argument.
  */
-export const startLocalDatabase = Effect.fnUntraced(function* (fromBackupFlag?: string) {
+export const startLocalDatabase = Effect.fn("DbBootstrap.startLocalDatabase")(function* (
+  fromBackupFlag?: string,
+) {
   const output = yield* Output;
   const cliSettings = yield* CommandSettings;
   const fs = yield* FileSystem.FileSystem;
@@ -581,6 +583,7 @@ export const startLocalDatabase = Effect.fnUntraced(function* (fromBackupFlag?:
     cliSettings.workdir,
     Option.getOrUndefined(cliSettings.projectId),
   );
+  yield* Effect.annotateCurrentSpan("db.already_running", running);
   if (running) {
     return { status: "already-running" } satisfies StartLocalDatabaseResult;
   }
diff --git a/apps/cli/src/command-internal/db-config.integration.test.ts b/apps/cli/src/command-internal/db-config.integration.test.ts
index 9e8a09e3ae..1002a2b5d7 100644
--- a/apps/cli/src/command-internal/db-config.integration.test.ts
+++ b/apps/cli/src/command-internal/db-config.integration.test.ts
@@ -465,7 +465,7 @@ describe("dbConfigResolver (db-url under the stack backend)", () => {
         registered: true,
       }),
       followStatus: Stream.empty,
-      logs: Stream.empty,
+      readLogs: () => Stream.empty,
       credentials: () => unused,
       saveSnapshot: () => unused,
       restoreSnapshot: () => unused,
diff --git a/apps/cli/src/command-internal/db-config.layer.ts b/apps/cli/src/command-internal/db-config.layer.ts
index 90f101b602..c4c5ff6f96 100644
--- a/apps/cli/src/command-internal/db-config.layer.ts
+++ b/apps/cli/src/command-internal/db-config.layer.ts
@@ -103,6 +103,8 @@ const tcpReachable = (host: string, port: number): Effect.Effect<boolean> =>
     return Effect.sync(() => socket.destroy());
   }).pipe(
     Effect.timeoutOrElse({ duration: TCP_PROBE_TIMEOUT, orElse: () => Effect.succeed(false) }),
+    Effect.tap((reachable) => Effect.annotateCurrentSpan("network.reachable", reachable)),
+    Effect.withSpan("DbConfig.tcpProbe", { attributes: { "server.port": port } }),
   );
 
 // POST /v1/projects/{ref}/cli/login-role → mint a temporary postgres role. The Management API
@@ -110,7 +112,10 @@ const tcpReachable = (host: string, port: number): Effect.Effect<boolean> =>
 // `CommandPlatformApi` stack), so the access token is resolved only here — when a temp role is
 // actually minted. `--linked --password` returns before reaching this, so it stays auth-free;
 // `--local`/`--db-url` never build this layer at all.
-const initLoginRole = Effect.fnUntraced(function* (ref: string, conn: PgConnInput) {
+const initLoginRole = Effect.fn("DbConfig.initLoginRole")(function* (
+  ref: string,
+  conn: PgConnInput,
+) {
   const output = yield* Output;
   const api = yield* (yield* CommandPlatformApiFactory).make;
   // Written to stderr unconditionally (not gated on --debug).
@@ -133,7 +138,7 @@ const listAndUnban = Effect.fnUntraced(function* (ref: string) {
 
 // Verify-connect with backoff while the pooler refreshes the temp password. On attempt ≥ 3,
 // clear any network ban on the requester.
-const waitForTempRole = Effect.fnUntraced(function* (
+const waitForTempRole = Effect.fn("DbConfig.waitForTempRole")(function* (
   ref: string,
   conn: PgConnInput,
   dnsResolver: "native" | "https",
@@ -144,6 +149,7 @@ const waitForTempRole = Effect.fnUntraced(function* (
     // The temp-role probe always targets the remote Supavisor pooler, so it connects with TLS
     // and honors `--dns-resolver`.
     Effect.scoped(dbConn.connect(conn, { isLocal: false, dnsResolver }).pipe(Effect.asVoid)).pipe(
+      Effect.ensuring(Effect.annotateCurrentSpan("retry.attempt_count", n)),
       Effect.catch((cause) => {
         // 8 retries after the initial attempt allows 9 total attempts. `n` is 1-based, so give
         // up only after attempt 9 (`n > MAX_RETRIES`), not at attempt 8.
@@ -224,7 +230,7 @@ const resolveDbPassword = Effect.fnUntraced(function* (
  *
  * `workdir`/`poolerHost` are explicit parameters (see {@link resolveDbPassword}).
  */
-const resolvePoolerConn = Effect.fnUntraced(function* (
+const resolvePoolerConn = Effect.fn("DbConfig.resolvePoolerConn")(function* (
   ref: string,
   workdir: string,
   poolerHost: string,
@@ -306,7 +312,7 @@ const resolvePoolerConn = Effect.fnUntraced(function* (
  * `DbConfigResolver`/`ProjectRefResolver` (both keyed off the ambient, potentially-stale
  * `CommandSettings.workdir`).
  */
-export const resolveLinkedConn = Effect.fnUntraced(function* (
+export const resolveLinkedConn = Effect.fn("DbConfig.resolveLinkedConn")(function* (
   ref: string,
   workdir: string,
   projectHost: string,
@@ -352,6 +358,7 @@ export const resolveLinkedConn = Effect.fnUntraced(function* (
   };
 
   const reachable = yield* tcpReachable(host, DIRECT_PORT);
+  yield* Effect.annotateCurrentSpan("db.direct_reachable", reachable);
   if (reachable) {
     if (base.password.length > 0) {
       yield* debug.debug("Using database password from env var...");
@@ -669,9 +676,23 @@ export const dbConfigResolverLayer = Layer.effect(
     });
     return DbConfigResolver.of({
       resolve: (flags) =>
-        resolve(flags).pipe(Effect.map((r) => ({ ...r, conn: withSuggestion(r.conn) }))),
+        resolve(flags).pipe(
+          Effect.tap((r) => Effect.annotateCurrentSpan("db.is_local", r.isLocal)),
+          Effect.map((r) => ({ ...r, conn: withSuggestion(r.conn) })),
+          Effect.withSpan("DbConfig.resolve", {
+            attributes: { "db.conn_type": flags.connType ?? "local" },
+          }),
+        ),
       resolvePoolerFallback: (flags) =>
-        resolvePoolerFallback(flags).pipe(Effect.map(Option.map(withSuggestion))),
+        resolvePoolerFallback(flags).pipe(
+          Effect.tap((pooler) =>
+            Effect.annotateCurrentSpan("db.pooler.found", Option.isSome(pooler)),
+          ),
+          Effect.map(Option.map(withSuggestion)),
+          Effect.withSpan("DbConfig.resolvePoolerFallback", {
+            attributes: { "db.conn_type": flags.connType ?? "local" },
+          }),
+        ),
     });
   }),
 );
diff --git a/apps/cli/src/command-internal/db-config.toml-read.ts b/apps/cli/src/command-internal/db-config.toml-read.ts
index c92052d930..60bcd879d9 100644
--- a/apps/cli/src/command-internal/db-config.toml-read.ts
+++ b/apps/cli/src/command-internal/db-config.toml-read.ts
@@ -23,6 +23,7 @@ import {
   validateResolvedConfig,
 } from "./config-validate.ts";
 import { DbConfigLoadError } from "./db-config.errors.ts";
+import { recordOrioleDbTelemetry, selectsOrioleDb } from "./db-image.ts";
 import { parseDotEnv } from "./dotenv.ts";
 import { strToArr } from "./local-config-values.ts";
 import { ramInBytes } from "./size-units.ts";
@@ -1283,7 +1284,11 @@ const readDbTomlCore = Effect.fnUntraced(function* (
     (remoteWins("db.orioledb_version") ? undefined : envOverride("SUPABASE_DB_ORIOLEDB_VERSION")) ??
     db?.["orioledb_version"];
   const orioledbVersion = expandString(orioledbVersionRaw);
-  if (Option.isSome(orioledbVersion) && (majorVersion === 15 || majorVersion === 17)) {
+  // The defaults-only fallback says nothing about the project's engine.
+  if (!ignoreConfigFile) {
+    yield* recordOrioleDbTelemetry(Option.getOrUndefined(orioledbVersion), majorVersion);
+  }
+  if (selectsOrioleDb(Option.getOrUndefined(orioledbVersion), majorVersion)) {
     // Warns (does not fail) when an S3 field still holds an unexpanded `env(VAR)`;
     // matches the established stderr line, with the env var name from the capture.
     const s3Fields = ["s3_host", "s3_region", "s3_access_key", "s3_secret_key"] as const;
diff --git a/apps/cli/src/command-internal/db-config.toml-read.unit.test.ts b/apps/cli/src/command-internal/db-config.toml-read.unit.test.ts
index ffa3a140d3..37e65f0246 100644
--- a/apps/cli/src/command-internal/db-config.toml-read.unit.test.ts
+++ b/apps/cli/src/command-internal/db-config.toml-read.unit.test.ts
@@ -3,7 +3,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { BunPath, BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
-import { ConfigProvider, Effect, Exit, FileSystem, Option, Path } from "effect";
+import { ConfigProvider, Effect, Exit, FileSystem, Option, Path, Ref } from "effect";
 
 import {
   checkDbToml,
@@ -12,6 +12,10 @@ import {
   resolveDeclarativeDir,
   resolveSeedSqlPath,
 } from "./db-config.toml-read.ts";
+import {
+  CommandTelemetryAttributes,
+  type CommandTelemetryAttributeValues,
+} from "../telemetry/command-telemetry-attributes.ts";
 
 function withConfig(content: string | undefined, poolerUrl?: string) {
   const dir = mkdtempSync(join(tmpdir(), "db-toml-"));
@@ -3408,3 +3412,42 @@ describe("readDbToml remoteOverrideKeys — auth.captcha.provider / auth.email.t
     },
   );
 });
+
+describe("readDbToml OrioleDB telemetry", () => {
+  const recordedAfterRead = (workdir: string) =>
+    Effect.gen(function* () {
+      const recorded = yield* Ref.make<CommandTelemetryAttributeValues>({});
+      yield* read(workdir).pipe(
+        Effect.provideService(CommandTelemetryAttributes, {
+          record: (values) => Ref.update(recorded, (current) => ({ ...current, ...values })),
+        }),
+      );
+      return yield* Ref.get(recorded);
+    });
+
+  it.effect.each([
+    {
+      name: "a configured version on 17",
+      toml: 'major_version = 17\norioledb_version = "17.0.0.1"',
+      env: undefined,
+      expected: true,
+    },
+    { name: "the env override", toml: "major_version = 15", env: "15.1.1.14", expected: true },
+    { name: "no version", toml: "major_version = 17", env: undefined, expected: false },
+  ])("records orioledb=$expected for $name", ({ toml, env, expected }) => {
+    const dir = withConfig(`[db]\n${toml}\n`);
+    const previous = process.env["SUPABASE_DB_ORIOLEDB_VERSION"];
+    if (env === undefined) delete process.env["SUPABASE_DB_ORIOLEDB_VERSION"];
+    else process.env["SUPABASE_DB_ORIOLEDB_VERSION"] = env;
+    return recordedAfterRead(dir).pipe(
+      Effect.tap((recorded) => Effect.sync(() => expect(recorded.orioledb).toBe(expected))),
+      Effect.ensuring(
+        Effect.sync(() => {
+          if (previous === undefined) delete process.env["SUPABASE_DB_ORIOLEDB_VERSION"];
+          else process.env["SUPABASE_DB_ORIOLEDB_VERSION"] = previous;
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+});
diff --git a/apps/cli/src/command-internal/db-connection.layer.ts b/apps/cli/src/command-internal/db-connection.layer.ts
deleted file mode 100644
index f75cf737a4..0000000000
--- a/apps/cli/src/command-internal/db-connection.layer.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-import { dbConnectionSqlPgLayer } from "./db-connection.sql-pg.layer.ts";
-
-/**
- * The active `DbConnection` layer. Re-exports the `@effect/sql-pg` layer; call sites import this
- * name, not the driver, so swapping the implementation is a one-line change here.
- */
-export const dbConnectionLayer = dbConnectionSqlPgLayer;
diff --git a/apps/cli/src/command-internal/db-connection.sql-pg.integration.test.ts b/apps/cli/src/command-internal/db-connection.sql-pg.integration.test.ts
index 06dc217ffc..721ff27bc7 100644
--- a/apps/cli/src/command-internal/db-connection.sql-pg.integration.test.ts
+++ b/apps/cli/src/command-internal/db-connection.sql-pg.integration.test.ts
@@ -11,11 +11,7 @@ import { Duration, Effect } from "effect";
 import { SUGGEST_ENV_VAR, SUGGEST_LOCAL_STACK } from "./connect-errors.ts";
 import type { DbConnectError, DbExecError } from "./db-connection.errors.ts";
 import { type DbSession, type PgConnInput, DbConnection } from "./db-connection.service.ts";
-import {
-  acquirePgPool,
-  dbConnectionSqlPgLayer,
-  PgBatchQuery,
-} from "./db-connection.sql-pg.layer.ts";
+import { acquirePgPool, dbConnectionLayer, PgBatchQuery } from "./db-connection.sql-pg.layer.ts";
 
 const SUGGESTION_CONTEXT = {
   dashboardUrl: "https://supabase.com/dashboard",
@@ -55,7 +51,7 @@ const connectFailure = (
         Effect.mapError(() => new Error("expected the connection to fail")),
         Effect.orDie,
       );
-  }).pipe(Effect.provide(dbConnectionSqlPgLayer));
+  }).pipe(Effect.provide(dbConnectionLayer));
 
 /** A TCP port that is guaranteed closed: bind an ephemeral port, then release it. */
 const acquireClosedPort = (): Promise<number> =>
@@ -403,7 +399,7 @@ const fakeQueryServer = (
     });
   });
 
-describe("dbConnectionSqlPgLayer connect failures", () => {
+describe("dbConnectionLayer connect failures", () => {
   it.live(
     "surfaces host, user, database, and the driver cause when a remote (--linked) connection is refused",
     () =>
@@ -487,7 +483,7 @@ describe("dbConnectionSqlPgLayer connect failures", () => {
   );
 });
 
-describe("dbConnectionSqlPgLayer exec failures", () => {
+describe("dbConnectionLayer exec failures", () => {
   it.live(
     "maps a real wire ErrorResponse to pgconn's PgError rendering with detail and position",
     () =>
@@ -540,7 +536,7 @@ describe("dbConnectionSqlPgLayer exec failures", () => {
               Effect.mapError(() => new Error("expected the statement to fail")),
               Effect.orDie,
             );
-        }).pipe(Effect.provide(dbConnectionSqlPgLayer), Effect.ensuring(Effect.sync(server.close)));
+        }).pipe(Effect.provide(dbConnectionLayer), Effect.ensuring(Effect.sync(server.close)));
         expect(error._tag).toBe("DbExecError");
         expect(error.message).toBe('FEHLER: type "ltree" does not exist (SQLSTATE 42704)');
         if (error._tag === "DbExecError") {
@@ -552,7 +548,7 @@ describe("dbConnectionSqlPgLayer exec failures", () => {
   );
 });
 
-describe("dbConnectionSqlPgLayer extended batches", () => {
+describe("dbConnectionLayer extended batches", () => {
   /**
    * Narrow a batch failure to its statement-execution error. `execBatch` also fails
    * with `DbConnectError` when it cannot check a connection out of the pool,
@@ -584,7 +580,7 @@ describe("dbConnectionSqlPgLayer extended batches", () => {
       return yield* use(session);
     }).pipe(
       Effect.scoped,
-      Effect.provide(dbConnectionSqlPgLayer),
+      Effect.provide(dbConnectionLayer),
       Effect.ensuring(Effect.sync(server.close)),
     );
 
diff --git a/apps/cli/src/command-internal/db-connection.sql-pg.layer.ts b/apps/cli/src/command-internal/db-connection.sql-pg.layer.ts
index 72de3279e2..e8d99fea43 100644
--- a/apps/cli/src/command-internal/db-connection.sql-pg.layer.ts
+++ b/apps/cli/src/command-internal/db-connection.sql-pg.layer.ts
@@ -1054,4 +1054,5 @@ const connect = (
     return session;
   });
 
-export const dbConnectionSqlPgLayer = Layer.succeed(DbConnection, { connect });
+/** The active `DbConnection` layer, backed by `@effect/sql-pg`. */
+export const dbConnectionLayer = Layer.succeed(DbConnection, { connect });
diff --git a/apps/cli/src/command-internal/db-image.ts b/apps/cli/src/command-internal/db-image.ts
index a154f4aab2..8db35f7ded 100644
--- a/apps/cli/src/command-internal/db-image.ts
+++ b/apps/cli/src/command-internal/db-image.ts
@@ -2,6 +2,8 @@ import { Effect, type FileSystem, type Path } from "effect";
 import { dockerfileServiceImageRaw } from "../shared/services/dockerfile-images.ts";
 import { postgresImageForDbMajorVersion } from "../shared/services/services.shared.ts";
 import { slimImageForCurrentPin, slimImagesEnabled } from "../shared/services/slim-images.ts";
+import { PropOrioleDb } from "../shared/telemetry/event-catalog.ts";
+import { recordCommandTelemetry } from "../telemetry/command-telemetry-attributes.ts";
 
 /**
  * Resolves the local Postgres Docker image for commands that run a pg_dump/shadow-DB container
@@ -48,6 +50,21 @@ function compareSemver(a: string, b: string): number {
   return 0;
 }
 
+/** OrioleDB replaces the Postgres image only on 15/17 projects with a version set. */
+export const selectsOrioleDb = (
+  orioledbVersion: string | undefined,
+  majorVersion: number,
+): orioledbVersion is string =>
+  orioledbVersion !== undefined &&
+  orioledbVersion.length > 0 &&
+  (majorVersion === 15 || majorVersion === 17);
+
+/** Records whether the local project selects OrioleDB on the enclosing command event. */
+export const recordOrioleDbTelemetry = (
+  orioledbVersion: string | undefined,
+  majorVersion: number,
+) => recordCommandTelemetry({ [PropOrioleDb]: selectsOrioleDb(orioledbVersion, majorVersion) });
+
 /**
  * Resolves the Postgres image for `majorVersion`, honoring the pinned version written by
  * `supabase start` to `supabase/.temp/postgres-version`. The tag is only replaced when the
@@ -60,13 +77,9 @@ export const resolveDbImage = Effect.fnUntraced(function* (
   majorVersion: number,
   orioledbVersion?: string,
 ) {
-  // OrioleDB override: on a 15/17 project with `db.orioledb_version` set, the Postgres image is
-  // replaced with the OrioleDB tag, taking precedence over the default/pinned image.
-  if (
-    orioledbVersion !== undefined &&
-    orioledbVersion.length > 0 &&
-    (majorVersion === 15 || majorVersion === 17)
-  ) {
+  yield* recordOrioleDbTelemetry(orioledbVersion, majorVersion);
+  // The OrioleDB tag takes precedence over the default/pinned image.
+  if (selectsOrioleDb(orioledbVersion, majorVersion)) {
     const image =
       versionCompare(orioledbVersion, "15.1.1.13") > 0
         ? `supabase/postgres:${orioledbVersion}-orioledb`
diff --git a/apps/cli/src/command-internal/db-pull-run.ts b/apps/cli/src/command-internal/db-pull-run.ts
index 455a000c2e..caf4e0ced2 100644
--- a/apps/cli/src/command-internal/db-pull-run.ts
+++ b/apps/cli/src/command-internal/db-pull-run.ts
@@ -235,6 +235,10 @@ export const runDbPull = Effect.fn("db.pull.run")(function* (
       : Option.isSome(flags.local)
         ? "local"
         : "linked";
+    yield* Effect.annotateCurrentSpan({
+      "db.conn_type": connType,
+      "db.pull.mode": useDeclarativeExport ? "declarative" : "migration",
+    });
 
     // `--project-ref` never implies `--linked` and must not be silently
     // discarded on a non-linked target — see push.handler.ts's identical guard
@@ -375,6 +379,7 @@ export const runDbPull = Effect.fn("db.pull.run")(function* (
     if (Option.getOrElse(flags.diffEngine, () => "pg-delta") === "migra") {
       yield* stackRejectNativeDockerDiffEngine("--diff-engine migra");
     }
+    const diffEngine = usePgDeltaDiff ? "pg-delta" : "migra";
 
     // Connectivity check, run before dialing.
     return yield* Effect.scoped(
@@ -407,6 +412,9 @@ export const runDbPull = Effect.fn("db.pull.run")(function* (
             });
           const exported = yield* withPoolerFallback(targetEndpoint, (target) =>
             exportSchema(target),
+          ).pipe(
+            Effect.tap((result) => Effect.annotateCurrentSpan("file.count", result.files.length)),
+            Effect.withSpan("db.pull.exportDeclarative"),
           );
           const written = yield* writeDeclarativeSchemas(fs, path, declarativeDir, exported).pipe(
             Effect.mapError((cause) => new DbPullWriteError({ message: cause.message })),
@@ -554,6 +562,7 @@ export const runDbPull = Effect.fn("db.pull.run")(function* (
                     }),
                   ),
                 ),
+                Effect.withSpan("db.pull.dumpSchema"),
               );
           };
           // Prints this once, before the pooler-fallback retry.
@@ -687,7 +696,15 @@ export const runDbPull = Effect.fn("db.pull.run")(function* (
                   { webhooks: migrationMode === "pgdelta-next" ? "config" : "enabled" },
                 );
           });
-        const diffOutcome = yield* withPoolerFallback(targetEndpoint, runShadowDiff);
+        const diffOutcome = yield* withPoolerFallback(targetEndpoint, runShadowDiff).pipe(
+          Effect.tap((outcome) =>
+            Effect.annotateCurrentSpan({
+              "diff.empty": outcome.sql.trim().length === 0,
+              "migration.count": outcome.files?.length ?? (outcome.sql.trim().length === 0 ? 0 : 1),
+            }),
+          ),
+          Effect.withSpan("db.pull.plan", { attributes: { "db.pull.engine": diffEngine } }),
+        );
 
         const out = diffOutcome.sql;
         const diffEmpty = out.trim().length === 0;
@@ -840,7 +857,7 @@ export const runDbPull = Effect.fn("db.pull.run")(function* (
           // string field from its first entry.
           schemaFiles: writtenMigrations.map((written) => written.path),
           remoteHistoryUpdated,
-          engine: usePgDeltaDiff ? "pg-delta" : "migra",
+          engine: diffEngine,
         } as const;
       }),
     );
diff --git a/apps/cli/src/command-internal/db-push-core.ts b/apps/cli/src/command-internal/db-push-core.ts
index 70cdba0d80..68c7029e77 100644
--- a/apps/cli/src/command-internal/db-push-core.ts
+++ b/apps/cli/src/command-internal/db-push-core.ts
@@ -84,7 +84,7 @@ export interface DbPushCoreInput {
   readonly emitStructuredResult: boolean;
 }
 
-export const dbPushCore = Effect.fnUntraced(function* (input: DbPushCoreInput) {
+export const dbPushCore = Effect.fn("DbPush.run")(function* (input: DbPushCoreInput) {
   const output = yield* Output;
   const dbConn = yield* DbConnection;
   const fs = yield* FileSystem.FileSystem;
@@ -184,6 +184,14 @@ export const dbPushCore = Effect.fnUntraced(function* (input: DbPushCoreInput) {
         if (exists) globals.push(CUSTOM_ROLES_PATH);
       }
 
+      yield* Effect.annotateCurrentSpan({
+        "db.is_local": isLocal,
+        "db.push.dry_run": dryRun,
+        "migration.count": pending.length,
+        "seed.count": seeds.length,
+        "role_file.count": globals.length,
+      });
+
       if (pending.length === 0 && seeds.length === 0 && globals.length === 0) {
         if (output.format === "text") {
           yield* output.raw(`${statusTarget} is up to date.\n`);
diff --git a/apps/cli/src/command-internal/db-target-flags.ts b/apps/cli/src/command-internal/db-target-flags.ts
index 59a2a106ed..035d2546fe 100644
--- a/apps/cli/src/command-internal/db-target-flags.ts
+++ b/apps/cli/src/command-internal/db-target-flags.ts
@@ -139,6 +139,7 @@ export const VALUE_CONSUMING_LONG_FLAGS = new Set([
   // experimental stack flags
   "capability",
   "service",
+  "since",
   "stack",
   "stack-id",
   "preparation",
diff --git a/apps/cli/src/command-internal/db-target-flags.unit.test.ts b/apps/cli/src/command-internal/db-target-flags.unit.test.ts
index 84c576779d..bc7f841570 100644
--- a/apps/cli/src/command-internal/db-target-flags.unit.test.ts
+++ b/apps/cli/src/command-internal/db-target-flags.unit.test.ts
@@ -3,6 +3,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { describe, expect, it } from "vitest";
 import {
+  changedLinkedLocalFlags,
   resolveDbTargetFlags,
   VALUE_CONSUMING_LONG_FLAGS,
   VALUE_CONSUMING_SHORT_FLAGS,
@@ -258,3 +259,65 @@ describe("VALUE_CONSUMING_LONG_FLAGS / VALUE_CONSUMING_SHORT_FLAGS completeness
     expect(missing).toEqual([]);
   });
 });
+
+describe("changedLinkedLocalFlags", () => {
+  it("returns nothing when neither selector is present", () => {
+    expect(changedLinkedLocalFlags(["seed", "buckets"])).toEqual([]);
+    expect(changedLinkedLocalFlags(["storage", "ls", "ss:///"])).toEqual([]);
+  });
+
+  it("returns a single selector", () => {
+    expect(changedLinkedLocalFlags(["seed", "buckets", "--linked"])).toEqual(["linked"]);
+    expect(changedLinkedLocalFlags(["seed", "buckets", "--local"])).toEqual(["local"]);
+  });
+
+  it("returns both selectors in cobra's sorted order when both are set", () => {
+    expect(changedLinkedLocalFlags(["seed", "buckets", "--local", "--linked"])).toEqual([
+      "linked",
+      "local",
+    ]);
+  });
+
+  it("handles = forms", () => {
+    expect(changedLinkedLocalFlags(["--local=true", "--linked=false"])).toEqual([
+      "linked",
+      "local",
+    ]);
+  });
+
+  it("treats the --no-* negation form as changed", () => {
+    expect(changedLinkedLocalFlags(["seed", "buckets", "--no-linked"])).toEqual(["linked"]);
+    expect(changedLinkedLocalFlags(["storage", "ls", "--no-local"])).toEqual(["local"]);
+    expect(changedLinkedLocalFlags(["seed", "buckets", "--no-local", "--linked"])).toEqual([
+      "linked",
+      "local",
+    ]);
+  });
+
+  it("does not treat a value-consuming flag's value as a selector", () => {
+    expect(changedLinkedLocalFlags(["seed", "buckets", "--workdir", "--linked"])).toEqual([]);
+    expect(changedLinkedLocalFlags(["-o", "--linked", "--local"])).toEqual(["local"]);
+    expect(
+      changedLinkedLocalFlags(["storage", "cp", "--content-type", "--local", "a", "b"]),
+    ).toEqual([]);
+    expect(
+      changedLinkedLocalFlags(["storage", "cp", "--cache-control", "--linked", "a", "b"]),
+    ).toEqual([]);
+    expect(changedLinkedLocalFlags(["storage", "cp", "--jobs", "--local", "a", "b"])).toEqual([]);
+    expect(changedLinkedLocalFlags(["storage", "cp", "-j", "--linked", "a", "b"])).toEqual([]);
+  });
+
+  it("still detects a selector after a value-consuming flag's value", () => {
+    expect(changedLinkedLocalFlags(["storage", "cp", "--jobs", "5", "--local", "a", "b"])).toEqual([
+      "local",
+    ]);
+  });
+
+  it("stops scanning at the -- terminator", () => {
+    expect(changedLinkedLocalFlags(["seed", "buckets", "--", "--local", "--linked"])).toEqual([]);
+  });
+
+  it("detects selectors given after positional arguments", () => {
+    expect(changedLinkedLocalFlags(["storage", "rm", "ss:///b/x", "--local"])).toEqual(["local"]);
+  });
+});
diff --git a/apps/cli/src/command-internal/docker-lifecycle.ts b/apps/cli/src/command-internal/docker-lifecycle.ts
index d2ad2ca18a..c9e8f11232 100644
--- a/apps/cli/src/command-internal/docker-lifecycle.ts
+++ b/apps/cli/src/command-internal/docker-lifecycle.ts
@@ -12,6 +12,7 @@ import {
   describeContainerCliFailure,
   spawnContainerCli,
 } from "./container-cli.ts";
+import { ChildTracePropagation } from "../shared/telemetry/spans.ts";
 import { CLI_WORKDIR_LABEL } from "./docker-ids.ts";
 
 type Spawner = ChildProcessSpawner["Service"];
@@ -190,6 +191,7 @@ export const listContainerIdsAndNames = (
  * Inspects a container's state via `docker container inspect <id> --format {{json .State}}`.
  * A missing container isn't special-cased — every non-zero exit, including "no such container",
  * propagates as {@link DockerLifecycleInspectError} carrying the real Docker stderr text.
+ * Emits no spans: wait loops poll it, and their wait span records the attempt count.
  */
 export const inspectContainerState = (spawner: Spawner, containerId: string) =>
   Effect.scoped(
@@ -243,7 +245,7 @@ export const inspectContainerState = (spawner: Spawner, containerId: string) =>
       }
       return parseContainerState(stdout);
     }),
-  );
+  ).pipe(Effect.withTracerEnabled(false), Effect.provideService(ChildTracePropagation, false));
 
 function parseContainerState(stdout: string): {
   readonly running: boolean;
diff --git a/apps/cli/src/command-internal/ensure-login.ts b/apps/cli/src/command-internal/ensure-login.ts
index e6c453bfe4..012e69b44a 100644
--- a/apps/cli/src/command-internal/ensure-login.ts
+++ b/apps/cli/src/command-internal/ensure-login.ts
@@ -30,13 +30,14 @@ export const LOGGED_IN_MSG = "You are now logged in. Happy coding!\n";
  * `stitchLogin` only aliases — it does not call `identify`. Do not add `analytics.identify` here;
  * it would emit an event the established telemetry never sends.
  */
-export const postLoginTelemetry = Effect.fnUntraced(function* (token: string) {
+export const postLoginTelemetry = Effect.fn("Login.postTelemetry")(function* (token: string) {
   const loginApi = yield* LoginApi;
   const telemetryState = yield* TelemetryState;
   const analytics = yield* Analytics;
   const cliSettings = yield* CommandSettings;
 
   const gotrueId = yield* loginApi.fetchGotrueId(cliSettings.apiUrl, token);
+  yield* Effect.annotateCurrentSpan("login.identity_resolved", Option.isSome(gotrueId));
   if (Option.isSome(gotrueId)) {
     yield* telemetryState.stitchLogin(gotrueId.value);
     yield* analytics
@@ -62,7 +63,7 @@ export interface BrowserLoginOptions {
  * post-login telemetry and prints the success banners. Owns the single `cli_login_completed`
  * capture for this path.
  */
-export const browserLogin = Effect.fnUntraced(function* (opts: BrowserLoginOptions) {
+export const browserLogin = Effect.fn("Login.browser")(function* (opts: BrowserLoginOptions) {
   const output = yield* Output;
   const crypto = yield* LoginCrypto;
   const loginApi = yield* LoginApi;
@@ -121,12 +122,19 @@ export const browserLogin = Effect.fnUntraced(function* (opts: BrowserLoginOptio
       const code = yield* output.promptText("Enter your verification code: ", {
         validate: (v) => (v.trim().length > 0 ? undefined : "Verification code is required"),
       });
-      return yield* loginApi.fetchLoginSession(apiHost, sessionId, code.trim());
+      return yield* loginApi
+        .fetchLoginSession(apiHost, sessionId, code.trim())
+        .pipe(
+          Effect.tap(() =>
+            Effect.annotateCurrentSpan("login.verify_attempt_count", failuresSoFar + 1),
+          ),
+        );
     }).pipe(
       Effect.catchTag("LoginVerificationError", (err: LoginVerificationError) =>
         Effect.gen(function* () {
           const failures = failuresSoFar + 1;
           if (failures > MAX_LOGIN_RETRIES) {
+            yield* Effect.annotateCurrentSpan("login.verify_attempt_count", failures);
             return yield* Effect.fail(
               new LoginFailedError({
                 message: err.message,
@@ -168,8 +176,9 @@ export const browserLogin = Effect.fnUntraced(function* (opts: BrowserLoginOptio
  * (env/keyring/file), otherwise runs the browser login flow and fires `cli_login_completed`
  * once.
  */
-export const ensureLogin = Effect.fnUntraced(function* (opts: { openBrowser: boolean }) {
+export const ensureLogin = Effect.fn("Login.ensure")(function* (opts: { openBrowser: boolean }) {
   const existing = yield* resolveAccessToken;
+  yield* Effect.annotateCurrentSpan("login.required", Option.isNone(existing));
   if (Option.isSome(existing)) {
     return;
   }
diff --git a/apps/cli/src/command-internal/git-status.ts b/apps/cli/src/command-internal/git-status.ts
index 36e45449da..136f4014ac 100644
--- a/apps/cli/src/command-internal/git-status.ts
+++ b/apps/cli/src/command-internal/git-status.ts
@@ -3,6 +3,7 @@ import { Effect, Option } from "effect";
 import * as ChildProcess from "effect/unstable/process/ChildProcess";
 import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
 
+import { withChildTraceEnv, withProcessSpan } from "../shared/telemetry/spans.ts";
 import { collectText } from "./container-cli.ts";
 
 /**
@@ -19,22 +20,36 @@ import { collectText } from "./container-cli.ts";
 export function pathHasUncommittedChanges(
   path: string,
 ): Effect.Effect<Option.Option<boolean>, never, ChildProcessSpawner> {
-  return Effect.scoped(
-    Effect.gen(function* () {
-      const spawner = yield* ChildProcessSpawner;
-      const handle = yield* spawner.spawn(
-        ChildProcess.make("git", ["status", "--porcelain", "--", basename(path)], {
-          cwd: dirname(path),
-          stdin: "ignore",
-          stdout: "pipe",
-          stderr: "ignore",
+  const args = ["status", "--porcelain", "--", basename(path)];
+  return withProcessSpan(
+    "Git.status",
+    { executable: "git", argCount: args.length },
+    (traceEnv) =>
+      Effect.scoped(
+        Effect.gen(function* () {
+          const spawner = yield* ChildProcessSpawner;
+          const handle = yield* spawner.spawn(
+            ChildProcess.make(
+              "git",
+              args,
+              withChildTraceEnv(
+                { cwd: dirname(path), stdin: "ignore", stdout: "pipe", stderr: "ignore" },
+                traceEnv,
+              ),
+            ),
+          );
+          const [exitCode, stdout] = yield* Effect.all(
+            [handle.exitCode.pipe(Effect.map(Number)), collectText(handle.stdout)],
+            { concurrency: "unbounded" },
+          );
+          return { exitCode, stdout };
         }),
-      );
-      const [exitCode, stdout] = yield* Effect.all(
-        [handle.exitCode.pipe(Effect.map(Number)), collectText(handle.stdout)],
-        { concurrency: "unbounded" },
-      );
-      return exitCode === 0 ? Option.some(stdout.trim().length > 0) : Option.none<boolean>();
-    }),
-  ).pipe(Effect.orElseSucceed(() => Option.none<boolean>()));
+      ),
+    (result) => result.exitCode,
+  ).pipe(
+    Effect.map(({ exitCode, stdout }) =>
+      exitCode === 0 ? Option.some(stdout.trim().length > 0) : Option.none<boolean>(),
+    ),
+    Effect.orElseSucceed(() => Option.none<boolean>()),
+  );
 }
diff --git a/apps/cli/src/command-internal/global-flags.ts b/apps/cli/src/command-internal/global-flags.ts
index 7e6b994ad4..2348e9a7cf 100644
--- a/apps/cli/src/command-internal/global-flags.ts
+++ b/apps/cli/src/command-internal/global-flags.ts
@@ -35,6 +35,19 @@ export const OutputFlag = GlobalFlag.setting("output")({
   ),
 });
 
+/**
+ * The TS-only `--output-format` global, accepted on any subcommand.
+ *
+ * A value-taking global flag must also be registered in `PERSISTENT_VALUE_FLAG_NAMES`
+ * (`shared/cli/cobra-flag-groups.ts`), or the pre-parse argv scanners won't consume its value.
+ */
+export const OutputFormatFlag = GlobalFlag.setting("output-format")({
+  flag: Flag.choice("output-format", ["text", "json", "stream-json"]).pipe(
+    Flag.withDescription("Output format: text (default), json, or stream-json (NDJSON)"),
+    Flag.optional,
+  ),
+});
+
 export const ProfileFlag = GlobalFlag.setting("profile")({
   flag: Flag.string("profile").pipe(
     Flag.withDescription("use a specific profile for connecting to Supabase API"),
diff --git a/apps/cli/src/command-internal/go-proxy.layer.ts b/apps/cli/src/command-internal/go-proxy.layer.ts
index e5c10d39ea..553d2c9acb 100644
--- a/apps/cli/src/command-internal/go-proxy.layer.ts
+++ b/apps/cli/src/command-internal/go-proxy.layer.ts
@@ -11,6 +11,7 @@ import { ProcessControl } from "../shared/runtime/process-control.service.ts";
 import { GoChildExitError } from "./go-child-exit.error.ts";
 import { GoProxyInvocation } from "./go-proxy-invocation.ts";
 import { GoProxy } from "./go-proxy.service.ts";
+import { withProcessSpan } from "../shared/telemetry/spans.ts";
 
 const markDelegated = Effect.serviceOption(GoProxyInvocation).pipe(
   Effect.flatMap((invocation) =>
@@ -193,16 +194,25 @@ export function makeGoProxyLayer(opts?: {
                   ? { SUPABASE_TELEMETRY_DISABLED: "1" }
                   : {}),
               };
-              const command = ChildProcess.make(binary, [...globalArgs, ...args], {
-                cwd: execOpts?.cwd ?? opts?.cwd,
-                env,
-                extendEnv: true,
-                stdin: "inherit",
-                stdout: "inherit",
-                stderr: "inherit",
-                detached: false,
-              });
-              const exitCode = yield* spawner.exitCode(command).pipe(Effect.orDie);
+              const argv = [...globalArgs, ...args];
+              const exitCode = yield* withProcessSpan(
+                "GoProxy.exec",
+                { executable: binary, argCount: argv.length },
+                (traceEnv) =>
+                  spawner
+                    .exitCode(
+                      ChildProcess.make(binary, argv, {
+                        cwd: execOpts?.cwd ?? opts?.cwd,
+                        env: { ...env, ...traceEnv },
+                        extendEnv: true,
+                        stdin: "inherit",
+                        stdout: "inherit",
+                        stderr: "inherit",
+                        detached: false,
+                      }),
+                    )
+                    .pipe(Effect.orDie),
+              );
               if (exitCode !== 0) {
                 return yield* Effect.fail(
                   new GoChildExitError({
@@ -246,22 +256,35 @@ export function makeGoProxyLayer(opts?: {
               // while stdout is collected for wrapping. Callers pass stdin: "ignore" to give the
               // child a non-TTY stdin so it can't block on a prompt before the wrapper emits its
               // machine-output envelope.
-              const command = ChildProcess.make(binary, [...globalArgs, ...args], {
-                cwd: execOpts?.cwd ?? opts?.cwd,
-                env,
-                extendEnv: true,
-                stdin: execOpts?.stdin ?? "inherit",
-                stdout: "pipe",
-                stderr: "inherit",
-                detached: false,
-              });
-              const handle = yield* spawner.spawn(command).pipe(Effect.orDie);
-              // Drain stdout fully before awaiting exit so a full pipe buffer can't
-              // deadlock the child.
-              const captured = yield* Stream.mkString(Stream.decodeText(handle.stdout)).pipe(
-                Effect.orDie,
+              const argv = [...globalArgs, ...args];
+              const { captured, exitCode } = yield* withProcessSpan(
+                "GoProxy.execCapture",
+                { executable: binary, argCount: argv.length },
+                (traceEnv) =>
+                  Effect.gen(function* () {
+                    const handle = yield* spawner
+                      .spawn(
+                        ChildProcess.make(binary, argv, {
+                          cwd: execOpts?.cwd ?? opts?.cwd,
+                          env: { ...env, ...traceEnv },
+                          extendEnv: true,
+                          stdin: execOpts?.stdin ?? "inherit",
+                          stdout: "pipe",
+                          stderr: "inherit",
+                          detached: false,
+                        }),
+                      )
+                      .pipe(Effect.orDie);
+                    // Drain stdout fully before awaiting exit so a full pipe buffer can't
+                    // deadlock the child.
+                    const captured = yield* Stream.mkString(Stream.decodeText(handle.stdout)).pipe(
+                      Effect.orDie,
+                    );
+                    const exitCode = yield* handle.exitCode.pipe(Effect.orDie);
+                    return { captured, exitCode };
+                  }),
+                (result) => result.exitCode,
               );
-              const exitCode = yield* handle.exitCode.pipe(Effect.orDie);
               if (exitCode !== 0) {
                 return yield* Effect.fail(
                   new GoChildExitError({
diff --git a/apps/cli/src/command-internal/link-services-core.ts b/apps/cli/src/command-internal/link-services-core.ts
index e5171a61cb..461162dafa 100644
--- a/apps/cli/src/command-internal/link-services-core.ts
+++ b/apps/cli/src/command-internal/link-services-core.ts
@@ -38,7 +38,13 @@ type WriteTempFile = (filePath: string, content: string) => Effect.Effect<void,
  * the linked-project cache, or fire `cli_project_linked`; the `link` command
  * owns those, and `bootstrap` calls this directly to skip them.
  */
-export const linkServicesCore = Effect.fnUntraced(function* (input: LinkServicesInput) {
+export const linkServicesCore = Effect.fn("LinkServices.write")(function* (
+  input: LinkServicesInput,
+) {
+  yield* Effect.annotateCurrentSpan({
+    "project.ref": input.ref,
+    "link.skip_pooler": input.skipPooler,
+  });
   const api = yield* CommandPlatformApi;
   const cliSettings = yield* CommandSettings;
   const fs = yield* FileSystem.FileSystem;
diff --git a/apps/cli/src/command-internal/linked-state.ts b/apps/cli/src/command-internal/linked-state.ts
index 0c5c8a48c1..c7ad6cc1a3 100644
--- a/apps/cli/src/command-internal/linked-state.ts
+++ b/apps/cli/src/command-internal/linked-state.ts
@@ -71,7 +71,7 @@ const resolveSoftLinkedRef = Effect.fnUntraced(function* () {
  *   from `SUPABASE_PROJECT_ID` the cache may not describe it, so the branch claim needs the
  *   lookup to confirm it and otherwise degrades to the plain shape.
  */
-export const resolveLinkedState = Effect.fnUntraced(function* () {
+export const resolveLinkedState = Effect.fn("LinkedState.resolve")(function* () {
   const cliSettings = yield* CommandSettings;
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
@@ -79,8 +79,14 @@ export const resolveLinkedState = Effect.fnUntraced(function* () {
   const soft = yield* resolveSoftLinkedRef();
   const linkedRef = soft.ref;
   if (Option.isNone(linkedRef)) {
+    yield* Effect.annotateCurrentSpan("linked_state.kind", "unlinked");
     return { linked: false } as const;
   }
+  yield* Effect.annotateCurrentSpan({
+    "linked_state.kind": "project",
+    "linked_state.ref_source": soft.source,
+    "project.ref": linkedRef.value,
+  });
 
   const paths = tempPaths(path, cliSettings.workdir);
   const cached = yield* fs.readFileString(paths.linkedProjectCache).pipe(
@@ -114,6 +120,7 @@ export const resolveLinkedState = Effect.fnUntraced(function* () {
     }
     // File-sourced, or env-sourced with a confirmed lookup: always render
     // the branch-linked shape, degrading only the `branch` name.
+    yield* Effect.annotateCurrentSpan("linked_state.kind", "branch");
     return {
       linked: true,
       projectRef: linkedRef.value,
diff --git a/apps/cli/src/command-internal/local-project-context.ts b/apps/cli/src/command-internal/local-project-context.ts
index 225b8959de..98487222a8 100644
--- a/apps/cli/src/command-internal/local-project-context.ts
+++ b/apps/cli/src/command-internal/local-project-context.ts
@@ -7,8 +7,10 @@ import {
 import { loadCliConfig } from "@supabase/config/internal";
 import { Crypto, Effect, FileSystem, Path, Schema } from "effect";
 
+import { recordOrioleDbTelemetry } from "./db-image.ts";
 import { resolveLocalProjectId, sanitizeProjectId } from "./docker-ids.ts";
 import { getHostname } from "./hostname.ts";
+import { envOverride, envOverrideMajorVersion } from "./local-config-values.ts";
 import { resolveProjectEnvironmentValues } from "./project-environment.ts";
 import { RuntimeInfo } from "../shared/runtime/runtime-info.service.ts";
 
@@ -95,5 +97,26 @@ export const loadLocalProjectContext = <E>(
       ),
     );
 
+    yield* Effect.annotateCurrentSpan({
+      "config.found": loaded !== null,
+      "config.remote_applied": loaded?.appliedRemote !== undefined,
+    });
     return { config, projectEnvValues, loaded, hostname, projectId };
-  });
+  }).pipe(Effect.withSpan("LocalProjectContext.load"));
+
+/** Records OrioleDB selection for commands whose only local config read is this context. */
+export const recordLocalProjectOrioleDbTelemetry = (context: LocalProjectContext) =>
+  Effect.try(() => ({
+    version: envOverride(
+      "SUPABASE_DB_ORIOLEDB_VERSION",
+      context.config.db.orioledb_version,
+      context.projectEnvValues,
+    ),
+    majorVersion: envOverrideMajorVersion(
+      context.config.db.major_version,
+      context.projectEnvValues,
+    ),
+  })).pipe(
+    Effect.flatMap(({ version, majorVersion }) => recordOrioleDbTelemetry(version, majorVersion)),
+    Effect.ignore,
+  );
diff --git a/apps/cli/src/command-internal/migration-apply.ts b/apps/cli/src/command-internal/migration-apply.ts
index 937709cd4f..96aea47001 100644
--- a/apps/cli/src/command-internal/migration-apply.ts
+++ b/apps/cli/src/command-internal/migration-apply.ts
@@ -441,6 +441,11 @@ const execMigrationBatch = <E>(
       const matches = MIGRATE_FILE_PATTERN.exec(filename);
       const version = forceNoVersion ? "" : (matches?.[1] ?? "");
       const name = matches?.[2] ?? "";
+      yield* Effect.annotateCurrentSpan({
+        "statement.count": statements.length,
+        "migration.transaction_mode": transactionMode,
+        ...(version !== "" ? { "migration.version": version } : {}),
+      });
 
       const restoreRole = session.restoreRoleSql;
 
@@ -592,7 +597,7 @@ const execMigrationBatch = <E>(
           : mapError(errorMessage(error), "exec", formattedExecBatchDbError(error)),
       ),
     );
-  });
+  }).pipe(Effect.withSpan("MigrationApply.file"));
 
 /**
  * Clears any connection settings a prior statement on the same session may have changed (e.g.
@@ -660,7 +665,9 @@ export const applyMigrations = <E>(
       yield* resetConnectionState(session, mapError);
       yield* execMigrationBatch(session, fs, path, migrationPath, mapError, false);
     }
-  });
+  }).pipe(
+    Effect.withSpan("MigrationApply.run", { attributes: { "migration.count": pending.length } }),
+  );
 
 /**
  * Applies custom-role/globals files: for each file, emits `Seeding globals from <name>...` to
@@ -680,7 +687,9 @@ export const seedGlobals = <E>(
       yield* output.raw(`Seeding globals from ${path.basename(globalPath)}...\n`, "stderr");
       yield* execMigrationBatch(session, fs, path, globalPath, mapError, true);
     }
-  });
+  }).pipe(
+    Effect.withSpan("MigrationApply.seedGlobals", { attributes: { "file.count": globals.length } }),
+  );
 
 /**
  * Runs one SQL file's statements transactionally, without `seedGlobals`'s per-file stderr
@@ -734,6 +743,7 @@ export const applySchemaFiles = <E>(
 ): Effect.Effect<void, E | DbConnectError> =>
   Effect.gen(function* () {
     const { files, warnings } = yield* sqlFilesGlob(fs, path, schemaPaths, workdir);
+    yield* Effect.annotateCurrentSpan("file.count", files.length);
     if (files.length === 0) {
       // Succeeds when there were no patterns to glob at all; fails with the joined per-pattern
       // warnings otherwise.
@@ -760,4 +770,4 @@ export const applySchemaFiles = <E>(
         projectEnv,
       );
     }
-  });
+  }).pipe(Effect.withSpan("MigrationApply.schemaFiles"));
diff --git a/apps/cli/src/command-internal/migration-fetch-run.ts b/apps/cli/src/command-internal/migration-fetch-run.ts
index b4ea180eb0..0390201928 100644
--- a/apps/cli/src/command-internal/migration-fetch-run.ts
+++ b/apps/cli/src/command-internal/migration-fetch-run.ts
@@ -36,7 +36,9 @@ export interface MigrationFetchOutcome {
   readonly files: ReadonlyArray<string>;
 }
 
-export const runMigrationFetch = Effect.fnUntraced(function* (input: MigrationFetchInput) {
+export const runMigrationFetch = Effect.fn("MigrationFetch.run")(function* (
+  input: MigrationFetchInput,
+) {
   const { flags, target, assumeYes } = input;
   const output = yield* Output;
   const resolver = yield* DbConfigResolver;
@@ -56,6 +58,7 @@ export const runMigrationFetch = Effect.fnUntraced(function* (input: MigrationFe
   }
 
   const connType = target.connType ?? "linked"; // fetch defaults to `--linked`.
+  yield* Effect.annotateCurrentSpan("db.conn_type", connType);
 
   // `--project-ref` never implies `--linked` and must not be silently
   // discarded on a non-linked target — see push.handler.ts's identical guard
@@ -178,6 +181,7 @@ export const runMigrationFetch = Effect.fnUntraced(function* (input: MigrationFe
       );
       written.push(filePath);
     }
+    yield* Effect.annotateCurrentSpan("migration.count", written.length);
 
     return { files: written } satisfies MigrationFetchOutcome;
   });
diff --git a/apps/cli/src/command-internal/migration-history.ts b/apps/cli/src/command-internal/migration-history.ts
index 9cf6e62243..3ff20c7f21 100644
--- a/apps/cli/src/command-internal/migration-history.ts
+++ b/apps/cli/src/command-internal/migration-history.ts
@@ -268,6 +268,8 @@ export const listRemoteMigrations = (session: DbSession) =>
         ? Effect.succeed<ReadonlyArray<string>>([])
         : Effect.fail(new MigrationsReadError({ message: error.message })),
     ),
+    Effect.tap((versions) => Effect.annotateCurrentSpan("migration.count", versions.length)),
+    Effect.withSpan("MigrationHistory.listRemote"),
   );
 
 /** Whether a query error is Postgres's `undefined_table` (42P01). */
@@ -428,6 +430,8 @@ export const readMigrationTable = (session: DbSession) =>
           message: `failed to read migration table: ${error.message}`,
         }),
     ),
+    Effect.tap((files) => Effect.annotateCurrentSpan("migration.count", files.length)),
+    Effect.withSpan("MigrationHistory.readTable"),
   );
 
 /**
diff --git a/apps/cli/src/command-internal/migration-list.ts b/apps/cli/src/command-internal/migration-list.ts
index 556b9d5d76..b1c6af5412 100644
--- a/apps/cli/src/command-internal/migration-list.ts
+++ b/apps/cli/src/command-internal/migration-list.ts
@@ -25,7 +25,7 @@ const NO_MIGRATIONS: ReadonlyArray<string> = [];
  * fires for the `db diff/pull/schema declarative` paths too, not only the `migration`
  * commands.
  */
-export const listLocalMigrations = Effect.fnUntraced(function* (
+export const listLocalMigrations = Effect.fn("MigrationList.local")(function* (
   fs: FileSystem.FileSystem,
   path: Path.Path,
   migrationsDir: string,
@@ -80,5 +80,6 @@ export const listLocalMigrations = Effect.fnUntraced(function* (
     }
     result.push(entryPath);
   }
+  yield* Effect.annotateCurrentSpan("migration.count", result.length);
   return result;
 });
diff --git a/apps/cli/src/command-internal/parent-project-ref.ts b/apps/cli/src/command-internal/parent-project-ref.ts
index ed14c356fd..751f259c44 100644
--- a/apps/cli/src/command-internal/parent-project-ref.ts
+++ b/apps/cli/src/command-internal/parent-project-ref.ts
@@ -126,20 +126,24 @@ export const resolveLinkedParentRef = Effect.fnUntraced(function* () {
  * always wins; otherwise it prefers `resolveLinkedParentRef`'s cached parent, falling back to
  * `resolver.resolve` unchanged when no parent is resolvable.
  */
-export const resolveParentScopedProjectRef = Effect.fnUntraced(function* (
+export const resolveParentScopedProjectRef = Effect.fn("ParentProjectRef.resolve")(function* (
   flagValue: Option.Option<string>,
 ) {
   const resolver = yield* ProjectRefResolver;
 
   if (Option.isSome(flagValue) && flagValue.value.length > 0) {
+    yield* Effect.annotateCurrentSpan("parent_project_ref.source", "flag");
     return yield* resolver.resolve(flagValue);
   }
 
   const parent = yield* resolveLinkedParentRef();
+  yield* Effect.annotateCurrentSpan("parent_project_ref.linked_parent", parent.kind);
   if (parent.kind === "resolved") {
+    yield* Effect.annotateCurrentSpan("parent_project_ref.source", "linked_parent");
     return parent.ref;
   }
 
+  yield* Effect.annotateCurrentSpan("parent_project_ref.source", "resolver");
   return yield* resolver.resolve(Option.none());
 });
 
diff --git a/apps/cli/src/command-internal/pgdelta-engine-runtime.layer.ts b/apps/cli/src/command-internal/pgdelta-engine-runtime.layer.ts
index a80e16ff0e..46dd9471c1 100644
--- a/apps/cli/src/command-internal/pgdelta-engine-runtime.layer.ts
+++ b/apps/cli/src/command-internal/pgdelta-engine-runtime.layer.ts
@@ -3,7 +3,7 @@ import { Layer } from "effect";
 import { httpClientLayer } from "../auth/http-debug.layer.ts";
 import { commandSettingsLayer } from "../config/command-settings.layer.ts";
 import { dbConfigLayer } from "./db-config.layer.ts";
-import { dbConnectionLayer } from "./db-connection.layer.ts";
+import { dbConnectionLayer } from "./db-connection.sql-pg.layer.ts";
 import { debugLoggerLayer } from "./debug-logger.layer.ts";
 import { dockerRunLayer } from "./docker-run.layer.ts";
 import { edgeRuntimeScriptLayer } from "./edge-runtime-script.layer.ts";
diff --git a/apps/cli/src/command-internal/pgdelta-ssl-probe.layer.ts b/apps/cli/src/command-internal/pgdelta-ssl-probe.layer.ts
index a8821702ca..ef08852176 100644
--- a/apps/cli/src/command-internal/pgdelta-ssl-probe.layer.ts
+++ b/apps/cli/src/command-internal/pgdelta-ssl-probe.layer.ts
@@ -126,9 +126,12 @@ export const pgDeltaSslProbeLayer = Layer.effect(
             return Effect.sync(() => socket.destroy());
           },
         );
+        yield* Effect.annotateCurrentSpan("db.ssl.supported", outcome === "tls");
         if (outcome === "refused") return false;
         return true;
-      });
+      }).pipe(
+        Effect.withSpan("PgDeltaSslProbe.probe", { attributes: { "server.port": target.port } }),
+      );
     return PgDeltaSslProbe.of({
       requireSsl: (dbUrl) =>
         Effect.gen(function* () {
diff --git a/apps/cli/src/command-internal/profile-load.ts b/apps/cli/src/command-internal/profile-load.ts
index ffe2f3d897..28a1c66c65 100644
--- a/apps/cli/src/command-internal/profile-load.ts
+++ b/apps/cli/src/command-internal/profile-load.ts
@@ -52,7 +52,9 @@ export function loadProfile(
     // Built-in names are all ASCII lower-case, so case-insensitive matching is plain
     // lower-casing.
     const folded = token.toLowerCase();
-    if (isBuiltinProfileName(folded)) {
+    const builtin = isBuiltinProfileName(folded);
+    yield* Effect.annotateCurrentSpan("profile.source", builtin ? "builtin" : "file");
+    if (builtin) {
       return {
         apiUrl: apiUrl(folded),
         name: folded,
@@ -159,7 +161,7 @@ export function loadProfile(
       poolerHost: values.get("pooler_host") ?? "",
       dashboardUrl: values.get("dashboard_url") ?? "",
     };
-  });
+  }).pipe(Effect.withSpan("Profile.load"));
 }
 
 const fail = (message: string) => Effect.fail(new ProfileLoadError({ message }));
diff --git a/apps/cli/src/command-internal/project-create-core.ts b/apps/cli/src/command-internal/project-create-core.ts
index aa1aca15e3..55238d6a59 100644
--- a/apps/cli/src/command-internal/project-create-core.ts
+++ b/apps/cli/src/command-internal/project-create-core.ts
@@ -68,7 +68,9 @@ function printKeyValue(key: string, value: string): string {
  * (the standalone command's own pre-run does that) and does not write the linked-project
  * cache (the caller owns that via `Effect.ensuring`).
  */
-export const projectCreateCore = Effect.fnUntraced(function* (input: ProjectCreateInput) {
+export const projectCreateCore = Effect.fn("ProjectCreate.run")(function* (
+  input: ProjectCreateInput,
+) {
   const output = yield* Output;
   const goOutputFlag = yield* OutputFlag;
   const api = yield* CommandPlatformApi;
@@ -143,6 +145,7 @@ export const projectCreateCore = Effect.fnUntraced(function* (input: ProjectCrea
   yield* creating?.clear ?? Effect.void;
 
   const id = readProjectField(created, "id");
+  yield* Effect.annotateCurrentSpan("project.ref", id);
 
   // Printed to stderr for every output format.
   const projectUrl = `${dashboardUrlForProfile(cliSettings.profile)}/project/${id}`;
diff --git a/apps/cli/src/command-internal/project-target.ts b/apps/cli/src/command-internal/project-target.ts
index 6ba150f089..9f66fdbbae 100644
--- a/apps/cli/src/command-internal/project-target.ts
+++ b/apps/cli/src/command-internal/project-target.ts
@@ -170,9 +170,11 @@ export function resolveConfigTarget<TError, EResolve extends ConfigTargetResolve
     if (Option.isSome(requested) && !BRANCH_PROJECT_REF_PATTERN.test(requested.value)) {
       const target = requested.value;
       branch = target;
+      const byId = BRANCH_UUID_PATTERN.test(target);
+      yield* Effect.annotateCurrentSpan("project_target.kind", byId ? "branch_id" : "branch_name");
 
       let parentRef: ReturnType<typeof resolveParentScopedProjectRef>;
-      if (BRANCH_UUID_PATTERN.test(target)) {
+      if (byId) {
         parentRef = resolveParentScopedProjectRef(Option.none());
       } else {
         const parent = yield* resolveLinkedParentRef();
@@ -204,9 +206,11 @@ export function resolveConfigTarget<TError, EResolve extends ConfigTargetResolve
         return yield* Effect.fail(errors.branchNotReady(target));
       }
     } else {
+      yield* Effect.annotateCurrentSpan("project_target.kind", "project");
       ref = yield* resolver.resolve(requested);
     }
 
+    yield* Effect.annotateCurrentSpan("project.ref", ref);
     return { ref, branch };
-  });
+  }).pipe(Effect.withSpan("ProjectTarget.resolve"));
 }
diff --git a/apps/cli/src/commands/backups/backups.format.ts b/apps/cli/src/command-internal/region.format.ts
similarity index 86%
rename from apps/cli/src/commands/backups/backups.format.ts
rename to apps/cli/src/command-internal/region.format.ts
index 61beb4c00e..e228cf6480 100644
--- a/apps/cli/src/commands/backups/backups.format.ts
+++ b/apps/cli/src/command-internal/region.format.ts
@@ -19,6 +19,7 @@ const REGION_NAMES: Readonly<Record<string, string>> = {
   "us-west-2": "West US (Oregon)",
 };
 
-export function formatRegion(region: string): string {
+/** Renders a known region code as its display name; unknown codes pass through. */
+export function formatRegion(region: string) {
   return REGION_NAMES[region] ?? region;
 }
diff --git a/apps/cli/src/commands/backups/backups.format.unit.test.ts b/apps/cli/src/command-internal/region.format.unit.test.ts
similarity index 95%
rename from apps/cli/src/commands/backups/backups.format.unit.test.ts
rename to apps/cli/src/command-internal/region.format.unit.test.ts
index a0f13e9e1f..eb6c6f3548 100644
--- a/apps/cli/src/commands/backups/backups.format.unit.test.ts
+++ b/apps/cli/src/command-internal/region.format.unit.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
 
-import { formatRegion } from "./backups.format.ts";
+import { formatRegion } from "./region.format.ts";
 
 describe("formatRegion", () => {
   it.each([
diff --git a/apps/cli/src/command-internal/stack-backend.ts b/apps/cli/src/command-internal/stack-backend.ts
index 9c12d7023a..aef22f5306 100644
--- a/apps/cli/src/command-internal/stack-backend.ts
+++ b/apps/cli/src/command-internal/stack-backend.ts
@@ -55,17 +55,18 @@ export class StackBackendContext extends Context.Service<
 export const stackBackendLayer = (kind: StackBackend) =>
   Layer.succeed(StackBackendContext, { kind });
 
-/** Handlers default to legacy when tests omit the root-provided backend service. */
+/** Handlers default to legacy when no backend was routed for the command. */
 export const currentStackBackend: Effect.Effect<{ readonly kind: StackBackend }, never, never> =
   Effect.serviceOption(StackBackendContext).pipe(
     Effect.map((value) => Option.getOrElse(value, () => ({ kind: "legacy" as const }))),
   );
 
+/** Resolves the backend, or `undefined` for commands that `experimental.stack` does not route. */
 export const resolveStackBackend = (input: {
   readonly args: ReadonlyArray<string>;
   readonly cwd: string;
   readonly env: Readonly<Record<string, string | undefined>>;
-}): Effect.Effect<StackBackend, StackRoutingError, FileSystem.FileSystem | Path.Path> =>
+}): Effect.Effect<StackBackend | undefined, StackRoutingError, FileSystem.FileSystem | Path.Path> =>
   Effect.gen(function* () {
     // Completion passes the final token as the cursor word, so it is not part of
     // the resolved command path.
@@ -73,7 +74,7 @@ export const resolveStackBackend = (input: {
       input.args[0] === "__complete" || input.args[0] === "__completeNoDesc"
         ? input.args.slice(0, -1)
         : input.args;
-    if (hasRootVersionFlag(routingArgs)) return "legacy";
+    if (hasRootVersionFlag(routingArgs)) return undefined;
 
     const commandPath = extractCommandPath(routingArgs);
     const completePath =
@@ -87,7 +88,7 @@ export const resolveStackBackend = (input: {
       !STACK_BACKEND_COMMANDS.has(command) &&
       !isFunctionsServePath(completePath)
     )
-      return "legacy";
+      return undefined;
 
     const enabled = yield* resolveExperimentalFeature({
       feature: "stack",
diff --git a/apps/cli/src/command-internal/stack-catalog-setup.ts b/apps/cli/src/command-internal/stack-catalog-setup.ts
index 714e683ac5..f7c6710969 100644
--- a/apps/cli/src/command-internal/stack-catalog-setup.ts
+++ b/apps/cli/src/command-internal/stack-catalog-setup.ts
@@ -10,7 +10,7 @@ import {
 import { parseConnectionString } from "./db-config.parse.ts";
 import type { DbConnectError } from "./db-connection.errors.ts";
 import { DbConnection } from "./db-connection.service.ts";
-import { dbConnectionLayer } from "./db-connection.layer.ts";
+import { dbConnectionLayer } from "./db-connection.sql-pg.layer.ts";
 import {
   applyDatabaseOverlay,
   type ApplyDatabaseOverlayInput,
@@ -116,6 +116,7 @@ const applyCatalog = Effect.fn("StackCatalogSetup.apply")(function* (
   const dbConn = yield* DbConnection;
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
+  yield* Effect.annotateCurrentSpan("service.count", input.target.databaseServices.length);
   const runtimeCredentials = yield* input.target.database
     .credentials({ from: "runtime" })
     .pipe(Effect.mapError(catalogError));
@@ -167,7 +168,7 @@ const applyCatalog = Effect.fn("StackCatalogSetup.apply")(function* (
         vault: input.overlay.vault,
         webhooks: input.overlay.webhooks,
         announceRoles: input.overlay.announceRoles,
-      });
+      }).pipe(Effect.withSpan("StackCatalogSetup.applyOverlay"));
     }),
   );
 });
diff --git a/apps/cli/src/command-internal/stack-config.ts b/apps/cli/src/command-internal/stack-config.ts
index c9a41e75f1..3009d58552 100644
--- a/apps/cli/src/command-internal/stack-config.ts
+++ b/apps/cli/src/command-internal/stack-config.ts
@@ -54,6 +54,7 @@ import {
   strToArr,
 } from "./local-config-values.ts";
 import { generateAsymmetricGoJwt } from "./go-jwt.ts";
+import { recordOrioleDbTelemetry } from "./db-image.ts";
 import {
   resolveRemoteJwks,
   resolveThirdPartyIssuerUrl,
@@ -161,6 +162,135 @@ const envNestedPortOrConfigured = (
   return typeof nested?.[key] === "number" ? configured : undefined;
 };
 
+/** A setting's `config.toml` key and the `SUPABASE_*` env var that overrides it. */
+export interface StackEndpointSetting {
+  readonly configPath: string;
+  readonly envVar: string;
+}
+
+/**
+ * A port setting's `config.toml` key and env var, shared by `createCreations` and
+ * `stackEndpointSetting` so both report the same names; a new endpoint still needs an entry in
+ * `endpointSettingsByServiceEndpoint`.
+ */
+interface PortSetting extends StackEndpointSetting {
+  readonly section: string;
+  readonly nestedSection?: string;
+  readonly key: string;
+}
+
+const DB_PORT: PortSetting = {
+  envVar: "SUPABASE_DB_PORT",
+  section: "db",
+  key: "port",
+  configPath: "db.port",
+};
+const API_PORT: PortSetting = {
+  envVar: "SUPABASE_API_PORT",
+  section: "api",
+  key: "port",
+  configPath: "api.port",
+};
+const STUDIO_PORT: PortSetting = {
+  envVar: "SUPABASE_STUDIO_PORT",
+  section: "studio",
+  key: "port",
+  configPath: "studio.port",
+};
+const DB_POOLER_PORT: PortSetting = {
+  envVar: "SUPABASE_DB_POOLER_PORT",
+  section: "db",
+  nestedSection: "pooler",
+  key: "port",
+  configPath: "db.pooler.port",
+};
+const LOCAL_SMTP_PORT: PortSetting = {
+  envVar: "SUPABASE_LOCAL_SMTP_PORT",
+  section: "local_smtp",
+  key: "port",
+  configPath: "local_smtp.port",
+};
+const LOCAL_SMTP_SMTP_PORT: PortSetting = {
+  envVar: "SUPABASE_LOCAL_SMTP_SMTP_PORT",
+  section: "local_smtp",
+  key: "smtp_port",
+  configPath: "local_smtp.smtp_port",
+};
+const LOCAL_SMTP_POP3_PORT: PortSetting = {
+  envVar: "SUPABASE_LOCAL_SMTP_POP3_PORT",
+  section: "local_smtp",
+  key: "pop3_port",
+  configPath: "local_smtp.pop3_port",
+};
+const ANALYTICS_PORT: PortSetting = {
+  envVar: "SUPABASE_ANALYTICS_PORT",
+  section: "analytics",
+  key: "port",
+  configPath: "analytics.port",
+};
+const EDGE_RUNTIME_INSPECTOR_PORT: PortSetting = {
+  envVar: "SUPABASE_EDGE_RUNTIME_INSPECTOR_PORT",
+  section: "edge_runtime",
+  key: "inspector_port",
+  configPath: "edge_runtime.inspector_port",
+};
+
+/** Resolves one `PortSetting` against the loaded document and env, picking the nested variant when needed. */
+const resolvePort = (
+  setting: PortSetting,
+  document: Readonly<Record<string, unknown>> | undefined,
+  configured: number,
+  env: Readonly<Record<string, string>>,
+): number | undefined =>
+  setting.nestedSection === undefined
+    ? envPortOrConfigured(setting.envVar, document, setting.section, setting.key, configured, env)
+    : envNestedPortOrConfigured(
+        setting.envVar,
+        document,
+        setting.section,
+        setting.nestedSection,
+        setting.key,
+        configured,
+        env,
+      );
+
+/**
+ * Maps a saved stack endpoint (service + endpoint name) to the `PortSetting` that controls it.
+ * An endpoint missing here (e.g. `pooler.http`, `realtime.rpc`) is always automatic.
+ */
+const endpointSettingsByServiceEndpoint: Readonly<Record<string, StackEndpointSetting>> = {
+  "database.sql": DB_PORT,
+  "pooler.sql": DB_POOLER_PORT,
+  "analytics.http": ANALYTICS_PORT,
+  "studio.http": STUDIO_PORT,
+  "mail.http": LOCAL_SMTP_PORT,
+  "mail.smtp": LOCAL_SMTP_SMTP_PORT,
+  "mail.pop3": LOCAL_SMTP_POP3_PORT,
+  "functions.inspector": EDGE_RUNTIME_INSPECTOR_PORT,
+  "rest.http": API_PORT,
+  "auth.http": API_PORT,
+  "realtime.http": API_PORT,
+  "storage.http": API_PORT,
+  "functions.http": API_PORT,
+};
+
+/** The config.toml key and env var override for a service endpoint, when the CLI exposes one. */
+export const stackEndpointSetting = (
+  service: string,
+  endpoint: string,
+): StackEndpointSetting | undefined => endpointSettingsByServiceEndpoint[`${service}.${endpoint}`];
+
+/**
+ * `db.major_version`'s config key and `SUPABASE_DB_MAJOR_VERSION` override. Unlike the ports
+ * above, `envOverrideMajorVersion` (shared with `db-bootstrap` and the legacy local stack) hardcodes
+ * its own name/field, so there is no single call site to read this from without widening that
+ * shared helper's signature; the two literals here are kept in sync by hand.
+ */
+export const stackMajorVersionSetting: StackEndpointSetting = {
+  configPath: "db.major_version",
+  envVar: "SUPABASE_DB_MAJOR_VERSION",
+};
+
 const authProviderNames = [
   "apple",
   "azure",
@@ -522,17 +652,6 @@ const resolveEffectiveCliConfig = (
       env,
     ),
     port: resolvedPort("SUPABASE_ANALYTICS_PORT", analytics.port, "analytics.port", env),
-    ...(analytics.vector_port === undefined &&
-    envOverride("SUPABASE_ANALYTICS_VECTOR_PORT", undefined, env) === undefined
-      ? {}
-      : {
-          vector_port: resolvedPort(
-            "SUPABASE_ANALYTICS_VECTOR_PORT",
-            analytics.vector_port ?? 0,
-            "analytics.vector_port",
-            env,
-          ),
-        }),
     backend: envOverrideAnalyticsBackend(analytics.backend, env),
     gcp_project_id: envOverride("SUPABASE_ANALYTICS_GCP_PROJECT_ID", analytics.gcp_project_id, env),
     gcp_project_number: envOverride(
@@ -852,6 +971,10 @@ export const loadStackConfig = Effect.fn("StackConfig.load")(
           });
         }),
       );
+      yield* recordOrioleDbTelemetry(
+        validatedConfig.db.orioledb_version,
+        validatedConfig.db.major_version,
+      );
       const validationError = configValidationError(validatedConfig);
       if (validationError !== undefined)
         return yield* new StackConfigError({ message: validationError });
@@ -951,6 +1074,7 @@ export const loadStackConfig = Effect.fn("StackConfig.load")(
               yield* resolveRemoteJwks(issuer).pipe(
                 Effect.provide(FetchHttpClient.layer),
                 Effect.mapError((cause) => new StackConfigError({ message: cause.message })),
+                Effect.withSpan("StackConfig.fetchRemoteJwks"),
               ),
             );
       });
@@ -1064,68 +1188,51 @@ export const loadStackConfig = Effect.fn("StackConfig.load")(
         },
         catch: (cause) => new StackConfigError({ message: String(cause) }),
       });
-      const dbPort = envPortOrConfigured(
-        "SUPABASE_DB_PORT",
+      const dbPort = resolvePort(
+        DB_PORT,
         document,
-        "db",
-        "port",
         validatedConfig.db.port,
         context.projectEnvValues,
       );
-      const apiPort = envPortOrConfigured(
-        "SUPABASE_API_PORT",
+      const apiPort = resolvePort(
+        API_PORT,
         document,
-        "api",
-        "port",
         validatedConfig.api.port,
         context.projectEnvValues,
       );
-      const studioPort = envPortOrConfigured(
-        "SUPABASE_STUDIO_PORT",
+      const studioPort = resolvePort(
+        STUDIO_PORT,
         document,
-        "studio",
-        "port",
         validatedConfig.studio.port,
         context.projectEnvValues,
       );
-      const poolerPort = envNestedPortOrConfigured(
-        "SUPABASE_DB_POOLER_PORT",
+      const poolerPort = resolvePort(
+        DB_POOLER_PORT,
         document,
-        "db",
-        "pooler",
-        "port",
         validatedConfig.db.pooler.port,
         context.projectEnvValues,
       );
-      const mailPort = envPortOrConfigured(
-        "SUPABASE_LOCAL_SMTP_PORT",
+      const mailPort = resolvePort(
+        LOCAL_SMTP_PORT,
         document,
-        "local_smtp",
-        "port",
         validatedConfig.local_smtp.port,
         context.projectEnvValues,
       );
-      const mailSmtpPort = envPortOrConfigured(
-        "SUPABASE_LOCAL_SMTP_SMTP_PORT",
+      const mailSmtpPort = resolvePort(
+        LOCAL_SMTP_SMTP_PORT,
         document,
-        "local_smtp",
-        "smtp_port",
         validatedConfig.local_smtp.smtp_port ?? 0,
         context.projectEnvValues,
       );
-      const mailPop3Port = envPortOrConfigured(
-        "SUPABASE_LOCAL_SMTP_POP3_PORT",
+      const mailPop3Port = resolvePort(
+        LOCAL_SMTP_POP3_PORT,
         document,
-        "local_smtp",
-        "pop3_port",
         validatedConfig.local_smtp.pop3_port ?? 0,
         context.projectEnvValues,
       );
-      const analyticsPort = envPortOrConfigured(
-        "SUPABASE_ANALYTICS_PORT",
+      const analyticsPort = resolvePort(
+        ANALYTICS_PORT,
         document,
-        "analytics",
-        "port",
         validatedConfig.analytics.port,
         context.projectEnvValues,
       );
@@ -1250,26 +1357,6 @@ export const loadStackConfig = Effect.fn("StackConfig.load")(
                   } satisfies ServiceCreationType,
                 ]
               : []),
-            ...(validatedConfig.analytics.enabled
-              ? [
-                  {
-                    service: "vector" as const,
-                    config: { apiKey: "api-key" },
-                    endpoints: {
-                      http: endpoint(
-                        envPortOrConfigured(
-                          "SUPABASE_ANALYTICS_VECTOR_PORT",
-                          document,
-                          "analytics",
-                          "vector_port",
-                          validatedConfig.analytics.vector_port ?? 0,
-                          context.projectEnvValues,
-                        ),
-                      ),
-                    },
-                  } satisfies ServiceCreationType,
-                ]
-              : []),
             ...(validatedConfig.storage.image_transformation?.enabled === true
               ? [
                   {
@@ -1295,11 +1382,9 @@ export const loadStackConfig = Effect.fn("StackConfig.load")(
                     endpoints: {
                       http: endpoint(apiPort),
                       inspector: endpoint(
-                        envPortOrConfigured(
-                          "SUPABASE_EDGE_RUNTIME_INSPECTOR_PORT",
+                        resolvePort(
+                          EDGE_RUNTIME_INSPECTOR_PORT,
                           document,
-                          "edge_runtime",
-                          "inspector_port",
                           validatedConfig.edge_runtime.inspector_port,
                           context.projectEnvValues,
                         ),
diff --git a/apps/cli/src/command-internal/stack-local-database.ts b/apps/cli/src/command-internal/stack-local-database.ts
index 1dddca074e..613bb47d10 100644
--- a/apps/cli/src/command-internal/stack-local-database.ts
+++ b/apps/cli/src/command-internal/stack-local-database.ts
@@ -20,7 +20,11 @@ import {
   initializeStackDatabase,
   projectCatalogOverlay,
 } from "./stack-bootstrap.ts";
-import { automaticRuntimeNotice, selectStackRuntime } from "./stack-runtime.ts";
+import {
+  automaticRuntimeNotice,
+  recordStackRuntimeTelemetry,
+  selectStackRuntime,
+} from "./stack-runtime.ts";
 import { Output } from "../shared/output/output.service.ts";
 import type { PgConnInput } from "./db-connection.service.ts";
 
@@ -41,9 +45,12 @@ const databaseFor = (instances: StackInstances): DatabaseInstance | undefined =>
   instances.find((instance): instance is DatabaseInstance => instance.service === "database");
 
 const stackForProject = (api: StackApi["Service"], settings: Settings, path: Path.Path) =>
-  api
-    .find({ stateRoot: stateRoot(settings, path), projectRoot: settings.workdir })
-    .pipe(Effect.map(Option.getOrUndefined));
+  api.find({ stateRoot: stateRoot(settings, path), projectRoot: settings.workdir }).pipe(
+    Effect.map(Option.getOrUndefined),
+    Effect.tap((found) =>
+      found === undefined ? Effect.void : recordStackRuntimeTelemetry(found.definition.runtime),
+    ),
+  );
 
 const openProjectStack = Effect.fn("StackLocalDatabase.openProject")(function* () {
   const api = yield* StackApi;
diff --git a/apps/cli/src/command-internal/stack-log-events.ts b/apps/cli/src/command-internal/stack-log-events.ts
new file mode 100644
index 0000000000..f8ef296b09
--- /dev/null
+++ b/apps/cli/src/command-internal/stack-log-events.ts
@@ -0,0 +1,37 @@
+import type { LogRecord, StackLogRecord } from "@supabase/stack/effect";
+import type { StreamEvent } from "../shared/output/types.ts";
+
+/** Whether a record was read as history or followed live. */
+export type LogSource = "history" | "live";
+
+/** The `log-entry` or `log-marker` event of a record. */
+export const logEvent = (record: StackLogRecord, source: LogSource): StreamEvent => {
+  const subject = { service: record.service, instance_id: record.instanceId };
+  if (record.kind === "stdout" || record.kind === "stderr")
+    return {
+      type: "log-entry",
+      timestamp: record.timestamp,
+      source,
+      ...subject,
+      stream: record.kind,
+      line: record.text ?? "",
+    };
+  return {
+    type: "log-marker",
+    timestamp: record.timestamp,
+    source,
+    ...subject,
+    kind: record.kind,
+    ...(record.stream === undefined ? {} : { stream: record.stream }),
+    ...(record.count === undefined ? {} : { count: record.count }),
+  };
+};
+
+/** The text of a launch or lost marker, as `stack logs` prints it. */
+export const markerText = (record: LogRecord) => {
+  if (record.kind === "launch")
+    return record.launchId === undefined ? "--- launch ---" : `--- launch ${record.launchId} ---`;
+  if (record.count === undefined) return "--- older records were removed by retention ---";
+  const unit = record.count === 1 ? "chunk" : "chunks";
+  return `--- ${record.count} ${record.stream ?? "output"} ${unit} lost ---`;
+};
diff --git a/apps/cli/src/command-internal/stack-runtime.ts b/apps/cli/src/command-internal/stack-runtime.ts
index 86aa22ef6b..aa7fb4dcf3 100644
--- a/apps/cli/src/command-internal/stack-runtime.ts
+++ b/apps/cli/src/command-internal/stack-runtime.ts
@@ -8,10 +8,17 @@ import {
   type CliErrorActionabilityDeclaration,
   ErrorActionabilityId,
 } from "../shared/telemetry/error-actionability.ts";
+import { PropStackRuntime } from "../shared/telemetry/event-catalog.ts";
+import { withChildTraceEnv, withProcessSpan } from "../shared/telemetry/spans.ts";
+import { recordCommandTelemetry } from "../telemetry/command-telemetry-attributes.ts";
 
 /** Runtime that executes a local stack's services. */
 export type StackRuntime = "native" | "docker" | "podman";
 
+/** Records the runtime of the stack the enclosing command operates on. */
+export const recordStackRuntimeTelemetry = (runtime: StackRuntime) =>
+  recordCommandTelemetry({ [PropStackRuntime]: runtime });
+
 /** Raised when no reachable container engine exists or native is requested on an unsupported host. */
 export class StackRuntimeSelectionError extends Data.TaggedError("StackRuntimeSelectionError")<{
   readonly reason: "engine-unreachable" | "native-unsupported";
@@ -38,20 +45,30 @@ const engineReachable = (
   spawner: ChildProcessSpawner["Service"],
   probe: (typeof engineProbes)[number],
 ) =>
-  spawner
-    .exitCode(
-      ChildProcess.make(probe.runtime, probe.args, {
-        stdin: "ignore",
-        stdout: "ignore",
-        stderr: "ignore",
-        forceKillAfter: "1 second",
-      }),
-    )
-    .pipe(
-      Effect.timeout(PROBE_TIMEOUT),
-      Effect.map((exitCode) => exitCode === 0),
-      Effect.orElseSucceed(() => false),
-    );
+  withProcessSpan(
+    "StackRuntime.probeEngine",
+    {
+      executable: probe.runtime,
+      argCount: probe.args.length,
+      subcommand: probe.args[0],
+      hasFallback: true,
+    },
+    (traceEnv) =>
+      spawner.exitCode(
+        ChildProcess.make(
+          probe.runtime,
+          probe.args,
+          withChildTraceEnv(
+            { stdin: "ignore", stdout: "ignore", stderr: "ignore", forceKillAfter: "1 second" },
+            traceEnv,
+          ),
+        ),
+      ),
+  ).pipe(
+    Effect.timeout(PROBE_TIMEOUT),
+    Effect.map((exitCode) => exitCode === 0),
+    Effect.orElseSucceed(() => false),
+  );
 
 /**
  * Notice for a new stack whose automatic selection skipped Docker, since that runtime is saved with
@@ -97,4 +114,4 @@ export const selectStackRuntime = Effect.fn("StackRuntime.select")(function* (
     message: `Neither Docker nor Podman is reachable, and native stacks are not supported on ${platform}/${arch}.`,
     suggestion: "Start Docker or Podman, then rerun the command.",
   });
-});
+}, Effect.tap(recordStackRuntimeTelemetry));
diff --git a/apps/cli/src/command-internal/stack-runtime.unit.test.ts b/apps/cli/src/command-internal/stack-runtime.unit.test.ts
new file mode 100644
index 0000000000..79794d8306
--- /dev/null
+++ b/apps/cli/src/command-internal/stack-runtime.unit.test.ts
@@ -0,0 +1,26 @@
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Layer, Ref } from "effect";
+import { runtimeInfoLayer } from "../shared/runtime/runtime-info.layer.ts";
+import {
+  CommandTelemetryAttributes,
+  type CommandTelemetryAttributeValues,
+} from "../telemetry/command-telemetry-attributes.ts";
+import { selectStackRuntime } from "./stack-runtime.ts";
+
+describe("selectStackRuntime", () => {
+  it.effect("records the selected runtime on the command event", () =>
+    Effect.gen(function* () {
+      const recorded = yield* Ref.make<CommandTelemetryAttributeValues>({});
+
+      const runtime = yield* selectStackRuntime("podman").pipe(
+        Effect.provideService(CommandTelemetryAttributes, {
+          record: (values) => Ref.update(recorded, (current) => ({ ...current, ...values })),
+        }),
+      );
+
+      expect(runtime).toBe("podman");
+      expect((yield* Ref.get(recorded)).stack_runtime).toBe("podman");
+    }).pipe(Effect.provide(Layer.mergeAll(BunServices.layer, runtimeInfoLayer))),
+  );
+});
diff --git a/apps/cli/src/command-internal/stack-shadow.integration.test.ts b/apps/cli/src/command-internal/stack-shadow.integration.test.ts
index ca7dae1a4b..40b038279b 100644
--- a/apps/cli/src/command-internal/stack-shadow.integration.test.ts
+++ b/apps/cli/src/command-internal/stack-shadow.integration.test.ts
@@ -7,7 +7,7 @@ import { mockOutput } from "../../tests/helpers/mocks.ts";
 import { mockCommandSettings } from "../../tests/helpers/command-mocks.ts";
 import { runtimeInfoLayer } from "../shared/runtime/runtime-info.layer.ts";
 import { DbConnection } from "./db-connection.service.ts";
-import { dbConnectionLayer } from "./db-connection.layer.ts";
+import { dbConnectionLayer } from "./db-connection.sql-pg.layer.ts";
 import { StackApi, stackApiLayer } from "./stack-api.ts";
 import { StackCatalogSetup, stackCatalogSetupLayer } from "./stack-catalog-setup.ts";
 import { parseConnectionString } from "./db-config.parse.ts";
diff --git a/apps/cli/src/command-internal/stack-storage.native.integration.test.ts b/apps/cli/src/command-internal/stack-storage.native.integration.test.ts
index 0abdee8627..15b735a500 100644
--- a/apps/cli/src/command-internal/stack-storage.native.integration.test.ts
+++ b/apps/cli/src/command-internal/stack-storage.native.integration.test.ts
@@ -4,7 +4,7 @@ import { Effect, FileSystem, Layer, Option, Path, Stream } from "effect";
 import { FetchHttpClient } from "effect/unstable/http";
 
 import { CommandPlatformApiFactory } from "../auth/command-platform-api-factory.service.ts";
-import { dbConnectionLayer } from "./db-connection.layer.ts";
+import { dbConnectionLayer } from "./db-connection.sql-pg.layer.ts";
 import { stackCatalogSetupLayer } from "./stack-catalog-setup.ts";
 import {
   classifyStorageCapability,
diff --git a/apps/cli/src/command-internal/status-values.ts b/apps/cli/src/command-internal/status-values.ts
index 9c5c430a62..5f5e1d6d36 100644
--- a/apps/cli/src/command-internal/status-values.ts
+++ b/apps/cli/src/command-internal/status-values.ts
@@ -337,9 +337,10 @@ export function gateStatusState(
   const { edgeRuntimeEnabled, storageS3ProtocolEnabled } = localState;
   const isExcluded = (id: string) => excluded.includes(id);
 
-  const kongEnabled = apiEnabled && !isExcluded(containerIds.kong) && !isExcluded(KONG_IMAGE_NAME);
+  // `start` runs Kong regardless of `api.enabled`, which gates only PostgREST.
+  const kongEnabled = !isExcluded(containerIds.kong) && !isExcluded(KONG_IMAGE_NAME);
   const postgrestEnabled =
-    kongEnabled && !isExcluded(containerIds.rest) && !isExcluded(POSTGREST_IMAGE_NAME);
+    apiEnabled && !isExcluded(containerIds.rest) && !isExcluded(POSTGREST_IMAGE_NAME);
   const studioEnabled =
     studioSectionEnabled && !isExcluded(containerIds.studio) && !isExcluded(STUDIO_IMAGE_NAME);
   const authEnabled =
diff --git a/apps/cli/src/command-internal/status-values.unit.test.ts b/apps/cli/src/command-internal/status-values.unit.test.ts
index 87e9167744..a5793494f8 100644
--- a/apps/cli/src/command-internal/status-values.unit.test.ts
+++ b/apps/cli/src/command-internal/status-values.unit.test.ts
@@ -40,7 +40,14 @@ describe("statusValues", () => {
       storage: { enabled: false },
       edge_runtime: { enabled: false },
     });
-    const { values } = statusValues(config, CONTAINER_IDS, HOSTNAME, NONE, NO_OVERRIDES, WORKDIR);
+    const { values } = statusValues(
+      config,
+      CONTAINER_IDS,
+      HOSTNAME,
+      [CONTAINER_IDS.kong],
+      NO_OVERRIDES,
+      WORKDIR,
+    );
     expect(Object.keys(values)).toEqual(["DB_URL"]);
     expect(values.DB_URL).toContain("postgresql://postgres:postgres@127.0.0.1");
   });
@@ -58,10 +65,14 @@ describe("statusValues", () => {
       expect(values.API_URL).toBeDefined();
     });
 
-    it("omits API_URL when api.enabled is false", () => {
+    it("keeps the Kong URLs but omits REST/GraphQL when api.enabled is false", () => {
       const config = baseConfig({ api: { enabled: false } });
       const { values } = statusValues(config, CONTAINER_IDS, HOSTNAME, NONE, NO_OVERRIDES, WORKDIR);
-      expect(values.API_URL).toBeUndefined();
+      expect(values.API_URL).toBeDefined();
+      expect(values.FUNCTIONS_URL).toBeDefined();
+      expect(values.MCP_URL).toBeDefined();
+      expect(values.REST_URL).toBeUndefined();
+      expect(values.GRAPHQL_URL).toBeUndefined();
     });
 
     it("omits API_URL when the kong container id is excluded", () => {
@@ -89,8 +100,14 @@ describe("statusValues", () => {
     });
 
     it("omits REST/GraphQL when kong is disabled even though postgrest is enabled", () => {
-      const config = baseConfig({ api: { enabled: false } });
-      const { values } = statusValues(config, CONTAINER_IDS, HOSTNAME, NONE, NO_OVERRIDES, WORKDIR);
+      const { values } = statusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        [CONTAINER_IDS.kong],
+        NO_OVERRIDES,
+        WORKDIR,
+      );
       expect(values.REST_URL).toBeUndefined();
       expect(values.GRAPHQL_URL).toBeUndefined();
     });
@@ -157,8 +174,14 @@ describe("statusValues", () => {
     });
 
     it("omits FUNCTIONS_URL when kong is disabled even though edge_runtime is enabled", () => {
-      const config = baseConfig({ api: { enabled: false } });
-      const { values } = statusValues(config, CONTAINER_IDS, HOSTNAME, NONE, NO_OVERRIDES, WORKDIR);
+      const { values } = statusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        [CONTAINER_IDS.kong],
+        NO_OVERRIDES,
+        WORKDIR,
+      );
       expect(values.FUNCTIONS_URL).toBeUndefined();
     });
 
@@ -245,8 +268,14 @@ describe("statusValues", () => {
     });
 
     it("omits MCP_URL when kong is disabled", () => {
-      const config = baseConfig({ api: { enabled: false } });
-      const { values } = statusValues(config, CONTAINER_IDS, HOSTNAME, NONE, NO_OVERRIDES, WORKDIR);
+      const { values } = statusValues(
+        baseConfig(),
+        CONTAINER_IDS,
+        HOSTNAME,
+        [CONTAINER_IDS.kong],
+        NO_OVERRIDES,
+        WORKDIR,
+      );
       expect(values.MCP_URL).toBeUndefined();
     });
 
@@ -432,7 +461,7 @@ describe("statusValues", () => {
       expect(values.REST_URL).toBeDefined();
     });
 
-    it("omits API_URL when SUPABASE_API_ENABLED=false overrides an enabled api.enabled", () => {
+    it("omits REST_URL when SUPABASE_API_ENABLED=false overrides an enabled api.enabled", () => {
       const { values } = statusValues(
         baseConfig(),
         CONTAINER_IDS,
@@ -442,7 +471,8 @@ describe("statusValues", () => {
         WORKDIR,
         { SUPABASE_API_ENABLED: "false" },
       );
-      expect(values.API_URL).toBeUndefined();
+      expect(values.REST_URL).toBeUndefined();
+      expect(values.API_URL).toBeDefined();
     });
 
     it("includes STUDIO_URL when SUPABASE_STUDIO_ENABLED overrides a disabled studio.enabled", () => {
diff --git a/apps/cli/src/command-internal/test-db.layers.ts b/apps/cli/src/command-internal/test-db.layers.ts
index 1da3775110..2ba9df6c0f 100644
--- a/apps/cli/src/command-internal/test-db.layers.ts
+++ b/apps/cli/src/command-internal/test-db.layers.ts
@@ -2,7 +2,7 @@ import { Layer } from "effect";
 
 import { commandSettingsLayer } from "../config/command-settings.layer.ts";
 import { dbConfigLayer } from "./db-config.layer.ts";
-import { dbConnectionLayer } from "./db-connection.layer.ts";
+import { dbConnectionLayer } from "./db-connection.sql-pg.layer.ts";
 import { dockerRunLayer } from "./docker-run.layer.ts";
 import { identityStitchLayer } from "./identity-stitch.ts";
 import { debugLoggerLayer } from "./debug-logger.layer.ts";
diff --git a/apps/cli/src/command-internal/test-db.native.integration.test.ts b/apps/cli/src/command-internal/test-db.native.integration.test.ts
index d8f52694fb..6377dabdbe 100644
--- a/apps/cli/src/command-internal/test-db.native.integration.test.ts
+++ b/apps/cli/src/command-internal/test-db.native.integration.test.ts
@@ -13,7 +13,7 @@ import { CliArgs } from "../shared/cli/cli-args.service.ts";
 import { RuntimeInfo } from "../shared/runtime/runtime-info.service.ts";
 import { DbConfigResolver } from "./db-config.service.ts";
 import { BundledPostgresClient } from "./bundled-postgres-client.ts";
-import { dbConnectionLayer } from "./db-connection.layer.ts";
+import { dbConnectionLayer } from "./db-connection.sql-pg.layer.ts";
 import { DbConnection } from "./db-connection.service.ts";
 import { parseConnectionString } from "./db-config.parse.ts";
 import { DebugFlag, DnsResolverFlag, NetworkIdFlag } from "./global-flags.ts";
diff --git a/apps/cli/src/command-internal/upgrade-notice.integration.test.ts b/apps/cli/src/command-internal/upgrade-notice.integration.test.ts
new file mode 100644
index 0000000000..75dbb060d4
--- /dev/null
+++ b/apps/cli/src/command-internal/upgrade-notice.integration.test.ts
@@ -0,0 +1,94 @@
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, utimesSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { stripVTControlCharacters } from "node:util";
+
+import { Effect } from "effect";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import { upgradeNoticeHook } from "./upgrade-notice.ts";
+
+describe("upgrade notice user-level cache", () => {
+  let root: string;
+  let workdir: string;
+  let supabaseHome: string;
+  let cacheFile: string;
+
+  beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), "supabase-upgrade-notice-home-"));
+    workdir = join(root, "outside-project");
+    supabaseHome = join(root, "supabase-home");
+    cacheFile = join(supabaseHome, "cli-latest");
+    mkdirSync(workdir);
+  });
+
+  afterEach(() => {
+    rmSync(root, { recursive: true, force: true });
+  });
+
+  function writeUserCache(tag: string, ageMs: number) {
+    mkdirSync(supabaseHome, { recursive: true });
+    writeFileSync(cacheFile, tag);
+    const then = new Date(Date.now() - ageMs);
+    utimesSync(cacheFile, then, then);
+  }
+
+  /** Runs the production hook with real `SUPABASE_HOME` resolution and a stub release fetch. */
+  async function runHook(latestTag: string) {
+    let fetchCalls = 0;
+    const written: Array<string> = [];
+    const realWrite = process.stderr.write.bind(process.stderr);
+    const realEnv = {
+      SUPABASE_HOME: process.env["SUPABASE_HOME"],
+      SUPABASE_NO_UPDATE_NOTIFIER: process.env["SUPABASE_NO_UPDATE_NOTIFIER"],
+    };
+    process.env["SUPABASE_HOME"] = supabaseHome;
+    process.env["SUPABASE_NO_UPDATE_NOTIFIER"] = "0";
+    process.stderr.write = ((chunk: unknown) => {
+      written.push(String(chunk));
+      return true;
+    }) as typeof process.stderr.write;
+    try {
+      await Effect.runPromise(
+        upgradeNoticeHook(
+          ["projects", "list"],
+          {
+            cleanShowHelp: false,
+            delegatedToGo: false,
+            workingDirectory: workdir,
+            isValueTakingFlagToken: () => false,
+          },
+          () => {
+            fetchCalls += 1;
+            return Promise.resolve(latestTag);
+          },
+        ),
+      );
+    } finally {
+      process.stderr.write = realWrite;
+      for (const [key, value] of Object.entries(realEnv)) {
+        if (value === undefined) delete process.env[key];
+        else process.env[key] = value;
+      }
+    }
+    return { fetchCalls, stderr: stripVTControlCharacters(written.join("")) };
+  }
+
+  it("serves a fresh SUPABASE_HOME cache outside a project without fetching", async () => {
+    writeUserCache("v99.99.99", 60_000);
+
+    const { fetchCalls, stderr } = await runHook("v99.99.100");
+
+    expect(fetchCalls).toBe(0);
+    expect(stderr).toContain("A new version of Supabase CLI is available: v99.99.99");
+  });
+
+  it("refetches a stale SUPABASE_HOME cache and records the new tag", async () => {
+    writeUserCache("v2.100.0", 11 * 60 * 60 * 1000);
+
+    const { fetchCalls } = await runHook("v99.99.100");
+
+    expect(fetchCalls).toBe(1);
+    expect(readFileSync(cacheFile, "utf8")).toBe("v99.99.100");
+  });
+});
diff --git a/apps/cli/src/command-internal/upgrade-notice.ts b/apps/cli/src/command-internal/upgrade-notice.ts
index c9cdb271cc..7c3d1509c4 100644
--- a/apps/cli/src/command-internal/upgrade-notice.ts
+++ b/apps/cli/src/command-internal/upgrade-notice.ts
@@ -1,12 +1,14 @@
 /**
  * Post-command upgrade notice: checks GitHub's latest release against the
  * running version and prints a notice to stderr, honoring
- * `SUPABASE_NO_UPDATE_NOTIFIER`. A failed fetch writes an empty cache as an
- * offline backoff.
+ * `SUPABASE_NO_UPDATE_NOTIFIER`. The tag is cached in the project's
+ * `supabase/.temp/cli-latest`, else `<SUPABASE_HOME>/cli-latest`. A failed
+ * fetch writes an empty cache as an offline backoff.
  */
 
 import { lstat, mkdir, open, readFile } from "node:fs/promises";
 import { constants as fsConstants, existsSync } from "node:fs";
+import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { stripVTControlCharacters } from "node:util";
 
@@ -14,11 +16,11 @@ import { Effect } from "effect";
 
 import {
   hasRootHelpOrVersionFlag,
-  hasRootVersionFlag,
   lastGlobalFlagValue,
   rootFlagTokens,
 } from "../shared/cli/run.ts";
 import { CLI_UPGRADE_GUIDE_URL, CLI_VERSION, parseSemver } from "../shared/cli/version.ts";
+import { resolveSupabaseHome } from "../shared/config/supabase-home.ts";
 import { bold, yellow } from "./colors.ts";
 import { parseDotEnv } from "./dotenv.ts";
 import { candidateDotenvFilenames } from "./project-environment.ts";
@@ -26,7 +28,7 @@ import { candidateDotenvFilenames } from "./project-environment.ts";
 const LATEST_RELEASE_URL = "https://api.github.com/repos/supabase/cli/releases/latest";
 const CACHE_TTL_MS = 10 * 60 * 60 * 1000;
 /** Bounds this pre-exit hook's latency. */
-const FETCH_TIMEOUT_MS = 3000;
+const FETCH_TIMEOUT_MS = 800;
 
 /** Recognized "true" spellings; anything else, including garbage, leaves the notifier on. */
 const PARSE_BOOL_TRUE = new Set(["1", "t", "T", "TRUE", "true", "True"]);
@@ -214,12 +216,23 @@ export interface UpgradeNoticeDeps {
   readonly cwd: string;
   readonly resolvedCwd?: string;
   readonly currentVersion: string;
+  /** The cache directory when `<base>/supabase` is not a real directory. */
+  readonly supabaseHome: string;
   readonly now: () => number;
   readonly fetchLatestTag: () => Promise<string>;
   readonly writeStderr: (text: string) => void;
 }
 
-export async function runUpgradeNotice(deps: UpgradeNoticeDeps): Promise<void> {
+/** The release-tag cache a check used, recorded on its trace span. */
+export interface UpgradeCheckOutcome {
+  readonly cache: "project" | "user" | "disabled";
+  readonly cacheFresh: boolean;
+}
+
+/** Resolves to `undefined` when the notifier is opted out. */
+export async function runUpgradeNotice(
+  deps: UpgradeNoticeDeps,
+): Promise<UpgradeCheckOutcome | undefined> {
   if (updateNotifierDisabled(deps.env["SUPABASE_NO_UPDATE_NOTIFIER"])) return;
 
   // `--help`/`--version` and a bare group's clean ShowHelp resolve the cache
@@ -240,8 +253,10 @@ export async function runUpgradeNotice(deps: UpgradeNoticeDeps): Promise<void> {
   if (updateNotifierDisabled(effectiveEnv("SUPABASE_NO_UPDATE_NOTIFIER"))) return;
   const debug = debugEnabled(deps, builtin, effectiveEnv("SUPABASE_DEBUG"));
   const supabaseDir = join(base, "supabase");
-  const tempDir = join(supabaseDir, ".temp");
-  const cacheFile = join(tempDir, "cli-latest");
+  const inProject = (await lstat(supabaseDir).catch(() => undefined))?.isDirectory() === true;
+  // `resolve` drops a trailing `/` or `/.`, which would make `lstat` follow a symlinked home.
+  const cacheDir = inProject ? join(supabaseDir, ".temp") : resolve(deps.supabaseHome);
+  const cacheFile = join(cacheDir, "cli-latest");
 
   // A hostile checkout can commit a symlink at any level of this well-known
   // path to clobber an arbitrary user-writable file (CWE-59), so a symlink
@@ -250,29 +265,25 @@ export async function runUpgradeNotice(deps: UpgradeNoticeDeps): Promise<void> {
   // `writeCacheFileNoFollow` for the write-time guarantee.
   const cacheLstat = await lstat(cacheFile).catch(() => undefined);
   const cachePathIsSafe =
-    cacheLstat?.isSymbolicLink() !== true &&
-    (await isRealDirOrAbsent(supabaseDir)) &&
-    (await isRealDirOrAbsent(tempDir));
+    cacheLstat?.isSymbolicLink() !== true && (await isRealDirOrAbsent(cacheDir));
 
-  // A subcommand's own `--version` must not bypass the cache.
-  const forceFetch = hasRootVersionFlag(deps.args, deps.isValueTakingFlagToken);
   const cacheFresh =
     cachePathIsSafe &&
     cacheLstat !== undefined &&
     deps.now() <= cacheLstat.mtime.getTime() + CACHE_TTL_MS;
 
   let latestTag: string;
-  if (forceFetch || !cacheFresh) {
+  if (!cacheFresh) {
     let notifyError: Error | undefined;
     latestTag = await deps.fetchLatestTag().catch((error: unknown) => {
       notifyError = new Error(`Failed to fetch latest release: ${errorMessage(error)}`);
       return "";
     });
-    // The offline-backoff write's result overwrites the fetch error when
-    // inside a project, so a successful write silences the diagnostic; only a
-    // missing project (no backoff) or a failing write leaves an error to log.
-    if (cachePathIsSafe && existsSync(supabaseDir)) {
-      notifyError = await mkdir(tempDir, { recursive: true, mode: 0o755 }).then(
+    // The offline-backoff write's result overwrites the fetch error, so a
+    // successful write silences the diagnostic; only an unsafe cache path (no
+    // backoff) or a failing write leaves an error to log.
+    if (cachePathIsSafe) {
+      notifyError = await mkdir(cacheDir, { recursive: true, mode: 0o755 }).then(
         () =>
           writeCacheFileNoFollow(cacheFile, latestTag).then(
             () => undefined,
@@ -299,6 +310,7 @@ export async function runUpgradeNotice(deps: UpgradeNoticeDeps): Promise<void> {
   if (isNewerCliVersion(latestTag, deps.currentVersion)) {
     deps.writeStderr(`${formatUpgradeNotice(latestTag, deps.currentVersion)}\n`);
   }
+  return { cache: cachePathIsSafe ? (inProject ? "project" : "user") : "disabled", cacheFresh };
 }
 
 async function fetchLatestReleaseTag(): Promise<string> {
@@ -331,22 +343,39 @@ export const upgradeNoticeHook = (
     readonly workingDirectory?: string;
     readonly isValueTakingFlagToken: (token: string) => boolean;
   },
+  fetchLatestTag: () => Promise<string> = fetchLatestReleaseTag,
 ): Effect.Effect<void> =>
   info.delegatedToGo
     ? Effect.void
-    : Effect.promise(() =>
-        runUpgradeNotice({
-          env: process.env,
-          args,
-          cleanShowHelp: info.cleanShowHelp,
-          isValueTakingFlagToken: info.isValueTakingFlagToken,
-          cwd: process.cwd(),
-          resolvedCwd: info.workingDirectory,
-          currentVersion: CLI_VERSION,
-          now: Date.now,
-          fetchLatestTag: fetchLatestReleaseTag,
-          writeStderr: (text) => {
-            process.stderr.write(text);
-          },
-        }),
-      ).pipe(Effect.ignoreCause);
+    : Effect.gen(function* () {
+        const context = yield* Effect.context();
+        const outcome = yield* Effect.promise(() =>
+          runUpgradeNotice({
+            env: process.env,
+            args,
+            cleanShowHelp: info.cleanShowHelp,
+            isValueTakingFlagToken: info.isValueTakingFlagToken,
+            cwd: process.cwd(),
+            resolvedCwd: info.workingDirectory,
+            currentVersion: CLI_VERSION,
+            supabaseHome: resolveSupabaseHome({ join }, process.env, homedir()),
+            now: Date.now,
+            // Runs under the check span's context so the fetch is its child span.
+            fetchLatestTag: () =>
+              Effect.runPromiseWith(context)(
+                Effect.tryPromise({ try: fetchLatestTag, catch: (error) => error }).pipe(
+                  Effect.withSpan("UpgradeNotice.fetch"),
+                ),
+              ),
+            writeStderr: (text) => {
+              process.stderr.write(text);
+            },
+          }),
+        );
+        if (outcome !== undefined) {
+          yield* Effect.annotateCurrentSpan({
+            "cache.location": outcome.cache,
+            "cache.hit": outcome.cacheFresh,
+          });
+        }
+      }).pipe(Effect.withSpan("UpgradeNotice.check"), Effect.ignoreCause);
diff --git a/apps/cli/src/command-internal/upgrade-notice.unit.test.ts b/apps/cli/src/command-internal/upgrade-notice.unit.test.ts
index 62c3243b89..89458d139b 100644
--- a/apps/cli/src/command-internal/upgrade-notice.unit.test.ts
+++ b/apps/cli/src/command-internal/upgrade-notice.unit.test.ts
@@ -16,7 +16,7 @@ import { join } from "node:path";
 import { stripVTControlCharacters } from "node:util";
 
 import { describe, expect, it } from "vitest";
-import { Effect } from "effect";
+import { Effect, Option, Tracer } from "effect";
 
 import {
   type UpgradeNoticeDeps,
@@ -109,6 +109,11 @@ describe("runUpgradeNotice", () => {
         utimesSync(cacheFile, then, then);
       }
     }
+    // A symlinked SUPABASE_HOME disables the user-level cache, so runs outside a
+    // project record no backoff.
+    const supabaseHome = join(workdir, "home");
+    mkdirSync(join(workdir, "home-target"));
+    symlinkSync(join(workdir, "home-target"), supabaseHome);
     let fetchCalls = 0;
     const stderr: Array<string> = [];
     const deps: UpgradeNoticeDeps = {
@@ -116,6 +121,7 @@ describe("runUpgradeNotice", () => {
       args: opts.args ?? ["db", "start"],
       cwd: workdir,
       currentVersion: opts.currentVersion ?? "2.113.0",
+      supabaseHome,
       now: Date.now,
       fetchLatestTag: () => {
         fetchCalls += 1;
@@ -191,10 +197,11 @@ describe("runUpgradeNotice", () => {
     ctx.cleanup();
   });
 
-  it("--version forces a fetch through a fresh cache", async () => {
+  it("--version reads a fresh cache instead of fetching", async () => {
     const ctx = setup({ args: ["--version"], cacheContent: "v2.115.0", cacheAgeMs: 60_000 });
     await runUpgradeNotice(ctx.deps);
-    expect(ctx.fetchCalls).toBe(1);
+    expect(ctx.fetchCalls).toBe(0);
+    expect(ctx.stderr).toContain("v2.115.0");
     ctx.cleanup();
   });
 
@@ -248,7 +255,7 @@ describe("runUpgradeNotice", () => {
     ctx.cleanup();
   });
 
-  it("a failed fetch surfaces its error under --debug when there is no project to back off in", async () => {
+  it("a failed fetch surfaces its error under --debug when no cache can record the backoff", async () => {
     const ctx = setup({ fetchFails: true, project: false, args: ["db", "start", "--debug"] });
     await runUpgradeNotice(ctx.deps);
     expect(ctx.stderr).toContain("Failed to fetch latest release");
@@ -339,8 +346,8 @@ describe("runUpgradeNotice", () => {
   });
 
   it("a false root version flag before a leaf runs the normal path, workdir included", async () => {
-    // `--version=false <leaf>` still marks the flag as set, forcing the fetch;
-    // only the built-in classification must not trigger.
+    // `--version=false <leaf>` is not the version built-in, so the cache
+    // resolves under `--workdir`.
     const ctx = setup({ project: false });
     const flagged = join(workdir, "flagged");
     mkdirSync(join(flagged, "supabase"), { recursive: true });
@@ -399,14 +406,6 @@ describe("runUpgradeNotice", () => {
     ctx.cleanup();
   });
 
-  it("outside a project the notice still prints but nothing is cached", async () => {
-    const ctx = setup({ project: false });
-    await runUpgradeNotice(ctx.deps);
-    expect(ctx.stderr).toContain("v2.114.0");
-    expect(() => readFileSync(ctx.cachePath, "utf8")).toThrow();
-    ctx.cleanup();
-  });
-
   it("resolves the cache under --workdir, then SUPABASE_WORKDIR, ahead of the cwd walk", async () => {
     const ctx = setup({ project: false });
     const flagDir = join(workdir, "flag-project");
@@ -614,6 +613,16 @@ describe("runUpgradeNotice", () => {
     },
   );
 
+  it.each(["", "/", "/."])(
+    "never writes through a symlinked SUPABASE_HOME spelled with suffix %j",
+    async (suffix) => {
+      const ctx = setup({ project: false });
+      await runUpgradeNotice({ ...ctx.deps, supabaseHome: `${ctx.deps.supabaseHome}${suffix}` });
+      expect(readdirSync(join(workdir, "home-target"))).toEqual([]);
+      ctx.cleanup();
+    },
+  );
+
   it("validates exact cache bytes and rejects embedded escape bytes", async () => {
     for (const cacheContent of ["v2.115.0\n", "v2.115.0\r\n", "v2.115.0\u001b[31mboo"]) {
       const ctx = setup({ cacheContent, cacheAgeMs: 60_000 });
@@ -631,13 +640,21 @@ describe("runUpgradeNotice", () => {
  * to one command would break the moment it's ported.
  */
 describe("upgradeNoticeHook", () => {
-  async function stderrFromHook(delegatedToGo: boolean): Promise<string> {
+  async function runHook(opts: { readonly delegatedToGo?: boolean; readonly cached?: boolean }) {
     const workdir = mkdtempSync(join(tmpdir(), "supabase-upgrade-notice-hook-"));
     mkdirSync(join(workdir, "supabase", ".temp"), { recursive: true });
     writeFileSync(join(workdir, "supabase", "config.toml"), 'project_id = "demo"\n');
-    // Fresh cache: the hook reads it instead of fetching, so this never touches
-    // the network.
-    writeFileSync(join(workdir, "supabase", ".temp", "cli-latest"), "v99.99.99");
+    if (opts.cached !== false) {
+      writeFileSync(join(workdir, "supabase", ".temp", "cli-latest"), "v99.99.99");
+    }
+    const spans: Array<Tracer.NativeSpan> = [];
+    const tracer = Tracer.make({
+      span: (options) => {
+        const span = new Tracer.NativeSpan(options);
+        spans.push(span);
+        return span;
+      },
+    });
 
     const written: Array<string> = [];
     const realWrite = process.stderr.write.bind(process.stderr);
@@ -650,12 +667,16 @@ describe("upgradeNoticeHook", () => {
 
     try {
       await Effect.runPromise(
-        upgradeNoticeHook(["db", "branch", "list"], {
-          cleanShowHelp: false,
-          delegatedToGo,
-          workingDirectory: workdir,
-          isValueTakingFlagToken: () => false,
-        }),
+        upgradeNoticeHook(
+          ["db", "branch", "list"],
+          {
+            cleanShowHelp: false,
+            delegatedToGo: opts.delegatedToGo === true,
+            workingDirectory: workdir,
+            isValueTakingFlagToken: () => false,
+          },
+          () => Promise.resolve("v99.99.99"),
+        ).pipe(Effect.withTracer(tracer), Effect.withTracerEnabled(true)),
       );
     } finally {
       process.stderr.write = realWrite;
@@ -663,16 +684,37 @@ describe("upgradeNoticeHook", () => {
       else process.env["SUPABASE_NO_UPDATE_NOTIFIER"] = realOptOut;
       rmSync(workdir, { recursive: true, force: true });
     }
-    return stripVTControlCharacters(written.join(""));
+    const span = (name: string) => spans.find((candidate) => candidate.name === name);
+    return { stderr: stripVTControlCharacters(written.join("")), span };
   }
 
   it("prints the notice for a natively handled command", async () => {
-    expect(await stderrFromHook(false)).toContain(
+    expect((await runHook({})).stderr).toContain(
       "A new version of Supabase CLI is available: v99.99.99",
     );
   });
 
   it("stays silent when the run delegated to Go, which printed its own notice", async () => {
-    expect(await stderrFromHook(true)).toBe("");
+    expect((await runHook({ delegatedToGo: true })).stderr).toBe("");
+  });
+
+  it("traces a cache hit on the check span without a fetch span", async () => {
+    const { span } = await runHook({});
+    expect(Object.fromEntries(span("UpgradeNotice.check")!.attributes)).toEqual({
+      "cache.location": "project",
+      "cache.hit": true,
+    });
+    expect(span("UpgradeNotice.fetch")).toBeUndefined();
+  });
+
+  it("traces a cache miss with the release fetch as a child of the check span", async () => {
+    const { span } = await runHook({ cached: false });
+    const check = span("UpgradeNotice.check")!;
+    expect(Object.fromEntries(check.attributes)).toEqual({
+      "cache.location": "project",
+      "cache.hit": false,
+    });
+    const parent = span("UpgradeNotice.fetch")!.parent;
+    expect(Option.isSome(parent) ? parent.value.spanId : undefined).toBe(check.spanId);
   });
 });
diff --git a/apps/cli/src/command-internal/upgrade-suggest.ts b/apps/cli/src/command-internal/upgrade-suggest.ts
index d370386cc1..345b95182d 100644
--- a/apps/cli/src/command-internal/upgrade-suggest.ts
+++ b/apps/cli/src/command-internal/upgrade-suggest.ts
@@ -80,7 +80,7 @@ export const gateMapError =
  * `linked-project-cache.layer.ts`). Returns whether the feature was
  * confirmed plan-gated.
  */
-export const suggestUpgrade = Effect.fnUntraced(function* (opts: {
+export const suggestUpgrade = Effect.fn("UpgradeSuggest.check")(function* (opts: {
   readonly projectRef: string;
   /**
    * Entitlements-fallback key. Omit for envelope-only sites: the domains
@@ -116,6 +116,7 @@ export const suggestUpgrade = Effect.fnUntraced(function* (opts: {
   const analytics = yield* Analytics;
   const cliSettings = yield* CommandSettings;
   const httpClient = yield* HttpClient.HttpClient;
+  yield* Effect.annotateCurrentSpan("upgrade.gated", false);
 
   let gate:
     | { readonly billingUrl: string; readonly feature: string; readonly orgSlug: string }
@@ -203,6 +204,7 @@ export const suggestUpgrade = Effect.fnUntraced(function* (opts: {
     };
   }
 
+  yield* Effect.annotateCurrentSpan("upgrade.gated", true);
   const suggestion = `Your organization does not have access to this feature. Upgrade your plan: ${styleText("bold", gate.billingUrl)}`;
 
   if (output.format === "text") {
diff --git a/apps/cli/src/commands/backups/list/list.handler.ts b/apps/cli/src/commands/backups/list/list.handler.ts
index 7c6289d062..adfaf43399 100644
--- a/apps/cli/src/commands/backups/list/list.handler.ts
+++ b/apps/cli/src/commands/backups/list/list.handler.ts
@@ -22,7 +22,7 @@ import {
 } from "../../../command-internal/go-struct-output.encoders.ts";
 import { mapHttpError } from "../../../command-internal/http-errors.ts";
 import { formatTimestamp } from "../../../command-internal/timestamp.format.ts";
-import { formatRegion } from "../backups.format.ts";
+import { formatRegion } from "../../../command-internal/region.format.ts";
 import type { BackupsListFlags } from "./list.command.ts";
 
 /** Struct shape for `-o yaml|toml` encoding of the backups response. */
diff --git a/apps/cli/src/commands/bootstrap/bootstrap.handler.ts b/apps/cli/src/commands/bootstrap/bootstrap.handler.ts
index 44d8752802..771a43daa0 100644
--- a/apps/cli/src/commands/bootstrap/bootstrap.handler.ts
+++ b/apps/cli/src/commands/bootstrap/bootstrap.handler.ts
@@ -129,6 +129,7 @@ export const bootstrap = Effect.fn("bootstrap")(function* (
       );
       starter = allTemplates.find((t) => t.name === choice) ?? SCRATCH_TEMPLATE;
     }
+    yield* Effect.annotateCurrentSpan("template.name", starter.name);
 
     const experimentalStack =
       starter.url.length === 0
@@ -181,7 +182,7 @@ export const bootstrap = Effect.fn("bootstrap")(function* (
         withVscodeSettings: false,
         withIntellijSettings: false,
         experimentalStack,
-      });
+      }).pipe(Effect.withSpan("bootstrap.initProject"));
     }
 
     yield* ensureLogin({ openBrowser: tty.stdinIsTty });
@@ -205,6 +206,7 @@ export const bootstrap = Effect.fn("bootstrap")(function* (
     });
     const projectRef = created.ref;
     createdRef = projectRef.length > 0 ? projectRef : undefined;
+    yield* Effect.annotateCurrentSpan("project.ref", projectRef);
 
     // A fresh notifier per retry block keeps this step's "Retry (n/8)" counter independent of
     // the health-poll and push retries below.
@@ -212,14 +214,18 @@ export const bootstrap = Effect.fn("bootstrap")(function* (
     const keys = yield* Effect.gen(function* () {
       if (isText) yield* output.raw("Linking project...\n", "stderr");
       return yield* getProjectApiKeys(projectRef);
-    }).pipe(apiKeysNotify, Effect.retry(retry));
+    }).pipe(apiKeysNotify, Effect.retry(retry), Effect.withSpan("bootstrap.fetchApiKeys"));
     const { anon } = extractServiceKeys(keys);
 
     // Config load must run before link/health/`.env` steps: a malformed config.toml aborts here
     // rather than after side effects start.
-    const projectEnv = yield* loadProjectEnv(fs, path, workdir);
-    const pushYes = yield* resolveYesWithProjectEnv(projectEnv);
-    const toml = yield* checkDbToml(fs, path, workdir, projectRef);
+    const { pushYes, toml } = yield* Effect.gen(function* () {
+      const projectEnv = yield* loadProjectEnv(fs, path, workdir);
+      return {
+        pushYes: yield* resolveYesWithProjectEnv(projectEnv),
+        toml: yield* checkDbToml(fs, path, workdir, projectRef),
+      };
+    }).pipe(Effect.withSpan("bootstrap.loadConfig"));
     if (toml.appliedRemote !== undefined) {
       yield* output.raw(`Loading config override: [remotes.${toml.appliedRemote}]\n`, "stderr");
     }
@@ -247,7 +253,12 @@ export const bootstrap = Effect.fn("bootstrap")(function* (
           });
         }
       }
-    }).pipe(healthNotify, Effect.retry(retry));
+    }).pipe(
+      Effect.withTracerEnabled(false),
+      healthNotify,
+      Effect.retry(retry),
+      Effect.withSpan("bootstrap.waitHealthy"),
+    );
 
     // Uses a naive direct-host db config with no IPv6/pooler fallback, since `.env` is written
     // for reference only and, unlike the push connection below, is never used to actually connect.
@@ -281,6 +292,7 @@ export const bootstrap = Effect.fn("bootstrap")(function* (
           );
         }),
       ),
+      Effect.withSpan("bootstrap.writeDotEnv"),
     );
 
     // `resolveLinkedConn` doesn't attach a suggestionContext like the full resolver does; build
@@ -323,7 +335,7 @@ export const bootstrap = Effect.fn("bootstrap")(function* (
       toml,
       yes: pushYes,
       emitStructuredResult: false,
-    }).pipe(pushNotify, Effect.retry(retry));
+    }).pipe(pushNotify, Effect.retry(retry), Effect.withSpan("bootstrap.pushMigrations"));
 
     if (isText) {
       const suggestion = suggestAppStart(path, runtimeInfo.cwd, workdir, starter.start, aqua);
diff --git a/apps/cli/src/commands/bootstrap/bootstrap.layers.ts b/apps/cli/src/commands/bootstrap/bootstrap.layers.ts
index f59a2e1746..c1c35c81f6 100644
--- a/apps/cli/src/commands/bootstrap/bootstrap.layers.ts
+++ b/apps/cli/src/commands/bootstrap/bootstrap.layers.ts
@@ -6,7 +6,7 @@ import { commandPlatformApiFactoryFromApiLayer } from "../../auth/command-platfo
 import { commandPlatformApiLayer } from "../../auth/command-platform-api.layer.ts";
 import { commandSettingsLayer } from "../../config/command-settings.layer.ts";
 import { projectRefLayer } from "../../config/project-ref.layer.ts";
-import { dbConnectionLayer } from "../../command-internal/db-connection.layer.ts";
+import { dbConnectionLayer } from "../../command-internal/db-connection.sql-pg.layer.ts";
 import { debugLoggerLayer } from "../../command-internal/debug-logger.layer.ts";
 import { identityStitchLayer } from "../../command-internal/identity-stitch.ts";
 import { linkedProjectCacheLayer } from "../../telemetry/linked-project-cache.layer.ts";
diff --git a/apps/cli/src/commands/bootstrap/bootstrap.retry.ts b/apps/cli/src/commands/bootstrap/bootstrap.retry.ts
index 773901111f..13e65cf74b 100644
--- a/apps/cli/src/commands/bootstrap/bootstrap.retry.ts
+++ b/apps/cli/src/commands/bootstrap/bootstrap.retry.ts
@@ -40,6 +40,7 @@ export const bootstrapRetryNotify = () => {
       Effect.tapError((error) =>
         Effect.gen(function* () {
           failureCount += 1;
+          yield* Effect.annotateCurrentSpan("retry.failure_count", failureCount);
           // No notify on the final, exhausted attempt.
           if (failureCount > BOOTSTRAP_MAX_RETRIES) return;
           const toStderr = failureCount * 3 > BOOTSTRAP_MAX_RETRIES;
diff --git a/apps/cli/src/commands/bootstrap/bootstrap.templates.ts b/apps/cli/src/commands/bootstrap/bootstrap.templates.ts
index a2c6353156..c789f0d65f 100644
--- a/apps/cli/src/commands/bootstrap/bootstrap.templates.ts
+++ b/apps/cli/src/commands/bootstrap/bootstrap.templates.ts
@@ -136,8 +136,10 @@ export const templateServiceLayer = Layer.effect(
         ),
       );
       const samples = (parsed as { samples?: ReadonlyArray<unknown> }).samples ?? [];
-      return samples.filter(isStarterTemplate);
-    });
+      const templates = samples.filter(isStarterTemplate);
+      yield* Effect.annotateCurrentSpan("template.count", templates.length);
+      return templates;
+    }).pipe(Effect.withSpan("TemplateService.listSamples"));
 
     const downloadFile = (localPath: string, remoteUrl: string) =>
       Effect.gen(function* () {
@@ -152,85 +154,84 @@ export const templateServiceLayer = Layer.effect(
         yield* fs.writeFile(localPath, bytes);
       }).pipe(Effect.catch(mapDownloadError));
 
-    const download = (templateUrl: string, targetDir: string) =>
-      Effect.gen(function* () {
-        // e.g. https://github.com/supabase/supabase/tree/master/examples/user-management
-        const parsed = new URL(templateUrl);
-        const parts = parsed.pathname.split("/");
-        const owner = parts[1] ?? "";
-        const repo = parts[2] ?? "";
-        const ref = parts[4] ?? "";
-        const root = parts.slice(5).join("/");
-
-        const downloads: Array<{ readonly localPath: string; readonly remoteUrl: string }> = [];
-        const queue: Array<string> = [root];
-        while (queue.length > 0) {
-          const contentPath = queue.shift() ?? "";
-          const response = yield* httpClient.execute(
-            contentsRequest(owner, repo, contentPath, ref),
-          );
-          if (response.status !== 200) {
-            const body = sanitizeErrorBody(
-              yield* response.text.pipe(Effect.orElseSucceed(() => "")),
-            );
-            return yield* new BootstrapTemplateDownloadError({
-              message: `failed to download template: status ${response.status}: ${body}`,
-            });
-          }
-          const payload = yield* response.json;
-          if (!Array.isArray(payload)) {
-            return yield* new BootstrapTemplateDownloadError({
-              message: `failed to download template: expected a directory listing for ${contentPath}`,
-            });
-          }
-          const listing = payload as ReadonlyArray<GithubContentEntry>;
-          for (const entry of listing) {
-            const entryPath = entry.path ?? "";
-            if (entry.type === "file") {
-              // Strip `<root>` on a path-segment boundary so a sibling directory that merely
-              // shares the prefix (e.g. `examples/app-2` under `root="examples/app"`) is never
-              // mis-sliced.
-              const relative =
-                root === ""
-                  ? entryPath
-                  : entryPath === root
-                    ? ""
-                    : entryPath.startsWith(`${root}/`)
-                      ? entryPath.slice(root.length + 1)
-                      : entryPath;
-              const localPath = path.join(targetDir, ...relative.split("/").filter(Boolean));
-              // Defence-in-depth: reject a malicious `path` (e.g. `../../etc/x`)
-              // that would escape the target directory.
-              const resolvedTarget = path.resolve(targetDir);
-              const resolvedLocal = path.resolve(localPath);
-              if (
-                resolvedLocal !== resolvedTarget &&
-                !resolvedLocal.startsWith(resolvedTarget + path.sep)
-              ) {
-                return yield* new BootstrapTemplateDownloadError({
-                  message: `failed to download template: entry escapes target directory: ${entryPath}`,
-                });
-              }
-              // GitHub returns a null `download_url` for files over 1 MB and submodules; without
-              // this guard, the `?? ""` fallback would issue `GET ""` with a confusing error.
-              if (entry.download_url == null || entry.download_url.length === 0) {
-                return yield* new BootstrapTemplateDownloadError({
-                  message: `failed to download template: unsupported entry (no download URL): ${entryPath}`,
-                });
-              }
-              downloads.push({ localPath, remoteUrl: entry.download_url });
-            } else if (entry.type === "dir") {
-              queue.push(entryPath);
-            } else {
-              yield* output.raw(`Ignoring ${entry.type}: ${entryPath}\n`, "stderr");
+    const download = Effect.fn("TemplateService.download")(function* (
+      templateUrl: string,
+      targetDir: string,
+    ) {
+      // e.g. https://github.com/supabase/supabase/tree/master/examples/user-management
+      const parsed = new URL(templateUrl);
+      const parts = parsed.pathname.split("/");
+      const owner = parts[1] ?? "";
+      const repo = parts[2] ?? "";
+      const ref = parts[4] ?? "";
+      const root = parts.slice(5).join("/");
+
+      const downloads: Array<{ readonly localPath: string; readonly remoteUrl: string }> = [];
+      const queue: Array<string> = [root];
+      while (queue.length > 0) {
+        const contentPath = queue.shift() ?? "";
+        const response = yield* httpClient.execute(contentsRequest(owner, repo, contentPath, ref));
+        if (response.status !== 200) {
+          const body = sanitizeErrorBody(yield* response.text.pipe(Effect.orElseSucceed(() => "")));
+          return yield* new BootstrapTemplateDownloadError({
+            message: `failed to download template: status ${response.status}: ${body}`,
+          });
+        }
+        const payload = yield* response.json;
+        if (!Array.isArray(payload)) {
+          return yield* new BootstrapTemplateDownloadError({
+            message: `failed to download template: expected a directory listing for ${contentPath}`,
+          });
+        }
+        const listing = payload as ReadonlyArray<GithubContentEntry>;
+        for (const entry of listing) {
+          const entryPath = entry.path ?? "";
+          if (entry.type === "file") {
+            // Strip `<root>` on a path-segment boundary so a sibling directory that merely
+            // shares the prefix (e.g. `examples/app-2` under `root="examples/app"`) is never
+            // mis-sliced.
+            const relative =
+              root === ""
+                ? entryPath
+                : entryPath === root
+                  ? ""
+                  : entryPath.startsWith(`${root}/`)
+                    ? entryPath.slice(root.length + 1)
+                    : entryPath;
+            const localPath = path.join(targetDir, ...relative.split("/").filter(Boolean));
+            // Defence-in-depth: reject a malicious `path` (e.g. `../../etc/x`)
+            // that would escape the target directory.
+            const resolvedTarget = path.resolve(targetDir);
+            const resolvedLocal = path.resolve(localPath);
+            if (
+              resolvedLocal !== resolvedTarget &&
+              !resolvedLocal.startsWith(resolvedTarget + path.sep)
+            ) {
+              return yield* new BootstrapTemplateDownloadError({
+                message: `failed to download template: entry escapes target directory: ${entryPath}`,
+              });
+            }
+            // GitHub returns a null `download_url` for files over 1 MB and submodules; without
+            // this guard, the `?? ""` fallback would issue `GET ""` with a confusing error.
+            if (entry.download_url == null || entry.download_url.length === 0) {
+              return yield* new BootstrapTemplateDownloadError({
+                message: `failed to download template: unsupported entry (no download URL): ${entryPath}`,
+              });
             }
+            downloads.push({ localPath, remoteUrl: entry.download_url });
+          } else if (entry.type === "dir") {
+            queue.push(entryPath);
+          } else {
+            yield* output.raw(`Ignoring ${entry.type}: ${entryPath}\n`, "stderr");
           }
         }
+      }
 
-        yield* Effect.forEach(downloads, (job) => downloadFile(job.localPath, job.remoteUrl), {
-          concurrency: DOWNLOAD_CONCURRENCY,
-        });
-      }).pipe(Effect.catch(mapDownloadError));
+      yield* Effect.annotateCurrentSpan("file.count", downloads.length);
+      yield* Effect.forEach(downloads, (job) => downloadFile(job.localPath, job.remoteUrl), {
+        concurrency: DOWNLOAD_CONCURRENCY,
+      });
+    }, Effect.catch(mapDownloadError));
 
     return { listSamples, download };
   }),
diff --git a/apps/cli/src/commands/branches/create/create.handler.ts b/apps/cli/src/commands/branches/create/create.handler.ts
index c736a4a9f5..3ad0354670 100644
--- a/apps/cli/src/commands/branches/create/create.handler.ts
+++ b/apps/cli/src/commands/branches/create/create.handler.ts
@@ -81,6 +81,7 @@ export const branchesCreate = Effect.fn("branches.create")(function* (flags: Bra
   // holds the branch's own ref, and the platform 403s on that ref for every branches-management
   // endpoint.
   const ref = yield* resolveParentScopedProjectRef(flags.projectRef);
+  yield* Effect.annotateCurrentSpan("project.ref", ref);
 
   yield* Effect.gen(function* () {
     const creating =
diff --git a/apps/cli/src/commands/branches/delete/delete.handler.ts b/apps/cli/src/commands/branches/delete/delete.handler.ts
index c9c22c378f..b48ced489e 100644
--- a/apps/cli/src/commands/branches/delete/delete.handler.ts
+++ b/apps/cli/src/commands/branches/delete/delete.handler.ts
@@ -35,6 +35,7 @@ export const branchesDelete = Effect.fn("branches.delete")(function* (flags: Bra
   // holds the branch's own ref, and the platform 403s on that ref for every branches-management
   // endpoint.
   const ref = yield* resolveParentScopedProjectRef(flags.projectRef);
+  yield* Effect.annotateCurrentSpan("project.ref", ref);
 
   yield* Effect.gen(function* () {
     const branchInput = yield* promptBranchId(flags.name, ref);
diff --git a/apps/cli/src/commands/branches/disable/disable.handler.ts b/apps/cli/src/commands/branches/disable/disable.handler.ts
index 3ee6f6e07a..0ed631772d 100644
--- a/apps/cli/src/commands/branches/disable/disable.handler.ts
+++ b/apps/cli/src/commands/branches/disable/disable.handler.ts
@@ -31,6 +31,7 @@ export const branchesDisable = Effect.fn("branches.disable")(function* (
   // `supabase/.temp/project-ref` holds the branch's own ref, and the platform
   // 403s on that ref for every branches-management endpoint.
   const ref = yield* resolveParentScopedProjectRef(flags.projectRef);
+  yield* Effect.annotateCurrentSpan("project.ref", ref);
 
   yield* Effect.gen(function* () {
     const disabling =
diff --git a/apps/cli/src/commands/branches/get/get.handler.ts b/apps/cli/src/commands/branches/get/get.handler.ts
index 8ba167a3fb..f6d436fd20 100644
--- a/apps/cli/src/commands/branches/get/get.handler.ts
+++ b/apps/cli/src/commands/branches/get/get.handler.ts
@@ -86,6 +86,7 @@ export const branchesGet = Effect.fn("branches.get")(function* (flags: BranchesG
   // `branches` is parent-scoped: after `supabase link <branch>`, `supabase/.temp/project-ref`
   // holds the branch's own ref, which the platform 403s on for every branches-management endpoint.
   const ref = yield* resolveParentScopedProjectRef(flags.projectRef);
+  yield* Effect.annotateCurrentSpan("project.ref", ref);
 
   yield* Effect.gen(function* () {
     const branchInput = yield* promptBranchId(flags.name, ref);
diff --git a/apps/cli/src/commands/branches/list/list.handler.ts b/apps/cli/src/commands/branches/list/list.handler.ts
index 3e3ddbc0d5..cb6f5f5b89 100644
--- a/apps/cli/src/commands/branches/list/list.handler.ts
+++ b/apps/cli/src/commands/branches/list/list.handler.ts
@@ -40,6 +40,7 @@ export const branchesList = Effect.fn("branches.list")(function* (flags: Branche
   // `branches` is parent-scoped: after `supabase link <branch>`, `supabase/.temp/project-ref`
   // holds the branch's own ref, which the platform 403s on for every branches-management endpoint.
   const ref = yield* resolveParentScopedProjectRef(flags.projectRef);
+  yield* Effect.annotateCurrentSpan("project.ref", ref);
 
   yield* Effect.gen(function* () {
     const fetching =
@@ -48,6 +49,7 @@ export const branchesList = Effect.fn("branches.list")(function* (flags: Branche
       Effect.tapError(() => fetching?.fail() ?? Effect.void),
       Effect.catch(mapListError),
     );
+    yield* Effect.annotateCurrentSpan("branch.count", branches.length);
     yield* fetching?.clear ?? Effect.void;
 
     const goFmt = Option.getOrUndefined(goOutputFlag);
diff --git a/apps/cli/src/commands/branches/pause/pause.handler.ts b/apps/cli/src/commands/branches/pause/pause.handler.ts
index 3ad94a3b86..01191e6ade 100644
--- a/apps/cli/src/commands/branches/pause/pause.handler.ts
+++ b/apps/cli/src/commands/branches/pause/pause.handler.ts
@@ -32,6 +32,7 @@ export const branchesPause = Effect.fn("branches.pause")(function* (flags: Branc
   // `branches` is parent-scoped: after `supabase link <branch>`, `supabase/.temp/project-ref`
   // holds the branch's own ref, which the platform 403s on for every branches-management endpoint.
   const ref = yield* resolveParentScopedProjectRef(flags.projectRef);
+  yield* Effect.annotateCurrentSpan("project.ref", ref);
 
   yield* Effect.gen(function* () {
     const branchInput = yield* promptBranchId(flags.name, ref);
diff --git a/apps/cli/src/commands/branches/unpause/unpause.handler.ts b/apps/cli/src/commands/branches/unpause/unpause.handler.ts
index 3c030b4d5e..c030a57194 100644
--- a/apps/cli/src/commands/branches/unpause/unpause.handler.ts
+++ b/apps/cli/src/commands/branches/unpause/unpause.handler.ts
@@ -34,6 +34,7 @@ export const branchesUnpause = Effect.fn("branches.unpause")(function* (
   // `branches` is parent-scoped: after `supabase link <branch>`, `supabase/.temp/project-ref`
   // holds the branch's own ref, which the platform 403s on for every branches-management endpoint.
   const ref = yield* resolveParentScopedProjectRef(flags.projectRef);
+  yield* Effect.annotateCurrentSpan("project.ref", ref);
 
   yield* Effect.gen(function* () {
     const branchInput = yield* promptBranchId(flags.name, ref);
diff --git a/apps/cli/src/commands/branches/update/update.handler.ts b/apps/cli/src/commands/branches/update/update.handler.ts
index 28d3fa838e..ea9b26fcee 100644
--- a/apps/cli/src/commands/branches/update/update.handler.ts
+++ b/apps/cli/src/commands/branches/update/update.handler.ts
@@ -44,6 +44,7 @@ export const branchesUpdate = Effect.fn("branches.update")(function* (flags: Bra
   // `branches` is parent-scoped: after `supabase link <branch>`, `supabase/.temp/project-ref`
   // holds the branch's own ref, which the platform 403s on for every branches-management endpoint.
   const ref = yield* resolveParentScopedProjectRef(flags.projectRef);
+  yield* Effect.annotateCurrentSpan("project.ref", ref);
 
   yield* Effect.gen(function* () {
     const branchInput = yield* promptBranchId(flags.branchId, ref);
diff --git a/apps/cli/src/commands/config/config.load.ts b/apps/cli/src/commands/config/config.load.ts
index 85efa6b119..09f67694ec 100644
--- a/apps/cli/src/commands/config/config.load.ts
+++ b/apps/cli/src/commands/config/config.load.ts
@@ -43,5 +43,8 @@ export function loadLocalConfig<E>(
           })
         : Effect.succeed(loaded),
     ),
+    Effect.tap((loaded) =>
+      Effect.annotateCurrentSpan("config.remote_applied", loaded.appliedRemote !== undefined),
+    ),
   );
 }
diff --git a/apps/cli/src/commands/config/diff/diff.handler.ts b/apps/cli/src/commands/config/diff/diff.handler.ts
index b5c3d29d4b..891923d793 100644
--- a/apps/cli/src/commands/config/diff/diff.handler.ts
+++ b/apps/cli/src/commands/config/diff/diff.handler.ts
@@ -121,6 +121,10 @@ export const configDiff = Effect.fn("config.diff")(function* (flags: ConfigDiffF
       mapBranchResolveError,
     );
     resolvedRef = ref;
+    yield* Effect.annotateCurrentSpan({
+      "project.ref": ref,
+      "config.target_is_branch": branch !== undefined,
+    });
 
     // Reload only if a `[remotes.*]` entry matches the resolved ref (ADR 0018), matched against
     // the raw pre-`env()` `project_id` literal so an `env(REF)` entry that merely resolves to
@@ -183,7 +187,8 @@ export const configDiff = Effect.fn("config.diff")(function* (flags: ConfigDiffF
     // the same ProjectConfigParseError boundary applies here.
     const changeSet = yield* configProjectConfigTry(() =>
       diffProjectConfig({ local: loaded, remote }),
-    );
+    ).pipe(Effect.withSpan("config.diff.computeDiff"));
+    yield* Effect.annotateCurrentSpan("change.count", changeSet.counts.total);
 
     const data = configIsRecord(responseJson) ? responseJson["data"] : undefined;
     const scope = configApiScope(
diff --git a/apps/cli/src/commands/config/diff/diff.integration.test.ts b/apps/cli/src/commands/config/diff/diff.integration.test.ts
index 77f19458ce..746416baa6 100644
--- a/apps/cli/src/commands/config/diff/diff.integration.test.ts
+++ b/apps/cli/src/commands/config/diff/diff.integration.test.ts
@@ -212,6 +212,29 @@ describe("config diff integration", () => {
     }).pipe(Effect.provide(layer));
   });
 
+  it.live("a disabled Data API diffs clean against a declared enabled = false", () => {
+    const { layer, out, processControl } = setup({
+      toml: 'project_id = "test"\n[api]\nenabled = false\n',
+      v2: {
+        status: 200,
+        body: v2Response({
+          attributes: (attributes) => ({
+            ...attributes,
+            api: {
+              ...(attributes["api"] as Record<string, unknown>),
+              db_schema: "pg_pgrst_no_exposed_schemas",
+            },
+          }),
+        }),
+      },
+    });
+    return Effect.gen(function* () {
+      yield* configDiff({ ...noFlags, exitCode: true });
+      expect(out.stdoutText).toContain("No config differences found.");
+      expect(processControl.exitCode).toBeUndefined();
+    }).pipe(Effect.provide(layer));
+  });
+
   it.live("a configured provider still diffs clean", () => {
     const { layer, out } = setup({
       toml: [
diff --git a/apps/cli/src/commands/config/pull/pull.handler.ts b/apps/cli/src/commands/config/pull/pull.handler.ts
index 2f2ab4f3ec..5f4e084f88 100644
--- a/apps/cli/src/commands/config/pull/pull.handler.ts
+++ b/apps/cli/src/commands/config/pull/pull.handler.ts
@@ -89,7 +89,7 @@ export interface ConfigPullInput {
   readonly source: ConfigPullSource;
 }
 
-export const runConfigPull = Effect.fnUntraced(function* (input: ConfigPullInput) {
+export const runConfigPull = Effect.fn("config.pull.run")(function* (input: ConfigPullInput) {
   const output = yield* Output;
 
   const runPlan = yield* planConfigPullRun({
@@ -99,6 +99,12 @@ export const runConfigPull = Effect.fnUntraced(function* (input: ConfigPullInput
   });
   const { changeSet, scope, plan: finalPlan, context, configFilePath } = runPlan;
   const ref = context.projectRef;
+  yield* Effect.annotateCurrentSpan({
+    "project.ref": ref,
+    "config.dry_run": input.dryRun,
+    "change.count": changeSet.counts.total,
+    "config.write_count": finalPlan.writes.length,
+  });
 
   // The text one-line disposition drops the caveats (opts.withCaveats: false) since the
   // change-by-change body above already rendered the same Note: lines; the machine-mode message
@@ -250,6 +256,7 @@ export const configPull = Effect.fn("config.pull")(function* (flags: ConfigPullF
       mapBranchResolveError,
     );
     resolvedRef = ref;
+    yield* Effect.annotateCurrentSpan("config.target_is_branch", branch !== undefined);
 
     yield* runConfigPull({
       target: { ref, branch },
diff --git a/apps/cli/src/commands/config/pull/pull.integration.test.ts b/apps/cli/src/commands/config/pull/pull.integration.test.ts
index 30f0a36ff4..eb4c7722a6 100644
--- a/apps/cli/src/commands/config/pull/pull.integration.test.ts
+++ b/apps/cli/src/commands/config/pull/pull.integration.test.ts
@@ -603,6 +603,31 @@ describe("config pull integration", () => {
     }).pipe(Effect.provide(layer));
   });
 
+  it.live("a disabled Data API leaves a declared enabled = false untouched", () => {
+    const before = 'project_id = "test"\n[api]\nenabled = false\n';
+    const { layer, out } = setup({
+      toml: before,
+      yes: true,
+      v2: {
+        status: 200,
+        body: v2Response({
+          attributes: (attributes) => ({
+            ...attributes,
+            api: {
+              ...(attributes["api"] as Record<string, unknown>),
+              db_schema: "pg_pgrst_no_exposed_schemas",
+            },
+          }),
+        }),
+      },
+    });
+    return Effect.gen(function* () {
+      yield* configPull(noFlags);
+      expect(yield* readConfig).toBe(before);
+      expect(out.stdoutText).toContain("No config differences found.");
+    }).pipe(Effect.provide(layer));
+  });
+
   it.live("declining the confirmation prompt leaves the file unchanged", () => {
     const before = 'project_id = "test"\n[api]\nmax_rows = 500\n';
     const { layer, out } = setup({
diff --git a/apps/cli/src/commands/config/push/push.auth-email-content.ts b/apps/cli/src/commands/config/push/push.auth-email-content.ts
index 2c1950e274..60cf929f00 100644
--- a/apps/cli/src/commands/config/push/push.auth-email-content.ts
+++ b/apps/cli/src/commands/config/push/push.auth-email-content.ts
@@ -85,7 +85,10 @@ const resolveContentPath = (
  *   nothing was configured or all `content_path` values were empty. Fails when a configured
  *   `content_path` points to a missing or unreadable file.
  */
-export const loadAuthEmailContent = Effect.fnUntraced(function* (cwd: string, email: AuthEmail) {
+export const loadAuthEmailContent = Effect.fn("config.push.loadAuthEmailContent")(function* (
+  cwd: string,
+  email: AuthEmail,
+) {
   const template: Record<string, string> = {};
   const notification: Record<string, string> = {};
 
@@ -130,7 +133,9 @@ export const loadAuthEmailContent = Effect.fnUntraced(function* (cwd: string, em
     notification[name] = yield* readTemplateContent("notification", name, resolved);
   }
 
-  if (Object.keys(template).length === 0 && Object.keys(notification).length === 0) {
+  const fileCount = Object.keys(template).length + Object.keys(notification).length;
+  yield* Effect.annotateCurrentSpan("file.count", fileCount);
+  if (fileCount === 0) {
     return EMPTY_AUTH_EMAIL_CONTENT;
   }
 
diff --git a/apps/cli/src/commands/config/push/push.cost-matrix.ts b/apps/cli/src/commands/config/push/push.cost-matrix.ts
index 31b99cb733..5abff00304 100644
--- a/apps/cli/src/commands/config/push/push.cost-matrix.ts
+++ b/apps/cli/src/commands/config/push/push.cost-matrix.ts
@@ -29,7 +29,7 @@ export interface CostItem {
  * (e.g. the `"api"` GraphQL addon). Mirrors the `sso add` /
  * `postgres-config` raw-HTTP precedent.
  */
-export const getCostMatrix = Effect.fn("config.push.cost-matrix")(function* (ref: string) {
+export const getCostMatrix = Effect.fn("config.push.fetchCostMatrix")(function* (ref: string) {
   const httpClient = yield* HttpClient.HttpClient;
   const cliSettings = yield* CommandSettings;
   const tokenOpt = yield* resolveAccessToken;
@@ -78,6 +78,7 @@ export const getCostMatrix = Effect.fn("config.push.cost-matrix")(function* (ref
       costMatrix.set(addon.type, { name: variant.name, price: variant.price.description });
     }
   }
+  yield* Effect.annotateCurrentSpan("addon.count", costMatrix.size);
   return costMatrix;
 });
 
diff --git a/apps/cli/src/commands/config/push/push.handler.ts b/apps/cli/src/commands/config/push/push.handler.ts
index fa74c15386..2d15d23a69 100644
--- a/apps/cli/src/commands/config/push/push.handler.ts
+++ b/apps/cli/src/commands/config/push/push.handler.ts
@@ -230,6 +230,10 @@ export const configPush = Effect.fn("config.push")(function* (flags: ConfigPushF
       mapPushBranchResolveError,
     );
     resolvedRef = ref;
+    yield* Effect.annotateCurrentSpan({
+      "project.ref": ref,
+      "config.target_is_branch": branch !== undefined,
+    });
 
     // 2. Load config.toml with the resolved ref (a TOML parse error aborts before any network
     // call); a matching `[remotes.<name>]` overlay merges before decode in the same call.
@@ -265,13 +269,15 @@ export const configPush = Effect.fn("config.push")(function* (flags: ConfigPushF
     // Deprecated `auth.external.{linkedin,slack}` blocks are stripped from `loaded.document`
     // before this decode, so scan `removedDeprecatedExternalProviders` too, or a secret hiding in
     // one of them would skip the check.
-    const secretError =
-      assertDecryptableSecrets(loaded.document, secretEnvLookup, dotenvPrivateKeys) ??
-      assertDecryptableSecrets(
-        { auth: { external: loaded.removedDeprecatedExternalProviders } },
-        secretEnvLookup,
-        dotenvPrivateKeys,
-      );
+    const secretError = yield* Effect.sync(
+      () =>
+        assertDecryptableSecrets(loaded.document, secretEnvLookup, dotenvPrivateKeys) ??
+        assertDecryptableSecrets(
+          { auth: { external: loaded.removedDeprecatedExternalProviders } },
+          secretEnvLookup,
+          dotenvPrivateKeys,
+        ),
+    ).pipe(Effect.withSpan("config.push.verifyDecryptable"));
     if (secretError !== undefined) {
       return yield* new ConfigPushLoadConfigError({ message: secretError });
     }
@@ -310,7 +316,10 @@ export const configPush = Effect.fn("config.push")(function* (flags: ConfigPushF
       !yes && tty.stdinIsTty && !output.interactive
         ? Effect.succeed(defaultValue)
         : promptYesNo(output, yes, label, defaultValue, true, { readMachineStdin: true });
-    const target = yield* resolveConfigPushTarget(ref, { knownBranch });
+    const target = yield* resolveConfigPushTarget(ref, { knownBranch }).pipe(
+      Effect.withSpan("config.push.probeTarget"),
+    );
+    yield* Effect.annotateCurrentSpan("config.target_kind", target.kind);
     yield* output.raw(configPushTargetLines(target), "stderr");
     if (target.kind === "branch" && knownBranch === undefined) {
       // Defaults `false`: an unattended run without affirmative consent
@@ -406,7 +415,8 @@ export const configPush = Effect.fn("config.push")(function* (flags: ConfigPushF
     const local = yield* configProjectConfigTry(() => fromConfigDocument(loaded));
     const changeSet = yield* configProjectConfigTry(() =>
       diffProjectConfig({ local: loaded, remote }),
-    );
+    ).pipe(Effect.withSpan("config.push.computeDiff"));
+    yield* Effect.annotateCurrentSpan("change.count", changeSet.counts.total);
 
     // 9. Route pushable changes to their v1 write endpoint and resolve every
     // declared secret's send/unchanged/not_set/gated status.
@@ -427,7 +437,7 @@ export const configPush = Effect.fn("config.push")(function* (flags: ConfigPushF
         new ConfigPushLoadConfigError({
           message: cause instanceof Error ? cause.message : String(cause),
         }),
-    });
+    }).pipe(Effect.withSpan("config.push.resolveAuthSecrets"));
     const now = yield* DateTime.now;
 
     // Whether each resource's local gate is on, computed once for the resource loop below and
@@ -482,7 +492,11 @@ export const configPush = Effect.fn("config.push")(function* (flags: ConfigPushF
           "stderr",
         );
         if (yield* keep(pushPromptKey(resource))) {
-          yield* write(body);
+          yield* write(body).pipe(
+            Effect.withSpan("config.push.updateResource", {
+              attributes: { "config.resource": resource },
+            }),
+          );
           const sentSecretPaths = pushSentSecretPaths(encoded);
           return {
             service: resource,
@@ -715,6 +729,10 @@ export const configPush = Effect.fn("config.push")(function* (flags: ConfigPushF
     if (notes !== "") {
       yield* output.raw(notes, "stderr");
     }
+    yield* Effect.annotateCurrentSpan(
+      "resource.updated_count",
+      services.filter((service) => service.status === "updated").length,
+    );
 
     // 13. Machine-readable summary in `json` / `stream-json` mode.
     if (output.format !== "text") {
diff --git a/apps/cli/src/commands/config/push/push.integration.test.ts b/apps/cli/src/commands/config/push/push.integration.test.ts
index 4cddc7ba2e..391bd6def0 100644
--- a/apps/cli/src/commands/config/push/push.integration.test.ts
+++ b/apps/cli/src/commands/config/push/push.integration.test.ts
@@ -560,6 +560,57 @@ max_rows = 1000
     }).pipe(Effect.provide(layer));
   });
 
+  it.live("reports up-to-date when the project already has the Data API disabled", () => {
+    const { layer, out, api } = setup({
+      toml: 'project_id = "test"\n[api]\nenabled = false\n',
+      yes: true,
+      v2: {
+        status: 200,
+        body: v2Response({
+          attributes: (a) => ({
+            ...a,
+            api: {
+              ...(a["api"] as Record<string, unknown>),
+              db_schema: "pg_pgrst_no_exposed_schemas",
+            },
+          }),
+        }),
+      },
+    });
+    return Effect.gen(function* () {
+      yield* configPush({ projectRef: Option.none() });
+      expect(out.stderrText).toContain("Remote API config is up to date.");
+      expect(api.requests.some((r) => r.method === "PATCH" && r.url.includes("/postgrest"))).toBe(
+        false,
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
+  it.live("re-enables a disabled Data API with the default schemas", () => {
+    const { layer, api } = setup({
+      toml: 'project_id = "test"\n[api]\nenabled = true\n',
+      yes: true,
+      v2: {
+        status: 200,
+        body: v2Response({
+          attributes: (a) => ({
+            ...a,
+            api: {
+              ...(a["api"] as Record<string, unknown>),
+              db_schema: "pg_pgrst_no_exposed_schemas",
+            },
+          }),
+        }),
+      },
+    });
+    return Effect.gen(function* () {
+      yield* configPush({ projectRef: Option.none() });
+      const update = api.requests.find((r) => r.method === "PATCH" && r.url.includes("/postgrest"));
+      expect(update).toBeDefined();
+      expect(update?.body).toMatchObject({ db_schema: "public,graphql_public" });
+    }).pipe(Effect.provide(layer));
+  });
+
   it.live("stops a service when the user declines the prompt (exit 0)", () => {
     const { layer, out, api } = setup({
       toml: `project_id = "test"\n[api]\nmax_rows = 2000\n`,
diff --git a/apps/cli/src/commands/db/advisors/advisors.handler.ts b/apps/cli/src/commands/db/advisors/advisors.handler.ts
index 085f6ed9af..750938f8d5 100644
--- a/apps/cli/src/commands/db/advisors/advisors.handler.ts
+++ b/apps/cli/src/commands/db/advisors/advisors.handler.ts
@@ -41,7 +41,7 @@ import { splitLintsSql } from "./advisors.lints-sql.ts";
 const loginSuggestion = (): string => `Run ${aqua("supabase login")} first.`;
 
 /** Queries and scans the lints, minus the transaction the caller owns. */
-const queryLints = Effect.fnUntraced(function* (session: DbSession) {
+const queryLints = Effect.fn("DbAdvisors.queryLints")(function* (session: DbSession) {
   const [setupSql, querySql] = splitLintsSql();
   yield* session.exec(setupSql).pipe(
     Effect.mapError(
@@ -58,11 +58,12 @@ const queryLints = Effect.fnUntraced(function* (session: DbSession) {
         (cause) => new DbAdvisorsQueryError({ message: `failed to query lints: ${cause.message}` }),
       ),
     );
+  yield* Effect.annotateCurrentSpan("advisor.count", rows.length);
   return rows.map(scanAdvisorLintRow);
 });
 
 /** Gathers lints from a local (or `--db-url`) database connection. */
-const runLocal = Effect.fnUntraced(function* (
+const runLocal = Effect.fn("db.advisors.runLocal")(function* (
   flags: DbAdvisorsFlags,
   dnsResolver: "native" | "https",
   advisorType: string,
@@ -108,7 +109,7 @@ const runLocal = Effect.fnUntraced(function* (
 });
 
 /** Gathers lints from the Management API for the linked project. */
-const runLinked = Effect.fnUntraced(function* (
+const runLinked = Effect.fn("db.advisors.runLinked")(function* (
   flags: DbAdvisorsFlags,
   dnsResolver: "native" | "https",
   advisorType: string,
@@ -233,6 +234,12 @@ const runAdvisors = Effect.fnUntraced(function* (
   const advisorType = Option.getOrElse(flags.type, () => "all");
   const level = Option.getOrElse(flags.level, () => "warn");
   const failOn = Option.getOrElse(flags.failOn, () => "none");
+  yield* Effect.annotateCurrentSpan({
+    "db.conn_type": target.connType ?? "local",
+    "advisor.type": advisorType,
+    "advisor.level": level,
+    "advisor.fail_on": failOn,
+  });
 
   // Branches on whether `--linked` was explicitly set: linked → Management
   // API; otherwise local / `--db-url`.
@@ -240,6 +247,7 @@ const runAdvisors = Effect.fnUntraced(function* (
     target.connType === "linked"
       ? yield* runLinked(flags, dnsResolver, advisorType, level)
       : yield* runLocal(flags, dnsResolver, advisorType, level, target);
+  yield* Effect.annotateCurrentSpan("advisor.reported_count", filtered.length);
 
   yield* outputAndCheck(filtered, failOn);
 });
diff --git a/apps/cli/src/commands/db/advisors/advisors.layers.ts b/apps/cli/src/commands/db/advisors/advisors.layers.ts
index e5b9698133..30b0239646 100644
--- a/apps/cli/src/commands/db/advisors/advisors.layers.ts
+++ b/apps/cli/src/commands/db/advisors/advisors.layers.ts
@@ -7,7 +7,7 @@ import { commandPlatformApiFactoryLayer } from "../../../auth/command-platform-a
 import { commandSettingsLayer } from "../../../config/command-settings.layer.ts";
 import { projectRefLayer } from "../../../config/project-ref.layer.ts";
 import { dbConfigLayer } from "../../../command-internal/db-config.layer.ts";
-import { dbConnectionLayer } from "../../../command-internal/db-connection.layer.ts";
+import { dbConnectionLayer } from "../../../command-internal/db-connection.sql-pg.layer.ts";
 import { debugLoggerLayer } from "../../../command-internal/debug-logger.layer.ts";
 import { identityStitchLayer } from "../../../command-internal/identity-stitch.ts";
 import { linkedProjectCacheLayer } from "../../../telemetry/linked-project-cache.layer.ts";
diff --git a/apps/cli/src/commands/db/advisors/advisors.linked.ts b/apps/cli/src/commands/db/advisors/advisors.linked.ts
index ca337bc1d6..a397f56553 100644
--- a/apps/cli/src/commands/db/advisors/advisors.linked.ts
+++ b/apps/cli/src/commands/db/advisors/advisors.linked.ts
@@ -89,10 +89,12 @@ const fetchAdvisors = Effect.fnUntraced(function* (
   // A decode error folds into the same `failed to fetch … advisors: %w` path,
   // so map both JSON syntax errors and structural-shape rejections (thrown by
   // `apiResponseToAdvisorLints`) to the endpoint's network error.
-  return yield* Effect.try({
+  const lints = yield* Effect.try({
     try: () => decodeAdvisorsBody(rawBody),
     catch: (cause) => endpoint.network(String(cause), { decode: true }),
   });
+  yield* Effect.annotateCurrentSpan("advisor.count", lints.length);
+  return lints;
 });
 
 export const fetchSecurityAdvisors = (ref: string, stitch: StitchFn) =>
@@ -113,6 +115,10 @@ export const fetchSecurityAdvisors = (ref: string, stitch: StitchFn) =>
         }),
     },
     stitch,
+  ).pipe(
+    Effect.withSpan("v1GetSecurityAdvisors", {
+      attributes: { "api.operation": "v1GetSecurityAdvisors" },
+    }),
   );
 
 export const fetchPerformanceAdvisors = (ref: string, stitch: StitchFn) =>
@@ -133,4 +139,8 @@ export const fetchPerformanceAdvisors = (ref: string, stitch: StitchFn) =>
         }),
     },
     stitch,
+  ).pipe(
+    Effect.withSpan("v1GetPerformanceAdvisors", {
+      attributes: { "api.operation": "v1GetPerformanceAdvisors" },
+    }),
   );
diff --git a/apps/cli/src/commands/db/diff/SIDE_EFFECTS.md b/apps/cli/src/commands/db/diff/SIDE_EFFECTS.md
index 4eb11d7469..9556a0282f 100644
--- a/apps/cli/src/commands/db/diff/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/db/diff/SIDE_EFFECTS.md
@@ -60,7 +60,10 @@ it, and JSON `null` disables formatting without disabling safe compaction.
 - Edge-runtime container (migra engine only). It and the `supabase/migra` fallback get
   loopback `SOURCE`/`TARGET` hosts rewritten to `host.docker.internal` when `--network-id`
   puts them on a named network, or when a stack-backend URL is used outside Linux host
-  networking.
+  networking. The edge-runtime run mounts the `supabase_edge_runtime_<project_id>` Deno-cache
+  volume, first created by `docker volume create` with the `com.supabase.cli.project`/
+  `com.docker.compose.project` labels so `stop --no-backup` removes it (skipped under Bitbucket
+  Pipelines, which drops the mount).
 - Shadow Postgres container — provisioned and torn down natively (`prepareShadowSource`
   in `commands/db/shared/shadow-source.ts`, over the lower-level primitives in
   `command-internal/db-bootstrap/shadow-database.ts`), no longer via a Go seam. Explicit
diff --git a/apps/cli/src/commands/db/diff/diff.handler.ts b/apps/cli/src/commands/db/diff/diff.handler.ts
index a92de2a624..85a048de5a 100644
--- a/apps/cli/src/commands/db/diff/diff.handler.ts
+++ b/apps/cli/src/commands/db/diff/diff.handler.ts
@@ -204,6 +204,7 @@ export const dbDiff = Effect.fn("db.diff")(function* (flags: DbDiffFlags) {
     const fromSet = from.length > 0;
     const toSet = to.length > 0;
     if (fromSet || toSet) {
+      yield* Effect.annotateCurrentSpan({ "diff.mode": "explicit", "diff.engine": "pg-delta" });
       if (!fromSet || !toSet) {
         return yield* new DbDiffExplicitFlagsError({
           message: "must set both --from and --to when using explicit diff mode",
@@ -570,91 +571,93 @@ export const dbDiff = Effect.fn("db.diff")(function* (flags: DbDiffFlags) {
       );
     });
 
-    let diffResult: {
+    const engine = usePgAdmin ? "pgadmin" : useDelta ? "pg-delta" : "migra";
+    yield* Effect.annotateCurrentSpan("diff.engine", engine);
+    const diffResult: {
       readonly sql: string;
       readonly files: ReadonlyArray<PgDeltaRenderedFile> | undefined;
       readonly hazards?: PgDeltaDiffResult["hazards"];
-    };
-    if (usePgAdmin) {
-      // The running-db check runs after the config load + target resolve above, and — unlike
-      // every other engine on this command — runs for `--linked`/`--db-url` too, not just the
-      // local target. Uses `ctx.projectId` (already remote-merge-resolved), not the raw
-      // `cliSettings.projectId` env reader, so it reflects a resolved remote merge.
-      const running = yield* isLocalDbRunning(
-        spawner,
-        fs,
-        path,
-        cliSettings.workdir,
-        ctx.projectId,
-      ).pipe(
-        Effect.mapError(
-          (cause) =>
-            new DbDiffDbNotRunningError({
-              message: cause.message,
-              daemonDown: cause.daemonDown,
-              suggestion: cause.suggestion,
+    } = yield* Effect.gen(function* () {
+      if (usePgAdmin) {
+        // The running-db check runs after the config load + target resolve above, and — unlike
+        // every other engine on this command — runs for `--linked`/`--db-url` too, not just the
+        // local target. Uses `ctx.projectId` (already remote-merge-resolved), not the raw
+        // `cliSettings.projectId` env reader, so it reflects a resolved remote merge.
+        const running = yield* isLocalDbRunning(
+          spawner,
+          fs,
+          path,
+          cliSettings.workdir,
+          ctx.projectId,
+        ).pipe(
+          Effect.mapError(
+            (cause) =>
+              new DbDiffDbNotRunningError({
+                message: cause.message,
+                daemonDown: cause.daemonDown,
+                suggestion: cause.suggestion,
+              }),
+          ),
+        );
+        if (!running) {
+          return yield* new DbDiffDbNotRunningError({
+            message: `${aqua("supabase start")} is not running.`,
+          });
+        }
+        yield* emitStatus("Creating shadow database...");
+        const shadowBase = yield* resolveShadowRunInput();
+        const shadowConnConfig: PgConnInput = {
+          host: shadowBase.hostname,
+          port: shadowBase.shadowPort,
+          user: "postgres",
+          password: shadowBase.password,
+          database: "postgres",
+        };
+        // Register cleanup atomically with shadow creation; preparation stays interruptible.
+        const sql = yield* Effect.acquireUseRelease(
+          createShadowDatabase(spawner, shadowBase),
+          (handle) =>
+            Effect.gen(function* () {
+              yield* waitForHealthyServices(spawner, [handle.containerId], {
+                timeoutSeconds: shadowBase.healthTimeoutSeconds,
+              });
+              yield* migrateShadowDatabase(spawner, {
+                fs,
+                path,
+                workdir: cliSettings.workdir,
+                projectId: shadowBase.projectId,
+                container: handle.containerId,
+                networkId: shadowBase.networkId,
+                connConfig: shadowConnConfig,
+                setup: shadowBase.setup,
+              });
+              yield* emitStatus("Diffing local database with current migrations...");
+              const differHost = (host: string) =>
+                toolContainerUsesHostNetwork(shadowBase.networkId)
+                  ? host
+                  : rewriteDumpHostForToolContainer(host, {
+                      platform: runtimeInfo.platform,
+                      usesHostNetwork: false,
+                    });
+              return yield* diffSchemaPgAdmin({
+                // `source`/`target` are inverted relative to the migra/pg-delta path below:
+                // `source` is the user's db, `target` is the shadow.
+                source: toPostgresURL({ ...resolved.conn, host: differHost(resolved.conn.host) }),
+                // Hardcoded, not built via `toPostgresURL`: this ignores
+                // `SUPABASE_SERVICES_HOSTNAME`/`[db] password` by design, not a bug to fix.
+                target: `postgresql://postgres:postgres@${differHost("127.0.0.1")}:${shadowBase.shadowPort}/postgres`,
+                schema: flags.schema,
+                projectEnvValues: cfg.projectEnv,
+                projectId: shadowBase.projectId,
+                networkId: shadowBase.networkId,
+                extraHosts: shadowBase.extraHosts,
+                emitStatus,
+              });
             }),
-        ),
-      );
-      if (!running) {
-        return yield* new DbDiffDbNotRunningError({
-          message: `${aqua("supabase start")} is not running.`,
-        });
+          (handle) => removeShadowDatabase(spawner, handle.containerId),
+        );
+        return { sql, files: undefined };
       }
-      yield* emitStatus("Creating shadow database...");
-      const shadowBase = yield* resolveShadowRunInput();
-      const shadowConnConfig: PgConnInput = {
-        host: shadowBase.hostname,
-        port: shadowBase.shadowPort,
-        user: "postgres",
-        password: shadowBase.password,
-        database: "postgres",
-      };
-      // Register cleanup atomically with shadow creation; preparation stays interruptible.
-      const sql = yield* Effect.acquireUseRelease(
-        createShadowDatabase(spawner, shadowBase),
-        (handle) =>
-          Effect.gen(function* () {
-            yield* waitForHealthyServices(spawner, [handle.containerId], {
-              timeoutSeconds: shadowBase.healthTimeoutSeconds,
-            });
-            yield* migrateShadowDatabase(spawner, {
-              fs,
-              path,
-              workdir: cliSettings.workdir,
-              projectId: shadowBase.projectId,
-              container: handle.containerId,
-              networkId: shadowBase.networkId,
-              connConfig: shadowConnConfig,
-              setup: shadowBase.setup,
-            });
-            yield* emitStatus("Diffing local database with current migrations...");
-            const differHost = (host: string) =>
-              toolContainerUsesHostNetwork(shadowBase.networkId)
-                ? host
-                : rewriteDumpHostForToolContainer(host, {
-                    platform: runtimeInfo.platform,
-                    usesHostNetwork: false,
-                  });
-            return yield* diffSchemaPgAdmin({
-              // `source`/`target` are inverted relative to the migra/pg-delta path below:
-              // `source` is the user's db, `target` is the shadow.
-              source: toPostgresURL({ ...resolved.conn, host: differHost(resolved.conn.host) }),
-              // Hardcoded, not built via `toPostgresURL`: this ignores
-              // `SUPABASE_SERVICES_HOSTNAME`/`[db] password` by design, not a bug to fix.
-              target: `postgresql://postgres:postgres@${differHost("127.0.0.1")}:${shadowBase.shadowPort}/postgres`,
-              schema: flags.schema,
-              projectEnvValues: cfg.projectEnv,
-              projectId: shadowBase.projectId,
-              networkId: shadowBase.networkId,
-              extraHosts: shadowBase.extraHosts,
-              emitStatus,
-            });
-          }),
-        (handle) => removeShadowDatabase(spawner, handle.containerId),
-      );
-      diffResult = { sql, files: undefined };
-    } else {
       yield* output.raw("Creating shadow database...\n", "stderr");
       const migrationMode: "legacy" | "pgdelta-next" = useDelta ? "pgdelta-next" : "legacy";
       const shadowInput = {
@@ -719,7 +722,7 @@ export const dbDiff = Effect.fn("db.diff")(function* (flags: DbDiffFlags) {
       // `prepareShadowSource` selects for this mode (legacy migrate forces `pg_net` on,
       // next follows config), or the two engines could restore each other's tars.
       const stackBackend = (yield* currentStackBackend).kind === "stack";
-      diffResult = stackBackend
+      return stackBackend
         ? yield* stackWithShadowDatabase(shadowInput, (handle) =>
             stackPrepareShadowSource(handle, shadowInput).pipe(Effect.flatMap(runDiff)),
           )
@@ -733,7 +736,7 @@ export const dbDiff = Effect.fn("db.diff")(function* (flags: DbDiffFlags) {
               }),
             { webhooks: migrationMode === "pgdelta-next" ? "config" : "enabled" },
           );
-    }
+    }).pipe(Effect.withSpan("db.diff.shadowDatabase"));
     const out = diffResult.sql;
 
     // The pgAdmin path skips the branch banner and drop-statement scan below entirely.
@@ -749,13 +752,16 @@ export const dbDiff = Effect.fn("db.diff")(function* (flags: DbDiffFlags) {
     }
 
     // The file-write + drop-statement warning below is bypassed by the pgadmin path.
-    const engine = usePgAdmin ? "pgadmin" : useDelta ? "pg-delta" : "migra";
     const drops: ReadonlyArray<string> = usePgAdmin
       ? []
       : diffResult.hazards !== undefined
         ? diffResult.hazards.dataLoss.map((action) => action.sql)
         : findDropStatements(out);
     const writtenFiles: Array<string> = [];
+    yield* Effect.annotateCurrentSpan({
+      "schema.count": flags.schema.length,
+      "diff.drop_statement_count": drops.length,
+    });
     let ignoredDeclarativeAdvisory: ReturnType<typeof declarativeBaselineAdvisory> | undefined;
     if (out.length >= 2 && useDelta && Option.isSome(flags.file) && flags.file.value.length > 0) {
       // This is an informational, best-effort probe only. Declarative files are
diff --git a/apps/cli/src/commands/db/diff/diff.integration.test.ts b/apps/cli/src/commands/db/diff/diff.integration.test.ts
index d3a6ff0c3a..76832600d3 100644
--- a/apps/cli/src/commands/db/diff/diff.integration.test.ts
+++ b/apps/cli/src/commands/db/diff/diff.integration.test.ts
@@ -251,9 +251,11 @@ function setup(workdir: string, opts: SetupOpts = {}) {
   );
 
   const edgeCalls: EdgeRuntimeRunOpts[] = [];
+  const spawnedBeforeEdgeRun: Array<ReadonlyArray<ReadonlyArray<string>>> = [];
   const edge = Layer.succeed(EdgeRuntimeScript, {
     run: (runOpts: EdgeRuntimeRunOpts) => {
       edgeCalls.push(runOpts);
+      spawnedBeforeEdgeRun.push(shadowSpawner.spawned.map((call) => call.args));
       if (opts.oom) {
         return Effect.fail(
           new EdgeRuntimeScriptError({ message: "Fatal JavaScript out of memory" }),
@@ -458,6 +460,7 @@ function setup(workdir: string, opts: SetupOpts = {}) {
     explicitDiffCalls,
     databaseDiffCalls,
     edgeCalls,
+    spawnedBeforeEdgeRun,
     resolverCalls,
     proxyCalls,
     proxyCaptureCalls,
@@ -598,6 +601,40 @@ describe("db diff", () => {
     }).pipe(Effect.provide(s.layer));
   });
 
+  it.effect("creates the labeled Deno-cache volume before the migra run mounts it", () => {
+    const s = setup(tmp.current, { diffSql: "create table players ();\n" });
+    return Effect.gen(function* () {
+      yield* dbDiff(flags());
+      expect(s.edgeCalls[0]?.binds).toEqual(["supabase_edge_runtime_test:/root/.cache/deno:rw"]);
+      expect(s.spawnedBeforeEdgeRun[0]).toContainEqual([
+        "volume",
+        "create",
+        "--label",
+        "com.supabase.cli.project=test",
+        "--label",
+        "com.docker.compose.project=test",
+        "supabase_edge_runtime_test",
+      ]);
+    }).pipe(Effect.provide(s.layer));
+  });
+
+  it.effect("skips creating the Deno-cache volume under Bitbucket Pipelines", () => {
+    const s = setup(tmp.current, {
+      diffSql: "create table players ();\n",
+      files: { "supabase/.env": "BITBUCKET_CLONE_DIR=/opt/atlassian/pipelines/agent/build\n" },
+    });
+    return Effect.gen(function* () {
+      yield* dbDiff(flags());
+      expect(s.edgeCalls).toHaveLength(1);
+      expect(
+        s.shadowSpawned.filter(
+          (call) => call.args[0] === "volume" && call.args.includes("supabase_edge_runtime_test"),
+        ),
+      ).toEqual([]);
+      expect(stdout(s.out)).toBe("create table players ();\n\n");
+    }).pipe(Effect.provide(s.layer));
+  });
+
   it.effect("diffs local with pgdelta when --use-pg-delta is set", () => {
     const s = setup(tmp.current, { diffSql: "create table p ();\n" });
     return Effect.gen(function* () {
diff --git a/apps/cli/src/commands/db/diff/diff.stack-cache.e2e.test.ts b/apps/cli/src/commands/db/diff/diff.stack-cache.e2e.test.ts
index c0518adc45..37603ac7da 100644
--- a/apps/cli/src/commands/db/diff/diff.stack-cache.e2e.test.ts
+++ b/apps/cli/src/commands/db/diff/diff.stack-cache.e2e.test.ts
@@ -1,11 +1,11 @@
 import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
-import { Data, Effect, Exit, FileSystem, Path, Predicate, Redacted, Schema, Stream } from "effect";
+import { Effect, FileSystem, Path, Redacted } from "effect";
 import { FetchHttpClient } from "effect/unstable/http";
-import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
 import { create as createStack } from "@supabase/stack/effect";
 import { tmpdir } from "node:os";
 import { runSupabaseEffect } from "../../../../tests/helpers/cli.ts";
+import { destroyTestStack } from "../../../../tests/helpers/stack-cleanup.ts";
 
 const COMMAND_TIMEOUT_MS = 8 * 60_000;
 const TEST_TIMEOUT_MS = COMMAND_TIMEOUT_MS * 4 + 2 * 60_000;
@@ -31,38 +31,6 @@ enabled = false
 enabled = false
 `;
 
-const storageMarker = Schema.Struct({
-  backend: Schema.Literals(["docker", "host"]),
-  volume: Schema.optionalKey(Schema.String),
-});
-
-class DockerCleanupError extends Data.TaggedError("DockerCleanupError")<{
-  readonly message: string;
-}> {}
-
-const removeDockerVolume = Effect.fn("DbDiffStackCacheE2e.removeDockerVolume")((volume: string) =>
-  Effect.scoped(
-    Effect.gen(function* () {
-      const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-      const child = yield* spawner.spawn(
-        ChildProcess.make("docker", ["volume", "rm", volume], { stdin: "ignore" }),
-      );
-      const [stderr, code] = yield* Effect.all(
-        [
-          child.stdout.pipe(Stream.runDrain),
-          child.stderr.pipe(Stream.decodeText, Stream.mkString),
-          child.exitCode,
-        ],
-        { concurrency: "unbounded" },
-      ).pipe(Effect.map(([, stderr, code]) => [stderr, code] as const));
-      if (Number(code) !== 0 && !/no such volume/iu.test(stderr))
-        return yield* new DockerCleanupError({
-          message: `docker volume rm ${volume} failed: ${stderr.trim() || `exit ${code}`}`,
-        });
-    }),
-  ),
-);
-
 const composeStack = Effect.fn("DbDiffStackCacheE2e.composeStack")(function* (
   root: string,
   home: string,
@@ -74,39 +42,7 @@ const composeStack = Effect.fn("DbDiffStackCacheE2e.composeStack")(function* (
     cacheRoot: `${home}/cache/stack`,
     runtime,
   });
-  let databaseId: string | undefined;
-  yield* Effect.addFinalizer(() =>
-    Effect.gen(function* () {
-      const marker = yield* Effect.gen(function* () {
-        if (runtime !== "docker" || databaseId === undefined) return undefined;
-        const fs = yield* FileSystem.FileSystem;
-        const markerText = yield* fs
-          .readFileString(
-            `${home}/stacks/${stack.id}/data/${databaseId}/.supabase-database-storage.json`,
-          )
-          .pipe(
-            Effect.catchIf(
-              (cause) => Predicate.isTagged(cause.reason, "NotFound"),
-              () => Effect.void,
-            ),
-          );
-        if (markerText === undefined) return undefined;
-        return yield* Schema.decodeEffect(Schema.fromJsonString(storageMarker))(markerText);
-      }).pipe(Effect.exit);
-      const destroyed = yield* stack.destroy.pipe(Effect.exit);
-      const volume =
-        Exit.isSuccess(marker) && marker.value !== undefined && marker.value.backend === "docker"
-          ? marker.value.volume
-          : undefined;
-      const removed =
-        volume === undefined
-          ? Exit.succeed(undefined)
-          : yield* removeDockerVolume(volume).pipe(Effect.exit);
-      if (Exit.isFailure(destroyed)) return yield* Effect.failCause(destroyed.cause);
-      if (Exit.isFailure(marker)) return yield* Effect.failCause(marker.cause);
-      if (Exit.isFailure(removed)) return yield* Effect.failCause(removed.cause);
-    }).pipe(Effect.catchCause((cause) => Effect.die(cause))),
-  );
+  yield* Effect.addFinalizer(() => destroyTestStack(stack));
   const [database] = yield* stack.composition.supabase([
     {
       service: "database",
@@ -120,7 +56,6 @@ const composeStack = Effect.fn("DbDiffStackCacheE2e.composeStack")(function* (
     },
   ]);
   if (database === undefined) return yield* Effect.die("database composition missing");
-  databaseId = database.id;
   yield* stack.composition.start;
   return stack;
 });
diff --git a/apps/cli/src/commands/db/diff/pgadmin-diff.ts b/apps/cli/src/commands/db/diff/pgadmin-diff.ts
index 35b3e23dde..a1c868777a 100644
--- a/apps/cli/src/commands/db/diff/pgadmin-diff.ts
+++ b/apps/cli/src/commands/db/diff/pgadmin-diff.ts
@@ -18,10 +18,14 @@ import { dockerfileServiceImage } from "../../../shared/services/dockerfile-imag
 import { COMPOSE_PROJECT_LABEL } from "../../../command-internal/db-bootstrap/container-lifecycle.ts";
 import { CLI_PROJECT_LABEL } from "../../../command-internal/docker-ids.ts";
 import { DockerRun } from "../../../command-internal/docker-run.service.ts";
-import { trimGoSpace } from "../shared/go-string.ts";
 import { INTERNAL_SCHEMAS } from "../../../command-internal/pg-dump.env.ts";
 import { DbDiffPgAdminError } from "./diff.errors.ts";
 
+// Trims the Unicode `White_Space` set like Go's `strings.TrimSpace`; unlike JS `trim`, it
+// leaves a leading U+FEFF (BOM) in place.
+const trimGoSpace = (value: string): string =>
+  value.replace(/^\p{White_Space}+|\p{White_Space}+$/gu, "");
+
 // `differ` has no slim build, so the slim flag never applies to it.
 const DIFFER_IMAGE = dockerfileServiceImage("differ", false);
 
diff --git a/apps/cli/src/commands/db/dump/dump.handler.ts b/apps/cli/src/commands/db/dump/dump.handler.ts
index 0d92fec4fa..c4d32a5dc9 100644
--- a/apps/cli/src/commands/db/dump/dump.handler.ts
+++ b/apps/cli/src/commands/db/dump/dump.handler.ts
@@ -351,6 +351,12 @@ export const dbDump = Effect.fn("db.dump")(function* (flags: DbDumpFlags) {
         .pipe(Effect.mapError(toOpenFileError));
     }
 
+    yield* Effect.annotateCurrentSpan({
+      "db.dump.mode": mode.verb,
+      "db.is_local": isLocal,
+      "db.dump.dry_run": flags.dryRun,
+    });
+
     // 6. Diagnostic to stderr (printed for both real and dry-run paths).
     yield* output.raw(`Dumping ${mode.verb} from ${db} database...\n`, "stderr");
 
@@ -430,6 +436,7 @@ export const dbDump = Effect.fn("db.dump")(function* (flags: DbDumpFlags) {
           reprintOnRetry: output.raw(`Dumping ${mode.verb} from ${db} database...\n`, "stderr"),
         }),
       ),
+      Effect.withSpan("db.dump.run"),
       Effect.catchIf(
         (error): error is DockerRunError =>
           Predicate.isTagged(error, "DockerRunError") &&
diff --git a/apps/cli/src/commands/db/dump/dump.integration.test.ts b/apps/cli/src/commands/db/dump/dump.integration.test.ts
index af9f38fc3b..e020809e10 100644
--- a/apps/cli/src/commands/db/dump/dump.integration.test.ts
+++ b/apps/cli/src/commands/db/dump/dump.integration.test.ts
@@ -124,7 +124,7 @@ const managedDumpStackApi = (runtime: "native" | "docker") => {
       registered: true,
     }),
     followStatus: Stream.empty,
-    logs: Stream.empty,
+    readLogs: () => Stream.empty,
     credentials: () =>
       Effect.succeed({ databaseUrl: "postgresql://postgres:secret@127.0.0.1:54322/postgres" }),
     saveSnapshot: () => Effect.die("unused"),
diff --git a/apps/cli/src/commands/db/dump/dump.layers.ts b/apps/cli/src/commands/db/dump/dump.layers.ts
index 0bf46f8693..85229a4aa9 100644
--- a/apps/cli/src/commands/db/dump/dump.layers.ts
+++ b/apps/cli/src/commands/db/dump/dump.layers.ts
@@ -6,7 +6,7 @@ import { commandPlatformApiFactoryLayer } from "../../../auth/command-platform-a
 import { commandSettingsLayer } from "../../../config/command-settings.layer.ts";
 import { projectRefLayer } from "../../../config/project-ref.layer.ts";
 import { dbConfigLayer } from "../../../command-internal/db-config.layer.ts";
-import { dbConnectionLayer } from "../../../command-internal/db-connection.layer.ts";
+import { dbConnectionLayer } from "../../../command-internal/db-connection.sql-pg.layer.ts";
 import { dockerRunLayer } from "../../../command-internal/docker-run.layer.ts";
 import { debugLoggerLayer } from "../../../command-internal/debug-logger.layer.ts";
 import { identityStitchLayer } from "../../../command-internal/identity-stitch.ts";
diff --git a/apps/cli/src/commands/db/lint/lint.handler.ts b/apps/cli/src/commands/db/lint/lint.handler.ts
index 71e0bdff60..7f739bef56 100644
--- a/apps/cli/src/commands/db/lint/lint.handler.ts
+++ b/apps/cli/src/commands/db/lint/lint.handler.ts
@@ -42,7 +42,7 @@ const asString = (value: unknown): string =>
   value === null || value === undefined ? "" : String(value);
 
 /** Lists the user schemas — used when `--schema` is omitted. */
-const listUserSchemas = Effect.fnUntraced(function* (session: DbSession) {
+const listUserSchemas = Effect.fn("DbLint.listUserSchemas")(function* (session: DbSession) {
   const rows = yield* session
     .query(LIST_SCHEMAS_SQL, [MANAGED_SCHEMAS])
     .pipe(
@@ -55,12 +55,13 @@ const listUserSchemas = Effect.fnUntraced(function* (session: DbSession) {
 });
 
 /** Runs the pgsql_check-based lint, minus the transaction setup the handler owns. */
-const lintDatabase = Effect.fnUntraced(function* (
+const lintDatabase = Effect.fn("DbLint.lintDatabase")(function* (
   session: DbSession,
   schemaFlags: ReadonlyArray<string>,
 ) {
   const output = yield* Output;
   const schemas = schemaFlags.length > 0 ? schemaFlags : yield* listUserSchemas(session);
+  yield* Effect.annotateCurrentSpan({ "schema.count": schemas.length });
 
   yield* session.exec(ENABLE_PGSQL_CHECK).pipe(
     Effect.mapError(
@@ -141,6 +142,12 @@ const runLint = Effect.fnUntraced(function* (
       linkedProjectRef: flags.projectRef,
     });
 
+    yield* Effect.annotateCurrentSpan({
+      "db.is_local": cfg.isLocal,
+      "db.lint.level": level,
+      "db.lint.fail_on": failOn,
+    });
+
     const results = yield* Effect.scoped(
       Effect.gen(function* () {
         yield* output.raw(
@@ -179,6 +186,7 @@ const runLint = Effect.fnUntraced(function* (
     }
 
     const filtered = filterLintResult(results, LINT_LEVEL_ENUM.toEnum(level));
+    yield* Effect.annotateCurrentSpan({ "db.lint.issue_count": filtered.length });
 
     if (output.format === "text") {
       // Encoding no-ops on an empty slice.
diff --git a/apps/cli/src/commands/db/lint/lint.layers.ts b/apps/cli/src/commands/db/lint/lint.layers.ts
index bb4086960c..f3c5c291cc 100644
--- a/apps/cli/src/commands/db/lint/lint.layers.ts
+++ b/apps/cli/src/commands/db/lint/lint.layers.ts
@@ -7,7 +7,7 @@ import { commandPlatformApiFactoryLayer } from "../../../auth/command-platform-a
 import { commandSettingsLayer } from "../../../config/command-settings.layer.ts";
 import { projectRefLayer } from "../../../config/project-ref.layer.ts";
 import { dbConfigLayer } from "../../../command-internal/db-config.layer.ts";
-import { dbConnectionLayer } from "../../../command-internal/db-connection.layer.ts";
+import { dbConnectionLayer } from "../../../command-internal/db-connection.sql-pg.layer.ts";
 import { debugLoggerLayer } from "../../../command-internal/debug-logger.layer.ts";
 import { identityStitchLayer } from "../../../command-internal/identity-stitch.ts";
 import { linkedProjectCacheLayer } from "../../../telemetry/linked-project-cache.layer.ts";
diff --git a/apps/cli/src/commands/db/pull/SIDE_EFFECTS.md b/apps/cli/src/commands/db/pull/SIDE_EFFECTS.md
index 07ae92efc8..e5577f534a 100644
--- a/apps/cli/src/commands/db/pull/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/db/pull/SIDE_EFFECTS.md
@@ -66,7 +66,10 @@ disables formatting without disabling safe compaction.
 
 ## Docker
 
-- Edge-runtime container (migra engine only).
+- Edge-runtime container (migra engine only). It mounts the `supabase_edge_runtime_<project_id>`
+  Deno-cache volume, first created by `docker volume create` with the `com.supabase.cli.project`/
+  `com.docker.compose.project` labels so `stop --no-backup` removes it (skipped under Bitbucket
+  Pipelines, which drops the mount).
 - Shadow Postgres container — provisioned and torn down natively (`prepareShadowSource` in
   `commands/db/shared/shadow-source.ts`, over the lower-level primitives in
   `command-internal/db-bootstrap/shadow-database.ts`), no longer via a Go seam. Torn down with
diff --git a/apps/cli/src/commands/db/pull/pull.handler.ts b/apps/cli/src/commands/db/pull/pull.handler.ts
index 7092cdbdab..5c972d065a 100644
--- a/apps/cli/src/commands/db/pull/pull.handler.ts
+++ b/apps/cli/src/commands/db/pull/pull.handler.ts
@@ -14,6 +14,11 @@ export const dbPull = Effect.fn("db.pull")(function* (flags: DbPullFlags, invoke
   const output = yield* Output;
   const outcome = yield* runDbPull(flags, invoke);
 
+  yield* Effect.annotateCurrentSpan({
+    "db.pull.outcome": outcome.kind,
+    "db.pull.engine": outcome.engine,
+  });
+
   if (output.format !== "text") {
     if (outcome.kind === "declarative") {
       yield* output.success("Declarative schema pulled.", {
diff --git a/apps/cli/src/commands/db/pull/pull.integration.test.ts b/apps/cli/src/commands/db/pull/pull.integration.test.ts
index e6f6b6b7b0..e0129d4e8a 100644
--- a/apps/cli/src/commands/db/pull/pull.integration.test.ts
+++ b/apps/cli/src/commands/db/pull/pull.integration.test.ts
@@ -277,10 +277,12 @@ function setup(workdir: string, opts: SetupOpts = {}) {
 
   let edgeRunCount = 0;
   const edgeCalls: EdgeRuntimeRunOpts[] = [];
+  const spawnedBeforeEdgeRun: Array<ReadonlyArray<ReadonlyArray<string>>> = [];
   const edge = Layer.succeed(EdgeRuntimeScript, {
     run: (runOpts: EdgeRuntimeRunOpts) => {
       edgeRunCount += 1;
       edgeCalls.push(runOpts);
+      spawnedBeforeEdgeRun.push(shadowSpawner.spawned.map((call) => call.args));
       if (opts.edgeFailFirstWith !== undefined && edgeRunCount === 1) {
         return Effect.fail(new EdgeRuntimeScriptError({ message: opts.edgeFailFirstWith }));
       }
@@ -513,6 +515,7 @@ function setup(workdir: string, opts: SetupOpts = {}) {
       return edgeRunCount;
     },
     edgeCalls,
+    spawnedBeforeEdgeRun,
     cache,
   };
 }
@@ -845,6 +848,54 @@ describe("db pull", () => {
     }).pipe(Effect.provide(s.layer));
   });
 
+  it.effect("creates the labeled Deno-cache volume before the migra run mounts it", () => {
+    const s = setup(tmp.current, {
+      migrations: ["20240101000000"],
+      remoteVersions: ["20240101000000"],
+      edgeStdout: "create table remote ();\n",
+      yes: true,
+    });
+    return Effect.gen(function* () {
+      yield* dbPull(flags());
+      expect(s.edgeCalls).toHaveLength(1);
+      expect(s.edgeCalls[0]?.binds).toEqual(["supabase_edge_runtime_test:/root/.cache/deno:rw"]);
+      expect(s.spawnedBeforeEdgeRun[0]).toContainEqual([
+        "volume",
+        "create",
+        "--label",
+        "com.supabase.cli.project=test",
+        "--label",
+        "com.docker.compose.project=test",
+        "supabase_edge_runtime_test",
+      ]);
+    }).pipe(Effect.provide(s.layer));
+  });
+
+  it.effect("skips creating the Deno-cache volume under Bitbucket Pipelines", () => {
+    const s = setup(tmp.current, {
+      migrations: ["20240101000000"],
+      remoteVersions: ["20240101000000"],
+      edgeStdout: "create table remote ();\n",
+      yes: true,
+      files: { "supabase/.env": "BITBUCKET_CLONE_DIR=/opt/atlassian/pipelines/agent/build\n" },
+    });
+    return Effect.gen(function* () {
+      yield* dbPull(flags());
+      expect(s.edgeCalls).toHaveLength(1);
+      expect(
+        s.shadowSpawned.filter(
+          (call) => call.args[0] === "volume" && call.args.includes("supabase_edge_runtime_test"),
+        ),
+      ).toEqual([]);
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const dir = path.join(tmp.current, "supabase", "migrations");
+      const file = (yield* fs.readDirectory(dir)).find((f) => f.endsWith("_remote_schema.sql"));
+      expect(yield* readFileText(path.join(dir, file ?? ""))).toContain("create table remote ();");
+      expect(streamText(s.out, "stdout")).toContain("Finished supabase db pull.");
+    }).pipe(Effect.provide(s.layer));
+  });
+
   it.effect(
     "validates the shadow's own local config (api.tls cert file) BEFORE resolving the connection",
     () => {
diff --git a/apps/cli/src/commands/db/pull/pull.sync.ts b/apps/cli/src/commands/db/pull/pull.sync.ts
index 2c5c20a7d6..6395a28e3c 100644
--- a/apps/cli/src/commands/db/pull/pull.sync.ts
+++ b/apps/cli/src/commands/db/pull/pull.sync.ts
@@ -23,60 +23,60 @@ export interface PulledMigration {
  * A pg-delta pull whose plan crosses a transaction boundary writes several files, so
  * several versions are recorded in one pass.
  */
-export const updateMigrationHistory = (
+export const updateMigrationHistory = Effect.fn("DbPull.updateMigrationHistory")(function* (
   session: DbSession,
   fs: FileSystem.FileSystem,
   path: Path.Path,
   migrations: ReadonlyArray<PulledMigration>,
-) =>
-  Effect.gen(function* () {
-    const output = yield* Output;
-    // The glob (`<version>_*.sql`) never crosses a path separator, so a migration name
-    // with one writes a nested file it can't reach — require the basename to both match
-    // the pattern and carry the generated version, rather than trusting `path.basename`.
-    const resolved: Array<{ version: string; name: string; migrationPath: string }> = [];
-    for (const migration of migrations) {
-      const match = MIGRATE_FILE_PATTERN.exec(path.basename(migration.path));
-      if (match === null || match[1] !== migration.version) {
-        return yield* new DbPullWriteError({
-          message: `glob supabase/migrations/${migration.version}_*.sql: file does not exist`,
-        });
-      }
-      resolved.push({
-        version: migration.version,
-        name: match[2] ?? "",
-        migrationPath: migration.path,
+) {
+  const output = yield* Output;
+  yield* Effect.annotateCurrentSpan({ "migration.count": migrations.length });
+  // The glob (`<version>_*.sql`) never crosses a path separator, so a migration name
+  // with one writes a nested file it can't reach — require the basename to both match
+  // the pattern and carry the generated version, rather than trusting `path.basename`.
+  const resolved: Array<{ version: string; name: string; migrationPath: string }> = [];
+  for (const migration of migrations) {
+    const match = MIGRATE_FILE_PATTERN.exec(path.basename(migration.path));
+    if (match === null || match[1] !== migration.version) {
+      return yield* new DbPullWriteError({
+        message: `glob supabase/migrations/${migration.version}_*.sql: file does not exist`,
       });
     }
+    resolved.push({
+      version: migration.version,
+      name: match[2] ?? "",
+      migrationPath: migration.path,
+    });
+  }
+  yield* Effect.gen(function* () {
+    // Created in its own transaction, outside the upsert transaction below, to avoid
+    // nesting BEGINs (`createMigrationTable` issues its own BEGIN/COMMIT).
+    yield* createMigrationTable(session);
+    // One explicit transaction: without it, each UPSERT autocommits, so a mid-loop
+    // failure would leave partial remote history that fails the next pull's sync check.
     yield* Effect.gen(function* () {
-      // Created in its own transaction, outside the upsert transaction below, to avoid
-      // nesting BEGINs (`createMigrationTable` issues its own BEGIN/COMMIT).
-      yield* createMigrationTable(session);
-      // One explicit transaction: without it, each UPSERT autocommits, so a mid-loop
-      // failure would leave partial remote history that fails the next pull's sync check.
-      yield* Effect.gen(function* () {
-        yield* session.exec("BEGIN");
-        for (const entry of resolved) {
-          const content = yield* fs.readFileString(entry.migrationPath);
-          const statements = splitAndTrim(content);
-          yield* session.query(UPSERT_MIGRATION_VERSION, [entry.version, entry.name, statements]);
-        }
-        yield* session.exec("COMMIT");
-      }).pipe(
-        // `Effect.ignore` keeps a ROLLBACK failure from masking the original error
-        // (`tapError` re-raises it); mirrors `createMigrationTable`'s rollback handling.
-        Effect.tapError(() => session.exec("ROLLBACK").pipe(Effect.ignore)),
-      );
+      yield* session.exec("BEGIN");
+      for (const entry of resolved) {
+        const content = yield* fs.readFileString(entry.migrationPath);
+        const statements = splitAndTrim(content);
+        yield* session.query(UPSERT_MIGRATION_VERSION, [entry.version, entry.name, statements]);
+      }
+      yield* session.exec("COMMIT");
     }).pipe(
-      Effect.mapError(
-        (cause) =>
-          new DbPullWriteError({
-            message: `failed to update migration table: ${cause.message}`,
-          }),
-      ),
+      // `Effect.ignore` keeps a ROLLBACK failure from masking the original error
+      // (`tapError` re-raises it); mirrors `createMigrationTable`'s rollback handling.
+      Effect.tapError(() => session.exec("ROLLBACK").pipe(Effect.ignore)),
     );
-    // Established output contract; printed to stderr so it never interferes with a
-    // machine-output payload on stdout.
-    const versions = resolved.map((entry) => entry.version).join(" ");
-    yield* output.raw(`Repaired migration history: [${versions}] => applied\n`, "stderr");
-  });
+  }).pipe(
+    Effect.mapError(
+      (cause) =>
+        new DbPullWriteError({
+          message: `failed to update migration table: ${cause.message}`,
+        }),
+    ),
+  );
+  // Established output contract; printed to stderr so it never interferes with a
+  // machine-output payload on stdout.
+  const versions = resolved.map((entry) => entry.version).join(" ");
+  yield* output.raw(`Repaired migration history: [${versions}] => applied\n`, "stderr");
+});
diff --git a/apps/cli/src/commands/db/push/push.handler.ts b/apps/cli/src/commands/db/push/push.handler.ts
index bc53c39887..42e93b72e9 100644
--- a/apps/cli/src/commands/db/push/push.handler.ts
+++ b/apps/cli/src/commands/db/push/push.handler.ts
@@ -95,6 +95,15 @@ export const dbPush = Effect.fn("db.push")(function* (flags: DbPushFlags) {
       linkedProjectRef: flags.projectRef,
     });
 
+    yield* Effect.annotateCurrentSpan({
+      "db.conn_type": connType,
+      "db.is_local": cfg.isLocal,
+      "db.push.dry_run": flags.dryRun,
+      "db.push.include_all": flags.includeAll,
+      "db.push.include_roles": flags.includeRoles,
+      "db.push.include_seed": flags.includeSeed,
+    });
+
     yield* dbPushCore({
       workdir,
       projectRef,
diff --git a/apps/cli/src/commands/db/push/push.layers.ts b/apps/cli/src/commands/db/push/push.layers.ts
index adf0d0a288..92008ab9c8 100644
--- a/apps/cli/src/commands/db/push/push.layers.ts
+++ b/apps/cli/src/commands/db/push/push.layers.ts
@@ -7,7 +7,7 @@ import { commandPlatformApiFactoryLayer } from "../../../auth/command-platform-a
 import { commandSettingsLayer } from "../../../config/command-settings.layer.ts";
 import { projectRefLayer } from "../../../config/project-ref.layer.ts";
 import { dbConfigLayer } from "../../../command-internal/db-config.layer.ts";
-import { dbConnectionLayer } from "../../../command-internal/db-connection.layer.ts";
+import { dbConnectionLayer } from "../../../command-internal/db-connection.sql-pg.layer.ts";
 import { debugLoggerLayer } from "../../../command-internal/debug-logger.layer.ts";
 import { stdinLayer } from "../../../shared/runtime/stdin.layer.ts";
 import { identityStitchLayer } from "../../../command-internal/identity-stitch.ts";
diff --git a/apps/cli/src/commands/db/query/query.handler.ts b/apps/cli/src/commands/db/query/query.handler.ts
index 2a7557820d..d021e2214d 100644
--- a/apps/cli/src/commands/db/query/query.handler.ts
+++ b/apps/cli/src/commands/db/query/query.handler.ts
@@ -127,6 +127,10 @@ export const dbQuery = Effect.fn("db.query")(function* (flags: DbQueryFlags) {
           .queryRaw(sql)
           .pipe(Effect.mapError((cause) => new DbQueryExecError({ message: cause.message })));
 
+        yield* Effect.annotateCurrentSpan({
+          "query.row_count": result.rows.length,
+          "query.column_count": result.fields.length,
+        });
         // DDL/DML statements expose no columns → print the command tag.
         if (result.fields.length === 0) {
           return yield* output.raw(`${result.commandTag}\n`);
@@ -207,6 +211,7 @@ export const dbQuery = Effect.fn("db.query")(function* (flags: DbQueryFlags) {
         return yield* output.raw(`${body}\n`);
       }
       const rows = parsed as ReadonlyArray<Record<string, unknown> | null>;
+      yield* Effect.annotateCurrentSpan("query.row_count", rows.length);
       if (rows.length === 0) {
         return yield* emit(format, [], [], agentMode, Option.none());
       }
@@ -334,16 +339,26 @@ export const dbQuery = Effect.fn("db.query")(function* (flags: DbQueryFlags) {
     // Mirrors the resolved format onto the global telemetry reads, or instrumentation would
     // report the table/human default as `text`.
     yield* telemetryOutputFormat.set(format);
+    yield* Effect.annotateCurrentSpan({
+      "db.conn_type":
+        linkedAuth !== undefined ? "linked" : Option.isSome(flags.dbUrl) ? "db-url" : "local",
+      "query.format": format,
+      "query.agent_mode": agentMode,
+    });
 
     // 3. Linked queries go through the Management API; local/--db-url connect directly.
     if (linkedAuth !== undefined) {
-      return yield* runLinked(sql, format, agentMode, linkedAuth.ref, linkedAuth.token);
+      return yield* runLinked(sql, format, agentMode, linkedAuth.ref, linkedAuth.token).pipe(
+        Effect.withSpan("db.query.runLinked"),
+      );
     }
     if (localTarget === undefined) {
       // Unreachable: the non-linked branch always resolves a target above.
       return yield* Effect.die(new Error("db query: connection target was not resolved"));
     }
-    return yield* runLocal(localTarget, sql, format, agentMode);
+    return yield* runLocal(localTarget, sql, format, agentMode).pipe(
+      Effect.withSpan("db.query.runLocal"),
+    );
   }).pipe(
     // Writes the linked-project cache whenever a ref was resolved, whether the query succeeds or
     // fails — `linkedRefForCache` is only set on the linked path, so `--local`/`--db-url` never
diff --git a/apps/cli/src/commands/db/query/query.layers.ts b/apps/cli/src/commands/db/query/query.layers.ts
index 84654f2f51..d6d2376e1d 100644
--- a/apps/cli/src/commands/db/query/query.layers.ts
+++ b/apps/cli/src/commands/db/query/query.layers.ts
@@ -2,7 +2,7 @@ import { Layer } from "effect";
 
 import { commandSettingsLayer } from "../../../config/command-settings.layer.ts";
 import { dbConfigLayer } from "../../../command-internal/db-config.layer.ts";
-import { dbConnectionLayer } from "../../../command-internal/db-connection.layer.ts";
+import { dbConnectionLayer } from "../../../command-internal/db-connection.sql-pg.layer.ts";
 import { debugLoggerLayer } from "../../../command-internal/debug-logger.layer.ts";
 import { identityStitchLayer } from "../../../command-internal/identity-stitch.ts";
 import { linkedDbResolverRuntimeLayer } from "../../../command-internal/management-api-runtime.layer.ts";
diff --git a/apps/cli/src/commands/db/reset/reset.handler.ts b/apps/cli/src/commands/db/reset/reset.handler.ts
index 26e78fbaab..a85fee1d23 100644
--- a/apps/cli/src/commands/db/reset/reset.handler.ts
+++ b/apps/cli/src/commands/db/reset/reset.handler.ts
@@ -187,6 +187,12 @@ export const dbReset = Effect.fn("db.reset")(function* (flags: DbResetFlags) {
       linkedProjectRef: flags.projectRef,
     });
 
+    yield* Effect.annotateCurrentSpan({
+      "db.conn_type": connType,
+      "db.is_local": cfg.isLocal,
+      ...(resolvedVersion !== "" ? { "migration.version": resolvedVersion } : {}),
+    });
+
     // Local target: the composition (container recreate, storage-health gate, bucket seeding,
     // git-branch line) is hoisted into `resetLocalDatabase`, shared with `db schema declarative`'s
     // recovery reset; this call site keeps only version/seed-flags plumbing and the JSON envelope.
@@ -263,6 +269,7 @@ export const dbReset = Effect.fn("db.reset")(function* (flags: DbResetFlags) {
             const m = MIGRATE_FILE_PATTERN.exec(path.basename(p));
             return m?.[1] !== undefined && m[1] <= resolvedVersion;
           });
+          yield* Effect.annotateCurrentSpan({ "migration.count": pending.length });
           yield* applyMigrations(session, fs, path, pending, applyError);
         }
 
@@ -276,9 +283,10 @@ export const dbReset = Effect.fn("db.reset")(function* (flags: DbResetFlags) {
         );
         if (resolvedSeed.enabled) {
           const seeds = yield* getPendingSeeds(session, fs, path, resolvedSeed.sqlPaths, workdir);
+          yield* Effect.annotateCurrentSpan({ "seed.count": seeds.length });
           yield* seedData(session, fs, workdir, path, seeds, applyError);
         }
-      }),
+      }).pipe(Effect.withSpan("db.reset.applyMigrations")),
     );
 
     if (output.format !== "text") {
diff --git a/apps/cli/src/commands/db/reset/reset.integration.test.ts b/apps/cli/src/commands/db/reset/reset.integration.test.ts
index 4e960d99b1..1f73deb1b8 100644
--- a/apps/cli/src/commands/db/reset/reset.integration.test.ts
+++ b/apps/cli/src/commands/db/reset/reset.integration.test.ts
@@ -565,7 +565,7 @@ const stackService = (
     prepare: Effect.void,
     status: observation,
     followStatus: Stream.empty,
-    logs: Stream.empty,
+    readLogs: () => Stream.empty,
     credentials: () => Effect.succeed({}),
   } satisfies Omit<ServiceInstance, "service">;
   switch (creation.service) {
diff --git a/apps/cli/src/commands/db/reset/reset.layers.ts b/apps/cli/src/commands/db/reset/reset.layers.ts
index 7a2db4e800..5de6afff43 100644
--- a/apps/cli/src/commands/db/reset/reset.layers.ts
+++ b/apps/cli/src/commands/db/reset/reset.layers.ts
@@ -8,7 +8,7 @@ import { commandPlatformApiFactoryLayer } from "../../../auth/command-platform-a
 import { commandSettingsLayer } from "../../../config/command-settings.layer.ts";
 import { projectRefLayer } from "../../../config/project-ref.layer.ts";
 import { dbConfigLayer } from "../../../command-internal/db-config.layer.ts";
-import { dbConnectionLayer } from "../../../command-internal/db-connection.layer.ts";
+import { dbConnectionLayer } from "../../../command-internal/db-connection.sql-pg.layer.ts";
 import { debugLoggerLayer } from "../../../command-internal/debug-logger.layer.ts";
 import { dockerRunLayer } from "../../../command-internal/docker-run.layer.ts";
 import { stdinLayer } from "../../../shared/runtime/stdin.layer.ts";
diff --git a/apps/cli/src/commands/db/schema/declarative/declarative.orchestrate.ts b/apps/cli/src/commands/db/schema/declarative/declarative.orchestrate.ts
index 5d2de28330..0ac2b76df8 100644
--- a/apps/cli/src/commands/db/schema/declarative/declarative.orchestrate.ts
+++ b/apps/cli/src/commands/db/schema/declarative/declarative.orchestrate.ts
@@ -71,7 +71,7 @@ const formatImplicitExtensionLoadFailure = (
  * The pg-delta engine owns both sides of the plan, planning against its scoped
  * migrations/declarative shadows.
  */
-export const diffDeclarativeToMigrations = Effect.fnUntraced(function* (
+export const diffDeclarativeToMigrations = Effect.fn("DeclarativeSchema.plan")(function* (
   run: DeclarativeRunContext,
   toml: DbTomlValues,
 ) {
@@ -91,6 +91,10 @@ export const diffDeclarativeToMigrations = Effect.fnUntraced(function* (
   const manifest = yield* ReadPgDeltaExportManifest(fs, path, run.declarativeDir).pipe(
     Effect.mapError((error) => declarativeError(error.message)),
   );
+  yield* Effect.annotateCurrentSpan({
+    "file.count": files.length,
+    "declarative.manifest_present": manifest !== undefined,
+  });
   const result = yield* engine
     .planDeclarativeSchema({
       context: run.pgDelta,
@@ -120,15 +124,20 @@ export const diffDeclarativeToMigrations = Effect.fnUntraced(function* (
         });
       }),
     );
+  const dropWarnings =
+    result.hazards !== undefined
+      ? result.hazards.dataLoss.map((action) => action.sql)
+      : findDropStatements(result.sql);
+  yield* Effect.annotateCurrentSpan({
+    "diff.empty": result.sql.trim().length === 0,
+    "diff.drop_statement_count": dropWarnings.length,
+  });
   return {
     diffSQL: result.sql,
     files: result.files,
     sourceRef: result.sourceRef,
     targetRef: result.targetRef,
-    dropWarnings:
-      result.hazards !== undefined
-        ? result.hazards.dataLoss.map((action) => action.sql)
-        : findDropStatements(result.sql),
+    dropWarnings,
     manifestPresent: manifest !== undefined,
     removals: result.removals ?? { extensions: [], extensionIntents: [] },
   } satisfies DeclarativeSyncResult;
diff --git a/apps/cli/src/commands/db/schema/declarative/declarative.smart-target.ts b/apps/cli/src/commands/db/schema/declarative/declarative.smart-target.ts
index 5089c2cabf..fcaa2d654a 100644
--- a/apps/cli/src/commands/db/schema/declarative/declarative.smart-target.ts
+++ b/apps/cli/src/commands/db/schema/declarative/declarative.smart-target.ts
@@ -114,7 +114,7 @@ export const resolveRemoteEndpoint = Effect.fnUntraced(function* (flags: SmartTa
  * mode) and `sync` (no-declarative-files bootstrap) so both offer the same local/linked/custom
  * choice and local-reset prompt.
  */
-export const resolveSmartTargetEndpoint = Effect.fnUntraced(function* (
+export const resolveSmartTargetEndpoint = Effect.fn("DeclarativeSchema.smartTarget")(function* (
   flags: SmartTargetFlags,
   local: LocalConn,
   hasMigrations: boolean,
@@ -125,6 +125,7 @@ export const resolveSmartTargetEndpoint = Effect.fnUntraced(function* (
   beforeLocalTarget: Effect.Effect<void, DeclarativeShadowDbError> = Effect.void,
 ) {
   if (!hasMigrations) {
+    yield* Effect.annotateCurrentSpan("declarative.target", "local");
     // No migrations: generate from local, starting a stopped stack first.
     yield* beforeLocalTarget;
     yield* (yield* DeclarativeSeam).ensureLocalDatabaseStarted;
@@ -152,6 +153,7 @@ export const resolveSmartTargetEndpoint = Effect.fnUntraced(function* (
       : []),
     { value: "custom", label: "Custom database URL", hint: "enter a connection string" },
   ]);
+  yield* Effect.annotateCurrentSpan("declarative.target", choice);
 
   if (choice === "linked") {
     // Same path as an explicit `--linked`: login-role mint + pooler fallback, then the resolved URL.
@@ -195,6 +197,7 @@ export const resolveSmartTargetEndpoint = Effect.fnUntraced(function* (
       false,
     );
   }
+  yield* Effect.annotateCurrentSpan("declarative.local_reset", shouldReset);
   if (shouldReset) {
     // `resetLocalDatabase` runs in-process, sharing this command's own context: it resolves
     // `NetworkIdFlag` itself, so no argv-forwarding is needed to stay on a custom Docker network,
diff --git a/apps/cli/src/commands/db/schema/declarative/generate/generate.handler.ts b/apps/cli/src/commands/db/schema/declarative/generate/generate.handler.ts
index fb34c77bfd..f5152f5bc9 100644
--- a/apps/cli/src/commands/db/schema/declarative/generate/generate.handler.ts
+++ b/apps/cli/src/commands/db/schema/declarative/generate/generate.handler.ts
@@ -162,6 +162,10 @@ export const dbSchemaDeclarativeGenerate = Effect.fn("db.schema.declarative.gene
 
     const hasExplicitTarget =
       Option.isSome(flags.local) || Option.isSome(flags.linked) || Option.isSome(flags.dbUrl);
+    yield* Effect.annotateCurrentSpan({
+      "declarative.target_mode": hasExplicitTarget ? "explicit" : "smart",
+      "schema.count": flags.schema.length,
+    });
 
     let target: PgDeltaDatabaseEndpoint;
     let overwrite: boolean;
diff --git a/apps/cli/src/commands/db/schema/declarative/generate/generate.integration.test.ts b/apps/cli/src/commands/db/schema/declarative/generate/generate.integration.test.ts
index 7344c9711b..f6838085f6 100644
--- a/apps/cli/src/commands/db/schema/declarative/generate/generate.integration.test.ts
+++ b/apps/cli/src/commands/db/schema/declarative/generate/generate.integration.test.ts
@@ -112,7 +112,7 @@ function generateStackApi(workdir: string) {
     saveSnapshot: unusedStackFn,
     restoreSnapshot: unusedStackFn,
     resetData: unusedStack,
-    logs: Stream.empty,
+    readLogs: () => Stream.empty,
     followStatus: Stream.empty,
     status: Effect.succeed({
       id: "primary",
diff --git a/apps/cli/src/commands/db/schema/declarative/sync/sync.handler.ts b/apps/cli/src/commands/db/schema/declarative/sync/sync.handler.ts
index cdbd06e22a..508ecaad0f 100644
--- a/apps/cli/src/commands/db/schema/declarative/sync/sync.handler.ts
+++ b/apps/cli/src/commands/db/schema/declarative/sync/sync.handler.ts
@@ -164,6 +164,10 @@ export const dbSchemaDeclarativeSync = Effect.fn("db.schema.declarative.sync")(f
     const ensureLocalPostgresImageCurrent = seam.ensureLocalPostgresImageCurrent;
     yield* warnFormerDeclarativeDefault(fs, path, cliSettings.workdir, toml.pgDelta);
     const declarativeFilesExist = yield* declarativeDirHasFiles(fs, declarativeDir);
+    yield* Effect.annotateCurrentSpan({
+      "declarative.bootstrap": !declarativeFilesExist,
+      "schema.count": flags.schema.length,
+    });
 
     // Warns (rather than masking the apply error) and treats the bundle path as empty when the
     // debug directory cannot be created, so an apply failure still surfaces without claiming a
@@ -248,7 +252,7 @@ export const dbSchemaDeclarativeSync = Effect.fn("db.schema.declarative.sync")(f
     }
 
     // Step 2: diff migrations state vs declarative; on error, save a debug bundle.
-    const stageNextExport = Effect.fnUntraced(function* () {
+    const stageNextExport = Effect.fn("db.schema.declarative.sync.stageNextExport")(function* () {
       const stagedDir = path.resolve(cliSettings.workdir, stagedDirRel);
       // Reject the active directory itself AND anything nested under it: a
       // staged export inside the declarative tree would be loaded recursively
@@ -494,6 +498,10 @@ export const dbSchemaDeclarativeSync = Effect.fn("db.schema.declarative.sync")(f
       result = replanned.value;
     }
 
+    yield* Effect.annotateCurrentSpan({
+      "diff.empty": result.diffSQL.trim().length < 2,
+      "diff.drop_statement_count": result.dropWarnings.length,
+    });
     // Step 3: empty diff.
     if (result.diffSQL.trim().length < 2) {
       yield* output.raw("No schema changes found\n", "stderr");
@@ -563,6 +571,10 @@ export const dbSchemaDeclarativeSync = Effect.fn("db.schema.declarative.sync")(f
           : yield* output.promptConfirm("Apply this migration to local database?", {
               defaultValue: true,
             });
+    yield* Effect.annotateCurrentSpan({
+      "migration.count": migrationPaths.length,
+      "declarative.apply": shouldApply,
+    });
     if (!shouldApply) return;
 
     // Step 8: apply the migration to the local database (native).
@@ -728,4 +740,9 @@ const applyMigrationToLocal = (
         (message) => new DeclarativeApplyError({ message }),
       );
     }
-  }).pipe(Effect.scoped);
+  }).pipe(
+    Effect.scoped,
+    Effect.withSpan("db.schema.declarative.sync.apply", {
+      attributes: { "migration.count": migrationPaths.length },
+    }),
+  );
diff --git a/apps/cli/src/commands/db/schema/declarative/sync/sync.integration.test.ts b/apps/cli/src/commands/db/schema/declarative/sync/sync.integration.test.ts
index 85ebc7eaaa..c7035c2c4f 100644
--- a/apps/cli/src/commands/db/schema/declarative/sync/sync.integration.test.ts
+++ b/apps/cli/src/commands/db/schema/declarative/sync/sync.integration.test.ts
@@ -114,7 +114,7 @@ function syncStackApi(workdir: string, port: number) {
     saveSnapshot: unusedSyncFn,
     restoreSnapshot: unusedSyncFn,
     resetData: unusedSync,
-    logs: Stream.empty,
+    readLogs: () => Stream.empty,
     followStatus: Stream.empty,
     status: Effect.succeed({
       id: "primary",
diff --git a/apps/cli/src/commands/db/shared/debug-bundle.ts b/apps/cli/src/commands/db/shared/debug-bundle.ts
index 6f3bd3fe71..d894841427 100644
--- a/apps/cli/src/commands/db/shared/debug-bundle.ts
+++ b/apps/cli/src/commands/db/shared/debug-bundle.ts
@@ -42,7 +42,7 @@ const copyBestEffort = (fs: FileSystem.FileSystem, from: string, to: string): Ef
  * top-level directory is fatal (so callers don't claim a bundle was saved), while every
  * individual artifact write is best-effort (a failed copy must not mask the original error).
  */
-export const saveDebugBundle = Effect.fnUntraced(function* (
+export const saveDebugBundle = Effect.fn("DebugBundle.save")(function* (
   fs: FileSystem.FileSystem,
   path: Path.Path,
   workdir: string,
diff --git a/apps/cli/src/commands/db/shared/drop-schemas.ts b/apps/cli/src/commands/db/shared/drop-schemas.ts
index a5a27ae626..eaecc8014d 100644
--- a/apps/cli/src/commands/db/shared/drop-schemas.ts
+++ b/apps/cli/src/commands/db/shared/drop-schemas.ts
@@ -23,4 +23,7 @@ export const dropUserSchemas = <E>(
       .exec(dropObjectsSql)
       .pipe(Effect.tapError(() => session.exec("ROLLBACK").pipe(Effect.ignore)));
     yield* session.exec("COMMIT");
-  }).pipe(Effect.mapError((error: DbExecError) => mapError(error.message)));
+  }).pipe(
+    Effect.mapError((error: DbExecError) => mapError(error.message)),
+    Effect.withSpan("DropSchemas.dropUserSchemas"),
+  );
diff --git a/apps/cli/src/commands/db/shared/go-string.ts b/apps/cli/src/commands/db/shared/go-string.ts
deleted file mode 100644
index adfd8de329..0000000000
--- a/apps/cli/src/commands/db/shared/go-string.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-/**
- * Trims exactly the Unicode `White_Space` set, matching Go's
- * `strings.TrimSpace`/`bytes.TrimSpace`. Unlike JS's `String.prototype.trim`,
- * it does not strip U+FEFF (BOM/ZWNBSP), so a BOM-prefixed value is left untouched.
- */
-export const trimGoSpace = (value: string): string =>
-  value.replace(/^\p{White_Space}+|\p{White_Space}+$/gu, "");
diff --git a/apps/cli/src/commands/db/shared/migra.ts b/apps/cli/src/commands/db/shared/migra.ts
index 0b7aa47d25..57d1814e56 100644
--- a/apps/cli/src/commands/db/shared/migra.ts
+++ b/apps/cli/src/commands/db/shared/migra.ts
@@ -1,5 +1,12 @@
 import { Config, Effect, Option } from "effect";
+import { ChildProcessSpawner } from "effect/unstable/process";
 
+import { isBitbucketPipeline } from "../../../command-internal/bitbucket-pipeline.ts";
+import {
+  COMPOSE_PROJECT_LABEL,
+  ensureVolume,
+} from "../../../command-internal/db-bootstrap/container-lifecycle.ts";
+import { CLI_PROJECT_LABEL } from "../../../command-internal/docker-ids.ts";
 import { NetworkIdFlag } from "../../../command-internal/global-flags.ts";
 import { RuntimeInfo } from "../../../shared/runtime/runtime-info.service.ts";
 import {
@@ -128,7 +135,7 @@ const containerDatabaseUrl = Effect.fnUntraced(function* (url: string) {
 });
 
 /** Builds the shared SOURCE/TARGET/SSL/schema env for both migra paths. */
-const buildMigraEnv = Effect.fnUntraced(function* (params: {
+const buildMigraEnv = Effect.fn("Migra.buildEnv")(function* (params: {
   readonly source: string;
   readonly target: string;
   readonly schema: ReadonlyArray<string>;
@@ -154,7 +161,7 @@ const buildMigraEnv = Effect.fnUntraced(function* (params: {
  * Loads the target's user-defined schemas for the bash fallback: migra.sh iterates over an
  * explicit schema list and cannot diff in exclude mode.
  */
-const loadTargetUserSchemas = Effect.fnUntraced(function* (
+const loadTargetUserSchemas = Effect.fn("Migra.loadTargetUserSchemas")(function* (
   target: string,
   connectOptions: DbConnectOptions,
 ) {
@@ -186,7 +193,7 @@ const loadTargetUserSchemas = Effect.fnUntraced(function* (
  * network. When no `--schema` is given, the included schemas are loaded from the target and
  * passed as positional args to migra.sh.
  */
-const diffMigraBash = Effect.fnUntraced(function* (params: {
+const diffMigraBash = Effect.fn("Migra.diffBash")(function* (params: {
   readonly source: string;
   readonly target: string;
   readonly schema: ReadonlyArray<string>;
@@ -247,12 +254,37 @@ const diffMigraBash = Effect.fnUntraced(function* (params: {
   return new TextDecoder().decode(result.stdout);
 });
 
+/** Pre-creates the project-labeled Deno-cache volume so `stop --no-backup` prunes it. */
+const ensureCacheVolume = Effect.fn("Migra.ensureCacheVolume")(function* (ctx: PgDeltaContext) {
+  const inBitbucket = yield* isBitbucketPipeline(ctx.projectEnv).pipe(
+    Effect.mapError(
+      (error) =>
+        new MigraDiffError({
+          message: `error diffing schema: failed to resolve Docker environment: ${error.message}`,
+        }),
+    ),
+  );
+  if (inBitbucket) return;
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  yield* ensureVolume(spawner, edgeRuntimeId(ctx.projectId), {
+    [CLI_PROJECT_LABEL]: ctx.projectId,
+    [COMPOSE_PROJECT_LABEL]: ctx.projectId,
+  }).pipe(
+    Effect.mapError((cause) => {
+      const message = `error diffing schema: ${cause.message}`;
+      return cause.reason === "runtime"
+        ? new MigraDiffError({ message, docker: "daemon" })
+        : new MigraDiffError({ message });
+    }),
+  );
+});
+
 /**
  * Diffs SOURCE → TARGET with migra via the edge-runtime template, falling back to the
  * `supabase/migra` Docker image when the edge-runtime worker runs out of memory.
  * `source`/`target` are live Postgres URLs (the shadow source and the diff target).
  */
-export const diffMigra = Effect.fnUntraced(function* (
+export const diffMigra = Effect.fn("Migra.diff")(function* (
   ctx: PgDeltaContext,
   params: {
     readonly source: string;
@@ -263,6 +295,7 @@ export const diffMigra = Effect.fnUntraced(function* (
 ) {
   const edgeRuntime = yield* EdgeRuntimeScript;
   const env = yield* buildMigraEnv(params);
+  yield* ensureCacheVolume(ctx);
   const result = yield* edgeRuntime
     .run({
       script: migraDiffScript,
diff --git a/apps/cli/src/commands/db/shared/pgdelta-declarative-shadow-prep.ts b/apps/cli/src/commands/db/shared/pgdelta-declarative-shadow-prep.ts
index 773c05268d..056d7c98b5 100644
--- a/apps/cli/src/commands/db/shared/pgdelta-declarative-shadow-prep.ts
+++ b/apps/cli/src/commands/db/shared/pgdelta-declarative-shadow-prep.ts
@@ -127,25 +127,27 @@ const queryShadow = (client: DeclarativeShadowClient, sql: string) =>
     catch: (cause) => queryError(sql, cause),
   });
 
-export const prepareDeclarativeShadow = (
+export const prepareDeclarativeShadow = Effect.fn("PgDeltaDeclarativeShadow.prepare")(function* (
   client: DeclarativeShadowClient,
-  files: ReadonlyArray<{ readonly name: string; readonly sql: string }>,
-) =>
-  Effect.gen(function* () {
-    const declared = declaredImageExtensions(files);
-    if (declared.size === 0) return { restorePgjwt: false } satisfies DeclarativeShadowPrepResult;
-    let restorePgjwt = false;
-    if (declared.has("pgcrypto") && !declared.has("pgjwt")) {
-      const installed = yield* queryShadow(client, INSTALLED_PGJWT_SQL);
-      restorePgjwt = rowHasPgjwt(installed.rows);
-    }
-    const versionRows = yield* queryShadow(client, "SHOW server_version");
-    const statements = declarativeBaselinePrepStatements(
-      parsePostgresMajorVersion(readServerVersion(versionRows.rows)),
-      declared,
-    );
-    for (const sql of statements) {
-      yield* queryShadow(client, sql);
-    }
-    return { restorePgjwt } satisfies DeclarativeShadowPrepResult;
-  });
+  files: ReadonlyArray<{
+    readonly name: string;
+    readonly sql: string;
+  }>,
+) {
+  const declared = declaredImageExtensions(files);
+  if (declared.size === 0) return { restorePgjwt: false } satisfies DeclarativeShadowPrepResult;
+  let restorePgjwt = false;
+  if (declared.has("pgcrypto") && !declared.has("pgjwt")) {
+    const installed = yield* queryShadow(client, INSTALLED_PGJWT_SQL);
+    restorePgjwt = rowHasPgjwt(installed.rows);
+  }
+  const versionRows = yield* queryShadow(client, "SHOW server_version");
+  const statements = declarativeBaselinePrepStatements(
+    parsePostgresMajorVersion(readServerVersion(versionRows.rows)),
+    declared,
+  );
+  for (const sql of statements) {
+    yield* queryShadow(client, sql);
+  }
+  return { restorePgjwt } satisfies DeclarativeShadowPrepResult;
+});
diff --git a/apps/cli/src/commands/db/shared/pgdelta-engine.next.layer.ts b/apps/cli/src/commands/db/shared/pgdelta-engine.next.layer.ts
index 6b7996b808..353283f9ae 100644
--- a/apps/cli/src/commands/db/shared/pgdelta-engine.next.layer.ts
+++ b/apps/cli/src/commands/db/shared/pgdelta-engine.next.layer.ts
@@ -198,9 +198,11 @@ export const pgDeltaNextEngineLayer = Layer.effect(
       );
     };
 
-    const diffPools = (
+    const diffPools = Effect.fn("PgDeltaNextEngine.diff")(function* (
       input: {
-        readonly context: { readonly cwd: string };
+        readonly context: {
+          readonly cwd: string;
+        };
         readonly schema: ReadonlyArray<string>;
         readonly formatOptions: string;
         readonly debug: boolean;
@@ -208,26 +210,29 @@ export const pgDeltaNextEngineLayer = Layer.effect(
       },
       sourcePool: Pool,
       desiredPool: Pool,
-    ) =>
-      Effect.gen(function* () {
-        const result = yield* adapter.diff({
-          sourcePool,
-          desiredPool,
-          allowDrops: true,
-          debug: input.debug,
-          schema: input.schema,
-          formatOptions: input.formatOptions,
-        });
-        const debugDirectory =
-          result.debug !== undefined
-            ? yield* saveDebugArtifacts(input.context.cwd, "diff", {
-                ...result.debug,
-                diagnostics: result.diagnostics,
-              })
-            : undefined;
-        yield* reportDiagnostics("diff", result.diagnostics, input.strictCoverage, input.debug);
-        return normalizeNextDiff(result, debugDirectory);
+    ) {
+      const result = yield* adapter.diff({
+        sourcePool,
+        desiredPool,
+        allowDrops: true,
+        debug: input.debug,
+        schema: input.schema,
+        formatOptions: input.formatOptions,
       });
+      const debugDirectory =
+        result.debug !== undefined
+          ? yield* saveDebugArtifacts(input.context.cwd, "diff", {
+              ...result.debug,
+              diagnostics: result.diagnostics,
+            })
+          : undefined;
+      yield* reportDiagnostics("diff", result.diagnostics, input.strictCoverage, input.debug);
+      yield* Effect.annotateCurrentSpan({
+        "diff.empty": !result.changes,
+        "diff.hazard_count": result.hazards.kinds.length,
+      });
+      return normalizeNextDiff(result, debugDirectory);
+    });
 
     return PgDeltaEngine.of({
       diffExplicit: (input) =>
@@ -281,7 +286,10 @@ export const pgDeltaNextEngineLayer = Layer.effect(
             );
             return yield* diffPools(input, sourcePool, desiredPool);
           }),
-        ).pipe(Effect.mapError(pgDeltaNextEngineError)),
+        ).pipe(
+          Effect.mapError(pgDeltaNextEngineError),
+          Effect.withSpan("PgDeltaNextEngine.diffExplicit"),
+        ),
       diffDatabase: (input) =>
         Effect.scoped(
           Effect.gen(function* () {
@@ -289,7 +297,10 @@ export const pgDeltaNextEngineLayer = Layer.effect(
             const desiredPool = yield* acquireDatabase(input.target, input.context.projectEnv);
             return yield* diffPools(input, migrationsPool, desiredPool);
           }),
-        ).pipe(Effect.mapError(pgDeltaNextEngineError)),
+        ).pipe(
+          Effect.mapError(pgDeltaNextEngineError),
+          Effect.withSpan("PgDeltaNextEngine.diffDatabase"),
+        ),
       exportDeclarativeSchema: (input) =>
         Effect.scoped(
           Effect.gen(function* () {
@@ -319,7 +330,10 @@ export const pgDeltaNextEngineLayer = Layer.effect(
             );
             return { files: result.files, manifest: result.manifest };
           }),
-        ).pipe(Effect.mapError(pgDeltaNextEngineError)),
+        ).pipe(
+          Effect.mapError(pgDeltaNextEngineError),
+          Effect.withSpan("PgDeltaNextEngine.exportDeclarativeSchema"),
+        ),
       planDeclarativeSchema: (input) =>
         Effect.scoped(
           Effect.gen(function* () {
@@ -375,7 +389,10 @@ export const pgDeltaNextEngineLayer = Layer.effect(
               targetRef: "pg-delta-next:declarative",
             };
           }),
-        ).pipe(Effect.mapError(pgDeltaNextEngineError)),
+        ).pipe(
+          Effect.mapError(pgDeltaNextEngineError),
+          Effect.withSpan("PgDeltaNextEngine.planDeclarativeSchema"),
+        ),
     });
   }),
 );
diff --git a/apps/cli/src/commands/db/shared/pgdelta-files.ts b/apps/cli/src/commands/db/shared/pgdelta-files.ts
index d96c8fcb3b..000c95f9e2 100644
--- a/apps/cli/src/commands/db/shared/pgdelta-files.ts
+++ b/apps/cli/src/commands/db/shared/pgdelta-files.ts
@@ -29,7 +29,7 @@ function parseManifestJson(raw: string): unknown {
 }
 
 /** Reads a next-engine export manifest from an explicit declarative directory. */
-export const ReadPgDeltaExportManifest = Effect.fnUntraced(function* (
+export const ReadPgDeltaExportManifest = Effect.fn("PgDeltaFiles.readExportManifest")(function* (
   fs: FileSystem.FileSystem,
   path: Path.Path,
   directory: string,
@@ -90,7 +90,7 @@ export const ReadPgDeltaExportManifest = Effect.fnUntraced(function* (
 });
 
 /** Recursively loads path-safe `.sql` files in stable POSIX-relative order. */
-export const LoadPgDeltaSqlFiles = Effect.fnUntraced(function* (
+export const LoadPgDeltaSqlFiles = Effect.fn("PgDeltaFiles.loadSqlFiles")(function* (
   fs: FileSystem.FileSystem,
   path: Path.Path,
   directory: string,
@@ -120,5 +120,6 @@ export const LoadPgDeltaSqlFiles = Effect.fnUntraced(function* (
       );
     files.push({ name, sql });
   }
+  yield* Effect.annotateCurrentSpan({ "file.count": files.length });
   return files;
 });
diff --git a/apps/cli/src/commands/db/shared/pgdelta-migrations.write.ts b/apps/cli/src/commands/db/shared/pgdelta-migrations.write.ts
index 6696251661..84f6dee4ba 100644
--- a/apps/cli/src/commands/db/shared/pgdelta-migrations.write.ts
+++ b/apps/cli/src/commands/db/shared/pgdelta-migrations.write.ts
@@ -64,6 +64,7 @@ export const writePgDeltaMigrations = (
 ): Effect.Effect<Array<WrittenMigration>, PgDeltaMigrationWriteError> =>
   Effect.gen(function* () {
     const { workdir, name, files } = opts;
+    yield* Effect.annotateCurrentSpan({ "file.count": files.length });
     for (const file of files) {
       if (file.transactionMode !== "transactional" && file.transactionMode !== "none") {
         return yield* new PgDeltaMigrationWriteError({
@@ -176,4 +177,4 @@ export const writePgDeltaMigrations = (
         Effect.forEach(written, (w) => fs.remove(w.path).pipe(Effect.ignore), { discard: true }),
       ),
     );
-  });
+  }).pipe(Effect.withSpan("PgDeltaMigrations.write"));
diff --git a/apps/cli/src/commands/db/shared/pgdelta-next-adapter.layer.ts b/apps/cli/src/commands/db/shared/pgdelta-next-adapter.layer.ts
index be454c1dc1..8816ea41aa 100644
--- a/apps/cli/src/commands/db/shared/pgdelta-next-adapter.layer.ts
+++ b/apps/cli/src/commands/db/shared/pgdelta-next-adapter.layer.ts
@@ -434,178 +434,173 @@ function makePgDeltaNextAdapter<FactBase, PlanOptions extends object, Plan, Subj
   libraries: PgDeltaNextLibraries<FactBase, PlanOptions, Plan, Subject>,
 ): PgDeltaNextAdapterShape {
   return {
-    diff: (input: PgDeltaNextDiffInput) =>
-      Effect.gen(function* () {
-        const format = yield* attemptPgDeltaNext("diff", () =>
-          pgDeltaNextFormatOptions(input.formatOptions),
-        );
-        const profile = yield* tryPgDeltaNext("diff", () =>
-          libraries.resolveProfile(input.sourcePool, { redactSecrets: true }, input.schema),
-        );
-        const [source, desired] = yield* tryPgDeltaNext("diff", () =>
-          Promise.all([
-            profile.extract(input.sourcePool, { redactSecrets: true }),
-            profile.extract(input.desiredPool, { redactSecrets: true }),
+    diff: Effect.fn("PgDeltaNextAdapter.diff")(function* (input: PgDeltaNextDiffInput) {
+      const format = yield* attemptPgDeltaNext("diff", () =>
+        pgDeltaNextFormatOptions(input.formatOptions),
+      );
+      const profile = yield* tryPgDeltaNext("diff", () =>
+        libraries.resolveProfile(input.sourcePool, { redactSecrets: true }, input.schema),
+      );
+      const [source, desired] = yield* tryPgDeltaNext("diff", () =>
+        Promise.all([
+          profile.extract(input.sourcePool, { redactSecrets: true }),
+          profile.extract(input.desiredPool, { redactSecrets: true }),
+        ]),
+      );
+      return yield* attemptPgDeltaNext("diff", () => {
+        const generatedPlan = libraries.plan(source.factBase, desired.factBase, {
+          ...profile.planOptions,
+          redactSecrets: true,
+        });
+        const rendered = libraries.renderPlanFiles(generatedPlan, {
+          allowDrops: input.allowDrops,
+        });
+        const renderedFiles = formatPgDeltaNextRenderedFiles(rendered.files, format);
+        const planDiagnostics = readPlanDiagnostics<Subject>(generatedPlan);
+        const diagnostics = [
+          ...normalizePgDeltaNextDiagnostics(source.diagnostics, "source", libraries.encodeSubject),
+          ...normalizePgDeltaNextDiagnostics(
+            desired.diagnostics,
+            "desired",
+            libraries.encodeSubject,
+          ),
+          ...normalizePgDeltaNextDiagnostics(planDiagnostics, "plan", libraries.encodeSubject),
+        ];
+        return {
+          changes: rendered.changes,
+          sql: renderedFiles.map((file) => file.contents).join("\n\n"),
+          files: normalizePgDeltaNextRenderedFiles(renderedFiles),
+          diagnostics,
+          hazards: libraries.summarizeHazards(generatedPlan, [
+            ...source.diagnostics,
+            ...desired.diagnostics,
+            ...planDiagnostics,
           ]),
-        );
-        return yield* attemptPgDeltaNext("diff", () => {
-          const generatedPlan = libraries.plan(source.factBase, desired.factBase, {
-            ...profile.planOptions,
-            redactSecrets: true,
-          });
-          const rendered = libraries.renderPlanFiles(generatedPlan, {
-            allowDrops: input.allowDrops,
-          });
-          const renderedFiles = formatPgDeltaNextRenderedFiles(rendered.files, format);
-          const planDiagnostics = readPlanDiagnostics<Subject>(generatedPlan);
-          const diagnostics = [
+          ...(input.debug
+            ? {
+                debug: {
+                  sourceSnapshot: libraries.serializeSnapshot(source.factBase, {
+                    pgVersion: source.pgVersion,
+                    redactSecrets: true,
+                    profile: profile.id,
+                  }),
+                  desiredSnapshot: libraries.serializeSnapshot(desired.factBase, {
+                    pgVersion: desired.pgVersion,
+                    redactSecrets: true,
+                    profile: profile.id,
+                  }),
+                  plan: libraries.serializePlan(generatedPlan),
+                },
+              }
+            : {}),
+        };
+      });
+    }),
+    exportDeclarativeSchema: Effect.fn("PgDeltaNextAdapter.exportDeclarativeSchema")(function* (
+      input: PgDeltaNextDeclarativeExportInput,
+    ) {
+      const result = yield* tryPgDeltaNext("declarativeExport", () =>
+        libraries.buildSchemaExport(input.pool, pgDeltaNextExportOptions(input)),
+      );
+      return yield* attemptPgDeltaNext("declarativeExport", () => ({
+        files: result.files.map((file) => ({ name: file.name, sql: file.sql })),
+        manifest: {
+          ...result.manifest,
+          files: result.files.map((file) => file.name).sort(),
+        },
+        diagnostics: normalizePgDeltaNextDiagnostics(
+          result.diagnostics,
+          "export",
+          libraries.encodeSubject,
+        ),
+      }));
+    }),
+    planDeclarativeSchema: Effect.fn("PgDeltaNextAdapter.planDeclarativeSchema")(function* (
+      input: PgDeltaNextDeclarativePlanInput,
+    ) {
+      const format = yield* attemptPgDeltaNext("declarativePlan", () =>
+        pgDeltaNextFormatOptions(input.formatOptions),
+      );
+      const result = yield* tryPgDeltaNext("declarativePlan", () =>
+        libraries.planSchemaFiles(
+          input.targetPool,
+          input.shadowPool,
+          input.files,
+          pgDeltaNextPlanOptions(input),
+        ),
+      );
+      return yield* attemptPgDeltaNext("declarativePlan", () => {
+        const rendered = libraries.renderPlanFiles(result.plan, {
+          allowDrops: input.allowDrops,
+        });
+        const renderedFiles = formatPgDeltaNextRenderedFiles(rendered.files, format);
+        const planDiagnostics = readPlanDiagnostics<Subject>(result.plan);
+        const libraryDiagnostics = [
+          ...result.loadDiagnostics,
+          ...result.targetDiagnostics,
+          ...result.driftDiagnostics,
+          ...planDiagnostics,
+        ];
+        return {
+          changes: rendered.changes,
+          sql: renderedFiles.map((file) => file.contents).join("\n\n"),
+          files: normalizePgDeltaNextRenderedFiles(renderedFiles),
+          diagnostics: [
             ...normalizePgDeltaNextDiagnostics(
-              source.diagnostics,
-              "source",
+              result.loadDiagnostics,
+              "declarativeLoad",
               libraries.encodeSubject,
             ),
             ...normalizePgDeltaNextDiagnostics(
-              desired.diagnostics,
-              "desired",
+              result.targetDiagnostics,
+              "declarativeTarget",
               libraries.encodeSubject,
             ),
-            ...normalizePgDeltaNextDiagnostics(planDiagnostics, "plan", libraries.encodeSubject),
-          ];
-          return {
-            changes: rendered.changes,
-            sql: renderedFiles.map((file) => file.contents).join("\n\n"),
-            files: normalizePgDeltaNextRenderedFiles(renderedFiles),
-            diagnostics,
-            hazards: libraries.summarizeHazards(generatedPlan, [
-              ...source.diagnostics,
-              ...desired.diagnostics,
-              ...planDiagnostics,
-            ]),
-            ...(input.debug
-              ? {
-                  debug: {
-                    sourceSnapshot: libraries.serializeSnapshot(source.factBase, {
-                      pgVersion: source.pgVersion,
-                      redactSecrets: true,
-                      profile: profile.id,
-                    }),
-                    desiredSnapshot: libraries.serializeSnapshot(desired.factBase, {
-                      pgVersion: desired.pgVersion,
-                      redactSecrets: true,
-                      profile: profile.id,
-                    }),
-                    plan: libraries.serializePlan(generatedPlan),
-                  },
-                }
-              : {}),
-          };
-        });
-      }),
-    exportDeclarativeSchema: (input: PgDeltaNextDeclarativeExportInput) =>
-      Effect.gen(function* () {
-        const result = yield* tryPgDeltaNext("declarativeExport", () =>
-          libraries.buildSchemaExport(input.pool, pgDeltaNextExportOptions(input)),
-        );
-        return yield* attemptPgDeltaNext("declarativeExport", () => ({
-          files: result.files.map((file) => ({ name: file.name, sql: file.sql })),
-          manifest: {
-            ...result.manifest,
-            files: result.files.map((file) => file.name).sort(),
-          },
-          diagnostics: normalizePgDeltaNextDiagnostics(
-            result.diagnostics,
-            "export",
-            libraries.encodeSubject,
-          ),
-        }));
-      }),
-    planDeclarativeSchema: (input: PgDeltaNextDeclarativePlanInput) =>
-      Effect.gen(function* () {
-        const format = yield* attemptPgDeltaNext("declarativePlan", () =>
-          pgDeltaNextFormatOptions(input.formatOptions),
-        );
-        const result = yield* tryPgDeltaNext("declarativePlan", () =>
-          libraries.planSchemaFiles(
-            input.targetPool,
-            input.shadowPool,
-            input.files,
-            pgDeltaNextPlanOptions(input),
-          ),
-        );
-        return yield* attemptPgDeltaNext("declarativePlan", () => {
-          const rendered = libraries.renderPlanFiles(result.plan, {
-            allowDrops: input.allowDrops,
-          });
-          const renderedFiles = formatPgDeltaNextRenderedFiles(rendered.files, format);
-          const planDiagnostics = readPlanDiagnostics<Subject>(result.plan);
-          const libraryDiagnostics = [
-            ...result.loadDiagnostics,
-            ...result.targetDiagnostics,
-            ...result.driftDiagnostics,
-            ...planDiagnostics,
-          ];
-          return {
-            changes: rendered.changes,
-            sql: renderedFiles.map((file) => file.contents).join("\n\n"),
-            files: normalizePgDeltaNextRenderedFiles(renderedFiles),
-            diagnostics: [
-              ...normalizePgDeltaNextDiagnostics(
-                result.loadDiagnostics,
-                "declarativeLoad",
-                libraries.encodeSubject,
-              ),
-              ...normalizePgDeltaNextDiagnostics(
-                result.targetDiagnostics,
-                "declarativeTarget",
-                libraries.encodeSubject,
-              ),
-              ...normalizePgDeltaNextDiagnostics(
-                result.driftDiagnostics,
-                "declarativeDrift",
-                libraries.encodeSubject,
-              ),
-              ...normalizePgDeltaNextDiagnostics(planDiagnostics, "plan", libraries.encodeSubject),
-              ...skippedStatementDiagnostics(result.skipped),
-            ],
-            hazards: libraries.summarizeHazards(result.plan, libraryDiagnostics),
-            skipped: result.skipped.map((skipped) => ({
-              file: skipped.file,
-              statement: skipped.stmt,
-            })),
-            removals: libraries.summarizeRemovals(result.plan),
-            ...(input.debug ? { debug: { plan: libraries.serializePlan(result.plan) } } : {}),
-          };
-        });
-      }),
-    captureSnapshot: (input: PgDeltaNextSnapshotCaptureInput) =>
-      Effect.gen(function* () {
-        const profile = yield* tryPgDeltaNext("snapshotCapture", () =>
-          libraries.resolveProfile(input.pool, {
-            redactSecrets: true,
-            skipBaseline: true,
-          }),
-        );
-        const result = yield* tryPgDeltaNext("snapshotCapture", () =>
-          profile.extract(input.pool, { redactSecrets: true }),
-        );
-        return yield* attemptPgDeltaNext<PgDeltaNextSnapshotCaptureResult>(
-          "snapshotCapture",
-          () => ({
-            generation: "v2",
-            snapshot: libraries.serializeSnapshot(result.factBase, {
-              pgVersion: result.pgVersion,
-              redactSecrets: true,
-              profile: profile.id,
-            }),
-            pgVersion: result.pgVersion,
-            diagnostics: normalizePgDeltaNextDiagnostics(
-              result.diagnostics,
-              "snapshot",
+            ...normalizePgDeltaNextDiagnostics(
+              result.driftDiagnostics,
+              "declarativeDrift",
               libraries.encodeSubject,
             ),
-          }),
-        );
-      }),
+            ...normalizePgDeltaNextDiagnostics(planDiagnostics, "plan", libraries.encodeSubject),
+            ...skippedStatementDiagnostics(result.skipped),
+          ],
+          hazards: libraries.summarizeHazards(result.plan, libraryDiagnostics),
+          skipped: result.skipped.map((skipped) => ({
+            file: skipped.file,
+            statement: skipped.stmt,
+          })),
+          removals: libraries.summarizeRemovals(result.plan),
+          ...(input.debug ? { debug: { plan: libraries.serializePlan(result.plan) } } : {}),
+        };
+      });
+    }),
+    captureSnapshot: Effect.fn("PgDeltaNextAdapter.captureSnapshot")(function* (
+      input: PgDeltaNextSnapshotCaptureInput,
+    ) {
+      const profile = yield* tryPgDeltaNext("snapshotCapture", () =>
+        libraries.resolveProfile(input.pool, {
+          redactSecrets: true,
+          skipBaseline: true,
+        }),
+      );
+      const result = yield* tryPgDeltaNext("snapshotCapture", () =>
+        profile.extract(input.pool, { redactSecrets: true }),
+      );
+      return yield* attemptPgDeltaNext<PgDeltaNextSnapshotCaptureResult>("snapshotCapture", () => ({
+        generation: "v2",
+        snapshot: libraries.serializeSnapshot(result.factBase, {
+          pgVersion: result.pgVersion,
+          redactSecrets: true,
+          profile: profile.id,
+        }),
+        pgVersion: result.pgVersion,
+        diagnostics: normalizePgDeltaNextDiagnostics(
+          result.diagnostics,
+          "snapshot",
+          libraries.encodeSubject,
+        ),
+      }));
+    }),
   };
 }
 
diff --git a/apps/cli/src/commands/db/shared/pgdelta-next-artifacts.ts b/apps/cli/src/commands/db/shared/pgdelta-next-artifacts.ts
index fa8cb440f9..14cc4105e1 100644
--- a/apps/cli/src/commands/db/shared/pgdelta-next-artifacts.ts
+++ b/apps/cli/src/commands/db/shared/pgdelta-next-artifacts.ts
@@ -39,7 +39,7 @@ interface PgDeltaNextArtifactMetadata {
  * Writes bundled-engine debug data below the v2 generation. These files are
  * diagnostics only: they are never considered catalog-cache inputs.
  */
-export const savePgDeltaNextDebugArtifacts = Effect.fnUntraced(function* (
+export const savePgDeltaNextDebugArtifacts = Effect.fn("PgDeltaNextArtifacts.save")(function* (
   fs: FileSystem.FileSystem,
   path: Path.Path,
   workdir: string,
diff --git a/apps/cli/src/commands/db/shared/pgdelta-next-shadow.layer.ts b/apps/cli/src/commands/db/shared/pgdelta-next-shadow.layer.ts
index a0b19f1a3f..6fa1993936 100644
--- a/apps/cli/src/commands/db/shared/pgdelta-next-shadow.layer.ts
+++ b/apps/cli/src/commands/db/shared/pgdelta-next-shadow.layer.ts
@@ -331,77 +331,32 @@ export const pgDeltaNextShadowLayer = Layer.effect(
     });
 
     return PgDeltaNextShadow.of({
-      provisionMigrations: (opts) =>
-        Effect.gen(function* () {
-          const backend = yield* currentStackBackend;
-          const port = backend.kind === "stack" ? 0 : yield* nextPort();
-          const built = yield* buildNativeBase(opts);
-          const input = buildNativeInput(opts, built, port);
-          return backend.kind === "stack"
-            ? yield* stackProvisionMigrations(input, cacheOpts(opts, "config"))
-            : yield* provisionMigrations(input, cacheOpts(opts, "config"));
-        }).pipe(Effect.mapError(nextShadowError)),
-      provisionPlan: (opts) =>
-        Effect.gen(function* () {
-          const backend = yield* currentStackBackend;
-          const migrationsPort = backend.kind === "stack" ? 0 : yield* nextPort();
-          const declarativePort = backend.kind === "stack" ? 0 : yield* nextPort(migrationsPort);
-          const built = yield* buildNativeBase(opts);
-          const migrationsInput = buildNativeInput(opts, built, migrationsPort);
-          const declarativeInput = buildNativeInput(opts, built, declarativePort);
-          if (backend.kind === "stack") {
-            const migrations = yield* stackProvisionMigrations(
-              migrationsInput,
-              cacheOpts(opts, "config"),
-            );
-            const declarative = yield* stackProvisionDeclarative(
-              declarativeInput,
-              cacheOpts(opts, "disabled"),
-            );
-            return {
-              migrationsUrl: migrations.migrationsUrl,
-              declarativeUrl: declarative.declarativeUrl,
-              allowSameDatabaseIdentity: allowSameDatabaseIdentityForPlanShadows({
-                declarativeRestoredFromPgDataSnapshot: declarative.restoredFromPgDataSnapshot,
-                sameSnapshotKey:
-                  migrations.snapshotKey !== undefined &&
-                  migrations.snapshotKey === declarative.snapshotKey,
-              }),
-            } satisfies PgDeltaNextPlanShadows;
-          }
-          const [migrationsPeek, declarativePeek] = yield* Effect.all([
-            peekShadowBaseline(migrationsInput.base, cacheOpts(opts, "config")),
-            peekShadowBaseline(declarativeInput.base, cacheOpts(opts, "disabled")),
-          ]);
-          const withPeek = (cache: ShadowCacheOpts, peek: ShadowBaselinePeek): ShadowCacheOpts =>
-            peek.state === "uncachable"
-              ? cache
-              : { ...cache, precomputedKeyInputs: peek.keyInputs };
-          const strategy = resolvePlanShadowStrategy(migrationsPeek, declarativePeek);
-          // Peeked inputs are reused only when acquire immediately follows peek: always for
-          // migrations, only under `parallel` for declarative. Delayed declarative acquires
-          // re-resolve so a mid-run `roles.sql` edit can't publish under a stale key — identity
-          // still comes from the acquired handles' snapshot keys, so this can't lie about lineage.
-          const migrationsOpts = withPeek(cacheOpts(opts, "config"), migrationsPeek);
-          const declarativeOpts =
-            strategy === "parallel"
-              ? withPeek(cacheOpts(opts, "disabled"), declarativePeek)
-              : cacheOpts(opts, "disabled");
-
-          const buffered = strategy === "sequential" ? undefined : bufferedShadowOutput(output);
-          const provisions = runPlanShadowProvisions({
-            strategy,
-            provisionMigrations: (onBaselineSeam) =>
-              provisionMigrations(migrationsInput, migrationsOpts, onBaselineSeam),
-            provisionDeclarative: provisionDeclarative(
-              declarativeInput,
-              declarativeOpts,
-              buffered === undefined ? output : buffered.output,
-            ),
-          });
-          const [migrations, declarative] = yield* buffered === undefined
-            ? provisions
-            : provisions.pipe(Effect.ensuring(buffered.flush));
+      provisionMigrations: Effect.fn("PgDeltaNextShadow.provisionMigrations")(function* (opts) {
+        const backend = yield* currentStackBackend;
+        const port = backend.kind === "stack" ? 0 : yield* nextPort();
+        const built = yield* buildNativeBase(opts);
+        const input = buildNativeInput(opts, built, port);
+        return backend.kind === "stack"
+          ? yield* stackProvisionMigrations(input, cacheOpts(opts, "config"))
+          : yield* provisionMigrations(input, cacheOpts(opts, "config"));
+      }, Effect.mapError(nextShadowError)),
+      provisionPlan: Effect.fn("PgDeltaNextShadow.provisionPlan")(function* (opts) {
+        const backend = yield* currentStackBackend;
+        const migrationsPort = backend.kind === "stack" ? 0 : yield* nextPort();
+        const declarativePort = backend.kind === "stack" ? 0 : yield* nextPort(migrationsPort);
+        const built = yield* buildNativeBase(opts);
+        const migrationsInput = buildNativeInput(opts, built, migrationsPort);
+        const declarativeInput = buildNativeInput(opts, built, declarativePort);
+        yield* Effect.annotateCurrentSpan({ "stack.backend": backend.kind });
+        if (backend.kind === "stack") {
+          const migrations = yield* stackProvisionMigrations(
+            migrationsInput,
+            cacheOpts(opts, "config"),
+          );
+          const declarative = yield* stackProvisionDeclarative(
+            declarativeInput,
+            cacheOpts(opts, "disabled"),
+          );
           return {
             migrationsUrl: migrations.migrationsUrl,
             declarativeUrl: declarative.declarativeUrl,
@@ -412,7 +367,49 @@ export const pgDeltaNextShadowLayer = Layer.effect(
                 migrations.snapshotKey === declarative.snapshotKey,
             }),
           } satisfies PgDeltaNextPlanShadows;
-        }).pipe(Effect.mapError(nextShadowError)),
+        }
+        const [migrationsPeek, declarativePeek] = yield* Effect.all([
+          peekShadowBaseline(migrationsInput.base, cacheOpts(opts, "config")),
+          peekShadowBaseline(declarativeInput.base, cacheOpts(opts, "disabled")),
+        ]);
+        const withPeek = (cache: ShadowCacheOpts, peek: ShadowBaselinePeek): ShadowCacheOpts =>
+          peek.state === "uncachable" ? cache : { ...cache, precomputedKeyInputs: peek.keyInputs };
+        const strategy = resolvePlanShadowStrategy(migrationsPeek, declarativePeek);
+        yield* Effect.annotateCurrentSpan({ "shadow.plan_strategy": strategy });
+        // Peeked inputs are reused only when acquire immediately follows peek: always for
+        // migrations, only under `parallel` for declarative. Delayed declarative acquires
+        // re-resolve so a mid-run `roles.sql` edit can't publish under a stale key — identity
+        // still comes from the acquired handles' snapshot keys, so this can't lie about lineage.
+        const migrationsOpts = withPeek(cacheOpts(opts, "config"), migrationsPeek);
+        const declarativeOpts =
+          strategy === "parallel"
+            ? withPeek(cacheOpts(opts, "disabled"), declarativePeek)
+            : cacheOpts(opts, "disabled");
+        const buffered = strategy === "sequential" ? undefined : bufferedShadowOutput(output);
+        const provisions = runPlanShadowProvisions({
+          strategy,
+          provisionMigrations: (onBaselineSeam) =>
+            provisionMigrations(migrationsInput, migrationsOpts, onBaselineSeam),
+          provisionDeclarative: provisionDeclarative(
+            declarativeInput,
+            declarativeOpts,
+            buffered === undefined ? output : buffered.output,
+          ),
+        });
+        const [migrations, declarative] = yield* buffered === undefined
+          ? provisions
+          : provisions.pipe(Effect.ensuring(buffered.flush));
+        return {
+          migrationsUrl: migrations.migrationsUrl,
+          declarativeUrl: declarative.declarativeUrl,
+          allowSameDatabaseIdentity: allowSameDatabaseIdentityForPlanShadows({
+            declarativeRestoredFromPgDataSnapshot: declarative.restoredFromPgDataSnapshot,
+            sameSnapshotKey:
+              migrations.snapshotKey !== undefined &&
+              migrations.snapshotKey === declarative.snapshotKey,
+          }),
+        } satisfies PgDeltaNextPlanShadows;
+      }, Effect.mapError(nextShadowError)),
     });
   }),
 );
diff --git a/apps/cli/src/commands/db/shared/pgdelta-next-shadow.stack.integration.test.ts b/apps/cli/src/commands/db/shared/pgdelta-next-shadow.stack.integration.test.ts
index 8073f19f52..9b4a0acf11 100644
--- a/apps/cli/src/commands/db/shared/pgdelta-next-shadow.stack.integration.test.ts
+++ b/apps/cli/src/commands/db/shared/pgdelta-next-shadow.stack.integration.test.ts
@@ -15,7 +15,7 @@ import {
 } from "../../../command-internal/global-flags.ts";
 import { DbConnection } from "../../../command-internal/db-connection.service.ts";
 import { DockerRun } from "../../../command-internal/docker-run.service.ts";
-import { dbConnectionLayer } from "../../../command-internal/db-connection.layer.ts";
+import { dbConnectionLayer } from "../../../command-internal/db-connection.sql-pg.layer.ts";
 import { parseConnectionString } from "../../../command-internal/db-config.parse.ts";
 import { StackApi, stackApiLayer } from "../../../command-internal/stack-api.ts";
 import { stackBackendLayer } from "../../../command-internal/stack-backend.ts";
diff --git a/apps/cli/src/commands/db/shared/pgdelta.seam.layer.ts b/apps/cli/src/commands/db/shared/pgdelta.seam.layer.ts
index 1223142205..a493fd8ea4 100644
--- a/apps/cli/src/commands/db/shared/pgdelta.seam.layer.ts
+++ b/apps/cli/src/commands/db/shared/pgdelta.seam.layer.ts
@@ -139,7 +139,7 @@ export const declarativeSeamLayer = Layer.effect(
               }),
           ),
         );
-      }),
+      }).pipe(Effect.withSpan("DeclarativeSeam.ensureLocalDatabaseStarted")),
       ensureLocalPostgresImageCurrent: Effect.gen(function* () {
         const backend = yield* currentStackBackend;
         if (backend.kind === "stack") return;
@@ -286,7 +286,7 @@ export const declarativeSeamLayer = Layer.effect(
             });
           }),
         );
-      }),
+      }).pipe(Effect.withSpan("DeclarativeSeam.ensureLocalPostgresImageCurrent")),
     });
   }),
 ).pipe(Layer.provide(stackApiLayer));
diff --git a/apps/cli/src/commands/db/shared/pgdelta.write.ts b/apps/cli/src/commands/db/shared/pgdelta.write.ts
index 326fa6c335..06da3da61f 100644
--- a/apps/cli/src/commands/db/shared/pgdelta.write.ts
+++ b/apps/cli/src/commands/db/shared/pgdelta.write.ts
@@ -82,7 +82,7 @@ const readManagedDeclarativeSqlFiles = Effect.fnUntraced(function* (
  * files were preserved (see {@link warnPreservedUnmanagedDeclarativeFiles}). Never touches
  * `[db.migrations] schema_paths`; `db pull --declarative` handles that separately.
  */
-export const writeDeclarativeSchemas = Effect.fnUntraced(function* (
+export const writeDeclarativeSchemas = Effect.fn("PgDelta.writeDeclarativeSchemas")(function* (
   fs: FileSystem.FileSystem,
   path: Path.Path,
   declarativeDir: string,
@@ -147,6 +147,11 @@ export const writeDeclarativeSchemas = Effect.fnUntraced(function* (
 
   yield* fs.makeDirectory(declarativeDir, { recursive: true });
   const changed = new Set([...classification.created, ...classification.updated]);
+  yield* Effect.annotateCurrentSpan({
+    "file.count": proposed.length,
+    "file.changed_count": changed.size,
+    "file.removed_count": classification.removed.length,
+  });
   for (const file of proposed) {
     if (!changed.has(file.name)) continue;
     const targetPath = path.join(declarativeDir, file.name);
@@ -253,7 +258,9 @@ const SCHEMA_PATHS_PATTERN = /\nschema_paths = \[[\s\S]*?\]\n/g;
  * literal byte-edit, not a TOML re-serialize, so the rest of the file's comments and
  * formatting are preserved exactly.
  */
-export const updateDeclarativeSchemaPathsConfig = Effect.fnUntraced(function* (
+export const updateDeclarativeSchemaPathsConfig = Effect.fn(
+  "PgDelta.updateDeclarativeSchemaPathsConfig",
+)(function* (
   fs: FileSystem.FileSystem,
   path: Path.Path,
   workdir: string,
diff --git a/apps/cli/src/commands/db/shared/pooler-fallback.ts b/apps/cli/src/commands/db/shared/pooler-fallback.ts
index 69381230a6..cd374fb157 100644
--- a/apps/cli/src/commands/db/shared/pooler-fallback.ts
+++ b/apps/cli/src/commands/db/shared/pooler-fallback.ts
@@ -41,7 +41,7 @@ export const isDirectLinkedHost = (params: {
  * warning and retries once via `runWithConn`. Otherwise returns the original `result`
  * unchanged, so the caller's failure classification always reads the correct stderr.
  */
-export const runWithPoolerFallback = Effect.fnUntraced(function* <E, RRun>(params: {
+export const runWithPoolerFallback = Effect.fn("PoolerFallback.run")(function* <E, RRun>(params: {
   /** The first attempt's result; returned unchanged when no fallback fires. */
   readonly result: PoolerFallbackResult;
   readonly connType: DbConnType;
diff --git a/apps/cli/src/commands/db/shared/shadow-source.ts b/apps/cli/src/commands/db/shared/shadow-source.ts
index 7dcf6df614..e6483fc8a7 100644
--- a/apps/cli/src/commands/db/shared/shadow-source.ts
+++ b/apps/cli/src/commands/db/shared/shadow-source.ts
@@ -83,6 +83,10 @@ export const prepareShadowSource = <E>(
 > =>
   Effect.gen(function* () {
     const { containerId } = handle;
+    yield* Effect.annotateCurrentSpan({
+      "shadow.migration_mode": input.migrationMode ?? "legacy",
+      "shadow.target_local": input.targetLocal,
+    });
 
     const connConfig: PgConnInput = {
       host: input.hostname,
@@ -140,7 +144,7 @@ export const prepareShadowSource = <E>(
       sourceUrl,
       targetUrlOverride,
     } satisfies ShadowSourceResult;
-  });
+  }).pipe(Effect.withSpan("ShadowSource.prepare"));
 
 /** Glob metacharacters recognized here: `*?[` only — not `\`. */
 function hasConfigGlobMeta(pattern: string): boolean {
@@ -331,7 +335,7 @@ export function loadDeclaredSchemas(
     );
     if (!isSchemasDir) return [];
     return yield* walkSqlFilesSorted(fs, path, workdir, schemasDirRel, "failed to walk dir");
-  });
+  }).pipe(Effect.withSpan("ShadowSource.loadDeclaredSchemas"));
 }
 
 /**
diff --git a/apps/cli/src/commands/db/start/SIDE_EFFECTS.md b/apps/cli/src/commands/db/start/SIDE_EFFECTS.md
index 05ade20e61..c0f7385151 100644
--- a/apps/cli/src/commands/db/start/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/db/start/SIDE_EFFECTS.md
@@ -28,7 +28,7 @@ composition reuses too — see that command's `SIDE_EFFECTS.md`):
    container is created on this path.
 4. Print `Starting database...` (fresh volume) or `Starting database from backup...`
    (existing volume — despite the wording, unrelated to `--from-backup`; see
-   `command-internal/db-bootstrap/messages.ts`).
+   `command-internal/db-bootstrap/start-database.ts`).
 5. Resolve the Postgres image (version-pin-aware) and create + start the container.
    `--from-backup` set: a THIRD entrypoint variant (`buildPostgresStartContainerSpec`'s
    `fromBackup` branch) — schema.sql + `_supabase.sql` (no `webhook.sql`), a ported
diff --git a/apps/cli/src/commands/db/start/start.handler.ts b/apps/cli/src/commands/db/start/start.handler.ts
index ced7190d4c..f6c543fbdc 100644
--- a/apps/cli/src/commands/db/start/start.handler.ts
+++ b/apps/cli/src/commands/db/start/start.handler.ts
@@ -25,6 +25,10 @@ export const dbStart = Effect.fn("db.start")(function* (flags: DbStartFlags) {
   const body = Effect.gen(function* () {
     const backend = yield* currentStackBackend;
     const fromBackup = Option.getOrUndefined(flags.fromBackup);
+    yield* Effect.annotateCurrentSpan({
+      "stack.backend": backend.kind,
+      "db.start.from_backup": fromBackup !== undefined && fromBackup.length > 0,
+    });
     if (backend.kind === "stack") {
       if (fromBackup !== undefined && fromBackup.length > 0) {
         return yield* new DbStartFromBackupUnsupportedError({
diff --git a/apps/cli/src/commands/db/start/start.integration.test.ts b/apps/cli/src/commands/db/start/start.integration.test.ts
index debb4eae72..48f591f4dc 100644
--- a/apps/cli/src/commands/db/start/start.integration.test.ts
+++ b/apps/cli/src/commands/db/start/start.integration.test.ts
@@ -1633,7 +1633,7 @@ describe("db start stack backend", () => {
       registered: true,
     })),
     followStatus: Stream.empty,
-    logs: Stream.empty,
+    readLogs: () => Stream.empty,
     credentials: () =>
       Effect.sync(() => {
         state.credentialsCalled = true;
diff --git a/apps/cli/src/commands/db/start/start.layers.ts b/apps/cli/src/commands/db/start/start.layers.ts
index 41c3eb2661..bb56504df5 100644
--- a/apps/cli/src/commands/db/start/start.layers.ts
+++ b/apps/cli/src/commands/db/start/start.layers.ts
@@ -4,7 +4,7 @@ import { localDockerEngineLayer } from "../../../command-internal/db-bootstrap/l
 import { commandRuntimeLayer } from "../../../shared/runtime/command-runtime.layer.ts";
 import { commandSettingsLayer } from "../../../config/command-settings.layer.ts";
 import { httpClientLayer } from "../../../auth/http-debug.layer.ts";
-import { dbConnectionLayer } from "../../../command-internal/db-connection.layer.ts";
+import { dbConnectionLayer } from "../../../command-internal/db-connection.sql-pg.layer.ts";
 import { debugLoggerLayer } from "../../../command-internal/debug-logger.layer.ts";
 import { dockerRunLayer } from "../../../command-internal/docker-run.layer.ts";
 import { telemetryStateLayer } from "../../../telemetry/telemetry-state.layer.ts";
diff --git a/apps/cli/src/commands/experimental/compute/delete/delete.handler.ts b/apps/cli/src/commands/experimental/compute/delete/delete.handler.ts
index b86d13a8d0..02d4e86192 100644
--- a/apps/cli/src/commands/experimental/compute/delete/delete.handler.ts
+++ b/apps/cli/src/commands/experimental/compute/delete/delete.handler.ts
@@ -150,11 +150,13 @@ export const computeDelete = Effect.fn("compute.delete")(function* (flags: Compu
 
     // Skipped only when the GET confirmed nothing exists; an unreadable compute
     // still gets the DELETE, since that's the request the credential may hold.
-    if (deployed !== undefined || !lookup.readable) {
+    const deleteSent = deployed !== undefined || !lookup.readable;
+    if (deleteSent) {
       const deleting = yield* output.task("Deleting compute...");
       yield* deleteCompute(api, projectRef, name).pipe(Effect.tapError(() => deleting.fail()));
       yield* deleting.clear;
     }
+    yield* Effect.annotateCurrentSpan({ "compute.confirmed": yes, "compute.deleted": deleteSent });
 
     // A compute deployed from another checkout has neither a local entry nor a
     // local directory, so there is nothing here that was kept.
diff --git a/apps/cli/src/commands/experimental/compute/list/list.handler.ts b/apps/cli/src/commands/experimental/compute/list/list.handler.ts
index 296e4ad1fb..05e68e5766 100644
--- a/apps/cli/src/commands/experimental/compute/list/list.handler.ts
+++ b/apps/cli/src/commands/experimental/compute/list/list.handler.ts
@@ -143,6 +143,8 @@ export const computeList = Effect.fn("compute.list")(function* (flags: ComputeLi
       };
     });
 
+    yield* Effect.annotateCurrentSpan({ "compute.count": rows.length });
+
     const payload = {
       project_ref: projectRef,
       compute: rows.map((row) => ({
diff --git a/apps/cli/src/commands/experimental/compute/logs/logs.handler.ts b/apps/cli/src/commands/experimental/compute/logs/logs.handler.ts
index cd26ce471b..41c5e68ada 100644
--- a/apps/cli/src/commands/experimental/compute/logs/logs.handler.ts
+++ b/apps/cli/src/commands/experimental/compute/logs/logs.handler.ts
@@ -265,6 +265,11 @@ export const computeLogs = Effect.fn("compute.logs")(function* (
         }
       }
 
+      yield* Effect.annotateCurrentSpan({
+        "compute.log_count": entries.length,
+        "compute.follow": flags.follow,
+      });
+
       const payload = {
         compute_name: name,
         project_ref: projectRef,
@@ -328,7 +333,9 @@ export const computeLogs = Effect.fn("compute.logs")(function* (
       // window and filtering by actual timestamp lets both cases coexist.
       const followFloorMs = flags.tail === 0 ? startedAtMs : Number.NEGATIVE_INFINITY;
 
+      let pollAttempts = 0;
       const pollOnce = Effect.gen(function* () {
+        pollAttempts += 1;
         const cursor = yield* Ref.get(newestSeen);
 
         // One request only ever answers with the newest page of its window, so a
@@ -416,8 +423,10 @@ export const computeLogs = Effect.fn("compute.logs")(function* (
       // A 429 or a blip should not end a tail the user is watching; the spaced
       // schedule rides out a transient failure without spending the rate limit.
       // Anything definitive surfaces on the first attempt.
+      // A tail can run for hours, so polls emit no request spans; the attempt count stands in.
       const poll = pollOnce.pipe(
         Effect.retry({ schedule: readRetrySchedule, while: isRetryableFollowFailure }),
+        Effect.withTracerEnabled(false),
       );
 
       // `repeat` runs the body before applying the schedule, so the first poll is
@@ -436,6 +445,10 @@ export const computeLogs = Effect.fn("compute.logs")(function* (
           .pipe(
             Effect.flatMap((signal) => processControl.setExitCode(signal === "SIGINT" ? 130 : 0)),
           ),
+      ).pipe(
+        Effect.ensuring(
+          Effect.suspend(() => Effect.annotateCurrentSpan({ "poll.attempt_count": pollAttempts })),
+        ),
       );
     }).pipe(Effect.ensuring(linkedProjectCache.cache(projectRef)));
   }).pipe(Effect.ensuring(telemetryState.flush));
diff --git a/apps/cli/src/commands/experimental/compute/logs/logs.integration.test.ts b/apps/cli/src/commands/experimental/compute/logs/logs.integration.test.ts
index 2235925289..1efe2a159a 100644
--- a/apps/cli/src/commands/experimental/compute/logs/logs.integration.test.ts
+++ b/apps/cli/src/commands/experimental/compute/logs/logs.integration.test.ts
@@ -11,6 +11,7 @@ import {
   DateTime,
   Schema,
   Stdio,
+  Tracer,
 } from "effect";
 import { Command } from "effect/unstable/cli";
 import {
@@ -796,6 +797,42 @@ describe("compute logs", () => {
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
 
+  it.live("traces the history read but records follow polls only as a count", () =>
+    Effect.gen(function* () {
+      const repo = yield* project();
+      const { layer } = setupCompute({
+        workdir: repo.dir,
+        routes: {
+          [LOGS_ROUTE]: [
+            logsResponse([computeLogRow({ id: "a", tsMs: T1, message: "first" })]),
+            logsResponse([computeLogRow({ id: "b", tsMs: T2, message: "second" })]),
+          ],
+        },
+      });
+      const spans: Array<Tracer.NativeSpan> = [];
+      const tracer = Tracer.make({
+        span: (options) => {
+          const span = new Tracer.NativeSpan(options);
+          spans.push(span);
+          return span;
+        },
+      });
+
+      yield* computeLogs(flags({ follow: true }), followFor(3)).pipe(
+        Effect.provide(layer),
+        Effect.withTracer(tracer),
+        Effect.withTracerEnabled(true),
+      );
+
+      expect(spans.map((span) => span.name)).toEqual([
+        "compute.logs",
+        "v1GetProjectLogs",
+        "http.client GET",
+      ]);
+      expect(spans[0]?.attributes.get("poll.attempt_count")).toBe(4);
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+
   it.live("does not reprint a line an overlapping window returns again", () =>
     Effect.gen(function* () {
       const repo = yield* project();
diff --git a/apps/cli/src/commands/experimental/compute/new/new.handler.ts b/apps/cli/src/commands/experimental/compute/new/new.handler.ts
index 1711ea0e95..e08d23720a 100644
--- a/apps/cli/src/commands/experimental/compute/new/new.handler.ts
+++ b/apps/cli/src/commands/experimental/compute/new/new.handler.ts
@@ -341,6 +341,12 @@ export const computeNew = Effect.fn("compute.new")(function* (flags: ComputeNewF
     // Everything below this line changes the user's disk, and nothing below it
     // can fail for a reason the plan above could have caught.
     const starters = Object.entries(COMPUTE_STACKS[runtime]);
+    yield* Effect.annotateCurrentSpan({
+      "compute.runtime": runtime,
+      "compute.size": size,
+      "compute.exposure": exposure,
+      "compute.starter_file_count": starters.length,
+    });
     const destinationExisted = yield* fs.exists(destination);
     const removeScaffold = Effect.gen(function* () {
       for (const [filename] of starters) {
diff --git a/apps/cli/src/commands/experimental/compute/push/push.handler.ts b/apps/cli/src/commands/experimental/compute/push/push.handler.ts
index 2d33bef76f..3afe8aee0a 100644
--- a/apps/cli/src/commands/experimental/compute/push/push.handler.ts
+++ b/apps/cli/src/commands/experimental/compute/push/push.handler.ts
@@ -217,7 +217,7 @@ function addYourCode(sourceDisplay: string): string {
   return `Add your compute's code to ${sourceDisplay}, then run this command again.`;
 }
 
-const deployOneCompute = Effect.fnUntraced(function* (input: {
+const deployOneCompute = Effect.fn("compute.push.deployOne")(function* (input: {
   readonly project: ComputeProject;
   readonly name: string;
   readonly projectRef: string;
@@ -324,6 +324,13 @@ const deployOneCompute = Effect.fnUntraced(function* (input: {
   // finding it out mid-walk would mean reporting it after the packaging step announced itself.
   const exclude = yield* compileComputeExclude({ name, patterns: compute.entry?.exclude });
 
+  yield* Effect.annotateCurrentSpan({
+    "compute.runtime": runtime,
+    "compute.size": size,
+    "compute.exposure": exposure,
+    "compute.instances": instances,
+  });
+
   let contextUploadId: string;
   {
     const packaging = yield* output.task("Packaging compute...");
@@ -331,6 +338,11 @@ const deployOneCompute = Effect.fnUntraced(function* (input: {
       Effect.tapError(() => packaging.fail()),
     );
     yield* packaging.clear;
+    yield* Effect.annotateCurrentSpan({
+      "compute.file_count": packaged.fileCount,
+      "compute.excluded_count": packaged.excludedCount,
+      "compute.bundle_bytes": packaged.archive.length,
+    });
     // The excluded count rides along on the same line, and only when patterns are configured:
     // an over-broad pattern is otherwise visible only as a file count nobody had a number to
     // compare against, and by then the archive is already uploaded.
@@ -409,6 +421,11 @@ const deployOneCompute = Effect.fnUntraced(function* (input: {
               : Effect.void,
         }).pipe(Effect.tapError(() => deploying.fail()));
 
+  yield* Effect.annotateCurrentSpan({
+    "compute.waited": !input.noWait && accepted.buildState === "building",
+    "compute.build_state": settled.buildState,
+  });
+
   // Checked regardless of whether the build was waited on: the verdict can
   // arrive on the deploy response as readily as on a poll.
   if (settled.buildState === "failed") {
diff --git a/apps/cli/src/commands/experimental/stack/destroy/SIDE_EFFECTS.md b/apps/cli/src/commands/experimental/stack/destroy/SIDE_EFFECTS.md
index 8f7f722738..fbd23fd571 100644
--- a/apps/cli/src/commands/experimental/stack/destroy/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/experimental/stack/destroy/SIDE_EFFECTS.md
@@ -6,7 +6,7 @@ files remain. The experimental feature flag controls command registration.
 
 ## Selection and confirmation
 
-Select the current project/branch/name, `--stack <name>`, or `--stack-id <id>`.
+Select the current project/branch/name, `--stack <name>`, or `--stack-id <id or unique prefix>`.
 The selectors are mutually exclusive; a missing target fails. Explicit legacy
 `-o/--output` is rejected in favor of `--output-format`.
 
diff --git a/apps/cli/src/commands/experimental/stack/destroy/destroy.command.ts b/apps/cli/src/commands/experimental/stack/destroy/destroy.command.ts
index 3a05bced3d..d32d57f57e 100644
--- a/apps/cli/src/commands/experimental/stack/destroy/destroy.command.ts
+++ b/apps/cli/src/commands/experimental/stack/destroy/destroy.command.ts
@@ -13,7 +13,7 @@ const config = {
     Flag.optional,
   ),
   stackId: Flag.string("stack-id").pipe(
-    Flag.withDescription("Destroy an existing stack by id."),
+    Flag.withDescription("Destroy an existing stack by id or unique id prefix."),
     Flag.optional,
   ),
 } as const;
diff --git a/apps/cli/src/commands/experimental/stack/destroy/destroy.handler.ts b/apps/cli/src/commands/experimental/stack/destroy/destroy.handler.ts
index 606b0da0f8..07cde13aee 100644
--- a/apps/cli/src/commands/experimental/stack/destroy/destroy.handler.ts
+++ b/apps/cli/src/commands/experimental/stack/destroy/destroy.handler.ts
@@ -107,6 +107,10 @@ export const stackDestroy = Effect.fn("experimental.stack.destroy")(function* (
       ),
       Effect.mapError(destroyError),
     );
+    yield* Effect.annotateCurrentSpan({
+      "stack.prompted": !yes,
+      "stack.runtime_cleanup": result.runtimeCleanup,
+    });
     if (result.runtimeCleanup === "skipped")
       yield* output.warn(skippedRuntimeCleanupWarning(`stack ${target.id}`, result));
     if (output.format !== "text")
diff --git a/apps/cli/src/commands/experimental/stack/destroy/destroy.integration.test.ts b/apps/cli/src/commands/experimental/stack/destroy/destroy.integration.test.ts
index 402938083a..b09a00292a 100644
--- a/apps/cli/src/commands/experimental/stack/destroy/destroy.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/destroy/destroy.integration.test.ts
@@ -119,6 +119,27 @@ describe("stack destroy", () => {
     }).pipe(Effect.provide(live)),
   );
 
+  it.live("destroys only the stack addressed by the short ID that stack list shows", () =>
+    Effect.gen(function* () {
+      const f = yield* fixture(true);
+      const other = yield* f.api.create({
+        ...f.locations,
+        projectRoot: f.root,
+        name: "other",
+        runtime: "native",
+      });
+
+      yield* stackDestroy({ ...f.flags, stackId: Option.some(f.stack.id.slice(0, 8)) }).pipe(
+        Effect.provide(f.layer),
+      );
+
+      expect((yield* f.api.discover(f.locations)).map(({ definition }) => definition.id)).toEqual([
+        other.id,
+      ]);
+      expect(f.output.stdoutText).toContain(`Stack ${f.stack.id} destroyed.`);
+    }).pipe(Effect.provide(live)),
+  );
+
   it.live(
     "destroys a live namespace and standalone services while preserving caller-owned uploads",
     () =>
diff --git a/apps/cli/src/commands/experimental/stack/list/SIDE_EFFECTS.md b/apps/cli/src/commands/experimental/stack/list/SIDE_EFFECTS.md
index d4ada831f3..a006346557 100644
--- a/apps/cli/src/commands/experimental/stack/list/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/experimental/stack/list/SIDE_EFFECTS.md
@@ -19,8 +19,8 @@ Entries contain `id`, `project_root`, `name`, `branch_context`, `runtime` (nativ
 docker, or podman), and `owner` (reachable or unavailable). Owner availability is
 not service lifecycle or health. Entries sort by project root, name, then ID.
 Text shows NAME, PROJECT, BRANCH, RUNTIME, OWNER, and a compact ID. An empty
-registry prints `No managed stacks found.` Use `--output-format json` to obtain
-the full ID required by `--stack-id`; the text column shows only a prefix.
+registry prints `No managed stacks found.` The text column shows an ID prefix that
+`--stack-id` accepts while it stays unique; `--output-format json` shows full IDs.
 
 JSON emits `{ "stacks": [...], "message": "" }`; stream-json wraps that data in
 one result event. State entries that cannot be read or decoded are skipped with a warning on
diff --git a/apps/cli/src/commands/experimental/stack/list/list.handler.ts b/apps/cli/src/commands/experimental/stack/list/list.handler.ts
index 0d8b268265..a0bb647a19 100644
--- a/apps/cli/src/commands/experimental/stack/list/list.handler.ts
+++ b/apps/cli/src/commands/experimental/stack/list/list.handler.ts
@@ -58,6 +58,7 @@ export const stackList = Effect.fn("experimental.stack.list")(function* () {
         }
         return 0;
       });
+    yield* Effect.annotateCurrentSpan({ "stack.count": stacks.length });
     if (output.format === "text") {
       yield* output.raw(
         stacks.length === 0
diff --git a/apps/cli/src/commands/experimental/stack/logs/SIDE_EFFECTS.md b/apps/cli/src/commands/experimental/stack/logs/SIDE_EFFECTS.md
index 2a9a9e92d3..d924a73b05 100644
--- a/apps/cli/src/commands/experimental/stack/logs/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/experimental/stack/logs/SIDE_EFFECTS.md
@@ -1,42 +1,80 @@
 # `supabase stack logs`
 
-Streams live stdout/stderr from the selected saved stack. The experimental
-feature flag controls command registration. It connects to an existing owner;
-it never launches an owner or starts/stops a service.
+Prints the retained service logs of the selected saved stack and exits; with
+`-f/--follow` it then streams new lines until interrupted. The experimental
+feature flag controls command registration. It never launches an owner or
+starts/stops a service.
 
 ## Selection and files
 
-Select the current project/branch/name, `--stack <name>`, or `--stack-id <id>`.
+Select the current project/branch/name, `--stack <name>`, or `--stack-id <id or unique prefix>`.
 The selectors are mutually exclusive. By default, only composition members are
-included. `--service <kind-or-instance-id>` can also select standalone instances.
-An unavailable owner, missing stack, or unmatched service fails with status 1.
+included. `--service <kind-or-instance-id>` is repeatable and can also select
+standalone instances; a value that matches no saved instance fails with status 1.
+A missing stack fails with status 1.
 
-Reads saved definitions under `<SUPABASE_HOME or ~/.supabase>/stacks/<id>/`.
-Discovery ensures the registry directory exists with mode 0700 and probes local
-owners. Shared routing/settings may read project config and profiles. No project
-files, service configuration, artifacts, or data are changed.
+Reads saved definitions under `<SUPABASE_HOME or ~/.supabase>/stacks/<id>/` and
+the persisted segments under
+`<SUPABASE_HOME or ~/.supabase>/stacks/<id>/logs/<service>/<instance-id>/<generation>.log`
+directly, so history is readable while the owner is down. Discovery ensures the
+registry directory exists with mode 0700 and probes local owners. Shared
+routing/settings may read project config and profiles. No project files,
+service configuration, artifacts, logs, or data are changed.
 
-## Output and cancellation
+## History, follow, and flags
 
-This is a live-only stream with no retained history, cursor, or `--tail` option.
-It continues until interrupted or the selected streams close. `--follow` is
-unnecessary and is not accepted. Legacy `-o/--output` and finite JSON output are
-rejected; use text or `--output-format stream-json`.
+`--tail N` (default 200, 0 prints none) keeps the newest N output lines across
+the selected services, with the `launch` and `lost` markers between them.
+`--since` accepts a duration before now (`30s`, `10m`, `1h30m`, `2d`), an
+ISO-8601 time, or `start`, which keeps the records of each instance's current
+launch and later ones, in history and while following. The current launch is the
+launch id saved in the stack definition, which keeps increasing across owner
+restarts, or else the highest launch record in history (all records when
+retention removed that launch record). Records are
+ordered by timestamp, service, instance, and file position. Timestamps are the
+owner's clock at each line's first byte. Lines end at `\n`, `\r\n`, or a lone
+`\r`, so carriage-return progress updates print as separate lines. History is
+read as a stream holding at most N lines per instance, while every matching line
+is counted for the footer.
 
-Text writes `<timestamp> <service>/<instance-id>/<stream>: <line>`. Terminal
-control sequences are stripped from text. Stream JSON emits `log-entry` events
-with `timestamp`, `service`, `instance_id`, `stream`, `line`, and `source: "live"`.
-Lines preserve their content in machine output. UTF-8 and line fragments are
-assembled separately for each instance and stdout/stderr channel. Timestamps
-reflect receipt by the CLI. Delivery is best effort: slow subscribers can lose entries. Ordering across
-stdout/stderr channels and different services is not guaranteed.
+`-f/--follow` requires a reachable owner: without one it fails with status 1
+before printing anything and suggests running without `--follow`. It prints the
+history, then streams each instance's new records through the owner from the
+last record read, so no record is repeated or skipped between history and live
+output. With `--tail 0` no history is read and the owner starts each follow at
+its current end. A selected instance the running owner does not serve is named
+in a warning and not followed; when it serves none of them, the command fails
+with status 1 after printing the history. The owner's log shipping to Analytics reads the persisted logs
+separately and does not affect this command.
 
-Interrupting the command cancels its subscriptions, exits with status 130, and
-leaves the owner and services running. Successful stream completion exits 0;
-selection, connection, or stream failures exit 1.
+## Output
+
+Text writes `<service> | <HH:MM:SS.mmm> <line>` with the service labels padded
+to one width; a service kind selected more than once is labelled
+`<service>:<first 8 characters of the instance id>`. Times are local. `launch`
+and `lost` records are dim separator lines (`--- launch 2 ---`,
+`--- 3 output chunks lost ---`, `--- older records were removed by retention ---`).
+Labels are coloured and markers dimmed only when stdout is a colour-capable
+terminal. Terminal control sequences are stripped from text. When a non-zero
+tail hides older lines, stderr gets
+`showing last 200 of 5,234 lines, use --tail/--since`; an empty history without
+`--follow` prints `No retained log lines for the selected services.` on stderr.
+
+Stream JSON emits a `log-entry` event per output line with `timestamp`,
+`service`, `instance_id`, `stream` (`stdout` or `stderr`), `line`, and `source`
+(`history` or `live`), and a `log-marker` event per marker with `timestamp`,
+`service`, `instance_id`, `kind` (`launch` or `lost`), `source`, and, for chunks
+lost before they were written, `count` and, when known, `stream`. A `lost` marker without
+`count` reports segments removed by retention. `--output-format json` prints
+one array of the same objects; it cannot be combined with `--follow`. Lines
+preserve their content in machine output. Legacy `-o/--output` is rejected.
+
+Interrupting a follow cancels its subscriptions, exits with status 130, and
+leaves the owner and services running. History reads and completed follows exit
+0; selection, owner, or read failures exit 1.
 
 ## Telemetry
 
-Standard command telemetry is retained; log contents are not custom telemetry
-properties. Telemetry flushes on every exit to
+Standard command telemetry is retained, with `-f` reported as `follow`; log
+contents are not custom telemetry properties. Telemetry flushes on every exit to
 `<SUPABASE_HOME or ~/.supabase>/telemetry.json`.
diff --git a/apps/cli/src/commands/experimental/stack/logs/logs.command.ts b/apps/cli/src/commands/experimental/stack/logs/logs.command.ts
index f895e7151d..8b707c123b 100644
--- a/apps/cli/src/commands/experimental/stack/logs/logs.command.ts
+++ b/apps/cli/src/commands/experimental/stack/logs/logs.command.ts
@@ -12,12 +12,35 @@ const config = {
     Flag.optional,
   ),
   stackId: Flag.string("stack-id").pipe(
-    Flag.withDescription("Read logs from an existing stack by id."),
+    Flag.withDescription("Read logs from an existing stack by id or unique id prefix."),
     Flag.optional,
   ),
   service: Flag.string("service").pipe(
     Flag.withDescription(
-      "Stream one service kind or instance ID; defaults to composition members.",
+      "Read one service kind or instance ID; repeat to select several. Defaults to composition members.",
+    ),
+    Flag.atLeast(0),
+  ),
+  follow: Flag.boolean("follow").pipe(
+    Flag.withAlias("f"),
+    Flag.withDescription(
+      "After the history, keep streaming new lines until interrupted; requires a running stack.",
+    ),
+    Flag.withDefault(false),
+  ),
+  tail: Flag.integer("tail").pipe(
+    Flag.filter(
+      (tail) => tail >= 0,
+      (tail) => `Expected --tail to be 0 or more, got ${tail}`,
+    ),
+    Flag.withDescription(
+      "Number of retained lines to print across the selected services (default 200); 0 prints none.",
+    ),
+    Flag.withDefault(200),
+  ),
+  since: Flag.string("since").pipe(
+    Flag.withDescription(
+      "Only print lines since a duration ago (10m, 1h30m), an ISO-8601 time, or start for each service's latest launch.",
     ),
     Flag.optional,
   ),
@@ -26,19 +49,28 @@ const config = {
 export type StackLogsFlags = CliCommand.Command.Config.Infer<typeof config>;
 
 export const stackLogsCommand = Command.make("logs", config).pipe(
-  Command.withDescription("Stream live logs until interrupted; retained history is unavailable."),
-  Command.withShortDescription("Stream managed local stack logs"),
+  Command.withDescription(
+    "Print retained service logs and exit; with --follow, keep streaming new lines. History is readable while the stack is stopped.",
+  ),
+  Command.withShortDescription("Show managed local stack logs"),
   Command.withExamples([
     {
-      command: "supabase stack logs --service database",
-      description: "Stream new database logs",
+      command: "supabase stack logs --service database --since 10m",
+      description: "Print database lines from the last ten minutes",
     },
     {
-      command: "supabase stack logs --output-format stream-json",
-      description: "Stream new stack logs as structured events",
+      command: "supabase stack logs -f --tail 0",
+      description: "Stream only new lines until interrupted",
+    },
+    {
+      command: "supabase stack logs --follow --output-format stream-json",
+      description: "Stream history and new lines as structured events",
     },
   ]),
   Command.withHandler((flags) =>
-    stackLogs(flags).pipe(withCommandTelemetry({ flags, config }), withJsonErrorHandling),
+    stackLogs(flags).pipe(
+      withCommandTelemetry({ flags, config, aliases: { f: "follow" } }),
+      withJsonErrorHandling,
+    ),
   ),
 );
diff --git a/apps/cli/src/commands/experimental/stack/logs/logs.format.ts b/apps/cli/src/commands/experimental/stack/logs/logs.format.ts
new file mode 100644
index 0000000000..d1a204c66f
--- /dev/null
+++ b/apps/cli/src/commands/experimental/stack/logs/logs.format.ts
@@ -0,0 +1,241 @@
+import { DateTime, Option } from "effect";
+import type { LogPosition, LogRecord, StackLogRecord } from "@supabase/stack/effect";
+import {
+  aqua,
+  blue,
+  type ColorStream,
+  dim,
+  green,
+  magenta,
+  yellow,
+} from "../../../../command-internal/colors.ts";
+import { stripControlSequences } from "../../../../shared/output/strip-control-sequences.ts";
+import { markerText } from "../../../../command-internal/stack-log-events.ts";
+
+/** A `--since` bound: an absolute time, or each instance's latest launch. */
+export type SinceBound =
+  | { readonly kind: "time"; readonly iso: string }
+  | { readonly kind: "start" };
+
+const durationShape = /^(?:\d+(?:\.\d+)?(?:ms|s|m|h|d))+$/u;
+const durationPart = /(\d+(?:\.\d+)?)(ms|s|m|h|d)/gu;
+const unitMillis: Readonly<Record<string, number>> = {
+  ms: 1,
+  s: 1_000,
+  m: 60_000,
+  h: 3_600_000,
+  d: 86_400_000,
+};
+const isoDate = /^\d{4}-\d{2}-\d{2}/u;
+
+/** Parses `start`, a duration before `nowMillis` such as `1h30m`, or an ISO-8601 time. */
+export const parseSince = (value: string, nowMillis: number): SinceBound | undefined => {
+  if (value === "start") return { kind: "start" };
+  if (durationShape.test(value)) {
+    let millis = 0;
+    for (const [, amount, unit] of value.matchAll(durationPart))
+      millis += Number(amount) * (unitMillis[unit ?? ""] ?? 0);
+    return Option.match(DateTime.make(nowMillis - millis), {
+      onNone: () => undefined,
+      onSome: (time) => ({ kind: "time", iso: DateTime.formatIso(time) }),
+    });
+  }
+  if (!isoDate.test(value)) return undefined;
+  return Option.match(DateTime.make(value), {
+    onNone: () => undefined,
+    onSome: (time) => ({ kind: "time", iso: DateTime.formatIso(time) }),
+  });
+};
+
+const isLine = (record: LogRecord) => record.kind === "stdout" || record.kind === "stderr";
+
+/** The newest `tail` output lines, with the markers between them, and how many lines exist. */
+export interface LogWindow {
+  readonly records: ReadonlyArray<StackLogRecord>;
+  readonly shown: number;
+  readonly total: number;
+}
+
+const tailWindow = (records: ReadonlyArray<StackLogRecord>, tail: number): LogWindow => {
+  const total = records.filter(isLine).length;
+  if (total <= tail) return { records, shown: total, total };
+  let seen = 0;
+  let start = records.length;
+  while (seen < tail && start > 0) {
+    start -= 1;
+    const record = records[start];
+    if (record !== undefined && isLine(record)) seen += 1;
+  }
+  return { records: seen === 0 ? [] : records.slice(start), shown: seen, total };
+};
+
+const comparePositions = (left: LogPosition, right: LogPosition) =>
+  left.generation - right.generation || left.byteOffset - right.byteOffset;
+
+const origin: LogPosition = { generation: 0, byteOffset: 0 };
+const compareText = (left: string, right: string) => (left < right ? -1 : left > right ? 1 : 0);
+const compareRecords = (left: StackLogRecord, right: StackLogRecord) =>
+  compareText(left.timestamp, right.timestamp) ||
+  compareText(left.service, right.service) ||
+  compareText(left.instanceId, right.instanceId) ||
+  comparePositions(
+    left.position ?? left.resumeAt ?? origin,
+    right.position ?? right.resumeAt ?? origin,
+  );
+
+interface Launch {
+  readonly id: number;
+  /** Unknown until its launch record is read; a saved launch may not have written one. */
+  readonly timestamp: string | undefined;
+}
+
+interface InstanceTail {
+  records: Array<StackLogRecord>;
+  head: number;
+  lines: number;
+  total: number;
+  launch: Launch | undefined;
+}
+
+/** Whether a record belongs to `launchId` or a later launch; a gap marker carries no launch id. */
+export const isFromLaunch = (record: LogRecord, launchId: number | undefined) =>
+  launchId === undefined || record.launchId === undefined || record.launchId >= launchId;
+
+/** Launch ids increase per instance; a gap marker carries none, so its time decides. */
+const fromLaunch = (record: StackLogRecord, launch: Launch) =>
+  record.launchId === undefined
+    ? launch.timestamp === undefined || record.timestamp >= launch.timestamp
+    : isFromLaunch(record, launch.id);
+
+/**
+ * Collects each instance's newest `tail` lines and last position. With `startLaunches`, it keeps
+ * only the records of each instance's current launch: its saved launch id, or else its highest
+ * launch record, which `launches` reports for following.
+ */
+export const makeHistoryCollector = (
+  tail: number,
+  startLaunches: ReadonlyMap<string, number> | undefined,
+) => {
+  const instances = new Map<string, InstanceTail>();
+  const positions = new Map<string, LogPosition>();
+  const launches = new Map(startLaunches);
+  const push = (record: StackLogRecord) => {
+    const position = record.position;
+    const last = positions.get(record.instanceId);
+    if (position !== undefined && (last === undefined || comparePositions(position, last) > 0))
+      positions.set(record.instanceId, position);
+    let state = instances.get(record.instanceId);
+    if (state === undefined) {
+      const saved = startLaunches?.get(record.instanceId);
+      state = {
+        records: [],
+        head: 0,
+        lines: 0,
+        total: 0,
+        launch: saved === undefined ? undefined : { id: saved, timestamp: undefined },
+      };
+      instances.set(record.instanceId, state);
+    }
+    if (startLaunches !== undefined) {
+      const latest = state.launch;
+      if (
+        record.kind === "launch" &&
+        record.launchId !== undefined &&
+        (latest === undefined ||
+          record.launchId > latest.id ||
+          (record.launchId === latest.id && latest.timestamp === undefined))
+      ) {
+        const launch = { id: record.launchId, timestamp: record.timestamp };
+        state.records = state.records.slice(state.head).filter((kept) => fromLaunch(kept, launch));
+        state.head = 0;
+        state.lines = state.records.filter(isLine).length;
+        state.total = state.lines;
+        state.launch = launch;
+        launches.set(record.instanceId, launch.id);
+      } else if (latest !== undefined && !fromLaunch(record, latest)) return;
+    }
+    const line = isLine(record);
+    if (line) state.total += 1;
+    // Kept records stay in display order; a record older than every kept line of a full window
+    // would be trimmed at once.
+    const oldest = state.records[state.head];
+    if (state.lines >= tail && oldest !== undefined && compareRecords(record, oldest) < 0) return;
+    let low = state.head;
+    let high = state.records.length;
+    while (low < high) {
+      const middle = (low + high) >>> 1;
+      const kept = state.records[middle];
+      if (kept !== undefined && compareRecords(kept, record) <= 0) low = middle + 1;
+      else high = middle;
+    }
+    if (low === state.records.length) state.records.push(record);
+    else state.records.splice(low, 0, record);
+    if (line) state.lines += 1;
+    while (state.lines > tail && state.head < state.records.length) {
+      const dropped = state.records[state.head];
+      state.head += 1;
+      if (dropped !== undefined && isLine(dropped)) state.lines -= 1;
+    }
+    if (state.head > 1024 && state.head * 2 > state.records.length) {
+      state.records = state.records.slice(state.head);
+      state.head = 0;
+    }
+  };
+  const finish = (): {
+    readonly window: LogWindow;
+    readonly positions: typeof positions;
+    readonly launches: ReadonlyMap<string, number>;
+  } => {
+    const kept = [...instances.values()].flatMap((state) => state.records.slice(state.head));
+    const total = [...instances.values()].reduce((sum, state) => sum + state.total, 0);
+    const window = tailWindow(kept.toSorted(compareRecords), tail);
+    return { window: { ...window, total }, positions, launches };
+  };
+  return { push, finish };
+};
+
+/** Whether a followed record comes after the history already printed. */
+export const isAfter = (record: LogRecord, printed: LogPosition | undefined) =>
+  printed === undefined ||
+  record.position === undefined ||
+  comparePositions(record.position, printed) > 0;
+
+const palette = [aqua, yellow, green, magenta, blue];
+const pad = (value: number, width: number) => String(value).padStart(width, "0");
+
+const localTime = (iso: string) =>
+  Option.match(DateTime.make(iso), {
+    onNone: () => iso,
+    onSome: (time) => {
+      const parts = DateTime.toParts(DateTime.setZone(time, DateTime.zoneMakeLocal()));
+      return `${pad(parts.hour, 2)}:${pad(parts.minute, 2)}:${pad(parts.second, 2)}.${pad(parts.millisecond, 3)}`;
+    },
+  });
+
+/** Formats records as `<label> | <local time> <line>`, labels aligned across `instances`. */
+export const makeTextFormatter = (
+  instances: ReadonlyArray<{ readonly id: string; readonly service: string }>,
+  stream: ColorStream,
+) => {
+  const kinds = new Map<string, number>();
+  for (const { service } of instances) kinds.set(service, (kinds.get(service) ?? 0) + 1);
+  const labels = new Map(
+    instances.map(({ id, service }, index) => {
+      const text = (kinds.get(service) ?? 0) > 1 ? `${service}:${id.slice(0, 8)}` : service;
+      return [id, { text, paint: palette[index % palette.length] ?? aqua }] as const;
+    }),
+  );
+  const width = Math.max(0, ...[...labels.values()].map(({ text }) => text.length));
+  return (record: StackLogRecord): string => {
+    const label = labels.get(record.instanceId) ?? { text: record.service, paint: aqua };
+    const prefix = `${label.paint(label.text.padEnd(width), stream)} | `;
+    const time = localTime(record.timestamp);
+    return isLine(record)
+      ? `${prefix}${time} ${stripControlSequences(record.text ?? "")}\n`
+      : `${prefix}${dim(`${time} ${markerText(record)}`, stream)}\n`;
+  };
+};
+
+/** The note printed when the tail hides older lines. */
+export const truncationFooter = (window: LogWindow) =>
+  `showing last ${window.shown.toLocaleString("en-US")} of ${window.total.toLocaleString("en-US")} lines, use --tail/--since`;
diff --git a/apps/cli/src/commands/experimental/stack/logs/logs.format.unit.test.ts b/apps/cli/src/commands/experimental/stack/logs/logs.format.unit.test.ts
new file mode 100644
index 0000000000..2e2bf2a006
--- /dev/null
+++ b/apps/cli/src/commands/experimental/stack/logs/logs.format.unit.test.ts
@@ -0,0 +1,128 @@
+import { DateTime } from "effect";
+import { describe, expect, it } from "vitest";
+import type { StackLogRecord } from "@supabase/stack/effect";
+import { makeHistoryCollector, parseSince } from "./logs.format.ts";
+
+const now = Date.parse("2026-09-29T12:00:00.000Z");
+
+describe("parseSince", () => {
+  it("subtracts compound durations from now", () => {
+    expect(parseSince("1h30m", now)).toEqual({ kind: "time", iso: "2026-09-29T10:30:00.000Z" });
+    expect(parseSince("2d", now)).toEqual({ kind: "time", iso: "2026-09-27T12:00:00.000Z" });
+    expect(parseSince("1.5s", now)).toEqual({ kind: "time", iso: "2026-09-29T11:59:58.500Z" });
+  });
+
+  it("accepts ISO-8601 times and start, and rejects bare numbers and words", () => {
+    expect(parseSince("2026-09-29T11:00:00+02:00", now)).toEqual({
+      kind: "time",
+      iso: "2026-09-29T09:00:00.000Z",
+    });
+    expect(parseSince("start", now)).toEqual({ kind: "start" });
+    expect(parseSince("10", now)).toBeUndefined();
+    expect(parseSince("soon", now)).toBeUndefined();
+  });
+
+  it("rejects durations reaching past the representable time range", () => {
+    expect(parseSince("99999999999d", now)).toBeUndefined();
+    expect(parseSince(`${"9".repeat(400)}s`, now)).toBeUndefined();
+  });
+});
+
+describe("makeHistoryCollector", () => {
+  const at = (
+    instanceId: string,
+    offset: number,
+    kind: StackLogRecord["kind"],
+    text = "",
+    launchId = 1,
+  ): StackLogRecord => ({
+    kind,
+    timestamp: DateTime.formatIso(DateTime.makeUnsafe(now + offset)),
+    launchId,
+    text,
+    service: "auth",
+    instanceId,
+    position: { generation: 1, byteOffset: offset },
+  });
+  const textsOf = (records: ReadonlyArray<StackLogRecord>) =>
+    records.filter(({ kind }) => kind !== "launch").map(({ text }) => text);
+
+  it("keeps the newest lines across instances, counts every line, and tracks positions", () => {
+    const collector = makeHistoryCollector(2, undefined);
+    for (let offset = 0; offset < 1_000; offset += 2) {
+      collector.push(at("a", offset, "stdout", `a ${offset}`));
+      collector.push(at("b", offset + 1, "stdout", `b ${offset + 1}`));
+    }
+
+    const { window, positions } = collector.finish();
+
+    expect(window.records.map(({ text }) => text)).toEqual(["a 998", "b 999"]);
+    expect(window).toMatchObject({ shown: 2, total: 1_000 });
+    expect(positions.get("a")).toEqual({ generation: 1, byteOffset: 998 });
+  });
+
+  it("keeps the newest line by time when an older partial line is flushed after it", () => {
+    const collector = makeHistoryCollector(1, undefined);
+    collector.push({
+      ...at("a", 10, "stdout", "newer"),
+      position: { generation: 1, byteOffset: 0 },
+    });
+    collector.push({
+      ...at("a", 5, "stderr", "late older"),
+      position: { generation: 1, byteOffset: 40 },
+    });
+
+    const { window, positions } = collector.finish();
+
+    expect(window.records.map(({ text }) => text)).toEqual(["newer"]);
+    expect(window).toMatchObject({ shown: 1, total: 2 });
+    expect(positions.get("a")).toEqual({ generation: 1, byteOffset: 40 });
+  });
+
+  it("starts each instance at its highest launch and keeps instances without one", () => {
+    const collector = makeHistoryCollector(10, new Map());
+    collector.push(at("a", 0, "launch", "", 1));
+    collector.push(at("a", 1, "stdout", "a old", 1));
+    collector.push(at("a", 5, "launch", "", 2));
+    collector.push(at("a", 3, "stderr", "a late old", 1));
+    collector.push(at("a", 6, "stdout", "a new", 2));
+    collector.push(at("b", 2, "stdout", "b retained"));
+
+    const { window } = collector.finish();
+
+    expect(textsOf(window.records)).toEqual(["b retained", "a new"]);
+    expect(window.total).toBe(2);
+  });
+
+  it("keeps the highest launch when an older launch's first output arrives after it", () => {
+    const collector = makeHistoryCollector(10, new Map());
+    collector.push(at("a", 10, "launch", "", 2));
+    collector.push(at("a", 11, "stdout", "second launch", 2));
+    collector.push(at("a", 20, "launch", "", 1));
+    collector.push(at("a", 21, "stdout", "delayed first launch", 1));
+    collector.push(at("a", 30, "stdout", "second launch again", 2));
+
+    const { window } = collector.finish();
+
+    expect(textsOf(window.records)).toEqual(["second launch", "second launch again"]);
+    expect(window.records.filter(({ kind }) => kind === "launch")).toHaveLength(1);
+  });
+
+  it("starts at the launch of the latest owner run, whose ids continue the earlier run's", () => {
+    const collector = makeHistoryCollector(10, new Map());
+    collector.push({ ...at("a", 0, "launch", "", 3), position: { generation: 1, byteOffset: 0 } });
+    collector.push({
+      ...at("a", 1, "stdout", "earlier run", 3),
+      position: { generation: 1, byteOffset: 40 },
+    });
+    collector.push({ ...at("a", 50, "launch", "", 4), position: { generation: 2, byteOffset: 0 } });
+    collector.push({
+      ...at("a", 51, "stdout", "restarted run", 4),
+      position: { generation: 2, byteOffset: 40 },
+    });
+
+    const { window } = collector.finish();
+
+    expect(textsOf(window.records)).toEqual(["restarted run"]);
+  });
+});
diff --git a/apps/cli/src/commands/experimental/stack/logs/logs.handler.ts b/apps/cli/src/commands/experimental/stack/logs/logs.handler.ts
index f9127c4023..779791e276 100644
--- a/apps/cli/src/commands/experimental/stack/logs/logs.handler.ts
+++ b/apps/cli/src/commands/experimental/stack/logs/logs.handler.ts
@@ -1,9 +1,10 @@
-import { DateTime, Effect, Option, Path, Stream } from "effect";
+import { Clock, Effect, Option, Path, Stream } from "effect";
+import { streamStackLogs, type SavedStack, type StackLogRecord } from "@supabase/stack/effect";
 import { Output } from "../../../../shared/output/output.service.ts";
 import { OutputFlag } from "../../../../command-internal/global-flags.ts";
+import { dim } from "../../../../command-internal/colors.ts";
 import { CommandSettings } from "../../../../config/command-settings.service.ts";
 import { TelemetryState } from "../../../../telemetry/telemetry-state.service.ts";
-import { stripControlSequences } from "../../../../shared/output/strip-control-sequences.ts";
 import {
   StackApi,
   StackTargetError,
@@ -13,6 +14,15 @@ import {
 } from "../stack.shared.ts";
 import { StackCommandLogsError } from "./logs.errors.ts";
 import type { StackLogsFlags } from "./logs.command.ts";
+import {
+  isAfter,
+  isFromLaunch,
+  makeHistoryCollector,
+  makeTextFormatter,
+  parseSince,
+  truncationFooter,
+} from "./logs.format.ts";
+import { logEvent, type LogSource } from "../../../../command-internal/stack-log-events.ts";
 
 const targetError = (cause: StackTargetError) =>
   new StackCommandLogsError({
@@ -24,6 +34,50 @@ const targetError = (cause: StackTargetError) =>
 const logsError = (cause: { readonly message: string }) =>
   new StackCommandLogsError({ reason: "unknown", message: cause.message, cause });
 
+type SavedInstance = SavedStack["instances"][number];
+interface Selected {
+  readonly id: string;
+  readonly service: string;
+  readonly launchId: number | undefined;
+}
+
+const select = (
+  definition: SavedStack,
+  requested: ReadonlyArray<string>,
+): Effect.Effect<ReadonlyArray<Selected>, StackCommandLogsError> => {
+  const subject = ({ id, creation, launchId }: SavedInstance): Selected => ({
+    id,
+    service: creation.service,
+    launchId,
+  });
+  if (requested.length === 0) {
+    const members = new Set(definition.composition.members.map(({ id }) => id));
+    const selected = definition.instances.filter(({ id }) => members.has(id)).map(subject);
+    return selected.length === 0
+      ? Effect.fail(
+          new StackCommandLogsError({
+            reason: "flags",
+            message: "The stack has no composition members to read.",
+            suggestion: "Select a standalone service with --service.",
+          }),
+        )
+      : Effect.succeed(selected);
+  }
+  const unmatched = requested.find(
+    (value) =>
+      !definition.instances.some(({ id, creation }) => id === value || creation.service === value),
+  );
+  if (unmatched !== undefined)
+    return Effect.fail(
+      new StackCommandLogsError({ reason: "flags", message: `No service matches ${unmatched}.` }),
+    );
+  return Effect.succeed(
+    definition.instances
+      .filter(({ id, creation }) => requested.includes(id) || requested.includes(creation.service))
+      .map(subject),
+  );
+};
+
 export const stackLogs = Effect.fn("experimental.stack.logs")(function* (flags: StackLogsFlags) {
   const telemetry = yield* TelemetryState;
   return yield* Effect.gen(function* () {
@@ -39,11 +93,19 @@ export const stackLogs = Effect.fn("experimental.stack.logs")(function* (flags:
       stack: Option.getOrUndefined(flags.stack),
       stackId: Option.getOrUndefined(flags.stackId),
     }).pipe(Effect.mapError(targetError));
-    if (output.format === "json")
+    if (flags.follow && output.format === "json")
       return yield* new StackCommandLogsError({
         reason: "flags",
-        message: "Live logs require text or stream-json output.",
-        suggestion: "Use --output-format stream-json.",
+        message: "Following logs requires text or stream-json output.",
+        suggestion: "Use --output-format stream-json, or omit --follow.",
+      });
+    const now = yield* Clock.currentTimeMillis;
+    const since = Option.isNone(flags.since) ? undefined : parseSince(flags.since.value, now);
+    if (Option.isSome(flags.since) && since === undefined)
+      return yield* new StackCommandLogsError({
+        reason: "flags",
+        message: `Invalid --since value ${flags.since.value}.`,
+        suggestion: "Use a duration such as 10m or 1h30m, an ISO-8601 time, or start.",
       });
     const target = yield* resolver
       .resolve({
@@ -53,72 +115,113 @@ export const stackLogs = Effect.fn("experimental.stack.logs")(function* (flags:
         ...(Option.isSome(flags.stackId) ? { id: flags.stackId.value } : {}),
       })
       .pipe(Effect.mapError(targetError));
-    if (target.id === undefined)
+    if (target.id === undefined || target.definition === undefined)
       return yield* new StackCommandLogsError({
         reason: "flags",
         message: "No managed stack exists for the selected project.",
         suggestion: "Run supabase stack start first.",
       });
+    if (flags.follow && !target.hostRunning)
+      return yield* new StackCommandLogsError({
+        reason: "lifecycle",
+        message: "The stack is not running, so there are no new lines to follow.",
+        suggestion:
+          "Run supabase stack logs without --follow to read retained logs, or supabase stack start first.",
+      });
+    const selected = yield* select(target.definition, flags.service);
+    yield* Effect.annotateCurrentSpan({ "stack.service_count": selected.length });
+    const stackId = target.id;
     const locations = {
       stateRoot: path.join(settings.supabaseHome, "stacks"),
       cacheRoot: path.join(settings.supabaseHome, "cache", "stack"),
     };
-    if (!target.hostRunning)
-      return yield* new StackCommandLogsError({
-        reason: "lifecycle",
-        message: "No owner is reachable; live logs are unavailable.",
-        suggestion: "Run supabase stack start first.",
-      });
-    const stack = yield* api.open({ ...locations, id: target.id }).pipe(Effect.mapError(logsError));
-    const instances = yield* stack.services.list.pipe(Effect.mapError(logsError));
-    const composition = yield* stack.composition.describe.pipe(Effect.mapError(logsError));
-    const requested = Option.getOrUndefined(flags.service);
-    const selected = instances.filter((instance) =>
-      requested === undefined
-        ? composition.members.some(({ id }) => id === instance.id)
-        : instance.service === requested || instance.id === requested,
-    );
-    if (selected.length === 0)
-      return yield* new StackCommandLogsError({
-        reason: "flags",
-        message:
-          requested === undefined
-            ? "The stack has no composition members to stream."
-            : `No service matches ${requested}.`,
-      });
-    const streams = selected.map((instance) =>
-      instance.logs.pipe(
-        Stream.groupByKey((entry) => entry.stream),
-        Stream.flatMap(
-          ([channel, chunks]) =>
-            chunks.pipe(
-              Stream.map(({ bytes }) => bytes),
-              Stream.decodeText,
-              Stream.splitLines,
-              Stream.map((line) => ({
-                service: instance.service,
-                instance_id: instance.id,
-                stream: channel,
-                line,
-              })),
+    const sinceTime = since?.kind === "time" ? { since: since.iso } : {};
+    const collector = makeHistoryCollector(
+      flags.tail,
+      since?.kind === "start"
+        ? new Map(
+            selected.flatMap(({ id, launchId }) =>
+              launchId === undefined ? [] : [[id, launchId] as const],
             ),
-          { concurrency: 2 },
-        ),
-      ),
+          )
+        : undefined,
     );
-    yield* Stream.mergeAll(streams, { concurrency: "unbounded" }).pipe(
-      Stream.mapError(logsError),
-      Stream.runForEach((entry) =>
-        Effect.gen(function* () {
-          const timestamp = DateTime.formatIso(yield* DateTime.now);
-          if (output.format === "stream-json")
-            yield* output.event({ type: "log-entry", timestamp, source: "live", ...entry });
-          else
-            yield* output.raw(
-              `${timestamp} ${entry.service}/${entry.instance_id}/${entry.stream}: ${stripControlSequences(entry.line)}\n`,
-            );
-        }),
-      ),
+    if (flags.tail > 0)
+      yield* streamStackLogs({
+        stateRoot: locations.stateRoot,
+        stackId,
+        instances: selected.map(({ id }) => id),
+        ...sinceTime,
+      }).pipe(
+        Stream.mapError(logsError),
+        Stream.runForEach((record) => Effect.sync(() => collector.push(record))),
+      );
+    const { window, positions: printed, launches } = collector.finish();
+
+    if (output.format === "json")
+      return yield* output.result(window.records.map((record) => logEvent(record, "history")));
+    // Colour follows the terminal only when stdout is one, so piped logs stay plain.
+    const terminal = output.interactive;
+    const text = makeTextFormatter(selected, terminal ? process.stdout : {});
+    const emit = (record: StackLogRecord, source: LogSource) =>
+      output.format === "stream-json"
+        ? output.event(logEvent(record, source))
+        : output.raw(text(record));
+    yield* Effect.forEach(window.records, (record) => emit(record, "history"), { discard: true });
+    if (output.format === "text" && flags.tail > 0) {
+      const note = (message: string) =>
+        output.raw(`${dim(message, terminal ? process.stderr : {})}\n`, "stderr");
+      if (window.shown < window.total) yield* note(truncationFooter(window));
+      else if (window.total === 0 && !flags.follow)
+        yield* note("No retained log lines for the selected services.");
+    }
+    if (!flags.follow) return;
+
+    yield* Effect.scoped(
+      Effect.gen(function* () {
+        const stack = yield* api
+          .open({ ...locations, id: stackId })
+          .pipe(Effect.mapError(logsError));
+        const handles = new Map(
+          (yield* stack.services.list.pipe(Effect.mapError(logsError))).map((handle) => [
+            handle.id,
+            handle,
+          ]),
+        );
+        const missing = selected
+          .filter(({ id }) => !handles.has(id))
+          .map(({ id, service }) => `${service} (${id})`);
+        if (missing.length === selected.length)
+          return yield* new StackCommandLogsError({
+            reason: "lifecycle",
+            message:
+              "The running stack serves none of the selected services, so there are no new lines to follow.",
+            suggestion: "Run supabase stack logs without --follow to read retained logs.",
+          });
+        if (missing.length > 0)
+          yield* output.warn(
+            `Not following ${missing.join(", ")}, which the running stack does not serve.`,
+          );
+        const streams = selected.flatMap(({ id, service }) => {
+          const handle = handles.get(id);
+          if (handle === undefined) return [];
+          const from = printed.get(id);
+          // Without history, the owner pins the start at its end under the writer's lock.
+          const start = flags.tail === 0 ? { tail: 0 } : from === undefined ? {} : { from };
+          return [
+            handle.readLogs({ follow: true, ...start, ...sinceTime }).pipe(
+              Stream.filter(
+                (record) => isAfter(record, from) && isFromLaunch(record, launches.get(id)),
+              ),
+              Stream.map((record): StackLogRecord => ({ ...record, service, instanceId: id })),
+            ),
+          ];
+        });
+        yield* Stream.mergeAll(streams, { concurrency: "unbounded" }).pipe(
+          Stream.mapError(logsError),
+          Stream.runForEach((record) => emit(record, "live")),
+        );
+      }),
     );
   }).pipe(Effect.ensuring(telemetry.flush));
 });
diff --git a/apps/cli/src/commands/experimental/stack/logs/logs.integration.test.ts b/apps/cli/src/commands/experimental/stack/logs/logs.integration.test.ts
index 5caba8c782..8868dd7693 100644
--- a/apps/cli/src/commands/experimental/stack/logs/logs.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/logs/logs.integration.test.ts
@@ -1,219 +1,555 @@
 import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
-import { Deferred, Effect, Fiber, FileSystem, Layer, Option, Path, Ref, Stream } from "effect";
-import type { Stack } from "@supabase/stack/effect";
+import {
+  Clock,
+  DateTime,
+  Deferred,
+  Effect,
+  Exit,
+  Fiber,
+  FileSystem,
+  Layer,
+  Option,
+  Path,
+  Redacted,
+  Ref,
+  Schema,
+  Stream,
+} from "effect";
+import {
+  streamStackLogs,
+  type LogRecord,
+  type ReadLogsOptions,
+  type SavedStack,
+  type ServiceInstance,
+} from "@supabase/stack/effect";
 import { mockOutput } from "../../../../../tests/helpers/mocks.ts";
 import {
   mockCommandSettings,
   mockTelemetryStateTracked,
 } from "../../../../../tests/helpers/command-mocks.ts";
 import { StackApi, stackApiLayer, stackTargetResolverLayer } from "../stack.shared.ts";
+import type { StackLogsFlags } from "./logs.command.ts";
 import { stackLogs } from "./logs.handler.ts";
-import { destroyTestStack } from "../../../../../tests/helpers/stack-cleanup.ts";
 
 const live = Layer.provideMerge(stackApiLayer, BunServices.layer);
-const fixture = Effect.fn("StackLogsTest.fixture")(function* (
-  format: "text" | "stream-json" | "json" = "text",
-) {
+
+type SavedInstance = SavedStack["instances"][number];
+const mail = (id: string): SavedInstance => ({
+  id,
+  creation: { service: "mail", config: {}, endpoints: {} },
+});
+const database = (id: string): SavedInstance => ({
+  id,
+  creation: {
+    service: "database",
+    config: {
+      version: "17",
+      databasePassword: Redacted.make("stack-logs-test"),
+      jwtSecret: Redacted.make("stack-logs-test-jwt-secret"),
+      jwtExpiry: 3600,
+    },
+    endpoints: {},
+  },
+});
+
+const iso = (millis: number) => DateTime.formatIso(DateTime.makeUnsafe(millis));
+const line = (millis: number, kind: "stdout" | "stderr", text: string, launchId = 1) =>
+  `${iso(millis)} ${kind} ${launchId} | ${text}`;
+const launch = (millis: number, launchId = 1) => `${iso(millis)} launch ${launchId} | `;
+const lost = (millis: number, count: number, launchId = 1) =>
+  `${iso(millis)} lost ${launchId} | ${count} output`;
+
+const baseFlags = (stackId: string): StackLogsFlags => ({
+  stack: Option.none(),
+  stackId: Option.some(stackId),
+  service: [],
+  follow: false,
+  tail: 200,
+  since: Option.none(),
+});
+
+const followingMail = (
+  id: string,
+  readLogs: (options?: ReadLogsOptions) => Stream.Stream<LogRecord, never>,
+): ServiceInstance<"mail"> => ({
+  id,
+  service: "mail",
+  start: Effect.die("unused"),
+  ready: Effect.die("unused"),
+  stop: Effect.die("unused"),
+  restart: () => Effect.die("unused"),
+  destroy: Effect.die("unused"),
+  prepare: Effect.die("unused"),
+  status: Effect.die("unused"),
+  followStatus: Stream.die("unused"),
+  readLogs,
+  credentials: () => Effect.die("unused"),
+});
+
+/** A saved stack with fixed definitions, a fake owner, and log segments written to disk. */
+const fixture = Effect.fn("StackLogsTest.fixture")(function* (options: {
+  readonly instances: ReadonlyArray<SavedInstance>;
+  readonly members: ReadonlyArray<string>;
+  readonly running?: boolean;
+  readonly handles?: (stack: {
+    readonly stateRoot: string;
+    readonly stackId: string;
+  }) => ReadonlyArray<ServiceInstance<"mail">>;
+}) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
   const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-logs-" });
   const api = yield* StackApi;
-  const locations = { stateRoot: path.join(root, "stacks"), cacheRoot: path.join(root, "cache") };
-  const stack = yield* api.create({ ...locations, projectRoot: root, runtime: "native" });
-  const output = mockOutput({ format });
-  const telemetry = mockTelemetryStateTracked();
-  const settings = mockCommandSettings({ workdir: root, supabaseHome: root });
-  const layer = Layer.mergeAll(
-    output.layer,
-    telemetry.layer,
-    settings,
-    stackTargetResolverLayer.pipe(Layer.provide(settings)),
-  );
-  return {
-    api,
-    locations,
-    stack,
-    output,
-    telemetry,
-    layer,
-    flags: {
-      stack: Option.none<string>(),
-      stackId: Option.some(stack.id),
-      service: Option.none<string>(),
+  const stateRoot = path.join(root, "stacks");
+  const stack = yield* api.create({
+    stateRoot,
+    cacheRoot: path.join(root, "cache"),
+    projectRoot: root,
+    runtime: "native",
+  });
+  const found = yield* api.find({ stateRoot, id: stack.id });
+  if (Option.isNone(found)) return yield* Effect.die("created stack missing");
+  const definition: SavedStack = {
+    ...found.value.definition,
+    instances: options.instances,
+    composition: {
+      members: options.members.map((id) => ({ id, activation: "eager" as const })),
+      dependencies: [],
     },
   };
-});
-const loggingApi = (
-  api: StackApi["Service"],
-  stack: Stack,
-  instances: Effect.Success<Stack["services"]["list"]>,
-) =>
-  Layer.succeed(
+  const opened = yield* Ref.make(0);
+  const fakeApi = Layer.succeed(
     StackApi,
     StackApi.of({
       ...api,
+      find: () =>
+        Effect.succeed(
+          Option.some({
+            definition,
+            host:
+              options.running === true
+                ? {
+                    stackId: stack.id,
+                    identity: definition.identity,
+                    pid: 1,
+                    port: 1,
+                    release: "test",
+                  }
+                : undefined,
+          }),
+        ),
       open: () =>
-        Effect.succeed({
-          ...stack,
-          services: { ...stack.services, list: Effect.succeed([...instances]) },
-        }),
+        Ref.update(opened, (count) => count + 1).pipe(
+          Effect.as({
+            ...stack,
+            services: {
+              ...stack.services,
+              list: Effect.succeed(options.handles?.({ stateRoot, stackId: stack.id }) ?? []),
+            },
+          }),
+        ),
     }),
   );
+  const settings = mockCommandSettings({ workdir: root, supabaseHome: root });
+  const writeSegment = (service: string, instanceId: string, records: ReadonlyArray<string>) =>
+    Effect.gen(function* () {
+      const directory = path.join(stateRoot, stack.id, "logs", service, instanceId);
+      yield* fs.makeDirectory(directory, { recursive: true });
+      yield* fs.writeFileString(
+        path.join(directory, "0000000001.log"),
+        records.map((record) => `${record}\n`).join(""),
+      );
+    });
+  const run = (flags: Partial<StackLogsFlags>, format: "text" | "stream-json" | "json" = "text") =>
+    Effect.gen(function* () {
+      const output = mockOutput({ format, interactive: false });
+      const telemetry = mockTelemetryStateTracked();
+      const layer = Layer.mergeAll(
+        output.layer,
+        telemetry.layer,
+        Layer.provideMerge(stackTargetResolverLayer, Layer.merge(settings, fakeApi)),
+      );
+      const exit = yield* stackLogs({ ...baseFlags(stack.id), ...flags }).pipe(
+        Effect.provide(layer),
+        Effect.exit,
+      );
+      return { exit, output, telemetry };
+    });
+  return { stackId: stack.id, stateRoot, opened, writeSegment, run };
+});
+
+const failure = <E>(exit: Exit.Exit<void, E>) =>
+  Exit.isFailure(exit) ? Option.getOrUndefined(Exit.findErrorOption(exit)) : undefined;
+const lines = (text: string) => text.split("\n").filter((value) => value.length > 0);
+const eventLines = (events: ReadonlyArray<{ readonly type: string; readonly line?: unknown }>) =>
+  events.filter(({ type }) => type === "log-entry").map(({ line: text }) => text);
 
 describe("stack logs", () => {
-  it.live("rejects finite JSON before starting an owner", () =>
+  const t0 = Date.parse("2026-09-29T10:00:00.000Z");
+
+  it.live("prints the newest lines across services with aligned labels, offline", () =>
+    Effect.gen(function* () {
+      const f = yield* fixture({
+        instances: [mail("mail-a"), database("db-a")],
+        members: ["mail-a", "db-a"],
+      });
+      yield* f.writeSegment("mail", "mail-a", [
+        launch(t0 - 1),
+        ...Array.from({ length: 149 }, (_, index) =>
+          line(t0 + index * 2, "stdout", `mail line ${index}`),
+        ),
+        line(t0 + 149 * 2, "stderr", "\u001b[31mwarning\u001b[0m"),
+      ]);
+      yield* f.writeSegment("database", "db-a", [
+        launch(t0 - 1),
+        ...Array.from({ length: 100 }, (_, index) =>
+          line(t0 + index * 2 + 1, "stdout", `database line ${index}`),
+        ),
+      ]);
+
+      const { exit, output, telemetry } = yield* f.run({});
+
+      expect(Exit.isSuccess(exit)).toBe(true);
+      const printed = lines(output.stdoutText);
+      expect(printed).toHaveLength(200);
+      expect(printed[0]).toMatch(/^mail {5}\| \d{2}:\d{2}:\d{2}\.\d{3} mail line 25$/u);
+      expect(printed[1]).toMatch(/^database \| \d{2}:\d{2}:\d{2}\.\d{3} database line 25$/u);
+      expect(printed.at(-1)).toMatch(/^mail {5}\| \S+ warning$/u);
+      expect(output.stdoutText).not.toContain("\u001b");
+      expect(output.stderrText).toBe("showing last 200 of 250 lines, use --tail/--since\n");
+      expect(yield* Ref.get(f.opened)).toBe(0);
+      expect(telemetry.flushed).toBe(true);
+    }).pipe(Effect.scoped, Effect.provide(live)),
+  );
+
+  it.live("selects history with --tail, --since, and repeated --service", () =>
     Effect.gen(function* () {
-      const f = yield* fixture("json");
-      const error = yield* stackLogs(f.flags).pipe(Effect.provide(f.layer), Effect.flip);
-      expect(error.reason).toBe("flags");
-      expect(error.suggestion).toBe("Use --output-format stream-json.");
-      expect((yield* f.api.discover(f.locations))[0]?.host).toBeUndefined();
-    }).pipe(Effect.provide(live)),
+      const now = yield* Clock.currentTimeMillis;
+      const minutes = (count: number) => now - count * 60_000;
+      const f = yield* fixture({
+        instances: [mail("mail-a"), mail("mail-b"), mail("mail-c"), database("db-a")],
+        members: ["mail-a", "db-a"],
+      });
+      yield* f.writeSegment("mail", "mail-a", [
+        launch(minutes(180)),
+        line(minutes(120), "stdout", "a old"),
+        launch(minutes(30), 2),
+        line(minutes(20), "stdout", "a new", 2),
+      ]);
+      yield* f.writeSegment("database", "db-a", [
+        launch(minutes(10)),
+        line(minutes(5), "stdout", "d recent"),
+      ]);
+      yield* f.writeSegment("mail", "mail-b", [
+        launch(minutes(3)),
+        line(minutes(1), "stdout", "b standalone"),
+      ]);
+      // Retention removed this instance's launch record along with its oldest segment.
+      yield* f.writeSegment("mail", "mail-c", [line(minutes(2), "stdout", "c retained")]);
+      const read = (flags: Partial<StackLogsFlags>) =>
+        f.run(flags, "stream-json").pipe(Effect.map(({ output }) => eventLines(output.events)));
+
+      expect(yield* read({})).toEqual(["a old", "a new", "d recent"]);
+      expect(yield* read({ since: Option.some("1h") })).toEqual(["a new", "d recent"]);
+      expect(yield* read({ since: Option.some(iso(minutes(25))) })).toEqual(["a new", "d recent"]);
+      expect(yield* read({ since: Option.some("start") })).toEqual(["a new", "d recent"]);
+      expect(yield* read({ service: ["mail-c"], since: Option.some("start") })).toEqual([
+        "c retained",
+      ]);
+      expect(yield* read({ service: ["mail"], tail: 1 })).toEqual(["b standalone"]);
+      expect(yield* read({ service: ["mail-b", "database"] })).toEqual([
+        "d recent",
+        "b standalone",
+      ]);
+      const truncated = yield* f.run({ service: ["mail"], tail: 1 });
+      expect(truncated.output.stderrText).toBe("showing last 1 of 4 lines, use --tail/--since\n");
+      const unknown = yield* f.run({ service: ["mail", "missing"] });
+      expect(failure(unknown.exit)).toMatchObject({
+        reason: "flags",
+        message: "No service matches missing.",
+      });
+      const invalid = yield* f.run({ since: Option.some("soon") });
+      expect(failure(invalid.exit)).toMatchObject({ reason: "flags" });
+      expect(invalid.output.stdoutText).toBe("");
+    }).pipe(Effect.scoped, Effect.provide(live)),
+  );
+
+  it.live("starts --since start at each instance's saved launch, even before it logged", () =>
+    Effect.gen(function* () {
+      const f = yield* fixture({
+        instances: [
+          { ...mail("mail-a"), launchId: 3 },
+          { ...mail("mail-b"), launchId: 2 },
+        ],
+        members: ["mail-a", "mail-b"],
+      });
+      yield* f.writeSegment("mail", "mail-a", [
+        launch(t0, 2),
+        line(t0 + 1, "stdout", "a previous launch", 2),
+      ]);
+      yield* f.writeSegment("mail", "mail-b", [
+        launch(t0 + 2, 1),
+        line(t0 + 3, "stdout", "b previous launch", 1),
+        launch(t0 + 4, 2),
+        line(t0 + 5, "stdout", "b current launch", 2),
+      ]);
+
+      const { output } = yield* f.run({ since: Option.some("start") }, "stream-json");
+
+      expect(
+        output.events.map(({ instance_id, kind, line: text }) => [instance_id, kind ?? text]),
+      ).toEqual([
+        ["mail-b", "launch"],
+        ["mail-b", "b current launch"],
+      ]);
+    }).pipe(Effect.scoped, Effect.provide(live)),
   );
 
-  it.live("selects all instances of a kind and sanitizes terminal text", () =>
+  it.live("keeps the log-entry fields and reports markers in every output mode", () =>
     Effect.gen(function* () {
-      const f = yield* fixture();
-      yield* Effect.acquireUseRelease(
-        Effect.succeed(f.stack),
-        (stack) =>
-          Effect.gen(function* () {
-            const first = yield* stack.services.create({
-              service: "mail",
-              config: {},
-              endpoints: {},
-            });
-            const second = yield* stack.services.create({
-              service: "mail",
-              config: {},
-              endpoints: {},
-            });
-            const api = loggingApi(
-              f.api,
-              stack,
-              [first, second].map((instance) => ({
-                ...instance,
-                logs: Stream.make({
-                  stream: "stderr" as const,
-                  bytes: new TextEncoder().encode("\u001b[31mwarning\u001b[0m\n"),
+      const f = yield* fixture({ instances: [mail("mail-a")], members: ["mail-a"] });
+      yield* f.writeSegment("mail", "mail-a", [
+        launch(t0),
+        line(t0 + 1, "stdout", "hello"),
+        line(t0 + 2, "stderr", "oops"),
+        lost(t0 + 3, 3),
+      ]);
+      const subject = { service: "mail", instance_id: "mail-a", source: "history" };
+      const expected = [
+        { type: "log-marker", timestamp: iso(t0), ...subject, kind: "launch" },
+        {
+          type: "log-entry",
+          timestamp: iso(t0 + 1),
+          ...subject,
+          stream: "stdout",
+          line: "hello",
+        },
+        { type: "log-entry", timestamp: iso(t0 + 2), ...subject, stream: "stderr", line: "oops" },
+        {
+          type: "log-marker",
+          timestamp: iso(t0 + 3),
+          ...subject,
+          kind: "lost",
+          count: 3,
+        },
+      ];
+
+      const streamed = yield* f.run({}, "stream-json");
+      const finite = yield* f.run({}, "json");
+      const text = yield* f.run({});
+
+      expect(streamed.output.events).toEqual(expected);
+      expect(
+        yield* Schema.decodeEffect(Schema.fromJsonString(Schema.Unknown))(finite.output.stdoutText),
+      ).toEqual(expected);
+      expect(
+        lines(text.output.stdoutText).map((value) => value.replace(/\d{2}:\S+ /u, "")),
+      ).toEqual([
+        "mail | --- launch 1 ---",
+        "mail | hello",
+        "mail | oops",
+        "mail | --- 3 output chunks lost ---",
+      ]);
+    }).pipe(Effect.scoped, Effect.provide(live)),
+  );
+
+  it.live("fails --follow without a running owner before printing anything", () =>
+    Effect.gen(function* () {
+      const f = yield* fixture({ instances: [mail("mail-a")], members: ["mail-a"] });
+      yield* f.writeSegment("mail", "mail-a", [launch(t0), line(t0 + 1, "stdout", "retained")]);
+
+      const followed = yield* f.run({ follow: true });
+      const finite = yield* f.run({ follow: true }, "json");
+
+      expect(failure(followed.exit)).toMatchObject({
+        reason: "lifecycle",
+        suggestion:
+          "Run supabase stack logs without --follow to read retained logs, or supabase stack start first.",
+      });
+      expect(followed.output.stdoutText).toBe("");
+      expect(followed.output.stderrText).toBe("");
+      expect(followed.telemetry.flushed).toBe(true);
+      expect(failure(finite.exit)).toMatchObject({
+        reason: "flags",
+        suggestion: "Use --output-format stream-json, or omit --follow.",
+      });
+      expect(yield* Ref.get(f.opened)).toBe(0);
+    }).pipe(Effect.scoped, Effect.provide(live)),
+  );
+
+  it.live("follows each service after its printed history without repeating it", () =>
+    Effect.gen(function* () {
+      // Serves the history like an owner, from `from` inclusive or none for `tail: 0`, then one new record.
+      const owner =
+        (stack: { readonly stateRoot: string; readonly stackId: string }) =>
+        (id: string, text: string) =>
+          followingMail(id, (options) =>
+            streamStackLogs({ ...stack, instances: [id] }).pipe(
+              Stream.orDie,
+              Stream.filter(
+                ({ position }) =>
+                  options?.tail !== 0 &&
+                  (options?.from === undefined ||
+                    (position !== undefined && position.byteOffset >= options.from.byteOffset)),
+              ),
+              Stream.concat(
+                Stream.make({
+                  kind: "stdout" as const,
+                  timestamp: iso(t0 + 100),
+                  launchId: 1,
+                  text,
+                  position: { generation: 1, byteOffset: 1_000_000 },
                 }),
-              })),
-            );
-            yield* stackLogs({ ...f.flags, service: Option.some("mail") }).pipe(
-              Effect.provide(Layer.provideMerge(f.layer, api)),
-            );
-            expect(f.output.stdoutText).toContain(`mail/${first.id}/stderr: warning\n`);
-            expect(f.output.stdoutText).toContain(`mail/${second.id}/stderr: warning\n`);
-            expect(f.output.stdoutText).not.toContain("\u001b");
-            const error = yield* stackLogs({ ...f.flags, service: Option.some("missing") }).pipe(
-              Effect.provide(f.layer),
-              Effect.flip,
-            );
-            expect(error.message).toBe("No service matches missing.");
-          }),
-        destroyTestStack,
+              ),
+              Stream.provide(BunServices.layer),
+            ),
+          );
+      const f = yield* fixture({
+        instances: [mail("mail-a"), mail("mail-b")],
+        members: ["mail-a", "mail-b"],
+        running: true,
+        handles: (stack) => [owner(stack)("mail-a", "a live"), owner(stack)("mail-b", "b live")],
+      });
+      yield* f.writeSegment("mail", "mail-a", [
+        launch(t0),
+        line(t0 + 1, "stdout", "a first"),
+        line(t0 + 2, "stdout", "a second"),
+      ]);
+
+      const { exit, output } = yield* f.run({ follow: true }, "stream-json");
+
+      expect(Exit.isSuccess(exit)).toBe(true);
+      const entries = output.events.filter(({ type }) => type === "log-entry");
+      expect(entries.map(({ line: text, source }) => [text, source])).toEqual(
+        expect.arrayContaining([
+          ["a first", "history"],
+          ["a second", "history"],
+          ["a live", "live"],
+          ["b live", "live"],
+        ]),
       );
-    }).pipe(Effect.provide(live)),
+      expect(entries).toHaveLength(4);
+      expect(entries.slice(0, 2).map(({ line: text }) => text)).toEqual(["a first", "a second"]);
+      expect(yield* Ref.get(f.opened)).toBe(1);
+
+      const liveOnly = yield* f.run({ follow: true, tail: 0 });
+
+      expect(Exit.isSuccess(liveOnly.exit)).toBe(true);
+      expect(
+        lines(liveOnly.output.stdoutText)
+          .map((value) => value.replace(/^\S+\s+\| \S+ /u, ""))
+          .toSorted(),
+      ).toEqual(["a live", "b live"]);
+      expect(liveOnly.output.stderrText).toBe("");
+    }).pipe(Effect.scoped, Effect.provide(live)),
   );
 
-  it.live("frames split UTF-8 and stdout/stderr lines with instance identity", () =>
+  it.live("follows --since start without delayed records of an earlier launch", () =>
     Effect.gen(function* () {
-      const f = yield* fixture("stream-json");
-      yield* Effect.acquireUseRelease(
-        Effect.succeed(f.stack),
-        (stack) =>
-          Effect.gen(function* () {
-            const member = yield* stack.services.create({
-              service: "mail",
-              config: {},
-              endpoints: {},
-            });
-            const standalone = yield* stack.services.create({
-              service: "mail",
-              config: {},
-              endpoints: {},
-            });
-            yield* stack.composition.configure({
-              members: [{ id: member.id, activation: "eager" }],
-              dependencies: [],
-            });
-            const utf8 = new TextEncoder().encode("hello 🐘\nlast line");
-            const memberLogs = Stream.make(
-              { stream: "stdout" as const, bytes: utf8.slice(0, 8) },
-              { stream: "stderr" as const, bytes: new TextEncoder().encode("warning\n") },
-              { stream: "stdout" as const, bytes: utf8.slice(8) },
-            );
-            const api = loggingApi(f.api, stack, [
-              { ...member, logs: memberLogs },
-              { ...standalone, logs: Stream.die("standalone must not be subscribed") },
-            ]);
-            yield* stackLogs(f.flags).pipe(Effect.provide(Layer.provideMerge(f.layer, api)));
-            const entries = f.output.events.filter((entry) => entry.type === "log-entry");
-            expect(entries).toHaveLength(3);
-            expect(entries.map(({ line }) => line)).toEqual(
-              expect.arrayContaining(["hello 🐘", "last line", "warning"]),
-            );
-            expect(
-              entries.every(
-                (entry) =>
-                  entry.instance_id === member.id &&
-                  entry.service === "mail" &&
-                  entry.source === "live",
-              ),
-            ).toBe(true);
-            expect(entries.find(({ line }) => line === "warning")?.stream).toBe("stderr");
-            expect(f.telemetry.flushed).toBe(true);
-          }),
-        destroyTestStack,
+      const record = (offset: number, launchId: number, text: string): LogRecord => ({
+        kind: "stdout",
+        timestamp: iso(t0 + offset),
+        launchId,
+        text,
+        position: { generation: 1, byteOffset: offset },
+      });
+      const f = yield* fixture({
+        instances: [{ ...mail("mail-a"), launchId: 3 }],
+        members: ["mail-a"],
+        running: true,
+        handles: () => [
+          followingMail("mail-a", () =>
+            Stream.make(
+              record(0, 3, "current launch"),
+              record(1, 2, "delayed earlier launch"),
+              record(2, 4, "newer launch"),
+            ),
+          ),
+        ],
+      });
+
+      const { exit, output } = yield* f.run(
+        { follow: true, since: Option.some("start") },
+        "stream-json",
       );
-    }).pipe(Effect.provide(live)),
+
+      expect(Exit.isSuccess(exit)).toBe(true);
+      expect(eventLines(output.events)).toEqual(["current launch", "newer launch"]);
+    }).pipe(Effect.scoped, Effect.provide(live)),
+  );
+
+  it.live("follows the services the running stack serves and names the others", () =>
+    Effect.gen(function* () {
+      const served = (text: string) =>
+        Stream.make({
+          kind: "stdout" as const,
+          timestamp: iso(t0),
+          launchId: 1,
+          text,
+          position: { generation: 1, byteOffset: 0 },
+        });
+      const f = yield* fixture({
+        instances: [mail("mail-a"), mail("mail-b")],
+        members: ["mail-a", "mail-b"],
+        running: true,
+        handles: () => [followingMail("mail-a", () => served("a live"))],
+      });
+
+      const { exit, output } = yield* f.run({ follow: true, tail: 0 }, "stream-json");
+
+      expect(Exit.isSuccess(exit)).toBe(true);
+      expect(eventLines(output.events)).toEqual(["a live"]);
+      expect(output.messages).toContainEqual({
+        type: "warn",
+        message: "Not following mail (mail-b), which the running stack does not serve.",
+      });
+    }).pipe(Effect.scoped, Effect.provide(live)),
+  );
+
+  it.live("fails --follow when the running stack serves none of the selected services", () =>
+    Effect.gen(function* () {
+      const f = yield* fixture({
+        instances: [mail("mail-a")],
+        members: ["mail-a"],
+        running: true,
+        handles: () => [],
+      });
+
+      const { exit } = yield* f.run({ follow: true, tail: 0 });
+
+      expect(failure(exit)).toMatchObject({
+        reason: "lifecycle",
+        message:
+          "The running stack serves none of the selected services, so there are no new lines to follow.",
+      });
+    }).pipe(Effect.scoped, Effect.provide(live)),
   );
 
-  it.live("interrupts a selected log subscription without stopping or destroying its service", () =>
+  it.live("interrupts a follow and releases its subscriptions", () =>
     Effect.gen(function* () {
-      const f = yield* fixture();
-      yield* Effect.acquireUseRelease(
-        Effect.succeed(f.stack),
-        (stack) =>
-          Effect.gen(function* () {
-            const service = yield* stack.services.create({
-              service: "mail",
-              config: {},
-              endpoints: {},
-            });
-            const subscribed = yield* Deferred.make<void>();
-            const released = yield* Ref.make(false);
-            const logs = Stream.fromEffect(Deferred.succeed(subscribed, undefined)).pipe(
+      const subscribed = yield* Deferred.make<void>();
+      const released = yield* Ref.make(false);
+      const f = yield* fixture({
+        instances: [mail("mail-a")],
+        members: ["mail-a"],
+        running: true,
+        handles: () => [
+          followingMail("mail-a", () =>
+            Stream.fromEffect(Deferred.succeed(subscribed, undefined)).pipe(
               Stream.drain,
               Stream.concat(Stream.never),
               Stream.ensuring(Ref.set(released, true)),
-            );
-            const api = loggingApi(f.api, stack, [{ ...service, logs }]);
-            const fiber = yield* stackLogs({ ...f.flags, service: Option.some(service.id) }).pipe(
-              Effect.provide(Layer.provideMerge(f.layer, api)),
-              Effect.forkChild,
-            );
-            yield* Deferred.await(subscribed);
-            yield* Fiber.interrupt(fiber);
-            expect(yield* Ref.get(released)).toBe(true);
-            expect((yield* service.status).registered).toBe(true);
-            expect((yield* f.api.discover(f.locations))[0]?.host).toBeDefined();
-            expect(f.telemetry.flushed).toBe(true);
-          }),
-        destroyTestStack,
-      );
-    }).pipe(Effect.provide(live)),
-  );
+            ),
+          ),
+        ],
+      });
 
-  it.live("reports unavailable logs without starting an offline owner", () =>
-    Effect.gen(function* () {
-      const f = yield* fixture();
-      const error = yield* stackLogs(f.flags).pipe(Effect.provide(f.layer), Effect.flip);
-      expect(error.reason).toBe("lifecycle");
-      expect((yield* f.api.discover(f.locations))[0]?.host).toBeUndefined();
-      expect(f.output.stdoutText).toBe("");
-      expect(f.telemetry.flushed).toBe(true);
-    }).pipe(Effect.provide(live)),
+      const fiber = yield* f.run({ follow: true }).pipe(Effect.forkChild);
+      yield* Deferred.await(subscribed);
+      yield* Fiber.interrupt(fiber);
+
+      expect(yield* Ref.get(released)).toBe(true);
+    }).pipe(Effect.scoped, Effect.provide(live)),
   );
 });
diff --git a/apps/cli/src/commands/experimental/stack/prepare/SIDE_EFFECTS.md b/apps/cli/src/commands/experimental/stack/prepare/SIDE_EFFECTS.md
index 4d51539261..fa73bfd61c 100644
--- a/apps/cli/src/commands/experimental/stack/prepare/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/experimental/stack/prepare/SIDE_EFFECTS.md
@@ -22,6 +22,8 @@ modified. A preparation failure still runs cleanup for every acquired temporary
 
 - A managed stack descriptor/state record when the target does not exist. Existing records are
   updated while temporary instances and their instance directories are created and removed.
+  Starting the owner of a target saved with a Vector instance removes that instance from the
+  record, as described for `stack start`.
 - Runtime artifacts through the selected native or container runtime's package-owned cache.
 - Telemetry state after success or failure once the handler starts.
 
@@ -39,7 +41,7 @@ which selects the same runtime as `stack start` (Docker, then Podman, then nativ
 existing stacks reuse their persisted runtime without probing, and an explicit mismatch fails. With no
 `--capability`, every enabled creation from the effective project configuration is prepared.
 Repeated `--capability` includes each capability's configured companion services (Storage/Imgproxy,
-Studio/Pgmeta, Analytics/Vector); requesting a disabled service fails before instance preparation. The legacy `-o/--output` flag is rejected; use
+Studio/Pgmeta); requesting a disabled service fails before instance preparation. The legacy `-o/--output` flag is rejected; use
 `--output-format`.
 
 Text output lists the stack ID and each prepared service and version. JSON output returns the stack
diff --git a/apps/cli/src/commands/experimental/stack/prepare/prepare.command.ts b/apps/cli/src/commands/experimental/stack/prepare/prepare.command.ts
index 0e728fb4e3..d1a052ffe9 100644
--- a/apps/cli/src/commands/experimental/stack/prepare/prepare.command.ts
+++ b/apps/cli/src/commands/experimental/stack/prepare/prepare.command.ts
@@ -3,12 +3,12 @@ import type * as CliCommand from "effect/unstable/cli/Command";
 import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
 import { withCommandTelemetry } from "../../../../telemetry/command-telemetry.ts";
 import { stackPrepare } from "./prepare.handler.ts";
-import { STACK_PREPARABLE_CAPABILITIES } from "./prepare.options.ts";
+import { STACK_PREPARABLE_CAPABILITIES } from "../start/start.options.ts";
 
 const config = {
   stack: Flag.string("stack").pipe(Flag.withDescription("Name this stack."), Flag.optional),
   stackId: Flag.string("stack-id").pipe(
-    Flag.withDescription("Open an existing stack by id."),
+    Flag.withDescription("Open an existing stack by id or unique id prefix."),
     Flag.optional,
   ),
   runtime: Flag.choice("runtime", ["auto", "docker", "podman", "native"] as const).pipe(
diff --git a/apps/cli/src/commands/experimental/stack/prepare/prepare.handler.ts b/apps/cli/src/commands/experimental/stack/prepare/prepare.handler.ts
index 08f53cb662..4bbbb88ca1 100644
--- a/apps/cli/src/commands/experimental/stack/prepare/prepare.handler.ts
+++ b/apps/cli/src/commands/experimental/stack/prepare/prepare.handler.ts
@@ -138,6 +138,7 @@ export const stackPrepare = Effect.fn("experimental.stack.prepare")(function* (
         : creations.filter(({ service }) =>
             selectedServices.has(stackCapabilityForService(service)),
           );
+    yield* Effect.annotateCurrentSpan({ "stack.capability_count": requested.length });
     const task = yield* output.task("Preparing local Supabase stack...");
     const capabilities = yield* Effect.forEach(requested, (creation) =>
       Effect.acquireUseRelease(
diff --git a/apps/cli/src/commands/experimental/stack/prepare/prepare.integration.test.ts b/apps/cli/src/commands/experimental/stack/prepare/prepare.integration.test.ts
index 32d6862aa3..352518aadb 100644
--- a/apps/cli/src/commands/experimental/stack/prepare/prepare.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/prepare/prepare.integration.test.ts
@@ -111,7 +111,7 @@ const makeFixture = (root: string, options: FixtureOptions = {}) => {
       registered: true,
     }),
     followStatus: Stream.empty,
-    logs: Stream.empty,
+    readLogs: () => Stream.empty,
     credentials: () => Effect.succeed({}),
     saveSnapshot: () => Effect.die("unused"),
     restoreSnapshot: () => Effect.die("unused"),
diff --git a/apps/cli/src/commands/experimental/stack/prepare/prepare.options.ts b/apps/cli/src/commands/experimental/stack/prepare/prepare.options.ts
deleted file mode 100644
index 2c64ed47f4..0000000000
--- a/apps/cli/src/commands/experimental/stack/prepare/prepare.options.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-import { STACK_START_EXCLUDABLE_CAPABILITIES } from "../start/start.options.ts";
-
-export const STACK_PREPARABLE_CAPABILITIES = [
-  "database",
-  ...STACK_START_EXCLUDABLE_CAPABILITIES,
-] as const;
diff --git a/apps/cli/src/commands/experimental/stack/restart/SIDE_EFFECTS.md b/apps/cli/src/commands/experimental/stack/restart/SIDE_EFFECTS.md
index 33a48bb19e..2710a054af 100644
--- a/apps/cli/src/commands/experimental/stack/restart/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/experimental/stack/restart/SIDE_EFFECTS.md
@@ -7,7 +7,7 @@ controls command registration.
 
 ## Selection and configuration
 
-Select the current project/branch/name, `--stack <name>`, or `--stack-id <id>`.
+Select the current project/branch/name, `--stack <name>`, or `--stack-id <id or unique prefix>`.
 The selectors are mutually exclusive. Missing or unconfigured stacks fail with
 guidance to run `stack start`. Explicit legacy `-o/--output` is rejected in favor
 of `--output-format`.
diff --git a/apps/cli/src/commands/experimental/stack/restart/restart.command.ts b/apps/cli/src/commands/experimental/stack/restart/restart.command.ts
index c0ac0707bd..206d37fe57 100644
--- a/apps/cli/src/commands/experimental/stack/restart/restart.command.ts
+++ b/apps/cli/src/commands/experimental/stack/restart/restart.command.ts
@@ -10,7 +10,7 @@ const config = {
     Flag.optional,
   ),
   stackId: Flag.string("stack-id").pipe(
-    Flag.withDescription("Restart an existing stack by id."),
+    Flag.withDescription("Restart an existing stack by id or unique id prefix."),
     Flag.optional,
   ),
 } as const;
diff --git a/apps/cli/src/commands/experimental/stack/restart/restart.handler.ts b/apps/cli/src/commands/experimental/stack/restart/restart.handler.ts
index 898d1cf198..25143db0b4 100644
--- a/apps/cli/src/commands/experimental/stack/restart/restart.handler.ts
+++ b/apps/cli/src/commands/experimental/stack/restart/restart.handler.ts
@@ -98,6 +98,7 @@ export const stackRestart = Effect.fn("experimental.stack.restart")(function* (
       health,
       wake_enabled: wakeEnabled,
     }));
+    yield* Effect.annotateCurrentSpan({ "stack.service_count": services.length });
     if (output.format === "text") {
       yield* output.raw(`Stack ${stack.id} restarted using its saved configuration.\n`);
       for (const service of services)
diff --git a/apps/cli/src/commands/experimental/stack/stack-backend.integration.test.ts b/apps/cli/src/commands/experimental/stack/stack-backend.integration.test.ts
index 2dfb685dd2..7c82c1835c 100644
--- a/apps/cli/src/commands/experimental/stack/stack-backend.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/stack-backend.integration.test.ts
@@ -3,7 +3,11 @@ import { describe, expect, it } from "@effect/vitest";
 import { Cause, Effect, Exit, FileSystem, Option, Path } from "effect";
 import { respondToComplete } from "../../../cli/complete.ts";
 import { rootCommandForFeatures } from "../../../cli/root.ts";
-import { StackRoutingError, resolveStackBackend } from "../../../command-internal/stack-backend.ts";
+import {
+  type StackBackend,
+  StackRoutingError,
+  resolveStackBackend,
+} from "../../../command-internal/stack-backend.ts";
 
 const resolve = (input: Parameters<typeof resolveStackBackend>[0]) =>
   resolveStackBackend(input).pipe(Effect.provide(BunServices.layer));
@@ -21,7 +25,7 @@ const project = (config: string, format: "toml" | "json" = "toml") =>
 const withServices = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
   effect.pipe(Effect.provide(BunServices.layer));
 
-const completionFlags = (backend: "legacy" | "stack", command: string) =>
+const completionFlags = (backend: StackBackend | undefined, command: string) =>
   respondToComplete(rootCommandForFeatures({ stackBackend: backend }), [
     "__complete",
     command,
@@ -85,11 +89,11 @@ stack = true
     );
   });
 
-  it.effect("keeps an unrouted command on legacy even when the feature flag is enabled", () => {
+  it.effect("selects no backend for an unrouted command when stack is enabled", () => {
     return withServices(
       Effect.gen(function* () {
         const root = yield* project("[experimental]\nstack = true\n");
-        expect(yield* resolve({ args: ["link"], cwd: root, env: {} })).toBe("legacy");
+        expect(yield* resolve({ args: ["link"], cwd: root, env: {} })).toBeUndefined();
       }),
     );
   });
@@ -321,7 +325,7 @@ stack = true
         expect(
           yield* resolve({ args: ["__complete", "functions", "serve", "--"], cwd: root, env: {} }),
         ).toBe("stack");
-        expect(yield* resolve({ args: ["functions", "list"], cwd: root, env: {} })).toBe("legacy");
+        expect(yield* resolve({ args: ["functions", "list"], cwd: root, env: {} })).toBeUndefined();
       }),
     ),
   );
diff --git a/apps/cli/src/commands/experimental/stack/stack-command-telemetry.integration.test.ts b/apps/cli/src/commands/experimental/stack/stack-command-telemetry.integration.test.ts
index 40c4ea8b7b..290c59da79 100644
--- a/apps/cli/src/commands/experimental/stack/stack-command-telemetry.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/stack-command-telemetry.integration.test.ts
@@ -62,7 +62,6 @@ const setup = () =>
         mockRuntimeInfo({ cwd: root, homeDir: root }),
         mockTelemetryRuntime({
           configDir: path.join(root, ".supabase"),
-          tracesDir: path.join(root, ".supabase", "traces"),
         }),
         processEnvLayer({ SUPABASE_HOME: path.join(root, ".supabase") }),
       ),
diff --git a/apps/cli/src/commands/experimental/stack/stack-config-environment.integration.test.ts b/apps/cli/src/commands/experimental/stack/stack-config-environment.integration.test.ts
index 45a41ae98b..d80244649f 100644
--- a/apps/cli/src/commands/experimental/stack/stack-config-environment.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/stack-config-environment.integration.test.ts
@@ -79,7 +79,6 @@ site_url = "from-config"
           SUPABASE_API_PORT: "54321",
           SUPABASE_DB_PORT: "54322",
           SUPABASE_ANALYTICS_PORT: "55555",
-          SUPABASE_ANALYTICS_VECTOR_PORT: "55556",
         },
         load(root),
       );
@@ -87,9 +86,6 @@ site_url = "from-config"
       expect(service(recipes, "database")?.endpoints).toEqual({ sql: { port: 54322 } });
       expect(service(recipes, "rest")?.endpoints).toEqual({ http: { port: 54321 } });
       expect(service(recipes, "analytics")?.endpoints).toEqual({ http: { port: 55555 } });
-
-      expect(service(recipes, "vector")?.endpoints).toEqual({ http: { port: 55556 } });
-
       const defaults = yield* load(root);
       const defaultRecipes = yield* defaults.creations("automatic-ports");
       expect(service(defaultRecipes, "analytics")?.endpoints).toEqual({
diff --git a/apps/cli/src/commands/experimental/stack/stack-config.integration.test.ts b/apps/cli/src/commands/experimental/stack/stack-config.integration.test.ts
index e32f41ad53..5589de8aac 100644
--- a/apps/cli/src/commands/experimental/stack/stack-config.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/stack-config.integration.test.ts
@@ -1,7 +1,7 @@
 import { BunServices } from "@effect/platform-bun";
 import { afterEach, describe, expect, it, vi } from "@effect/vitest";
 import { DEFAULT_SIGNING_KEY } from "@supabase/stack/defaults";
-import { Effect, Exit, FileSystem, Layer, Path, Schema } from "effect";
+import { Effect, Exit, FileSystem, Layer, Path, Ref, Schema } from "effect";
 import { importJWK, jwtVerify } from "jose";
 import { ServiceCreationInput } from "../../../../../../packages/stack/src/services/Catalog.ts";
 import { runtimeInfoLayer } from "../../../shared/runtime/runtime-info.layer.ts";
@@ -10,6 +10,10 @@ import { renderCliConfigTemplate } from "../../../shared/init/project-init.templ
 
 import { loadStackConfig } from "../../../command-internal/stack-config.ts";
 import { createStackConfigProject } from "../../../../tests/helpers/stack-config.ts";
+import {
+  CommandTelemetryAttributes,
+  type CommandTelemetryAttributeValues,
+} from "../../../telemetry/command-telemetry-attributes.ts";
 
 const load = (projectRoot: string) =>
   loadStackConfig(projectRoot).pipe(
@@ -75,7 +79,6 @@ enabled = true
       expect(recipes.get("analytics")?.endpoints).toEqual({ http: { port: "auto" } });
       const storage = recipes.get("storage");
       expect(storage?.service === "storage" && storage.config.fileSizeLimit).toBe("52428800");
-      expect(recipes.has("vector")).toBe(true);
       expect(recipes.has("functions")).toBe(true);
     }).pipe(Effect.provide(BunServices.layer)),
   );
@@ -369,4 +372,33 @@ s3_host = "s3.example.test"
       expect(s3Config.source.experimental.s3_host).toBe("s3.example.test");
     }).pipe(Effect.provide(BunServices.layer)),
   );
+
+  it.live("records OrioleDB selection on the command event before rejecting it", () =>
+    Effect.gen(function* () {
+      const loadRecordingOrioleDb = (projectRoot: string) =>
+        Effect.gen(function* () {
+          const recorded = yield* Ref.make<CommandTelemetryAttributeValues>({});
+          const exit = yield* load(projectRoot).pipe(
+            Effect.provideService(CommandTelemetryAttributes, {
+              record: (values) => Ref.update(recorded, (current) => ({ ...current, ...values })),
+            }),
+            Effect.exit,
+          );
+          return { exit, orioledb: (yield* Ref.get(recorded)).orioledb };
+        });
+
+      const orioledb = yield* project(`project_id = "stack-config-orioledb-telemetry"
+[db]
+orioledb_version = "15.1.1.14"
+`);
+      const rejected = yield* loadRecordingOrioleDb(orioledb);
+      expect(Exit.isFailure(rejected.exit)).toBe(true);
+      expect(rejected.orioledb).toBe(true);
+
+      const standard = yield* project(`project_id = "stack-config-standard-telemetry"\n`);
+      const accepted = yield* loadRecordingOrioleDb(standard);
+      expect(Exit.isSuccess(accepted.exit)).toBe(true);
+      expect(accepted.orioledb).toBe(false);
+    }).pipe(Effect.provide(BunServices.layer)),
+  );
 });
diff --git a/apps/cli/src/commands/experimental/stack/stack-forwarding.integration.test.ts b/apps/cli/src/commands/experimental/stack/stack-forwarding.integration.test.ts
index 79ad9f79c4..d48745aeff 100644
--- a/apps/cli/src/commands/experimental/stack/stack-forwarding.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/stack-forwarding.integration.test.ts
@@ -41,8 +41,6 @@ enabled = false
 enabled = false
 max_buckets = 3
 max_indexes = 2
-[analytics]
-vector_port = 59001
 `);
       const loaded = yield* loadStackConfig(root);
       const services = yield* loaded.creations("forwarding");
@@ -60,7 +58,6 @@ vector_port = 59001
       expect(
         realtime?.service === "realtime" ? realtime.config.secretKeyBase : undefined,
       ).toBeUndefined();
-      expect(services.find((s) => s.service === "vector")?.endpoints?.http?.port).toBe(59001);
       // A composition binds each database URL before launch.
       const bound = <C extends { readonly config: object }>(creation: C) => ({
         ...creation,
diff --git a/apps/cli/src/commands/experimental/stack/stack.command.ts b/apps/cli/src/commands/experimental/stack/stack.command.ts
index 28f3cbf6eb..eb710b0fa9 100644
--- a/apps/cli/src/commands/experimental/stack/stack.command.ts
+++ b/apps/cli/src/commands/experimental/stack/stack.command.ts
@@ -4,7 +4,7 @@ import { commandRuntimeLayer } from "../../../shared/runtime/command-runtime.lay
 import { commandSettingsLayer } from "../../../config/command-settings.layer.ts";
 import { debugLoggerLayer } from "../../../command-internal/debug-logger.layer.ts";
 import { telemetryStateLayer } from "../../../telemetry/telemetry-state.layer.ts";
-import { dbConnectionLayer } from "../../../command-internal/db-connection.layer.ts";
+import { dbConnectionLayer } from "../../../command-internal/db-connection.sql-pg.layer.ts";
 import { stackCatalogSetupLayer } from "../../../command-internal/stack-catalog-setup.ts";
 import { httpClientLayer } from "../../../auth/http-debug.layer.ts";
 import { commandCredentialsLayer } from "../../../auth/command-credentials.layer.ts";
diff --git a/apps/cli/src/commands/experimental/stack/stack.shared.integration.test.ts b/apps/cli/src/commands/experimental/stack/stack.shared.integration.test.ts
index ed4e9742cb..dcdb889a29 100644
--- a/apps/cli/src/commands/experimental/stack/stack.shared.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/stack.shared.integration.test.ts
@@ -1,6 +1,6 @@
 import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, FileSystem, Layer, Path } from "effect";
+import { Effect, FileSystem, Layer, Path, Ref } from "effect";
 import {
   StackApi,
   StackTargetError,
@@ -9,6 +9,10 @@ import {
   stackTargetResolverLayer,
 } from "./stack.shared.ts";
 import { mockCommandSettings } from "../../../../tests/helpers/command-mocks.ts";
+import {
+  CommandTelemetryAttributes,
+  type CommandTelemetryAttributeValues,
+} from "../../../telemetry/command-telemetry-attributes.ts";
 
 type TargetInput = {
   readonly projectRoot: string;
@@ -78,6 +82,53 @@ describe("stack target resolver", () => {
     }).pipe(Effect.provide(BunServices.layer)),
   );
 
+  it.live("rejects an id prefix that several readable or unreadable saved stacks share", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const { root, home, register, resolve } = yield* workspace;
+      const id = yield* register({ projectRoot: root });
+      const twin = `${id.slice(0, 8)}${id.slice(8).replace(/./gu, (c) => (c === "0" ? "1" : "0"))}`;
+      const saved = yield* fs.readFileString(path.join(home, "stacks", id, "state.json"));
+      yield* fs.makeDirectory(path.join(home, "stacks", twin));
+      yield* fs.writeFileString(
+        path.join(home, "stacks", twin, "state.json"),
+        saved.replaceAll(id, twin),
+      );
+      const broken = `${id.slice(0, 8)}${"f".repeat(56)}`;
+      yield* fs.makeDirectory(path.join(home, "stacks", broken));
+      yield* fs.writeFileString(path.join(home, "stacks", broken, "state.json"), "{broken");
+
+      const failure = yield* resolve({
+        projectRoot: root,
+        id: id.slice(0, 8),
+        runtime: "auto",
+      }).pipe(Effect.flip);
+
+      expect(failure.reason).toBe("flags");
+      expect(failure.message).toContain(`Stack id prefix ${id.slice(0, 8)} matches 3 stacks`);
+      expect(failure.message).toContain(id);
+      expect(failure.message).toContain(twin);
+      expect(failure.message).toContain(broken);
+    }).pipe(Effect.provide(BunServices.layer)),
+  );
+
+  it.live("rejects a stack id shorter than four characters", () =>
+    Effect.gen(function* () {
+      const { root, register, resolve } = yield* workspace;
+      const id = yield* register({ projectRoot: root });
+
+      const failure = yield* resolve({
+        projectRoot: root,
+        id: id.slice(0, 3),
+        runtime: "auto",
+      }).pipe(Effect.flip);
+
+      expect(failure.reason).toBe("flags");
+      expect(failure.message).toContain("prefix of at least 4 characters");
+    }).pipe(Effect.provide(BunServices.layer)),
+  );
+
   it.live("rejects an explicit id when its saved runtime differs", () =>
     Effect.gen(function* () {
       const { root, register, resolve } = yield* workspace;
@@ -109,6 +160,22 @@ describe("stack target resolver", () => {
     }).pipe(Effect.provide(BunServices.layer)),
   );
 
+  it.live("records the saved stack's runtime on the command event", () =>
+    Effect.gen(function* () {
+      const { root, register, resolve } = yield* workspace;
+      yield* register({ projectRoot: root, runtime: "docker" });
+      const recorded = yield* Ref.make<CommandTelemetryAttributeValues>({});
+
+      yield* resolve({ projectRoot: root, runtime: "auto" }).pipe(
+        Effect.provideService(CommandTelemetryAttributes, {
+          record: (values) => Ref.update(recorded, (current) => ({ ...current, ...values })),
+        }),
+      );
+
+      expect((yield* Ref.get(recorded)).stack_runtime).toBe("docker");
+    }).pipe(Effect.provide(BunServices.layer)),
+  );
+
   it.live("reports no id when the project has no saved stack", () =>
     Effect.gen(function* () {
       const { root, resolve } = yield* workspace;
@@ -160,6 +227,25 @@ describe("stack target resolver", () => {
       expect(failure.message).toContain(id);
     }).pipe(Effect.provide(BunServices.layer)),
   );
+
+  it.live("surfaces an unreadable saved stack that an id prefix selects", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const { root, home, register, resolve } = yield* workspace;
+      const id = yield* register({ projectRoot: root });
+      yield* fs.writeFileString(path.join(home, "stacks", id, "state.json"), "{broken");
+
+      const failure = yield* resolve({
+        projectRoot: root,
+        id: id.slice(0, 8),
+        runtime: "auto",
+      }).pipe(Effect.flip);
+
+      expect(failure.reason).toBe("invalid-config");
+      expect(failure.message).toContain(`Stack ${id} could not be read`);
+    }).pipe(Effect.provide(BunServices.layer)),
+  );
 });
 
 describe("stack API layer", () => {
diff --git a/apps/cli/src/commands/experimental/stack/stack.shared.ts b/apps/cli/src/commands/experimental/stack/stack.shared.ts
index d7958bcc7c..604dab3612 100644
--- a/apps/cli/src/commands/experimental/stack/stack.shared.ts
+++ b/apps/cli/src/commands/experimental/stack/stack.shared.ts
@@ -16,7 +16,10 @@ import {
   StackApi,
   stackApiLayer,
 } from "../../../command-internal/stack-api.ts";
-import type { StackRuntime } from "../../../command-internal/stack-runtime.ts";
+import {
+  recordStackRuntimeTelemetry,
+  type StackRuntime,
+} from "../../../command-internal/stack-runtime.ts";
 
 export { skippedRuntimeCleanupWarning, StackApi, stackApiLayer };
 
@@ -68,13 +71,18 @@ export const validateStackTarget = (input: {
       )
     : Effect.void;
 
+const isStackId = Schema.is(StackId);
+const STACK_ID_PREFIX = /^[0-9a-f]{4,64}$/;
+
 const validateStackId = (id: string): Effect.Effect<string, StackTargetError> =>
-  Schema.is(StackId)(id)
+  STACK_ID_PREFIX.test(id)
     ? Effect.succeed(id)
     : Effect.fail(
         new StackTargetError({
-          message: "--stack-id must be a lowercase SHA-256 stack id",
+          message:
+            "--stack-id must be a lowercase hexadecimal stack id or a prefix of at least 4 characters",
           reason: "flags",
+          suggestion: "Copy the ID column from `supabase stack list`.",
         }),
       );
 
@@ -92,6 +100,9 @@ export const rejectStackOutput = (
       )
     : Effect.void;
 
+const stateError = (cause: StackError) =>
+  new StackTargetError({ message: cause.message, reason: "invalid-config", cause });
+
 const runtimeForFlag = (runtime: "auto" | StackRuntime): StackTarget["runtime"] =>
   runtime === "auto" ? undefined : runtime;
 
@@ -100,7 +111,7 @@ const runtimeMatches = (
   requested: StackTarget["runtime"],
 ): boolean => requested === undefined || saved === requested;
 
-/** Resolves an existing stack by id or by the package identity of the project and stack name. */
+/** Resolves an existing stack by id, unique id prefix, or the identity of the project and stack name. */
 export const stackTargetResolverLayer = Layer.effect(
   StackTargetResolver,
   Effect.gen(function* () {
@@ -108,6 +119,40 @@ export const stackTargetResolverLayer = Layer.effect(
     const stackApi = yield* StackApi;
     const fs = yield* FileSystem.FileSystem;
     const path = yield* Path.Path;
+    const findByIdPrefix = Effect.fn("StackTargetResolver.findByIdPrefix")(function* (
+      stateRoot: string,
+      prefix: string,
+    ) {
+      const unreadable: Array<{ readonly id: string; readonly error: Error }> = [];
+      const matches = yield* stackApi
+        .discover({
+          stateRoot,
+          idPrefix: prefix,
+          onInvalidState: (id, error) => Effect.sync(() => unreadable.push({ id, error })),
+        })
+        .pipe(Effect.mapError(stateError));
+      const matchedIds = [
+        ...matches.map(({ definition }) => definition.id),
+        ...unreadable.map(({ id }) => id),
+      ];
+      yield* Effect.annotateCurrentSpan({ "stack.id_prefix_matches": matchedIds.length });
+      if (matchedIds.length > 1)
+        return yield* new StackTargetError({
+          message: `Stack id prefix ${prefix} matches ${matchedIds.length} stacks: ${matchedIds.join(", ")}`,
+          reason: "flags",
+          suggestion: "Pass more characters of one of the listed stack ids.",
+        });
+      const [invalid] = unreadable;
+      if (invalid !== undefined)
+        return yield* new StackTargetError({
+          message: `Stack ${invalid.id} could not be read: ${invalid.error.message}`,
+          reason: "invalid-config",
+          suggestion:
+            "Inspect the stack registry under $SUPABASE_HOME/stacks or ~/.supabase/stacks.",
+          cause: invalid.error,
+        });
+      return matches[0];
+    });
     const resolve = Effect.fn("StackTargetResolver.resolve")(function* (input: {
       readonly projectRoot: string;
       readonly name?: string;
@@ -117,31 +162,25 @@ export const stackTargetResolverLayer = Layer.effect(
       const id = input.id === undefined ? undefined : yield* validateStackId(input.id);
       const requestedRuntime = runtimeForFlag(input.runtime);
       const stateRoot = path.join(settings.supabaseHome, "stacks");
-      const found = yield* stackApi
-        .find(
-          id === undefined
-            ? {
-                stateRoot,
-                projectRoot: input.projectRoot,
-                ...(input.name === undefined ? {} : { name: input.name }),
-              }
-            : { stateRoot, id },
-        )
-        .pipe(
-          Effect.map(Option.getOrUndefined),
-          Effect.mapError(
-            (cause) =>
-              new StackTargetError({
-                message: cause.message,
-                reason: "invalid-config",
-                cause,
-              }),
-          ),
-        );
+      const found =
+        id === undefined || isStackId(id)
+          ? yield* stackApi
+              .find(
+                id === undefined
+                  ? {
+                      stateRoot,
+                      projectRoot: input.projectRoot,
+                      ...(input.name === undefined ? {} : { name: input.name }),
+                    }
+                  : { stateRoot, id },
+              )
+              .pipe(Effect.map(Option.getOrUndefined), Effect.mapError(stateError))
+          : yield* findByIdPrefix(stateRoot, id);
       if (id !== undefined && found === undefined)
         return yield* new StackTargetError({
           message: `Stack ${id} was not found`,
           reason: "flags",
+          suggestion: "Run `supabase stack list` to see managed stacks and their IDs.",
         });
       if (found !== undefined && !runtimeMatches(found.definition.runtime, requestedRuntime))
         return yield* new StackTargetError({
@@ -151,6 +190,7 @@ export const stackTargetResolverLayer = Layer.effect(
           reason: "flags",
         });
       const runtime = found?.definition.runtime ?? requestedRuntime;
+      if (runtime !== undefined) yield* recordStackRuntimeTelemetry(runtime);
       // A new stack saves paths under the canonical root its identity derives from.
       const projectRoot =
         found?.definition.identity.projectRoot ??
@@ -179,8 +219,6 @@ export const stackCapabilityForService = (service: ServiceCreation["service"]) =
   switch (service) {
     case "imgproxy":
       return "storage";
-    case "vector":
-      return "analytics";
     case "pgmeta":
       return "studio";
     default:
diff --git a/apps/cli/src/commands/experimental/stack/start/SIDE_EFFECTS.md b/apps/cli/src/commands/experimental/stack/start/SIDE_EFFECTS.md
index 59b0bf2b38..6dff1cfb23 100644
--- a/apps/cli/src/commands/experimental/stack/start/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/experimental/stack/start/SIDE_EFFECTS.md
@@ -20,9 +20,10 @@ If the stack is otherwise in a partial lifecycle state, start fails with guidanc
 and start it again before applying configuration.
 Auth policies, OAuth providers, hooks, MFA, SMTP, email subjects and notification controls are
 forwarded to Auth. REST search paths, pooler limits, Realtime settings, Studio settings, Storage
-S3 protocol/vector controls, and configured Vector ports are forwarded to their services. Storage
-receives the local S3 access keys and region, and uses the gateway's `/storage/v1` prefix to verify
-S3 signatures and to build resumable upload URLs.
+S3 protocol/vector controls are forwarded to their services. Storage receives the local S3 access
+keys and region, and uses the gateway's `/storage/v1` prefix to verify S3 signatures and to build
+resumable upload URLs. `analytics.vector_port` and `SUPABASE_ANALYTICS_VECTOR_PORT` are accepted
+and ignored: the stack runs no Vector service.
 Encrypted JWT secrets are decrypted before shared credentials are derived. `db.health_timeout`
 controls database readiness; package JWT and PostgreSQL root-key defaults apply when omitted, and
 the effective root key is supplied through a stack-owned key file.
@@ -36,6 +37,15 @@ Secrets needed by enabled services are passed to the runtime. State and service
 `$SUPABASE_HOME/stacks/<stack-id>/` (`~/.supabase/stacks/<stack-id>/` by default); native artifacts
 use `$SUPABASE_HOME/cache/stack`. Storage files use the caller-owned project directory
 `supabase/.temp/stack-uploads/<stack-id>/`. Functions preparation may build the project's source.
+The owner persists each service's output under `$SUPABASE_HOME/stacks/<stack-id>/logs/`, keeping at
+most about 10 MiB (plus the segment being written) per service instance. Destroying an instance or
+the stack deletes those logs; stopping the stack and resetting database data keep them.
+PostgREST runs with `PGRST_LOG_LEVEL=info`, so every request line, query string included, is
+persisted and shipped to Analytics.
+When an owner starts a stack saved with a Vector instance, it removes that instance, its composition
+members, dependencies and port claims from `state.json`, and its stack-owned Vector config files
+under `data/<instance-id>/runtime/vector/`; its containers go with the stack's container sweep. A
+migration that fails is logged as a warning and retried by the next owner start.
 
 For a new stack, `--runtime auto` selects Docker when `docker version` reaches its daemon, then
 Podman when `podman info` reaches its engine, then native on Linux x64/arm64 and macOS arm64. Each
@@ -75,10 +85,37 @@ it again to apply those changes.
 
 `--exclude` accepts repeated or comma-separated capability names: `rest`, `auth`, `realtime`,
 `storage`, `functions`, `studio`, `mail`, `analytics`, and `pooler`. Database cannot be excluded.
-Storage includes its Imgproxy companion, Studio includes Pgmeta, and Analytics includes Vector.
+Storage includes its Imgproxy companion and Studio includes Pgmeta.
 Studio requires REST; excluding REST while keeping Studio fails before stopping the composition.
-Vector runs a stack-owned default configuration that enables its health API and forwards no service
-logs; log collection into Analytics is not implemented yet.
+
+## Service logs in Analytics
+
+The owner ships the persisted Auth, REST, Realtime, Storage, Functions, and database output lines
+(not launch or lost markers) to Analytics' `POST /api/logs` ingest endpoint on its direct backend,
+using the Analytics API key and the legacy Logflare source names (`gotrue.logs.prod`,
+`postgREST.logs.prod`, `realtime.logs.prod`, `storage.logs.prod.2`, `deno-relay-logs`,
+`postgres.logs`) with the legacy per-service field remaps. This applies to the Docker, Podman, and
+native runtimes. Shipping runs only while the composed Analytics service is running and healthy;
+each instance keeps its position in `logs/<service>/<instance-id>/cursor.json`, so lines written
+while Analytics is stopped, starting, or unhealthy are shipped with their original timestamps once
+it is healthy again, including after an owner restart. A missing or unreadable position starts from
+the oldest retained line. Lines already deleted by log retention are skipped, and Analytics refusing
+the API key pauses shipping until Analytics stops or turns unhealthy and is healthy again, or the
+composition selects a different Analytics instance. A failed log read is retried from the saved
+position with a backoff. Each event carries an id derived from its instance and position. Before
+posting a request, the owner records it as pending in `cursor.json`; it then reads Analytics'
+Postgres tables (`_analytics.sources` and `_analytics.log_events_<token>` in the stack's
+`_supabase` database) to confirm which events are stored, posts only the missing ones, and
+advances the position once all are stored. While those tables cannot be read, shipping waits and
+logs one warning. Events an Analytics process accepted are not posted to it again while it may
+still store them; events still missing are posted again 5 seconds after the request ended once
+Analytics restarted, or 60 seconds after it once the owner restarted, and a pending request is
+confirmed the same way. Events still missing after 60 seconds of Analytics serving are posted
+again in halves; one that is still not stored on its own is skipped with a warning once Analytics
+stored a later request, and kept otherwise. NUL characters and unpaired
+surrogates in shipped lines are replaced with U+FFFD. Shipping never wakes Analytics
+and does not count as idle activity, so a lazy Analytics still stops on its idle timer while other
+services log. Service log streams and `supabase stack logs` are never blocked by shipping.
 
 After an explicit stop, start compares the project configuration with the saved composition through
 the stack package's composition plan, ignoring values the composition and stack credentials supply.
@@ -88,8 +125,9 @@ and ports are retained. Changed exclusions reuse existing service identities, da
 Removed services remain saved and stopped so including them again can reuse them; a saved stopped
 instance of a newly included service is reused when its endpoints and versions still match. The
 project configuration file is unchanged. A changed endpoint, artifact version, or PostgreSQL major
-version fails before modifying the stopped composition, naming the changed setting and suggesting
-`supabase stack destroy` to recreate the stack.
+version fails before modifying the stopped composition, naming the `config.toml` key or
+`SUPABASE_*` env var behind the change with its saved and requested values, and suggesting either
+reverting it or running the stack's exact `supabase stack destroy` command to recreate it.
 
 ## First startup and retries
 
@@ -127,7 +165,7 @@ Text output reports progress and `Stack is ready.`, then prints the connection s
 `stack status` on stdout: API, REST, Functions, Studio, MCP, Mailpit, and database URLs for the
 members that expose them, the publishable and secret keys, the Storage S3 URL, access keys, and
 region when the S3 protocol is enabled, a services table, the runtime, and a
-pointer to `supabase status --env` that repeats an explicit `--workdir` and any `--stack` or `--stack-id` selector, shell-quoted. Progress lines
+pointer to `supabase status --env` that repeats an explicit `--workdir` and any `--stack` selector or the resolved full `--stack-id`, shell-quoted. Progress lines
 and warnings written while the spinner is shown appear on their own rows.
 
 JSON output returns the stack `id`, its saved `runtime`, `endpoints` keyed by service and endpoint
@@ -137,3 +175,12 @@ name (protocol, address, port, and URL, matching `stack status`, with no synthet
 empty message. See [`docs/stack-commands.md`](../../../../../docs/stack-commands.md) for an
 example. Failures retain typed command errors and package diagnostics. Telemetry state is flushed
 after success or failure.
+
+A rejected configuration change additionally carries `stack_changes` on the JSON/stream-json error
+envelope: one entry per affected service (a shared setting such as the API port appears once per
+API-backed service, unlike the deduplicated text message), each with `service`, `path` (the
+composition planner's dotted path, e.g. `endpoints.http.port`, not a `config.toml` key), `key`,
+`saved`, `requested`, and `editable`. `recreate_command` is the exact `supabase stack destroy
+--stack-id <id>` invocation, without `--yes`, since destroy deletes local database data; running it
+non-interactively or with `--output-format json`/`--output-format stream-json` requires passing
+`--yes` explicitly.
diff --git a/apps/cli/src/commands/experimental/stack/start/start-export-pointer.integration.test.ts b/apps/cli/src/commands/experimental/stack/start/start-export-pointer.integration.test.ts
index a15901b14b..022a52ae47 100644
--- a/apps/cli/src/commands/experimental/stack/start/start-export-pointer.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/start/start-export-pointer.integration.test.ts
@@ -84,7 +84,7 @@ function makeDatabaseStack(sqlPort: number, credentials: StackCredentials): Stac
     prepare: Effect.die("unused"),
     status: Effect.succeed(observation),
     followStatus: Stream.empty,
-    logs: Stream.empty,
+    readLogs: () => Stream.empty,
     credentials: () => Effect.succeed({}),
     saveSnapshot: () => Effect.die("unused"),
     restoreSnapshot: () => Effect.die("unused"),
@@ -240,10 +240,7 @@ const runStatusEnv = (input: {
           mockTty({ stdinIsTty: false, stdoutIsTty: false }),
           mockStdin(false),
           mockRuntimeInfo({ cwd: input.ambientCwd, homeDir: "/pointer-test/home" }),
-          mockTelemetryRuntime({
-            configDir: "/pointer-test/.supabase",
-            tracesDir: "/pointer-test/.supabase/traces",
-          }),
+          mockTelemetryRuntime({ configDir: "/pointer-test/.supabase" }),
         ),
       ),
     );
diff --git a/apps/cli/src/commands/experimental/stack/start/start.command.ts b/apps/cli/src/commands/experimental/stack/start/start.command.ts
index 4f9df6a258..bcc8f3e806 100644
--- a/apps/cli/src/commands/experimental/stack/start/start.command.ts
+++ b/apps/cli/src/commands/experimental/stack/start/start.command.ts
@@ -1,6 +1,8 @@
+import { Layer } from "effect";
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
 import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { machineErrorContextLayer } from "../../../../shared/output/machine-error-context.layer.ts";
 import { withCommandTelemetry } from "../../../../telemetry/command-telemetry.ts";
 import { stringSliceFlag } from "../../../../command-internal/string-slice-flag.ts";
 import { stdinLayer } from "../../../../shared/runtime/stdin.layer.ts";
@@ -17,7 +19,7 @@ const config = {
   exclude: excludeFlag,
   stack: Flag.string("stack").pipe(Flag.withDescription("Name this stack."), Flag.optional),
   stackId: Flag.string("stack-id").pipe(
-    Flag.withDescription("Open an existing stack by id."),
+    Flag.withDescription("Open an existing stack by id or unique id prefix."),
     Flag.optional,
   ),
   runtime: Flag.choice("runtime", ["auto", "docker", "podman", "native"] as const).pipe(
@@ -66,5 +68,7 @@ export const stackStartCommand = Command.make("start", config).pipe(
   ),
   // `stackStart`'s bucket-seeding path satisfies `promptYesNo`'s `Stdin` requirement here even
   // though it always passes `yes: true`/`interactive: false` and never reaches the prompt.
-  Command.provide(stdinLayer),
+  // `machineErrorContextLayer` carries the structured incompatible-change payload onto the
+  // JSON/stream-json error envelope.
+  Command.provide(Layer.mergeAll(stdinLayer, machineErrorContextLayer)),
 );
diff --git a/apps/cli/src/commands/experimental/stack/start/start.e2e.test.ts b/apps/cli/src/commands/experimental/stack/start/start.e2e.test.ts
index fca1046b9b..d73c028be2 100644
--- a/apps/cli/src/commands/experimental/stack/start/start.e2e.test.ts
+++ b/apps/cli/src/commands/experimental/stack/start/start.e2e.test.ts
@@ -343,6 +343,7 @@ describe("stack start (compiled e2e)", () => {
                       [
                         "stack",
                         "logs",
+                        "--follow",
                         "--stack-id",
                         idText,
                         "--service",
@@ -374,6 +375,12 @@ describe("stack start (compiled e2e)", () => {
                     ),
                   ),
               );
+              // History precedes the follow, whose start is the last printed record.
+              yield* waitForOutput(
+                followed,
+                /"type":"log-entry".*"source":"history"/u,
+                START_TIMEOUT_MS,
+              );
               const restarted = yield* runSupabaseEffect(
                 ["stack", "restart", "--stack-id", idText],
                 {
@@ -523,28 +530,49 @@ describe("stack start (compiled e2e)", () => {
 
           yield* access(join(databasePath, "data", "PG_VERSION"));
 
-          const stoppedLogs = yield* runSupabaseEffect(
-            [
-              "stack",
-              "logs",
-              "--stack-id",
-              idText,
-              "--service",
-              "database",
-              "--output-format",
-              "stream-json",
-            ],
-            {
-              cwd: projectRoot,
-              home: homeDir.dir,
-              env: { SUPABASE_EXPERIMENTAL_STACK: "1" },
-              exitTimeoutMs: CLEANUP_TIMEOUT_MS,
-            },
+          const stoppedLogsArgs = [
+            "stack",
+            "logs",
+            "--stack-id",
+            idText,
+            "--service",
+            "database",
+            "--output-format",
+            "stream-json",
+          ];
+          const stoppedOptions = {
+            cwd: projectRoot,
+            home: homeDir.dir,
+            env: { SUPABASE_EXPERIMENTAL_STACK: "1" },
+            exitTimeoutMs: CLEANUP_TIMEOUT_MS,
+          };
+          const stoppedHistory = yield* runSupabaseEffect(stoppedLogsArgs, stoppedOptions);
+          expect(
+            stoppedHistory.exitCode,
+            `stdout:\n${stoppedHistory.stdout}\nstderr:\n${stoppedHistory.stderr}`,
+          ).toBe(0);
+          const historyEvents = yield* Effect.forEach(
+            stoppedHistory.stdout
+              .trim()
+              .split("\n")
+              .filter((line) => line.length > 0),
+            (line) => Schema.decodeEffect(Schema.fromJsonString(FollowEventSchema))(line),
           );
-          expect(stoppedLogs.exitCode).not.toBe(0);
-          expect(`${stoppedLogs.stdout}\n${stoppedLogs.stderr}`).toMatch(
-            /unavailable|not running|must be running/iu,
+          expect(
+            historyEvents.some(
+              (event) =>
+                event.type === "log-entry" &&
+                event.source === "history" &&
+                event.service === "database",
+            ),
+          ).toBe(true);
+          const stoppedFollow = yield* runSupabaseEffect(
+            [...stoppedLogsArgs, "--follow"],
+            stoppedOptions,
           );
+          expect(stoppedFollow.exitCode).not.toBe(0);
+          expect(stoppedFollow.stdout).not.toContain("log-entry");
+          expect(`${stoppedFollow.stdout}\n${stoppedFollow.stderr}`).toMatch(/not running/iu);
 
           yield* destroyStack(homeDir.dir, idText);
           stackDestroyed = true;
diff --git a/apps/cli/src/commands/experimental/stack/start/start.handler.ts b/apps/cli/src/commands/experimental/stack/start/start.handler.ts
index ad8262f771..83df18a4f5 100644
--- a/apps/cli/src/commands/experimental/stack/start/start.handler.ts
+++ b/apps/cli/src/commands/experimental/stack/start/start.handler.ts
@@ -1,4 +1,4 @@
-import { defaultRuntime } from "@supabase/stack/internal/artifacts";
+import { defaultRuntime, postgresVersion } from "@supabase/stack/internal/artifacts";
 import {
   connectionEnv,
   renderStackSummary,
@@ -27,6 +27,7 @@ import {
   type StackError,
 } from "@supabase/stack/effect";
 import { Output } from "../../../../shared/output/output.service.ts";
+import { MachineErrorContext } from "../../../../shared/output/machine-error-context.service.ts";
 import {
   OutputFlag,
   resolveExperimentalWithProjectEnv,
@@ -47,7 +48,13 @@ import {
   seedBucketsRun,
 } from "../../../../command-internal/seed-buckets.ts";
 import { loadLocalProjectContext } from "../../../../command-internal/local-project-context.ts";
-import { loadStackConfig } from "../../../../command-internal/stack-config.ts";
+import {
+  loadStackConfig,
+  stackEndpointSetting,
+  stackMajorVersionSetting,
+  type StackEndpointSetting,
+} from "../../../../command-internal/stack-config.ts";
+import { envOverride } from "../../../../command-internal/local-config-values.ts";
 import {
   StackApi,
   stackCapabilityForService,
@@ -164,23 +171,206 @@ const sameKinds = (
   return leftKinds.size === rightKinds.size && [...leftKinds].every((kind) => rightKinds.has(kind));
 };
 
-/** Rejects a saved instance whose endpoints or artifact versions the request would change. */
-const incompatibleChange = (planned: PlannedInstance) =>
-  planned.change !== "incompatible"
+const isRecord = (value: unknown): value is Readonly<Record<string, unknown>> =>
+  typeof value === "object" && value !== null;
+
+const endpointPortLabel = (endpoints: unknown, name: string): string => {
+  const intent = isRecord(endpoints) ? endpoints[name] : undefined;
+  const port = isRecord(intent) ? intent.port : undefined;
+  return port === "auto" ? "automatic" : typeof port === "number" ? String(port) : "unset";
+};
+
+const databaseVersionOf = (
+  creation: ServiceCreation | ServiceCreationInput | undefined,
+): string | undefined => (creation?.service === "database" ? creation.config.version : undefined);
+
+const majorVersionOf = (version: string): string => version.split(".")[0] ?? version;
+
+/** Renders a dotted config key as its `config.toml` section/key pair, e.g. `[db] major_version`. */
+const formatConfigPath = (path: string): string => {
+  const segments = path.split(".");
+  const key = segments.pop();
+  return `[${segments.join(".")}] ${key}`;
+};
+
+/** The display key for a setting: its env var when that's what overrides it, else its config key. */
+const settingKeyLabel = (
+  setting: StackEndpointSetting,
+  projectEnvValues: Readonly<Record<string, string>>,
+): string =>
+  envOverride(setting.envVar, undefined, projectEnvValues) !== undefined
+    ? setting.envVar
+    : formatConfigPath(setting.configPath);
+
+/**
+ * One incompatible path, reported as the JSON/stream-json error envelope's `stack_changes`
+ * entries (contract documented in `SIDE_EFFECTS.md`). `editable` marks whether `key` is a
+ * `config.toml` key or env var the user can revert, or plain wording for a catalog-pinned
+ * artifact or Postgres build.
+ */
+interface StructuredSettingChange {
+  readonly service: string;
+  readonly path: string;
+  readonly key: string;
+  readonly saved: string;
+  readonly requested: string;
+  readonly editable: boolean;
+}
+
+const describeSettingChange = (
+  service: PlannedInstance["service"],
+  path: string,
+  savedCreation: ServiceCreation | undefined,
+  requestedCreation: ServiceCreationInput | undefined,
+  projectEnvValues: Readonly<Record<string, string>>,
+): StructuredSettingChange => {
+  if (service === "database" && path === "config.version") {
+    // `postgresVersion` resolves a bare major alias (e.g. "17") to the pinned build the
+    // composition plan actually compared, so the saved/requested pair reflects what changed.
+    const savedVersion = postgresVersion(databaseVersionOf(savedCreation) ?? "unknown");
+    const requestedVersion = postgresVersion(databaseVersionOf(requestedCreation) ?? "unknown");
+    const savedMajor = majorVersionOf(savedVersion);
+    const requestedMajor = majorVersionOf(requestedVersion);
+    // Same major but different pinned build: `major_version` doesn't control this, so reverting
+    // it wouldn't fix anything — name the actual (unpinnable) versions instead.
+    if (savedMajor === requestedMajor)
+      return {
+        service,
+        path,
+        key: "Postgres build",
+        saved: savedVersion,
+        requested: requestedVersion,
+        editable: false,
+      };
+    return {
+      service,
+      path,
+      key: settingKeyLabel(stackMajorVersionSetting, projectEnvValues),
+      saved: savedMajor,
+      requested: requestedMajor,
+      editable: true,
+    };
+  }
+  const endpointName = path.startsWith("endpoints.") ? path.split(".")[1] : undefined;
+  const setting =
+    endpointName === undefined ? undefined : stackEndpointSetting(service, endpointName);
+  if (endpointName !== undefined && setting !== undefined)
+    return {
+      service,
+      path,
+      key: settingKeyLabel(setting, projectEnvValues),
+      saved: endpointPortLabel(savedCreation?.endpoints, endpointName),
+      requested: endpointPortLabel(requestedCreation?.endpoints, endpointName),
+      editable: true,
+    };
+  // No config.toml key or env var covers this path (e.g. the catalog-pinned artifact `version`):
+  // name it plainly instead of implying a setting the user could edit.
+  return {
+    service,
+    path,
+    key: path === "version" ? `${service} artifact version` : `${service} ${path}`,
+    saved: path === "version" ? (savedCreation?.version ?? "unknown") : "changed",
+    requested: path === "version" ? (requestedCreation?.version ?? "unknown") : "changed",
+    editable: false,
+  };
+};
+
+/** Every incompatible path across every rejected saved member, as one structured list. */
+const incompatibleSettingChanges = (
+  planned: ReadonlyArray<PlannedInstance>,
+  savedConfigById: ReadonlyMap<string, ServiceCreation>,
+  requested: ReadonlyArray<ServiceCreationInput>,
+  projectEnvValues: Readonly<Record<string, string>>,
+): ReadonlyArray<StructuredSettingChange> =>
+  planned
+    .filter((entry) => entry.member && entry.change === "incompatible")
+    .flatMap((entry) =>
+      // Narrowed by the filter above; `Extract` isn't inferred through `.filter`.
+      entry.change === "incompatible"
+        ? entry.paths.map((path) =>
+            describeSettingChange(
+              entry.service,
+              path,
+              savedConfigById.get(entry.id),
+              requested.find((creation) => creation.service === entry.service),
+              projectEnvValues,
+            ),
+          )
+        : [],
+    );
+
+/** One deduplicated text line per distinct setting change (shared API port lines collapse to one). */
+const settingChangeLines = (
+  changes: ReadonlyArray<StructuredSettingChange>,
+): ReadonlyArray<string> => {
+  const seen = new Set<string>();
+  const lines: Array<string> = [];
+  for (const change of changes) {
+    const line = `${change.key}: saved ${change.saved}, requested ${change.requested}`;
+    if (seen.has(line)) continue;
+    seen.add(line);
+    lines.push(line);
+  }
+  return lines;
+};
+
+const dedupe = (values: ReadonlyArray<string>): ReadonlyArray<string> => [...new Set(values)];
+
+/**
+ * The exact `supabase stack destroy` invocation that recreates this stack. Always targets
+ * `--stack-id`: a `--stack <name>` destroy re-resolves the name against the caller's current
+ * `--workdir`, which can point at a different project's stack of the same name. Omits `--yes` on
+ * purpose, since destroying deletes local database data (details in `SIDE_EFFECTS.md`).
+ */
+const destroyCommandFor = (id: string): string => `supabase stack destroy --stack-id ${id}`;
+
+/** The revert clause for the editable keys among a rejection's changes, or `undefined` for none. */
+const revertAdvice = (editableKeys: ReadonlyArray<string>): string | undefined =>
+  editableKeys.length === 0
     ? undefined
-    : planned.service === "database" && planned.paths.includes("config.version")
-      ? new StackCommandStartError({
-          reason: "invalid-config",
-          message: "The requested database version does not match the saved stack binding",
-          suggestion:
-            "Keep the saved database version, or run supabase stack destroy to recreate the stack.",
-        })
-      : new StackCommandStartError({
-          reason: "invalid-config",
-          message: `The requested ${planned.service} ${planned.paths.join(", ")} cannot change on the saved stack`,
-          suggestion:
-            "Keep the saved endpoint and version settings, or run supabase stack destroy to recreate the stack.",
-        });
+    : editableKeys.length === 1
+      ? `Revert ${editableKeys[0]} to its saved value`
+      : "Revert the settings listed to their saved values";
+
+/** Rejects every saved member whose endpoints or artifact versions the request would change. */
+const incompatibleChange = (
+  planned: ReadonlyArray<PlannedInstance>,
+  savedConfigById: ReadonlyMap<string, ServiceCreation>,
+  requested: ReadonlyArray<ServiceCreationInput>,
+  projectEnvValues: Readonly<Record<string, string>>,
+  stackIdentity: { readonly id: string; readonly name?: string },
+):
+  | {
+      readonly error: StackCommandStartError;
+      readonly changes: ReadonlyArray<StructuredSettingChange>;
+      readonly command: string;
+    }
+  | undefined => {
+  const changes = incompatibleSettingChanges(planned, savedConfigById, requested, projectEnvValues);
+  if (changes.length === 0) return undefined;
+  const lines = settingChangeLines(changes);
+  const command = destroyCommandFor(stackIdentity.id);
+  const nameNote = stackIdentity.name === undefined ? "" : ` (stack ${stackIdentity.name})`;
+  const revert = revertAdvice(
+    dedupe(changes.filter((change) => change.editable).map(({ key }) => key)),
+  );
+  const nonEditable = dedupe(changes.filter((change) => !change.editable).map(({ key }) => key));
+  const destroyClause = `\`${command}\`${nameNote} to recreate the stack — this permanently deletes its local database data.`;
+  // A non-editable change blocks start whatever else changed, so destroy is the only way out.
+  const suggestion =
+    nonEditable.length > 0 || revert === undefined
+      ? `This CLI release starts a different ${nonEditable.join(" and ")} than the saved stack. Run ${destroyClause}`
+      : `${revert} to keep the stack and its data, or run ${destroyClause}`;
+  return {
+    changes,
+    command,
+    error: new StackCommandStartError({
+      reason: "invalid-config",
+      message: `The saved stack cannot adopt these changes: ${lines.join("; ")}`,
+      suggestion,
+    }),
+  };
+};
 
 const selectedCreations = (
   creations: ReadonlyArray<ServiceCreationInput>,
@@ -307,7 +497,7 @@ export const stackStart = Effect.fn("experimental.stack.start")(function* (flags
         explicitWorkdir: settings.explicitWorkdir,
         projectRoot: target.projectRoot,
         ...(Option.isSome(flags.stack) ? { stack: flags.stack.value } : {}),
-        ...(Option.isSome(flags.stackId) ? { stackId: flags.stackId.value } : {}),
+        ...(Option.isSome(flags.stackId) ? { stackId: stack.id } : {}),
       },
       currentShellPlatform(),
     );
@@ -355,6 +545,7 @@ export const stackStart = Effect.fn("experimental.stack.start")(function* (flags
           : status.lifecycle !== "starting" && status.wakeEnabled,
       );
     if (fullyStarted) {
+      yield* Effect.annotateCurrentSpan({ "stack.path": "already-running" });
       yield* Ref.set(startupComplete, true);
       yield* reportReady(
         yield* startReport(stack, currentInstances),
@@ -370,6 +561,10 @@ export const stackStart = Effect.fn("experimental.stack.start")(function* (flags
           lifecycle === "running" || lifecycle === "starting" || wakeEnabled,
       );
     if (resumable) {
+      yield* Effect.annotateCurrentSpan({
+        "stack.path": "resume",
+        "stack.service_count": currentInstances.length,
+      });
       yield* output.info(
         "Resuming the saved stack services. Run `supabase stack stop`, then `supabase stack start` to apply configuration or service-selection changes.",
       );
@@ -511,9 +706,26 @@ export const stackStart = Effect.fn("experimental.stack.start")(function* (flags
     const initialComposition = composition.members.length === 0;
     const serviceKindsChanged = !sameKinds(currentInstances, requested);
     const planned = yield* stack.composition.plan(requested).pipe(Effect.mapError(stackError));
-    for (const entry of planned) {
-      const rejected = entry.member ? incompatibleChange(entry) : undefined;
-      if (rejected !== undefined) return yield* rejected;
+    const stackIdentity = {
+      id: stack.id,
+      ...(target.name === undefined ? {} : { name: target.name }),
+    };
+    const savedConfigById = new Map(currentStatuses.map(({ id, config: saved }) => [id, saved]));
+    const rejected = incompatibleChange(
+      planned,
+      savedConfigById,
+      requested,
+      config.projectEnvValues,
+      stackIdentity,
+    );
+    if (rejected !== undefined) {
+      const machineErrorContext = yield* Effect.serviceOption(MachineErrorContext);
+      if (Option.isSome(machineErrorContext))
+        yield* machineErrorContext.value.set({
+          stack_changes: rejected.changes,
+          recreate_command: rejected.command,
+        });
+      return yield* rejected.error;
     }
     const reuseIds: Array<string> = planned.filter(({ member }) => member).map(({ id }) => id);
     for (const creation of requested) {
@@ -547,6 +759,12 @@ export const stackStart = Effect.fn("experimental.stack.start")(function* (flags
       const candidate = candidates[0];
       if (candidate !== undefined) reuseIds.push(candidate.id);
     }
+    yield* Effect.annotateCurrentSpan({
+      "stack.path": "start",
+      "stack.service_count": requested.length,
+      "stack.initial_composition": initialComposition,
+      "stack.service_kinds_changed": serviceKindsChanged,
+    });
     const starting = yield* output.task("Starting local Supabase stack...");
     const members = yield* stack.composition
       .supabase(requested, {
@@ -620,6 +838,7 @@ export const stackStart = Effect.fn("experimental.stack.start")(function* (flags
         message: "The stack has no saved credentials",
       });
     if (initialComposition || serviceKindsChanged) {
+      yield* Effect.annotateCurrentSpan({ "stack.migrations_applied": true });
       const migrations = initialComposition
         ? {
             workdir: target.projectRoot,
@@ -649,6 +868,7 @@ export const stackStart = Effect.fn("experimental.stack.start")(function* (flags
           (message) => new SeedConfigLoadError({ message }),
         );
         if (hasConfiguredBuckets(context.config)) {
+          yield* Effect.annotateCurrentSpan({ "stack.storage_seeded": true });
           yield* storage.start.pipe(
             Effect.tapError((error) => starting.fail(error.message)),
             Effect.mapError(stackError),
diff --git a/apps/cli/src/commands/experimental/stack/start/start.integration.test.ts b/apps/cli/src/commands/experimental/stack/start/start.integration.test.ts
index c1267d0a4f..4a3f809976 100644
--- a/apps/cli/src/commands/experimental/stack/start/start.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/start/start.integration.test.ts
@@ -4,12 +4,14 @@ import { describe, expect, it } from "@effect/vitest";
 import {
   Deferred,
   Effect,
-  Equal,
   Fiber,
   FileSystem,
   Layer,
   Option,
   Redacted,
+  Schema,
+  Sink,
+  Stdio,
   Stream,
 } from "effect";
 import {
@@ -22,18 +24,23 @@ import {
   StackError,
   type ServiceCreation,
   type ServiceCreationInput,
-  type PlannedInstance,
   type ServiceInstance,
   type ServiceInstances,
   type StackCredentials,
   type Stack,
 } from "@supabase/stack/effect";
+import { planSupabaseComposition } from "@supabase/stack/testing";
 import {
   mockCommandSettings,
   mockTelemetryStateTracked,
   withEnvVar,
 } from "../../../../../tests/helpers/command-mocks.ts";
-import { mockOutput, mockRuntimeInfo, mockTty } from "../../../../../tests/helpers/mocks.ts";
+import {
+  mockOutput,
+  mockProcessControl,
+  mockRuntimeInfo,
+  mockTty,
+} from "../../../../../tests/helpers/mocks.ts";
 import { containerEngineSpawner } from "../../../../../tests/helpers/child-process-spawner.ts";
 import {
   DbConnection,
@@ -45,6 +52,9 @@ import { CommandPlatformApiFactory } from "../../../../auth/command-platform-api
 import { stdinLayer } from "../../../../shared/runtime/stdin.layer.ts";
 import * as HttpClient from "effect/unstable/http/HttpClient";
 import { CliArgs } from "../../../../shared/cli/cli-args.service.ts";
+import { withJsonErrorHandling } from "../../../../shared/output/json-error-handling.ts";
+import { machineErrorContextLayer } from "../../../../shared/output/machine-error-context.layer.ts";
+import { jsonOutputLayer, streamJsonOutputLayer } from "../../../../shared/output/output.layer.ts";
 import { StackApi, stackApiLayer, StackTargetResolver } from "../stack.shared.ts";
 import { stackStart } from "./start.handler.ts";
 import { StackCommandStartError } from "./start.errors.ts";
@@ -119,7 +129,7 @@ const instance = (
     prepare: Effect.void,
     status: Effect.sync(() => status(creation)),
     followStatus: Stream.empty,
-    logs: Stream.empty,
+    readLogs: () => Stream.empty,
     credentials: () => Effect.succeed({}),
   } satisfies Omit<ServiceInstance, "service">;
   switch (creation.service) {
@@ -144,8 +154,18 @@ const instance = (
         resetData: Effect.die("unused"),
       };
     }
-    case "rest":
-      return { ...base, service: "rest" };
+    case "rest": {
+      let current = creation;
+      return {
+        ...base,
+        service: "rest",
+        restart: (input?: Parameters<ServiceInstances["rest"]["restart"]>[0]) =>
+          Effect.sync(() => {
+            if (input !== undefined) current = { ...current, ...input };
+          }),
+        status: Effect.sync(() => status(current)),
+      };
+    }
     case "auth":
       return { ...base, service: "auth" };
     case "realtime":
@@ -174,8 +194,6 @@ const instance = (
       return { ...base, service: "mail" };
     case "analytics":
       return { ...base, service: "analytics" };
-    case "vector":
-      return { ...base, service: "vector" };
     case "pooler":
       return { ...base, service: "pooler" };
   }
@@ -305,29 +323,28 @@ const fakeStack = (compositionStart?: Stack["composition"]["start"]) => {
           );
           return members;
         }),
-      plan: (creations) =>
+      // Delegates to the production planner so paths/shared-API-port normalization match what
+      // `packages/stack` actually reports, instead of a hand-rolled approximation.
+      plan: (creations: ReadonlyArray<ServiceCreationInput>) =>
         Effect.forEach(members, (member) =>
-          member.status.pipe(
-            Effect.map(({ config }): ReadonlyArray<PlannedInstance> => {
-              const request = creations.find(({ service }) => service === member.service);
-              if (request === undefined) return [];
-              const base = { id: member.id, service: member.service, member: true };
-              if (config.service === "database" && request.service === "database")
-                return [
-                  postgresVersion(config.config.version) === postgresVersion(request.config.version)
-                    ? { ...base, change: "unchanged" }
-                    : { ...base, change: "incompatible", paths: ["config.version"] },
-                ];
-              if (!Equal.equals(config.endpoints, request.endpoints))
-                return [{ ...base, change: "incompatible", paths: ["endpoints"] }];
-              return [
-                Equal.equals(config.config, request.config)
-                  ? { ...base, change: "unchanged" }
-                  : { ...base, change: "changed", paths: ["config"] },
-              ];
-            }),
+          member.status.pipe(Effect.map(({ config }) => ({ id: member.id, creation: config }))),
+        ).pipe(
+          Effect.map((instances) =>
+            planSupabaseComposition(
+              {
+                instances,
+                composition: {
+                  members: members.map(({ id }) => ({
+                    id,
+                    activation: activations.get(id) ?? "eager",
+                  })),
+                  dependencies: [],
+                },
+              },
+              creations,
+            ),
           ),
-        ).pipe(Effect.map((planned) => planned.flat())),
+        ),
       configure: ({ members: configured }) =>
         Effect.sync(() => {
           activations = new Map(configured.map(({ id, activation }) => [id, activation]));
@@ -398,7 +415,7 @@ const fakeStack = (compositionStart?: Stack["composition"]["start"]) => {
 const layers = (
   root: string,
   fixture: ReturnType<typeof fakeStack>,
-  output = mockOutput(),
+  output: Pick<ReturnType<typeof mockOutput>, "layer"> = mockOutput(),
   existing = true,
   explicitWorkdir = false,
   // Fixtures request the native runtime, so pin a host that ships native artifacts.
@@ -445,6 +462,57 @@ const layers = (
   );
 };
 
+const machineEnvelope = Schema.decodeEffect(
+  Schema.fromJsonString(Schema.Record(Schema.String, Schema.Unknown)),
+);
+
+/**
+ * A real captured `Stdio` layer, needed only by the JSON/stream-json failure-envelope tests below
+ * since `machineErrorContextLayer`'s merge into the error envelope lives inside the real
+ * `jsonOutputLayer`/`streamJsonOutputLayer` `fail` implementations, which `mockOutput()` never
+ * replicates.
+ */
+const mockCapturingStdio = () => {
+  const stdout: Array<string> = [];
+  const layer = Layer.succeed(
+    Stdio.Stdio,
+    Stdio.make({
+      args: Effect.succeed([]),
+      stdin: Stream.empty,
+      stdout: () =>
+        Sink.forEach((item: string | Uint8Array) =>
+          Effect.sync(() => {
+            stdout.push(typeof item === "string" ? item : new TextDecoder().decode(item));
+          }),
+        ),
+      stderr: () => Sink.forEach(() => Effect.void),
+    }),
+  );
+  return { layer, stdout };
+};
+
+/**
+ * Wires the real `jsonOutputLayer`/`streamJsonOutputLayer` over a captured `Stdio`, with
+ * `machineErrorContextLayer` merged alongside it (matching `start.command.ts`'s composition) so
+ * the handler and the output layer's `fail` share the same live cell, plus a real
+ * `mockProcessControl()` since `withJsonErrorHandling` sets the exit code on it.
+ */
+const jsonErrorLayers = (
+  root: string,
+  fixture: ReturnType<typeof fakeStack>,
+  format: "json" | "stream-json",
+) => {
+  const stdio = mockCapturingStdio();
+  const processControl = mockProcessControl();
+  const outputLayer = format === "json" ? jsonOutputLayer : streamJsonOutputLayer;
+  const layer = Layer.mergeAll(
+    layers(root, fixture, { layer: outputLayer.pipe(Layer.provide(stdio.layer)) }),
+    machineErrorContextLayer,
+    processControl.layer,
+  );
+  return { layer, stdio, processControl };
+};
+
 describe("experimental stack start", () => {
   it.live("rejects incompatible Functions env before changing composition", () =>
     Effect.gen(function* () {
@@ -671,6 +739,16 @@ describe("experimental stack start", () => {
       expect(text.stdoutText).toContain(
         `Runtime: native\nRun supabase status --env --workdir ${workdir} --stack 'feature demo' to export these values as environment variables.\n`,
       );
+
+      yield* fixture.stack.composition.stop;
+      const byPrefix = mockOutput();
+      yield* stackStart({
+        ...flags(excluded),
+        stackId: Option.some(fixture.stack.id.slice(0, 8)),
+      }).pipe(Effect.provide(layers(root, fixture, byPrefix, true, true)));
+      expect(byPrefix.stdoutText).toContain(
+        `Run supabase status --env --workdir ${workdir} --stack-id ${fixture.stack.id} to export`,
+      );
     }).pipe(Effect.provide(BunServices.layer)),
   );
 
@@ -745,7 +823,7 @@ describe("experimental stack start", () => {
             message: "Composition start had failures",
             outcomes: [
               { id: "database-member-1", succeeded: true },
-              { id: "vector-member-1", succeeded: false, error: "Service health timed out" },
+              { id: "analytics-member-1", succeeded: false, error: "Service health timed out" },
             ],
           }),
         ),
@@ -756,7 +834,7 @@ describe("experimental stack start", () => {
       expect(error).toBeInstanceOf(StackCommandStartError);
       expect(error).toMatchObject({
         message: "Composition start had failures",
-        detail: "vector (vector-member-1): Service health timed out",
+        detail: "analytics (analytics-member-1): Service health timed out",
       });
     }).pipe(Effect.provide(BunServices.layer)),
   );
@@ -1174,13 +1252,454 @@ describe("experimental stack start", () => {
 
       expect(error).toMatchObject({
         reason: "invalid-config",
-        message: expect.stringContaining("cannot change on the saved stack"),
-        suggestion: expect.stringContaining("supabase stack destroy"),
+        message: expect.stringContaining("[api] port: saved automatic, requested 54999"),
+        suggestion: expect.stringContaining(
+          `supabase stack destroy --stack-id ${fixture.stack.id}`,
+        ),
       });
       expect(fixture.composed).toBe(1);
     }).pipe(Effect.provide(BunServices.layer)),
   );
 
+  it.live("names the config key and both values when a saved port changes", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-start-port-config-" });
+      yield* fs.makeDirectory(`${root}/supabase`, { recursive: true });
+      yield* fs.writeFileString(
+        `${root}/supabase/config.toml`,
+        'project_id = "port-config"\n[api]\nport = 54321\n',
+      );
+      const fixture = fakeStack();
+      yield* stackStart(flags()).pipe(Effect.provide(layers(root, fixture)));
+
+      yield* fs.writeFileString(
+        `${root}/supabase/config.toml`,
+        'project_id = "port-config"\n[api]\nport = 54999\n',
+      );
+      yield* fixture.stack.composition.stop;
+      const error = yield* stackStart(flags()).pipe(
+        Effect.provide(layers(root, fixture)),
+        Effect.flip,
+      );
+
+      expect(error).toMatchObject({
+        reason: "invalid-config",
+        message: expect.stringContaining("[api] port: saved 54321, requested 54999"),
+      });
+    }).pipe(Effect.provide(BunServices.layer)),
+  );
+
+  it.live("names a dedicated (non-shared) port's own config key", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-start-dedicated-port-" });
+      yield* fs.makeDirectory(`${root}/supabase`, { recursive: true });
+      yield* fs.writeFileString(`${root}/supabase/config.toml`, 'project_id = "dedicated-port"\n');
+      const fixture = fakeStack();
+      yield* stackStart(flags()).pipe(Effect.provide(layers(root, fixture)));
+
+      yield* fs.writeFileString(
+        `${root}/supabase/config.toml`,
+        'project_id = "dedicated-port"\n[studio]\nport = 12345\n',
+      );
+      yield* fixture.stack.composition.stop;
+      const error = yield* stackStart(flags()).pipe(
+        Effect.provide(layers(root, fixture)),
+        Effect.flip,
+      );
+
+      expect(error).toMatchObject({
+        reason: "invalid-config",
+        message: expect.stringContaining("[studio] port: saved automatic, requested 12345"),
+      });
+      // A dedicated port only affects its own service, unlike the shared API port.
+      expect(error).toBeInstanceOf(StackCommandStartError);
+      if (error instanceof StackCommandStartError)
+        expect(error.message).not.toContain("[api] port");
+    }).pipe(Effect.provide(BunServices.layer)),
+  );
+
+  // The production planner (`fixedApiPorts`/`withSharedApiPort`) normalizes a requested
+  // automatic shared-API port to the composition's already-fixed value whenever one exists, so a
+  // saved fixed port going back to automatic in `config.toml` reuses the saved port rather than
+  // failing. This locks down that non-obvious compatible case: it is not an incompatible path.
+  it.live(
+    "accepts a shared API port going from fixed back to automatic, reusing the saved port",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-start-api-to-auto-" });
+        yield* fs.makeDirectory(`${root}/supabase`, { recursive: true });
+        yield* fs.writeFileString(
+          `${root}/supabase/config.toml`,
+          'project_id = "api-to-auto"\n[api]\nport = 54321\n',
+        );
+        const fixture = fakeStack();
+        yield* stackStart(flags()).pipe(Effect.provide(layers(root, fixture)));
+
+        yield* fs.writeFileString(`${root}/supabase/config.toml`, 'project_id = "api-to-auto"\n');
+        yield* fixture.stack.composition.stop;
+        // Does not throw: the planner treats this as compatible (`change: "unchanged"`), not an
+        // incompatible path to report. Reusing the already-bound port for the resumed instance is
+        // `packages/stack`'s own concern, not asserted here.
+        yield* stackStart(flags()).pipe(Effect.provide(layers(root, fixture)));
+      }).pipe(Effect.provide(BunServices.layer)),
+  );
+
+  it.live(
+    "collects simultaneous database-version and port changes into one error with plural revert wording",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-start-multi-change-" });
+        yield* fs.makeDirectory(`${root}/supabase`, { recursive: true });
+        yield* fs.writeFileString(`${root}/supabase/config.toml`, 'project_id = "multi-change"\n');
+        const fixture = fakeStack();
+        yield* stackStart(flags()).pipe(Effect.provide(layers(root, fixture)));
+
+        yield* fs.writeFileString(
+          `${root}/supabase/config.toml`,
+          'project_id = "multi-change"\n[db]\nmajor_version = 15\n[studio]\nport = 12345\n',
+        );
+        yield* fixture.stack.composition.stop;
+        const error = yield* stackStart(flags()).pipe(
+          Effect.provide(layers(root, fixture)),
+          Effect.flip,
+        );
+
+        expect(error).toMatchObject({
+          reason: "invalid-config",
+          message: expect.stringContaining("[db] major_version: saved 17, requested 15"),
+        });
+        expect(error).toMatchObject({
+          message: expect.stringContaining("[studio] port: saved automatic, requested 12345"),
+        });
+        expect(error).toBeInstanceOf(StackCommandStartError);
+        if (error instanceof StackCommandStartError)
+          expect(error.suggestion).toContain(
+            "Revert the settings listed to their saved values to keep the stack and its data",
+          );
+      }).pipe(Effect.provide(BunServices.layer)),
+  );
+
+  it.live("names the env var override when SUPABASE_*_PORT set the saved port", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-start-port-env-" });
+      yield* fs.makeDirectory(`${root}/supabase`, { recursive: true });
+      yield* fs.writeFileString(`${root}/supabase/config.toml`, 'project_id = "port-env"\n');
+      const fixture = fakeStack();
+      yield* withEnvVar(
+        "SUPABASE_API_PORT",
+        "54321",
+        stackStart(flags()).pipe(Effect.provide(layers(root, fixture))),
+      );
+
+      yield* fixture.stack.composition.stop;
+      const error = yield* withEnvVar(
+        "SUPABASE_API_PORT",
+        "54999",
+        stackStart(flags()).pipe(Effect.provide(layers(root, fixture)), Effect.flip),
+      );
+
+      expect(error).toMatchObject({
+        reason: "invalid-config",
+        message: expect.stringContaining("SUPABASE_API_PORT: saved 54321, requested 54999"),
+      });
+    }).pipe(Effect.provide(BunServices.layer)),
+  );
+
+  it.live(
+    "names [db] major_version and the destroy command when the saved Postgres version changes",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-start-major-version-" });
+        yield* fs.makeDirectory(`${root}/supabase`, { recursive: true });
+        yield* fs.writeFileString(`${root}/supabase/config.toml`, 'project_id = "major-version"\n');
+        const fixture = fakeStack();
+        yield* stackStart(flags()).pipe(Effect.provide(layers(root, fixture)));
+
+        yield* fs.writeFileString(
+          `${root}/supabase/config.toml`,
+          'project_id = "major-version"\n[db]\nmajor_version = 15\n',
+        );
+        yield* fixture.stack.composition.stop;
+        const error = yield* stackStart(flags()).pipe(
+          Effect.provide(layers(root, fixture)),
+          Effect.flip,
+        );
+
+        expect(error).toMatchObject({
+          reason: "invalid-config",
+          message: expect.stringContaining("[db] major_version: saved 17, requested 15"),
+          suggestion: expect.stringContaining(
+            `Revert [db] major_version to its saved value to keep the stack and its data, or run \`supabase stack destroy --stack-id ${fixture.stack.id}\` to recreate the stack`,
+          ),
+        });
+        expect(error).toMatchObject({ suggestion: expect.stringContaining("database data") });
+      }).pipe(Effect.provide(BunServices.layer)),
+  );
+
+  it.live(
+    "names the full Postgres build, not major_version, when only the pinned build differs",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-start-pg-build-" });
+        yield* fs.makeDirectory(`${root}/supabase`, { recursive: true });
+        yield* fs.writeFileString(
+          `${root}/supabase/config.toml`,
+          'project_id = "pg-build"\n[db]\nmajor_version = 17\n',
+        );
+        const fixture = fakeStack();
+        yield* stackStart(flags()).pipe(Effect.provide(layers(root, fixture)));
+        const database = fixture.members.find(({ service }) => service === "database");
+        if (database?.service !== "database") return yield* Effect.die("Database missing");
+        const observed = yield* database.status;
+        if (observed.config.service !== "database")
+          return yield* Effect.die("Database config missing");
+        const pinnedVersion = postgresVersion("17");
+        // A saved build the current catalog no longer pins (`postgresVersion` only normalizes a
+        // recognized alias): same major as the requested `17`, different full build.
+        yield* database.restart({
+          config: { ...observed.config.config, version: "17.0.0-stale-build" },
+        });
+        yield* fixture.stack.composition.stop;
+        const error = yield* stackStart(flags()).pipe(
+          Effect.provide(layers(root, fixture)),
+          Effect.flip,
+        );
+
+        expect(error).toMatchObject({
+          reason: "invalid-config",
+          message: expect.stringContaining(
+            `Postgres build: saved 17.0.0-stale-build, requested ${pinnedVersion}`,
+          ),
+        });
+        expect(error).toBeInstanceOf(StackCommandStartError);
+        if (error instanceof StackCommandStartError) {
+          expect(error.message).not.toContain("major_version");
+          expect(error.suggestion).not.toContain("Revert");
+          expect(error.suggestion).toContain(
+            "This CLI release starts a different Postgres build than the saved stack.",
+          );
+          expect(error.suggestion).toContain(
+            `supabase stack destroy --stack-id ${fixture.stack.id}`,
+          );
+        }
+      }).pipe(Effect.provide(BunServices.layer)),
+  );
+
+  it.live(
+    "drops the revert sentence for an artifact-version-only mismatch and explains the fix in plain language",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-start-artifact-version-" });
+        yield* fs.makeDirectory(`${root}/supabase`, { recursive: true });
+        yield* fs.writeFileString(
+          `${root}/supabase/config.toml`,
+          'project_id = "artifact-version"\n',
+        );
+        const fixture = fakeStack();
+        yield* stackStart(flags()).pipe(Effect.provide(layers(root, fixture)));
+        const rest = fixture.members.find(({ service }) => service === "rest");
+        if (rest?.service !== "rest") return yield* Effect.die("REST missing");
+        const restObserved = yield* rest.status;
+        if (restObserved.config.service !== "rest") return yield* Effect.die("REST config missing");
+        yield* rest.restart({ ...restObserved.config, version: "rest-v1-stale" });
+        yield* fixture.stack.composition.stop;
+        const error = yield* stackStart(flags()).pipe(
+          Effect.provide(layers(root, fixture)),
+          Effect.flip,
+        );
+
+        expect(error).toMatchObject({
+          reason: "invalid-config",
+          message: expect.stringContaining("rest artifact version"),
+        });
+        expect(error).toBeInstanceOf(StackCommandStartError);
+        if (error instanceof StackCommandStartError) {
+          expect(error.suggestion).not.toContain("Revert");
+          expect(error.suggestion).toContain(
+            "This CLI release starts a different rest artifact version than the saved stack.",
+          );
+          expect(error.suggestion).toContain(
+            `supabase stack destroy --stack-id ${fixture.stack.id}`,
+          );
+        }
+      }).pipe(Effect.provide(BunServices.layer)),
+  );
+
+  it.live(
+    "uses the destroy-only wording when a non-editable change accompanies an editable one",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-start-mixed-editable-" });
+        yield* fs.makeDirectory(`${root}/supabase`, { recursive: true });
+        yield* fs.writeFileString(
+          `${root}/supabase/config.toml`,
+          'project_id = "mixed-editable"\n',
+        );
+        const fixture = fakeStack();
+        yield* stackStart(flags()).pipe(Effect.provide(layers(root, fixture)));
+        const rest = fixture.members.find(({ service }) => service === "rest");
+        if (rest?.service !== "rest") return yield* Effect.die("REST missing");
+        const restObserved = yield* rest.status;
+        if (restObserved.config.service !== "rest") return yield* Effect.die("REST config missing");
+        yield* rest.restart({ ...restObserved.config, version: "rest-v1-stale" });
+        yield* fixture.stack.composition.stop;
+
+        yield* fs.writeFileString(
+          `${root}/supabase/config.toml`,
+          'project_id = "mixed-editable"\n[studio]\nport = 12345\n',
+        );
+        const error = yield* stackStart(flags()).pipe(
+          Effect.provide(layers(root, fixture)),
+          Effect.flip,
+        );
+
+        expect(error).toMatchObject({
+          reason: "invalid-config",
+          // The editable change still appears in the message even though reverting it alone
+          // can't unblock start: the non-editable artifact-version change still would.
+          message: expect.stringContaining("[studio] port: saved automatic, requested 12345"),
+        });
+        expect(error).toBeInstanceOf(StackCommandStartError);
+        if (error instanceof StackCommandStartError) {
+          expect(error.suggestion).not.toContain("Revert");
+          expect(error.suggestion).toContain(
+            "This CLI release starts a different rest artifact version than the saved stack.",
+          );
+          expect(error.suggestion).toContain(
+            `supabase stack destroy --stack-id ${fixture.stack.id}`,
+          );
+        }
+      }).pipe(Effect.provide(BunServices.layer)),
+  );
+
+  it.live("emits structured stack_changes and recreate_command on the JSON error envelope", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-start-json-envelope-" });
+      yield* fs.makeDirectory(`${root}/supabase`, { recursive: true });
+      yield* fs.writeFileString(`${root}/supabase/config.toml`, 'project_id = "json-envelope"\n');
+      const fixture = fakeStack();
+      yield* stackStart(flags()).pipe(Effect.provide(layers(root, fixture)));
+
+      yield* fs.writeFileString(
+        `${root}/supabase/config.toml`,
+        'project_id = "json-envelope"\n[db]\nmajor_version = 15\n',
+      );
+      yield* fixture.stack.composition.stop;
+      const { layer, stdio } = jsonErrorLayers(root, fixture, "json");
+      yield* stackStart(flags()).pipe(withJsonErrorHandling, Effect.provide(layer));
+
+      expect(stdio.stdout).toHaveLength(1);
+      const envelope = yield* machineEnvelope(stdio.stdout[0]!);
+      expect(envelope._tag).toBe("Error");
+      expect(envelope.error).toMatchObject({
+        code: "ExperimentalStackStartError",
+        message: expect.stringContaining("[db] major_version: saved 17, requested 15"),
+      });
+      expect(envelope.stack_changes).toEqual([
+        {
+          service: "database",
+          path: "config.version",
+          key: "[db] major_version",
+          saved: "17",
+          requested: "15",
+          editable: true,
+        },
+      ]);
+      expect(envelope.recreate_command).toBe(
+        `supabase stack destroy --stack-id ${fixture.stack.id}`,
+      );
+    }).pipe(Effect.provide(BunServices.layer)),
+  );
+
+  it.live("emits the same structured error fields on the stream-json terminal event", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-start-stream-json-" });
+      yield* fs.makeDirectory(`${root}/supabase`, { recursive: true });
+      yield* fs.writeFileString(`${root}/supabase/config.toml`, 'project_id = "stream-json"\n');
+      const fixture = fakeStack();
+      yield* stackStart(flags()).pipe(Effect.provide(layers(root, fixture)));
+
+      yield* fs.writeFileString(
+        `${root}/supabase/config.toml`,
+        'project_id = "stream-json"\n[db]\nmajor_version = 15\n',
+      );
+      yield* fixture.stack.composition.stop;
+      const { layer, stdio } = jsonErrorLayers(root, fixture, "stream-json");
+      yield* stackStart(flags()).pipe(withJsonErrorHandling, Effect.provide(layer));
+
+      const event = yield* machineEnvelope(stdio.stdout.at(-1)!);
+      expect(event.type).toBe("error");
+      expect(event.error).toMatchObject({
+        code: "ExperimentalStackStartError",
+        message: expect.stringContaining("[db] major_version: saved 17, requested 15"),
+      });
+      expect(event.stack_changes).toEqual([
+        {
+          service: "database",
+          path: "config.version",
+          key: "[db] major_version",
+          saved: "17",
+          requested: "15",
+          editable: true,
+        },
+      ]);
+      expect(event.recreate_command).toBe(`supabase stack destroy --stack-id ${fixture.stack.id}`);
+    }).pipe(Effect.provide(BunServices.layer)),
+  );
+
+  it.live("always suggests --stack-id for a named stack, naming the stack as plain text", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-start-named-destroy-" });
+      yield* fs.makeDirectory(`${root}/supabase`, { recursive: true });
+      yield* fs.writeFileString(`${root}/supabase/config.toml`, 'project_id = "named-destroy"\n');
+      const fixture = fakeStack();
+      const target = Layer.succeed(StackTargetResolver, {
+        resolve: () =>
+          Effect.succeed({
+            projectRoot: root,
+            id: fixture.stack.id,
+            name: "feature-a",
+            runtime: "native" as const,
+            hostRunning: false,
+          }),
+      });
+      yield* stackStart(flags()).pipe(
+        Effect.provide(Layer.mergeAll(layers(root, fixture), target)),
+      );
+
+      yield* fs.writeFileString(
+        `${root}/supabase/config.toml`,
+        'project_id = "named-destroy"\n[db]\nmajor_version = 15\n',
+      );
+      yield* fixture.stack.composition.stop;
+      const error = yield* stackStart(flags()).pipe(
+        Effect.provide(Layer.mergeAll(layers(root, fixture), target)),
+        Effect.flip,
+      );
+
+      expect(error).toMatchObject({
+        suggestion: expect.stringContaining(
+          `supabase stack destroy --stack-id ${fixture.stack.id}\` (stack feature-a)`,
+        ),
+      });
+      expect(error).toBeInstanceOf(StackCommandStartError);
+      if (error instanceof StackCommandStartError)
+        expect(error.suggestion).not.toContain("--stack feature-a");
+    }).pipe(Effect.provide(BunServices.layer)),
+  );
+
   it.live("matches a Postgres major alias to the saved pinned database version", () =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
diff --git a/apps/cli/src/commands/experimental/stack/start/start.native.integration.test.ts b/apps/cli/src/commands/experimental/stack/start/start.native.integration.test.ts
index b1ab5732b7..85363964ec 100644
--- a/apps/cli/src/commands/experimental/stack/start/start.native.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/start/start.native.integration.test.ts
@@ -10,7 +10,7 @@ import {
 } from "../../../../../tests/helpers/command-mocks.ts";
 import { mockOutput, mockTty } from "../../../../../tests/helpers/mocks.ts";
 import { CommandPlatformApiFactory } from "../../../../auth/command-platform-api-factory.service.ts";
-import { dbConnectionLayer } from "../../../../command-internal/db-connection.layer.ts";
+import { dbConnectionLayer } from "../../../../command-internal/db-connection.sql-pg.layer.ts";
 import { DbConnection } from "../../../../command-internal/db-connection.service.ts";
 import { parseConnectionString } from "../../../../command-internal/db-config.parse.ts";
 import { stackCatalogSetupLayer } from "../../../../command-internal/stack-catalog-setup.ts";
diff --git a/apps/cli/src/commands/experimental/stack/start/start.options.ts b/apps/cli/src/commands/experimental/stack/start/start.options.ts
index 13b810c47b..dd89edeedd 100644
--- a/apps/cli/src/commands/experimental/stack/start/start.options.ts
+++ b/apps/cli/src/commands/experimental/stack/start/start.options.ts
@@ -9,3 +9,8 @@ export const STACK_START_EXCLUDABLE_CAPABILITIES = [
   "analytics",
   "pooler",
 ] as const;
+
+export const STACK_PREPARABLE_CAPABILITIES = [
+  "database",
+  ...STACK_START_EXCLUDABLE_CAPABILITIES,
+] as const;
diff --git a/apps/cli/src/commands/experimental/stack/status/SIDE_EFFECTS.md b/apps/cli/src/commands/experimental/stack/status/SIDE_EFFECTS.md
index dd2200f2c3..488c519d36 100644
--- a/apps/cli/src/commands/experimental/stack/status/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/experimental/stack/status/SIDE_EFFECTS.md
@@ -9,7 +9,7 @@ a stack addressed with `--stack-id` when project configuration is missing or
 invalid.
 
 Target selection accepts the current project, `--stack <name>`, or
-`--stack-id <id>`. `--stack` and `--stack-id` are mutually exclusive. Explicit
+`--stack-id <id or unique prefix>`. `--stack` and `--stack-id` are mutually exclusive. Explicit
 legacy `-o/--output` values are rejected; use `--output-format` instead, or
 `--env` in place of the `env` value.
 
@@ -31,7 +31,8 @@ available while the owner is unavailable. It reports `config_drift.status` as `u
 loading failure or unreadable saved state keeps the saved stack report available and is shown as
 `config_drift.status: "unavailable"` with a message in JSON. Status does not apply current configuration. The `services` list may include
 saved standalone instances; composition members identify the services used for
-primary database, environment export, and drift comparisons.
+primary database, environment export, and drift comparisons. Vector instances saved by earlier
+releases are omitted without rewriting saved state.
 
 Text output starts with one line naming the stack, its readiness, runtime, and
 project directory, noting when the owner is unavailable. It then prints the
diff --git a/apps/cli/src/commands/experimental/stack/status/status.command.ts b/apps/cli/src/commands/experimental/stack/status/status.command.ts
index 7ba2d86ad7..804ea0f622 100644
--- a/apps/cli/src/commands/experimental/stack/status/status.command.ts
+++ b/apps/cli/src/commands/experimental/stack/status/status.command.ts
@@ -8,7 +8,7 @@ import { stackStatus } from "./status.handler.ts";
 const config = {
   stack: Flag.string("stack").pipe(Flag.withDescription("Inspect a named stack."), Flag.optional),
   stackId: Flag.string("stack-id").pipe(
-    Flag.withDescription("Inspect an existing stack by id."),
+    Flag.withDescription("Inspect an existing stack by id or unique id prefix."),
     Flag.optional,
   ),
   env: Flag.boolean("env").pipe(
diff --git a/apps/cli/src/commands/experimental/stack/status/status.handler.ts b/apps/cli/src/commands/experimental/stack/status/status.handler.ts
index e82f9ab753..c0450d6659 100644
--- a/apps/cli/src/commands/experimental/stack/status/status.handler.ts
+++ b/apps/cli/src/commands/experimental/stack/status/status.handler.ts
@@ -278,22 +278,24 @@ const findTarget = Effect.fn("experimental.stack.status.findTarget")(function* (
   };
 });
 
-const observe = (stack: Stack, owner: StackReport["owner"]) =>
-  Effect.gen(function* () {
-    const instances = yield* stack.services.list.pipe(Effect.mapError(mapStackError));
-    const composition = yield* stack.composition.describe.pipe(Effect.mapError(mapStackError));
-    const observed = yield* Effect.forEach(instances, (instance): Effect.Effect<ObservedService> =>
-      owner === "unavailable"
-        ? Effect.succeed({ instance, observation: undefined })
-        : instance.status.pipe(
-            Effect.map((observation) => ({ instance, observation })),
-            Effect.catchTag("StackError", (error) =>
-              Effect.succeed({ instance, observation: undefined, error }),
-            ),
+const observe = Effect.fn("experimental.stack.status.observe")(function* (
+  stack: Stack,
+  owner: StackReport["owner"],
+) {
+  const instances = yield* stack.services.list.pipe(Effect.mapError(mapStackError));
+  const composition = yield* stack.composition.describe.pipe(Effect.mapError(mapStackError));
+  const observed = yield* Effect.forEach(instances, (instance): Effect.Effect<ObservedService> =>
+    owner === "unavailable"
+      ? Effect.succeed({ instance, observation: undefined })
+      : instance.status.pipe(
+          Effect.map((observation) => ({ instance, observation })),
+          Effect.catchTag("StackError", (error) =>
+            Effect.succeed({ instance, observation: undefined, error }),
           ),
-    );
-    return { observed, members: composition.members };
-  });
+        ),
+  );
+  return { observed, members: composition.members };
+});
 
 const driftFrom = (planned: ReadonlyArray<PlannedInstance>): StackReport["config_drift"] => {
   const paths = planned.flatMap((entry) =>
@@ -318,8 +320,8 @@ const unavailableDrift = (message: string): StackReport["config_drift"] => ({
   message,
 });
 
-const configDrift = (stack: Stack, projectRoot: string, functionsIsMember: boolean) =>
-  Effect.gen(function* () {
+const configDrift = Effect.fn("experimental.stack.status.configDrift")(
+  function* (stack: Stack, projectRoot: string, functionsIsMember: boolean) {
     const loaded = yield* loadStackConfig(projectRoot);
     const creations = yield* loaded.creations(stack.id);
     // Drift ignores non-members, so a Functions dotenv only matters when Functions is a member.
@@ -327,22 +329,25 @@ const configDrift = (stack: Stack, projectRoot: string, functionsIsMember: boole
       ? yield* Effect.forEach(creations, withProjectFunctionsEnv)
       : creations;
     return driftFrom(yield* stack.composition.plan(requested));
-  }).pipe(
-    Effect.catchTags({
-      StackConfigError: (error) =>
-        Effect.succeed(
-          unavailableDrift(`Project configuration could not be compared: ${error.message}`),
-        ),
-      StackFunctionsEnvError: (error) =>
-        Effect.succeed(
-          unavailableDrift(`Project configuration could not be compared: ${error.message}`),
-        ),
-      StackError: (error) =>
-        Effect.succeed(
-          unavailableDrift(`Saved configuration could not be compared: ${error.message}`),
-        ),
-    }),
-  );
+  },
+  (effect) =>
+    effect.pipe(
+      Effect.catchTags({
+        StackConfigError: (error) =>
+          Effect.succeed(
+            unavailableDrift(`Project configuration could not be compared: ${error.message}`),
+          ),
+        StackFunctionsEnvError: (error) =>
+          Effect.succeed(
+            unavailableDrift(`Project configuration could not be compared: ${error.message}`),
+          ),
+        StackError: (error) =>
+          Effect.succeed(
+            unavailableDrift(`Saved configuration could not be compared: ${error.message}`),
+          ),
+      }),
+    ),
+);
 
 export const stackStatus = Effect.fn("experimental.stack.status")(function* (
   flags: StackStatusFlags,
diff --git a/apps/cli/src/commands/experimental/stack/status/status.integration.test.ts b/apps/cli/src/commands/experimental/stack/status/status.integration.test.ts
index ffa4890839..3d2584df86 100644
--- a/apps/cli/src/commands/experimental/stack/status/status.integration.test.ts
+++ b/apps/cli/src/commands/experimental/stack/status/status.integration.test.ts
@@ -137,7 +137,7 @@ const makeService = (input: {
       : Effect.succeed(input.observation);
   }),
   followStatus: Stream.empty,
-  logs: Stream.empty,
+  readLogs: () => Stream.empty,
   credentials: () =>
     input.rejectCredentials
       ? Effect.die("credentials must not run")
diff --git a/apps/cli/src/commands/experimental/stack/stop/SIDE_EFFECTS.md b/apps/cli/src/commands/experimental/stack/stop/SIDE_EFFECTS.md
index a2bd679794..7aadf9738e 100644
--- a/apps/cli/src/commands/experimental/stack/stop/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/experimental/stack/stop/SIDE_EFFECTS.md
@@ -6,7 +6,7 @@ The experimental top-level `supabase stop` alias delegates to this handler.
 
 ## Selection and output
 
-Select the current project/branch/name, `--stack <name>`, or `--stack-id <id>`.
+Select the current project/branch/name, `--stack <name>`, or `--stack-id <id or unique prefix>`.
 `--stack` and `--stack-id` are mutually exclusive. `--all` cannot be combined
 with either selector. Explicit legacy `-o/--output` is rejected; use
 `--output-format` instead.
diff --git a/apps/cli/src/commands/experimental/stack/stop/stop.command.ts b/apps/cli/src/commands/experimental/stack/stop/stop.command.ts
index 39ec3ec781..76f82b7515 100644
--- a/apps/cli/src/commands/experimental/stack/stop/stop.command.ts
+++ b/apps/cli/src/commands/experimental/stack/stop/stop.command.ts
@@ -14,7 +14,7 @@ const config = {
     Flag.optional,
   ),
   stackId: Flag.string("stack-id").pipe(
-    Flag.withDescription("Stop an existing stack by id."),
+    Flag.withDescription("Stop an existing stack by id or unique id prefix."),
     Flag.optional,
   ),
 } as const;
diff --git a/apps/cli/src/commands/experimental/stack/stop/stop.handler.ts b/apps/cli/src/commands/experimental/stack/stop/stop.handler.ts
index 93477c1335..6dd789617f 100644
--- a/apps/cli/src/commands/experimental/stack/stop/stop.handler.ts
+++ b/apps/cli/src/commands/experimental/stack/stop/stop.handler.ts
@@ -147,6 +147,10 @@ export const stackStop = Effect.fn("experimental.stack.stop")(function* (flags:
     const unavailable = results.flatMap(({ id, result }) =>
       Result.isSuccess(result) && result.success === "unavailable" ? [id] : [],
     );
+    yield* Effect.annotateCurrentSpan({
+      "stack.count": results.length,
+      "stack.stopped_count": stopped.length,
+    });
     if (output.format === "text") {
       for (const id of stopped) yield* output.raw(`Stack ${id} stopped.\n`);
       for (const id of unavailable)
diff --git a/apps/cli/src/commands/functions/delete/delete.handler.ts b/apps/cli/src/commands/functions/delete/delete.handler.ts
index ad49a6df3a..381ac6ea8e 100644
--- a/apps/cli/src/commands/functions/delete/delete.handler.ts
+++ b/apps/cli/src/commands/functions/delete/delete.handler.ts
@@ -36,7 +36,10 @@ export const functionsDelete = Effect.fn("functions.delete")(function* (
       Effect.suspend(() =>
         Option.match(resolvedProjectRef, {
           onNone: () => Effect.void,
-          onSome: (ref) => linkedProjectCache.cache(ref),
+          onSome: (ref) =>
+            Effect.annotateCurrentSpan("project.ref", ref).pipe(
+              Effect.andThen(linkedProjectCache.cache(ref)),
+            ),
         }),
       ),
     ),
diff --git a/apps/cli/src/commands/functions/deploy/deploy.handler.ts b/apps/cli/src/commands/functions/deploy/deploy.handler.ts
index 443979bfd8..30ae2493d6 100644
--- a/apps/cli/src/commands/functions/deploy/deploy.handler.ts
+++ b/apps/cli/src/commands/functions/deploy/deploy.handler.ts
@@ -62,7 +62,10 @@ export const functionsDeploy = Effect.fn("functions.deploy")(function* (
       Effect.suspend(() =>
         Option.match(resolvedProjectRef, {
           onNone: () => Effect.void,
-          onSome: (ref) => linkedProjectCache.cache(ref),
+          onSome: (ref) =>
+            Effect.annotateCurrentSpan("project.ref", ref).pipe(
+              Effect.andThen(linkedProjectCache.cache(ref)),
+            ),
         }),
       ),
     ),
diff --git a/apps/cli/src/commands/functions/deploy/deploy.integration.test.ts b/apps/cli/src/commands/functions/deploy/deploy.integration.test.ts
index 600907e826..f06ac21d68 100644
--- a/apps/cli/src/commands/functions/deploy/deploy.integration.test.ts
+++ b/apps/cli/src/commands/functions/deploy/deploy.integration.test.ts
@@ -1,10 +1,23 @@
 import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, Exit, FileSystem, Layer, Option, Path, Stdio } from "effect";
+import {
+  Cause,
+  Deferred,
+  Effect,
+  Exit,
+  Fiber,
+  FileSystem,
+  Layer,
+  Option,
+  Path,
+  Stdio,
+} from "effect";
+import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
 
 import { YesFlag } from "../../../command-internal/global-flags.ts";
 import { stripControlSequences } from "../../../shared/output/strip-control-sequences.ts";
 import {
+  type ApiHandler,
   buildTestRuntime,
   jsonResponse,
   mockCommandSettings,
@@ -12,9 +25,11 @@ import {
   mockCommandPlatformApi,
   mockTelemetryStateTracked,
   useTempWorkdir,
+  withConfigEnv,
   withEnvVar,
 } from "../../../../tests/helpers/command-mocks.ts";
 import { mockOutput, mockRuntimeInfo } from "../../../../tests/helpers/mocks.ts";
+import { Output } from "../../../shared/output/output.service.ts";
 import { mockChildProcessSpawner } from "../../../../tests/helpers/child-process-spawner.ts";
 import {
   deployFunctions,
@@ -24,9 +39,11 @@ import { toDockerPath } from "../../../shared/functions/functions-docker.ts";
 import { functionsGoConfigCompat } from "../../../command-internal/functions-go-config.ts";
 import {
   ConflictingFunctionDeployFlagsError,
+  FunctionImportMapSyntaxError,
   InvalidFunctionDeploySlugError,
   NoFunctionsToDeployError,
 } from "../../../shared/functions/deploy.errors.ts";
+import { FunctionsApiStatusError } from "../../../shared/functions/functions-api.errors.ts";
 import { withJsonErrorHandling } from "../../../shared/output/json-error-handling.ts";
 import { CommandPlatformApi } from "../../../auth/command-platform-api.service.ts";
 import { functionsDeploy } from "./deploy.handler.ts";
@@ -501,6 +518,336 @@ describe("functions deploy", () => {
     }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
   });
 
+  function apiDeployHarness(handler: ApiHandler) {
+    const out = mockOutput({ format: "text" });
+    const api = mockCommandPlatformApi({ handler });
+    const layer = Layer.mergeAll(
+      buildTestRuntime({
+        out,
+        api,
+        cliSettings: mockCommandSettings({ workdir: tempRoot.current }),
+        runtimeInfo: mockRuntimeInfo({ cwd: tempRoot.current }),
+      }),
+      Layer.succeed(YesFlag, false),
+      Stdio.layerTest({
+        args: Effect.succeed(["functions", "deploy", "hello-world", "--use-api"]),
+      }),
+    );
+    return { out, api, layer };
+  }
+
+  const deployedHelloWorld: ApiHandler = (request) =>
+    Effect.succeed(
+      request.method === "GET"
+        ? jsonResponse(request, 200, [])
+        : jsonResponse(request, 201, {
+            id: "function-id",
+            slug: "hello-world",
+            name: "hello-world",
+            status: "ACTIVE",
+            version: 2,
+          }),
+    );
+
+  it.live("warns about an invalid static_files glob instead of failing the deploy", () => {
+    const { out, api, layer } = apiDeployHarness(deployedHelloWorld);
+
+    return Effect.gen(function* () {
+      yield* writeCliConfig(
+        tempRoot.current,
+        'project_id = "test-project"\n[functions.hello-world]\nstatic_files = ["./assets/[z-a].txt"]\n',
+      );
+      yield* writeLocalFunction(tempRoot.current, "hello-world");
+
+      yield* functionsDeploy(baseFlags);
+
+      expect(out.stderrText).toContain("WARN: Invalid regular expression");
+      expect(
+        api.requests.some(
+          (request) => request.method === "POST" && request.url.endsWith("/functions/deploy"),
+        ),
+      ).toBe(true);
+    }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
+  });
+
+  it.live("reports a malformed deno.json with the schema decoder's message", () => {
+    const { api, layer } = apiDeployHarness(deployedHelloWorld);
+
+    return Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      yield* writeCliConfig(tempRoot.current);
+      yield* writeLocalFunction(tempRoot.current, "hello-world");
+      yield* fs.writeFileString(
+        path.join(tempRoot.current, "supabase", "functions", "hello-world", "deno.json"),
+        "{",
+      );
+
+      const error = yield* functionsDeploy(baseFlags).pipe(Effect.flip);
+
+      expect(error).toBeInstanceOf(FunctionImportMapSyntaxError);
+      expect(error).toMatchObject({ name: "SyntaxError", message: "Expected a valid JSON string" });
+      expect(api.requests.some((request) => request.method === "POST")).toBe(false);
+    }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
+  });
+
+  it.live(
+    "reports a failed progress write while collecting upload files as a typed failure",
+    () => {
+      const out = mockOutput({ format: "text" });
+      const brokenPipe = new Error("EPIPE: broken pipe, write");
+      const api = mockCommandPlatformApi({ handler: deployedHelloWorld });
+      const layer = Layer.mergeAll(
+        buildTestRuntime({
+          out: {
+            ...out,
+            layer: Layer.effect(
+              Output,
+              Effect.gen(function* () {
+                const output = yield* Output;
+                return {
+                  ...output,
+                  raw: (text: string, stream?: "stdout" | "stderr") =>
+                    text.startsWith("Uploading asset")
+                      ? Effect.die(brokenPipe)
+                      : output.raw(text, stream),
+                };
+              }),
+            ).pipe(Layer.provide(out.layer)),
+          },
+          api,
+          cliSettings: mockCommandSettings({ workdir: tempRoot.current }),
+          runtimeInfo: mockRuntimeInfo({ cwd: tempRoot.current }),
+        }),
+        Layer.succeed(YesFlag, false),
+        Stdio.layerTest({
+          args: Effect.succeed(["functions", "deploy", "hello-world", "--use-api"]),
+        }),
+      );
+
+      return Effect.gen(function* () {
+        yield* writeCliConfig(tempRoot.current);
+        yield* writeLocalFunction(tempRoot.current, "hello-world");
+
+        const error = yield* functionsDeploy(baseFlags).pipe(Effect.flip);
+
+        expect(error).toBe(brokenPipe);
+        expect(api.requests.some((request) => request.method === "POST")).toBe(false);
+      }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
+    },
+  );
+
+  it.live("keeps collecting upload files after the deploy is interrupted", () => {
+    const out = mockOutput({ format: "text" });
+    const api = mockCommandPlatformApi({ handler: deployedHelloWorld });
+    const started = Deferred.makeUnsafe<void>();
+    const gate = Deferred.makeUnsafe<void>();
+    const continued = Deferred.makeUnsafe<void>();
+    const layer = Layer.mergeAll(
+      buildTestRuntime({
+        out: {
+          ...out,
+          layer: Layer.effect(
+            Output,
+            Effect.gen(function* () {
+              const output = yield* Output;
+              return {
+                ...output,
+                raw: (text: string, stream?: "stdout" | "stderr") =>
+                  text.startsWith("Uploading asset")
+                    ? Deferred.succeed(started, undefined).pipe(
+                        Effect.flatMap((first) =>
+                          first
+                            ? Deferred.await(gate).pipe(Effect.andThen(output.raw(text, stream)))
+                            : output
+                                .raw(text, stream)
+                                .pipe(Effect.tap(Deferred.succeed(continued, undefined))),
+                        ),
+                      )
+                    : output.raw(text, stream),
+              };
+            }),
+          ).pipe(Layer.provide(out.layer)),
+        },
+        api,
+        cliSettings: mockCommandSettings({ workdir: tempRoot.current }),
+        runtimeInfo: mockRuntimeInfo({ cwd: tempRoot.current }),
+      }),
+      Layer.succeed(YesFlag, false),
+      Stdio.layerTest({
+        args: Effect.succeed(["functions", "deploy", "hello-world", "--use-api"]),
+      }),
+    );
+
+    return Effect.gen(function* () {
+      yield* writeCliConfig(tempRoot.current);
+      yield* writeLocalFunction(tempRoot.current, "hello-world");
+
+      const deploy = yield* Effect.forkChild(functionsDeploy(baseFlags));
+      yield* Deferred.await(started);
+      yield* Fiber.interrupt(deploy);
+      yield* Deferred.succeed(gate, undefined);
+      yield* Deferred.await(continued);
+
+      expect(out.stderrText).toContain(
+        "Uploading asset (hello-world): supabase/functions/hello-world/deno.json\n",
+      );
+      expect(out.stderrText).toContain(
+        "Uploading asset (hello-world): supabase/functions/hello-world/index.ts\n",
+      );
+    }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
+  });
+
+  it.live("reports a malformed deploy response with the schema decoder's message", () => {
+    const { layer } = apiDeployHarness((request) =>
+      Effect.succeed(
+        request.method === "GET"
+          ? jsonResponse(request, 200, [])
+          : HttpClientResponse.fromWeb(request, new Response("{", { status: 201 })),
+      ),
+    );
+
+    return Effect.gen(function* () {
+      yield* writeCliConfig(tempRoot.current);
+      yield* writeLocalFunction(tempRoot.current, "hello-world");
+
+      const error = yield* functionsDeploy(baseFlags).pipe(Effect.flip);
+
+      expect(error).toBeInstanceOf(FunctionsApiStatusError);
+      expect(error).toMatchObject({
+        status: 201,
+        decode: true,
+        message: "failed to read deploy response: Expected a valid JSON string",
+      });
+    }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
+  });
+
+  it.live("reports a malformed functions list with the schema decoder's message", () => {
+    const { layer } = apiDeployHarness((request) =>
+      Effect.succeed(
+        request.method === "GET" && request.url.endsWith("/functions")
+          ? HttpClientResponse.fromWeb(request, new Response("{", { status: 200 }))
+          : jsonResponse(request, 200, []),
+      ),
+    );
+
+    return Effect.gen(function* () {
+      yield* writeCliConfig(tempRoot.current);
+      yield* writeLocalFunction(tempRoot.current, "hello-world");
+
+      const error = yield* functionsDeploy(baseFlags).pipe(Effect.flip);
+
+      expect(error).toBeInstanceOf(FunctionsApiStatusError);
+      expect(error).toMatchObject({
+        status: 200,
+        decode: true,
+        message: "failed to read functions list: Expected a valid JSON string",
+      });
+    }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
+  });
+
+  it.live(
+    "reports a malformed Docker-bundled function response with the schema decoder's message",
+    () => {
+      const out = mockOutput({ format: "text" });
+      const api = mockCommandPlatformApi({
+        handler: (request) =>
+          Effect.succeed(
+            request.method === "GET"
+              ? jsonResponse(request, 200, [])
+              : HttpClientResponse.fromWeb(request, new Response("{", { status: 201 })),
+          ),
+      });
+      const child = mockDockerBundleSpawner();
+      const layer = Layer.mergeAll(
+        buildTestRuntime({
+          out,
+          api,
+          cliSettings: mockCommandSettings({ workdir: tempRoot.current }),
+          runtimeInfo: mockRuntimeInfo({ cwd: tempRoot.current }),
+        }),
+        Layer.succeed(YesFlag, false),
+        child.layer,
+        Stdio.layerTest({
+          args: Effect.succeed(["functions", "deploy", "hello-world", "--use-api=false"]),
+        }),
+      );
+
+      return Effect.gen(function* () {
+        yield* writeCliConfig(tempRoot.current);
+        yield* writeLocalFunction(tempRoot.current, "hello-world");
+
+        const error = yield* functionsDeploy({ ...baseFlags, useApi: false, useDocker: true }).pipe(
+          Effect.flip,
+        );
+
+        expect(error).toBeInstanceOf(FunctionsApiStatusError);
+        expect(error).toMatchObject({
+          status: 201,
+          decode: true,
+          message: "failed to read function response: Expected a valid JSON string",
+        });
+      }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
+    },
+  );
+
+  it.live("reports a NUL byte in an imported path as the raw host TypeError", () => {
+    const { layer } = apiDeployHarness(deployedHelloWorld);
+
+    return Effect.gen(function* () {
+      yield* writeCliConfig(tempRoot.current);
+      yield* writeLocalFunction(
+        tempRoot.current,
+        "hello-world",
+        'import "./a\u0000b.ts";\nDeno.serve(() => new Response())\n',
+      );
+
+      const error = yield* functionsDeploy(baseFlags).pipe(Effect.flip);
+
+      expect(error).toBeInstanceOf(TypeError);
+      expect(error).toMatchObject({
+        code: "ERR_INVALID_ARG_VALUE",
+        message: expect.stringContaining("without null bytes"),
+      });
+    }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
+  });
+
+  it.live("reports a bundle output directory that cannot be created as an unknown error", () => {
+    const out = mockOutput({ format: "text" });
+    const child = mockDockerBundleSpawner();
+    const layer = Layer.mergeAll(
+      buildTestRuntime({
+        out,
+        api: mockCommandPlatformApi({ handler: deployedHelloWorld }),
+        cliSettings: mockCommandSettings({ workdir: tempRoot.current }),
+        runtimeInfo: mockRuntimeInfo({ cwd: tempRoot.current }),
+      }),
+      Layer.succeed(YesFlag, false),
+      child.layer,
+      Stdio.layerTest({
+        args: Effect.succeed(["functions", "deploy", "hello-world", "--use-api=false"]),
+      }),
+    );
+
+    return Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      yield* writeCliConfig(tempRoot.current);
+      yield* writeLocalFunction(tempRoot.current, "hello-world");
+      yield* fs.writeFileString(path.join(tempRoot.current, "supabase", ".temp"), "");
+
+      const error = yield* functionsDeploy({ ...baseFlags, useApi: false, useDocker: true }).pipe(
+        Effect.flip,
+      );
+
+      expect(error).toBeInstanceOf(Cause.UnknownError);
+      expect(error).toMatchObject({
+        message: "An error occurred in Effect.tryPromise",
+        cause: expect.objectContaining({ code: "EEXIST" }),
+      });
+    }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
+  });
+
   it.live("deploys config-declared custom entrypoints when deploying all functions", () => {
     const out = mockOutput({ format: "text" });
     const api = mockCommandPlatformApi({
@@ -1335,6 +1682,71 @@ describe("functions deploy", () => {
       },
     );
 
+    it.live("passes --verbose to the bundler container when DEBUG=true", () => {
+      const out = mockOutput({ format: "text" });
+      const api = mockFunctionCreateApi();
+      const child = mockDockerBundleSpawner();
+      const layer = Layer.mergeAll(
+        buildTestRuntime({
+          out,
+          api,
+          cliSettings: mockCommandSettings({ workdir: tempRoot.current }),
+          runtimeInfo: mockRuntimeInfo({ cwd: tempRoot.current }),
+        }),
+        Layer.succeed(YesFlag, false),
+        child.layer,
+        Stdio.layerTest({
+          args: Effect.succeed(["functions", "deploy", "hello-world", "--use-api=false"]),
+        }),
+      );
+
+      return Effect.gen(function* () {
+        yield* writeCliConfig(tempRoot.current);
+        yield* writeLocalFunction(tempRoot.current, "hello-world");
+
+        yield* withConfigEnv(
+          { DEBUG: "true" },
+          functionsDeploy({ ...baseFlags, useApi: false, useDocker: true }),
+        );
+
+        const runCommand = child.spawned.find((spawned) => spawned.args[0] === "run");
+        expect(runCommand?.args).toContain("--verbose");
+      }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
+    });
+
+    it.live("keeps --verbose off the bundler container when DEBUG=false", () => {
+      const out = mockOutput({ format: "text" });
+      const api = mockFunctionCreateApi();
+      const child = mockDockerBundleSpawner();
+      const layer = Layer.mergeAll(
+        buildTestRuntime({
+          out,
+          api,
+          cliSettings: mockCommandSettings({ workdir: tempRoot.current }),
+          runtimeInfo: mockRuntimeInfo({ cwd: tempRoot.current }),
+        }),
+        Layer.succeed(YesFlag, false),
+        child.layer,
+        Stdio.layerTest({
+          args: Effect.succeed(["functions", "deploy", "hello-world", "--use-api=false"]),
+        }),
+      );
+
+      return Effect.gen(function* () {
+        yield* writeCliConfig(tempRoot.current);
+        yield* writeLocalFunction(tempRoot.current, "hello-world");
+
+        yield* withConfigEnv(
+          { DEBUG: "false" },
+          functionsDeploy({ ...baseFlags, useApi: false, useDocker: true }),
+        );
+
+        const runCommand = child.spawned.find((spawned) => spawned.args[0] === "run");
+        expect(runCommand?.args).toContain("run");
+        expect(runCommand?.args).not.toContain("--verbose");
+      }).pipe(Effect.provide(layer), Effect.ensuring(removeTempRoot));
+    });
+
     it.live(
       "uses SUPABASE_NETWORK_ID as the bundler's docker network when no --network-id flag is passed",
       () => {
diff --git a/apps/cli/src/commands/functions/download/download.handler.ts b/apps/cli/src/commands/functions/download/download.handler.ts
index 3049be36ea..9bf4d9affa 100644
--- a/apps/cli/src/commands/functions/download/download.handler.ts
+++ b/apps/cli/src/commands/functions/download/download.handler.ts
@@ -73,6 +73,7 @@ export const functionsDownload = Effect.fn("functions.download")(function* (
     if (flags.legacyBundle) {
       return;
     }
+    yield* Effect.annotateCurrentSpan("function.count", result.slugs.length);
 
     if (result.empty) {
       if (output.format === "text") {
@@ -105,7 +106,10 @@ export const functionsDownload = Effect.fn("functions.download")(function* (
       Effect.suspend(() =>
         Option.match(resolvedProjectRef, {
           onNone: () => Effect.void,
-          onSome: (ref) => linkedProjectCache.cache(ref),
+          onSome: (ref) =>
+            Effect.annotateCurrentSpan("project.ref", ref).pipe(
+              Effect.andThen(linkedProjectCache.cache(ref)),
+            ),
         }),
       ),
     ),
diff --git a/apps/cli/src/commands/functions/download/download.integration.test.ts b/apps/cli/src/commands/functions/download/download.integration.test.ts
index 7c9b82c61b..0ce78d449b 100644
--- a/apps/cli/src/commands/functions/download/download.integration.test.ts
+++ b/apps/cli/src/commands/functions/download/download.integration.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "@effect/vitest";
-import { BunCrypto } from "@effect/platform-bun";
+import { BunCrypto, BunServices } from "@effect/platform-bun";
 import { dockerfileServiceImage } from "../../../shared/services/dockerfile-images.ts";
 import { slimImagesEnabled } from "../../../shared/services/slim-images.ts";
 import {
@@ -24,6 +24,7 @@ import { commandRuntimeLayer } from "../../../shared/runtime/command-runtime.lay
 import { CurrentAnalyticsContext } from "../../../shared/telemetry/analytics-context.ts";
 import { Analytics } from "../../../shared/telemetry/analytics.service.ts";
 import {
+  type ApiHandler,
   buildTestRuntime,
   jsonResponse,
   mockCommandSettings,
@@ -156,18 +157,24 @@ const baseFlags: FunctionsDownloadFlags = {
   legacyBundle: false,
 };
 
-function multipartResponse(request: Parameters<typeof HttpClientResponse.fromWeb>[0]) {
+function multipartResponse(
+  request: Parameters<typeof HttpClientResponse.fromWeb>[0],
+  {
+    metadata = { deno2_entrypoint_path: "source/index.ts" },
+    contents = "console.log('legacy native')",
+  }: { readonly metadata?: Readonly<Record<string, string>>; readonly contents?: string } = {},
+) {
   const boundary = "legacy-download-test";
   const body = [
     `--${boundary}`,
     'Content-Disposition: form-data; name="metadata"',
     "Content-Type: application/json",
     "",
-    JSON.stringify({ deno2_entrypoint_path: "source/index.ts" }),
+    JSON.stringify(metadata),
     `--${boundary}`,
     'Content-Disposition: form-data; name="file"; filename="source/index.ts"',
     "",
-    "console.log('legacy native')",
+    contents,
     `--${boundary}--`,
     "",
   ].join("\r\n");
@@ -257,6 +264,238 @@ describe("functions download", () => {
     }).pipe(Effect.provide(layer));
   });
 
+  function nativeDownloadLayer(
+    handler: ApiHandler,
+    args: ReadonlyArray<string> = [
+      "functions",
+      "download",
+      "hello-world",
+      "--project-ref",
+      PROJECT_ID,
+    ],
+  ) {
+    return Layer.mergeAll(
+      buildTestRuntime({
+        out: mockOutput({ format: "text" }),
+        api: mockCommandPlatformApi({ handler }),
+        cliSettings: mockCommandSettings({ workdir: tempRoot.current }),
+      }),
+      mockProxy().layer,
+      Stdio.layerTest({ args: Effect.succeed(args) }),
+    );
+  }
+
+  it.live("downloads an empty function file as an empty file", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      yield* functionsDownload(baseFlags);
+
+      expect(
+        yield* fs.readFileString(
+          path.join(tempRoot.current, "supabase", "functions", "hello-world", "index.ts"),
+        ),
+      ).toBe("");
+    }).pipe(
+      Effect.provide(
+        nativeDownloadLayer((request) =>
+          request.url.endsWith("/body")
+            ? Effect.succeed(multipartResponse(request, { contents: "" }))
+            : Effect.succeed(jsonResponse(request, 200, {})),
+        ),
+      ),
+    ),
+  );
+
+  it.live("removes the temporary file when a downloaded file cannot be moved into place", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const functionDir = path.join(tempRoot.current, "supabase", "functions", "hello-world");
+      yield* fs.makeDirectory(path.join(functionDir, "index.ts", "occupied"), { recursive: true });
+
+      const error = yield* functionsDownload(baseFlags).pipe(Effect.flip);
+
+      expect(error).toMatchObject({
+        message: expect.stringMatching(
+          /^failed to move Function file into place: source\/index\.ts: E[A-Z]+: /,
+        ),
+      });
+      expect(yield* fs.readDirectory(functionDir)).toEqual(["index.ts"]);
+    }).pipe(
+      Effect.provide(
+        nativeDownloadLayer((request) =>
+          request.url.endsWith("/body")
+            ? Effect.succeed(multipartResponse(request))
+            : Effect.succeed(jsonResponse(request, 200, {})),
+        ),
+      ),
+    ),
+  );
+
+  it.live("reports malformed function metadata JSON", () =>
+    Effect.gen(function* () {
+      const error = yield* functionsDownload(baseFlags).pipe(Effect.flip);
+
+      expect(error).toMatchObject({
+        message: "failed to get function metadata: Expected a valid JSON string",
+      });
+    }).pipe(
+      Effect.provide(
+        nativeDownloadLayer((request) =>
+          request.url.endsWith("/body")
+            ? Effect.succeed(multipartResponse(request, { metadata: {} }))
+            : Effect.succeed(
+                HttpClientResponse.fromWeb(request, new Response("{", { status: 200 })),
+              ),
+        ),
+      ),
+    ),
+  );
+
+  it.live.each([
+    {
+      name: "malformed JSON",
+      body: "{",
+      message: "failed to read functions list: Expected a valid JSON string",
+    },
+    {
+      name: "a non-array body",
+      body: "{}",
+      message: "failed to read functions list: expected functions list response to be an array",
+    },
+    {
+      name: "a non-string slug",
+      body: '[{"slug":1}]',
+      message: "failed to read functions list: expected function slug to be a string, got number",
+    },
+  ])("reports a functions list response with $name", ({ body, message }) =>
+    Effect.gen(function* () {
+      const error = yield* functionsDownload({ ...baseFlags, functionName: Option.none() }).pipe(
+        Effect.flip,
+      );
+
+      expect(error).toMatchObject({ message });
+    }).pipe(
+      Effect.provide(
+        nativeDownloadLayer(
+          (request) =>
+            Effect.succeed(
+              HttpClientResponse.fromWeb(request, new Response(body, { status: 200 })),
+            ),
+          ["functions", "download", "--project-ref", PROJECT_ID],
+        ),
+      ),
+    ),
+  );
+
+  it.live("reports a temp directory that cannot be created for the eszip download", () => {
+    const child = mockChildProcessSpawner({ exitCode: 0 });
+    return Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      yield* fs.makeDirectory(path.join(tempRoot.current, "supabase"), { recursive: true });
+      yield* fs.writeFileString(path.join(tempRoot.current, "supabase", ".temp"), "");
+
+      const error = yield* functionsDownload({ ...baseFlags, useDocker: true }).pipe(Effect.flip);
+
+      expect(error).toMatchObject({
+        message: expect.stringMatching(/^failed to mkdir: E[A-Z]+: .*\.temp/),
+      });
+    }).pipe(
+      Effect.provide(
+        Layer.mergeAll(
+          nativeDownloadLayer(
+            (request) => Effect.succeed(jsonResponse(request, 200, {})),
+            ["functions", "download", "hello-world", "--use-docker", "--project-ref", PROJECT_ID],
+          ),
+          child.layer,
+        ),
+      ),
+    );
+  });
+
+  it.live("reports an eszip path that cannot be written as the raw host error", () => {
+    const child = mockChildProcessSpawner({ exitCode: 0 });
+    return Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      yield* fs.makeDirectory(
+        path.join(tempRoot.current, "supabase", ".temp", "output_hello-world.eszip"),
+        { recursive: true },
+      );
+
+      const error = yield* functionsDownload({ ...baseFlags, useDocker: true }).pipe(Effect.flip);
+
+      expect(error).toMatchObject({
+        message: expect.stringMatching(
+          /^failed to download file: E[A-Z]+: .*output_hello-world\.eszip/,
+        ),
+      });
+    }).pipe(
+      Effect.provide(
+        Layer.mergeAll(
+          nativeDownloadLayer(
+            (request) => Effect.succeed(jsonResponse(request, 200, {})),
+            ["functions", "download", "hello-world", "--use-docker", "--project-ref", PROJECT_ID],
+          ),
+          child.layer,
+        ),
+      ),
+    );
+  });
+
+  it.live("prints the raw host error when the temporary eszip cannot be removed", () => {
+    const out = mockOutput({ format: "text" });
+    const child = mockChildProcessSpawner({
+      exitCode: 0,
+      beforeSpawn: (record) =>
+        record.command === "docker" && record.args[0] === "run"
+          ? Effect.gen(function* () {
+              const fs = yield* FileSystem.FileSystem;
+              const path = yield* Path.Path;
+              const eszipPath = path.join(
+                tempRoot.current,
+                "supabase",
+                ".temp",
+                "output_hello-world.eszip",
+              );
+              yield* fs.remove(eszipPath);
+              yield* fs.makeDirectory(path.join(eszipPath, "occupied"), { recursive: true });
+            }).pipe(Effect.provide(BunServices.layer), Effect.orDie)
+          : Effect.void,
+    });
+    const layer = Layer.mergeAll(
+      buildTestRuntime({
+        out,
+        api: mockCommandPlatformApi({
+          handler: (request) => Effect.succeed(jsonResponse(request, 200, {})),
+        }),
+        cliSettings: mockCommandSettings({ workdir: tempRoot.current }),
+      }),
+      mockProxy().layer,
+      child.layer,
+      Stdio.layerTest({
+        args: Effect.succeed([
+          "functions",
+          "download",
+          "hello-world",
+          "--use-docker",
+          "--project-ref",
+          PROJECT_ID,
+        ]),
+      }),
+    );
+
+    return Effect.gen(function* () {
+      yield* functionsDownload({ ...baseFlags, useDocker: true });
+
+      expect(out.stderrText).toMatch(
+        /Path is a directory: rm returned EISDIR \(is a directory\) .*output_hello-world\.eszip\n/,
+      );
+    }).pipe(Effect.provide(layer));
+  });
+
   it.live(
     "runs the native Docker unbundle path by default (Go parity), with no flags passed",
     () => {
diff --git a/apps/cli/src/commands/functions/list/list.handler.ts b/apps/cli/src/commands/functions/list/list.handler.ts
index a2711b6ac5..2300dcbdb4 100644
--- a/apps/cli/src/commands/functions/list/list.handler.ts
+++ b/apps/cli/src/commands/functions/list/list.handler.ts
@@ -47,6 +47,7 @@ export const functionsList = Effect.fn("functions.list")(function* (flags: Funct
         }),
       ),
     );
+    yield* Effect.annotateCurrentSpan("project.ref", ref);
 
     const fetching =
       output.format === "text" ? yield* output.task("Fetching functions...") : undefined;
@@ -88,6 +89,7 @@ export const functionsList = Effect.fn("functions.list")(function* (flags: Funct
     }
     yield* fetching?.clear ?? Effect.void;
     const { functions, isNil } = decodedFunctions.value;
+    yield* Effect.annotateCurrentSpan("function.count", functions.length);
 
     const goFmt = Option.getOrUndefined(goOutputFlag);
 
diff --git a/apps/cli/src/commands/functions/new/new.handler.ts b/apps/cli/src/commands/functions/new/new.handler.ts
index 54616be9dc..4e3c23b12a 100644
--- a/apps/cli/src/commands/functions/new/new.handler.ts
+++ b/apps/cli/src/commands/functions/new/new.handler.ts
@@ -57,7 +57,9 @@ function hasFunctionConfigDeclaration(contents: string, slug: string): boolean {
   return pattern.test(contents);
 }
 
-const listExistingFunctionSlugs = Effect.fnUntraced(function* (workdir: string) {
+const listExistingFunctionSlugs = Effect.fn("functions.new.listExistingSlugs")(function* (
+  workdir: string,
+) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
 
@@ -85,10 +87,11 @@ const listExistingFunctionSlugs = Effect.fnUntraced(function* (workdir: string)
     }
   }
 
+  yield* Effect.annotateCurrentSpan("function.count", slugs.size);
   return slugs;
 });
 
-const resolveTemplateInputs = Effect.fnUntraced(function* (
+const resolveTemplateInputs = Effect.fn("functions.new.resolveTemplateInputs")(function* (
   cliSettings: { readonly workdir: string; readonly explicitWorkdir: boolean },
   slug: string,
 ) {
@@ -96,6 +99,7 @@ const resolveTemplateInputs = Effect.fnUntraced(function* (
     goViperCompat: true,
     search: shouldSearchAncestors(cliSettings),
   }).pipe(Effect.orElseSucceed(() => null));
+  yield* Effect.annotateCurrentSpan("config.found", loaded !== null);
   const port = loaded?.config.api.port ?? DEFAULT_LOCAL_API_PORT;
   const publishableKey = loaded?.config.auth.publishable_key ?? defaultPublishableKey;
   return {
@@ -106,7 +110,9 @@ const resolveTemplateInputs = Effect.fnUntraced(function* (
 
 // Only invoked in text mode: json/stream-json runs stay payload-only and
 // never scaffold IDE settings as an undisclosed side effect.
-const promptForIdeSettings = Effect.fnUntraced(function* (workdir: string) {
+const promptForIdeSettings = Effect.fn("functions.new.promptIdeSettings")(function* (
+  workdir: string,
+) {
   const output = yield* Output;
   // Also honors `SUPABASE_YES`, not just the `--yes` flag.
   const yes = yield* resolveYes;
diff --git a/apps/cli/src/commands/functions/serve/SIDE_EFFECTS.md b/apps/cli/src/commands/functions/serve/SIDE_EFFECTS.md
index c885973790..9c4e0ea74a 100644
--- a/apps/cli/src/commands/functions/serve/SIDE_EFFECTS.md
+++ b/apps/cli/src/commands/functions/serve/SIDE_EFFECTS.md
@@ -92,6 +92,7 @@ Writes lifecycle text to stderr / stdout while the command is running:
 - `Skipped serving Function: <slug>` for disabled functions
 - `File change detected: <path> (<op>)` when a watched file triggers a restart
 - live `docker logs -f --timestamps` output from the edge-runtime container
+- in stack mode, `--- <count> <stream or output> chunk(s) lost ---` on stderr when the stack could not persist Functions output
 - `Stopped serving supabase/functions` on a user-initiated shutdown (`SIGINT`/`SIGTERM`)
 - `Edge Runtime exited (code 0). Stopped serving supabase/functions` when the container stops on its own with exit code `0`
 - `Edge Runtime container stopped (exit <code>). Stopped serving supabase/functions` when an external supervisor tears the container down (exit `129`/`130`/`131`/`143`)
@@ -104,7 +105,9 @@ Long-running raw log / error output only; there is no final success payload obje
 ### `--output-format stream-json`
 
 The legacy backend emits long-running raw log / error events with no terminal `result` event.
-Stack mode emits a readiness `result` containing the instance ID and URL, then live log events.
+Stack mode emits a readiness `result` containing the instance ID and URL, then live log events
+for Functions output persisted since the command started, stamped with the owner's record time,
+and a `log-marker` event of kind `lost` for output the stack could not persist.
 
 ## Notes
 
diff --git a/apps/cli/src/commands/functions/serve/serve.handler.ts b/apps/cli/src/commands/functions/serve/serve.handler.ts
index f25a216929..96838d0d6b 100644
--- a/apps/cli/src/commands/functions/serve/serve.handler.ts
+++ b/apps/cli/src/commands/functions/serve/serve.handler.ts
@@ -10,6 +10,7 @@ import { functionsServeStack } from "./serve.stack.handler.ts";
 
 export const functionsServe = Effect.fn("functions.serve")(function* (flags: FunctionsServeFlags) {
   const backend = yield* currentStackBackend;
+  yield* Effect.annotateCurrentSpan("stack.backend", backend.kind);
   if (backend.kind === "stack") return yield* functionsServeStack(flags);
   const cliSettings = yield* CommandSettings;
   const runtimeInfo = yield* RuntimeInfo;
diff --git a/apps/cli/src/commands/functions/serve/serve.stack.handler.ts b/apps/cli/src/commands/functions/serve/serve.stack.handler.ts
index 189d4ee154..4beab2b035 100644
--- a/apps/cli/src/commands/functions/serve/serve.stack.handler.ts
+++ b/apps/cli/src/commands/functions/serve/serve.stack.handler.ts
@@ -14,6 +14,7 @@ import { stackOpenReadyProject } from "../../../command-internal/stack-local-dat
 import { OutputFlag } from "../../../command-internal/global-flags.ts";
 import { TelemetryState } from "../../../telemetry/telemetry-state.service.ts";
 import type { FunctionsServeFlags } from "../../../shared/functions/serve.ts";
+import { logEvent, markerText } from "../../../command-internal/stack-log-events.ts";
 import { FunctionsServeStackError } from "./serve.errors.ts";
 
 type Instance = Effect.Success<ReturnType<Stack["services"]["get"]>>;
@@ -44,38 +45,25 @@ const follow = Effect.fn("functions.serve.follow")(function* (
   launch: Effect.Effect<void, { readonly message: string }, Scope.Scope>,
 ) {
   const output = yield* Output;
-  const logs = yield* instance.logs.pipe(
-    Stream.groupByKey((entry) => entry.stream),
-    Stream.flatMap(
-      ([channel, entries]) =>
-        entries.pipe(
-          Stream.map(({ bytes }) => bytes),
-          Stream.decodeText,
-          Stream.splitLines,
-          Stream.map((line) => ({ channel, line })),
-        ),
-      { concurrency: 2 },
-    ),
-    Stream.runForEach(
-      Effect.fn(function* ({ channel, line }) {
-        const timestamp = DateTime.formatIso(yield* DateTime.now);
-        yield* output.format === "stream-json"
-          ? output.event({
-              type: "log-entry",
-              timestamp,
-              source: "live",
-              service: "functions",
-              instance_id: instance.id,
-              stream: channel,
-              line,
-            })
-          : output.raw(`${line}\n`, channel);
-      }),
-    ),
+  // The owner may pin a follow's start after the launch begins; a time bound taken before launch
+  // keeps its first output.
+  const since = DateTime.formatIso(yield* DateTime.now);
+  const logs = yield* instance.readLogs({ follow: true, since }).pipe(
+    Stream.runForEach((record) => {
+      const lost = record.kind === "lost" && record.count !== undefined;
+      if (record.kind !== "stdout" && record.kind !== "stderr" && !lost) return Effect.void;
+      if (output.format === "stream-json")
+        return output.event(
+          logEvent({ ...record, service: "functions", instanceId: instance.id }, "live"),
+        );
+      return record.kind === "stdout" || record.kind === "stderr"
+        ? output.raw(`${record.text ?? ""}\n`, record.kind)
+        : output.raw(`${markerText(record)}\n`, "stderr");
+    }),
     Effect.forkScoped({ startImmediately: true }),
   );
-  yield* launch;
-  yield* instance.ready;
+  yield* launch.pipe(Effect.withSpan("functions.serve.launch"));
+  yield* instance.ready.pipe(Effect.withSpan("functions.serve.waitReady"));
   const url = (yield* instance.credentials()).url;
   if (url === undefined) return yield* invalidConfig("Functions has no public HTTP endpoint.");
   if (output.format === "stream-json") yield* output.result({ instance_id: instance.id, url });
@@ -168,6 +156,10 @@ const session = Effect.fn("functions.serve.session")(function* (flags: Functions
       ...(Option.isSome(flags.noVerifyJwt) ? { verifyJwt: !flags.noVerifyJwt.value } : {}),
     };
     const changed = !Equal.equals(saved, desired);
+    yield* Effect.annotateCurrentSpan({
+      "functions.instance": "existing",
+      "config.changed": changed,
+    });
     const launch = changed
       ? Effect.uninterruptibleMask((restore) =>
           Effect.gen(function* () {
@@ -213,6 +205,7 @@ const session = Effect.fn("functions.serve.session")(function* (flags: Functions
   const identity = yield* stack.credentials.get;
   if (identity === undefined) return yield* invalidConfig("The stack has no saved credentials.");
   const config = yield* loadStackConfig(settings.workdir);
+  yield* Effect.annotateCurrentSpan("functions.instance", "temporary");
   const refreshedJwks = yield* config.remoteJwks.pipe(
     Effect.catch((cause) =>
       output
@@ -270,11 +263,13 @@ const session = Effect.fn("functions.serve.session")(function* (flags: Functions
     },
     endpoints: { ...source.endpoints, http: { port } },
   };
-  const temporary = yield* Effect.acquireRelease(stack.services.create(creation), (instance) =>
-    instance.status.pipe(
-      Effect.andThen(instance.destroy),
-      Effect.catch((error) => cleanupWarning("Failed to remove temporary Functions", error)),
-    ),
+  const temporary = yield* Effect.acquireRelease(
+    stack.services.create(creation).pipe(Effect.withSpan("functions.serve.createInstance")),
+    (instance) =>
+      instance.status.pipe(
+        Effect.andThen(instance.destroy),
+        Effect.catch((error) => cleanupWarning("Failed to remove temporary Functions", error)),
+      ),
   );
   yield* follow(temporary, temporary.start);
 });
diff --git a/apps/cli/src/commands/functions/serve/serve.stack.integration.test.ts b/apps/cli/src/commands/functions/serve/serve.stack.integration.test.ts
index 45f486e1cd..10cc300593 100644
--- a/apps/cli/src/commands/functions/serve/serve.stack.integration.test.ts
+++ b/apps/cli/src/commands/functions/serve/serve.stack.integration.test.ts
@@ -16,6 +16,7 @@ import {
 } from "effect";
 import {
   StackError,
+  type LogRecord,
   type Observation,
   type ServiceCreation,
   type ServiceCreationInput,
@@ -117,6 +118,7 @@ const fixture = (
     readonly savedGotrueJwtKeys?: string;
     readonly savedJwks?: string;
     readonly savedRemoteJwks?: string;
+    readonly functionsLogs?: FunctionsInstance["readLogs"];
     readonly restartGate?: {
       readonly entered: Deferred.Deferred<void>;
       readonly release: Deferred.Deferred<void>;
@@ -187,7 +189,7 @@ const fixture = (
       }),
       prepare: Effect.void,
       followStatus: Stream.never,
-      logs: Stream.never,
+      readLogs: () => Stream.never,
     };
     const database: DatabaseInstance = {
       id: "database",
@@ -205,7 +207,7 @@ const fixture = (
       saveSnapshot: () => Effect.die("unused"),
       restoreSnapshot: () => Effect.die("unused"),
       followStatus: Stream.never,
-      logs: Stream.never,
+      readLogs: () => Stream.never,
     };
     const functions: FunctionsInstance = {
       id: "functions",
@@ -244,7 +246,7 @@ const fixture = (
       }),
       prepare: Effect.void,
       followStatus: Stream.never,
-      logs: Stream.never,
+      readLogs: options.functionsLogs ?? (() => Stream.never),
     };
     const stack = {
       id: "a".repeat(64),
@@ -508,6 +510,47 @@ describe("experimental Stack Functions serve", () => {
     }).pipe(Effect.provide(BunServices.layer)),
   );
 
+  it.live("forwards Functions output written since serve started and reports lost output", () =>
+    Effect.gen(function* () {
+      const drained = yield* Deferred.make<void>();
+      const records: ReadonlyArray<LogRecord> = [
+        { kind: "stdout", timestamp: "2000-01-01T00:00:00.000Z", launchId: 1, text: "old" },
+        { kind: "launch", timestamp: "2999-01-01T00:00:00.000Z", launchId: 2 },
+        { kind: "stdout", timestamp: "2999-01-01T00:00:00.001Z", launchId: 2, text: "hello" },
+        { kind: "stderr", timestamp: "2999-01-01T00:00:00.002Z", launchId: 2, text: "oops" },
+        { kind: "lost", timestamp: "2999-01-01T00:00:00.003Z", stream: "stdout", count: 2 },
+      ];
+      // Honors `since` like the owner, so replaying earlier launches would surface "old".
+      const state = yield* fixture({
+        functionsLogs: (options) =>
+          Stream.fromIterable(
+            records.filter(
+              ({ timestamp }) => options?.since === undefined || timestamp >= options.since,
+            ),
+          ).pipe(
+            Stream.concat(
+              Stream.fromEffect(Deferred.succeed(drained, undefined)).pipe(Stream.drain),
+            ),
+            Stream.concat(Stream.never),
+          ),
+      });
+      const run = yield* functionsServeStack(flags()).pipe(
+        Effect.provide(state.layer),
+        Effect.forkChild,
+      );
+      yield* Deferred.await(drained);
+      yield* Deferred.succeed(state.signal, undefined);
+      yield* Fiber.join(run);
+
+      const forwarded = state.output.rawChunks.filter(({ text }) => !text.startsWith("Serving"));
+      expect(forwarded).toEqual([
+        { text: "hello\n", stream: "stdout" },
+        { text: "oops\n", stream: "stderr" },
+        { text: "--- 2 stdout chunks lost ---\n", stream: "stderr" },
+      ]);
+    }),
+  );
+
   it.live("restores an overridden composed Functions config on SIGINT", () =>
     Effect.gen(function* () {
       const state = yield* fixture();
diff --git a/apps/cli/src/commands/gen/bearer-jwt/bearer-jwt.integration.test.ts b/apps/cli/src/commands/gen/bearer-jwt/bearer-jwt.integration.test.ts
index 9bdc628664..6660897120 100644
--- a/apps/cli/src/commands/gen/bearer-jwt/bearer-jwt.integration.test.ts
+++ b/apps/cli/src/commands/gen/bearer-jwt/bearer-jwt.integration.test.ts
@@ -1225,9 +1225,7 @@ describe("gen bearer-jwt integration", () => {
         TelemetryRuntime,
         TelemetryRuntime.of({
           configDir: `${tempRoot.current}/.supabase`,
-          tracesDir: `${tempRoot.current}/.supabase/traces`,
           consent: "granted",
-          showDebug: false,
           deviceId: "test-device-id",
           sessionId: "test-session-id",
           identity: makeTelemetryIdentity(undefined),
diff --git a/apps/cli/src/commands/gen/signing-key/signing-key.handler.ts b/apps/cli/src/commands/gen/signing-key/signing-key.handler.ts
index 840df06425..be56233efd 100644
--- a/apps/cli/src/commands/gen/signing-key/signing-key.handler.ts
+++ b/apps/cli/src/commands/gen/signing-key/signing-key.handler.ts
@@ -15,6 +15,7 @@ import { resolveYesWithProjectEnv } from "../../../command-internal/global-flags
 import { CONTEXT_CANCELED_MESSAGE } from "../../../shared/output/errors.ts";
 import { Output } from "../../../shared/output/output.service.ts";
 import { Tty } from "../../../shared/runtime/tty.service.ts";
+import { withChildTraceEnv, withProcessSpan } from "../../../shared/telemetry/spans.ts";
 import {
   readSigningKeysFile,
   resolveSigningKeysConfigPaths,
@@ -185,21 +186,21 @@ const isGitIgnored = Effect.fnUntraced(function* (filePath: string, searchFrom:
 
   const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
   const relative = path.relative(gitRoot, filePath).replaceAll("\\", "/");
-  const command = ChildProcess.make(
-    "git",
-    // `--` terminates flag parsing so a path beginning with `-` is never read as a git option.
-    ["-C", gitRoot, "check-ignore", "--quiet", "--", relative],
-    {
-      detached: true,
-      stdin: "ignore",
-      stdout: "ignore",
-      stderr: "ignore",
-    },
-  );
+  // `--` terminates flag parsing so a path beginning with `-` is never read as a git option.
+  const args = ["-C", gitRoot, "check-ignore", "--quiet", "--", relative];
+  const options: ChildProcess.CommandOptions = {
+    detached: true,
+    stdin: "ignore",
+    stdout: "ignore",
+    stderr: "ignore",
+  };
 
-  return yield* spawner
-    .exitCode(command)
-    .pipe(Effect.map((exitCode) => Option.some(Number(exitCode) === 0)));
+  return yield* withProcessSpan(
+    "GenSigningKey.gitCheckIgnore",
+    { executable: "git", argCount: args.length },
+    (traceEnv) =>
+      spawner.exitCode(ChildProcess.make("git", args, withChildTraceEnv(options, traceEnv))),
+  ).pipe(Effect.map((exitCode) => Option.some(Number(exitCode) === 0)));
 });
 
 export const genSigningKey = Effect.fn("gen.signing-key")(function* (flags: GenSigningKeyFlags) {
diff --git a/apps/cli/src/commands/gen/signing-key/signing-key.integration.test.ts b/apps/cli/src/commands/gen/signing-key/signing-key.integration.test.ts
index 302919a1ac..3436de11d6 100644
--- a/apps/cli/src/commands/gen/signing-key/signing-key.integration.test.ts
+++ b/apps/cli/src/commands/gen/signing-key/signing-key.integration.test.ts
@@ -277,9 +277,7 @@ describe("gen signing-key integration", () => {
           TelemetryRuntime,
           TelemetryRuntime.of({
             configDir: path.join(tempRoot.current, ".supabase"),
-            tracesDir: path.join(tempRoot.current, ".supabase", "traces"),
             consent: "granted",
-            showDebug: false,
             deviceId: "test-device-id",
             sessionId: "test-session-id",
             identity: makeTelemetryIdentity(undefined),
diff --git a/apps/cli/src/commands/gen/types/types.generator.layer.ts b/apps/cli/src/commands/gen/types/types.generator.layer.ts
index f94fceec4f..d540245688 100644
--- a/apps/cli/src/commands/gen/types/types.generator.layer.ts
+++ b/apps/cli/src/commands/gen/types/types.generator.layer.ts
@@ -16,6 +16,7 @@ import { DbConnection } from "../../../command-internal/db-connection.service.ts
 import { RuntimeInfo } from "../../../shared/runtime/runtime-info.service.ts";
 import {
   type GenTypesGenerateError,
+  type GenTypesGenerateInput,
   GenTypesGenerationError,
   GenTypesGenerator,
   GenTypesToolFailedError,
@@ -73,52 +74,66 @@ export const genTypesGeneratorLayer = Layer.effect(
       ComSpec: yield* optionalEnv("ComSpec"),
     };
     return GenTypesGenerator.of({
-      generate: (input) =>
-        Effect.gen(function* () {
-          const language = findLanguage(input.lang);
-          if (language === undefined) {
-            return yield* new GenTypesGenerationError({
-              message: `failed to generate ${input.lang} types: unknown language`,
+      generate: Effect.fn("GenTypes.generate")(function* (input: GenTypesGenerateInput) {
+        yield* Effect.annotateCurrentSpan({
+          "typegen.lang": input.lang,
+          "typegen.schema_count": input.includedSchemas.length,
+          "db.is_local": input.isLocal,
+        });
+        const language = findLanguage(input.lang);
+        if (language === undefined) {
+          return yield* new GenTypesGenerationError({
+            message: `failed to generate ${input.lang} types: unknown language`,
+          });
+        }
+        // Each Promise bridge runs through its phase's fiber context (rather than a bare detached
+        // `Effect.runPromise`) so it stays anchored to this generator effect instead of a
+        // disconnected top-level runtime.
+        const toGenerationError = (cause: unknown) => generationError(input.lang, cause);
+        // The session closes before an out-of-process tool starts, so no connection idles
+        // while, say, `dart run` compiles.
+        const metadata = yield* Effect.scoped(
+          Effect.gen(function* () {
+            const runPromise = Effect.runPromiseWith(yield* Effect.context<never>());
+            const session = yield* dbConn.connect(input.conn, {
+              isLocal: input.isLocal,
+              dnsResolver: input.dnsResolver,
+            });
+            return yield* Effect.tryPromise({
+              try: (signal) => {
+                // `signal` aborts when this generate call is interrupted, so forwarding it to
+                // every query stops an in-flight introspection query instead of leaving it
+                // detached from the fiber that started it.
+                const queryable: Queryable = {
+                  query: (sql) =>
+                    runPromise(session.query(sql), { signal }).then((rows) => ({
+                      rows: [...rows],
+                    })),
+                };
+                return introspect(queryable, { includedSchemas: [...input.includedSchemas] });
+              },
+              catch: toGenerationError,
             });
-          }
-          // Both Promise bridges run through the current fiber's context (rather than a bare
-          // detached `Effect.runPromise`) so they stay anchored to this generator effect instead
-          // of a disconnected top-level runtime.
-          const runPromise = Effect.runPromiseWith(yield* Effect.context<never>());
-          const toGenerationError = (cause: unknown) => generationError(input.lang, cause);
-          // The session closes before an out-of-process tool starts, so no connection idles
-          // while, say, `dart run` compiles.
-          const metadata = yield* Effect.scoped(
-            Effect.gen(function* () {
-              const session = yield* dbConn.connect(input.conn, {
-                isLocal: input.isLocal,
-                dnsResolver: input.dnsResolver,
-              });
-              return yield* Effect.tryPromise({
-                try: (signal) => {
-                  // `signal` aborts when this generate call is interrupted, so forwarding it to
-                  // every query stops an in-flight introspection query instead of leaving it
-                  // detached from the fiber that started it.
-                  const queryable: Queryable = {
-                    query: (sql) =>
-                      runPromise(session.query(sql), { signal }).then((rows) => ({
-                        rows: [...rows],
-                      })),
-                  };
-                  return introspect(queryable, { includedSchemas: [...input.includedSchemas] });
-                },
-                catch: toGenerationError,
-              });
+          }),
+        ).pipe(
+          Effect.tap((metadata) =>
+            Effect.annotateCurrentSpan({
+              "typegen.table_count": metadata.tables.length,
+              "typegen.view_count": metadata.views.length,
+              "typegen.function_count": metadata.functions.length,
             }),
-          );
+          ),
+          Effect.withSpan("GenTypes.introspect"),
+        );
+        return yield* Effect.gen(function* () {
           const host = makeTypegenHost({
             cwd: runtime.cwd,
             env: lookupEnv,
             platform: runtime.platform,
             spawner,
-            runPromise,
+            runPromise: Effect.runPromiseWith(yield* Effect.context<never>()),
           });
-          return yield* Effect.tryPromise({
+          const source = yield* Effect.tryPromise({
             try: (signal) =>
               language.generate(metadata, declaredOptions(language, input.options), {
                 ...host,
@@ -126,7 +141,10 @@ export const genTypesGeneratorLayer = Layer.effect(
               }),
             catch: (cause) => mapRegistryError(input.lang, cause),
           });
-        }),
+          yield* Effect.annotateCurrentSpan("typegen.output_length", source.length);
+          return source;
+        }).pipe(Effect.withSpan("GenTypes.render"));
+      }),
     });
   }),
 );
diff --git a/apps/cli/src/commands/gen/types/types.handler.ts b/apps/cli/src/commands/gen/types/types.handler.ts
index 3885284cec..53feefe65f 100644
--- a/apps/cli/src/commands/gen/types/types.handler.ts
+++ b/apps/cli/src/commands/gen/types/types.handler.ts
@@ -272,6 +272,7 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
           new GenTypesParseConfigError({ message: cause.message }),
       }),
       Effect.flatMap(requireProjectConfigWhenExplicit),
+      Effect.tap((loaded) => Effect.annotateCurrentSpan("config.found", loaded !== null)),
     );
 
   // An explicit --workdir that holds no project must not silently resolve to the embedded
@@ -326,7 +327,7 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
     }
   };
 
-  const runGenerate = (input: {
+  const runGenerate = Effect.fn("gen.types.generate")(function* (input: {
     readonly conn: PgConnInput;
     readonly isLocal: boolean;
     readonly includedSchemas: ReadonlyArray<string>;
@@ -336,47 +337,50 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
       readonly eligible: boolean;
       readonly resolve: Effect.Effect<Option.Option<PgConnInput>, DbConfigError>;
     };
-  }) =>
-    Effect.gen(function* () {
-      const attempt = (conn: PgConnInput) =>
-        Effect.scoped(
-          Effect.gen(function* () {
-            const target = withQueryTimeout(conn);
-            yield* output.raw(`Connecting to ${target.host} ${target.port}\n`, "stderr");
-            return yield* generator.generate({
-              conn: target,
-              isLocal: input.isLocal,
-              dnsResolver,
-              lang,
-              includedSchemas: input.includedSchemas,
-              options: {
-                ...languageOptions,
-                "detect-one-to-one-relationships": input.detectOneToOneRelationships,
-              },
-            });
-          }),
-        );
+  }) {
+    yield* Effect.annotateCurrentSpan(
+      "pooler_fallback.eligible",
+      input.poolerFallback?.eligible ?? false,
+    );
+    const attempt = (conn: PgConnInput) =>
+      Effect.scoped(
+        Effect.gen(function* () {
+          const target = withQueryTimeout(conn);
+          yield* output.raw(`Connecting to ${target.host} ${target.port}\n`, "stderr");
+          return yield* generator.generate({
+            conn: target,
+            isLocal: input.isLocal,
+            dnsResolver,
+            lang,
+            includedSchemas: input.includedSchemas,
+            options: {
+              ...languageOptions,
+              "detect-one-to-one-relationships": input.detectOneToOneRelationships,
+            },
+          });
+        }),
+      );
 
-      const types =
-        input.poolerFallback === undefined
-          ? yield* attempt(input.conn)
-          : yield* runWithPoolerFallback({
-              run: attempt(input.conn),
-              retry: attempt,
-              directHost: input.poolerFallback.directHost,
-              eligible: input.poolerFallback.eligible,
-              resolveFallback: input.poolerFallback.resolve,
-              classifyError: classifyGenerateError,
-            });
+    const types =
+      input.poolerFallback === undefined
+        ? yield* attempt(input.conn)
+        : yield* runWithPoolerFallback({
+            run: attempt(input.conn),
+            retry: attempt,
+            directHost: input.poolerFallback.directHost,
+            eligible: input.poolerFallback.eligible,
+            resolveFallback: input.poolerFallback.resolve,
+            classifyError: classifyGenerateError,
+          });
 
-      if (lang === "typescript") {
-        yield* output.raw(
-          "Generated TypeScript is unformatted. Format it with:\n  npx oxfmt <generated-file.ts>\n",
-          "stderr",
-        );
-      }
-      yield* output.raw(types);
-    });
+    if (lang === "typescript") {
+      yield* output.raw(
+        "Generated TypeScript is unformatted. Format it with:\n  npx oxfmt <generated-file.ts>\n",
+        "stderr",
+      );
+    }
+    yield* output.raw(types);
+  });
 
   const runProjectTypes = (
     projectRef: string,
@@ -386,6 +390,7 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
     adHocProjectRef: boolean,
   ) =>
     Effect.gen(function* () {
+      yield* Effect.annotateCurrentSpan("project.ref", projectRef);
       const api = yield* platformApi.make;
 
       if (lang !== "typescript") {
@@ -440,6 +445,7 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
   const runPreviewBranchTypes = (branchRef: string, includedSchemas: ReadonlyArray<string>) =>
     Effect.gen(function* () {
       const api = yield* platformApi.make;
+      yield* Effect.annotateCurrentSpan("typegen.preview_branch", true);
       const branch = yield* api.v1
         .getABranchConfig({ branch_id_or_ref: branchRef })
         .pipe(Effect.catch(mapBranchDatabaseConfigError));
@@ -526,7 +532,7 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
           });
         }
       }),
-    );
+    ).pipe(Effect.withSpan("gen.types.checkLocalDb"));
 
   yield* Effect.gen(function* () {
     // Validated before the command's own guard or flag-group validation; the query-timeout
@@ -594,7 +600,13 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
       }
     }
 
+    yield* Effect.annotateCurrentSpan("typegen.lang", lang);
+
     if (flags.local) {
+      yield* Effect.annotateCurrentSpan({
+        "typegen.source": "local",
+        "stack.backend": backend.kind,
+      });
       const config = yield* readDbToml(fs, path, cliSettings.workdir);
       const projectEnvValues = Object.fromEntries(
         Object.entries(config.projectEnv).filter(([key]) => key !== "SUPABASE_DB_PASSWORD"),
@@ -647,6 +659,7 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
     }
 
     if (Option.isSome(flags.dbUrl)) {
+      yield* Effect.annotateCurrentSpan("typegen.source", "db_url");
       // Skips the config load entirely when `--schema` is explicit, since the load's only
       // output here is the schema fallback — a `--db-url --schema ...` invocation must not
       // fail just because the workdir has no project config.
@@ -680,6 +693,7 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
     }
 
     if (flags.linked) {
+      yield* Effect.annotateCurrentSpan("typegen.source", "linked");
       const ref = yield* projectRef.resolve(Option.none());
       const loaded = schemas.length > 0 ? null : yield* loadConfig(ref);
       yield* runProjectTypes(
@@ -691,6 +705,7 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
     }
 
     if (Option.isSome(flags.projectId)) {
+      yield* Effect.annotateCurrentSpan("typegen.source", "project_id");
       const ref = yield* projectRef.resolve(flags.projectId);
       const loaded = schemas.length > 0 ? null : yield* loadConfig(ref);
       yield* runProjectTypes(
@@ -701,6 +716,7 @@ export const genTypes = Effect.fn("gen.types")(function* (flags: GenTypesFlags)
       return;
     }
 
+    yield* Effect.annotateCurrentSpan("typegen.source", "linked");
     const resolvedRef = yield* projectRef.resolve(Option.none()).pipe(
       Effect.catchTag("ProjectRefNotLinkedError", (cause) =>
         Effect.fail(
diff --git a/apps/cli/src/commands/gen/types/types.layers.ts b/apps/cli/src/commands/gen/types/types.layers.ts
index 1e775a3054..f30f4be646 100644
--- a/apps/cli/src/commands/gen/types/types.layers.ts
+++ b/apps/cli/src/commands/gen/types/types.layers.ts
@@ -9,7 +9,7 @@ import { projectRefLayer } from "../../../config/project-ref.layer.ts";
 import { ProjectRefResolver } from "../../../config/project-ref.service.ts";
 import { dbConfigLayer } from "../../../command-internal/db-config.layer.ts";
 import { DbConfigResolver } from "../../../command-internal/db-config.service.ts";
-import { dbConnectionLayer } from "../../../command-internal/db-connection.layer.ts";
+import { dbConnectionLayer } from "../../../command-internal/db-connection.sql-pg.layer.ts";
 import { DbConnection } from "../../../command-internal/db-connection.service.ts";
 import { debugLoggerLayer } from "../../../command-internal/debug-logger.layer.ts";
 import { IdentityStitch, identityStitchLayer } from "../../../command-internal/identity-stitch.ts";
diff --git a/apps/cli/src/commands/gen/types/types.typegen-host.ts b/apps/cli/src/commands/gen/types/types.typegen-host.ts
index 2c7cf0d2ef..51e9966a62 100644
--- a/apps/cli/src/commands/gen/types/types.typegen-host.ts
+++ b/apps/cli/src/commands/gen/types/types.typegen-host.ts
@@ -10,6 +10,7 @@ import { Effect, Predicate, Stream } from "effect";
 import { ChildProcess, type ChildProcessSpawner } from "effect/unstable/process";
 
 import { collectText } from "../../../command-internal/container-cli.ts";
+import { withProcessSpanScoped } from "../../../shared/telemetry/spans.ts";
 
 export interface TypegenHostOptions {
   /** Where out-of-process tools run: the directory the command was invoked from. */
@@ -51,22 +52,30 @@ const spawnForTypegen = (
         command = shell ? quoteForCmd(resolved) : resolved;
         if (shell) args = request.args.map(quoteForCmd);
       }
-      const child = yield* spawner.spawn(
-        ChildProcess.make(command, [...args], {
-          cwd: request.cwd,
-          env: request.env,
-          extendEnv: true,
-          shell,
-          stdin: "pipe",
-          stdout: "pipe",
-          stderr: "pipe",
-        }),
+      const child = yield* withProcessSpanScoped(
+        "GenTypes.spawnTypegen",
+        { executable: request.command, argCount: args.length },
+        (traceEnv) =>
+          spawner.spawn(
+            ChildProcess.make(command, [...args], {
+              cwd: request.cwd,
+              env: { ...request.env, ...traceEnv },
+              extendEnv: true,
+              shell,
+              stdin: "pipe",
+              stdout: "pipe",
+              stderr: "pipe",
+            }),
+          ),
       );
       // Written here rather than handed to the spawner, so a tool that exits before reading its
       // input fails the write in this fiber, where it is expected, instead of in a forked one.
-      const feedStdin = Stream.run(
-        Stream.make(new TextEncoder().encode(request.stdin)),
-        child.stdin,
+      // Raced against the child's own exit: under load, a stalled write can lose its scheduling
+      // race against the pipe's "error" event and wait forever on a drain that never comes. Exit
+      // is always observable, so it bounds the wait without a timer.
+      const feedStdin = Effect.raceFirst(
+        Stream.run(Stream.make(new TextEncoder().encode(request.stdin)), child.stdin),
+        child.exitCode,
       ).pipe(Effect.ignore);
       const [, stdout, stderr, exitCode] = yield* Effect.all(
         [
diff --git a/apps/cli/src/commands/gen/types/types.typegen-host.unit.test.ts b/apps/cli/src/commands/gen/types/types.typegen-host.unit.test.ts
index 8be1e919e3..d40155f741 100644
--- a/apps/cli/src/commands/gen/types/types.typegen-host.unit.test.ts
+++ b/apps/cli/src/commands/gen/types/types.typegen-host.unit.test.ts
@@ -1,7 +1,7 @@
 import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import type { SpawnRequest, SpawnResult } from "@supabase/typegen";
-import { Data, Effect, FileSystem, Path, PlatformError, Sink, Stream } from "effect";
+import { Data, Deferred, Effect, FileSystem, Path, PlatformError, Sink, Stream } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
 import { makeTypegenHost } from "./types.typegen-host.ts";
 
@@ -15,13 +15,15 @@ interface SpawnCall {
   stdin: string;
 }
 
-/** Records what `spawnForTypegen` asks for and answers like a finished process. */
+/** Records what `spawnForTypegen` asks for and exits like a tool once it has read its stdin. */
 function fakeSpawner(
   opts: {
     readonly exitCode?: number;
     readonly stdout?: string;
     readonly stderr?: string;
     readonly notFound?: boolean;
+    /** The tool exits without ever reading its stdin, which stays blocked. */
+    readonly stdinBlocked?: boolean;
   } = {},
 ) {
   const calls: Array<SpawnCall> = [];
@@ -50,18 +52,28 @@ function fakeSpawner(
           description: `${command.command} not found`,
         });
       }
+      const stdinRead = yield* Deferred.make<void>();
+      const exitCode = ChildProcessSpawner.ExitCode(opts.exitCode ?? 0);
       return ChildProcessSpawner.makeHandle({
         pid: ChildProcessSpawner.ProcessId(4242),
         stdout: Stream.make(encoder.encode(opts.stdout ?? "")),
         stderr: Stream.make(encoder.encode(opts.stderr ?? "")),
         all: Stream.empty,
-        exitCode: Effect.succeed(ChildProcessSpawner.ExitCode(opts.exitCode ?? 0)),
+        exitCode:
+          opts.stdinBlocked === true
+            ? Effect.succeed(exitCode)
+            : Deferred.await(stdinRead).pipe(Effect.as(exitCode)),
         isRunning: Effect.succeed(false),
-        stdin: Sink.forEach((chunk: Uint8Array) =>
-          Effect.sync(() => {
-            call.stdin += decoder.decode(chunk, { stream: true });
-          }),
-        ),
+        stdin:
+          opts.stdinBlocked === true
+            ? Sink.fromEffect(Effect.never)
+            : Sink.forEach((chunk: Uint8Array) =>
+                Effect.sync(() => {
+                  call.stdin += decoder.decode(chunk, { stream: true });
+                }),
+              ).pipe(
+                Sink.mapEffect(() => Deferred.succeed(stdinRead, undefined).pipe(Effect.asVoid)),
+              ),
         kill: () => Effect.void,
         unref: Effect.succeed(Effect.void),
         getInputFd: () => Sink.drain,
@@ -135,6 +147,15 @@ describe("makeTypegenHost", () => {
     }),
   );
 
+  it.effect("returns once a tool exits without reading its stdin", () =>
+    Effect.gen(function* () {
+      const { spawner } = fakeSpawner({ stdinBlocked: true, exitCode: 3, stderr: "usage\n" });
+      const result: SpawnResult = yield* spawnOf(spawner)(request());
+
+      expect(result).toEqual({ exitCode: 3, stdout: "", stderr: "usage\n" });
+    }),
+  );
+
   it.effect("reports a non-zero exit as a result rather than a failure", () =>
     Effect.gen(function* () {
       const { spawner } = fakeSpawner({ exitCode: 65, stderr: "Could not parse the document\n" });
diff --git a/apps/cli/src/commands/init/init.handler.ts b/apps/cli/src/commands/init/init.handler.ts
index 49fa0ca9a2..41218b3095 100644
--- a/apps/cli/src/commands/init/init.handler.ts
+++ b/apps/cli/src/commands/init/init.handler.ts
@@ -34,6 +34,12 @@ export const init = Effect.fn("init")(function* (flags: InitFlags) {
     withIntellijSettings: flags.withIntellijSettings,
     experimentalStack,
   });
+  yield* Effect.annotateCurrentSpan({
+    "init.created": result.created,
+    "init.force": flags.force,
+    "init.use_orioledb": flags.useOrioledb,
+    "init.experimental_stack": experimentalStack,
+  });
 
   if (!result.created) {
     // The path in this message is always the relative `supabase/config.toml`, regardless of
diff --git a/apps/cli/src/commands/inspect/db/inspect-query.ts b/apps/cli/src/commands/inspect/db/inspect-query.ts
index 6515a66d9a..da95ad27c7 100644
--- a/apps/cli/src/commands/inspect/db/inspect-query.ts
+++ b/apps/cli/src/commands/inspect/db/inspect-query.ts
@@ -136,7 +136,7 @@ export function inspectBacktickStmt(value: unknown): string {
  * connect (printing "Connecting to <local|remote> database..." to stderr), run the query, then
  * render the table — or, in `json`/`stream-json` mode, emit the raw driver rows instead.
  */
-export const runInspectQuery = Effect.fnUntraced(function* (
+export const runInspectQuery = Effect.fn("Inspect.runQuery")(function* (
   spec: InspectQuerySpec,
   flags: InspectConnectionFlags,
   dnsResolver: "native" | "https",
@@ -188,6 +188,7 @@ export const runInspectQuery = Effect.fnUntraced(function* (
       return yield* session.query(spec.sql, spec.params(cfg));
     }),
   );
+  yield* Effect.annotateCurrentSpan({ "query.row_count": rows.length });
 
   if (output.format === "text") {
     const cells = rows.map((row) => spec.project(row, cfg));
diff --git a/apps/cli/src/commands/inspect/inspect.layers.ts b/apps/cli/src/commands/inspect/inspect.layers.ts
index f132ef3c8f..0aa83ff2fb 100644
--- a/apps/cli/src/commands/inspect/inspect.layers.ts
+++ b/apps/cli/src/commands/inspect/inspect.layers.ts
@@ -2,7 +2,7 @@ import { Layer } from "effect";
 
 import { commandSettingsLayer } from "../../config/command-settings.layer.ts";
 import { dbConfigLayer } from "../../command-internal/db-config.layer.ts";
-import { dbConnectionLayer } from "../../command-internal/db-connection.layer.ts";
+import { dbConnectionLayer } from "../../command-internal/db-connection.sql-pg.layer.ts";
 import { identityStitchLayer } from "../../command-internal/identity-stitch.ts";
 import { debugLoggerLayer } from "../../command-internal/debug-logger.layer.ts";
 import { telemetryStateLayer } from "../../telemetry/telemetry-state.layer.ts";
diff --git a/apps/cli/src/commands/inspect/report/report.command.ts b/apps/cli/src/commands/inspect/report/report.command.ts
index 5d97d7a106..9e170de825 100644
--- a/apps/cli/src/commands/inspect/report/report.command.ts
+++ b/apps/cli/src/commands/inspect/report/report.command.ts
@@ -1,10 +1,12 @@
+import { Layer } from "effect";
 import { Command, Flag } from "effect/unstable/cli";
 import type * as CliCommand from "effect/unstable/cli/Command";
 
 import { withJsonErrorHandling } from "../../../shared/output/json-error-handling.ts";
+import { commandRuntimeLayer } from "../../../shared/runtime/command-runtime.layer.ts";
 import { withCommandTelemetry } from "../../../telemetry/command-telemetry.ts";
 import { inspectReport } from "./report.handler.ts";
-import { inspectReportRuntimeLayer } from "./report.layers.ts";
+import { inspectBaseLayer } from "../inspect.layers.ts";
 
 const config = {
   dbUrl: Flag.string("db-url").pipe(
@@ -52,5 +54,5 @@ export const inspectReportCommand = Command.make("report", config).pipe(
       withJsonErrorHandling,
     ),
   ),
-  Command.provide(inspectReportRuntimeLayer),
+  Command.provide(Layer.merge(inspectBaseLayer, commandRuntimeLayer(["inspect", "report"]))),
 );
diff --git a/apps/cli/src/commands/inspect/report/report.handler.ts b/apps/cli/src/commands/inspect/report/report.handler.ts
index cf2e87a45f..16e4957977 100644
--- a/apps/cli/src/commands/inspect/report/report.handler.ts
+++ b/apps/cli/src/commands/inspect/report/report.handler.ts
@@ -6,7 +6,6 @@ import { Output } from "../../../shared/output/output.service.ts";
 import { RuntimeInfo } from "../../../shared/runtime/runtime-info.service.ts";
 import { Tty } from "../../../shared/runtime/tty.service.ts";
 import { CommandSettings } from "../../../config/command-settings.service.ts";
-import { bold } from "../../../output/bold.ts";
 import { renderGlamourTable } from "../../../output/glamour-table.ts";
 import { DbConfigResolver } from "../../../command-internal/db-config.service.ts";
 import { DbConnection } from "../../../command-internal/db-connection.service.ts";
@@ -125,24 +124,33 @@ const runInspectReport = Effect.fnUntraced(function* (
       const session = yield* dbConn.connect(cfg.conn, { isLocal: cfg.isLocal, dnsResolver });
       if (isText) yield* output.raw("Running queries...\n", "stderr");
       for (const { fileName, sql } of REPORT_QUERIES) {
-        const bytes = yield* session.copyToCsv(wrapReportQuery(sql, ignoreSchemas, dbLiteral));
-        const filePath = path.join(outDir, `${fileName}.csv`);
-        yield* fs.writeFile(filePath, bytes, { mode: 0o644 }).pipe(
-          Effect.mapError(
-            (error) =>
-              new InspectReportWriteError({
-                message: `failed to create output file: ${error}`,
-              }),
-          ),
+        yield* Effect.gen(function* () {
+          const bytes = yield* session.copyToCsv(wrapReportQuery(sql, ignoreSchemas, dbLiteral));
+          yield* Effect.annotateCurrentSpan({ "csv.bytes": bytes.length });
+          const filePath = path.join(outDir, `${fileName}.csv`);
+          yield* fs.writeFile(filePath, bytes, { mode: 0o644 }).pipe(
+            Effect.mapError(
+              (error) =>
+                new InspectReportWriteError({
+                  message: `failed to create output file: ${error}`,
+                }),
+            ),
+          );
+          csvByFile.set(`${fileName}.csv`, bytes);
+          files.push({ name: fileName, path: filePath });
+        }).pipe(
+          Effect.withSpan("inspect.report.runQuery", {
+            attributes: { "inspect.query.name": fileName },
+          }),
         );
-        csvByFile.set(`${fileName}.csv`, bytes);
-        files.push({ name: fileName, path: filePath });
       }
     }),
   );
 
   if (isText) {
-    yield* output.raw(`Reports saved to ${bold(outDir, tty.stdoutIsTty)}\n`, "stderr");
+    // Bolding is keyed off stdout's TTY state even though this line goes to stderr.
+    const savedTo = tty.stdoutIsTty ? `\x1b[1m${outDir}\x1b[0m` : outDir;
+    yield* output.raw(`Reports saved to ${savedTo}\n`, "stderr");
   }
 
   // Custom rules (validated above) replace the defaults when present.
diff --git a/apps/cli/src/commands/inspect/report/report.layers.ts b/apps/cli/src/commands/inspect/report/report.layers.ts
deleted file mode 100644
index 90365c2728..0000000000
--- a/apps/cli/src/commands/inspect/report/report.layers.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-import { Layer } from "effect";
-
-import { commandRuntimeLayer } from "../../../shared/runtime/command-runtime.layer.ts";
-import { inspectBaseLayer } from "../inspect.layers.ts";
-
-/**
- * Runtime layer for `supabase inspect report`.
- *
- * `FileSystem` / `Path` / `Tty` / `RuntimeInfo` / `Clock` come from the global run harness
- * (`shared/cli/run.ts`), not here.
- */
-export const inspectReportRuntimeLayer = Layer.merge(
-  inspectBaseLayer,
-  commandRuntimeLayer(["inspect", "report"]),
-);
diff --git a/apps/cli/src/commands/issue/issue.integration.test.ts b/apps/cli/src/commands/issue/issue.integration.test.ts
index 8034a1d8ed..7909f0115e 100644
--- a/apps/cli/src/commands/issue/issue.integration.test.ts
+++ b/apps/cli/src/commands/issue/issue.integration.test.ts
@@ -113,9 +113,7 @@ function issueSetup(
     TelemetryRuntime,
     TelemetryRuntime.of({
       configDir: "/test/config",
-      tracesDir: "/test/config/traces",
       consent: "granted",
-      showDebug: false,
       deviceId: "device-id",
       sessionId: "session-id",
       identity: makeTelemetryIdentity(undefined),
diff --git a/apps/cli/src/commands/link/link.handler.ts b/apps/cli/src/commands/link/link.handler.ts
index 5a56ff300f..4fb7143a04 100644
--- a/apps/cli/src/commands/link/link.handler.ts
+++ b/apps/cli/src/commands/link/link.handler.ts
@@ -139,7 +139,7 @@ function linkBranchNotFoundMessage(
  * Uses the list endpoint (`GET /v1/projects/{ref}/branches`) rather than a single-branch lookup
  * so the full list can power the available-branches error enrichment below.
  */
-const resolveLinkBranchRef = Effect.fnUntraced(function* (value: string) {
+const resolveLinkBranchRef = Effect.fn("link.resolveBranch")(function* (value: string) {
   const output = yield* Output;
   const api = yield* CommandPlatformApi;
 
@@ -168,6 +168,10 @@ const resolveLinkBranchRef = Effect.fnUntraced(function* (value: string) {
     Effect.catch(mapBranchListError),
   );
   yield* task?.clear ?? Effect.void;
+  yield* Effect.annotateCurrentSpan({
+    "project.parent_ref": parentRef,
+    "branch.count": branches.length,
+  });
 
   const found: LinkBranch | undefined = branches.find(
     // UUID matching is case-insensitive (canonical ids are lowercase hex, but uppercase input
@@ -241,6 +245,10 @@ export const link = Effect.fn("link")(function* (flags: LinkFlags) {
 
     const ref = yield* resolver.resolveForLink(resolvedRefOrBranch);
     resolvedRef = ref;
+    yield* Effect.annotateCurrentSpan({
+      "project.ref": ref,
+      "link.via_branch": Option.isSome(branchResolution),
+    });
     const paths = tempPaths(path, cliSettings.workdir);
 
     const writeTempFile: WriteTempFile = (filePath, content) =>
@@ -252,6 +260,10 @@ export const link = Effect.fn("link")(function* (flags: LinkFlags) {
     const project = yield* api.v1
       .getProject({ ref })
       .pipe(Effect.asSome, Effect.catch(classifyProjectError));
+    yield* Effect.annotateCurrentSpan(
+      "project.status",
+      Option.isSome(project) ? project.value.status : "not_found",
+    );
 
     if (Option.isSome(project)) {
       const status = project.value.status;
@@ -394,6 +406,7 @@ export const link = Effect.fn("link")(function* (flags: LinkFlags) {
           Effect.map((branches) => branches.some((branch) => branch.project_ref === ref)),
           Effect.orElseSucceed(() => false),
           Effect.ensuring(correlating?.clear ?? Effect.void),
+          Effect.tap((result) => Effect.annotateCurrentSpan("link.parent_verified", result)),
         );
         if (!verified) {
           yield* fs.remove(paths.linkedProjectCache, { force: true }).pipe(Effect.ignore);
diff --git a/apps/cli/src/commands/migration/down/down.handler.ts b/apps/cli/src/commands/migration/down/down.handler.ts
index 06bd00771a..312183c4aa 100644
--- a/apps/cli/src/commands/migration/down/down.handler.ts
+++ b/apps/cli/src/commands/migration/down/down.handler.ts
@@ -117,6 +117,11 @@ const runDown = Effect.fnUntraced(function* (
 
         const version = remote[total - flags.last - 1]!;
         yield* output.raw(`Resetting database to version: ${version}\n`, "stderr");
+        yield* Effect.annotateCurrentSpan({
+          "db.is_local": cfg.isLocal,
+          "migration.version": version,
+          "migration.last": flags.last,
+        });
         yield* dropUserSchemas(session);
         yield* upsertVaultSecrets(session, toml.vault);
         yield* migrateAndSeed(session, fs, path, cliSettings.workdir, version, {
diff --git a/apps/cli/src/commands/migration/fetch/fetch.handler.ts b/apps/cli/src/commands/migration/fetch/fetch.handler.ts
index 2034d6a642..cea9ee3147 100644
--- a/apps/cli/src/commands/migration/fetch/fetch.handler.ts
+++ b/apps/cli/src/commands/migration/fetch/fetch.handler.ts
@@ -15,6 +15,7 @@ export const migrationFetch = Effect.fn("migration.fetch")(function* (flags: Mig
   const outcome = yield* runMigrationFetch({ flags, target, assumeYes: undefined }).pipe(
     Effect.ensuring(telemetryState.flush),
   );
+  yield* Effect.annotateCurrentSpan({ "file.count": outcome.files.length });
 
   // Silent on success in text mode.
   if (output.format !== "text") {
diff --git a/apps/cli/src/commands/migration/list/list.handler.ts b/apps/cli/src/commands/migration/list/list.handler.ts
index 0d7068d2f5..308e64ea7b 100644
--- a/apps/cli/src/commands/migration/list/list.handler.ts
+++ b/apps/cli/src/commands/migration/list/list.handler.ts
@@ -86,6 +86,10 @@ const runList = Effect.fnUntraced(function* (
     );
 
     const rows = makeMigrationListRows(remote, local);
+    yield* Effect.annotateCurrentSpan({
+      "db.is_local": cfg.isLocal,
+      "migration.count": rows.length,
+    });
     if (output.format === "text") {
       yield* output.raw(renderGlamourTable([...LIST_HEADERS], migrationListTableCells(rows)));
     } else {
diff --git a/apps/cli/src/commands/migration/migration.integration.test.ts b/apps/cli/src/commands/migration/migration.integration.test.ts
index 14bee8197a..ddc3a8b76c 100644
--- a/apps/cli/src/commands/migration/migration.integration.test.ts
+++ b/apps/cli/src/commands/migration/migration.integration.test.ts
@@ -33,7 +33,6 @@ describe("migration command integration", () => {
       CliOutput.layer(textCliOutputFormatter()),
       mockTelemetryRuntime({
         configDir: `${tmp.current}/.supabase`,
-        tracesDir: `${tmp.current}/.supabase/traces`,
       }),
     );
     // No subcommand is proxied, so the plural alias is proven at the parser:
diff --git a/apps/cli/src/commands/migration/migration.layers.ts b/apps/cli/src/commands/migration/migration.layers.ts
index e9cebc6e59..564fc9115f 100644
--- a/apps/cli/src/commands/migration/migration.layers.ts
+++ b/apps/cli/src/commands/migration/migration.layers.ts
@@ -5,7 +5,7 @@ import { commandRuntimeLayer } from "../../shared/runtime/command-runtime.layer.
 import { stdinLayer } from "../../shared/runtime/stdin.layer.ts";
 import { commandSettingsLayer } from "../../config/command-settings.layer.ts";
 import { dbConfigLayer } from "../../command-internal/db-config.layer.ts";
-import { dbConnectionLayer } from "../../command-internal/db-connection.layer.ts";
+import { dbConnectionLayer } from "../../command-internal/db-connection.sql-pg.layer.ts";
 import { debugLoggerLayer } from "../../command-internal/debug-logger.layer.ts";
 import { dockerRunLayer } from "../../command-internal/docker-run.layer.ts";
 import { identityStitchLayer } from "../../command-internal/identity-stitch.ts";
diff --git a/apps/cli/src/commands/migration/new/new.handler.ts b/apps/cli/src/commands/migration/new/new.handler.ts
index 95a68cf461..502c1b2258 100644
--- a/apps/cli/src/commands/migration/new/new.handler.ts
+++ b/apps/cli/src/commands/migration/new/new.handler.ts
@@ -26,6 +26,7 @@ export const migrationNew = Effect.fn("migration.new")(function* (flags: Migrati
   const path = yield* Path.Path;
 
   yield* Effect.gen(function* () {
+    yield* Effect.annotateCurrentSpan({ "migration.stdin_piped": !stdin.isTTY });
     const timestamp = formatMigrationTimestamp(yield* Clock.currentTimeMillis);
     const migrationPath = getMigrationPath(
       path,
diff --git a/apps/cli/src/commands/migration/repair/repair.handler.ts b/apps/cli/src/commands/migration/repair/repair.handler.ts
index 0ef0bd0163..530168638f 100644
--- a/apps/cli/src/commands/migration/repair/repair.handler.ts
+++ b/apps/cli/src/commands/migration/repair/repair.handler.ts
@@ -49,7 +49,7 @@ export interface MigrationRepairInput {
 }
 
 /** Creates the migration table, then runs one batch transaction. */
-const updateMigrationTable = Effect.fnUntraced(function* (
+const updateMigrationTable = Effect.fn("MigrationRepair.updateMigrationTable")(function* (
   session: DbSession,
   fs: FileSystem.FileSystem,
   path: Path.Path,
@@ -153,6 +153,12 @@ const runRepair = Effect.fnUntraced(function* (
     password: input.password,
     linkedProjectRef: input.projectRef,
   });
+  yield* Effect.annotateCurrentSpan({
+    "db.conn_type": connType,
+    "db.is_local": cfg.isLocal,
+    "migration.repair_all": repairAll,
+    "migration.status": input.status,
+  });
 
   // Loads after the flag-group check above, so a flag conflict surfaces before any
   // .env read; a SUPABASE_YES set only in supabase/.env still auto-confirms the
diff --git a/apps/cli/src/commands/migration/squash/squash.dump.ts b/apps/cli/src/commands/migration/squash/squash.dump.ts
index 2b53782217..17035741ac 100644
--- a/apps/cli/src/commands/migration/squash/squash.dump.ts
+++ b/apps/cli/src/commands/migration/squash/squash.dump.ts
@@ -41,7 +41,9 @@ export interface SquashDumpParams<E> {
  * with `WithSchema("auth","storage")`, and a third, unrestricted call for the final
  * full dump written straight to the target migration file.
  */
-export const squashDumpSchema = Effect.fnUntraced(function* <E>(params: SquashDumpParams<E>) {
+export const squashDumpSchema = Effect.fn("MigrationSquash.dumpSchema")(function* <E>(
+  params: SquashDumpParams<E>,
+) {
   const opt: DumpOptions = {
     schema: params.schema,
     keepComments: false,
@@ -73,21 +75,23 @@ export const squashDumpSchema = Effect.fnUntraced(function* <E>(params: SquashDu
  * straight to the target migration file's own handle at constant memory
  * (`squash.handler.ts`'s `squashMigrations`).
  */
-export const squashDumpSchemaToString = Effect.fnUntraced(function* (params: {
-  readonly image: string;
-  readonly conn: PgConnInput;
-  readonly schema: ReadonlyArray<string>;
-  readonly projectEnvValues?: Readonly<Record<string, string>>;
-  readonly client?: PgDumpClient;
-}) {
-  const chunks: Array<Uint8Array> = [];
-  yield* squashDumpSchema({
-    image: params.image,
-    conn: params.conn,
-    schema: params.schema,
-    onStdout: (chunk) => Effect.sync(() => chunks.push(chunk)),
-    projectEnvValues: params.projectEnvValues,
-    client: params.client,
-  });
-  return new TextDecoder().decode(Buffer.concat(chunks));
-});
+export const squashDumpSchemaToString = Effect.fn("MigrationSquash.dumpSchemaToString")(
+  function* (params: {
+    readonly image: string;
+    readonly conn: PgConnInput;
+    readonly schema: ReadonlyArray<string>;
+    readonly projectEnvValues?: Readonly<Record<string, string>>;
+    readonly client?: PgDumpClient;
+  }) {
+    const chunks: Array<Uint8Array> = [];
+    yield* squashDumpSchema({
+      image: params.image,
+      conn: params.conn,
+      schema: params.schema,
+      onStdout: (chunk) => Effect.sync(() => chunks.push(chunk)),
+      projectEnvValues: params.projectEnvValues,
+      client: params.client,
+    });
+    return new TextDecoder().decode(Buffer.concat(chunks));
+  },
+);
diff --git a/apps/cli/src/commands/migration/squash/squash.handler.ts b/apps/cli/src/commands/migration/squash/squash.handler.ts
index e9e2e461b1..3005397104 100644
--- a/apps/cli/src/commands/migration/squash/squash.handler.ts
+++ b/apps/cli/src/commands/migration/squash/squash.handler.ts
@@ -84,7 +84,7 @@ type Spawner = ChildProcessSpawnerType["Service"];
  * creation, so a SIGINT during the health-wait lands immediately from a single
  * cancellable scope.
  */
-const squashMigrations = Effect.fnUntraced(function* (
+const squashMigrations = Effect.fn("MigrationSquash.squashMigrations")(function* (
   spawner: Spawner,
   fs: FileSystem.FileSystem,
   path: Path.Path,
@@ -319,7 +319,7 @@ interface SquashToVersionResult {
  * the last into the shadow-produced dump, then removes the merged files. A removal
  * failure is non-fatal: only printed to stderr, then continues.
  */
-const squashToVersion = Effect.fnUntraced(function* (
+const squashToVersion = Effect.fn("MigrationSquash.squashToVersion")(function* (
   spawner: Spawner,
   fs: FileSystem.FileSystem,
   path: Path.Path,
@@ -331,6 +331,7 @@ const squashToVersion = Effect.fnUntraced(function* (
 ) {
   const output = yield* Output;
   const migrations = yield* loadPartialMigrations(fs, path, migrationsDir, version);
+  yield* Effect.annotateCurrentSpan({ "migration.count": migrations.length });
   if (migrations.length === 0) {
     return yield* new MigrationSquashMissingVersionError({ message: "version not found" });
   }
@@ -383,7 +384,7 @@ const squashToVersion = Effect.fnUntraced(function* (
  * the "Baselining…" banner before connecting, then deletes every history row `<=
  * version` and inserts the target migration's row in one transaction.
  */
-const baselineMigrations = Effect.fnUntraced(function* (
+const baselineMigrations = Effect.fn("MigrationSquash.baselineMigrations")(function* (
   fs: FileSystem.FileSystem,
   path: Path.Path,
   migrationsDir: string,
@@ -534,6 +535,7 @@ const runSquash = Effect.fnUntraced(function* (
       linkedRef = Option.getOrUndefined(cfg.ref ?? Option.none());
     }
     if (linkedRef !== undefined) linkedRefForCache = linkedRef;
+    yield* Effect.annotateCurrentSpan({ "db.conn_type": connType, "db.is_local": cfg.isLocal });
 
     // Loads after the flag-group check above, so a flag conflict surfaces before any
     // .env read; a SUPABASE_YES set only in supabase/.env still auto-confirms the
diff --git a/apps/cli/src/commands/migration/squash/squash.native.integration.test.ts b/apps/cli/src/commands/migration/squash/squash.native.integration.test.ts
index db17d0494a..88ebe11339 100644
--- a/apps/cli/src/commands/migration/squash/squash.native.integration.test.ts
+++ b/apps/cli/src/commands/migration/squash/squash.native.integration.test.ts
@@ -18,7 +18,7 @@ import {
   YesFlag,
 } from "../../../command-internal/global-flags.ts";
 import { DbConfigResolver } from "../../../command-internal/db-config.service.ts";
-import { dbConnectionLayer } from "../../../command-internal/db-connection.layer.ts";
+import { dbConnectionLayer } from "../../../command-internal/db-connection.sql-pg.layer.ts";
 import { DebugLogger } from "../../../command-internal/debug-logger.service.ts";
 import { DockerRun } from "../../../command-internal/docker-run.service.ts";
 import { StackApi, stackApiLayer } from "../../../command-internal/stack-api.ts";
diff --git a/apps/cli/src/commands/migration/up/up.handler.ts b/apps/cli/src/commands/migration/up/up.handler.ts
index 14dfe33933..4803aeb53b 100644
--- a/apps/cli/src/commands/migration/up/up.handler.ts
+++ b/apps/cli/src/commands/migration/up/up.handler.ts
@@ -70,6 +70,10 @@ const runUp = Effect.fnUntraced(function* (
     });
     const ref = Option.getOrUndefined(cfg.ref ?? Option.none());
     const toml = yield* readDbToml(fs, path, cliSettings.workdir, ref);
+    yield* Effect.annotateCurrentSpan({
+      "db.conn_type": target.connType ?? "local",
+      "db.is_local": cfg.isLocal,
+    });
 
     yield* Effect.scoped(
       Effect.gen(function* () {
@@ -116,6 +120,7 @@ const runUp = Effect.fnUntraced(function* (
 
         yield* upsertVaultSecrets(session, toml.vault);
 
+        yield* Effect.annotateCurrentSpan({ "migration.count": pending.length });
         for (const migrationPath of pending) {
           yield* output.raw(`Applying migration ${path.basename(migrationPath)}...\n`, "stderr");
           yield* applyMigrationFile(
diff --git a/apps/cli/src/commands/network-bans/network-bans.experimental-gate.integration.test.ts b/apps/cli/src/commands/network-bans/network-bans.experimental-gate.integration.test.ts
index f3069fb42b..cf3f664712 100644
--- a/apps/cli/src/commands/network-bans/network-bans.experimental-gate.integration.test.ts
+++ b/apps/cli/src/commands/network-bans/network-bans.experimental-gate.integration.test.ts
@@ -46,7 +46,6 @@ function setup() {
     CliOutput.layer(textCliOutputFormatter()),
     mockTelemetryRuntime({
       configDir: `${tempRoot.current}/.supabase`,
-      tracesDir: `${tempRoot.current}/.supabase/traces`,
     }),
   );
   return { layer, api };
diff --git a/apps/cli/src/commands/network-restrictions/network-restrictions.experimental-gate.integration.test.ts b/apps/cli/src/commands/network-restrictions/network-restrictions.experimental-gate.integration.test.ts
index ea44dbc30a..fabfda57b0 100644
--- a/apps/cli/src/commands/network-restrictions/network-restrictions.experimental-gate.integration.test.ts
+++ b/apps/cli/src/commands/network-restrictions/network-restrictions.experimental-gate.integration.test.ts
@@ -55,9 +55,7 @@ function setup() {
       TelemetryRuntime,
       TelemetryRuntime.of({
         configDir: `${tempRoot.current}/.supabase`,
-        tracesDir: `${tempRoot.current}/.supabase/traces`,
         consent: "granted",
-        showDebug: false,
         deviceId: "test-device-id",
         sessionId: "test-session-id",
         identity: makeTelemetryIdentity(undefined),
diff --git a/apps/cli/src/commands/network-restrictions/update/update.handler.ts b/apps/cli/src/commands/network-restrictions/update/update.handler.ts
index 4617ed42b6..8d2edab27b 100644
--- a/apps/cli/src/commands/network-restrictions/update/update.handler.ts
+++ b/apps/cli/src/commands/network-restrictions/update/update.handler.ts
@@ -74,6 +74,12 @@ export const networkRestrictionsUpdate = Effect.fn("network-restrictions.update"
         | typeof V1UpdateNetworkRestrictionsOutput.Type
         | typeof V1PatchNetworkRestrictionsOutput.Type;
 
+      yield* Effect.annotateCurrentSpan({
+        "network_restrictions.strategy": flags.append ? "append" : "replace",
+        "network_restrictions.cidr_v4_count": v4.length,
+        "network_restrictions.cidr_v6_count": v6.length,
+      });
+
       if (flags.append) {
         const response = yield* api.v1
           .patchNetworkRestrictions({
diff --git a/apps/cli/src/commands/notebooks/pull/pull.handler.ts b/apps/cli/src/commands/notebooks/pull/pull.handler.ts
index c726998aa3..16f1319dc7 100644
--- a/apps/cli/src/commands/notebooks/pull/pull.handler.ts
+++ b/apps/cli/src/commands/notebooks/pull/pull.handler.ts
@@ -132,6 +132,14 @@ export const notebooksPull = Effect.fn("notebooks.pull")(function* (flags: Noteb
         }
       }
 
+      yield* Effect.annotateCurrentSpan({
+        "notebook.pulled_count": pulled.length,
+        "notebook.preserved_count": preserved.length,
+        "notebook.created_count": pushed.length,
+        "notebook.deleted_count": deleted.length,
+        "notebook.skipped_count": skipped,
+      });
+
       const payload = {
         project_ref: ref,
         notebooks_dir: dir,
diff --git a/apps/cli/src/commands/notebooks/push/push.handler.ts b/apps/cli/src/commands/notebooks/push/push.handler.ts
index 7c98814902..fcedd7acbe 100644
--- a/apps/cli/src/commands/notebooks/push/push.handler.ts
+++ b/apps/cli/src/commands/notebooks/push/push.handler.ts
@@ -141,6 +141,13 @@ export const notebooksPush = Effect.fn("notebooks.push")(function* (flags: Noteb
         pulled.push(notebook.name);
       }
 
+      yield* Effect.annotateCurrentSpan({
+        "notebook.created_count": created.length,
+        "notebook.updated_count": updated.length,
+        "notebook.deleted_count": deleted.length,
+        "notebook.pulled_count": pulled.length,
+      });
+
       const payload = {
         project_ref: ref,
         notebooks_dir: dir,
diff --git a/apps/cli/src/commands/postgres-config/postgres-config.experimental-gate.integration.test.ts b/apps/cli/src/commands/postgres-config/postgres-config.experimental-gate.integration.test.ts
index 3641fcef94..0b5b214aca 100644
--- a/apps/cli/src/commands/postgres-config/postgres-config.experimental-gate.integration.test.ts
+++ b/apps/cli/src/commands/postgres-config/postgres-config.experimental-gate.integration.test.ts
@@ -47,7 +47,6 @@ function setup() {
     CliOutput.layer(textCliOutputFormatter()),
     mockTelemetryRuntime({
       configDir: `${tempRoot.current}/.supabase`,
-      tracesDir: `${tempRoot.current}/.supabase/traces`,
     }),
   );
   return { layer, api };
diff --git a/apps/cli/src/commands/projects/create/create.integration.test.ts b/apps/cli/src/commands/projects/create/create.integration.test.ts
index 5caa0e25bd..8acbb041c8 100644
--- a/apps/cli/src/commands/projects/create/create.integration.test.ts
+++ b/apps/cli/src/commands/projects/create/create.integration.test.ts
@@ -607,7 +607,6 @@ describe("projects create integration", () => {
       CliOutput.layer(textCliOutputFormatter()),
       mockTelemetryRuntime({
         configDir: `${tempRoot.current}/.supabase`,
-        tracesDir: `${tempRoot.current}/.supabase/traces`,
       }),
     );
 
diff --git a/apps/cli/src/commands/projects/projects.format.ts b/apps/cli/src/commands/projects/projects.format.ts
index 188d3d997a..aa459166d2 100644
--- a/apps/cli/src/commands/projects/projects.format.ts
+++ b/apps/cli/src/commands/projects/projects.format.ts
@@ -2,6 +2,7 @@ import type { ApiKeyResponse_Output } from "@supabase/api/effect";
 
 import { renderGlamourTable } from "../../output/glamour-table.ts";
 import { apiKeyValue } from "../../command-internal/api-keys.format.ts";
+import { formatRegion } from "../../command-internal/region.format.ts";
 import { formatTimestamp } from "../../command-internal/timestamp.format.ts";
 
 type ApiKey = typeof ApiKeyResponse_Output.Type;
@@ -20,34 +21,6 @@ export function readProjectField(project: unknown, key: string): string {
   return typeof value === "string" ? value : "";
 }
 
-// Region display names: known region codes render as a human-readable name;
-// unknown codes pass through unchanged.
-
-const REGION_MAP: Readonly<Record<string, string>> = {
-  "ap-east-1": "East Asia (Hong Kong)",
-  "ap-northeast-1": "Northeast Asia (Tokyo)",
-  "ap-northeast-2": "Northeast Asia (Seoul)",
-  "ap-south-1": "South Asia (Mumbai)",
-  "ap-southeast-1": "Southeast Asia (Singapore)",
-  "ap-southeast-2": "Oceania (Sydney)",
-  "ca-central-1": "Canada (Central)",
-  "eu-central-1": "Central EU (Frankfurt)",
-  "eu-central-2": "Central Europe (Zurich)",
-  "eu-north-1": "North EU (Stockholm)",
-  "eu-west-1": "West EU (Ireland)",
-  "eu-west-2": "West Europe (London)",
-  "eu-west-3": "West EU (Paris)",
-  "sa-east-1": "South America (São Paulo)",
-  "us-east-1": "East US (North Virginia)",
-  "us-east-2": "East US (Ohio)",
-  "us-west-1": "West US (North California)",
-  "us-west-2": "West US (Oregon)",
-};
-
-export function formatRegion(region: string): string {
-  return REGION_MAP[region] ?? region;
-}
-
 // Dashboard URL per profile. Defaults to the production dashboard for
 // unknown / file-based profiles.
 
diff --git a/apps/cli/src/commands/projects/projects.format.unit.test.ts b/apps/cli/src/commands/projects/projects.format.unit.test.ts
index 0dbe0c69f2..676325079c 100644
--- a/apps/cli/src/commands/projects/projects.format.unit.test.ts
+++ b/apps/cli/src/commands/projects/projects.format.unit.test.ts
@@ -5,7 +5,6 @@ import { apiKeyValue, apiKeysToEnv } from "../../command-internal/api-keys.forma
 import {
   type LinkedProject,
   dashboardUrlForProfile,
-  formatRegion,
   renderProjectApiKeysTable,
   renderProjectCreateTable,
   renderProjectsListTable,
@@ -44,17 +43,6 @@ const CREATED: CreatedProject = {
   status: "COMING_UP",
 };
 
-describe("formatRegion", () => {
-  it("maps a known region code to its display name", () => {
-    expect(formatRegion("us-east-1")).toBe("East US (North Virginia)");
-    expect(formatRegion("ap-southeast-2")).toBe("Oceania (Sydney)");
-  });
-
-  it("passes an unknown region code through unchanged", () => {
-    expect(formatRegion("mars-west-9")).toBe("mars-west-9");
-  });
-});
-
 describe("dashboardUrlForProfile", () => {
   it("resolves the built-in profile dashboard URLs", () => {
     expect(dashboardUrlForProfile("supabase")).toBe("https://supabase.com/dashboard");
diff --git a/apps/cli/src/commands/projects/projects.prompt.ts b/apps/cli/src/commands/projects/projects.prompt.ts
index d792d12a77..859700baca 100644
--- a/apps/cli/src/commands/projects/projects.prompt.ts
+++ b/apps/cli/src/commands/projects/projects.prompt.ts
@@ -10,7 +10,7 @@ import {
   ProjectsOrgsListNetworkError,
   ProjectsOrgsListUnexpectedStatusError,
 } from "./projects.errors.ts";
-import { formatRegion } from "./projects.format.ts";
+import { formatRegion } from "../../command-internal/region.format.ts";
 
 const mapOrgsListError = mapHttpError({
   networkError: ProjectsOrgsListNetworkError,
diff --git a/apps/cli/src/commands/pull/pull.handler.ts b/apps/cli/src/commands/pull/pull.handler.ts
index 27ae257773..25ab439b2c 100644
--- a/apps/cli/src/commands/pull/pull.handler.ts
+++ b/apps/cli/src/commands/pull/pull.handler.ts
@@ -224,21 +224,20 @@ export const pull = Effect.fn("pull")(function* (flags: PullFlags) {
 
     // Resolves the pull target exactly once; every sub-step below targets `ref` directly
     // instead of re-resolving (ADR 0024).
-    const source = yield* openConfigPullSource();
-    const { ref, branch } = yield* resolveConfigTarget(
-      requested,
-      pullTargetErrors,
-      mapBranchResolveError,
-    );
-    resolvedRef = ref;
-
-    // `planConfigPullRun` does everything up through the schema-validation gate: no git check,
-    // no prompt, no write.
-    const runPlan = yield* planConfigPullRun({
-      target: { ref, branch },
-      remoteLabel,
-      source,
-    });
+    const { ref, branch, runPlan, source } = yield* Effect.gen(function* () {
+      const pullSource = yield* openConfigPullSource();
+      const target = yield* resolveConfigTarget(requested, pullTargetErrors, mapBranchResolveError);
+      resolvedRef = target.ref;
+
+      // `planConfigPullRun` does everything up through the schema-validation gate: no git
+      // check, no prompt, no write.
+      const plan = yield* planConfigPullRun({
+        target,
+        remoteLabel,
+        source: pullSource,
+      });
+      return { ref: target.ref, branch: target.branch, runPlan: plan, source: pullSource };
+    }).pipe(Effect.withSpan("pull.resolveTarget"));
 
     // Retry hints below use the planned remote destination's label, not the raw `remoteLabel`
     // flag: for a branch-derived implicit target, that's the `[remotes.<branch>]` block the
@@ -408,91 +407,95 @@ export const pull = Effect.fn("pull")(function* (flags: PullFlags) {
     // Each step is failure-isolated: one failing doesn't stop the rest from running and being
     // reported.
     const stepContext: PullStepContext = { ref, assumeYes: true };
-    let firstFailureCause: Cause.Cause<PullStepFailureCause> | undefined;
-    const results: Array<PullStepResult> = [];
+    const { results, firstFailureCause } = yield* Effect.gen(function* () {
+      let firstFailureCause: Cause.Cause<PullStepFailureCause> | undefined;
+      const results: Array<PullStepResult> = [];
+
+      const configCapture = yield* pullCaptureStep(pullConfigStep({ runPlan, source }));
+      if (configCapture.kind === "ok") {
+        results.push(
+          pullConfigStepResult(
+            // `pullConfigStep` returns the plan's absolute `configFilePath`; overridden here to
+            // the workdir-relative path, matching the dry-run/declined branches above.
+            { ...configCapture.value, configFilePath: runPlan.context.configPath },
+            configPullPayloadFor(runPlan, { dryRun: false, declined: false }),
+          ),
+        );
+      } else {
+        results.push(
+          pullWithRetryHint(
+            pullFailedStepResult("config", Cause.squash(configCapture.cause)),
+            ref,
+            plannedRemoteLabel,
+          ),
+        );
+        firstFailureCause = configCapture.cause;
+      }
 
-    const configCapture = yield* pullCaptureStep(pullConfigStep({ runPlan, source }));
-    if (configCapture.kind === "ok") {
-      results.push(
-        pullConfigStepResult(
-          // `pullConfigStep` returns the plan's absolute `configFilePath`; overridden here to
-          // the workdir-relative path, matching the dry-run/declined branches above.
-          { ...configCapture.value, configFilePath: runPlan.context.configPath },
-          configPullPayloadFor(runPlan, { dryRun: false, declined: false }),
-        ),
+      const migrationCapture = yield* pullCaptureStep(
+        shouldFetchMigrationHistory
+          ? pullMigrationHistoryStep(stepContext)
+          : Effect.succeed<PullMigrationHistoryStepOutcome>({
+              kind: "skipped",
+              reason: "not_needed",
+            }),
       );
-    } else {
-      results.push(
-        pullWithRetryHint(
-          pullFailedStepResult("config", Cause.squash(configCapture.cause)),
-          ref,
-          plannedRemoteLabel,
-        ),
-      );
-      firstFailureCause = configCapture.cause;
-    }
-
-    const migrationCapture = yield* pullCaptureStep(
-      shouldFetchMigrationHistory
-        ? pullMigrationHistoryStep(stepContext)
-        : Effect.succeed<PullMigrationHistoryStepOutcome>({
-            kind: "skipped",
-            reason: "not_needed",
-          }),
-    );
-    if (migrationCapture.kind === "ok") {
-      results.push(pullMigrationHistoryStepResult(migrationCapture.value));
-    } else {
-      results.push(
-        pullWithRetryHint(
-          pullFailedStepResult(
-            "migration_history",
-            Cause.squash(migrationCapture.cause),
-            cliSettings.workdir,
+      if (migrationCapture.kind === "ok") {
+        results.push(pullMigrationHistoryStepResult(migrationCapture.value));
+      } else {
+        results.push(
+          pullWithRetryHint(
+            pullFailedStepResult(
+              "migration_history",
+              Cause.squash(migrationCapture.cause),
+              cliSettings.workdir,
+            ),
+            ref,
+            plannedRemoteLabel,
           ),
-          ref,
-          plannedRemoteLabel,
-        ),
-      );
-      firstFailureCause ??= migrationCapture.cause;
-    }
+        );
+        firstFailureCause ??= migrationCapture.cause;
+      }
 
-    const dbCapture = yield* pullCaptureStep(pullDbStep(stepContext));
-    if (dbCapture.kind === "ok") {
-      results.push(pullDbStepResult(dbCapture.value));
-    } else {
-      results.push(
-        pullWithRetryHint(
-          pullDbStepFailureResult(
-            Cause.squash(dbCapture.cause),
+      const dbCapture = yield* pullCaptureStep(pullDbStep(stepContext));
+      if (dbCapture.kind === "ok") {
+        results.push(pullDbStepResult(dbCapture.value));
+      } else {
+        results.push(
+          pullWithRetryHint(
+            pullDbStepFailureResult(
+              Cause.squash(dbCapture.cause),
+              ref,
+              plannedRemoteLabel,
+              cliSettings.workdir,
+            ),
             ref,
             plannedRemoteLabel,
-            cliSettings.workdir,
           ),
-          ref,
-          plannedRemoteLabel,
-        ),
-      );
-      firstFailureCause ??= dbCapture.cause;
-    }
+        );
+        firstFailureCause ??= dbCapture.cause;
+      }
 
-    const functionsCapture = yield* pullCaptureStep(pullFunctionsStep(stepContext));
-    if (functionsCapture.kind === "ok") {
-      results.push(pullFunctionsStepResult(functionsCapture.value));
-    } else {
-      results.push(
-        pullWithRetryHint(
-          pullFailedStepResult(
-            "functions",
-            Cause.squash(functionsCapture.cause),
-            cliSettings.workdir,
+      const functionsCapture = yield* pullCaptureStep(pullFunctionsStep(stepContext));
+      if (functionsCapture.kind === "ok") {
+        results.push(pullFunctionsStepResult(functionsCapture.value));
+      } else {
+        results.push(
+          pullWithRetryHint(
+            pullFailedStepResult(
+              "functions",
+              Cause.squash(functionsCapture.cause),
+              cliSettings.workdir,
+            ),
+            ref,
+            plannedRemoteLabel,
           ),
-          ref,
-          plannedRemoteLabel,
-        ),
-      );
-      firstFailureCause ??= functionsCapture.cause;
-    }
+        );
+        firstFailureCause ??= functionsCapture.cause;
+      }
+
+      return { results, firstFailureCause };
+    }).pipe(Effect.withSpan("pull.runSteps"));
 
     const aggregate = pullAggregate({
       ref,
diff --git a/apps/cli/src/commands/secrets/set/set.handler.ts b/apps/cli/src/commands/secrets/set/set.handler.ts
index 690690bed3..879bd030b9 100644
--- a/apps/cli/src/commands/secrets/set/set.handler.ts
+++ b/apps/cli/src/commands/secrets/set/set.handler.ts
@@ -266,6 +266,11 @@ export const secretsSet = Effect.fn("secrets.set")(function* (flags: SecretsSetF
       batches.push(body.slice(i, i + SECRETS_PER_REQUEST));
     }
 
+    yield* Effect.annotateCurrentSpan({
+      "secret.count": body.length,
+      "secret.batch_count": batches.length,
+    });
+
     // Validated up front so a schema-invalid entry in a later batch can't leave the project
     // partially updated after earlier batches already uploaded.
     yield* Effect.forEach(
diff --git a/apps/cli/src/commands/secrets/unset/unset.handler.ts b/apps/cli/src/commands/secrets/unset/unset.handler.ts
index e39fe9d3cc..ccc1f462ac 100644
--- a/apps/cli/src/commands/secrets/unset/unset.handler.ts
+++ b/apps/cli/src/commands/secrets/unset/unset.handler.ts
@@ -74,6 +74,8 @@ export const secretsUnset = Effect.fn("secrets.unset")(function* (flags: Secrets
       return yield* new SecretsUnsetCancelledError({ message: CONTEXT_CANCELED_MESSAGE });
     }
 
+    yield* Effect.annotateCurrentSpan({ "secret.count": names.length });
+
     const unsetting =
       output.format === "text" ? yield* output.task("Unsetting secrets...") : undefined;
     yield* api.v1.bulkDeleteSecrets({ ref, body: names }).pipe(
diff --git a/apps/cli/src/commands/seed/buckets/buckets.flags.ts b/apps/cli/src/commands/seed/buckets/buckets.flags.ts
index 4a6b8a8342..f731fac0bf 100644
--- a/apps/cli/src/commands/seed/buckets/buckets.flags.ts
+++ b/apps/cli/src/commands/seed/buckets/buckets.flags.ts
@@ -3,15 +3,6 @@ import { Effect } from "effect";
 import { changedLinkedLocalFlags } from "../../../command-internal/db-target-flags.ts";
 import { SeedMutuallyExclusiveFlagsError } from "./buckets.errors.ts";
 
-/**
- * Detects which of `--local` / `--linked` were explicitly set on argv,
- * delegating to the shared linked/local scanner also used by `storage`. The
- * seed target is selected from this changed set, not the parsed flag value.
- */
-export function seedChangedTargetFlags(args: ReadonlyArray<string>): ReadonlyArray<string> {
-  return changedLinkedLocalFlags(args);
-}
-
 /**
  * Rejects `--local` and `--linked` set together. Must run before
  * `withCommandTelemetry` so the rejection doesn't emit `cli_command_executed`.
@@ -23,7 +14,7 @@ export function seedChangedTargetFlags(args: ReadonlyArray<string>): ReadonlyArr
 export const assertSeedTargetsExclusive = Effect.fnUntraced(function* (
   args: ReadonlyArray<string>,
 ) {
-  const setFlags = seedChangedTargetFlags(args);
+  const setFlags = changedLinkedLocalFlags(args);
   if (setFlags.length > 1) {
     return yield* new SeedMutuallyExclusiveFlagsError({
       message: `if any flags in the group [local linked] are set none of the others can be; [${setFlags.join(" ")}] were all set`,
diff --git a/apps/cli/src/commands/seed/buckets/buckets.flags.unit.test.ts b/apps/cli/src/commands/seed/buckets/buckets.flags.unit.test.ts
index f69959ed60..ae83ee007d 100644
--- a/apps/cli/src/commands/seed/buckets/buckets.flags.unit.test.ts
+++ b/apps/cli/src/commands/seed/buckets/buckets.flags.unit.test.ts
@@ -1,50 +1,7 @@
 import { describe, expect, it } from "vitest";
 import { Effect, Exit } from "effect";
 
-import { assertSeedTargetsExclusive, seedChangedTargetFlags } from "./buckets.flags.ts";
-
-describe("seedChangedTargetFlags", () => {
-  it("returns both selectors in cobra's sorted order when both are set", () => {
-    expect(seedChangedTargetFlags(["seed", "buckets", "--local", "--linked"])).toEqual([
-      "linked",
-      "local",
-    ]);
-  });
-
-  it("returns a single selector", () => {
-    expect(seedChangedTargetFlags(["seed", "buckets", "--linked"])).toEqual(["linked"]);
-    expect(seedChangedTargetFlags(["seed", "buckets", "--local"])).toEqual(["local"]);
-  });
-
-  it("returns nothing when neither is set", () => {
-    expect(seedChangedTargetFlags(["seed", "buckets"])).toEqual([]);
-  });
-
-  it("does not treat a value-consuming flag's value as a selector", () => {
-    expect(seedChangedTargetFlags(["seed", "buckets", "--workdir", "--linked"])).toEqual([]);
-  });
-
-  it("skips the value token after a short value-consuming flag", () => {
-    expect(seedChangedTargetFlags(["-o", "--linked", "--local"])).toEqual(["local"]);
-  });
-
-  it("stops scanning at the -- terminator", () => {
-    expect(seedChangedTargetFlags(["seed", "buckets", "--", "--local", "--linked"])).toEqual([]);
-  });
-
-  it("handles = forms", () => {
-    expect(seedChangedTargetFlags(["--local=true", "--linked=false"])).toEqual(["linked", "local"]);
-  });
-
-  it("treats the --no-* negation form as changed (Effect CLI boolean negation)", () => {
-    expect(seedChangedTargetFlags(["seed", "buckets", "--no-linked"])).toEqual(["linked"]);
-    expect(seedChangedTargetFlags(["seed", "buckets", "--no-local"])).toEqual(["local"]);
-    expect(seedChangedTargetFlags(["seed", "buckets", "--no-local", "--linked"])).toEqual([
-      "linked",
-      "local",
-    ]);
-  });
-});
+import { assertSeedTargetsExclusive } from "./buckets.flags.ts";
 
 describe("assertSeedTargetsExclusive", () => {
   it("fails when both --local and --linked are set (cobra mutual exclusivity)", () => {
diff --git a/apps/cli/src/commands/seed/buckets/buckets.handler.ts b/apps/cli/src/commands/seed/buckets/buckets.handler.ts
index 2404fa7c81..6f35f9183f 100644
--- a/apps/cli/src/commands/seed/buckets/buckets.handler.ts
+++ b/apps/cli/src/commands/seed/buckets/buckets.handler.ts
@@ -3,12 +3,12 @@ import { Effect, FileSystem, Option } from "effect";
 import { CliArgs } from "../../../shared/cli/cli-args.service.ts";
 import { CommandSettings } from "../../../config/command-settings.service.ts";
 import { ProjectRefResolver } from "../../../config/project-ref.service.ts";
+import { changedLinkedLocalFlags } from "../../../command-internal/db-target-flags.ts";
 import { seedBucketsRun } from "../../../command-internal/seed-buckets.ts";
 import { requireExplicitWorkdirProject } from "../../../command-internal/workdir-project.ts";
 import { validateWorkdirIsDirectory } from "../../../command-internal/workdir-validation.ts";
 import { LinkedProjectCache } from "../../../telemetry/linked-project-cache.service.ts";
 import { TelemetryState } from "../../../telemetry/telemetry-state.service.ts";
-import { seedChangedTargetFlags } from "./buckets.flags.ts";
 import type { BucketsFlags } from "./buckets.command.ts";
 import {
   SeedMissingProjectConfigError,
@@ -47,7 +47,7 @@ export const seedBuckets = Effect.fn("seed.buckets")(function* (
     // matching `[remotes.<name>]` override (whose `project_id == ref`) is
     // merged over the base config by `loadCliConfig`. `--linked` selects the
     // linked path whenever it's set, even `--linked=false`.
-    const setFlags = seedChangedTargetFlags(cliArgs.args);
+    const setFlags = changedLinkedLocalFlags(cliArgs.args);
     const isLinked = setFlags.includes("linked");
 
     // `--project-ref` never implies `--linked` and must not be silently
@@ -72,6 +72,7 @@ export const seedBuckets = Effect.fn("seed.buckets")(function* (
     const projectRef = isLinked ? yield* projectRefResolver.loadProjectRef(flags.projectRef) : "";
     linkedRef = projectRef;
 
+    yield* Effect.annotateCurrentSpan({ "db.conn_type": isLinked ? "linked" : "local" });
     yield* seedBucketsRun({ projectRef, emitSummary: true });
   }).pipe(
     // Caches the linked project and fires org/project group identify — only
diff --git a/apps/cli/src/commands/seed/seed.command.ts b/apps/cli/src/commands/seed/seed.command.ts
index 806190392d..345a25fe5a 100644
--- a/apps/cli/src/commands/seed/seed.command.ts
+++ b/apps/cli/src/commands/seed/seed.command.ts
@@ -6,8 +6,9 @@ import { SeedLinkedFlag, SeedLocalFlag } from "./seed.flags.ts";
 export const seedCommand = Command.make("seed").pipe(
   Command.withDescription("Seed a Supabase project from supabase/config.toml."),
   Command.withShortDescription("Seed a Supabase project"),
+  Command.withSubcommands([bucketsCommand]),
   // Persistent `--linked`/`--local` (Go `seedCmd.PersistentFlags()`), accepted
-  // before or after the subcommand. See `seed.flags.ts`.
+  // before or after the subcommand. See `seed.flags.ts`. Kept after
+  // `withSubcommands` so it discharges the subcommands' flag requirements.
   Command.withGlobalFlags([SeedLinkedFlag, SeedLocalFlag]),
-  Command.withSubcommands([bucketsCommand]),
 );
diff --git a/apps/cli/src/commands/services/services-local-stack.ts b/apps/cli/src/commands/services/services-local-stack.ts
index 7a37515ff9..4658efcdaf 100644
--- a/apps/cli/src/commands/services/services-local-stack.ts
+++ b/apps/cli/src/commands/services/services-local-stack.ts
@@ -41,6 +41,7 @@ export const stackServiceVersions = Effect.fn("services.stackServiceVersions")(f
     if (Result.isFailure(resolvedMajor)) configError = resolvedMajor.failure;
     else major = resolvedMajor.success;
   }
+  yield* Effect.annotateCurrentSpan({ "config.load_failed": configError !== undefined });
   return yield* Effect.forEach(artifactServiceKinds(), (service) =>
     Effect.gen(function* () {
       const artifact = yield* resolveArtifact({
diff --git a/apps/cli/src/commands/services/services.handler.ts b/apps/cli/src/commands/services/services.handler.ts
index 4cee002ec2..c19092ff51 100644
--- a/apps/cli/src/commands/services/services.handler.ts
+++ b/apps/cli/src/commands/services/services.handler.ts
@@ -106,6 +106,10 @@ export const services = Effect.fn("services")(function* (_flags: ServicesFlags)
 
     const validLinkedRef = Option.filter(linkedProjectRef, (ref) => PROJECT_REF_PATTERN.test(ref));
     const backend = yield* currentStackBackend;
+    yield* Effect.annotateCurrentSpan({
+      "stack.backend": backend.kind,
+      "project.linked": Option.isSome(validLinkedRef),
+    });
     if (Option.isSome(linkedProjectRef) && Option.isNone(validLinkedRef)) {
       // A malformed linked ref still warns, but the remote call is skipped:
       // `fetchLinkedServiceVersions` embeds the ref unescaped into the tenant
@@ -142,6 +146,7 @@ export const services = Effect.fn("services")(function* (_flags: ServicesFlags)
         cliSettings.workdir,
         Option.getOrUndefined(linkedProjectRef),
       ).pipe(
+        Effect.withSpan("services.readConfig"),
         Effect.catch((error) =>
           output.raw(`${formatConfigLoadError(error)}\n`, "stderr").pipe(Effect.as(null)),
         ),
@@ -197,6 +202,8 @@ export const services = Effect.fn("services")(function* (_flags: ServicesFlags)
       }
     }
 
+    yield* Effect.annotateCurrentSpan({ "service.count": rows.length });
+
     const warning = renderServicesWarning(
       rows,
       backend.kind === "stack"
diff --git a/apps/cli/src/commands/services/services.integration.test.ts b/apps/cli/src/commands/services/services.integration.test.ts
index 839a972d36..1cdebc41ca 100644
--- a/apps/cli/src/commands/services/services.integration.test.ts
+++ b/apps/cli/src/commands/services/services.integration.test.ts
@@ -277,9 +277,7 @@ describe("services", () => {
           TelemetryRuntime,
           TelemetryRuntime.of({
             configDir: path.join(workdir, ".supabase"),
-            tracesDir: path.join(workdir, ".supabase", "traces"),
             consent: "granted",
-            showDebug: false,
             deviceId: "test-device-id",
             sessionId: "test-session-id",
             identity: makeTelemetryIdentity(undefined),
@@ -355,7 +353,7 @@ describe("services", () => {
 
       const rows = yield* decodeServiceRows(out.stdoutText);
       expect(out.stderrText).toBe("");
-      expect(rows).toHaveLength(13);
+      expect(rows).toHaveLength(12);
       expect(rows).toContainEqual(
         expect.objectContaining({
           name: "ghcr.io/supabase/cli/postgres",
@@ -370,13 +368,11 @@ describe("services", () => {
       );
       expect(rows).toContainEqual(
         expect.objectContaining({
-          name: "ghcr.io/supabase/cli/vector",
-          local: catalogUpstreamVersion("vector"),
+          name: "ghcr.io/supabase/cli/storage",
+          local: catalogUpstreamVersion("storage"),
         }),
       );
-      expect(rows).toContainEqual(
-        expect.objectContaining({ name: "ghcr.io/supabase/cli/storage", local: "v1.79.28" }),
-      );
+      expect(rows.map((row) => row.name)).not.toContain("ghcr.io/supabase/cli/vector");
     }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
   );
 
diff --git a/apps/cli/src/commands/ssl-enforcement/ssl-enforcement.experimental-gate.integration.test.ts b/apps/cli/src/commands/ssl-enforcement/ssl-enforcement.experimental-gate.integration.test.ts
index 7e15bb4d97..5af6fba114 100644
--- a/apps/cli/src/commands/ssl-enforcement/ssl-enforcement.experimental-gate.integration.test.ts
+++ b/apps/cli/src/commands/ssl-enforcement/ssl-enforcement.experimental-gate.integration.test.ts
@@ -48,7 +48,6 @@ function setup() {
     CliOutput.layer(textCliOutputFormatter()),
     mockTelemetryRuntime({
       configDir: `${tempRoot.current}/.supabase`,
-      tracesDir: `${tempRoot.current}/.supabase/traces`,
     }),
   );
   return { layer, api };
diff --git a/apps/cli/src/commands/sso/add/add.handler.ts b/apps/cli/src/commands/sso/add/add.handler.ts
index 39519f7a1d..3d7674777c 100644
--- a/apps/cli/src/commands/sso/add/add.handler.ts
+++ b/apps/cli/src/commands/sso/add/add.handler.ts
@@ -193,6 +193,15 @@ export const ssoAdd = Effect.fn("sso.add")(function* (flags: SsoAddFlags) {
     // every auxiliary call alike.
     const apiUrl = Option.getOrElse(profileApiUrl, () => cliSettings.apiUrl);
 
+    yield* Effect.annotateCurrentSpan({
+      "sso.metadata_source": Option.isSome(metadataFile)
+        ? "file"
+        : Option.isSome(metadataUrl)
+          ? "url"
+          : "none",
+      "sso.domain_count": domains.length,
+    });
+
     yield* Effect.gen(function* () {
       // Posted as raw JSON, not the generated schema, so unlisted
       // `attribute_mapping.keys.<x>` fields (e.g. `default`) survive.
diff --git a/apps/cli/src/commands/sso/sso.metadata-url.ts b/apps/cli/src/commands/sso/sso.metadata-url.ts
index 9cbff1b0b1..0675df5b7e 100644
--- a/apps/cli/src/commands/sso/sso.metadata-url.ts
+++ b/apps/cli/src/commands/sso/sso.metadata-url.ts
@@ -35,77 +35,72 @@ const METADATA_URL_MAX_BYTES = 5 * 1024 * 1024;
  * error[.]` suffix — the trailing punctuation differs between `create`
  * (no period) and `update` (period).
  */
-export const validateMetadataUrl = (
+export const validateMetadataUrl = Effect.fn("Sso.validateMetadataUrl")(function* (
   metadataUrl: string,
-): Effect.Effect<
-  void,
-  SsoMetadataUrlInvalidError | SsoMetadataUrlNetworkError | SsoMetadataUrlNonUtf8Error,
-  HttpClient.HttpClient
-> =>
-  Effect.gen(function* () {
-    const parsed = yield* Effect.try({
-      try: () => new URL(metadataUrl),
-      catch: (cause) =>
-        new SsoMetadataUrlInvalidError({
-          message: `failed to parse metadata uri ${quoteSsoString(metadataUrl)}: ${String(cause)}`,
-        }),
-    });
-
-    // URL.protocol is already lowercased, so a direct compare against
-    // "https:" is safe.
-    if (parsed.protocol !== "https:") {
-      return yield* new SsoMetadataUrlInvalidError({
-        message: "only HTTPS Metadata URLs are supported",
-      });
-    }
-
-    const httpClient = yield* HttpClient.HttpClient;
-    const request = HttpClientRequest.get(metadataUrl).pipe(
-      HttpClientRequest.setHeader("Accept", "application/xml"),
-    );
-
-    const response = yield* httpClient.execute(request).pipe(
-      // Refuse redirects so the HTTPS-only guard above can't be sidestepped via 3xx → http://internal/.
-      Effect.provideService(FetchHttpClient.RequestInit, { redirect: "error" }),
-      Effect.timeout(METADATA_URL_TIMEOUT),
-      Effect.catchTags({
-        TimeoutError: () =>
-          Effect.fail(
-            new SsoMetadataUrlNetworkError({ message: "failed to fetch metadata url: timeout" }),
-          ),
-        HttpClientError: (cause) =>
-          Effect.fail(
-            new SsoMetadataUrlNetworkError({
-              message: `failed to fetch metadata url: ${String(cause)}`,
-            }),
-          ),
+) {
+  const parsed = yield* Effect.try({
+    try: () => new URL(metadataUrl),
+    catch: (cause) =>
+      new SsoMetadataUrlInvalidError({
+        message: `failed to parse metadata uri ${quoteSsoString(metadataUrl)}: ${String(cause)}`,
       }),
-    );
+  });
+
+  // URL.protocol is already lowercased, so a direct compare against
+  // "https:" is safe.
+  if (parsed.protocol !== "https:") {
+    return yield* new SsoMetadataUrlInvalidError({
+      message: "only HTTPS Metadata URLs are supported",
+    });
+  }
 
-    if (response.status !== 200) {
-      return yield* new SsoMetadataUrlNetworkError({
-        message: `unexpected metadata url status: ${response.status}`,
-      });
-    }
+  const httpClient = yield* HttpClient.HttpClient;
+  const request = HttpClientRequest.get(metadataUrl).pipe(
+    HttpClientRequest.setHeader("Accept", "application/xml"),
+  );
 
-    const arrayBuffer = yield* response.arrayBuffer.pipe(
-      Effect.mapError(
-        (cause) =>
+  const response = yield* httpClient.execute(request).pipe(
+    // Refuse redirects so the HTTPS-only guard above can't be sidestepped via 3xx → http://internal/.
+    Effect.provideService(FetchHttpClient.RequestInit, { redirect: "error" }),
+    Effect.timeout(METADATA_URL_TIMEOUT),
+    Effect.catchTags({
+      TimeoutError: () =>
+        Effect.fail(
+          new SsoMetadataUrlNetworkError({ message: "failed to fetch metadata url: timeout" }),
+        ),
+      HttpClientError: (cause) =>
+        Effect.fail(
           new SsoMetadataUrlNetworkError({
-            message: `failed to read http response: ${String(cause)}`,
+            message: `failed to fetch metadata url: ${String(cause)}`,
           }),
-      ),
-    );
+        ),
+    }),
+  );
 
-    if (arrayBuffer.byteLength > METADATA_URL_MAX_BYTES) {
-      return yield* new SsoMetadataUrlNetworkError({
-        message: `metadata url response exceeds maximum allowed size (${METADATA_URL_MAX_BYTES} bytes)`,
-      });
-    }
+  if (response.status !== 200) {
+    return yield* new SsoMetadataUrlNetworkError({
+      message: `unexpected metadata url status: ${response.status}`,
+    });
+  }
 
-    yield* validateMetadataXmlBytes(
-      new Uint8Array(arrayBuffer),
-      metadataUrl,
-      (args) => new SsoMetadataUrlNonUtf8Error({ message: args.message }),
-    );
-  });
+  const arrayBuffer = yield* response.arrayBuffer.pipe(
+    Effect.mapError(
+      (cause) =>
+        new SsoMetadataUrlNetworkError({
+          message: `failed to read http response: ${String(cause)}`,
+        }),
+    ),
+  );
+
+  if (arrayBuffer.byteLength > METADATA_URL_MAX_BYTES) {
+    return yield* new SsoMetadataUrlNetworkError({
+      message: `metadata url response exceeds maximum allowed size (${METADATA_URL_MAX_BYTES} bytes)`,
+    });
+  }
+
+  yield* validateMetadataXmlBytes(
+    new Uint8Array(arrayBuffer),
+    metadataUrl,
+    (args) => new SsoMetadataUrlNonUtf8Error({ message: args.message }),
+  );
+});
diff --git a/apps/cli/src/commands/sso/sso.string-slice-flags.integration.test.ts b/apps/cli/src/commands/sso/sso.string-slice-flags.integration.test.ts
index 190bcbeea3..75d0c76844 100644
--- a/apps/cli/src/commands/sso/sso.string-slice-flags.integration.test.ts
+++ b/apps/cli/src/commands/sso/sso.string-slice-flags.integration.test.ts
@@ -51,9 +51,7 @@ function setup() {
       TelemetryRuntime,
       TelemetryRuntime.of({
         configDir: `${tempRoot.current}/.supabase`,
-        tracesDir: `${tempRoot.current}/.supabase/traces`,
         consent: "granted",
-        showDebug: false,
         deviceId: "test-device-id",
         sessionId: "test-session-id",
         identity: makeTelemetryIdentity(undefined),
diff --git a/apps/cli/src/commands/sso/update/update.handler.ts b/apps/cli/src/commands/sso/update/update.handler.ts
index 6d9f91b37b..3f32371153 100644
--- a/apps/cli/src/commands/sso/update/update.handler.ts
+++ b/apps/cli/src/commands/sso/update/update.handler.ts
@@ -296,6 +296,15 @@ export const ssoUpdate = Effect.fn("sso.update")(function* (flags: SsoUpdateFlag
     // `--profile`, otherwise the config layer's.
     const apiUrl = Option.getOrElse(profileApiUrl, () => cliSettings.apiUrl);
 
+    yield* Effect.annotateCurrentSpan({
+      "sso.metadata_source": Option.isSome(metadataFile)
+        ? "file"
+        : Option.isSome(metadataUrl)
+          ? "url"
+          : "none",
+      "sso.domain_count": domains.length + addDomains.length + removeDomains.length,
+    });
+
     yield* Effect.gen(function* () {
       const fetching =
         output.format === "text" ? yield* output.task("Updating SSO provider...") : undefined;
diff --git a/apps/cli/src/commands/start/services/edge-runtime.service.ts b/apps/cli/src/commands/start/services/edge-runtime.service.ts
index f71c79e3db..1ce2cb047a 100644
--- a/apps/cli/src/commands/start/services/edge-runtime.service.ts
+++ b/apps/cli/src/commands/start/services/edge-runtime.service.ts
@@ -93,6 +93,10 @@ export interface EdgeRuntimeBringUpInput {
 export const startStackEdgeRuntimeContainer = Effect.fn("start.edgeRuntime")(function* (
   input: EdgeRuntimeBringUpInput,
 ) {
+  yield* Effect.annotateCurrentSpan({
+    "image.name": input.image,
+    "function.count": Object.keys(input.configFunctions).length,
+  });
   return yield* startEdgeRuntimeContainer({
     config: {
       projectId: input.projectId,
diff --git a/apps/cli/src/commands/start/services/vector.service.ts b/apps/cli/src/commands/start/services/vector.service.ts
index ec49dab78b..a04c710670 100644
--- a/apps/cli/src/commands/start/services/vector.service.ts
+++ b/apps/cli/src/commands/start/services/vector.service.ts
@@ -18,6 +18,7 @@ import {
   slimWgetHealthcheck,
   slimWgetWaitCommand,
 } from "../../../command-internal/db-bootstrap/slim-runtime.ts";
+import { withChildTraceEnv, withProcessSpanScoped } from "../../../shared/telemetry/spans.ts";
 import { usesSlimImageRuntime } from "../../../shared/services/slim-images.ts";
 import { platformDefaultDockerHost } from "../../../command-internal/hostname.ts";
 import { renderStartVectorYaml } from "../lib/template-render.ts";
@@ -168,15 +169,19 @@ function collectText<E, R>(stream: Stream.Stream<Uint8Array, E, R>) {
 function inspectDockerContextHost(spawner: Spawner): Effect.Effect<string, string> {
   return Effect.scoped(
     Effect.gen(function* () {
-      const child = yield* spawner
-        .spawn(
-          ChildProcess.make(
-            "docker",
-            ["context", "inspect", "--format", "{{ .Endpoints.docker.Host }}"],
-            { stdin: "ignore", stdout: "pipe", stderr: "ignore" },
+      const args = ["context", "inspect", "--format", "{{ .Endpoints.docker.Host }}"];
+      const child = yield* withProcessSpanScoped(
+        "Vector.inspectDockerContext",
+        { executable: "docker", argCount: args.length },
+        (traceEnv) =>
+          spawner.spawn(
+            ChildProcess.make(
+              "docker",
+              args,
+              withChildTraceEnv({ stdin: "ignore", stdout: "pipe", stderr: "ignore" }, traceEnv),
+            ),
           ),
-        )
-        .pipe(Effect.mapError(() => "failed to spawn docker"));
+      ).pipe(Effect.mapError(() => "failed to spawn docker"));
       const [exitCode, stdout] = yield* Effect.all(
         [child.exitCode.pipe(Effect.map(Number)), collectText(child.stdout)],
         { concurrency: "unbounded" },
@@ -222,14 +227,9 @@ const VECTOR_HEALTHCHECK = {
 } as const;
 
 /**
- * Creates `/etc/vector` (absent from Vector 0.58's images, both slim and upstream), writes the
- * rendered `vector.yaml` via a `cat <<'EOF'` heredoc, waits on Logflare's `/health` (sinks would
- * otherwise start too early), then `exec`s Vector so it stays PID 1. A TERM trap covers the wait
- * so `docker stop` does not burn 10s if Logflare is still down; `-T 2` bounds each probe so a hung
- * health endpoint can't defer the trap. Slim Vector ships BusyBox wget, so the wait uses
- * `-q --spider` instead of GNU's `--no-verbose --tries`. Both images run as root, so `mkdir -p`
- * needs no separate ownership handling, and `/var/lib/vector` (the `docker_logs` source's
- * checkpoint `data_dir`) already exists in both.
+ * Vector 0.58's images (slim and upstream) have no `/etc/vector`, so the script creates it. The
+ * TERM trap keeps `docker stop` fast while Logflare's `/health` is still down, and `-T 2` bounds
+ * each probe so a hung endpoint can't defer the trap.
  */
 export function buildVectorEntrypointScript(
   vectorYaml: string,
diff --git a/apps/cli/src/commands/start/start.command.ts b/apps/cli/src/commands/start/start.command.ts
index 1047256290..184970f1ca 100644
--- a/apps/cli/src/commands/start/start.command.ts
+++ b/apps/cli/src/commands/start/start.command.ts
@@ -9,7 +9,7 @@ import { commandCredentialsLayer } from "../../auth/command-credentials.layer.ts
 import { commandPlatformApiFactoryLayer } from "../../auth/command-platform-api-factory.layer.ts";
 import { httpClientLayer } from "../../auth/http-debug.layer.ts";
 import { commandSettingsLayer } from "../../config/command-settings.layer.ts";
-import { dbConnectionLayer } from "../../command-internal/db-connection.layer.ts";
+import { dbConnectionLayer } from "../../command-internal/db-connection.sql-pg.layer.ts";
 import { debugLoggerLayer } from "../../command-internal/debug-logger.layer.ts";
 import { dockerRunLayer } from "../../command-internal/docker-run.layer.ts";
 import { identityStitchLayer } from "../../command-internal/identity-stitch.ts";
diff --git a/apps/cli/src/commands/start/start.handler.ts b/apps/cli/src/commands/start/start.handler.ts
index 6c2e52d394..20d6842ab5 100644
--- a/apps/cli/src/commands/start/start.handler.ts
+++ b/apps/cli/src/commands/start/start.handler.ts
@@ -360,7 +360,7 @@ const readKongEmailTemplateContent = Effect.fnUntraced(function* (
  * Skips (never throws for) an entry whose resolver returns `undefined`, defensively, even though
  * that should be unreachable since Kong's set is built from configured entries.
  */
-const resolveKongEmailTemplateMounts = Effect.fnUntraced(function* (
+const resolveKongEmailTemplateMounts = Effect.fn("start.resolveEmailTemplateMounts")(function* (
   email: ResolvedAuthEmail,
   workdir: string,
   fs: FileSystem.FileSystem,
@@ -398,6 +398,7 @@ const resolveKongEmailTemplateMounts = Effect.fnUntraced(function* (
     yield* readKongEmailTemplateContent("notification", id, resolvedPath, fs);
     mounts.push({ id: `${id}_notification`, resolvedPath, notification: true });
   }
+  yield* Effect.annotateCurrentSpan({ "email_template.count": mounts.length });
   return mounts;
 });
 
@@ -439,6 +440,10 @@ export const start = Effect.fn("start")(function* (flags: StartFlags) {
       yield* output.raw(partition.warning, "stderr");
     }
     const excludedKeys = new Set(partition.valid);
+    yield* Effect.annotateCurrentSpan({
+      "start.excluded_count": excludedKeys.size,
+      "start.ignore_health_check": flags.ignoreHealthCheck,
+    });
 
     // 2. Config load + validate — same config-load/env/project-id
     // resolution sequence as `stop`/`status`.
@@ -588,7 +593,9 @@ export const start = Effect.fn("start")(function* (flags: StartFlags) {
     // `SUPABASE_DB_SEED_ENABLED` or an undecryptable `[db.vault]` secret would go unvalidated
     // whenever `start` reuses an existing volume instead of provisioning a fresh one.
     // `startSetupLocalDatabase` still resolves its own fresh-setup values independently when it runs.
-    const dbTomlValues = yield* checkDbToml(fs, path, cliSettings.workdir);
+    const dbTomlValues = yield* checkDbToml(fs, path, cliSettings.workdir).pipe(
+      Effect.withSpan("start.validateDbConfig"),
+    );
 
     const dbContainerId = localDbContainerId(projectId);
     const filterValue = cliProjectFilterValue(projectId);
@@ -634,6 +641,13 @@ export const start = Effect.fn("start")(function* (flags: StartFlags) {
       Effect.catch((error) =>
         isContainerNotFoundMessage(error.message) ? Effect.void : Effect.fail(error),
       ),
+      Effect.tap((state) =>
+        Effect.annotateCurrentSpan({
+          "db.exists": state !== undefined,
+          ...(state !== undefined && { "db.status": state.status, "db.running": state.running }),
+        }),
+      ),
+      Effect.withSpan("start.inspectDb"),
     );
     const dbState = yield* inspectDbState;
     const isRecoverableStoppedState = (
@@ -642,8 +656,12 @@ export const start = Effect.fn("start")(function* (flags: StartFlags) {
       // `created` may own a just-provisioned volume that Postgres never initialized.
       state?.running === false && state.status.length > 0 && state.status !== "created";
     const shouldRecoverStoppedStack = isRecoverableStoppedState(dbState) && !inBitbucketPipeline;
+    yield* Effect.annotateCurrentSpan({
+      "start.already_running": dbState !== undefined && !shouldRecoverStoppedStack,
+      "start.recover_stopped_stack": shouldRecoverStoppedStack,
+    });
 
-    const reportAlreadyRunningStatus = Effect.fnUntraced(function* () {
+    const reportAlreadyRunningStatus = Effect.fn("start.reportAlreadyRunning")(function* () {
       // Gated on text mode for consistency with every other supplementary stderr line this
       // handler prints — json/stream-json callers get a clean structured payload with no noise.
       if (output.format === "text") {
@@ -676,6 +694,7 @@ export const start = Effect.fn("start")(function* (flags: StartFlags) {
       const runningSet = new Set(runningNames);
       const serviceIds = serviceContainerIds(projectId);
       const stopped = serviceIds.filter((id) => !runningSet.has(id));
+      yield* Effect.annotateCurrentSpan({ "service.stopped_count": stopped.length });
       // Unconditional here — stderr text, never corrupts a JSON stdout payload.
       if (stopped.length > 0) {
         yield* output.raw(`Stopped services: [${stopped.join(" ")}]\n`, "stderr");
@@ -753,7 +772,7 @@ export const start = Effect.fn("start")(function* (flags: StartFlags) {
       path,
       { config, projectEnvValues, workdir: cliSettings.workdir },
       (message) => new StartInvalidConfigError({ message }),
-    );
+    ).pipe(Effect.withSpan("start.resolveBootstrapConfig"));
 
     // 7. Resolve every image that will actually be pulled before any container is created.
     const slim = yield* slimImagesEnabled;
@@ -797,7 +816,11 @@ export const start = Effect.fn("start")(function* (flags: StartFlags) {
       // Climbing ancestors again here could let an unrelated ancestor project's
       // `supabase/functions` win when `--workdir` points at a subdirectory with no config of its own.
       search: false,
-    });
+    }).pipe(
+      Effect.tap((functions) =>
+        Effect.annotateCurrentSpan({ "function.count": Object.keys(functions).length }),
+      ),
+    );
     const rawConfigFunctions = rawFunctionConfigRecord(context.loaded?.document);
     // Resolve once during preflight so a missing function source cannot fail only after stopped
     // containers have been removed. Studio consumes the cached binds later during bring-up.
@@ -1676,6 +1699,10 @@ export const start = Effect.fn("start")(function* (flags: StartFlags) {
         Effect.ensuring(
           Effect.suspend(() => cleanupStartSecrets(removedContainers, cliSettings.workdir)),
         ),
+        Effect.tap(() =>
+          Effect.annotateCurrentSpan({ "container.removed_count": removedContainers.length }),
+        ),
+        Effect.withSpan("start.recoverStoppedStack"),
       );
     }
 
@@ -1785,7 +1812,7 @@ export const start = Effect.fn("start")(function* (flags: StartFlags) {
                     document: context.loaded?.document,
                   },
                   projectEnvValues,
-                }).pipe(Effect.result);
+                }).pipe(Effect.withSpan("start.seedBuckets"), Effect.result);
                 if (Result.isFailure(seedResult)) {
                   // No manual `rollbackStart` here — the outer
                   // `Effect.onError` below rolls back on this failure too.
@@ -1821,7 +1848,7 @@ export const start = Effect.fn("start")(function* (flags: StartFlags) {
               document: context.loaded?.document,
             },
             projectEnvValues,
-          });
+          }).pipe(Effect.withSpan("start.seedBuckets"));
         }
 
         // 11. Fires `cli_stack_started` exactly once, only on success. Sits after the entire
diff --git a/apps/cli/src/commands/start/start.slim-images.e2e.test.ts b/apps/cli/src/commands/start/start.slim-images.e2e.test.ts
index 2a44aacfb3..86419c7502 100644
--- a/apps/cli/src/commands/start/start.slim-images.e2e.test.ts
+++ b/apps/cli/src/commands/start/start.slim-images.e2e.test.ts
@@ -2,7 +2,7 @@ import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/unstable/
 import { BunServices } from "@effect/platform-bun";
 import { Clock, Data, Effect, FileSystem, Layer, Path, Schema } from "effect";
 import { beforeAll, describe, expect, it } from "@effect/vitest";
-import { catalogPins, type ServiceKind } from "@supabase/stack/internal/artifacts";
+import { catalogPins, type ArtifactKind } from "@supabase/stack/internal/artifacts";
 
 import { dockerfileServiceImageRaw } from "../../shared/services/dockerfile-images.ts";
 import { isSlimImageRef, toSlimImage } from "../../shared/services/slim-images.ts";
@@ -73,7 +73,7 @@ const PULL_ALIASES = [
  * Dockerfile-derived image: whether the Dockerfile's tag currently matches that catalog pin is
  * unrelated to whether the pinned slim image itself accepts the BusyBox argv).
  */
-const WGET_PROBE_SERVICES: ReadonlyArray<ServiceKind> = [
+const WGET_PROBE_SERVICES: ReadonlyArray<ArtifactKind> = [
   "auth",
   "realtime",
   "storage",
@@ -313,6 +313,11 @@ describe("supabase start slim images (e2e)", () => {
           env: { ...DOCKER_IO_ENV, SUPABASE_YES: "1" },
         });
         requireCliSuccess(created, "functions new");
+        // The template imports from live jsr/npm; new.stack.e2e.test.ts covers that resolution.
+        yield* fs.writeFileString(
+          path.join(projectDir, "supabase", "functions", "hello", "index.ts"),
+          'Deno.serve(async (req) => Response.json({ message: "Hello " + (await req.json()).name + "!" }));\n',
+        );
         yield* overridePorts(projectDir);
         const config = yield* fs.readFileString(path.join(projectDir, "supabase", "config.toml"));
         const apiPort = readSectionPort(config, "api");
diff --git a/apps/cli/src/commands/start/start.string-slice-flags.integration.test.ts b/apps/cli/src/commands/start/start.string-slice-flags.integration.test.ts
index 9633110cd2..b44e722b95 100644
--- a/apps/cli/src/commands/start/start.string-slice-flags.integration.test.ts
+++ b/apps/cli/src/commands/start/start.string-slice-flags.integration.test.ts
@@ -50,9 +50,7 @@ function setup() {
       TelemetryRuntime,
       TelemetryRuntime.of({
         configDir: `${tempRoot.current}/.supabase`,
-        tracesDir: `${tempRoot.current}/.supabase/traces`,
         consent: "granted",
-        showDebug: false,
         deviceId: "test-device-id",
         sessionId: "test-session-id",
         identity: makeTelemetryIdentity(undefined),
diff --git a/apps/cli/src/commands/status/status.handler.ts b/apps/cli/src/commands/status/status.handler.ts
index 64398e536d..e2da29c5aa 100644
--- a/apps/cli/src/commands/status/status.handler.ts
+++ b/apps/cli/src/commands/status/status.handler.ts
@@ -28,7 +28,10 @@ import {
   linkedStateJsonField,
   resolveLinkedState,
 } from "../../command-internal/linked-state.ts";
-import { loadLocalProjectContext } from "../../command-internal/local-project-context.ts";
+import {
+  loadLocalProjectContext,
+  recordLocalProjectOrioleDbTelemetry,
+} from "../../command-internal/local-project-context.ts";
 import {
   StatusConfigLoadError,
   StatusDbInspectError,
@@ -136,6 +139,7 @@ export const status = Effect.fn("status")(function* (flags: StatusFlags) {
       cliSettings.workdir,
       (message) => new StatusConfigLoadError({ message }),
     );
+    yield* recordLocalProjectOrioleDbTelemetry(context);
 
     // 3. Config validation runs entirely before the health check/container listing below, so a
     // config error (`InvalidJwtSecretError`, a malformed `SUPABASE_*_PORT`/`_ENABLED` override, a
@@ -167,6 +171,14 @@ export const status = Effect.fn("status")(function* (flags: StatusFlags) {
     if (!flags.ignoreHealthCheck) {
       const state = yield* inspectContainerState(spawner, dbContainerId).pipe(
         Effect.mapError((cause) => new StatusDbInspectError({ message: cause.message })),
+        Effect.tap((inspected) =>
+          Effect.annotateCurrentSpan({
+            "db.status": inspected.status,
+            "db.running": inspected.running,
+            ...(inspected.health !== undefined && { "db.health": inspected.health }),
+          }),
+        ),
+        Effect.withSpan("status.inspectDb"),
       );
       if (!state.running) {
         return yield* new StatusDbNotRunningError({
@@ -187,10 +199,18 @@ export const status = Effect.fn("status")(function* (flags: StatusFlags) {
       projectIdFilter: filterValue,
       all: false,
       format: "names",
-    }).pipe(Effect.mapError((cause) => new StatusListError({ message: cause.message })));
+    }).pipe(
+      Effect.mapError((cause) => new StatusListError({ message: cause.message })),
+      Effect.withSpan("status.listContainers"),
+    );
     const runningSet = new Set(runningNames);
     const serviceIds = serviceContainerIds(projectId);
     const stopped = serviceIds.filter((id) => !runningSet.has(id));
+    yield* Effect.annotateCurrentSpan({
+      "service.running_count": serviceIds.length - stopped.length,
+      "service.stopped_count": stopped.length,
+      "status.ignore_health_check": flags.ignoreHealthCheck,
+    });
     if (stopped.length > 0) {
       yield* output.raw(`Stopped services: ${formatGoStringSlice(stopped)}\n`, "stderr");
     }
diff --git a/apps/cli/src/commands/status/status.integration.test.ts b/apps/cli/src/commands/status/status.integration.test.ts
index f075882cd0..c6fb090829 100644
--- a/apps/cli/src/commands/status/status.integration.test.ts
+++ b/apps/cli/src/commands/status/status.integration.test.ts
@@ -1028,6 +1028,21 @@ content_path = "./supabase/templates/password_changed_notification.html"
     }).pipe(Effect.provide(layer));
   });
 
+  it.live("prints API_URL but no REST_URL with -o env when [api] enabled = false", () => {
+    const { layer, out } = setup({
+      goOutput: Option.some("env"),
+      route: defaultRoute({
+        runningNames: ALL_RUNNING_NAMES.filter((name) => !name.includes("_rest_")),
+      }),
+    });
+    return Effect.gen(function* () {
+      yield* writeConfig('project_id = "demo"\n[api]\nenabled = false\n');
+      yield* status(flags());
+      expect(out.stdoutText).toContain('API_URL="http://127.0.0.1:54321"');
+      expect(out.stdoutText).not.toContain("REST_URL=");
+    }).pipe(Effect.provide(layer));
+  });
+
   it.live("outputs a json object with -o json", () => {
     const { layer, out } = setup({ goOutput: Option.some("json") });
     return Effect.gen(function* () {
diff --git a/apps/cli/src/commands/status/status.string-slice-flags.integration.test.ts b/apps/cli/src/commands/status/status.string-slice-flags.integration.test.ts
index d6dc6811b8..a34e0415a4 100644
--- a/apps/cli/src/commands/status/status.string-slice-flags.integration.test.ts
+++ b/apps/cli/src/commands/status/status.string-slice-flags.integration.test.ts
@@ -48,9 +48,7 @@ function setup() {
       TelemetryRuntime,
       TelemetryRuntime.of({
         configDir: `${tempRoot.current}/.supabase`,
-        tracesDir: `${tempRoot.current}/.supabase/traces`,
         consent: "granted",
-        showDebug: false,
         deviceId: "test-device-id",
         sessionId: "test-session-id",
         identity: makeTelemetryIdentity(undefined),
diff --git a/apps/cli/src/commands/stop/stop.handler.ts b/apps/cli/src/commands/stop/stop.handler.ts
index 9fff144a8e..5a44798e21 100644
--- a/apps/cli/src/commands/stop/stop.handler.ts
+++ b/apps/cli/src/commands/stop/stop.handler.ts
@@ -15,7 +15,10 @@ import {
 import { dockerRemoveAll } from "../../command-internal/docker-remove-all.ts";
 import { cleanupStartSecrets } from "../../command-internal/start-secrets-cleanup.ts";
 import { resolveLocalConfigValues } from "../../command-internal/local-config-values.ts";
-import { loadLocalProjectContext } from "../../command-internal/local-project-context.ts";
+import {
+  loadLocalProjectContext,
+  recordLocalProjectOrioleDbTelemetry,
+} from "../../command-internal/local-project-context.ts";
 import { validateWorkdirIsDirectory } from "../../command-internal/workdir-validation.ts";
 import type { StopFlags } from "./stop.command.ts";
 import {
@@ -53,6 +56,7 @@ const resolveSearchProjectIdFilter = Effect.fn("stop.resolveSearchProjectIdFilte
     cliSettings.workdir,
     (message) => new StopConfigLoadError({ message }),
   );
+  yield* recordLocalProjectOrioleDbTelemetry(context);
 
   // Runs full config validation before touching Docker, unlike the `--all`/`--project-id`
   // branches above which bypass config loading. `resolveLocalConfigValues` is reused purely for
@@ -149,6 +153,15 @@ export const stop = Effect.fn("stop")(function* (flags: StopFlags) {
       Effect.ensuring(
         Effect.suspend(() => cleanupStartSecrets(removedContainers, cliSettings.workdir)),
       ),
+      Effect.tap(() =>
+        Effect.annotateCurrentSpan({ "container.removed_count": removedContainers.length }),
+      ),
+      Effect.withSpan("stop.removeContainers", {
+        attributes: {
+          "stop.all_projects": searchProjectIdFilter.length === 0,
+          "stop.delete_volumes": deleteVolumes,
+        },
+      }),
     );
 
     if (output.format === "text") {
@@ -166,6 +179,8 @@ export const stop = Effect.fn("stop")(function* (flags: StopFlags) {
     if (output.format === "text") {
       const remainingVolumes = yield* listVolumesByLabel(spawner, filterValue).pipe(
         Effect.orElseSucceed(() => []),
+        Effect.tap((volumes) => Effect.annotateCurrentSpan({ "volume.count": volumes.length })),
+        Effect.withSpan("stop.listRemainingVolumes"),
       );
       if (remainingVolumes.length > 0) {
         const listVolumeCommand =
diff --git a/apps/cli/src/commands/storage/cp/cp.command.integration.test.ts b/apps/cli/src/commands/storage/cp/cp.command.integration.test.ts
index e19579525d..f7ba5f09a3 100644
--- a/apps/cli/src/commands/storage/cp/cp.command.integration.test.ts
+++ b/apps/cli/src/commands/storage/cp/cp.command.integration.test.ts
@@ -46,9 +46,7 @@ function setup(args: ReadonlyArray<string>) {
       TelemetryRuntime,
       TelemetryRuntime.of({
         configDir: "/tmp/supabase-storage-cp-jobs-test/.supabase",
-        tracesDir: "/tmp/supabase-storage-cp-jobs-test/.supabase/traces",
         consent: "granted",
-        showDebug: false,
         deviceId: "test-device-id",
         sessionId: "test-session-id",
         identity: makeTelemetryIdentity(undefined),
diff --git a/apps/cli/src/commands/storage/cp/cp.handler.ts b/apps/cli/src/commands/storage/cp/cp.handler.ts
index 6239bfab43..d99b82d374 100644
--- a/apps/cli/src/commands/storage/cp/cp.handler.ts
+++ b/apps/cli/src/commands/storage/cp/cp.handler.ts
@@ -216,7 +216,7 @@ const downloadSingle = (
   );
 
 /** Recursively downloads a remote prefix: BFS walk, truncating existing files, creating parent dirs. */
-const downloadAll = (
+const downloadAll = Effect.fn("storage.cp.downloadAll")(function* (
   gateway: StorageGateway,
   output: typeof Output.Service,
   fs: FileSystem.FileSystem,
@@ -226,70 +226,71 @@ const downloadAll = (
   localPath0: string,
   jobs: number,
   summary: CpSummary,
-) =>
-  Effect.gen(function* () {
-    // If the destination is an existing directory, nest under base(remotePath).
-    const isDir = yield* fs.stat(localPath0).pipe(
-      Effect.map((i) => i.type === "Directory"),
-      Effect.orElseSucceed(() => false),
-    );
-    const localPath = isDir ? path.join(localPath0, posixPath.basename(remotePath)) : localPath0;
-
-    const tasks: Array<{ objectPath: string; dstPath: string; isDir: boolean }> = [];
-    // Captured as a value, not failed immediately: an "Object not found" (nothing visited) must
-    // mask a walk error, and a walk that errors partway must still run the already-queued
-    // downloads before the walk error surfaces — so this is checked after the download pass below.
-    const iterError = yield* iterateStoragePathsAll(gateway, output, remotePath, (objectPath) =>
-      Effect.gen(function* () {
-        const relPath = objectPath.startsWith(remotePath)
-          ? objectPath.slice(remotePath.length)
-          : objectPath;
-        const dstPath = path.join(localPath, relPath);
-        yield* output.raw(`Downloading: ${objectPath} => ${dstPath}\n`, "stderr");
-        tasks.push({ objectPath, dstPath, isDir: objectPath.endsWith("/") });
-      }),
-    ).pipe(
-      Effect.as<StorageGatewayError | undefined>(undefined),
-      Effect.catch((error) => Effect.succeed(error)),
-    );
+) {
+  // If the destination is an existing directory, nest under base(remotePath).
+  const isDir = yield* fs.stat(localPath0).pipe(
+    Effect.map((i) => i.type === "Directory"),
+    Effect.orElseSucceed(() => false),
+  );
+  const localPath = isDir ? path.join(localPath0, posixPath.basename(remotePath)) : localPath0;
 
-    if (tasks.length === 0) {
-      return yield* new StorageObjectNotFoundError(remotePath);
-    }
+  const tasks: Array<{ objectPath: string; dstPath: string; isDir: boolean }> = [];
+  // Captured as a value, not failed immediately: an "Object not found" (nothing visited) must
+  // mask a walk error, and a walk that errors partway must still run the already-queued
+  // downloads before the walk error surfaces — so this is checked after the download pass below.
+  const iterError = yield* iterateStoragePathsAll(gateway, output, remotePath, (objectPath) =>
+    Effect.gen(function* () {
+      const relPath = objectPath.startsWith(remotePath)
+        ? objectPath.slice(remotePath.length)
+        : objectPath;
+      const dstPath = path.join(localPath, relPath);
+      yield* output.raw(`Downloading: ${objectPath} => ${dstPath}\n`, "stderr");
+      tasks.push({ objectPath, dstPath, isDir: objectPath.endsWith("/") });
+    }),
+  ).pipe(
+    Effect.as<StorageGatewayError | undefined>(undefined),
+    Effect.catch((error) => Effect.succeed(error)),
+  );
 
-    yield* Effect.forEach(
-      tasks,
-      (task) =>
-        task.isDir
-          ? makeDirIfNotExist(fs, task.dstPath)
-          : Effect.gen(function* () {
-              yield* makeDirIfNotExist(fs, path.dirname(task.dstPath));
-              yield* Effect.scoped(
-                Effect.gen(function* () {
-                  const handle = yield* fs.open(task.dstPath, { flag: "w" }).pipe(
-                    Effect.mapError(
-                      (cause) =>
-                        new StorageFileError({
-                          message: `failed to create file: ${String(cause.cause ?? cause)}`,
-                        }),
-                    ),
-                  );
-                  yield* gateway
-                    .downloadObject(task.objectPath)
-                    .pipe(Stream.runForEach((c) => writeChunk(handle, c)));
-                }),
-              );
-              summary.downloaded.push({ from: task.objectPath, to: task.dstPath });
-            }),
-      { concurrency: jobs },
-    );
+  yield* Effect.annotateCurrentSpan({ "file.count": tasks.length });
+
+  if (tasks.length === 0) {
+    return yield* new StorageObjectNotFoundError(remotePath);
+  }
+
+  yield* Effect.forEach(
+    tasks,
+    (task) =>
+      task.isDir
+        ? makeDirIfNotExist(fs, task.dstPath)
+        : Effect.gen(function* () {
+            yield* makeDirIfNotExist(fs, path.dirname(task.dstPath));
+            yield* Effect.scoped(
+              Effect.gen(function* () {
+                const handle = yield* fs.open(task.dstPath, { flag: "w" }).pipe(
+                  Effect.mapError(
+                    (cause) =>
+                      new StorageFileError({
+                        message: `failed to create file: ${String(cause.cause ?? cause)}`,
+                      }),
+                  ),
+                );
+                yield* gateway
+                  .downloadObject(task.objectPath)
+                  .pipe(Stream.runForEach((c) => writeChunk(handle, c)));
+              }),
+            );
+            summary.downloaded.push({ from: task.objectPath, to: task.dstPath });
+          }),
+    { concurrency: jobs },
+  );
 
-    // Surfaced only after the queued downloads have run; a download failure propagates from the
-    // pass above first, so a rare walk-error + download-error pair collapses to whichever fails first.
-    if (iterError !== undefined) {
-      return yield* iterError;
-    }
-  });
+  // Surfaced only after the queued downloads have run; a download failure propagates from the
+  // pass above first, so a rare walk-error + download-error pair collapses to whichever fails first.
+  if (iterError !== undefined) {
+    return yield* iterError;
+  }
+});
 
 const makeDirIfNotExist = (fs: FileSystem.FileSystem, dir: string) =>
   fs.makeDirectory(dir, { recursive: true }).pipe(
@@ -338,49 +339,55 @@ const uploadSingle = (ctx: UploadCtx, remoteDstPath: string, localPath: string)
   });
 
 /** Recursively uploads a local directory: walks files, resolves each destination key, auto-creating the bucket if needed. */
-const uploadAll = (ctx: UploadCtx, remotePath: string, localPath: string, jobs: number) =>
-  Effect.gen(function* () {
-    const noSlash = remotePath.endsWith("/") ? remotePath.slice(0, -1) : remotePath;
-
-    // Detect whether base(noSlash) already exists remotely as a file or dir.
-    let dirExists = false;
-    let fileExists = false;
-    if (noSlash.length > 0) {
-      const base = ctx.posixPath.basename(noSlash);
-      yield* iterateStoragePaths(ctx.gateway, ctx.output, noSlash, (objectName) =>
-        Effect.sync(() => {
-          if (objectName === base) fileExists = true;
-          if (objectName === `${base}/`) dirExists = true;
-        }),
-      );
-    }
-
-    const baseName = ctx.path.basename(localPath);
-    const files = yield* collectUploadFiles(ctx.fs, ctx.path, localPath);
-
-    const tasks: Array<{ filePath: string; dstPath: string }> = [];
-    for (const file of files) {
-      const dstPath = resolveUploadDstPath(ctx.posixPath, {
-        remotePath,
-        relPath: file.relPath,
-        fileName: ctx.path.basename(file.filePath),
-        baseName,
-        noSlash,
-        dirExists,
-        fileExists,
-      });
-      yield* ctx.output.raw(`Uploading: ${file.filePath} => ${dstPath}\n`, "stderr");
-      tasks.push({ filePath: file.filePath, dstPath });
-    }
-
-    yield* Effect.forEach(
-      tasks,
-      (task) => uploadOneWithAutoCreate(ctx, task.dstPath, task.filePath),
-      {
-        concurrency: jobs,
-      },
+const uploadAll = Effect.fn("storage.cp.uploadAll")(function* (
+  ctx: UploadCtx,
+  remotePath: string,
+  localPath: string,
+  jobs: number,
+) {
+  const noSlash = remotePath.endsWith("/") ? remotePath.slice(0, -1) : remotePath;
+
+  // Detect whether base(noSlash) already exists remotely as a file or dir.
+  let dirExists = false;
+  let fileExists = false;
+  if (noSlash.length > 0) {
+    const base = ctx.posixPath.basename(noSlash);
+    yield* iterateStoragePaths(ctx.gateway, ctx.output, noSlash, (objectName) =>
+      Effect.sync(() => {
+        if (objectName === base) fileExists = true;
+        if (objectName === `${base}/`) dirExists = true;
+      }),
     );
-  });
+  }
+
+  const baseName = ctx.path.basename(localPath);
+  const files = yield* collectUploadFiles(ctx.fs, ctx.path, localPath);
+
+  const tasks: Array<{ filePath: string; dstPath: string }> = [];
+  for (const file of files) {
+    const dstPath = resolveUploadDstPath(ctx.posixPath, {
+      remotePath,
+      relPath: file.relPath,
+      fileName: ctx.path.basename(file.filePath),
+      baseName,
+      noSlash,
+      dirExists,
+      fileExists,
+    });
+    yield* ctx.output.raw(`Uploading: ${file.filePath} => ${dstPath}\n`, "stderr");
+    tasks.push({ filePath: file.filePath, dstPath });
+  }
+
+  yield* Effect.annotateCurrentSpan({ "file.count": tasks.length });
+
+  yield* Effect.forEach(
+    tasks,
+    (task) => uploadOneWithAutoCreate(ctx, task.dstPath, task.filePath),
+    {
+      concurrency: jobs,
+    },
+  );
+});
 
 /** One recursive upload (overwrite), retrying after bucket auto-create on 404. */
 const uploadOneWithAutoCreate = (ctx: UploadCtx, dstPath: string, filePath: string) =>
diff --git a/apps/cli/src/commands/storage/ls/ls.handler.ts b/apps/cli/src/commands/storage/ls/ls.handler.ts
index 0edb6ba4c8..527a436cb4 100644
--- a/apps/cli/src/commands/storage/ls/ls.handler.ts
+++ b/apps/cli/src/commands/storage/ls/ls.handler.ts
@@ -58,12 +58,16 @@ export const storageLs = Effect.fn("storage.ls")(function* (flags: StorageLsFlag
     const remotePath = yield* parseStorageUrlEffect(Option.getOrElse(flags.path, () => "ss:///"));
 
     const paths: Array<string> = [];
+    let count = 0;
     const callback = (objectPath: string) =>
-      output.format === "text"
-        ? output.raw(`${objectPath}\n`, "stdout")
-        : Effect.sync(() => {
-            paths.push(objectPath);
-          });
+      Effect.suspend(() => {
+        count++;
+        return output.format === "text"
+          ? output.raw(`${objectPath}\n`, "stdout")
+          : Effect.sync(() => {
+              paths.push(objectPath);
+            });
+      });
 
     yield* connectStorageGateway(
       { projectRef, config: loaded.config, userAgent: cliSettings.userAgent },
@@ -73,6 +77,8 @@ export const storageLs = Effect.fn("storage.ls")(function* (flags: StorageLsFlag
           : iterateStoragePaths(gateway, output, remotePath, callback),
     );
 
+    yield* Effect.annotateCurrentSpan({ "file.count": count });
+
     if (output.format !== "text") {
       yield* output.success("", { paths });
     }
diff --git a/apps/cli/src/commands/storage/mv/mv.handler.ts b/apps/cli/src/commands/storage/mv/mv.handler.ts
index f3fc0952e6..37d8ce7ccb 100644
--- a/apps/cli/src/commands/storage/mv/mv.handler.ts
+++ b/apps/cli/src/commands/storage/mv/mv.handler.ts
@@ -120,42 +120,42 @@ export const storageMv = Effect.fn("storage.mv")(function* (flags: StorageMvFlag
  * BFS over the source tree (LIFO), moving each object with its `srcPrefix`→`dstPrefix` rewrite.
  * `srcPath` is terminated by `/`. Fails with `Object not found: <srcPath>` when nothing moved.
  */
-const moveStorageObjectAll = (
+const moveStorageObjectAll = Effect.fn("storage.mv.moveAll")(function* (
   gateway: StorageGateway,
   output: typeof Output.Service,
   posixPath: Path.Path,
   srcPath: string,
   dstPath: string,
-) =>
-  Effect.gen(function* () {
-    const [, dstPrefix] = splitBucketPrefix(dstPath);
-    let count = 0;
-    const queue: Array<string> = [srcPath];
-    while (queue.length > 0) {
-      const dirPath = queue.pop();
-      if (dirPath === undefined) break;
-      const paths = yield* listStoragePaths(gateway, output, dirPath);
-      for (const objectName of paths) {
-        const objectPath = dirPath + objectName;
-        if (objectName.endsWith("/")) {
-          queue.push(objectPath);
-          continue;
-        }
-        count++;
-        const relPath = objectPath.startsWith(srcPath)
-          ? objectPath.slice(srcPath.length)
-          : objectPath;
-        const [srcBucket, srcPrefix] = splitBucketPrefix(objectPath);
-        const absPath = posixPath.join(dstPrefix, relPath);
-        yield* output.raw(
-          `Moving object: ${objectPath} => ${posixPath.join(dstPath, relPath)}\n`,
-          "stderr",
-        );
-        yield* gateway.moveObject(srcBucket, srcPrefix, absPath);
+) {
+  const [, dstPrefix] = splitBucketPrefix(dstPath);
+  let count = 0;
+  const queue: Array<string> = [srcPath];
+  while (queue.length > 0) {
+    const dirPath = queue.pop();
+    if (dirPath === undefined) break;
+    const paths = yield* listStoragePaths(gateway, output, dirPath);
+    for (const objectName of paths) {
+      const objectPath = dirPath + objectName;
+      if (objectName.endsWith("/")) {
+        queue.push(objectPath);
+        continue;
       }
+      count++;
+      const relPath = objectPath.startsWith(srcPath)
+        ? objectPath.slice(srcPath.length)
+        : objectPath;
+      const [srcBucket, srcPrefix] = splitBucketPrefix(objectPath);
+      const absPath = posixPath.join(dstPrefix, relPath);
+      yield* output.raw(
+        `Moving object: ${objectPath} => ${posixPath.join(dstPath, relPath)}\n`,
+        "stderr",
+      );
+      yield* gateway.moveObject(srcBucket, srcPrefix, absPath);
     }
-    if (count === 0) {
-      return yield* new StorageObjectNotFoundError(srcPath);
-    }
-    return count;
-  });
+  }
+  yield* Effect.annotateCurrentSpan({ "file.count": count });
+  if (count === 0) {
+    return yield* new StorageObjectNotFoundError(srcPath);
+  }
+  return count;
+});
diff --git a/apps/cli/src/commands/storage/rm/rm.handler.ts b/apps/cli/src/commands/storage/rm/rm.handler.ts
index fec2ca3f80..8677f747e2 100644
--- a/apps/cli/src/commands/storage/rm/rm.handler.ts
+++ b/apps/cli/src/commands/storage/rm/rm.handler.ts
@@ -146,6 +146,12 @@ export const storageRm = Effect.fn("storage.rm")(function* (flags: StorageRmFlag
             }
           }
 
+          yield* Effect.annotateCurrentSpan({
+            "bucket.count": groups.size,
+            "file.count": summary.deleted.length,
+            "bucket.deleted_count": summary.buckets_deleted.length,
+          });
+
           if (output.format !== "text") {
             yield* output.success("", {
               deleted: summary.deleted,
@@ -184,51 +190,53 @@ const deleteObjects = (
  * Walks the prefix tree with a stack, deleting files per directory, then the bucket
  * itself once the prefix is empty. `prefix` ends with `/` or is empty.
  */
-const removeStoragePathAll = (
+const removeStoragePathAll = Effect.fn("storage.rm.removeAll")(function* (
   gateway: StorageGateway,
   output: typeof Output.Service,
   bucket: string,
   prefix: string,
   summary: RmSummary,
-) =>
-  Effect.gen(function* () {
-    const queue: Array<string> = [prefix];
-    while (queue.length > 0) {
-      const dirPrefix = queue.pop();
-      if (dirPrefix === undefined) break;
-      const paths = yield* listStoragePaths(gateway, output, `/${bucket}/${dirPrefix}`);
-      if (paths.length === 0 && prefix.length > 0) {
-        return yield* new StorageObjectNotFoundError(`${bucket}/${prefix}`);
-      }
-      const files: Array<string> = [];
-      for (const objectName of paths) {
-        const objectPrefix = dirPrefix + objectName;
-        if (objectName.endsWith("/")) {
-          queue.push(objectPrefix);
-        } else {
-          files.push(objectPrefix);
-        }
-      }
-      if (files.length > 0) {
-        yield* output.raw(`Deleting objects: [${files.join(" ")}]\n`, "stderr");
-        yield* deleteObjects(gateway, bucket, files, summary);
+) {
+  let deletedCount = 0;
+  const queue: Array<string> = [prefix];
+  while (queue.length > 0) {
+    const dirPrefix = queue.pop();
+    if (dirPrefix === undefined) break;
+    const paths = yield* listStoragePaths(gateway, output, `/${bucket}/${dirPrefix}`);
+    if (paths.length === 0 && prefix.length > 0) {
+      return yield* new StorageObjectNotFoundError(`${bucket}/${prefix}`);
+    }
+    const files: Array<string> = [];
+    for (const objectName of paths) {
+      const objectPrefix = dirPrefix + objectName;
+      if (objectName.endsWith("/")) {
+        queue.push(objectPrefix);
+      } else {
+        files.push(objectPrefix);
       }
     }
-    if (prefix.length === 0) {
-      yield* output.raw(`Deleting bucket: ${bucket}\n`, "stderr");
-      yield* gateway.deleteBucket(bucket).pipe(
-        Effect.flatMap((message) =>
-          Effect.gen(function* () {
-            yield* output.raw(`${message}\n`, "stderr");
-            summary.buckets_deleted.push(bucket);
-          }),
-        ),
-        Effect.catch((error) =>
-          error instanceof StorageGatewayStatusError &&
-          error.body.includes('"error":"Bucket not found"')
-            ? output.raw(`Bucket not found: ${bucket}\n`, "stderr")
-            : Effect.fail(error),
-        ),
-      );
+    if (files.length > 0) {
+      yield* output.raw(`Deleting objects: [${files.join(" ")}]\n`, "stderr");
+      yield* deleteObjects(gateway, bucket, files, summary);
+      deletedCount += files.length;
     }
-  });
+  }
+  yield* Effect.annotateCurrentSpan({ "file.count": deletedCount });
+  if (prefix.length === 0) {
+    yield* output.raw(`Deleting bucket: ${bucket}\n`, "stderr");
+    yield* gateway.deleteBucket(bucket).pipe(
+      Effect.flatMap((message) =>
+        Effect.gen(function* () {
+          yield* output.raw(`${message}\n`, "stderr");
+          summary.buckets_deleted.push(bucket);
+        }),
+      ),
+      Effect.catch((error) =>
+        error instanceof StorageGatewayStatusError &&
+        error.body.includes('"error":"Bucket not found"')
+          ? output.raw(`Bucket not found: ${bucket}\n`, "stderr")
+          : Effect.fail(error),
+      ),
+    );
+  }
+});
diff --git a/apps/cli/src/commands/storage/storage.experimental-gate.integration.test.ts b/apps/cli/src/commands/storage/storage.experimental-gate.integration.test.ts
index 78ea602091..188cb5653b 100644
--- a/apps/cli/src/commands/storage/storage.experimental-gate.integration.test.ts
+++ b/apps/cli/src/commands/storage/storage.experimental-gate.integration.test.ts
@@ -40,7 +40,6 @@ function setup(args: ReadonlyArray<string>) {
     mockAnalytics().layer,
     mockTelemetryRuntime({
       configDir: `${tempRoot.current}/.supabase`,
-      tracesDir: `${tempRoot.current}/.supabase/traces`,
     }),
   );
   return { layer };
diff --git a/apps/cli/src/commands/storage/storage.flags.ts b/apps/cli/src/commands/storage/storage.flags.ts
index 124ec77b90..d904255c77 100644
--- a/apps/cli/src/commands/storage/storage.flags.ts
+++ b/apps/cli/src/commands/storage/storage.flags.ts
@@ -28,11 +28,6 @@ export const StorageProjectRefFlagDef = Flag.string("project-ref").pipe(
   Flag.optional,
 );
 
-/** Names of `--linked`/`--local` flags that were explicitly passed, for the exclusivity check. */
-export function storageChangedTargetFlags(args: ReadonlyArray<string>): ReadonlyArray<string> {
-  return changedLinkedLocalFlags(args);
-}
-
 /**
  * Mutual-exclusion check for `--linked`/`--local`, rejected before the handler body
  * so it never fires `cli_command_executed`. Each leaf must call this before
@@ -41,7 +36,7 @@ export function storageChangedTargetFlags(args: ReadonlyArray<string>): Readonly
 export const assertStorageTargetsExclusive = Effect.fnUntraced(function* (
   args: ReadonlyArray<string>,
 ) {
-  const setFlags = storageChangedTargetFlags(args);
+  const setFlags = changedLinkedLocalFlags(args);
   if (setFlags.length > 1) {
     return yield* new StorageMutuallyExclusiveFlagsError({
       message: `if any flags in the group [linked local] are set none of the others can be; [${setFlags.join(" ")}] were all set`,
diff --git a/apps/cli/src/commands/storage/storage.flags.unit.test.ts b/apps/cli/src/commands/storage/storage.flags.unit.test.ts
index 1e2de586aa..00885f763f 100644
--- a/apps/cli/src/commands/storage/storage.flags.unit.test.ts
+++ b/apps/cli/src/commands/storage/storage.flags.unit.test.ts
@@ -1,55 +1,7 @@
 import { describe, expect, it } from "@effect/vitest";
 import { Cause, Effect, Exit } from "effect";
 
-import { assertStorageTargetsExclusive, storageChangedTargetFlags } from "./storage.flags.ts";
-
-describe("storageChangedTargetFlags", () => {
-  it("detects neither when no target flag is present", () => {
-    expect(storageChangedTargetFlags(["storage", "ls", "ss:///"])).toEqual([]);
-  });
-
-  it("detects --linked and --local in cobra's sorted order", () => {
-    expect(storageChangedTargetFlags(["storage", "--local", "--linked", "ls"])).toEqual([
-      "linked",
-      "local",
-    ]);
-  });
-
-  it("treats the negation form as changed", () => {
-    expect(storageChangedTargetFlags(["storage", "ls", "--no-local"])).toEqual(["local"]);
-  });
-
-  it("does not mistake a value token for a target flag", () => {
-    // `--workdir --linked`: `--linked` is the value of `--workdir`, not a selector.
-    expect(storageChangedTargetFlags(["storage", "--workdir", "--linked", "ls"])).toEqual([]);
-  });
-
-  it("skips the value of `storage cp` value-consuming flags (content-type/cache-control/jobs)", () => {
-    expect(
-      storageChangedTargetFlags(["storage", "cp", "--content-type", "--local", "a", "b"]),
-    ).toEqual([]);
-    expect(
-      storageChangedTargetFlags(["storage", "cp", "--cache-control", "--linked", "a", "b"]),
-    ).toEqual([]);
-    expect(storageChangedTargetFlags(["storage", "cp", "--jobs", "--local", "a", "b"])).toEqual([]);
-    expect(storageChangedTargetFlags(["storage", "cp", "-j", "--linked", "a", "b"])).toEqual([]);
-  });
-
-  it("still detects a real selector after a `storage cp` flag's value", () => {
-    // `--jobs 5` consumes `5`; the trailing `--local` is a genuine selector.
-    expect(
-      storageChangedTargetFlags(["storage", "cp", "--jobs", "5", "--local", "a", "b"]),
-    ).toEqual(["local"]);
-  });
-
-  it("ignores tokens after the -- sentinel", () => {
-    expect(storageChangedTargetFlags(["storage", "ls", "--", "--local"])).toEqual([]);
-  });
-
-  it("detects flags given after the subcommand token (persistent globals)", () => {
-    expect(storageChangedTargetFlags(["storage", "rm", "ss:///b/x", "--local"])).toEqual(["local"]);
-  });
-});
+import { assertStorageTargetsExclusive } from "./storage.flags.ts";
 
 describe("assertStorageTargetsExclusive", () => {
   it.effect("rejects passing both --linked and --local (byte-exact cobra message)", () =>
diff --git a/apps/cli/src/commands/storage/storage.frame.ts b/apps/cli/src/commands/storage/storage.frame.ts
index c7524281ae..ffb0db64c3 100644
--- a/apps/cli/src/commands/storage/storage.frame.ts
+++ b/apps/cli/src/commands/storage/storage.frame.ts
@@ -46,7 +46,7 @@ interface LoadedStorageConfig {
  * read `config` at all. `appliedRemote` is set when a `[remotes.<name>]` block
  * matches the linked ref.
  */
-export const loadStorageConfig = Effect.fnUntraced(function* (
+export const loadStorageConfig = Effect.fn("Storage.loadConfig")(function* (
   cliSettings: { readonly workdir: string; readonly explicitWorkdir: boolean },
   projectRef: string,
 ) {
diff --git a/apps/cli/src/commands/test/new/new.handler.ts b/apps/cli/src/commands/test/new/new.handler.ts
index 339f7cf117..dce04b1064 100644
--- a/apps/cli/src/commands/test/new/new.handler.ts
+++ b/apps/cli/src/commands/test/new/new.handler.ts
@@ -25,6 +25,7 @@ export const testNew = Effect.fn("test.new")(function* (flags: TestNewFlags) {
   const path = yield* Path.Path;
 
   const template = Option.getOrElse(flags.template, () => "pgtap" as const);
+  yield* Effect.annotateCurrentSpan("test.template", template);
 
   yield* Effect.gen(function* () {
     // The printed path is relative to the project root ("supabase/tests"); FS ops are
diff --git a/apps/cli/src/commands/vanity-subdomains/vanity-subdomains.experimental-gate.integration.test.ts b/apps/cli/src/commands/vanity-subdomains/vanity-subdomains.experimental-gate.integration.test.ts
index 2cbc23bf81..f4f958e4d2 100644
--- a/apps/cli/src/commands/vanity-subdomains/vanity-subdomains.experimental-gate.integration.test.ts
+++ b/apps/cli/src/commands/vanity-subdomains/vanity-subdomains.experimental-gate.integration.test.ts
@@ -48,9 +48,7 @@ function setup() {
       TelemetryRuntime,
       TelemetryRuntime.of({
         configDir: `${tempRoot.current}/.supabase`,
-        tracesDir: `${tempRoot.current}/.supabase/traces`,
         consent: "granted",
-        showDebug: false,
         deviceId: "test-device-id",
         sessionId: "test-session-id",
         identity: makeTelemetryIdentity(undefined),
diff --git a/apps/cli/src/config/command-settings.layer.ts b/apps/cli/src/config/command-settings.layer.ts
index 9cfecd1851..90f177897d 100644
--- a/apps/cli/src/config/command-settings.layer.ts
+++ b/apps/cli/src/config/command-settings.layer.ts
@@ -60,7 +60,7 @@ function resolveProfile(
     }
 
     return yield* loadProfile(token, fs);
-  });
+  }).pipe(Effect.withSpan("CommandSettings.resolveProfile"));
 }
 
 /**
@@ -71,34 +71,32 @@ function resolveProfile(
  * `explicit` is true only when the flag/env value was used verbatim, without walking up to find
  * `supabase/config.toml`; some config loads use it to skip a redundant ancestor search.
  */
-export function resolveWorkdir(
+export const resolveWorkdir = Effect.fn("CommandSettings.resolveWorkdir")(function* (
   flagValue: Option.Option<string>,
   envValue: Option.Option<string>,
   cwd: string,
   configTomlExists: (path: string) => Effect.Effect<boolean>,
   path: Path.Path,
-): Effect.Effect<{ readonly workdir: string; readonly explicit: boolean }> {
-  return Effect.gen(function* () {
-    if (Option.isSome(flagValue) && flagValue.value.length > 0) {
-      return { workdir: path.resolve(cwd, flagValue.value), explicit: true };
-    }
-    if (Option.isSome(envValue) && envValue.value.length > 0) {
-      return { workdir: path.resolve(cwd, envValue.value), explicit: true };
+) {
+  if (Option.isSome(flagValue) && flagValue.value.length > 0) {
+    return { workdir: path.resolve(cwd, flagValue.value), explicit: true };
+  }
+  if (Option.isSome(envValue) && envValue.value.length > 0) {
+    return { workdir: path.resolve(cwd, envValue.value), explicit: true };
+  }
+  let current = cwd;
+  while (true) {
+    const candidate = path.join(current, "supabase", "config.toml");
+    if (yield* configTomlExists(candidate)) {
+      return { workdir: current, explicit: false };
     }
-    let current = cwd;
-    while (true) {
-      const candidate = path.join(current, "supabase", "config.toml");
-      if (yield* configTomlExists(candidate)) {
-        return { workdir: current, explicit: false };
-      }
-      const parent = path.dirname(current);
-      if (parent === current) {
-        return { workdir: cwd, explicit: false };
-      }
-      current = parent;
+    const parent = path.dirname(current);
+    if (parent === current) {
+      return { workdir: cwd, explicit: false };
     }
-  });
-}
+    current = parent;
+  }
+});
 
 export const commandSettingsLayer = Layer.unwrap(
   Effect.gen(function* () {
@@ -111,6 +109,7 @@ export const commandSettingsLayer = Layer.unwrap(
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
         const path = yield* Path.Path;
+
         const runtimeInfo = yield* RuntimeInfo;
         const provider = yield* ConfigProvider.ConfigProvider;
         const read = <A>(config: Config.Config<A>) => config.parse(provider);
@@ -174,6 +173,11 @@ export const commandSettingsLayer = Layer.unwrap(
 
         const userAgent = `SupabaseCLI/${CLI_VERSION}`;
 
+        yield* Effect.annotateCurrentSpan({
+          "config.workdir_explicit": explicitWorkdir,
+          "config.access_token_from_env": Option.isSome(accessToken),
+        });
+
         return CommandSettings.of({
           profile,
           profileEnvValue,
@@ -191,7 +195,7 @@ export const commandSettingsLayer = Layer.unwrap(
           workdirEnvValue,
           userAgent,
         });
-      }),
+      }).pipe(Effect.withSpan("CommandSettings.load")),
     );
   }),
 );
diff --git a/apps/cli/src/config/profile-file.ts b/apps/cli/src/config/profile-file.ts
index b96d90a1e0..20a0c7187c 100644
--- a/apps/cli/src/config/profile-file.ts
+++ b/apps/cli/src/config/profile-file.ts
@@ -14,20 +14,6 @@ import {
  * profile; `CommandSettings` reads it as the lowest-precedence profile source.
  */
 
-/**
- * Resolves the global Supabase home for the CLI. Delegates to the
- * shared `resolveSupabaseHome` contract (honors `SUPABASE_HOME`, else
- * `<homeDir>/.supabase`). The CLI reads ambient `process.env`
- * directly, so `env` defaults to it.
- */
-export function supabaseHome(
-  path: Path.Path,
-  homeDir: string,
-  env: Readonly<Record<string, string | undefined>> = process.env,
-): string {
-  return resolveSupabaseHome(path, env, homeDir);
-}
-
 /** Raised when persisting the profile name fails — fails `login` outright,
  * blocking subsequent CI commands that rely on the persisted profile. */
 export class ProfileSaveError extends Data.TaggedError("ProfileSaveError")<{
@@ -43,7 +29,7 @@ export function profileFilePath(
   homeDir: string,
   env?: Readonly<Record<string, string | undefined>>,
 ): string {
-  return path.join(supabaseHome(path, homeDir, env), "profile");
+  return path.join(resolveSupabaseHome(path, env ?? process.env, homeDir), "profile");
 }
 
 /** Writes the profile name to the resolved profile path. Fatal on failure. */
diff --git a/apps/cli/src/output/bold.ts b/apps/cli/src/output/bold.ts
deleted file mode 100644
index b162812a0d..0000000000
--- a/apps/cli/src/output/bold.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-/**
- * Renders text bold for a TTY, unchanged otherwise.
- *
- * Callers pass `Tty.stdoutIsTty` here even when the bolded text is written to stderr (e.g.
- * `inspect report`'s "Reports saved to <bold>"), since whether bolding is enabled is keyed off
- * stdout, not the destination stream.
- */
-export function bold(text: string, isTty: boolean): string {
-  return isTty ? `\x1b[1m${text}\x1b[0m` : text;
-}
diff --git a/apps/cli/src/shared/auth/api.layer.ts b/apps/cli/src/shared/auth/api.layer.ts
deleted file mode 100644
index d0046b8b49..0000000000
--- a/apps/cli/src/shared/auth/api.layer.ts
+++ /dev/null
@@ -1,68 +0,0 @@
-import { Effect, Layer } from "effect";
-import { makeApiClient } from "@supabase/api/effect";
-import { HttpClient, HttpClientError, HttpClientRequest } from "effect/unstable/http";
-
-import { ApiError } from "./errors.ts";
-import { Api, type LoginSessionResponse } from "./api.service.ts";
-
-// HttpClientError reasons that mean the response arrived but its body could not
-// be decoded (including a 2xx whose body isn't valid JSON). These are API
-// response problems, not transport ones, so they classify by `decode` rather
-// than a status code.
-const BODY_DECODE_REASONS = new Set<string>(["DecodeError", "EmptyBodyError"]);
-
-/**
- * Maps any fetcher failure to an {@link ApiError}, preserving the classification signal: a
- * received status → `statusCode` (no status → classified as network); a body/schema decode
- * failure → `decode: true`, classified as an API response problem instead of network.
- */
-function mapToApiError(error: unknown): Effect.Effect<never, ApiError> {
-  if (HttpClientError.isHttpClientError(error)) {
-    if (BODY_DECODE_REASONS.has(error.reason._tag)) {
-      return Effect.fail(new ApiError({ detail: error.message, decode: true }));
-    }
-    if (error.response !== undefined) {
-      return Effect.fail(
-        new ApiError({
-          statusCode: error.response.status,
-          detail: `${error.response.status} ${error.message}`,
-        }),
-      );
-    }
-    return Effect.fail(new ApiError({ detail: error.message }));
-  }
-  return Effect.fail(
-    new ApiError({
-      detail: error instanceof Error ? error.message : String(error),
-      decode: true,
-    }),
-  );
-}
-
-export const makeApi = Effect.gen(function* () {
-  const rawHttpClient = yield* HttpClient.HttpClient;
-  const httpClient = rawHttpClient.pipe(HttpClient.filterStatusOk);
-  const httpClientLayer = Layer.succeed(HttpClient.HttpClient, rawHttpClient);
-
-  return Api.of({
-    fetchLoginSession: Effect.fnUntraced(
-      function* (apiUrl: string, sessionId: string, deviceCode: string) {
-        const url = `${apiUrl}/platform/cli/login/${sessionId}?device_code=${deviceCode}`;
-        const response = yield* httpClient.execute(HttpClientRequest.get(url));
-        return (yield* response.json) as LoginSessionResponse;
-      },
-      (effect) => effect.pipe(Effect.catch(mapToApiError)),
-    ),
-    fetchProfile: Effect.fnUntraced(
-      function* (apiUrl, accessToken) {
-        const api = yield* makeApiClient({
-          baseUrl: apiUrl,
-          accessToken,
-          userAgent: "supabase",
-        }).pipe(Effect.provide(httpClientLayer));
-        return yield* api.v1.getProfile();
-      },
-      (effect) => effect.pipe(Effect.catch(mapToApiError)),
-    ),
-  });
-});
diff --git a/apps/cli/src/shared/auth/api.layer.unit.test.ts b/apps/cli/src/shared/auth/api.layer.unit.test.ts
deleted file mode 100644
index 4b719e0026..0000000000
--- a/apps/cli/src/shared/auth/api.layer.unit.test.ts
+++ /dev/null
@@ -1,154 +0,0 @@
-import { describe, expect, it } from "@effect/vitest";
-import { Cause, Effect, Exit, Layer, Redacted } from "effect";
-import { HttpClient, HttpClientError, HttpClientResponse } from "effect/unstable/http";
-import { Api } from "./api.service.ts";
-import { ApiError } from "./errors.ts";
-import { makeApi } from "./api.layer.ts";
-
-const API_URL = "https://api.supabase.com";
-const SESSION_ID = "test-session-id";
-const DEVICE_CODE = "test-device-code";
-const EXPECTED_URL = `${API_URL}/platform/cli/login/${SESSION_ID}?device_code=${DEVICE_CODE}`;
-
-function mockHttpClient(opts: { status?: number; body?: unknown; transportError?: string }) {
-  const requests: string[] = [];
-
-  const layer = Layer.succeed(
-    HttpClient.HttpClient,
-    HttpClient.makeWith<never, never, HttpClientError.HttpClientError, never>(
-      (requestEffect) =>
-        Effect.flatMap(requestEffect, (request) => {
-          requests.push(request.url);
-          if (opts.transportError !== undefined) {
-            return Effect.fail(
-              new HttpClientError.HttpClientError({
-                reason: new HttpClientError.TransportError({
-                  request,
-                  cause: new Error(opts.transportError),
-                  description: opts.transportError,
-                }),
-              }),
-            );
-          }
-          const webResponse = new Response(JSON.stringify(opts.body ?? null), {
-            status: opts.status ?? 200,
-          });
-          return Effect.succeed(HttpClientResponse.fromWeb(request, webResponse));
-        }),
-      Effect.succeed,
-    ),
-  );
-
-  return {
-    layer,
-    get requests() {
-      return requests;
-    },
-  };
-}
-
-function getFailError(exit: Exit.Exit<unknown, unknown>): unknown {
-  if (!Exit.isFailure(exit)) throw new Error("Expected failure");
-  const fail = exit.cause.reasons.find(Cause.isFailReason);
-  if (!fail) throw new Error("Expected fail reason");
-  return fail.error;
-}
-
-describe("Api", () => {
-  describe("fetchLoginSession", () => {
-    it.effect("parses JSON on successful response", () => {
-      const responseBody = {
-        access_token: "sbp_token_123",
-        public_key: "04abcdef",
-        nonce: "deadbeef",
-      };
-      const { layer: httpLayer } = mockHttpClient({ body: responseBody });
-      const testLayer = Layer.effect(Api, makeApi).pipe(Layer.provide(httpLayer));
-      return Effect.gen(function* () {
-        const { fetchLoginSession } = yield* Api;
-        const result = yield* fetchLoginSession(API_URL, SESSION_ID, DEVICE_CODE);
-        expect(result).toEqual(responseBody);
-      }).pipe(Effect.provide(testLayer));
-    });
-
-    it.effect("constructs correct URL", () => {
-      const responseBody = { access_token: "", public_key: "", nonce: "" };
-      const mock = mockHttpClient({ body: responseBody });
-      const testLayer = Layer.effect(Api, makeApi).pipe(Layer.provide(mock.layer));
-      return Effect.gen(function* () {
-        const { fetchLoginSession } = yield* Api;
-        yield* fetchLoginSession(API_URL, SESSION_ID, DEVICE_CODE);
-        expect(mock.requests[0]).toBe(EXPECTED_URL);
-      }).pipe(Effect.provide(testLayer));
-    });
-
-    it.effect("returns ApiError on non-OK response", () => {
-      const { layer: httpLayer } = mockHttpClient({ status: 404, body: "Not Found" });
-      const testLayer = Layer.effect(Api, makeApi).pipe(Layer.provide(httpLayer));
-      return Effect.gen(function* () {
-        const { fetchLoginSession } = yield* Api;
-        const exit = yield* fetchLoginSession(API_URL, SESSION_ID, DEVICE_CODE).pipe(Effect.exit);
-        const error = getFailError(exit) as ApiError;
-        expect(error).toBeInstanceOf(ApiError);
-        expect(error.statusCode).toBe(404);
-      }).pipe(Effect.provide(testLayer));
-    });
-
-    it.effect("returns ApiError with message on network/transport error", () => {
-      const { layer: httpLayer } = mockHttpClient({ transportError: "Network failure" });
-      const testLayer = Layer.effect(Api, makeApi).pipe(Layer.provide(httpLayer));
-      return Effect.gen(function* () {
-        const { fetchLoginSession } = yield* Api;
-        const exit = yield* fetchLoginSession(API_URL, SESSION_ID, DEVICE_CODE).pipe(Effect.exit);
-        const error = getFailError(exit) as ApiError;
-        expect(error).toBeInstanceOf(ApiError);
-        expect(error.detail).toContain("Network failure");
-        expect(error.statusCode).toBeUndefined();
-      }).pipe(Effect.provide(testLayer));
-    });
-
-    it.effect("ApiError detail includes status code on non-OK response", () => {
-      const { layer: httpLayer } = mockHttpClient({ status: 503, body: "Service Unavailable" });
-      const testLayer = Layer.effect(Api, makeApi).pipe(Layer.provide(httpLayer));
-      return Effect.gen(function* () {
-        const { fetchLoginSession } = yield* Api;
-        const exit = yield* fetchLoginSession(API_URL, SESSION_ID, DEVICE_CODE).pipe(Effect.exit);
-        const error = getFailError(exit) as ApiError;
-        expect(error.statusCode).toBe(503);
-        expect(error.detail).toContain("503");
-      }).pipe(Effect.provide(testLayer));
-    });
-  });
-
-  describe("fetchProfile", () => {
-    it.effect("requests the canonical profile endpoint", () => {
-      const responseBody = {
-        gotrue_id: "user-123",
-        primary_email: "test@example.com",
-        username: "tester",
-      };
-      const mock = mockHttpClient({ body: responseBody });
-      const testLayer = Layer.effect(Api, makeApi).pipe(Layer.provide(mock.layer));
-      return Effect.gen(function* () {
-        const { fetchProfile } = yield* Api;
-        const result = yield* fetchProfile(API_URL, Redacted.make("sbp_" + "a".repeat(40)));
-        expect(result).toEqual(responseBody);
-        expect(mock.requests[0]).toBe(`${API_URL}/v1/profile`);
-      }).pipe(Effect.provide(testLayer));
-    });
-
-    it.effect("returns ApiError when profile lookup is not OK", () => {
-      const { layer: httpLayer } = mockHttpClient({ status: 401, body: "Unauthorized" });
-      const testLayer = Layer.effect(Api, makeApi).pipe(Layer.provide(httpLayer));
-      return Effect.gen(function* () {
-        const { fetchProfile } = yield* Api;
-        const exit = yield* fetchProfile(API_URL, Redacted.make("sbp_" + "a".repeat(40))).pipe(
-          Effect.exit,
-        );
-        const error = getFailError(exit) as ApiError;
-        expect(error).toBeInstanceOf(ApiError);
-        expect(error.statusCode).toBe(401);
-      }).pipe(Effect.provide(testLayer));
-    });
-  });
-});
diff --git a/apps/cli/src/shared/auth/api.service.ts b/apps/cli/src/shared/auth/api.service.ts
deleted file mode 100644
index 743ce06f23..0000000000
--- a/apps/cli/src/shared/auth/api.service.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-import type { Effect, Redacted } from "effect";
-import { Context } from "effect";
-
-import type { ApiError } from "./errors.ts";
-
-export type LoginSessionResponse = {
-  access_token: string;
-  public_key: string;
-  nonce: string;
-};
-
-type ProfileResponse = {
-  gotrue_id: string;
-  primary_email: string;
-  username: string;
-};
-
-interface ApiShape {
-  readonly fetchLoginSession: (
-    apiUrl: string,
-    sessionId: string,
-    deviceCode: string,
-  ) => Effect.Effect<LoginSessionResponse, ApiError>;
-  readonly fetchProfile: (
-    apiUrl: string,
-    accessToken: string | Redacted.Redacted<string>,
-  ) => Effect.Effect<ProfileResponse, ApiError>;
-}
-
-export class Api extends Context.Service<Api, ApiShape>()("supabase/auth/Api") {}
diff --git a/apps/cli/src/shared/auth/credentials.layer.ts b/apps/cli/src/shared/auth/credentials.layer.ts
deleted file mode 100644
index de62eac175..0000000000
--- a/apps/cli/src/shared/auth/credentials.layer.ts
+++ /dev/null
@@ -1,123 +0,0 @@
-import { Effect, FileSystem, Layer, Option, Path, Predicate, Redacted } from "effect";
-
-import { normalizeKeyringToken } from "./keyring-token.ts";
-import { CliSettings } from "../config/cli-settings.service.ts";
-import { Credentials } from "./credentials.service.ts";
-
-const SERVICE = "Supabase CLI";
-const ACCOUNT = "access-token";
-const LEGACY_ACCOUNT = "supabase";
-type KeyringModule = typeof import("@napi-rs/keyring");
-
-const tryKeyringRead = (
-  module: KeyringModule,
-  account: string,
-): Effect.Effect<Option.Option<string>> =>
-  Effect.try(() => new module.Entry(SERVICE, account).getPassword()).pipe(
-    Effect.option,
-    Effect.map(
-      Option.flatMap((value) =>
-        value === null || value.length === 0 ? Option.none() : Option.some(value),
-      ),
-    ),
-  );
-
-const tryKeyringWrite = (
-  module: KeyringModule,
-  account: string,
-  token: string,
-): Effect.Effect<boolean> =>
-  Effect.try(() => {
-    new module.Entry(SERVICE, account).setPassword(token);
-    return true;
-  }).pipe(Effect.orElseSucceed(() => false));
-
-const tryKeyringDelete = (module: KeyringModule, account: string): Effect.Effect<boolean> =>
-  Effect.try(() => {
-    const entry = new module.Entry(SERVICE, account);
-    if (!entry.getPassword()) return false;
-    entry.deleteCredential();
-    return true;
-  }).pipe(Effect.orElseSucceed(() => false));
-
-/**
- * credentialsLayer - Token persistence policy for the CLI.
- *
- * The layer prefers keyring-backed storage when available, while preserving a
- * filesystem fallback for no-keyring environments and older installs.
- */
-const makeCredentials = Effect.gen(function* () {
-  const fs = yield* FileSystem.FileSystem;
-  const path = yield* Path.Path;
-  const cliSettings = yield* CliSettings;
-  const fallbackDir = cliSettings.supabaseHome;
-  const fallbackPath = path.join(fallbackDir, "access-token");
-
-  const keyringModule =
-    Option.isSome(cliSettings.noKeyring) && cliSettings.noKeyring.value === "1"
-      ? Option.none<KeyringModule>()
-      : yield* Effect.tryPromise(() => import("@napi-rs/keyring")).pipe(Effect.option);
-
-  return Credentials.of({
-    getAccessToken: Effect.gen(function* () {
-      if (Option.isSome(keyringModule)) {
-        const token = yield* tryKeyringRead(keyringModule.value, ACCOUNT);
-        if (Option.isSome(token)) {
-          return Option.some(Redacted.make(normalizeKeyringToken(token.value)));
-        }
-        const legacyToken = yield* tryKeyringRead(keyringModule.value, LEGACY_ACCOUNT);
-        if (Option.isSome(legacyToken)) {
-          return Option.some(Redacted.make(normalizeKeyringToken(legacyToken.value)));
-        }
-      }
-
-      const exists = yield* fs.exists(fallbackPath);
-      if (exists) {
-        const content = yield* fs.readFileString(fallbackPath);
-        const trimmed = content.trim();
-        if (trimmed) return Option.some(Redacted.make(trimmed));
-      }
-
-      return Option.none();
-    }),
-
-    saveAccessToken: (token: string | Redacted.Redacted<string>) =>
-      Effect.gen(function* () {
-        const plainToken = typeof token === "string" ? token : Redacted.value(token);
-        if (Option.isSome(keyringModule)) {
-          if (yield* tryKeyringWrite(keyringModule.value, ACCOUNT, plainToken)) return;
-        }
-
-        yield* fs.makeDirectory(fallbackDir, { recursive: true, mode: 0o700 });
-        yield* fs.writeFileString(fallbackPath, plainToken, { mode: 0o600 });
-      }),
-
-    deleteAccessToken: Effect.gen(function* () {
-      let anyDeleted = false;
-
-      if (Option.isSome(keyringModule)) {
-        for (const account of [ACCOUNT, LEGACY_ACCOUNT]) {
-          const deleted = yield* tryKeyringDelete(keyringModule.value, account);
-          anyDeleted ||= deleted;
-        }
-      }
-
-      const exists = yield* fs.exists(fallbackPath);
-      if (exists) {
-        const removed = yield* fs.remove(fallbackPath).pipe(
-          Effect.as(true),
-          Effect.catchTag("PlatformError", (error) =>
-            Predicate.isTagged(error.reason, "NotFound")
-              ? Effect.succeed(false)
-              : Effect.fail(error),
-          ),
-        );
-        anyDeleted ||= removed;
-      }
-
-      return anyDeleted;
-    }),
-  });
-});
-
-export const credentialsLayer = Layer.effect(Credentials, makeCredentials);
diff --git a/apps/cli/src/shared/auth/credentials.layer.unit.test.ts b/apps/cli/src/shared/auth/credentials.layer.unit.test.ts
deleted file mode 100644
index 30e2c2928d..0000000000
--- a/apps/cli/src/shared/auth/credentials.layer.unit.test.ts
+++ /dev/null
@@ -1,485 +0,0 @@
-import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
-import { beforeEach, vi } from "vitest";
-import {
-  Cause,
-  Effect,
-  Exit,
-  FileSystem,
-  Layer,
-  Option,
-  Path,
-  PlatformError,
-  Redacted,
-} from "effect";
-import { useTempWorkdir } from "../../../tests/helpers/command-mocks.ts";
-import {
-  mockCliProjectContext,
-  mockRuntimeInfo,
-  processEnvLayer,
-} from "../../../tests/helpers/mocks.ts";
-import { cliSettingsLayer } from "../config/cli-settings.layer.ts";
-import { Credentials } from "./credentials.service.ts";
-import { credentialsLayer } from "./credentials.layer.ts";
-
-const passwords = new Map<string, string>();
-let throwOnSetPassword = false;
-const throwOnGetPasswordAccounts = new Set<string>();
-const returnNullForAccounts = new Set<string>();
-const throwOnDeletePasswordAccounts = new Set<string>();
-const encodeGoKeyringBase64 = (token: string) =>
-  `go-keyring-base64:${Buffer.from(token).toString("base64")}`;
-
-vi.mock("@napi-rs/keyring", () => ({
-  Entry: class Entry {
-    service: string;
-    account: string;
-    constructor(service: string, account: string) {
-      this.service = service;
-      this.account = account;
-    }
-    getPassword(): string | null {
-      const key = `${this.service}/${this.account}`;
-      if (throwOnGetPasswordAccounts.has(key)) {
-        throw new Error("Keyring unavailable");
-      }
-      if (returnNullForAccounts.has(key)) {
-        return null;
-      }
-      if (!passwords.has(key)) {
-        throw new Error("No password found");
-      }
-      return passwords.get(key)!;
-    }
-    setPassword(password: string): void {
-      if (throwOnSetPassword) {
-        throw new Error("Keyring unavailable");
-      }
-      passwords.set(`${this.service}/${this.account}`, password);
-    }
-    deleteCredential(): boolean {
-      const key = `${this.service}/${this.account}`;
-      if (throwOnDeletePasswordAccounts.has(key)) {
-        throw new Error("Keyring unavailable");
-      }
-      if (!passwords.has(key)) {
-        throw new Error("No entry found");
-      }
-      passwords.delete(key);
-      return true;
-    }
-  },
-}));
-
-function makeLayer(
-  home: string,
-  env: Record<string, string> = {},
-  fsLayer: Layer.Layer<FileSystem.FileSystem> = BunServices.layer,
-) {
-  const runtimeInfoLayer = mockRuntimeInfo({ homeDir: home });
-  const cliProjectContextLayer = mockCliProjectContext();
-  const envLayer = processEnvLayer({ HOME: home, ...env });
-  const baseLayer = Layer.mergeAll(
-    runtimeInfoLayer,
-    cliProjectContextLayer,
-    cliSettingsLayer.pipe(
-      Layer.provide(runtimeInfoLayer),
-      Layer.provide(cliProjectContextLayer),
-      Layer.provide(envLayer),
-      Layer.provide(BunServices.layer),
-    ),
-  );
-  return credentialsLayer.pipe(
-    Layer.provide(fsLayer),
-    Layer.provide(BunServices.layer),
-    Layer.provide(baseLayer),
-  );
-}
-
-const tempHome = useTempWorkdir("supabase-creds-test-");
-
-const writeFallbackToken = (content: string) =>
-  Effect.gen(function* () {
-    const fs = yield* FileSystem.FileSystem;
-    const path = yield* Path.Path;
-    const supaDir = path.join(tempHome.current, ".supabase");
-    yield* fs.makeDirectory(supaDir, { recursive: true });
-    yield* fs.writeFileString(path.join(supaDir, "access-token"), content, { mode: 0o600 });
-  });
-
-beforeEach(() => {
-  passwords.clear();
-  throwOnSetPassword = false;
-  throwOnGetPasswordAccounts.clear();
-  returnNullForAccounts.clear();
-  throwOnDeletePasswordAccounts.clear();
-});
-
-describe("Credentials", () => {
-  const expectSomeToken = (token: Option.Option<Redacted.Redacted<string>>, expected: string) => {
-    expect(Option.isSome(token)).toBe(true);
-    if (Option.isSome(token)) {
-      expect(Redacted.value(token.value)).toBe(expected);
-    }
-  };
-
-  describe("getAccessToken", () => {
-    it.effect("reads from current account", () => {
-      passwords.set("Supabase CLI/access-token", "current-token");
-      return Effect.gen(function* () {
-        const { getAccessToken } = yield* Credentials;
-        const token = yield* getAccessToken;
-        expectSomeToken(token, "current-token");
-      }).pipe(Effect.provide(makeLayer(tempHome.current)));
-    });
-
-    it.effect("decodes Go keyring base64 values from current account", () => {
-      passwords.set("Supabase CLI/access-token", encodeGoKeyringBase64("current-token"));
-      return Effect.gen(function* () {
-        const { getAccessToken } = yield* Credentials;
-        const token = yield* getAccessToken;
-        expectSomeToken(token, "current-token");
-      }).pipe(Effect.provide(makeLayer(tempHome.current)));
-    });
-
-    it.effect("falls back to legacy account when current is missing", () => {
-      passwords.set("Supabase CLI/supabase", "legacy-token");
-      return Effect.gen(function* () {
-        const { getAccessToken } = yield* Credentials;
-        const token = yield* getAccessToken;
-        expectSomeToken(token, "legacy-token");
-      }).pipe(Effect.provide(makeLayer(tempHome.current)));
-    });
-
-    it.effect("prefers current account over legacy", () => {
-      passwords.set("Supabase CLI/access-token", "current-token");
-      passwords.set("Supabase CLI/supabase", "legacy-token");
-      return Effect.gen(function* () {
-        const { getAccessToken } = yield* Credentials;
-        const token = yield* getAccessToken;
-        expectSomeToken(token, "current-token");
-      }).pipe(Effect.provide(makeLayer(tempHome.current)));
-    });
-
-    it.effect("returns none when no token found anywhere", () => {
-      return Effect.gen(function* () {
-        const { getAccessToken } = yield* Credentials;
-        const token = yield* getAccessToken;
-        expect(token).toEqual(Option.none());
-      }).pipe(Effect.provide(makeLayer(tempHome.current)));
-    });
-
-    it.effect("falls back to filesystem when keyring throws", () => {
-      throwOnGetPasswordAccounts.add("Supabase CLI/access-token");
-      throwOnGetPasswordAccounts.add("Supabase CLI/supabase");
-      return Effect.gen(function* () {
-        yield* writeFallbackToken("fs-token-123");
-        const { getAccessToken } = yield* Credentials;
-        const token = yield* getAccessToken;
-        expectSomeToken(token, "fs-token-123");
-      }).pipe(Effect.provide(Layer.mergeAll(makeLayer(tempHome.current), BunServices.layer)));
-    });
-
-    it.effect("returns Some from filesystem in no-keyring mode", () => {
-      return Effect.gen(function* () {
-        yield* writeFallbackToken("fs-only-token");
-        const { getAccessToken } = yield* Credentials;
-        const token = yield* getAccessToken;
-        expectSomeToken(token, "fs-only-token");
-      }).pipe(
-        Effect.provide(
-          Layer.mergeAll(
-            makeLayer(tempHome.current, { SUPABASE_NO_KEYRING: "1" }),
-            BunServices.layer,
-          ),
-        ),
-      );
-    });
-
-    it.effect("returns None when filesystem file is empty", () => {
-      throwOnGetPasswordAccounts.add("Supabase CLI/access-token");
-      throwOnGetPasswordAccounts.add("Supabase CLI/supabase");
-      return Effect.gen(function* () {
-        yield* writeFallbackToken("");
-        const { getAccessToken } = yield* Credentials;
-        const token = yield* getAccessToken;
-        expect(token).toEqual(Option.none());
-      }).pipe(Effect.provide(Layer.mergeAll(makeLayer(tempHome.current), BunServices.layer)));
-    });
-
-    it.effect("returns None when filesystem file has only whitespace", () => {
-      throwOnGetPasswordAccounts.add("Supabase CLI/access-token");
-      throwOnGetPasswordAccounts.add("Supabase CLI/supabase");
-      return Effect.gen(function* () {
-        yield* writeFallbackToken("   \n  \t  ");
-        const { getAccessToken } = yield* Credentials;
-        const token = yield* getAccessToken;
-        expect(token).toEqual(Option.none());
-      }).pipe(Effect.provide(Layer.mergeAll(makeLayer(tempHome.current), BunServices.layer)));
-    });
-
-    it.effect("falls through when keyring returns null for both accounts", () => {
-      returnNullForAccounts.add("Supabase CLI/access-token");
-      returnNullForAccounts.add("Supabase CLI/supabase");
-      return Effect.gen(function* () {
-        yield* writeFallbackToken("fs-fallback-token");
-        const { getAccessToken } = yield* Credentials;
-        const token = yield* getAccessToken;
-        // keyring returns null (falsy) for both → falls through to filesystem
-        expectSomeToken(token, "fs-fallback-token");
-      }).pipe(Effect.provide(Layer.mergeAll(makeLayer(tempHome.current), BunServices.layer)));
-    });
-
-    it.effect("falls through when keyring returns empty passwords for both accounts", () => {
-      passwords.set("Supabase CLI/access-token", "");
-      passwords.set("Supabase CLI/supabase", "");
-      return Effect.gen(function* () {
-        yield* writeFallbackToken("fs-empty-keyring-fallback");
-        const { getAccessToken } = yield* Credentials;
-        const token = yield* getAccessToken;
-        expectSomeToken(token, "fs-empty-keyring-fallback");
-      }).pipe(Effect.provide(Layer.mergeAll(makeLayer(tempHome.current), BunServices.layer)));
-    });
-
-    it.effect("surfaces a filesystem read failure instead of treating it as no token", () => {
-      throwOnGetPasswordAccounts.add("Supabase CLI/access-token");
-      throwOnGetPasswordAccounts.add("Supabase CLI/supabase");
-      const failingFs = Layer.succeed(
-        FileSystem.FileSystem,
-        FileSystem.makeNoop({
-          exists: (_path: string) =>
-            Effect.fail(
-              PlatformError.systemError({
-                _tag: "PermissionDenied",
-                module: "FileSystem",
-                method: "exists",
-                description: "permission denied",
-              }),
-            ),
-          readFileString: (_path: string) =>
-            Effect.fail(
-              PlatformError.systemError({
-                _tag: "PermissionDenied",
-                module: "FileSystem",
-                method: "readFileString",
-                description: "permission denied",
-              }),
-            ),
-        }),
-      );
-      const runtimeInfoLayer = mockRuntimeInfo({ homeDir: tempHome.current });
-      const cliProjectContextLayer = mockCliProjectContext();
-      const envLayer = processEnvLayer({ HOME: tempHome.current, SUPABASE_NO_KEYRING: "1" });
-      const layer = credentialsLayer.pipe(
-        Layer.provide(failingFs),
-        Layer.provide(BunServices.layer),
-        Layer.provide(runtimeInfoLayer),
-        Layer.provide(cliProjectContextLayer),
-        Layer.provide(
-          cliSettingsLayer.pipe(
-            Layer.provide(runtimeInfoLayer),
-            Layer.provide(cliProjectContextLayer),
-            Layer.provide(envLayer),
-            Layer.provide(BunServices.layer),
-          ),
-        ),
-      );
-      return Effect.gen(function* () {
-        const { getAccessToken } = yield* Credentials;
-        const exit = yield* Effect.exit(getAccessToken);
-        expect(Exit.isFailure(exit)).toBe(true);
-        if (Exit.isFailure(exit)) {
-          const error = Cause.findErrorOption(exit.cause);
-          expect(Option.isSome(error)).toBe(true);
-          if (Option.isSome(error)) expect(error.value).toBeInstanceOf(PlatformError.PlatformError);
-        }
-      }).pipe(Effect.provide(layer));
-    });
-  });
-
-  describe("saveAccessToken", () => {
-    it.effect("surfaces a fallback directory write failure as PlatformError", () => {
-      const failingFs = Layer.succeed(
-        FileSystem.FileSystem,
-        FileSystem.makeNoop({
-          makeDirectory: () =>
-            Effect.fail(
-              PlatformError.systemError({
-                _tag: "PermissionDenied",
-                module: "FileSystem",
-                method: "makeDirectory",
-                description: "permission denied",
-              }),
-            ),
-        }),
-      );
-      return Effect.gen(function* () {
-        const { saveAccessToken } = yield* Credentials;
-        const exit = yield* Effect.exit(saveAccessToken("write-failure-token"));
-        expect(Exit.isFailure(exit)).toBe(true);
-        if (Exit.isFailure(exit)) {
-          const error = Cause.findErrorOption(exit.cause);
-          expect(Option.isSome(error)).toBe(true);
-          if (Option.isSome(error)) expect(error.value).toBeInstanceOf(PlatformError.PlatformError);
-        }
-      }).pipe(Effect.provide(makeLayer(tempHome.current, { SUPABASE_NO_KEYRING: "1" }, failingFs)));
-    });
-
-    it.effect("saves to keyring when available", () => {
-      return Effect.gen(function* () {
-        const { saveAccessToken } = yield* Credentials;
-        yield* saveAccessToken("new-token");
-        expect(passwords.get("Supabase CLI/access-token")).toBe("new-token");
-      }).pipe(Effect.provide(makeLayer(tempHome.current)));
-    });
-
-    it.effect("falls back to filesystem when setPassword throws", () => {
-      throwOnSetPassword = true;
-      return Effect.gen(function* () {
-        const fs = yield* FileSystem.FileSystem;
-        const path = yield* Path.Path;
-        yield* Effect.gen(function* () {
-          const { saveAccessToken } = yield* Credentials;
-          yield* saveAccessToken("fallback-token");
-        }).pipe(Effect.provide(makeLayer(tempHome.current)));
-        const content = yield* fs.readFileString(
-          path.join(tempHome.current, ".supabase", "access-token"),
-        );
-        expect(content).toBe("fallback-token");
-      }).pipe(Effect.provide(BunServices.layer));
-    });
-
-    it.effect("saves to filesystem in no-keyring mode", () => {
-      return Effect.gen(function* () {
-        const fs = yield* FileSystem.FileSystem;
-        const path = yield* Path.Path;
-        yield* Effect.gen(function* () {
-          const { saveAccessToken } = yield* Credentials;
-          yield* saveAccessToken("no-keyring-token");
-        }).pipe(Effect.provide(makeLayer(tempHome.current, { SUPABASE_NO_KEYRING: "1" })));
-        const content = yield* fs.readFileString(
-          path.join(tempHome.current, ".supabase", "access-token"),
-        );
-        expect(content).toBe("no-keyring-token");
-      }).pipe(Effect.provide(BunServices.layer));
-    });
-
-    it.effect("creates .supabase directory if missing", () => {
-      throwOnSetPassword = true;
-      return Effect.gen(function* () {
-        const fs = yield* FileSystem.FileSystem;
-        const path = yield* Path.Path;
-        expect(yield* fs.exists(path.join(tempHome.current, ".supabase"))).toBe(false);
-        yield* Effect.gen(function* () {
-          const { saveAccessToken } = yield* Credentials;
-          yield* saveAccessToken("create-dir-token");
-        }).pipe(Effect.provide(makeLayer(tempHome.current)));
-        expect(yield* fs.exists(path.join(tempHome.current, ".supabase"))).toBe(true);
-      }).pipe(Effect.provide(BunServices.layer));
-    });
-  });
-
-  describe("deleteAccessToken", () => {
-    it.effect("surfaces a fallback file delete failure as PlatformError", () => {
-      const failingFs = Layer.succeed(
-        FileSystem.FileSystem,
-        FileSystem.makeNoop({
-          exists: () => Effect.succeed(true),
-          remove: () =>
-            Effect.fail(
-              PlatformError.systemError({
-                _tag: "PermissionDenied",
-                module: "FileSystem",
-                method: "remove",
-                description: "permission denied",
-              }),
-            ),
-        }),
-      );
-      return Effect.gen(function* () {
-        const { deleteAccessToken } = yield* Credentials;
-        const exit = yield* Effect.exit(deleteAccessToken);
-        expect(Exit.isFailure(exit)).toBe(true);
-        if (Exit.isFailure(exit)) {
-          const error = Cause.findErrorOption(exit.cause);
-          expect(Option.isSome(error)).toBe(true);
-          if (Option.isSome(error)) expect(error.value).toBeInstanceOf(PlatformError.PlatformError);
-        }
-      }).pipe(Effect.provide(makeLayer(tempHome.current, { SUPABASE_NO_KEYRING: "1" }, failingFs)));
-    });
-
-    it.effect("returns false when no token exists anywhere", () => {
-      return Effect.gen(function* () {
-        const { deleteAccessToken } = yield* Credentials;
-        const deleted = yield* deleteAccessToken;
-        expect(deleted).toBe(false);
-      }).pipe(Effect.provide(makeLayer(tempHome.current)));
-    });
-
-    it.effect("deletes current keyring account and returns true", () => {
-      passwords.set("Supabase CLI/access-token", "my-token");
-      return Effect.gen(function* () {
-        const { deleteAccessToken } = yield* Credentials;
-        const deleted = yield* deleteAccessToken;
-        expect(deleted).toBe(true);
-        expect(passwords.has("Supabase CLI/access-token")).toBe(false);
-      }).pipe(Effect.provide(makeLayer(tempHome.current)));
-    });
-
-    it.effect("deletes legacy keyring account when current is absent", () => {
-      passwords.set("Supabase CLI/supabase", "legacy-token");
-      return Effect.gen(function* () {
-        const { deleteAccessToken } = yield* Credentials;
-        const deleted = yield* deleteAccessToken;
-        expect(deleted).toBe(true);
-        expect(passwords.has("Supabase CLI/supabase")).toBe(false);
-      }).pipe(Effect.provide(makeLayer(tempHome.current)));
-    });
-
-    it.effect("deletes both keyring accounts when both exist", () => {
-      passwords.set("Supabase CLI/access-token", "current-token");
-      passwords.set("Supabase CLI/supabase", "legacy-token");
-      return Effect.gen(function* () {
-        const { deleteAccessToken } = yield* Credentials;
-        const deleted = yield* deleteAccessToken;
-        expect(deleted).toBe(true);
-        expect(passwords.has("Supabase CLI/access-token")).toBe(false);
-        expect(passwords.has("Supabase CLI/supabase")).toBe(false);
-      }).pipe(Effect.provide(makeLayer(tempHome.current)));
-    });
-
-    it.effect("deletes filesystem token and returns true", () => {
-      throwOnDeletePasswordAccounts.add("Supabase CLI/access-token");
-      throwOnDeletePasswordAccounts.add("Supabase CLI/supabase");
-      return Effect.gen(function* () {
-        const fs = yield* FileSystem.FileSystem;
-        const path = yield* Path.Path;
-        yield* writeFallbackToken("fs-token");
-        const deleted = yield* Effect.gen(function* () {
-          const { deleteAccessToken } = yield* Credentials;
-          return yield* deleteAccessToken;
-        }).pipe(Effect.provide(makeLayer(tempHome.current)));
-        expect(deleted).toBe(true);
-        expect(yield* fs.exists(path.join(tempHome.current, ".supabase", "access-token"))).toBe(
-          false,
-        );
-      }).pipe(Effect.provide(BunServices.layer));
-    });
-
-    it.effect("deletes filesystem token in no-keyring mode", () => {
-      return Effect.gen(function* () {
-        const fs = yield* FileSystem.FileSystem;
-        const path = yield* Path.Path;
-        yield* writeFallbackToken("fs-token");
-        const deleted = yield* Effect.gen(function* () {
-          const { deleteAccessToken } = yield* Credentials;
-          return yield* deleteAccessToken;
-        }).pipe(Effect.provide(makeLayer(tempHome.current, { SUPABASE_NO_KEYRING: "1" })));
-        expect(deleted).toBe(true);
-        expect(yield* fs.exists(path.join(tempHome.current, ".supabase", "access-token"))).toBe(
-          false,
-        );
-      }).pipe(Effect.provide(BunServices.layer));
-    });
-  });
-});
diff --git a/apps/cli/src/shared/auth/credentials.service.ts b/apps/cli/src/shared/auth/credentials.service.ts
deleted file mode 100644
index afef9bb891..0000000000
--- a/apps/cli/src/shared/auth/credentials.service.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-import type { Effect, Option, Redacted } from "effect";
-import { Context } from "effect";
-import type { PlatformError } from "effect/PlatformError";
-
-/**
- * Credentials - Boundary for loading and persisting the CLI access token.
- *
- * The implementation owns fallback policy between keyring-backed storage and the
- * filesystem so command handlers can treat token storage as one stable service.
- */
-interface CredentialsShape {
-  readonly getAccessToken: Effect.Effect<Option.Option<Redacted.Redacted<string>>, PlatformError>;
-  readonly saveAccessToken: (
-    token: string | Redacted.Redacted<string>,
-  ) => Effect.Effect<void, PlatformError>;
-  /** Deletes the stored access token from all locations. Returns true if a token was found and removed. */
-  readonly deleteAccessToken: Effect.Effect<boolean, PlatformError>;
-}
-
-/**
- * Credentials - Service tag for access token persistence.
- */
-export class Credentials extends Context.Service<Credentials, CredentialsShape>()(
-  "supabase/auth/Credentials",
-) {}
diff --git a/apps/cli/src/shared/auth/crypto.layer.ts b/apps/cli/src/shared/auth/crypto.layer.ts
deleted file mode 100644
index 32a1f40ab6..0000000000
--- a/apps/cli/src/shared/auth/crypto.layer.ts
+++ /dev/null
@@ -1,46 +0,0 @@
-import { Buffer } from "node:buffer";
-import { createDecipheriv, createECDH, randomUUID, type ECDH } from "node:crypto";
-import { hostname, userInfo } from "node:os";
-import { Clock, Effect, Layer } from "effect";
-
-import { Crypto, type EncryptedPayload } from "./crypto.service.ts";
-
-export const cryptoLayer = Layer.sync(Crypto, () =>
-  Crypto.of({
-    generateKeyPair: Effect.sync(() => {
-      const ecdh = createECDH("prime256v1");
-      ecdh.generateKeys();
-      return { ecdh, publicKeyHex: ecdh.getPublicKey("hex", "uncompressed") };
-    }),
-    generateSessionId: Effect.sync(() => randomUUID()),
-    defaultTokenName: Clock.currentTimeMillis.pipe(
-      Effect.map((ts) => {
-        try {
-          const user = userInfo().username;
-          const host = hostname();
-          if (user && host) return `cli_${user}@${host}_${ts}`;
-        } catch {
-          /* fall through */
-        }
-        return `cli_${ts}`;
-      }),
-    ),
-    decryptToken: (ecdh: ECDH, payload: EncryptedPayload) =>
-      Effect.sync(() => {
-        const sharedSecret = ecdh.computeSecret(Buffer.from(payload.publicKey, "hex"));
-        const ciphertextHex = payload.ciphertext.slice(0, -32);
-        const authTagHex = payload.ciphertext.slice(-32);
-        const decipher = createDecipheriv(
-          "aes-256-gcm",
-          sharedSecret,
-          Buffer.from(payload.nonce, "hex"),
-        );
-        decipher.setAuthTag(Buffer.from(authTagHex, "hex"));
-        const decrypted = Buffer.concat([
-          decipher.update(Buffer.from(ciphertextHex, "hex")),
-          decipher.final(),
-        ]);
-        return decrypted.toString("utf-8");
-      }),
-  }),
-);
diff --git a/apps/cli/src/shared/auth/crypto.layer.unit.test.ts b/apps/cli/src/shared/auth/crypto.layer.unit.test.ts
deleted file mode 100644
index 314b78b996..0000000000
--- a/apps/cli/src/shared/auth/crypto.layer.unit.test.ts
+++ /dev/null
@@ -1,254 +0,0 @@
-import { Buffer } from "node:buffer";
-import { describe, expect, it } from "@effect/vitest";
-import { createCipheriv, createECDH, randomBytes } from "node:crypto";
-import { vi } from "vitest";
-import { Cause, Clock, Effect, Exit } from "effect";
-import { Crypto } from "./crypto.service.ts";
-import { cryptoLayer } from "./crypto.layer.ts";
-
-const mockOs = vi.hoisted(() => ({
-  userInfoShouldThrow: false,
-  userInfoReturnEmptyUsername: false,
-}));
-
-vi.mock("node:os", (importOriginal) =>
-  importOriginal<typeof import("node:os")>().then((actual) => ({
-    ...actual,
-    userInfo: (...args: Parameters<typeof actual.userInfo>) => {
-      if (mockOs.userInfoShouldThrow) throw new Error("userInfo unavailable");
-      if (mockOs.userInfoReturnEmptyUsername) return { ...actual.userInfo(...args), username: "" };
-      return actual.userInfo(...args);
-    },
-  })),
-);
-
-const testLayer = cryptoLayer;
-
-/**
- * Encrypts a plaintext string using AES-256-GCM with an ECDH shared secret.
- * This is the inverse of `decryptToken` in the Crypto service and is used
- * to set up meaningful round-trip tests.
- */
-function encryptWithEcdh(
-  serverPrivateKeyHex: string,
-  clientPublicKeyHex: string,
-  plaintext: string,
-): { ciphertext: string; publicKey: string; nonce: string } {
-  const serverEcdh = createECDH("prime256v1");
-  serverEcdh.setPrivateKey(Buffer.from(serverPrivateKeyHex, "hex"));
-  const sharedSecret = serverEcdh.computeSecret(Buffer.from(clientPublicKeyHex, "hex"));
-
-  const nonce = randomBytes(12);
-  const cipher = createCipheriv("aes-256-gcm", sharedSecret, nonce);
-  const encrypted = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
-  const authTag = cipher.getAuthTag();
-  // ciphertext = encrypted || authTag (16 bytes = 32 hex chars)
-  const ciphertext = encrypted.toString("hex") + authTag.toString("hex");
-
-  return {
-    ciphertext,
-    publicKey: serverEcdh.getPublicKey("hex", "uncompressed"),
-    nonce: nonce.toString("hex"),
-  };
-}
-
-describe("Crypto", () => {
-  describe("generateKeyPair", () => {
-    it.effect("returns an ECDH instance and a hex-encoded uncompressed public key", () => {
-      return Effect.gen(function* () {
-        const { generateKeyPair } = yield* Crypto;
-        const { ecdh, publicKeyHex } = yield* generateKeyPair;
-
-        expect(publicKeyHex).toHaveLength(130);
-        expect(publicKeyHex.startsWith("04")).toBe(true);
-
-        expect(ecdh.getPrivateKey()).toBeInstanceOf(Buffer);
-        expect(ecdh.getPrivateKey().length).toBeGreaterThan(0);
-
-        expect(ecdh.getPublicKey("hex", "uncompressed")).toBe(publicKeyHex);
-      }).pipe(Effect.provide(testLayer));
-    });
-
-    it.effect("generates a different key pair on each call", () => {
-      return Effect.gen(function* () {
-        const { generateKeyPair } = yield* Crypto;
-        const first = yield* generateKeyPair;
-        const second = yield* generateKeyPair;
-        expect(first.publicKeyHex).not.toBe(second.publicKeyHex);
-      }).pipe(Effect.provide(testLayer));
-    });
-  });
-
-  describe("generateSessionId", () => {
-    it.effect("returns a valid UUID v4", () => {
-      return Effect.gen(function* () {
-        const { generateSessionId } = yield* Crypto;
-        const id = yield* generateSessionId;
-        expect(id).toMatch(
-          /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,
-        );
-      }).pipe(Effect.provide(testLayer));
-    });
-
-    it.effect("generates a different session ID on each call", () => {
-      return Effect.gen(function* () {
-        const { generateSessionId } = yield* Crypto;
-        const first = yield* generateSessionId;
-        const second = yield* generateSessionId;
-        expect(first).not.toBe(second);
-      }).pipe(Effect.provide(testLayer));
-    });
-  });
-
-  describe("defaultTokenName", () => {
-    it.effect("returns a string starting with cli_", () => {
-      return Effect.gen(function* () {
-        const { defaultTokenName } = yield* Crypto;
-        const name = yield* defaultTokenName;
-        expect(name.startsWith("cli_")).toBe(true);
-      }).pipe(Effect.provide(testLayer));
-    });
-
-    it.live("contains a numeric timestamp", () =>
-      Effect.gen(function* () {
-        const before = yield* Clock.currentTimeMillis;
-        const { defaultTokenName } = yield* Crypto;
-        const name = yield* defaultTokenName;
-        const after = yield* Clock.currentTimeMillis;
-
-        // Token names end with _<timestamp>: cli_<ts> or cli_<user>@<host>_<ts>.
-        const match = name.match(/_(\d+)$/);
-        expect(match).not.toBeNull();
-        const ts = Number(match![1]);
-        expect(ts).toBeGreaterThanOrEqual(before);
-        expect(ts).toBeLessThanOrEqual(after);
-      }).pipe(Effect.provide(testLayer)),
-    );
-
-    it.effect("falls back to cli_<ts> when userInfo throws", () => {
-      mockOs.userInfoShouldThrow = true;
-      // testLayer can be reused here since defaultTokenName calls userInfo lazily, inside
-      // Effect.sync, at invocation time rather than at layer-construction time.
-      return Effect.gen(function* () {
-        const { defaultTokenName } = yield* Crypto;
-        const name = yield* defaultTokenName;
-        expect(name).toMatch(/^cli_\d+$/);
-      }).pipe(
-        Effect.provide(testLayer),
-        Effect.ensuring(
-          Effect.sync(() => {
-            mockOs.userInfoShouldThrow = false;
-          }),
-        ),
-      );
-    });
-
-    it.effect("falls back to cli_<ts> when username is empty (if-branch false path)", () => {
-      mockOs.userInfoReturnEmptyUsername = true;
-      return Effect.gen(function* () {
-        const { defaultTokenName } = yield* Crypto;
-        const name = yield* defaultTokenName;
-        expect(name).toMatch(/^cli_\d+$/);
-      }).pipe(
-        Effect.provide(testLayer),
-        Effect.ensuring(
-          Effect.sync(() => {
-            mockOs.userInfoReturnEmptyUsername = false;
-          }),
-        ),
-      );
-    });
-  });
-
-  describe("decryptToken", () => {
-    it.effect("decrypts a token encrypted with the corresponding ECDH public key", () => {
-      return Effect.gen(function* () {
-        const { generateKeyPair, decryptToken } = yield* Crypto;
-
-        const { ecdh: clientEcdh, publicKeyHex: clientPublicKeyHex } = yield* generateKeyPair;
-
-        const serverEcdh = createECDH("prime256v1");
-        serverEcdh.generateKeys();
-        const serverPrivateKeyHex = serverEcdh.getPrivateKey("hex");
-        const plaintext = "sbp_test_secret_access_token_12345";
-        const payload = encryptWithEcdh(serverPrivateKeyHex, clientPublicKeyHex, plaintext);
-
-        const decrypted = yield* decryptToken(clientEcdh, payload);
-        expect(decrypted).toBe(plaintext);
-      }).pipe(Effect.provide(testLayer));
-    });
-
-    it.effect("decrypts tokens containing unicode characters", () => {
-      return Effect.gen(function* () {
-        const { generateKeyPair, decryptToken } = yield* Crypto;
-
-        const { ecdh: clientEcdh, publicKeyHex: clientPublicKeyHex } = yield* generateKeyPair;
-
-        const serverEcdh = createECDH("prime256v1");
-        serverEcdh.generateKeys();
-        const serverPrivateKeyHex = serverEcdh.getPrivateKey("hex");
-        const plaintext = "token_with_unicode_\u00e9\u4e2d\u6587";
-        const payload = encryptWithEcdh(serverPrivateKeyHex, clientPublicKeyHex, plaintext);
-
-        const decrypted = yield* decryptToken(clientEcdh, payload);
-        expect(decrypted).toBe(plaintext);
-      }).pipe(Effect.provide(testLayer));
-    });
-
-    it.effect("produces different ciphertexts for the same plaintext due to random nonce", () => {
-      return Effect.gen(function* () {
-        const { generateKeyPair, decryptToken } = yield* Crypto;
-
-        const { ecdh: clientEcdh, publicKeyHex: clientPublicKeyHex } = yield* generateKeyPair;
-
-        const serverEcdh = createECDH("prime256v1");
-        serverEcdh.generateKeys();
-        const serverPrivateKeyHex = serverEcdh.getPrivateKey("hex");
-        const plaintext = "same_plaintext";
-
-        const payload1 = encryptWithEcdh(serverPrivateKeyHex, clientPublicKeyHex, plaintext);
-        const payload2 = encryptWithEcdh(serverPrivateKeyHex, clientPublicKeyHex, plaintext);
-
-        expect(payload1.nonce).not.toBe(payload2.nonce);
-        expect(payload1.ciphertext).not.toBe(payload2.ciphertext);
-
-        const decrypted1 = yield* decryptToken(clientEcdh, payload1);
-        const decrypted2 = yield* decryptToken(clientEcdh, payload2);
-        expect(decrypted1).toBe(plaintext);
-        expect(decrypted2).toBe(plaintext);
-      }).pipe(Effect.provide(testLayer));
-    });
-
-    it.effect("fails when the ciphertext has been tampered with", () => {
-      return Effect.gen(function* () {
-        const { generateKeyPair, decryptToken } = yield* Crypto;
-
-        const { ecdh: clientEcdh, publicKeyHex: clientPublicKeyHex } = yield* generateKeyPair;
-
-        const serverEcdh = createECDH("prime256v1");
-        serverEcdh.generateKeys();
-        const serverPrivateKeyHex = serverEcdh.getPrivateKey("hex");
-        const plaintext = "sbp_secret_token_to_tamper";
-
-        const payload = encryptWithEcdh(serverPrivateKeyHex, clientPublicKeyHex, plaintext);
-
-        // Flip the first character of the ciphertext to corrupt the auth tag verification
-        const firstChar = payload.ciphertext[0];
-        const flippedChar = firstChar === "a" ? "b" : "a";
-        const tamperedPayload = {
-          ...payload,
-          ciphertext: flippedChar + payload.ciphertext.slice(1),
-        };
-
-        // decryptToken wraps the crypto call in Effect.sync, so the auth-tag failure surfaces
-        // as a Die (defect), not a typed error.
-        const exit = yield* decryptToken(clientEcdh, tamperedPayload).pipe(Effect.exit);
-        expect(Exit.isFailure(exit)).toBe(true);
-        if (Exit.isFailure(exit)) {
-          const hasDie = exit.cause.reasons.some(Cause.isDieReason);
-          expect(hasDie).toBe(true);
-        }
-      }).pipe(Effect.provide(testLayer));
-    });
-  });
-});
diff --git a/apps/cli/src/shared/auth/crypto.service.ts b/apps/cli/src/shared/auth/crypto.service.ts
deleted file mode 100644
index e519614b4f..0000000000
--- a/apps/cli/src/shared/auth/crypto.service.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-import type { ECDH } from "node:crypto";
-import type { Effect } from "effect";
-import { Context } from "effect";
-
-export type EncryptedPayload = { ciphertext: string; publicKey: string; nonce: string };
-
-interface CryptoShape {
-  readonly generateKeyPair: Effect.Effect<{ ecdh: ECDH; publicKeyHex: string }>;
-  readonly generateSessionId: Effect.Effect<string>;
-  readonly defaultTokenName: Effect.Effect<string>;
-  readonly decryptToken: (ecdh: ECDH, payload: EncryptedPayload) => Effect.Effect<string>;
-}
-
-export class Crypto extends Context.Service<Crypto, CryptoShape>()("supabase/auth/Crypto") {}
diff --git a/apps/cli/src/shared/auth/errors.ts b/apps/cli/src/shared/auth/errors.ts
deleted file mode 100644
index 8e4521ff08..0000000000
--- a/apps/cli/src/shared/auth/errors.ts
+++ /dev/null
@@ -1,58 +0,0 @@
-import { Data } from "effect";
-import {
-  actionability,
-  type CliErrorActionabilityDeclaration,
-  ErrorActionabilityId,
-  statusCodeActionability,
-} from "../telemetry/error-actionability.ts";
-
-export class InvalidTokenError extends Data.TaggedError("InvalidTokenError")<{
-  readonly detail: string;
-  readonly suggestion: string;
-  /**
-   * Where the malformed token came from. Direct-input tokens (`--token` flag,
-   * `SUPABASE_ACCESS_TOKEN`, piped stdin) cannot be fixed by `supabase login`,
-   * so their remediation is to correct that input. A token from the browser
-   * flow (no source) is fixable by logging in again.
-   */
-  readonly source?: "env" | "flag" | "stdin";
-}> {
-  override get message() {
-    return `${this.detail}\n  Suggestion: ${this.suggestion}`;
-  }
-  get [ErrorActionabilityId](): CliErrorActionabilityDeclaration {
-    return this.source === undefined ? actionability.authLogin : actionability.authToken;
-  }
-}
-
-export class ApiError extends Data.TaggedError("ApiError")<{
-  readonly statusCode?: number;
-  readonly detail: string;
-  /**
-   * Set when this error represents a body/schema decode failure on an
-   * otherwise-successful response (no status code to classify by), rather
-   * than a transport failure — so it classifies as an API response problem
-   * instead of a network problem.
-   */
-  readonly decode?: boolean;
-}> {
-  get [ErrorActionabilityId](): CliErrorActionabilityDeclaration {
-    if (this.statusCode !== undefined) {
-      return statusCodeActionability(this.statusCode);
-    }
-    if (this.decode === true) {
-      return { ...actionability.apiStatus, fingerprint_suffix: "api_response" };
-    }
-    return statusCodeActionability(undefined);
-  }
-}
-
-export class PlatformAuthRequiredError extends Data.TaggedError("PlatformAuthRequiredError")<{
-  readonly message: string;
-  readonly detail?: string;
-  readonly suggestion?: string;
-}> {
-  get [ErrorActionabilityId](): CliErrorActionabilityDeclaration {
-    return actionability.authLogin;
-  }
-}
diff --git a/apps/cli/src/shared/auth/platform-api.layer.ts b/apps/cli/src/shared/auth/platform-api.layer.ts
deleted file mode 100644
index 55aa052ecc..0000000000
--- a/apps/cli/src/shared/auth/platform-api.layer.ts
+++ /dev/null
@@ -1,39 +0,0 @@
-import { Effect, Layer, Option } from "effect";
-import { makeApiClient } from "@supabase/api/effect";
-
-import { CommandRuntime, getCommandRuntimeCommand } from "../runtime/command-runtime.service.ts";
-import { CliSettings } from "../config/cli-settings.service.ts";
-import { PlatformAuthRequiredError } from "./errors.ts";
-import { Credentials } from "./credentials.service.ts";
-import { PlatformApi } from "./platform-api.service.ts";
-
-export const makePlatformApiServices = Effect.gen(function* () {
-  const cliSettings = yield* CliSettings;
-  const credentials = yield* Credentials;
-  const commandRuntime = yield* CommandRuntime;
-
-  const configuredToken = cliSettings.accessToken;
-  const storedToken = yield* credentials.getAccessToken;
-  const token = Option.isSome(configuredToken) ? configuredToken : storedToken;
-
-  if (Option.isNone(token)) {
-    return yield* new PlatformAuthRequiredError({
-      message: "You are not logged in to Supabase.",
-      detail: "Platform commands require a management API access token.",
-      suggestion: "Run `supabase login` or set SUPABASE_ACCESS_TOKEN before retrying.",
-    });
-  }
-
-  const config = {
-    baseUrl: cliSettings.apiUrl,
-    accessToken: token.value,
-    userAgent: "supabase",
-    headers: {
-      "X-Supabase-Command": getCommandRuntimeCommand(commandRuntime),
-      "X-Supabase-Command-Run-ID": commandRuntime.commandRunId,
-    },
-  };
-
-  const api = yield* makeApiClient(config);
-  return Layer.succeed(PlatformApi, api);
-});
diff --git a/apps/cli/src/shared/auth/platform-api.layer.unit.test.ts b/apps/cli/src/shared/auth/platform-api.layer.unit.test.ts
deleted file mode 100644
index c4a9f5d132..0000000000
--- a/apps/cli/src/shared/auth/platform-api.layer.unit.test.ts
+++ /dev/null
@@ -1,262 +0,0 @@
-import { describe, expect, it } from "@effect/vitest";
-import { Effect, Exit, Layer, Option, Redacted, Stdio } from "effect";
-import * as HttpClient from "effect/unstable/http/HttpClient";
-import * as HttpClientError from "effect/unstable/http/HttpClientError";
-import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
-import type * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
-
-import { CliSettings } from "../config/cli-settings.service.ts";
-import { CommandRuntime } from "../runtime/command-runtime.service.ts";
-import { CurrentAnalyticsContext } from "../telemetry/analytics-context.ts";
-import { Analytics } from "../telemetry/analytics.service.ts";
-import { withCommandInstrumentation } from "../telemetry/command-instrumentation.ts";
-import { Credentials } from "./credentials.service.ts";
-import { PlatformApi } from "./platform-api.service.ts";
-import { makePlatformApiServices } from "./platform-api.layer.ts";
-import { mockOutput } from "../../../tests/helpers/mocks.ts";
-
-function httpClientLayer(
-  handler: (
-    request: HttpClientRequest.HttpClientRequest,
-  ) => Effect.Effect<HttpClientResponse.HttpClientResponse, HttpClientError.HttpClientError>,
-) {
-  return Layer.succeed(
-    HttpClient.HttpClient,
-    HttpClient.make((request) => handler(request)),
-  );
-}
-
-function jsonResponse(
-  request: HttpClientRequest.HttpClientRequest,
-  status: number,
-  body: unknown,
-): HttpClientResponse.HttpClientResponse {
-  return HttpClientResponse.fromWeb(
-    request,
-    new Response(JSON.stringify(body), {
-      status,
-      headers: {
-        "content-type": "application/json",
-      },
-    }),
-  );
-}
-
-function cliSettingsLayer(token = Option.none<Redacted.Redacted<string>>()) {
-  return Layer.succeed(
-    CliSettings,
-    CliSettings.of({
-      apiUrl: "https://api.supabase.com",
-      dashboardUrl: "https://supabase.com/dashboard",
-      projectHost: "supabase.co",
-      telemetryPosthogHost: "https://us.i.posthog.com",
-      telemetryPosthogKey: Option.some("phc_test_key"),
-      accessToken: token,
-      noKeyring: Option.none(),
-      supabaseHome: "/tmp/supabase-cli-test-home",
-      debug: Option.none(),
-      telemetryDebug: Option.none(),
-      telemetryDisabled: Option.none(),
-      doNotTrack: Option.none(),
-    }),
-  );
-}
-
-function credentialsLayer(token?: string) {
-  return Layer.succeed(
-    Credentials,
-    Credentials.of({
-      getAccessToken: Effect.succeed(
-        token === undefined ? Option.none() : Option.some(Redacted.make(token)),
-      ),
-      saveAccessToken: () => Effect.void,
-      deleteAccessToken: Effect.succeed(false),
-    }),
-  );
-}
-
-function commandRuntimeLayer(command: string, commandRunId: string) {
-  return Layer.succeed(
-    CommandRuntime,
-    CommandRuntime.of({
-      commandPath: command.split(" "),
-      commandRunId,
-    }),
-  );
-}
-
-function mockContextualAnalytics() {
-  const captured: Array<{
-    event: string;
-    properties: Record<string, unknown>;
-  }> = [];
-
-  const layer = Layer.succeed(
-    Analytics,
-    Analytics.of({
-      capture: (event: string, properties: Record<string, unknown> = {}) =>
-        Effect.gen(function* () {
-          const context = yield* CurrentAnalyticsContext;
-          captured.push({
-            event,
-            properties: {
-              ...context,
-              ...properties,
-            },
-          });
-        }),
-      identify: () => Effect.void,
-      alias: () => Effect.void,
-      groupIdentify: () => Effect.void,
-    }),
-  );
-
-  return { layer, captured };
-}
-
-describe("platformApiLayer", () => {
-  it.effect("fails with PlatformAuthRequiredError when no token is available", () => {
-    const layer = Layer.unwrap(makePlatformApiServices).pipe(
-      Layer.provide(cliSettingsLayer()),
-      Layer.provide(credentialsLayer()),
-      Layer.provide(commandRuntimeLayer("branches list", "run-no-token")),
-      Layer.provide(
-        httpClientLayer((request) =>
-          Effect.succeed(
-            jsonResponse(request, 200, {
-              ok: true,
-            }),
-          ),
-        ),
-      ),
-    );
-
-    return Effect.gen(function* () {
-      const exit = yield* PlatformApi.pipe(Effect.provide(layer), Effect.exit);
-      expect(Exit.isFailure(exit)).toBe(true);
-      if (Exit.isFailure(exit)) {
-        expect(String(exit.cause)).toContain("PlatformAuthRequiredError");
-      }
-    });
-  });
-
-  it.effect("injects auth and shared command headers on every request", () => {
-    const seenRequests: Array<{
-      authorization: string | undefined;
-      userAgent: string | undefined;
-      command: string | undefined;
-      commandRunId: string | undefined;
-    }> = [];
-
-    const layer = Layer.unwrap(makePlatformApiServices).pipe(
-      Layer.provide(cliSettingsLayer()),
-      Layer.provide(credentialsLayer("stored-token")),
-      Layer.provide(commandRuntimeLayer("branches list", "run-headers")),
-      Layer.provide(
-        httpClientLayer((request) => {
-          seenRequests.push({
-            authorization: request.headers.authorization,
-            userAgent: request.headers["user-agent"],
-            command: request.headers["x-supabase-command"],
-            commandRunId: request.headers["x-supabase-command-run-id"],
-          });
-
-          return Effect.succeed(
-            jsonResponse(request, 200, [
-              {
-                id: "00000000-0000-4000-8000-000000000001",
-                name: "main",
-                project_ref: "mainrefghijklmnopqrst",
-                parent_project_ref: "parentrefabcdefghijk",
-                is_default: true,
-                persistent: true,
-                status: "MIGRATIONS_PASSED",
-                created_at: "2024-01-15T10:30:00.000Z",
-                updated_at: "2024-01-15T10:30:00.000Z",
-                with_data: false,
-              },
-            ]),
-          );
-        }),
-      ),
-    );
-
-    return Effect.gen(function* () {
-      const api = yield* PlatformApi;
-      yield* api.v1.listAllBranches({ ref: "abcdefghijklmnopqrst" });
-      yield* api.v1.listAllBranches({ ref: "abcdefghijklmnopqrst" });
-      expect(seenRequests).toEqual([
-        {
-          authorization: "Bearer stored-token",
-          userAgent: "supabase",
-          command: "branches list",
-          commandRunId: "run-headers",
-        },
-        {
-          authorization: "Bearer stored-token",
-          userAgent: "supabase",
-          command: "branches list",
-          commandRunId: "run-headers",
-        },
-      ]);
-    }).pipe(Effect.provide(layer));
-  });
-
-  it.effect("shares the command run id between analytics and API headers", () => {
-    const analytics = mockContextualAnalytics();
-    const seenRunIds: string[] = [];
-    const runtimeLayer = commandRuntimeLayer("branches list", "run-analytics");
-
-    const layer = Layer.unwrap(makePlatformApiServices).pipe(
-      Layer.provide(cliSettingsLayer()),
-      Layer.provide(credentialsLayer("stored-token")),
-      Layer.provide(runtimeLayer),
-      Layer.provide(
-        httpClientLayer((request) => {
-          seenRunIds.push(request.headers["x-supabase-command-run-id"] ?? "");
-          return Effect.succeed(
-            jsonResponse(request, 200, [
-              {
-                id: "00000000-0000-4000-8000-000000000001",
-                name: "main",
-                project_ref: "mainrefghijklmnopqrst",
-                parent_project_ref: "parentrefabcdefghijk",
-                is_default: true,
-                persistent: true,
-                status: "MIGRATIONS_PASSED",
-                created_at: "2024-01-15T10:30:00.000Z",
-                updated_at: "2024-01-15T10:30:00.000Z",
-                with_data: false,
-              },
-            ]),
-          );
-        }),
-      ),
-    );
-
-    return Effect.gen(function* () {
-      const api = yield* PlatformApi;
-      yield* api.v1.listAllBranches({ ref: "abcdefghijklmnopqrst" });
-    }).pipe(
-      withCommandInstrumentation(),
-      Effect.provide(
-        Layer.mergeAll(
-          layer,
-          runtimeLayer,
-          analytics.layer,
-          mockOutput({ format: "text" }).layer,
-          Stdio.layerTest({
-            args: Effect.succeed(["branches", "list"]),
-          }),
-        ),
-      ),
-      Effect.tap(() =>
-        Effect.sync(() => {
-          expect(seenRunIds).toEqual(["run-analytics"]);
-          expect(analytics.captured).toHaveLength(1);
-          expect(analytics.captured[0]?.properties.command_run_id).toBe("run-analytics");
-        }),
-      ),
-    );
-  });
-});
diff --git a/apps/cli/src/shared/auth/platform-api.service.ts b/apps/cli/src/shared/auth/platform-api.service.ts
deleted file mode 100644
index 68d7d72f88..0000000000
--- a/apps/cli/src/shared/auth/platform-api.service.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-import type { ApiClient } from "@supabase/api/effect";
-import { Context } from "effect";
-
-export class PlatformApi extends Context.Service<PlatformApi, ApiClient>()(
-  "supabase/auth/PlatformApi",
-) {}
diff --git a/apps/cli/src/shared/auth/token.ts b/apps/cli/src/shared/auth/token.ts
deleted file mode 100644
index 00f959149d..0000000000
--- a/apps/cli/src/shared/auth/token.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-import { Effect } from "effect";
-import { InvalidTokenError } from "./errors.ts";
-
-const TOKEN_PATTERN = /^sbp_(oauth_)?[a-f0-9]{40}$/;
-
-export const validateToken = Effect.fnUntraced(function* (
-  token: string,
-  source?: "env" | "flag" | "stdin",
-) {
-  if (!TOKEN_PATTERN.test(token)) {
-    return yield* new InvalidTokenError({
-      detail: "Invalid access token format",
-      suggestion: "Generate a token at https://supabase.com/dashboard/account/tokens",
-      source,
-    });
-  }
-});
diff --git a/apps/cli/src/shared/auth/token.unit.test.ts b/apps/cli/src/shared/auth/token.unit.test.ts
deleted file mode 100644
index b420e388df..0000000000
--- a/apps/cli/src/shared/auth/token.unit.test.ts
+++ /dev/null
@@ -1,103 +0,0 @@
-import { describe, expect, it } from "@effect/vitest";
-import { Effect, Exit, Option } from "effect";
-import { InvalidTokenError } from "./errors.ts";
-import { validateToken } from "./token.ts";
-
-const VALID_HEX_40 = "a".repeat(40);
-
-function expectInvalidTokenError(exit: Exit.Exit<unknown, unknown>) {
-  expect(Exit.isFailure(exit)).toBe(true);
-  const errorOption = Exit.findErrorOption(exit);
-  expect(Option.isSome(errorOption)).toBe(true);
-  if (Option.isSome(errorOption)) {
-    expect(errorOption.value).toBeInstanceOf(InvalidTokenError);
-  }
-}
-
-describe("validateToken", () => {
-  describe("valid tokens", () => {
-    it.live("accepts sbp_ prefix with 40 lowercase hex chars", () =>
-      validateToken(`sbp_${VALID_HEX_40}`),
-    );
-
-    it.live("accepts sbp_oauth_ prefix with 40 lowercase hex chars", () =>
-      validateToken(`sbp_oauth_${VALID_HEX_40}`),
-    );
-
-    it.live("accepts all valid hex characters (a-f, 0-9)", () =>
-      validateToken("sbp_abcdef0123456789abcdef0123456789abcdef01"),
-    );
-  });
-
-  describe("invalid tokens", () => {
-    it.live("rejects uppercase hex characters in sbp_ token", () =>
-      Effect.gen(function* () {
-        const exit = yield* validateToken(`sbp_${"A".repeat(40)}`).pipe(Effect.exit);
-        expectInvalidTokenError(exit);
-      }),
-    );
-
-    it.live("rejects uppercase hex characters in sbp_oauth_ token", () =>
-      Effect.gen(function* () {
-        const exit = yield* validateToken(`sbp_oauth_${"A".repeat(40)}`).pipe(Effect.exit);
-        expectInvalidTokenError(exit);
-      }),
-    );
-
-    it.live("rejects token that is too short (39 hex chars)", () =>
-      Effect.gen(function* () {
-        const exit = yield* validateToken(`sbp_${"a".repeat(39)}`).pipe(Effect.exit);
-        expectInvalidTokenError(exit);
-      }),
-    );
-
-    it.live("rejects token that is too long (41 hex chars)", () =>
-      Effect.gen(function* () {
-        const exit = yield* validateToken(`sbp_${"a".repeat(41)}`).pipe(Effect.exit);
-        expectInvalidTokenError(exit);
-      }),
-    );
-
-    it.live("rejects oauth token that is too short (39 hex chars)", () =>
-      Effect.gen(function* () {
-        const exit = yield* validateToken(`sbp_oauth_${"a".repeat(39)}`).pipe(Effect.exit);
-        expectInvalidTokenError(exit);
-      }),
-    );
-
-    it.live("rejects oauth token that is too long (41 hex chars)", () =>
-      Effect.gen(function* () {
-        const exit = yield* validateToken(`sbp_oauth_${"a".repeat(41)}`).pipe(Effect.exit);
-        expectInvalidTokenError(exit);
-      }),
-    );
-
-    it.live("rejects wrong prefix", () =>
-      Effect.gen(function* () {
-        const exit = yield* validateToken(`tok_${VALID_HEX_40}`).pipe(Effect.exit);
-        expectInvalidTokenError(exit);
-      }),
-    );
-
-    it.live("rejects empty string", () =>
-      Effect.gen(function* () {
-        const exit = yield* validateToken("").pipe(Effect.exit);
-        expectInvalidTokenError(exit);
-      }),
-    );
-
-    it.live("rejects token with no prefix", () =>
-      Effect.gen(function* () {
-        const exit = yield* validateToken(VALID_HEX_40).pipe(Effect.exit);
-        expectInvalidTokenError(exit);
-      }),
-    );
-
-    it.live("rejects token with invalid characters (g-z)", () =>
-      Effect.gen(function* () {
-        const exit = yield* validateToken(`sbp_${"g".repeat(40)}`).pipe(Effect.exit);
-        expectInvalidTokenError(exit);
-      }),
-    );
-  });
-});
diff --git a/apps/cli/src/shared/cli/code-structure.unit.test.ts b/apps/cli/src/shared/cli/code-structure.unit.test.ts
index 8908b688ae..d586ab2f6a 100644
--- a/apps/cli/src/shared/cli/code-structure.unit.test.ts
+++ b/apps/cli/src/shared/cli/code-structure.unit.test.ts
@@ -1,42 +1,59 @@
-import { readdirSync, readFileSync, statSync } from "node:fs";
-import path from "node:path";
+import { BunServices } from "@effect/platform-bun";
+import { expect, layer } from "@effect/vitest";
+import { Effect, FileSystem, Path, PlatformError } from "effect";
 import { fileURLToPath } from "node:url";
-import { describe, expect, it } from "vitest";
 
 const srcDir = fileURLToPath(new URL("../..", import.meta.url));
-const sharedDir = path.join(srcDir, "shared");
-const commandsDir = path.join(srcDir, "commands");
-const dbBootstrapDir = path.join(srcDir, "command-internal", "db-bootstrap");
-const cliDir = path.join(srcDir, "cli");
-const concernSlices = [
-  path.join(sharedDir, "auth"),
-  path.join(sharedDir, "config"),
-  path.join(sharedDir, "output"),
-  path.join(sharedDir, "runtime"),
-  path.join(sharedDir, "telemetry"),
-] as const;
-
-function walk(dir: string): Array<string> {
-  return readdirSync(dir).flatMap((entry) => {
-    if (entry === "__fixtures__") return [];
-    const fullPath = path.join(dir, entry);
-    const stats = statSync(fullPath);
-    if (stats.isDirectory()) {
-      return walk(fullPath);
-    }
-    return [fullPath];
+
+const layout = Effect.gen(function* () {
+  const path = yield* Path.Path;
+  const sharedDir = path.join(srcDir, "shared");
+  return {
+    path,
+    commandsDir: path.join(srcDir, "commands"),
+    dbBootstrapDir: path.join(srcDir, "command-internal", "db-bootstrap"),
+    cliDir: path.join(srcDir, "cli"),
+    concernSlices: [
+      path.join(sharedDir, "auth"),
+      path.join(sharedDir, "config"),
+      path.join(sharedDir, "output"),
+      path.join(sharedDir, "runtime"),
+      path.join(sharedDir, "telemetry"),
+    ],
+  };
+});
+
+const walk = (
+  dir: string,
+): Effect.Effect<Array<string>, PlatformError.PlatformError, FileSystem.FileSystem | Path.Path> =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const entries = yield* fs.readDirectory(dir);
+    const nested = yield* Effect.forEach(entries, (entry) => {
+      if (entry === "__fixtures__") return Effect.succeed([]);
+      const fullPath = path.join(dir, entry);
+      return fs
+        .stat(fullPath)
+        .pipe(
+          Effect.flatMap((stats) =>
+            stats.type === "Directory" ? walk(fullPath) : Effect.succeed([fullPath]),
+          ),
+        );
+    });
+    return nested.flat();
   });
-}
 
-function extractRelativeImports(filePath: string): Array<string> {
-  const source = readFileSync(filePath, "utf8");
-  const imports = Array.from(source.matchAll(/from\s+["']([^"']+)["']/g), (match) => match[1]!);
-  return imports.filter((specifier) => specifier.startsWith("."));
-}
+const extractRelativeImports = (filePath: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const source = yield* fs.readFileString(filePath);
+    const imports = Array.from(source.matchAll(/from\s+["']([^"']+)["']/g), (match) => match[1]!);
+    return imports.filter((specifier) => specifier.startsWith("."));
+  });
 
-function resolveImport(filePath: string, specifier: string): string {
-  return path.normalize(path.resolve(path.dirname(filePath), specifier));
-}
+const resolveImport = (path: Path.Path, filePath: string, specifier: string): string =>
+  path.normalize(path.resolve(path.dirname(filePath), specifier));
 
 function isSourceFile(filePath: string): boolean {
   return (
@@ -48,64 +65,78 @@ function isSourceFile(filePath: string): boolean {
   );
 }
 
-describe("code structure", () => {
-  it("does not keep barrel index.ts files under src", () => {
-    const indexFiles = walk(srcDir).filter((filePath) => path.basename(filePath) === "index.ts");
-    expect(indexFiles).toEqual([]);
-  });
-
-  it("keeps concern slices independent from shell cli and commands", () => {
-    const violations: Array<string> = [];
+layer(BunServices.layer)("code structure", (it) => {
+  it.effect("does not keep barrel index.ts files under src", () =>
+    Effect.gen(function* () {
+      const { path } = yield* layout;
+      const indexFiles = (yield* walk(srcDir)).filter(
+        (filePath) => path.basename(filePath) === "index.ts",
+      );
+      expect(indexFiles).toEqual([]);
+    }),
+  );
 
-    for (const sliceDir of concernSlices) {
-      for (const filePath of walk(sliceDir).filter(isSourceFile)) {
-        for (const specifier of extractRelativeImports(filePath)) {
-          const resolved = resolveImport(filePath, specifier);
-          if (resolved.startsWith(commandsDir) || resolved.startsWith(cliDir)) {
-            violations.push(`${path.relative(srcDir, filePath)} -> ${specifier}`);
+  it.effect("keeps concern slices independent from shell cli and commands", () =>
+    Effect.gen(function* () {
+      const { path, commandsDir, cliDir, concernSlices } = yield* layout;
+      const violations: Array<string> = [];
+
+      for (const sliceDir of concernSlices) {
+        for (const filePath of (yield* walk(sliceDir)).filter(isSourceFile)) {
+          for (const specifier of yield* extractRelativeImports(filePath)) {
+            const resolved = resolveImport(path, filePath, specifier);
+            if (resolved.startsWith(commandsDir) || resolved.startsWith(cliDir)) {
+              violations.push(`${path.relative(srcDir, filePath)} -> ${specifier}`);
+            }
           }
         }
       }
-    }
-
-    expect(violations).toEqual([]);
-  });
 
-  it("prevents commands from importing other command internals", () => {
-    const violations: Array<string> = [];
+      expect(violations).toEqual([]);
+    }),
+  );
 
-    for (const filePath of walk(commandsDir).filter(isSourceFile)) {
-      const relativeFile = path.relative(commandsDir, filePath);
-      const currentCommand = relativeFile.split(path.sep)[0];
-      for (const specifier of extractRelativeImports(filePath)) {
-        const resolved = resolveImport(filePath, specifier);
-        if (!resolved.startsWith(commandsDir)) {
-          continue;
-        }
+  it.effect("prevents commands from importing other command internals", () =>
+    Effect.gen(function* () {
+      const { path, commandsDir } = yield* layout;
+      const violations: Array<string> = [];
+
+      for (const filePath of (yield* walk(commandsDir)).filter(isSourceFile)) {
+        const relativeFile = path.relative(commandsDir, filePath);
+        const currentCommand = relativeFile.split(path.sep)[0];
+        for (const specifier of yield* extractRelativeImports(filePath)) {
+          const resolved = resolveImport(path, filePath, specifier);
+          if (!resolved.startsWith(commandsDir)) {
+            continue;
+          }
 
-        const relativeTarget = path.relative(commandsDir, resolved);
-        const targetCommand = relativeTarget.split(path.sep)[0];
-        if (targetCommand !== currentCommand) {
-          violations.push(`${path.relative(srcDir, filePath)} -> ${specifier}`);
+          const relativeTarget = path.relative(commandsDir, resolved);
+          const targetCommand = relativeTarget.split(path.sep)[0];
+          if (targetCommand !== currentCommand) {
+            violations.push(`${path.relative(srcDir, filePath)} -> ${specifier}`);
+          }
         }
       }
-    }
 
-    expect(violations).toEqual([]);
-  });
+      expect(violations).toEqual([]);
+    }),
+  );
 
-  it("keeps command-internal/db-bootstrap independent from commands", () => {
-    const violations: Array<string> = [];
+  it.effect("keeps command-internal/db-bootstrap independent from commands", () =>
+    Effect.gen(function* () {
+      const { path, commandsDir, dbBootstrapDir } = yield* layout;
+      const violations: Array<string> = [];
 
-    for (const filePath of walk(dbBootstrapDir).filter(isSourceFile)) {
-      for (const specifier of extractRelativeImports(filePath)) {
-        const resolved = resolveImport(filePath, specifier);
-        if (resolved.startsWith(commandsDir)) {
-          violations.push(`${path.relative(srcDir, filePath)} -> ${specifier}`);
+      for (const filePath of (yield* walk(dbBootstrapDir)).filter(isSourceFile)) {
+        for (const specifier of yield* extractRelativeImports(filePath)) {
+          const resolved = resolveImport(path, filePath, specifier);
+          if (resolved.startsWith(commandsDir)) {
+            violations.push(`${path.relative(srcDir, filePath)} -> ${specifier}`);
+          }
         }
       }
-    }
 
-    expect(violations).toEqual([]);
-  });
+      expect(violations).toEqual([]);
+    }),
+  );
 });
diff --git a/apps/cli/src/shared/cli/global-flags.ts b/apps/cli/src/shared/cli/global-flags.ts
deleted file mode 100644
index 782d878e4a..0000000000
--- a/apps/cli/src/shared/cli/global-flags.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-import { Flag, GlobalFlag } from "effect/unstable/cli";
-
-/**
- * The TS-only `--output-format` global, accepted on any subcommand.
- *
- * A value-taking global flag must also be registered in `PERSISTENT_VALUE_FLAG_NAMES`
- * (`shared/cli/cobra-flag-groups.ts`), or the pre-parse argv scanners won't consume its value.
- */
-export const OutputFormatFlag = GlobalFlag.setting("output-format")({
-  flag: Flag.choice("output-format", ["text", "json", "stream-json"]).pipe(
-    Flag.withDescription("Output format: text (default), json, or stream-json (NDJSON)"),
-    Flag.optional,
-  ),
-});
diff --git a/apps/cli/src/shared/cli/hidden-flag.unit.test.ts b/apps/cli/src/shared/cli/hidden-flag.unit.test.ts
index 0d317fec81..ab83e33047 100644
--- a/apps/cli/src/shared/cli/hidden-flag.unit.test.ts
+++ b/apps/cli/src/shared/cli/hidden-flag.unit.test.ts
@@ -1,7 +1,7 @@
-import { Effect, Layer } from "effect";
+import { Cause, Effect, Exit, FileSystem, Layer, Schema } from "effect";
 import { BunServices } from "@effect/platform-bun";
 import { CliOutput, Command, type HelpDoc } from "effect/unstable/cli";
-import { describe, expect, it } from "vitest";
+import { describe, expect, it } from "@effect/vitest";
 import { branchesCommand } from "../../commands/branches/branches.command.ts";
 import { dbCommand } from "../../commands/db/db.command.ts";
 import { functionsCommand } from "../../commands/functions/functions.command.ts";
@@ -15,7 +15,18 @@ import { startCommand } from "../../commands/start/start.command.ts";
 import { stopCommand } from "../../commands/stop/stop.command.ts";
 import { GLOBAL_FLAGS } from "../../command-internal/global-flags.ts";
 import { GoProxy } from "../../command-internal/go-proxy.service.ts";
+import { TestDbMutuallyExclusiveFlagsError } from "../../command-internal/test-db.errors.ts";
+import {
+  mockAnalytics,
+  mockOutput,
+  mockProcessControl,
+  mockRuntimeInfo,
+  mockTelemetryRuntime,
+  mockTty,
+  processEnvLayer,
+} from "../../../tests/helpers/mocks.ts";
 import { textCliOutputFormatter } from "../output/text-formatter.ts";
+import { CliArgs } from "./cli-args.service.ts";
 
 interface CommandImpl {
   readonly buildHelpDoc: (path: ReadonlyArray<string>) => HelpDoc.HelpDoc;
@@ -38,6 +49,24 @@ function mockGoProxy() {
   return { layer, calls };
 }
 
+const testRootLayer = (
+  proxy: Layer.Layer<GoProxy>,
+  formatter: CliOutput.Formatter,
+  args: ReadonlyArray<string>,
+) =>
+  Layer.mergeAll(
+    proxy,
+    CliOutput.layer(formatter),
+    Layer.succeed(CliArgs, { args }),
+    mockOutput({ format: "text" }).layer,
+    BunServices.layer,
+    mockRuntimeInfo(),
+    mockAnalytics().layer,
+    mockTelemetryRuntime(),
+    mockTty(),
+    mockProcessControl().layer,
+  );
+
 const testRoot = Command.make("supabase").pipe(
   Command.withSubcommands([
     startCommand,
@@ -64,6 +93,8 @@ function parserCommand<Name extends string, Input, ContextInput, E, R>(
   );
 }
 
+const encodeJson = Schema.encodeEffect(Schema.fromJsonString(Schema.Unknown));
+
 const silentCliOutputFormatter: CliOutput.Formatter = {
   formatCliError: () => "",
   formatError: () => "",
@@ -123,7 +154,7 @@ describe("native hidden flags", () => {
     ]);
   });
 
-  it("passes hidden flag values to handlers by exact name", async () => {
+  it.effect("passes hidden flag values to handlers by exact name", () => {
     const parsed: Array<unknown> = [];
     const parserFunctionsCommand = Command.make("functions").pipe(
       Command.withSubcommands([
@@ -148,64 +179,57 @@ describe("native hidden flags", () => {
         Effect.provide(parserLayer),
       );
 
-    await Effect.runPromise(
-      Effect.scoped(
-        Effect.gen(function* () {
-          // Recorder handlers cover parser-to-handler values without running command runtimes.
-          yield* runParser(["start", "--preview"]);
-          yield* runParser(["stop", "--backup=false"]);
-          yield* runParser([
-            "functions",
-            "download",
-            "hello",
-            "--project-ref",
-            "abcdefghijklmnopqrst",
-            "--use-docker=false",
-          ]);
-          yield* runParser([
-            "functions",
-            "download",
-            "hello",
-            "--project-ref",
-            "abcdefghijklmnopqrst",
-            "--legacy-bundle",
-          ]);
-          yield* runParser(["functions", "deploy", "hello", "--use-docker=false"]);
-          yield* runParser(["functions", "deploy", "hello", "--legacy-bundle"]);
-          yield* runParser(["functions", "serve", "--all=false"]);
-        }),
-      ),
-    );
-    expect(parsed).toEqual([
-      expect.objectContaining({ preview: true }),
-      expect.objectContaining({ backup: false }),
-      expect.objectContaining({ useDocker: false }),
-      expect.objectContaining({ legacyBundle: true }),
-      expect.objectContaining({ useDocker: false }),
-      expect.objectContaining({ legacyBundle: true }),
-      expect.objectContaining({ all: false }),
-    ]);
+    return Effect.gen(function* () {
+      // Recorder handlers cover parser-to-handler values without running command runtimes.
+      yield* runParser(["start", "--preview"]);
+      yield* runParser(["stop", "--backup=false"]);
+      yield* runParser([
+        "functions",
+        "download",
+        "hello",
+        "--project-ref",
+        "abcdefghijklmnopqrst",
+        "--use-docker=false",
+      ]);
+      yield* runParser([
+        "functions",
+        "download",
+        "hello",
+        "--project-ref",
+        "abcdefghijklmnopqrst",
+        "--legacy-bundle",
+      ]);
+      yield* runParser(["functions", "deploy", "hello", "--use-docker=false"]);
+      yield* runParser(["functions", "deploy", "hello", "--legacy-bundle"]);
+      yield* runParser(["functions", "serve", "--all=false"]);
+      expect(parsed).toEqual([
+        expect.objectContaining({ preview: true }),
+        expect.objectContaining({ backup: false }),
+        expect.objectContaining({ useDocker: false }),
+        expect.objectContaining({ legacyBundle: true }),
+        expect.objectContaining({ useDocker: false }),
+        expect.objectContaining({ legacyBundle: true }),
+        expect.objectContaining({ all: false }),
+      ]);
+    });
   });
 
-  it("does not leak hidden flag names through unknown-flag suggestions", async () => {
-    const proxy = mockGoProxy();
+  it.effect("does not leak hidden flag names through unknown-flag suggestions", () =>
+    Effect.gen(function* () {
+      const proxy = mockGoProxy();
+      const args = ["projects", "create", "demo", "--pla"];
 
-    const exit = await Effect.runPromise(
-      Command.runWith(testRoot, { version: "0.0.0-test" })([
-        "projects",
-        "create",
-        "demo",
-        "--pla",
-      ]).pipe(
-        Effect.provide(Layer.mergeAll(proxy.layer, CliOutput.layer(silentCliOutputFormatter))),
+      const exit = yield* Command.runWith(testRoot, { version: "0.0.0-test" })(args).pipe(
+        Effect.provide(testRootLayer(proxy.layer, silentCliOutputFormatter, args)),
         Effect.exit,
-      ) as Effect.Effect<unknown, never, never>,
-    );
+      );
 
-    expect((exit as { _tag: string })._tag).toBe("Failure");
-    expect(JSON.stringify(exit)).toContain('"suggestions":[]');
-    expect(JSON.stringify(exit)).not.toContain("--plan");
-  });
+      expect(Exit.isFailure(exit)).toBe(true);
+      const exitJson = yield* encodeJson(exit);
+      expect(exitJson).toContain('"suggestions":[]');
+      expect(exitJson).not.toContain("--plan");
+    }),
+  );
 });
 
 describe("hidden subcommands", () => {
@@ -236,53 +260,49 @@ describe("hidden subcommands", () => {
     ]);
   });
 
-  it("still executes hidden subcommands by exact name", async () => {
-    const proxy = mockGoProxy();
-
-    await Effect.runPromise(
-      Effect.gen(function* () {
-        yield* Command.runWith(testRoot, { version: "0.0.0-test" })(["db", "branch", "list"]);
-        yield* Command.runWith(testRoot, { version: "0.0.0-test" })(["db", "remote", "changes"]);
-      }).pipe(
-        Effect.provide(Layer.mergeAll(proxy.layer, CliOutput.layer(textCliOutputFormatter()))),
-      ) as Effect.Effect<void>,
-    );
+  it.effect("still executes hidden subcommands by exact name", () =>
+    Effect.gen(function* () {
+      const proxy = mockGoProxy();
+      const run = (args: ReadonlyArray<string>) =>
+        Command.runWith(testRoot, { version: "0.0.0-test" })(args).pipe(
+          Effect.provide(testRootLayer(proxy.layer, textCliOutputFormatter(), args)),
+        );
 
-    expect(proxy.calls).toEqual([
-      ["db", "branch", "list"],
-      ["db", "remote", "changes"],
-    ]);
-  });
+      yield* run(["db", "branch", "list"]);
+      yield* run(["db", "remote", "changes"]);
 
-  it("still executes the native `db test` hidden alias by exact name (CLI-1962)", async () => {
-    // This test's minimal layer doesn't wire the services the native handler needs, so dispatch
-    // reaching the handler (a Die on a missing service, not success) is what's being proven.
-    const proxy = mockGoProxy();
-    const layer = Layer.mergeAll(proxy.layer, CliOutput.layer(textCliOutputFormatter()));
+      expect(proxy.calls).toEqual([
+        ["db", "branch", "list"],
+        ["db", "remote", "changes"],
+      ]);
+    }),
+  );
 
-    const causeOf = (exit: unknown) =>
-      (exit as { cause: { reasons: Array<{ _tag: string; defect?: unknown; error?: unknown }> } })
-        .cause;
+  it.effect("still executes the native `db test` hidden alias by exact name (CLI-1962)", () =>
+    Effect.gen(function* () {
+      // `--local --linked` fail inside the native handler's mutual-exclusivity check before any
+      // DB/docker IO, so that typed failure (not success) is what proves dispatch reached it.
+      const fs = yield* FileSystem.FileSystem;
+      const home = yield* fs.makeTempDirectoryScoped({ prefix: "supabase-hidden-flag-" });
+      const proxy = mockGoProxy();
+      const run = (args: ReadonlyArray<string>) =>
+        Command.runWith(testRoot, { version: "0.0.0-test" })(args).pipe(
+          Effect.provide(testRootLayer(proxy.layer, textCliOutputFormatter(), args)),
+          Effect.exit,
+        );
 
-    const dbTestExit = await Effect.runPromise(
-      Command.runWith(testRoot, { version: "0.0.0-test" })(["db", "test"]).pipe(
-        Effect.provide(layer),
-        Effect.exit,
-      ) as Effect.Effect<unknown, never, never>,
-    );
-    expect((dbTestExit as { _tag: string })._tag).toBe("Failure");
-    expect(causeOf(dbTestExit).reasons[0]?._tag).toBe("Die");
-    expect(String(causeOf(dbTestExit).reasons[0]?.defect)).toContain(
-      "Service not found: supabase/telemetry/Analytics",
-    );
+      const dbTestExit = yield* run(["db", "test", "--local", "--linked"]).pipe(
+        Effect.provide(processEnvLayer({ SUPABASE_HOME: home })),
+      );
+      expect(Exit.isFailure(dbTestExit)).toBe(true);
+      if (!Exit.isFailure(dbTestExit)) return;
+      expect(Cause.squash(dbTestExit.cause)).toBeInstanceOf(TestDbMutuallyExclusiveFlagsError);
 
-    const unknownExit = await Effect.runPromise(
-      Command.runWith(testRoot, { version: "0.0.0-test" })(["db", "not-a-real-command"]).pipe(
-        Effect.provide(layer),
-        Effect.exit,
-      ) as Effect.Effect<unknown, never, never>,
-    );
-    expect(JSON.stringify(unknownExit)).toContain("UnknownSubcommand");
-    expect(causeOf(unknownExit).reasons[0]?._tag).toBe("Fail");
-  });
+      const unknownExit = yield* run(["db", "not-a-real-command"]);
+      expect(yield* encodeJson(unknownExit)).toContain("UnknownSubcommand");
+      expect(Exit.isFailure(unknownExit)).toBe(true);
+      if (!Exit.isFailure(unknownExit)) return;
+      expect(Cause.hasFails(unknownExit.cause)).toBe(true);
+    }).pipe(Effect.provide(BunServices.layer)),
+  );
 });
diff --git a/apps/cli/src/shared/cli/run.e2e.test.ts b/apps/cli/src/shared/cli/run.e2e.test.ts
index 6102ce0d5b..9028aedb5f 100644
--- a/apps/cli/src/shared/cli/run.e2e.test.ts
+++ b/apps/cli/src/shared/cli/run.e2e.test.ts
@@ -1,24 +1,26 @@
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import { afterEach, describe, expect, test } from "vitest";
-import { runSupabase } from "../../../tests/helpers/cli.ts";
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, FileSystem, Path } from "effect";
+import { runSupabaseEffect } from "../../../tests/helpers/cli.ts";
 
 /**
  * Only a genuine subprocess run proves the shipped binary's real OS exit code — the
  * classification logic itself is covered by `run.unit.test.ts` and `run.integration.test.ts`.
  */
 describe("CLI process exit codes (CLI-1906)", () => {
-  test("bare `branches` (no subcommand, no --help) exits 0", async () => {
-    const { exitCode } = await runSupabase(["branches"]);
-    expect(exitCode).toBe(0);
-  });
-
-  test("a genuine parse error still exits 1", async () => {
-    const { exitCode } = await runSupabase(["branches", "--this-flag-does-not-exist"], {});
-    expect(exitCode).toBe(1);
-  });
+  it.live("bare `branches` (no subcommand, no --help) exits 0", () =>
+    Effect.gen(function* () {
+      const { exitCode } = yield* runSupabaseEffect(["branches"]);
+      expect(exitCode).toBe(0);
+    }),
+  );
+
+  it.live("a genuine parse error still exits 1", () =>
+    Effect.gen(function* () {
+      const { exitCode } = yield* runSupabaseEffect(["branches", "--this-flag-does-not-exist"], {});
+      expect(exitCode).toBe(1);
+    }),
+  );
 });
 
 /**
@@ -27,93 +29,104 @@ describe("CLI process exit codes (CLI-1906)", () => {
  * subprocess boundary: whether stdout/stderr stay separated and the error text isn't duplicated.
  */
 describe("CLI required-flag/choice parse errors (CLI-1901)", () => {
-  test("an unrecognized flag: stdout stays clean, the help/usage content and the single error line land on stderr with no duplicate", async () => {
-    const { exitCode, stdout, stderr } = await runSupabase([
-      "branches",
-      "--this-flag-does-not-exist",
-    ]);
-    expect(exitCode).toBe(1);
-    expect(stdout).toBe("");
-    expect(stderr).toContain("USAGE");
-    const occurrences = stderr.split("Unrecognized flag: --this-flag-does-not-exist").length - 1;
-    expect(occurrences).toBe(1);
-    expect(
-      stderr.trim().endsWith("Try rerunning the command with --debug to troubleshoot the error."),
-    ).toBe(true);
-  });
+  it.live(
+    "an unrecognized flag: stdout stays clean, the help/usage content and the single error line land on stderr with no duplicate",
+    () =>
+      Effect.gen(function* () {
+        const { exitCode, stdout, stderr } = yield* runSupabaseEffect([
+          "branches",
+          "--this-flag-does-not-exist",
+        ]);
+        expect(exitCode).toBe(1);
+        expect(stdout).toBe("");
+        expect(stderr).toContain("USAGE");
+        const occurrences =
+          stderr.split("Unrecognized flag: --this-flag-does-not-exist").length - 1;
+        expect(occurrences).toBe(1);
+        expect(
+          stderr
+            .trim()
+            .endsWith("Try rerunning the command with --debug to troubleshoot the error."),
+        ).toBe(true);
+      }),
+  );
 });
 
 /** Real-subprocess proof of the `afterSuccess` wiring; everything else lives in `upgrade-notice.unit.test.ts`. */
 describe("CLI upgrade notice (#5853)", () => {
-  let workdir: string;
-
-  afterEach(() => {
-    rmSync(workdir, { recursive: true, force: true });
-  });
-
-  test("prints the cached notice on success and honors SUPABASE_NO_UPDATE_NOTIFIER", async () => {
-    workdir = mkdtempSync(join(tmpdir(), "supabase-upgrade-notice-e2e-"));
-    mkdirSync(join(workdir, "supabase", ".temp"), { recursive: true });
-    writeFileSync(join(workdir, "supabase", "config.toml"), 'project_id = "demo"\n');
-    writeFileSync(join(workdir, "supabase", ".temp", "cli-latest"), "v99.99.99");
-
-    const enabled = await runSupabase(["branches"], {
-      cwd: workdir,
-      env: { SUPABASE_NO_UPDATE_NOTIFIER: "0" },
-    });
-    expect(enabled.exitCode).toBe(0);
-    expect(enabled.stderr).toContain("A new version of Supabase CLI is available: v99.99.99");
-
-    const suppressed = await runSupabase(["branches"], { cwd: workdir });
-    expect(suppressed.exitCode).toBe(0);
-    expect(suppressed.stderr).not.toContain("A new version of Supabase CLI is available");
-
-    // `--help` exits through the plain-success branch, bare `branches` through the
-    // clean-ShowHelp one — both call sites must fire.
-    const helped = await runSupabase(["branches", "--help"], {
-      cwd: workdir,
-      env: { SUPABASE_NO_UPDATE_NOTIFIER: "0" },
-    });
-    expect(helped.exitCode).toBe(0);
-    expect(helped.stderr).toContain("A new version of Supabase CLI is available: v99.99.99");
-  });
-
-  test("a failing command exits non-zero and prints no notice", async () => {
-    workdir = mkdtempSync(join(tmpdir(), "supabase-upgrade-notice-e2e-"));
-    mkdirSync(join(workdir, "supabase", ".temp"), { recursive: true });
-    writeFileSync(join(workdir, "supabase", "config.toml"), 'project_id = "demo"\n');
-    writeFileSync(join(workdir, "supabase", ".temp", "cli-latest"), "v99.99.99");
-
-    const { exitCode, stderr } = await runSupabase(["branches", "--nope"], {
-      cwd: workdir,
-      env: { SUPABASE_NO_UPDATE_NOTIFIER: "0" },
-    });
-    expect(exitCode).toBe(1);
-    expect(stderr).not.toContain("A new version of Supabase CLI is available");
+  const upgradeNoticeWorkdir = Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const workdir = yield* fs.makeTempDirectoryScoped({ prefix: "supabase-upgrade-notice-e2e-" });
+    yield* fs.makeDirectory(path.join(workdir, "supabase", ".temp"), { recursive: true });
+    yield* fs.writeFileString(
+      path.join(workdir, "supabase", "config.toml"),
+      'project_id = "demo"\n',
+    );
+    yield* fs.writeFileString(path.join(workdir, "supabase", ".temp", "cli-latest"), "v99.99.99");
+    return workdir;
   });
 
-  test("keeps the Go upgrade notice before a native command suggestion", async () => {
-    workdir = mkdtempSync(join(tmpdir(), "supabase-upgrade-notice-e2e-"));
-    mkdirSync(join(workdir, "supabase", ".temp"), { recursive: true });
-    writeFileSync(join(workdir, "supabase", "config.toml"), 'project_id = "demo"\n');
-    writeFileSync(join(workdir, "supabase", ".temp", "cli-latest"), "v99.99.99");
-
-    const { exitCode, stderr } = await runSupabase(["gen", "signing-key"], {
-      cwd: workdir,
-      env: { SUPABASE_NO_UPDATE_NOTIFIER: "0" },
-    });
-
-    expect(exitCode).toBe(0);
-    const noticeIndex = stderr.indexOf("A new version of Supabase CLI is available");
-    const suggestionIndex = stderr.indexOf("To enable JWT signing keys in your local project:");
-    expect(noticeIndex).toBeGreaterThanOrEqual(0);
-    expect(suggestionIndex).toBeGreaterThan(noticeIndex);
-
-    const suppressed = await runSupabase(["gen", "signing-key"], {
-      cwd: workdir,
-    });
-    expect(suppressed.exitCode).toBe(0);
-    expect(suppressed.stderr).not.toContain("A new version of Supabase CLI is available");
-    expect(suppressed.stderr).toContain("To enable JWT signing keys in your local project:");
-  });
+  it.live("prints the cached notice on success and honors SUPABASE_NO_UPDATE_NOTIFIER", () =>
+    Effect.gen(function* () {
+      const workdir = yield* upgradeNoticeWorkdir;
+
+      const enabled = yield* runSupabaseEffect(["branches"], {
+        cwd: workdir,
+        env: { SUPABASE_NO_UPDATE_NOTIFIER: "0" },
+      });
+      expect(enabled.exitCode).toBe(0);
+      expect(enabled.stderr).toContain("A new version of Supabase CLI is available: v99.99.99");
+
+      const suppressed = yield* runSupabaseEffect(["branches"], { cwd: workdir });
+      expect(suppressed.exitCode).toBe(0);
+      expect(suppressed.stderr).not.toContain("A new version of Supabase CLI is available");
+
+      // `--help` exits through the plain-success branch, bare `branches` through the
+      // clean-ShowHelp one — both call sites must fire.
+      const helped = yield* runSupabaseEffect(["branches", "--help"], {
+        cwd: workdir,
+        env: { SUPABASE_NO_UPDATE_NOTIFIER: "0" },
+      });
+      expect(helped.exitCode).toBe(0);
+      expect(helped.stderr).toContain("A new version of Supabase CLI is available: v99.99.99");
+    }).pipe(Effect.provide(BunServices.layer)),
+  );
+
+  it.live("a failing command exits non-zero and prints no notice", () =>
+    Effect.gen(function* () {
+      const workdir = yield* upgradeNoticeWorkdir;
+
+      const { exitCode, stderr } = yield* runSupabaseEffect(["branches", "--nope"], {
+        cwd: workdir,
+        env: { SUPABASE_NO_UPDATE_NOTIFIER: "0" },
+      });
+      expect(exitCode).toBe(1);
+      expect(stderr).not.toContain("A new version of Supabase CLI is available");
+    }).pipe(Effect.provide(BunServices.layer)),
+  );
+
+  it.live("keeps the Go upgrade notice before a native command suggestion", () =>
+    Effect.gen(function* () {
+      const workdir = yield* upgradeNoticeWorkdir;
+
+      const { exitCode, stderr } = yield* runSupabaseEffect(["gen", "signing-key"], {
+        cwd: workdir,
+        env: { SUPABASE_NO_UPDATE_NOTIFIER: "0" },
+      });
+
+      expect(exitCode).toBe(0);
+      const noticeIndex = stderr.indexOf("A new version of Supabase CLI is available");
+      const suggestionIndex = stderr.indexOf("To enable JWT signing keys in your local project:");
+      expect(noticeIndex).toBeGreaterThanOrEqual(0);
+      expect(suggestionIndex).toBeGreaterThan(noticeIndex);
+
+      const suppressed = yield* runSupabaseEffect(["gen", "signing-key"], {
+        cwd: workdir,
+      });
+      expect(suppressed.exitCode).toBe(0);
+      expect(suppressed.stderr).not.toContain("A new version of Supabase CLI is available");
+      expect(suppressed.stderr).toContain("To enable JWT signing keys in your local project:");
+    }).pipe(Effect.provide(BunServices.layer)),
+  );
 });
diff --git a/apps/cli/src/shared/cli/run.integration.test.ts b/apps/cli/src/shared/cli/run.integration.test.ts
index 9aa9075f95..ca5a904444 100644
--- a/apps/cli/src/shared/cli/run.integration.test.ts
+++ b/apps/cli/src/shared/cli/run.integration.test.ts
@@ -1,12 +1,11 @@
-import { describe, expect, test } from "@effect/vitest";
+import { describe, expect, it } from "@effect/vitest";
 import { Console, Effect, Exit, Layer } from "effect";
 import { Argument, CliOutput, Command, Flag } from "effect/unstable/cli";
 import { branchesCommand } from "../../commands/branches/branches.command.ts";
-import { GLOBAL_FLAGS } from "../../command-internal/global-flags.ts";
+import { GLOBAL_FLAGS, OutputFormatFlag } from "../../command-internal/global-flags.ts";
 import { textCliOutputFormatter } from "../output/text-formatter.ts";
 import { emptyEnv, fakeConsole, mockOutput } from "../../../tests/helpers/mocks.ts";
 import { CliArgs } from "./cli-args.service.ts";
-import { OutputFormatFlag } from "./global-flags.ts";
 import { exitCodeForFailure, withoutParseErrorHelpDump } from "./run.ts";
 
 const testBranchesCommand = branchesCommand.pipe(
@@ -29,32 +28,41 @@ describe("group command exit codes (CLI-1906)", () => {
     );
 
   const runBranches = (args: ReadonlyArray<string>) =>
-    Effect.runPromiseExit(
-      Command.runWith(testBranchesCommand, { version: "0.0.0-test" })(args).pipe(
-        Effect.provide(layerFor(args)),
-      ),
+    Command.runWith(testBranchesCommand, { version: "0.0.0-test" })(args).pipe(
+      Effect.provide(layerFor(args)),
+      Effect.exit,
     );
 
-  test("bare `branches` (no subcommand, no --help) fails with a clean ShowHelp that maps to exit 0", async () => {
-    const exit = await runBranches([]);
-    expect(Exit.isFailure(exit)).toBe(true);
-    if (!Exit.isFailure(exit)) return;
-
-    expect(exitCodeForFailure(exit.cause)).toBe(0);
-  });
-
-  test("`branches --help` succeeds outright and exits 0", async () => {
-    const exit = await runBranches(["--help"]);
-    expect(Exit.isSuccess(exit)).toBe(true);
-  });
-
-  test("`branches` with an unrecognized flag is a genuine parse error that still exits 1", async () => {
-    const exit = await runBranches(["--this-flag-does-not-exist"]);
-    expect(Exit.isFailure(exit)).toBe(true);
-    if (!Exit.isFailure(exit)) return;
-
-    expect(exitCodeForFailure(exit.cause)).toBe(1);
-  });
+  it.effect(
+    "bare `branches` (no subcommand, no --help) fails with a clean ShowHelp that maps to exit 0",
+    () =>
+      Effect.gen(function* () {
+        const exit = yield* runBranches([]);
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (!Exit.isFailure(exit)) return;
+
+        expect(exitCodeForFailure(exit.cause)).toBe(0);
+      }),
+  );
+
+  it.effect("`branches --help` succeeds outright and exits 0", () =>
+    Effect.gen(function* () {
+      const exit = yield* runBranches(["--help"]);
+      expect(Exit.isSuccess(exit)).toBe(true);
+    }),
+  );
+
+  it.effect(
+    "`branches` with an unrecognized flag is a genuine parse error that still exits 1",
+    () =>
+      Effect.gen(function* () {
+        const exit = yield* runBranches(["--this-flag-does-not-exist"]);
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (!Exit.isFailure(exit)) return;
+
+        expect(exitCodeForFailure(exit.cause)).toBe(1);
+      }),
+  );
 });
 
 /**
@@ -96,118 +104,147 @@ describe("withoutParseErrorHelpDump (CLI-1901)", () => {
       { rootCommand: requiredFlagCommand, args },
     ).pipe(Effect.provide(layerFor(args, console)));
 
-  test("an unrecognized flag: replays the help dump to stderr (never stdout) and drops the duplicate error, but still fails with the original cause", async () => {
-    const { console, calls } = fakeConsole();
-    const exit = await Effect.runPromiseExit(runBranches(["--this-flag-does-not-exist"], console));
-
-    expect(calls.length).toBeGreaterThan(0);
-    expect(calls.every((call) => call.startsWith("error:"))).toBe(true);
-
-    expect(Exit.isFailure(exit)).toBe(true);
-    if (!Exit.isFailure(exit)) return;
-    expect(exitCodeForFailure(exit.cause)).toBe(1);
-  });
-
-  test("`branches` bare (clean ShowHelp) still flushes its help dump to stdout and exits 0 (untouched)", async () => {
-    const { console, calls } = fakeConsole();
-    const exit = await Effect.runPromiseExit(runBranches([], console));
-
-    expect(calls.length).toBeGreaterThan(0);
-    expect(calls.every((call) => call.startsWith("log:"))).toBe(true);
-    expect(Exit.isFailure(exit)).toBe(true);
-    if (!Exit.isFailure(exit)) return;
-    expect(exitCodeForFailure(exit.cause)).toBe(0);
-  });
-
-  test("missing a required flag: drops the help dump entirely and the duplicate error, but still fails with the original cause", async () => {
-    const { console, calls } = fakeConsole();
-    const exit = await Effect.runPromiseExit(runRequiredFlagCommand([], console));
-
-    expect(calls).toEqual([]);
-    expect(Exit.isFailure(exit)).toBe(true);
-    if (!Exit.isFailure(exit)) return;
-    expect(exitCodeForFailure(exit.cause)).toBe(1);
-  });
-
-  test("a required flag present on argv but missing its value: replays the help dump to stderr instead of dropping it", async () => {
-    const { console, calls } = fakeConsole();
-    const exit = await Effect.runPromiseExit(runRequiredFlagCommand(["--type"], console));
-
-    expect(calls.length).toBeGreaterThan(0);
-    expect(calls.every((call) => call.startsWith("error:"))).toBe(true);
-    expect(Exit.isFailure(exit)).toBe(true);
-    if (!Exit.isFailure(exit)) return;
-    expect(exitCodeForFailure(exit.cause)).toBe(1);
-  });
-
-  test("a required flag present on argv by its short alias but missing its value: replays the help dump to stderr instead of dropping it", async () => {
-    const { console, calls } = fakeConsole();
-    const exit = await Effect.runPromiseExit(runRequiredFlagCommand(["-t"], console));
-
-    expect(calls.length).toBeGreaterThan(0);
-    expect(calls.every((call) => call.startsWith("error:"))).toBe(true);
-    expect(Exit.isFailure(exit)).toBe(true);
-    if (!Exit.isFailure(exit)) return;
-    expect(exitCodeForFailure(exit.cause)).toBe(1);
-  });
-
-  test("an invalid Flag.choice value: replays the help dump to stderr (never stdout) and drops the duplicate error, but still fails with the original cause", async () => {
-    const { console, calls } = fakeConsole();
-    const exit = await Effect.runPromiseExit(runRequiredFlagCommand(["--type", "bogus"], console));
-
-    expect(calls.length).toBeGreaterThan(0);
-    expect(calls.every((call) => call.startsWith("error:"))).toBe(true);
-    expect(Exit.isFailure(exit)).toBe(true);
-    if (!Exit.isFailure(exit)) return;
-    expect(exitCodeForFailure(exit.cause)).toBe(1);
-  });
-
-  test("`--help` on a command with a required flag still prints the full help doc to stdout and exits 0 (untouched)", async () => {
-    const { console, calls } = fakeConsole();
-    const exit = await Effect.runPromiseExit(runRequiredFlagCommand(["--help"], console));
-
-    expect(calls.length).toBeGreaterThan(0);
-    expect(calls.every((call) => call.startsWith("log:"))).toBe(true);
-    expect(Exit.isSuccess(exit)).toBe(true);
-  });
-
-  test("Effect.log* output during a successful run is still flushed, not lost", async () => {
-    const { console, calls } = fakeConsole();
-    const program = Effect.gen(function* () {
-      yield* Effect.logInfo("hello from a handler");
-      return "done" as const;
-    });
-
-    const result = await Effect.runPromise(
-      withoutParseErrorHelpDump(program, { rootCommand: requiredFlagCommand, args: [] }).pipe(
-        Effect.provide(Layer.succeed(Console.Console, console)),
-      ),
-    );
-
-    expect(result).toBe("done");
-    expect(calls.length).toBeGreaterThan(0);
-    expect(calls.some((call) => call.includes("hello from a handler"))).toBe(true);
-  });
+  it.effect(
+    "an unrecognized flag: replays the help dump to stderr (never stdout) and drops the duplicate error, but still fails with the original cause",
+    () =>
+      Effect.gen(function* () {
+        const { console, calls } = fakeConsole();
+        const exit = yield* runBranches(["--this-flag-does-not-exist"], console).pipe(Effect.exit);
+
+        expect(calls.length).toBeGreaterThan(0);
+        expect(calls.every((call) => call.startsWith("error:"))).toBe(true);
+
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (!Exit.isFailure(exit)) return;
+        expect(exitCodeForFailure(exit.cause)).toBe(1);
+      }),
+  );
+
+  it.effect(
+    "`branches` bare (clean ShowHelp) still flushes its help dump to stdout and exits 0 (untouched)",
+    () =>
+      Effect.gen(function* () {
+        const { console, calls } = fakeConsole();
+        const exit = yield* runBranches([], console).pipe(Effect.exit);
+
+        expect(calls.length).toBeGreaterThan(0);
+        expect(calls.every((call) => call.startsWith("log:"))).toBe(true);
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (!Exit.isFailure(exit)) return;
+        expect(exitCodeForFailure(exit.cause)).toBe(0);
+      }),
+  );
+
+  it.effect(
+    "missing a required flag: drops the help dump entirely and the duplicate error, but still fails with the original cause",
+    () =>
+      Effect.gen(function* () {
+        const { console, calls } = fakeConsole();
+        const exit = yield* runRequiredFlagCommand([], console).pipe(Effect.exit);
+
+        expect(calls).toEqual([]);
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (!Exit.isFailure(exit)) return;
+        expect(exitCodeForFailure(exit.cause)).toBe(1);
+      }),
+  );
+
+  it.effect(
+    "a required flag present on argv but missing its value: replays the help dump to stderr instead of dropping it",
+    () =>
+      Effect.gen(function* () {
+        const { console, calls } = fakeConsole();
+        const exit = yield* runRequiredFlagCommand(["--type"], console).pipe(Effect.exit);
+
+        expect(calls.length).toBeGreaterThan(0);
+        expect(calls.every((call) => call.startsWith("error:"))).toBe(true);
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (!Exit.isFailure(exit)) return;
+        expect(exitCodeForFailure(exit.cause)).toBe(1);
+      }),
+  );
+
+  it.effect(
+    "a required flag present on argv by its short alias but missing its value: replays the help dump to stderr instead of dropping it",
+    () =>
+      Effect.gen(function* () {
+        const { console, calls } = fakeConsole();
+        const exit = yield* runRequiredFlagCommand(["-t"], console).pipe(Effect.exit);
+
+        expect(calls.length).toBeGreaterThan(0);
+        expect(calls.every((call) => call.startsWith("error:"))).toBe(true);
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (!Exit.isFailure(exit)) return;
+        expect(exitCodeForFailure(exit.cause)).toBe(1);
+      }),
+  );
+
+  it.effect(
+    "an invalid Flag.choice value: replays the help dump to stderr (never stdout) and drops the duplicate error, but still fails with the original cause",
+    () =>
+      Effect.gen(function* () {
+        const { console, calls } = fakeConsole();
+        const exit = yield* runRequiredFlagCommand(["--type", "bogus"], console).pipe(Effect.exit);
+
+        expect(calls.length).toBeGreaterThan(0);
+        expect(calls.every((call) => call.startsWith("error:"))).toBe(true);
+        expect(Exit.isFailure(exit)).toBe(true);
+        if (!Exit.isFailure(exit)) return;
+        expect(exitCodeForFailure(exit.cause)).toBe(1);
+      }),
+  );
+
+  it.effect(
+    "`--help` on a command with a required flag still prints the full help doc to stdout and exits 0 (untouched)",
+    () =>
+      Effect.gen(function* () {
+        const { console, calls } = fakeConsole();
+        const exit = yield* runRequiredFlagCommand(["--help"], console).pipe(Effect.exit);
+
+        expect(calls.length).toBeGreaterThan(0);
+        expect(calls.every((call) => call.startsWith("log:"))).toBe(true);
+        expect(Exit.isSuccess(exit)).toBe(true);
+      }),
+  );
+
+  it.effect("Effect.log* output during a successful run is still flushed, not lost", () =>
+    Effect.gen(function* () {
+      const { console, calls } = fakeConsole();
+      const program = Effect.gen(function* () {
+        yield* Effect.logInfo("hello from a handler");
+        return "done" as const;
+      });
+
+      const result = yield* withoutParseErrorHelpDump(program, {
+        rootCommand: requiredFlagCommand,
+        args: [],
+      }).pipe(Effect.provide(Layer.succeed(Console.Console, console)));
+
+      expect(result).toBe("done");
+      expect(calls.length).toBeGreaterThan(0);
+      expect(calls.some((call) => call.includes("hello from a handler"))).toBe(true);
+    }),
+  );
 });
 
 describe("nested command parsing", () => {
-  test("forwards operands after -- to a nested variadic argument", async () => {
-    let receivedPaths: ReadonlyArray<string> = [];
-    const db = Command.make("db", {
-      paths: Argument.string("path").pipe(Argument.variadic()),
-    }).pipe(
-      Command.withHandler(({ paths }) =>
-        Effect.sync(() => {
-          receivedPaths = paths;
-        }),
-      ),
-    );
-    const testCommand = Command.make("test").pipe(Command.withSubcommands([db]));
-    const root = Command.make("supabase").pipe(Command.withSubcommands([testCommand]));
-    const args = ["test", "db", "--", "-foo.sql", "--literal"];
+  it.effect("forwards operands after -- to a nested variadic argument", () =>
+    Effect.gen(function* () {
+      let receivedPaths: ReadonlyArray<string> = [];
+      const db = Command.make("db", {
+        paths: Argument.string("path").pipe(Argument.variadic()),
+      }).pipe(
+        Command.withHandler(({ paths }) =>
+          Effect.sync(() => {
+            receivedPaths = paths;
+          }),
+        ),
+      );
+      const testCommand = Command.make("test").pipe(Command.withSubcommands([db]));
+      const root = Command.make("supabase").pipe(Command.withSubcommands([testCommand]));
+      const args = ["test", "db", "--", "-foo.sql", "--literal"];
 
-    const exit = await Effect.runPromiseExit(
-      Command.runWith(root, { version: "0.0.0-test" })(args).pipe(
+      const exit = yield* Command.runWith(root, { version: "0.0.0-test" })(args).pipe(
         Effect.provide(
           Layer.mergeAll(
             CliOutput.layer(textCliOutputFormatter()),
@@ -216,10 +253,11 @@ describe("nested command parsing", () => {
             emptyEnv(),
           ),
         ),
-      ),
-    );
+        Effect.exit,
+      );
 
-    expect(Exit.isSuccess(exit)).toBe(true);
-    expect(receivedPaths).toEqual(["-foo.sql", "--literal"]);
-  });
+      expect(Exit.isSuccess(exit)).toBe(true);
+      expect(receivedPaths).toEqual(["-foo.sql", "--literal"]);
+    }),
+  );
 });
diff --git a/apps/cli/src/shared/cli/run.ts b/apps/cli/src/shared/cli/run.ts
index f5766aaf30..966873a739 100644
--- a/apps/cli/src/shared/cli/run.ts
+++ b/apps/cli/src/shared/cli/run.ts
@@ -17,9 +17,9 @@ import {
   Stdio,
 } from "effect";
 import { CliError, CliOutput, Command } from "effect/unstable/cli";
+import { HttpClient } from "effect/unstable/http";
 import { ChildProcessSpawner } from "effect/unstable/process";
 import { CLI_VERSION } from "./version.ts";
-import { Credentials } from "../auth/credentials.service.ts";
 import type { CliProjectHome } from "../config/cli-project-home.service.ts";
 import type { CliSettings } from "../config/cli-settings.service.ts";
 import type { ProjectLinkState } from "../config/project-link-state.service.ts";
@@ -37,7 +37,6 @@ import {
 import { cliSettingsLayer } from "../config/cli-settings.layer.ts";
 import { cliConfigProviderLayer } from "../config/cli-config-provider.layer.ts";
 import { cliProjectHomeLayer } from "../config/cli-project-home.layer.ts";
-import { CliProjectLocalServiceVersions } from "../config/cli-project-local-service-versions.service.ts";
 import { cliProjectContextLayer } from "../config/cli-project-context.layer.ts";
 import { projectLinkStateLayer } from "../config/project-link-state.layer.ts";
 import { processControlLayer } from "../runtime/process-control.layer.ts";
@@ -52,7 +51,11 @@ import { aiToolLayer } from "../telemetry/ai-tool.layer.ts";
 import { AiTool } from "../telemetry/ai-tool.service.ts";
 import { telemetryRuntimeLayer } from "../telemetry/runtime.layer.ts";
 import type { TelemetryRuntime } from "../telemetry/runtime.service.ts";
-import { tracingLayer } from "../telemetry/tracing.layer.ts";
+import {
+  resolveTraceSettings,
+  withDebugConsole,
+  withTraceExport,
+} from "../telemetry/trace-export.layer.ts";
 import { CliArgs } from "./cli-args.service.ts";
 import { GLOBAL_VALUE_FLAG_TOKENS } from "./cobra-flag-groups.ts";
 import {
@@ -72,10 +75,9 @@ import {
  * Services available before evaluating the root command. Keep this list explicit: preserving the
  * root command's requirement channel here makes an accidentally unprovided service fail at the
  * shell boundary instead of becoming a runtime missing-service defect. Every entry must be
- * genuinely satisfied at the root: by `cliProgramFor`'s provide chain (including
- * `fallbackCommandLayer`'s root `CommandRuntime` placeholder) or, for the `GlobalFlag`
- * identifiers, by the CLI parser itself. Never widen this union to silence a leaked command
- * requirement; provide the layer in the command instead.
+ * genuinely satisfied at the root by `cliProgramFor`'s provide chain (including
+ * `fallbackCommandLayer`'s root `CommandRuntime` placeholder). Never widen this union to silence
+ * a leaked command requirement; provide the layer in the command instead.
  */
 export type AllowedRunCliServices =
   | Analytics
@@ -93,9 +95,7 @@ export type AllowedRunCliServices =
   | Scope.Scope
   | Stdio.Stdio
   | TelemetryRuntime
-  | Tty
-  | "effect/unstable/cli/GlobalFlag/linked"
-  | "effect/unstable/cli/GlobalFlag/local";
+  | Tty;
 
 export type CliRootCommand = Command.Command<"supabase", {}, {}, unknown, AllowedRunCliServices>;
 
@@ -535,16 +535,14 @@ function cliProjectHomeLayerFor(runtimeLayer: Layer.Layer<never>) {
   );
 }
 
-type AnyAnalyticsLayer = Layer.Layer<
-  Analytics,
-  Config.ConfigError | PlatformError.PlatformError,
-  any
->;
-
-export interface RunCliOptions {
+export interface RunCliOptions<BeforeParseError = never> {
   /** Runs after runtime services are installed and before command parsing. */
-  readonly beforeParse?: Effect.Effect<void, unknown, FileSystem.FileSystem | Path.Path>;
-  readonly analyticsLayer: AnyAnalyticsLayer;
+  readonly beforeParse?: Effect.Effect<void, BeforeParseError, FileSystem.FileSystem | Path.Path>;
+  readonly analyticsLayer: Layer.Layer<
+    Analytics,
+    Config.ConfigError | PlatformError.PlatformError,
+    CliSettings | Crypto.Crypto | FileSystem.FileSystem | Path.Path | RuntimeInfo | Tty
+  >;
   /**
    * Runs just before the process exits on any invocation that exits 0 — the seam for the CLI's
    * upgrade notice. `cleanShowHelp` marks the exit-0 `ShowHelp` failure branch (a bare group
@@ -568,24 +566,17 @@ function cliProgramFor<
   ContextInput,
   E,
   R extends AllowedRunCliServices,
+  BeforeParseError,
 >(
   rootCommand: Command.Command<Name, Input, ContextInput, E, R>,
   args: ReadonlyArray<string>,
-  options: RunCliOptions,
+  options: RunCliOptions<BeforeParseError>,
   outputFormat: OutputFormat,
 ) {
   const runtimeLayer = Layer.mergeAll(processControlLayer, runtimeInfoLayer, ttyLayer);
   const fallbackCommandLayer = Layer.mergeAll(
     // Root command env inference leaks some subcommand-provided services; these stand-ins die
     // if a root-level invocation ever touches them.
-    Layer.succeed(Credentials, {
-      getAccessToken: Effect.die("unexpected root credentials access"),
-      saveAccessToken: () => Effect.die("unexpected root credentials write"),
-      deleteAccessToken: Effect.die("unexpected root credentials deletion"),
-    }),
-    Layer.succeed(CliProjectLocalServiceVersions, {
-      load: Effect.die("unexpected root project local service versions access"),
-    }),
     Layer.succeed(CliConfigStore, {
       load: () => Effect.die("unexpected root cli-config access"),
       loadFile: () => Effect.die("unexpected root cli-config file access"),
@@ -600,6 +591,19 @@ function cliProgramFor<
     ),
   );
   const commandProgram = options.beforeParse ?? Effect.void;
+  const commandLayer = formatterLayerFor(rootCommand, args, outputFormat).pipe(
+    Layer.provideMerge(options.analyticsLayer),
+  );
+  const cliProgramLayer = telemetryRuntimeLayer.pipe(
+    Layer.provideMerge(cliSettingsLayerFor(runtimeLayer)),
+    Layer.provideMerge(cliProjectHomeLayerFor(runtimeLayer)),
+    Layer.provideMerge(cliProjectContextLayerFor(runtimeLayer)),
+    Layer.provideMerge(projectLinkStateLayer),
+    Layer.provideMerge(runtimeLayer),
+    Layer.provideMerge(fallbackCommandLayer),
+    Layer.provideMerge(Layer.succeed(CliArgs, { args })),
+    Layer.provideMerge(BunServices.layer),
+  );
   return withoutParseErrorHelpDump(
     commandProgram.pipe(
       Effect.andThen(Command.runWith(rootCommand, { version: CLI_VERSION })(args)),
@@ -608,48 +612,51 @@ function cliProgramFor<
       rootCommand,
       args,
     },
-  ).pipe(
-    Effect.provide(formatterLayerFor(rootCommand, args, outputFormat)),
-    Effect.provide(options.analyticsLayer),
-    Effect.provide(tracingLayer),
-    Effect.provide(telemetryRuntimeLayer),
-    Effect.provide(cliSettingsLayerFor(runtimeLayer)),
-    Effect.provide(cliProjectHomeLayerFor(runtimeLayer)),
-    Effect.provide(cliProjectContextLayerFor(runtimeLayer)),
-    Effect.provide(projectLinkStateLayer),
-    Effect.provide(runtimeLayer),
-    Effect.provide(fallbackCommandLayer),
-    Effect.provide(Layer.succeed(CliArgs, { args })),
-    Effect.provide(BunServices.layer),
-  );
+  ).pipe(Effect.provide(commandLayer), withDebugConsole, Effect.provide(cliProgramLayer));
 }
 
-export async function runCli<
+/**
+ * Marks `cli.run` failed for a non-zero exit, after the outcome is already rendered and reported.
+ * It is recovered to the exit code right outside the span, so it is a span signal, not a CLI error.
+ */
+class CliNonZeroExit {
+  readonly _tag = "CliNonZeroExit";
+  readonly name = "CliNonZeroExit";
+  constructor(readonly code: number) {}
+}
+
+export const runCli = Effect.fnUntraced(function* <
   Name extends string,
   Input,
   ContextInput,
   E,
   R extends AllowedRunCliServices,
->(rootCommand: Command.Command<Name, Input, ContextInput, E, R>, options: RunCliOptions) {
-  const args = await Effect.runPromise(
-    Effect.gen(function* () {
-      const stdio = yield* Stdio.Stdio;
-      return yield* stdio.args;
-    }).pipe(Effect.provide(BunServices.layer)),
-  );
+  BeforeParseError,
+>(
+  rootCommand: Command.Command<Name, Input, ContextInput, E, R>,
+  options: RunCliOptions<BeforeParseError>,
+) {
+  const bootMs = Math.round(performance.now());
+  const args = yield* Effect.gen(function* () {
+    const stdio = yield* Stdio.Stdio;
+    return yield* stdio.args;
+  }).pipe(Effect.provide(BunServices.layer));
 
   // Same shape `formatterLayerFor` builds below, so `normalizeCause`'s fallback path can reuse
   // `formatCliErrorsForDisplay` and surface the same subcommand-flag hint the formatters would.
   const suggestionContext = { rootCommand, args };
   const useGlobalSignalInterrupt = shouldUseGlobalSignalInterrupt(args);
-  const outputFormat = await Effect.runPromise(
-    Effect.gen(function* () {
-      const aiTool = yield* AiTool;
-      return resolveAgentOutputFormatFromArgs(args, aiTool.name);
-    }).pipe(Effect.provide(aiToolLayer)),
-  );
+  const outputFormat = yield* Effect.gen(function* () {
+    const aiTool = yield* AiTool;
+    return resolveAgentOutputFormatFromArgs(args, aiTool.name);
+  }).pipe(Effect.provide(aiToolLayer));
   const cliProgram = cliProgramFor(rootCommand, args, options, outputFormat);
 
+  const signalAwareLayer = processControlLayer.pipe(
+    Layer.provideMerge(runtimeInfoLayer),
+    Layer.provideMerge(ttyLayer),
+    Layer.provideMerge(BunServices.layer),
+  );
   const signalAwareProgram = Effect.scoped(
     Effect.gen(function* () {
       const processControl = yield* ProcessControl;
@@ -672,12 +679,7 @@ export async function runCli<
 
       return yield* outcome.exit;
     }),
-  ).pipe(
-    Effect.provide(processControlLayer),
-    Effect.provide(runtimeInfoLayer),
-    Effect.provide(ttyLayer),
-    Effect.provide(BunServices.layer),
-  );
+  ).pipe(Effect.provide(signalAwareLayer));
 
   const selfManagedSignalProgram = Effect.scoped(
     Effect.gen(function* () {
@@ -688,10 +690,22 @@ export async function runCli<
   ).pipe(Effect.provide(processControlLayer));
 
   const handledRuntimeLayer = Layer.mergeAll(processControlLayer, runtimeInfoLayer, ttyLayer);
+  const runToExitCodeLayer = outputLayerFor(outputFormat).pipe(
+    Layer.provideMerge(telemetryRuntimeLayer),
+    Layer.provideMerge(cliProjectHomeLayerFor(handledRuntimeLayer)),
+    Layer.provideMerge(cliSettingsLayerFor(handledRuntimeLayer)),
+    Layer.provideMerge(cliProjectContextLayerFor(handledRuntimeLayer)),
+    Layer.provideMerge(ttyLayer),
+    Layer.provideMerge(goProxyInvocationLayer),
+    Layer.provideMerge(successTrailerLayer),
+  );
+  const handledProgramLayer = processControlLayer.pipe(
+    Layer.provideMerge(runtimeInfoLayer),
+    Layer.provideMerge(BunServices.layer),
+    Layer.provideMerge(cliConfigProviderLayer),
+  );
 
-  const handledProgram = <A, E, R>(
-    program: Effect.Effect<A, E, R>,
-  ): Effect.Effect<never, unknown, never> =>
+  const runToExitCode = <A, E, R>(program: Effect.Effect<A, E, R>) =>
     Effect.gen(function* () {
       const processControl = yield* ProcessControl;
       const goProxyInvocation = yield* GoProxyInvocation;
@@ -740,29 +754,40 @@ export async function runCli<
           yield* output.fail(normalizeCause(exit.cause, suggestionContext));
         }
         yield* afterSuccess(exitCode, true);
-        return yield* processControl.exit(exitCode);
+        return exitCode;
       }
       const exitCode = yield* processControl.getExitCode;
       yield* afterSuccess(exitCode ?? 0, false);
-      return yield* processControl.exit(exitCode ?? 0);
+      return exitCode ?? 0;
+    }).pipe(Effect.provide(runToExitCodeLayer));
+
+  // The exit code is resolved inside the traced scope so its flush completes before
+  // `processControl.exit`, which skips finalizers.
+  const handledProgram = <A, E, R>(program: Effect.Effect<A, E, R>) =>
+    Effect.gen(function* () {
+      const processControl = yield* ProcessControl;
+      const exitCode = yield* resolveTraceSettings.pipe(
+        Effect.flatMap((settings) =>
+          withTraceExport(settings, { "process.boot_ms": bootMs })(
+            runToExitCode(program).pipe(
+              Effect.tap((code) => Effect.annotateCurrentSpan("process.exit_code", code)),
+              Effect.flatMap((code) =>
+                code === 0 ? Effect.succeed(code) : Effect.fail(new CliNonZeroExit(code)),
+              ),
+            ),
+          ),
+        ),
+        Effect.catchTag("CliNonZeroExit", (failure) => Effect.succeed(failure.code)),
+      );
+      return yield* processControl.exit(exitCode);
     }).pipe(
-      Effect.provide(outputLayerFor(outputFormat)),
-      Effect.provide(telemetryRuntimeLayer),
-      Effect.provide(cliProjectHomeLayerFor(handledRuntimeLayer)),
-      Effect.provide(cliSettingsLayerFor(handledRuntimeLayer)),
-      Effect.provide(cliProjectContextLayerFor(handledRuntimeLayer)),
-      Effect.provide(processControlLayer),
-      Effect.provide(runtimeInfoLayer),
-      Effect.provide(ttyLayer),
-      Effect.provide(BunServices.layer),
-      Effect.provide(goProxyInvocationLayer),
-      Effect.provide(successTrailerLayer),
-      Effect.provide(cliConfigProviderLayer),
+      Effect.withTracerEnabled(false),
+      Effect.provideService(HttpClient.TracerPropagationEnabled, false),
+      Effect.provide(handledProgramLayer),
     );
 
   if (useGlobalSignalInterrupt) {
-    await Effect.runPromise(handledProgram(signalAwareProgram));
-  } else {
-    await Effect.runPromise(handledProgram(selfManagedSignalProgram));
+    return yield* handledProgram(signalAwareProgram);
   }
-}
+  return yield* handledProgram(selfManagedSignalProgram);
+});
diff --git a/apps/cli/src/shared/cli/version.integration.test.ts b/apps/cli/src/shared/cli/version.integration.test.ts
index 77edf2dadb..8349391d23 100644
--- a/apps/cli/src/shared/cli/version.integration.test.ts
+++ b/apps/cli/src/shared/cli/version.integration.test.ts
@@ -1,105 +1,81 @@
-import { describe, expect, test } from "@effect/vitest";
+import { describe, expect, it } from "@effect/vitest";
 import { BunServices } from "@effect/platform-bun";
-import { Effect, Layer } from "effect";
+import { Console, Effect, Layer, Schema, Stream } from "effect";
 import { CliOutput, Command } from "effect/unstable/cli";
+import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
 import { fileURLToPath } from "node:url";
-import { vi } from "vitest";
 import { rootCommand } from "../../cli/root.ts";
+import { emptyEnv, fakeConsole, mockOutput } from "../../../tests/helpers/mocks.ts";
 import { textCliOutputFormatter } from "../output/text-formatter.ts";
 import { CliArgs } from "./cli-args.service.ts";
 import { CLI_VERSION } from "./version.ts";
 
-const formatLogArg = (value: unknown): string =>
-  typeof value === "object" && value !== null ? JSON.stringify(value) : String(value);
-
-const builtinLayer = (args: ReadonlyArray<string>) =>
+const builtinLayer = (args: ReadonlyArray<string>, console: Console.Console) =>
   Layer.mergeAll(
     CliOutput.layer(textCliOutputFormatter()),
     Layer.succeed(CliArgs, { args }),
-    BunServices.layer,
+    Layer.succeed(Console.Console, console),
+    mockOutput({ format: "text" }).layer,
+    emptyEnv(),
   );
 
-/**
- * Captures `console.log` while `run` executes. Spying on `console.log` alone is reliable here;
- * `run.integration.test.ts` explains why pairing it with a `console.error` spy is not.
- */
-async function captureLogs(run: () => Promise<void>): Promise<Array<string>> {
-  const logs: string[] = [];
-  const spy = vi.spyOn(console, "log").mockImplementation((first?: unknown, ...rest: unknown[]) => {
-    const line =
-      rest.length === 0
-        ? first === undefined
-          ? ""
-          : formatLogArg(first)
-        : [first, ...rest].map(formatLogArg).join(" ");
-    logs.push(line);
-  });
-  try {
-    await run();
-  } finally {
-    spy.mockRestore();
-  }
-  return logs;
-}
-
 describe("CLI --help (text)", () => {
-  test("source runs describe themselves as a development build", async () => {
-    // `Command.runWith` keeps handler/global-flag services in the effect type even when the
-    // built-in `--help`/`--version` exits early; only BunServices + CliOutput are needed here.
-    const logs = await captureLogs(() =>
-      Effect.runPromise(
-        Command.runWith(rootCommand, { version: CLI_VERSION })(["--help"]).pipe(
-          Effect.provide(builtinLayer(["--help"])),
-        ) as Effect.Effect<void>,
-      ),
-    );
-    const help = logs.join("\n");
-    expect(help).toContain("Supabase CLI (development build).");
-    expect(help).not.toContain("stable channel");
-  });
+  it.effect("source runs describe themselves as a development build", () =>
+    Effect.gen(function* () {
+      const { console, calls } = fakeConsole();
+      yield* Command.runWith(rootCommand, { version: CLI_VERSION })(["--help"]).pipe(
+        Effect.provide(builtinLayer(["--help"], console)),
+      );
+      const help = calls.join("\n");
+      expect(help).toContain("Supabase CLI (development build).");
+      expect(help).not.toContain("stable channel");
+    }),
+  );
 });
 
 describe("CLI --version (text)", () => {
-  test("CLI prints bare semver on stdout", async () => {
-    const version = "2.99.0-beta.1";
-    const logs = await captureLogs(() =>
-      Effect.runPromise(
-        Command.runWith(rootCommand, { version })(["--version"]).pipe(
-          Effect.provide(builtinLayer(["--version"])),
-        ) as Effect.Effect<void>,
-      ),
-    );
-    expect(logs.length).toBeGreaterThanOrEqual(1);
-    expect(logs[0]).toBe(version);
-    expect(logs[0]).not.toMatch(/supabase\s+v/i);
-  });
-
-  test("source execution ignores a runtime version environment variable", async () => {
-    const bunExecutable = Bun.which("bun");
-    if (!bunExecutable) {
-      throw new Error("Bun executable not found");
-    }
+  it.effect("CLI prints bare semver on stdout", () =>
+    Effect.gen(function* () {
+      const version = "2.99.0-beta.1";
+      const { console, calls } = fakeConsole();
+      yield* Command.runWith(rootCommand, { version })(["--version"]).pipe(
+        Effect.provide(builtinLayer(["--version"], console)),
+      );
+      expect(calls.length).toBeGreaterThanOrEqual(1);
+      expect(calls[0]).toBe(`log:${version}`);
+      expect(calls[0]).not.toMatch(/supabase\s+v/i);
+    }),
+  );
 
-    const versionModule = fileURLToPath(new URL("./version.ts", import.meta.url));
-    const child = Bun.spawn(
-      [
-        bunExecutable,
-        "-e",
-        `import { CLI_VERSION } from ${JSON.stringify(versionModule)}; console.log(CLI_VERSION);`,
-      ],
-      {
-        env: { ...process.env, SUPABASE_CLI_VERSION: "9.9.9" },
-        stdout: "pipe",
-        stderr: "pipe",
-      },
-    );
-    const [exitCode, stdout, stderr] = await Promise.all([
-      child.exited,
-      new Response(child.stdout).text(),
-      new Response(child.stderr).text(),
-    ]);
+  it.live("source execution ignores a runtime version environment variable", () =>
+    Effect.gen(function* () {
+      const bunExecutable = yield* Effect.fromNullishOr(Bun.which("bun"));
+      const versionModule = yield* Schema.encodeEffect(Schema.fromJsonString(Schema.String))(
+        fileURLToPath(new URL("./version.ts", import.meta.url)),
+      );
+      const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+      const child = yield* spawner.spawn(
+        ChildProcess.make(
+          bunExecutable,
+          ["-e", `import { CLI_VERSION } from ${versionModule}; console.log(CLI_VERSION);`],
+          {
+            env: { SUPABASE_CLI_VERSION: "9.9.9" },
+            extendEnv: true,
+            stdin: "ignore",
+          },
+        ),
+      );
+      const [exitCode, stdout, stderr] = yield* Effect.all(
+        [
+          child.exitCode,
+          Stream.mkString(Stream.decodeText(child.stdout)),
+          Stream.mkString(Stream.decodeText(child.stderr)),
+        ],
+        { concurrency: "unbounded" },
+      );
 
-    expect(exitCode, stderr).toBe(0);
-    expect(stdout.trim()).toBe("0.0.0-dev");
-  });
+      expect(exitCode, stderr).toBe(0);
+      expect(stdout.trim()).toBe("0.0.0-dev");
+    }).pipe(Effect.provide(BunServices.layer)),
+  );
 });
diff --git a/apps/cli/src/shared/compute/compute-api.ts b/apps/cli/src/shared/compute/compute-api.ts
index ef1a6662db..e905f3a138 100644
--- a/apps/cli/src/shared/compute/compute-api.ts
+++ b/apps/cli/src/shared/compute/compute-api.ts
@@ -220,12 +220,14 @@ export const createComputeUpload = Effect.fnUntraced(function* (
  * signature in the URL is the authorization. That's also why `httpClientLayer` redacts query
  * strings before logging: under `--debug` this URL is a write-capable credential.
  */
-export const uploadBuildContext = Effect.fnUntraced(function* (
+export const uploadBuildContext = Effect.fn("Compute.uploadContext")(function* (
   slot: ComputeUploadSlot,
   archive: Uint8Array,
 ) {
   const client = yield* HttpClient.HttpClient;
 
+  yield* Effect.annotateCurrentSpan({ "upload.bytes": archive.byteLength });
+
   // The slot names its own method; anything other than `POST` falls back to `PUT`, the only
   // method documented for a presigned object-store destination.
   const request = (
@@ -247,6 +249,7 @@ export const uploadBuildContext = Effect.fnUntraced(function* (
         }),
     ),
   );
+  yield* Effect.annotateCurrentSpan({ "http.response.status_code": response.status });
 
   if (response.status < 200 || response.status >= 300) {
     const body = yield* bodyText(response);
@@ -344,7 +347,7 @@ const isPermanentReadFailure = (error: unknown) =>
   error instanceof ComputeUnavailableError ||
   error instanceof ComputeProjectNotFoundError;
 
-export const awaitComputeBuild = Effect.fnUntraced(function* (
+export const awaitComputeBuild = Effect.fn("Compute.awaitBuild")(function* (
   api: ApiClient,
   projectRef: string,
   name: string,
@@ -361,7 +364,10 @@ export const awaitComputeBuild = Effect.fnUntraced(function* (
     readonly refSuffix?: string;
   } = {},
 ) {
+  let attempts = 0;
+  // Polls emit no request spans; this span's attempt count stands in for them.
   const poll = Effect.gen(function* () {
+    attempts += 1;
     // A build runs for minutes; one blip on one read must not abandon a deploy that is fine.
     const compute = yield* getCompute(api, projectRef, name).pipe(
       Effect.retry({
@@ -377,7 +383,7 @@ export const awaitComputeBuild = Effect.fnUntraced(function* (
       yield* options.onPoll(compute.value);
     }
     return compute.value.buildState === "building" ? undefined : compute.value;
-  });
+  }).pipe(Effect.withTracerEnabled(false));
 
   const settled = yield* poll.pipe(
     Effect.repeat({
@@ -385,6 +391,7 @@ export const awaitComputeBuild = Effect.fnUntraced(function* (
       until: (result) => result !== undefined,
     }),
   );
+  yield* Effect.annotateCurrentSpan({ "poll.attempt_count": attempts });
 
   if (settled === undefined) {
     return yield* new ComputeBuildTimeoutError({
diff --git a/apps/cli/src/shared/compute/compute-config.ts b/apps/cli/src/shared/compute/compute-config.ts
index 9e4257d07e..da5f16f3a2 100644
--- a/apps/cli/src/shared/compute/compute-config.ts
+++ b/apps/cli/src/shared/compute/compute-config.ts
@@ -157,7 +157,7 @@ export interface ComputeEntryWrite {
  * writes the starter files first, and a failure after that would leave a directory nothing
  * records.
  */
-export const planComputeEntry = Effect.fnUntraced(function* (options: {
+export const planComputeEntry = Effect.fn("Compute.planConfigEntry")(function* (options: {
   readonly configPath: string;
   readonly name: string;
   /** Rendered as written: strings are quoted, numbers are not, lists become TOML arrays. */
@@ -231,7 +231,9 @@ export const planComputeEntry = Effect.fnUntraced(function* (options: {
  * exist yet, so `new` works in a directory that has never been `supabase
  * init`-ed.
  */
-export const commitComputeEntry = Effect.fnUntraced(function* (write: ComputeEntryWrite) {
+export const commitComputeEntry = Effect.fn("Compute.commitConfigEntry")(function* (
+  write: ComputeEntryWrite,
+) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
   yield* fs.makeDirectory(path.dirname(write.configPath), { recursive: true });
diff --git a/apps/cli/src/shared/compute/compute-package.ts b/apps/cli/src/shared/compute/compute-package.ts
index 1cdab9f5db..7252911096 100644
--- a/apps/cli/src/shared/compute/compute-package.ts
+++ b/apps/cli/src/shared/compute/compute-package.ts
@@ -187,7 +187,7 @@ const collectEntries = (
     return { entries, excludedCount } satisfies CollectedEntries;
   });
 
-export const packageComputeDirectory = Effect.fnUntraced(function* (
+export const packageComputeDirectory = Effect.fn("Compute.package")(function* (
   dir: string,
   exclude: ComputeExcludeMatcher = NO_COMPUTE_EXCLUSIONS,
 ) {
@@ -204,9 +204,16 @@ export const packageComputeDirectory = Effect.fnUntraced(function* (
       }),
   });
 
+  const fileCount = collected.entries.filter((entry) => !entry.path.endsWith("/")).length;
+  yield* Effect.annotateCurrentSpan({
+    "file.count": fileCount,
+    "file.excluded_count": collected.excludedCount,
+    "archive.bytes": archive.byteLength,
+  });
+
   return {
     archive: new Uint8Array(archive),
-    fileCount: collected.entries.filter((entry) => !entry.path.endsWith("/")).length,
+    fileCount,
     excludedCount: collected.excludedCount,
   } satisfies PackagedCompute;
 });
diff --git a/apps/cli/src/shared/config/cli-project-context.layer.ts b/apps/cli/src/shared/config/cli-project-context.layer.ts
index f9cc01b6c7..acdc758e7e 100644
--- a/apps/cli/src/shared/config/cli-project-context.layer.ts
+++ b/apps/cli/src/shared/config/cli-project-context.layer.ts
@@ -25,4 +25,7 @@ const makeCliProjectContext = Effect.gen(function* () {
   });
 });
 
-export const cliProjectContextLayer = Layer.effect(CliProjectContext, makeCliProjectContext);
+export const cliProjectContextLayer = Layer.effect(
+  CliProjectContext,
+  makeCliProjectContext.pipe(Effect.withSpan("CliProjectContext.load")),
+);
diff --git a/apps/cli/src/shared/config/cli-project-local-service-versions.layer.ts b/apps/cli/src/shared/config/cli-project-local-service-versions.layer.ts
deleted file mode 100644
index 82884cd7fa..0000000000
--- a/apps/cli/src/shared/config/cli-project-local-service-versions.layer.ts
+++ /dev/null
@@ -1,51 +0,0 @@
-import { Effect, FileSystem, Layer, Option, Schema } from "effect";
-import {
-  InvalidLocalServiceVersionsStateError,
-  LocalServiceVersionsStateSchema,
-  type LocalServiceVersionsState,
-  CliProjectLocalServiceVersions,
-} from "./cli-project-local-service-versions.service.ts";
-import { CliProjectHome } from "./cli-project-home.service.ts";
-
-const LocalServiceVersionsStateFileSchema = Schema.fromJsonString(LocalServiceVersionsStateSchema);
-const decodeLocalServiceVersionsState = Schema.decodeUnknownEffect(
-  LocalServiceVersionsStateFileSchema,
-);
-
-const makeCliProjectLocalServiceVersions = Effect.gen(function* () {
-  const fs = yield* FileSystem.FileSystem;
-  const cliProjectHome = yield* CliProjectHome;
-
-  const loadFromPath = (filePath: string) =>
-    Effect.gen(function* () {
-      // A FILE named `.supabase` reads as "no saved local versions" rather
-      // than a defect (same bug family as the boot fix; reachable via `supabase services`).
-      const exists = yield* fs.exists(filePath).pipe(Effect.orElseSucceed(() => false));
-      if (!exists) {
-        return Option.none<LocalServiceVersionsState>();
-      }
-
-      const content = yield* fs.readFileString(filePath);
-      const decoded = yield* decodeLocalServiceVersionsState(content).pipe(
-        Effect.mapError(
-          () =>
-            new InvalidLocalServiceVersionsStateError({
-              detail: `The local service override file at ${filePath} is invalid.`,
-              suggestion: "Fix or remove local-versions.json, then retry `supabase start`.",
-            }),
-        ),
-      );
-      return Option.some(decoded);
-    });
-
-  const load = loadFromPath(cliProjectHome.projectLocalVersionsPath);
-
-  return CliProjectLocalServiceVersions.of({
-    load,
-  });
-});
-
-export const cliProjectLocalServiceVersionsLayer = Layer.effect(
-  CliProjectLocalServiceVersions,
-  makeCliProjectLocalServiceVersions,
-);
diff --git a/apps/cli/src/shared/config/cli-project-local-service-versions.layer.unit.test.ts b/apps/cli/src/shared/config/cli-project-local-service-versions.layer.unit.test.ts
deleted file mode 100644
index 4f422e9147..0000000000
--- a/apps/cli/src/shared/config/cli-project-local-service-versions.layer.unit.test.ts
+++ /dev/null
@@ -1,205 +0,0 @@
-import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
-import {
-  Cause,
-  Effect,
-  Exit,
-  FileSystem,
-  Layer,
-  Option,
-  Path,
-  PlatformError,
-  Schema,
-} from "effect";
-import { mockRuntimeInfo, processEnvLayer } from "../../../tests/helpers/mocks.ts";
-import { cliSettingsLayer } from "./cli-settings.layer.ts";
-import { cliProjectContextLayer } from "./cli-project-context.layer.ts";
-import { cliProjectHomeLayer } from "./cli-project-home.layer.ts";
-import { cliProjectLocalServiceVersionsLayer } from "./cli-project-local-service-versions.layer.ts";
-import { CliProjectHome } from "./cli-project-home.service.ts";
-import { CliProjectLocalServiceVersions } from "./cli-project-local-service-versions.service.ts";
-
-const makeTempDir = Effect.flatMap(FileSystem.FileSystem, (fs) =>
-  fs.makeTempDirectoryScoped({ prefix: "supabase-project-local-versions-" }),
-);
-
-const PrettyJsonString = Schema.fromJsonString(Schema.Unknown, { space: 2 });
-
-function buildLayer(
-  path: Path.Path,
-  opts: {
-    cwd: string;
-    env?: Record<string, string>;
-    homeDir?: string;
-    fs?: Layer.Layer<FileSystem.FileSystem>;
-  },
-) {
-  const runtimeInfoLayer = mockRuntimeInfo({
-    cwd: opts.cwd,
-    homeDir: opts.homeDir ?? path.join(opts.cwd, ".home"),
-  });
-  const envLayer = processEnvLayer(opts.env ?? {});
-  const discoveredCliProjectContextLayer = cliProjectContextLayer.pipe(
-    Layer.provide(BunServices.layer),
-    Layer.provide(runtimeInfoLayer),
-    Layer.provide(envLayer),
-  );
-  const discoveredCliSettingsLayer = cliSettingsLayer.pipe(
-    Layer.provide(BunServices.layer),
-    Layer.provide(runtimeInfoLayer),
-    Layer.provide(discoveredCliProjectContextLayer),
-  );
-  const discoveredCliProjectHomeLayer = cliProjectHomeLayer.pipe(
-    Layer.provide(BunServices.layer),
-    Layer.provide(runtimeInfoLayer),
-    Layer.provide(discoveredCliProjectContextLayer),
-    Layer.provide(discoveredCliSettingsLayer),
-  );
-  const discoveredCliProjectLocalServiceVersionsLayer = cliProjectLocalServiceVersionsLayer.pipe(
-    Layer.provide(opts.fs ?? BunServices.layer),
-    Layer.provide(discoveredCliProjectHomeLayer),
-  );
-
-  return Layer.mergeAll(
-    BunServices.layer,
-    runtimeInfoLayer,
-    envLayer,
-    discoveredCliProjectContextLayer,
-    discoveredCliSettingsLayer,
-    discoveredCliProjectHomeLayer,
-    discoveredCliProjectLocalServiceVersionsLayer,
-  );
-}
-
-describe("cliProjectLocalServiceVersionsLayer", () => {
-  it.live("surfaces a filesystem read permission failure", () => {
-    const fsLayer = Layer.succeed(
-      FileSystem.FileSystem,
-      FileSystem.makeNoop({
-        exists: () => Effect.succeed(true),
-        readFileString: () =>
-          Effect.fail(
-            PlatformError.systemError({
-              _tag: "PermissionDenied",
-              module: "FileSystem",
-              method: "readFileString",
-              description: "permission denied",
-            }),
-          ),
-      }),
-    );
-
-    return Effect.gen(function* () {
-      const fs = yield* FileSystem.FileSystem;
-      const path = yield* Path.Path;
-      const tempDir = yield* makeTempDir;
-      const projectRoot = path.join(tempDir, "repo");
-      yield* fs.makeDirectory(path.join(projectRoot, "supabase"), { recursive: true });
-      yield* fs.writeFileString(path.join(projectRoot, "supabase", "config.toml"), "");
-
-      const layer = buildLayer(path, { cwd: projectRoot, fs: fsLayer });
-      const localVersions = yield* CliProjectLocalServiceVersions.pipe(Effect.provide(layer));
-
-      const exit = yield* Effect.exit(localVersions.load);
-      expect(Exit.isFailure(exit)).toBe(true);
-      if (Exit.isFailure(exit)) {
-        const error = Cause.findErrorOption(exit.cause);
-        expect(Option.isSome(error)).toBe(true);
-        if (Option.isSome(error)) {
-          expect(error.value).toBeInstanceOf(PlatformError.PlatformError);
-        }
-      }
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer));
-  });
-
-  it.live("fails with a tagged error when local service versions are malformed", () =>
-    Effect.gen(function* () {
-      const fs = yield* FileSystem.FileSystem;
-      const path = yield* Path.Path;
-      const tempDir = yield* makeTempDir;
-      const projectRoot = path.join(tempDir, "repo");
-      yield* fs.makeDirectory(path.join(projectRoot, "supabase"), { recursive: true });
-      yield* fs.writeFileString(path.join(projectRoot, "supabase", "config.toml"), "");
-
-      const layer = buildLayer(path, { cwd: projectRoot });
-      const { cliProjectHome, localVersions } = yield* Effect.gen(function* () {
-        return {
-          cliProjectHome: yield* CliProjectHome,
-          localVersions: yield* CliProjectLocalServiceVersions,
-        };
-      }).pipe(Effect.provide(layer));
-
-      yield* cliProjectHome.ensureCliProjectHomeDir;
-      yield* fs.writeFileString(cliProjectHome.projectLocalVersionsPath, "{not-json");
-
-      const exit = yield* Effect.exit(localVersions.load);
-      expect(Exit.isFailure(exit)).toBe(true);
-      if (Exit.isFailure(exit)) {
-        const error = Cause.findErrorOption(exit.cause);
-        expect(Option.isSome(error)).toBe(true);
-        if (Option.isSome(error)) {
-          expect(error.value).toMatchObject({ _tag: "InvalidLocalServiceVersionsStateError" });
-        }
-      }
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
-  );
-
-  it.live("loads local service version overrides from repo-local state", () =>
-    Effect.gen(function* () {
-      const fs = yield* FileSystem.FileSystem;
-      const path = yield* Path.Path;
-      const tempDir = yield* makeTempDir;
-      const projectRoot = path.join(tempDir, "repo");
-      const supabaseHome = path.join(tempDir, "supabase-home");
-      yield* fs.makeDirectory(path.join(projectRoot, "supabase"), { recursive: true });
-      yield* fs.writeFileString(path.join(projectRoot, "supabase", "config.toml"), "");
-
-      const layer = buildLayer(path, { cwd: projectRoot, env: { SUPABASE_HOME: supabaseHome } });
-      const { cliProjectHome, localVersions } = yield* Effect.gen(function* () {
-        return {
-          cliProjectHome: yield* CliProjectHome,
-          localVersions: yield* CliProjectLocalServiceVersions,
-        };
-      }).pipe(Effect.provide(layer));
-
-      yield* cliProjectHome.ensureCliProjectHomeDir;
-      yield* fs.writeFileString(
-        cliProjectHome.projectLocalVersionsPath,
-        yield* Schema.encodeEffect(PrettyJsonString)({
-          updatedAt: "2026-03-21T12:00:00.000Z",
-          versions: {
-            auth: "v2.180.0",
-            storage: "1.40.0",
-          },
-        }),
-      );
-
-      const loaded = yield* localVersions.load;
-      expect(Option.isSome(loaded)).toBe(true);
-      if (Option.isSome(loaded)) {
-        expect(loaded.value.versions).toEqual({
-          auth: "v2.180.0",
-          storage: "1.40.0",
-        });
-      }
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
-  );
-
-  it.live("returns none when no local override file exists", () =>
-    Effect.gen(function* () {
-      const fs = yield* FileSystem.FileSystem;
-      const path = yield* Path.Path;
-      const tempDir = yield* makeTempDir;
-      const projectRoot = path.join(tempDir, "repo");
-      const supabaseHome = path.join(tempDir, "supabase-home");
-      yield* fs.makeDirectory(path.join(projectRoot, "supabase"), { recursive: true });
-      yield* fs.writeFileString(path.join(projectRoot, "supabase", "config.toml"), "");
-
-      const layer = buildLayer(path, { cwd: projectRoot, env: { SUPABASE_HOME: supabaseHome } });
-      const localVersions = yield* CliProjectLocalServiceVersions.pipe(Effect.provide(layer));
-
-      const loaded = yield* localVersions.load;
-      expect(Option.isNone(loaded)).toBe(true);
-    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
-  );
-});
diff --git a/apps/cli/src/shared/config/cli-project-local-service-versions.service.ts b/apps/cli/src/shared/config/cli-project-local-service-versions.service.ts
deleted file mode 100644
index 6f56366a06..0000000000
--- a/apps/cli/src/shared/config/cli-project-local-service-versions.service.ts
+++ /dev/null
@@ -1,53 +0,0 @@
-import type { Effect, Option } from "effect";
-import { Data, Schema, Context } from "effect";
-import type { PlatformError } from "effect/PlatformError";
-import {
-  actionability,
-  type CliErrorActionabilityDeclaration,
-  ErrorActionabilityId,
-} from "../telemetry/error-actionability.ts";
-
-const LocalServiceVersionsSchema = Schema.Struct({
-  postgres: Schema.optionalKey(Schema.String),
-  postgrest: Schema.optionalKey(Schema.String),
-  auth: Schema.optionalKey(Schema.String),
-  realtime: Schema.optionalKey(Schema.String),
-  storage: Schema.optionalKey(Schema.String),
-  imgproxy: Schema.optionalKey(Schema.String),
-  mailpit: Schema.optionalKey(Schema.String),
-  pgmeta: Schema.optionalKey(Schema.String),
-  studio: Schema.optionalKey(Schema.String),
-  analytics: Schema.optionalKey(Schema.String),
-  vector: Schema.optionalKey(Schema.String),
-  pooler: Schema.optionalKey(Schema.String),
-});
-
-export const LocalServiceVersionsStateSchema = Schema.Struct({
-  updatedAt: Schema.String,
-  versions: LocalServiceVersionsSchema,
-});
-
-export type LocalServiceVersionsState = Schema.Schema.Type<typeof LocalServiceVersionsStateSchema>;
-
-export class InvalidLocalServiceVersionsStateError extends Data.TaggedError(
-  "InvalidLocalServiceVersionsStateError",
-)<{
-  readonly detail: string;
-  readonly suggestion: string;
-}> {
-  get [ErrorActionabilityId](): CliErrorActionabilityDeclaration {
-    return actionability.invalidConfig;
-  }
-}
-
-interface CliProjectLocalServiceVersionsShape {
-  readonly load: Effect.Effect<
-    Option.Option<LocalServiceVersionsState>,
-    InvalidLocalServiceVersionsStateError | PlatformError
-  >;
-}
-
-export class CliProjectLocalServiceVersions extends Context.Service<
-  CliProjectLocalServiceVersions,
-  CliProjectLocalServiceVersionsShape
->()("supabase/cli/CliProjectLocalServiceVersions") {}
diff --git a/apps/cli/src/shared/config/cli-settings.layer.ts b/apps/cli/src/shared/config/cli-settings.layer.ts
index f5316c4896..e205ad78d9 100644
--- a/apps/cli/src/shared/config/cli-settings.layer.ts
+++ b/apps/cli/src/shared/config/cli-settings.layer.ts
@@ -50,4 +50,7 @@ const makeCliSettings = Effect.gen(function* () {
   });
 });
 
-export const cliSettingsLayer = Layer.effect(CliSettings, makeCliSettings);
+export const cliSettingsLayer = Layer.effect(
+  CliSettings,
+  makeCliSettings.pipe(Effect.withSpan("CliSettings.load")),
+);
diff --git a/apps/cli/src/shared/config/project-link-state.layer.ts b/apps/cli/src/shared/config/project-link-state.layer.ts
index 6def89eb3f..b8f292f601 100644
--- a/apps/cli/src/shared/config/project-link-state.layer.ts
+++ b/apps/cli/src/shared/config/project-link-state.layer.ts
@@ -84,4 +84,7 @@ const makeProjectLinkState = Effect.gen(function* () {
   });
 });
 
-export const projectLinkStateLayer = Layer.effect(ProjectLinkState, makeProjectLinkState);
+export const projectLinkStateLayer = Layer.effect(
+  ProjectLinkState,
+  makeProjectLinkState.pipe(Effect.withSpan("ProjectLinkState.load")),
+);
diff --git a/apps/cli/src/shared/config/supabase-home.ts b/apps/cli/src/shared/config/supabase-home.ts
index 7095246ead..326601911c 100644
--- a/apps/cli/src/shared/config/supabase-home.ts
+++ b/apps/cli/src/shared/config/supabase-home.ts
@@ -9,7 +9,7 @@ import { Option, type Path } from "effect";
  * its own environment and home directory, keeping the contract in one place.
  */
 export const resolveSupabaseHomeValue = (
-  path: Path.Path,
+  path: Pick<Path.Path, "join">,
   value: Option.Option<string>,
   homeDir: string,
 ): string => {
@@ -20,7 +20,7 @@ export const resolveSupabaseHomeValue = (
 };
 
 export const resolveSupabaseHome = (
-  path: Path.Path,
+  path: Pick<Path.Path, "join">,
   env: Readonly<Record<string, string | undefined>>,
   homeDir: string,
 ): string =>
diff --git a/apps/cli/src/shared/functions/delete.ts b/apps/cli/src/shared/functions/delete.ts
index b1f6c8525d..4bcbc82695 100644
--- a/apps/cli/src/shared/functions/delete.ts
+++ b/apps/cli/src/shared/functions/delete.ts
@@ -41,69 +41,66 @@ function validateSlug(slug: string): Effect.Effect<void, InvalidFunctionSlugErro
   return Effect.fail(new InvalidFunctionSlugError({ message: invalidFunctionSlugDetail }));
 }
 
-export function deleteFunction<ResolveError, ResolveRequirements>(
+export const deleteFunction = Effect.fn("functions.delete")(function* <
+  ResolveError,
+  ResolveRequirements,
+>(
   flags: DeleteFunctionOptions,
   dependencies: DeleteFunctionDependencies<ResolveError, ResolveRequirements>,
 ) {
-  return Effect.gen(function* () {
-    const output = yield* Output;
+  const output = yield* Output;
 
-    yield* validateSlug(flags.slug);
-    const projectRef = yield* dependencies.resolveProjectRef(flags.projectRef);
+  yield* validateSlug(flags.slug);
+  const projectRef = yield* dependencies.resolveProjectRef(flags.projectRef);
 
-    const response = yield* dependencies.api
-      .executeRaw(operationDefinitions.v1DeleteAFunction, {
-        ref: projectRef,
-        function_slug: flags.slug,
-      })
-      .pipe(
-        Effect.mapError((error) => {
-          if (error instanceof SupabaseApiInputError) {
-            // This operation's complete input is the resolved ref and the
-            // prevalidated slug, so a schema rejection is user-derived.
-            return markSupabaseApiInputErrorAsUserInput(error);
-          }
-          if (HttpClientError.isHttpClientError(error)) {
-            const description = error.reason.description ?? error.reason._tag;
-            return new DeleteFunctionNetworkError({
-              message: `failed to delete function: ${description}`,
-            });
-          }
+  const response = yield* dependencies.api
+    .executeRaw(operationDefinitions.v1DeleteAFunction, {
+      ref: projectRef,
+      function_slug: flags.slug,
+    })
+    .pipe(
+      Effect.mapError((error) => {
+        if (error instanceof SupabaseApiInputError) {
+          // This operation's complete input is the resolved ref and the
+          // prevalidated slug, so a schema rejection is user-derived.
+          return markSupabaseApiInputErrorAsUserInput(error);
+        }
+        if (HttpClientError.isHttpClientError(error)) {
+          const description = error.reason.description ?? error.reason._tag;
           return new DeleteFunctionNetworkError({
-            message: `failed to delete function: ${String(error)}`,
+            message: `failed to delete function: ${description}`,
           });
-        }),
-      );
+        }
+        return new DeleteFunctionNetworkError({
+          message: `failed to delete function: ${String(error)}`,
+        });
+      }),
+    );
 
-    switch (response.status) {
-      case 200:
-        break;
-      case 404:
-        return yield* Effect.fail(
-          new FunctionNotFoundError({
-            message: `Function ${flags.slug} does not exist on the Supabase project: nothing to delete`,
-          }),
-        );
-      default: {
-        const body = yield* response.text.pipe(Effect.orElseSucceed(() => ""));
-        return yield* Effect.fail(
-          new DeleteFunctionUnexpectedStatusError({
-            status: response.status,
-            message: `unexpected delete function status ${response.status}: ${body}`,
-          }),
-        );
-      }
-    }
-
-    if (output.format !== "text") {
-      yield* output.success("Deleted Edge Function.", {
-        function_slug: flags.slug,
-        project_ref: projectRef,
+  switch (response.status) {
+    case 200:
+      break;
+    case 404:
+      return yield* new FunctionNotFoundError({
+        message: `Function ${flags.slug} does not exist on the Supabase project: nothing to delete`,
+      });
+    default: {
+      const body = yield* response.text.pipe(Effect.orElseSucceed(() => ""));
+      return yield* new DeleteFunctionUnexpectedStatusError({
+        status: response.status,
+        message: `unexpected delete function status ${response.status}: ${body}`,
       });
-      return;
     }
+  }
 
-    const style = dependencies.styleIdentifier ?? ((text: string) => text);
-    yield* output.raw(`Deleted Function ${style(flags.slug)} from project ${style(projectRef)}.\n`);
-  }).pipe(Effect.withSpan("functions.delete"));
-}
+  if (output.format !== "text") {
+    yield* output.success("Deleted Edge Function.", {
+      function_slug: flags.slug,
+      project_ref: projectRef,
+    });
+    return;
+  }
+
+  const style = dependencies.styleIdentifier ?? ((text: string) => text);
+  yield* output.raw(`Deleted Function ${style(flags.slug)} from project ${style(projectRef)}.\n`);
+});
diff --git a/apps/cli/src/shared/functions/deploy.errors.ts b/apps/cli/src/shared/functions/deploy.errors.ts
index 6b9198ca21..2926d86327 100644
--- a/apps/cli/src/shared/functions/deploy.errors.ts
+++ b/apps/cli/src/shared/functions/deploy.errors.ts
@@ -50,3 +50,9 @@ export class FunctionImportNotDirectoryError extends Data.TaggedError(
     return actionability.invalidConfig;
   }
 }
+
+export class FunctionDeployError extends Data.Error<{ readonly message: string }> {}
+
+export class FunctionImportMapSyntaxError extends Data.Error<{ readonly message: string }> {
+  override readonly name = "SyntaxError";
+}
diff --git a/apps/cli/src/shared/functions/deploy.errors.unit.test.ts b/apps/cli/src/shared/functions/deploy.errors.unit.test.ts
new file mode 100644
index 0000000000..78289dbad5
--- /dev/null
+++ b/apps/cli/src/shared/functions/deploy.errors.unit.test.ts
@@ -0,0 +1,25 @@
+import { describe, expect, it } from "vitest";
+import { classifyCliErrorActionability } from "../telemetry/error-actionability.ts";
+import { FunctionDeployError, FunctionImportMapSyntaxError } from "./deploy.errors.ts";
+
+describe("deploy error telemetry identity", () => {
+  it("classifies a FunctionDeployError like a plain Error", () => {
+    const message = "failed to bundle function: exit 1";
+    const result = classifyCliErrorActionability(new FunctionDeployError({ message }));
+    expect(result).toEqual(classifyCliErrorActionability(new Error(message)));
+    expect(result.error_kind).toBe("unknown");
+    expect(result.error_fingerprint).toBe("error:unknown");
+  });
+
+  it("classifies a FunctionImportMapSyntaxError like a native SyntaxError", () => {
+    const result = classifyCliErrorActionability(
+      new FunctionImportMapSyntaxError({ message: "Expected a valid JSON string" }),
+    );
+    expect(result).toEqual(
+      classifyCliErrorActionability(new SyntaxError("JSON Parse error: Expected '}'")),
+    );
+    expect(result.error_kind).toBe("internal_bug");
+    expect(result.error_category).toBe("panic");
+    expect(result.error_fingerprint).toBe("error:SyntaxError");
+  });
+});
diff --git a/apps/cli/src/shared/functions/deploy.ts b/apps/cli/src/shared/functions/deploy.ts
index 2282b7b6ef..74f845eed7 100644
--- a/apps/cli/src/shared/functions/deploy.ts
+++ b/apps/cli/src/shared/functions/deploy.ts
@@ -1,6 +1,4 @@
 import { brotliCompressSync, constants as zlibConstants } from "node:zlib";
-import { chmod, mkdir, mkdtemp, readFile, readdir, realpath, rm, stat } from "node:fs/promises";
-import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { URL } from "node:url";
 import {
   FunctionResponse_Output,
@@ -12,7 +10,19 @@ import {
   inferFunctionsManifest,
   type ResolvedFunctionConfig as ManifestFunctionConfig,
 } from "@supabase/config/effect";
-import { Duration, Effect, Option, Schema } from "effect";
+import {
+  Cause,
+  Clock,
+  Config,
+  Duration,
+  Effect,
+  Fiber,
+  FileSystem,
+  Option,
+  Path,
+  type PlatformError,
+  Schema,
+} from "effect";
 import * as HttpBody from "effect/unstable/http/HttpBody";
 import * as HttpClientError from "effect/unstable/http/HttpClientError";
 import { promptYesNo } from "../../command-internal/prompt-yes-no.ts";
@@ -38,6 +48,8 @@ import { slimImagesEnabled } from "../services/slim-images.ts";
 import {
   ConflictingFunctionDeployFlagsError,
   FunctionDeployCancelledError,
+  FunctionDeployError,
+  FunctionImportMapSyntaxError,
   FunctionImportNotDirectoryError,
   InvalidFunctionDeploySlugError,
   NoFunctionsToDeployError,
@@ -48,6 +60,7 @@ import {
   ensureDockerNamedVolume,
   ensureDockerNetwork,
   isDockerRunning,
+  nativePlatformFailure,
   resolveDockerNetworkMode,
   resolveEdgeRuntimeVersion,
   resolveFunctionsDockerImage,
@@ -170,10 +183,11 @@ const defaultManifestFunctionConfig: ManifestFunctionConfig = {
   env: {},
 };
 
-const decodeFunctionListResponseSchema = Schema.decodeUnknownSync(
+const decodeJson = Schema.decodeEffect(Schema.fromJsonString(Schema.Unknown));
+const decodeFunctionListResponseSchema = Schema.decodeUnknownEffect(
   Schema.Array(FunctionResponse_Output),
 );
-const decodeDeployFunctionResponseSchema = Schema.decodeUnknownSync(
+const decodeDeployFunctionResponseSchema = Schema.decodeUnknownEffect(
   operationDefinitions.v1DeployAFunction.outputSchema,
 );
 
@@ -187,17 +201,30 @@ function omitNullableFields(value: unknown, fields: ReadonlySet<string>) {
   );
 }
 
-function decodeDeployFunctionResponse(value: unknown): DeployFunctionResponse {
-  return decodeDeployFunctionResponseSchema(
-    omitNullableFields(value, nullableOptionalDeployFunctionFields),
+function decodeDeployFunctionResponse(
+  body: string,
+): Effect.Effect<DeployFunctionResponse, Schema.SchemaError> {
+  return decodeJson(body).pipe(
+    Effect.flatMap((value) =>
+      decodeDeployFunctionResponseSchema(
+        omitNullableFields(value, nullableOptionalDeployFunctionFields),
+      ),
+    ),
   );
 }
 
-function decodeFunctionListResponse(value: unknown): ReadonlyArray<RemoteFunction> {
-  const normalized = Array.isArray(value)
-    ? value.map((item) => omitNullableFields(item, nullableOptionalFunctionListFields))
-    : value;
-  return decodeFunctionListResponseSchema(normalized);
+function decodeFunctionListResponse(
+  body: string,
+): Effect.Effect<ReadonlyArray<RemoteFunction>, Schema.SchemaError> {
+  return decodeJson(body).pipe(
+    Effect.flatMap((value) =>
+      decodeFunctionListResponseSchema(
+        Array.isArray(value)
+          ? value.map((item) => omitNullableFields(item, nullableOptionalFunctionListFields))
+          : value,
+      ),
+    ),
+  );
 }
 
 // Formats a raw response body for an unexpected-status error message: re-stringifies JSON so the
@@ -266,8 +293,8 @@ function validateDeploySlug(slug: string): Effect.Effect<void, InvalidFunctionDe
   return Effect.fail(new InvalidFunctionDeploySlugError({ message: invalidFunctionSlugDetail }));
 }
 
-function isDenoConfigFile(pathname: string) {
-  const name = basename(pathname).toLowerCase();
+function isDenoConfigFile(path: Path.Path, pathname: string) {
+  const name = path.basename(pathname).toLowerCase();
   return name === "deno.json" || name === "deno.jsonc";
 }
 
@@ -303,9 +330,9 @@ export const dockerWorkdirLabel = "com.supabase.cli.workdir";
  */
 const dockerNpmEnvNames = ["NPM_CONFIG_REGISTRY"] as const;
 
-function toBundledFileUrl(hostPath: string) {
+function toBundledFileUrl(path: Path.Path, hostPath: string) {
   const url = new URL("file:///");
-  url.pathname = toDockerPath(hostPath, { resolve }).replaceAll("%", "%25");
+  url.pathname = toDockerPath(hostPath, path).replaceAll("%", "%25");
   return url.toString();
 }
 
@@ -361,24 +388,56 @@ function dockerNpmEnv(env: NodeJS.ProcessEnv = process.env): ReadonlyArray<strin
   });
 }
 
-function toApiRelativePath(cwd: string, hostPath: string) {
-  const resolved = resolve(hostPath);
-  const relativePath = relative(cwd, resolved);
-  return toSlash(relativePath.length > 0 ? relativePath : basename(resolved));
+function toApiRelativePath(path: Path.Path, cwd: string, hostPath: string) {
+  const resolved = path.resolve(hostPath);
+  const relativePath = path.relative(cwd, resolved);
+  return toSlash(relativePath.length > 0 ? relativePath : path.basename(resolved));
 }
 
-function isContainedPath(root: string, candidate: string) {
-  const relativePath = relative(resolve(root), resolve(candidate));
+function isContainedPath(path: Path.Path, root: string, candidate: string) {
+  const relativePath = path.relative(path.resolve(root), path.resolve(candidate));
   return (
     relativePath === "" ||
-    (!isAbsolute(relativePath) && relativePath !== ".." && !relativePath.startsWith(`..${sep}`))
+    (!path.isAbsolute(relativePath) &&
+      relativePath !== ".." &&
+      !relativePath.startsWith(`..${path.sep}`))
   );
 }
 
-function isContainedInAnyPath(roots: ReadonlyArray<string>, candidate: string) {
-  return roots.some((root) => isContainedPath(root, candidate));
+function isContainedInAnyPath(path: Path.Path, roots: ReadonlyArray<string>, candidate: string) {
+  return roots.some((root) => isContainedPath(path, root, candidate));
 }
 
+const hostError = (pathname: string) => (error: PlatformError.PlatformError) =>
+  nativePlatformFailure(error, pathname).cause;
+
+const unknownHostError = (pathname: string) => (error: PlatformError.PlatformError) =>
+  new Cause.UnknownError(hostError(pathname)(error), "An error occurred in Effect.tryPromise");
+
+const debugEnvEnabled = Config.option(Config.string("DEBUG")).pipe(
+  Effect.map(Option.exists((value) => value === "true")),
+  Effect.orDie,
+);
+
+function hasErrorCode(error: Error, code: string) {
+  return "code" in error && error.code === code;
+}
+
+const hostRealPath = Effect.fnUntraced(function* (pathname: string) {
+  const fs = yield* FileSystem.FileSystem;
+  return yield* fs.realPath(pathname).pipe(Effect.mapError(hostError(pathname)));
+});
+
+const hostReadFile = Effect.fnUntraced(function* (pathname: string) {
+  const fs = yield* FileSystem.FileSystem;
+  return yield* fs.readFile(pathname).pipe(Effect.mapError(hostError(pathname)));
+});
+
+const hostStat = Effect.fnUntraced(function* (pathname: string) {
+  const fs = yield* FileSystem.FileSystem;
+  return yield* fs.stat(pathname).pipe(Effect.mapError(hostError(pathname)));
+});
+
 /**
  * Rejects any path containing a `..` segment before it's uploaded. A workdir that differs from
  * the git root can otherwise produce a multipart `File` name like
@@ -390,24 +449,21 @@ function hasParentPathSegment(relativePath: string) {
     .some((segment) => segment === "..");
 }
 
-async function realpathIfExists(pathname: string) {
-  try {
-    return await realpath(resolve(pathname));
-  } catch (error) {
-    // ENOTDIR (a path routed through a file) is as nonexistent as ENOENT here.
-    if (
-      error instanceof Error &&
-      "code" in error &&
-      (error.code === "ENOENT" || error.code === "ENOTDIR")
-    ) {
-      return resolve(pathname);
-    }
-    throw error;
-  }
-}
+const realpathIfExists = Effect.fnUntraced(function* (pathname: string) {
+  const path = yield* Path.Path;
+  return yield* hostRealPath(path.resolve(pathname)).pipe(
+    Effect.catchIf(
+      // ENOTDIR (a path routed through a file) is as nonexistent as ENOENT here.
+      (error) => hasErrorCode(error, "ENOENT") || hasErrorCode(error, "ENOTDIR"),
+      () => Effect.succeed(path.resolve(pathname)),
+    ),
+  );
+});
 
-const resolveFunctionsSourceRoot = (projectRoot: string) =>
-  findGitRootPath(projectRoot).pipe(Effect.map(Option.getOrElse(() => resolve(projectRoot))));
+const resolveFunctionsSourceRoot = Effect.fnUntraced(function* (projectRoot: string) {
+  const path = yield* Path.Path;
+  return Option.getOrElse(yield* findGitRootPath(projectRoot), () => path.resolve(projectRoot));
+});
 
 function humanSize(bytes: number) {
   if (bytes < 1000) {
@@ -499,7 +555,7 @@ function stripJsonComments(contents: string): string {
   return out.join("");
 }
 
-function resolveImportTarget(jsonPath: string, target: string) {
+function resolveImportTarget(path: Path.Path, jsonPath: string, target: string) {
   if (target.startsWith("/")) {
     return target;
   }
@@ -513,7 +569,7 @@ function resolveImportTarget(jsonPath: string, target: string) {
     // Fall through.
   }
 
-  const resolved = toSlash(join(dirname(jsonPath), target));
+  const resolved = toSlash(path.join(path.dirname(jsonPath), target));
   const normalized =
     resolved.startsWith("/") ||
     WINDOWS_ABSOLUTE_PATH.test(resolved) ||
@@ -540,23 +596,27 @@ function getObjectProperty(input: object, key: string): unknown {
   return Reflect.get(input, key);
 }
 
-function readStringMap(input: unknown, fieldName: string): Record<string, string> {
+const readStringMap = Effect.fnUntraced(function* (input: unknown, fieldName: string) {
   if (input === undefined) {
     return {};
   }
   if (typeof input !== "object" || input === null || Array.isArray(input)) {
-    throw new Error(`failed to parse import map: expected ${fieldName} to be an object`);
+    return yield* new FunctionDeployError({
+      message: `failed to parse import map: expected ${fieldName} to be an object`,
+    });
   }
 
   const values: Record<string, string> = {};
   for (const [key, value] of Object.entries(input)) {
     if (typeof value !== "string") {
-      throw new Error(`failed to parse import map: expected ${fieldName}.${key} to be a string`);
+      return yield* new FunctionDeployError({
+        message: `failed to parse import map: expected ${fieldName}.${key} to be a string`,
+      });
     }
     values[key] = value;
   }
   return values;
-}
+});
 
 class ImportMapFile {
   readonly imports: Record<string, string>;
@@ -573,7 +633,7 @@ class ImportMapFile {
     this.importMapReference = importMapReference;
   }
 
-  static fromUnknown(input: unknown) {
+  static readonly fromUnknown = Effect.fnUntraced(function* (input: unknown) {
     const imports: Record<string, string> = {};
     const scopes: Record<string, Record<string, string>> = {};
     let importMapReference = "";
@@ -584,22 +644,24 @@ class ImportMapFile {
         importMapReference = importMap;
       }
 
-      Object.assign(imports, readStringMap(getObjectProperty(input, "imports"), "imports"));
+      Object.assign(imports, yield* readStringMap(getObjectProperty(input, "imports"), "imports"));
 
       const rawScopes = getObjectProperty(input, "scopes");
       if (rawScopes === undefined) {
         return new ImportMapFile(imports, scopes, importMapReference);
       }
       if (typeof rawScopes !== "object" || rawScopes === null || Array.isArray(rawScopes)) {
-        throw new Error("failed to parse import map: expected scopes to be an object");
+        return yield* new FunctionDeployError({
+          message: "failed to parse import map: expected scopes to be an object",
+        });
       }
       for (const [scopeName, scopeValue] of Object.entries(rawScopes)) {
-        scopes[scopeName] = readStringMap(scopeValue, `scopes.${scopeName}`);
+        scopes[scopeName] = yield* readStringMap(scopeValue, `scopes.${scopeName}`);
       }
     }
 
     return new ImportMapFile(imports, scopes, importMapReference);
-  }
+  });
 
   isReference() {
     return (
@@ -609,20 +671,20 @@ class ImportMapFile {
     );
   }
 
-  resolve(jsonPath: string) {
+  resolve(path: Path.Path, jsonPath: string) {
     const imports = Object.fromEntries(
       Object.entries(this.imports).map(([key, value]) => [
         key,
-        resolveImportTarget(jsonPath, value),
+        resolveImportTarget(path, jsonPath, value),
       ]),
     );
     const scopes = Object.fromEntries(
       Object.entries(this.scopes).map(([scopeName, scopeValue]) => [
-        resolveImportTarget(jsonPath, scopeName),
+        resolveImportTarget(path, jsonPath, scopeName),
         Object.fromEntries(
           Object.entries(scopeValue).map(([key, value]) => [
             key,
-            resolveImportTarget(jsonPath, value),
+            resolveImportTarget(path, jsonPath, value),
           ]),
         ),
       ]),
@@ -631,28 +693,36 @@ class ImportMapFile {
   }
 }
 
-async function loadImportMapFile(
+const parseImportMapContents = (contents: Uint8Array) =>
+  decodeJson(stripJsonComments(new TextDecoder().decode(contents))).pipe(
+    Effect.mapError((error) => new FunctionImportMapSyntaxError({ message: error.message })),
+  );
+
+const loadImportMapFile = Effect.fnUntraced(function* <E = never, R = never>(
   pathname: string,
-  onRead?: (pathname: string, contents: Uint8Array) => Promise<void>,
-  seen = new Set<string>(),
-): Promise<ImportMapFile> {
-  const resolvedPath = resolve(pathname);
-  if (seen.has(resolvedPath)) {
-    throw new Error(`cyclic import map reference: ${pathname}`);
-  }
-  seen.add(resolvedPath);
-  const contents = await readFile(pathname);
-  if (onRead !== undefined) {
-    await onRead(pathname, contents);
-  }
-  const parsed = JSON.parse(stripJsonComments(new TextDecoder().decode(contents)));
-  const importMap = ImportMapFile.fromUnknown(parsed).resolve(toSlash(pathname));
-  if (isDenoConfigFile(pathname) && importMap.isReference()) {
-    const nestedPath = join(dirname(pathname), importMap.importMapReference);
-    return loadImportMapFile(nestedPath, onRead, seen);
-  }
-  return importMap;
-}
+  onRead?: (pathname: string, contents: Uint8Array) => Effect.Effect<void, E, R>,
+) {
+  const path = yield* Path.Path;
+  const seen = new Set<string>();
+  let current = pathname;
+  for (;;) {
+    const resolvedPath = path.resolve(current);
+    if (seen.has(resolvedPath)) {
+      return yield* new FunctionDeployError({ message: `cyclic import map reference: ${current}` });
+    }
+    seen.add(resolvedPath);
+    const contents = yield* hostReadFile(current);
+    if (onRead !== undefined) {
+      yield* onRead(current, contents);
+    }
+    const parsed = yield* parseImportMapContents(contents);
+    const importMap = (yield* ImportMapFile.fromUnknown(parsed)).resolve(path, toSlash(current));
+    if (!(isDenoConfigFile(path, current) && importMap.isReference())) {
+      return importMap;
+    }
+    current = path.join(path.dirname(current), importMap.importMapReference);
+  }
+});
 
 function substituteImportMapValue(
   mappings: Readonly<Record<string, string>>,
@@ -726,14 +796,20 @@ function resolveImportSpecifier(
   return { path: resolved, substituted };
 }
 
-async function walkImportPaths(
+const walkImportPaths = Effect.fnUntraced(function* <
+  FileError,
+  FileServices,
+  WarningError,
+  WarningServices,
+>(
   importMap: ImportMapFile,
   srcPath: string,
   allowedRoots: ReadonlyArray<string>,
   displayRoot: string,
-  onFile: (pathname: string, contents: Uint8Array) => Promise<void>,
-  onWarning: (message: string) => Promise<void>,
+  onFile: (pathname: string, contents: Uint8Array) => Effect.Effect<void, FileError, FileServices>,
+  onWarning: (message: string) => Effect.Effect<void, WarningError, WarningServices>,
 ) {
+  const path = yield* Path.Path;
   const seen = new Set<string>();
   const queue = [toSlash(srcPath)];
 
@@ -744,34 +820,39 @@ async function walkImportPaths(
     }
     seen.add(current);
 
-    let contents: Uint8Array;
-    try {
-      const resolvedCurrent = await realpath(resolve(current));
-      if (!isContainedInAnyPath(allowedRoots, resolvedCurrent)) {
-        await onWarning(`WARN: Skipping import path outside source root: ${current}\n`);
-        continue;
+    const contents = yield* Effect.gen(function* () {
+      const resolvedCurrent = yield* hostRealPath(path.resolve(current));
+      if (!isContainedInAnyPath(path, allowedRoots, resolvedCurrent)) {
+        yield* onWarning(`WARN: Skipping import path outside source root: ${current}\n`);
+        return Option.none<Uint8Array>();
       }
-      contents = await readFile(resolvedCurrent);
-    } catch (error) {
-      if (error instanceof Error && "code" in error) {
-        if (error.code === "ENOENT") {
-          const message = `failed to read file: open ${toApiRelativePath(displayRoot, current)}: no such file or directory`;
-          await onWarning(`WARN: ${message}\n`);
-          continue;
-        }
+      return Option.some(yield* hostReadFile(resolvedCurrent));
+    }).pipe(
+      Effect.catchIf(
+        (error) => error instanceof Error && hasErrorCode(error, "ENOENT"),
+        () => {
+          const message = `failed to read file: open ${toApiRelativePath(path, displayRoot, current)}: no such file or directory`;
+          return onWarning(`WARN: ${message}\n`).pipe(Effect.as(Option.none<Uint8Array>()));
+        },
+      ),
+      Effect.catchIf(
         // An ENOTDIR (import path routed through a file) gets a classified, user-facing message
         // instead of an unhandled raw Node error, so telemetry books it as user-fixable config.
-        if (error.code === "ENOTDIR") {
-          throw new FunctionImportNotDirectoryError({
-            message: `failed to read file: open ${toApiRelativePath(displayRoot, current)}: not a directory`,
-          });
-        }
-      }
-      throw error;
+        (error) => error instanceof Error && hasErrorCode(error, "ENOTDIR"),
+        () =>
+          Effect.fail(
+            new FunctionImportNotDirectoryError({
+              message: `failed to read file: open ${toApiRelativePath(path, displayRoot, current)}: not a directory`,
+            }),
+          ),
+      ),
+    );
+    if (Option.isNone(contents)) {
+      continue;
     }
 
-    await onFile(current, contents);
-    const text = new TextDecoder().decode(contents);
+    yield* onFile(current, contents.value);
+    const text = new TextDecoder().decode(contents.value);
     importPathPattern.lastIndex = 0;
     for (const match of text.matchAll(importPathPattern)) {
       const raw = match[1] ?? match[2];
@@ -804,30 +885,30 @@ async function walkImportPaths(
       }
 
       if (!substituted && (modulePath.startsWith("./") || modulePath.startsWith("../"))) {
-        modulePath = toSlash(join(dirname(current), modulePath));
+        modulePath = toSlash(path.join(path.dirname(current), modulePath));
       }
 
-      const resolvedModule = resolve(modulePath);
-      const containmentPath = await realpathIfExists(resolvedModule);
-      if (!isContainedInAnyPath(allowedRoots, containmentPath)) {
-        await onWarning(`WARN: Skipping import path outside source root: ${modulePath}\n`);
+      const resolvedModule = path.resolve(modulePath);
+      const containmentPath = yield* realpathIfExists(resolvedModule);
+      if (!isContainedInAnyPath(path, allowedRoots, containmentPath)) {
+        yield* onWarning(`WARN: Skipping import path outside source root: ${modulePath}\n`);
         continue;
       }
       queue.push(toSlash(resolvedModule));
     }
   }
-}
+});
 
 function hasGlobMeta(pattern: string) {
   return pattern.includes("*") || pattern.includes("?") || pattern.includes("[");
 }
 
-function defaultFunctionEntrypoint(functionsDir: string, slug: string) {
-  return join(functionsDir, slug, "index.ts");
+function defaultFunctionEntrypoint(path: Path.Path, functionsDir: string, slug: string) {
+  return path.join(functionsDir, slug, "index.ts");
 }
 
-function defaultFunctionImportMap(functionsDir: string, slug: string) {
-  return join(functionsDir, slug, "deno.json");
+function defaultFunctionImportMap(path: Path.Path, functionsDir: string, slug: string) {
+  return path.join(functionsDir, slug, "deno.json");
 }
 
 function globToRegExp(pattern: string) {
@@ -866,10 +947,10 @@ function globToRegExp(pattern: string) {
   return new RegExp(source);
 }
 
-function globBaseDirectory(pattern: string) {
+function globBaseDirectory(path: Path.Path, pattern: string) {
   const normalized = toSlash(pattern);
   if (!hasGlobMeta(normalized)) {
-    return dirname(normalized);
+    return path.dirname(normalized);
   }
   const parts = normalized.split("/");
   const stableParts: string[] = [];
@@ -885,269 +966,309 @@ function globBaseDirectory(pattern: string) {
   return stableParts.join("/");
 }
 
-async function listPathsRecursive(root: string): Promise<ReadonlyArray<string>> {
-  const resolvedRoot = resolve(root);
-  const entries = await readdir(resolvedRoot, { withFileTypes: true });
-  const paths: string[] = [];
-  for (const entry of entries) {
-    const pathname = join(resolvedRoot, entry.name);
-    paths.push(pathname);
-    if (entry.isDirectory()) {
-      paths.push(...(await listPathsRecursive(pathname)));
-    }
+const isNonSymlinkDirectory = Effect.fnUntraced(function* (pathname: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const isDirectory = yield* fs.stat(pathname).pipe(
+    Effect.map((info) => info.type === "Directory"),
+    Effect.orElseSucceed(() => false),
+  );
+  if (!isDirectory) {
+    return false;
   }
-  return paths;
-}
+  return !(yield* Effect.isSuccess(fs.readLink(pathname)));
+});
 
-async function expandStaticPattern(pattern: string): Promise<ReadonlyArray<string>> {
-  if (!hasGlobMeta(pattern)) {
-    try {
-      await stat(pattern);
-    } catch {
-      throw new Error(`no files matched pattern: ${pattern}`);
+const listPathsRecursive: (
+  root: string,
+) => Effect.Effect<ReadonlyArray<string>, Error, FileSystem.FileSystem | Path.Path> =
+  Effect.fnUntraced(function* (root: string) {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const resolvedRoot = path.resolve(root);
+    const entries = yield* fs
+      .readDirectory(resolvedRoot)
+      .pipe(Effect.mapError(hostError(resolvedRoot)));
+    const paths: string[] = [];
+    for (const entry of entries) {
+      const pathname = path.join(resolvedRoot, entry);
+      paths.push(pathname);
+      if (yield* isNonSymlinkDirectory(pathname)) {
+        paths.push(...(yield* listPathsRecursive(pathname)));
+      }
     }
+    return paths;
+  });
+
+const expandStaticPattern = Effect.fnUntraced(function* (pattern: string) {
+  const path = yield* Path.Path;
+  if (!hasGlobMeta(pattern)) {
+    yield* hostStat(pattern).pipe(
+      Effect.mapError(
+        () => new FunctionDeployError({ message: `no files matched pattern: ${pattern}` }),
+      ),
+    );
     return [pattern];
   }
 
-  const baseDir = globBaseDirectory(pattern);
-  const matcher = globToRegExp(toSlash(resolve(pattern)));
-  let candidates: ReadonlyArray<string>;
-  try {
-    candidates = await listPathsRecursive(baseDir);
-  } catch (error) {
-    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-      throw new Error(`no files matched pattern: ${pattern}`);
-    }
-    throw error;
-  }
-  const matches = candidates.filter((candidate) => matcher.test(toSlash(resolve(candidate))));
+  const baseDir = globBaseDirectory(path, pattern);
+  const matcher = yield* Effect.try({
+    try: () => globToRegExp(toSlash(path.resolve(pattern))),
+    catch: (cause) =>
+      new FunctionDeployError({ message: cause instanceof Error ? cause.message : String(cause) }),
+  });
+  const candidates = yield* listPathsRecursive(baseDir).pipe(
+    Effect.mapError((error) =>
+      hasErrorCode(error, "ENOENT")
+        ? new FunctionDeployError({ message: `no files matched pattern: ${pattern}` })
+        : error,
+    ),
+  );
+  const matches = candidates.filter((candidate) => matcher.test(toSlash(path.resolve(candidate))));
   if (matches.length === 0) {
-    throw new Error(`no files matched pattern: ${pattern}`);
+    return yield* new FunctionDeployError({ message: `no files matched pattern: ${pattern}` });
   }
   return matches;
-}
+});
 
-async function forEachLocalImportMapTarget(
+const forEachLocalImportMapTarget = Effect.fnUntraced(function* <E, R>(
   importMap: ImportMapFile,
-  onTarget: (pathname: string, kind: "import" | "scope") => Promise<void>,
+  onTarget: (pathname: string, kind: "import" | "scope") => Effect.Effect<void, E, R>,
 ) {
   for (const target of Object.values(importMap.imports)) {
     if (isRemoteImportTarget(target)) {
       continue;
     }
-    await onTarget(target, "import");
+    yield* onTarget(target, "import");
   }
   for (const scope of Object.values(importMap.scopes)) {
     for (const target of Object.values(scope)) {
       if (isRemoteImportTarget(target)) {
         continue;
       }
-      await onTarget(target, "scope");
+      yield* onTarget(target, "scope");
     }
   }
-}
+});
 
-async function walkLocalImportMapTargetImports(
+const walkLocalImportMapTargetImports = Effect.fnUntraced(function* <
+  FileError,
+  FileServices,
+  WarningError,
+  WarningServices,
+>(
   importMap: ImportMapFile,
   pathname: string,
   allowedRoots: ReadonlyArray<string>,
   displayRoot: string,
-  onFile: (pathname: string, contents: Uint8Array) => Promise<void>,
-  onWarning: (message: string) => Promise<void>,
+  onFile: (pathname: string, contents: Uint8Array) => Effect.Effect<void, FileError, FileServices>,
+  onWarning: (message: string) => Effect.Effect<void, WarningError, WarningServices>,
 ) {
-  if ((await stat(pathname)).isDirectory()) {
+  if ((yield* hostStat(pathname)).type === "Directory") {
     return;
   }
-  await walkImportPaths(importMap, pathname, allowedRoots, displayRoot, onFile, onWarning);
-}
+  yield* walkImportPaths(importMap, pathname, allowedRoots, displayRoot, onFile, onWarning);
+});
 
-async function isFile(pathname: string): Promise<boolean> {
-  try {
-    return (await stat(pathname)).isFile();
-  } catch {
-    return false;
-  }
-}
+const isFile = Effect.fnUntraced(function* (pathname: string) {
+  const fs = yield* FileSystem.FileSystem;
+  return yield* fs.stat(pathname).pipe(
+    Effect.map((info) => info.type === "File"),
+    Effect.orElseSucceed(() => false),
+  );
+});
 
-async function resolveImportMapAllowedRoots(projectRoot: string, importMapPath: string) {
-  const realProjectRoot = await realpath(projectRoot);
+const resolveImportMapAllowedRoots = Effect.fnUntraced(function* (
+  projectRoot: string,
+  importMapPath: string,
+) {
+  const path = yield* Path.Path;
+  const realProjectRoot = yield* hostRealPath(projectRoot);
   const allowedRoots = [realProjectRoot];
   if (importMapPath.length === 0) {
     return allowedRoots;
   }
 
-  const realImportMapPath = await realpath(importMapPath);
-  if (!isContainedPath(realProjectRoot, realImportMapPath)) {
-    allowedRoots.push(dirname(realImportMapPath));
+  const realImportMapPath = yield* hostRealPath(importMapPath);
+  if (!isContainedPath(path, realProjectRoot, realImportMapPath)) {
+    allowedRoots.push(path.dirname(realImportMapPath));
   }
-  if (isDenoConfigFile(importMapPath)) {
-    const contents = await readFile(importMapPath);
-    const parsed = JSON.parse(stripJsonComments(new TextDecoder().decode(contents)));
-    const importMap = ImportMapFile.fromUnknown(parsed);
+  if (isDenoConfigFile(path, importMapPath)) {
+    const contents = yield* hostReadFile(importMapPath);
+    const parsed = yield* parseImportMapContents(contents);
+    const importMap = yield* ImportMapFile.fromUnknown(parsed);
     if (importMap.importMapReference.length > 0) {
-      const referencedImportMapPath = await realpath(
-        join(dirname(importMapPath), importMap.importMapReference),
+      const referencedImportMapPath = yield* hostRealPath(
+        path.join(path.dirname(importMapPath), importMap.importMapReference),
       );
-      if (!isContainedPath(realProjectRoot, referencedImportMapPath)) {
-        allowedRoots.push(dirname(referencedImportMapPath));
+      if (!isContainedPath(path, realProjectRoot, referencedImportMapPath)) {
+        allowedRoots.push(path.dirname(referencedImportMapPath));
       }
     }
   }
   return allowedRoots;
-}
+});
 
-async function writeSourceDeployForm(
+const collectSourceDeployFiles = Effect.fnUntraced(function* (
   sourceRoot: string,
   workdir: string,
   config: ResolvedDeployFunctionConfig,
   metadata: SourceDeployMetadata,
   outputRaw: (text: string) => Effect.Effect<void, never>,
 ) {
-  const form = new FormData();
-  form.append("metadata", JSON.stringify(metadata));
-  const realSourceRoot = await realpath(sourceRoot);
-  const importMapAllowedRoots = await resolveImportMapAllowedRoots(sourceRoot, config.importMap);
+  const path = yield* Path.Path;
+  const files: Array<File> = [];
+  const realSourceRoot = yield* hostRealPath(sourceRoot);
+  const importMapAllowedRoots = yield* resolveImportMapAllowedRoots(sourceRoot, config.importMap);
   const uploadedAssets = new Set<string>();
 
-  const appendAsset = async (pathname: string, contents: Uint8Array, realPathname: string) => {
+  const appendAsset = Effect.fnUntraced(function* (
+    pathname: string,
+    contents: Uint8Array,
+    realPathname: string,
+  ) {
     if (uploadedAssets.has(realPathname)) {
       return;
     }
     uploadedAssets.add(realPathname);
     // Uploaded file names are anchored at the workdir, not at `sourceRoot` — see the note in
     // `deployViaApi`.
-    const relativePath = toApiRelativePath(workdir, pathname);
+    const relativePath = toApiRelativePath(path, workdir, pathname);
     if (hasParentPathSegment(relativePath)) {
-      throw new Error(`failed to read file: open ${relativePath}: invalid argument`);
+      return yield* new FunctionDeployError({
+        message: `failed to read file: open ${relativePath}: invalid argument`,
+      });
     }
-    await Effect.runPromise(outputRaw(`Uploading asset (${config.slug}): ${relativePath}\n`));
-    form.append("file", new File([contents], relativePath));
-  };
+    yield* outputRaw(`Uploading asset (${config.slug}): ${relativePath}\n`);
+    files.push(new File([contents], relativePath));
+  });
 
-  const uploadAsset = async (pathname: string, contents: Uint8Array) => {
-    const realPathname = await realpath(pathname);
-    if (!isContainedPath(realSourceRoot, realPathname)) {
-      throw new Error(`refusing to upload asset outside source root: ${pathname}`);
+  const uploadAsset = Effect.fnUntraced(function* (pathname: string, contents: Uint8Array) {
+    const realPathname = yield* hostRealPath(pathname);
+    if (!isContainedPath(path, realSourceRoot, realPathname)) {
+      return yield* new FunctionDeployError({
+        message: `refusing to upload asset outside source root: ${pathname}`,
+      });
     }
-    await appendAsset(pathname, contents, realPathname);
-  };
+    yield* appendAsset(pathname, contents, realPathname);
+  });
 
-  const uploadImportMapAsset = async (pathname: string, contents: Uint8Array) => {
-    const realPathname = await realpath(pathname);
-    if (!isContainedInAnyPath(importMapAllowedRoots, realPathname)) {
-      throw new Error(`refusing to upload import map outside allowed roots: ${pathname}`);
+  const uploadImportMapAsset = Effect.fnUntraced(function* (
+    pathname: string,
+    contents: Uint8Array,
+  ) {
+    const realPathname = yield* hostRealPath(pathname);
+    if (!isContainedInAnyPath(path, importMapAllowedRoots, realPathname)) {
+      return yield* new FunctionDeployError({
+        message: `refusing to upload import map outside allowed roots: ${pathname}`,
+      });
     }
-    await appendAsset(pathname, contents, realPathname);
-  };
+    yield* appendAsset(pathname, contents, realPathname);
+  });
 
-  const uploadImportMapTargetAsset = async (pathname: string, contents: Uint8Array) => {
-    const realPathname = await realpath(pathname);
-    if (!isContainedInAnyPath(importMapAllowedRoots, realPathname)) {
-      await Effect.runPromise(
-        outputRaw(`WARN: Skipping import path outside source root: ${pathname}\n`),
-      );
+  const uploadImportMapTargetAsset = Effect.fnUntraced(function* (
+    pathname: string,
+    contents: Uint8Array,
+  ) {
+    const realPathname = yield* hostRealPath(pathname);
+    if (!isContainedInAnyPath(path, importMapAllowedRoots, realPathname)) {
+      yield* outputRaw(`WARN: Skipping import path outside source root: ${pathname}\n`);
       return;
     }
-    await appendAsset(pathname, contents, realPathname);
-  };
+    yield* appendAsset(pathname, contents, realPathname);
+  });
 
-  const uploadScopeTarget = async (pathname: string) => {
-    let resolvedPath: string;
-    let pathInfo: Awaited<ReturnType<typeof stat>>;
-    try {
-      resolvedPath = await realpath(pathname);
-      pathInfo = await stat(pathname);
-    } catch (error) {
-      if (error instanceof Error && "code" in error && error.code === "ENOTDIR") {
-        await Effect.runPromise(
-          outputRaw(`WARN: Skipping import map target that is not a directory: ${pathname}\n`),
-        );
-        return;
-      }
-      throw error;
+  const uploadScopeTarget = Effect.fnUntraced(function* (pathname: string) {
+    const target = yield* hostRealPath(pathname).pipe(
+      Effect.flatMap((resolvedPath) =>
+        hostStat(pathname).pipe(Effect.map((pathInfo) => Option.some({ resolvedPath, pathInfo }))),
+      ),
+      Effect.catchIf(
+        (error) => hasErrorCode(error, "ENOTDIR"),
+        () =>
+          outputRaw(`WARN: Skipping import map target that is not a directory: ${pathname}\n`).pipe(
+            Effect.as(Option.none()),
+          ),
+      ),
+    );
+    if (Option.isNone(target)) {
+      return;
     }
-    if (!isContainedInAnyPath(importMapAllowedRoots, resolvedPath)) {
-      await Effect.runPromise(
-        outputRaw(`WARN: Skipping import path outside source root: ${pathname}\n`),
-      );
+    const { resolvedPath, pathInfo } = target.value;
+    if (!isContainedInAnyPath(path, importMapAllowedRoots, resolvedPath)) {
+      yield* outputRaw(`WARN: Skipping import path outside source root: ${pathname}\n`);
       return;
     }
-    if (!pathInfo.isDirectory()) {
-      await uploadImportMapTargetAsset(pathname, await readFile(pathname));
-      await walkLocalImportMapTargetImports(
+    if (pathInfo.type !== "Directory") {
+      yield* uploadImportMapTargetAsset(pathname, yield* hostReadFile(pathname));
+      yield* walkLocalImportMapTargetImports(
         importMap,
         pathname,
         importMapAllowedRoots,
         workdir,
         uploadImportMapTargetAsset,
-        async (message) => {
-          await Effect.runPromise(outputRaw(message));
-        },
+        outputRaw,
       );
       return;
     }
-    const nestedPaths = await listPathsRecursive(pathname);
+    const nestedPaths = yield* listPathsRecursive(pathname);
     for (const nestedPath of nestedPaths) {
-      if ((await stat(nestedPath)).isDirectory()) {
+      if ((yield* hostStat(nestedPath)).type === "Directory") {
         continue;
       }
-      const resolvedNestedPath = await realpath(nestedPath);
-      if (!isContainedInAnyPath(importMapAllowedRoots, resolvedNestedPath)) {
-        await Effect.runPromise(
-          outputRaw(`WARN: Skipping import path outside source root: ${nestedPath}\n`),
-        );
+      const resolvedNestedPath = yield* hostRealPath(nestedPath);
+      if (!isContainedInAnyPath(path, importMapAllowedRoots, resolvedNestedPath)) {
+        yield* outputRaw(`WARN: Skipping import path outside source root: ${nestedPath}\n`);
         continue;
       }
-      await uploadImportMapTargetAsset(nestedPath, await readFile(nestedPath));
+      yield* uploadImportMapTargetAsset(nestedPath, yield* hostReadFile(nestedPath));
     }
-  };
+  });
 
   if (metadata.import_map_path !== undefined && metadata.import_map_path.length > 0) {
-    await loadImportMapFile(config.importMap, uploadImportMapAsset);
+    yield* loadImportMapFile(config.importMap, uploadImportMapAsset);
   }
 
   for (const pattern of config.staticFiles) {
-    let files: ReadonlyArray<string>;
-    try {
-      files = await expandStaticPattern(pattern);
-    } catch (error) {
-      await Effect.runPromise(
-        outputRaw(`WARN: ${error instanceof Error ? error.message : String(error)}\n`),
-      );
+    const matches = yield* expandStaticPattern(pattern).pipe(
+      Effect.map(Option.some),
+      Effect.catch((error) =>
+        outputRaw(`WARN: ${error.message}\n`).pipe(Effect.as(Option.none<ReadonlyArray<string>>())),
+      ),
+    );
+    if (Option.isNone(matches)) {
       continue;
     }
-    for (const pathname of files) {
-      if ((await stat(pathname)).isDirectory()) {
-        throw new Error(`file path is a directory: ${pathname}`);
+    for (const pathname of matches.value) {
+      if ((yield* hostStat(pathname)).type === "Directory") {
+        return yield* new FunctionDeployError({ message: `file path is a directory: ${pathname}` });
       }
-      await uploadAsset(pathname, await readFile(pathname));
+      yield* uploadAsset(pathname, yield* hostReadFile(pathname));
     }
   }
 
   const importMap =
     metadata.import_map_path !== undefined && metadata.import_map_path.length > 0
-      ? await loadImportMapFile(config.importMap)
+      ? yield* loadImportMapFile(config.importMap)
       : new ImportMapFile();
-  await walkImportPaths(
+  yield* walkImportPaths(
     importMap,
     config.entrypoint,
     [realSourceRoot],
     workdir,
     uploadAsset,
-    async (message) => {
-      await Effect.runPromise(outputRaw(message));
-    },
+    outputRaw,
   );
-  await forEachLocalImportMapTarget(importMap, uploadScopeTarget);
+  yield* forEachLocalImportMapTarget(importMap, uploadScopeTarget);
 
-  return form;
-}
+  return files;
+});
 
 /**
  * Server-recorded metadata paths are anchored at the workdir, with forward slashes regardless of
  * platform — see the note in `deployViaApi`.
  */
 function createSourceMetadata(
+  path: Path.Path,
   workdir: string,
   config: ResolvedDeployFunctionConfig,
   remote?: RemoteFunction,
@@ -1156,41 +1277,47 @@ function createSourceMetadata(
   return {
     name: config.slug,
     ...(verifyJwt === undefined ? {} : { verify_jwt: verifyJwt }),
-    entrypoint_path: toApiRelativePath(workdir, config.entrypoint),
+    entrypoint_path: toApiRelativePath(path, workdir, config.entrypoint),
     import_map_path:
-      config.importMap.length > 0 ? toApiRelativePath(workdir, config.importMap) : "",
-    static_patterns: config.staticFiles.map((pathname) => toApiRelativePath(workdir, pathname)),
+      config.importMap.length > 0 ? toApiRelativePath(path, workdir, config.importMap) : "",
+    static_patterns: config.staticFiles.map((pathname) =>
+      toApiRelativePath(path, workdir, pathname),
+    ),
   };
 }
 
 function createBundledMetadata(
+  path: Path.Path,
   config: ResolvedDeployFunctionConfig,
   sha256: string,
 ): BundledDeployMetadata {
   return {
     name: config.slug,
     ...(config.verifyJwt === undefined ? {} : { verify_jwt: config.verifyJwt }),
-    entrypoint_path: toBundledFileUrl(config.entrypoint),
+    entrypoint_path: toBundledFileUrl(path, config.entrypoint),
     sha256,
-    ...(config.importMap.length > 0 ? { import_map_path: toBundledFileUrl(config.importMap) } : {}),
+    ...(config.importMap.length > 0
+      ? { import_map_path: toBundledFileUrl(path, config.importMap) }
+      : {}),
     ...(config.staticFiles.length > 0
-      ? { static_patterns: config.staticFiles.map(toBundledFileUrl) }
+      ? { static_patterns: config.staticFiles.map((pathname) => toBundledFileUrl(path, pathname)) }
       : {}),
   };
 }
 
 function sanitizeDockerBinds(
+  path: Path.Path,
   binds: ReadonlyArray<DockerBind>,
   functionsDir: string,
   outputDir: string,
 ) {
-  const normalizedFunctionsDir = `${toSlash(resolve(functionsDir))}/`;
-  const normalizedOutputDir = `${toSlash(resolve(outputDir))}/`;
+  const normalizedFunctionsDir = `${toSlash(path.resolve(functionsDir))}/`;
+  const normalizedOutputDir = `${toSlash(path.resolve(outputDir))}/`;
   const seen = new Set<string>();
   const result: DockerBind[] = [];
 
   for (const bind of binds) {
-    const normalizedHostPath = toSlash(resolve(bind.hostPath));
+    const normalizedHostPath = toSlash(path.resolve(bind.hostPath));
     if (
       normalizedHostPath.startsWith(normalizedFunctionsDir) ||
       normalizedHostPath.startsWith(normalizedOutputDir)
@@ -1209,57 +1336,56 @@ function sanitizeDockerBinds(
 
 type DockerBindsOptions = {
   readonly additionalModuleRoots?: ReadonlyArray<string>;
-  readonly onWarning?: (message: string) => Promise<void>;
+  readonly onWarning?: (message: string) => Effect.Effect<void>;
   readonly skipMissingImportMapTargets?: boolean;
   /** Resolved marker presence, including an explicitly empty project value. */
   readonly bitbucketCloneDirDefined?: boolean;
 };
 
-export const buildDockerBinds = (
+// Detached so an interrupt stops waiting without stopping the walk; only this join observes it.
+const joinDetached = <A, E, R>(walk: Effect.Effect<A, E, R>) =>
+  Effect.flatMap(Effect.forkDetach(walk, { startImmediately: true }), Fiber.join);
+
+export const buildDockerBinds = Effect.fnUntraced(function* (
   projectId: string,
   functionsDir: string,
   outputDir: string,
   config: ResolvedDeployFunctionConfig,
   options: DockerBindsOptions = {},
-) =>
-  resolveFunctionsSourceRoot(resolve(functionsDir, "..", "..")).pipe(
-    Effect.flatMap((sourceRoot) =>
-      Effect.promise(() =>
-        buildDockerBindsWithin(sourceRoot, projectId, functionsDir, outputDir, config, options),
-      ),
-    ),
-  );
+) {
+  const path = yield* Path.Path;
+  const sourceRoot = yield* resolveFunctionsSourceRoot(path.resolve(functionsDir, "..", ".."));
+  return yield* joinDetached(
+    buildDockerBindsWithin(sourceRoot, projectId, functionsDir, outputDir, config, options),
+  ).pipe(Effect.orDie);
+});
 
-async function buildDockerBindsWithin(
+const buildDockerBindsWithin = Effect.fnUntraced(function* (
   sourceRoot: string,
   projectId: string,
   functionsDir: string,
   outputDir: string,
   config: ResolvedDeployFunctionConfig,
   options: DockerBindsOptions,
-): Promise<ReadonlyArray<DockerBind>> {
-  const hostFunctionsDir = resolve(functionsDir);
-  const hostOutputDir = resolve(outputDir);
-  const realSourceRoot = await realpath(sourceRoot);
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const hostFunctionsDir = path.resolve(functionsDir);
+  const hostOutputDir = path.resolve(outputDir);
+  const realSourceRoot = yield* hostRealPath(sourceRoot);
   const moduleRoots = [
     realSourceRoot,
-    ...(
-      await Promise.all(
-        (options.additionalModuleRoots ?? []).map(async (root) => {
-          try {
-            return await realpath(root);
-          } catch {
-            return undefined;
-          }
-        }),
-      )
-    ).flatMap((root) => (root === undefined ? [] : [root])),
+    ...(yield* Effect.forEach(
+      options.additionalModuleRoots ?? [],
+      (root) => Effect.option(fs.realPath(root)),
+      { concurrency: "unbounded" },
+    )).flatMap(Option.toArray),
   ];
-  const importMapAllowedRoots = await resolveImportMapAllowedRoots(sourceRoot, config.importMap);
+  const importMapAllowedRoots = yield* resolveImportMapAllowedRoots(sourceRoot, config.importMap);
   const binds: DockerBind[] = [
     {
       hostPath: hostFunctionsDir,
-      containerPath: toDockerPath(hostFunctionsDir, { resolve }),
+      containerPath: toDockerPath(hostFunctionsDir, path),
       mode: "ro",
       externalScope: false,
     },
@@ -1277,42 +1403,42 @@ async function buildDockerBindsWithin(
   if (!hostOutputDir.startsWith(hostFunctionsDir)) {
     binds.push({
       hostPath: hostOutputDir,
-      containerPath: toDockerPath(hostOutputDir, { resolve }),
+      containerPath: toDockerPath(hostOutputDir, path),
       mode: "rw",
       externalScope: false,
     });
   }
 
-  const warn = options.onWarning ?? (async () => {});
+  const warn = options.onWarning ?? (() => Effect.void);
   const extraBinds: DockerBind[] = [];
   const explicitScopeBinds = new Map<string, DockerBind>();
-  const appendBindWithinRoots = async (roots: ReadonlyArray<string>, pathname: string) => {
-    const hostPath = await realpath(pathname);
-    const contained = isContainedInAnyPath(roots, hostPath);
+  const appendBindWithinRoots = Effect.fnUntraced(function* (
+    roots: ReadonlyArray<string>,
+    pathname: string,
+  ) {
+    const hostPath = yield* hostRealPath(pathname);
+    const contained = isContainedInAnyPath(path, roots, hostPath);
     if (contained) {
       extraBinds.push({
         hostPath,
-        containerPath: toDockerPath(hostPath, { resolve }),
+        containerPath: toDockerPath(hostPath, path),
         mode: "ro",
         externalScope: false,
       });
     }
     return { hostPath, contained };
-  };
-  const appendProjectBind = async (pathname: string, _contents: Uint8Array) => {
-    await appendBindWithinRoots([realSourceRoot], pathname);
-  };
-  const appendModuleBind = async (pathname: string, _contents: Uint8Array) => {
-    await appendBindWithinRoots(moduleRoots, pathname);
-  };
-  const appendImportMapBind = async (pathname: string, _contents: Uint8Array) => {
-    await appendBindWithinRoots(importMapAllowedRoots, pathname);
-  };
+  });
+  const appendProjectBind = (pathname: string, _contents: Uint8Array) =>
+    Effect.asVoid(appendBindWithinRoots([realSourceRoot], pathname));
+  const appendModuleBind = (pathname: string, _contents: Uint8Array) =>
+    Effect.asVoid(appendBindWithinRoots(moduleRoots, pathname));
+  const appendImportMapBind = (pathname: string, _contents: Uint8Array) =>
+    Effect.asVoid(appendBindWithinRoots(importMapAllowedRoots, pathname));
   const importMap =
     config.importMap.length > 0
-      ? await loadImportMapFile(config.importMap, appendImportMapBind)
+      ? yield* loadImportMapFile(config.importMap, appendImportMapBind)
       : new ImportMapFile();
-  await walkImportPaths(
+  yield* walkImportPaths(
     importMap,
     config.entrypoint,
     moduleRoots,
@@ -1320,14 +1446,14 @@ async function buildDockerBindsWithin(
     appendModuleBind,
     warn,
   );
-  await forEachLocalImportMapTarget(importMap, async (target, kind) => {
-    try {
-      const { hostPath, contained } = await appendBindWithinRoots(importMapAllowedRoots, target);
-      const isDirectory = (await stat(target)).isDirectory();
+  yield* forEachLocalImportMapTarget(importMap, (target, kind) =>
+    Effect.gen(function* () {
+      const { hostPath, contained } = yield* appendBindWithinRoots(importMapAllowedRoots, target);
+      const isDirectory = (yield* hostStat(target)).type === "Directory";
       if (!contained && kind === "scope") {
         const scopeBind: DockerBind = {
           hostPath,
-          containerPath: toDockerPath(target, { resolve }),
+          containerPath: toDockerPath(target, path),
           mode: "ro",
           externalScope: true,
         };
@@ -1336,48 +1462,48 @@ async function buildDockerBindsWithin(
       if (isDirectory) {
         return;
       }
-      await walkLocalImportMapTargetImports(
+      yield* walkLocalImportMapTargetImports(
         importMap,
         target,
         importMapAllowedRoots,
         sourceRoot,
         appendImportMapBind,
-        async () => {},
+        () => Effect.void,
       );
-    } catch (error) {
-      if (error instanceof Error && "code" in error) {
-        // ENOTDIR (a trailing-slash value routed through a file) is never a
-        // walkable target regardless of caller: an import that actually
-        // reaches through that file still fails via the walker's
-        // FunctionImportNotDirectoryError.
-        if (error.code === "ENOTDIR") {
-          await warn(`WARN: Skipping import map target that is not a directory: ${target}\n`);
-          return;
-        }
-        if (options.skipMissingImportMapTargets === true && error.code === "ENOENT") {
-          await warn(`WARN: Skipping missing import map target: ${target}\n`);
-          return;
-        }
-      }
-      throw error;
-    }
-  });
+    }).pipe(
+      // ENOTDIR (a trailing-slash value routed through a file) is never a
+      // walkable target regardless of caller: an import that actually
+      // reaches through that file still fails via the walker's
+      // FunctionImportNotDirectoryError.
+      Effect.catchIf(
+        (error) => hasErrorCode(error, "ENOTDIR"),
+        () => warn(`WARN: Skipping import map target that is not a directory: ${target}\n`),
+      ),
+      Effect.catchIf(
+        (error) => options.skipMissingImportMapTargets === true && hasErrorCode(error, "ENOENT"),
+        () => warn(`WARN: Skipping missing import map target: ${target}\n`),
+      ),
+    ),
+  );
   for (const pattern of config.staticFiles) {
-    let files: ReadonlyArray<string>;
-    try {
-      files = await expandStaticPattern(pattern);
-    } catch {
+    const matches = yield* Effect.option(expandStaticPattern(pattern));
+    if (Option.isNone(matches)) {
       continue;
     }
-    for (const pathname of files) {
-      if ((await stat(pathname)).isDirectory()) {
-        throw new Error(`file path is a directory: ${pathname}`);
+    for (const pathname of matches.value) {
+      if ((yield* hostStat(pathname)).type === "Directory") {
+        return yield* new FunctionDeployError({ message: `file path is a directory: ${pathname}` });
       }
-      await appendProjectBind(pathname, new Uint8Array());
+      yield* appendProjectBind(pathname, new Uint8Array());
     }
   }
 
-  const sanitizedExtraBinds = sanitizeDockerBinds(extraBinds, hostFunctionsDir, hostOutputDir);
+  const sanitizedExtraBinds = sanitizeDockerBinds(
+    path,
+    extraBinds,
+    hostFunctionsDir,
+    hostOutputDir,
+  );
   const occupiedContainerPaths = new Set(
     [...binds, ...sanitizedExtraBinds].map((bind) => bind.containerPath),
   );
@@ -1388,29 +1514,32 @@ async function buildDockerBindsWithin(
     }
     occupiedContainerPaths.add(bind.containerPath);
     uniqueScopeBinds.push(bind);
-    await warn(
+    yield* warn(
       `WARN: Mounting import map scope target outside the project root: ${bind.hostPath}\n`,
     );
   }
 
   return [...binds, ...sanitizedExtraBinds, ...uniqueScopeBinds];
-}
+});
 
-function shouldUseDenoJsonDiscovery(entrypoint: string, importMap: string) {
-  return isDenoConfigFile(importMap) && dirname(importMap) === dirname(entrypoint);
+function shouldUseDenoJsonDiscovery(path: Path.Path, entrypoint: string, importMap: string) {
+  return isDenoConfigFile(path, importMap) && path.dirname(importMap) === path.dirname(entrypoint);
 }
 
-async function shouldUsePackageJsonDiscovery(entrypoint: string, importMap: string) {
+const shouldUsePackageJsonDiscovery = Effect.fnUntraced(function* (
+  entrypoint: string,
+  importMap: string,
+) {
   if (importMap.length > 0) {
     return false;
   }
-  try {
-    await stat(join(dirname(entrypoint), "package.json"));
-    return true;
-  } catch {
-    return false;
-  }
-}
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  return yield* fs.stat(path.join(path.dirname(entrypoint), "package.json")).pipe(
+    Effect.as(true),
+    Effect.orElseSucceed(() => false),
+  );
+});
 
 interface BundleFunctionWithDockerOptions {
   readonly projectId: string;
@@ -1424,7 +1553,7 @@ interface BundleFunctionWithDockerOptions {
   readonly projectEnvValues?: Readonly<Record<string, string>>;
 }
 
-const bundleFunctionWithDocker = Effect.fnUntraced(function* (
+const bundleFunctionWithDocker = Effect.fn("functions.deploy.bundleWithDocker")(function* (
   options: BundleFunctionWithDockerOptions,
 ) {
   const {
@@ -1439,29 +1568,31 @@ const bundleFunctionWithDocker = Effect.fnUntraced(function* (
   } = options;
   const bitbucketCloneDirDefined = Option.isSome(yield* bitbucketCloneDir(projectEnvValues));
   const output = yield* Output;
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
   yield* output.raw(`Bundling Function: ${styleEmphasis(config.slug)}\n`, "stderr");
 
-  const outputRoot = resolve(functionsDir, "..", ".temp");
-  yield* Effect.tryPromise(() => mkdir(outputRoot, { recursive: true }));
-  const outputDir = yield* Effect.tryPromise(() =>
-    mkdtemp(join(outputRoot, `.supabase-output-${config.slug}-`)),
-  );
+  const outputRoot = path.resolve(functionsDir, "..", ".temp");
+  yield* fs
+    .makeDirectory(outputRoot, { recursive: true })
+    .pipe(Effect.mapError(unknownHostError(outputRoot)));
+  const outputPrefix = `.supabase-output-${config.slug}-`;
+  const outputDir = yield* fs
+    .makeTempDirectory({ directory: outputRoot, prefix: outputPrefix })
+    .pipe(Effect.mapError(unknownHostError(path.join(outputRoot, outputPrefix))));
   try {
     // Go passes 0777 to MkdirAll, which Windows ignores. Calling chmod separately
     // adds an NTFS WRITE_ATTRIBUTES requirement that the Go CLI does not have.
     if (shouldChmodBundleOutputDirectory(process.platform)) {
-      yield* Effect.tryPromise({
-        try: () => chmod(outputDir, 0o777),
-        catch: (cause) => (cause instanceof Error ? cause : new Error(String(cause))),
-      });
+      yield* fs.chmod(outputDir, 0o777).pipe(Effect.mapError(hostError(outputDir)));
     }
-    const outputPath = join(outputDir, "output.eszip");
+    const outputPath = path.join(outputDir, "output.eszip");
     // `edgeRuntimeImage` applies the tag verbatim — a `.temp/edge-runtime-version` pin flows
     // through unmodified, `v` prefix or not (see the helper's doc in `functions.shared.ts`).
     const rawImage = edgeRuntimeImage(edgeRuntimeVersion, yield* slimImagesEnabled);
     const binds = yield* buildDockerBinds(projectId, functionsDir, outputDir, config, {
       bitbucketCloneDirDefined,
-      onWarning: (message) => Effect.runPromise(output.raw(message, "stderr")),
+      onWarning: (message) => output.raw(message, "stderr"),
     });
     // Resolved per function rather than hoisted out of the loop (unlike `download.ts`'s
     // `PulledEdgeRuntimeImage`): the first resolve failure aborts the loop, and the only added
@@ -1475,11 +1606,7 @@ const bundleFunctionWithDocker = Effect.fnUntraced(function* (
     );
 
     const env: Array<string> = [];
-    if (
-      !(yield* Effect.promise(() =>
-        shouldUsePackageJsonDiscovery(config.entrypoint, config.importMap),
-      ))
-    ) {
+    if (!(yield* shouldUsePackageJsonDiscovery(config.entrypoint, config.importMap))) {
       env.push("DENO_NO_PACKAGE_JSON=1");
     }
     env.push(...dockerNpmEnv());
@@ -1487,20 +1614,20 @@ const bundleFunctionWithDocker = Effect.fnUntraced(function* (
     const containerArgs = [
       "bundle",
       "--entrypoint",
-      toDockerPath(config.entrypoint, { resolve }),
+      toDockerPath(config.entrypoint, path),
       "--output",
-      toDockerPath(outputPath, { resolve }),
+      toDockerPath(outputPath, path),
     ];
     if (
       config.importMap.length > 0 &&
-      !shouldUseDenoJsonDiscovery(config.entrypoint, config.importMap)
+      !shouldUseDenoJsonDiscovery(path, config.entrypoint, config.importMap)
     ) {
-      containerArgs.push("--import-map", toDockerPath(config.importMap, { resolve }));
+      containerArgs.push("--import-map", toDockerPath(config.importMap, path));
     }
     for (const staticFile of config.staticFiles) {
-      containerArgs.push("--static", toDockerPath(staticFile, { resolve }));
+      containerArgs.push("--static", toDockerPath(staticFile, path));
     }
-    if (verbose || process.env["DEBUG"] === "true") {
+    if (verbose || (yield* debugEnvEnabled)) {
       containerArgs.push("--verbose");
     }
 
@@ -1512,7 +1639,7 @@ const bundleFunctionWithDocker = Effect.fnUntraced(function* (
       env,
       // `functionsDir` is `<workdir>/supabase/functions`, same derivation as `deployViaApi`'s
       // own `projectRoot`.
-      workingDir: toDockerPath(resolve(functionsDir, "..", ".."), { resolve }),
+      workingDir: toDockerPath(path.resolve(functionsDir, "..", ".."), path),
       containerArgs,
     });
 
@@ -1525,16 +1652,19 @@ const bundleFunctionWithDocker = Effect.fnUntraced(function* (
       onStderr: (chunk) => output.raw(chunk, "stderr"),
     });
     if (result.exitCode !== 0) {
-      return yield* Effect.fail(new Error(`failed to bundle function: exit ${result.exitCode}`));
+      return yield* new FunctionDeployError({
+        message: `failed to bundle function: exit ${result.exitCode}`,
+      });
     }
 
-    const eszip = yield* Effect.tryPromise({
-      try: () => readFile(outputPath),
-      catch: (error) =>
-        new Error(
-          `failed to open eszip: ${error instanceof Error ? error.message : String(error)}`,
-        ),
-    });
+    const eszip = yield* fs.readFile(outputPath).pipe(
+      Effect.mapError(
+        (error) =>
+          new FunctionDeployError({
+            message: `failed to open eszip: ${hostError(outputPath)(error).message}`,
+          }),
+      ),
+    );
     const compressed = new Uint8Array(
       Buffer.concat([
         Buffer.from(COMPRESSED_ESZIP_MAGIC),
@@ -1547,19 +1677,21 @@ const bundleFunctionWithDocker = Effect.fnUntraced(function* (
     );
     const sha256 = yield* Effect.promise(() => crypto.subtle.digest("SHA-256", compressed));
     const hash = Buffer.from(sha256).toString("hex");
+    yield* Effect.annotateCurrentSpan({ "bundle.bytes": compressed.byteLength });
     return {
       slug: config.slug,
-      metadata: createBundledMetadata(config, hash),
+      metadata: createBundledMetadata(path, config, hash),
       body: compressed,
     } satisfies BundledFunction;
   } finally {
-    yield* Effect.tryPromise(() => rm(outputDir, { recursive: true, force: true })).pipe(
-      Effect.orElseSucceed(() => undefined),
-    );
+    yield* fs.remove(outputDir, { recursive: true, force: true }).pipe(Effect.ignore);
   }
 });
 
-const listRemoteFunctions = Effect.fnUntraced(function* (api: ApiClient, projectRef: string) {
+const listRemoteFunctions = Effect.fn("functions.deploy.listRemoteFunctions")(function* (
+  api: ApiClient,
+  projectRef: string,
+) {
   let lastError: Error | FunctionsApiStatusError | undefined;
   for (let attempt = 0; attempt <= 3; attempt += 1) {
     const result = yield* api
@@ -1580,15 +1712,16 @@ const listRemoteFunctions = Effect.fnUntraced(function* (api: ApiClient, project
         // A 200 whose body is not the expected JSON is an API-response problem,
         // not a transport failure — surface it via FunctionsApiStatusError so it
         // classifies as api_status rather than network.
-        return yield* Effect.try({
-          try: () => decodeFunctionListResponse(JSON.parse(body)),
-          catch: (error) =>
-            new FunctionsApiStatusError({
-              status: result.response.status,
-              message: `failed to read functions list: ${error instanceof Error ? error.message : String(error)}`,
-              decode: true,
-            }),
-        });
+        return yield* decodeFunctionListResponse(body).pipe(
+          Effect.mapError(
+            (error) =>
+              new FunctionsApiStatusError({
+                status: result.response.status,
+                message: `failed to read functions list: ${error.message}`,
+                decode: true,
+              }),
+          ),
+        );
       }
       lastError = new FunctionsApiStatusError({
         status: result.response.status,
@@ -1605,14 +1738,16 @@ const listRemoteFunctions = Effect.fnUntraced(function* (api: ApiClient, project
       yield* Effect.sleep(Duration.millis(1_000 * 2 ** attempt));
     }
   }
-  return yield* Effect.fail(lastError ?? new Error("failed to list functions"));
+  return yield* Effect.fail(
+    lastError ?? new FunctionDeployError({ message: "failed to list functions" }),
+  );
 });
 
 function headerValue(headers: Readonly<Record<string, string | undefined>>, name: string) {
   return headers[name.toLowerCase()] ?? headers[name];
 }
 
-function parseRateLimitDelay(value: string | undefined): number | undefined {
+function parseRateLimitDelay(value: string | undefined, now: number): number | undefined {
   if (value === undefined || value.length === 0) {
     return undefined;
   }
@@ -1622,7 +1757,7 @@ function parseRateLimitDelay(value: string | undefined): number | undefined {
   }
   const timestamp = Date.parse(value);
   if (!Number.isNaN(timestamp)) {
-    return Math.max(timestamp - Date.now(), 0);
+    return Math.max(timestamp - now, 0);
   }
   return undefined;
 }
@@ -1630,10 +1765,11 @@ function parseRateLimitDelay(value: string | undefined): number | undefined {
 function rateLimitDelayMillis(
   headers: Readonly<Record<string, string | undefined>>,
   attempt: number,
+  now: number,
 ) {
   return (
-    parseRateLimitDelay(headerValue(headers, "retry-after")) ??
-    parseRateLimitDelay(headerValue(headers, "x-ratelimit-reset")) ??
+    parseRateLimitDelay(headerValue(headers, "retry-after"), now) ??
+    parseRateLimitDelay(headerValue(headers, "x-ratelimit-reset"), now) ??
     1_000 * 2 ** Math.min(attempt, 5)
   );
 }
@@ -1659,7 +1795,7 @@ const rateLimitedRequest = Effect.fnUntraced(function* <A>(
     if (response.status !== 429 || attempt >= DEPLOY_RATE_LIMIT_MAX_RETRIES) {
       return response;
     }
-    const delayMs = rateLimitDelayMillis(response.headers, attempt);
+    const delayMs = rateLimitDelayMillis(response.headers, attempt, yield* Clock.currentTimeMillis);
     yield* output.raw(
       `Rate limit exceeded while ${action}. Retrying in ${rateLimitDelayText(delayMs)}.\n`,
       "stderr",
@@ -1668,7 +1804,7 @@ const rateLimitedRequest = Effect.fnUntraced(function* <A>(
   }
 });
 
-const uploadFunctionSource = Effect.fnUntraced(function* (
+const uploadFunctionSource = Effect.fn("functions.deploy.uploadFunctionSource")(function* (
   api: ApiClient,
   projectRef: string,
   sourceRoot: string,
@@ -1678,15 +1814,17 @@ const uploadFunctionSource = Effect.fnUntraced(function* (
   bundleOnly: boolean,
 ) {
   const output = yield* Output;
-  const files = yield* Effect.tryPromise({
-    try: async () => {
-      const form = await writeSourceDeployForm(sourceRoot, workdir, config, metadata, (text) =>
-        output.raw(text, "stderr"),
-      );
-      return form.getAll("file").flatMap((part) => (part instanceof Blob ? [part] : []));
-    },
-    catch: (error) => (error instanceof Error ? error : new Error(String(error))),
-  });
+  const files = yield* joinDetached(
+    collectSourceDeployFiles(sourceRoot, workdir, config, metadata, (text) =>
+      output.raw(text, "stderr"),
+    ),
+  ).pipe(
+    Effect.catchDefect((defect) =>
+      Effect.fail(
+        defect instanceof Error ? defect : new FunctionDeployError({ message: String(defect) }),
+      ),
+    ),
+  );
   const response = yield* rateLimitedRequest(`deploying function ${config.slug}`, () =>
     api
       .executeRaw(operationDefinitions.v1DeployAFunction, {
@@ -1713,25 +1851,24 @@ const uploadFunctionSource = Effect.fnUntraced(function* (
   );
   const body = yield* response.body;
   if (response.status !== 201) {
-    return yield* Effect.fail(
-      new FunctionsApiStatusError({
-        status: response.status,
-        message: `unexpected deploy status ${response.status}: ${formatUnexpectedStatusBody(body)}`,
-      }),
-    );
+    return yield* new FunctionsApiStatusError({
+      status: response.status,
+      message: `unexpected deploy status ${response.status}: ${formatUnexpectedStatusBody(body)}`,
+    });
   }
   // A 201 whose body is not the expected JSON is an API-response problem, not a
   // transport failure — surface it via FunctionsApiStatusError so it classifies
   // as api_status rather than network.
-  return yield* Effect.try({
-    try: () => decodeDeployFunctionResponse(JSON.parse(body)),
-    catch: (error) =>
-      new FunctionsApiStatusError({
-        status: response.status,
-        message: `failed to read deploy response: ${error instanceof Error ? error.message : String(error)}`,
-        decode: true,
-      }),
-  });
+  return yield* decodeDeployFunctionResponse(body).pipe(
+    Effect.mapError(
+      (error) =>
+        new FunctionsApiStatusError({
+          status: response.status,
+          message: `failed to read deploy response: ${error.message}`,
+          decode: true,
+        }),
+    ),
+  );
 });
 
 function toBulkUpdateItem(remote: RemoteFunction | DeployFunctionResponse): BulkUpdateFunction {
@@ -1750,7 +1887,7 @@ function toBulkUpdateItem(remote: RemoteFunction | DeployFunctionResponse): Bulk
   };
 }
 
-const bulkUpdateRemoteFunctions = Effect.fnUntraced(function* (
+const bulkUpdateRemoteFunctions = Effect.fn("functions.deploy.bulkUpdateFunctions")(function* (
   api: ApiClient,
   projectRef: string,
   functions: ReadonlyArray<BulkUpdateFunction>,
@@ -1803,10 +1940,12 @@ const bulkUpdateRemoteFunctions = Effect.fnUntraced(function* (
       yield* Effect.sleep(Duration.millis(1_000 * 2 ** attempt));
     }
   }
-  return yield* Effect.fail(lastError ?? new Error("failed to bulk update"));
+  return yield* Effect.fail(
+    lastError ?? new FunctionDeployError({ message: "failed to bulk update" }),
+  );
 });
 
-const upsertBundledFunction = Effect.fnUntraced(function* (
+const upsertBundledFunction = Effect.fn("functions.deploy.upsertFunction")(function* (
   api: ApiClient,
   projectRef: string,
   bundled: BundledFunction,
@@ -1857,15 +1996,16 @@ const upsertBundledFunction = Effect.fnUntraced(function* (
         // API-response problem, not a transport failure — surface it via
         // FunctionsApiStatusError so it classifies as api_status not network.
         const body = yield* response.value.text.pipe(Effect.orElseSucceed(() => ""));
-        return yield* Effect.try({
-          try: () => decodeDeployFunctionResponse(JSON.parse(body)),
-          catch: (error) =>
-            new FunctionsApiStatusError({
-              status: response.value.status,
-              message: `failed to read function response: ${error instanceof Error ? error.message : String(error)}`,
-              decode: true,
-            }),
-        });
+        return yield* decodeDeployFunctionResponse(body).pipe(
+          Effect.mapError(
+            (error) =>
+              new FunctionsApiStatusError({
+                status: response.value.status,
+                message: `failed to read function response: ${error.message}`,
+                decode: true,
+              }),
+          ),
+        );
       }
 
       const body = yield* response.value.text.pipe(Effect.orElseSucceed(() => ""));
@@ -1886,10 +2026,12 @@ const upsertBundledFunction = Effect.fnUntraced(function* (
     }
   }
 
-  return yield* Effect.fail(lastError ?? new Error("failed to upsert function"));
+  return yield* Effect.fail(
+    lastError ?? new FunctionDeployError({ message: "failed to upsert function" }),
+  );
 });
 
-const deleteRemoteFunction = Effect.fnUntraced(function* (
+const deleteRemoteFunction = Effect.fn("functions.deploy.deleteFunction")(function* (
   api: ApiClient,
   projectRef: string,
   slug: string,
@@ -1905,42 +2047,42 @@ const deleteRemoteFunction = Effect.fnUntraced(function* (
     return;
   }
   const body = yield* response.text.pipe(Effect.orElseSucceed(() => ""));
-  return yield* Effect.fail(
-    new FunctionsApiStatusError({
-      status: response.status,
-      message: `unexpected delete function status ${response.status}: ${body}`,
-    }),
-  );
+  return yield* new FunctionsApiStatusError({
+    status: response.status,
+    message: `unexpected delete function status ${response.status}: ${body}`,
+  });
 });
 
-export const discoverFunctionSlugs = Effect.fnUntraced(function* (
+export const discoverFunctionSlugs = Effect.fn("functions.deploy.discoverSlugs")(function* (
   projectRoot: string,
   configDeclaredFunctions: Readonly<Record<string, ManifestFunctionConfig>>,
 ) {
-  const functionsDir = join(projectRoot, SUPABASE_FUNCTIONS_DIR);
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const functionsDir = path.join(projectRoot, SUPABASE_FUNCTIONS_DIR);
   const slugs: string[] = [];
 
-  const entries = yield* Effect.tryPromise({
-    try: () => readdir(functionsDir, { withFileTypes: true }),
-    catch: (cause) => (cause instanceof Error ? cause : new Error(String(cause))),
-  }).pipe(
-    Effect.catch((error) => {
-      return "code" in error && error.code === "ENOENT"
-        ? Effect.succeed(undefined)
-        : Effect.fail(error);
-    }),
+  const entries = yield* fs.readDirectory(functionsDir).pipe(
+    Effect.mapError(hostError(functionsDir)),
+    Effect.catchIf(
+      (error) => hasErrorCode(error, "ENOENT"),
+      () => Effect.undefined,
+    ),
   );
   if (entries !== undefined) {
-    for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
-      if (!entry.isDirectory() && !entry.isSymbolicLink()) {
+    for (const slug of entries.sort((left, right) => left.localeCompare(right))) {
+      const isDirectory = yield* fs.stat(path.join(functionsDir, slug)).pipe(
+        Effect.map((info) => info.type === "Directory"),
+        Effect.orElseSucceed(() => false),
+      );
+      if (!isDirectory) {
         continue;
       }
-      const slug = entry.name;
       if (validateFunctionSlugMessage(slug) !== undefined) {
         continue;
       }
-      const hasDefaultEntrypoint = yield* Effect.promise(() =>
-        isFile(defaultFunctionEntrypoint(functionsDir, slug)),
+      const hasDefaultEntrypoint = yield* isFile(
+        defaultFunctionEntrypoint(path, functionsDir, slug),
       );
       if (hasDefaultEntrypoint) {
         slugs.push(slug);
@@ -1962,130 +2104,135 @@ const validateConfigFunctionSlugs = Effect.fnUntraced(function* (
   return configSlugs;
 });
 
-export const resolveFunctionConfigs = Effect.fnUntraced(function* (input: {
-  readonly slugs: ReadonlyArray<string>;
-  readonly cwd: string;
-  readonly projectRoot: string;
-  readonly supabaseDir: string;
-  readonly configFunctions: Readonly<Record<string, ManifestFunctionConfig>>;
-  readonly configDeclaredFunctions: Readonly<Record<string, ManifestFunctionConfig>>;
-  readonly rawConfigFunctions: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
-  readonly importMapOverride: Option.Option<string>;
-  readonly noVerifyJwtOverride: Option.Option<boolean>;
-}) {
-  const output = yield* Output;
-  const functionsDir = join(input.projectRoot, SUPABASE_FUNCTIONS_DIR);
-  const seenDeprecatedImportMap = new Set<string>();
-  const seenFallbackImportMap = new Set<string>();
-  const resolved: ResolvedDeployFunctionConfig[] = [];
-
-  const fallbackImportMapPath = join(functionsDir, "import_map.json");
-  const fallbackExists = yield* Effect.promise(() => isFile(fallbackImportMapPath));
-
-  const importMapOverride = Option.match(input.importMapOverride, {
-    onNone: () => "",
-    onSome: (pathname) => resolve(input.cwd, pathname),
-  });
-
-  for (const slug of input.slugs) {
-    const configured = input.configFunctions[slug] ?? defaultManifestFunctionConfig;
-    const override = input.configDeclaredFunctions[slug];
-    const enabled = configured.enabled;
-    const verifyJwt = Option.match(input.noVerifyJwtOverride, {
-      onNone: () =>
-        hasOwnKey(input.rawConfigFunctions[slug], "verify_jwt") ? configured.verify_jwt : undefined,
-      onSome: (noVerifyJwt) => !noVerifyJwt,
+export const resolveFunctionConfigs = Effect.fn("functions.deploy.resolveConfigs")(
+  function* (input: {
+    readonly slugs: ReadonlyArray<string>;
+    readonly cwd: string;
+    readonly projectRoot: string;
+    readonly supabaseDir: string;
+    readonly configFunctions: Readonly<Record<string, ManifestFunctionConfig>>;
+    readonly configDeclaredFunctions: Readonly<Record<string, ManifestFunctionConfig>>;
+    readonly rawConfigFunctions: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
+    readonly importMapOverride: Option.Option<string>;
+    readonly noVerifyJwtOverride: Option.Option<boolean>;
+  }) {
+    const output = yield* Output;
+    const path = yield* Path.Path;
+    const functionsDir = path.join(input.projectRoot, SUPABASE_FUNCTIONS_DIR);
+    const seenDeprecatedImportMap = new Set<string>();
+    const seenFallbackImportMap = new Set<string>();
+    const resolved: ResolvedDeployFunctionConfig[] = [];
+
+    const fallbackImportMapPath = path.join(functionsDir, "import_map.json");
+    const fallbackExists = yield* isFile(fallbackImportMapPath);
+
+    const importMapOverride = Option.match(input.importMapOverride, {
+      onNone: () => "",
+      onSome: (pathname) => path.resolve(input.cwd, pathname),
     });
 
-    const defaultEntrypoint = defaultFunctionEntrypoint(functionsDir, slug);
-    const entrypoint =
-      configured.entrypoint === undefined || configured.entrypoint.length === 0
-        ? defaultEntrypoint
-        : resolve(
-            configured.entrypoint.startsWith(".") || !isAbsolute(configured.entrypoint)
-              ? join(input.supabaseDir, configured.entrypoint)
-              : configured.entrypoint,
-          );
+    for (const slug of input.slugs) {
+      const configured = input.configFunctions[slug] ?? defaultManifestFunctionConfig;
+      const override = input.configDeclaredFunctions[slug];
+      const enabled = configured.enabled;
+      const verifyJwt = Option.match(input.noVerifyJwtOverride, {
+        onNone: () =>
+          hasOwnKey(input.rawConfigFunctions[slug], "verify_jwt")
+            ? configured.verify_jwt
+            : undefined,
+        onSome: (noVerifyJwt) => !noVerifyJwt,
+      });
 
-    let importMap = importMapOverride;
-    if (importMap.length === 0) {
-      let configuredImportMap = "";
-      if (configured.import_map.length > 0) {
-        configuredImportMap = resolve(
-          configured.import_map.startsWith(".") || !isAbsolute(configured.import_map)
-            ? join(input.supabaseDir, configured.import_map)
-            : configured.import_map,
-        );
-      }
+      const defaultEntrypoint = defaultFunctionEntrypoint(path, functionsDir, slug);
+      const entrypoint =
+        configured.entrypoint === undefined || configured.entrypoint.length === 0
+          ? defaultEntrypoint
+          : path.resolve(
+              configured.entrypoint.startsWith(".") || !path.isAbsolute(configured.entrypoint)
+                ? path.join(input.supabaseDir, configured.entrypoint)
+                : configured.entrypoint,
+            );
+
+      let importMap = importMapOverride;
+      if (importMap.length === 0) {
+        let configuredImportMap = "";
+        if (configured.import_map.length > 0) {
+          configuredImportMap = path.resolve(
+            configured.import_map.startsWith(".") || !path.isAbsolute(configured.import_map)
+              ? path.join(input.supabaseDir, configured.import_map)
+              : configured.import_map,
+          );
+        }
 
-      if (
-        configuredImportMap.length > 0 &&
-        !(
-          (override === undefined || override.import_map.length === 0) &&
-          entrypoint !== defaultEntrypoint &&
-          configuredImportMap === defaultFunctionImportMap(functionsDir, slug)
-        )
-      ) {
-        importMap = configuredImportMap;
-      } else {
-        const functionDir = dirname(entrypoint);
-        const denoJson = join(functionDir, "deno.json");
-        const denoJsonc = join(functionDir, "deno.jsonc");
-        const deprecatedImportMap = join(functionDir, "import_map.json");
-
-        if (yield* Effect.promise(() => isFile(denoJson))) {
-          importMap = denoJson;
-        } else if (yield* Effect.promise(() => isFile(denoJsonc))) {
-          importMap = denoJsonc;
-        } else if (yield* Effect.promise(() => isFile(deprecatedImportMap))) {
-          importMap = deprecatedImportMap;
-          seenDeprecatedImportMap.add(slug);
-        } else if (fallbackExists) {
-          if (fallbackExists) {
-            importMap = fallbackImportMapPath;
-            seenFallbackImportMap.add(slug);
+        if (
+          configuredImportMap.length > 0 &&
+          !(
+            (override === undefined || override.import_map.length === 0) &&
+            entrypoint !== defaultEntrypoint &&
+            configuredImportMap === defaultFunctionImportMap(path, functionsDir, slug)
+          )
+        ) {
+          importMap = configuredImportMap;
+        } else {
+          const functionDir = path.dirname(entrypoint);
+          const denoJson = path.join(functionDir, "deno.json");
+          const denoJsonc = path.join(functionDir, "deno.jsonc");
+          const deprecatedImportMap = path.join(functionDir, "import_map.json");
+
+          if (yield* isFile(denoJson)) {
+            importMap = denoJson;
+          } else if (yield* isFile(denoJsonc)) {
+            importMap = denoJsonc;
+          } else if (yield* isFile(deprecatedImportMap)) {
+            importMap = deprecatedImportMap;
+            seenDeprecatedImportMap.add(slug);
+          } else if (fallbackExists) {
+            if (fallbackExists) {
+              importMap = fallbackImportMapPath;
+              seenFallbackImportMap.add(slug);
+            }
           }
         }
       }
-    }
 
-    const staticFiles = configured.static_files.map((pathname) =>
-      isAbsolute(pathname) ? pathname : join(input.supabaseDir, pathname),
-    );
+      const staticFiles = configured.static_files.map((pathname) =>
+        path.isAbsolute(pathname) ? pathname : path.join(input.supabaseDir, pathname),
+      );
 
-    resolved.push({
-      slug,
-      enabled,
-      ...(verifyJwt === undefined ? {} : { verifyJwt }),
-      entrypoint,
-      importMap,
-      staticFiles,
-      env: configured.env,
-    });
-  }
+      resolved.push({
+        slug,
+        enabled,
+        ...(verifyJwt === undefined ? {} : { verifyJwt }),
+        entrypoint,
+        importMap,
+        staticFiles,
+        env: configured.env,
+      });
+    }
 
-  if (seenDeprecatedImportMap.size > 0) {
-    yield* output.raw(
-      `WARNING: Functions using deprecated import_map.json (please migrate to deno.json): ${[...seenDeprecatedImportMap].join(", ")}\n`,
-      "stderr",
-    );
-  }
+    if (seenDeprecatedImportMap.size > 0) {
+      yield* output.raw(
+        `WARNING: Functions using deprecated import_map.json (please migrate to deno.json): ${[...seenDeprecatedImportMap].join(", ")}\n`,
+        "stderr",
+      );
+    }
 
-  if (seenFallbackImportMap.size > 0) {
-    yield* output.raw(
-      `WARNING: Functions using fallback import map: ${[...seenFallbackImportMap].join(", ")}\n`,
-      "stderr",
-    );
-    yield* output.raw(
-      `Please use recommended per function dependency declaration  ${IMPORT_MAP_GUIDE_URL}\n`,
-      "stderr",
-    );
-  }
+    if (seenFallbackImportMap.size > 0) {
+      yield* output.raw(
+        `WARNING: Functions using fallback import map: ${[...seenFallbackImportMap].join(", ")}\n`,
+        "stderr",
+      );
+      yield* output.raw(
+        `Please use recommended per function dependency declaration  ${IMPORT_MAP_GUIDE_URL}\n`,
+        "stderr",
+      );
+    }
 
-  return resolved;
-});
+    return resolved;
+  },
+);
 
-const deployViaApi = Effect.fnUntraced(function* (
+const deployViaApi = Effect.fn("functions.deploy.viaApi")(function* (
   projectRef: string,
   projectRoot: string,
   configs: ReadonlyArray<ResolvedDeployFunctionConfig>,
@@ -2093,6 +2240,9 @@ const deployViaApi = Effect.fnUntraced(function* (
   jobs: number,
 ) {
   const output = yield* Output;
+  const path = yield* Path.Path;
+  yield* Effect.annotateCurrentSpan({ "function.count": configs.length, "deploy.jobs": jobs });
+
   // Uploaded file names and the server-recorded metadata paths are anchored at the workdir
   // (`projectRoot`), not at `sourceRoot`. The import-walk boundary (which files may be uploaded
   // at all) is intentionally wider, extending to the nearest git root, so files outside the
@@ -2104,9 +2254,7 @@ const deployViaApi = Effect.fnUntraced(function* (
   }
 
   if (enabled.length === 0) {
-    return yield* Effect.fail(
-      new NoFunctionsToDeployError({ message: "All Functions are up to date." }),
-    );
+    return yield* new NoFunctionsToDeployError({ message: "All Functions are up to date." });
   }
 
   const remoteBySlug = enabled.some((config) => config.verifyJwt === undefined)
@@ -2121,7 +2269,7 @@ const deployViaApi = Effect.fnUntraced(function* (
       sourceRoot,
       projectRoot,
       config,
-      createSourceMetadata(projectRoot, config, remoteBySlug.get(config.slug)),
+      createSourceMetadata(path, projectRoot, config, remoteBySlug.get(config.slug)),
       false,
     );
     return;
@@ -2143,7 +2291,7 @@ const deployViaApi = Effect.fnUntraced(function* (
             sourceRoot,
             projectRoot,
             config,
-            createSourceMetadata(projectRoot, config, remoteBySlug.get(config.slug)),
+            createSourceMetadata(path, projectRoot, config, remoteBySlug.get(config.slug)),
             true,
           ),
         );
@@ -2197,7 +2345,9 @@ interface DeployViaDockerOptions {
   readonly projectEnvValues?: Readonly<Record<string, string>>;
 }
 
-const deployViaDocker = Effect.fnUntraced(function* (options: DeployViaDockerOptions) {
+const deployViaDocker = Effect.fn("functions.deploy.viaDocker")(function* (
+  options: DeployViaDockerOptions,
+) {
   const {
     projectId,
     projectRef,
@@ -2211,7 +2361,9 @@ const deployViaDocker = Effect.fnUntraced(function* (options: DeployViaDockerOpt
     projectEnvValues,
   } = options;
   const output = yield* Output;
+  yield* Effect.annotateCurrentSpan({ "function.count": configs.length });
   const remoteFunctions = yield* listRemoteFunctions(api, projectRef);
+
   const remoteBySlug = new Map(remoteFunctions.map((fn) => [fn.slug, fn]));
   const changed: BulkUpdateFunction[] = [];
 
@@ -2257,7 +2409,7 @@ const deployViaDocker = Effect.fnUntraced(function* (options: DeployViaDockerOpt
   }
 });
 
-const pruneFunctions = Effect.fnUntraced(function* (
+const pruneFunctions = Effect.fn("functions.deploy.prune")(function* (
   projectRef: string,
   configs: ReadonlyArray<ResolvedDeployFunctionConfig>,
   api: ApiClient,
@@ -2284,9 +2436,7 @@ const pruneFunctions = Effect.fnUntraced(function* (
   ].join("\n")}\n\n`;
   const confirmed = yield* promptYesNo(output, yes, prompt, false);
   if (!confirmed) {
-    return yield* Effect.fail(
-      new FunctionDeployCancelledError({ message: CONTEXT_CANCELED_MESSAGE }),
-    );
+    return yield* new FunctionDeployCancelledError({ message: CONTEXT_CANCELED_MESSAGE });
   }
 
   for (const slug of toDelete) {
@@ -2295,209 +2445,204 @@ const pruneFunctions = Effect.fnUntraced(function* (
   }
 });
 
-export function deployFunctions<ResolveError, ResolveRequirements>(
+export const deployFunctions = Effect.fn("functions.deploy")(function* <
+  ResolveError,
+  ResolveRequirements,
+>(
   flags: FunctionsDeployFlags,
   dependencies: DeployFunctionsDependencies<ResolveError, ResolveRequirements>,
 ) {
-  return Effect.gen(function* () {
-    const output = yield* Output;
-    const styleIdentifier = dependencies.styleIdentifier ?? ((text: string) => text);
-    const styleEmphasis = dependencies.styleEmphasis ?? ((text: string) => text);
-    const commandPath = ["functions", "deploy"] as const;
-    // Presence-based (true for `--use-api=false`, not just bare `--use-api`) — used only for
-    // the mutual-exclusivity check below. Behavior branches (bundler routing, --jobs guard) key
-    // off the resolved `flags.useApi` value instead.
-    const explicitUseApi = hasExplicitLongFlag(dependencies.rawArgs, commandPath, "use-api");
-    const explicitUseDocker = hasExplicitLongFlag(dependencies.rawArgs, commandPath, "use-docker");
-    const explicitLegacyBundle = hasExplicitLongFlag(
-      dependencies.rawArgs,
-      commandPath,
-      "legacy-bundle",
-    );
+  const output = yield* Output;
+  const path = yield* Path.Path;
+  const styleIdentifier = dependencies.styleIdentifier ?? ((text: string) => text);
+  const styleEmphasis = dependencies.styleEmphasis ?? ((text: string) => text);
+  const commandPath = ["functions", "deploy"] as const;
+  // Presence-based (true for `--use-api=false`, not just bare `--use-api`) — used only for
+  // the mutual-exclusivity check below. Behavior branches (bundler routing, --jobs guard) key
+  // off the resolved `flags.useApi` value instead.
+  const explicitUseApi = hasExplicitLongFlag(dependencies.rawArgs, commandPath, "use-api");
+  const explicitUseDocker = hasExplicitLongFlag(dependencies.rawArgs, commandPath, "use-docker");
+  const explicitLegacyBundle = hasExplicitLongFlag(
+    dependencies.rawArgs,
+    commandPath,
+    "legacy-bundle",
+  );
 
-    const changedModes = [
-      explicitUseApi ? "use-api" : undefined,
-      explicitUseDocker ? "use-docker" : undefined,
-      explicitLegacyBundle ? "legacy-bundle" : undefined,
-    ].filter((flag): flag is string => flag !== undefined);
+  const changedModes = [
+    explicitUseApi ? "use-api" : undefined,
+    explicitUseDocker ? "use-docker" : undefined,
+    explicitLegacyBundle ? "legacy-bundle" : undefined,
+  ].filter((flag): flag is string => flag !== undefined);
 
-    if (changedModes.length > 1) {
-      return yield* Effect.fail(
-        new ConflictingFunctionDeployFlagsError({
-          message: cobraMutuallyExclusiveErrorMessage(FUNCTIONS_BUNDLER_MUTEX_GROUP, changedModes),
-        }),
-      );
-    }
+  if (changedModes.length > 1) {
+    return yield* new ConflictingFunctionDeployFlagsError({
+      message: cobraMutuallyExclusiveErrorMessage(FUNCTIONS_BUNDLER_MUTEX_GROUP, changedModes),
+    });
+  }
 
-    // `--use-api=false` alone must not force the API path — it should fall through to whatever
-    // `--use-docker`/`--legacy-bundle` already resolved to.
-    const useLocalBundler = !flags.useApi && (flags.useDocker || flags.legacyBundle);
-    const configuredJobs = Option.getOrElse(flags.jobs, () => 1);
-    const jobs = configuredJobs === 0 ? 1 : configuredJobs;
-    // Keyed on the resolved `--use-api` value alone, not on whether local bundling
-    // (Docker/legacy-bundle) is in play.
-    if (!flags.useApi && jobs > 1) {
-      return yield* Effect.fail(new Error("--jobs must be used together with --use-api"));
-    }
-
-    const projectRef = yield* dependencies.resolveProjectRef(flags.projectRef);
-    // `@supabase/config` merges the matching `[remotes.*]` block over the base config, so this
-    // already reflects any remote function/edge_runtime overrides, through the same
-    // `Config.Validate`/dotenv/env-override pipeline `start`/`stop`/`status` use (see
-    // `functions-config.ts`). Must precede the slug-validation loop below, so an invalid
-    // `config.toml` is reported ahead of a malformed slug when both are wrong.
-    const context = yield* loadFunctionsCliConfig({
-      projectRoot: dependencies.projectRoot,
-      projectRef,
-      goConfigCompat: dependencies.goConfigCompat,
+  // `--use-api=false` alone must not force the API path — it should fall through to whatever
+  // `--use-docker`/`--legacy-bundle` already resolved to.
+  const useLocalBundler = !flags.useApi && (flags.useDocker || flags.legacyBundle);
+  const configuredJobs = Option.getOrElse(flags.jobs, () => 1);
+  const jobs = configuredJobs === 0 ? 1 : configuredJobs;
+  // Keyed on the resolved `--use-api` value alone, not on whether local bundling
+  // (Docker/legacy-bundle) is in play.
+  if (!flags.useApi && jobs > 1) {
+    return yield* new FunctionDeployError({
+      message: "--jobs must be used together with --use-api",
     });
+  }
 
-    if (flags.functionNames.length > 0) {
-      for (const slug of flags.functionNames) {
-        yield* validateDeploySlug(slug);
-      }
-    }
+  const projectRef = yield* dependencies.resolveProjectRef(flags.projectRef);
+  // `@supabase/config` merges the matching `[remotes.*]` block over the base config, so this
+  // already reflects any remote function/edge_runtime overrides, through the same
+  // `Config.Validate`/dotenv/env-override pipeline `start`/`stop`/`status` use (see
+  // `functions-config.ts`). Must precede the slug-validation loop below, so an invalid
+  // `config.toml` is reported ahead of a malformed slug when both are wrong.
+  const context = yield* loadFunctionsCliConfig({
+    projectRoot: dependencies.projectRoot,
+    projectRef,
+    goConfigCompat: dependencies.goConfigCompat,
+  });
 
-    const noVerifyJwtOverride = explicitBooleanFlag(
-      dependencies.rawArgs,
-      ["functions", "deploy"],
-      "no-verify-jwt",
-      flags.noVerifyJwt,
-    );
-    // `--debug=false` must resolve to `false` — a plain presence check would get that backwards
-    // (same rule as `download.ts`'s own `--debug` read).
-    const debugEnabled = explicitBooleanLongFlag(dependencies.rawArgs, "debug") ?? false;
-    const deployConfig = context.loaded?.config;
-    const edgeRuntimeVersion = yield* resolveEdgeRuntimeVersion(
-      context.denoVersion,
-      dependencies.edgeRuntimeVersion,
-    );
-    const configFunctions = yield* inferFunctionsManifest({
-      cwd: dependencies.projectRoot,
-      config: deployConfig,
-      // Matches `loadFunctionsCliConfig`'s own options above: no ancestor directory is searched
-      // past `dependencies.projectRoot` for either load, so they can never resolve two
-      // different projects.
-      search: dependencies.goConfigCompat === undefined,
-    });
-    const configDeclaredFunctions = deployConfig?.functions ?? {};
-    const rawConfigFunctions = rawFunctionConfigRecord(context.loaded?.document);
-    yield* validateConfigFunctionSlugs(configDeclaredFunctions);
-    const slugs =
-      flags.functionNames.length > 0
-        ? [...flags.functionNames]
-        : yield* discoverFunctionSlugs(dependencies.projectRoot, configDeclaredFunctions);
-
-    if (slugs.length === 0) {
-      return yield* Effect.fail(
-        new NoFunctionsToDeployError({
-          // Styling is text-mode only: in `--output-format json`/`stream-json` this message
-          // lands in the structured error payload, which must stay free of ANSI escapes.
-          message: `No Functions specified or found in ${
-            output.format === "text"
-              ? styleEmphasis(SUPABASE_FUNCTIONS_DIR)
-              : SUPABASE_FUNCTIONS_DIR
-          }`,
-        }),
-      );
+  if (flags.functionNames.length > 0) {
+    for (const slug of flags.functionNames) {
+      yield* validateDeploySlug(slug);
     }
+  }
 
-    const uniqueSlugs = [...new Set(slugs)];
-    const configs = yield* resolveFunctionConfigs({
-      slugs: uniqueSlugs,
-      cwd: dependencies.flagCwd,
-      projectRoot: dependencies.projectRoot,
-      supabaseDir: dependencies.supabaseDir,
-      configFunctions,
-      configDeclaredFunctions,
-      rawConfigFunctions,
-      importMapOverride: flags.importMap,
-      noVerifyJwtOverride,
+  const noVerifyJwtOverride = explicitBooleanFlag(
+    dependencies.rawArgs,
+    ["functions", "deploy"],
+    "no-verify-jwt",
+    flags.noVerifyJwt,
+  );
+  // `--debug=false` must resolve to `false` — a plain presence check would get that backwards
+  // (same rule as `download.ts`'s own `--debug` read).
+  const debugEnabled = explicitBooleanLongFlag(dependencies.rawArgs, "debug") ?? false;
+  const deployConfig = context.loaded?.config;
+  const edgeRuntimeVersion = yield* resolveEdgeRuntimeVersion(
+    context.denoVersion,
+    dependencies.edgeRuntimeVersion,
+  );
+  const configFunctions = yield* inferFunctionsManifest({
+    cwd: dependencies.projectRoot,
+    config: deployConfig,
+    // Matches `loadFunctionsCliConfig`'s own options above: no ancestor directory is searched
+    // past `dependencies.projectRoot` for either load, so they can never resolve two
+    // different projects.
+    search: dependencies.goConfigCompat === undefined,
+  });
+  const configDeclaredFunctions = deployConfig?.functions ?? {};
+  const rawConfigFunctions = rawFunctionConfigRecord(context.loaded?.document);
+  yield* validateConfigFunctionSlugs(configDeclaredFunctions);
+  const slugs =
+    flags.functionNames.length > 0
+      ? [...flags.functionNames]
+      : yield* discoverFunctionSlugs(dependencies.projectRoot, configDeclaredFunctions);
+
+  if (slugs.length === 0) {
+    return yield* new NoFunctionsToDeployError({
+      // Styling is text-mode only: in `--output-format json`/`stream-json` this message
+      // lands in the structured error payload, which must stay free of ANSI escapes.
+      message: `No Functions specified or found in ${
+        output.format === "text" ? styleEmphasis(SUPABASE_FUNCTIONS_DIR) : SUPABASE_FUNCTIONS_DIR
+      }`,
     });
-    const dashboardUrl = `${dependencies.dashboardUrl}/project/${projectRef}/functions`;
+  }
 
-    const deployWithApi = deployViaApi(
-      projectRef,
-      dependencies.projectRoot,
-      configs,
-      dependencies.api,
-      jobs,
-    ).pipe(
-      Effect.as(true),
-      Effect.catchIf(
-        (error): error is NoFunctionsToDeployError => error instanceof NoFunctionsToDeployError,
-        (error) =>
-          (output.format === "text"
-            ? output.raw(`${error.message}\n`, "stderr")
-            : output.success(error.message, {
-                project_ref: projectRef,
-                functions: uniqueSlugs,
-                dashboard_url: dashboardUrl,
-              })
-          ).pipe(Effect.as(false)),
-      ),
-    );
+  const uniqueSlugs = [...new Set(slugs)];
+  const configs = yield* resolveFunctionConfigs({
+    slugs: uniqueSlugs,
+    cwd: dependencies.flagCwd,
+    projectRoot: dependencies.projectRoot,
+    supabaseDir: dependencies.supabaseDir,
+    configFunctions,
+    configDeclaredFunctions,
+    rawConfigFunctions,
+    importMapOverride: flags.importMap,
+    noVerifyJwtOverride,
+  });
+  const dashboardUrl = `${dependencies.dashboardUrl}/project/${projectRef}/functions`;
 
-    const styleWarning = dependencies.styleWarning ?? ((text: string) => text);
-    const deployed = useLocalBundler
-      ? yield* Effect.gen(function* () {
-          if (!(yield* isDockerRunning())) {
-            yield* output.raw(`${styleWarning("WARNING:")} Docker is not running\n`, "stderr");
-            return yield* deployWithApi;
-          }
+  const deployWithApi = deployViaApi(
+    projectRef,
+    dependencies.projectRoot,
+    configs,
+    dependencies.api,
+    jobs,
+  ).pipe(
+    Effect.as(true),
+    Effect.catchIf(
+      (error): error is NoFunctionsToDeployError => error instanceof NoFunctionsToDeployError,
+      (error) =>
+        (output.format === "text"
+          ? output.raw(`${error.message}\n`, "stderr")
+          : output.success(error.message, {
+              project_ref: projectRef,
+              functions: uniqueSlugs,
+              dashboard_url: dashboardUrl,
+            })
+        ).pipe(Effect.as(false)),
+    ),
+  );
 
-          // `lastExplicitLongFlagValue` preserves the "explicitly cleared" vs "never touched"
-          // distinction `resolveDockerNetworkMode` needs — see that function's own doc comment.
-          // `SUPABASE_NETWORK_ID` (env or project dotenv) is CLI-only, `undefined` for library
-          // callers.
-          const networkMode = resolveDockerNetworkMode({
-            explicit: lastExplicitLongFlagValue(dependencies.rawArgs, [], "network-id"),
-            envOverride:
-              context.projectEnvValues === undefined
-                ? undefined
-                : viperEnvStringWithProjectFallback(
-                    "SUPABASE_NETWORK_ID",
-                    context.projectEnvValues,
-                  ),
-            projectId: context.projectId,
-          });
-          yield* deployViaDocker({
-            projectId: context.projectId,
-            projectRef,
-            edgeRuntimeVersion,
-            functionsDir: join(dependencies.projectRoot, SUPABASE_FUNCTIONS_DIR),
-            configs,
-            api: dependencies.api,
-            networkMode,
-            verbose: debugEnabled,
-            styleEmphasis,
-            projectEnvValues: context.projectEnvValues,
-          });
-          return true;
-        })
-      : yield* deployWithApi;
+  const styleWarning = dependencies.styleWarning ?? ((text: string) => text);
+  const deployed = useLocalBundler
+    ? yield* Effect.gen(function* () {
+        if (!(yield* isDockerRunning())) {
+          yield* output.raw(`${styleWarning("WARNING:")} Docker is not running\n`, "stderr");
+          return yield* deployWithApi;
+        }
 
-    if (!deployed) {
-      return;
-    }
+        // `lastExplicitLongFlagValue` preserves the "explicitly cleared" vs "never touched"
+        // distinction `resolveDockerNetworkMode` needs — see that function's own doc comment.
+        // `SUPABASE_NETWORK_ID` (env or project dotenv) is CLI-only, `undefined` for library
+        // callers.
+        const networkMode = resolveDockerNetworkMode({
+          explicit: lastExplicitLongFlagValue(dependencies.rawArgs, [], "network-id"),
+          envOverride:
+            context.projectEnvValues === undefined
+              ? undefined
+              : viperEnvStringWithProjectFallback("SUPABASE_NETWORK_ID", context.projectEnvValues),
+          projectId: context.projectId,
+        });
+        yield* deployViaDocker({
+          projectId: context.projectId,
+          projectRef,
+          edgeRuntimeVersion,
+          functionsDir: path.join(dependencies.projectRoot, SUPABASE_FUNCTIONS_DIR),
+          configs,
+          api: dependencies.api,
+          networkMode,
+          verbose: debugEnabled,
+          styleEmphasis,
+          projectEnvValues: context.projectEnvValues,
+        });
+        return true;
+      })
+    : yield* deployWithApi;
 
-    if (output.format === "text") {
-      // Joins the raw `slugs` list, not the deduped set, so `functions deploy foo foo` prints
-      // "foo, foo".
-      yield* output.raw(
-        `Deployed Functions on project ${styleIdentifier(projectRef)}: ${slugs.join(", ")}\n`,
-      );
-      yield* output.raw(`You can inspect your deployment in the Dashboard: ${dashboardUrl}\n`);
-    } else {
-      yield* output.success("Deployed Functions.", {
-        project_ref: projectRef,
-        functions: uniqueSlugs,
-        dashboard_url: dashboardUrl,
-      });
-    }
+  if (!deployed) {
+    return;
+  }
 
-    if (flags.prune) {
-      yield* pruneFunctions(projectRef, configs, dependencies.api, dependencies.yes ?? false);
-    }
-  }).pipe(Effect.withSpan("functions.deploy"));
-}
+  if (output.format === "text") {
+    // Joins the raw `slugs` list, not the deduped set, so `functions deploy foo foo` prints
+    // "foo, foo".
+    yield* output.raw(
+      `Deployed Functions on project ${styleIdentifier(projectRef)}: ${slugs.join(", ")}\n`,
+    );
+    yield* output.raw(`You can inspect your deployment in the Dashboard: ${dashboardUrl}\n`);
+  } else {
+    yield* output.success("Deployed Functions.", {
+      project_ref: projectRef,
+      functions: uniqueSlugs,
+      dashboard_url: dashboardUrl,
+    });
+  }
+
+  if (flags.prune) {
+    yield* pruneFunctions(projectRef, configs, dependencies.api, dependencies.yes ?? false);
+  }
+});
diff --git a/apps/cli/src/shared/functions/deploy.unit.test.ts b/apps/cli/src/shared/functions/deploy.unit.test.ts
index eff5003774..2579e2e087 100644
--- a/apps/cli/src/shared/functions/deploy.unit.test.ts
+++ b/apps/cli/src/shared/functions/deploy.unit.test.ts
@@ -1,21 +1,17 @@
-import { mkdir, mkdtemp, realpath, rename, rm, symlink, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join, resolve } from "node:path";
-
 import { BunServices } from "@effect/platform-bun";
-import { Effect } from "effect";
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, layer } from "@effect/vitest";
+import { Cause, Deferred, Effect, Exit, Fiber, FileSystem, Path, Predicate, Schema } from "effect";
 
 import {
   buildDockerBinds,
+  discoverFunctionSlugs,
   formatDockerBind,
   pruneRedundantDockerBinds,
   type ResolvedDeployFunctionConfig,
 } from "./deploy.ts";
 import { FunctionImportNotDirectoryError } from "./deploy.errors.ts";
 
-const runBuildDockerBinds = (...args: Parameters<typeof buildDockerBinds>) =>
-  Effect.runPromise(buildDockerBinds(...args).pipe(Effect.provide(BunServices.layer)));
+const encodeJson = Schema.encodeEffect(Schema.fromJsonString(Schema.Unknown));
 
 /**
  * `../../` from `<root>/supabase/functions/hello/deno.json`'s directory lands at
@@ -28,32 +24,36 @@ const VENDOR_TARGET_RELATIVE = "../../_vendor/package/dist/index.mjs";
 /** Import-maps spec: a value for a "/"-suffixed key should itself end in "/". */
 const VENDOR_TARGET_RELATIVE_SLASH = "../../_vendor/package/dist/index.mjs/";
 
-async function createFunctionProjectWithDenoJson(
+const createFunctionProjectWithDenoJson = Effect.fnUntraced(function* (
   denoJson: Readonly<Record<string, unknown>>,
   indexTsContents: string,
   options: { readonly nestedProject?: boolean } = {},
 ) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
   // realpath the temp dir up front: on macOS `TMPDIR` resolves through a `/var` ->
   // `/private/var` symlink, and `buildDockerBinds` compares realpath'd module roots against a
   // non-realpath'd fallback path — an unresolved prefix would make every path look "outside the
   // source root" and mask the real assertions here.
-  const root = await realpath(await mkdtemp(join(tmpdir(), "deploy-import-scanner-")));
-  const projectRoot = options.nestedProject ? join(root, "infra", "my-project") : root;
-  const functionsDir = join(projectRoot, "supabase", "functions");
-  const functionDir = join(functionsDir, "hello");
-  const outputDir = join(projectRoot, "out");
-
-  await mkdir(functionDir, { recursive: true });
-  await mkdir(outputDir, { recursive: true });
+  const root = yield* fs.realPath(
+    yield* fs.makeTempDirectoryScoped({ prefix: "deploy-import-scanner-" }),
+  );
+  const projectRoot = options.nestedProject ? path.join(root, "infra", "my-project") : root;
+  const functionsDir = path.join(projectRoot, "supabase", "functions");
+  const functionDir = path.join(functionsDir, "hello");
+  const outputDir = path.join(projectRoot, "out");
+
+  yield* fs.makeDirectory(functionDir, { recursive: true });
+  yield* fs.makeDirectory(outputDir, { recursive: true });
   if (options.nestedProject) {
-    await mkdir(join(root, ".git"), { recursive: true });
-    await writeFile(join(projectRoot, ".git"), "gitdir: ignored\n");
+    yield* fs.makeDirectory(path.join(root, ".git"), { recursive: true });
+    yield* fs.writeFileString(path.join(projectRoot, ".git"), "gitdir: ignored\n");
   }
 
-  const entrypoint = join(functionDir, "index.ts");
-  const importMap = join(functionDir, "deno.json");
-  await writeFile(entrypoint, indexTsContents);
-  await writeFile(importMap, JSON.stringify(denoJson));
+  const entrypoint = path.join(functionDir, "index.ts");
+  const importMap = path.join(functionDir, "deno.json");
+  yield* fs.writeFileString(entrypoint, indexTsContents);
+  yield* fs.writeFileString(importMap, yield* encodeJson(denoJson));
 
   const config: ResolvedDeployFunctionConfig = {
     slug: "hello",
@@ -65,568 +65,705 @@ async function createFunctionProjectWithDenoJson(
   };
 
   return { root, functionsDir, functionDir, outputDir, config };
-}
+});
 
-async function createHelloFunctionProject(
+const createHelloFunctionProject = (
   denoJsonImports: Record<string, string>,
   indexTsContents: string,
-) {
-  return createFunctionProjectWithDenoJson({ imports: denoJsonImports }, indexTsContents);
-}
-
-async function writeVendorIndexFile(root: string) {
-  const vendorDir = join(root, "supabase", "_vendor", "package", "dist");
-  await mkdir(vendorDir, { recursive: true });
-  const vendorIndexPath = join(vendorDir, "index.mjs");
-  await writeFile(vendorIndexPath, "export const core = 1;\n");
+) => createFunctionProjectWithDenoJson({ imports: denoJsonImports }, indexTsContents);
+
+const writeVendorIndexFile = Effect.fnUntraced(function* (root: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const vendorDir = path.join(root, "supabase", "_vendor", "package", "dist");
+  yield* fs.makeDirectory(vendorDir, { recursive: true });
+  const vendorIndexPath = path.join(vendorDir, "index.mjs");
+  yield* fs.writeFileString(vendorIndexPath, "export const core = 1;\n");
   return vendorIndexPath;
-}
+});
 
-async function createVendoredFunctionProject(indexTsContents: string) {
-  const project = await createHelloFunctionProject(
+const createVendoredFunctionProject = Effect.fnUntraced(function* (indexTsContents: string) {
+  const project = yield* createHelloFunctionProject(
     { "@supabase/server": VENDOR_TARGET_RELATIVE },
     indexTsContents,
   );
-  const vendorIndexPath = await writeVendorIndexFile(project.root);
+  const vendorIndexPath = yield* writeVendorIndexFile(project.root);
   return { ...project, vendorIndexPath };
-}
+});
 
-async function createSlashVendoredFunctionProject(indexTsContents: string) {
-  const project = await createHelloFunctionProject(
+const createSlashVendoredFunctionProject = Effect.fnUntraced(function* (indexTsContents: string) {
+  const project = yield* createHelloFunctionProject(
     { "@supabase/server/": VENDOR_TARGET_RELATIVE_SLASH },
     indexTsContents,
   );
-  const vendorIndexPath = await writeVendorIndexFile(project.root);
+  const vendorIndexPath = yield* writeVendorIndexFile(project.root);
   return { ...project, vendorIndexPath };
-}
-
-describe("buildDockerBinds — import-map key matching (spec-strict) and the file-mapped-key guard", () => {
-  it("drops a specifier reachable only through a JSDoc comment, now via a no-match on the unqualified bare key (not the extension guard)", async () => {
-    // A bare key ("@supabase/server", no trailing slash) matches only exactly, so
-    // "@supabase/server/core" is dropped as an unresolvable bare specifier before the
-    // final-segment guard ever runs — see "final-segment guard" below for the guard itself.
-    const { root, functionsDir, outputDir, config, vendorIndexPath } =
-      await createVendoredFunctionProject(
-        [
-          "/**",
-          " * @example",
-          ' * import { core } from "@supabase/server/core";',
-          " */",
-          'Deno.serve(() => new Response("ok"));',
-          "",
-        ].join("\n"),
-      );
-    const warnings: Array<string> = [];
-
-    try {
-      const binds = await runBuildDockerBinds("test-project", functionsDir, outputDir, config, {
-        onWarning: async (message) => {
-          warnings.push(message);
-        },
-      });
-
-      expect(binds.some((bind) => bind.hostPath === vendorIndexPath)).toBe(true);
-      expect(binds.some((bind) => formatDockerBind(bind).includes("index.mjs/core"))).toBe(false);
-      expect(warnings).toEqual([]);
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
+});
+
+layer(BunServices.layer)(
+  "buildDockerBinds — import-map key matching (spec-strict) and the file-mapped-key guard",
+  (it) => {
+    it.effect(
+      "drops a specifier reachable only through a JSDoc comment, now via a no-match on the unqualified bare key (not the extension guard)",
+      () =>
+        Effect.gen(function* () {
+          // A bare key ("@supabase/server", no trailing slash) matches only exactly, so
+          // "@supabase/server/core" is dropped as an unresolvable bare specifier before the
+          // final-segment guard ever runs — see "final-segment guard" below for the guard itself.
+          const { functionsDir, outputDir, config, vendorIndexPath } =
+            yield* createVendoredFunctionProject(
+              [
+                "/**",
+                " * @example",
+                ' * import { core } from "@supabase/server/core";',
+                " */",
+                'Deno.serve(() => new Response("ok"));',
+                "",
+              ].join("\n"),
+            );
+          const warnings: Array<string> = [];
+
+          const binds = yield* buildDockerBinds("test-project", functionsDir, outputDir, config, {
+            onWarning: (message) =>
+              Effect.sync(() => {
+                warnings.push(message);
+              }),
+          });
+
+          expect(binds.some((bind) => bind.hostPath === vendorIndexPath)).toBe(true);
+          expect(binds.some((bind) => formatDockerBind(bind).includes("index.mjs/core"))).toBe(
+            false,
+          );
+          expect(warnings).toEqual([]);
+        }),
+    );
 
-  it("rejects with a FunctionImportNotDirectoryError carrying a clean 'not a directory' message (not a raw ENOTDIR) for a real import reaching a dotted final segment through a `/`-suffixed file-mapped key", async () => {
-    const { root, functionsDir, outputDir, config } = await createSlashVendoredFunctionProject(
-      [
-        'import { extra } from "@supabase/server/extra.ts";',
-        'Deno.serve(() => new Response("ok"));',
-        "",
-      ].join("\n"),
+    it.effect(
+      "rejects with a FunctionImportNotDirectoryError carrying a clean 'not a directory' message (not a raw ENOTDIR) for a real import reaching a dotted final segment through a `/`-suffixed file-mapped key",
+      () =>
+        Effect.gen(function* () {
+          const { functionsDir, outputDir, config } = yield* createSlashVendoredFunctionProject(
+            [
+              'import { extra } from "@supabase/server/extra.ts";',
+              'Deno.serve(() => new Response("ok"));',
+              "",
+            ].join("\n"),
+          );
+
+          const exit = yield* Effect.exit(
+            buildDockerBinds("test-project", functionsDir, outputDir, config, {
+              onWarning: () => Effect.void,
+            }),
+          );
+          const caught = Exit.isFailure(exit) ? Cause.squash(exit.cause) : undefined;
+
+          expect(Exit.isFailure(exit) && Cause.hasDies(exit.cause)).toBe(true);
+          expect(Exit.isFailure(exit) && Cause.hasFails(exit.cause)).toBe(false);
+          expect(caught).toBeInstanceOf(FunctionImportNotDirectoryError);
+          expect(Predicate.isTagged(caught, "FunctionImportNotDirectoryError")).toBe(true);
+          expect(caught).toMatchObject({
+            message:
+              "failed to read file: open supabase/_vendor/package/dist/index.mjs/extra.ts: not a directory",
+          });
+        }),
     );
 
-    try {
-      let caught: unknown;
-      try {
-        await runBuildDockerBinds("test-project", functionsDir, outputDir, config, {
-          onWarning: async () => {},
+    it.effect(
+      "no longer prefix-matches a bare (non-`/`-suffixed) key: a longer specifier stays bare and is skipped without a warning",
+      () =>
+        Effect.gen(function* () {
+          const { functionsDir, outputDir, config } = yield* createVendoredFunctionProject(
+            [
+              'import { extra } from "@supabase/server/extra.ts";',
+              'Deno.serve(() => new Response("ok"));',
+              "",
+            ].join("\n"),
+          );
+          const warnings: Array<string> = [];
+
+          const binds = yield* buildDockerBinds("test-project", functionsDir, outputDir, config, {
+            onWarning: (message) =>
+              Effect.sync(() => {
+                warnings.push(message);
+              }),
+          });
+
+          expect(binds.some((bind) => formatDockerBind(bind).includes("extra.ts"))).toBe(false);
+          expect(warnings).toEqual([]);
+        }),
+    );
+
+    it.effect("still substitutes on an exact match against a bare key", () =>
+      Effect.gen(function* () {
+        const { functionsDir, outputDir, config, vendorIndexPath } =
+          yield* createVendoredFunctionProject(
+            [
+              'import { server } from "@supabase/server";',
+              'Deno.serve(() => new Response("ok"));',
+              "",
+            ].join("\n"),
+          );
+        const warnings: Array<string> = [];
+
+        const binds = yield* buildDockerBinds("test-project", functionsDir, outputDir, config, {
+          onWarning: (message) =>
+            Effect.sync(() => {
+              warnings.push(message);
+            }),
         });
-      } catch (error) {
-        caught = error;
-      }
-
-      expect(caught).toBeInstanceOf(FunctionImportNotDirectoryError);
-      expect((caught as FunctionImportNotDirectoryError)._tag).toBe(
-        "FunctionImportNotDirectoryError",
-      );
-      expect((caught as FunctionImportNotDirectoryError).message).toBe(
-        "failed to read file: open supabase/_vendor/package/dist/index.mjs/extra.ts: not a directory",
-      );
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
 
-  it("no longer prefix-matches a bare (non-`/`-suffixed) key: a longer specifier stays bare and is skipped without a warning", async () => {
-    const { root, functionsDir, outputDir, config } = await createVendoredFunctionProject(
-      [
-        'import { extra } from "@supabase/server/extra.ts";',
-        'Deno.serve(() => new Response("ok"));',
-        "",
-      ].join("\n"),
+        expect(binds.some((bind) => bind.hostPath === vendorIndexPath)).toBe(true);
+        expect(warnings).toEqual([]);
+      }),
     );
-    const warnings: Array<string> = [];
-
-    try {
-      const binds = await runBuildDockerBinds("test-project", functionsDir, outputDir, config, {
-        onWarning: async (message) => {
-          warnings.push(message);
-        },
-      });
-
-      expect(binds.some((bind) => formatDockerBind(bind).includes("extra.ts"))).toBe(false);
-      expect(warnings).toEqual([]);
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
 
-  it("still substitutes on an exact match against a bare key", async () => {
-    const { root, functionsDir, outputDir, config, vendorIndexPath } =
-      await createVendoredFunctionProject(
-        [
-          'import { server } from "@supabase/server";',
-          'Deno.serve(() => new Response("ok"));',
-          "",
-        ].join("\n"),
-      );
-    const warnings: Array<string> = [];
-
-    try {
-      const binds = await runBuildDockerBinds("test-project", functionsDir, outputDir, config, {
-        onWarning: async (message) => {
-          warnings.push(message);
-        },
-      });
-
-      expect(binds.some((bind) => bind.hostPath === vendorIndexPath)).toBe(true);
-      expect(warnings).toEqual([]);
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
+    it.effect(
+      "warns ENOENT-style for a genuinely missing relative import, unaffected by the file-mapped-key guard",
+      () =>
+        Effect.gen(function* () {
+          const { functionsDir, outputDir, config } = yield* createVendoredFunctionProject(
+            [
+              'import { missing } from "./missing.ts";',
+              'Deno.serve(() => new Response("ok"));',
+              "",
+            ].join("\n"),
+          );
+          const warnings: Array<string> = [];
+
+          yield* buildDockerBinds("test-project", functionsDir, outputDir, config, {
+            onWarning: (message) =>
+              Effect.sync(() => {
+                warnings.push(message);
+              }),
+          });
+
+          const matches = warnings.filter(
+            (warning) =>
+              warning.includes("failed to read file: open ") &&
+              warning.includes(": no such file or directory"),
+          );
+          expect(matches).toHaveLength(1);
+          expect(matches[0]).toContain("missing.ts");
+        }),
+    );
 
-  it("warns ENOENT-style for a genuinely missing relative import, unaffected by the file-mapped-key guard", async () => {
-    const { root, functionsDir, outputDir, config } = await createVendoredFunctionProject(
-      ['import { missing } from "./missing.ts";', 'Deno.serve(() => new Response("ok"));', ""].join(
-        "\n",
-      ),
+    it.effect(
+      "the final-segment guard still covers the original crash shape under a spec-valid `/`-suffixed map: a JSDoc-only mention is dropped silently",
+      () =>
+        Effect.gen(function* () {
+          const { functionsDir, outputDir, config } = yield* createSlashVendoredFunctionProject(
+            [
+              "/**",
+              " * @example",
+              ' * import { core } from "@supabase/server/core";',
+              " */",
+              'Deno.serve(() => new Response("ok"));',
+              "",
+            ].join("\n"),
+          );
+          const warnings: Array<string> = [];
+
+          const binds = yield* buildDockerBinds("test-project", functionsDir, outputDir, config, {
+            onWarning: (message) =>
+              Effect.sync(() => {
+                warnings.push(message);
+              }),
+          });
+
+          expect(binds.some((bind) => formatDockerBind(bind).includes("index.mjs/core"))).toBe(
+            false,
+          );
+          expect(warnings.some((warning) => warning.includes("index.mjs/core"))).toBe(false);
+        }),
     );
-    const warnings: Array<string> = [];
-
-    try {
-      await runBuildDockerBinds("test-project", functionsDir, outputDir, config, {
-        onWarning: async (message) => {
-          warnings.push(message);
-        },
-      });
-
-      const matches = warnings.filter(
-        (warning) =>
-          warning.includes("failed to read file: open ") &&
-          warning.includes(": no such file or directory"),
-      );
-      expect(matches).toHaveLength(1);
-      expect(matches[0]).toContain("missing.ts");
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
 
-  it("the final-segment guard still covers the original crash shape under a spec-valid `/`-suffixed map: a JSDoc-only mention is dropped silently", async () => {
-    const { root, functionsDir, outputDir, config } = await createSlashVendoredFunctionProject(
-      [
-        "/**",
-        " * @example",
-        ' * import { core } from "@supabase/server/core";',
-        " */",
-        'Deno.serve(() => new Response("ok"));',
-        "",
-      ].join("\n"),
+    it.effect(
+      "does not crash when an unreferenced `/`-suffixed import-map target resolves through a file, with no options passed",
+      () =>
+        Effect.gen(function* () {
+          // `forEachLocalImportMapTarget` enumerates every import-map value unconditionally, and
+          // Bun's `realpath` (unlike Node's) throws ENOTDIR on a trailing-slash path through a file —
+          // this reproduces that with no options passed, matching how the real bundling call site
+          // invokes it.
+          const { root, functionsDir, outputDir, config } = yield* createHelloFunctionProject(
+            { "@x/": VENDOR_TARGET_RELATIVE_SLASH },
+            'Deno.serve(() => new Response("ok"));\n',
+          );
+          yield* writeVendorIndexFile(root);
+
+          yield* buildDockerBinds("test-project", functionsDir, outputDir, config);
+        }),
     );
-    const warnings: Array<string> = [];
-
-    try {
-      const binds = await runBuildDockerBinds("test-project", functionsDir, outputDir, config, {
-        onWarning: async (message) => {
-          warnings.push(message);
-        },
-      });
-
-      expect(binds.some((bind) => formatDockerBind(bind).includes("index.mjs/core"))).toBe(false);
-      expect(warnings.some((warning) => warning.includes("index.mjs/core"))).toBe(false);
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
 
-  it("does not crash when an unreferenced `/`-suffixed import-map target resolves through a file, with no options passed", async () => {
-    // `forEachLocalImportMapTarget` enumerates every import-map value unconditionally, and
-    // Bun's `realpath` (unlike Node's) throws ENOTDIR on a trailing-slash path through a file —
-    // this reproduces that with no options passed, matching how the real bundling call site
-    // invokes it.
-    const { root, functionsDir, outputDir, config } = await createHelloFunctionProject(
-      { "@x/": VENDOR_TARGET_RELATIVE_SLASH },
-      'Deno.serve(() => new Response("ok"));\n',
+    it.effect(
+      "skips an unreferenced import-map target that resolves through a file, regardless of skipMissingImportMapTargets",
+      () =>
+        Effect.gen(function* () {
+          // ENOTDIR (a target routed through a file) is always skippable, with its own wording
+          // distinct from the ENOENT "missing" case below — see "skips a genuinely missing import-map
+          // target" for that option's actual gate.
+          const { root, functionsDir, outputDir, config } = yield* createHelloFunctionProject(
+            { "@x": `${VENDOR_TARGET_RELATIVE}/sub.ts` },
+            'Deno.serve(() => new Response("ok"));\n',
+          );
+          yield* writeVendorIndexFile(root);
+          const warnings: Array<string> = [];
+
+          const binds = yield* buildDockerBinds("test-project", functionsDir, outputDir, config, {
+            onWarning: (message) =>
+              Effect.sync(() => {
+                warnings.push(message);
+              }),
+          });
+
+          expect(binds.some((bind) => formatDockerBind(bind).includes("index.mjs"))).toBe(false);
+          expect(
+            warnings.some((warning) =>
+              warning.includes("Skipping import map target that is not a directory"),
+            ),
+          ).toBe(true);
+        }),
     );
-    await writeVendorIndexFile(root);
 
-    try {
-      await runBuildDockerBinds("test-project", functionsDir, outputDir, config);
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
+    it.effect(
+      "skips a genuinely missing import-map target only when skipMissingImportMapTargets is set",
+      () =>
+        Effect.gen(function* () {
+          const { functionsDir, outputDir, config } = yield* createHelloFunctionProject(
+            { "@missing": "../../does-not-exist.ts" },
+            'Deno.serve(() => new Response("ok"));\n',
+          );
+
+          const withoutOption = yield* Effect.exit(
+            buildDockerBinds("test-project", functionsDir, outputDir, config),
+          );
+          expect(Exit.isFailure(withoutOption)).toBe(true);
+          expect(Exit.isFailure(withoutOption) && Cause.hasDies(withoutOption.cause)).toBe(true);
+          expect(
+            Exit.isFailure(withoutOption) ? Cause.squash(withoutOption.cause) : undefined,
+          ).toMatchObject({ code: "ENOENT" });
+
+          const warnings: Array<string> = [];
+          const binds = yield* buildDockerBinds("test-project", functionsDir, outputDir, config, {
+            onWarning: (message) =>
+              Effect.sync(() => {
+                warnings.push(message);
+              }),
+            skipMissingImportMapTargets: true,
+          });
+
+          expect(binds.some((bind) => formatDockerBind(bind).includes("does-not-exist"))).toBe(
+            false,
+          );
+          expect(
+            warnings.some((warning) => warning.includes("Skipping missing import map target")),
+          ).toBe(true);
+        }),
+    );
 
-  it("skips an unreferenced import-map target that resolves through a file, regardless of skipMissingImportMapTargets", async () => {
-    // ENOTDIR (a target routed through a file) is always skippable, with its own wording
-    // distinct from the ENOENT "missing" case below — see "skips a genuinely missing import-map
-    // target" for that option's actual gate.
-    const { root, functionsDir, outputDir, config } = await createHelloFunctionProject(
-      { "@x": `${VENDOR_TARGET_RELATIVE}/sub.ts` },
-      'Deno.serve(() => new Response("ok"));\n',
+    it.effect("skips a missing scope target when missing import targets are skipped", () =>
+      Effect.gen(function* () {
+        const { functionsDir, outputDir, config } = yield* createFunctionProjectWithDenoJson(
+          {
+            scopes: {
+              __local: { __missing: "../../does-not-exist" },
+            },
+          },
+          'Deno.serve(() => new Response("ok"));\n',
+        );
+        const warnings: Array<string> = [];
+
+        const binds = yield* buildDockerBinds("test-project", functionsDir, outputDir, config, {
+          onWarning: (message) =>
+            Effect.sync(() => {
+              warnings.push(message);
+            }),
+          skipMissingImportMapTargets: true,
+        });
+
+        expect(binds.some((bind) => formatDockerBind(bind).includes("does-not-exist"))).toBe(false);
+        expect(
+          warnings.some((warning) => warning.includes("Skipping missing import map target")),
+        ).toBe(true);
+      }),
     );
-    await writeVendorIndexFile(root);
-    const warnings: Array<string> = [];
-
-    try {
-      const binds = await runBuildDockerBinds("test-project", functionsDir, outputDir, config, {
-        onWarning: async (message) => {
-          warnings.push(message);
-        },
-      });
-
-      expect(binds.some((bind) => formatDockerBind(bind).includes("index.mjs"))).toBe(false);
-      expect(
-        warnings.some((warning) =>
-          warning.includes("Skipping import map target that is not a directory"),
-        ),
-      ).toBe(true);
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
 
-  it("skips a genuinely missing import-map target only when skipMissingImportMapTargets is set", async () => {
-    const { root, functionsDir, outputDir, config } = await createHelloFunctionProject(
-      { "@missing": "../../does-not-exist.ts" },
-      'Deno.serve(() => new Response("ok"));\n',
+    it.effect("keeps scanning imports from file-valued scope targets", () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const { root, functionsDir, outputDir, config } = yield* createFunctionProjectWithDenoJson(
+          {
+            scopes: {
+              __local: { __scope: "../../_scope/entry.ts" },
+            },
+          },
+          'Deno.serve(() => new Response("ok"));\n',
+        );
+        const scopeDir = path.join(root, "supabase", "_scope");
+        const scopeEntrypoint = path.join(scopeDir, "entry.ts");
+        const scopeDependency = path.join(scopeDir, "dependency.ts");
+        yield* fs.makeDirectory(scopeDir, { recursive: true });
+        yield* fs.writeFileString(
+          scopeEntrypoint,
+          'export { dependency } from "./dependency.ts";\n',
+        );
+        yield* fs.writeFileString(scopeDependency, 'export const dependency = "scope";\n');
+
+        const binds = yield* buildDockerBinds("test-project", functionsDir, outputDir, config);
+        const hostPaths = binds.map((bind) => bind.hostPath);
+
+        expect(hostPaths).toContain(scopeEntrypoint);
+        expect(hostPaths).toContain(scopeDependency);
+      }),
     );
 
-    try {
-      let threwWithoutOption = false;
-      try {
-        await runBuildDockerBinds("test-project", functionsDir, outputDir, config);
-      } catch {
-        threwWithoutOption = true;
-      }
-      expect(threwWithoutOption).toBe(true);
-
-      const warnings: Array<string> = [];
-      const binds = await runBuildDockerBinds("test-project", functionsDir, outputDir, config, {
-        onWarning: async (message) => {
-          warnings.push(message);
-        },
-        skipMissingImportMapTargets: true,
-      });
-
-      expect(binds.some((bind) => formatDockerBind(bind).includes("does-not-exist"))).toBe(false);
-      expect(
-        warnings.some((warning) => warning.includes("Skipping missing import map target")),
-      ).toBe(true);
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
+    it.effect(
+      "mounts an out-of-root file-valued scope target itself, warns, and does not follow its imports",
+      () =>
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const path = yield* Path.Path;
+          const { root, functionsDir, outputDir, config } =
+            yield* createFunctionProjectWithDenoJson(
+              {
+                scopes: { __local: { __mod: "../../../../../libs/thing/mod.ts" } },
+              },
+              'Deno.serve(() => new Response("ok"));\n',
+              { nestedProject: true },
+            );
+          const libsDir = path.join(root, "libs", "thing");
+          const scopeEntrypoint = path.join(libsDir, "mod.ts");
+          const scopeDependency = path.join(libsDir, "util.ts");
+          const warnings: Array<string> = [];
+
+          yield* fs.makeDirectory(libsDir, { recursive: true });
+          yield* fs.writeFileString(scopeEntrypoint, 'export { util } from "./util.ts";\n');
+          yield* fs.writeFileString(scopeDependency, 'export const util = "thing";\n');
+
+          const binds = yield* buildDockerBinds("test-project", functionsDir, outputDir, config, {
+            onWarning: (message) =>
+              Effect.sync(() => {
+                warnings.push(message);
+              }),
+          });
+          const hostPaths = binds.map((bind) => bind.hostPath);
+
+          expect(hostPaths).toContain(scopeEntrypoint);
+          expect(hostPaths).not.toContain(scopeDependency);
+          expect(binds.filter((bind) => bind.externalScope).map((bind) => bind.hostPath)).toEqual([
+            scopeEntrypoint,
+          ]);
+          expect(warnings).toContainEqual(
+            `WARN: Mounting import map scope target outside the project root: ${scopeEntrypoint}\n`,
+          );
+        }),
+    );
 
-  it("skips a missing scope target when missing import targets are skipped", async () => {
-    const { root, functionsDir, outputDir, config } = await createFunctionProjectWithDenoJson(
-      {
-        scopes: {
-          __local: { __missing: "../../does-not-exist" },
-        },
-      },
-      'Deno.serve(() => new Response("ok"));\n',
+    it.effect.skipIf(process.platform === "win32")(
+      "does not duplicate the functions mount when its directory is symlinked",
+      () =>
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const path = yield* Path.Path;
+          const { functionsDir, outputDir, config } = yield* createFunctionProjectWithDenoJson(
+            {
+              scopes: {
+                __local: { __functions: ".." },
+              },
+            },
+            'Deno.serve(() => new Response("ok"));\n',
+          );
+          const externalRoot = yield* fs.realPath(
+            yield* fs.makeTempDirectoryScoped({ prefix: "deploy-external-functions-" }),
+          );
+          const externalFunctionsDir = path.join(externalRoot, "functions");
+          yield* fs.rename(functionsDir, externalFunctionsDir);
+          yield* fs.symlink(externalFunctionsDir, functionsDir);
+
+          const warnings: Array<string> = [];
+
+          const binds = yield* buildDockerBinds("test-project", functionsDir, outputDir, config, {
+            onWarning: (message) =>
+              Effect.sync(() => {
+                warnings.push(message);
+              }),
+          });
+          const functionsBinds = binds.filter(
+            (bind) => bind.containerPath === path.resolve(functionsDir),
+          );
+
+          expect(functionsBinds).toHaveLength(1);
+          expect(functionsBinds[0]?.hostPath).toBe(path.resolve(functionsDir));
+          expect(binds.filter((bind) => bind.externalScope)).toHaveLength(0);
+          expect(
+            warnings.filter((warning) => warning.includes("Mounting import map scope target")),
+          ).toHaveLength(0);
+        }),
     );
-    const warnings: Array<string> = [];
-
-    try {
-      const binds = await runBuildDockerBinds("test-project", functionsDir, outputDir, config, {
-        onWarning: async (message) => {
-          warnings.push(message);
-        },
-        skipMissingImportMapTargets: true,
-      });
-
-      expect(binds.some((bind) => formatDockerBind(bind).includes("does-not-exist"))).toBe(false);
-      expect(
-        warnings.some((warning) => warning.includes("Skipping missing import map target")),
-      ).toBe(true);
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
 
-  it("keeps scanning imports from file-valued scope targets", async () => {
-    const { root, functionsDir, outputDir, config } = await createFunctionProjectWithDenoJson(
-      {
-        scopes: {
-          __local: { __scope: "../../_scope/entry.ts" },
-        },
-      },
-      'Deno.serve(() => new Response("ok"));\n',
+    it.effect(
+      "drops a `/`-suffixed key whose value lacks a trailing slash (spec-invalid mapping), instead of fabricating a concatenated path",
+      () =>
+        Effect.gen(function* () {
+          const { root, functionsDir, outputDir, config } = yield* createHelloFunctionProject(
+            { "pkg/": VENDOR_TARGET_RELATIVE },
+            [
+              'import { core } from "pkg/core.ts";',
+              'import { core2 } from "pkg//core.ts";',
+              'Deno.serve(() => new Response("ok"));',
+              "",
+            ].join("\n"),
+          );
+          yield* writeVendorIndexFile(root);
+          const warnings: Array<string> = [];
+
+          yield* buildDockerBinds("test-project", functionsDir, outputDir, config, {
+            onWarning: (message) =>
+              Effect.sync(() => {
+                warnings.push(message);
+              }),
+          });
+
+          expect(warnings).toEqual([]);
+        }),
     );
-    const scopeDir = join(root, "supabase", "_scope");
-    const scopeEntrypoint = join(scopeDir, "entry.ts");
-    const scopeDependency = join(scopeDir, "dependency.ts");
-    await mkdir(scopeDir, { recursive: true });
-    await writeFile(scopeEntrypoint, 'export { dependency } from "./dependency.ts";\n');
-    await writeFile(scopeDependency, 'export const dependency = "scope";\n');
-
-    try {
-      const binds = await runBuildDockerBinds("test-project", functionsDir, outputDir, config);
-      const hostPaths = binds.map((bind) => bind.hostPath);
-
-      expect(hostPaths).toContain(scopeEntrypoint);
-      expect(hostPaths).toContain(scopeDependency);
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
 
-  it("mounts an out-of-root file-valued scope target itself, warns, and does not follow its imports", async () => {
-    const { root, functionsDir, outputDir, config } = await createFunctionProjectWithDenoJson(
-      {
-        scopes: { __local: { __mod: "../../../../../libs/thing/mod.ts" } },
-      },
-      'Deno.serve(() => new Response("ok"));\n',
-      { nestedProject: true },
+    it.effect(
+      "ignores an empty-string import-map key (spec) without crashing; other mappings still resolve",
+      () =>
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const path = yield* Path.Path;
+          const { root, functionsDir, functionDir, outputDir, config } =
+            yield* createHelloFunctionProject(
+              { "": "./x.ts", "@supabase/server": VENDOR_TARGET_RELATIVE },
+              [
+                'import { server } from "@supabase/server";',
+                'Deno.serve(() => new Response("ok"));',
+                "",
+              ].join("\n"),
+            );
+          yield* fs.writeFileString(path.join(functionDir, "x.ts"), "export const x = 1;\n");
+          const vendorIndexPath = yield* writeVendorIndexFile(root);
+          const warnings: Array<string> = [];
+
+          const binds = yield* buildDockerBinds("test-project", functionsDir, outputDir, config, {
+            onWarning: (message) =>
+              Effect.sync(() => {
+                warnings.push(message);
+              }),
+          });
+
+          expect(binds.some((bind) => bind.hostPath === vendorIndexPath)).toBe(true);
+          expect(warnings).toEqual([]);
+        }),
     );
-    const libsDir = join(root, "libs", "thing");
-    const scopeEntrypoint = join(libsDir, "mod.ts");
-    const scopeDependency = join(libsDir, "util.ts");
-    const warnings: Array<string> = [];
-
-    try {
-      await mkdir(libsDir, { recursive: true });
-      await writeFile(scopeEntrypoint, 'export { util } from "./util.ts";\n');
-      await writeFile(scopeDependency, 'export const util = "thing";\n');
-
-      const binds = await runBuildDockerBinds("test-project", functionsDir, outputDir, config, {
-        onWarning: async (message) => {
-          warnings.push(message);
-        },
-      });
-      const hostPaths = binds.map((bind) => bind.hostPath);
-
-      expect(hostPaths).toContain(scopeEntrypoint);
-      expect(hostPaths).not.toContain(scopeDependency);
-      expect(binds.filter((bind) => bind.externalScope).map((bind) => bind.hostPath)).toEqual([
-        scopeEntrypoint,
-      ]);
-      expect(warnings).toContainEqual(
-        `WARN: Mounting import map scope target outside the project root: ${scopeEntrypoint}\n`,
-      );
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
 
-  it.skipIf(process.platform === "win32")(
-    "does not duplicate the functions mount when its directory is symlinked",
-    async () => {
-      const { root, functionsDir, outputDir, config } = await createFunctionProjectWithDenoJson(
-        {
-          scopes: {
-            __local: { __functions: ".." },
-          },
-        },
-        'Deno.serve(() => new Response("ok"));\n',
-      );
-      const externalRoot = await realpath(
-        await mkdtemp(join(tmpdir(), "deploy-external-functions-")),
-      );
-      const externalFunctionsDir = join(externalRoot, "functions");
-      await rename(functionsDir, externalFunctionsDir);
-      await symlink(externalFunctionsDir, functionsDir, "dir");
-
-      const warnings: Array<string> = [];
-
-      try {
-        const binds = await runBuildDockerBinds("test-project", functionsDir, outputDir, config, {
-          onWarning: async (message) => {
-            warnings.push(message);
+    it.effect("resolves via the longest matching `/`-suffixed key when two keys compete", () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const { root, functionsDir, outputDir, config } = yield* createHelloFunctionProject(
+          {
+            "@v/": "../../../dirA/",
+            "@v/deep/": "../../../dirB/",
           },
+          [
+            'import { mod } from "@v/deep/mod.ts";',
+            'Deno.serve(() => new Response("ok"));',
+            "",
+          ].join("\n"),
+        );
+        yield* fs.makeDirectory(path.join(root, "dirA"), { recursive: true });
+        yield* fs.makeDirectory(path.join(root, "dirB"), { recursive: true });
+        const modPath = path.join(root, "dirB", "mod.ts");
+        yield* fs.writeFileString(modPath, "export const mod = 2;\n");
+        const warnings: Array<string> = [];
+
+        const binds = yield* buildDockerBinds("test-project", functionsDir, outputDir, config, {
+          onWarning: (message) =>
+            Effect.sync(() => {
+              warnings.push(message);
+            }),
         });
-        const functionsBinds = binds.filter((bind) => bind.containerPath === resolve(functionsDir));
 
-        expect(functionsBinds).toHaveLength(1);
-        expect(functionsBinds[0]?.hostPath).toBe(resolve(functionsDir));
-        expect(binds.filter((bind) => bind.externalScope)).toHaveLength(0);
+        expect(binds.some((bind) => bind.hostPath === modPath)).toBe(true);
         expect(
-          warnings.filter((warning) => warning.includes("Mounting import map scope target")),
-        ).toHaveLength(0);
-      } finally {
-        await rm(root, { recursive: true, force: true });
-        await rm(externalRoot, { recursive: true, force: true });
-      }
-    },
-  );
-
-  it("drops a `/`-suffixed key whose value lacks a trailing slash (spec-invalid mapping), instead of fabricating a concatenated path", async () => {
-    const { root, functionsDir, outputDir, config } = await createHelloFunctionProject(
-      { "pkg/": VENDOR_TARGET_RELATIVE },
-      [
-        'import { core } from "pkg/core.ts";',
-        'import { core2 } from "pkg//core.ts";',
-        'Deno.serve(() => new Response("ok"));',
-        "",
-      ].join("\n"),
+          binds.some((bind) => formatDockerBind(bind).includes(path.join("dirA", "deep"))),
+        ).toBe(false);
+        expect(warnings).toEqual([]);
+      }),
     );
-    await writeVendorIndexFile(root);
-    const warnings: Array<string> = [];
-
-    try {
-      await runBuildDockerBinds("test-project", functionsDir, outputDir, config, {
-        onWarning: async (message) => {
-          warnings.push(message);
-        },
-      });
-
-      expect(warnings).toEqual([]);
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
 
-  it("ignores an empty-string import-map key (spec) without crashing; other mappings still resolve", async () => {
-    const { root, functionsDir, functionDir, outputDir, config } = await createHelloFunctionProject(
-      { "": "./x.ts", "@supabase/server": VENDOR_TARGET_RELATIVE },
-      [
-        'import { server } from "@supabase/server";',
-        'Deno.serve(() => new Response("ok"));',
-        "",
-      ].join("\n"),
+    it.effect(
+      "no longer applies a scope whose name coincidentally shares a string prefix with the current file's directory (spec-strict scope matching)",
+      () =>
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const path = yield* Path.Path;
+          const { root, functionsDir, outputDir, config } =
+            yield* createFunctionProjectWithDenoJson(
+              {
+                imports: { "@lib": "../../../scoped-test/fallback-lib.ts" },
+                scopes: {
+                  "../hell": { "@lib": "../../../scoped-test/definitely-not-real.ts" },
+                },
+              },
+              ['import { lib } from "@lib";', 'Deno.serve(() => new Response("ok"));', ""].join(
+                "\n",
+              ),
+            );
+          yield* fs.makeDirectory(path.join(root, "scoped-test"), { recursive: true });
+          yield* fs.writeFileString(
+            path.join(root, "scoped-test", "fallback-lib.ts"),
+            "export const lib = 1;\n",
+          );
+          const warnings: Array<string> = [];
+
+          yield* buildDockerBinds("test-project", functionsDir, outputDir, config, {
+            onWarning: (message) =>
+              Effect.sync(() => {
+                warnings.push(message);
+              }),
+            skipMissingImportMapTargets: true,
+          });
+
+          // If the scope incorrectly matched, "@lib" would emit a "failed to read file" warning
+          // instead of the constant "Skipping missing import map target" warning every target
+          // enumeration walk emits regardless of scope matching.
+          expect(
+            warnings.some(
+              (warning) => warning.includes("failed to read file") && warning.includes("not-real"),
+            ),
+          ).toBe(false);
+          expect(
+            warnings.some(
+              (warning) =>
+                warning.includes("Skipping missing import map target") &&
+                warning.includes("not-real"),
+            ),
+          ).toBe(true);
+        }),
     );
-    await writeFile(join(functionDir, "x.ts"), "export const x = 1;\n");
-    const vendorIndexPath = await writeVendorIndexFile(root);
-    const warnings: Array<string> = [];
-
-    try {
-      const binds = await runBuildDockerBinds("test-project", functionsDir, outputDir, config, {
-        onWarning: async (message) => {
-          warnings.push(message);
-        },
-      });
-
-      expect(binds.some((bind) => bind.hostPath === vendorIndexPath)).toBe(true);
-      expect(warnings).toEqual([]);
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
 
-  it("resolves via the longest matching `/`-suffixed key when two keys compete", async () => {
-    const { root, functionsDir, outputDir, config } = await createHelloFunctionProject(
-      {
-        "@v/": "../../../dirA/",
-        "@v/deep/": "../../../dirB/",
-      },
-      ['import { mod } from "@v/deep/mod.ts";', 'Deno.serve(() => new Response("ok"));', ""].join(
-        "\n",
-      ),
+    it.effect(
+      "silently drops a trailing-slash directory-shaped specifier instead of crashing",
+      () =>
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const path = yield* Path.Path;
+          const { functionsDir, functionDir, outputDir, config } =
+            yield* createHelloFunctionProject(
+              { "@dir/": "./sub/" },
+              'import "@dir/nested/";\nDeno.serve(() => new Response("ok"));\n',
+            );
+          yield* fs.makeDirectory(path.join(functionDir, "sub"), { recursive: true });
+          const warnings: Array<string> = [];
+
+          yield* buildDockerBinds("test-project", functionsDir, outputDir, config, {
+            onWarning: (message) =>
+              Effect.sync(() => {
+                warnings.push(message);
+              }),
+          });
+
+          expect(warnings.some((warning) => warning.includes("nested"))).toBe(false);
+        }),
     );
-    await mkdir(join(root, "dirA"), { recursive: true });
-    await mkdir(join(root, "dirB"), { recursive: true });
-    const modPath = join(root, "dirB", "mod.ts");
-    await writeFile(modPath, "export const mod = 2;\n");
-    const warnings: Array<string> = [];
-
-    try {
-      const binds = await runBuildDockerBinds("test-project", functionsDir, outputDir, config, {
-        onWarning: async (message) => {
-          warnings.push(message);
-        },
-      });
-
-      expect(binds.some((bind) => bind.hostPath === modPath)).toBe(true);
-      expect(binds.some((bind) => formatDockerBind(bind).includes(join("dirA", "deep")))).toBe(
-        false,
-      );
-      expect(warnings).toEqual([]);
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
 
-  it("no longer applies a scope whose name coincidentally shares a string prefix with the current file's directory (spec-strict scope matching)", async () => {
-    const { root, functionsDir, outputDir, config } = await createFunctionProjectWithDenoJson(
-      {
-        imports: { "@lib": "../../../scoped-test/fallback-lib.ts" },
-        scopes: {
-          "../hell": { "@lib": "../../../scoped-test/definitely-not-real.ts" },
-        },
-      },
-      ['import { lib } from "@lib";', 'Deno.serve(() => new Response("ok"));', ""].join("\n"),
+    it.effect("skips an invalid static_files glob instead of failing, binding nothing for it", () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const { root, functionsDir, outputDir, config } = yield* createHelloFunctionProject(
+          {},
+          'Deno.serve(() => new Response("ok"));\n',
+        );
+        const assetsDir = path.join(root, "supabase", "assets");
+        yield* fs.makeDirectory(assetsDir, { recursive: true });
+        yield* fs.writeFileString(path.join(assetsDir, "[z-a].txt"), "a\n");
+
+        const baseline = yield* buildDockerBinds("test-project", functionsDir, outputDir, config);
+        const binds = yield* buildDockerBinds("test-project", functionsDir, outputDir, {
+          ...config,
+          staticFiles: [path.join(assetsDir, "[z-a].txt")],
+        });
+
+        expect(binds).toEqual(baseline);
+      }),
     );
-    await mkdir(join(root, "scoped-test"), { recursive: true });
-    await writeFile(join(root, "scoped-test", "fallback-lib.ts"), "export const lib = 1;\n");
-    const warnings: Array<string> = [];
-
-    try {
-      await runBuildDockerBinds("test-project", functionsDir, outputDir, config, {
-        onWarning: async (message) => {
-          warnings.push(message);
-        },
-        skipMissingImportMapTargets: true,
-      });
-
-      // If the scope incorrectly matched, "@lib" would emit a "failed to read file" warning
-      // instead of the constant "Skipping missing import map target" warning every target
-      // enumeration walk emits regardless of scope matching.
-      expect(
-        warnings.some(
-          (warning) => warning.includes("failed to read file") && warning.includes("not-real"),
-        ),
-      ).toBe(false);
-      expect(
-        warnings.some(
-          (warning) =>
-            warning.includes("Skipping missing import map target") && warning.includes("not-real"),
-        ),
-      ).toBe(true);
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
 
-  it("silently drops a trailing-slash directory-shaped specifier instead of crashing", async () => {
-    const { root, functionsDir, functionDir, outputDir, config } = await createHelloFunctionProject(
-      { "@dir/": "./sub/" },
-      'import "@dir/nested/";\nDeno.serve(() => new Response("ok"));\n',
+    it.effect("keeps walking imports after the caller is interrupted", () =>
+      Effect.gen(function* () {
+        const { functionsDir, outputDir, config } = yield* createHelloFunctionProject(
+          {},
+          ['import "../../../outside-a.ts";', 'import "../../../outside-b.ts";', ""].join("\n"),
+        );
+        const started = yield* Deferred.make<void>();
+        const gate = yield* Deferred.make<void>();
+        const continued = yield* Deferred.make<void>();
+        const warnings: Array<string> = [];
+
+        const caller = yield* Effect.forkChild(
+          buildDockerBinds("test-project", functionsDir, outputDir, config, {
+            onWarning: (message) =>
+              Effect.sync(() => {
+                warnings.push(message);
+              }).pipe(
+                Effect.andThen(Deferred.succeed(started, undefined)),
+                Effect.flatMap((first) =>
+                  first ? Deferred.await(gate) : Deferred.succeed(continued, undefined),
+                ),
+                Effect.asVoid,
+              ),
+          }),
+        );
+        yield* Deferred.await(started);
+        yield* Fiber.interrupt(caller);
+        yield* Deferred.succeed(gate, undefined);
+        yield* Deferred.await(continued);
+
+        expect(warnings).toEqual(
+          expect.arrayContaining([
+            "WARN: failed to read file: open outside-a.ts: no such file or directory\n",
+            "WARN: failed to read file: open outside-b.ts: no such file or directory\n",
+          ]),
+        );
+      }),
     );
-    await mkdir(join(functionDir, "sub"), { recursive: true });
-    const warnings: Array<string> = [];
-
-    try {
-      await runBuildDockerBinds("test-project", functionsDir, outputDir, config, {
-        onWarning: async (message) => {
-          warnings.push(message);
-        },
-      });
-
-      expect(warnings.some((warning) => warning.includes("nested"))).toBe(false);
-    } finally {
-      await rm(root, { recursive: true, force: true });
-    }
-  });
+  },
+);
+
+layer(BunServices.layer)("discoverFunctionSlugs — function directories on disk", (it) => {
+  it.effect.skipIf(process.platform === "win32")(
+    "includes symlinked function directories and skips files, links to files, broken links and entrypoint-less directories",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const projectRoot = yield* fs.realPath(
+          yield* fs.makeTempDirectoryScoped({ prefix: "deploy-discover-slugs-" }),
+        );
+        const functionsDir = path.join(projectRoot, "supabase", "functions");
+        const externalDir = path.join(projectRoot, "elsewhere", "linked");
+        yield* fs.makeDirectory(path.join(functionsDir, "realdir"), { recursive: true });
+        yield* fs.writeFileString(path.join(functionsDir, "realdir", "index.ts"), "export {};\n");
+        yield* fs.makeDirectory(externalDir, { recursive: true });
+        yield* fs.writeFileString(path.join(externalDir, "index.ts"), "export {};\n");
+        yield* fs.symlink(externalDir, path.join(functionsDir, "linked"));
+        yield* fs.symlink(
+          path.join(functionsDir, "realdir", "index.ts"),
+          path.join(functionsDir, "filelink"),
+        );
+        yield* fs.symlink(path.join(projectRoot, "nowhere"), path.join(functionsDir, "broken"));
+        yield* fs.makeDirectory(path.join(functionsDir, "noentry"), { recursive: true });
+        yield* fs.writeFileString(path.join(functionsDir, "noentry", "other.ts"), "export {};\n");
+        yield* fs.writeFileString(path.join(functionsDir, "plainfile"), "x\n");
+
+        expect(yield* discoverFunctionSlugs(projectRoot, {})).toEqual(["linked", "realdir"]);
+      }),
+  );
 });
 
 describe("pruneRedundantDockerBinds — child binds covered by a parent bind", () => {
diff --git a/apps/cli/src/shared/functions/download.errors.ts b/apps/cli/src/shared/functions/download.errors.ts
index c1e4122bca..d010bd4b9a 100644
--- a/apps/cli/src/shared/functions/download.errors.ts
+++ b/apps/cli/src/shared/functions/download.errors.ts
@@ -45,6 +45,8 @@ export class InvalidFunctionDownloadResponseError extends Data.TaggedError(
   }
 }
 
+export class FunctionEszipDownloadError extends Data.Error<{ readonly message: string }> {}
+
 export class UnsafeFunctionDownloadPathError extends Data.TaggedError(
   "UnsafeFunctionDownloadPathError",
 )<{
diff --git a/apps/cli/src/shared/functions/download.ts b/apps/cli/src/shared/functions/download.ts
index 46f8bce592..d848afc205 100644
--- a/apps/cli/src/shared/functions/download.ts
+++ b/apps/cli/src/shared/functions/download.ts
@@ -1,9 +1,8 @@
+import { BunPath } from "@effect/platform-bun";
 import { operationDefinitions, SupabaseApiInputError, type ApiClient } from "@supabase/api/effect";
 import { randomUUID } from "node:crypto";
-import { mkdir, open, rename, rm, writeFile } from "node:fs/promises";
-import { dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { Effect, FileSystem, Option } from "effect";
+import { Effect, FileSystem, Option, Path, type PlatformError, Schema } from "effect";
 import * as HttpBody from "effect/unstable/http/HttpBody";
 import * as HttpClientError from "effect/unstable/http/HttpClientError";
 import type * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
@@ -23,6 +22,7 @@ import {
   ensureDockerNamedVolume,
   ensureDockerNetwork,
   isDockerRunning,
+  nativePlatformFailure,
   resolveDockerNetworkMode,
   resolveEdgeRuntimeVersion,
   resolveFunctionsDockerImage,
@@ -39,6 +39,7 @@ import { slimImagesEnabled } from "../services/slim-images.ts";
 import {
   ConflictingFunctionDownloadFlagsError,
   FunctionDownloadNotFoundError,
+  FunctionEszipDownloadError,
   InvalidFunctionDownloadResponseError,
   InvalidFunctionSlugError,
   UnsafeFunctionDownloadPathError,
@@ -170,16 +171,21 @@ function getObjectProperty(value: unknown, key: string): unknown {
   return typeof value === "object" && value !== null ? Reflect.get(value, key) : undefined;
 }
 
-function isContainedPath(root: string, candidate: string): boolean {
-  const relativeCandidate = relative(root, candidate);
+function isContainedPath(path: Path.Path, root: string, candidate: string): boolean {
+  const relativeCandidate = path.relative(root, candidate);
   return (
     relativeCandidate === "" ||
-    (!isAbsolute(relativeCandidate) &&
+    (!path.isAbsolute(relativeCandidate) &&
       relativeCandidate !== ".." &&
-      !relativeCandidate.startsWith(`..${sep}`))
+      !relativeCandidate.startsWith(`..${path.sep}`))
   );
 }
 
+const hostErrorMessage = (error: PlatformError.PlatformError, pathname: string) =>
+  nativePlatformFailure(error, pathname).cause.message;
+
+const decodeJson = Schema.decodeEffect(Schema.fromJsonString(Schema.Unknown));
+
 function validateSlug(slug: string): Effect.Effect<void, InvalidFunctionSlugError> {
   if (validateFunctionSlugMessage(slug) === undefined) {
     return Effect.void;
@@ -439,7 +445,7 @@ function readContentDispositionParam(
     new RegExp(`(?:^|;)\\s*${paramPattern}=([^;]*)`, "i"),
   );
   if (assignmentMatch === null) {
-    return Effect.succeed(undefined);
+    return Effect.undefined;
   }
   const token = assignmentMatch[1]?.trim() ?? "";
   if (token.length > 0 && !token.startsWith('"') && !/\s/.test(token)) {
@@ -489,7 +495,7 @@ function readFormFieldName(
 ): Effect.Effect<string | undefined, InvalidFunctionDownloadResponseError> {
   const contentDisposition = headers["content-disposition"];
   if (contentDisposition === undefined) {
-    return Effect.succeed(undefined);
+    return Effect.undefined;
   }
   return readContentDispositionParam(contentDisposition, "name");
 }
@@ -592,6 +598,7 @@ function resolveEntrypointPath(
 }
 
 function resolveDownloadDestination(
+  { path, posixPath }: { readonly path: Path.Path; readonly posixPath: Path.Path },
   functionsRoot: string,
   functionDir: string,
   entrypointPath: string,
@@ -600,15 +607,15 @@ function resolveDownloadDestination(
   const normalizedEntrypoint = entrypointPath.replaceAll("\\", "/");
   const normalizedPartPath = partPath.replaceAll("\\", "/");
   const relativePath =
-    posix.isAbsolute(normalizedEntrypoint) === posix.isAbsolute(normalizedPartPath)
-      ? posix.relative(normalizedEntrypoint, normalizedPartPath)
-      : posix.join("..", normalizedPartPath);
-  const entrypointName = posix.basename(normalizedEntrypoint);
+    posixPath.isAbsolute(normalizedEntrypoint) === posixPath.isAbsolute(normalizedPartPath)
+      ? posixPath.relative(normalizedEntrypoint, normalizedPartPath)
+      : posixPath.join("..", normalizedPartPath);
+  const entrypointName = posixPath.basename(normalizedEntrypoint);
   const destination =
     relativePath.length === 0
-      ? resolve(functionDir, entrypointName)
-      : resolve(functionDir, entrypointName, ...relativePath.split("/"));
-  if (isContainedPath(resolve(functionsRoot), destination)) {
+      ? path.resolve(functionDir, entrypointName)
+      : path.resolve(functionDir, entrypointName, ...relativePath.split("/"));
+  if (isContainedPath(path, path.resolve(functionsRoot), destination)) {
     return Effect.succeed(destination);
   }
 
@@ -620,8 +627,8 @@ function resolveDownloadDestination(
   );
 }
 
-function ensureContainedPath(root: string, candidate: string, sourcePath: string) {
-  if (isContainedPath(root, candidate)) {
+function ensureContainedPath(path: Path.Path, root: string, candidate: string, sourcePath: string) {
+  if (isContainedPath(path, root, candidate)) {
     return Effect.void;
   }
 
@@ -639,34 +646,47 @@ function writeFileWithoutFollowingSymlinks(
   sourcePath: string,
 ) {
   return Effect.gen(function* () {
-    const tempDestination = join(dirname(destination), `.supabase-download-${randomUUID()}.tmp`);
-    const file = yield* Effect.tryPromise({
-      try: () => open(tempDestination, "wx"),
-      catch: (cause) =>
-        new UnsafeFunctionDownloadPathError({
-          message: `failed to create temporary Function file while extracting ${sourcePath}: ${cause instanceof Error ? cause.message : String(cause)}`,
-        }),
-    });
-
-    yield* Effect.tryPromise({
-      try: () => file.writeFile(body),
-      catch: (cause) =>
-        new UnsafeFunctionDownloadPathError({
-          message: `failed to write Function file: ${sourcePath}: ${cause instanceof Error ? cause.message : String(cause)}`,
-        }),
-    }).pipe(Effect.ensuring(Effect.promise(() => file.close()).pipe(Effect.ignore)));
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const tempDestination = path.join(
+      path.dirname(destination),
+      `.supabase-download-${randomUUID()}.tmp`,
+    );
+    yield* Effect.scoped(
+      Effect.gen(function* () {
+        const file = yield* fs.open(tempDestination, { flag: "wx" }).pipe(
+          Effect.mapError(
+            (error) =>
+              new UnsafeFunctionDownloadPathError({
+                message: `failed to create temporary Function file while extracting ${sourcePath}: ${hostErrorMessage(error, tempDestination)}`,
+              }),
+          ),
+        );
+
+        if (body.byteLength > 0) {
+          yield* file.writeAll(body).pipe(
+            Effect.mapError(
+              (error) =>
+                new UnsafeFunctionDownloadPathError({
+                  message: `failed to write Function file: ${sourcePath}: ${hostErrorMessage(error, tempDestination)}`,
+                }),
+            ),
+          );
+        }
+      }),
+    );
 
-    yield* Effect.tryPromise({
-      try: () => rename(tempDestination, destination),
-      catch: (cause) =>
-        new UnsafeFunctionDownloadPathError({
-          message: `failed to move Function file into place: ${sourcePath}: ${cause instanceof Error ? cause.message : String(cause)}`,
-        }),
-    }).pipe(
-      Effect.catch((error) =>
-        Effect.promise(() => rm(tempDestination, { force: true })).pipe(
-          Effect.ignore,
-          Effect.andThen(() => Effect.fail(error)),
+    yield* fs.rename(tempDestination, destination).pipe(
+      Effect.mapError(
+        (error) =>
+          new UnsafeFunctionDownloadPathError({
+            message: `failed to move Function file into place: ${sourcePath}: ${hostErrorMessage(error, destination)}`,
+          }),
+      ),
+      Effect.tapError(() =>
+        fs.remove(tempDestination, { force: true }).pipe(
+          Effect.mapError((error) => nativePlatformFailure(error, tempDestination).cause),
+          Effect.orDie,
         ),
       ),
     );
@@ -682,43 +702,46 @@ const listRemoteFunctionSlugs = Effect.fnUntraced(function* (api: ApiClient, pro
 
   const body = yield* response.text.pipe(Effect.orElseSucceed(() => ""));
   if (response.status !== 200) {
-    return yield* Effect.fail(
-      new FunctionsApiStatusError({
-        status: response.status,
-        message: `unexpected list functions status ${response.status}: ${body}`,
-      }),
-    );
+    return yield* new FunctionsApiStatusError({
+      status: response.status,
+      message: `unexpected list functions status ${response.status}: ${body}`,
+    });
   }
 
-  return yield* Effect.try({
-    try: () => {
-      const parsed = JSON.parse(body);
-      if (!Array.isArray(parsed)) {
-        throw new Error("expected functions list response to be an array");
-      }
-      // A missing/null "slug" coerces to "" here (rather than being filtered
-      // out) so it fails loudly downstream via `validateRemoteSlug`, instead
-      // of silently vanishing from the list.
-      //
-      // A "slug" typed as something other than string/null throws here,
-      // failing the whole list call before any function is downloaded —
-      // never after some entries have already been fetched.
-      return parsed.map((value) => {
-        const slug = getObjectProperty(value, "slug");
-        if (slug === null || slug === undefined) {
-          return "";
-        }
-        if (typeof slug !== "string") {
-          throw new Error(`expected function slug to be a string, got ${typeof slug}`);
-        }
-        return slug;
+  const parsed = yield* decodeJson(body).pipe(
+    Effect.mapError(
+      (error) =>
+        new InvalidFunctionDownloadResponseError({
+          message: `failed to read functions list: ${error.message}`,
+        }),
+    ),
+  );
+  if (!Array.isArray(parsed)) {
+    return yield* new InvalidFunctionDownloadResponseError({
+      message: "failed to read functions list: expected functions list response to be an array",
+    });
+  }
+  // A missing/null "slug" coerces to "" here (rather than being filtered
+  // out) so it fails loudly downstream via `validateRemoteSlug`, instead
+  // of silently vanishing from the list.
+  //
+  // A "slug" typed as something other than string/null fails here,
+  // failing the whole list call before any function is downloaded —
+  // never after some entries have already been fetched.
+  const slugs: Array<string> = [];
+  for (const value of parsed) {
+    const slug = getObjectProperty(value, "slug");
+    if (slug === null || slug === undefined) {
+      slugs.push("");
+    } else if (typeof slug === "string") {
+      slugs.push(slug);
+    } else {
+      return yield* new InvalidFunctionDownloadResponseError({
+        message: `failed to read functions list: expected function slug to be a string, got ${typeof slug}`,
       });
-    },
-    catch: (cause) =>
-      new InvalidFunctionDownloadResponseError({
-        message: `failed to read functions list: ${cause instanceof Error ? cause.message : String(cause)}`,
-      }),
-  });
+    }
+  }
+  return slugs;
 });
 
 const getRemoteFunction = Effect.fnUntraced(function* (
@@ -738,33 +761,28 @@ const getRemoteFunction = Effect.fnUntraced(function* (
     case 200:
       break;
     case 404:
-      return yield* Effect.fail(
-        new FunctionDownloadNotFoundError({
-          message: `Function ${slug} does not exist on the Supabase project.`,
-        }),
-      );
+      return yield* new FunctionDownloadNotFoundError({
+        message: `Function ${slug} does not exist on the Supabase project.`,
+      });
     default:
-      return yield* Effect.fail(
-        new FunctionsApiStatusError({
-          status: response.status,
-          message: `Failed to download Function ${slug} on the Supabase project: ${body}`,
-        }),
-      );
+      return yield* new FunctionsApiStatusError({
+        status: response.status,
+        message: `Failed to download Function ${slug} on the Supabase project: ${body}`,
+      });
   }
 
-  return yield* Effect.try({
-    try: () => {
-      const parsed = JSON.parse(body);
-      const entrypointPath = getObjectProperty(parsed, "entrypoint_path");
-      return typeof entrypointPath === "string" && entrypointPath.length > 0
-        ? { entrypoint_path: entrypointPath }
-        : { entrypoint_path: legacyEntrypointPath };
-    },
-    catch: (cause) =>
-      new InvalidFunctionDownloadResponseError({
-        message: `failed to get function metadata: ${cause instanceof Error ? cause.message : String(cause)}`,
-      }),
-  });
+  const parsed = yield* decodeJson(body).pipe(
+    Effect.mapError(
+      (error) =>
+        new InvalidFunctionDownloadResponseError({
+          message: `failed to get function metadata: ${error.message}`,
+        }),
+    ),
+  );
+  const entrypointPath = getObjectProperty(parsed, "entrypoint_path");
+  return typeof entrypointPath === "string" && entrypointPath.length > 0
+    ? { entrypoint_path: entrypointPath }
+    : { entrypoint_path: legacyEntrypointPath };
 });
 
 const downloadBody = Effect.fnUntraced(function* (
@@ -788,13 +806,11 @@ const downloadBody = Effect.fnUntraced(function* (
   }
 
   const body = yield* response.text.pipe(Effect.orElseSucceed(() => ""));
-  return yield* Effect.fail(
-    new FunctionsApiStatusError({
-      status: response.status,
-      message: `Error status ${response.status}: ${body}`,
-      notFoundIsInvalidInput: true,
-    }),
-  );
+  return yield* new FunctionsApiStatusError({
+    status: response.status,
+    message: `Error status ${response.status}: ${body}`,
+    notFoundIsInvalidInput: true,
+  });
 });
 
 // Overrides `Accept: */*` so `executeRaw` doesn't default to
@@ -820,16 +836,18 @@ const downloadEszipBody = Effect.fnUntraced(function* (
 
   if (response.status !== 200) {
     const body = yield* response.text.pipe(Effect.orElseSucceed(() => ""));
-    return yield* Effect.fail(new Error(`Error status ${response.status}: ${body}`));
+    return yield* new FunctionEszipDownloadError({
+      message: `Error status ${response.status}: ${body}`,
+    });
   }
 
   return new Uint8Array(
     yield* response.arrayBuffer.pipe(
       Effect.mapError(
         (cause) =>
-          new Error(
-            `failed to download file: ${cause instanceof Error ? cause.message : String(cause)}`,
-          ),
+          new FunctionEszipDownloadError({
+            message: `failed to download file: ${cause instanceof Error ? cause.message : String(cause)}`,
+          }),
       ),
     ),
   );
@@ -881,7 +899,7 @@ function withDockerStepFailure(step: string, slug: string, styleAqua?: (text: st
 // `deno_version = 1` pins the older `DENO1_EDGE_RUNTIME_VERSION`; anything
 // else (including unset) uses the project's configured/default tag.
 // Resolved once per invocation by the caller, not once per slug.
-const resolveEdgeRuntimeImage = Effect.fnUntraced(function* (
+const resolveEdgeRuntimeImage = Effect.fn("functions.download.resolveEdgeRuntimeImage")(function* (
   dependencies: EdgeRuntimeImageDependencies,
   projectRef: string,
 ) {
@@ -927,7 +945,7 @@ interface PulledEdgeRuntimeImage extends EdgeRuntimeImage {
 // Downloads the function body as an eszip, writes it to a temp file, then
 // runs the edge-runtime image's `unbundle` subcommand against it, mounting
 // the shared `supabase/functions` directory (not the slug's own subdirectory).
-const downloadWithDockerUnbundle = Effect.fnUntraced(function* (
+const downloadWithDockerUnbundle = Effect.fn("functions.download.dockerUnbundle")(function* (
   dependencies: DownloadDockerRuntimeDependencies,
   edgeRuntimeImage: PulledEdgeRuntimeImage,
   projectRef: string,
@@ -943,21 +961,28 @@ const downloadWithDockerUnbundle = Effect.fnUntraced(function* (
 
   const eszip = yield* downloadEszipBody(dependencies.api, projectRef, slug);
 
-  const tempDir = join(dependencies.projectRoot, "supabase", ".temp");
-  yield* Effect.tryPromise({
-    try: () => mkdir(tempDir, { recursive: true }),
-    catch: (cause) =>
-      new Error(`failed to mkdir: ${cause instanceof Error ? cause.message : String(cause)}`),
-  });
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const posixPath = yield* Effect.provide(Path.Path, BunPath.layerPosix);
+  const tempDir = path.join(dependencies.projectRoot, "supabase", ".temp");
+  yield* fs.makeDirectory(tempDir, { recursive: true }).pipe(
+    Effect.mapError(
+      (error) =>
+        new FunctionEszipDownloadError({
+          message: `failed to mkdir: ${hostErrorMessage(error, tempDir)}`,
+        }),
+    ),
+  );
   const eszipFileName = `output_${slug}.eszip`;
-  const eszipPath = join(tempDir, eszipFileName);
-  yield* Effect.tryPromise({
-    try: () => writeFile(eszipPath, eszip),
-    catch: (cause) =>
-      new Error(
-        `failed to download file: ${cause instanceof Error ? cause.message : String(cause)}`,
-      ),
-  });
+  const eszipPath = path.join(tempDir, eszipFileName);
+  yield* fs.writeFile(eszipPath, eszip).pipe(
+    Effect.mapError(
+      (error) =>
+        new FunctionEszipDownloadError({
+          message: `failed to download file: ${hostErrorMessage(error, eszipPath)}`,
+        }),
+    ),
+  );
 
   // `Effect.ensuring` below wraps every step from here on so a failure
   // resolving the network/volume, spawning Docker, or a non-zero container
@@ -969,17 +994,18 @@ const downloadWithDockerUnbundle = Effect.fnUntraced(function* (
   const debugEnabled = explicitBooleanLongFlag(dependencies.rawArgs, "debug") ?? false;
   const cleanupEszip = debugEnabled
     ? Effect.void
-    : Effect.tryPromise({
-        try: () => rm(eszipPath, { force: true }),
-        catch: (cause) => (cause instanceof Error ? cause.message : String(cause)),
-      }).pipe(Effect.catch((message) => output.raw(`${message}\n`, "stderr")));
+    : fs
+        .remove(eszipPath, { force: true })
+        .pipe(
+          Effect.catch((error) => output.raw(`${hostErrorMessage(error, eszipPath)}\n`, "stderr")),
+        );
 
   const { projectId, denoVersion, image, projectEnvValues } = edgeRuntimeImage;
-  const functionsDir = resolve(dependencies.projectRoot, "supabase", "functions");
-  const hostEszipPath = resolve(eszipPath);
+  const functionsDir = path.resolve(dependencies.projectRoot, "supabase", "functions");
+  const hostEszipPath = path.resolve(eszipPath);
   const cacheVolume = edgeRuntimeCacheVolume(projectId);
-  const dockerEszipPath = posix.join(DOCKER_ESZIP_DIR, eszipFileName);
-  const dockerOutputPath = posix.join(DOCKER_DENO_DIR, slug);
+  const dockerEszipPath = posixPath.join(DOCKER_ESZIP_DIR, eszipFileName);
+  const dockerOutputPath = posixPath.join(DOCKER_DENO_DIR, slug);
   const hasBitbucketCloneDir = Option.isSome(yield* bitbucketCloneDir(projectEnvValues));
 
   // `--network-id` is a persistent root flag, not registered on `functions
@@ -1064,12 +1090,14 @@ const downloadWithDockerUnbundle = Effect.fnUntraced(function* (
   return yield* extract.pipe(Effect.ensuring(cleanupEszip));
 });
 
-const downloadSingle = Effect.fnUntraced(function* (
+const downloadSingle = Effect.fn("functions.download.single")(function* (
   dependencies: DownloadRuntimeDependencies,
   projectRef: string,
   slug: string,
 ) {
   const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const posixPath = yield* Effect.provide(Path.Path, BunPath.layerPosix);
   const output = yield* Output;
 
   if (output.format === "text") {
@@ -1083,8 +1111,8 @@ const downloadSingle = Effect.fnUntraced(function* (
     : yield* getRemoteFunction(dependencies.api, projectRef, slug);
   const entrypointPath = resolveEntrypointPath(metadata, remoteFunction);
   const projectRoot = dependencies.projectRoot;
-  const functionsRoot = join(projectRoot, "supabase", "functions");
-  const functionDir = join(functionsRoot, slug);
+  const functionsRoot = path.join(projectRoot, "supabase", "functions");
+  const functionDir = path.join(functionsRoot, slug);
   const realProjectRoot = yield* fs.realPath(projectRoot);
   const makeContainedDirectory = Effect.fnUntraced(function* (
     root: string,
@@ -1093,13 +1121,13 @@ const downloadSingle = Effect.fnUntraced(function* (
   ) {
     let existingParent = directory;
     while (!(yield* fs.exists(existingParent))) {
-      existingParent = dirname(existingParent);
+      existingParent = path.dirname(existingParent);
     }
     const realExistingParent = yield* fs.realPath(existingParent);
-    yield* ensureContainedPath(root, realExistingParent, sourcePath);
+    yield* ensureContainedPath(path, root, realExistingParent, sourcePath);
     yield* fs.makeDirectory(directory, { recursive: true });
     const realDirectory = yield* fs.realPath(directory);
-    yield* ensureContainedPath(root, realDirectory, sourcePath);
+    yield* ensureContainedPath(path, root, realDirectory, sourcePath);
   });
 
   yield* makeContainedDirectory(realProjectRoot, functionsRoot, functionsRoot);
@@ -1111,15 +1139,16 @@ const downloadSingle = Effect.fnUntraced(function* (
     }
 
     const destination = yield* resolveDownloadDestination(
+      { path, posixPath },
       functionsRoot,
       functionDir,
       entrypointPath,
       file.path,
     );
-    const parent = dirname(destination);
+    const parent = path.dirname(destination);
     yield* makeContainedDirectory(realFunctionsRoot, parent, file.path);
     yield* writeFileWithoutFollowingSymlinks(destination, file.body, file.path);
-    yield* ensureContainedPath(realFunctionsRoot, yield* fs.realPath(destination), file.path);
+    yield* ensureContainedPath(path, realFunctionsRoot, yield* fs.realPath(destination), file.path);
     if (output.format === "text") {
       yield* output.raw(`Extracting file: ${destination}\n`, "stderr");
     }
@@ -1151,7 +1180,12 @@ function attachDownloadWrittenSoFar<E extends object>(
     : Object.assign(error, { writtenSoFar: [...downloadedSoFar] });
 }
 
-export function downloadFunctions<ResolveError, ResolveRequirements, ProxyError, ProxyRequirements>(
+export const downloadFunctions = Effect.fn("functions.download")(function* <
+  ResolveError,
+  ResolveRequirements,
+  ProxyError,
+  ProxyRequirements,
+>(
   flags: DownloadFunctionsOptions,
   dependencies: DownloadFunctionsDependencies<
     ResolveError,
@@ -1160,145 +1194,143 @@ export function downloadFunctions<ResolveError, ResolveRequirements, ProxyError,
     ProxyRequirements
   >,
 ) {
-  return Effect.gen(function* () {
-    const output = yield* Output;
-
-    yield* validateDownloadFlags(dependencies.rawArgs);
-
-    if (Option.isSome(flags.functionName)) {
-      yield* validateSlug(flags.functionName.value);
-    }
-
-    // `--legacy-bundle` still delegates to the Go binary: it requires
-    // installing/upgrading a Deno binary on the host and shelling out to an
-    // embedded Deno script, with no other precedent in this codebase.
-    // `--use-docker` (default `true`) runs natively below and falls through
-    // to the same server-side downloader when Docker isn't running.
-    if (flags.legacyBundle) {
-      const projectRef = yield* dependencies.resolveProjectRef(flags.projectRef);
-
-      if (output.format === "text") {
-        yield* dependencies.proxyDownload(flags, projectRef, false);
-        // The slug list is never resolved in text mode here, so this result
-        // is not meaningful — callers never read it (the orchestrator never
-        // sets `legacyBundle: true`).
-        return { projectRef, slugs: [], empty: false };
-      }
-
-      // Resolved before delegating: this list is purely for the JSON
-      // payload (the delegated child's own stdout is captured/discarded, not
-      // inherited, since it never emits the `Output` envelope). Resolving it
-      // first means a transient listing failure is reported before any
-      // download side effect, rather than masking an already-successful
-      // delegated download with an unrelated listing failure after the fact.
-      const slugs = Option.isSome(flags.functionName)
-        ? [flags.functionName.value]
-        : yield* listRemoteFunctionSlugs(dependencies.api, projectRef);
-
-      // Mirrors the native path's empty-project short-circuit below: an
-      // empty project has nothing to delegate, so this reports "No functions
-      // found." instead of invoking the Go child unnecessarily.
-      if (slugs.length === 0) {
-        yield* output.success("No functions found.", {
-          function_slugs: [],
-          project_ref: projectRef,
-        });
-        return { projectRef, slugs: [], empty: true };
-      }
+  const output = yield* Output;
+  const path = yield* Path.Path;
 
-      yield* dependencies.proxyDownload(flags, projectRef, true);
+  yield* validateDownloadFlags(dependencies.rawArgs);
 
-      yield* output.success("Downloaded Edge Function source.", {
-        function_slugs: slugs,
-        project_ref: projectRef,
-      });
-      return { projectRef, slugs, empty: false };
-    }
+  if (Option.isSome(flags.functionName)) {
+    yield* validateSlug(flags.functionName.value);
+  }
 
+  // `--legacy-bundle` still delegates to the Go binary: it requires
+  // installing/upgrading a Deno binary on the host and shelling out to an
+  // embedded Deno script, with no other precedent in this codebase.
+  // `--use-docker` (default `true`) runs natively below and falls through
+  // to the same server-side downloader when Docker isn't running.
+  if (flags.legacyBundle) {
     const projectRef = yield* dependencies.resolveProjectRef(flags.projectRef);
 
-    // Resolved unconditionally here, before checking `useDocker` or whether
-    // Docker is running: an invalid `supabase/config.toml` (e.g. a bad
-    // `edge_runtime.deno_version`) must fail up front regardless of
-    // `--use-api`/`--use-docker`/Docker's state, not only on the Docker path.
-    const resolvedEdgeRuntimeImage = yield* resolveEdgeRuntimeImage(dependencies, projectRef);
-
-    // Resolved once for the entire invocation, before any per-function work,
-    // so the "Docker is not running" warning can print even for a project
-    // with zero functions. `edgeRuntimeImage === undefined` is the single
-    // source of truth for "use the server-side path" instead of a separate
-    // boolean that could silently disagree with whether an image resolved.
-    const styleWarning = dependencies.styleWarning ?? ((text: string) => text);
-    const edgeRuntimeImage: EdgeRuntimeImage | undefined =
-      !flags.useApi && flags.useDocker
-        ? (yield* isDockerRunning())
-          ? resolvedEdgeRuntimeImage
-          : yield* output
-              .raw(`${styleWarning("WARNING:")} Docker is not running\n`, "stderr")
-              .pipe(Effect.as(undefined))
-        : undefined;
+    if (output.format === "text") {
+      yield* dependencies.proxyDownload(flags, projectRef, false);
+      // The slug list is never resolved in text mode here, so this result
+      // is not meaningful — callers never read it (the orchestrator never
+      // sets `legacyBundle: true`).
+      return { projectRef, slugs: [], empty: false };
+    }
 
+    // Resolved before delegating: this list is purely for the JSON
+    // payload (the delegated child's own stdout is captured/discarded, not
+    // inherited, since it never emits the `Output` envelope). Resolving it
+    // first means a transient listing failure is reported before any
+    // download side effect, rather than masking an already-successful
+    // delegated download with an unrelated listing failure after the fact.
     const slugs = Option.isSome(flags.functionName)
       ? [flags.functionName.value]
       : yield* listRemoteFunctionSlugs(dependencies.api, projectRef);
 
-    // The standalone `functionsDownload` handler emits the final summary;
-    // this only computes and returns the result.
+    // Mirrors the native path's empty-project short-circuit below: an
+    // empty project has nothing to delegate, so this reports "No functions
+    // found." instead of invoking the Go child unnecessarily.
     if (slugs.length === 0) {
+      yield* output.success("No functions found.", {
+        function_slugs: [],
+        project_ref: projectRef,
+      });
       return { projectRef, slugs: [], empty: true };
     }
 
-    if (output.format === "text" && Option.isNone(flags.functionName)) {
-      yield* output.raw(`Found ${slugs.length} function(s) to download\n`, "stderr");
-    }
+    yield* dependencies.proxyDownload(flags, projectRef, true);
 
-    // Resolved once for the whole invocation, not once per slug — see
-    // `PulledEdgeRuntimeImage`'s own doc comment. The `--legacy-bundle`
-    // suggestion on a resolve failure uses the first slug as a
-    // representative example, since none is "the" one being processed yet.
-    const styleAqua = dependencies.styleAqua ?? ((text: string) => text);
-    const pulledEdgeRuntimeImage: PulledEdgeRuntimeImage | undefined =
-      edgeRuntimeImage === undefined
-        ? undefined
-        : {
-            ...edgeRuntimeImage,
-            image: yield* resolveFunctionsDockerImage(
-              edgeRuntimeImage.rawImage,
-              edgeRuntimeImage.projectEnvValues,
-            ).pipe(Effect.mapError(withLegacyBundleSuggestion(slugs[0] ?? "", styleAqua))),
-          };
-
-    const downloaded: string[] = [];
-    // Absolute directory path per fully-downloaded slug, separate from
-    // `downloaded` (bare slugs): a caller upstream (`pull.aggregate.ts`'s
-    // `hasWrittenSoFar`) needs an on-disk path.
-    const downloadedPaths: string[] = [];
-    for (const slug of slugs) {
-      yield* Effect.gen(function* () {
-        // A user-supplied slug is already validated above; this covers
-        // slugs sourced from the Management API's function list, which is
-        // untrusted (a malicious/compromised response, or a MITM).
-        if (Option.isNone(flags.functionName)) {
-          yield* validateRemoteSlug(slug, styleAqua);
-        }
-        if (pulledEdgeRuntimeImage !== undefined) {
-          downloaded.push(
-            yield* downloadWithDockerUnbundle(
-              dependencies,
-              pulledEdgeRuntimeImage,
-              projectRef,
-              slug,
-            ),
-          );
-        } else {
-          downloaded.push(yield* downloadSingle(dependencies, projectRef, slug));
-        }
-        downloadedPaths.push(resolve(dependencies.projectRoot, "supabase", "functions", slug));
-      }).pipe(Effect.mapError((error) => attachDownloadWrittenSoFar(error, downloadedPaths)));
-    }
+    yield* output.success("Downloaded Edge Function source.", {
+      function_slugs: slugs,
+      project_ref: projectRef,
+    });
+    return { projectRef, slugs, empty: false };
+  }
 
-    // The standalone `functionsDownload` handler emits the final summary;
-    // this only computes and returns the result.
-    return { projectRef, slugs: downloaded, empty: false };
-  });
-}
+  const projectRef = yield* dependencies.resolveProjectRef(flags.projectRef);
+
+  // Resolved unconditionally here, before checking `useDocker` or whether
+  // Docker is running: an invalid `supabase/config.toml` (e.g. a bad
+  // `edge_runtime.deno_version`) must fail up front regardless of
+  // `--use-api`/`--use-docker`/Docker's state, not only on the Docker path.
+  const resolvedEdgeRuntimeImage = yield* resolveEdgeRuntimeImage(dependencies, projectRef);
+
+  // Resolved once for the entire invocation, before any per-function work,
+  // so the "Docker is not running" warning can print even for a project
+  // with zero functions. `edgeRuntimeImage === undefined` is the single
+  // source of truth for "use the server-side path" instead of a separate
+  // boolean that could silently disagree with whether an image resolved.
+  const styleWarning = dependencies.styleWarning ?? ((text: string) => text);
+  const edgeRuntimeImage: EdgeRuntimeImage | undefined =
+    !flags.useApi && flags.useDocker
+      ? (yield* isDockerRunning())
+        ? resolvedEdgeRuntimeImage
+        : yield* output
+            .raw(`${styleWarning("WARNING:")} Docker is not running\n`, "stderr")
+            .pipe(Effect.as(undefined))
+      : undefined;
+
+  const slugs = Option.isSome(flags.functionName)
+    ? [flags.functionName.value]
+    : yield* listRemoteFunctionSlugs(dependencies.api, projectRef);
+
+  // The standalone `functionsDownload` handler emits the final summary;
+  // this only computes and returns the result.
+  if (slugs.length === 0) {
+    return { projectRef, slugs: [], empty: true };
+  }
+
+  if (output.format === "text" && Option.isNone(flags.functionName)) {
+    yield* output.raw(`Found ${slugs.length} function(s) to download\n`, "stderr");
+  }
+  yield* Effect.annotateCurrentSpan({ "function.count": slugs.length });
+
+  // Resolved once for the whole invocation, not once per slug — see
+  // `PulledEdgeRuntimeImage`'s own doc comment. The `--legacy-bundle`
+  // suggestion on a resolve failure uses the first slug as a
+  // representative example, since none is "the" one being processed yet.
+  const styleAqua = dependencies.styleAqua ?? ((text: string) => text);
+  const pulledEdgeRuntimeImage: PulledEdgeRuntimeImage | undefined =
+    edgeRuntimeImage === undefined
+      ? undefined
+      : {
+          ...edgeRuntimeImage,
+          image: yield* resolveFunctionsDockerImage(
+            edgeRuntimeImage.rawImage,
+            edgeRuntimeImage.projectEnvValues,
+          ).pipe(Effect.mapError(withLegacyBundleSuggestion(slugs[0] ?? "", styleAqua))),
+        };
+
+  const downloaded: string[] = [];
+  // Absolute directory path per fully-downloaded slug, separate from
+  // `downloaded` (bare slugs): a caller upstream (`pull.aggregate.ts`'s
+  // `hasWrittenSoFar`) needs an on-disk path.
+  const downloadedPaths: string[] = [];
+  for (const slug of slugs) {
+    yield* Effect.gen(function* () {
+      // A user-supplied slug is already validated above; this covers
+      // slugs sourced from the Management API's function list, which is
+      // untrusted (a malicious/compromised response, or a MITM).
+      if (Option.isNone(flags.functionName)) {
+        yield* validateRemoteSlug(slug, styleAqua);
+      }
+      if (pulledEdgeRuntimeImage !== undefined) {
+        downloaded.push(
+          yield* downloadWithDockerUnbundle(dependencies, pulledEdgeRuntimeImage, projectRef, slug),
+        );
+      } else {
+        downloaded.push(yield* downloadSingle(dependencies, projectRef, slug));
+      }
+      downloadedPaths.push(path.resolve(dependencies.projectRoot, "supabase", "functions", slug));
+    }).pipe(
+      Effect.mapError((error) => attachDownloadWrittenSoFar(error, downloadedPaths)),
+      Effect.withSpan("functions.download.function"),
+    );
+  }
+
+  // The standalone `functionsDownload` handler emits the final summary;
+  // this only computes and returns the result.
+  return { projectRef, slugs: downloaded, empty: false };
+});
diff --git a/apps/cli/src/shared/functions/functions-config.ts b/apps/cli/src/shared/functions/functions-config.ts
index 62081757b6..77a20c5d41 100644
--- a/apps/cli/src/shared/functions/functions-config.ts
+++ b/apps/cli/src/shared/functions/functions-config.ts
@@ -1,5 +1,4 @@
-import { basename } from "node:path";
-import { Crypto, Effect, type FileSystem, type Path } from "effect";
+import { Crypto, Effect, type FileSystem, Path } from "effect";
 import type { RuntimeInfo } from "../runtime/runtime-info.service.ts";
 import type { LoadedCliConfig } from "@supabase/config/effect";
 import { loadCliConfig } from "@supabase/config/effect";
@@ -47,12 +46,16 @@ export interface FunctionsGoConfigCompat {
  * `goConfigCompat` run its dotenv/config-validate pipeline before any
  * Docker/API work; callers that don't fall back to `loadCliConfig`.
  */
-export const loadFunctionsCliConfig = Effect.fnUntraced(function* (input: {
+export const loadFunctionsCliConfig = Effect.fn("FunctionsConfig.load")(function* (input: {
   readonly projectRoot: string;
   readonly projectRef: string | undefined;
   readonly goConfigCompat: FunctionsGoConfigCompat | undefined;
 }) {
+  yield* Effect.annotateCurrentSpan({
+    "config.go_compat": input.goConfigCompat !== undefined,
+  });
   if (input.goConfigCompat === undefined) {
+    const path = yield* Path.Path;
     const loaded = yield* loadCliConfig(
       input.projectRoot,
       input.projectRef === undefined ? {} : { projectRef: input.projectRef },
@@ -64,7 +67,7 @@ export const loadFunctionsCliConfig = Effect.fnUntraced(function* (input: {
       // config lacks `project_id`. Sanitized because it also feeds Docker
       // label/resource names, where an unsanitized value breaks cleanup filters.
       projectId: normalizeProjectId(
-        loaded?.config.project_id ?? input.projectRef ?? basename(input.projectRoot),
+        loaded?.config.project_id ?? input.projectRef ?? path.basename(input.projectRoot),
       ),
       denoVersion: loaded?.config.edge_runtime.deno_version,
     } satisfies FunctionsCliConfigContext;
diff --git a/apps/cli/src/shared/functions/functions-docker.ts b/apps/cli/src/shared/functions/functions-docker.ts
index 7a3bce6de4..b31fa892ba 100644
--- a/apps/cli/src/shared/functions/functions-docker.ts
+++ b/apps/cli/src/shared/functions/functions-docker.ts
@@ -250,7 +250,7 @@ export function isUserDefinedDockerNetwork(networkMode: string) {
   );
 }
 
-export const ensureDockerNetwork = Effect.fnUntraced(function* (
+export const ensureDockerNetwork = Effect.fn("FunctionsDocker.ensureNetwork")(function* (
   networkMode: string,
   projectId: string,
 ) {
@@ -262,6 +262,7 @@ export const ensureDockerNetwork = Effect.fnUntraced(function* (
     stdout: "ignore",
     stderr: "ignore",
   }).pipe(Effect.orElseSucceed(() => ({ exitCode: 1, stdout: "", stderr: "" })));
+  yield* Effect.annotateCurrentSpan({ "docker.network.exists": inspect.exitCode === 0 });
   if (inspect.exitCode === 0) {
     return;
   }
@@ -288,7 +289,7 @@ export const ensureDockerNetwork = Effect.fnUntraced(function* (
   }
 });
 
-export const ensureDockerNamedVolume = Effect.fnUntraced(function* (
+export const ensureDockerNamedVolume = Effect.fn("FunctionsDocker.ensureVolume")(function* (
   volumeName: string,
   projectId: string,
   projectEnvValues?: Readonly<Record<string, string>>,
@@ -319,12 +320,14 @@ export const ensureDockerNamedVolume = Effect.fnUntraced(function* (
   }
 });
 
-export const isDockerRunning = Effect.fnUntraced(function* () {
+export const isDockerRunning = Effect.fn("FunctionsDocker.isRunning")(function* () {
   const result = yield* runChildProcess("docker", ["info"], {
     stdout: "ignore",
     stderr: "ignore",
   }).pipe(Effect.orElseSucceed(() => ({ exitCode: 1, stdout: "", stderr: "" })));
-  return result.exitCode === 0;
+  const running = result.exitCode === 0;
+  yield* Effect.annotateCurrentSpan({ "docker.running": running });
+  return running;
 });
 
 /**
@@ -357,12 +360,14 @@ export function resolveEdgeRuntimeVersion(
  * answered. Shared by every `functions` Docker path (`deploy`, `download`,
  * `serve`).
  */
-export const resolveFunctionsDockerImage = Effect.fnUntraced(function* (
+export const resolveFunctionsDockerImage = Effect.fn("FunctionsDocker.resolveImage")(function* (
   image: string,
   projectEnvValues?: Readonly<Record<string, string>>,
 ) {
   const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-  return yield* makeDockerImageResolver(spawner, projectEnvValues)(image);
+  const resolved = yield* makeDockerImageResolver(spawner, projectEnvValues)(image);
+  yield* Effect.annotateCurrentSpan({ "docker.image.resolved": resolved });
+  return resolved;
 });
 
 /** Retains native failure diagnostics while exposing a typed Effect failure. */
diff --git a/apps/cli/src/shared/functions/functions.shared.ts b/apps/cli/src/shared/functions/functions.shared.ts
index 2f691ac4ff..1ef1612fee 100644
--- a/apps/cli/src/shared/functions/functions.shared.ts
+++ b/apps/cli/src/shared/functions/functions.shared.ts
@@ -1,6 +1,4 @@
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
-import { Effect } from "effect";
+import { Effect, FileSystem, Path } from "effect";
 import { dockerfileServiceImageRaw } from "../services/dockerfile-images.ts";
 import { imageTag, slimImageForCurrentPin } from "../services/slim-images.ts";
 
@@ -45,11 +43,11 @@ export function edgeRuntimeImage(tag: string, slim: boolean): string {
  * resolves a Docker edge-runtime image.
  */
 export const resolveEdgeRuntimeVersionPin = Effect.fnUntraced(function* (supabaseDir: string) {
-  return yield* Effect.tryPromise(() =>
-    readFile(join(supabaseDir, ".temp", "edge-runtime-version"), "utf8"),
-  ).pipe(
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  return yield* fs.readFileString(path.join(supabaseDir, ".temp", "edge-runtime-version")).pipe(
     Effect.map((version) => version.trim()),
-    Effect.catch(() => Effect.succeed("")),
+    Effect.orElseSucceed(() => ""),
     Effect.map((version) => version || (imageTag(dockerfileServiceImageRaw("edgeruntime")) ?? "")),
   );
 });
diff --git a/apps/cli/src/shared/functions/functions.shared.unit.test.ts b/apps/cli/src/shared/functions/functions.shared.unit.test.ts
index 57e310bf51..6851ccc73e 100644
--- a/apps/cli/src/shared/functions/functions.shared.unit.test.ts
+++ b/apps/cli/src/shared/functions/functions.shared.unit.test.ts
@@ -1,5 +1,7 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { BunServices } from "@effect/platform-bun";
+import { afterEach, describe, expect, it } from "@effect/vitest";
 import { Effect } from "effect";
+import { vi } from "vitest";
 
 import { dockerfileServiceImageRaw } from "../services/dockerfile-images.ts";
 import {
@@ -38,10 +40,14 @@ describe("edgeRuntimeImage", () => {
 });
 
 describe("resolveEdgeRuntimeVersionPin", () => {
-  it("falls back to the Dockerfile tag, not the ghcr host, when slim is on and no pin file exists", async () => {
-    vi.stubEnv("SUPABASE_USE_SLIM_IMAGES", "true");
-    const tag = await Effect.runPromise(resolveEdgeRuntimeVersionPin("/no-such-supabase-dir"));
-    expect(tag).toBe(currentEdgeRuntimeTag);
-    expect(tag.includes("/")).toBe(false);
-  });
+  it.effect(
+    "falls back to the Dockerfile tag, not the ghcr host, when slim is on and no pin file exists",
+    () =>
+      Effect.gen(function* () {
+        vi.stubEnv("SUPABASE_USE_SLIM_IMAGES", "true");
+        const tag = yield* resolveEdgeRuntimeVersionPin("/no-such-supabase-dir");
+        expect(tag).toBe(currentEdgeRuntimeTag);
+        expect(tag.includes("/")).toBe(false);
+      }).pipe(Effect.provide(BunServices.layer)),
+  );
 });
diff --git a/apps/cli/src/shared/functions/serve-main-bundler.integration.test.ts b/apps/cli/src/shared/functions/serve-main-bundler.integration.test.ts
index bef3c5392a..ec046c2e75 100644
--- a/apps/cli/src/shared/functions/serve-main-bundler.integration.test.ts
+++ b/apps/cli/src/shared/functions/serve-main-bundler.integration.test.ts
@@ -1,5 +1,6 @@
 import { createContext, SourceTextModule } from "node:vm";
 import { describe, expect, it } from "@effect/vitest";
+import { Cause, Data, Deferred, Effect, Exit, Predicate, Schema, Scope } from "effect";
 import { exportJWK, generateKeyPair, SignJWT } from "jose";
 import { bundleServeMainTemplate } from "./serve-main-bundler.ts";
 
@@ -9,11 +10,14 @@ type ServeOptions = {
 };
 type FetchImplementation = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
 
-class InvalidWorkerCreation extends Error {}
-class InvalidWorkerResponse extends Error {}
-class WorkerRequestCancelled extends Error {}
-class NotFoundError extends Error {}
-class WorkerAlreadyRetired extends Error {}
+class InvalidWorkerCreation extends Data.Error {}
+class InvalidWorkerResponse extends Data.Error {}
+class WorkerRequestCancelled extends Data.Error {}
+class NotFoundError extends Data.Error {}
+class WorkerAlreadyRetired extends Data.Error {}
+class BootstrapLoadError extends Data.TaggedError("BootstrapLoadError")<{
+  readonly cause: unknown;
+}> {}
 
 type LoadOptions = {
   readonly errors?: Record<string, abstract new (...args: never[]) => Error>;
@@ -26,7 +30,9 @@ type LoadOptions = {
   readonly metricError?: unknown;
 };
 
-const load = async (
+const encodeJson = Schema.encodeEffect(Schema.fromJsonString(Schema.Unknown));
+
+const load = Effect.fnUntraced(function* (
   bundle: string,
   env: Record<string, string>,
   worker: Record<string, unknown>,
@@ -40,7 +46,7 @@ const load = async (
     lstatError,
     metricError,
   }: LoadOptions = {},
-) => {
+) {
   let options: ServeOptions | undefined;
   const state: { createOptions?: Record<string, unknown> } = {};
   const envRecord = { ...env };
@@ -48,10 +54,10 @@ const load = async (
     Deno: {
       env: { get: (name: string) => envRecord[name], toObject: () => envRecord },
       cwd: () => "/functions",
-      lstat: async () => {
-        if (lstatError !== undefined) throw lstatError;
-        return { isFile: true, isDirectory: false, isSymlink: false };
-      },
+      lstat: () =>
+        lstatError === undefined
+          ? Promise.resolve({ isFile: true, isDirectory: false, isSymlink: false })
+          : Promise.reject(lstatError),
       makeTempDirSync: () => "/tmp/worker",
       errors,
       version: { deno: "test" },
@@ -101,13 +107,22 @@ const load = async (
     context: createContext(sandbox),
     identifier: "cli-serve.main.bundle.js",
   });
-  await module.link(() => {
-    throw new Error("unexpected external import");
+  yield* Effect.tryPromise({
+    try: () =>
+      module.link(() => {
+        throw new Error("unexpected external import");
+      }),
+    catch: (cause) => new BootstrapLoadError({ cause }),
+  });
+  yield* Effect.tryPromise({
+    try: () => module.evaluate(),
+    catch: (cause) => new BootstrapLoadError({ cause }),
   });
-  await module.evaluate();
-  if (options === undefined) throw new Error("bootstrap did not register server");
+  if (options === undefined) {
+    return yield* new BootstrapLoadError({ cause: "bootstrap did not register server" });
+  }
   return { options, envRecord, state };
-};
+});
 
 const baseEnv = (config: string) => ({
   SUPABASE_INTERNAL_HOST_PORT: "8081",
@@ -117,163 +132,196 @@ const baseEnv = (config: string) => ({
   SUPABASE_INTERNAL_FUNCTIONS_ROOT: "/functions",
 });
 
+const okWorker = { fetch: () => Promise.resolve(new Response("ok")) };
+
 describe("CLI functions bootstrap bundle", () => {
-  it("fails startup for missing URL and malformed required config", async () => {
-    const bundle = await bundleServeMainTemplate();
-    const config = JSON.stringify({
-      hello: {
-        entrypointPath: "hello/index.ts",
-        importMapPath: "",
-        staticFiles: [],
-        verifyJWT: false,
-      },
-    });
-    await expect(
-      load(
-        bundle,
-        { ...baseEnv(config), SUPABASE_URL: "" },
-        { fetch: async () => new Response("ok") },
-      ),
-    ).rejects.toThrow();
-    await expect(
-      load(
-        bundle,
-        { ...baseEnv("{"), SUPABASE_INTERNAL_FUNCTIONS_CONFIG: "{" },
-        { fetch: async () => new Response("ok") },
-      ),
-    ).rejects.toThrow();
-  });
+  it.effect("fails startup for missing URL and malformed required config", () =>
+    Effect.gen(function* () {
+      const bundle = yield* bundleServeMainTemplate();
+      const config = yield* encodeJson({
+        hello: {
+          entrypointPath: "hello/index.ts",
+          importMapPath: "",
+          staticFiles: [],
+          verifyJWT: false,
+        },
+      });
+      const missingUrl = yield* Effect.exit(
+        load(bundle, { ...baseEnv(config), SUPABASE_URL: "" }, okWorker),
+      );
+      expect(Exit.isFailure(missingUrl)).toBe(true);
+      const malformedConfig = yield* Effect.exit(
+        load(bundle, { ...baseEnv("{"), SUPABASE_INTERNAL_FUNCTIONS_CONFIG: "{" }, okWorker),
+      );
+      expect(Exit.isFailure(malformedConfig)).toBe(true);
+    }),
+  );
 
-  it("authenticates and forwards request, environment, and worker options", async () => {
-    const bundle = await bundleServeMainTemplate();
-    const config = JSON.stringify({
-      hello: {
-        entrypointPath: "hello/index.ts",
-        importMapPath: "",
-        staticFiles: [],
-        verifyJWT: true,
-        env: { FUNCTION_ONLY: "yes", SUPABASE_BLOCKED: "no" },
-      },
-    });
-    let received: Request | undefined;
-    const loaded = await load(
-      bundle,
-      { ...baseEnv(config), KEEP: "yes", HOME: "hidden", SUPABASE_INTERNAL_SECRET_KEY: "internal" },
-      {
-        fetch: async (request: Request) => {
-          received = request;
-          return new Response(request.body);
+  it.effect("authenticates and forwards request, environment, and worker options", () =>
+    Effect.gen(function* () {
+      const bundle = yield* bundleServeMainTemplate();
+      const config = yield* encodeJson({
+        hello: {
+          entrypointPath: "hello/index.ts",
+          importMapPath: "",
+          staticFiles: [],
+          verifyJWT: true,
+          env: { FUNCTION_ONLY: "yes", SUPABASE_BLOCKED: "no" },
         },
-      },
-    );
-    const token = await new SignJWT({ sub: "test" })
-      .setProtectedHeader({ alg: "HS256" })
-      .sign(new TextEncoder().encode("secret"));
-    const response = await loaded.options.handler(
-      new Request("http://localhost/hello", {
-        method: "POST",
-        body: "body",
-        headers: { Authorization: `Bearer ${token}`, "sb-api-key": "remove", "x-tag": "tag" },
-      }),
-    );
-    expect(response.status).toBe(200);
-    expect(received?.headers.get("sb-api-key")).toBeNull();
-    expect(received?.headers.get("x-tag")).toBe("tag");
-    expect(await response.text()).toBe("body");
-    expect(loaded.state.createOptions?.envVars).toEqual(
-      expect.arrayContaining([
-        ["KEEP", "yes"],
-        ["FUNCTION_ONLY", "yes"],
-      ]),
-    );
-  });
+      });
+      let received: Request | undefined;
+      const loaded = yield* load(
+        bundle,
+        {
+          ...baseEnv(config),
+          KEEP: "yes",
+          HOME: "hidden",
+          SUPABASE_INTERNAL_SECRET_KEY: "internal",
+        },
+        {
+          fetch: (request: Request) => {
+            received = request;
+            return Promise.resolve(new Response(request.body));
+          },
+        },
+      );
+      const token = yield* Effect.promise(() =>
+        new SignJWT({ sub: "test" })
+          .setProtectedHeader({ alg: "HS256" })
+          .sign(new TextEncoder().encode("secret")),
+      );
+      const response = yield* Effect.promise(() =>
+        loaded.options.handler(
+          new Request("http://localhost/hello", {
+            method: "POST",
+            body: "body",
+            headers: { Authorization: `Bearer ${token}`, "sb-api-key": "remove", "x-tag": "tag" },
+          }),
+        ),
+      );
+      expect(response.status).toBe(200);
+      expect(received?.headers.get("sb-api-key")).toBeNull();
+      expect(received?.headers.get("x-tag")).toBe("tag");
+      expect(yield* Effect.promise(() => response.text())).toBe("body");
+      expect(loaded.state.createOptions?.envVars).toEqual(
+        expect.arrayContaining([
+          ["KEEP", "yes"],
+          ["FUNCTION_ONLY", "yes"],
+        ]),
+      );
+    }),
+  );
 
-  it("rejects an invalid token", async () => {
-    const bundle = await bundleServeMainTemplate();
-    const config = JSON.stringify({
-      hello: {
-        entrypointPath: "hello/index.ts",
-        importMapPath: "",
-        staticFiles: [],
-        verifyJWT: true,
-      },
-    });
-    const loaded = await load(bundle, baseEnv(config), {
-      fetch: async () => new Response("should not run"),
-    });
-    const response = await loaded.options.handler(
-      new Request("http://localhost/hello", { headers: { Authorization: "Bearer invalid" } }),
-    );
-    expect(response.status).toBe(401);
-    expect(await response.json()).toMatchObject({ code: "UNAUTHORIZED_INVALID_JWT_FORMAT" });
-  });
+  it.effect("rejects an invalid token", () =>
+    Effect.gen(function* () {
+      const bundle = yield* bundleServeMainTemplate();
+      const config = yield* encodeJson({
+        hello: {
+          entrypointPath: "hello/index.ts",
+          importMapPath: "",
+          staticFiles: [],
+          verifyJWT: true,
+        },
+      });
+      const loaded = yield* load(bundle, baseEnv(config), {
+        fetch: () => Promise.resolve(new Response("should not run")),
+      });
+      const response = yield* Effect.promise(() =>
+        loaded.options.handler(
+          new Request("http://localhost/hello", { headers: { Authorization: "Bearer invalid" } }),
+        ),
+      );
+      expect(response.status).toBe(401);
+      expect(yield* Effect.promise(() => response.json())).toMatchObject({
+        code: "UNAUTHORIZED_INVALID_JWT_FORMAT",
+      });
+    }),
+  );
 
-  it("retains non-abort handler failures", async () => {
-    const bundle = await bundleServeMainTemplate();
-    const metricError = new Error("metrics unavailable");
-    const loaded = await load(
-      bundle,
-      baseEnv("{}"),
-      { fetch: async () => new Response("ok") },
-      {
+  it.effect("retains non-abort handler failures", () =>
+    Effect.gen(function* () {
+      const bundle = yield* bundleServeMainTemplate();
+      const metricError = new Error("metrics unavailable");
+      const loaded = yield* load(bundle, baseEnv("{}"), okWorker, {
         metricError,
-      },
-    );
-    const failure = await loaded.options
-      .handler(new Request("http://localhost/_internal/metric"))
-      .catch((error) => error);
-    expect(failure).toMatchObject({ _tag: "BootstrapOperationError", cause: metricError });
-  });
+      });
+      const exit = yield* Effect.exit(
+        Effect.promise(() =>
+          loaded.options.handler(new Request("http://localhost/_internal/metric")),
+        ),
+      );
+      const failure = Exit.isFailure(exit) ? Cause.squash(exit.cause) : undefined;
+      expect(Predicate.isTagged(failure, "BootstrapOperationError")).toBe(true);
+      expect(failure).toMatchObject({ cause: metricError });
+    }),
+  );
 
-  it.each([
-    [InvalidWorkerCreation, 503, "BOOT_ERROR"],
-    [InvalidWorkerResponse, 500, "WORKER_ERROR"],
-    [WorkerRequestCancelled, 546, "WORKER_LIMIT"],
-  ] as const)("maps %s worker failure to the runtime response", async (ErrorType, status, code) => {
-    const bundle = await bundleServeMainTemplate();
-    const config = JSON.stringify({
-      hello: {
-        entrypointPath: "hello/index.ts",
-        importMapPath: "",
-        staticFiles: ["public/**"],
-        verifyJWT: false,
-      },
-    });
-    const failure = new ErrorType();
-    const loaded = await load(
-      bundle,
-      baseEnv(config),
-      {
-        fetch: async () => {
-          throw failure;
+  it.effect.each([
+    {
+      name: "InvalidWorkerCreation",
+      ErrorType: InvalidWorkerCreation,
+      status: 503,
+      code: "BOOT_ERROR",
+    },
+    {
+      name: "InvalidWorkerResponse",
+      ErrorType: InvalidWorkerResponse,
+      status: 500,
+      code: "WORKER_ERROR",
+    },
+    {
+      name: "WorkerRequestCancelled",
+      ErrorType: WorkerRequestCancelled,
+      status: 546,
+      code: "WORKER_LIMIT",
+    },
+  ])("maps $name worker failure to the runtime response", ({ ErrorType, status, code }) =>
+    Effect.gen(function* () {
+      const bundle = yield* bundleServeMainTemplate();
+      const config = yield* encodeJson({
+        hello: {
+          entrypointPath: "hello/index.ts",
+          importMapPath: "",
+          staticFiles: ["public/**"],
+          verifyJWT: false,
         },
-      },
-      {
-        errors: { InvalidWorkerCreation, InvalidWorkerResponse, WorkerRequestCancelled },
-        creationError: ErrorType === InvalidWorkerCreation ? failure : undefined,
-      },
-    );
-    const response = await loaded.options.handler(new Request("http://localhost/hello"));
-    expect(response.status).toBe(status);
-    expect(await response.json()).toMatchObject({ code });
-  });
+      });
+      const failure = new ErrorType();
+      const loaded = yield* load(
+        bundle,
+        baseEnv(config),
+        {
+          fetch: () => Promise.reject(failure),
+        },
+        {
+          errors: { InvalidWorkerCreation, InvalidWorkerResponse, WorkerRequestCancelled },
+          creationError: ErrorType === InvalidWorkerCreation ? failure : undefined,
+        },
+      );
+      const response = yield* Effect.promise(() =>
+        loaded.options.handler(new Request("http://localhost/hello")),
+      );
+      expect(response.status).toBe(status);
+      expect(yield* Effect.promise(() => response.json())).toMatchObject({ code });
+    }),
+  );
 
   describe("retired worker dispatch", () => {
-    const config = JSON.stringify({
+    const config = {
       hello: {
         entrypointPath: "hello/index.ts",
         importMapPath: "",
         staticFiles: [],
         verifyJWT: false,
       },
-    });
+    };
     // Every create() hands out a distinct worker: worker n always rejects with failures[n - 1] when
     // one is given, otherwise it answers with its own number so the response names the worker.
-    const serve = async (failures: ReadonlyArray<Error>) => {
+    const serve = Effect.fnUntraced(function* (failures: ReadonlyArray<Error>) {
       let creates = 0;
-      const loaded = await load(
-        await bundleServeMainTemplate(),
-        baseEnv(config),
+      const loaded = yield* load(
+        yield* bundleServeMainTemplate(),
+        baseEnv(yield* encodeJson(config)),
         {},
         {
           errors: { WorkerAlreadyRetired, InvalidWorkerResponse },
@@ -281,54 +329,76 @@ describe("CLI functions bootstrap bundle", () => {
             const worker = ++creates;
             const failure = failures[worker - 1];
             return {
-              fetch: async (request: Request) => {
-                if (failure !== undefined) throw failure;
-                return new Response(
-                  `fn-ok worker-${worker} ${request.method} ${await request.text()}`,
-                );
-              },
+              fetch: (request: Request) =>
+                failure !== undefined
+                  ? Promise.reject(failure)
+                  : request
+                      .text()
+                      .then(
+                        (text) => new Response(`fn-ok worker-${worker} ${request.method} ${text}`),
+                      ),
             };
           },
         },
       );
       return { loaded, creates: () => creates };
-    };
-
-    it("serves a bodyless request with a fresh worker after WorkerAlreadyRetired", async () => {
-      const { loaded, creates } = await serve([new WorkerAlreadyRetired()]);
-      const response = await loaded.options.handler(new Request("http://localhost/hello"));
-      expect(response.status).toBe(200);
-      expect(await response.text()).toBe("fn-ok worker-2 GET ");
-      expect(creates()).toBe(2);
     });
 
-    it("does not retry a second consecutive WorkerAlreadyRetired", async () => {
-      const { loaded, creates } = await serve([
-        new WorkerAlreadyRetired(),
-        new WorkerAlreadyRetired(),
-      ]);
-      const response = await loaded.options.handler(new Request("http://localhost/hello"));
-      expect(response.status).toBe(500);
-      expect(creates()).toBe(2);
-    });
+    it.effect("serves a bodyless request with a fresh worker after WorkerAlreadyRetired", () =>
+      Effect.gen(function* () {
+        const { loaded, creates } = yield* serve([new WorkerAlreadyRetired()]);
+        const response = yield* Effect.promise(() =>
+          loaded.options.handler(new Request("http://localhost/hello")),
+        );
+        expect(response.status).toBe(200);
+        expect(yield* Effect.promise(() => response.text())).toBe("fn-ok worker-2 GET ");
+        expect(creates()).toBe(2);
+      }),
+    );
 
-    it("does not retry other worker failures", async () => {
-      const { loaded, creates } = await serve([new InvalidWorkerResponse()]);
-      const response = await loaded.options.handler(new Request("http://localhost/hello"));
-      expect(response.status).toBe(500);
-      expect(await response.json()).toMatchObject({ code: "WORKER_ERROR" });
-      expect(creates()).toBe(1);
-    });
+    it.effect("does not retry a second consecutive WorkerAlreadyRetired", () =>
+      Effect.gen(function* () {
+        const { loaded, creates } = yield* serve([
+          new WorkerAlreadyRetired(),
+          new WorkerAlreadyRetired(),
+        ]);
+        const response = yield* Effect.promise(() =>
+          loaded.options.handler(new Request("http://localhost/hello")),
+        );
+        expect(response.status).toBe(500);
+        expect(creates()).toBe(2);
+      }),
+    );
 
-    it("does not replay a request whose body was already forwarded", async () => {
-      const { loaded, creates } = await serve([new WorkerAlreadyRetired()]);
-      const response = await loaded.options.handler(
-        new Request("http://localhost/hello", { method: "POST", body: "payload" }),
-      );
-      expect(response.status).toBe(500);
-      expect(await response.json()).toMatchObject({ code: "Internal Server Error" });
-      expect(creates()).toBe(1);
-    });
+    it.effect("does not retry other worker failures", () =>
+      Effect.gen(function* () {
+        const { loaded, creates } = yield* serve([new InvalidWorkerResponse()]);
+        const response = yield* Effect.promise(() =>
+          loaded.options.handler(new Request("http://localhost/hello")),
+        );
+        expect(response.status).toBe(500);
+        expect(yield* Effect.promise(() => response.json())).toMatchObject({
+          code: "WORKER_ERROR",
+        });
+        expect(creates()).toBe(1);
+      }),
+    );
+
+    it.effect("does not replay a request whose body was already forwarded", () =>
+      Effect.gen(function* () {
+        const { loaded, creates } = yield* serve([new WorkerAlreadyRetired()]);
+        const response = yield* Effect.promise(() =>
+          loaded.options.handler(
+            new Request("http://localhost/hello", { method: "POST", body: "payload" }),
+          ),
+        );
+        expect(response.status).toBe(500);
+        expect(yield* Effect.promise(() => response.json())).toMatchObject({
+          code: "Internal Server Error",
+        });
+        expect(creates()).toBe(1);
+      }),
+    );
   });
 
   describe("request body ownership", () => {
@@ -352,222 +422,267 @@ describe("CLI functions bootstrap bundle", () => {
       return { body, progress };
     };
     const functionConfig = (verifyJWT: boolean) =>
-      JSON.stringify({
+      encodeJson({
         hello: { entrypointPath: "hello/index.ts", importMapPath: "", staticFiles: [], verifyJWT },
       });
 
-    it("reads the rest of a request body the worker abandons", async () => {
-      const loaded = await load(await bundleServeMainTemplate(), baseEnv(functionConfig(false)), {
-        fetch: async (request: Request) => {
-          const reader = request.body?.getReader();
-          await reader?.read();
-          // Not awaited: if the body were shared with the incoming request again, Bun
-          // would never settle this cancel and the test would hang instead of failing.
-          void reader?.cancel();
-          return new Response("rejected", { status: 400 });
-        },
-      });
-      const { body, progress } = upload();
+    it.effect("reads the rest of a request body the worker abandons", () =>
+      Effect.gen(function* () {
+        const loaded = yield* load(
+          yield* bundleServeMainTemplate(),
+          baseEnv(yield* functionConfig(false)),
+          {
+            fetch: (request: Request) => {
+              const reader = request.body?.getReader();
+              return Promise.resolve(reader?.read()).then(() => {
+                // Not awaited: if the body were shared with the incoming request again, Bun
+                // would never settle this cancel and the test would hang instead of failing.
+                void reader?.cancel();
+                return new Response("rejected", { status: 400 });
+              });
+            },
+          },
+        );
+        const { body, progress } = upload();
 
-      const response = await loaded.options.handler(
-        new Request("http://localhost/hello", { method: "POST", body, duplex: "half" }),
-      );
+        const response = yield* Effect.promise(() =>
+          loaded.options.handler(
+            new Request("http://localhost/hello", { method: "POST", body, duplex: "half" }),
+          ),
+        );
 
-      expect(progress).toEqual({ readToEnd: true, cancelled: false });
-      expect(response.status).toBe(400);
-      expect(await response.text()).toBe("rejected");
-    });
+        expect(progress).toEqual({ readToEnd: true, cancelled: false });
+        expect(response.status).toBe(400);
+        expect(yield* Effect.promise(() => response.text())).toBe("rejected");
+      }),
+    );
 
-    it("settles an aborted request while the abandoned body read is pending", async () => {
-      const { promise: readPending, resolve: markReadPending } = Promise.withResolvers<void>();
-      const pendingRead = Promise.withResolvers<void>().promise;
-      let pulls = 0;
-      const body = new ReadableStream<Uint8Array>({
-        pull: (streamController) => {
-          pulls += 1;
-          if (pulls === 1) {
-            streamController.enqueue(new Uint8Array([1]));
-            return;
-          }
-          markReadPending();
-          return pendingRead;
-        },
-      });
-      const loaded = await load(await bundleServeMainTemplate(), baseEnv(functionConfig(false)), {
-        fetch: async () => new Response("worker should not run"),
-      });
-      const controller = new AbortController();
-      const pending = loaded.options.handler(
-        new Request("http://localhost/missing", {
-          method: "POST",
-          body,
-          duplex: "half",
-          signal: controller.signal,
-        }),
-      );
+    it.effect("settles an aborted request while the abandoned body read is pending", () =>
+      Effect.gen(function* () {
+        const readPending = yield* Deferred.make<void>();
+        const hungRead = yield* Deferred.make<void>();
+        yield* Effect.addFinalizer(() => Deferred.interrupt(hungRead));
+        const pendingRead = Effect.runPromiseWith(yield* Effect.context<never>())(
+          Deferred.await(hungRead),
+        );
+        let pulls = 0;
+        const body = new ReadableStream<Uint8Array>({
+          pull: (streamController) => {
+            pulls += 1;
+            if (pulls === 1) {
+              streamController.enqueue(new Uint8Array([1]));
+              return;
+            }
+            Deferred.doneUnsafe(readPending, Effect.void);
+            return pendingRead;
+          },
+        });
+        const loaded = yield* load(
+          yield* bundleServeMainTemplate(),
+          baseEnv(yield* functionConfig(false)),
+          {
+            fetch: () => Promise.resolve(new Response("worker should not run")),
+          },
+        );
+        const requestScope = yield* Scope.fork(yield* Effect.scope);
+        const signal = yield* Scope.provide(Effect.abortSignal, requestScope);
+        const pending = loaded.options.handler(
+          new Request("http://localhost/missing", {
+            method: "POST",
+            body,
+            duplex: "half",
+            signal,
+          }),
+        );
 
-      await readPending;
-      controller.abort();
+        yield* Deferred.await(readPending);
+        yield* Scope.close(requestScope, Exit.void);
 
-      await expect(pending).resolves.toMatchObject({ status: 499 });
-    });
+        expect(yield* Effect.promise(() => pending)).toMatchObject({ status: 499 });
+      }),
+    );
 
-    it.each([
+    it.effect.each([
       ["an invalid token", "/hello", 401],
       ["an unknown function", "/missing", 404],
-    ] as const)("reads the whole upload before rejecting %s", async (_, path, status) => {
-      const loaded = await load(await bundleServeMainTemplate(), baseEnv(functionConfig(true)), {
-        fetch: async () => new Response("should not run"),
-      });
-      const { body, progress } = upload();
-
-      const response = await loaded.options.handler(
-        new Request(`http://localhost${path}`, {
-          method: "POST",
-          body,
-          duplex: "half",
-          headers: { Authorization: "Bearer invalid" },
-        }),
-      );
+    ] as const)("reads the whole upload before rejecting %s", ([, path, status]) =>
+      Effect.gen(function* () {
+        const loaded = yield* load(
+          yield* bundleServeMainTemplate(),
+          baseEnv(yield* functionConfig(true)),
+          {
+            fetch: () => Promise.resolve(new Response("should not run")),
+          },
+        );
+        const { body, progress } = upload();
 
-      expect(progress).toEqual({ readToEnd: true, cancelled: false });
-      expect(response.status).toBe(status);
-    });
-  });
+        const response = yield* Effect.promise(() =>
+          loaded.options.handler(
+            new Request(`http://localhost${path}`, {
+              method: "POST",
+              body,
+              duplex: "half",
+              headers: { Authorization: "Bearer invalid" },
+            }),
+          ),
+        );
 
-  it("does not fetch after an aborted pending worker creation", async () => {
-    const bundle = await bundleServeMainTemplate();
-    const config = JSON.stringify({
-      hello: {
-        entrypointPath: "hello/index.ts",
-        importMapPath: "",
-        staticFiles: [],
-        verifyJWT: false,
-      },
-    });
-    let fetchCalls = 0;
-    let resolveCreation!: (worker: { fetch(request: Request): Promise<Response> }) => void;
-    const workerReady = new Promise<{ fetch(request: Request): Promise<Response> }>((resolve) => {
-      resolveCreation = resolve;
-    });
-    let createInvoked!: () => void;
-    const createCalled = new Promise<void>((resolve) => {
-      createInvoked = resolve;
-    });
-    const loaded = await load(
-      bundle,
-      baseEnv(config),
-      {
-        fetch: async () => {
-          fetchCalls += 1;
-          return new Response("unreachable");
-        },
-      },
-      { onCreate: createInvoked, creation: workerReady },
-    );
-    const controller = new AbortController();
-    const pending = loaded.options.handler(
-      new Request("http://localhost/hello", { signal: controller.signal }),
+        expect(progress).toEqual({ readToEnd: true, cancelled: false });
+        expect(response.status).toBe(status);
+      }),
     );
-    await createCalled;
-    controller.abort();
-    await expect(pending).resolves.toMatchObject({ status: 499 });
-    resolveCreation({
-      fetch: async () => {
-        fetchCalls += 1;
-        return new Response("unreachable");
-      },
-    });
-    await workerReady;
-    expect(fetchCalls).toBe(0);
   });
 
-  it("authenticates ES256 with injected keys and owned remote fallback", async () => {
-    const { publicKey, privateKey } = await generateKeyPair("ES256");
-    const publicJwk = await exportJWK(publicKey);
-    const token = await new SignJWT({ sub: "test" })
-      .setProtectedHeader({ alg: "ES256", kid: "test-key" })
-      .sign(privateKey);
-    const config = JSON.stringify({
-      hello: {
-        entrypointPath: "hello/index.ts",
-        importMapPath: "",
-        staticFiles: [],
-        verifyJWT: true,
-      },
-    });
-    const bundle = await bundleServeMainTemplate();
-    const worker = { fetch: async () => new Response("ok") };
-    const injected = await load(
-      bundle,
-      {
-        ...baseEnv(config),
-        SUPABASE_JWKS: JSON.stringify({
-          keys: [{ ...publicJwk, kid: "test-key", alg: "ES256", use: "sig" }],
-        }),
-      },
-      worker,
-    );
-    const injectedResponse = await injected.options.handler(
-      new Request("http://localhost/hello", { headers: { Authorization: `Bearer ${token}` } }),
-    );
-    expect(injectedResponse.status).toBe(200);
-
-    for (const jwks of [undefined, "{"] as const) {
+  it.effect("does not fetch after an aborted pending worker creation", () =>
+    Effect.gen(function* () {
+      const bundle = yield* bundleServeMainTemplate();
+      const config = yield* encodeJson({
+        hello: {
+          entrypointPath: "hello/index.ts",
+          importMapPath: "",
+          staticFiles: [],
+          verifyJWT: false,
+        },
+      });
+      const runPromise = Effect.runPromiseWith(yield* Effect.context<never>());
       let fetchCalls = 0;
-      const remote = await load(
+      const workerCreation = yield* Deferred.make<{ fetch(request: Request): Promise<Response> }>();
+      yield* Effect.addFinalizer(() => Deferred.interrupt(workerCreation));
+      const createCalled = yield* Deferred.make<void>();
+      const workerReady = runPromise(Deferred.await(workerCreation));
+      const loaded = yield* load(
         bundle,
+        baseEnv(config),
         {
-          ...baseEnv(config),
-          ...(jwks === undefined ? {} : { SUPABASE_JWKS: jwks }),
+          fetch: () => {
+            fetchCalls += 1;
+            return Promise.resolve(new Response("unreachable"));
+          },
         },
-        worker,
         {
-          fetchImpl: async () => {
-            fetchCalls += 1;
-            return new Response(
-              JSON.stringify({
-                keys: [{ ...publicJwk, kid: "test-key", alg: "ES256", use: "sig" }],
-              }),
-              { headers: { "content-type": "application/json" } },
-            );
+          onCreate: () => {
+            Deferred.doneUnsafe(createCalled, Effect.void);
           },
+          creation: workerReady,
         },
       );
-      const remoteResponse = await remote.options.handler(
-        new Request("http://localhost/hello", { headers: { Authorization: `Bearer ${token}` } }),
+      const requestScope = yield* Scope.fork(yield* Effect.scope);
+      const signal = yield* Scope.provide(Effect.abortSignal, requestScope);
+      const pending = loaded.options.handler(new Request("http://localhost/hello", { signal }));
+      yield* Deferred.await(createCalled);
+      yield* Scope.close(requestScope, Exit.void);
+      expect(yield* Effect.promise(() => pending)).toMatchObject({ status: 499 });
+      yield* Deferred.succeed(workerCreation, {
+        fetch: () => {
+          fetchCalls += 1;
+          return Promise.resolve(new Response("unreachable"));
+        },
+      });
+      yield* Effect.promise(() => workerReady);
+      expect(fetchCalls).toBe(0);
+    }),
+  );
+
+  it.effect("authenticates ES256 with injected keys and owned remote fallback", () =>
+    Effect.gen(function* () {
+      const { publicKey, privateKey } = yield* Effect.promise(() => generateKeyPair("ES256"));
+      const publicJwk = yield* Effect.promise(() => exportJWK(publicKey));
+      const token = yield* Effect.promise(() =>
+        new SignJWT({ sub: "test" })
+          .setProtectedHeader({ alg: "ES256", kid: "test-key" })
+          .sign(privateKey),
       );
-      expect(remoteResponse.status).toBe(200);
-      const secondResponse = await remote.options.handler(
-        new Request("http://localhost/hello", { headers: { Authorization: `Bearer ${token}` } }),
+      const config = yield* encodeJson({
+        hello: {
+          entrypointPath: "hello/index.ts",
+          importMapPath: "",
+          staticFiles: [],
+          verifyJWT: true,
+        },
+      });
+      const keys = yield* encodeJson({
+        keys: [{ ...publicJwk, kid: "test-key", alg: "ES256", use: "sig" }],
+      });
+      const bundle = yield* bundleServeMainTemplate();
+      const injected = yield* load(
+        bundle,
+        {
+          ...baseEnv(config),
+          SUPABASE_JWKS: keys,
+        },
+        okWorker,
       );
-      expect(secondResponse.status).toBe(200);
-      expect(fetchCalls).toBe(1);
-    }
-  });
+      const injectedResponse = yield* Effect.promise(() =>
+        injected.options.handler(
+          new Request("http://localhost/hello", { headers: { Authorization: `Bearer ${token}` } }),
+        ),
+      );
+      expect(injectedResponse.status).toBe(200);
 
-  it("uses package discovery when package.json is present or lstat reports NotFound", async () => {
-    const bundle = await bundleServeMainTemplate();
-    const config = JSON.stringify({
-      hello: {
-        entrypointPath: "hello/index.ts",
-        importMapPath: "",
-        staticFiles: [],
-        verifyJWT: false,
-      },
-    });
-    const worker = { fetch: async () => new Response("ok") };
-    const permissionFailure = await load(bundle, baseEnv(config), worker, {
-      lstatError: new Error("permission denied"),
-    });
-    await permissionFailure.options.handler(new Request("http://localhost/hello"));
-    expect(permissionFailure.state.createOptions?.noNpm).toBe(false);
+      for (const jwks of [undefined, "{"] as const) {
+        let fetchCalls = 0;
+        const remote = yield* load(
+          bundle,
+          {
+            ...baseEnv(config),
+            ...(jwks === undefined ? {} : { SUPABASE_JWKS: jwks }),
+          },
+          okWorker,
+          {
+            fetchImpl: () => {
+              fetchCalls += 1;
+              return Promise.resolve(
+                new Response(keys, { headers: { "content-type": "application/json" } }),
+              );
+            },
+          },
+        );
+        const remoteResponse = yield* Effect.promise(() =>
+          remote.options.handler(
+            new Request("http://localhost/hello", {
+              headers: { Authorization: `Bearer ${token}` },
+            }),
+          ),
+        );
+        expect(remoteResponse.status).toBe(200);
+        const secondResponse = yield* Effect.promise(() =>
+          remote.options.handler(
+            new Request("http://localhost/hello", {
+              headers: { Authorization: `Bearer ${token}` },
+            }),
+          ),
+        );
+        expect(secondResponse.status).toBe(200);
+        expect(fetchCalls).toBe(1);
+      }
+    }),
+  );
 
-    const missing = await load(bundle, baseEnv(config), worker, {
-      errors: { NotFound: NotFoundError },
-      lstatError: new NotFoundError(),
-    });
-    await missing.options.handler(new Request("http://localhost/hello"));
-    expect(missing.state.createOptions?.noNpm).toBe(true);
-  });
+  it.effect("uses package discovery when package.json is present or lstat reports NotFound", () =>
+    Effect.gen(function* () {
+      const bundle = yield* bundleServeMainTemplate();
+      const config = yield* encodeJson({
+        hello: {
+          entrypointPath: "hello/index.ts",
+          importMapPath: "",
+          staticFiles: [],
+          verifyJWT: false,
+        },
+      });
+      const permissionFailure = yield* load(bundle, baseEnv(config), okWorker, {
+        lstatError: new Error("permission denied"),
+      });
+      yield* Effect.promise(() =>
+        permissionFailure.options.handler(new Request("http://localhost/hello")),
+      );
+      expect(permissionFailure.state.createOptions?.noNpm).toBe(false);
+
+      const missing = yield* load(bundle, baseEnv(config), okWorker, {
+        errors: { NotFound: NotFoundError },
+        lstatError: new NotFoundError(),
+      });
+      yield* Effect.promise(() => missing.options.handler(new Request("http://localhost/hello")));
+      expect(missing.state.createOptions?.noNpm).toBe(true);
+    }),
+  );
 });
diff --git a/apps/cli/src/shared/functions/serve-main-bundler.ts b/apps/cli/src/shared/functions/serve-main-bundler.ts
index 4572e7b206..930515c70c 100644
--- a/apps/cli/src/shared/functions/serve-main-bundler.ts
+++ b/apps/cli/src/shared/functions/serve-main-bundler.ts
@@ -1,5 +1,6 @@
 import { fileURLToPath } from "node:url";
 
+import { Effect } from "effect";
 import { build } from "esbuild";
 
 /**
@@ -18,21 +19,25 @@ const serveMainEntrypoint = fileURLToPath(new URL("./serve.main.ts", import.meta
  * `platform: "browser"` selects `jose`'s Web Crypto build for the
  * edge-runtime's Deno; `Deno` and `EdgeRuntime` are left as free globals.
  */
-export async function bundleServeMainTemplate(): Promise<string> {
-  const result = await build({
-    entryPoints: [serveMainEntrypoint],
-    bundle: true,
-    format: "esm",
-    platform: "browser",
-    minify: true,
-    write: false,
-    legalComments: "none",
-    logLevel: "silent",
-  });
+export const bundleServeMainTemplate = Effect.fnUntraced(function* () {
+  const result = yield* Effect.promise(() =>
+    build({
+      entryPoints: [serveMainEntrypoint],
+      bundle: true,
+      format: "esm",
+      platform: "browser",
+      minify: true,
+      write: false,
+      legalComments: "none",
+      logLevel: "silent",
+    }),
+  );
 
   const output = result.outputFiles[0]?.text;
   if (output === undefined) {
-    throw new Error("esbuild produced no output for the functions serve runtime template");
+    return yield* Effect.die(
+      new Error("esbuild produced no output for the functions serve runtime template"),
+    );
   }
   return output;
-}
+});
diff --git a/apps/cli/src/shared/functions/serve-main-bundler.unit.test.ts b/apps/cli/src/shared/functions/serve-main-bundler.unit.test.ts
index 2779e430b3..6e76c8c09d 100644
--- a/apps/cli/src/shared/functions/serve-main-bundler.unit.test.ts
+++ b/apps/cli/src/shared/functions/serve-main-bundler.unit.test.ts
@@ -1,24 +1,29 @@
-import { describe, expect, it } from "vitest";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect } from "effect";
 
 import { bundleServeMainTemplate } from "./serve-main-bundler.ts";
 
 describe("bundleServeMainTemplate", () => {
-  it("produces a self-contained runtime template with no remote import specifiers", async () => {
-    const bundled = await bundleServeMainTemplate();
+  it.effect("produces a self-contained runtime template with no remote import specifiers", () =>
+    Effect.gen(function* () {
+      const bundled = yield* bundleServeMainTemplate();
 
-    // The offline failure (#45570) was caused by these being resolved over the
-    // network on every container start. They must be inlined into the bundle.
-    expect(bundled).not.toMatch(/(?:from|import)\s*["']https?:/);
-    expect(bundled).not.toContain("jsr:");
-    expect(bundled).not.toMatch(/from\s*["']jose["']/);
-  });
+      // The offline failure (#45570) was caused by these being resolved over the
+      // network on every container start. They must be inlined into the bundle.
+      expect(bundled).not.toMatch(/(?:from|import)\s*["']https?:/);
+      expect(bundled).not.toContain("jsr:");
+      expect(bundled).not.toMatch(/from\s*["']jose["']/);
+    }),
+  );
 
-  it("preserves the template's Deno.serve entrypoint and inlines jose", async () => {
-    const bundled = await bundleServeMainTemplate();
+  it.effect("preserves the template's Deno.serve entrypoint and inlines jose", () =>
+    Effect.gen(function* () {
+      const bundled = yield* bundleServeMainTemplate();
 
-    // Template body survives bundling (Deno global left as a free reference).
-    expect(bundled).toContain("Deno.serve");
-    // jose is inlined, so the bundle is materially larger than the ~12KB template.
-    expect(bundled.length).toBeGreaterThan(20_000);
-  });
+      // Template body survives bundling (Deno global left as a free reference).
+      expect(bundled).toContain("Deno.serve");
+      // jose is inlined, so the bundle is materially larger than the ~12KB template.
+      expect(bundled.length).toBeGreaterThan(20_000);
+    }),
+  );
 });
diff --git a/apps/cli/src/shared/functions/serve-main-offline.e2e.test.ts b/apps/cli/src/shared/functions/serve-main-offline.e2e.test.ts
index b83d3ae5e0..a98313fd90 100644
--- a/apps/cli/src/shared/functions/serve-main-offline.e2e.test.ts
+++ b/apps/cli/src/shared/functions/serve-main-offline.e2e.test.ts
@@ -1,11 +1,22 @@
-import { execFile, execSync, spawnSync } from "node:child_process";
-import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { promisify } from "node:util";
-
-import { Effect } from "effect";
-import { describe, expect, test } from "vitest";
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import {
+  Clock,
+  Data,
+  Duration,
+  Effect,
+  FileSystem,
+  Layer,
+  Path,
+  Predicate,
+  Ref,
+  Result,
+  Schedule,
+  Stream,
+} from "effect";
+import { FetchHttpClient, HttpBody, HttpClient } from "effect/unstable/http";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
 
 import { START_KONG_YML_TEMPLATE } from "../../commands/start/templates/kong.yml.ts";
 import { edgeRuntimeDockerfileImage } from "../../command-internal/edge-runtime-image.ts";
@@ -25,16 +36,41 @@ import { bundleServeMainTemplate } from "./serve-main-bundler.ts";
  * isolating the network as the only variable.
  */
 
-function hasDocker(): boolean {
-  try {
-    execSync("docker info", { stdio: "ignore" });
-    return true;
-  } catch {
-    return false;
-  }
-}
+class ServeOfflineE2eError extends Data.TaggedError("ServeOfflineE2eError")<{
+  readonly message: string;
+  readonly cause?: unknown;
+}> {}
 
-const dockerAvailable = hasDocker();
+const docker = (args: ReadonlyArray<string>, timeoutMs?: number) =>
+  Effect.gen(function* () {
+    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const child = yield* spawner.spawn(
+      ChildProcess.make("docker", args, { stdin: "ignore", stdout: "pipe", stderr: "pipe" }),
+    );
+    const [exitCode, stdout, stderr] = yield* Effect.all(
+      [
+        child.exitCode,
+        Stream.mkString(Stream.decodeText(child.stdout)),
+        Stream.mkString(Stream.decodeText(child.stderr)),
+      ],
+      { concurrency: "unbounded" },
+    );
+    return { status: Number(exitCode), stdout, stderr };
+  }).pipe(
+    Effect.scoped,
+    (effect) => (timeoutMs === undefined ? effect : Effect.timeout(effect, timeoutMs)),
+    Effect.mapError(
+      (cause) => new ServeOfflineE2eError({ message: `docker ${args.join(" ")} failed`, cause }),
+    ),
+  );
+
+const dockerAvailable = await Effect.runPromise(
+  docker(["info"]).pipe(
+    Effect.map(({ status }) => status === 0),
+    Effect.orElseSucceed(() => false),
+    Effect.provide(BunServices.layer),
+  ),
+);
 const SERVE_OFFLINE_STARTUP_TIMEOUT_MS = 60_000;
 const SERVE_OFFLINE_ATTEMPT_TIMEOUT_MS = 10_000;
 const DOCKER_COMMAND_TIMEOUT_MS = 5_000;
@@ -148,489 +184,534 @@ const authFailureCases = [
   },
 ];
 
-function containerLogs(container: string): string {
-  const result = spawnSync("docker", ["logs", container], {
-    encoding: "utf8",
-    timeout: DOCKER_COMMAND_TIMEOUT_MS,
+const containerLogs = (container: string) =>
+  Effect.gen(function* () {
+    const stdout = yield* Ref.make("");
+    const stderr = yield* Ref.make("");
+    const failure = yield* Effect.gen(function* () {
+      const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+      const child = yield* spawner.spawn(
+        ChildProcess.make("docker", ["logs", container], {
+          stdin: "ignore",
+          stdout: "pipe",
+          stderr: "pipe",
+        }),
+      );
+      yield* Effect.all(
+        [
+          child.exitCode,
+          Stream.runForEach(Stream.decodeText(child.stdout), (chunk) =>
+            Ref.update(stdout, (text) => text + chunk),
+          ),
+          Stream.runForEach(Stream.decodeText(child.stderr), (chunk) =>
+            Ref.update(stderr, (text) => text + chunk),
+          ),
+        ],
+        { concurrency: "unbounded" },
+      );
+    }).pipe(
+      Effect.scoped,
+      Effect.timeout(DOCKER_COMMAND_TIMEOUT_MS),
+      Effect.match({
+        onFailure: (cause) => `\n<docker logs failed: ${String(cause)}>`,
+        onSuccess: () => "",
+      }),
+    );
+    return `${yield* Ref.get(stdout)}\n${yield* Ref.get(stderr)}${failure}`;
   });
-  const failure = result.error ? `\n<docker logs failed: ${result.error.message}>` : "";
-  return `${result.stdout ?? ""}\n${result.stderr ?? ""}${failure}`;
-}
-
-const execFileAsync = promisify(execFile);
 
-async function containerState(container: string): Promise<string> {
-  try {
-    const { stdout } = await execFileAsync(
-      "docker",
-      [
-        "inspect",
-        "--format",
-        '{{.State.Status}}{{if ne .State.Status "running"}} (exit code {{.State.ExitCode}}{{if .State.OOMKilled}}, OOM-killed{{end}}){{end}}',
-        container,
-      ],
-      { encoding: "utf8", timeout: DOCKER_COMMAND_TIMEOUT_MS },
-    );
-    return stdout.trim();
-  } catch (error) {
-    const stderr = error instanceof Error && "stderr" in error ? String(error.stderr) : "";
-    return `not inspectable (${stderr.trim() || String(error)})`;
-  }
-}
+const containerState = (container: string) =>
+  docker(
+    [
+      "inspect",
+      "--format",
+      '{{.State.Status}}{{if ne .State.Status "running"}} (exit code {{.State.ExitCode}}{{if .State.OOMKilled}}, OOM-killed{{end}}){{end}}',
+      container,
+    ],
+    DOCKER_COMMAND_TIMEOUT_MS,
+  ).pipe(
+    Effect.map(({ status, stdout, stderr }) =>
+      status === 0 ? stdout.trim() : `not inspectable (${stderr.trim() || `exit ${status}`})`,
+    ),
+    Effect.catch((error) =>
+      Effect.succeed(`not inspectable (${String(error.cause ?? error.message)})`),
+    ),
+  );
 
 function isTerminalContainerState(state: string): boolean {
   return /^(exited|dead)\b/u.test(state);
 }
 
-async function containerDiagnostics(containers: readonly string[]): Promise<string> {
-  const blocks = await Promise.all(
-    containers.map(
-      async (container) =>
-        `${container} (${await containerState(container)}) logs:\n${containerLogs(container)}`,
+const containerDiagnostics = (containers: readonly string[]) =>
+  Effect.forEach(
+    containers,
+    (container) =>
+      Effect.all([containerState(container), containerLogs(container)]).pipe(
+        Effect.map(([state, logs]) => `${container} (${state}) logs:\n${logs}`),
+      ),
+    { concurrency: "unbounded" },
+  ).pipe(Effect.map((blocks) => blocks.join("\n")));
+
+const fetchFunctionWithDiagnostics = (
+  request: HttpClientRequest.HttpClientRequest,
+  diagnosticContainers: readonly string[],
+  timeout: Duration.Input,
+) =>
+  HttpClient.execute(request).pipe(
+    Effect.timeout(timeout),
+    Effect.catch((cause) =>
+      Effect.gen(function* () {
+        return yield* new ServeOfflineE2eError({
+          message: `Function request to ${request.url} failed.\n${yield* containerDiagnostics(diagnosticContainers)}`,
+          cause,
+        });
+      }),
     ),
   );
-  return blocks.join("\n");
-}
 
-async function fetchFunctionWithDiagnostics(
-  url: string,
-  diagnosticContainers: readonly string[],
-  init: RequestInit,
-): Promise<Response> {
-  try {
-    return await fetch(url, init);
-  } catch (cause) {
-    throw new Error(
-      `Function request to ${url} failed.\n${await containerDiagnostics(diagnosticContainers)}`,
-      { cause },
-    );
-  }
-}
+class TransientFunctionResponse extends Data.TaggedError("TransientFunctionResponse")<{
+  readonly cause: unknown;
+}> {}
+
+class UnexpectedResponseStatus extends Data.TaggedError("UnexpectedResponseStatus")<{
+  readonly message: string;
+}> {}
 
-async function fetchColdFunction(
+const fetchColdFunction = (
   url: string,
   diagnosticContainers: readonly string[],
-  init?: RequestInit,
-): Promise<Response> {
+  headers: Record<string, string> = {},
+) => {
   // Runtime health does not start user workers, and Edge Runtime exposes no
   // per-worker readiness signal. A cold worker can briefly disconnect or
   // return 502/503, so retry only those transient outcomes, each bounded so
   // one hung request cannot eat the budget. A container that exited or died
   // ends the wait: nothing will answer.
-  const deadline = Date.now() + SERVE_OFFLINE_STARTUP_TIMEOUT_MS;
-  let lastError: unknown;
-
-  for (;;) {
-    try {
-      const response = await fetch(url, {
-        ...init,
-        signal: AbortSignal.timeout(
-          Math.max(1, Math.min(SERVE_OFFLINE_ATTEMPT_TIMEOUT_MS, deadline - Date.now())),
-        ),
-      });
-      if (response.status !== 502 && response.status !== 503) {
-        return response;
+  return Effect.gen(function* () {
+    const deadline = (yield* Clock.currentTimeMillis) + SERVE_OFFLINE_STARTUP_TIMEOUT_MS;
+    const attempt = Effect.gen(function* () {
+      const attemptMs = Math.min(
+        SERVE_OFFLINE_ATTEMPT_TIMEOUT_MS,
+        deadline - (yield* Clock.currentTimeMillis),
+      );
+      const result = yield* HttpClient.execute(HttpClientRequest.get(url, { headers })).pipe(
+        Effect.timeout(Duration.millis(Math.max(1, attemptMs))),
+        Effect.result,
+      );
+      if (
+        Result.isSuccess(result) &&
+        result.success.status !== 502 &&
+        result.success.status !== 503
+      ) {
+        return result.success;
+      }
+      const cause = Result.isSuccess(result)
+        ? new UnexpectedResponseStatus({ message: `Received ${result.success.status} from ${url}` })
+        : result.failure;
+      if (Result.isSuccess(result)) {
+        yield* Stream.runDrain(result.success.stream).pipe(
+          Effect.timeout(Duration.millis(Math.max(1, attemptMs))),
+          Effect.ignore,
+        );
+      }
+      const states = yield* Effect.forEach(
+        diagnosticContainers,
+        (container) => Effect.map(containerState(container), (state) => ({ container, state })),
+        { concurrency: "unbounded" },
+      );
+      const dead = states.filter(({ state }) => isTerminalContainerState(state));
+      const remainingMs = deadline - (yield* Clock.currentTimeMillis);
+      if (dead.length === 0 && remainingMs > 0) {
+        return yield* new TransientFunctionResponse({ cause });
       }
-      lastError = new Error(`Received ${response.status} from ${url}`);
-      await response.body?.cancel();
-    } catch (error) {
-      lastError = error;
-    }
-
-    const states = await Promise.all(
-      diagnosticContainers.map(async (container) => ({
-        container,
-        state: await containerState(container),
-      })),
-    );
-    const dead = states.filter(({ state }) => isTerminalContainerState(state));
-    const remainingMs = deadline - Date.now();
-    if (dead.length > 0 || remainingMs <= 0) {
       const reason =
         dead.length > 0
           ? `: ${dead.map(({ container, state }) => `${container} is ${state}`).join(", ")}`
           : "";
-      throw new Error(
-        `Function at ${url} did not become ready${reason}.\n${await containerDiagnostics(diagnosticContainers)}`,
-        { cause: lastError },
-      );
-    }
+      return yield* new ServeOfflineE2eError({
+        message: `Function at ${url} did not become ready${reason}.\n${yield* containerDiagnostics(diagnosticContainers)}`,
+        cause,
+      });
+    });
 
-    await Bun.sleep(Math.min(250, remainingMs));
-  }
-}
+    return yield* attempt.pipe(
+      Effect.retry({
+        schedule: Schedule.spaced("250 millis"),
+        while: Predicate.isTagged("TransientFunctionResponse"),
+      }),
+    );
+  });
+};
+
+const awaitRuntimeReady = (url: string, diagnosticContainers: readonly string[]) =>
+  Effect.gen(function* () {
+    const deadline = (yield* Clock.currentTimeMillis) + SERVE_OFFLINE_STARTUP_TIMEOUT_MS;
+    yield* HttpClient.execute(HttpClientRequest.get(url)).pipe(
+      Effect.timeout(Duration.millis(SERVE_OFFLINE_ATTEMPT_TIMEOUT_MS)),
+      Effect.filterOrFail(
+        (response) => response.status === 401,
+        (response) =>
+          new UnexpectedResponseStatus({ message: `Received ${response.status} from ${url}` }),
+      ),
+      Effect.retry({
+        schedule: Schedule.spaced("250 millis"),
+        while: () => Effect.map(Clock.currentTimeMillis, (now) => now < deadline),
+      }),
+      Effect.catch((cause) =>
+        Effect.gen(function* () {
+          return yield* new ServeOfflineE2eError({
+            message: `Runtime at ${url} did not become ready.\n${yield* containerDiagnostics(diagnosticContainers)}`,
+            cause,
+          });
+        }),
+      ),
+    );
+  });
 
-async function writeKongConfig(dir: string, edgeRuntimeContainer: string) {
+const writeKongConfig = Effect.fnUntraced(function* (dir: string, edgeRuntimeContainer: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
   // Uses the TS transcription of the Kong template that `start`'s Kong
   // service already ports byte-for-byte.
   const config = START_KONG_YML_TEMPLATE.replaceAll("{{ .EdgeRuntimeId }}", edgeRuntimeContainer)
     .replaceAll("{{ .BearerToken }}", "$((headers.authorization or headers.apikey))")
     .replaceAll("{{ .QueryToken }}", "$((query_params.apikey))")
     .replace(/{{ \.[A-Za-z]+ }}/g, "unused");
-  await writeFile(join(dir, "kong.yml"), config);
-}
+  yield* fs.writeFileString(path.join(dir, "kong.yml"), config);
+});
+
+const resolveImage = (image: string, deadline?: number) =>
+  Effect.tryPromise({
+    try: () => ensureImage(image, deadline),
+    catch: (cause) =>
+      new ServeOfflineE2eError({
+        message: cause instanceof Error ? cause.message : String(cause),
+        cause,
+      }),
+  });
+
+const removeOnClose = (containers: ReadonlyArray<string>, network?: string) =>
+  Effect.addFinalizer(() =>
+    docker(["rm", "-f", ...containers]).pipe(
+      Effect.ignore,
+      Effect.andThen(
+        network === undefined ? Effect.void : Effect.ignore(docker(["network", "rm", network])),
+      ),
+    ),
+  );
+
+const publishedPort = Effect.fnUntraced(function* (container: string, containerPort: string) {
+  const portResult = yield* docker(["port", container, containerPort]);
+  expect(portResult.status, portResult.stderr).toBe(0);
+  const port = Number(portResult.stdout.trim().split(":").at(-1));
+  expect(port).toBeGreaterThan(0);
+  return port;
+});
+
+const testLayer = Layer.mergeAll(
+  BunServices.layer,
+  FetchHttpClient.layer,
+  Layer.succeed(HttpClient.TracerPropagationEnabled, false),
+);
 
 describe("functions serve runtime template (offline)", () => {
-  test.skipIf(!dockerAvailable)(
+  it.live.skipIf(!dockerAvailable)(
     "boots under edge-runtime with networking disabled and fetches nothing remote",
-    { timeout: SERVE_OFFLINE_TEST_TIMEOUT_MS },
-    async () => {
-      const runtimeImage = await ensureImage(await Effect.runPromise(edgeRuntimeDockerfileImage));
-      const dir = await mkdtemp(join(tmpdir(), "supabase-serve-offline-e2e-"));
-      const container = `supabase-serve-offline-e2e-${process.pid.toString()}`;
-      try {
-        await writeFile(join(dir, "index.ts"), await bundleServeMainTemplate());
-
-        const run = spawnSync(
-          "docker",
-          [
-            "run",
-            "-d",
-            "--name",
-            container,
-            "--network",
-            "none",
-            "-e",
-            "SUPABASE_INTERNAL_HOST_PORT=8081",
-            "-e",
-            "SUPABASE_INTERNAL_JWT_SECRET=offline-e2e",
-            "-e",
-            "SUPABASE_URL=http://127.0.0.1:54321",
-            "-e",
-            "SUPABASE_INTERNAL_FUNCTIONS_CONFIG={}",
-            "-e",
-            "SUPABASE_INTERNAL_WALLCLOCK_LIMIT_SEC=400",
-            "-v",
-            `${dir}:/app:ro`,
-            "--entrypoint",
-            "edge-runtime",
-            runtimeImage,
-            "start",
-            "--main-service=/app",
-            "--port=8081",
-          ],
-          { encoding: "utf8" },
-        );
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const runtimeImage = yield* resolveImage(yield* edgeRuntimeDockerfileImage);
+        const dir = yield* fs.makeTempDirectoryScoped({ prefix: "supabase-serve-offline-e2e-" });
+        const container = `supabase-serve-offline-e2e-${process.pid.toString()}`;
+        yield* removeOnClose([container]);
+        yield* fs.writeFileString(path.join(dir, "index.ts"), yield* bundleServeMainTemplate());
+
+        const run = yield* docker([
+          "run",
+          "-d",
+          "--name",
+          container,
+          "--network",
+          "none",
+          "-e",
+          "SUPABASE_INTERNAL_HOST_PORT=8081",
+          "-e",
+          "SUPABASE_INTERNAL_JWT_SECRET=offline-e2e",
+          "-e",
+          "SUPABASE_URL=http://127.0.0.1:54321",
+          "-e",
+          "SUPABASE_INTERNAL_FUNCTIONS_CONFIG={}",
+          "-e",
+          "SUPABASE_INTERNAL_WALLCLOCK_LIMIT_SEC=400",
+          "-v",
+          `${dir}:/app:ro`,
+          "--entrypoint",
+          "edge-runtime",
+          runtimeImage,
+          "start",
+          "--main-service=/app",
+          "--port=8081",
+        ]);
         expect(run.status, run.stderr).toBe(0);
 
-        const deadline = Date.now() + SERVE_OFFLINE_STARTUP_TIMEOUT_MS;
-        let logs = "";
-        while (Date.now() < deadline) {
-          logs = containerLogs(container);
-          if (/Serving functions on/.test(logs) || /worker boot error/i.test(logs)) {
-            break;
-          }
-          await new Promise((resolve) => setTimeout(resolve, 250));
-        }
+        const deadline = (yield* Clock.currentTimeMillis) + SERVE_OFFLINE_STARTUP_TIMEOUT_MS;
+        const logs = yield* containerLogs(container).pipe(
+          Effect.repeat({
+            schedule: Schedule.spaced("250 millis"),
+            until: (current) =>
+              /Serving functions on/.test(current) || /worker boot error/i.test(current)
+                ? Effect.succeed(true)
+                : Effect.map(Clock.currentTimeMillis, (now) => now >= deadline),
+          }),
+        );
 
         expect(logs).toMatch(/Serving functions on/);
         expect(logs).not.toMatch(/deno\.land|jsr\.io/);
         expect(logs).not.toMatch(/dns error|name resolution|worker boot error/i);
-      } finally {
-        spawnSync("docker", ["rm", "-f", container], { stdio: "ignore" });
-        await rm(dir, { recursive: true, force: true });
-      }
-    },
+      }).pipe(Effect.provide(testLayer)),
+    SERVE_OFFLINE_TEST_TIMEOUT_MS,
   );
 
-  test.skipIf(!dockerAvailable)(
+  it.live.skipIf(!dockerAvailable)(
     "returns canonical JWT auth failures",
-    { timeout: SERVE_OFFLINE_TEST_TIMEOUT_MS },
-    async () => {
-      const runtimeImage = await ensureImage(await Effect.runPromise(edgeRuntimeDockerfileImage));
-      const dir = await mkdtemp(join(tmpdir(), "supabase-serve-auth-e2e-"));
-      const container = `supabase-serve-auth-e2e-${process.pid.toString()}`;
-      try {
-        await writeFile(join(dir, "index.ts"), await bundleServeMainTemplate());
-
-        const run = spawnSync(
-          "docker",
-          [
-            "run",
-            "-d",
-            "--name",
-            container,
-            "-p",
-            "127.0.0.1::8081",
-            "-e",
-            "SUPABASE_INTERNAL_HOST_PORT=8081",
-            "-e",
-            "SUPABASE_INTERNAL_JWT_SECRET=auth-e2e",
-            "-e",
-            "SUPABASE_URL=http://127.0.0.1:54321",
-            "-e",
-            `SUPABASE_INTERNAL_FUNCTIONS_CONFIG=${AUTH_FUNCTIONS_CONFIG}`,
-            "-e",
-            "SUPABASE_INTERNAL_WALLCLOCK_LIMIT_SEC=400",
-            "-e",
-            'SUPABASE_JWKS={"keys":[]}',
-            "-v",
-            `${dir}:/app:ro`,
-            "--entrypoint",
-            "edge-runtime",
-            runtimeImage,
-            "start",
-            "--main-service=/app",
-            "--port=8081",
-          ],
-          { encoding: "utf8" },
-        );
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const runtimeImage = yield* resolveImage(yield* edgeRuntimeDockerfileImage);
+        const dir = yield* fs.makeTempDirectoryScoped({ prefix: "supabase-serve-auth-e2e-" });
+        const container = `supabase-serve-auth-e2e-${process.pid.toString()}`;
+        yield* removeOnClose([container]);
+        yield* fs.writeFileString(path.join(dir, "index.ts"), yield* bundleServeMainTemplate());
+
+        const run = yield* docker([
+          "run",
+          "-d",
+          "--name",
+          container,
+          "-p",
+          "127.0.0.1::8081",
+          "-e",
+          "SUPABASE_INTERNAL_HOST_PORT=8081",
+          "-e",
+          "SUPABASE_INTERNAL_JWT_SECRET=auth-e2e",
+          "-e",
+          "SUPABASE_URL=http://127.0.0.1:54321",
+          "-e",
+          `SUPABASE_INTERNAL_FUNCTIONS_CONFIG=${AUTH_FUNCTIONS_CONFIG}`,
+          "-e",
+          "SUPABASE_INTERNAL_WALLCLOCK_LIMIT_SEC=400",
+          "-e",
+          'SUPABASE_JWKS={"keys":[]}',
+          "-v",
+          `${dir}:/app:ro`,
+          "--entrypoint",
+          "edge-runtime",
+          runtimeImage,
+          "start",
+          "--main-service=/app",
+          "--port=8081",
+        ]);
         expect(run.status, run.stderr).toBe(0);
 
-        const portResult = spawnSync("docker", ["port", container, "8081/tcp"], {
-          encoding: "utf8",
-        });
-        expect(portResult.status, portResult.stderr).toBe(0);
-        const port = Number(portResult.stdout.trim().split(":").at(-1));
-        expect(port).toBeGreaterThan(0);
+        const port = yield* publishedPort(container, "8081/tcp");
         const url = `http://127.0.0.1:${port}/test`;
 
-        const deadline = Date.now() + SERVE_OFFLINE_STARTUP_TIMEOUT_MS;
-        let ready = false;
-        let lastError: unknown;
-        while (Date.now() < deadline) {
-          try {
-            const response = await fetch(url, {
-              signal: AbortSignal.timeout(SERVE_OFFLINE_ATTEMPT_TIMEOUT_MS),
-            });
-            if (response.status === 401) {
-              ready = true;
-              break;
-            }
-            lastError = new Error(`Received ${response.status} from ${url}`);
-          } catch (error) {
-            lastError = error;
-          }
-          await new Promise((resolve) => setTimeout(resolve, 250));
-        }
-        if (!ready) {
-          throw new Error(
-            `Runtime at ${url} did not become ready.\n${await containerDiagnostics([container])}`,
-            { cause: lastError },
-          );
-        }
+        yield* awaitRuntimeReady(url, [container]);
 
         for (const { name, authorization, code, message } of authFailureCases) {
-          const response = await fetch(url, {
-            headers: authorization === undefined ? undefined : { authorization },
-          });
+          const response = yield* HttpClient.execute(
+            HttpClientRequest.get(url, {
+              headers: authorization === undefined ? {} : { authorization },
+            }),
+          );
           expect(response.status, name).toBe(401);
-          expect(response.headers.get("content-type"), name).toContain("application/json");
-          expect(response.headers.get("sb-error-code"), name).toBe(code);
-          expect(await response.json(), name).toEqual({ code, message, msg: message });
+          expect(response.headers["content-type"], name).toContain("application/json");
+          expect(response.headers["sb-error-code"], name).toBe(code);
+          expect(yield* response.json, name).toEqual({ code, message, msg: message });
         }
-      } finally {
-        spawnSync("docker", ["rm", "-f", container], { stdio: "ignore" });
-        await rm(dir, { recursive: true, force: true });
-      }
-    },
+      }).pipe(Effect.provide(testLayer)),
+    SERVE_OFFLINE_TEST_TIMEOUT_MS,
   );
 
-  test.skipIf(!dockerAvailable)(
+  it.live.skipIf(!dockerAvailable)(
     "preserves function env and CORS headers, exposes JWT errors, and returns early responses through Kong",
-    { timeout: SERVE_OFFLINE_TEST_TIMEOUT_MS },
-    async () => {
-      const imageDeadline = resolveDeadline();
-      const [runtimeImage, kongImage] = await Promise.all([
-        ensureImage(await Effect.runPromise(edgeRuntimeDockerfileImage), imageDeadline),
-        ensureImage(dockerfileServiceImage("kong", false), imageDeadline),
-      ]);
-      const dir = await mkdtemp(join(tmpdir(), "supabase-serve-kong-e2e-"));
-      const network = `supabase-serve-kong-e2e-${process.pid.toString()}`;
-      const runtimeContainer = `${network}-runtime`;
-      const kongContainer = `${network}-kong`;
-      try {
-        await writeFile(join(dir, "index.ts"), await bundleServeMainTemplate());
-        await mkdir(join(dir, "functions", "custom"), { recursive: true });
-        await mkdir(join(dir, "functions", "_shared"), { recursive: true });
-        await mkdir(join(dir, "functions", "custom", ".supabase-worker", "custom"), {
-          recursive: true,
-        });
-        await writeFile(join(dir, "functions", "custom", "index.ts"), CUSTOM_FUNCTION);
-        await writeFile(
-          join(dir, "functions", "custom", ".supabase-worker", "custom", "index.ts"),
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const imageDeadline = resolveDeadline();
+        const [runtimeImage, kongImage] = yield* Effect.all(
+          [
+            resolveImage(yield* edgeRuntimeDockerfileImage, imageDeadline),
+            resolveImage(dockerfileServiceImage("kong", false), imageDeadline),
+          ],
+          { concurrency: "unbounded" },
+        );
+        const dir = yield* fs.makeTempDirectoryScoped({ prefix: "supabase-serve-kong-e2e-" });
+        const network = `supabase-serve-kong-e2e-${process.pid.toString()}`;
+        const runtimeContainer = `${network}-runtime`;
+        const kongContainer = `${network}-kong`;
+        yield* removeOnClose([kongContainer, runtimeContainer], network);
+        yield* fs.writeFileString(path.join(dir, "index.ts"), yield* bundleServeMainTemplate());
+        yield* fs.makeDirectory(path.join(dir, "functions", "custom"), { recursive: true });
+        yield* fs.makeDirectory(path.join(dir, "functions", "_shared"), { recursive: true });
+        yield* fs.makeDirectory(
+          path.join(dir, "functions", "custom", ".supabase-worker", "custom"),
+          {
+            recursive: true,
+          },
+        );
+        yield* fs.writeFileString(
+          path.join(dir, "functions", "custom", "index.ts"),
+          CUSTOM_FUNCTION,
+        );
+        yield* fs.writeFileString(
+          path.join(dir, "functions", "custom", ".supabase-worker", "custom", "index.ts"),
           NESTED_FUNCTION,
         );
-        await writeFile(
-          join(dir, "functions", "_shared", "value.ts"),
+        yield* fs.writeFileString(
+          path.join(dir, "functions", "_shared", "value.ts"),
           'export const sharedValue = "shared-import-ok";\n',
         );
-        await writeKongConfig(dir, runtimeContainer);
+        yield* writeKongConfig(dir, runtimeContainer);
 
-        const createNetwork = spawnSync("docker", ["network", "create", network], {
-          encoding: "utf8",
-        });
+        const createNetwork = yield* docker(["network", "create", network]);
         expect(createNetwork.status, createNetwork.stderr).toBe(0);
 
-        const runRuntime = spawnSync(
-          "docker",
-          [
-            "run",
-            "-d",
-            "--name",
-            runtimeContainer,
-            "--network",
-            network,
-            "-e",
-            "SUPABASE_INTERNAL_HOST_PORT=8081",
-            "-e",
-            "SUPABASE_INTERNAL_JWT_SECRET=auth-e2e",
-            "-e",
-            `SUPABASE_URL=http://${kongContainer}:8000`,
-            "-e",
-            `SUPABASE_INTERNAL_FUNCTIONS_CONFIG=${KONG_FUNCTIONS_CONFIG}`,
-            "-e",
-            "SUPABASE_INTERNAL_DEBUG=true",
-            "-e",
-            "SHARED=shared",
-            "-e",
-            "GLOBAL_ONLY=global",
-            "-e",
-            "SUPABASE_INTERNAL_WALLCLOCK_LIMIT_SEC=400",
-            "-e",
-            'SUPABASE_JWKS={"keys":[]}',
-            "-v",
-            `${dir}:/app:ro`,
-            "--entrypoint",
-            "edge-runtime",
-            runtimeImage,
-            "start",
-            "--main-service=/app",
-            "--port=8081",
-          ],
-          { encoding: "utf8" },
-        );
+        const runRuntime = yield* docker([
+          "run",
+          "-d",
+          "--name",
+          runtimeContainer,
+          "--network",
+          network,
+          "-e",
+          "SUPABASE_INTERNAL_HOST_PORT=8081",
+          "-e",
+          "SUPABASE_INTERNAL_JWT_SECRET=auth-e2e",
+          "-e",
+          `SUPABASE_URL=http://${kongContainer}:8000`,
+          "-e",
+          `SUPABASE_INTERNAL_FUNCTIONS_CONFIG=${KONG_FUNCTIONS_CONFIG}`,
+          "-e",
+          "SUPABASE_INTERNAL_DEBUG=true",
+          "-e",
+          "SHARED=shared",
+          "-e",
+          "GLOBAL_ONLY=global",
+          "-e",
+          "SUPABASE_INTERNAL_WALLCLOCK_LIMIT_SEC=400",
+          "-e",
+          'SUPABASE_JWKS={"keys":[]}',
+          "-v",
+          `${dir}:/app:ro`,
+          "--entrypoint",
+          "edge-runtime",
+          runtimeImage,
+          "start",
+          "--main-service=/app",
+          "--port=8081",
+        ]);
         expect(runRuntime.status, runRuntime.stderr).toBe(0);
 
-        const runKong = spawnSync(
-          "docker",
-          [
-            "run",
-            "-d",
-            "--name",
-            kongContainer,
-            "--network",
-            network,
-            "-p",
-            "127.0.0.1::8000",
-            "-e",
-            "KONG_DATABASE=off",
-            "-e",
-            "KONG_DECLARATIVE_CONFIG=/home/kong/kong.yml",
-            "-e",
-            "KONG_PLUGINS=request-transformer,cors",
-            "-e",
-            "KONG_NGINX_WORKER_PROCESSES=1",
-            "-v",
-            `${join(dir, "kong.yml")}:/home/kong/kong.yml:ro`,
-            kongImage,
-            "kong",
-            "docker-start",
-          ],
-          { encoding: "utf8" },
-        );
+        const runKong = yield* docker([
+          "run",
+          "-d",
+          "--name",
+          kongContainer,
+          "--network",
+          network,
+          "-p",
+          "127.0.0.1::8000",
+          "-e",
+          "KONG_DATABASE=off",
+          "-e",
+          "KONG_DECLARATIVE_CONFIG=/home/kong/kong.yml",
+          "-e",
+          "KONG_PLUGINS=request-transformer,cors",
+          "-e",
+          "KONG_NGINX_WORKER_PROCESSES=1",
+          "-v",
+          `${path.join(dir, "kong.yml")}:/home/kong/kong.yml:ro`,
+          kongImage,
+          "kong",
+          "docker-start",
+        ]);
         expect(runKong.status, runKong.stderr).toBe(0);
 
-        const portResult = spawnSync("docker", ["port", kongContainer, "8000/tcp"], {
-          encoding: "utf8",
-        });
-        expect(portResult.status, portResult.stderr).toBe(0);
-        const port = Number(portResult.stdout.trim().split(":").at(-1));
-        expect(port).toBeGreaterThan(0);
+        const port = yield* publishedPort(kongContainer, "8000/tcp");
         const functionsUrl = `http://127.0.0.1:${port}/functions/v1`;
         const authUrl = `${functionsUrl}/test`;
 
         const diagnosticContainers = [kongContainer, runtimeContainer] as const;
-        const deadline = Date.now() + SERVE_OFFLINE_STARTUP_TIMEOUT_MS;
-        let ready = false;
-        let lastError: unknown;
-        while (Date.now() < deadline) {
-          try {
-            const response = await fetch(authUrl, {
-              signal: AbortSignal.timeout(SERVE_OFFLINE_ATTEMPT_TIMEOUT_MS),
-            });
-            if (response.status === 401) {
-              ready = true;
-              break;
-            }
-            lastError = new Error(`Received ${response.status} from ${authUrl}`);
-          } catch (error) {
-            lastError = error;
-          }
-          await new Promise((resolve) => setTimeout(resolve, 250));
-        }
-        if (!ready) {
-          throw new Error(
-            `Runtime at ${authUrl} did not become ready.\n${await containerDiagnostics(diagnosticContainers)}`,
-            { cause: lastError },
-          );
-        }
+        yield* awaitRuntimeReady(authUrl, diagnosticContainers);
 
-        const [customResponse, aliasResponse, nestedResponse] = await Promise.all([
-          fetchColdFunction(`${functionsUrl}/custom`, diagnosticContainers, {
-            headers: { Origin: "http://localhost:3000" },
-          }),
-          fetchColdFunction(`${functionsUrl}/custom-alias`, diagnosticContainers),
-          fetchColdFunction(`${functionsUrl}/nested-worker-path`, diagnosticContainers),
-        ]);
+        const [customResponse, aliasResponse, nestedResponse] = yield* Effect.all(
+          [
+            fetchColdFunction(`${functionsUrl}/custom`, diagnosticContainers, {
+              Origin: "http://localhost:3000",
+            }),
+            fetchColdFunction(`${functionsUrl}/custom-alias`, diagnosticContainers),
+            fetchColdFunction(`${functionsUrl}/nested-worker-path`, diagnosticContainers),
+          ],
+          { concurrency: "unbounded" },
+        );
         expect(customResponse.status).toBe(200);
-        expect(customResponse.headers.get("x-custom-id")).toBe("abc123");
-        expect(customResponse.headers.get("x-function-slug")).toBe("custom");
-        expect(customResponse.headers.get("x-shared-import")).toBe("shared-import-ok");
-        expect(customResponse.headers.get("x-shared")).toBe("function");
-        expect(customResponse.headers.get("x-function-only")).toBe("function");
-        expect(customResponse.headers.get("x-global-only")).toBe("global");
-        expect(customResponse.headers.get("access-control-expose-headers")?.toLowerCase()).toBe(
+        expect(customResponse.headers["x-custom-id"]).toBe("abc123");
+        expect(customResponse.headers["x-function-slug"]).toBe("custom");
+        expect(customResponse.headers["x-shared-import"]).toBe("shared-import-ok");
+        expect(customResponse.headers["x-shared"]).toBe("function");
+        expect(customResponse.headers["x-function-only"]).toBe("function");
+        expect(customResponse.headers["x-global-only"]).toBe("global");
+        expect(customResponse.headers["access-control-expose-headers"]?.toLowerCase()).toBe(
           "x-custom-id",
         );
         expect(aliasResponse.status).toBe(200);
-        expect(aliasResponse.headers.get("x-function-slug")).toBe("custom-alias");
-        expect(aliasResponse.headers.get("x-shared-import")).toBe("shared-import-ok");
+        expect(aliasResponse.headers["x-function-slug"]).toBe("custom-alias");
+        expect(aliasResponse.headers["x-shared-import"]).toBe("shared-import-ok");
         expect(nestedResponse.status).toBe(200);
-        expect(nestedResponse.headers.get("x-function-slug")).toBe("nested-worker-path");
-        const earlyResponse = await fetchFunctionWithDiagnostics(
-          `${functionsUrl}/custom`,
-          diagnosticContainers,
-          {
-            method: "POST",
+        expect(nestedResponse.headers["x-function-slug"]).toBe("nested-worker-path");
+        const earlyResponse = yield* fetchFunctionWithDiagnostics(
+          HttpClientRequest.post(`${functionsUrl}/custom`, {
             headers: { "x-reject-before-body": "true" },
-            body: new Uint8Array(1024 * 1024),
-            signal: AbortSignal.timeout(5_000),
-          },
+            body: HttpBody.raw(new Uint8Array(1024 * 1024)),
+          }),
+          diagnosticContainers,
+          Duration.seconds(5),
         );
         expect(earlyResponse.status).toBe(400);
-        expect(await earlyResponse.text()).toBe("rejected");
-        const runtimeLogs = containerLogs(runtimeContainer);
+        expect(yield* earlyResponse.text.pipe(Effect.timeout(Duration.seconds(5)))).toBe(
+          "rejected",
+        );
+        const runtimeLogs = yield* containerLogs(runtimeContainer);
         expect(runtimeLogs).toContain("Functions config:");
         expect(runtimeLogs).toContain('"custom"');
         expect(runtimeLogs).not.toContain('"env"');
         expect(runtimeLogs).not.toContain("must-not-appear-in-debug-logs");
 
-        const authResponse = await fetch(authUrl, {
-          method: "POST",
-          headers: { Origin: "http://localhost:3000" },
-          body: new Uint8Array(1024 * 1024),
-          signal: AbortSignal.timeout(5_000),
-        });
+        const authResponse = yield* HttpClient.execute(
+          HttpClientRequest.post(authUrl, {
+            headers: { Origin: "http://localhost:3000" },
+            body: HttpBody.raw(new Uint8Array(1024 * 1024)),
+          }),
+        ).pipe(Effect.timeout(Duration.seconds(5)));
         expect(authResponse.status).toBe(401);
-        expect(authResponse.headers.get("sb-error-code")).toBe("UNAUTHORIZED_NO_AUTH_HEADER");
-        expect(authResponse.headers.get("access-control-expose-headers")).toBe("sb-error-code");
-        expect(await authResponse.json()).toEqual({
+        expect(authResponse.headers["sb-error-code"]).toBe("UNAUTHORIZED_NO_AUTH_HEADER");
+        expect(authResponse.headers["access-control-expose-headers"]).toBe("sb-error-code");
+        expect(yield* authResponse.json.pipe(Effect.timeout(Duration.seconds(5)))).toEqual({
           code: "UNAUTHORIZED_NO_AUTH_HEADER",
           message: "Missing authorization header",
           msg: "Missing authorization header",
         });
 
-        const reusedCustomResponse = await fetch(`${functionsUrl}/custom`);
+        const reusedCustomResponse = yield* HttpClient.execute(
+          HttpClientRequest.get(`${functionsUrl}/custom`),
+        );
         expect(reusedCustomResponse.status).toBe(200);
-        expect(reusedCustomResponse.headers.get("x-function-slug")).toBe("custom");
-      } finally {
-        spawnSync("docker", ["rm", "-f", kongContainer, runtimeContainer], {
-          stdio: "ignore",
-        });
-        spawnSync("docker", ["network", "rm", network], { stdio: "ignore" });
-        await rm(dir, { recursive: true, force: true });
-      }
-    },
+        expect(reusedCustomResponse.headers["x-function-slug"]).toBe("custom");
+      }).pipe(Effect.provide(testLayer)),
+    SERVE_OFFLINE_TEST_TIMEOUT_MS,
   );
 });
diff --git a/apps/cli/src/shared/functions/serve.ts b/apps/cli/src/shared/functions/serve.ts
index e55ba8ddec..fe1c997214 100644
--- a/apps/cli/src/shared/functions/serve.ts
+++ b/apps/cli/src/shared/functions/serve.ts
@@ -34,6 +34,7 @@ import {
   Duration,
   Effect,
   Exit,
+  Fiber,
   Option,
   Predicate,
   Redacted,
@@ -360,24 +361,31 @@ declare const SUPABASE_FUNCTIONS_SERVE_MAIN_TEMPLATE: string | undefined;
  * so the shipped binary never bundles at runtime. Running from source
  * bundles on demand.
  */
-function getFunctionsServeMainTemplate(): Promise<string> {
+const getFunctionsServeMainTemplate = Effect.fnUntraced(function* () {
   if (cachedFunctionsServeMainTemplate !== undefined) {
-    return Promise.resolve(cachedFunctionsServeMainTemplate);
+    return cachedFunctionsServeMainTemplate;
   }
   if (typeof SUPABASE_FUNCTIONS_SERVE_MAIN_TEMPLATE === "string") {
     cachedFunctionsServeMainTemplate = SUPABASE_FUNCTIONS_SERVE_MAIN_TEMPLATE;
-    return Promise.resolve(cachedFunctionsServeMainTemplate);
+    return cachedFunctionsServeMainTemplate;
   }
   // Bundler (and its esbuild dependency) is imported lazily and only here,
   // so it's never loaded by shipped binaries, which always take the define
   // branch above.
-  return import("./serve-main-bundler.ts")
-    .then(({ bundleServeMainTemplate }) => bundleServeMainTemplate())
-    .then((bundled) => {
+  // Detached so an interrupted bring-up still finishes and fills the cache; only this join observes it.
+  const bundling = yield* Effect.forkDetach(
+    Effect.gen(function* () {
+      const { bundleServeMainTemplate } = yield* Effect.promise(
+        () => import("./serve-main-bundler.ts"),
+      );
+      const bundled = yield* bundleServeMainTemplate();
       cachedFunctionsServeMainTemplate = bundled;
       return bundled;
-    });
-}
+    }),
+    { startImmediately: true },
+  );
+  return yield* Fiber.join(bundling);
+});
 
 function reveal(value: string | Redacted.Redacted<string> | undefined): string | undefined {
   if (value === undefined) {
@@ -566,7 +574,7 @@ interface ServeLocalAuthArtifacts {
  * the DB assertion, so a config error here still surfaces before a
  * docker-down error.
  */
-const resolveLocalAuthArtifacts = Effect.fnUntraced(function* (
+const resolveLocalAuthArtifacts = Effect.fn("functions.serve.resolveLocalAuthArtifacts")(function* (
   auth: PlainServeAuthConfig,
   configPath: string | undefined,
 ) {
@@ -673,7 +681,9 @@ const resolveLocalAuthArtifacts = Effect.fnUntraced(function* (
  * {@link resolveLocalAuthArtifacts} so `startEdgeRuntime` can run it strictly
  * after the DB assertion — with Docker down, no external JWKS request is made.
  */
-const finalizeAuthArtifacts = Effect.fnUntraced(function* (local: ServeLocalAuthArtifacts) {
+const finalizeAuthArtifacts = Effect.fn("functions.serve.finalizeAuthArtifacts")(function* (
+  local: ServeLocalAuthArtifacts,
+) {
   const keys: unknown[] = [];
   if (local.issuerUrl !== undefined) {
     const issuerUrl = local.issuerUrl;
@@ -696,7 +706,7 @@ const finalizeAuthArtifacts = Effect.fnUntraced(function* (local: ServeLocalAuth
   } satisfies ServeAuthArtifacts;
 });
 
-const resolveServeConfig = Effect.fnUntraced(function* (
+const resolveServeConfig = Effect.fn("functions.serve.resolveConfig")(function* (
   projectRoot: string,
   projectIdOverride: Option.Option<string>,
   goViperCompat: boolean,
@@ -885,7 +895,7 @@ const filterCustomEnv = Effect.fnUntraced(function* (env: Readonly<Record<string
   return Object.fromEntries(filtered);
 });
 
-const parseCustomEnvFile = Effect.fnUntraced(function* (
+const parseCustomEnvFile = Effect.fn("functions.serve.parseCustomEnv")(function* (
   envFileFlag: Option.Option<string>,
   projectRoot: string,
   flagCwd: string,
@@ -901,7 +911,9 @@ const parseCustomEnvFile = Effect.fnUntraced(function* (
   return Object.entries(filtered).map(([name, value]) => `${name}=${value}`);
 });
 
-const parseFunctionEnvFile = Effect.fnUntraced(function* (pathname: string) {
+const parseFunctionEnvFile = Effect.fn("functions.serve.parseFunctionEnv")(function* (
+  pathname: string,
+) {
   return yield* readDotEnvFile(pathname, true).pipe(Effect.flatMap(filterCustomEnv));
 });
 
@@ -941,7 +953,7 @@ function splitEnvEntry(entry: string) {
     : ([entry.slice(0, separatorIndex), entry.slice(separatorIndex + 1)] as const);
 }
 
-const writeDockerEnvFile = Effect.fnUntraced(function* (
+const writeDockerEnvFile = Effect.fn("functions.serve.writeDockerEnvFile")(function* (
   { fs, path }: { readonly fs: FileSystem.FileSystem; readonly path: Path.Path },
   env: Readonly<Record<string, string>>,
   dir: string,
@@ -978,63 +990,65 @@ const writeDockerEnvFile = Effect.fnUntraced(function* (
   return { path: pathname };
 });
 
-const writeDockerMultilineEnvScript = Effect.fnUntraced(function* (
-  { fs, path }: { readonly fs: FileSystem.FileSystem; readonly path: Path.Path },
-  env: ReadonlyArray<readonly [string, string]>,
-  containerDir: string,
-  dir: string,
-) {
-  // Self-healing — see the matching comment in `writeDockerEnvFile`. Runs
-  // unconditionally, before the length check, so a stale directory from an
-  // earlier invocation that needed multiline secrets is still reclaimed.
-  yield* fs
-    .remove(dir, { recursive: true, force: true })
-    .pipe(Effect.mapError((error) => nativePlatformFailure(error, dir)));
-
-  if (env.length === 0) {
-    return undefined;
-  }
+const writeDockerMultilineEnvScript = Effect.fn("functions.serve.writeDockerMultilineEnvScript")(
+  function* (
+    { fs, path }: { readonly fs: FileSystem.FileSystem; readonly path: Path.Path },
+    env: ReadonlyArray<readonly [string, string]>,
+    containerDir: string,
+    dir: string,
+  ) {
+    // Self-healing — see the matching comment in `writeDockerEnvFile`. Runs
+    // unconditionally, before the length check, so a stale directory from an
+    // earlier invocation that needed multiline secrets is still reclaimed.
+    yield* fs
+      .remove(dir, { recursive: true, force: true })
+      .pipe(Effect.mapError((error) => nativePlatformFailure(error, dir)));
+
+    if (env.length === 0) {
+      return undefined;
+    }
 
-  yield* fs
-    .makeDirectory(dir, { recursive: true, mode: 0o700 })
-    .pipe(Effect.mapError((error) => nativePlatformFailure(error, dir)));
-  const scriptName = "multiline-env.sh";
-  const pathname = path.join(dir, scriptName);
-  const envDir = path.join(containerDir, "values");
-  const hostEnvDir = path.join(dir, "values");
-  // Names are validated by `validateDockerMultilineEnvNames` before this runs.
-  const script = env
-    .map(([name], index) => {
-      const valueFile = `env-${index}`;
-      const valuePath = path.join(envDir, valueFile).replaceAll("\\", "/");
-      return `${name}="$(cat ${valuePath}; printf x)"
+    yield* fs
+      .makeDirectory(dir, { recursive: true, mode: 0o700 })
+      .pipe(Effect.mapError((error) => nativePlatformFailure(error, dir)));
+    const scriptName = "multiline-env.sh";
+    const pathname = path.join(dir, scriptName);
+    const envDir = path.join(containerDir, "values");
+    const hostEnvDir = path.join(dir, "values");
+    // Names are validated by `validateDockerMultilineEnvNames` before this runs.
+    const script = env
+      .map(([name], index) => {
+        const valueFile = `env-${index}`;
+        const valuePath = path.join(envDir, valueFile).replaceAll("\\", "/");
+        return `${name}="$(cat ${valuePath}; printf x)"
 export ${name}="\${${name}%x}"`;
-    })
-    .join("\n");
-  yield* fs
-    .makeDirectory(hostEnvDir, { recursive: true, mode: 0o700 })
-    .pipe(Effect.mapError((error) => nativePlatformFailure(error, hostEnvDir)));
-  // The value files hold secret env values, so keep them owner-only.
-  yield* Effect.all(
-    env.map(([, value], index) => {
-      const valuePath = path.join(hostEnvDir, `env-${index}`);
-      return fs
-        .writeFileString(valuePath, value, { mode: 0o600 })
-        .pipe(Effect.mapError((error) => nativePlatformFailure(error, valuePath)));
-    }),
-    { concurrency: "unbounded" },
-  );
-  yield* fs
-    .writeFileString(pathname, script, { mode: 0o600 })
-    .pipe(Effect.mapError((error) => nativePlatformFailure(error, pathname)));
-
-  return {
-    // `Z`: private SELinux relabel of this CLI-staged dir (supabase/cli#5989);
-    // single-consumer bind, no-op without SELinux.
-    bind: `${dir}:${containerDir}:ro,Z`,
-    scriptPath: path.join(containerDir, scriptName).replaceAll("\\", "/"),
-  };
-});
+      })
+      .join("\n");
+    yield* fs
+      .makeDirectory(hostEnvDir, { recursive: true, mode: 0o700 })
+      .pipe(Effect.mapError((error) => nativePlatformFailure(error, hostEnvDir)));
+    // The value files hold secret env values, so keep them owner-only.
+    yield* Effect.all(
+      env.map(([, value], index) => {
+        const valuePath = path.join(hostEnvDir, `env-${index}`);
+        return fs
+          .writeFileString(valuePath, value, { mode: 0o600 })
+          .pipe(Effect.mapError((error) => nativePlatformFailure(error, valuePath)));
+      }),
+      { concurrency: "unbounded" },
+    );
+    yield* fs
+      .writeFileString(pathname, script, { mode: 0o600 })
+      .pipe(Effect.mapError((error) => nativePlatformFailure(error, pathname)));
+
+    return {
+      // `Z`: private SELinux relabel of this CLI-staged dir (supabase/cli#5989);
+      // single-consumer bind, no-op without SELinux.
+      bind: `${dir}:${containerDir}:ro,Z`,
+      scriptPath: path.join(containerDir, scriptName).replaceAll("\\", "/"),
+    };
+  },
+);
 
 function partitionDockerEnvEntries(env: Readonly<Record<string, string>>) {
   const singleLine: Record<string, string> = {};
@@ -1102,54 +1116,53 @@ function ambientProjectEnv() {
   );
 }
 
-const loadServeCliProjectEnvironment = Effect.fnUntraced(function* (
-  projectRoot: string,
-  options: { readonly search: boolean },
-) {
-  const path = yield* Path.Path;
-  const fs = yield* FileSystem.FileSystem;
-  const paths = yield* findCliProjectPaths(projectRoot, { search: options.search });
-  if (paths === null) {
-    return null;
-  }
+const loadServeCliProjectEnvironment = Effect.fn("functions.serve.loadProjectEnvironment")(
+  function* (projectRoot: string, options: { readonly search: boolean }) {
+    const path = yield* Path.Path;
+    const fs = yield* FileSystem.FileSystem;
+    const paths = yield* findCliProjectPaths(projectRoot, { search: options.search });
+    if (paths === null) {
+      return null;
+    }
 
-  const values: Record<string, string> = ambientProjectEnv();
-  const sources: Record<string, "ambient" | ".env" | ".env.local"> = Object.fromEntries(
-    Object.keys(values).map((key) => [key, "ambient"]),
-  );
-  const loadedPaths: string[] = [];
-  const env = values["SUPABASE_ENV"] || defaultSupabaseEnv;
-
-  for (const dir of [paths.supabaseDir, paths.projectRoot]) {
-    for (const filename of loadDefaultEnvFilenames(env)) {
-      const envPath = path.join(dir, filename);
-      const contents = yield* readFileUtf8(fs, envPath).pipe(
-        Effect.catch((error) =>
-          Predicate.isTagged(error.reason, "NotFound")
-            ? Effect.void
-            : nativePlatformFailure(error, envPath),
-        ),
-      );
-      if (contents === undefined) {
-        continue;
-      }
-      loadedPaths.push(envPath);
-      const parsed = yield* Effect.try({
-        try: () => parseDotEnv(contents),
-        catch: (cause) => nativeFailure(sanitizeDotEnvParseError(envPath, cause)),
-      });
-      for (const [key, value] of Object.entries(parsed)) {
-        if (values[key] !== undefined) {
+    const values: Record<string, string> = ambientProjectEnv();
+    const sources: Record<string, "ambient" | ".env" | ".env.local"> = Object.fromEntries(
+      Object.keys(values).map((key) => [key, "ambient"]),
+    );
+    const loadedPaths: string[] = [];
+    const env = values["SUPABASE_ENV"] || defaultSupabaseEnv;
+
+    for (const dir of [paths.supabaseDir, paths.projectRoot]) {
+      for (const filename of loadDefaultEnvFilenames(env)) {
+        const envPath = path.join(dir, filename);
+        const contents = yield* readFileUtf8(fs, envPath).pipe(
+          Effect.catch((error) =>
+            Predicate.isTagged(error.reason, "NotFound")
+              ? Effect.void
+              : nativePlatformFailure(error, envPath),
+          ),
+        );
+        if (contents === undefined) {
           continue;
         }
-        values[key] = value;
-        sources[key] = filename.includes(".local") ? ".env.local" : ".env";
+        loadedPaths.push(envPath);
+        const parsed = yield* Effect.try({
+          try: () => parseDotEnv(contents),
+          catch: (cause) => nativeFailure(sanitizeDotEnvParseError(envPath, cause)),
+        });
+        for (const [key, value] of Object.entries(parsed)) {
+          if (values[key] !== undefined) {
+            continue;
+          }
+          values[key] = value;
+          sources[key] = filename.includes(".local") ? ".env.local" : ".env";
+        }
       }
     }
-  }
 
-  return { paths, values, loadedPaths, sources } satisfies CliProjectEnvironment;
-});
+    return { paths, values, loadedPaths, sources } satisfies CliProjectEnvironment;
+  },
+);
 
 /**
  * Whether any bind mounts something at `containerPath` or below it, i.e. whether
@@ -1169,7 +1182,7 @@ function hasBindUnder(binds: Iterable<DockerBind>, containerPath: string): boole
   return false;
 }
 
-const buildWatchSpecs = Effect.fnUntraced(function* (
+const buildWatchSpecs = Effect.fn("functions.serve.buildWatchSpecs")(function* (
   binds: ReadonlyArray<DockerBind>,
   { fs, path }: { readonly fs: FileSystem.FileSystem; readonly path: Path.Path },
 ) {
@@ -1227,7 +1240,9 @@ function eventMatchesSpec(spec: WatchSpec, event: FileWatchEvent) {
  */
 const goFileEventOp = { create: "CREATE", update: "WRITE", delete: "REMOVE" } as const;
 
-const waitForRestartSignal = Effect.fnUntraced(function* (watchSpecs: ReadonlyArray<WatchSpec>) {
+const waitForRestartSignal = Effect.fn("functions.serve.waitForRestart")(function* (
+  watchSpecs: ReadonlyArray<WatchSpec>,
+) {
   if (watchSpecs.length === 0) {
     return yield* Effect.never;
   }
@@ -1376,7 +1391,7 @@ function attachToContainerLogsOnce(
   );
 }
 
-const streamContainerLogs = Effect.fnUntraced(function* (
+const streamContainerLogs = Effect.fn("functions.serve.streamContainerLogs")(function* (
   containerId: string,
   retryDelay: Duration.Duration,
 ) {
@@ -1484,7 +1499,9 @@ const streamContainerLogs = Effect.fnUntraced(function* (
   }
 });
 
-const assertLocalDbRunning = Effect.fnUntraced(function* (projectId: string) {
+const assertLocalDbRunning = Effect.fn("functions.serve.assertLocalDbRunning")(function* (
+  projectId: string,
+) {
   const dbId = localDockerId("db", projectId);
   // A spawn failure (neither `docker` nor `podman` on PATH) must keep its
   // cause: blanking stderr here would demote it to a bare "failed to inspect
@@ -1516,7 +1533,9 @@ const assertLocalDbRunning = Effect.fnUntraced(function* (projectId: string) {
   });
 });
 
-const bestEffortRemoveContainer = Effect.fnUntraced(function* (containerId: string) {
+const bestEffortRemoveContainer = Effect.fn("functions.serve.removeContainer")(function* (
+  containerId: string,
+) {
   yield* runChildProcess("docker", ["container", "rm", "-f", "-v", containerId], {
     stdout: "ignore",
     stderr: "ignore",
@@ -1525,7 +1544,7 @@ const bestEffortRemoveContainer = Effect.fnUntraced(function* (containerId: stri
 
 // One step of Edge Runtime's create → cp → start bring-up. Only the cp step
 // passes a `messagePrefix`, since its raw stderr is uninterpretable alone.
-const runEdgeRuntimeDockerStep = Effect.fnUntraced(function* (
+const runEdgeRuntimeDockerStep = Effect.fn("functions.serve.dockerStep")(function* (
   args: ReadonlyArray<string>,
   opts: { readonly messagePrefix?: string; readonly stdin?: Stream.Stream<Uint8Array> } = {},
 ) {
@@ -1546,7 +1565,7 @@ const runEdgeRuntimeDockerStep = Effect.fnUntraced(function* (
   }
 });
 
-const reloadKong = Effect.fnUntraced(function* (projectId: string) {
+const reloadKong = Effect.fn("functions.serve.reloadKong")(function* (projectId: string) {
   const output = yield* Output;
   const kongId = localDockerId("kong", projectId);
   // Needs the `--nginx-conf` flag pointing at the custom template
@@ -1602,7 +1621,7 @@ export function buildServeEntrypointCommand(
 `;
 }
 
-const resolveServeFunctionConfigs = Effect.fnUntraced(function* (
+const resolveServeFunctionConfigs = Effect.fn("functions.serve.resolveFunctionConfigs")(function* (
   projectRoot: string,
   supabaseDir: string,
   config: Pick<
@@ -1681,10 +1700,10 @@ export const resolveFunctionBindMounts = Effect.fn("functions.resolveFunctionBin
         bitbucketCloneDirDefined,
         additionalModuleRoots: [flagCwd],
         skipMissingImportMapTargets: true,
-        onWarning: (message) => {
-          bindWarnings.push(message);
-          return Promise.resolve();
-        },
+        onWarning: (message) =>
+          Effect.sync(() => {
+            bindWarnings.push(message);
+          }),
       })) {
         binds.add(formatDockerBind(bind));
       }
@@ -1774,10 +1793,10 @@ export const startEdgeRuntimeContainer = Effect.fn("functions.startEdgeRuntimeCo
         bitbucketCloneDirDefined,
         additionalModuleRoots: [input.flagCwd],
         skipMissingImportMapTargets: true,
-        onWarning: (message) => {
-          bindWarnings.push(message);
-          return Promise.resolve();
-        },
+        onWarning: (message) =>
+          Effect.sync(() => {
+            bindWarnings.push(message);
+          }),
       })) {
         const key = formatDockerBind(bind);
         functionBinds.set(key, bind);
@@ -1885,7 +1904,9 @@ export const startEdgeRuntimeContainer = Effect.fn("functions.startEdgeRuntimeCo
         ...buildFunctionsServeInspectArgs(input.inspectMode, input.inspectMain),
         ...(input.debug ? ["--verbose"] : []),
       ];
-      const serveMainTemplate = yield* Effect.promise(() => getFunctionsServeMainTemplate());
+      const serveMainTemplate = yield* getFunctionsServeMainTemplate().pipe(
+        Effect.withSpan("functions.serve.bundleMainTemplate"),
+      );
       // Streamed in via `docker cp` between create and start: embedding the template in the
       // `sh -c` argv hits Windows ENAMETOOLONG (#5711), and a single-file host bind mounts as
       // an empty directory on daemons that cannot see this host's filesystem (#6254, #4190).
@@ -1968,7 +1989,7 @@ const defaultServeDbUrl = "postgresql://postgres:postgres@db:5432/postgres";
  * only this wrapper — reloads Kong so its routing table picks up the
  * freshly (re)started container.
  */
-const startEdgeRuntime = Effect.fnUntraced(function* (input: {
+const startEdgeRuntime = Effect.fn("functions.serve.startEdgeRuntime")(function* (input: {
   readonly flags: FunctionsServeFlags;
   readonly dependencies: FunctionsServeDependencies;
   readonly debug: boolean;
diff --git a/apps/cli/src/shared/functions/serve.unit.test.ts b/apps/cli/src/shared/functions/serve.unit.test.ts
index 4895274c63..f8b8ff4268 100644
--- a/apps/cli/src/shared/functions/serve.unit.test.ts
+++ b/apps/cli/src/shared/functions/serve.unit.test.ts
@@ -1,4 +1,3 @@
-import { nativeFailure } from "./functions-docker.ts";
 import { it } from "@effect/vitest";
 import { Effect } from "effect";
 import { describe, expect } from "vitest";
@@ -20,10 +19,7 @@ describe("buildServeEntrypointCommand", () => {
 
   it.effect("keeps the spawned command short even with the real bundled template", () => {
     return Effect.gen(function* () {
-      const bundled = yield* Effect.tryPromise({
-        try: () => bundleServeMainTemplate(),
-        catch: nativeFailure,
-      });
+      const bundled = yield* bundleServeMainTemplate();
       const script = buildServeEntrypointCommand(["edge-runtime", "start"]);
       expect(bundled.length).toBeGreaterThan(20_000);
       expect(script.length).toBeLessThan(128);
diff --git a/apps/cli/src/shared/output/table.ts b/apps/cli/src/shared/output/table.ts
deleted file mode 100644
index ed91af103f..0000000000
--- a/apps/cli/src/shared/output/table.ts
+++ /dev/null
@@ -1,60 +0,0 @@
-import { Effect } from "effect";
-import { Output } from "./output.service.ts";
-
-/**
- * Computes the minimum column widths needed to fit both headers and all row values.
- * Headers and rows must have the same number of columns.
- */
-export function columnWidths(
-  headers: ReadonlyArray<string>,
-  rows: ReadonlyArray<ReadonlyArray<string>>,
-): ReadonlyArray<number> {
-  return headers.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i]!.length)));
-}
-
-/**
- * Formats a single table row by padding each cell to its column width,
- * joining with a 2-space separator.
- */
-export function formatTableRow(
-  cells: ReadonlyArray<string>,
-  widths: ReadonlyArray<number>,
-): string {
-  return cells.map((c, i) => c + " ".repeat(widths[i]! - c.length)).join("  ");
-}
-
-/**
- * Renders a table via the Output service: prints the header row then each data row.
- *
- * TODO: Consider replacing with a declarative ink component using `renderToString`
- * for more complex table layouts.
- *
- * `toRow` converts a data item to a string cell array (used to compute column
- * widths and as the default cell source for each row).
- *
- * `formatRow` optionally overrides how each row string is produced — receives
- * the cell array, computed column widths, and the original data item. Use it
- * to append continuation lines (e.g. `"\n" + extraLine`) or add decoration.
- * When omitted, each row is formatted with `formatTableRow`.
- */
-export function outputTable<T>(
-  headers: ReadonlyArray<string>,
-  data: ReadonlyArray<T>,
-  toRow: (item: T) => ReadonlyArray<string>,
-  formatRow?: (cells: ReadonlyArray<string>, widths: ReadonlyArray<number>, item: T) => string,
-): Effect.Effect<void, never, Output> {
-  const rows = data.map(toRow);
-  const widths = columnWidths(headers, rows);
-  return Effect.gen(function* () {
-    const output = yield* Output;
-    yield* output.info(formatTableRow(headers, widths));
-    yield* Effect.forEach(
-      rows,
-      (cells, i) => {
-        const line = formatRow ? formatRow(cells, widths, data[i]!) : formatTableRow(cells, widths);
-        return output.info(line);
-      },
-      { discard: true },
-    );
-  });
-}
diff --git a/apps/cli/src/shared/output/table.unit.test.ts b/apps/cli/src/shared/output/table.unit.test.ts
deleted file mode 100644
index ee4c846474..0000000000
--- a/apps/cli/src/shared/output/table.unit.test.ts
+++ /dev/null
@@ -1,79 +0,0 @@
-import { describe, expect, it } from "@effect/vitest";
-import { Effect } from "effect";
-import { mockOutput } from "../../../tests/helpers/mocks.ts";
-import { columnWidths, formatTableRow, outputTable } from "./table.ts";
-
-describe("columnWidths", () => {
-  it("uses the header width when it is wider than all cells", () => {
-    expect(columnWidths(["STATUS"], [["OK"]])).toEqual([6]);
-  });
-
-  it("uses the cell width when a cell is wider than the header", () => {
-    expect(columnWidths(["ID"], [["abcdefghijklmnopqrst"]])).toEqual([20]);
-  });
-
-  it("takes the max across all rows", () => {
-    expect(columnWidths(["NAME"], [["alice"], ["bob"], ["charlotte"]])).toEqual([9]);
-  });
-
-  it("handles multiple columns independently", () => {
-    expect(columnWidths(["A", "LONG_HEADER"], [["abc", "x"]])).toEqual([3, 11]);
-  });
-});
-
-describe("formatTableRow", () => {
-  it("pads cells to their column widths and joins with a 2-space separator", () => {
-    expect(formatTableRow(["hi", "there"], [5, 8])).toBe("hi     there   ");
-  });
-
-  it("does not pad a cell that exactly fills its column", () => {
-    expect(formatTableRow(["abc"], [3])).toBe("abc");
-  });
-});
-
-describe("outputTable", () => {
-  it.effect("emits a header row then one info message per data item", () => {
-    const out = mockOutput();
-    return Effect.gen(function* () {
-      yield* outputTable(["ID", "NAME"], [{ id: "1", name: "main" }], (r) => [r.id, r.name]);
-      const infos = out.messages.filter((m) => m.type === "info").map((m) => m.message);
-      expect(infos).toEqual(["ID  NAME", "1   main"]);
-    }).pipe(Effect.provide(out.layer));
-  });
-
-  it.effect("uses header width when wider than any cell", () => {
-    const out = mockOutput();
-    return Effect.gen(function* () {
-      yield* outputTable(["STATUS"], [{ s: "OK" }], (r) => [r.s]);
-      const infos = out.messages.filter((m) => m.type === "info").map((m) => m.message);
-      expect(infos[0]).toBe("STATUS");
-      expect(infos[1]).toBe("OK    ");
-    }).pipe(Effect.provide(out.layer));
-  });
-
-  it.effect("calls formatRow with cells, widths, and original item to produce row string", () => {
-    const out = mockOutput();
-    const captured: Array<{
-      cells: ReadonlyArray<string>;
-      widths: ReadonlyArray<number>;
-      item: { name: string };
-    }> = [];
-    return Effect.gen(function* () {
-      yield* outputTable(
-        ["NAME"],
-        [{ name: "alice" }],
-        (r) => [r.name],
-        (cells, widths, item) => {
-          captured.push({ cells, widths, item });
-          return formatTableRow(cells, widths) + " [custom]";
-        },
-      );
-      expect(captured).toHaveLength(1);
-      expect(captured[0]!.cells).toEqual(["alice"]);
-      expect(captured[0]!.widths).toEqual([5]);
-      expect(captured[0]!.item).toEqual({ name: "alice" });
-      const infos = out.messages.filter((m) => m.type === "info").map((m) => m.message);
-      expect(infos[1]).toBe("alice [custom]");
-    }).pipe(Effect.provide(out.layer));
-  });
-});
diff --git a/apps/cli/src/shared/output/time.ts b/apps/cli/src/shared/output/time.ts
deleted file mode 100644
index 4598459abb..0000000000
--- a/apps/cli/src/shared/output/time.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-import { DateTime, Option } from "effect";
-
-const pad2 = (value: number): string => String(value).padStart(2, "0");
-
-/** Extracts the date portion of an ISO 8601 UTC string as `YYYY-MM-DD`. */
-export function formatUtcDate(iso: string): string {
-  return DateTime.make(iso).pipe(
-    Option.map(DateTime.formatIsoDateUtc),
-    Option.getOrElse(() => "Invalid date"),
-  );
-}
-
-/** Extracts the time portion of an ISO 8601 UTC string as `HH:MM:SS UTC`. */
-export function formatUtcTime(iso: string): string {
-  return DateTime.make(iso).pipe(
-    Option.map((dt) => {
-      const { hour, minute, second } = DateTime.toPartsUtc(dt);
-      return `${pad2(hour)}:${pad2(minute)}:${pad2(second)} UTC`;
-    }),
-    Option.getOrElse(() => "Invalid time"),
-  );
-}
diff --git a/apps/cli/src/shared/output/time.unit.test.ts b/apps/cli/src/shared/output/time.unit.test.ts
deleted file mode 100644
index d90b4ec56a..0000000000
--- a/apps/cli/src/shared/output/time.unit.test.ts
+++ /dev/null
@@ -1,22 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { formatUtcDate, formatUtcTime } from "./time.ts";
-
-describe("formatUtcDate", () => {
-  it("extracts the date portion from an ISO string", () => {
-    expect(formatUtcDate("2024-01-15T10:30:00.000Z")).toBe("2024-01-15");
-  });
-
-  it("handles end-of-year dates", () => {
-    expect(formatUtcDate("2024-12-31T23:59:59.000Z")).toBe("2024-12-31");
-  });
-});
-
-describe("formatUtcTime", () => {
-  it("formats the time portion with UTC suffix", () => {
-    expect(formatUtcTime("2024-01-15T10:30:00.000Z")).toBe("10:30:00 UTC");
-  });
-
-  it("handles midnight UTC", () => {
-    expect(formatUtcTime("2024-03-20T00:00:00.000Z")).toBe("00:00:00 UTC");
-  });
-});
diff --git a/apps/cli/src/shared/output/types.ts b/apps/cli/src/shared/output/types.ts
index e6eb28cbb9..c9ccfdaf2c 100644
--- a/apps/cli/src/shared/output/types.ts
+++ b/apps/cli/src/shared/output/types.ts
@@ -16,6 +16,16 @@ export type StreamEvent =
       readonly line: string;
       readonly source: "history" | "live";
     }
+  | {
+      readonly type: "log-marker";
+      readonly instance_id: string;
+      readonly timestamp: string;
+      readonly service: string;
+      readonly kind: "launch" | "lost";
+      readonly stream?: "stdout" | "stderr";
+      readonly count?: number;
+      readonly source: "history" | "live";
+    }
   | {
       readonly type: "result";
       readonly data: unknown;
diff --git a/apps/cli/src/shared/runtime/browser.layer.ts b/apps/cli/src/shared/runtime/browser.layer.ts
index f813633d2c..97b9db9692 100644
--- a/apps/cli/src/shared/runtime/browser.layer.ts
+++ b/apps/cli/src/shared/runtime/browser.layer.ts
@@ -3,6 +3,7 @@ import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
 
 import { RuntimeInfo } from "./runtime-info.service.ts";
 import { Browser } from "./browser.service.ts";
+import { withChildTraceEnv, withProcessSpan } from "../telemetry/spans.ts";
 
 const makeBrowser = Effect.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
@@ -35,13 +36,23 @@ const makeBrowser = Effect.gen(function* () {
           args = [url];
         }
 
-        const cmd = ChildProcess.make(command, args, {
-          detached: true,
-          stdin: "ignore",
-          stdout: "ignore",
-          stderr: "ignore",
-        });
-        yield* spawner.exitCode(cmd);
+        const openCommand = command;
+        const openArgs = args;
+        yield* withProcessSpan(
+          "Browser.open",
+          { executable: openCommand, argCount: openArgs.length },
+          (traceEnv) =>
+            spawner.exitCode(
+              ChildProcess.make(
+                openCommand,
+                openArgs,
+                withChildTraceEnv(
+                  { detached: true, stdin: "ignore", stdout: "ignore", stderr: "ignore" },
+                  traceEnv,
+                ),
+              ),
+            ),
+        );
       }).pipe(Effect.ignore),
   });
 });
diff --git a/apps/cli/src/shared/services/Dockerfile b/apps/cli/src/shared/services/Dockerfile
index aee8c87f83..0f56babd32 100644
--- a/apps/cli/src/shared/services/Dockerfile
+++ b/apps/cli/src/shared/services/Dockerfile
@@ -3,29 +3,45 @@
 # postgrest, pgmeta, studio, imgproxy, edgeruntime, vector, supavisor, gotrue, realtime, storage,
 # logflare. Do not hand-edit those tags; a CI drift check enforces this. Run the generator after
 # a catalog update. Everything else in this file (this comment, kong, pg14, the one-shot job
-# images) is hand- or Dependabot-managed.
-FROM supabase/postgres:17.11.0.002 AS pg
-FROM supabase/postgres:15.19.0.002 AS pg15
+# images) is hand- or Dependabot-managed. Keep a line between image lines: git conflicts on edits to
+# adjacent lines, and catalog PRs for neighbouring aliases are often open at the same time.
+FROM supabase/postgres:17.11.0.004 AS pg
+
+FROM supabase/postgres:15.19.0.004 AS pg15
 # Postgres 14 has no slim build; bumped by hand (Dependabot ignores supabase/postgres).
 FROM supabase/postgres:14.1.0.89 AS pg14
 # New always-on service alias: extend SERVICE_IMAGE_ALIASES in
 # shared/services/services.shared.ts and DOCKERFILE_ALIAS_BY_SERVICE in
 # commands/start/start.gates.ts.
 FROM library/kong:2.8.1 AS kong
+
 FROM axllent/mailpit:v1.31.3 AS mailpit
+
 FROM postgrest/postgrest:v16.4 AS postgrest
-FROM supabase/postgres-meta:v0.99.0 AS pgmeta
-FROM supabase/studio:2026.09.28-sha-5e59b60 AS studio
+
+FROM supabase/postgres-meta:v0.100.0 AS pgmeta
+
+FROM supabase/studio:2026.10.05-sha-94b8b06 AS studio
+
 FROM darthsim/imgproxy:v3.26.0 AS imgproxy
-FROM supabase/edge-runtime:v1.77.1 AS edgeruntime
+
+FROM supabase/edge-runtime:v1.77.4 AS edgeruntime
+
 FROM timberio/vector:0.58.0-alpine AS vector
+
 FROM supabase/supavisor:2.9.13 AS supavisor
+
 FROM supabase/gotrue:v2.197.0 AS gotrue
-FROM supabase/realtime:v2.140.3 AS realtime
-FROM supabase/storage-api:v1.79.28 AS storage
-FROM supabase/logflare:1.50.15 AS logflare
+
+FROM supabase/realtime:v2.140.10 AS realtime
+
+FROM supabase/storage-api:v1.79.36 AS storage
+
+FROM supabase/logflare:1.52.0 AS logflare
 # One-shot job images (not started as long-running containers); differ's alias
 # is resolved via dockerfileServiceImage("differ") in commands/db/diff/pgadmin-diff.ts.
 FROM supabase/pgadmin-schema-diff:cli-0.0.5 AS differ
+
 FROM supabase/migra:3.0.1663481299 AS migra
+
 FROM supabase/pg_prove:3.36 AS pgprove
diff --git a/apps/cli/src/shared/services/services.shared.ts b/apps/cli/src/shared/services/services.shared.ts
index 3f0f553586..d1e683d9f7 100644
--- a/apps/cli/src/shared/services/services.shared.ts
+++ b/apps/cli/src/shared/services/services.shared.ts
@@ -358,7 +358,7 @@ const fetchText = Effect.fnUntraced(function* (
   return yield* response.text;
 });
 
-const fetchPostgrestVersion = Effect.fnUntraced(function* (
+const fetchPostgrestVersion = Effect.fn("Services.fetchPostgrestVersion")(function* (
   client: HttpClient.HttpClient,
   baseUrl: string,
   accessKey: Redacted.Redacted<string>,
@@ -380,10 +380,12 @@ const fetchPostgrestVersion = Effect.fnUntraced(function* (
     return yield* new ServiceVersionNotFoundError({ service: "postgrest" });
   }
 
-  return tagForServiceVersion("postgrest", normalized);
+  const tag = tagForServiceVersion("postgrest", normalized);
+  yield* Effect.annotateCurrentSpan({ "service.version": tag });
+  return tag;
 });
 
-const fetchAuthVersion = Effect.fnUntraced(function* (
+const fetchAuthVersion = Effect.fn("Services.fetchAuthVersion")(function* (
   client: HttpClient.HttpClient,
   baseUrl: string,
   accessKey: Redacted.Redacted<string>,
@@ -395,10 +397,11 @@ const fetchAuthVersion = Effect.fnUntraced(function* (
     return yield* new ServiceVersionNotFoundError({ service: "auth" });
   }
 
+  yield* Effect.annotateCurrentSpan({ "service.version": version });
   return version;
 });
 
-const fetchStorageVersion = Effect.fnUntraced(function* (
+const fetchStorageVersion = Effect.fn("Services.fetchStorageVersion")(function* (
   client: HttpClient.HttpClient,
   baseUrl: string,
   accessKey: Redacted.Redacted<string>,
@@ -408,7 +411,9 @@ const fetchStorageVersion = Effect.fnUntraced(function* (
     return yield* new ServiceVersionNotFoundError({ service: "storage" });
   }
 
-  return tagForServiceVersion("storage", version);
+  const tag = tagForServiceVersion("storage", version);
+  yield* Effect.annotateCurrentSpan({ "service.version": tag });
+  return tag;
 });
 
 const fetchOptionalVersion = <E>(
@@ -420,7 +425,9 @@ const fetchOptionalVersion = <E>(
     Effect.map((exit) => ({ service, exit }) as const),
   );
 
-const makeConfiguredApiClient = Effect.fnUntraced(function* (input: ServiceFetchConfig) {
+const makeConfiguredApiClient = Effect.fn("Services.buildApiClient")(function* (
+  input: ServiceFetchConfig,
+) {
   return (
     input.api ??
     (yield* makeApiClient({
@@ -556,5 +563,9 @@ export function fetchLinkedServiceVersions(input: ServiceFetchConfig) {
       return versions;
     }).pipe(Effect.exit);
     return Exit.isSuccess(exit) ? exit.value : ({} as Partial<Record<RemoteServiceName, string>>);
-  });
+  }).pipe(
+    Effect.withSpan("Services.fetchLinkedVersions", {
+      attributes: { "project.ref": input.projectRef },
+    }),
+  );
 }
diff --git a/apps/cli/src/shared/services/services.shared.unit.test.ts b/apps/cli/src/shared/services/services.shared.unit.test.ts
index ff9e180f5c..93179986c7 100644
--- a/apps/cli/src/shared/services/services.shared.unit.test.ts
+++ b/apps/cli/src/shared/services/services.shared.unit.test.ts
@@ -1,7 +1,7 @@
 import { describe, expect, it, test } from "@effect/vitest";
 import { Effect, Redacted } from "effect";
 import { FetchHttpClient } from "effect/unstable/http";
-import { vi } from "vitest";
+import { afterEach, beforeEach, vi } from "vitest";
 import serviceImagesDockerfile from "./Dockerfile" with { type: "text" };
 import { dockerfileServiceImageRaw } from "./dockerfile-images.ts";
 import {
@@ -15,36 +15,40 @@ import {
   renderServicesWarning,
 } from "./services.shared.ts";
 
-// Only `auth` is pinned in this fixture catalog, at the current Dockerfile-independent version
-// `v2.197.0-r0`, with a realistic (non-placeholder) fixture digest built to the real
-// `ArtifactPin`/`NativePin` shape from `@supabase/stack/internal/artifacts`. Every other service
-// is deliberately absent, so `toSlimImage` falls through to the upstream image for them — the
-// permanent state for a non-slim-capable alias (kong, `pg14`, the job images): the Dockerfile's
-// slim-capable lines are generated from the catalog now, so they never disagree with it.
-// `vi.mock` factories are hoisted above every other top-level statement, so the fixture is
-// inlined rather than referencing an outer const.
-vi.mock("@supabase/stack/internal/artifacts", () => {
-  const digest = "260e94edb8d402555791146fcf70b8e90efdc6a81877a04e5aa26f0f416a5dd7";
-  const nativePin = { archive: digest, manifest: digest };
-  return {
-    catalogPins: () => [
-      {
-        service: "auth",
-        sourceService: "auth",
-        pin: {
-          upstreamVersion: "v2.197.0",
-          revision: 0,
-          image: `ghcr.io/supabase/cli/auth:v2.197.0-r0@sha256:${digest}`,
-          natives: {
-            "darwin-arm64": nativePin,
-            "linux-amd64": nativePin,
-            "linux-arm64": nativePin,
-          },
-        },
+// `catalogPins` defaults to an auth-only fixture; the real-catalog tests swap in the original.
+const { mockCatalogPins } = vi.hoisted(() => ({ mockCatalogPins: vi.fn() }));
+
+vi.mock("@supabase/stack/internal/artifacts", (importOriginal) =>
+  importOriginal<typeof import("@supabase/stack/internal/artifacts")>().then((actual) => ({
+    ...actual,
+    catalogPins: mockCatalogPins,
+  })),
+);
+
+const { catalogPins: actualCatalogPins } = await vi.importActual<
+  typeof import("@supabase/stack/internal/artifacts")
+>("@supabase/stack/internal/artifacts");
+
+const FIXTURE_DIGEST = "260e94edb8d402555791146fcf70b8e90efdc6a81877a04e5aa26f0f416a5dd7";
+const FIXTURE_NATIVE_PIN = { archive: FIXTURE_DIGEST, manifest: FIXTURE_DIGEST };
+const FIXTURE_CATALOG_PINS = [
+  {
+    service: "auth",
+    sourceService: "auth",
+    pin: {
+      upstreamVersion: "v2.197.0",
+      revision: 0,
+      image: `ghcr.io/supabase/cli/auth:v2.197.0-r0@sha256:${FIXTURE_DIGEST}`,
+      natives: {
+        "darwin-arm64": FIXTURE_NATIVE_PIN,
+        "linux-amd64": FIXTURE_NATIVE_PIN,
+        "linux-arm64": FIXTURE_NATIVE_PIN,
       },
-    ],
-  };
-});
+    },
+  },
+];
+
+mockCatalogPins.mockImplementation(() => FIXTURE_CATALOG_PINS);
 
 const ACCESS_TOKEN = Redacted.make(`sbp_${"a".repeat(40)}`);
 const PROJECT_REF = "abcdefghijklmnopqrst";
@@ -122,6 +126,71 @@ describe("services shared", () => {
     expect(postgresImageForDbMajorVersion(14)).toBe(pg14);
   });
 
+  describe("against the real slim-services catalog", () => {
+    beforeEach(() => {
+      mockCatalogPins.mockImplementation(actualCatalogPins);
+    });
+
+    afterEach(() => {
+      mockCatalogPins.mockImplementation(() => FIXTURE_CATALOG_PINS);
+    });
+
+    test("lists slim images with versions derived from the catalog's default pins", () => {
+      const expectedNames = [
+        "postgres",
+        "auth",
+        "postgrest",
+        "realtime",
+        "storage",
+        "edge-runtime",
+        "studio",
+        "pgmeta",
+        "analytics",
+        "pooler",
+      ];
+      const rows = listLocalServiceVersions({ slim: true });
+
+      expect(rows.map((row) => row.name)).toEqual(
+        expectedNames.map((service) => `ghcr.io/supabase/cli/${service}`),
+      );
+
+      for (const row of rows) {
+        const service = row.name.replace("ghcr.io/supabase/cli/", "");
+        const defaultPin = actualCatalogPins().find(
+          (entry) => entry.sourceService === service && entry.isDefault,
+        );
+        expect(defaultPin).toBeDefined();
+        expect(row.local).toBe(defaultPin?.pin.upstreamVersion);
+        expect(row.remote).toBe("");
+      }
+    });
+
+    test("slim-translates a serviceVersions override to a non-default catalog pin", () => {
+      const nonDefaultPostgresPin = actualCatalogPins().find(
+        (entry) => entry.sourceService === "postgres" && !entry.isDefault,
+      );
+      if (nonDefaultPostgresPin === undefined) {
+        throw new Error("Expected the catalog to carry a non-default postgres pin.");
+      }
+      const version = nonDefaultPostgresPin.pin.upstreamVersion;
+
+      // The Dockerfile's `pg` stage pins the default line, not this one — establishing that the
+      // override below actually changes the resolved version instead of matching it by accident.
+      expect(dockerfileServiceImageRaw("pg").split(":").at(-1)).not.toBe(version);
+
+      expect(
+        listLocalServiceVersions({
+          slim: true,
+          serviceVersions: { postgres: version },
+        }),
+      ).toContainEqual({
+        name: "ghcr.io/supabase/cli/postgres",
+        local: version,
+        remote: "",
+      });
+    });
+  });
+
   test("slim-translates a version override that matches a catalog pin", () => {
     expect(
       listLocalServiceVersions({ slim: true, serviceVersions: { auth: "v2.197.0" } }),
diff --git a/apps/cli/src/shared/services/slim-images.ts b/apps/cli/src/shared/services/slim-images.ts
index 440e3a5284..503114e438 100644
--- a/apps/cli/src/shared/services/slim-images.ts
+++ b/apps/cli/src/shared/services/slim-images.ts
@@ -4,12 +4,7 @@ import { Config, ConfigProvider, Effect, Option } from "effect";
 const SLIM_IMAGES_ENV = "SUPABASE_USE_SLIM_IMAGES";
 const SLIM_IMAGE_PREFIX = "ghcr.io/supabase/cli/";
 
-/**
- * Maps embedded-Dockerfile aliases onto the slim service catalog. Aliases with
- * no slim build (kong, `pg14`, the `differ`/`migra`/`pgprove` job images) are
- * absent and keep their docker.io reference. OrioleDB tags are excluded in
- * `slimCatalogPin`.
- */
+/** Dockerfile alias to slim service; kong, `pg14`, and the job images have no slim build. */
 const SLIM_SERVICE_BY_ALIAS = {
   pg: "postgres",
   pg15: "postgres",
@@ -46,19 +41,12 @@ const V_PREFIXED_SERVICES: ReadonlySet<SlimServiceName> = new Set([
   "pooler",
 ]);
 
-/**
- * Reads the ambient slim-image flag for callers without an explicit project value: always the
- * process environment, never the active `ConfigProvider`. That lookup cannot fail.
- */
+/** The slim-image flag from the process environment, never the active `ConfigProvider`. */
 export const slimImagesEnabled = Effect.suspend(() =>
   Config.option(Config.string(SLIM_IMAGES_ENV)).parse(ConfigProvider.fromEnv()),
 ).pipe(Effect.map(Option.exists((value) => value === "true" || value === "1")), Effect.orDie);
 
-/**
- * Catalog-normalized slim tag under `ghcr.io/supabase/cli/<service>`. The
- * published slim catalog uses a `v` prefix for application services while
- * postgres, studio, and vector retain their unprefixed tags.
- */
+/** Catalog tag: `v`-prefixed for application services; postgres, studio, and vector stay bare. */
 function slimTagForService(service: SlimServiceName, rawTag: string): string {
   const tag = rawTag.trim();
   if (V_PREFIXED_SERVICES.has(service)) {
@@ -100,12 +88,7 @@ export function slimCatalogPin(alias: string, image: string): SlimCatalogPin | u
   return { service, version: slimTagForService(service, tag) };
 }
 
-/**
- * Looks up the pinned catalog image (with its published `@sha256` digest) for
- * `service` whose `upstreamVersion` equals `version`. Reads the same catalog
- * `apps/cli`'s stack-independent clients use, keyed by the slim-services
- * `sourceService` name (which matches this module's `SlimServiceName`).
- */
+/** Keyed by the slim-services `sourceService`, which matches `SlimServiceName`. */
 function catalogImageFor(service: SlimServiceName, upstreamVersion: string): string | undefined {
   for (const entry of catalogPins()) {
     if (entry.sourceService === service && entry.pin.upstreamVersion === upstreamVersion) {
@@ -116,17 +99,9 @@ function catalogImageFor(service: SlimServiceName, upstreamVersion: string): str
 }
 
 /**
- * Resolves the catalog's pinned slim image (repository, release version and
- * digest) whose `upstreamVersion` normalizes to `image`'s tag for `alias`.
- * This owns tag normalization (`v`-prefixing, `tagPrefix`, vector's `-alpine`
- * strip) via {@link slimCatalogPin}, so pins that differ only in prefix
- * between the two registries (`supavisor`, `logflare`) still match. Returns `undefined` whenever
- * no catalog pin matches `alias` and `image`'s tag — callers then keep the upstream (non-slim)
- * image instead of guessing a slim tag. That covers more than "no slim build": an alias with no
- * slim build at all (kong, `pg14`, the one-shot job images); an excluded tag on an alias that
- * does have one (an OrioleDB `pg` tag, which {@link slimCatalogPin} always excludes); and a tag
- * the catalog simply doesn't pin (an upstream version the catalog hasn't caught up to yet, or a
- * hosted-project override from `supabase link` that doesn't match the pinned upstream version).
+ * Resolves the catalog's pinned slim image matching `alias`'s normalized tag (via
+ * {@link slimCatalogPin}), or `undefined` when no catalog pin matches — callers then keep the
+ * upstream image instead of guessing a slim tag.
  */
 export function toSlimImage(alias: string, image: string): string | undefined {
   const pin = slimCatalogPin(alias, image);
diff --git a/apps/cli/src/shared/services/slim-images.unit.test.ts b/apps/cli/src/shared/services/slim-images.unit.test.ts
index 5064bd026a..998611c15b 100644
--- a/apps/cli/src/shared/services/slim-images.unit.test.ts
+++ b/apps/cli/src/shared/services/slim-images.unit.test.ts
@@ -14,14 +14,8 @@ import {
   usesSlimImageRuntime,
 } from "./slim-images.ts";
 
-// Only `auth` is pinned in this fixture catalog, at `v2.197.0-r0`, with a realistic
-// (non-placeholder) fixture digest built to the real `ArtifactPin`/`NativePin` shape from
-// `@supabase/stack/internal/artifacts`. Every other service is deliberately absent, so
-// `toSlimImage` falls through to the upstream image for them — the permanent state for a
-// non-slim-capable alias (kong, `pg14`, the job images): the Dockerfile's slim-capable lines
-// are generated from the catalog now, so they never disagree with it. `vi.mock` factories are
-// hoisted above every other top-level statement, so the fixture is inlined rather than
-// referencing an outer const.
+// Only `auth` is pinned, so every other alias falls through to its upstream image. `vi.mock`
+// factories are hoisted above top-level statements, so the fixture is inlined.
 vi.mock("@supabase/stack/internal/artifacts", () => {
   const digest = "d348483ad1141c54bfb4eaae801f5385fe1c2970fc106f95f531b5247092d52c";
   const nativePin = { archive: digest, manifest: digest };
diff --git a/apps/cli/src/shared/telemetry/__fixtures__/error-tags.txt b/apps/cli/src/shared/telemetry/__fixtures__/error-tags.txt
index c89c548f1b..fc5ef75610 100644
--- a/apps/cli/src/shared/telemetry/__fixtures__/error-tags.txt
+++ b/apps/cli/src/shared/telemetry/__fixtures__/error-tags.txt
@@ -1,5 +1,4 @@
 AccessTokenRequiredError
-ApiError
 BackupListNetworkError
 BackupListUnexpectedStatusError
 BackupRestoreNetworkError
@@ -315,14 +314,12 @@ InvalidFunctionDeploySlugError
 InvalidFunctionDownloadResponseError
 InvalidFunctionSlugError
 InvalidGenTypesDurationError
-InvalidLocalServiceVersionsStateError
 InvalidOutputFormatError
 InvalidProjectLinkStateError
 InvalidProjectRefError
 InvalidRemoteProjectIdError
 InvalidSecretPairError
 InvalidServiceVersionTagError
-InvalidTokenError
 KongReloadError
 LinkApiKeysNetworkError
 LinkAuthTokenError
@@ -406,7 +403,6 @@ PgDeltaFilesError
 PgDeltaMigrationWriteError
 PgDeltaNextError
 PgDeltaSslProbeError
-PlatformAuthRequiredError
 PostgresConfigDeleteNetworkError
 PostgresConfigDeleteSerializeError
 PostgresConfigDeleteUnexpectedStatusError
diff --git a/apps/cli/src/shared/telemetry/analytics-context.ts b/apps/cli/src/shared/telemetry/analytics-context.ts
index f7851e4e13..5ba647b6bb 100644
--- a/apps/cli/src/shared/telemetry/analytics-context.ts
+++ b/apps/cli/src/shared/telemetry/analytics-context.ts
@@ -3,10 +3,7 @@ import { Effect, Context } from "effect";
 export type AnalyticsContext = {
   readonly command_run_id?: string;
   readonly command?: string;
-  // next/ shell shape — separate `flags_used` (names) and `flag_values` (allowlist).
-  readonly flags_used?: ReadonlyArray<string>;
-  readonly flag_values?: Record<string, unknown>;
-  // legacy/ shell shape — single `flags` map mirroring Go's redaction.
+  // Changed flags only; values not marked telemetry-safe are redacted.
   readonly flags?: Record<string, unknown>;
   readonly distinct_id?: string;
   readonly groups?: {
diff --git a/apps/cli/src/shared/telemetry/command-instrumentation.ts b/apps/cli/src/shared/telemetry/command-instrumentation.ts
deleted file mode 100644
index 665e189731..0000000000
--- a/apps/cli/src/shared/telemetry/command-instrumentation.ts
+++ /dev/null
@@ -1,168 +0,0 @@
-import { Cause, Clock, Effect, Exit, Option, Stdio } from "effect";
-import {
-  CommandRuntime,
-  getCommandRuntimeCommand,
-  getCommandRuntimeSpanName,
-} from "../runtime/command-runtime.service.ts";
-import { Output } from "../output/output.service.ts";
-import { withAnalyticsContext } from "./analytics-context.ts";
-import { Analytics } from "./analytics.service.ts";
-import {
-  EventCommandExecuted,
-  PropDurationMs,
-  PropExitCode,
-  PropOutputFormat,
-} from "./event-catalog.ts";
-import { failureTelemetryPropertiesForCause } from "./failure-metadata.ts";
-
-interface CommandInstrumentationOptions<Flags extends Record<string, unknown> = never> {
-  readonly analytics?: boolean;
-  readonly flags?: Flags;
-  readonly allowedFlagValues?: ReadonlyArray<Extract<keyof Flags, string>>;
-}
-
-function toCliFlagName(key: string): string {
-  return key.replace(/[A-Z]/g, (char) => `-${char.toLowerCase()}`);
-}
-
-function extractFlagsUsed(args: ReadonlyArray<string>): ReadonlyArray<string> {
-  const used = new Set<string>();
-
-  for (let index = 0; index < args.length; index++) {
-    const arg = args[index];
-    if (arg === undefined || !arg.startsWith("--")) continue;
-
-    const raw = arg.slice(2);
-    const [flagName] = raw.split("=", 2);
-    if (flagName === undefined || flagName.length === 0) continue;
-
-    used.add(flagName);
-  }
-
-  return [...used].sort((left, right) => left.localeCompare(right));
-}
-
-function normalizeFlagValue(value: unknown): unknown {
-  if (value === undefined) return undefined;
-  if (!Option.isOption(value)) return value;
-  if (Option.isNone(value)) return undefined;
-  return normalizeFlagValue(value.value);
-}
-
-function extractAllowedFlagValues<Flags extends Record<string, unknown>>(
-  flags: Flags,
-  allowedFlagValues: ReadonlyArray<Extract<keyof Flags, string>>,
-  flagsUsed: ReadonlyArray<string>,
-): Record<string, unknown> {
-  const usedFlagSet = new Set(flagsUsed);
-  const entries: Array<readonly [string, unknown]> = [];
-
-  for (const key of allowedFlagValues) {
-    const flagName = toCliFlagName(key);
-    if (!usedFlagSet.has(flagName)) continue;
-
-    const value = normalizeFlagValue(flags[key]);
-    if (value === undefined) continue;
-
-    entries.push([flagName, value]);
-  }
-
-  return Object.fromEntries(entries);
-}
-
-function hasFlags<Flags extends Record<string, unknown>>(
-  options: CommandInstrumentationOptions<Flags> | undefined,
-): options is CommandInstrumentationOptions<Flags> & { readonly flags: Flags } {
-  return options?.flags !== undefined;
-}
-
-function withCommandTracingImplementation() {
-  return <A, E, R>(self: Effect.Effect<A, E, R>) =>
-    Effect.gen(function* () {
-      const commandRuntime = yield* CommandRuntime;
-      const command = getCommandRuntimeCommand(commandRuntime);
-
-      return yield* Effect.gen(function* () {
-        yield* Effect.annotateCurrentSpan({
-          command_run_id: commandRuntime.commandRunId,
-          command,
-        });
-        return yield* self;
-      }).pipe(Effect.withSpan(getCommandRuntimeSpanName(commandRuntime)));
-    });
-}
-
-function withCommandAnalyticsImplementation<Flags extends Record<string, unknown>>(
-  options?: CommandInstrumentationOptions<Flags>,
-) {
-  return <A, E, R>(self: Effect.Effect<A, E, R>) =>
-    Effect.gen(function* () {
-      const commandRuntime = yield* CommandRuntime;
-      const command = getCommandRuntimeCommand(commandRuntime);
-
-      return yield* Effect.gen(function* () {
-        yield* Effect.annotateCurrentSpan({
-          command_run_id: commandRuntime.commandRunId,
-          command,
-        });
-
-        const analytics = yield* Analytics;
-        const output = yield* Output;
-        const stdio = yield* Stdio.Stdio;
-        const args = yield* stdio.args;
-        const startedAt = yield* Clock.currentTimeMillis;
-        const flagsUsed = extractFlagsUsed(args);
-        const flagValues = hasFlags(options)
-          ? extractAllowedFlagValues(options.flags, options.allowedFlagValues ?? [], flagsUsed)
-          : {};
-        const analyticsContext = {
-          command_run_id: commandRuntime.commandRunId,
-          command,
-          flags_used: flagsUsed,
-          flag_values: flagValues,
-        } as const;
-
-        const exit = yield* self.pipe(withAnalyticsContext(analyticsContext), Effect.exit);
-        const finishedAt = yield* Clock.currentTimeMillis;
-
-        yield* analytics
-          .capture(EventCommandExecuted, {
-            [PropExitCode]: Exit.isSuccess(exit) ? 0 : 1,
-            [PropDurationMs]: finishedAt - startedAt,
-            [PropOutputFormat]: output.format,
-            ...(Exit.isFailure(exit) ? failureTelemetryPropertiesForCause(exit.cause) : {}),
-          })
-          .pipe(
-            withAnalyticsContext(analyticsContext),
-            // Best-effort: a capture failure or defect must never replace the
-            // command's own result, but fiber interruption (Ctrl+C landing
-            // during this trailing capture) must still propagate.
-            Effect.catchCause((cause) =>
-              Cause.hasInterruptsOnly(cause) ? Effect.failCause(cause) : Effect.void,
-            ),
-          );
-
-        if (Exit.isFailure(exit)) {
-          return yield* Effect.failCause(exit.cause);
-        }
-        return exit.value;
-      }).pipe(Effect.withSpan(getCommandRuntimeSpanName(commandRuntime)));
-    });
-}
-
-export function withCommandInstrumentation(): <A, E, R>(
-  self: Effect.Effect<A, E, R>,
-) => Effect.Effect<A, E, R | Analytics | CommandRuntime | Stdio.Stdio | Output>;
-export function withCommandInstrumentation<Flags extends Record<string, unknown>>(
-  options: CommandInstrumentationOptions<Flags>,
-): <A, E, R>(
-  self: Effect.Effect<A, E, R>,
-) => Effect.Effect<A, E, R | Analytics | CommandRuntime | Stdio.Stdio | Output>;
-export function withCommandInstrumentation<Flags extends Record<string, unknown>>(
-  options?: CommandInstrumentationOptions<Flags>,
-) {
-  if (options?.analytics === false) {
-    return withCommandTracingImplementation();
-  }
-  return withCommandAnalyticsImplementation(options);
-}
diff --git a/apps/cli/src/shared/telemetry/command-instrumentation.unit.test.ts b/apps/cli/src/shared/telemetry/command-instrumentation.unit.test.ts
deleted file mode 100644
index 7434fb22ea..0000000000
--- a/apps/cli/src/shared/telemetry/command-instrumentation.unit.test.ts
+++ /dev/null
@@ -1,415 +0,0 @@
-import { describe, expect, it } from "@effect/vitest";
-import { BunCrypto } from "@effect/platform-bun";
-import { Cause, Data, Effect, Exit, Layer, Option, Schema, Stdio } from "effect";
-import { commandRuntimeLayer } from "../runtime/command-runtime.layer.ts";
-import { CurrentAnalyticsContext } from "./analytics-context.ts";
-import { Analytics } from "./analytics.service.ts";
-import { withCommandInstrumentation } from "./command-instrumentation.ts";
-import {
-  actionability,
-  type CliErrorActionabilityDeclaration,
-  ErrorActionabilityId,
-} from "./error-actionability.ts";
-import {
-  PropErrorCategory,
-  PropErrorFingerprint,
-  PropErrorKind,
-  PropHasSuggestion,
-  PropSuggestedCommand,
-  PropSuggestionType,
-  PropWorkflow,
-} from "./event-catalog.ts";
-import { mockOutput } from "../../../tests/helpers/mocks.ts";
-
-const FAILURE_PROPERTY_NAMES = [
-  PropErrorKind,
-  PropErrorCategory,
-  PropErrorFingerprint,
-  PropHasSuggestion,
-  PropSuggestionType,
-  PropSuggestedCommand,
-  PropWorkflow,
-] as const;
-
-const encodeJson = Schema.encodeEffect(Schema.fromJsonString(Schema.Unknown));
-
-class InstrumentationAuthError extends Data.TaggedError("InstrumentationAuthError")<{
-  readonly message: string;
-  readonly path: string;
-  readonly sql: string;
-  readonly projectRef: string;
-  readonly hostname: string;
-  readonly token: string;
-}> {
-  get [ErrorActionabilityId](): CliErrorActionabilityDeclaration {
-    return actionability.authLogin;
-  }
-}
-
-function mockContextualAnalytics() {
-  const captured: Array<{
-    event: string;
-    properties: Record<string, unknown>;
-  }> = [];
-
-  const layer = Layer.succeed(
-    Analytics,
-    Analytics.of({
-      capture: (event: string, properties: Record<string, unknown> = {}) =>
-        Effect.gen(function* () {
-          const context = yield* CurrentAnalyticsContext;
-          captured.push({
-            event,
-            properties: {
-              ...context,
-              ...properties,
-            },
-          });
-        }),
-      identify: () => Effect.void,
-      alias: () => Effect.void,
-      groupIdentify: () => Effect.void,
-    }),
-  );
-
-  return { layer, captured };
-}
-
-function failingAnalytics(defect: unknown) {
-  return Layer.succeed(
-    Analytics,
-    Analytics.of({
-      capture: () => Effect.die(defect),
-      identify: () => Effect.void,
-      alias: () => Effect.void,
-      groupIdentify: () => Effect.void,
-    }),
-  );
-}
-
-function interruptingAnalytics() {
-  return Layer.succeed(
-    Analytics,
-    Analytics.of({
-      capture: () => Effect.interrupt,
-      identify: () => Effect.void,
-      alias: () => Effect.void,
-      groupIdentify: () => Effect.void,
-    }),
-  );
-}
-
-describe("withCommandInstrumentation", () => {
-  it.live("creates a command span and annotates it with command metadata", () => {
-    const analytics = mockContextualAnalytics();
-
-    return Effect.gen(function* () {
-      const span = yield* Effect.currentSpan;
-      expect(span.name).toBe("command.branches.list");
-      expect(span.attributes.get("command")).toBe("branches list");
-      expect(typeof span.attributes.get("command_run_id")).toBe("string");
-    }).pipe(
-      withCommandInstrumentation({ analytics: false }),
-      Effect.provide(
-        Layer.mergeAll(
-          analytics.layer,
-          mockOutput({ format: "text" }).layer,
-          Stdio.layerTest({ args: Effect.succeed(["branches", "list"]) }),
-          commandRuntimeLayer(["branches", "list"]).pipe(Layer.provide(BunCrypto.layer)),
-        ),
-      ),
-    );
-  });
-
-  it.live("shares one command_run_id across milestone and command events", () => {
-    const analytics = mockContextualAnalytics();
-
-    return Effect.gen(function* () {
-      const service = yield* Analytics;
-      const context = yield* CurrentAnalyticsContext;
-
-      yield* service.capture("cli_stack_started", {
-        command_run_id: context.command_run_id,
-      });
-    }).pipe(
-      withCommandInstrumentation(),
-      Effect.provide(
-        Layer.mergeAll(
-          analytics.layer,
-          mockOutput({ format: "text" }).layer,
-          Stdio.layerTest({ args: Effect.succeed(["start", "--detach", "--exclude=auth"]) }),
-          commandRuntimeLayer(["start"]).pipe(Layer.provide(BunCrypto.layer)),
-        ),
-      ),
-      Effect.tap(() =>
-        Effect.sync(() => {
-          expect(analytics.captured).toHaveLength(2);
-
-          const milestone = analytics.captured[0];
-          const command = analytics.captured[1];
-          expect(milestone?.event).toBe("cli_stack_started");
-          expect(command?.event).toBe("cli_command_executed");
-
-          expect(typeof milestone?.properties.command_run_id).toBe("string");
-          expect(milestone?.properties.command_run_id).toBe(command?.properties.command_run_id);
-          expect(command?.properties.command).toBe("start");
-          expect(command?.properties.flags_used).toEqual(["detach", "exclude"]);
-          expect(command?.properties.flag_values).toEqual({});
-          expect(command?.properties.exit_code).toBe(0);
-          for (const property of FAILURE_PROPERTY_NAMES) {
-            expect(command?.properties).not.toHaveProperty(property);
-          }
-        }),
-      ),
-    );
-  });
-
-  it.live("adds sanitized actionability metadata and preserves the original failure", () => {
-    const analytics = mockContextualAnalytics();
-    const secrets = {
-      message: "failed at /Users/alice/private/config.toml",
-      path: "/Users/alice/private/config.toml",
-      sql: "select * from customer_private_table",
-      projectRef: "abcdefghijklmnopqrst",
-      hostname: "db.customer.internal",
-      token: "customer-secret-token",
-    };
-    const failure = new InstrumentationAuthError(secrets);
-
-    const program = withCommandInstrumentation()(Effect.fail(failure)).pipe(
-      Effect.provide(
-        Layer.mergeAll(
-          analytics.layer,
-          mockOutput({ format: "text" }).layer,
-          Stdio.layerTest({ args: Effect.succeed(["login"]) }),
-          commandRuntimeLayer(["login"]).pipe(Layer.provide(BunCrypto.layer)),
-        ),
-      ),
-      Effect.exit,
-      Effect.tap((exit) =>
-        Effect.gen(function* () {
-          expect(analytics.captured).toHaveLength(1);
-          const event = analytics.captured[0];
-          expect(event?.event).toBe("cli_command_executed");
-          expect(event?.properties).toMatchObject({
-            exit_code: 1,
-            error_kind: "user_actionable",
-            error_category: "auth",
-            error_fingerprint: "tag:InstrumentationAuthError",
-            has_suggestion: true,
-            suggestion_type: "login",
-            suggested_command: "supabase login",
-          });
-          expect(event?.properties).not.toHaveProperty(PropWorkflow);
-          const encoded = yield* encodeJson(event);
-          for (const secret of Object.values(secrets)) expect(encoded).not.toContain(secret);
-
-          expect(Exit.isFailure(exit)).toBe(true);
-          if (Exit.isFailure(exit)) {
-            expect(Option.getOrUndefined(Cause.findErrorOption(exit.cause))).toBe(failure);
-          }
-        }),
-      ),
-    );
-
-    return program.pipe(Effect.asVoid);
-  });
-
-  it.live("classifies defects as internal panics without capturing their message", () => {
-    const analytics = mockContextualAnalytics();
-    const secret = "panic at /Users/alice/customer-project";
-
-    return Effect.die(new TypeError(secret)).pipe(
-      withCommandInstrumentation(),
-      Effect.provide(
-        Layer.mergeAll(
-          analytics.layer,
-          mockOutput({ format: "text" }).layer,
-          Stdio.layerTest({ args: Effect.succeed(["branches", "list"]) }),
-          commandRuntimeLayer(["branches", "list"]).pipe(Layer.provide(BunCrypto.layer)),
-        ),
-      ),
-      Effect.exit,
-      Effect.tap(() =>
-        Effect.gen(function* () {
-          expect(analytics.captured[0]?.properties).toMatchObject({
-            exit_code: 1,
-            error_kind: "internal_bug",
-            error_category: "panic",
-            error_fingerprint: "error:TypeError",
-            has_suggestion: true,
-            suggestion_type: "rerun_debug",
-          });
-          expect(yield* encodeJson(analytics.captured[0])).not.toContain(secret);
-        }),
-      ),
-      Effect.asVoid,
-    );
-  });
-
-  it.live("preserves the command failure when telemetry capture defects", () => {
-    const failure = new InstrumentationAuthError({
-      message: "command failure",
-      path: "path",
-      sql: "sql",
-      projectRef: "project",
-      hostname: "host",
-      token: "token",
-    });
-
-    return Effect.fail(failure).pipe(
-      withCommandInstrumentation(),
-      Effect.provide(
-        Layer.mergeAll(
-          failingAnalytics(new Error("telemetry defect")),
-          mockOutput({ format: "text" }).layer,
-          Stdio.layerTest({ args: Effect.succeed(["login"]) }),
-          commandRuntimeLayer(["login"]).pipe(Layer.provide(BunCrypto.layer)),
-        ),
-      ),
-      Effect.exit,
-      Effect.tap((exit) =>
-        Effect.sync(() => {
-          expect(Exit.isFailure(exit)).toBe(true);
-          if (Exit.isFailure(exit)) {
-            expect(Option.getOrUndefined(Cause.findErrorOption(exit.cause))).toBe(failure);
-            expect(Cause.hasDies(exit.cause)).toBe(false);
-          }
-        }),
-      ),
-      Effect.asVoid,
-    );
-  });
-
-  it.live("propagates fiber interruption from telemetry capture", () => {
-    // A capture failure or defect is swallowed (best-effort telemetry), but an
-    // interruption landing during the trailing capture must not be — the fiber
-    // is being cancelled and swallowing would fight the cancellation.
-    return Effect.void.pipe(
-      withCommandInstrumentation(),
-      Effect.provide(
-        Layer.mergeAll(
-          interruptingAnalytics(),
-          mockOutput({ format: "text" }).layer,
-          Stdio.layerTest({ args: Effect.succeed(["login"]) }),
-          commandRuntimeLayer(["login"]).pipe(Layer.provide(BunCrypto.layer)),
-        ),
-      ),
-      Effect.exit,
-      Effect.tap((exit) =>
-        Effect.sync(() => {
-          expect(Exit.isFailure(exit)).toBe(true);
-          if (Exit.isFailure(exit)) {
-            expect(Cause.hasInterruptsOnly(exit.cause)).toBe(true);
-          }
-        }),
-      ),
-      Effect.asVoid,
-    );
-  });
-
-  it.live("captures flag values only when explicitly allowlisted", () => {
-    const analytics = mockContextualAnalytics();
-
-    return Effect.void.pipe(
-      withCommandInstrumentation({
-        flags: {
-          stack: "default",
-          mode: "docker" as const,
-          exclude: ["auth", "storage"],
-          serviceVersion: [],
-          detach: true,
-        },
-        allowedFlagValues: ["exclude", "mode", "stack"],
-      }),
-      Effect.provide(
-        Layer.mergeAll(
-          analytics.layer,
-          mockOutput({ format: "text" }).layer,
-          Stdio.layerTest({
-            args: Effect.succeed([
-              "start",
-              "--detach",
-              "--mode=docker",
-              "--exclude",
-              "auth",
-              "--exclude",
-              "storage",
-            ]),
-          }),
-          commandRuntimeLayer(["start"]).pipe(Layer.provide(BunCrypto.layer)),
-        ),
-      ),
-      Effect.tap(() =>
-        Effect.sync(() => {
-          expect(analytics.captured).toHaveLength(1);
-          expect(analytics.captured[0]?.properties.flags_used).toEqual([
-            "detach",
-            "exclude",
-            "mode",
-          ]);
-          expect(analytics.captured[0]?.properties.flag_values).toEqual({
-            exclude: ["auth", "storage"],
-            mode: "docker",
-          });
-        }),
-      ),
-    );
-  });
-
-  it.live("unwraps Option values and emits kebab-case allowlisted keys only when used", () => {
-    const analytics = mockContextualAnalytics();
-
-    return Effect.void.pipe(
-      withCommandInstrumentation({
-        flags: {
-          token: Option.none<string>(),
-          name: Option.some("my-machine"),
-          noBrowser: true,
-        },
-        allowedFlagValues: ["token", "name", "noBrowser"],
-      }),
-      Effect.provide(
-        Layer.mergeAll(
-          analytics.layer,
-          mockOutput({ format: "text" }).layer,
-          Stdio.layerTest({
-            args: Effect.succeed(["login", "--name", "my-machine", "--no-browser"]),
-          }),
-          commandRuntimeLayer(["login"]).pipe(Layer.provide(BunCrypto.layer)),
-        ),
-      ),
-      Effect.tap(() =>
-        Effect.sync(() => {
-          expect(analytics.captured).toHaveLength(1);
-          expect(analytics.captured[0]?.properties.flags_used).toEqual(["name", "no-browser"]);
-          expect(analytics.captured[0]?.properties.flag_values).toEqual({
-            name: "my-machine",
-            "no-browser": true,
-          });
-        }),
-      ),
-    );
-  });
-
-  it.live("skips analytics capture when analytics are disabled", () => {
-    const analytics = mockContextualAnalytics();
-
-    return Effect.succeed("ok").pipe(
-      withCommandInstrumentation({ analytics: false }),
-      Effect.provide(
-        Layer.mergeAll(
-          analytics.layer,
-          mockOutput({ format: "text" }).layer,
-          Stdio.layerTest({ args: Effect.succeed(["telemetry", "enable"]) }),
-          commandRuntimeLayer(["telemetry", "enable"]).pipe(Layer.provide(BunCrypto.layer)),
-        ),
-      ),
-      Effect.tap(() =>
-        Effect.sync(() => {
-          expect(analytics.captured).toEqual([]);
-        }),
-      ),
-    );
-  });
-});
diff --git a/apps/cli/src/shared/telemetry/event-catalog.ts b/apps/cli/src/shared/telemetry/event-catalog.ts
index 5720929844..b6008797e1 100644
--- a/apps/cli/src/shared/telemetry/event-catalog.ts
+++ b/apps/cli/src/shared/telemetry/event-catalog.ts
@@ -37,6 +37,12 @@ export const PropErrorFingerprint = "error_fingerprint";
 export const PropHasSuggestion = "has_suggestion";
 export const PropSuggestionType = "suggestion_type";
 export const PropSuggestedCommand = "suggested_command";
+// Set only for commands routed by `experimental.stack`.
+export const PropStackBackend = "stack_backend";
+// Set only once a command resolves local database config.
+export const PropOrioleDb = "orioledb";
+// Set only once a stack-backend command resolves its stack's runtime.
+export const PropStackRuntime = "stack_runtime";
 // Reserved for a closed workflow label; nothing emits it until a closed
 // vocabulary is agreed (tests assert its absence on failure events).
 export const PropWorkflow = "workflow";
diff --git a/apps/cli/src/shared/telemetry/exporters/debug-console.ts b/apps/cli/src/shared/telemetry/exporters/debug-console.ts
index 6044712728..6f6110848a 100644
--- a/apps/cli/src/shared/telemetry/exporters/debug-console.ts
+++ b/apps/cli/src/shared/telemetry/exporters/debug-console.ts
@@ -1,7 +1,10 @@
-import { DateTime, Effect, Match, Option, Schema } from "effect";
+import { Cause, DateTime, Effect, Exit, Option, Schema } from "effect";
 import type { PlatformError, Tracer } from "effect";
+import type { TraceSanitizer } from "../trace-sanitize.ts";
 
-type EndedSpanStatus = Extract<Tracer.SpanStatus, { readonly _tag: "Ended" }>;
+const MAX_PRINTED_DEPTH = 2;
+/** Keeps each console line readable; exporters still receive every attribute. */
+const MAX_PRINTED_ATTRIBUTES_LENGTH = 120;
 const JsonAttributesSchema = Schema.fromJsonString(Schema.Record(Schema.String, Schema.Unknown));
 
 function formatTimestamp(ms: number): Option.Option<string> {
@@ -18,38 +21,69 @@ function formatTimestamp(ms: number): Option.Option<string> {
   );
 }
 
-export const formatSpanForDebugConsole = Effect.fnUntraced(function* (span: Tracer.Span) {
-  const ended = Match.value(span.status).pipe(
-    Match.tag("Started", (): Option.Option<EndedSpanStatus> => Option.none()),
-    Match.tag("Ended", (status): Option.Option<EndedSpanStatus> => Option.some(status)),
-    Match.exhaustive,
+const isSameSpan = (span: Tracer.AnySpan, other: Option.Option<Tracer.AnySpan>): boolean =>
+  Option.isSome(other) &&
+  span.spanId === other.value.spanId &&
+  span.traceId === other.value.traceId;
+
+/** Counts ancestors below `root`, the span current where the console is installed. */
+function spanDepth(span: Tracer.Span, root: Option.Option<Tracer.AnySpan>): number {
+  let depth = 0;
+  let parent = span.parent;
+  while (Option.isSome(parent) && parent.value._tag === "Span" && !isSameSpan(parent.value, root)) {
+    depth += 1;
+    parent = parent.value.parent;
+  }
+  return depth;
+}
+
+function spanFailed(span: Tracer.Span): boolean {
+  return (
+    span.status._tag === "Ended" &&
+    Exit.isFailure(span.status.exit) &&
+    !Cause.hasInterruptsOnly(span.status.exit.cause)
   );
-  if (Option.isNone(ended)) return Option.none<string>();
+}
 
-  const durationMs = Math.round(Number(ended.value.endTime - ended.value.startTime) / 1_000_000);
-  const timestampMs = Number(ended.value.startTime / BigInt(1_000_000));
-  const time = formatTimestamp(timestampMs);
+export const formatSpanForDebugConsole = Effect.fnUntraced(function* (
+  span: Tracer.Span,
+  sanitizer: TraceSanitizer,
+  root: Option.Option<Tracer.AnySpan> = Option.none(),
+) {
+  const status = span.status;
+  if (status._tag !== "Ended") return Option.none<string>();
+  const depth = spanDepth(span, root);
+  const failed = spanFailed(span);
+  if (depth > MAX_PRINTED_DEPTH && !failed) return Option.none<string>();
+
+  const durationMs = Math.round(Number(status.endTime - status.startTime) / 1_000_000);
+  const time = formatTimestamp(Number(status.startTime / BigInt(1_000_000)));
   if (Option.isNone(time)) return Option.none<string>();
 
-  const attrs: Record<string, unknown> = {};
-  for (const [key, value] of span.attributes) {
-    attrs[key] = value;
-  }
+  const attrs = Object.fromEntries(sanitizer.attributeEntries(span.attributes));
+  const encoded =
+    Object.keys(attrs).length === 0 ? "" : yield* Schema.encodeEffect(JsonAttributesSchema)(attrs);
   const attrStr =
-    Object.keys(attrs).length === 0
+    encoded.length === 0
       ? ""
-      : ` ${yield* Schema.encodeEffect(JsonAttributesSchema)(attrs)}`;
+      : ` ${encoded.length > MAX_PRINTED_ATTRIBUTES_LENGTH ? `${encoded.slice(0, MAX_PRINTED_ATTRIBUTES_LENGTH - 1)}…` : encoded}`;
+  const indent = "  ".repeat(Math.min(depth, MAX_PRINTED_DEPTH + 1));
+  const marker = failed ? " failed" : "";
 
-  return Option.some(`[${time.value}] ${span.name} (${durationMs}ms)${attrStr}\n`);
+  return Option.some(
+    `[${time.value}] ${indent}${span.name} (${durationMs}ms)${marker}${attrStr}\n`,
+  );
 });
 
 export function makeDebugConsoleExporter(
   write: (line: string) => Effect.Effect<void, PlatformError.PlatformError, never>,
+  sanitizer: TraceSanitizer,
+  root: Option.Option<Tracer.AnySpan> = Option.none(),
 ): (
   span: Tracer.Span,
 ) => Effect.Effect<void, PlatformError.PlatformError | Schema.SchemaError, never> {
   return (span) =>
-    formatSpanForDebugConsole(span).pipe(
+    formatSpanForDebugConsole(span, sanitizer, root).pipe(
       Effect.flatMap(
         Option.match({
           onNone: () => Effect.void,
diff --git a/apps/cli/src/shared/telemetry/exporters/debug-console.unit.test.ts b/apps/cli/src/shared/telemetry/exporters/debug-console.unit.test.ts
index 6d5482dffd..f9cd025c8a 100644
--- a/apps/cli/src/shared/telemetry/exporters/debug-console.unit.test.ts
+++ b/apps/cli/src/shared/telemetry/exporters/debug-console.unit.test.ts
@@ -1,7 +1,11 @@
+import { BunServices } from "@effect/platform-bun";
 import { describe, expect, it } from "@effect/vitest";
 import { Cause, Clock, Context, Effect, Exit, Option, Schema, Tracer } from "effect";
+import { makeTraceSanitizer } from "../trace-sanitize.ts";
 import { formatSpanForDebugConsole, makeDebugConsoleExporter } from "./debug-console.ts";
 
+const sanitizer = makeTraceSanitizer.pipe(Effect.provide(BunServices.layer));
+
 const makeEndedSpan = (name: string, attrs: Record<string, unknown> = {}) =>
   Effect.map(Clock.currentTimeMillis, (now): Tracer.Span => {
     const startTime = BigInt(now) * BigInt(1_000_000);
@@ -36,10 +40,12 @@ describe("debug-console exporter", () => {
     Effect.gen(function* () {
       let stderrOutput = "";
       const span = yield* makeEndedSpan("test-span", { command: "login" });
-      const exportSpanToDebugConsole = makeDebugConsoleExporter((line) =>
-        Effect.sync(() => {
-          stderrOutput += line;
-        }),
+      const exportSpanToDebugConsole = makeDebugConsoleExporter(
+        (line) =>
+          Effect.sync(() => {
+            stderrOutput += line;
+          }),
+        yield* sanitizer,
       );
 
       yield* exportSpanToDebugConsole(span);
@@ -51,6 +57,21 @@ describe("debug-console exporter", () => {
     }),
   );
 
+  it.effect("caps long attribute output so each line stays readable", () =>
+    Effect.gen(function* () {
+      const span = yield* makeEndedSpan("command.status", {
+        "service.names":
+          "auth,rest,realtime,storage,imgproxy,kong,meta,studio,edge_runtime,logflare,vector,pooler",
+        "service.running_count": 12,
+      });
+
+      const line = yield* formatSpanForDebugConsole(span, yield* sanitizer);
+
+      expect(Option.getOrThrow(line)).toMatch(/…\n$/u);
+      expect(Option.getOrThrow(line).length).toBeLessThan(200);
+    }),
+  );
+
   it.effect("returns undefined for spans that have not ended", () =>
     Effect.gen(function* () {
       const span = {
@@ -61,7 +82,7 @@ describe("debug-console exporter", () => {
         } as Tracer.SpanStatus,
       };
 
-      expect(yield* formatSpanForDebugConsole(span)).toEqual(Option.none());
+      expect(yield* formatSpanForDebugConsole(span, yield* sanitizer)).toEqual(Option.none());
     }),
   );
 
@@ -70,7 +91,7 @@ describe("debug-console exporter", () => {
       const cyclic: Record<string, unknown> = {};
       cyclic.self = cyclic;
       const result = yield* Effect.exit(
-        formatSpanForDebugConsole(yield* makeEndedSpan("cyclic", cyclic)),
+        formatSpanForDebugConsole(yield* makeEndedSpan("cyclic", cyclic), yield* sanitizer),
       );
 
       expect(Exit.isFailure(result)).toBe(true);
diff --git a/apps/cli/src/shared/telemetry/exporters/ndjson.ts b/apps/cli/src/shared/telemetry/exporters/ndjson.ts
deleted file mode 100644
index 0d1e51f3f4..0000000000
--- a/apps/cli/src/shared/telemetry/exporters/ndjson.ts
+++ /dev/null
@@ -1,81 +0,0 @@
-import { Clock, DateTime, Effect, Exit, FileSystem, Match, Option, Path, Schema } from "effect";
-import type { Tracer } from "effect";
-
-const RETENTION_DAYS = 7;
-type EndedSpanStatus = Extract<Tracer.SpanStatus, { readonly _tag: "Ended" }>;
-
-const NdjsonPayloadSchema = Schema.fromJsonString(
-  Schema.Struct({
-    timestamp: Schema.String,
-    traceId: Schema.String,
-    spanId: Schema.String,
-    name: Schema.String,
-    duration_ms: Schema.Finite,
-    status: Schema.Literals(["ok", "error"]),
-    error_code: Schema.optionalKey(Schema.String),
-    attributes: Schema.Record(Schema.String, Schema.Unknown),
-  }),
-);
-
-export const initNdjsonExporter = Effect.fnUntraced(
-  function* (tracesDir: string) {
-    const fs = yield* FileSystem.FileSystem;
-    const path = yield* Path.Path;
-    const now = yield* Clock.currentTimeMillis;
-    yield* fs.makeDirectory(tracesDir, { recursive: true, mode: 0o700 });
-
-    const files = yield* fs.readDirectory(tracesDir);
-    const cutoff = now - RETENTION_DAYS * 24 * 60 * 60 * 1000;
-    for (const file of files) {
-      if (!file.endsWith(".ndjson")) continue;
-      const dateStr = file.replace(".ndjson", "");
-      const fileDate = DateTime.make(dateStr);
-      if (Option.isSome(fileDate) && DateTime.toEpochMillis(fileDate.value) < cutoff) {
-        yield* fs.remove(path.join(tracesDir, file));
-      }
-    }
-  },
-  (effect, _tracesDir) => Effect.ignore(effect),
-);
-
-export const exportSpanToNdjson = Effect.fnUntraced(function* (
-  span: Tracer.Span,
-  tracesDir: string,
-) {
-  const status = span.status;
-  const ended = Match.value(status).pipe(
-    Match.tag("Started", (): Option.Option<EndedSpanStatus> => Option.none()),
-    Match.tag("Ended", (status): Option.Option<EndedSpanStatus> => Option.some(status)),
-    Match.exhaustive,
-  );
-  if (Option.isNone(ended)) return;
-
-  const durationMs = Number(ended.value.endTime - ended.value.startTime) / 1_000_000;
-  const timestamp = DateTime.make(Number(ended.value.startTime / BigInt(1_000_000)));
-  if (Option.isNone(timestamp)) return;
-
-  const attributes: Record<string, unknown> = {};
-  for (const [key, value] of span.attributes) {
-    attributes[key] = value;
-  }
-
-  const payload = {
-    timestamp: DateTime.formatIso(timestamp.value),
-    traceId: span.traceId,
-    spanId: span.spanId,
-    name: span.name,
-    duration_ms: Math.round(durationMs),
-    status: Exit.isSuccess(ended.value.exit) ? ("ok" as const) : ("error" as const),
-    ...(Exit.isFailure(ended.value.exit) && { error_code: "Failure" }),
-    attributes,
-  };
-
-  const fs = yield* FileSystem.FileSystem;
-  const path = yield* Path.Path;
-  const now = yield* Clock.currentTimeMillis;
-  const dateTime = DateTime.make(now);
-  if (Option.isNone(dateTime)) return;
-  const date = DateTime.formatIsoDateUtc(dateTime.value);
-  const line = yield* Schema.encodeEffect(NdjsonPayloadSchema)(payload);
-  yield* fs.writeFileString(path.join(tracesDir, `${date}.ndjson`), `${line}\n`, { flag: "a" });
-});
diff --git a/apps/cli/src/shared/telemetry/exporters/ndjson.unit.test.ts b/apps/cli/src/shared/telemetry/exporters/ndjson.unit.test.ts
deleted file mode 100644
index ef739c80ed..0000000000
--- a/apps/cli/src/shared/telemetry/exporters/ndjson.unit.test.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-import { describe, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
-import { Effect, Path } from "effect";
-import { useTempWorkdir } from "../../../../tests/helpers/command-mocks.ts";
-import { initNdjsonExporter } from "./ndjson.ts";
-
-const fsLayer = BunServices.layer;
-
-describe("initNdjsonExporter", () => {
-  const tempRoot = useTempWorkdir("supabase-ndjson-test-");
-
-  it.live("does not fail when traces directory does not exist", () =>
-    Effect.gen(function* () {
-      const path = yield* Path.Path;
-      yield* initNdjsonExporter(path.join(tempRoot.current, "traces"));
-    }).pipe(Effect.provide(fsLayer)),
-  );
-});
diff --git a/apps/cli/src/shared/telemetry/otlp-trace-sink.ts b/apps/cli/src/shared/telemetry/otlp-trace-sink.ts
new file mode 100644
index 0000000000..106dd73372
--- /dev/null
+++ b/apps/cli/src/shared/telemetry/otlp-trace-sink.ts
@@ -0,0 +1,106 @@
+import {
+  ConfigProvider,
+  Effect,
+  FileSystem,
+  Layer,
+  Option,
+  PlatformError,
+  Redacted,
+  Semaphore,
+} from "effect";
+import type { Crypto, Scope, Tracer } from "effect";
+import { FetchHttpClient, HttpBody, HttpClient, HttpClientResponse } from "effect/unstable/http";
+import * as OtlpExporter from "effect/unstable/observability/OtlpExporter";
+import * as OtlpSerialization from "effect/unstable/observability/OtlpSerialization";
+import * as OtlpTracer from "effect/unstable/observability/OtlpTracer";
+import { makeTraceSanitizer } from "./trace-sanitize.ts";
+
+const EXPORT_TIMEOUT_MS = 2_000;
+const NEWLINE = new TextEncoder().encode("\n");
+
+/** Resource identity attached to every exported span. */
+export interface OtlpTraceResource {
+  readonly serviceVersion: string;
+  readonly attributes: Readonly<Record<string, unknown>>;
+}
+
+const sanitizingSerialization = Layer.effect(
+  OtlpSerialization.OtlpSerialization,
+  Effect.gen(function* () {
+    const sanitizer = yield* makeTraceSanitizer;
+    return OtlpSerialization.OtlpSerialization.of({
+      traces: (data) => HttpBody.jsonUnsafe(sanitizer.traceData(data)),
+      metrics: (data) => HttpBody.jsonUnsafe(data),
+      logs: (data) => HttpBody.jsonUnsafe(data),
+    });
+  }),
+);
+
+/** An OTLP tracer whose batches are sanitized before they reach the transport. */
+export const makeOtlpTracer = (options: {
+  readonly url: string;
+  readonly headers: Redacted.Redacted<Readonly<Record<string, string>>>;
+  readonly resource: OtlpTraceResource;
+}): Effect.Effect<Tracer.Tracer, never, HttpClient.HttpClient | Crypto.Crypto | Scope.Scope> =>
+  OtlpTracer.make({
+    url: options.url,
+    headers: Redacted.value(options.headers),
+    resource: {
+      serviceName: "supabase-cli",
+      serviceVersion: options.resource.serviceVersion,
+      attributes: { ...options.resource.attributes },
+    },
+    shutdownTimeout: EXPORT_TIMEOUT_MS,
+  }).pipe(
+    Effect.provide(Layer.mergeAll(OtlpExporter.layerFlusher, sanitizingSerialization)),
+    // The exporter otherwise reads global `OTEL_*` settings such as `OTEL_RESOURCE_ATTRIBUTES`.
+    Effect.provideService(ConfigProvider.ConfigProvider, ConfigProvider.fromUnknown({})),
+  );
+
+/**
+ * Transport that appends each batch as one JSON line and always answers 2xx, so the exporter
+ * never retries, duplicates, or pauses on a local write failure.
+ */
+export const fileTransportLayer = (path: string) =>
+  Layer.effect(
+    HttpClient.HttpClient,
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const lock = yield* Semaphore.make(1);
+      const existing = yield* Effect.option(fs.stat(path));
+      if (Option.isSome(existing) && existing.value.type !== "File") {
+        return yield* PlatformError.systemError({
+          _tag: "BadResource",
+          module: "FileSystem",
+          method: "open",
+          pathOrDescriptor: path,
+          description: "not a regular file",
+        });
+      }
+      yield* fs.writeFile(path, new Uint8Array(), { flag: "a", mode: 0o600 });
+      // A file we did not create may belong to someone else; owner-only mode is then best-effort.
+      yield* Effect.ignore(fs.chmod(path, 0o600));
+      return HttpClient.make((request) => {
+        const write =
+          request.body._tag === "Uint8Array"
+            ? fs.writeFile(path, appendNewline(request.body.body), { flag: "a", mode: 0o600 })
+            : Effect.void;
+        return lock
+          .withPermits(1)(write)
+          .pipe(
+            Effect.ignore,
+            Effect.as(HttpClientResponse.fromWeb(request, new Response(null, { status: 204 }))),
+          );
+      });
+    }),
+  );
+
+function appendNewline(bytes: Uint8Array): Uint8Array {
+  const line = new Uint8Array(bytes.length + NEWLINE.length);
+  line.set(bytes);
+  line.set(NEWLINE, bytes.length);
+  return line;
+}
+
+/** Transport that posts batches to a collector. */
+export const collectorTransportLayer = FetchHttpClient.layer;
diff --git a/apps/cli/src/shared/telemetry/posthog-client.ts b/apps/cli/src/shared/telemetry/posthog-client.ts
index 176a923a34..aa15346128 100644
--- a/apps/cli/src/shared/telemetry/posthog-client.ts
+++ b/apps/cli/src/shared/telemetry/posthog-client.ts
@@ -99,6 +99,7 @@ export const scopedPosthogClient = Effect.fnUntraced(function* (apiKey: string,
         // The SDK drain can continue after the Effect deadline; aborting its
         // fetches lets that background drain settle without active requests.
         Effect.ensuring(Effect.sync(() => shutdown.abort())),
+        Effect.withSpan("Analytics.flush"),
       ),
   );
   return client;
diff --git a/apps/cli/src/shared/telemetry/runtime.layer.ts b/apps/cli/src/shared/telemetry/runtime.layer.ts
index 89de0ba456..3c48b97811 100644
--- a/apps/cli/src/shared/telemetry/runtime.layer.ts
+++ b/apps/cli/src/shared/telemetry/runtime.layer.ts
@@ -1,6 +1,5 @@
 import { note } from "@clack/prompts";
-import { Config, Crypto, Effect, Layer, Option, Path } from "effect";
-import { CliSettings } from "../config/cli-settings.service.ts";
+import { Config, Crypto, Effect, Layer, Option } from "effect";
 import { CLI_VERSION } from "../cli/version.ts";
 import { RuntimeInfo } from "../runtime/runtime-info.service.ts";
 import { Tty } from "../runtime/tty.service.ts";
@@ -10,14 +9,19 @@ import { TelemetryRuntime } from "./runtime.service.ts";
 
 const CI_ENV_VARS = ["CI", "GITHUB_ACTIONS", "GITLAB_CI", "CIRCLECI", "JENKINS_URL", "BUILDKITE"];
 
+/** Whether a well-known CI provider variable is set. */
+export const detectCi = Effect.gen(function* () {
+  for (const envVar of CI_ENV_VARS) {
+    if (Option.isSome(yield* Config.option(Config.string(envVar)))) return true;
+  }
+  return false;
+});
+
 export const telemetryRuntimeLayer = Layer.effect(
   TelemetryRuntime,
   Effect.gen(function* () {
-    const cliSettings = yield* CliSettings;
     const crypto = yield* Crypto.Crypto;
-    const path = yield* Path.Path;
     const configDir = yield* getConfigDir;
-    const tracesDir = path.join(configDir, "traces");
     const tty = yield* Tty;
     const runtimeInfo = yield* RuntimeInfo;
 
@@ -59,23 +63,11 @@ export const telemetryRuntimeLayer = Layer.effect(
       }
     }
 
-    const showDebug =
-      (Option.isSome(cliSettings.debug) && cliSettings.debug.value === "1") ||
-      (Option.isSome(cliSettings.telemetryDebug) && cliSettings.telemetryDebug.value === "1");
-
-    let isCi = false;
-    for (const envVar of CI_ENV_VARS) {
-      if (Option.isSome(yield* Config.option(Config.string(envVar)))) {
-        isCi = true;
-        break;
-      }
-    }
+    const isCi = yield* detectCi;
 
     return TelemetryRuntime.of({
       configDir,
-      tracesDir,
       consent,
-      showDebug,
       deviceId: identity.deviceId,
       sessionId: identity.sessionId,
       identity: makeTelemetryIdentity(identity.distinctId),
diff --git a/apps/cli/src/shared/telemetry/runtime.service.ts b/apps/cli/src/shared/telemetry/runtime.service.ts
index ae287a0a60..f4086dd1db 100644
--- a/apps/cli/src/shared/telemetry/runtime.service.ts
+++ b/apps/cli/src/shared/telemetry/runtime.service.ts
@@ -4,9 +4,7 @@ import type { ConsentState } from "./types.ts";
 
 interface TelemetryRuntimeShape {
   readonly configDir: string;
-  readonly tracesDir: string;
   readonly consent: ConsentState;
-  readonly showDebug: boolean;
   readonly deviceId: string;
   readonly sessionId: string;
   readonly identity: TelemetryIdentity;
diff --git a/apps/cli/src/shared/telemetry/spans.ts b/apps/cli/src/shared/telemetry/spans.ts
new file mode 100644
index 0000000000..4998a89953
--- /dev/null
+++ b/apps/cli/src/shared/telemetry/spans.ts
@@ -0,0 +1,124 @@
+import { Clock, Context, Effect, Exit } from "effect";
+import type { Scope, Tracer } from "effect";
+import type * as ChildProcess from "effect/unstable/process/ChildProcess";
+import { makeHandle, type ChildProcessHandle } from "effect/unstable/process/ChildProcessSpawner";
+
+/** Whether spawned processes receive `TRACEPARENT`; true only while a trace sink is active. */
+export const ChildTracePropagation = Context.Reference<boolean>(
+  "supabase/telemetry/ChildTracePropagation",
+  { defaultValue: () => false },
+);
+
+/** What a process span records about the child: never argv or environment values. */
+export interface ProcessSpanTarget {
+  readonly executable: string;
+  readonly argCount: number;
+  /** A fixed-vocabulary verb such as `container inspect`; never free-form argv. */
+  readonly subcommand?: string;
+  /**
+   * Marks an attempt that has a fallback: a failure is recorded as `process.attempt_failed`
+   * instead of failing the span.
+   */
+  readonly hasFallback?: boolean;
+}
+
+/** Extra environment for a child process; empty unless a trace sink is active. */
+export type ChildTraceEnv = Readonly<Record<string, string>>;
+
+const noTraceEnv: ChildTraceEnv = {};
+
+function basename(executable: string): string {
+  const segments = executable.split(/[\\/]/u);
+  return segments[segments.length - 1] ?? executable;
+}
+
+const processAttributes = (target: ProcessSpanTarget) => ({
+  "process.executable.name": basename(target.executable),
+  "process.arg_count": target.argCount,
+  ...(target.subcommand === undefined ? {} : { "process.subcommand": target.subcommand }),
+});
+
+const traceEnvFor = Effect.fnUntraced(function* (span: Tracer.Span) {
+  const enabled = yield* ChildTracePropagation;
+  return enabled
+    ? { TRACEPARENT: `00-${span.traceId}-${span.spanId}-${span.sampled ? "01" : "00"}` }
+    : noTraceEnv;
+});
+
+/** Merges `traceEnv` into spawn options without dropping the inherited environment. */
+export function withChildTraceEnv(
+  options: ChildProcess.CommandOptions | undefined,
+  traceEnv: ChildTraceEnv,
+): ChildProcess.CommandOptions | undefined {
+  if (Object.keys(traceEnv).length === 0) return options;
+  if (options?.env === undefined) {
+    return { ...options, env: traceEnv, extendEnv: options?.extendEnv ?? true };
+  }
+  return { ...options, env: { ...options.env, ...traceEnv } };
+}
+
+/**
+ * Runs a child process to completion inside a span and records its exit code when `exitCode`
+ * extracts one from the result.
+ */
+export const withProcessSpan = <A, E, R>(
+  name: string,
+  target: ProcessSpanTarget,
+  run: (traceEnv: ChildTraceEnv) => Effect.Effect<A, E, R>,
+  exitCode: (result: A) => number | undefined = (result) =>
+    typeof result === "number" ? result : undefined,
+): Effect.Effect<A, E, R> => {
+  const options = { attributes: processAttributes(target) };
+  const traced = (span: Tracer.Span) =>
+    traceEnvFor(span).pipe(
+      Effect.flatMap((traceEnv) =>
+        run(traceEnv).pipe(Effect.withParentSpan(span, { captureStackTrace: false })),
+      ),
+      Effect.tap((result) =>
+        Effect.sync(() => {
+          const code = exitCode(result);
+          if (code !== undefined) span.attribute("process.exit_code", code);
+        }),
+      ),
+    );
+  if (target.hasFallback !== true) return Effect.useSpan(name, options, traced);
+  return Effect.useSpan(name, options, (span) =>
+    traced(span).pipe(
+      Effect.tapCause(() => Effect.sync(() => span.attribute("process.attempt_failed", true))),
+      Effect.exit,
+    ),
+  ).pipe(Effect.flatten);
+};
+
+/**
+ * Spawns a child process whose span stays open until the surrounding scope closes and records
+ * the exit code once the caller awaits it. A failed spawn ends the span immediately.
+ */
+export const withProcessSpanScoped = <E, R>(
+  name: string,
+  target: ProcessSpanTarget,
+  spawn: (traceEnv: ChildTraceEnv) => Effect.Effect<ChildProcessHandle, E, R>,
+): Effect.Effect<ChildProcessHandle, E, R | Scope.Scope> =>
+  Effect.gen(function* () {
+    const span = yield* Effect.makeSpan(name, { attributes: processAttributes(target) });
+    const endSpan = (exit: Exit.Exit<unknown, unknown>) =>
+      Effect.map(Clock.currentTimeNanos, (now) => span.end(now, exit));
+    const traceEnv = yield* traceEnvFor(span);
+    const spawned = yield* spawn(traceEnv).pipe(
+      Effect.withParentSpan(span, { captureStackTrace: false }),
+      Effect.exit,
+    );
+    if (Exit.isFailure(spawned)) {
+      if (target.hasFallback === true) span.attribute("process.attempt_failed", true);
+      yield* endSpan(target.hasFallback === true ? Exit.void : spawned);
+      return yield* spawned;
+    }
+    yield* Effect.addFinalizer(endSpan);
+    const handle = spawned.value;
+    return makeHandle({
+      ...handle,
+      exitCode: handle.exitCode.pipe(
+        Effect.tap((code) => Effect.sync(() => span.attribute("process.exit_code", code))),
+      ),
+    });
+  });
diff --git a/apps/cli/src/shared/telemetry/spans.unit.test.ts b/apps/cli/src/shared/telemetry/spans.unit.test.ts
new file mode 100644
index 0000000000..2a3ee6b1a3
--- /dev/null
+++ b/apps/cli/src/shared/telemetry/spans.unit.test.ts
@@ -0,0 +1,33 @@
+import { describe, expect, it } from "vitest";
+import { withChildTraceEnv } from "./spans.ts";
+
+const traceEnv = { TRACEPARENT: "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01" };
+
+describe("withChildTraceEnv", () => {
+  it("leaves spawn options untouched without a trace environment", () => {
+    const options = { cwd: "/tmp" };
+
+    expect(withChildTraceEnv(options, {})).toBe(options);
+  });
+
+  it("inherits the parent environment when the caller sets none", () => {
+    expect(withChildTraceEnv({ cwd: "/tmp" }, traceEnv)).toEqual({
+      cwd: "/tmp",
+      env: traceEnv,
+      extendEnv: true,
+    });
+  });
+
+  it("keeps an explicit request not to inherit the parent environment", () => {
+    expect(withChildTraceEnv({ extendEnv: false }, traceEnv)).toEqual({
+      env: traceEnv,
+      extendEnv: false,
+    });
+  });
+
+  it("adds the trace environment to a caller-provided environment", () => {
+    expect(withChildTraceEnv({ env: { PGHOST: "localhost" }, extendEnv: false }, traceEnv)).toEqual(
+      { env: { PGHOST: "localhost", ...traceEnv }, extendEnv: false },
+    );
+  });
+});
diff --git a/apps/cli/src/shared/telemetry/standalone-analytics-config.layer.ts b/apps/cli/src/shared/telemetry/standalone-analytics-config.layer.ts
deleted file mode 100644
index bf8ff64d18..0000000000
--- a/apps/cli/src/shared/telemetry/standalone-analytics-config.layer.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import { Layer } from "effect";
-import { cliSettingsLayer } from "../config/cli-settings.layer.ts";
-import { cliProjectContextLayer } from "../config/cli-project-context.layer.ts";
-import { runtimeInfoLayer } from "../runtime/runtime-info.layer.ts";
-import { ttyLayer } from "../runtime/tty.layer.ts";
-
-/**
- * Resolves `CliSettings | RuntimeInfo | Tty` for callers that build and run an
- * `Analytics`-capturing effect outside `runCli`'s own composed layer tree — today, only
- * `cli/complete.ts`'s telemetry capture, which fires before `runCli` bootstraps.
- *
- * Still requires the platform layer (`FileSystem`/`Path`) to be provided separately by the
- * caller, matching `run.ts`'s own top-level `Effect.provide(BunServices.layer)`.
- */
-export const standaloneAnalyticsConfigLayer = Layer.mergeAll(
-  cliSettingsLayer.pipe(Layer.provide(cliProjectContextLayer), Layer.provide(runtimeInfoLayer)),
-  runtimeInfoLayer,
-  ttyLayer,
-);
diff --git a/apps/cli/src/shared/telemetry/trace-export.e2e.test.ts b/apps/cli/src/shared/telemetry/trace-export.e2e.test.ts
new file mode 100644
index 0000000000..08e285fee3
--- /dev/null
+++ b/apps/cli/src/shared/telemetry/trace-export.e2e.test.ts
@@ -0,0 +1,163 @@
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, FileSystem, Path } from "effect";
+import { runSupabaseEffect } from "../../../tests/helpers/cli.ts";
+
+interface TraceLine {
+  readonly resourceSpans: ReadonlyArray<{
+    readonly scopeSpans: ReadonlyArray<{
+      readonly spans: ReadonlyArray<{
+        readonly name: string;
+        readonly traceId: string;
+        readonly parentSpanId?: string;
+        readonly status: { readonly code: number };
+        readonly attributes?: ReadonlyArray<{
+          readonly key: string;
+          readonly value: { readonly intValue?: string | number };
+        }>;
+      }>;
+    }>;
+  }>;
+}
+
+const STATUS_OK = 1;
+const STATUS_ERROR = 2;
+
+const withoutTraceEnv = {
+  SUPABASE_DEBUG: undefined,
+  SUPABASE_TELEMETRY_DEBUG: undefined,
+  SUPABASE_TRACE_FILE: undefined,
+  SUPABASE_OTLP_ENDPOINT: undefined,
+  SUPABASE_ACCESS_TOKEN: undefined,
+};
+
+const readTraceSpans = Effect.fnUntraced(function* (tracePath: string) {
+  const fs = yield* FileSystem.FileSystem;
+  return (yield* fs.readFileString(tracePath))
+    .split("\n")
+    .filter((line) => line.length > 0)
+    .flatMap((line): TraceLine["resourceSpans"][number]["scopeSpans"][number]["spans"] => {
+      const batch: TraceLine = JSON.parse(line);
+      return batch.resourceSpans.flatMap((resource) =>
+        resource.scopeSpans.flatMap((scope) => scope.spans),
+      );
+    });
+});
+
+describe("trace export across the process exit", () => {
+  it.live("writes the cli.run span under the adopted TRACEPARENT before the process exits", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "supabase-trace-e2e-" });
+      const tracePath = path.join(root, "trace.jsonl");
+      const traceId = "4bf92f3577b34da6a3ce929d0e0e4736";
+      const parentId = "00f067aa0ba902b7";
+
+      const { exitCode, stderr } = yield* runSupabaseEffect(["--version"], {
+        env: { SUPABASE_TRACE_FILE: tracePath, TRACEPARENT: `00-${traceId}-${parentId}-01` },
+      });
+
+      expect(exitCode, stderr).toBe(0);
+      expect((yield* fs.stat(tracePath)).mode & 0o777).toBe(0o600);
+      const spans = yield* readTraceSpans(tracePath);
+      expect(spans.find((span) => span.name === "cli.run")).toMatchObject({
+        traceId,
+        parentSpanId: parentId,
+        status: { code: STATUS_OK },
+      });
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+
+  it.live("warns once and still runs the command when the trace file is /dev/null", () =>
+    Effect.gen(function* () {
+      const { exitCode, stdout, stderr } = yield* runSupabaseEffect(["--version"], {
+        env: { ...withoutTraceEnv, SUPABASE_TRACE_FILE: "/dev/null" },
+      });
+
+      expect(exitCode, stderr).toBe(0);
+      expect(stdout.trim()).toMatch(/^\d+\.\d+\.\d+/u);
+      expect(stderr.trim().split("\n")).toEqual([
+        expect.stringMatching(/^Warning: tracing disabled: /u),
+      ]);
+    }),
+  );
+
+  it.live("records a failed command's exit code and error status on cli.run", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "supabase-trace-e2e-" });
+      const tracePath = path.join(root, "trace.jsonl");
+
+      const { exitCode, stderr } = yield* runSupabaseEffect(["projects", "list"], {
+        cwd: root,
+        env: { ...withoutTraceEnv, SUPABASE_TRACE_FILE: tracePath },
+      });
+
+      expect(exitCode, stderr).toBe(1);
+      const run = (yield* readTraceSpans(tracePath)).find((span) => span.name === "cli.run");
+      const recorded = run?.attributes?.find((attribute) => attribute.key === "process.exit_code");
+      expect(Number(recorded?.value.intValue)).toBe(1);
+      expect(run?.status.code).toBe(STATUS_ERROR);
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+});
+
+const SPAN_LINE = /^\[\d{2}:\d{2}:\d{2}\.\d{3}\] +\S+ \(\d+ms\)/mu;
+
+describe("span debug console", () => {
+  it.live("prints spans when the project .env sets SUPABASE_DEBUG=1", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "supabase-trace-debug-e2e-" });
+      yield* fs.makeDirectory(path.join(root, "supabase"));
+      yield* fs.writeFileString(
+        path.join(root, "supabase", "config.toml"),
+        'project_id = "trace-e2e"\n',
+      );
+      yield* fs.writeFileString(path.join(root, "supabase", ".env"), "SUPABASE_DEBUG=1\n");
+
+      const { exitCode, stderr } = yield* runSupabaseEffect(["projects", "list"], {
+        cwd: root,
+        env: withoutTraceEnv,
+      });
+
+      expect(exitCode, stderr).toBe(1);
+      expect(stderr).toMatch(SPAN_LINE);
+      expect(stderr).toContain("CommandCredentials.load (");
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+
+  it.live("prints no spans for --debug", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "supabase-trace-debug-e2e-" });
+
+      const { exitCode, stderr } = yield* runSupabaseEffect(["--debug", "projects", "list"], {
+        cwd: root,
+        env: withoutTraceEnv,
+      });
+
+      expect(exitCode, stderr).toBe(1);
+      expect(stderr).toContain("Access token not provided");
+      expect(stderr).not.toMatch(SPAN_LINE);
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+
+  it.live("prints no spans when --debug is a flag value", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "supabase-trace-debug-e2e-" });
+
+      const { exitCode, stderr } = yield* runSupabaseEffect(
+        ["projects", "list", "--workdir", "--debug"],
+        { cwd: root, env: withoutTraceEnv },
+      );
+
+      expect(exitCode, stderr).toBe(1);
+      expect(stderr).not.toMatch(SPAN_LINE);
+    }).pipe(Effect.scoped, Effect.provide(BunServices.layer)),
+  );
+});
diff --git a/apps/cli/src/shared/telemetry/trace-export.integration.test.ts b/apps/cli/src/shared/telemetry/trace-export.integration.test.ts
new file mode 100644
index 0000000000..d21bbb21dd
--- /dev/null
+++ b/apps/cli/src/shared/telemetry/trace-export.integration.test.ts
@@ -0,0 +1,365 @@
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "@effect/vitest";
+import {
+  ConfigProvider,
+  Deferred,
+  Effect,
+  Exit,
+  Fiber,
+  FileSystem,
+  Layer,
+  Logger,
+  Option,
+  Path,
+  References,
+  Sink,
+  Stdio,
+} from "effect";
+import {
+  VALID_REF,
+  VALID_TOKEN,
+  buildTestRuntime,
+  mockCommandPlatformApi,
+  mockCommandSettings,
+  useTempWorkdir,
+} from "../../../tests/helpers/command-mocks.ts";
+import { mockOutput, mockRuntimeInfo } from "../../../tests/helpers/mocks.ts";
+import { DbExecError } from "../../command-internal/db-connection.errors.ts";
+import { projectsList } from "../../commands/projects/list/list.handler.ts";
+import { withTraceExport, type TraceSettings } from "./trace-export.layer.ts";
+
+interface ExportedAttribute {
+  readonly key: string;
+  readonly value: unknown;
+}
+
+interface ExportedSpan {
+  readonly traceId: string;
+  readonly spanId: string;
+  readonly parentSpanId?: string;
+  readonly name: string;
+  readonly attributes: ReadonlyArray<ExportedAttribute>;
+  readonly events: ReadonlyArray<{
+    readonly name: string;
+    readonly attributes: ReadonlyArray<ExportedAttribute>;
+  }>;
+  readonly status: { readonly code: number; readonly message?: string };
+}
+
+const tempRoot = useTempWorkdir("supabase-trace-export-int-");
+
+const fileSink = (path: string): TraceSettings => ({
+  sink: Option.some({ _tag: "File", path }),
+});
+
+const readBatches = Effect.fnUntraced(function* (tracePath: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const text = yield* fs.readFileString(tracePath);
+  return text
+    .split("\n")
+    .filter((line) => line.length > 0)
+    .map((line): { resourceSpans: Array<{ scopeSpans: Array<{ spans: Array<ExportedSpan> }> }> } =>
+      JSON.parse(line),
+    );
+});
+
+const spansOf = (
+  batches: ReadonlyArray<{
+    resourceSpans: Array<{ scopeSpans: Array<{ spans: Array<ExportedSpan> }> }>;
+  }>,
+) =>
+  batches.flatMap((batch) =>
+    batch.resourceSpans.flatMap((resource) => resource.scopeSpans.flatMap((scope) => scope.spans)),
+  );
+
+const traceFilePath = Effect.map(Path.Path, (path) => path.join(tempRoot.current, "trace.jsonl"));
+
+const runtime = Layer.mergeAll(mockRuntimeInfo(), BunServices.layer);
+
+describe("withTraceExport with a trace file", () => {
+  it.live("creates the file with owner-only permissions and writes one line per batch", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const tracePath = yield* traceFilePath;
+
+      yield* Effect.void.pipe(
+        Effect.withSpan("Test.child"),
+        withTraceExport(fileSink(tracePath), { "process.boot_ms": 12 }),
+      );
+
+      const info = yield* fs.stat(tracePath);
+      expect(info.mode & 0o777).toBe(0o600);
+      const batches = yield* readBatches(tracePath);
+      expect(batches).toHaveLength(1);
+      expect(
+        spansOf(batches)
+          .map((span) => span.name)
+          .sort(),
+      ).toEqual(["Test.child", "cli.run"]);
+    }).pipe(Effect.provide(runtime)),
+  );
+
+  it.live("appends to an existing file instead of replacing it", () =>
+    Effect.gen(function* () {
+      const tracePath = yield* traceFilePath;
+      const run = Effect.void.pipe(withTraceExport(fileSink(tracePath), {}));
+
+      yield* run;
+      yield* run;
+
+      const batches = yield* readBatches(tracePath);
+      expect(batches).toHaveLength(2);
+      expect(spansOf(batches).filter((span) => span.name === "cli.run")).toHaveLength(2);
+    }).pipe(Effect.provide(runtime)),
+  );
+
+  it.live("restricts an existing file to owner-only permissions", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const tracePath = yield* traceFilePath;
+      yield* fs.writeFileString(tracePath, "", { mode: 0o644 });
+      yield* fs.chmod(tracePath, 0o644);
+
+      yield* Effect.void.pipe(withTraceExport(fileSink(tracePath), {}));
+
+      expect((yield* fs.stat(tracePath)).mode & 0o777).toBe(0o600);
+    }).pipe(Effect.provide(runtime)),
+  );
+
+  it.live("adopts TRACEPARENT as the parent of cli.run", () =>
+    Effect.gen(function* () {
+      const tracePath = yield* traceFilePath;
+      const traceId = "4bf92f3577b34da6a3ce929d0e0e4736";
+      const parentId = "00f067aa0ba902b7";
+
+      yield* Effect.void.pipe(
+        withTraceExport(fileSink(tracePath), {}),
+        Effect.provide(
+          ConfigProvider.layer(
+            ConfigProvider.fromUnknown({ TRACEPARENT: `00-${traceId}-${parentId}-01` }),
+          ),
+        ),
+      );
+
+      const [root] = spansOf(yield* readBatches(tracePath));
+      expect(root).toMatchObject({ name: "cli.run", traceId, parentSpanId: parentId });
+    }).pipe(Effect.provide(runtime)),
+  );
+
+  it.live("ignores global OTEL_RESOURCE_ATTRIBUTES, even malformed ones", () =>
+    Effect.gen(function* () {
+      const tracePath = yield* traceFilePath;
+
+      yield* Effect.void.pipe(
+        withTraceExport(fileSink(tracePath), {}),
+        Effect.provide(
+          ConfigProvider.layer(
+            ConfigProvider.fromUnknown({
+              OTEL_RESOURCE_ATTRIBUTES: "team=%,telemetry.sdk.name=injected",
+            }),
+          ),
+        ),
+      );
+
+      const text = yield* (yield* FileSystem.FileSystem).readFileString(tracePath);
+      expect(spansOf(yield* readBatches(tracePath)).map((span) => span.name)).toEqual(["cli.run"]);
+      expect(text).not.toContain("team");
+      expect(text).not.toContain("injected");
+    }).pipe(Effect.provide(runtime)),
+  );
+
+  it.live("records the run under an unsampled TRACEPARENT", () =>
+    Effect.gen(function* () {
+      const tracePath = yield* traceFilePath;
+      const traceId = "4bf92f3577b34da6a3ce929d0e0e4736";
+      const parentId = "00f067aa0ba902b7";
+
+      yield* Effect.void.pipe(
+        Effect.withSpan("Test.child"),
+        withTraceExport(fileSink(tracePath), {}),
+        Effect.provide(
+          ConfigProvider.layer(
+            ConfigProvider.fromUnknown({ TRACEPARENT: `00-${traceId}-${parentId}-00` }),
+          ),
+        ),
+      );
+
+      const spans = spansOf(yield* readBatches(tracePath));
+      expect(spans.map((span) => span.name).sort()).toEqual(["Test.child", "cli.run"]);
+      expect(spans.find((span) => span.name === "cli.run")).toMatchObject({
+        traceId,
+        parentSpanId: parentId,
+      });
+    }).pipe(Effect.provide(runtime)),
+  );
+
+  it.live("flushes the interrupted run before returning", () =>
+    Effect.gen(function* () {
+      const tracePath = yield* traceFilePath;
+
+      const exit = yield* Effect.interrupt.pipe(
+        Effect.withSpan("Test.interrupted"),
+        withTraceExport(fileSink(tracePath), {}),
+        Effect.exit,
+      );
+
+      expect(Exit.hasInterrupts(exit)).toBe(true);
+      const names = spansOf(yield* readBatches(tracePath)).map((span) => span.name);
+      expect(names).toContain("cli.run");
+      expect(names).toContain("Test.interrupted");
+    }).pipe(Effect.provide(runtime)),
+  );
+
+  it.live("flushes the batch when the traced run is interrupted from outside", () =>
+    Effect.gen(function* () {
+      const tracePath = yield* traceFilePath;
+      const started = yield* Deferred.make<void>();
+
+      const fiber = yield* Deferred.succeed(started, undefined).pipe(
+        Effect.andThen(Effect.never),
+        Effect.withSpan("Test.awaiting"),
+        withTraceExport(fileSink(tracePath), {}),
+        Effect.forkChild,
+      );
+      yield* Deferred.await(started);
+      yield* Fiber.interrupt(fiber);
+
+      const names = spansOf(yield* readBatches(tracePath)).map((span) => span.name);
+      expect(names).toContain("cli.run");
+      expect(names).toContain("Test.awaiting");
+    }).pipe(Effect.provide(runtime)),
+  );
+
+  it.live.each([
+    { target: "a path in a missing directory", tracePath: "missing/trace.jsonl" },
+    { target: "/dev/null", tracePath: "/dev/null" },
+  ])("warns once and runs the command untraced for $target", ({ tracePath }) =>
+    Effect.gen(function* () {
+      const path = yield* Path.Path;
+      const written: Array<string> = [];
+      const stderr = Sink.forEach((chunk: string | Uint8Array) =>
+        Effect.sync(() => {
+          written.push(typeof chunk === "string" ? chunk : new TextDecoder().decode(chunk));
+        }),
+      );
+
+      const result = yield* Effect.gen(function* () {
+        return { tracerEnabled: yield* References.TracerEnabled, value: "ran" };
+      }).pipe(
+        withTraceExport(fileSink(path.resolve(tempRoot.current, tracePath)), {}),
+        Effect.provide(Stdio.layerTest({ stderr: () => stderr })),
+      );
+
+      expect(result).toEqual({ tracerEnabled: false, value: "ran" });
+      const lines = written
+        .join("")
+        .split("\n")
+        .filter((line) => line.length > 0);
+      expect(lines).toHaveLength(1);
+      expect(lines[0]).toMatch(/^Warning: tracing disabled: could not start trace export: /u);
+    }).pipe(Effect.provide(runtime)),
+  );
+});
+
+describe("withTraceExport for a failed migration", () => {
+  it.live("exports the error type, SQLSTATE, and log levels but no error or log text", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const tracePath = yield* traceFilePath;
+      const failure = new DbExecError({
+        message: 'ERROR: null value in column "role" violates not-null constraint (SQLSTATE 23502)',
+        code: "23502",
+        detail: "Failing row contains (1, alice@example.com, s3cret).",
+      });
+
+      yield* Effect.logWarning(
+        "applying CREATE FUNCTION seed() RETURNS text AS $$ SELECT $pw$dollar-quoted-secret$pw$ $$",
+      ).pipe(
+        Effect.andThen(Effect.logError("syntax error at or near E'it\\'s-e-literal-secret'")),
+        Effect.andThen(Effect.logInfo("Object not found: bucket/private/key.pdf")),
+        Effect.andThen(Effect.fail(failure)),
+        Effect.withSpan("Migration.apply"),
+        withTraceExport(fileSink(tracePath), {}),
+        Effect.provide(Logger.layer([Logger.tracerLogger])),
+        Effect.exit,
+      );
+
+      const raw = yield* fs.readFileString(tracePath);
+      const span = spansOf(yield* readBatches(tracePath)).find(
+        (candidate) => candidate.name === "Migration.apply",
+      );
+      const logEvent = (level: string) => ({
+        name: "log",
+        attributes: [{ key: "effect.logLevel", value: { stringValue: level } }],
+      });
+      expect(span?.status).toEqual({ code: 2 });
+      expect(span?.attributes).toContainEqual({
+        key: "db.response.status_code",
+        value: { stringValue: "23502" },
+      });
+      expect(span?.attributes).toContainEqual({
+        key: "error.type",
+        value: { stringValue: "DbExecError" },
+      });
+      expect(span?.events.map(({ name, attributes }) => ({ name, attributes }))).toEqual([
+        logEvent("WARN"),
+        logEvent("ERROR"),
+        logEvent("INFO"),
+        {
+          name: "exception",
+          attributes: [{ key: "exception.type", value: { stringValue: "DbExecError" } }],
+        },
+      ]);
+      for (const text of [
+        "alice@example.com",
+        "s3cret",
+        "not-null constraint",
+        "dollar-quoted-secret",
+        "e-literal-secret",
+        "bucket/private/key.pdf",
+      ]) {
+        expect(raw).not.toContain(text);
+      }
+    }).pipe(Effect.provide(runtime)),
+  );
+});
+
+describe("withTraceExport around a command handler", () => {
+  it.live("records one sanitized, connected trace for projects list within the span budget", () =>
+    Effect.gen(function* () {
+      const tracePath = yield* traceFilePath;
+      const out = mockOutput({ format: "text" });
+      const api = mockCommandPlatformApi({ response: { status: 200, body: [] } });
+      const layer = buildTestRuntime({
+        out,
+        api,
+        cliSettings: mockCommandSettings({
+          workdir: tempRoot.current,
+          projectId: Option.some(VALID_REF),
+        }),
+      });
+
+      yield* projectsList({}).pipe(
+        Effect.provide(layer),
+        withTraceExport(fileSink(tracePath), { "process.boot_ms": 5 }),
+      );
+
+      const fs = yield* FileSystem.FileSystem;
+      const raw = yield* fs.readFileString(tracePath);
+      const spans = spansOf(yield* readBatches(tracePath));
+      const roots = spans.filter((span) => span.parentSpanId === undefined);
+      const ids = new Set(spans.map((span) => span.spanId));
+      const counts = new Map<string, number>();
+      for (const span of spans) counts.set(span.name, (counts.get(span.name) ?? 0) + 1);
+
+      expect(roots.map((span) => span.name)).toEqual(["cli.run"]);
+      expect(spans.filter((span) => !ids.has(span.parentSpanId ?? span.spanId))).toEqual([]);
+      expect(spans.some((span) => span.name.startsWith("http.client"))).toBe(true);
+      expect(spans.length).toBeLessThanOrEqual(2000);
+      expect(Math.max(...counts.values())).toBeLessThanOrEqual(200);
+      expect(raw).not.toContain(VALID_TOKEN);
+      expect(raw).not.toMatch(/bearer\s/iu);
+      expect(api.requests.map((request) => request.headers["traceparent"])).toEqual([undefined]);
+    }).pipe(Effect.provide(runtime)),
+  );
+});
diff --git a/apps/cli/src/shared/telemetry/trace-export.layer.ts b/apps/cli/src/shared/telemetry/trace-export.layer.ts
new file mode 100644
index 0000000000..56ecdb4549
--- /dev/null
+++ b/apps/cli/src/shared/telemetry/trace-export.layer.ts
@@ -0,0 +1,345 @@
+import {
+  Cause,
+  Config,
+  Crypto,
+  Duration,
+  Effect,
+  Exit,
+  Fiber,
+  FileSystem,
+  Layer,
+  Option,
+  Path,
+  Queue,
+  Redacted,
+  Scope,
+  Stdio,
+  Stream,
+  Tracer,
+} from "effect";
+import { Headers, HttpTraceContext } from "effect/unstable/http";
+import { CLI_VERSION } from "../cli/version.ts";
+import { CliSettings } from "../config/cli-settings.service.ts";
+import { RuntimeInfo } from "../runtime/runtime-info.service.ts";
+import { makeDebugConsoleExporter } from "./exporters/debug-console.ts";
+import { detectCi } from "./runtime.layer.ts";
+import { ChildTracePropagation } from "./spans.ts";
+import { errorTypeOf, makeTraceSanitizer, sqlStateOf } from "./trace-sanitize.ts";
+
+const FLUSH_TIMEOUT = Duration.seconds(2);
+const OTLP_TRACES_PATH = "/v1/traces";
+
+/** Tracing never stops a command: a setup problem prints one warning and the run continues untraced. */
+const warnTracingDisabled = (reason: string) =>
+  Effect.flatMap(Stdio.Stdio, (stdio) =>
+    Stream.make(`Warning: tracing disabled: ${reason}\n`).pipe(
+      Stream.run(stdio.stderr()),
+      Effect.ignore,
+    ),
+  );
+
+type TraceSink =
+  | { readonly _tag: "File"; readonly path: string }
+  | {
+      readonly _tag: "Otlp";
+      readonly url: string;
+      readonly headers: Redacted.Redacted<Readonly<Record<string, string>>>;
+    };
+
+/** Trace export decision for one CLI run. */
+export interface TraceSettings {
+  readonly sink: Option.Option<TraceSink>;
+}
+
+const optionalEnv = (name: string) =>
+  Config.option(Config.string(name)).pipe(
+    Effect.map(Option.filter((value) => value.trim().length > 0)),
+    Effect.mapError(() => `${name} could not be read`),
+  );
+
+function otlpTracesUrl(endpoint: string): Option.Option<string> {
+  try {
+    const url = new URL(endpoint);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return Option.none();
+    if (!url.pathname.endsWith(OTLP_TRACES_PATH)) {
+      url.pathname = `${url.pathname.replace(/\/+$/u, "")}${OTLP_TRACES_PATH}`;
+    }
+    return Option.some(url.toString());
+  } catch {
+    return Option.none();
+  }
+}
+
+const HEADER_NAME = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/u;
+const HEADER_VALUE = /^[\t\x20-\x7e\x80-\xff]*$/u;
+
+/** Parses `key=value,key2=value2` with percent-encoded parts, as in `OTEL_EXPORTER_OTLP_HEADERS`. */
+function parseOtlpHeaders(value: string): Option.Option<Record<string, string>> {
+  const headers: Record<string, string> = {};
+  for (const pair of value.split(",")) {
+    if (pair.trim().length === 0) continue;
+    const separator = pair.indexOf("=");
+    if (separator <= 0) return Option.none();
+    try {
+      const name = decodeURIComponent(pair.slice(0, separator).trim());
+      const headerValue = decodeURIComponent(pair.slice(separator + 1).trim());
+      if (!HEADER_NAME.test(name) || !HEADER_VALUE.test(headerValue)) return Option.none();
+      headers[name] = headerValue;
+    } catch {
+      return Option.none();
+    }
+  }
+  return Option.some(headers);
+}
+
+const resolveSink = Effect.fnUntraced(function* () {
+  const file = yield* optionalEnv("SUPABASE_TRACE_FILE");
+  const endpoint = yield* optionalEnv("SUPABASE_OTLP_ENDPOINT");
+  if (Option.isSome(file) && Option.isSome(endpoint)) {
+    return yield* Effect.fail(
+      "SUPABASE_TRACE_FILE and SUPABASE_OTLP_ENDPOINT are both set; choose one trace destination",
+    );
+  }
+  if (Option.isSome(file)) {
+    // Resolved once against the startup cwd, so a later `process.chdir` keeps one trace file.
+    const path = yield* Path.Path;
+    return Option.some<TraceSink>({ _tag: "File", path: path.resolve(file.value) });
+  }
+  if (Option.isNone(endpoint)) return Option.none<TraceSink>();
+
+  const url = otlpTracesUrl(endpoint.value);
+  if (Option.isNone(url)) {
+    return yield* Effect.fail(
+      "SUPABASE_OTLP_ENDPOINT must be an http(s) URL, for example http://localhost:4318",
+    );
+  }
+  const rawHeaders = yield* optionalEnv("SUPABASE_OTLP_HEADERS");
+  const headers = Option.isSome(rawHeaders) ? parseOtlpHeaders(rawHeaders.value) : Option.some({});
+  if (Option.isNone(headers)) {
+    return yield* Effect.fail(
+      "SUPABASE_OTLP_HEADERS must be a comma-separated list of key=value pairs",
+    );
+  }
+  return Option.some<TraceSink>({
+    _tag: "Otlp",
+    url: url.value,
+    headers: Redacted.make(headers.value, { label: "SUPABASE_OTLP_HEADERS" }),
+  });
+});
+
+/** Reads the trace sink for this run; an invalid setting warns and leaves tracing off. */
+export const resolveTraceSettings: Effect.Effect<TraceSettings, never, Path.Path | Stdio.Stdio> =
+  resolveSink().pipe(
+    Effect.catch((reason) => warnTracingDisabled(reason).pipe(Effect.as(Option.none<TraceSink>()))),
+    Effect.map((sink) => ({ sink })),
+  );
+
+// An explicitly configured sink records the run even when the caller's context is unsampled.
+const externalParent = optionalEnv("TRACEPARENT").pipe(
+  Effect.orElseSucceed(() => Option.none<string>()),
+  Effect.map(
+    Option.flatMap((traceparent) =>
+      HttpTraceContext.w3c(Headers.fromRecordUnsafe({ traceparent })),
+    ),
+  ),
+  Effect.map(
+    Option.map((parent) =>
+      Tracer.externalSpan({
+        traceId: parent.traceId,
+        spanId: parent.spanId,
+        sampled: true,
+        annotations: parent.annotations,
+      }),
+    ),
+  ),
+);
+
+/** Records a failure's tag and SQLSTATE on the span, since exported exception events keep only the type. */
+class ObservedSpan implements Tracer.Span {
+  readonly _tag = "Span";
+  constructor(
+    private readonly span: Tracer.Span,
+    private readonly onEnd: (span: Tracer.Span) => void,
+  ) {}
+  get name() {
+    return this.span.name;
+  }
+  get spanId() {
+    return this.span.spanId;
+  }
+  get traceId() {
+    return this.span.traceId;
+  }
+  get parent() {
+    return this.span.parent;
+  }
+  get annotations() {
+    return this.span.annotations;
+  }
+  get status() {
+    return this.span.status;
+  }
+  get attributes() {
+    return this.span.attributes;
+  }
+  get links() {
+    return this.span.links;
+  }
+  get sampled() {
+    return this.span.sampled;
+  }
+  get kind() {
+    return this.span.kind;
+  }
+  end(endTime: bigint, exit: Exit.Exit<unknown, unknown>): void {
+    const errorType = errorTypeOf(exit);
+    if (errorType !== undefined) this.span.attribute("error.type", errorType);
+    const sqlState = sqlStateOf(exit);
+    if (sqlState !== undefined) this.span.attribute("db.response.status_code", sqlState);
+    this.span.end(endTime, exit);
+    this.onEnd(this);
+  }
+  attribute(key: string, value: unknown): void {
+    this.span.attribute(key, value);
+  }
+  event(name: string, startTime: bigint, attributes?: Record<string, unknown>): void {
+    this.span.event(name, startTime, attributes);
+  }
+  addLinks(links: ReadonlyArray<Tracer.SpanLink>): void {
+    this.span.addLinks(links);
+  }
+}
+
+const observedTracer = (
+  base: Tracer.Tracer,
+  onEnd: (span: Tracer.Span) => void = () => {},
+): Tracer.Tracer =>
+  Tracer.make({
+    span: (options) => new ObservedSpan(base.span(options), onEnd),
+    context: base.context,
+  });
+
+const debugConsoleTracer = Effect.fnUntraced(function* (
+  base: Tracer.Tracer,
+  root: Option.Option<Tracer.AnySpan>,
+) {
+  const stdio = yield* Stdio.Stdio;
+  const exportSpan = makeDebugConsoleExporter(
+    (line) => Stream.make(line).pipe(Stream.run(stdio.stderr()), Effect.asVoid),
+    yield* makeTraceSanitizer,
+    root,
+  );
+  const queue = yield* Queue.unbounded<Tracer.Span, Cause.Done>();
+  const worker = yield* Queue.take(queue).pipe(
+    Effect.flatMap((span) => Effect.ignore(exportSpan(span))),
+    Effect.forever,
+    Effect.catchTag("Done", () => Effect.void),
+    Effect.forkScoped,
+  );
+  yield* Effect.addFinalizer(() =>
+    Queue.end(queue).pipe(
+      Effect.andThen(Effect.interruptible(Fiber.join(worker)).pipe(Effect.timeout(FLUSH_TIMEOUT))),
+      Effect.ignore,
+    ),
+  );
+  return observedTracer(base, (span) => {
+    Queue.offerUnsafe(queue, span);
+  });
+});
+
+const sinkTracer = Effect.fnUntraced(function* (sink: TraceSink) {
+  const runtimeInfo = yield* RuntimeInfo;
+  const crypto = yield* Crypto.Crypto;
+  const sinkModule = yield* Effect.promise(() => import("./otlp-trace-sink.ts"));
+  const resource = {
+    serviceVersion: CLI_VERSION,
+    attributes: {
+      os: runtimeInfo.platform,
+      arch: runtimeInfo.arch,
+      is_ci: yield* detectCi,
+      "service.instance.id": yield* Effect.orDie(crypto.randomUUIDv4),
+    },
+  };
+  const make = (url: string, headers: Redacted.Redacted<Readonly<Record<string, string>>>) =>
+    sinkModule.makeOtlpTracer({ url, headers, resource });
+  const tracer =
+    sink._tag === "File"
+      ? make("file:///v1/traces", Redacted.make({})).pipe(
+          Effect.provide(sinkModule.fileTransportLayer(sink.path)),
+        )
+      : make(sink.url, sink.headers).pipe(Effect.provide(sinkModule.collectorTransportLayer));
+  return observedTracer(yield* tracer);
+});
+
+/**
+ * Prints the finished spans of `effect` to stderr when `SUPABASE_DEBUG=1` or
+ * `SUPABASE_TELEMETRY_DEBUG=1`, on top of the active sink tracer when there is one.
+ */
+export const withDebugConsole = <A, E, R>(
+  effect: Effect.Effect<A, E, R>,
+): Effect.Effect<A, E, R | CliSettings | Crypto.Crypto | Stdio.Stdio> =>
+  Effect.gen(function* () {
+    const settings = yield* CliSettings;
+    const enabled =
+      Option.exists(settings.debug, (value) => value === "1") ||
+      Option.exists(settings.telemetryDebug, (value) => value === "1");
+    if (!enabled) return yield* effect;
+    const base = yield* Effect.tracer;
+    const root = yield* Effect.option(Effect.currentParentSpan);
+    return yield* Effect.acquireUseRelease(
+      Scope.make(),
+      (scope) =>
+        debugConsoleTracer(base, root).pipe(
+          Scope.provide(scope),
+          Effect.flatMap((tracer) =>
+            effect.pipe(Effect.withTracer(tracer), Effect.withTracerEnabled(true)),
+          ),
+        ),
+      (scope, exit) => Scope.close(scope, exit),
+    );
+  });
+
+/**
+ * Runs `effect` as the `cli.run` root span with the configured exporter, then flushes it within a
+ * bounded, uninterruptible window so the caller can exit the process right after.
+ */
+export const withTraceExport =
+  (settings: TraceSettings, attributes: Readonly<Record<string, unknown>>) =>
+  <A, E, R>(
+    effect: Effect.Effect<A, E, R>,
+  ): Effect.Effect<A, E, R | Crypto.Crypto | FileSystem.FileSystem | RuntimeInfo | Stdio.Stdio> => {
+    const untraced = effect.pipe(Effect.withTracerEnabled(false));
+    if (Option.isNone(settings.sink)) return untraced;
+    const sink = settings.sink.value;
+    return Effect.gen(function* () {
+      const parent = yield* externalParent;
+      return yield* Effect.acquireUseRelease(
+        Scope.make(),
+        (scope) =>
+          Layer.buildWithScope(Layer.effect(Tracer.Tracer, sinkTracer(sink)), scope).pipe(
+            Effect.map(Option.some),
+            Effect.catchCause((cause) => {
+              if (Cause.hasInterruptsOnly(cause)) return Effect.interrupt;
+              const reason = Cause.squash(cause);
+              return warnTracingDisabled(
+                `could not start trace export: ${reason instanceof Error ? reason.message : String(reason)}`,
+              ).pipe(Effect.as(Option.none()));
+            }),
+            Effect.flatMap((context) =>
+              Option.isNone(context)
+                ? untraced
+                : effect.pipe(
+                    Effect.withSpan("cli.run", {
+                      attributes,
+                      ...(Option.isSome(parent) ? { parent: parent.value } : {}),
+                    }),
+                    Effect.provideService(ChildTracePropagation, true),
+                    Effect.provide(context.value),
+                  ),
+            ),
+          ),
+        (scope, exit) =>
+          Scope.close(scope, exit).pipe(Effect.interruptible, Effect.timeoutOption(FLUSH_TIMEOUT)),
+      );
+    }).pipe(Effect.withTracerEnabled(true));
+  };
diff --git a/apps/cli/src/shared/telemetry/trace-export.off-path.unit.test.ts b/apps/cli/src/shared/telemetry/trace-export.off-path.unit.test.ts
new file mode 100644
index 0000000000..43d26a6dec
--- /dev/null
+++ b/apps/cli/src/shared/telemetry/trace-export.off-path.unit.test.ts
@@ -0,0 +1,56 @@
+import { describe, expect, it } from "@effect/vitest";
+import { vi } from "vitest";
+import { BunServices } from "@effect/platform-bun";
+import { Effect, Layer, Option, References, Sink, Stdio } from "effect";
+import { mockRuntimeInfo } from "../../../tests/helpers/mocks.ts";
+import { withTraceExport } from "./trace-export.layer.ts";
+
+const runtime = Layer.mergeAll(mockRuntimeInfo(), BunServices.layer);
+
+const sinkModule = vi.hoisted(() => ({ evaluated: false }));
+
+vi.mock("./otlp-trace-sink.ts", () => {
+  sinkModule.evaluated = true;
+  return {};
+});
+
+describe("withTraceExport without a sink", () => {
+  it.effect("runs with the tracer disabled and never loads the OTLP sink", () =>
+    Effect.gen(function* () {
+      const observed = yield* Effect.gen(function* () {
+        const tracerEnabled = yield* References.TracerEnabled;
+        const span = yield* Effect.currentSpan;
+        return { tracerEnabled, spanName: span.name, spanAttributes: span.attributes.size };
+      }).pipe(
+        Effect.withSpan("Probe.span", { attributes: { a: 1 } }),
+        withTraceExport({ sink: Option.none() }, {}),
+        Effect.provide(runtime),
+      );
+
+      expect(observed).toEqual({ tracerEnabled: false, spanName: "Probe.span", spanAttributes: 0 });
+      expect(sinkModule.evaluated).toBe(false);
+    }),
+  );
+
+  it.effect("loads the sink module once a sink is configured, and runs untraced if it breaks", () =>
+    Effect.gen(function* () {
+      const written: Array<string> = [];
+      const stderr = Sink.forEach((chunk: string | Uint8Array) =>
+        Effect.sync(() => {
+          written.push(typeof chunk === "string" ? chunk : new TextDecoder().decode(chunk));
+        }),
+      );
+
+      const tracerEnabled = yield* Effect.service(References.TracerEnabled).pipe(
+        withTraceExport({ sink: Option.some({ _tag: "File", path: "/unused" }) }, {}),
+        Effect.provide(Layer.mergeAll(runtime, Stdio.layerTest({ stderr: () => stderr }))),
+      );
+
+      expect(sinkModule.evaluated).toBe(true);
+      expect(tracerEnabled).toBe(false);
+      expect(written.join("")).toMatch(
+        /^Warning: tracing disabled: could not start trace export: /u,
+      );
+    }),
+  );
+});
diff --git a/apps/cli/src/shared/telemetry/trace-export.unit.test.ts b/apps/cli/src/shared/telemetry/trace-export.unit.test.ts
new file mode 100644
index 0000000000..feb5463b09
--- /dev/null
+++ b/apps/cli/src/shared/telemetry/trace-export.unit.test.ts
@@ -0,0 +1,249 @@
+import { describe, expect, it } from "@effect/vitest";
+import { ConfigProvider, Effect, Layer, Option, Path, Redacted, Sink, Stdio } from "effect";
+import { BunServices } from "@effect/platform-bun";
+import { mockRuntimeInfo } from "../../../tests/helpers/mocks.ts";
+import { CliSettings } from "../config/cli-settings.service.ts";
+import { resolveTraceSettings, withDebugConsole, withTraceExport } from "./trace-export.layer.ts";
+
+const capturedStderr = () => {
+  const written: Array<string> = [];
+  const sink = Sink.forEach((chunk: string | Uint8Array) =>
+    Effect.sync(() => {
+      written.push(typeof chunk === "string" ? chunk : new TextDecoder().decode(chunk));
+    }),
+  );
+  return {
+    layer: Stdio.layerTest({ stderr: () => sink }),
+    text: () => written.join(""),
+  };
+};
+
+const resolveWithEnv = (env: Readonly<Record<string, string | undefined>>) => {
+  const stderr = capturedStderr();
+  return resolveTraceSettings.pipe(
+    Effect.provide(
+      Layer.mergeAll(
+        ConfigProvider.layer(ConfigProvider.fromUnknown(env)),
+        BunServices.layer,
+        stderr.layer,
+      ),
+    ),
+    Effect.map((settings) => ({ settings, stderr: stderr.text() })),
+  );
+};
+
+describe("resolveTraceSettings", () => {
+  it.effect("warns and turns tracing off for a trace file and an OTLP endpoint set together", () =>
+    Effect.gen(function* () {
+      const { settings, stderr } = yield* resolveWithEnv({
+        SUPABASE_TRACE_FILE: "/tmp/trace.jsonl",
+        SUPABASE_OTLP_ENDPOINT: "http://localhost:4318",
+      });
+
+      expect(settings).toEqual({ sink: Option.none() });
+      expect(stderr).toBe(
+        "Warning: tracing disabled: SUPABASE_TRACE_FILE and SUPABASE_OTLP_ENDPOINT are both set; choose one trace destination\n",
+      );
+    }),
+  );
+
+  it.effect("resolves a relative trace file against the startup directory", () =>
+    Effect.gen(function* () {
+      const path = yield* Path.Path;
+
+      const { settings } = yield* resolveWithEnv({ SUPABASE_TRACE_FILE: "traces/run.jsonl" });
+
+      expect(Option.getOrThrow(settings.sink)).toEqual({
+        _tag: "File",
+        path: path.join(process.cwd(), "traces", "run.jsonl"),
+      });
+    }).pipe(Effect.provide(BunServices.layer)),
+  );
+
+  it.effect("appends the OTLP traces path to a collector base URL", () =>
+    Effect.gen(function* () {
+      const { settings } = yield* resolveWithEnv({
+        SUPABASE_OTLP_ENDPOINT: "http://localhost:4318/",
+        SUPABASE_OTLP_HEADERS: "x-api-key=abc%3D,x-tenant = team",
+      });
+
+      expect(Option.getOrThrow(settings.sink)).toMatchObject({
+        _tag: "Otlp",
+        url: "http://localhost:4318/v1/traces",
+      });
+      const sink = Option.getOrThrow(settings.sink);
+      expect(sink._tag === "Otlp" && Redacted.value(sink.headers)).toEqual({
+        "x-api-key": "abc=",
+        "x-tenant": "team",
+      });
+    }),
+  );
+
+  it.effect("keeps an endpoint that already targets the traces path", () =>
+    Effect.gen(function* () {
+      const { settings } = yield* resolveWithEnv({
+        SUPABASE_OTLP_ENDPOINT: "https://otel.example.com/v1/traces",
+      });
+
+      expect(Option.getOrThrow(settings.sink)).toMatchObject({
+        url: "https://otel.example.com/v1/traces",
+      });
+    }),
+  );
+
+  it.effect.each([
+    {
+      setting: "endpoint",
+      env: { SUPABASE_OTLP_ENDPOINT: "localhost:4318" },
+      reason: "SUPABASE_OTLP_ENDPOINT must be an http(s) URL",
+    },
+    {
+      setting: "headers",
+      env: { SUPABASE_OTLP_ENDPOINT: "http://localhost:4318", SUPABASE_OTLP_HEADERS: "no-sep" },
+      reason: "SUPABASE_OTLP_HEADERS must be a comma-separated list",
+    },
+    {
+      setting: "header name",
+      env: { SUPABASE_OTLP_ENDPOINT: "http://localhost:4318", SUPABASE_OTLP_HEADERS: "x%20y=1" },
+      reason: "SUPABASE_OTLP_HEADERS must be a comma-separated list",
+    },
+    {
+      setting: "header value",
+      env: {
+        SUPABASE_OTLP_ENDPOINT: "http://localhost:4318",
+        SUPABASE_OTLP_HEADERS: "x-a=1%0D%0Ainjected: yes",
+      },
+      reason: "SUPABASE_OTLP_HEADERS must be a comma-separated list",
+    },
+  ])("warns and turns tracing off for invalid collector $setting", ({ env, reason }) =>
+    Effect.gen(function* () {
+      const { settings, stderr } = yield* resolveWithEnv(env);
+
+      expect(settings).toEqual({ sink: Option.none() });
+      expect(stderr).toContain(`Warning: tracing disabled: ${reason}`);
+      expect(stderr.split("\n").filter((line) => line.length > 0)).toHaveLength(1);
+    }),
+  );
+
+  it.effect("is off without a sink or warning, even with SUPABASE_DEBUG set", () =>
+    Effect.gen(function* () {
+      const { settings, stderr } = yield* resolveWithEnv({ SUPABASE_DEBUG: "1" });
+
+      expect(settings).toEqual({ sink: Option.none() });
+      expect(stderr).toBe("");
+    }),
+  );
+});
+
+const debugSettings = (debug: Partial<Record<"debug" | "telemetryDebug", string>>) =>
+  Layer.succeed(
+    CliSettings,
+    CliSettings.of({
+      apiUrl: "https://api.supabase.com",
+      dashboardUrl: "https://supabase.com/dashboard",
+      projectHost: "supabase.co",
+      telemetryPosthogHost: "https://eu.i.posthog.com",
+      telemetryPosthogKey: Option.none(),
+      accessToken: Option.none(),
+      noKeyring: Option.none(),
+      supabaseHome: "/tmp/supabase-cli-test-home",
+      debug: Option.fromUndefinedOr(debug.debug),
+      telemetryDebug: Option.fromUndefinedOr(debug.telemetryDebug),
+      telemetryDisabled: Option.none(),
+      doNotTrack: Option.none(),
+    }),
+  );
+
+const runWithDebugConsole = Effect.fnUntraced(function* (
+  debug: Partial<Record<"debug" | "telemetryDebug", string>>,
+  program: Effect.Effect<void>,
+  options: { readonly enclosingRoot?: boolean } = {},
+) {
+  const stderr = capturedStderr();
+  const consoled = withDebugConsole(program);
+  yield* (
+    options.enclosingRoot === true
+      ? consoled.pipe(Effect.withSpan("cli.run"), Effect.withTracerEnabled(true))
+      : consoled.pipe(withTraceExport({ sink: Option.none() }, {}))
+  ).pipe(
+    Effect.provide(
+      Layer.mergeAll(BunServices.layer, stderr.layer, mockRuntimeInfo(), debugSettings(debug)),
+    ),
+  );
+  return stderr.text();
+});
+
+describe("withDebugConsole", () => {
+  it.effect("prints spans up to depth 2 and deeper failures, sanitized", () =>
+    Effect.gen(function* () {
+      const program = Effect.void.pipe(
+        Effect.withSpan("Depth.three"),
+        Effect.andThen(
+          Effect.fail("boom").pipe(Effect.withSpan("Depth.threeFailed"), Effect.ignore),
+        ),
+        Effect.withSpan("Depth.two"),
+        Effect.withSpan("Depth.one", {
+          attributes: { "url.full": "https://api.supabase.com/v1/projects?token=abc" },
+        }),
+        Effect.withSpan("Depth.zero"),
+      );
+
+      const output = yield* runWithDebugConsole({ debug: "1" }, program);
+
+      expect(output).toContain("Depth.zero");
+      expect(output).toContain("Depth.one");
+      expect(output).toContain("Depth.two");
+      expect(output).toContain("Depth.threeFailed (");
+      expect(output).toContain("failed");
+      expect(output).not.toContain("Depth.three (");
+      expect(output).not.toContain("token=abc");
+      expect(output).not.toContain("boom");
+    }),
+  );
+
+  it.effect("prints the same spans whether or not a root span encloses the console", () =>
+    Effect.gen(function* () {
+      const program = Effect.void.pipe(
+        Effect.withSpan("Depth.three"),
+        Effect.withSpan("Depth.two"),
+        Effect.withSpan("Depth.one"),
+        Effect.withSpan("Depth.zero"),
+      );
+      const printedSpans = (output: string) =>
+        output
+          .split("\n")
+          .filter((line) => line.length > 0)
+          .map((line) => line.replace(/^\[[^\]]+\] /u, "").replace(/ \(\d+ms\)/u, ""));
+
+      const standalone = yield* runWithDebugConsole({ debug: "1" }, program);
+      const enclosed = yield* runWithDebugConsole({ debug: "1" }, program, {
+        enclosingRoot: true,
+      });
+
+      expect(printedSpans(standalone)).toEqual(["    Depth.two", "  Depth.one", "Depth.zero"]);
+      expect(printedSpans(enclosed)).toEqual(printedSpans(standalone));
+    }),
+  );
+
+  it.effect("prints spans for SUPABASE_TELEMETRY_DEBUG=1", () =>
+    Effect.gen(function* () {
+      const output = yield* runWithDebugConsole(
+        { telemetryDebug: "1" },
+        Effect.void.pipe(Effect.withSpan("Probe.span")),
+      );
+
+      expect(output).toContain("Probe.span");
+    }),
+  );
+
+  it.effect("prints nothing unless a debug setting is exactly 1", () =>
+    Effect.gen(function* () {
+      const output = yield* runWithDebugConsole(
+        { debug: "true", telemetryDebug: "0" },
+        Effect.void.pipe(Effect.withSpan("Probe.span")),
+      );
+
+      expect(output).toBe("");
+    }),
+  );
+});
diff --git a/apps/cli/src/shared/telemetry/trace-sanitize.ts b/apps/cli/src/shared/telemetry/trace-sanitize.ts
new file mode 100644
index 0000000000..66be615ad6
--- /dev/null
+++ b/apps/cli/src/shared/telemetry/trace-sanitize.ts
@@ -0,0 +1,374 @@
+import { createHmac } from "node:crypto";
+import { Cause, Crypto, Effect, Exit } from "effect";
+import type { KeyValue, AnyValue } from "effect/unstable/observability/OtlpResource";
+import type { ScopeSpan, TraceData } from "effect/unstable/observability/OtlpTracer";
+
+const MAX_STRING_LENGTH = 2048;
+const REDACTED = "<redacted>";
+const QUERY_HASH_SALT_BYTES = 32;
+const QUERY_HASH_HEX_LENGTH = 16;
+const MAX_CAUSE_DEPTH = 6;
+/** SQLSTATE classes start with a digit or `F0`/`HV`/`P0`/`XX`, which excludes errno names like `E2BIG`. */
+const POSTGRES_SQLSTATE = /^(?:[0-9][0-9A-Z]|F0|HV|P0|XX)[0-9A-Z]{3}$/u;
+const TRACE_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$.]{0,99}$/u;
+const FALLBACK_ERROR_TYPE = "Error";
+/** Effect also merges `OTEL_RESOURCE_ATTRIBUTES` into the resource; only these keys are exported. */
+const RESOURCE_ATTRIBUTE_KEPT: ReadonlySet<string> = new Set([
+  "service.name",
+  "service.version",
+  "os",
+  "arch",
+  "is_ci",
+  "service.instance.id",
+  "telemetry.sdk.name",
+  "telemetry.sdk.language",
+  "telemetry.sdk.version",
+]);
+const EXCEPTION_EVENT = "exception";
+const LOG_EVENT = "log";
+const EVENT_ATTRIBUTE_KEPT = {
+  [EXCEPTION_EVENT]: "exception.type",
+  [LOG_EVENT]: "effect.logLevel",
+};
+
+type SpanEvent = ScopeSpan["spans"][number]["events"][number];
+type QueryHasher = (text: string) => string;
+
+const ALLOWED_HEADERS: ReadonlySet<string> = new Set([
+  "content-type",
+  "content-length",
+  "user-agent",
+  "x-request-id",
+  "cf-ray",
+  "retry-after",
+]);
+const HEADER_ATTRIBUTE = /^http\.(?:request|response)\.header\.(.+)$/u;
+const DENIED_KEY = /token|password|secret|apikey|api_key|authorization|cookie/iu;
+
+const VALUE_SCRUBBERS: ReadonlyArray<readonly [RegExp, string]> = [
+  // Greedy to the last `@`, since a password may itself contain `/` or `@`.
+  [/\b([a-z][a-z0-9+.-]*:\/\/)[^\s"'<>]+@/giu, `$1${REDACTED}@`],
+  [/(https?:\/\/[^\s?#"'<>]+)\?[^\s#"'<>]*/giu, `$1?${REDACTED}`],
+  [/\b(bearer\s+)[A-Za-z0-9._~+/=-]+/giu, `$1${REDACTED}`],
+  [/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/gu, REDACTED],
+  [/\b(?:sbp|sba|sb_secret|sb_publishable)_[A-Za-z0-9_-]{8,}/gu, REDACTED],
+  [/(\bpassword\s+)'(?:[^']|'')*'/giu, `$1'${REDACTED}'`],
+  [
+    /\b(password|passwd|pwd|secret|token|apikey|api_key)(\s*[=:]\s*)("[^"]*"|'[^']*'|[^\s&;,]+)/giu,
+    `$1$2${REDACTED}`,
+  ],
+  // Postgres constraint details such as `Key (email)=(a@b.c) already exists.`
+  [/(\bkey \((?:[^()]|\([^()]*\))*\)=\()(?:[^()]|\([^()]*\))*\)/giu, `$1${REDACTED})`],
+  // SQL string literals; the lookarounds leave apostrophes inside words alone.
+  [/(?<![\w'])'(?:[^']|'')*'(?!\w)/gu, `'${REDACTED}'`],
+];
+
+const STORAGE_PATH = "/storage/v1/";
+const STORAGE_OBJECT_ROUTE = "object/";
+/** Storage routes whose remaining path segments name a bucket or object. */
+const STORAGE_NAMED_ROUTES: ReadonlyArray<string> = [
+  STORAGE_OBJECT_ROUTE,
+  "bucket/",
+  "iceberg/bucket/",
+];
+const STORAGE_OBJECT_VERBS: ReadonlySet<string> = new Set([
+  "sign",
+  "public",
+  "authenticated",
+  "list",
+  "info",
+  "move",
+  "copy",
+  "upload",
+]);
+
+/** Removes credentials from free text and caps its length. */
+export function scrubString(value: string): string {
+  let scrubbed = value;
+  for (const [pattern, replacement] of VALUE_SCRUBBERS) {
+    scrubbed = scrubbed.replace(pattern, replacement);
+  }
+  return scrubbed.length > MAX_STRING_LENGTH
+    ? `${scrubbed.slice(0, MAX_STRING_LENGTH)}…[truncated]`
+    : scrubbed;
+}
+
+function redactStoragePath(pathname: string): string {
+  const start = pathname.indexOf(STORAGE_PATH);
+  if (start === -1) return pathname;
+  const routeStart = start + STORAGE_PATH.length;
+  const route = STORAGE_NAMED_ROUTES.find((candidate) =>
+    pathname.startsWith(candidate, routeStart),
+  );
+  if (route === undefined) return pathname;
+  const prefixEnd = routeStart + route.length;
+  const [first = "", ...rest] = pathname.slice(prefixEnd).split("/");
+  if (route === STORAGE_OBJECT_ROUTE && STORAGE_OBJECT_VERBS.has(first)) {
+    return rest.join("/").length === 0
+      ? pathname
+      : `${pathname.slice(0, prefixEnd)}${first}/${REDACTED}`;
+  }
+  return first.length === 0 && rest.length === 0
+    ? pathname
+    : `${pathname.slice(0, prefixEnd)}${REDACTED}`;
+}
+
+function urlWithoutQuery(value: string): string {
+  try {
+    const url = new URL(value);
+    return scrubString(`${url.protocol}//${url.host}${redactStoragePath(url.pathname)}`);
+  } catch {
+    return scrubString(value);
+  }
+}
+
+function sanitizeUrlAttribute(key: string, value: string): string | undefined {
+  if (key === "url.full") return urlWithoutQuery(value);
+  if (key === "url.path") return scrubString(redactStoragePath(value));
+  return undefined;
+}
+
+function queryAttributes(
+  text: string,
+  hashQuery: QueryHasher,
+): ReadonlyArray<readonly [string, string | number]> {
+  const keyword = /^\s*([A-Za-z]+)/u.exec(text)?.[1]?.toUpperCase();
+  return [
+    ...(keyword === undefined ? [] : [["db.operation.name", keyword] as const]),
+    ["db.query.hash", hashQuery(text)],
+    ["db.query.length", text.length],
+  ];
+}
+
+type AttributeDecision =
+  | { readonly _tag: "Drop" }
+  | { readonly _tag: "Keep" }
+  | { readonly _tag: "Query" };
+
+/** `numericOrBoolean` values such as `secret.count` carry no credential and survive the key denylist. */
+function decide(key: string, numericOrBoolean: boolean): AttributeDecision {
+  if (key === "db.query.text") return { _tag: "Query" };
+  if (key === "url.query") return { _tag: "Drop" };
+  const header = HEADER_ATTRIBUTE.exec(key);
+  if (header !== null) {
+    return ALLOWED_HEADERS.has(header[1]!.toLowerCase()) ? { _tag: "Keep" } : { _tag: "Drop" };
+  }
+  if (!numericOrBoolean && DENIED_KEY.test(key)) return { _tag: "Drop" };
+  return { _tag: "Keep" };
+}
+
+function isNumericOrBoolean(value: unknown): boolean {
+  return typeof value === "number" || typeof value === "bigint" || typeof value === "boolean";
+}
+
+function isNumericOrBooleanAnyValue(value: AnyValue): boolean {
+  return value.intValue != null || value.doubleValue != null || value.boolValue != null;
+}
+
+function scrubUnknown(value: unknown): unknown {
+  if (typeof value === "string") return scrubString(value);
+  if (Array.isArray(value)) return value.map(scrubUnknown);
+  return value;
+}
+
+function sanitizeAttributeEntries(
+  entries: Iterable<readonly [string, unknown]>,
+  hashQuery: QueryHasher,
+): Array<readonly [string, unknown]> {
+  const result: Array<readonly [string, unknown]> = [];
+  for (const [key, value] of entries) {
+    const decision = decide(key, isNumericOrBoolean(value));
+    switch (decision._tag) {
+      case "Drop":
+        break;
+      case "Query":
+        if (typeof value === "string") result.push(...queryAttributes(value, hashQuery));
+        break;
+      default:
+        result.push([
+          key,
+          (typeof value === "string" ? sanitizeUrlAttribute(key, value) : undefined) ??
+            scrubUnknown(value),
+        ]);
+    }
+  }
+  return result;
+}
+
+function scrubAnyValue(value: AnyValue, hashQuery: QueryHasher): AnyValue {
+  if (typeof value.stringValue === "string") {
+    return { ...value, stringValue: scrubString(value.stringValue) };
+  }
+  if (value.arrayValue !== undefined) {
+    return {
+      ...value,
+      arrayValue: { values: value.arrayValue.values.map((item) => scrubAnyValue(item, hashQuery)) },
+    };
+  }
+  if (value.kvlistValue !== undefined) {
+    return {
+      ...value,
+      kvlistValue: { values: sanitizeKeyValues(value.kvlistValue.values, hashQuery) },
+    };
+  }
+  return value;
+}
+
+function toAnyValue(value: string | number): AnyValue {
+  return typeof value === "number" ? { intValue: value } : { stringValue: value };
+}
+
+function sanitizeKeyValues(
+  attributes: ReadonlyArray<KeyValue>,
+  hashQuery: QueryHasher,
+): Array<KeyValue> {
+  const result: Array<KeyValue> = [];
+  for (const attribute of attributes) {
+    const decision = decide(attribute.key, isNumericOrBooleanAnyValue(attribute.value));
+    switch (decision._tag) {
+      case "Drop":
+        break;
+      case "Query": {
+        const text = attribute.value.stringValue;
+        if (typeof text === "string") {
+          for (const [key, value] of queryAttributes(text, hashQuery)) {
+            result.push({ key, value: toAnyValue(value) });
+          }
+        }
+        break;
+      }
+      default: {
+        const text = attribute.value.stringValue;
+        const url =
+          typeof text === "string" ? sanitizeUrlAttribute(attribute.key, text) : undefined;
+        result.push({
+          key: attribute.key,
+          value:
+            url === undefined ? scrubAnyValue(attribute.value, hashQuery) : { stringValue: url },
+        });
+      }
+    }
+  }
+  return result;
+}
+
+/** `value` when it reads as a class or tag name; an error's `name` is free text that may carry user data. */
+function errorTypeName(value: unknown): string {
+  return typeof value === "string" && TRACE_IDENTIFIER.test(value) ? value : FALLBACK_ERROR_TYPE;
+}
+
+/** Log events are named after their free-text message, so every non-exception event becomes `log`. */
+function sanitizeEvent(event: SpanEvent, hashQuery: QueryHasher): SpanEvent {
+  if (event.name === EXCEPTION_EVENT) {
+    return {
+      ...event,
+      attributes: event.attributes
+        .filter((attribute) => attribute.key === EVENT_ATTRIBUTE_KEPT[EXCEPTION_EVENT])
+        .map((attribute) => ({
+          key: attribute.key,
+          value: { stringValue: errorTypeName(attribute.value.stringValue) },
+        })),
+    };
+  }
+  return {
+    ...event,
+    name: LOG_EVENT,
+    attributes: sanitizeKeyValues(
+      event.attributes.filter((attribute) => attribute.key === EVENT_ATTRIBUTE_KEPT[LOG_EVENT]),
+      hashQuery,
+    ),
+  };
+}
+
+function sanitizeTraceData(data: TraceData, hashQuery: QueryHasher): TraceData {
+  return {
+    resourceSpans: data.resourceSpans.map((resourceSpan) => ({
+      ...resourceSpan,
+      resource: {
+        ...resourceSpan.resource,
+        attributes: sanitizeKeyValues(
+          resourceSpan.resource.attributes.filter((attribute) =>
+            RESOURCE_ATTRIBUTE_KEPT.has(attribute.key),
+          ),
+          hashQuery,
+        ),
+      },
+      scopeSpans: resourceSpan.scopeSpans.map((scopeSpan) => ({
+        ...scopeSpan,
+        spans: scopeSpan.spans.map((span) => ({
+          ...span,
+          attributes: sanitizeKeyValues(span.attributes, hashQuery),
+          events: span.events.map((event) => sanitizeEvent(event, hashQuery)),
+          links: span.links.map((link) => ({
+            ...link,
+            attributes: sanitizeKeyValues(link.attributes, hashQuery),
+          })),
+          status: { code: span.status.code },
+        })),
+      })),
+    })),
+  };
+}
+
+/** Sanitizes span data before it leaves the process or reaches the debug console. */
+export interface TraceSanitizer {
+  /** Sanitizes span attributes for local display. */
+  readonly attributeEntries: (
+    entries: Iterable<readonly [string, unknown]>,
+  ) => Array<readonly [string, unknown]>;
+  /** Keeps only structured data: attributes, event and exception types, and status codes. */
+  readonly traceData: (data: TraceData) => TraceData;
+}
+
+/**
+ * Creates a sanitizer whose `db.query.hash` is keyed by a fresh random salt, so repeated
+ * statements share a hash within one sanitizer but hashes cannot be compared across runs.
+ */
+export const makeTraceSanitizer: Effect.Effect<TraceSanitizer, never, Crypto.Crypto> = Effect.gen(
+  function* () {
+    const crypto = yield* Crypto.Crypto;
+    const salt = yield* Effect.orDie(crypto.randomBytes(QUERY_HASH_SALT_BYTES));
+    const hashQuery: QueryHasher = (text) =>
+      createHmac("sha256", salt).update(text).digest("hex").slice(0, QUERY_HASH_HEX_LENGTH);
+    return {
+      attributeEntries: (entries) => sanitizeAttributeEntries(entries, hashQuery),
+      traceData: (data) => sanitizeTraceData(data, hashQuery),
+    };
+  },
+);
+
+function failureOf(reason: Cause.Reason<unknown>): unknown {
+  if (Cause.isFailReason(reason)) return reason.error;
+  if (Cause.isDieReason(reason)) return reason.defect;
+  return undefined;
+}
+
+/** The `_tag` of a failed exit's first tagged error, if any, reduced to an identifier. */
+export function errorTypeOf(exit: Exit.Exit<unknown, unknown>): string | undefined {
+  if (Exit.isSuccess(exit)) return undefined;
+  for (const reason of exit.cause.reasons) {
+    const failure = failureOf(reason);
+    if (typeof failure !== "object" || failure === null) continue;
+    const tag = Reflect.get(failure, "_tag");
+    if (typeof tag === "string") return errorTypeName(tag);
+  }
+  return undefined;
+}
+
+/** The Postgres SQLSTATE carried by a failed exit's error or its `cause` chain, if any. */
+export function sqlStateOf(exit: Exit.Exit<unknown, unknown>): string | undefined {
+  if (Exit.isSuccess(exit)) return undefined;
+  for (const reason of exit.cause.reasons) {
+    let current: unknown = failureOf(reason);
+    for (
+      let depth = 0;
+      depth < MAX_CAUSE_DEPTH && typeof current === "object" && current !== null;
+      depth++
+    ) {
+      const code = Reflect.get(current, "code");
+      if (typeof code === "string" && POSTGRES_SQLSTATE.test(code)) return code;
+      current = Reflect.get(current, "cause");
+    }
+  }
+  return undefined;
+}
diff --git a/apps/cli/src/shared/telemetry/trace-sanitize.unit.test.ts b/apps/cli/src/shared/telemetry/trace-sanitize.unit.test.ts
new file mode 100644
index 0000000000..76a2b20268
--- /dev/null
+++ b/apps/cli/src/shared/telemetry/trace-sanitize.unit.test.ts
@@ -0,0 +1,483 @@
+import { BunServices } from "@effect/platform-bun";
+import { describe, expect, it } from "vitest";
+import { Effect, Exit } from "effect";
+import type { TraceData } from "effect/unstable/observability/OtlpTracer";
+import { SqlError, UniqueViolation } from "effect/unstable/sql/SqlError";
+import { DbExecError } from "../../command-internal/db-connection.errors.ts";
+import { errorTypeOf, makeTraceSanitizer, scrubString, sqlStateOf } from "./trace-sanitize.ts";
+
+const JWT =
+  "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoic2VydmljZV9yb2xlIn0.c2lnbmF0dXJlLXZhbHVl";
+
+const newSanitizer = () =>
+  Effect.runSync(makeTraceSanitizer.pipe(Effect.provide(BunServices.layer)));
+const sanitizer = newSanitizer();
+const sanitizeAttributeEntries = sanitizer.attributeEntries;
+const sanitizeTraceData = sanitizer.traceData;
+
+function traceWith(span: {
+  readonly attributes?: TraceData["resourceSpans"][number]["scopeSpans"][number]["spans"][number]["attributes"];
+  readonly events?: TraceData["resourceSpans"][number]["scopeSpans"][number]["spans"][number]["events"];
+  readonly statusMessage?: string;
+}): TraceData {
+  return {
+    resourceSpans: [
+      {
+        resource: { attributes: [], droppedAttributesCount: 0 },
+        scopeSpans: [
+          {
+            scope: { name: "supabase-cli" },
+            spans: [
+              {
+                traceId: "0".repeat(32),
+                spanId: "0".repeat(16),
+                parentSpanId: undefined,
+                name: "span",
+                kind: 1,
+                startTimeUnixNano: "0",
+                endTimeUnixNano: "1",
+                attributes: span.attributes ?? [],
+                droppedAttributesCount: 0,
+                events: span.events ?? [],
+                droppedEventsCount: 0,
+                status:
+                  span.statusMessage === undefined
+                    ? { code: 1 }
+                    : { code: 2, message: span.statusMessage },
+                links: [],
+                droppedLinksCount: 0,
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  };
+}
+
+const firstSpan = (data: TraceData) => data.resourceSpans[0]!.scopeSpans[0]!.spans[0]!;
+
+describe("scrubString", () => {
+  it.each([
+    [
+      "DSN credentials",
+      "connect postgresql://postgres:hunter2@db.example.com:5432/postgres",
+      "hunter2",
+    ],
+    ["bearer token", "Authorization: Bearer sbp_0123456789abcdef0123", "sbp_0123456789abcdef0123"],
+    ["JWT", `token was ${JWT}`, JWT],
+    ["Supabase secret key", "key sb_secret_abcdefghijklmnop", "sb_secret_abcdefghijklmnop"],
+    ["password pair", "host=db user=postgres password=hunter2 dbname=x", "hunter2"],
+    ["SQL literal password", "ALTER ROLE app WITH LOGIN PASSWORD 'hunter2'", "hunter2"],
+    [
+      "signed URL query",
+      "GET https://x.supabase.co/storage/v1/object/sign/a.png?token=abc123",
+      "abc123",
+    ],
+  ])("removes %s", (_label, input, secret) => {
+    const scrubbed = scrubString(input);
+
+    expect(scrubbed).not.toContain(secret);
+    expect(scrubbed).toContain("<redacted>");
+  });
+
+  it("truncates long strings to 2 KB", () => {
+    const scrubbed = scrubString("a".repeat(5000));
+
+    expect(scrubbed.startsWith("a".repeat(2048))).toBe(true);
+    expect(scrubbed.length).toBeLessThan(2100);
+    expect(scrubbed).toContain("[truncated]");
+  });
+
+  it("keeps ordinary text unchanged", () => {
+    expect(scrubString("migration 20240101 applied")).toBe("migration 20240101 applied");
+  });
+
+  it.each([
+    ["a SQL literal", "syntax error near 'hunter2'", "syntax error near '<redacted>'"],
+    ["an escaped SQL literal", "value 'it''s hunter2' rejected", "value '<redacted>' rejected"],
+    [
+      "a constraint detail",
+      "Key (email)=(a@b.c) already exists.",
+      "Key (email)=(<redacted>) already exists.",
+    ],
+    [
+      "a composite constraint detail",
+      "Key (org_id, lower(email))=(7, a@b.c) is not present in table",
+      "Key (org_id, lower(email))=(<redacted>) is not present in table",
+    ],
+  ])("redacts %s", (_label, input, expected) => {
+    expect(scrubString(input)).toBe(expected);
+  });
+
+  it("keeps apostrophes inside words", () => {
+    expect(scrubString("can't read the project's config")).toBe("can't read the project's config");
+  });
+
+  it.each([
+    ["a slash", "dial postgresql://postgres:pa/ss@db.example.com/postgres failed"],
+    ["an at sign", "dial postgresql://postgres:p@ss@db.example.com/postgres failed"],
+  ])("redacts URL credentials whose password contains %s", (_label, input) => {
+    expect(scrubString(input)).toBe("dial postgresql://<redacted>@db.example.com/postgres failed");
+  });
+
+  it("keeps a URL without credentials unchanged", () => {
+    expect(scrubString("GET https://api.supabase.com/v1/projects failed")).toBe(
+      "GET https://api.supabase.com/v1/projects failed",
+    );
+  });
+});
+
+describe("attribute entries", () => {
+  it("replaces the query text with its shape", () => {
+    const text = "SELECT * FROM auth.users WHERE email = 'a@b.c'";
+
+    const attributes = Object.fromEntries(sanitizeAttributeEntries([["db.query.text", text]]));
+
+    expect(attributes).toEqual({
+      "db.operation.name": "SELECT",
+      "db.query.hash": expect.stringMatching(/^[0-9a-f]{16}$/u),
+      "db.query.length": text.length,
+    });
+  });
+
+  it("hashes a repeated query the same within one sanitizer and differently across sanitizers", () => {
+    const query = [["db.query.text", "SELECT * FROM storage.objects WHERE id = $1"]] as const;
+    const hashOf = (entries: ReadonlyArray<readonly [string, unknown]>) =>
+      Object.fromEntries(entries)["db.query.hash"];
+
+    const first = hashOf(sanitizeAttributeEntries(query));
+    const repeated = hashOf(sanitizeAttributeEntries(query));
+    const otherRun = hashOf(newSanitizer().attributeEntries(query));
+
+    expect(repeated).toBe(first);
+    expect(otherRun).not.toBe(first);
+  });
+
+  it("strips the query from url.full and drops url.query", () => {
+    const attributes = Object.fromEntries(
+      sanitizeAttributeEntries([
+        ["url.full", "https://user:pw@x.supabase.co/storage/v1/object/sign/a.png?token=abc"],
+        ["url.query", "token=abc"],
+      ]),
+    );
+
+    expect(attributes).toEqual({
+      "url.full": "https://x.supabase.co/storage/v1/object/sign/<redacted>",
+    });
+  });
+
+  it.each([
+    ["/storage/v1/object/sign/avatars/u1/a.png", "/storage/v1/object/sign/<redacted>"],
+    ["/storage/v1/object/avatars/u1/a.png", "/storage/v1/object/<redacted>"],
+    ["/storage/v1/object/list/avatars", "/storage/v1/object/list/<redacted>"],
+    ["/storage/v1/object/move", "/storage/v1/object/move"],
+    ["/storage/v1/bucket/avatars", "/storage/v1/bucket/<redacted>"],
+    ["/storage/v1/bucket", "/storage/v1/bucket"],
+    ["/storage/v1/iceberg/bucket/analytics", "/storage/v1/iceberg/bucket/<redacted>"],
+    ["/storage/v1/iceberg/bucket", "/storage/v1/iceberg/bucket"],
+    ["/storage/v1/vector/ListVectorBuckets", "/storage/v1/vector/ListVectorBuckets"],
+    ["/v1/projects/abc/functions", "/v1/projects/abc/functions"],
+  ])("redacts the Storage bucket or object in url.path and url.full for %s", (path, expected) => {
+    const attributes = Object.fromEntries(
+      sanitizeAttributeEntries([
+        ["url.path", path],
+        ["url.full", `https://x.supabase.co${path}`],
+      ]),
+    );
+
+    expect(attributes).toEqual({
+      "url.path": expected,
+      "url.full": `https://x.supabase.co${expected}`,
+    });
+  });
+
+  it("scrubs credentials that appear in the path of a non-Storage url.full", () => {
+    const jwt = "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.c2lnbmF0dXJl";
+    const attributes = Object.fromEntries(
+      sanitizeAttributeEntries([["url.full", `https://idp.example.com/saml/${jwt}/metadata?x=1`]]),
+    );
+    const exported = JSON.stringify(
+      sanitizeTraceData(
+        traceWith({
+          attributes: [
+            {
+              key: "url.full",
+              value: { stringValue: `https://idp.example.com/saml/${jwt}/metadata` },
+            },
+          ],
+        }),
+      ),
+    );
+
+    expect(attributes["url.full"]).toBe("https://idp.example.com/saml/<redacted>/metadata");
+    expect(exported).not.toContain(jwt);
+  });
+
+  it("keeps only allowlisted headers", () => {
+    const attributes = Object.fromEntries(
+      sanitizeAttributeEntries([
+        ["http.request.header.content-type", "application/json"],
+        ["http.request.header.authorization", "Bearer abc"],
+        ["http.response.header.location", "https://x.supabase.co/cb?code=secret"],
+        ["http.response.header.x-request-id", "req-1"],
+      ]),
+    );
+
+    expect(attributes).toEqual({
+      "http.request.header.content-type": "application/json",
+      "http.response.header.x-request-id": "req-1",
+    });
+  });
+
+  it("drops keys that name credentials", () => {
+    const attributes = Object.fromEntries(
+      sanitizeAttributeEntries([
+        ["db.password", "hunter2"],
+        ["access_token", "abc"],
+        ["service", "db"],
+      ]),
+    );
+
+    expect(attributes).toEqual({ service: "db" });
+  });
+
+  it("keeps numeric and boolean values under credential-named keys", () => {
+    const attributes = Object.fromEntries(
+      sanitizeAttributeEntries([
+        ["secret.count", 3],
+        ["secret.batch_count", 1],
+        ["config.access_token_from_env", true],
+        ["secret.name", "STRIPE_KEY"],
+      ]),
+    );
+
+    expect(attributes).toEqual({
+      "secret.count": 3,
+      "secret.batch_count": 1,
+      "config.access_token_from_env": true,
+    });
+  });
+});
+
+const failingMigration = [
+  'ERROR: null value in column "role" violates not-null constraint (SQLSTATE 23502)',
+  "Detail: Failing row contains (1, alice@example.com, s3cret).",
+].join("\n");
+const dollarQuotedBody =
+  "CREATE FUNCTION seed() RETURNS text AS $$ SELECT $pw$dollar-quoted-secret$pw$ $$ LANGUAGE sql";
+const escapeLiteral = "syntax error at or near E'it\\'s-e-literal-secret'";
+const storageError = "Object not found: bucket/private/key.pdf";
+
+describe("trace data", () => {
+  it("exports only allowlisted resource attributes", () => {
+    const data = traceWith({});
+    const withResource: TraceData = {
+      resourceSpans: data.resourceSpans.map((resourceSpan) => ({
+        ...resourceSpan,
+        resource: {
+          ...resourceSpan.resource,
+          attributes: [
+            { key: "service.name", value: { stringValue: "supabase-cli" } },
+            { key: "os", value: { stringValue: "darwin" } },
+            { key: "service.instance.id", value: { stringValue: "4242" } },
+            { key: "deployment.owner", value: { stringValue: "alice@example.com" } },
+          ],
+        },
+      })),
+    };
+
+    expect(
+      sanitizeTraceData(withResource).resourceSpans[0]!.resource.attributes.map(
+        (attribute) => attribute.key,
+      ),
+    ).toEqual(["service.name", "os", "service.instance.id"]);
+  });
+
+  it("exports exception events with only the error type and drops the status message", () => {
+    const data = traceWith({
+      statusMessage: failingMigration,
+      events: [
+        {
+          name: "exception",
+          timeUnixNano: "1",
+          droppedAttributesCount: 0,
+          attributes: [
+            { key: "exception.type", value: { stringValue: "DbExecError" } },
+            { key: "exception.message", value: { stringValue: failingMigration } },
+            {
+              key: "exception.stacktrace",
+              value: { stringValue: `DbExecError: ${storageError}\n    at ${escapeLiteral}` },
+            },
+          ],
+        },
+      ],
+    });
+
+    const span = firstSpan(sanitizeTraceData(data));
+
+    expect(span.status).toEqual({ code: 2 });
+    expect(span.events.map(({ name, attributes }) => ({ name, attributes }))).toEqual([
+      {
+        name: "exception",
+        attributes: [{ key: "exception.type", value: { stringValue: "DbExecError" } }],
+      },
+    ]);
+  });
+
+  it.each([
+    ["Key (email)=(a@b) already exists", "Error"],
+    ["", "Error"],
+    ["x".repeat(101), "Error"],
+    ["PlatformError", "PlatformError"],
+    ["effect.Cause.NoSuchElementError", "effect.Cause.NoSuchElementError"],
+  ])("exports exception type %j as %j", (type, expected) => {
+    const data = traceWith({
+      events: [
+        {
+          name: "exception",
+          timeUnixNano: "1",
+          droppedAttributesCount: 0,
+          attributes: [{ key: "exception.type", value: { stringValue: type } }],
+        },
+      ],
+    });
+
+    expect(firstSpan(sanitizeTraceData(data)).events[0]!.attributes).toEqual([
+      { key: "exception.type", value: { stringValue: expected } },
+    ]);
+  });
+
+  it("renames log events to log and keeps only their level", () => {
+    const data = traceWith({
+      events: [dollarQuotedBody, escapeLiteral, storageError].map((message) => ({
+        name: message,
+        timeUnixNano: "1",
+        droppedAttributesCount: 0,
+        attributes: [
+          { key: "effect.fiberId", value: { intValue: 7 } },
+          { key: "effect.logLevel", value: { stringValue: "INFO" } },
+          { key: "effect.cause", value: { stringValue: failingMigration } },
+          { key: "migration.file", value: { stringValue: "20240101_seed.sql" } },
+        ],
+      })),
+    });
+
+    const span = firstSpan(sanitizeTraceData(data));
+
+    expect(span.events.map(({ name, attributes }) => ({ name, attributes }))).toEqual(
+      Array.from({ length: 3 }, () => ({
+        name: "log",
+        attributes: [{ key: "effect.logLevel", value: { stringValue: "INFO" } }],
+      })),
+    );
+  });
+
+  it("replaces db.query.text with the operation, hash, and length", () => {
+    const text = "ALTER ROLE app PASSWORD 'hunter2'";
+    const data = traceWith({
+      attributes: [{ key: "db.query.text", value: { stringValue: text } }],
+    });
+
+    const attributes = firstSpan(sanitizeTraceData(data)).attributes;
+
+    expect(attributes.map((attribute) => attribute.key)).toEqual([
+      "db.operation.name",
+      "db.query.hash",
+      "db.query.length",
+    ]);
+    expect(JSON.stringify(attributes)).not.toContain("hunter2");
+  });
+
+  it("drops a location header carrying a signed URL", () => {
+    const data = traceWith({
+      attributes: [
+        {
+          key: "http.response.header.location",
+          value: { stringValue: "https://x.supabase.co/object/sign/a?token=abc" },
+        },
+        { key: "http.response.status_code", value: { intValue: 302 } },
+      ],
+    });
+
+    expect(firstSpan(sanitizeTraceData(data)).attributes).toEqual([
+      { key: "http.response.status_code", value: { intValue: 302 } },
+    ]);
+  });
+
+  it("keeps numeric and boolean values under credential-named keys", () => {
+    const data = traceWith({
+      attributes: [
+        { key: "vault.secret_count", value: { intValue: 2 } },
+        { key: "config.access_token_from_env", value: { boolValue: false } },
+        { key: "secret.value", value: { stringValue: "hunter2" } },
+      ],
+    });
+
+    expect(firstSpan(sanitizeTraceData(data)).attributes).toEqual([
+      { key: "vault.secret_count", value: { intValue: 2 } },
+      { key: "config.access_token_from_env", value: { boolValue: false } },
+    ]);
+  });
+
+  it("redacts the Storage object key in url.path", () => {
+    const data = traceWith({
+      attributes: [
+        { key: "url.path", value: { stringValue: "/storage/v1/object/public/avatars/u1.png" } },
+      ],
+    });
+
+    expect(firstSpan(sanitizeTraceData(data)).attributes).toEqual([
+      { key: "url.path", value: { stringValue: "/storage/v1/object/public/<redacted>" } },
+    ]);
+  });
+});
+
+describe("errorTypeOf", () => {
+  it("reads the tag of a tagged failure", () => {
+    expect(errorTypeOf(Exit.fail(new DbExecError({ message: failingMigration })))).toBe(
+      "DbExecError",
+    );
+  });
+
+  it("reduces a free-form tag to Error", () => {
+    expect(errorTypeOf(Exit.fail({ _tag: "Key (email)=(a@b) already exists" }))).toBe("Error");
+  });
+
+  it("is absent for an untagged defect and a success", () => {
+    expect(errorTypeOf(Exit.die(new Error("boom")))).toBeUndefined();
+    expect(errorTypeOf(Exit.void)).toBeUndefined();
+  });
+});
+
+describe("sqlStateOf", () => {
+  it("reads the code of a CLI exec error", () => {
+    const error = new DbExecError({ message: failingMigration, code: "23502" });
+
+    expect(sqlStateOf(Exit.fail(error))).toBe("23502");
+  });
+
+  it("reads the driver code through a SqlError reason", () => {
+    const driverError = { severity: "ERROR", code: "23505", message: "duplicate key" };
+    const error = new SqlError({
+      reason: new UniqueViolation({ cause: driverError, constraint: "users_email_key" }),
+    });
+
+    expect(sqlStateOf(Exit.fail(error))).toBe("23505");
+  });
+
+  it("ignores node errno codes and successful exits", () => {
+    const errno = (code: string) => Object.assign(new Error(`failed ${code}`), { code });
+
+    for (const code of ["ECONNREFUSED", "EPERM", "EPIPE", "E2BIG"]) {
+      expect(sqlStateOf(Exit.fail(errno(code)))).toBeUndefined();
+    }
+    expect(sqlStateOf(Exit.void)).toBeUndefined();
+  });
+
+  it("accepts letter-class SQLSTATEs", () => {
+    expect(sqlStateOf(Exit.fail(new DbExecError({ message: "raise", code: "P0001" })))).toBe(
+      "P0001",
+    );
+  });
+});
diff --git a/apps/cli/src/shared/telemetry/tracing.layer.ts b/apps/cli/src/shared/telemetry/tracing.layer.ts
deleted file mode 100644
index 84d7af964c..0000000000
--- a/apps/cli/src/shared/telemetry/tracing.layer.ts
+++ /dev/null
@@ -1,93 +0,0 @@
-import { Cause, Duration, Effect, Fiber, Layer, Queue, Stdio, Stream, Tracer } from "effect";
-import type { Exit } from "effect";
-
-import { makeDebugConsoleExporter } from "./exporters/debug-console.ts";
-import { exportSpanToNdjson, initNdjsonExporter } from "./exporters/ndjson.ts";
-import { telemetryRuntimeLayer } from "./runtime.layer.ts";
-import { TelemetryRuntime } from "./runtime.service.ts";
-import { Tracing } from "./tracing.service.ts";
-
-const EXPORT_DRAIN_TIMEOUT = Duration.millis(2_000);
-
-class ExportableSpan extends Tracer.NativeSpan {
-  constructor(
-    options: ConstructorParameters<typeof Tracer.NativeSpan>[0],
-    private readonly queue: Queue.Queue<Tracer.Span, Cause.Done>,
-  ) {
-    super(options);
-  }
-
-  override attribute(key: string, value: unknown): void {
-    if (key.endsWith(".header.apikey")) return;
-    super.attribute(key, value);
-  }
-
-  override end(endTime: bigint, exit: Exit.Exit<unknown, unknown>): void {
-    super.end(endTime, exit);
-    if (this.sampled) Queue.offerUnsafe(this.queue, this);
-  }
-}
-
-export const tracingLayer = Layer.effect(
-  Tracing,
-  Effect.gen(function* () {
-    const stdio = yield* Stdio.Stdio;
-    const telemetryRuntime = yield* TelemetryRuntime;
-    const exportSpanToDebugConsole = makeDebugConsoleExporter((line) =>
-      Stream.make(line).pipe(Stream.run(stdio.stderr()), Effect.asVoid),
-    );
-
-    if (telemetryRuntime.consent === "granted") {
-      yield* initNdjsonExporter(telemetryRuntime.tracesDir);
-    }
-
-    const queue = yield* Queue.unbounded<Tracer.Span, Cause.Done>();
-    const exportSpan = (span: Tracer.Span) =>
-      Effect.gen(function* () {
-        if (telemetryRuntime.consent === "granted") {
-          yield* Effect.ignore(exportSpanToNdjson(span, telemetryRuntime.tracesDir));
-        }
-        if (telemetryRuntime.showDebug) {
-          yield* Effect.ignore(exportSpanToDebugConsole(span));
-        }
-      });
-
-    const workerEffect = Queue.take(queue).pipe(
-      Effect.flatMap(exportSpan),
-      Effect.forever,
-      Effect.catchTag("Done", () => Effect.void),
-    );
-    const worker = yield* Effect.forkScoped(workerEffect);
-    // Match PostHog's 2-second shutdown cap so a stalled sink cannot hold scope closure forever.
-    yield* Effect.addFinalizer(() =>
-      Queue.end(queue).pipe(
-        Effect.andThen(
-          Effect.interruptible(Fiber.join(worker)).pipe(Effect.timeout(EXPORT_DRAIN_TIMEOUT)),
-        ),
-        Effect.ignore,
-      ),
-    );
-
-    const globalAttrs: Record<string, unknown> = {
-      schema_version: 1,
-      device_id: telemetryRuntime.deviceId,
-      session_id: telemetryRuntime.sessionId,
-      is_first_run: telemetryRuntime.isFirstRun,
-      is_tty: telemetryRuntime.isTty,
-      is_ci: telemetryRuntime.isCi,
-      os: telemetryRuntime.os,
-      arch: telemetryRuntime.arch,
-      cli_version: telemetryRuntime.cliVersion,
-    };
-
-    return Tracer.make({
-      span(options) {
-        const span = new ExportableSpan(options, queue);
-        for (const [key, value] of Object.entries(globalAttrs)) {
-          span.attribute(key, value);
-        }
-        return span;
-      },
-    });
-  }),
-).pipe(Layer.provide(telemetryRuntimeLayer));
diff --git a/apps/cli/src/shared/telemetry/tracing.layer.unit.test.ts b/apps/cli/src/shared/telemetry/tracing.layer.unit.test.ts
deleted file mode 100644
index b6eaa097db..0000000000
--- a/apps/cli/src/shared/telemetry/tracing.layer.unit.test.ts
+++ /dev/null
@@ -1,658 +0,0 @@
-import { describe, expect, it } from "@effect/vitest";
-import { BunServices } from "@effect/platform-bun";
-import {
-  Clock,
-  ConfigProvider,
-  Context,
-  Deferred,
-  Duration,
-  Effect,
-  Exit,
-  FileSystem,
-  Fiber,
-  Layer,
-  Option,
-  Path,
-  PlatformError,
-  Schema,
-  Sink,
-  Stdio,
-  Tracer,
-} from "effect";
-import { TestClock } from "effect/testing";
-import { CliSettings } from "../config/cli-settings.service.ts";
-import { TelemetryConfigSchema, type TelemetryConfig } from "./types.ts";
-import { useTempWorkdir } from "../../../tests/helpers/command-mocks.ts";
-import { mockCliProjectContext, mockRuntimeInfo, mockTty } from "../../../tests/helpers/mocks.ts";
-import { tracingLayer } from "./tracing.layer.ts";
-
-const fsLayer = BunServices.layer;
-
-const tempRoot = useTempWorkdir("supabase-tracing-test-");
-
-const TelemetryConfigJson = Schema.fromJsonString(TelemetryConfigSchema);
-
-const writeConfig = (dir: string, config: TelemetryConfig) =>
-  Effect.gen(function* () {
-    const fs = yield* FileSystem.FileSystem;
-    const path = yield* Path.Path;
-    yield* fs.makeDirectory(dir, { recursive: true });
-    yield* fs.writeFileString(
-      path.join(dir, "telemetry.json"),
-      yield* Schema.encodeEffect(TelemetryConfigJson)(config),
-    );
-  });
-
-const readConfig = (configPath: string) =>
-  Effect.gen(function* () {
-    const fs = yield* FileSystem.FileSystem;
-    return yield* Schema.decodeEffect(TelemetryConfigJson)(yield* fs.readFileString(configPath));
-  });
-
-const hasNdjsonTrace = (tracesDir: string) =>
-  Effect.gen(function* () {
-    const fs = yield* FileSystem.FileSystem;
-    if (!(yield* fs.exists(tracesDir))) return false;
-    return (yield* fs.readDirectory(tracesDir)).some((file) => file.endsWith(".ndjson"));
-  });
-
-const readTraceFile = (tracesDir: string) =>
-  Effect.gen(function* () {
-    const fs = yield* FileSystem.FileSystem;
-    const path = yield* Path.Path;
-    const traceFile = (yield* fs.readDirectory(tracesDir)).find((file) => file.endsWith(".ndjson"));
-    expect(traceFile).toBeDefined();
-    return yield* fs.readFileString(path.join(tracesDir, traceFile!));
-  });
-
-function buildLayer(opts: {
-  home: string;
-  env?: Record<string, string>;
-  stdoutIsTty?: boolean;
-  fileSystem?: Layer.Layer<FileSystem.FileSystem>;
-  stdio?: Layer.Layer<Stdio.Stdio>;
-}) {
-  const env: Record<string, string> = {
-    HOME: opts.home,
-    ...opts.env,
-  };
-  const runtimeInfoLayer = mockRuntimeInfo({
-    homeDir: opts.home,
-    cwd: opts.home,
-    platform: "linux",
-    arch: "x64",
-  });
-  const cliProjectContextLayer = mockCliProjectContext();
-  const setting = (key: string) => {
-    const value = opts.env?.[key];
-    return value === undefined ? Option.none<string>() : Option.some(value);
-  };
-  const settingsLayer = Layer.effect(
-    CliSettings,
-    Effect.gen(function* () {
-      const path = yield* Path.Path;
-      return CliSettings.of({
-        apiUrl: "https://api.supabase.com",
-        dashboardUrl: "https://supabase.com/dashboard",
-        projectHost: "supabase.co",
-        telemetryPosthogHost: "https://eu.i.posthog.com",
-        telemetryPosthogKey: Option.none(),
-        accessToken: Option.none(),
-        noKeyring: Option.none(),
-        supabaseHome: path.join(opts.home, ".supabase"),
-        debug: setting("SUPABASE_DEBUG"),
-        telemetryDebug: setting("SUPABASE_TELEMETRY_DEBUG"),
-        telemetryDisabled: setting("SUPABASE_TELEMETRY_DISABLED"),
-        doNotTrack: Option.none(),
-      });
-    }),
-  ).pipe(Layer.provide(fsLayer));
-  return Layer.mergeAll(
-    fsLayer,
-    opts.fileSystem ?? Layer.empty,
-    runtimeInfoLayer,
-    cliProjectContextLayer,
-    ConfigProvider.layer(ConfigProvider.fromEnvRecord(env, { preserveEmptyStrings: true })),
-    settingsLayer,
-    mockTty({
-      stdoutIsTty: opts.stdoutIsTty ?? false,
-      stdinIsTty: false,
-    }),
-    opts.stdio ?? Layer.empty,
-  );
-}
-
-function buildTracingLayer(opts: {
-  home: string;
-  env?: Record<string, string>;
-  stdoutIsTty?: boolean;
-  fileSystem?: Layer.Layer<FileSystem.FileSystem>;
-  stdio?: Layer.Layer<Stdio.Stdio>;
-}) {
-  return tracingLayer.pipe(Layer.provide(buildLayer(opts)));
-}
-
-function blockingFileSystemLayer(
-  started: Deferred.Deferred<void>,
-  release: Deferred.Deferred<void>,
-  order: Array<string>,
-  finished?: Deferred.Deferred<void>,
-) {
-  return Layer.effect(
-    FileSystem.FileSystem,
-    Effect.gen(function* () {
-      const fs = yield* FileSystem.FileSystem;
-      return {
-        ...fs,
-        writeFileString: (
-          filePath: string,
-          content: string,
-          options?: Parameters<FileSystem.FileSystem["writeFileString"]>[2],
-        ): Effect.Effect<void, PlatformError.PlatformError> =>
-          Effect.gen(function* () {
-            if (!filePath.endsWith(".ndjson")) {
-              yield* fs.writeFileString(filePath, content, options);
-              return;
-            }
-            order.push("started");
-            yield* Deferred.succeed(started, undefined);
-            yield* Deferred.await(release);
-            order.push("finished");
-            if (finished !== undefined) yield* Deferred.succeed(finished, undefined);
-          }),
-      };
-    }),
-  ).pipe(Layer.provide(BunServices.layer));
-}
-
-function capturingStdio(chunks: Array<string>): Layer.Layer<Stdio.Stdio> {
-  return Stdio.layerTest({
-    stderr: () =>
-      Sink.forEach((chunk: string | Uint8Array) =>
-        Effect.sync(() =>
-          chunks.push(typeof chunk === "string" ? chunk : new TextDecoder().decode(chunk)),
-        ),
-      ),
-  });
-}
-
-const makeSpanOptions = (
-  overrides: Partial<{
-    name: string;
-    sampled: boolean;
-    parent: Option.Option<Tracer.AnySpan>;
-  }> = {},
-) =>
-  Effect.map(Clock.currentTimeMillis, (now) => ({
-    name: overrides.name ?? "test-span",
-    parent: overrides.parent ?? Option.none(),
-    annotations: Context.empty(),
-    links: [] as Tracer.SpanLink[],
-    startTime: BigInt(now) * 1_000_000n,
-    kind: "internal" as Tracer.SpanKind,
-    root: false,
-    sampled: overrides.sampled ?? true,
-  }));
-
-describe("tracingLayer – layer construction & first-run", () => {
-  it.live("first-run TTY: creates telemetry.json with consent=granted", () => {
-    const home = tempRoot.current;
-    return Effect.gen(function* () {
-      const fs = yield* FileSystem.FileSystem;
-      const path = yield* Path.Path;
-      const configDir = path.join(home, ".supabase");
-      yield* Effect.void.pipe(Effect.provide(buildTracingLayer({ home, stdoutIsTty: true })));
-
-      const configPath = path.join(configDir, "telemetry.json");
-      expect(yield* fs.exists(configPath)).toBe(true);
-      const config = yield* readConfig(configPath);
-      expect(config.consent).toBe("granted");
-      expect(typeof config.device_id).toBe("string");
-      expect(config.device_id.length).toBeGreaterThan(0);
-      expect(typeof config.session_id).toBe("string");
-      expect(config.session_id.length).toBeGreaterThan(0);
-    }).pipe(Effect.provide(fsLayer));
-  });
-
-  it.live("first-run non-TTY: creates telemetry.json with consent=granted", () => {
-    const home = tempRoot.current;
-    return Effect.gen(function* () {
-      const fs = yield* FileSystem.FileSystem;
-      const path = yield* Path.Path;
-      const configDir = path.join(home, ".supabase");
-      yield* Effect.void.pipe(Effect.provide(buildTracingLayer({ home, stdoutIsTty: false })));
-
-      const configPath = path.join(configDir, "telemetry.json");
-      expect(yield* fs.exists(configPath)).toBe(true);
-      const config = yield* readConfig(configPath);
-      expect(config.consent).toBe("granted");
-    }).pipe(Effect.provide(fsLayer));
-  });
-
-  it.live("existing config with consent=granted: layer builds and tracer is usable", () => {
-    const home = tempRoot.current;
-    return Effect.gen(function* () {
-      const path = yield* Path.Path;
-      const configDir = path.join(home, ".supabase");
-      yield* writeConfig(configDir, {
-        consent: "granted",
-        device_id: "existing-device",
-        session_id: "existing-session",
-        session_last_active: yield* Clock.currentTimeMillis,
-      });
-      yield* Effect.gen(function* () {
-        const tracer = yield* Tracer.Tracer;
-        const span = tracer.span(yield* makeSpanOptions());
-        expect(span).toBeDefined();
-        expect(span.name).toBe("test-span");
-      }).pipe(Effect.provide(buildTracingLayer({ home })));
-    }).pipe(Effect.provide(fsLayer));
-  });
-
-  it.live(
-    "SUPABASE_TELEMETRY_DISABLED=1 overrides consent=granted: no NDJSON export on span end",
-    () => {
-      const home = tempRoot.current;
-      return Effect.gen(function* () {
-        const path = yield* Path.Path;
-        const configDir = path.join(home, ".supabase");
-        const tracesDir = path.join(configDir, "traces");
-        yield* writeConfig(configDir, {
-          consent: "granted",
-          device_id: "existing-device",
-          session_id: "existing-session",
-          session_last_active: yield* Clock.currentTimeMillis,
-        });
-        yield* Effect.gen(function* () {
-          const tracer = yield* Tracer.Tracer;
-          const span = tracer.span(yield* makeSpanOptions());
-          span.end(BigInt((yield* Clock.currentTimeMillis) + 100) * 1_000_000n, Exit.void);
-        }).pipe(
-          Effect.provide(buildTracingLayer({ home, env: { SUPABASE_TELEMETRY_DISABLED: "1" } })),
-        );
-
-        expect(yield* hasNdjsonTrace(tracesDir)).toBe(false);
-      }).pipe(Effect.provide(fsLayer));
-    },
-  );
-});
-
-describe("tracingLayer – span behaviour", () => {
-  it.live("waits for a blocked exporter before closing its scope", () => {
-    const home = tempRoot.current;
-    return Effect.gen(function* () {
-      const started = yield* Deferred.make<void>();
-      const release = yield* Deferred.make<void>();
-      const order: Array<string> = [];
-      const run = Effect.scoped(
-        Effect.gen(function* () {
-          const tracer = yield* Tracer.Tracer;
-          tracer.span(yield* makeSpanOptions()).end(1_000_000_000n, Exit.void);
-        }).pipe(
-          Effect.provide(
-            buildTracingLayer({
-              home,
-              fileSystem: blockingFileSystemLayer(started, release, order),
-            }),
-          ),
-        ),
-      );
-
-      const fiber = yield* Effect.forkChild(run);
-      yield* Deferred.await(started);
-      expect(fiber.pollUnsafe()).toBeUndefined();
-      expect(order).toEqual(["started"]);
-
-      yield* Deferred.succeed(release, undefined);
-      yield* Fiber.join(fiber);
-      expect(order.length).toBeGreaterThan(0);
-      expect(
-        order.every(
-          (entry, index) =>
-            (entry === "started" && order[index + 1] === "finished") ||
-            (entry === "finished" && order[index - 1] === "started"),
-        ),
-      ).toBe(true);
-    });
-  });
-
-  it.live("drains a blocked exporter when the scoped program fails", () => {
-    const home = tempRoot.current;
-    return Effect.gen(function* () {
-      const started = yield* Deferred.make<void>();
-      const release = yield* Deferred.make<void>();
-      const order: Array<string> = [];
-      const run = Effect.gen(function* () {
-        const tracer = yield* Tracer.Tracer;
-        tracer.span(yield* makeSpanOptions()).end(1_000_000_000n, Exit.void);
-        return yield* Effect.fail("injected program failure");
-      }).pipe(
-        Effect.provide(
-          buildTracingLayer({
-            home,
-            fileSystem: blockingFileSystemLayer(started, release, order),
-          }),
-        ),
-      );
-
-      const fiber = yield* Effect.forkChild(run);
-      yield* Deferred.await(started);
-      expect(fiber.pollUnsafe()).toBeUndefined();
-      yield* Deferred.succeed(release, undefined);
-      const exit = yield* Fiber.await(fiber);
-      expect(Exit.isFailure(exit)).toBe(true);
-      expect(order.at(-1)).toBe("finished");
-    });
-  });
-
-  it.live("drains a blocked exporter when the scoped program is interrupted", () => {
-    const home = tempRoot.current;
-    return Effect.gen(function* () {
-      const started = yield* Deferred.make<void>();
-      const release = yield* Deferred.make<void>();
-      const finished = yield* Deferred.make<void>();
-      const interrupted = yield* Deferred.make<void>();
-      const order: Array<string> = [];
-      const run = Effect.scoped(
-        Effect.gen(function* () {
-          const tracer = yield* Tracer.Tracer;
-          tracer.span(yield* makeSpanOptions()).end(1_000_000_000n, Exit.void);
-          return yield* Effect.never.pipe(
-            Effect.onInterrupt(() => Deferred.succeed(interrupted, undefined)),
-          );
-        }).pipe(
-          Effect.provide(
-            buildTracingLayer({
-              home,
-              fileSystem: blockingFileSystemLayer(started, release, order, finished),
-            }),
-          ),
-        ),
-      );
-
-      const fiber = yield* Effect.forkChild(run);
-      yield* Deferred.await(started);
-      expect(fiber.pollUnsafe()).toBeUndefined();
-      const interrupt = yield* Fiber.interrupt(fiber).pipe(Effect.forkChild);
-      yield* Deferred.await(interrupted);
-      expect(order).toEqual(["started"]);
-      yield* Deferred.succeed(release, undefined);
-      yield* Deferred.await(finished);
-      yield* Fiber.join(interrupt);
-      const exit = yield* Fiber.await(fiber);
-      expect(Exit.isFailure(exit)).toBe(true);
-      expect(order.at(-1)).toBe("finished");
-    });
-  });
-
-  it.effect("bounds shutdown when an exporter never completes", () => {
-    const home = tempRoot.current;
-    return Effect.gen(function* () {
-      const started = yield* Deferred.make<void>();
-      const release = yield* Deferred.make<void>();
-      const order: Array<string> = [];
-      const run = Effect.scoped(
-        Effect.gen(function* () {
-          const tracer = yield* Tracer.Tracer;
-          tracer.span(yield* makeSpanOptions()).end(1_000_000_000n, Exit.void);
-        }).pipe(
-          Effect.provide(
-            buildTracingLayer({
-              home,
-              fileSystem: blockingFileSystemLayer(started, release, order),
-            }),
-          ),
-        ),
-      );
-
-      const fiber = yield* Effect.forkChild(run);
-      yield* Deferred.await(started);
-      const result = yield* Fiber.await(fiber).pipe(Effect.forkChild);
-      yield* TestClock.adjust(Duration.seconds(2));
-      const exit = yield* Fiber.join(result);
-
-      expect(Exit.isSuccess(exit)).toBe(true);
-      expect(order).toEqual(["started"]);
-    });
-  });
-
-  it.live("keeps exporting after debug formatting fails", () => {
-    const home = tempRoot.current;
-    const stderrChunks: string[] = [];
-    const cyclic: Record<string, unknown> = {};
-    cyclic.self = cyclic;
-    return Effect.gen(function* () {
-      const path = yield* Path.Path;
-      const tracesDir = path.join(home, ".supabase", "traces");
-      yield* Effect.gen(function* () {
-        const tracer = yield* Tracer.Tracer;
-        const badSpan = tracer.span(yield* makeSpanOptions({ name: "bad-debug-span" }));
-        badSpan.attribute("cyclic", cyclic);
-        badSpan.end(1_000_000_000n, Exit.void);
-        tracer
-          .span(yield* makeSpanOptions({ name: "good-debug-span" }))
-          .end(1_000_000_000n, Exit.void);
-      }).pipe(
-        Effect.provide(
-          buildTracingLayer({
-            home,
-            env: { SUPABASE_DEBUG: "1" },
-            stdio: capturingStdio(stderrChunks),
-          }),
-        ),
-      );
-
-      const traces = yield* readTraceFile(tracesDir);
-      expect(traces).toContain("good-debug-span");
-      expect(stderrChunks.join(" ")).toContain("good-debug-span");
-    }).pipe(Effect.provide(fsLayer));
-  });
-
-  it.live("continues file export when debug output fails", () => {
-    const home = tempRoot.current;
-    const failure = PlatformError.systemError({
-      _tag: "Unknown",
-      module: "stderr",
-      method: "write",
-      description: "injected debug export failure",
-      pathOrDescriptor: "stderr",
-    });
-    return Effect.gen(function* () {
-      const path = yield* Path.Path;
-      const tracesDir = path.join(home, ".supabase", "traces");
-      yield* Effect.gen(function* () {
-        const tracer = yield* Tracer.Tracer;
-        tracer
-          .span(yield* makeSpanOptions())
-          .end(BigInt(yield* Clock.currentTimeMillis) * 1_000_000n, Exit.void);
-      }).pipe(
-        Effect.provide(
-          buildTracingLayer({
-            home,
-            env: { SUPABASE_TELEMETRY_DEBUG: "1" },
-            stdio: Stdio.layerTest({ stderr: () => Sink.fail(failure) }),
-          }),
-        ),
-      );
-
-      expect(yield* hasNdjsonTrace(tracesDir)).toBe(true);
-    }).pipe(Effect.provide(fsLayer));
-  });
-
-  it.live("span creation attaches global attributes", () => {
-    const home = tempRoot.current;
-    return Effect.gen(function* () {
-      const tracer = yield* Tracer.Tracer;
-      const span = tracer.span(yield* makeSpanOptions());
-      expect(span.attributes.get("schema_version")).toBe(1);
-      expect(typeof span.attributes.get("device_id")).toBe("string");
-      expect(typeof span.attributes.get("session_id")).toBe("string");
-      expect(typeof span.attributes.get("is_first_run")).toBe("boolean");
-      expect(span.attributes.get("is_tty")).toBe(false);
-      expect(typeof span.attributes.get("is_ci")).toBe("boolean");
-      expect(span.attributes.get("os")).toBe("linux");
-      expect(span.attributes.get("arch")).toBe("x64");
-      expect(span.attributes.get("cli_version")).toBe("0.0.0-dev");
-    }).pipe(Effect.provide(buildTracingLayer({ home })));
-  });
-
-  it.live("span end exports to debug console when SUPABASE_DEBUG=1", () => {
-    const home = tempRoot.current;
-    const stderrChunks: string[] = [];
-    return Effect.gen(function* () {
-      const tracer = yield* Tracer.Tracer;
-      tracer.span(yield* makeSpanOptions({ name: "debug-span" })).end(1_000_000_000n, Exit.void);
-    }).pipe(
-      Effect.provide(
-        buildTracingLayer({
-          home,
-          env: { SUPABASE_DEBUG: "1" },
-          stdio: capturingStdio(stderrChunks),
-        }),
-      ),
-      Effect.ensuring(
-        Effect.sync(() => {
-          expect(stderrChunks.join(" ")).toContain("debug-span");
-        }),
-      ),
-    );
-  });
-
-  it.live("span end exports to debug console when SUPABASE_TELEMETRY_DEBUG=1", () => {
-    const home = tempRoot.current;
-    const stderrChunks: string[] = [];
-    return Effect.gen(function* () {
-      const tracer = yield* Tracer.Tracer;
-      tracer
-        .span(yield* makeSpanOptions({ name: "telemetry-debug-span" }))
-        .end(1_000_000_000n, Exit.void);
-    }).pipe(
-      Effect.provide(
-        buildTracingLayer({
-          home,
-          env: { SUPABASE_TELEMETRY_DEBUG: "1" },
-          stdio: capturingStdio(stderrChunks),
-        }),
-      ),
-      Effect.ensuring(
-        Effect.sync(() => {
-          expect(stderrChunks.join(" ")).toContain("telemetry-debug-span");
-        }),
-      ),
-    );
-  });
-
-  it.live("span end exports to NDJSON file when consent=granted", () => {
-    const home = tempRoot.current;
-    return Effect.gen(function* () {
-      const path = yield* Path.Path;
-      const configDir = path.join(home, ".supabase");
-      const tracesDir = path.join(configDir, "traces");
-      yield* Effect.gen(function* () {
-        const tracer = yield* Tracer.Tracer;
-        const span = tracer.span(yield* makeSpanOptions());
-        span.end(BigInt((yield* Clock.currentTimeMillis) + 100) * 1_000_000n, Exit.void);
-      }).pipe(Effect.provide(buildTracingLayer({ home })));
-
-      expect(yield* hasNdjsonTrace(tracesDir)).toBe(true);
-    }).pipe(Effect.provide(fsLayer));
-  });
-
-  it.live("does not write API keys to trace files", () => {
-    const home = tempRoot.current;
-    const secretKey = `sb_secret_${"a".repeat(40)}`;
-    return Effect.gen(function* () {
-      const path = yield* Path.Path;
-      const tracesDir = path.join(home, ".supabase", "traces");
-      yield* Effect.gen(function* () {
-        const tracer = yield* Tracer.Tracer;
-        const span = tracer.span(yield* makeSpanOptions());
-        span.attribute("http.request.header.apikey", secretKey);
-        span.end(BigInt((yield* Clock.currentTimeMillis) + 100) * 1_000_000n, Exit.void);
-      }).pipe(Effect.provide(buildTracingLayer({ home })));
-
-      const trace = yield* readTraceFile(tracesDir);
-      expect(trace).not.toContain(secretKey);
-      expect(trace).not.toContain("http.request.header.apikey");
-    }).pipe(Effect.provide(fsLayer));
-  });
-
-  it.live("span end does NOT export to NDJSON when SUPABASE_TELEMETRY_DISABLED=1", () => {
-    const home = tempRoot.current;
-    return Effect.gen(function* () {
-      const path = yield* Path.Path;
-      const configDir = path.join(home, ".supabase");
-      const tracesDir = path.join(configDir, "traces");
-      yield* Effect.gen(function* () {
-        const tracer = yield* Tracer.Tracer;
-        const span = tracer.span(yield* makeSpanOptions());
-        span.end(BigInt((yield* Clock.currentTimeMillis) + 100) * 1_000_000n, Exit.void);
-      }).pipe(
-        Effect.provide(buildTracingLayer({ home, env: { SUPABASE_TELEMETRY_DISABLED: "1" } })),
-      );
-
-      expect(yield* hasNdjsonTrace(tracesDir)).toBe(false);
-    }).pipe(Effect.provide(fsLayer));
-  });
-
-  it.live("span end skips unsampled spans – no NDJSON export", () => {
-    const home = tempRoot.current;
-    return Effect.gen(function* () {
-      const path = yield* Path.Path;
-      const configDir = path.join(home, ".supabase");
-      const tracesDir = path.join(configDir, "traces");
-      yield* Effect.gen(function* () {
-        const tracer = yield* Tracer.Tracer;
-        const span = tracer.span(yield* makeSpanOptions({ sampled: false }));
-        span.end(BigInt((yield* Clock.currentTimeMillis) + 100) * 1_000_000n, Exit.void);
-      }).pipe(Effect.provide(buildTracingLayer({ home })));
-
-      expect(yield* hasNdjsonTrace(tracesDir)).toBe(false);
-    }).pipe(Effect.provide(fsLayer));
-  });
-
-  it.live("CI detection via CI env var sets is_ci=true on span", () => {
-    const home = tempRoot.current;
-    return Effect.gen(function* () {
-      const tracer = yield* Tracer.Tracer;
-      const span = tracer.span(yield* makeSpanOptions());
-      expect(span.attributes.get("is_ci")).toBe(true);
-    }).pipe(Effect.provide(buildTracingLayer({ home, env: { CI: "true" } })));
-  });
-});
-
-describe("ExportableSpan unit tests", () => {
-  it.live("child span inherits traceId from parent span", () => {
-    const home = tempRoot.current;
-    return Effect.gen(function* () {
-      const tracer = yield* Tracer.Tracer;
-      const parent = tracer.span(yield* makeSpanOptions({ name: "parent" }));
-      const child = tracer.span(
-        yield* makeSpanOptions({ name: "child", parent: Option.some(parent) }),
-      );
-      expect(child.traceId).toBe(parent.traceId);
-    }).pipe(Effect.provide(buildTracingLayer({ home })));
-  });
-
-  it.live("event() and addLinks() are no-ops that do not throw", () => {
-    const home = tempRoot.current;
-    return Effect.gen(function* () {
-      const tracer = yield* Tracer.Tracer;
-      const span = tracer.span(yield* makeSpanOptions());
-      span.event("test-event", BigInt(yield* Clock.currentTimeMillis) * 1_000_000n, { key: "val" });
-      span.addLinks([]);
-    }).pipe(Effect.provide(buildTracingLayer({ home })));
-  });
-
-  it.live("span without parent generates 32-char hex traceId and 16-char hex spanId", () => {
-    const home = tempRoot.current;
-    const HEX_32 = /^[0-9a-f]{32}$/;
-    const HEX_16 = /^[0-9a-f]{16}$/;
-    return Effect.gen(function* () {
-      const tracer = yield* Tracer.Tracer;
-      const span = tracer.span(yield* makeSpanOptions());
-      expect(span.traceId).toMatch(HEX_32);
-      expect(span.spanId).toMatch(HEX_16);
-    }).pipe(Effect.provide(buildTracingLayer({ home })));
-  });
-});
diff --git a/apps/cli/src/shared/telemetry/tracing.service.ts b/apps/cli/src/shared/telemetry/tracing.service.ts
deleted file mode 100644
index 3a416566d9..0000000000
--- a/apps/cli/src/shared/telemetry/tracing.service.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-import { Tracer } from "effect";
-
-/**
- * Tracing - Canonical tracing boundary for the CLI.
- *
- * The service reuses Effect's `Tracer` contract; the CLI-specific policy lives
- * in `tracing.layer.ts`, where consent, identity, and export wiring are applied.
- */
-export const Tracing = Tracer.Tracer;
diff --git a/apps/cli/src/telemetry/command-telemetry-attributes.ts b/apps/cli/src/telemetry/command-telemetry-attributes.ts
new file mode 100644
index 0000000000..9b4f2f71ec
--- /dev/null
+++ b/apps/cli/src/telemetry/command-telemetry-attributes.ts
@@ -0,0 +1,25 @@
+import { Context, Effect } from "effect";
+import type { StackRuntime } from "../command-internal/stack-runtime.ts";
+import { PropOrioleDb, PropStackRuntime } from "../shared/telemetry/event-catalog.ts";
+
+/** Properties that code below a command handler adds to its `cli_command_executed` event. */
+export interface CommandTelemetryAttributeValues {
+  readonly [PropOrioleDb]?: boolean;
+  readonly [PropStackRuntime]?: StackRuntime;
+}
+
+/** Command-scoped attribute sink; `withCommandTelemetry` provides one, otherwise records are dropped. */
+export const CommandTelemetryAttributes = Context.Reference<{
+  readonly record: (values: CommandTelemetryAttributeValues) => Effect.Effect<void>;
+}>("supabase/cli/CommandTelemetryAttributes", {
+  defaultValue: () => ({ record: () => Effect.void }),
+});
+
+/** Records attributes on the enclosing command's `cli_command_executed` event. */
+export const recordCommandTelemetry = (
+  values: CommandTelemetryAttributeValues,
+): Effect.Effect<void> =>
+  Effect.gen(function* () {
+    const attributes = yield* CommandTelemetryAttributes;
+    yield* attributes.record(values);
+  });
diff --git a/apps/cli/src/telemetry/command-telemetry.ts b/apps/cli/src/telemetry/command-telemetry.ts
index bab116f64b..58bb5c4230 100644
--- a/apps/cli/src/telemetry/command-telemetry.ts
+++ b/apps/cli/src/telemetry/command-telemetry.ts
@@ -1,4 +1,4 @@
-import { Cause, Clock, Effect, Exit, Option, Stdio } from "effect";
+import { Cause, Clock, Effect, Exit, Option, Ref, Stdio } from "effect";
 import { Param } from "effect/unstable/cli";
 import {
   CommandRuntime,
@@ -10,6 +10,7 @@ import { GLOBAL_FLAGS, OutputFlag, globalFlagValues } from "../command-internal/
 import { ProcessControl } from "../shared/runtime/process-control.service.ts";
 import { withAnalyticsContext } from "../shared/telemetry/analytics-context.ts";
 import { Analytics } from "../shared/telemetry/analytics.service.ts";
+import { TelemetryRuntime } from "../shared/telemetry/runtime.service.ts";
 import {
   type CliErrorActionability,
   classifyCliErrorActionability,
@@ -22,6 +23,7 @@ import {
   PropDurationMs,
   PropExitCode,
   PropOutputFormat,
+  PropStackBackend,
 } from "../shared/telemetry/event-catalog.ts";
 import {
   failureTelemetryPropertiesForCause,
@@ -39,6 +41,11 @@ import {
   VALUE_CONSUMING_SHORT_FLAGS,
 } from "../command-internal/db-target-flags.ts";
 import { unwrapToSingleParam } from "../command-internal/param-introspection.ts";
+import { StackBackendContext } from "../command-internal/stack-backend.ts";
+import {
+  CommandTelemetryAttributes,
+  type CommandTelemetryAttributeValues,
+} from "./command-telemetry-attributes.ts";
 
 /**
  * Classifies a command that succeeded its Effect but recorded a nonzero exit code through
@@ -314,19 +321,31 @@ function buildFlagsMap<Flags extends Record<string, unknown>>(options: {
   return result;
 }
 
+const annotateCommandSpan = Effect.fnUntraced(function* (commandRunId: string, command: string) {
+  const telemetryRuntime = yield* Effect.serviceOption(TelemetryRuntime);
+  // Trace export needs no consent, so persistent identifiers are recorded only when it is granted.
+  yield* Effect.annotateCurrentSpan({
+    command_run_id: commandRunId,
+    command,
+    ...(Option.isSome(telemetryRuntime) &&
+      telemetryRuntime.value.consent === "granted" && {
+        device_id: telemetryRuntime.value.deviceId,
+        session_id: telemetryRuntime.value.sessionId,
+        is_first_run: telemetryRuntime.value.isFirstRun,
+      }),
+  });
+});
+
 function withCommandTracingImplementation() {
   return <A, E, R>(self: Effect.Effect<A, E, R>) =>
     Effect.gen(function* () {
       const commandRuntime = yield* CommandRuntime;
       const command = getCommandRuntimeCommand(commandRuntime);
 
-      return yield* Effect.gen(function* () {
-        yield* Effect.annotateCurrentSpan({
-          command_run_id: commandRuntime.commandRunId,
-          command,
-        });
-        return yield* self;
-      }).pipe(Effect.withSpan(getCommandRuntimeSpanName(commandRuntime)));
+      return yield* annotateCommandSpan(commandRuntime.commandRunId, command).pipe(
+        Effect.andThen(self),
+        Effect.withSpan(getCommandRuntimeSpanName(commandRuntime)),
+      );
     });
 }
 
@@ -341,10 +360,7 @@ function withCommandAnalyticsImplementation<Flags extends Record<string, unknown
       const command = getCommandRuntimeCommand(commandRuntime);
 
       return yield* Effect.gen(function* () {
-        yield* Effect.annotateCurrentSpan({
-          command_run_id: commandRuntime.commandRunId,
-          command,
-        });
+        yield* annotateCommandSpan(commandRuntime.commandRunId, command);
 
         const analytics = yield* Analytics;
         const output = yield* Output;
@@ -370,8 +386,18 @@ function withCommandAnalyticsImplementation<Flags extends Record<string, unknown
           flags,
         } as const;
 
-        const exit = yield* self.pipe(withAnalyticsContext(analyticsContext), Effect.exit);
+        const stackBackend = yield* Effect.serviceOption(StackBackendContext);
+        const attributes = yield* Ref.make<CommandTelemetryAttributeValues>({});
+
+        const exit = yield* self.pipe(
+          Effect.provideService(CommandTelemetryAttributes, {
+            record: (values) => Ref.update(attributes, (current) => ({ ...current, ...values })),
+          }),
+          withAnalyticsContext(analyticsContext),
+          Effect.exit,
+        );
         const finishedAt = yield* Clock.currentTimeMillis;
+        const recordedAttributes = yield* Ref.get(attributes);
 
         // A command that resolves its own `--output` (e.g. `db query`, defaulting `table`/`json`
         // by agent mode) records it here; read optionally so commands that don't provide the
@@ -424,6 +450,8 @@ function withCommandAnalyticsImplementation<Flags extends Record<string, unknown
             [PropOutputFormat]: Option.isSome(resolvedOutputFormat)
               ? resolvedOutputFormat.value
               : resolveOutputFormatForTelemetry(args, output.format),
+            ...(Option.isSome(stackBackend) ? { [PropStackBackend]: stackBackend.value.kind } : {}),
+            ...recordedAttributes,
             ...failureMetadata,
           })
           .pipe(
diff --git a/apps/cli/src/telemetry/command-telemetry.unit.test.ts b/apps/cli/src/telemetry/command-telemetry.unit.test.ts
index 6e8b8598a2..1686ed56a7 100644
--- a/apps/cli/src/telemetry/command-telemetry.unit.test.ts
+++ b/apps/cli/src/telemetry/command-telemetry.unit.test.ts
@@ -16,6 +16,8 @@ import {
   PropErrorFingerprint,
   PropErrorKind,
   PropHasSuggestion,
+  PropOrioleDb,
+  PropStackBackend,
   PropSuggestedCommand,
   PropSuggestionType,
   PropWorkflow,
@@ -25,6 +27,8 @@ import { ConfigDiffLoadConfigError } from "../commands/config/diff/diff.errors.t
 import { DbDumpRunError } from "../commands/db/dump/dump.errors.ts";
 import { IdentityStitch } from "../command-internal/identity-stitch.ts";
 import { withCommandTelemetry } from "./command-telemetry.ts";
+import { recordCommandTelemetry } from "./command-telemetry-attributes.ts";
+import { stackBackendLayer } from "../command-internal/stack-backend.ts";
 import {
   QUERY_OUTPUT_FORMATS,
   InvalidOutputFormatError,
@@ -33,6 +37,7 @@ import {
   mockContextualAnalytics,
   mockOutput,
   mockProcessControl,
+  mockTelemetryRuntime,
 } from "../../tests/helpers/mocks.ts";
 
 const FAILURE_PROPERTY_NAMES = [
@@ -82,6 +87,44 @@ function interruptingAnalytics() {
 }
 
 describe("withCommandTelemetry", () => {
+  const commandSpanAttributes = (consent: "granted" | "denied") =>
+    Effect.currentSpan.pipe(
+      Effect.map((span) => Object.fromEntries(span.attributes)),
+      withCommandTelemetry(),
+      Effect.provide(mockContextualAnalytics().layer),
+      Effect.provide(mockProcessControl().layer),
+      Effect.provide(mockOutput({ format: "text" }).layer),
+      Effect.provide(Stdio.layerTest({ args: Effect.succeed(["backups", "list"]) })),
+      Effect.provide(commandRuntimeLayer(["backups", "list"]).pipe(Layer.provide(BunCrypto.layer))),
+      Effect.provide(
+        mockTelemetryRuntime({ consent, deviceId: "device-1", sessionId: "session-1" }),
+      ),
+    );
+
+  it.live("records persistent identifiers on the command span when consent is granted", () =>
+    Effect.gen(function* () {
+      const attributes = yield* commandSpanAttributes("granted");
+
+      expect(attributes).toMatchObject({
+        device_id: "device-1",
+        session_id: "session-1",
+        is_first_run: false,
+      });
+      expect(typeof attributes["command_run_id"]).toBe("string");
+    }),
+  );
+
+  it.live("keeps persistent identifiers off the command span without consent", () =>
+    Effect.gen(function* () {
+      const attributes = yield* commandSpanAttributes("denied");
+
+      expect(attributes).not.toHaveProperty("device_id");
+      expect(attributes).not.toHaveProperty("session_id");
+      expect(attributes).not.toHaveProperty("is_first_run");
+      expect(typeof attributes["command_run_id"]).toBe("string");
+    }),
+  );
+
   it.live("annotates the command span and emits cli_command_executed", () => {
     const analytics = mockContextualAnalytics();
 
@@ -113,6 +156,33 @@ describe("withCommandTelemetry", () => {
           for (const property of FAILURE_PROPERTY_NAMES) {
             expect(event?.properties).not.toHaveProperty(property);
           }
+          expect(event?.properties).not.toHaveProperty(PropStackBackend);
+          expect(event?.properties).not.toHaveProperty(PropOrioleDb);
+        }),
+      ),
+    );
+  });
+
+  it.live("keeps attributes recorded by a failing command on its event", () => {
+    const analytics = mockContextualAnalytics();
+
+    return recordCommandTelemetry({ [PropOrioleDb]: true }).pipe(
+      Effect.andThen(Effect.fail(new DbDumpRunError({ message: "dump failed" }))),
+      withCommandTelemetry(),
+      Effect.provide(stackBackendLayer("legacy")),
+      Effect.provide(analytics.layer),
+      Effect.provide(mockProcessControl().layer),
+      Effect.provide(mockOutput({ format: "text" }).layer),
+      Effect.provide(Stdio.layerTest({ args: Effect.succeed(["db", "dump", "--local"]) })),
+      Effect.provide(commandRuntimeLayer(["db", "dump"]).pipe(Layer.provide(BunCrypto.layer))),
+      Effect.exit,
+      Effect.tap((exit) =>
+        Effect.sync(() => {
+          expect(Exit.isFailure(exit)).toBe(true);
+          const properties = analytics.captured[0]?.properties;
+          expect(properties?.exit_code).toBe(1);
+          expect(properties?.[PropStackBackend]).toBe("legacy");
+          expect(properties?.[PropOrioleDb]).toBe(true);
         }),
       ),
     );
diff --git a/apps/cli/src/telemetry/linked-project-cache.layer.ts b/apps/cli/src/telemetry/linked-project-cache.layer.ts
index 3e3cb86e87..ff6a028c5f 100644
--- a/apps/cli/src/telemetry/linked-project-cache.layer.ts
+++ b/apps/cli/src/telemetry/linked-project-cache.layer.ts
@@ -58,6 +58,7 @@ export const linkedProjectCacheLayer = Layer.effect(
           const resolvedWorkdir = workdir ?? cliSettings.workdir;
           const cachePath = tempPaths(path, resolvedWorkdir).linkedProjectCache;
           const exists = yield* fs.exists(cachePath).pipe(Effect.orElseSucceed(() => false));
+          yield* Effect.annotateCurrentSpan({ "cache.hit": exists });
           if (exists) return;
 
           // The cache must describe the linked workdir's own state, not whatever ref the calling
@@ -96,7 +97,9 @@ export const linkedProjectCacheLayer = Layer.effect(
           const response = yield* httpClient.execute(request);
           // Stitch identity from the response before the status gate, regardless of status.
           yield* stitch(response);
+          yield* Effect.annotateCurrentSpan({ "http.response.status_code": response.status });
           if (response.status !== 200) return;
+
           const body = yield* response.json;
 
           const linked = {
@@ -123,7 +126,7 @@ export const linkedProjectCacheLayer = Layer.effect(
               organization_slug: linked.organization_slug,
             });
           }
-        }).pipe(Effect.ignore),
+        }).pipe(Effect.withSpan("LinkedProjectCache.cache"), Effect.ignore),
     });
   }),
 );
diff --git a/apps/cli/src/telemetry/telemetry-state.layer.ts b/apps/cli/src/telemetry/telemetry-state.layer.ts
index 48b603e828..3ba8f232d3 100644
--- a/apps/cli/src/telemetry/telemetry-state.layer.ts
+++ b/apps/cli/src/telemetry/telemetry-state.layer.ts
@@ -4,7 +4,7 @@ import { homedir } from "node:os";
 import { Analytics } from "../shared/telemetry/analytics.service.ts";
 import { TelemetryRuntime } from "../shared/telemetry/runtime.service.ts";
 import { isEphemeralIdentityRuntime } from "../shared/telemetry/identity.ts";
-import { supabaseHome } from "../config/profile-file.ts";
+import { resolveSupabaseHome } from "../shared/config/supabase-home.ts";
 import { TelemetryState } from "./telemetry-state.service.ts";
 
 interface State {
@@ -26,7 +26,7 @@ const SCHEMA_VERSION = 1;
 const SESSION_ROTATION_MS = 30 * 60 * 1000;
 
 function telemetryPath(env: Record<string, string | undefined>, pathSvc: Path.Path): string {
-  return pathSvc.join(supabaseHome(pathSvc, homedir(), env), "telemetry.json");
+  return pathSvc.join(resolveSupabaseHome(pathSvc, env, homedir()), "telemetry.json");
 }
 
 /**
diff --git a/apps/cli/src/telemetry/telemetry-state.layer.unit.test.ts b/apps/cli/src/telemetry/telemetry-state.layer.unit.test.ts
index b8241a7714..1a73b920f6 100644
--- a/apps/cli/src/telemetry/telemetry-state.layer.unit.test.ts
+++ b/apps/cli/src/telemetry/telemetry-state.layer.unit.test.ts
@@ -36,9 +36,7 @@ function makeRuntime(opts: { isCi?: boolean; isFirstRun?: boolean; isTty?: boole
   const identity = makeTelemetryIdentity(undefined);
   const layer = Layer.succeed(TelemetryRuntime, {
     configDir: "/tmp",
-    tracesDir: "/tmp",
     consent: "granted",
-    showDebug: false,
     deviceId: "device-xyz",
     sessionId: "session-1",
     identity,
diff --git a/apps/cli/tests/helpers/mocks.ts b/apps/cli/tests/helpers/mocks.ts
index bbd0af32c5..e67e985305 100644
--- a/apps/cli/tests/helpers/mocks.ts
+++ b/apps/cli/tests/helpers/mocks.ts
@@ -4,12 +4,9 @@ import process from "node:process";
 import { BunServices } from "@effect/platform-bun";
 import { Console, ConfigProvider, Deferred, Effect, Layer, Option, Stream } from "effect";
 import type { CliProjectEnvironment, CliProjectPaths } from "@supabase/config";
+import { testRunEnvVar as stackTestRunEnvVar } from "@supabase/stack/internal/test-run-label";
 import { cliSettingsLayer } from "../../src/shared/config/cli-settings.layer.ts";
 import { CliProjectHome } from "../../src/shared/config/cli-project-home.service.ts";
-import {
-  CliProjectLocalServiceVersions,
-  type LocalServiceVersionsState,
-} from "../../src/shared/config/cli-project-local-service-versions.service.ts";
 import {
   ProjectLinkState,
   type ProjectLinkStateValue,
@@ -521,9 +518,7 @@ export function mockAnalytics() {
 export function mockTelemetryRuntime(
   opts: Partial<{
     configDir: string;
-    tracesDir: string;
     consent: "granted" | "denied";
-    showDebug: boolean;
     deviceId: string;
     sessionId: string;
     distinctId: string | undefined;
@@ -539,9 +534,7 @@ export function mockTelemetryRuntime(
     TelemetryRuntime,
     TelemetryRuntime.of({
       configDir: opts.configDir ?? join(defaultTestHomeDir, ".supabase"),
-      tracesDir: opts.tracesDir ?? join(defaultTestHomeDir, ".supabase", "traces"),
       consent: opts.consent ?? "granted",
-      showDebug: opts.showDebug ?? false,
       deviceId: opts.deviceId ?? "test-device-id",
       sessionId: opts.sessionId ?? "test-session-id",
       identity: makeTelemetryIdentity(opts.distinctId),
@@ -577,7 +570,12 @@ export function processEnvLayer(
   return ConfigProvider.layer(
     Effect.acquireRelease(
       Effect.sync(() => {
-        const snapshot = applyProcessEnv(values);
+        const ambientTestRun = process.env[stackTestRunEnvVar];
+        const snapshot = applyProcessEnv(
+          stackTestRunEnvVar in values || ambientTestRun === undefined
+            ? values
+            : { [stackTestRunEnvVar]: ambientTestRun, ...values },
+        );
         return {
           provider: ConfigProvider.fromEnvRecord(process.env, { preserveEmptyStrings: true }),
           snapshot,
@@ -661,27 +659,12 @@ function mockProjectLinkState(
   );
 }
 
-function mockCliProjectLocalServiceVersions(
-  initialState?: LocalServiceVersionsState,
-): Layer.Layer<CliProjectLocalServiceVersions, never, never> {
-  let state = initialState;
-  return Layer.succeed(
-    CliProjectLocalServiceVersions,
-    CliProjectLocalServiceVersions.of({
-      load: Effect.sync(() =>
-        state === undefined ? Option.none<LocalServiceVersionsState>() : Option.some(state),
-      ),
-    }),
-  );
-}
-
 export function emptyEnv() {
   const runtimeInfoLayer = mockRuntimeInfo();
   const cliProjectContextLayer = mockCliProjectContext();
   const envLayer = processEnvLayer();
   const cliProjectHomeLayer = mockCliProjectHome();
   const projectLinkStateLayer = mockProjectLinkState();
-  const cliProjectLocalServiceVersionsLayer = mockCliProjectLocalServiceVersions();
   const analytics = mockAnalytics();
   return Layer.mergeAll(
     BunServices.layer,
@@ -689,7 +672,6 @@ export function emptyEnv() {
     cliProjectContextLayer,
     cliProjectHomeLayer,
     projectLinkStateLayer,
-    cliProjectLocalServiceVersionsLayer,
     analytics.layer,
     mockTelemetryRuntime(),
     mockTty(),
diff --git a/apps/cli/tests/helpers/slim-images.ts b/apps/cli/tests/helpers/slim-images.ts
index 0bab6745fc..eb04f57183 100644
--- a/apps/cli/tests/helpers/slim-images.ts
+++ b/apps/cli/tests/helpers/slim-images.ts
@@ -5,14 +5,7 @@ import { slimCatalogPin } from "../../src/shared/services/slim-images.ts";
 /** A regression to the docker.io fallback must fail an assertion built from this. */
 export const GHCR_SLIM_IMAGE_PATTERN = /^ghcr\.io\/supabase\/cli\/.+@sha256:[0-9a-f]{64}$/;
 
-/**
- * The catalog's own pinned image for `alias`'s (docker.io) `image` — read straight from
- * `catalogPins()`, independent of `toSlimImage`, so a test asserting against this actually
- * exercises the catalog lookup instead of passing whether or not it resolves (a default
- * Dockerfile tag is generated from the catalog, so it always matches a catalog pin). Only reuses `slimCatalogPin` for alias
- * and tag normalization (`v`-prefixing), not the catalog image lookup itself. Throws when
- * nothing is pinned, so a caller never silently falls back to a weaker assertion.
- */
+/** The catalog's pinned image for `alias`'s `image`, read independently of `toSlimImage`. */
 export function expectedPinnedImage(alias: string, image: string): string {
   const pin = slimCatalogPin(alias, image);
   if (pin === undefined) {
diff --git a/apps/cli/tests/helpers/storage.ts b/apps/cli/tests/helpers/storage.ts
index 5a5a1f2479..95cb7d9854 100644
--- a/apps/cli/tests/helpers/storage.ts
+++ b/apps/cli/tests/helpers/storage.ts
@@ -180,7 +180,7 @@ const instance = <K extends ServiceCreation["service"]>(
   prepare: Effect.void,
   status,
   followStatus: Stream.empty,
-  logs: Stream.empty,
+  readLogs: () => Stream.empty,
   credentials: () => Effect.succeed({}),
 });
 
diff --git a/apps/cli/vitest.config.ts b/apps/cli/vitest.config.ts
index 8c65253e02..1c20786369 100644
--- a/apps/cli/vitest.config.ts
+++ b/apps/cli/vitest.config.ts
@@ -68,6 +68,7 @@ export default defineConfig({
           // Integration workers start real service processes and containers.
           maxWorkers: 4,
           sequence: { groupOrder: 1 },
+          globalSetup: ["../../packages/stack/tests/docker-volume-run.ts"],
         },
       },
       {
@@ -77,6 +78,7 @@ export default defineConfig({
           fileParallelism: false,
           maxWorkers: 1,
           setupFiles: ["tests/e2e-setup.ts"],
+          globalSetup: ["../../packages/stack/tests/docker-volume-run.ts"],
           testTimeout: 120_000,
           hookTimeout: 120_000,
         },
diff --git a/docs/adr/0001-cli-dx-architecture-pillars.md b/docs/adr/0001-cli-dx-architecture-pillars.md
index baea0fbc61..b15505ab35 100644
--- a/docs/adr/0001-cli-dx-architecture-pillars.md
+++ b/docs/adr/0001-cli-dx-architecture-pillars.md
@@ -331,7 +331,7 @@ span.end(); // records duration
 
 **Telemetry consent**:
 
-Local diagnostics (traces written to `~/.supabase/traces/`, `--debug` output) are always available — they stay on the user's machine and require no consent.
+Local diagnostics (a trace file via `SUPABASE_TRACE_FILE`, a user-run OTLP collector via `SUPABASE_OTLP_ENDPOINT`, and `--debug` output) are opt-in per run and require no consent; [ADR 0027](0027-cli-tracing-conventions.md) defines the export and instrumentation conventions.
 
 Remote telemetry is **opt-in by default** — it is never sent unless the user explicitly consents. See [ADR 0002](0002-cli-product-metrics.md) for consent implementation details.
 
diff --git a/docs/adr/0021-projectconfig-convergence-semantics.md b/docs/adr/0021-projectconfig-convergence-semantics.md
index 3b052badfb..a835dbf4ca 100644
--- a/docs/adr/0021-projectconfig-convergence-semantics.md
+++ b/docs/adr/0021-projectconfig-convergence-semantics.md
@@ -245,9 +245,9 @@ inert/unrepresentable server-side when the container's own toggle is off, indepe
 actor's write path — rather than "what legacy push happened to send"**:
 
 - `api.{schemas,extra_search_path,max_rows}`: `api.enabled` isn't an independent wire field at all —
-  the registry derives it from `db_schema.length > 0`, the same fact `schemas` itself carries, and
-  the API arm already row-gates all three siblings on that same check independently. Symmetry with
-  something the API arm enforces on its own, not push imitation.
+  the registry derives it from `db_schema` via `remoteDataApiDisabled`, the same fact `schemas`
+  itself carries, and the API arm already row-gates all three siblings on that same check
+  independently. Symmetry with something the API arm enforces on its own, not push imitation.
 - `db.network_restrictions.{allowed_cidrs,allowed_cidrs_v6}`: the flag's own schema description is
   "Enable **management** of network restrictions," not "enable network restrictions" — a
   deliberate, actor-independent opt-out with no v2 API field at all (the one entry with no API-arm
diff --git a/docs/adr/0022-config-diff-classification-and-managed-surface.md b/docs/adr/0022-config-diff-classification-and-managed-surface.md
index 46ca73e61e..25fc6a6937 100644
--- a/docs/adr/0022-config-diff-classification-and-managed-surface.md
+++ b/docs/adr/0022-config-diff-classification-and-managed-surface.md
@@ -22,7 +22,7 @@ This ADR was first accepted with a self-contained translation table inside `conf
 - **Three-way classification per comparable path**, driven by _declared_ presence (the raw pre-decode document), which a decoded config cannot recover: `update` (declared + reported, values differ), `remote_only` (reported while undeclared — or while the feature it belongs to is switched off and no actor's write path can express the declared state — and differing from the suppression baseline), `local_only` (a declared local projection value the response did not account for: parsed-but-never-pushed attributes and permission-truncated responses). The local operand follows ADR 0018: the branch's merged effective config when the target ref matches a `[remotes.*]` block's `project_id`, the base config otherwise.
 - **`remote_only` suppression baseline**: the default config's own convergence projection, falling back — for push-gated containers the projection is silent on — to the raw default config's value (`db.network_restrictions`' allow-all default IS the platform's unconfigured state), then to the registry row's declared `unconfiguredValue` (the platform's own report of an unconfigured feature — GoTrue's `sessions_timebox: 0` canonicalizes to the STRING `"0s"`, pinned by the recorded `config_auth` fixtures). Platform-RENDERED strings (mailer template/notification subjects) get no pinned baseline at all: the platform authors those values and rewords them across environments, so a pinned copy cannot be simultaneously correct for prod and staging — their rows declare `platformRendered` instead, and any remote value is suppressed while the local projection is silent (a locally declared subject still classifies normally). "Unconfigured" is never inferred from type-level zero values — canonicalization can turn a platform zero into a non-zero shape, and PR #6295's review reproduced 15 noise lines on an untouched staging project from exactly that inference. A path with no baseline at any tier reports rather than guesses (over-report over under-report). An unconfigured project therefore diffs clean instead of flooding with platform-default noise.
 - **Equality is meaning-based**: the normalizers canonicalize representations (durations, byte sizes, comma-joins) per ADR 0021, and the classifier's residual equality tolerates string/number and string/boolean scalar skew. Whether an array is a SET or a SEQUENCE is per-field wire knowledge and lives on the registry row (`arrayEquality`), defaulting to sequence — `api.schemas`' first entry is PostgREST's default schema and `api.extra_search_path` is a literal `search_path`, so reordering is drift; `auth.additional_redirect_urls` opts into set semantics.
-- **Secrets are "present, unknown".** Both normalizers omit secret leaves (the platform only reports HMAC digests), so secrets can never classify; the registry's `isSecret` rows define the masked surface, and locally-declared ones are surfaced in `ConfigChangeSet.masked` so a clean change list is visibly a partial claim. The same visibility rule covers `ConfigChangeSet.unmanaged`: a declared comparable path the local projection drops can never classify either, and silently vanishing would print a false "no differences" over a real disagreement. This family is no longer whole-container omissions predicting what a push mapper happened to send (that mechanism, `applyPushUnmanagedOmissions`, was retired on CLI-2314 — see ADR 0021's 2026-09-04 addendum for the full re-derivation); it is now `DISABLED_SENTINEL_PRUNES`'s surviving sibling-only rules, each re-derived from a platform data-model fact independent of any actor's write path — e.g. the Data-API-off `api.{schemas,extra_search_path,max_rows}` siblings (`api.enabled` is itself derived from `db_schema.length > 0`, the same fact `schemas` carries), `auth.email.smtp`'s non-host fields (`smtp.enabled` is likewise derived from `smtp_host.length > 0`, not an independent field), `auth.captcha.provider`/`secret` (a disabled captcha's provider choice is genuinely retained-but-inert on the platform), `auth.oauth_server`'s two non-`enabled` siblings, `storage.analytics`/`storage.vector`'s quota fields, and `db.network_restrictions`'s CIDR fields (a document-only management opt-out with no v2 API counterpart at all). The command layer separately echoes which response blocks were carried — a block absent from the response, or present but EMPTY (the plausible permission-truncated shape), reports as not-returned — so partially-populated responses degrade to `local_only` + an explicit scope note instead of an error or silent omission. This resource is read via `api.executeRaw` rather than the generated client's `execute`, per ADR 0019 rule 2: a strict `Schema.Struct` decode would drop excess properties and reject unknown enum members (a new `pooler.pool_mode` value, say) before the lenient config mirror ever ran on the body, leaving nothing left for it to be lenient about — `diff.integration.test.ts`'s "an unknown enum value in the response degrades instead of failing" case pins the resulting degrade-not-fail behavior. Any future typed consumer of this resource, `config pull` included, must read it the same way, or deliberately reintroduce contract overrides for it.
+- **Secrets are "present, unknown".** Both normalizers omit secret leaves (the platform only reports HMAC digests), so secrets can never classify; the registry's `isSecret` rows define the masked surface, and locally-declared ones are surfaced in `ConfigChangeSet.masked` so a clean change list is visibly a partial claim. The same visibility rule covers `ConfigChangeSet.unmanaged`: a declared comparable path the local projection drops can never classify either, and silently vanishing would print a false "no differences" over a real disagreement. This family is no longer whole-container omissions predicting what a push mapper happened to send (that mechanism, `applyPushUnmanagedOmissions`, was retired on CLI-2314 — see ADR 0021's 2026-09-04 addendum for the full re-derivation); it is now `DISABLED_SENTINEL_PRUNES`'s surviving sibling-only rules, each re-derived from a platform data-model fact independent of any actor's write path — e.g. the Data-API-off `api.{schemas,extra_search_path,max_rows}` siblings (`api.enabled` is itself derived from `db_schema` via `remoteDataApiDisabled`, the same fact `schemas` carries), `auth.email.smtp`'s non-host fields (`smtp.enabled` is likewise derived from `smtp_host.length > 0`, not an independent field), `auth.captcha.provider`/`secret` (a disabled captcha's provider choice is genuinely retained-but-inert on the platform), `auth.oauth_server`'s two non-`enabled` siblings, `storage.analytics`/`storage.vector`'s quota fields, and `db.network_restrictions`'s CIDR fields (a document-only management opt-out with no v2 API counterpart at all). The command layer separately echoes which response blocks were carried — a block absent from the response, or present but EMPTY (the plausible permission-truncated shape), reports as not-returned — so partially-populated responses degrade to `local_only` + an explicit scope note instead of an error or silent omission. This resource is read via `api.executeRaw` rather than the generated client's `execute`, per ADR 0019 rule 2: a strict `Schema.Struct` decode would drop excess properties and reject unknown enum members (a new `pooler.pool_mode` value, say) before the lenient config mirror ever ran on the body, leaving nothing left for it to be lenient about — `diff.integration.test.ts`'s "an unknown enum value in the response degrades instead of failing" case pins the resulting degrade-not-fail behavior. Any future typed consumer of this resource, `config pull` included, must read it the same way, or deliberately reintroduce contract overrides for it.
 - **Change entries carry what a consumer needs verbatim**: `path` is a SEGMENT ARRAY end to end (an `sms.test_otp` phone-number key may itself contain a `.`; joining is display-only), `declared` distinguishes file-written values from schema-materialized defaults, and a `remote_only` entry keeps the materialized local default so "what would `config push` change?" is answerable from the change alone — the primary dashboard-drift use case, and what `config pull` will need to write back.
 - **Command surface (review revision, PR #6295)**: the target flag is `link`'s settled vocabulary — a single `--project-ref` accepting a project ref or a branch name/UUID (ref-shaped values always read as refs; a UUID resolves without a linked parent) — not a bespoke `--target`. The global `-o/--output` flag is rejected outright — every value, `pretty` included — with a message pointing at `--output-format` (the CLI-2156 ruling: no Go-compat contract for net-new commands, recorded as the scoped exception to Legacy Shell Invariant #6). `--exit-code` gives drift its own exit code `2`, keeping `1` for failures, so scripts can tell "drifted" from "token expired". The machine payload versions its own contract (`schema_version: 1`, an integer) separately from the user-controlled `$schema` document reference (`config_schema`).
 - The interpolation pipeline records the resolving env var name on `"environment"` value origins, so a change on an `env()`-fed property can name the variable involved.
diff --git a/docs/adr/0026-slim-artifact-mirrors.md b/docs/adr/0026-slim-artifact-mirrors.md
index cba056ffe3..cd0b9551ac 100644
--- a/docs/adr/0026-slim-artifact-mirrors.md
+++ b/docs/adr/0026-slim-artifact-mirrors.md
@@ -70,6 +70,25 @@ runtime checksum authority: **GitHub Releases, the S3 mirror, GHCR, and ECR Publ
 mirrors only** for both images and native archives. None of them is consulted for the expected
 hash — that comes only from the pin already committed to the catalog.
 
+### Invocations
+
+`.github/scripts/sync-artifacts-catalog.ts` has three modes:
+
+- **Manual** — `--service <svc> [--upstream <U> | --release <U>-r<N>]`. Refreshes one catalog
+  entry; see "Sync and the S3-staleness check" below.
+- **`plan-updates --service <svc> --output <path> [--format lines] [--expect-release <U>-r<N>]`**
+  — used by `slim-release-published.yml`. Runs `planSlimUpdates` (see "Hotfix and upgrade pickup"
+  below) against the service's committed releases and writes the resulting records only to
+  `--output`, never to stdout; any `::warning ::…` the planner emits goes to stdout instead, so
+  the workflow can read warnings there without risking mistaking one for a malformed record.
+  `--expect-release` guards against the releases API lagging behind the dispatch that triggered
+  this run (`waitForExpectedRelease`): before planning, `<service>-<release>` must already be a
+  listed tag, or this mode re-lists a bounded number of times before giving up.
+- **`validate-payload --service <svc> --upstream <U> --revision <N> --release <R>`** — used by the
+  same workflow, before anything else. Checks an untrusted dispatch payload against anchored
+  charsets and prints it back as `key=value` lines, so a value that fails validation never reaches
+  `$GITHUB_OUTPUT`.
+
 ### Sync and the S3-staleness check
 
 `.github/scripts/sync-artifacts-catalog.ts` writes those pins, in manual mode: given a service
@@ -79,35 +98,82 @@ release's `SHA256SUMS` for the archive and manifest sha256 per target, and resol
 digest with `regctl manifest head`. Before writing the pin, it downloads each target's S3 archive
 and manifest and hashes them against those same release sums. This exists because
 `publish-release` does not wait for the ECR/S3 mirror to finish, so a freshly committed
-revision's S3 copy can briefly lag. A missing object waits, bounded (`waitForExpectedRelease`'s
-retry helper, generalized); an object that exists with the wrong bytes fails the sync
-immediately — that's corruption, not lag, and means "run the mirror backfill", not "the CLI is
-broken". Hosts that reach GitHub are unaffected — GitHub is the primary mirror — but a host that
-can only reach S3 would otherwise fail verification with no fallback.
+revision's S3 copy can briefly lag. A missing object is waited for, bounded; an object that
+exists with the wrong bytes fails the sync immediately — that's corruption, not lag, and means
+"run the mirror backfill", not "the CLI is broken". Hosts that reach GitHub are unaffected —
+GitHub is the primary mirror — but a host that can only reach S3 would otherwise fail
+verification with no fallback.
 
 ### Hotfix and upgrade pickup
 
 The last step of slim-services' `publish-release` sends a `repository_dispatch`
 (`slim-release-published`) to the CLI repo with `{service, upstream_version, revision,
-release_version}`. `slim-release-published.yml` treats the dispatch as a trigger, not as the
-payload to apply: it reconciles the named service against every committed (published, non-draft)
-`<service>-...-r<N>` release it can currently see (`planSlimUpdates`), and opens or updates, per
-release line the service carries:
+release_version}`. The payload arrives with whatever authority holds the dispatch token, so
+`slim-release-published.yml` treats it as untrusted: `validate-payload` mode checks every field
+against an anchored charset before it is written to `$GITHUB_OUTPUT`, a branch name, or a PR
+title, and the workflow only ever passes those fields through `env:`, never interpolating them
+into a `run:` script. Release tag names come from the releases API too, so `planSlimUpdates`
+re-validates every value it emits against the same patterns before it can reach a branch name or
+PR title.
+
+The workflow treats the dispatch as a trigger, not as the payload to apply: it reconciles the
+named service against every committed (published, non-draft) `<service>-...-r<N>` release it can
+currently see (`planSlimUpdates`), and opens or updates, per release line the service carries, at
+most one of:
 
 - a **hotfix**, when the pinned upstream version has a higher committed revision — branch
   `slim-hotfix/<svc>[-<line>]`, title `chore(stack): pin <svc> <release_version>`;
 - an **upgrade**, when the newest committed upstream on that line is newer than the pinned one —
   branch `slim-bump/<svc>[-<line>]`, title `chore(stack): bump <svc> to <release_version>`.
 
-Both can be planned in the same run. Plan and apply run from the same checkout of the default
-branch in one job, so a re-run always recomputes from the latest develop: a stale plan can never
-be applied, and a superseded PR's branch is rewritten (force-pushed) in place rather than raced
-by a new one — the workflow deliberately never auto-closes a superseded PR. A backlog republish
-of an older upstream version naturally plans nothing. The fallback, if the push or PR step fails,
-is a documented manual `bun .github/scripts/sync-artifacts-catalog.ts --service <svc> --release
-<U>-r<N>` invocation, followed by `apps/cli/scripts/render-service-dockerfile.ts` — the release
-itself is already committed by then, so a failure here means "open the pull request by hand", not
-"republish".
+A line that upgrades skips its hotfix. Both PRs would edit the same catalog span, so once the
+upgrade merged, the `slim-hotfix/<svc>[-<line>]` PR would be left conflicting, and no later run
+revisits it because the pin has moved past that upstream. The planner instead emits a
+`::warning ::…` naming the skipped release and the manual `--release` invocation that pins it
+alone. Different lines stay independent, so one run can still plan both kinds: postgres can
+upgrade its 17 line while hotfixing its 15 line.
+
+The skip lasts as long as the upgrade is available: while its PR stays open, or if it is
+declined, every run skips the line's hotfix again, and only the manual `--release` invocation
+pins it. A hotfix PR opened before the upgrade appeared is left as is. Merge it before the
+upgrade and the upgrade PR conflicts until the next run for that service rewrites it; merge the
+upgrade first and the hotfix PR is superseded and must be closed by hand.
+
+A service with a single pin has a single line, which accepts any comparable newer upstream: a
+Studio year rollover or a postgrest major bump moves that line forward. Only a service with
+additional pins (postgres) assigns each release tag to a line by its leading version component. A
+tag on no carried line, or with a version that isn't comparable, is warned about and ignored
+rather than failing the run. Comparison strips a trailing `-sha-<hex>`, so two Studio builds dated
+the same day compare equal and never produce an upgrade; the manual `--release` path pins such a
+build.
+
+Plan and apply run from the same checkout of the default branch in one job, so a re-run always
+recomputes from the latest develop: a stale plan can never be applied, and a superseded PR's branch
+is rewritten (force-pushed) in place rather than raced by a new one — a superseded PR is never
+auto-closed. A backlog republish of an older upstream version naturally plans nothing. A branch
+whose PR is in the merge queue rejects the force-push; the run waits up to 30 minutes (less when
+earlier work leaves the app token too little lifetime) for the queue to merge or drop that PR, then
+re-sends the same dispatch and stops, so a fresh run re-plans every remaining update from the
+updated default branch. At most three re-sends run in a row. The concurrency group keeps every
+pending run (`queue: max`), so a replay never cancels a newer dispatch and its release-visibility
+wait. A queue that holds the branch longer, or a failed queue lookup or dispatch, fails the run with
+the manual invocation below. The fallback, if the push or PR step fails, is a documented manual `bun
+.github/scripts/sync-artifacts-catalog.ts --service <svc> --release <U>-r<N>` invocation, followed
+by `apps/cli/scripts/render-service-dockerfile.ts` — the release itself is already committed by
+then, so a failure here means "open the pull request by hand", not "republish".
+
+Each opened or rewritten PR is approved by `supabase-oss` and set to auto-merge by
+`bot-pr-auto-merge.yml`, which handles every Dependabot and release-app PR against `develop`, so a green PR enters
+the merge queue without a human review. `supabase-oss` co-owns the bot-updated files in
+`.github/CODEOWNERS` because the app cannot approve its own PR. The approval token lives in the
+`auto-approve` environment, which only deploys from the default branch, so a workflow on any other
+branch cannot approve with it.
+
+The app token (contents and pull-requests write) never reaches third-party code or disk: `git push`
+takes it only inside an explicit URL (`PUSH_REMOTE_URL` overrides it, so a dry run can target a
+local bare repository), and each `gh` call gets it inline. The sync script, the Dockerfile
+generator and the formatter all run with it unset, so a compromised transitive dependency of any
+of them cannot read it.
 
 ### Registry and bucket mirrors
 
diff --git a/docs/adr/0027-cli-tracing-conventions.md b/docs/adr/0027-cli-tracing-conventions.md
new file mode 100644
index 0000000000..93367fe87c
--- /dev/null
+++ b/docs/adr/0027-cli-tracing-conventions.md
@@ -0,0 +1,112 @@
+# 0027. CLI tracing conventions
+
+**Status**: proposed
+**Date**: 2026-09-29
+
+## Problem Statement
+
+Finding where a CLI run spends time used to need ad-hoc instrumentation per investigation. The old
+tracer wrote consent-gated NDJSON without parent links, so nothing could rebuild a span tree from
+it. The CLI needs one span tree per run that people and agents can read locally or in an
+OpenTelemetry backend, costs nothing when unused, and never exports secrets.
+
+## Decision
+
+Each run produces one trace rooted at `cli.run`, exported to at most one sink:
+
+- `SUPABASE_TRACE_FILE=<path>` appends one OTLP/JSON batch per line to a regular file. A relative
+  path resolves once against the startup directory, so a command that changes directory keeps one
+  file. A new file is created with mode `0600`; an existing one is restricted to `0600` when the
+  CLI may change its mode.
+- `SUPABASE_OTLP_ENDPOINT=<base URL>` posts OTLP/HTTP JSON to `<base>/v1/traces`, with optional
+  `SUPABASE_OTLP_HEADERS=k=v,k2=v2`.
+- Tracing never stops a command. Setting both variables, a malformed endpoint or headers, or a
+  sink that cannot start prints one `Warning: tracing disabled: <reason>` line on stderr and runs
+  the command untraced, with the same exit code and stdout. Generic `OTEL_EXPORTER_OTLP_*`,
+  `OTEL_SERVICE_NAME`, and `OTEL_RESOURCE_ATTRIBUTES` are ignored, so a global collector setting
+  never receives CLI internals.
+- `cli.run` records `process.exit_code` and ends with error status, as a `CliNonZeroExit`
+  failure, when that code is non-zero.
+- `TRACEPARENT` becomes the parent of `cli.run` when a sink is active, even when its sampled flag
+  is off, and spawned processes receive a `TRACEPARENT` for their process span.
+- `SUPABASE_DEBUG=1` or `SUPABASE_TELEMETRY_DEBUG=1`, read from the project `.env` or the
+  environment, prints finished command spans up to depth 2 plus every failed span to stderr.
+  `--debug` does not print spans. The console starts once CLI settings load, so spans that end
+  earlier, including `cli.run`, reach only the sink.
+
+With no sink, the root runs with `References.TracerEnabled = false`. Spans are Effect's no-op
+spans, no exporter module is loaded, and no trace file or network I/O happens; the debug console
+enables tracing only for the command it wraps.
+
+Exported traces carry no free-form text, because pattern scrubbing cannot reliably find values
+inside Postgres details, dollar-quoted bodies, or Storage paths in error messages. Every exported
+batch and console line goes through `shared/telemetry/trace-sanitize.ts`:
+
+- Exception events keep only `exception.type`, the error class or tag name, and only when it reads
+  as an identifier; any other name becomes `Error`. Failed spans record a tagged error's tag as
+  `error.type` and a Postgres SQLSTATE carried by the error as `db.response.status_code`.
+- Status messages are dropped; the status code remains.
+- Log events are renamed `log` and keep only `effect.logLevel`.
+- `db.query.text` becomes `db.operation.name`, `db.query.hash`, and `db.query.length`. The hash is
+  keyed by a random salt drawn once per sink or console, so repeated statements match within one
+  run but hashes cannot be compared across runs.
+- `url.full` loses its query; `url.full` and `url.path` hide Storage bucket and object names in
+  `object`, `bucket`, and `iceberg/bucket` routes; `url.query` and non-allowlisted headers are
+  dropped; string values under credential-named keys are dropped; remaining strings are scrubbed
+  of URL userinfo up to its last `@`, other credentials, SQL literals, and constraint key values,
+  and capped at 2 KB.
+
+HTTP trace-header propagation is disabled for all CLI requests.
+
+### Instrumentation rules
+
+- Name spans `Area.operation` with low cardinality. Put ids, refs, and counts in attributes.
+- Use `Effect.fn("Area.op")` only for functions that do I/O or millisecond-scale work. Use
+  `Effect.withSpan` for phases inside a `gen` body and `Effect.annotateCurrentSpan` for counts,
+  sizes, cache hit or miss, strategy, retry attempts, service or image names, project refs, and
+  status or exit codes.
+- Keep `Effect.fnUntraced` for pure helpers and anything called per item in a loop; `Effect.fn`
+  captures a stack on every call even when tracing is off.
+- Never annotate secrets, connection strings, environment values, file contents, argv, or query
+  results. The sanitizer is a safety net, not a license.
+- Do not create spans per row, byte, stream element, or poll iteration. Run each poll attempt with
+  the tracer disabled and record the attempt count on the enclosing wait span. Per-item spans are
+  fine for bounded, heavy fan-outs such as migrations, services, functions, and images.
+- Wrap child processes with `withProcessSpan` or `withProcessSpanScoped` from
+  `shared/telemetry/spans.ts`, which record the executable basename, argument count, and exit code
+  and pass `TRACEPARENT` to the child.
+- Build layer spans with `Effect.withSpan` inside the `Layer.effect` constructor. `Layer.withSpan`
+  keeps the span open until the scope closes.
+- The `packages/api` client names each request span after its generated operation id and annotates
+  `api.operation`, because the HTTP span name generator only sees interpolated paths. Do not wrap a
+  single API call in another span at the call site.
+
+An integration test caps one representative command, `projects list`, at 2,000 spans and 200
+spans per name. It catches hot-loop spans only on that command's path; other paths rely on these
+rules and review.
+
+## Consequences
+
+- Tracing is opt-in per run and needs no telemetry consent: the user chooses the destination.
+- Old `~/.supabase/traces/*.ndjson` files are no longer written or cleaned up; they are safe to
+  delete.
+- A traced point costs about 1 µs when tracing is off, so overhead grows with span count; the span
+  budget test guards the representative command only.
+- `runCli` closes the trace scope with a bounded, uninterruptible 2-second flush before
+  `processControl.exit`, which skips finalizers.
+- Error text is visible in the terminal but not in traces; a trace identifies a failure by span,
+  error type, and SQLSTATE.
+
+## Alternatives Considered
+
+- **Standard `OTEL_*` variables**: rejected because a developer's global collector configuration
+  would silently export CLI internals.
+- **Keeping the NDJSON exporter**: rejected because it lacked parent links and required a custom
+  format; OTLP/JSON lines work with standard tools and the report script.
+- **Sanitizing in span attribute setters**: rejected because exception events and status
+  messages bypass attribute writes; sanitizing the serialized batch covers every field.
+
+## References
+
+- [Tracing and monitoring how-to](../../apps/cli/docs/tracing-monitoring.md)
+- [ADR 0001, Pillar 5](0001-cli-dx-architecture-pillars.md)
diff --git a/docs/adr/README.md b/docs/adr/README.md
index 27eb9beae9..efbb6f77f1 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -68,6 +68,7 @@ When an ADR becomes outdated, mark it as `deprecated` or reference the supersedi
 | 0024 | [Top-Level `pull` Orchestration](0024-top-level-pull-orchestration.md)                                         | accepted   |
 | 0025 | [Ephemeral Postgres for Schema Tooling](0025-ephemeral-postgres-for-schema-tooling.md)                         | superseded |
 | 0026 | [Slim Image and Native Artifact Mirrors](0026-slim-artifact-mirrors.md)                                        | proposed   |
+| 0027 | [CLI Tracing Conventions](0027-cli-tracing-conventions.md)                                                     | proposed   |
 
 ## Template
 
diff --git a/docs/output.md b/docs/output.md
index a38ea854ff..5441b0b0da 100644
--- a/docs/output.md
+++ b/docs/output.md
@@ -45,10 +45,14 @@ yield* output.fail({ code: "InvalidTokenError", message: "Bad token format" })
 ## How It Works
 
 `stream-json` commands emit newline-delimited JSON events. Bounded compute log
-reads emit one `result` event. Stack logs stream live `log-entry` events with
-`timestamp`, `service`, `instance_id`, `stream`, `line`, and `source: "live"`.
-Stack log streams are `stdout` or `stderr`; other emitters may include history
-or internal messages and may omit `instance_id`.
+reads emit one `result` event. Stack logs emit a `log-entry` event per line with
+`timestamp`, `service`, `instance_id`, `stream`, `line`, and `source`: `history`
+for retained lines, `live` for lines streamed by `--follow`. `timestamp` is when
+the stack owner received the line. Stack launches and lost output are
+`log-marker` events with `timestamp`, `service`, `instance_id`, `kind` (`launch`
+or `lost`), `source`, and, for lost output, `count` and, when known, `stream`. Stack log
+streams are `stdout` or `stderr`; other emitters may include internal messages
+and may omit `instance_id`.
 
 Each format has its own layer implementation. The root command provides the appropriate layer based on the `--output-format` flag:
 
diff --git a/docs/self-documenting-cli.md b/docs/self-documenting-cli.md
index 8cd3c292a0..3f7988c392 100644
--- a/docs/self-documenting-cli.md
+++ b/docs/self-documenting-cli.md
@@ -1,136 +1,40 @@
 # Self-Documenting CLI
 
-The CLI extracts structured metadata from its command definitions at runtime and serves it in multiple formats. No separate documentation maintenance is needed — the code is the single source of truth.
+The CLI's command definitions are the single source of truth for its reference documentation.
+The command tree is introspected at build time to produce the command reference pages served by
+the in-repo docs site, so flags, arguments, and examples never drift from the code.
 
 See [ADR 0003](adr/0003-self-documenting-cli.md) for the original design rationale.
 
-## Global flags
+This page covers the in-repo [Fumadocs](https://fumadocs.dev) site under `apps/docs`. The
+separate pipeline that publishes the command spec to supabase.com is described in
+[`apps/cli/docs/README.md`](../apps/cli/docs/README.md).
 
-Three global flags power the documentation pipeline:
+## How generation works
 
-| Flag                 | Purpose                                                                                      |
-| -------------------- | -------------------------------------------------------------------------------------------- |
-| `--usage`            | Output the full CLI spec in [usage](https://usage.jdx.dev) format (KDL) and exit             |
-| `--skill`            | Auto-detect installed AI agents and write SKILL.md files to each agent's skills directory    |
-| `--skill-dir <path>` | Write SKILL.md files to a custom directory (useful when no agent is detected or for testing) |
+`apps/cli/scripts/generate-docs.ts` runs as the docs `generate` task before the docs `build` task
+when invoked through Turbo (for example, `pnpm run build` from the repository root). The package's
+`build` script is a leaf `next build`; `pnpm run generate` remains available for local docs
+development. The generator:
 
-These flags are defined in `apps/cli/src/lib/global-flags.ts` and work from any subcommand position. For example, both `supabase --usage` and `supabase login --usage` emit the same full CLI spec.
+1. Walks the command tree from `rootCommand` with `collectCommands()` and keeps the leaf commands.
+2. Extracts a `HelpDoc` (description, flags, arguments, examples) for each leaf with `getHelpDoc()`
+   and renders it with `formatHelpDocAsMarkdown()`.
+3. Writes each command as `content/docs/commands/<path>.mdx` with title and description
+   frontmatter.
+4. Writes `content/docs/commands/index.mdx`, a table linking to every command page, and
+   `content/docs/commands/meta.json`, which controls sidebar order.
+5. Copies the built `@supabase/config` JSON schemas into `public/cli/` so the configuration
+   reference links resolve. This requires `@supabase/config#build` to have run first, which
+   `turbo.json` wires up.
 
-### `--usage`
+The generated `content/docs/commands/` directory is git-ignored; only the hand-authored pages are
+committed.
 
-Outputs the entire command tree as a [usage spec](https://usage.jdx.dev/spec/) in KDL format. This is consumed by shell completion engines and documentation generators.
+The extraction helpers live in `apps/cli/src/shared/cli/command-docs.ts` and
+`apps/cli/src/shared/cli/markdown-formatter.ts`.
 
-Implementation: `apps/cli/src/lib/usage-formatter.ts`
-
-### `--skill` and `--skill-dir`
-
-Both flags generate [Agent Skills](https://github.com/anthropics/skills) — markdown files that teach AI coding agents how to use the CLI.
-
-`--skill` auto-detects which agents are installed on the machine by checking for their config directories (e.g. `~/.claude`, `~/.cursor`). It writes skill files to each detected agent's conventional skills directory. The agent registry is ported from [Vercel's skills library](https://github.com/vercel-labs/skills/blob/b248cdf08f647faf8b7a00e4d89344d9b83ab0e1/src/agents.ts) and supports 40+ agents.
-
-`--skill-dir <path>` writes to a specific directory instead. Useful for testing or when the target agent isn't auto-detected.
-
-When invoked from a subcommand (e.g. `supabase login --skill`), only that subtree's leaf commands are emitted.
-
-Key files:
-
-| File                                 | Role                                                 |
-| ------------------------------------ | ---------------------------------------------------- |
-| `apps/cli/src/lib/agent-detect.ts`   | Filesystem-based agent detection (40+ agents)        |
-| `apps/cli/src/lib/skill-writer.ts`   | Writes `SKILL.md` files with YAML frontmatter        |
-| `apps/cli/src/lib/guide-injector.ts` | Injects auto-generated sections into guide templates |
-| `apps/cli/src/lib/guide-registry.ts` | Maps command paths to guide entries                  |
-
-## Guide files
-
-Each command can have an optional `.guide.md` file colocated with its source:
-
-```
-apps/cli/src/commands/login/
-├── login.command.ts
-├── login.handler.ts
-├── login.guide.md      ← hand-authored skill template
-├── login.integration.test.ts
-├── login.unit.test.ts
-└── login.e2e.test.ts
-```
-
-A guide file is a hand-authored markdown template with HTML comment markers where auto-generated sections get injected:
-
-```md
-# Login
-
-Log in to Supabase by providing an access token or using browser-based OAuth.
-
-## When to use
-
-Run once to authenticate before using commands that require auth.
-
-<!-- USAGE:START -->
-<!-- USAGE:END -->
-
-<!-- FLAGS:START -->
-<!-- FLAGS:END -->
-
-<!-- EXAMPLES:START -->
-<!-- EXAMPLES:END -->
-
-## Tips
-
-- Token resolution priority: `--token` flag > `SUPABASE_ACCESS_TOKEN` env > ...
-```
-
-Available marker sections: `USAGE`, `FLAGS`, `ARGS`, `EXAMPLES`, `SUBCOMMANDS`. At skill generation time, the injector replaces the content between each marker pair with the auto-generated reference from the command definition.
-
-This lets authors control the narrative structure (intro, "When to use", "Tips") while keeping the reference sections (usage, flags, examples) always in sync with the code.
-
-### Registering a guide
-
-Guides are registered in `apps/cli/src/lib/guide-registry.ts`:
-
-```ts
-const guides = new Map<string, GuideEntry>([
-  [
-    "login",
-    {
-      template: loginGuide,
-      skillName: "supabase-login",
-      skillDescription: "Use when you need to authenticate, log in, or ...",
-    },
-  ],
-]);
-```
-
-- **Key**: the command path segments joined by space (e.g. `"login"`, `"db push"`)
-- **template**: the raw `.guide.md` content, imported with `{ type: "text" }`
-- **skillName**: the directory name for the generated SKILL.md
-- **skillDescription**: appears in the YAML frontmatter — should include trigger words so agents know when to activate the skill
-
-### Commands without a guide
-
-Commands that don't have a registered guide still get skill files. The fallback uses `formatHelpDocAsMarkdown()` to generate a plain reference page from the command definition, with the skill name derived from the command path (e.g. `supabase-db-push`).
-
-## Docs website
-
-A [Fumadocs](https://fumadocs.dev) site at `apps/docs` serves the command reference as a browsable website. It reuses the same extraction pipeline as the skill generator — command definitions are the single source of truth for both AI skills and human-readable docs.
-
-### How generation works
-
-The script `apps/cli/scripts/generate-docs.ts` runs as the docs `generate`
-task before the docs `build` task when invoked through Turbo (for example,
-`pnpm run build` from the repository root). The package's `build` script is a
-leaf `next build`; running `pnpm run generate` directly remains available for
-local docs development. The generator:
-
-1. Walks the command tree via `collectCommands()` to find all leaf commands
-2. For each command, extracts a `HelpDoc` (description, flags, args, examples)
-3. If a `.guide.md` exists for the command, injects the auto-generated sections into the guide template (stripping HTML comment markers for clean MDX output). Otherwise, falls back to `formatHelpDocAsMarkdown()` for a plain reference page
-4. Writes each command as `content/docs/commands/<slug>.mdx` with frontmatter
-5. Generates `content/docs/commands/index.mdx` — a command reference index with a table linking to every command page
-6. Generates `content/docs/commands/meta.json` to control page ordering in the sidebar
-7. Generates `public/cli/config.schema.json` for the CLI configuration reference
-
-### Site structure
+## Site structure
 
 ```
 apps/docs/
@@ -144,19 +48,13 @@ apps/docs/
 │   ├── index.mdx               ← Landing page (hand-authored)
 │   ├── getting-started.mdx     ← Quickstart guide (hand-authored)
 │   ├── meta.json               ← Top-level page order
-│   └── commands/               ← Auto-generated command reference
-│       ├── index.mdx           ← Command table (generated)
-│       ├── meta.json           ← Command page order (generated)
-│       └── login.mdx           ← Individual command page (generated)
+│   └── commands/               ← Auto-generated command reference (git-ignored)
+├── public/cli/                 ← Generated config schema assets
 └── lib/
     └── source.ts               ← Fumadocs content source loader
 ```
 
-The generator is maintained alongside the CLI at
-`apps/cli/scripts/generate-docs.ts` and writes the generated command content
-and schema asset into `apps/docs`.
-
-### Running the docs site
+## Running the docs site
 
 ```sh
 # From the repository root:
@@ -168,8 +66,7 @@ pnpm --filter @supabase/docs run generate
 
 ## Adding a new command's documentation
 
-1. Write the command definition with descriptions, flags, and examples in the `.command.ts` file — this is the source of truth
-2. Optionally create a `<command>.guide.md` with narrative content and injection markers
-3. If a guide exists, register it in `guide-registry.ts` with a skill name and description
-4. Run `supabase <command> --skill-dir /tmp/test` to verify the generated skill output
-5. Run `cd apps/docs && pnpm run generate` to regenerate the docs website — the new command appears automatically in the command index and sidebar
+1. Write the command definition with descriptions, flags, and examples in the `.command.ts` file.
+   That file is the source of truth; there is no separate page to author.
+2. Run `pnpm --filter @supabase/docs run generate` to regenerate the site. The new command appears
+   in the command index and sidebar automatically.
diff --git a/docs/telemetry.md b/docs/telemetry.md
index 1d77d2441b..164e6f11b5 100644
--- a/docs/telemetry.md
+++ b/docs/telemetry.md
@@ -26,20 +26,22 @@ ADR 0001 Pillar 5 and ADR 0002 share infrastructure. No separate metrics SDK and
                    │
      ┌─────────────┼─────────────┐
      ▼             ▼             ▼
-Local file      --debug       Remote
-state root/     output        export
-traces/         (always)      (opt-in)
-(always)           │               │
+Trace file or   Span console  Remote
+own OTLP        on stderr     export
+collector       (opt-in)      (opt-in)
+(opt-in)           │               │
      │             │         ┌─────┴─────┐
      ▼             ▼         ▼           ▼
 Observability  Observability Sentry    Grafana
-(ADR 0001      (ADR 0001    (Phase 1) (Phase 2,
- Pillar 5)      Pillar 5)             future)
+(ADR 0027)     (ADR 0027)   (Phase 1) (Phase 2,
+                                       future)
 ```
 
 Sentry receives every command span via its native OpenTelemetry integration and powers error diagnostics, performance monitoring, and product analytics dashboards for all 5 metric categories from ADR 0002. In Phase 2, spans will also be exported to a company-owned Grafana instance via OTLP for long-term retention and custom analytics. The CLI code does not change between phases — only the exporter configuration.
 
-In the diagram, "state root" means `<SUPABASE_HOME or ~/.supabase>`.
+The trace file and user-owned OTLP collector are chosen per run with `SUPABASE_TRACE_FILE` or
+`SUPABASE_OTLP_ENDPOINT`, and the span console with `SUPABASE_DEBUG=1` or
+`SUPABASE_TELEMETRY_DEBUG=1`; see [ADR 0027](adr/0027-cli-tracing-conventions.md).
 
 ## Collection Architecture
 
@@ -156,15 +158,14 @@ Privacy guarantees:
 | OS and architecture                       | Environment variables                  |
 | Stack traces (via span.recordException()) | Email, name, or other profile data     |
 
-## Local Storage
+## Local Traces
 
-NDJSON files in `<SUPABASE_HOME or ~/.supabase>/traces/`:
-
-- One file per day: `2025-01-15.ndjson`
-- 7-day automatic retention (older files deleted on CLI startup)
-- Always written regardless of consent — this is the user's own machine
-- Powers `--debug` output and local diagnostics (ADR 0001 Pillar 5)
-- Same span attribute format as remote export
+Local traces are opt-in per run: `SUPABASE_TRACE_FILE` appends sanitized OTLP/JSON batches to a
+file, `SUPABASE_OTLP_ENDPOINT` sends them to a collector the user runs, and `SUPABASE_DEBUG=1` or
+`SUPABASE_TELEMETRY_DEBUG=1` prints the top of the span tree and every failed span to stderr.
+`--debug` does not print spans. The CLI no longer writes `<SUPABASE_HOME or ~/.supabase>/traces/`. See
+the [tracing how-to](../apps/cli/docs/tracing-monitoring.md) and
+[ADR 0027](adr/0027-cli-tracing-conventions.md).
 
 ## Remote Export
 
@@ -247,8 +248,7 @@ span.setAttributes({
 span.setStatus({ code: SpanStatusCode.OK });
 span.end();
 
-// 5. Always: append to local trace file
-// <SUPABASE_HOME or ~/.supabase>/traces/2025-01-15.ndjson += JSON.stringify(spanData) + "\n"
+// 5. Only when SUPABASE_TRACE_FILE is set: append the sanitized OTLP batch to that file
 
 // 6. If consent === "granted": Sentry SDK exports the span
 // Non-blocking — SDK batches internally
@@ -287,7 +287,7 @@ span.setStatus({
 });
 span.end();
 
-// 5. Always: append to local trace file (same as success)
+// 5. Only when SUPABASE_TRACE_FILE is set: append the sanitized OTLP batch (same as success)
 
 // 6. If consent === "granted": Sentry SDK exports the error span
 // Sentry alerts if AUTH_TOKEN_EXPIRED spikes across devices
@@ -327,7 +327,7 @@ rootSpan.end();
 // Sentry receives a full trace with parent + child spans:
 // enables per-phase latency dashboards (e.g. "p95 cli.phase.docker.start duration")
 
-// Local trace file shows the same data via `supabase dev --debug`:
+// SUPABASE_TRACE_FILE or SUPABASE_OTLP_ENDPOINT captures the same tree locally:
 //   supabase dev (total: 1.2s)
 //   ├── config.load: 12ms
 //   ├── docker.start: 890ms
@@ -424,7 +424,6 @@ Performance impact:
 | Operation                 | Cost      |
 | ------------------------- | --------- |
 | Span construction         | < 0.1ms   |
-| Local NDJSON write        | < 0.5ms   |
 | Sentry SDK export (async) | < 0.1ms   |
 | **Total per command**     | **< 1ms** |
 
@@ -436,7 +435,7 @@ Performance impact:
 | ConsentState      | 2-state (`"granted" \| "denied"`)        | 3-state (`"pending" \| "granted" \| "denied"`) |
 | Default consent   | `"granted"` when no config exists        | `"denied"` for non-TTY; prompt for TTY         |
 | API metrics       | Fields in type but not collected         | Collect from injected API client               |
-| Remote export     | None (local NDJSON + debug only)         | Sentry SDK (Phase 1)                           |
+| Remote export     | None (opt-in trace file or collector)    | Sentry SDK (Phase 1)                           |
 | PII filtering     | None                                     | `beforeSend` hooks in Sentry config            |
 | `cli_version`     | Hardcoded `"0.1.0"`                      | Read from package.json or build constant       |
 | Child spans       | Not implemented                          | Per-phase spans for workflow commands          |
diff --git a/packages/api/src/generated/contracts.ts b/packages/api/src/generated/contracts.ts
index b1b7bd52ac..69421858bf 100644
--- a/packages/api/src/generated/contracts.ts
+++ b/packages/api/src/generated/contracts.ts
@@ -10757,7 +10757,48 @@ export const V2CreateOrganizationInvitationsOutput = Schema.Struct({
   error: Schema.optionalKey(
     Schema.Struct({
       id: Schema.optionalKey(Schema.String),
-      code: Schema.String,
+      code: Schema.Literals([
+        "bad_request",
+        "forbidden",
+        "internal_server_error",
+        "not_found",
+        "payment_required",
+        "rate_limit_exceeded",
+        "request_timeout",
+        "request_too_large",
+        "unauthorized",
+        "validation_failed",
+        "agentic_credential_not_found",
+        "branch_admin_required",
+        "compute_build_context_too_large",
+        "compute_build_in_progress",
+        "compute_deploy_rate_limit_exceeded",
+        "compute_instance_limit_exceeded",
+        "compute_instance_not_found",
+        "compute_not_enabled",
+        "compute_request_rejected",
+        "compute_unavailable",
+        "notebook_cell_duplicate",
+        "notebook_cell_unknown",
+        "notebook_disabled",
+        "notebook_not_found",
+        "notebook_sort_invalid",
+        "organization_invitation_email_delivery_failed",
+        "organization_invitations_partially_failed",
+        "organization_role_name_invalid",
+        "organization_role_not_entitled",
+        "pagination_cursor_invalid",
+        "project_branch_resync_unsupported",
+        "project_not_found",
+        "project_privatelink_disabled",
+        "project_transfer_disabled",
+        "delivery_not_found",
+        "endpoint_disabled",
+        "endpoint_event_type_not_subscribed",
+        "endpoint_not_found",
+        "endpoint_url_unresolvable",
+        "webhooks_access_disabled",
+      ]),
       message: Schema.String,
       description: Schema.optionalKey(Schema.String),
       links: Schema.optionalKey(
diff --git a/packages/api/src/generated/openapi.json b/packages/api/src/generated/openapi.json
index 60c3ec30c1..c6e3698817 100644
--- a/packages/api/src/generated/openapi.json
+++ b/packages/api/src/generated/openapi.json
@@ -24476,7 +24476,49 @@
             "type": "string"
           },
           "code": {
-            "type": "string"
+            "type": "string",
+            "enum": [
+              "bad_request",
+              "forbidden",
+              "internal_server_error",
+              "not_found",
+              "payment_required",
+              "rate_limit_exceeded",
+              "request_timeout",
+              "request_too_large",
+              "unauthorized",
+              "validation_failed",
+              "agentic_credential_not_found",
+              "branch_admin_required",
+              "compute_build_context_too_large",
+              "compute_build_in_progress",
+              "compute_deploy_rate_limit_exceeded",
+              "compute_instance_limit_exceeded",
+              "compute_instance_not_found",
+              "compute_not_enabled",
+              "compute_request_rejected",
+              "compute_unavailable",
+              "notebook_cell_duplicate",
+              "notebook_cell_unknown",
+              "notebook_disabled",
+              "notebook_not_found",
+              "notebook_sort_invalid",
+              "organization_invitation_email_delivery_failed",
+              "organization_invitations_partially_failed",
+              "organization_role_name_invalid",
+              "organization_role_not_entitled",
+              "pagination_cursor_invalid",
+              "project_branch_resync_unsupported",
+              "project_not_found",
+              "project_privatelink_disabled",
+              "project_transfer_disabled",
+              "delivery_not_found",
+              "endpoint_disabled",
+              "endpoint_event_type_not_subscribed",
+              "endpoint_not_found",
+              "endpoint_url_unresolvable",
+              "webhooks_access_disabled"
+            ]
           },
           "message": {
             "type": "string"
@@ -24519,7 +24561,54 @@
           "issues": {
             "type": "array",
             "items": {
-              "$ref": "#/components/schemas/ErrorResponseBodyAPIErrorObject"
+              "type": "object",
+              "properties": {
+                "id": {
+                  "type": "string"
+                },
+                "code": {
+                  "type": "string"
+                },
+                "message": {
+                  "type": "string"
+                },
+                "description": {
+                  "type": "string"
+                },
+                "links": {
+                  "type": "object",
+                  "additionalProperties": {
+                    "type": "object",
+                    "properties": {
+                      "href": {
+                        "type": "string"
+                      },
+                      "rel": {
+                        "type": "string"
+                      },
+                      "title": {
+                        "type": "string"
+                      },
+                      "type": {
+                        "type": "string"
+                      },
+                      "describedby": {
+                        "type": "string"
+                      },
+                      "meta": {
+                        "type": "object",
+                        "additionalProperties": {}
+                      }
+                    },
+                    "required": ["href"]
+                  }
+                },
+                "meta": {
+                  "type": "object",
+                  "additionalProperties": {}
+                }
+              },
+              "required": ["code", "message"]
             }
           }
         },
@@ -28052,7 +28141,49 @@
                 "type": "string"
               },
               "code": {
-                "type": "string"
+                "type": "string",
+                "enum": [
+                  "bad_request",
+                  "forbidden",
+                  "internal_server_error",
+                  "not_found",
+                  "payment_required",
+                  "rate_limit_exceeded",
+                  "request_timeout",
+                  "request_too_large",
+                  "unauthorized",
+                  "validation_failed",
+                  "agentic_credential_not_found",
+                  "branch_admin_required",
+                  "compute_build_context_too_large",
+                  "compute_build_in_progress",
+                  "compute_deploy_rate_limit_exceeded",
+                  "compute_instance_limit_exceeded",
+                  "compute_instance_not_found",
+                  "compute_not_enabled",
+                  "compute_request_rejected",
+                  "compute_unavailable",
+                  "notebook_cell_duplicate",
+                  "notebook_cell_unknown",
+                  "notebook_disabled",
+                  "notebook_not_found",
+                  "notebook_sort_invalid",
+                  "organization_invitation_email_delivery_failed",
+                  "organization_invitations_partially_failed",
+                  "organization_role_name_invalid",
+                  "organization_role_not_entitled",
+                  "pagination_cursor_invalid",
+                  "project_branch_resync_unsupported",
+                  "project_not_found",
+                  "project_privatelink_disabled",
+                  "project_transfer_disabled",
+                  "delivery_not_found",
+                  "endpoint_disabled",
+                  "endpoint_event_type_not_subscribed",
+                  "endpoint_not_found",
+                  "endpoint_url_unresolvable",
+                  "webhooks_access_disabled"
+                ]
               },
               "message": {
                 "type": "string"
diff --git a/packages/api/src/internal/client.ts b/packages/api/src/internal/client.ts
index 4370099738..440444eabf 100644
--- a/packages/api/src/internal/client.ts
+++ b/packages/api/src/internal/client.ts
@@ -266,6 +266,8 @@ function prepareClient(
       }
       return next;
     }),
+    // Trace context stays local; no API consumer reads it.
+    HttpClient.transformResponse(Effect.provideService(HttpClient.TracerPropagationEnabled, false)),
   );
 
   const retried = applySupabaseRetryPolicy(prefixed, options?.retry);
@@ -500,7 +502,7 @@ function executeRequest(
     const request = yield* buildRequest(definition, input);
     const response = yield* client.execute(request);
     return yield* HttpClientResponse.filterStatusOk(response);
-  });
+  }).pipe(Effect.withSpan(definition.id, { attributes: { "api.operation": definition.id } }));
 }
 
 function isJsonOperation<Id extends OperationId>(
@@ -597,7 +599,7 @@ export function makeSupabaseApiClient(
             ),
           );
           return yield* prepared.execute(request);
-        }),
+        }).pipe(Effect.withSpan(definition.id, { attributes: { "api.operation": definition.id } })),
     };
   });
 }
diff --git a/packages/cli-test-helpers/package.json b/packages/cli-test-helpers/package.json
index c080b70f69..d05111f6d5 100644
--- a/packages/cli-test-helpers/package.json
+++ b/packages/cli-test-helpers/package.json
@@ -4,7 +4,7 @@
   "private": true,
   "type": "module",
   "exports": {
-    ".": "./src/index.ts"
+    ".": "./src/harness.ts"
   },
   "scripts": {
     "test": "pnpm run test:unit",
diff --git a/packages/cli-test-helpers/src/index.ts b/packages/cli-test-helpers/src/index.ts
deleted file mode 100644
index 2eeb06a991..0000000000
--- a/packages/cli-test-helpers/src/index.ts
+++ /dev/null
@@ -1,2 +0,0 @@
-export type { CLIHarness, CLIResult, HarnessOptions, TempDir } from "./harness.ts";
-export { createHarness, exec, makeTempDir } from "./harness.ts";
diff --git a/packages/config/src/functions-manifest.ts b/packages/config/src/functions-manifest.ts
index d05c50adc8..540726183e 100644
--- a/packages/config/src/functions-manifest.ts
+++ b/packages/config/src/functions-manifest.ts
@@ -66,7 +66,7 @@ function applyFunctionOverride(
   };
 }
 
-export const inferFunctionsManifest = Effect.fnUntraced(function* (
+export const inferFunctionsManifest = Effect.fn("FunctionsManifest.infer")(function* (
   options: InferFunctionsManifestOptions,
 ) {
   const fs = yield* FileSystem.FileSystem;
diff --git a/packages/config/src/io.ts b/packages/config/src/io.ts
index dad9fc13c2..82bffc9e6f 100644
--- a/packages/config/src/io.ts
+++ b/packages/config/src/io.ts
@@ -523,7 +523,9 @@ function mergeSelectedRemoteForValidation(
  * `.env`/`.env.local` under `options.path`'s project directory. `options.remoteName` lets a
  * caller validate the document as it would decode with one `[remotes.*]` block selected.
  */
-export const decodeCliConfigDocumentForValidationEffect = Effect.fnUntraced(function* (
+export const decodeCliConfigDocumentForValidationEffect = Effect.fn(
+  "CliConfig.decodeForValidation",
+)(function* (
   document: Record<string, unknown>,
   options: DecodeCliConfigDocumentForValidationEffectOptions,
 ) {
@@ -562,7 +564,7 @@ export const configTomlPath = Effect.fnUntraced(function* (cwd: string) {
   return configTomlPathWith(path, project?.projectRoot ?? cwd);
 });
 
-export const loadCliConfigFile = Effect.fnUntraced(function* (
+export const loadCliConfigFile = Effect.fn("CliConfig.loadFile")(function* (
   filePath: string,
   options?: InternalLoadCliConfigOptions,
 ) {
@@ -710,7 +712,7 @@ export const loadCliConfigFile = Effect.fnUntraced(function* (
   } satisfies LoadedCliConfig;
 });
 
-export const loadCliConfig = Effect.fnUntraced(function* (
+export const loadCliConfig = Effect.fn("CliConfig.load")(function* (
   cwd: string,
   options?: InternalLoadCliConfigOptions,
 ) {
@@ -788,7 +790,7 @@ const writeFileAtomic = Effect.fnUntraced(function* (filePath: string, content:
   }).pipe(Effect.ensuring(fs.remove(tmpPath).pipe(Effect.ignore)));
 });
 
-export const saveCliConfig = Effect.fnUntraced(function* (options: SaveCliConfigOptions) {
+export const saveCliConfig = Effect.fn("CliConfig.save")(function* (options: SaveCliConfigOptions) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
   const project = yield* findCliProjectPaths(options.cwd);
@@ -821,7 +823,7 @@ export const saveCliConfig = Effect.fnUntraced(function* (options: SaveCliConfig
 });
 
 /** Atomically replaces text while applying the target mode at creation to protect sensitive files. */
-export const writeCliConfigDocumentText = Effect.fnUntraced(function* (
+export const writeCliConfigDocumentText = Effect.fn("CliConfig.writeDocument")(function* (
   filePath: string,
   content: string,
 ) {
diff --git a/packages/config/src/project-config/project-config.ts b/packages/config/src/project-config/project-config.ts
index b719d47d67..456f131a2e 100644
--- a/packages/config/src/project-config/project-config.ts
+++ b/packages/config/src/project-config/project-config.ts
@@ -369,7 +369,7 @@ export const DISABLED_SENTINEL_PRUNES: ReadonlyArray<{
   /** Keys to drop when `enabled === false`; absent = drop every key but `enabled`. */
   readonly dropKeys?: ReadonlyArray<string>;
 }> = [
-  // `api.enabled` derives from `schemas.length > 0`; `extra_search_path`/`max_rows` configure a
+  // `api.enabled` and `schemas` share one `db_schema`; `extra_search_path`/`max_rows` configure a
   // PostgREST that isn't exposed while the Data API is off.
   { containerPath: ["api"], dropKeys: ["schemas", "extra_search_path", "max_rows"] },
   // `enabled` here means "manage network restrictions", a management opt-out — the platform has
diff --git a/packages/config/src/project-config/project-config.unit.test.ts b/packages/config/src/project-config/project-config.unit.test.ts
index 4961bf83ea..e7cf72ab42 100644
--- a/packages/config/src/project-config/project-config.unit.test.ts
+++ b/packages/config/src/project-config/project-config.unit.test.ts
@@ -724,14 +724,18 @@ describe("fromApiProjectConfig — api section", () => {
     expect(result.api).toEqual({ schemas: ["public", "graphql_public"], enabled: true });
   });
 
-  // An explicit `db_schema: ""` is the remote's disable sentinel, so only `enabled: false` is
-  // reported; an absent `db_schema` does not gate the siblings.
-  test("an empty db_schema disables the Data API and omits the sibling fields", () => {
-    const result = fromApiProjectConfig({
-      api: { db_schema: "", db_extra_search_path: "public", max_rows: 100 },
-    });
-    expect(result.api).toEqual({ enabled: false });
-  });
+  // An explicit `db_schema: ""` and the platform's `pg_pgrst_no_exposed_schemas` marker are the
+  // remote's disable sentinels, so only `enabled: false` is reported; an absent `db_schema` does
+  // not gate the siblings.
+  test.each(["", "pg_pgrst_no_exposed_schemas"])(
+    "db_schema %j disables the Data API and omits the sibling fields",
+    (dbSchema) => {
+      const result = fromApiProjectConfig({
+        api: { db_schema: dbSchema, db_extra_search_path: "public", max_rows: 100 },
+      });
+      expect(result.api).toEqual({ enabled: false });
+    },
+  );
 
   test("max_rows is clamped to zero when negative", () => {
     const result = fromApiProjectConfig({ api: { max_rows: -5 } });
diff --git a/packages/config/src/project-config/registry.ts b/packages/config/src/project-config/registry.ts
index a0e4cd2ae8..dbce597062 100644
--- a/packages/config/src/project-config/registry.ts
+++ b/packages/config/src/project-config/registry.ts
@@ -26,13 +26,16 @@ const apiExtraSearchPathPath = ["api", "db_extra_search_path"];
 const apiMaxRowsPath = ["api", "max_rows"];
 
 /**
- * True when the remote reports the Data API disabled: an explicit `""` `db_schema`, not an
- * absent one (which means the sparse input simply didn't mention it). The rows below gate on
- * this so a disabled remote maps to exactly `{ api: { enabled: false } }`.
+ * True when the remote reports the Data API disabled: an explicit `""` `db_schema` or the
+ * platform's `pg_pgrst_no_exposed_schemas` marker, not an absent one (which means the sparse
+ * input simply didn't mention it). The marker can't name a real schema because Postgres
+ * reserves the `pg_` prefix. The rows below gate on this so a disabled remote maps to exactly
+ * `{ api: { enabled: false } }`.
  */
 function remoteDataApiDisabled(attributes: Record<string, unknown>): boolean {
   const api = attributes["api"];
-  return isObject(api) && api["db_schema"] === "";
+  const dbSchema = isObject(api) ? api["db_schema"] : undefined;
+  return dbSchema === "" || dbSchema === "pg_pgrst_no_exposed_schemas";
 }
 
 /**
@@ -79,7 +82,10 @@ const apiSectionRows: ReadonlyArray<ProjectConfigMappingRow> = [
     // `apiPath` (see registry-row.ts).
     configPath: ["api", "enabled"],
     apiPath: apiDbSchemaPath,
-    transform: (value) => expectString(value, apiDbSchemaPath).length > 0,
+    transform: (value, attributes) => {
+      expectString(value, apiDbSchemaPath);
+      return !remoteDataApiDisabled(attributes);
+    },
   },
   {
     configPath: ["api", "extra_search_path"],
diff --git a/packages/config/src/project.ts b/packages/config/src/project.ts
index 7cbd593c21..42819fb68b 100644
--- a/packages/config/src/project.ts
+++ b/packages/config/src/project.ts
@@ -181,7 +181,7 @@ export interface InternalResolveCliConfigOptions {
   readonly goViperCompat?: boolean;
 }
 
-export const loadCliProjectEnvironment = Effect.fnUntraced(function* (
+export const loadCliProjectEnvironment = Effect.fn("ProjectEnvironment.load")(function* (
   options: LoadCliProjectEnvironmentOptions,
 ) {
   const fs = yield* FileSystem.FileSystem;
diff --git a/packages/config/src/validate.ts b/packages/config/src/validate.ts
index 027cd8d788..85b114bab2 100644
--- a/packages/config/src/validate.ts
+++ b/packages/config/src/validate.ts
@@ -13,7 +13,7 @@ const decodeRemotesWithoutChecks = Schema.decodeUnknownEffect(RemotesSchema, {
  * structurally with business-rule checks disabled until that remote is
  * selected and merged into the effective config.
  */
-export const validateCliConfig = Effect.fnUntraced(function* (value: unknown) {
+export const validateCliConfig = Effect.fn("CliConfig.validate")(function* (value: unknown) {
   const document = isObject(value) ? { ...value, remotes: {} } : value;
   const config = yield* decodeCliConfig(document);
   const remotes = isObject(value) ? value.remotes : undefined;
diff --git a/packages/stack/ARCHITECTURE.md b/packages/stack/ARCHITECTURE.md
index 51017714da..a0ec07a164 100644
--- a/packages/stack/ARCHITECTURE.md
+++ b/packages/stack/ARCHITECTURE.md
@@ -217,7 +217,7 @@ Namespace stop also cancels and settles attached jobs before StackHost shutdown;
 
 For example, REST binds to the primary database; a shadow database has no relationship to it unless the caller asks to copy its initialization profile. Functions may run without PostgreSQL or Auth. An API URL in configuration is not automatically a hard lifecycle dependency.
 
-For example, Studio and pg-meta are separate service instances. Each has its own ID, configuration, lifecycle and health. Composition declares the relevant edges explicitly. Storage and imgproxy, or Logflare and Vector, follow the same rule when selected; there is no parent handle that starts private children or computes combined health.
+For example, Studio and pg-meta are separate service instances. Each has its own ID, configuration, lifecycle and health. Composition declares the relevant edges explicitly. Storage and imgproxy follow the same rule when selected; there is no parent handle that starts private children or computes combined health.
 
 ```mermaid
 flowchart LR
@@ -446,15 +446,15 @@ Definition changes (service creation and destruction, composition configuration
 
 ### Proposed RPC surface
 
-| Area                 | Methods                                                                                                                | Responsibility                                                |
-| -------------------- | ---------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- |
-| Host                 | `host.describe`, `host.stop`, `host.destroy`                                                                           | Inspect the stack; stop or destroy everything it owns         |
-| Registry             | `services.create`, `services.get`, `services.list`                                                                     | Create and locate instances                                   |
-| Instance lifecycle   | `service.prepare`, `service.start`, `service.stop`, `service.restart`, `service.destroy`                               | Operate one instance                                          |
-| Instance observation | `service.status`, `service.ready`, `service.followStatus`, `service.logs`, `service.followLogs`, `service.credentials` | Read state, await health and inspect outputs                  |
-| Database snapshots   | `database.saveSnapshot`, `database.restoreSnapshot`                                                                    | Database-specific managed storage operations                  |
-| Composition          | `composition.configure`, `composition.describe`, `composition.start`, `composition.stop`, `composition.restart`        | Define and operate the application selection and dependencies |
-| Commands             | `runCommand`, `commandInput`                                                                                           | Execute an attached command with streamed input/output        |
+| Area                 | Methods                                                                                                         | Responsibility                                                |
+| -------------------- | --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- |
+| Host                 | `host.describe`, `host.stop`, `host.destroy`                                                                    | Inspect the stack; stop or destroy everything it owns         |
+| Registry             | `services.create`, `services.get`, `services.list`                                                              | Create and locate instances                                   |
+| Instance lifecycle   | `service.prepare`, `service.start`, `service.stop`, `service.restart`, `service.destroy`                        | Operate one instance                                          |
+| Instance observation | `service.status`, `service.ready`, `service.followStatus`, `service.readLogs`, `service.credentials`            | Read state, await health and inspect outputs                  |
+| Database snapshots   | `database.saveSnapshot`, `database.restoreSnapshot`                                                             | Database-specific managed storage operations                  |
+| Composition          | `composition.configure`, `composition.describe`, `composition.start`, `composition.stop`, `composition.restart` | Define and operate the application selection and dependencies |
+| Commands             | `runCommand`, `commandInput`                                                                                    | Execute an attached command with streamed input/output        |
 
 These are proposed wire names. Public `shadow.start()` maps to `service.start({ id })`; `stack.stop()` maps to `host.stop`. Public `stack.composition.stop()` leaves the host and independent instances available. `composition.configure` sends validated declarative membership, edges and input wiring, not executable callbacks. Configuration changes use the same graph and lifecycle admission rules as other mutations.
 
@@ -639,8 +639,91 @@ The state root is the stack registry root. Each stack keeps one state document a
 <stateRoot>/<stack-id>/owner.lock    lease; opened only by SQLite
 <stateRoot>/<stack-id>/owner.json    endpoint of the lease holder
 <stateRoot>/<stack-id>/owner.log     owner stdout and stderr, truncated at each owner start
+<stateRoot>/<stack-id>/logs/<service>/<instance-id>/<generation>.log   persisted service output
 ```
 
+#### Persisted service logs
+
+The owner is the only subscriber of each instance's output and persists it as records:
+
+- **Format:** one record per line, ended by `\n`, `\r\n` or a lone `\r` so carriage-return progress
+  updates become separate records: `<ISO time> <stdout|stderr|launch|lost> <launch id>[ truncated] | <text>`.
+  Records carry the publish time of their first byte; lines are cut at 32 KiB.
+- **Segments:** immutable and generation-named. Each owner start opens a new generation on the
+  instance's first output, and a record that would take a segment past 5 MiB starts the next one.
+- **Retention:** the oldest closed segments except the newest are deleted while an instance holds
+  more than 10 MiB or 64 segments. A failed deletion is retried at the next rotation, with one
+  warning until a pass succeeds.
+- **Launch ids:** keep increasing across owner starts, since each saved instance records its latest
+  one; an instance saved without one continues after the launch ids at the end of its newest segment.
+- **Lines:** state is kept per launch, process and stream. A late partial line of an ended launch
+  waits for its newline for two seconds of quiet, or until the store closes.
+- **Loss:** chunk sequence numbers span a launch's streams and processes, so any dropped chunk
+  shows as `lost`, without a stream since the dropped chunks' streams are unknown, and the owner log warns once per launch that dropped output. Chunks the in-memory output buffer dropped, chunks still queued when
+  a bounded drain at close ran out, and records that failed to write are recorded as `lost`; a write
+  that fails part-way can count records that did land, so the count is an upper bound. Closing
+  aborts filesystem work still pending after 5 seconds; output not yet written by then is not recorded.
+- **Readers:** every reader, live or offline, reads segments by position, so history and following
+  share one path. A follow can resume at a record position, and a reader that finds its segment
+  deleted reports a `lost` gap marker, which carries `resumeAt` instead of a record position.
+- **Deletion:** destroying an instance deletes its segments, and an owner start removes directories
+  of instances no longer saved, so a failed deletion is retried. Destroying the stack removes
+  `logs/`; resetting database data keeps them.
+
+#### Shipping logs to Analytics
+
+While the composed Analytics instance is running and healthy, the owner ships the persisted
+stdout/stderr records of the Auth, REST, Realtime, Storage, Functions and database instances of the
+composition to its direct backend, never the proxy, so shipping neither wakes it nor counts as
+activity; standalone instances such as shadow databases are not shipped. The owner logs
+each target change, and the target is re-selected when the composition, Analytics' health or its
+launch changes.
+
+- **Bodies:** at most 256 events and 1 MiB. Bodies of an instance are sequential, and event ids
+  derive from the instance and record position.
+- **Cursor:** each instance reads from `cursor.json` in its logs directory: the position of its last
+  confirmed record plus an optional pending body (its end position, source, event ids, the Analytics
+  launch its latest post went to, and when that post ends at the latest). A missing or unreadable
+  cursor starts at the oldest retained segment, and a cursor in a deleted segment resumes at the
+  next retained one. A failed log read restarts the instance from its cursor after a capped
+  backoff, and attaching an instance removes temporary cursor writes a dead owner left behind.
+- **Why delivery is confirmed:** Logflare answers a post once it queued the events and stores them
+  later in per-source batches; a batch holding an id already stored is dropped whole.
+- **Stored-id check:** the owner reads which ids `_analytics.log_events_<token>` holds, resolving the
+  token from `_analytics.sources`, in the database Logflare keeps its sources and events in:
+  `_supabase` on the host and port of Analytics' database URL (reached at the bound database's
+  endpoint when the composition binds it), with `supabase_admin`/`postgres` for credentials the URL
+  omits. A source Analytics does not know, or a failed query, leaves the stored state unknown: the
+  check is retried and shipping waits, with one warning per outage. A known source without a table
+  holds no events. The check depends on Logflare's private table layout, which the owner's Analytics
+  integration test pins.
+- **Posting:** the pending body is written atomically before each post, and a failed write blocks
+  posting. Only ids not yet stored are posted. A post ends by its 5 second timeout, which the
+  pending body records. The owner polls the stored ids until all are stored, then advances the
+  cursor and clears the pending body.
+- **Reposting:** a post that succeeded, timed out or broke after it was sent is not repeated to the
+  Analytics launch that took it while that launch may still store it. Ids still missing are posted
+  again once the launch can no longer store them: 5 seconds after the post ended for a launch of
+  this owner, which starts a launch only after the previous one exited, and 60 seconds after it
+  for another owner's launch, whose process may still be draining. Any other HTTP status and a
+  request that was never sent are posted again 5 seconds later.
+- **Lost batches:** ids the serving launch leaves unstored for 60 seconds of serving are posted
+  again in halves until each unstored one was posted alone. A lone unstored id is skipped once a
+  later post of its source to the launch was stored, which shows Analytics stores that source;
+  otherwise it stays pending and is posted alone again, so an Analytics that stores nothing loses
+  nothing. Each round warns once.
+- **Statuses:** a 401, 403 or 404 response clears the pending body and pauses the instance with its
+  cursor until the target changes; after any other 4xx except 408 and 429 the body is posted again
+  in halves, and only events still rejected on their own are skipped.
+- **Sanitizing:** event text and metadata strings have NUL and unpaired surrogates replaced with
+  U+FFFD before posting, because Postgres `jsonb` rejects them and drops the whole batch.
+- **Recovery and retargets:** a start, restart or retarget reconciles a pending body before later
+  records; pending records already deleted by retention are skipped with a warning. A retarget
+  waits for a post in flight, and a retired target's stored-event view stays open until its
+  sessions end.
+
+#### Registry lock
+
 Registry updates use an OS-backed lock through a private `node:sqlite` connection to
 `<stateRoot>/.registry-lock.sqlite`. Each `withLock` call opens its own connection, disables
 SQLite busy waiting, and retries `BEGIN IMMEDIATE` contention for up to five seconds through
@@ -650,6 +733,8 @@ SQLite. No tables, state records, or WAL are created there. Saved stack data rem
 the lock does not make multi-file operations transactional or recover interrupted operations.
 This uses the built-in SQLite API available in the pinned Bun runtime and modern Node.js.
 
+#### Stop and destroy
+
 The artifact cache is independent and shared across stacks. Normal stop preserves the stack directory and service data. Destroy removes the state document, owner files and proven-owned, empty parents; the lease file goes last, while its lock is still held; caller-owned paths such as Storage uploads remain untouched.
 
 ### Snapshots belong to the database instance
@@ -676,7 +761,7 @@ await shadow.start();
 await shadow.ready();
 ```
 
-The database implementation owns the snapshot format, PostgreSQL data selection, compatibility validation, initialization metadata and credential reconciliation. It uses native filesystem clone/copy operations or container volume/helper operations through the runtime backend. Native entries live below `cacheRoot`; Docker entries share the data volume, in a separate namespace derived from `cacheRoot`. Docker cache reuse requires the same daemon, `stateRoot`, and `cacheRoot`. The cache store retains three entries by last use; saving a key replaces the previous complete entry for that key. Instance-scoped snapshots, which test checkpoints use, live beside the instance's data (native instance root, Docker data namespace or host-backed instance root), are outside cache retention, and are removed when the instance is destroyed; reset keeps them. Cache entries are disposable and do not promise durability across power loss. The orchestrator knows only admission, instance ownership and operation settlement; it never needs to understand PostgreSQL data contents.
+The database implementation owns the snapshot format, PostgreSQL data selection, compatibility validation, initialization metadata and credential reconciliation. It uses native filesystem clone/copy operations or container volume/helper operations through the runtime backend. Native entries live below `cacheRoot`; Docker entries share the data volume, in a separate namespace derived from `cacheRoot`. Docker cache reuse requires the same daemon, `stateRoot`, and `cacheRoot`. When the `SUPABASE_STACK_TEST_RUN` environment variable is set, created volumes and containers also carry a `com.supabase.stack-test-run` label so the test run that created them can remove them. The cache store retains three entries by last use; saving a key replaces the previous complete entry for that key. Instance-scoped snapshots, which test checkpoints use, live beside the instance's data (native instance root, Docker data namespace or host-backed instance root), are outside cache retention, and are removed when the instance is destroyed; reset keeps them. Cache entries are disposable and do not promise durability across power loss. The orchestrator knows only admission, instance ownership and operation settlement; it never needs to understand PostgreSQL data contents.
 
 Keep the contract narrow:
 
diff --git a/packages/stack/README.md b/packages/stack/README.md
index 5363725a53..8110f2d2d7 100644
--- a/packages/stack/README.md
+++ b/packages/stack/README.md
@@ -157,7 +157,7 @@ Bindings supply ordinary configuration values; a URL alone never creates a depen
 
 Exit confirmation is bounded. If cleanup is acknowledged but owner exit cannot be confirmed, the operation fails with `operation: "shutdown-exit"` and the owner PID in the message. A failed or cancelled call does not guarantee that teardown has completed. Do not start or restart the same stack concurrently with whole-stack shutdown; separate stacks remain independent.
 
-Each service exposes `status`, `followStatus`, `logs`, and `credentials`. Observations include the currently bound public endpoints, including listeners for sleeping services. Credentials default to host addressing. Use `from: "runtime"` for a URL passed to a service or command container.
+Each service exposes `status`, `followStatus`, `readLogs`, and `credentials`. The owner persists service output under `<stateRoot>/<id>/logs`; `readLogs({ from?, since?, tail?, follow? })` streams an instance's records through its live owner (`from` and `tail` are mutually exclusive), and `streamStackLogs({ stateRoot, stackId, instances?, since? })` from `@supabase/stack/effect` reads them without an owner, one instance after another in file order. Observations include the currently bound public endpoints, including listeners for sleeping services. Credentials default to host addressing. Use `from: "runtime"` for a URL passed to a service or command container.
 
 ## Testing
 
diff --git a/packages/stack/package.json b/packages/stack/package.json
index c93c0764a7..e71911609f 100644
--- a/packages/stack/package.json
+++ b/packages/stack/package.json
@@ -11,7 +11,8 @@
     "./commands": "./src/Commands.ts",
     "./internal/dispatch": "./src/internal/dispatch.ts",
     "./internal/artifacts": "./src/internal/artifacts.ts",
-    "./internal/release": "./src/internal/release.ts"
+    "./internal/release": "./src/internal/release.ts",
+    "./internal/test-run-label": "./src/internal/test-run-label.ts"
   },
   "scripts": {
     "generate": "bun run scripts/generate-functions-bootstrap.ts",
diff --git a/packages/stack/src/Artifacts.ts b/packages/stack/src/Artifacts.ts
index 4ffbe1290d..7c4065b6fb 100644
--- a/packages/stack/src/Artifacts.ts
+++ b/packages/stack/src/Artifacts.ts
@@ -19,9 +19,13 @@ export type ServiceKind =
   | "pgmeta"
   | "mail"
   | "analytics"
-  | "vector"
   | "pooler";
 
+/** A catalog artifact: a stack service kind, or an artifact only the legacy `supabase start` runs. */
+export type ArtifactKind = ServiceKind | "vector";
+
+const isServiceKind = (kind: ArtifactKind): kind is ServiceKind => kind !== "vector";
+
 export class ArtifactError extends Data.TaggedError("ArtifactError")<{
   readonly message: string;
   readonly service?: string;
@@ -60,7 +64,7 @@ export interface ArtifactPin {
 const releaseVersion = (pin: ArtifactPin): string => `${pin.upstreamVersion}-r${pin.revision}`;
 
 interface ArtifactResolution {
-  readonly service: ServiceKind;
+  readonly service: ArtifactKind;
   /** Upstream version. */
   readonly version: string;
   readonly releaseVersion: string;
@@ -71,7 +75,7 @@ interface ArtifactResolution {
 }
 
 export interface PreparedNativeArtifact {
-  readonly service: ServiceKind;
+  readonly service: ArtifactKind;
   readonly version: string;
   readonly root: string;
   readonly executable: string;
@@ -102,51 +106,51 @@ const definition = (
 
 const SLIM_IMAGE_GHCR_REGISTRY = "ghcr.io/supabase/cli/";
 
-const definitions: Readonly<Record<ServiceKind, ArtifactDefinition>> = {
+const definitions: Readonly<Record<ArtifactKind, ArtifactDefinition>> = {
   database: definition(
     "postgres",
     {
-      upstreamVersion: "17.11.0.002",
-      revision: 0,
+      upstreamVersion: "17.11.0.004",
+      revision: 1,
       image:
-        "ghcr.io/supabase/cli/postgres:17.11.0.002-r0@sha256:5a551a204a41267c4f78a2e5b34657f5c6fdd39eddccd50262466481b95739cc",
-      upstreamImage: "supabase/postgres:17.11.0.002",
+        "ghcr.io/supabase/cli/postgres:17.11.0.004-r1@sha256:8fb7ae7cd0d8121c460c8756d7f2791ce9a19c3331b46987456dfa4f8b45d701",
+      upstreamImage: "supabase/postgres:17.11.0.004",
       natives: {
         "darwin-arm64": {
-          archive: "10410e402c77210a0543539d9bafcabd0c04923d8e796928cbd2a053cf7b4f4f",
-          manifest: "6c1f236324f02baf472152aafed68884cb115b3979fbf1c49209717485d36ac2",
+          archive: "4c5b550683b8835a1a5ca0bf8ba73b6c1fe0cb8b2484dbfa15f32f76eade7efb",
+          manifest: "0f53b023b5afb14b759705661e88af450f634df4584eb5ffd3de0ede32119b44",
         },
         "linux-amd64": {
-          archive: "4a4410791bdeeda2e08fda400039b4319bb26d74e08e68951f38abc9dacd7c26",
-          manifest: "cd76249031db380831d773acea6fea8a54104d5ca97bb18db34d05e7bd124e5f",
+          archive: "a9d374c950ec50cb59ead868662f0dd44d358b3917a10346b4bf131f567207f7",
+          manifest: "368ab96c35d21b3505966b4d892ebe3fe8247335ea75873bc0bbd1881e968459",
         },
         "linux-arm64": {
-          archive: "1d54954b2441990643f25a825e4e46ec50ecf538a63baa8e413e353e7faeb939",
-          manifest: "8dda36ffdb7b5b501873ff41c265bb061e8eb9aeed0e4372c5ad9af59110776b",
+          archive: "6c7dfb5adf4b443a6af472bad8906ac9677dfe8310b0d598bfb101844095bcf5",
+          manifest: "f0e5cbf7aee20f175a845251652b2c4f761d914941914df483ee2c20d104eb0e",
         },
       },
     },
     "bin/supabase-postgres-start",
     ["bin/supabase-postgres-start", "bin/pg_dump", "bin/pg_dumpall", "bin/pg_prove", "bin/psql"],
     {
-      "15.19.0.002": {
-        upstreamVersion: "15.19.0.002",
-        revision: 0,
+      "15.19.0.004": {
+        upstreamVersion: "15.19.0.004",
+        revision: 1,
         image:
-          "ghcr.io/supabase/cli/postgres:15.19.0.002-r0@sha256:a3f343f19323497a5766fa4e86a51dba495a8eca354cc128d879b4632c6bd017",
-        upstreamImage: "supabase/postgres:15.19.0.002",
+          "ghcr.io/supabase/cli/postgres:15.19.0.004-r1@sha256:df77a34bf5839149c74b24a12228ad58e492c2a9d76d3887ef4f279d06173e09",
+        upstreamImage: "supabase/postgres:15.19.0.004",
         natives: {
           "darwin-arm64": {
-            archive: "59b05ca76db9d807803840264d885a5ff435e552f294d7f22ca831fac1ffb4a3",
-            manifest: "b7956520ee15a8265635cabb318490f89c4737706f9349246da9921a17fbac07",
+            archive: "57463faeb424d11296a833ea271881ba4ab31434ec90b860b104e2e814de25fd",
+            manifest: "7a0dab606017ccfea22f1e32f69b78792f3ff5eca13e3880a3de8884e9c03832",
           },
           "linux-amd64": {
-            archive: "bdf565e0b866ca7b2494b56b502963ef57d54ab1c99eac6855f760caaffda712",
-            manifest: "e1ecda082f1c414fea6356d0399eaf76d22a25b96808961a945aacb242f904c9",
+            archive: "867fba08024fb813dcbd8d0cfcc87f02dfb49d6093e18a9459a6f4c1b44236c2",
+            manifest: "eab1b6d62684aef3f7d3aa9e55b9e8dbf99f732e4ac23f704e75474321bdfa30",
           },
           "linux-arm64": {
-            archive: "c7420f0eb0938397d90906265630359313936cc576035cb31c2bdef6451565c6",
-            manifest: "207feac260bcbc5607decca9e14e0422accc4a0ae1f7d24b8fe0992d284cc43c",
+            archive: "73502a47bb7419f70668feeb857fe2da039fdaade60a7baba41b1edb954b2796",
+            manifest: "3b957388f0bf05c230b1d65691412150239aa39847e0d782a1448d56258f9ef8",
           },
         },
       },
@@ -205,23 +209,23 @@ const definitions: Readonly<Record<ServiceKind, ArtifactDefinition>> = {
   realtime: definition(
     "realtime",
     {
-      upstreamVersion: "v2.140.3",
+      upstreamVersion: "v2.140.10",
       revision: 0,
       image:
-        "ghcr.io/supabase/cli/realtime:v2.140.3-r0@sha256:af7b883647770351eef150cc16e1f12d7fe4b4920324e2e40487961ad3b22789",
-      upstreamImage: "supabase/realtime:v2.140.3",
+        "ghcr.io/supabase/cli/realtime:v2.140.10-r0@sha256:592caf1e1c896e395bdf40feba61ef7a3609e0fae7dc77f13e0d34c4b8aed716",
+      upstreamImage: "supabase/realtime:v2.140.10",
       natives: {
         "darwin-arm64": {
-          archive: "e015ced15ed2110c2a0123b6e75edb2aeb12ac6bdbacffdfb296262a4215f97e",
-          manifest: "a833a92e7b2e34b6bfcf41c4c934587f85e96eb11acb9cce14852b8ffec312d6",
+          archive: "51d536d743fb2cd8c23a632b28338951b2883a7ff8ca04239dee3b2e27786d5a",
+          manifest: "c58bb48429c854c206b18817da4d9e43f80fe495cea6a49e9ac2e1566e6ba5ac",
         },
         "linux-amd64": {
-          archive: "d528a255b2cb20df25ab9440e29f026e2fb3c993e4ed7b0707e037d0cb3880d9",
-          manifest: "fc5445d4b28d41691091c8cdccde7cff0dbd06af2bf56e70401ec6a049fb8757",
+          archive: "8e8994b97862478d9d6cc917d374442b33900435867dbd915e950f9a0317cb9f",
+          manifest: "53d5be6a61c3488d31ea4bff5fdd895ce83571af648026a8223a984e2d9cc5da",
         },
         "linux-arm64": {
-          archive: "bb3b810540dbba2f9a94eb974799384cbffe67756cd91ebb3b8254d02d890e2e",
-          manifest: "1a33f5620a39a64b49645c25878a892122d695f8f1a26d3548fb5332d6e0d88b",
+          archive: "439acc097353d2f074edea2728d1d18d672b03a4c1e74321f4eeb8f756fbb6ca",
+          manifest: "6007cefb3e33ed9f434ae9b2d0a924b075d16ba32405a7d8005b7b143dc4f858",
         },
       },
     },
@@ -231,23 +235,23 @@ const definitions: Readonly<Record<ServiceKind, ArtifactDefinition>> = {
   storage: definition(
     "storage",
     {
-      upstreamVersion: "v1.79.28",
-      revision: 1,
+      upstreamVersion: "v1.79.36",
+      revision: 0,
       image:
-        "ghcr.io/supabase/cli/storage:v1.79.28-r1@sha256:95e0007f273e7c990ab81c44e021e4278b8953dd95ae2fbdc19fca047d4bd470",
-      upstreamImage: "supabase/storage-api:v1.79.28",
+        "ghcr.io/supabase/cli/storage:v1.79.36-r0@sha256:83d831c2e0b3d0070c340135a70f93df4be32b2274d777b9b316f31f9c792dfc",
+      upstreamImage: "supabase/storage-api:v1.79.36",
       natives: {
         "darwin-arm64": {
-          archive: "bea019baff21e10b78291a9c23687ec15ebb45994d0d03c656ffda13e13108d4",
-          manifest: "8612ea30b918ac6590f30660b518ea41b80d9d591734fa3313a64c6607621cb2",
+          archive: "373d85e2db5237fbd239dc368355e738f2887329c50c3d8d562cd42b01a2b824",
+          manifest: "060d672776ec77e9dceaf3463f3acbe4bce34a4fac2429eb8975b076d2acc370",
         },
         "linux-amd64": {
-          archive: "c8ce124acfe46a2151052f160a81653f751277516f5c378d93ba7f18e7b3efe4",
-          manifest: "edce6bb24a84e5245956c1de3fa93d96d3813efbe2e5dac105b385ebae7e3f0d",
+          archive: "75aad9077a7e7c93aa75ac3a701f55172eee30cc909ba3e9fac6bcb9a7c0fbc4",
+          manifest: "34ad52308c92cc09336cd77266ae6c329aac952eefc11e388e85afad1231d791",
         },
         "linux-arm64": {
-          archive: "8a51c2b8bc4d1076665321ae0da7eca81dbdff84dbc687a209a958955cf9cb69",
-          manifest: "befaaec0e8660d99a4040f81ece4277e4db27812b8e2630a4d0b15d16b3ed831",
+          archive: "4b9d29084549c10d72cff60b98dafa68f4439f355c471e37a2945f2395fbe153",
+          manifest: "4ae5ec1879061980ed049b8bdf6492ccc419fd45994e33c1739fccb11ac879ca",
         },
       },
     },
@@ -282,23 +286,23 @@ const definitions: Readonly<Record<ServiceKind, ArtifactDefinition>> = {
   functions: definition(
     "edge-runtime",
     {
-      upstreamVersion: "v1.77.1",
+      upstreamVersion: "v1.77.4",
       revision: 0,
       image:
-        "ghcr.io/supabase/cli/edge-runtime:v1.77.1-r0@sha256:98582ce39914bba6ac856a5bf6ed3c1584ce4616687ca359c8acd5f59dd9ff59",
-      upstreamImage: "supabase/edge-runtime:v1.77.1",
+        "ghcr.io/supabase/cli/edge-runtime:v1.77.4-r0@sha256:33ca85830d726be1864e8ab929bf9e2230b0a750d59634fef871e736c9a40c34",
+      upstreamImage: "supabase/edge-runtime:v1.77.4",
       natives: {
         "darwin-arm64": {
-          archive: "e52fdbedccf258fd9a427b19bd34569ca210c1ca257a85fc23f66b4e18c1d6a1",
-          manifest: "ef2590d8119fe1c2c877746ef72f58ed4d935ce23647b893fd5d36892b0496e0",
+          archive: "c0a16266b5208caec6669a982076575492c46f4d999748cdb7f3eb1dccbd6e39",
+          manifest: "ffa7bc574ead39237657cbc96308b750e8ddce778bf8072b6db8bf7a9f25e91a",
         },
         "linux-amd64": {
-          archive: "e524630f0743319d77535f93748a894520fd52cf9c8fa8c2adb22e08ddb39419",
-          manifest: "3ff18dc0667373dfc108da7d206dbfbf844f2596a804319343d5793298416e9c",
+          archive: "29447f4e0ff992bce358fa3e08c4535e99c185d245a3e4c76efc4685aadadd18",
+          manifest: "eead320333d0bb58c10a491c53e00c5076e983b2f5044a41036a54ee5d092188",
         },
         "linux-arm64": {
-          archive: "c0fe416e506087afd75771beeeb6cfd070d4d6056293a940e3bf453637ba7a5f",
-          manifest: "703581ebe6213c484955313fbec3ea6ad5f20a86f0c48eb0e29d1bbe9d1c286b",
+          archive: "f8b2b43ca5320729e25d8b455c8aaeef43c08ccddc764557c970c4e30a4d9fe4",
+          manifest: "6b7257fca1bacecb4ca7c8f7512073109c8557672d8f9386533c483aa27320c4",
         },
       },
     },
@@ -307,23 +311,23 @@ const definitions: Readonly<Record<ServiceKind, ArtifactDefinition>> = {
   studio: definition(
     "studio",
     {
-      upstreamVersion: "2026.09.28-sha-5e59b60",
+      upstreamVersion: "2026.10.05-sha-94b8b06",
       revision: 0,
       image:
-        "ghcr.io/supabase/cli/studio:2026.09.28-sha-5e59b60-r0@sha256:4cf4f70978bb0866d1644b43cb0d23acc4b4ef7a898592043ad0d13cad8059be",
-      upstreamImage: "supabase/studio:2026.09.28-sha-5e59b60",
+        "ghcr.io/supabase/cli/studio:2026.10.05-sha-94b8b06-r0@sha256:a5580ddf689128fac853f3fa1b122414b78a64f9a4af0194ef4caa2a387aae5f",
+      upstreamImage: "supabase/studio:2026.10.05-sha-94b8b06",
       natives: {
         "darwin-arm64": {
-          archive: "37f420f6af3d5ee7dab884e8c39fe2c3bcddcee0d90e53d1e075a05ae3cb4b73",
-          manifest: "b5d6209c4c28e594cc8b0ab961105465418f0021ba50a3fd92067ff5720ae820",
+          archive: "01613b298673ee5829b5847da72105b5dbe7206b80482fd05bc17619c21901b9",
+          manifest: "1eb8a29d6cf67a6b0de0d76dc89840aff6022d56fbf2a7dc20634c541fa50c4e",
         },
         "linux-amd64": {
-          archive: "19a9903732b71fba04ce342e4d13b83bf7579bce806981cf8f2b491ad792fc6e",
-          manifest: "5a4f1e316ad84ff058263601b9b144177ab0cd18443e826354551aec88013199",
+          archive: "3c7c87ddd859979a5b441e2a7abfe462c4864922818b8dda3fd013bced73337c",
+          manifest: "77adf4f7a45510a4fd807056cce1ba54b35285001e9b87e556774902aeaff33c",
         },
         "linux-arm64": {
-          archive: "ce69544c9ec5dbae50e5da731770bc199e12f0f1d63b22ec7a43b6a0ba00cb4c",
-          manifest: "c27374ccc51cc6419f9bbd14f095f1a16db4bda369928effcc15a6366dcb3d1f",
+          archive: "c663e88999d36ad587df2d56ede2e6cdaefbbb8011f9369b075500606effea03",
+          manifest: "c62ff9c6779a3e92964b27ee9430d60f0e12b54d201dc53b870942c1ee926ff4",
         },
       },
     },
@@ -332,23 +336,23 @@ const definitions: Readonly<Record<ServiceKind, ArtifactDefinition>> = {
   pgmeta: definition(
     "pgmeta",
     {
-      upstreamVersion: "v0.99.0",
+      upstreamVersion: "v0.100.0",
       revision: 0,
       image:
-        "ghcr.io/supabase/cli/pgmeta:v0.99.0-r0@sha256:c19f6bba3ab66fcf30c8737d2361ec9f8e12a4fa8a071481f53366dc13e83340",
-      upstreamImage: "supabase/postgres-meta:v0.99.0",
+        "ghcr.io/supabase/cli/pgmeta:v0.100.0-r0@sha256:1dc3ce4f710e9696ec1374f89d0dc84291104c9a1ce030f9ac999670d4d74a08",
+      upstreamImage: "supabase/postgres-meta:v0.100.0",
       natives: {
         "darwin-arm64": {
-          archive: "337f8cc6a23d93f3f9cfeed12de2a86d686ce6f4346ff9b334b5dfdcba7e890f",
-          manifest: "6b35ee42d334138562444842ed0662b97b3cbde504caa11e97407b137bc8b2ca",
+          archive: "adecdf5168a9e43056d4e3d78122960b3f645607f6b64e7e178522ad8ca7f3e4",
+          manifest: "edf539c9a613c4f0d2d4ccf5d245c8fd57b60d158bcc7c24a18f343236529c69",
         },
         "linux-amd64": {
-          archive: "43156ba28901710bf02a333dc04c4b30754eb6a2334ff1d890a4a3ea55c02f22",
-          manifest: "dbd8a7eac705b6c6df16826f22f3317906842be8498ce44fa1229ae6f16273ad",
+          archive: "5df0dfb03469f358858b8768f39db9a77b5947ec0567aff1056fddbfa1f2db75",
+          manifest: "3095c4655e8f35451fdb84194065a31c4edee9b52fd5b28ac01dfdae620e07a1",
         },
         "linux-arm64": {
-          archive: "a8565d6e550efa8a8481c7d542b612e7a6d50668321fcd2e668b2ee9bcb28ed7",
-          manifest: "1b67627c5ccde0f94a4997ab223a0ac072c70e9bf1bb86d3e4d0df42e90b4059",
+          archive: "8289012110b6b466d8366ceb2e6f731eca9b46020046b585438f988615666a22",
+          manifest: "349d37edae9ac07d15543e7acf5bae288112850285dee28c602cd6c04ea11c1a",
         },
       },
     },
@@ -382,23 +386,23 @@ const definitions: Readonly<Record<ServiceKind, ArtifactDefinition>> = {
   analytics: definition(
     "analytics",
     {
-      upstreamVersion: "v1.50.15",
+      upstreamVersion: "v1.52.0",
       revision: 0,
       image:
-        "ghcr.io/supabase/cli/analytics:v1.50.15-r0@sha256:cea1595bafa6ab32df4854d407261ddef6e35394e300ae29770ba48c49c8dc7e",
-      upstreamImage: "supabase/logflare:1.50.15",
+        "ghcr.io/supabase/cli/analytics:v1.52.0-r0@sha256:f2e3b54f41a42f8f422cec15382be390c986fe5a121d1345bb28c918291f9517",
+      upstreamImage: "supabase/logflare:1.52.0",
       natives: {
         "darwin-arm64": {
-          archive: "336c78c501aff270b0fcd2a42229b76d9f2feafa646f49a59c3de29358e3de17",
-          manifest: "d0e1a0c3fa0a4ebfcebbe490f290699424e3b8c92a542f50111ff88d6e47b8b5",
+          archive: "385c0613b70e65b81266f469e5be9d12d4cc8fc06fe3ac6424a3fb59ebb387b2",
+          manifest: "f3cc90f649b6c84f31f185984c47232f75247eda19031c179d80f88bc8a3e6ab",
         },
         "linux-amd64": {
-          archive: "a699ce1522dac43989987a9d152648ed0506fb887ffedff49c148da02cbbc7e7",
-          manifest: "ba8c55eeb06be91ad582156854babdc6a06d7a26fa6956bc1271eee4cae9d536",
+          archive: "bb2d8071b965eb8e6e055e6ea176824e94ee0f570cbc583d302c0ffe96bb683a",
+          manifest: "692a90984395c3b7a076c8804daf4709f65cee768dc71256061ec2a1c349200b",
         },
         "linux-arm64": {
-          archive: "bb977b9cd0623e1b1ece9875377fdf29577f96991d2e5c72a38a1b664c6a7538",
-          manifest: "1739bbd4afb838e62b6191c4de8aa39685df9f5d83e1b7cc303bd096237ba08c",
+          archive: "d004f392e1db41b63dacc19a7afc42981ab8198ef2b8fa27f81eebd6cde9bcee",
+          manifest: "25010eb91632bfa7b0be1bbc3caf713cc4c20572215c135dce957f285ba95ba6",
         },
       },
     },
@@ -435,22 +439,22 @@ const definitions: Readonly<Record<ServiceKind, ArtifactDefinition>> = {
     "pooler",
     {
       upstreamVersion: "v2.9.13",
-      revision: 0,
+      revision: 1,
       image:
-        "ghcr.io/supabase/cli/pooler:v2.9.13-r0@sha256:3a32b56d03675ed24e84408afcbb12fa52b7ec6e7741f913770fea5b66c2ddd3",
+        "ghcr.io/supabase/cli/pooler:v2.9.13-r1@sha256:f02ccc6e18ea77789978e248ac302a4e0955d03fdeeea0d63ac0b7a315595c60",
       upstreamImage: "supabase/supavisor:2.9.13",
       natives: {
         "darwin-arm64": {
-          archive: "c05285be2a945a29d5be491661926f8c88d976540d49ddbcab10aa7276b29934",
-          manifest: "0fafa8dcf601ff3cea7326e82f7a5191ffe03e3e4edd0d2b155e80e8c9f53d78",
+          archive: "aa53594e91144a6d33267b802152f0f42d35ca85e6efd13b9cd06f53e327fb5f",
+          manifest: "1c42764f1f706cb177ee4f066c6ebcb75e15a2399e8f552488a426718d9e2edd",
         },
         "linux-amd64": {
-          archive: "d94e36f44267b4159fa55e1aea39320a68789b6af07f9cc87c27327ed6a00602",
-          manifest: "4f181d1d25da91f72ca37c22cdc46278a424a4edef6bdd2ea2c30f463c629a5a",
+          archive: "ff1543cebb9331646294475c609c3e231618e46f1dca53108d35f3172c1fa705",
+          manifest: "1ef9f8041632ca0c96045f64092c880a3ad7a6af4febe7d0b43322b330fc19f8",
         },
         "linux-arm64": {
-          archive: "124f3e6c95e6ba985239e013cab76c5be28fbd92cb4986b687dd5e827f0525ca",
-          manifest: "c6cdc298bc3a00d082a1c9c34f4131f13437df51fb0bf9a0ce857b0a2fd66460",
+          archive: "ed08b8856a0516026321a47055fca5c30cea82f93dc3da8bb2ab81951342a20c",
+          manifest: "12e867a370fac6aa68f1e657840d30c9d4e5cae56f38da833a26e05c688c94ad",
         },
       },
     },
@@ -501,7 +505,7 @@ export const slimImageMirrors = (image: string): ReadonlyArray<string> =>
     : [];
 
 const artifactFor = (
-  service: ServiceKind,
+  service: ArtifactKind,
   resolved: ArtifactResolution,
   target: NativeTarget,
 ): SlimServicesArtifact => {
@@ -537,7 +541,7 @@ const artifactFor = (
 };
 
 export const resolveArtifact = Effect.fn("Artifacts.resolveArtifact")(function* (request: {
-  readonly service: ServiceKind;
+  readonly service: ArtifactKind;
   readonly version?: string;
 }) {
   if (!Object.hasOwn(definitions, request.service))
@@ -567,8 +571,9 @@ export const postgresVersion = (version: string): string =>
   Object.keys(definitions.database.pins).find((candidate) => candidate.split(".")[0] === version) ??
   version;
 
-/** Service kinds in artifact catalog order. */
-export const artifactServiceKinds = (): ReadonlyArray<ServiceKind> => Record.keys(definitions);
+/** Service kinds the stack runs, in artifact catalog order; legacy-only artifacts are omitted. */
+export const artifactServiceKinds = (): ReadonlyArray<ServiceKind> =>
+  Record.keys(definitions).filter(isServiceKind);
 
 /**
  * Every catalog pin in catalog order, including additional upstream lines. `isDefault` marks the
@@ -576,12 +581,12 @@ export const artifactServiceKinds = (): ReadonlyArray<ServiceKind> => Record.key
  * other pin (postgres's 15.x additional line) carries `isDefault: false`.
  */
 export const catalogPins = (): ReadonlyArray<{
-  readonly service: ServiceKind;
+  readonly service: ArtifactKind;
   readonly sourceService: string;
   readonly pin: ArtifactPin;
   readonly isDefault: boolean;
 }> =>
-  artifactServiceKinds().flatMap((service) => {
+  Record.keys(definitions).flatMap((service) => {
     const { sourceService, defaultVersion, pins } = definitions[service];
     return Object.values(pins).map((pin) => ({
       service,
@@ -595,7 +600,7 @@ const artifactKey = (artifact: SlimServicesArtifact): string =>
   `slim-services/${artifact.service}/${artifact.version}/${artifact.target}`;
 
 export const prepareNativeArtifact = Effect.fn("Artifacts.prepareNativeArtifact")(function* (
-  request: { readonly service: ServiceKind; readonly version?: string },
+  request: { readonly service: ArtifactKind; readonly version?: string },
   cacheRoot: string,
   platform: { readonly os: string; readonly arch: string } = {
     os: process.platform,
diff --git a/packages/stack/src/Commands.integration.test.ts b/packages/stack/src/Commands.integration.test.ts
index 7e6d3b7a36..21d81d129a 100644
--- a/packages/stack/src/Commands.integration.test.ts
+++ b/packages/stack/src/Commands.integration.test.ts
@@ -24,6 +24,7 @@ import type { PgProveOptions, PostgresCommand } from "./Commands.ts";
 import { makeDatabase } from "./services/Database.ts";
 import { makeService } from "./Service.ts";
 import { bindTcp, serveTcp } from "./Proxy.ts";
+import { makeDockerDatabaseRoot } from "../tests/docker-fixture.ts";
 
 const cacheRoot = `${tmpdir()}/supabase-stack-artifacts`;
 
@@ -77,8 +78,11 @@ describe("finite PostgreSQL commands", { timeout: 180_000 }, () => {
       Effect.scoped(
         Effect.gen(function* () {
           const fs = yield* FileSystem.FileSystem;
-          const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-tools-" });
           const stackId = `tools-integration-${randomUUID()}`;
+          const root =
+            runtime === "docker"
+              ? yield* makeDockerDatabaseRoot("stack-tools-", stackId)
+              : yield* fs.makeTempDirectoryScoped({ prefix: "stack-tools-" });
           const database = yield* makeDatabase({
             root,
             cacheRoot,
@@ -224,8 +228,11 @@ describe("finite PostgreSQL commands", { timeout: 180_000 }, () => {
         Effect.scoped(
           Effect.gen(function* () {
             const fs = yield* FileSystem.FileSystem;
-            const root = yield* fs.makeTempDirectoryScoped({ prefix: `stack-pgprove-${major}-` });
             const stackId = `tools-pgprove-${runtime}-${major}-${randomUUID()}`;
+            const root =
+              runtime === "docker"
+                ? yield* makeDockerDatabaseRoot(`stack-pgprove-${major}-`, stackId)
+                : yield* fs.makeTempDirectoryScoped({ prefix: `stack-pgprove-${major}-` });
             const database = yield* makeDatabase({
               root,
               cacheRoot,
diff --git a/packages/stack/src/HostProcess.ts b/packages/stack/src/HostProcess.ts
index 46b60d3820..88f34aa4de 100644
--- a/packages/stack/src/HostProcess.ts
+++ b/packages/stack/src/HostProcess.ts
@@ -1,3 +1,4 @@
+import { withAttemptCount } from "./internal/attempts.ts";
 import { NodeStream } from "@effect/platform-node";
 import {
   Crypto,
@@ -262,10 +263,11 @@ export const connectHost = Effect.fn("HostProcess.connectHost")(function* (
   HttpClient.HttpClient | FileSystem.FileSystem | Path.Path | Crypto.Crypto
 > {
   const stack = yield* registered(state, stackId);
-  const access = yield* Effect.gen(function* () {
-    if (!(yield* state.leased(stackId)))
+  // Lease and holder reads repeat every poll and stay untraced; the identity request is traced.
+  const lookup = Effect.gen(function* () {
+    if (!(yield* state.leased(stackId).pipe(Effect.withTracerEnabled(false))))
       return yield* error("connect", "Stack owner is not running", "not-running");
-    const holder = yield* state.readHolder(stackId);
+    const holder = yield* state.readHolder(stackId).pipe(Effect.withTracerEnabled(false));
     if (holder === undefined)
       return yield* error(
         "connect",
@@ -275,11 +277,18 @@ export const connectHost = Effect.fn("HostProcess.connectHost")(function* (
     if (holder.role === "sweeper")
       return yield* error("connect", "Another owner is sweeping this stack", "sweeping");
     return yield* identityOf(stack, holder);
-  }).pipe(
-    Effect.retry({
-      schedule: Schedule.spaced("50 millis").pipe(Schedule.upTo({ duration: "30 seconds" })),
-      while: hasReason("owner-starting"),
-    }),
+  });
+  const access = yield* withAttemptCount(
+    lookup,
+    (counted) =>
+      counted.pipe(
+        Effect.retry({
+          schedule: Schedule.spaced("50 millis").pipe(Schedule.upTo({ duration: "30 seconds" })),
+          while: hasReason("owner-starting"),
+        }),
+      ),
+    { traced: true },
+  ).pipe(
     Effect.mapError((failure) =>
       hasReason("owner-starting")(failure)
         ? error(
@@ -560,13 +569,18 @@ export const launchHost = Effect.fn("HostProcess.launchHost")(function* (
     return spawned._tag === "Ready" ? spawned.access : yield* connectHost(state, options.stackId);
   });
   // A sweeper holds a dead stack's lease for a bounded time; a displaced spawn waits it out.
-  return yield* attempt.pipe(
-    Effect.retry({
-      schedule: Schedule.spaced("100 millis").pipe(
-        Schedule.upTo({ duration: Duration.sum(sweepTimeout, Duration.seconds(10)) }),
+  return yield* withAttemptCount(
+    attempt,
+    (counted) =>
+      counted.pipe(
+        Effect.retry({
+          schedule: Schedule.spaced("100 millis").pipe(
+            Schedule.upTo({ duration: Duration.sum(sweepTimeout, Duration.seconds(10)) }),
+          ),
+          while: hasReason("not-running", "sweeping"),
+        }),
       ),
-      while: hasReason("not-running", "sweeping"),
-    }),
+    { traced: true },
   );
 });
 
@@ -664,12 +678,15 @@ export const waitForOwnerExit = Effect.fn("HostProcess.waitForOwnerExit")(functi
       }
     }),
   );
-  return yield* check.pipe(
-    Effect.retry({
-      schedule: Schedule.spaced("25 millis").pipe(Schedule.upTo({ duration: "5 seconds" })),
-      while: (failure) =>
-        failure.reason === "owner-exit-pending" || failure.reason === "owner-exit-zombie",
-    }),
+  return yield* withAttemptCount(check, (counted) =>
+    counted.pipe(
+      Effect.retry({
+        schedule: Schedule.spaced("25 millis").pipe(Schedule.upTo({ duration: "5 seconds" })),
+        while: (failure) =>
+          failure.reason === "owner-exit-pending" || failure.reason === "owner-exit-zombie",
+      }),
+    ),
+  ).pipe(
     Effect.catchIf(
       (failure) => failure.reason === "owner-exit-zombie",
       () => Effect.void,
diff --git a/packages/stack/src/Orchestrator.ts b/packages/stack/src/Orchestrator.ts
index b00639164e..2ae7d33c58 100644
--- a/packages/stack/src/Orchestrator.ts
+++ b/packages/stack/src/Orchestrator.ts
@@ -250,6 +250,7 @@ export const make = Effect.fn("Orchestrator.make")(function* <
   const node = Effect.fn("Orchestrator.node")(function* (
     id: string,
   ): Effect.fn.Return<Entry, OrchestratorError> {
+    yield* Effect.annotateCurrentSpan({ instance_id: id });
     const nodes = yield* Ref.get(registry);
     const value = nodes.get(id);
     if (value === undefined) return yield* graphError("register", `Unknown instance ${id}`);
@@ -765,8 +766,9 @@ export const make = Effect.fn("Orchestrator.make")(function* <
 
   const orchestrator: Interface<Entry> = {
     admissionFor,
-    register: Effect.fn("Orchestrator.register")((instance) =>
-      withGraph(
+    register: Effect.fn("Orchestrator.register")(function* (instance) {
+      yield* Effect.annotateCurrentSpan({ instance_id: instance.id });
+      return yield* withGraph(
         Effect.gen(function* () {
           const values = yield* Ref.get(registry);
           if (values.has(instance.id))
@@ -815,8 +817,8 @@ export const make = Effect.fn("Orchestrator.make")(function* <
             owner,
           );
         }),
-      ),
-    ),
+      );
+    }),
     get: Effect.fn("Orchestrator.get")((id) => node(id)),
     composition: Ref.get(composition),
     configure: <E = never>(configuration: CompositionConfig, persist?: Effect.Effect<void, E>) =>
@@ -847,6 +849,7 @@ export const make = Effect.fn("Orchestrator.make")(function* <
       ).pipe(Effect.withSpan("Orchestrator.configure")),
     start: Effect.fn("Orchestrator.start")((id) =>
       Effect.gen(function* () {
+        yield* Effect.annotateCurrentSpan({ instance_id: id });
         const plan = yield* snapshotPlan(id);
         for (const member of plan.order) yield* (yield* node(member)).bind;
         yield* startNode(id, false, false, plan);
@@ -854,6 +857,7 @@ export const make = Effect.fn("Orchestrator.make")(function* <
     ),
     stop: Effect.fn("Orchestrator.stop")((id) =>
       Effect.gen(function* () {
+        yield* Effect.annotateCurrentSpan({ instance_id: id });
         const instance = yield* node(id);
         yield* instance.core.stop;
         yield* instance.close;
@@ -862,6 +866,7 @@ export const make = Effect.fn("Orchestrator.make")(function* <
     ),
     restart: Effect.fn("Orchestrator.restart")((id, config) =>
       Effect.gen(function* () {
+        yield* Effect.annotateCurrentSpan({ instance_id: id });
         const plan = yield* snapshotPlan(id);
         for (const member of plan.order) yield* (yield* node(member)).bind;
         for (const member of plan.order.slice(0, -1)) {
@@ -883,7 +888,9 @@ export const make = Effect.fn("Orchestrator.make")(function* <
         yield* instance.bind;
       }),
     ),
-    destroy: Effect.fn("Orchestrator.destroy")((id) => destroyNode(id)),
+    destroy: Effect.fn("Orchestrator.destroy")((id) =>
+      Effect.annotateCurrentSpan({ instance_id: id }).pipe(Effect.andThen(destroyNode(id))),
+    ),
     startComposition: startComposition(),
     stopComposition: stopComposition(),
     restartComposition: restartComposition(),
@@ -891,6 +898,7 @@ export const make = Effect.fn("Orchestrator.make")(function* <
     destroyNamespace: destroyNamespace(),
     acquire: Effect.fn("Orchestrator.acquire")((id, awaitReady = true, trigger) =>
       Effect.gen(function* () {
+        yield* Effect.annotateCurrentSpan({ instance_id: id });
         const instance = yield* node(id);
         const scope = yield* Scope.Scope;
         const now = yield* Clock.currentTimeMillis;
diff --git a/packages/stack/src/Owner.analytics.integration.test.ts b/packages/stack/src/Owner.analytics.integration.test.ts
new file mode 100644
index 0000000000..578c863a83
--- /dev/null
+++ b/packages/stack/src/Owner.analytics.integration.test.ts
@@ -0,0 +1,370 @@
+import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { PgClient } from "@effect/sql-pg";
+import { expect, it } from "@effect/vitest";
+import {
+  Context,
+  Crypto,
+  DateTime,
+  Effect,
+  Fiber,
+  FileSystem,
+  Layer,
+  Option,
+  Path,
+  Redacted,
+  Schedule,
+  Schema,
+  Stream,
+} from "effect";
+import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http";
+import { tmpdir } from "node:os";
+import { logflareEvent, logflareSources } from "./host/LogflareEvents.ts";
+import * as State from "./State.ts";
+import type { SavedStack } from "./State.ts";
+import type { ServiceCreationInput } from "./services/Catalog.ts";
+import { makeDockerDatabaseRoot } from "../tests/docker-fixture.ts";
+import { ownerFor } from "../tests/owner-rpc.ts";
+
+const cacheRoot = `${tmpdir()}/supabase-stack-artifacts`;
+
+const query = <A extends object>(url: string, statement: string) =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const parsed = new URL(url);
+      const services = yield* Layer.build(
+        PgClient.layer({
+          host: parsed.hostname,
+          port: Number(parsed.port),
+          database: parsed.pathname.slice(1),
+          username: decodeURIComponent(parsed.username),
+          password: Redacted.make(decodeURIComponent(parsed.password)),
+        }),
+      );
+      return yield* Context.get(services, PgClient.PgClient).unsafe<A>(statement);
+    }),
+  );
+
+const Confirmed = Schema.Struct({ generation: Schema.Int, byteOffset: Schema.Int });
+const decodeConfirmed = Schema.decodeUnknownEffect(Schema.fromJsonString(Confirmed));
+
+interface StoredEvent {
+  readonly message: string;
+  readonly severity: string | null;
+  readonly host: string | null;
+  readonly timestamp: string;
+}
+
+/** The table Logflare's Postgres backend stores a source's events in, once the source exists. */
+const eventsTable = (internalDatabaseUrl: string, source: string) =>
+  query<{ readonly token: string }>(
+    internalDatabaseUrl,
+    `SELECT replace(token::text, '-', '_') AS token FROM _analytics.sources WHERE name = '${source}'`,
+  ).pipe(
+    Effect.map(([row]) => (row === undefined ? undefined : `_analytics."log_events_${row.token}"`)),
+  );
+
+const database: ServiceCreationInput = {
+  service: "database",
+  config: {
+    version: "17",
+    databasePassword: Redacted.make("owner-logs-password"),
+    jwtSecret: Redacted.make("owner-logs-jwt-secret-with-at-least-32-chars"),
+    jwtExpiry: 3600,
+  },
+  endpoints: { sql: { port: "auto" } },
+};
+const analytics: ServiceCreationInput = {
+  service: "analytics",
+  config: { backend: "postgres", apiKey: "owner-logs-key" },
+  endpoints: { http: { port: "auto" } },
+};
+
+/**
+ * Starts an owner composing `services` in a fresh Docker stack. Its Analytics wakes on proxy
+ * traffic, which `keepAwake` keeps sending while events must persist.
+ */
+const startStack = (
+  name: string,
+  services: ReadonlyArray<ServiceCreationInput>,
+  analyticsIdleMillis?: number,
+) =>
+  Effect.gen(function* () {
+    const path = yield* Path.Path;
+    const crypto = yield* Crypto.Crypto;
+    const client = yield* HttpClient.HttpClient;
+    const stackId = `${name}-${(yield* crypto.randomUUIDv4).slice(0, 8)}`;
+    const root = yield* makeDockerDatabaseRoot(`stack-${name}-`, stackId);
+    const saved: SavedStack = {
+      id: stackId,
+      identity: { projectRoot: "/tmp/project", branchContext: name, stackName: stackId },
+      runtime: "docker",
+      instances: [],
+      lifetime: "detached",
+      composition: { members: [], dependencies: [] },
+      ports: [],
+    };
+    const state = Context.get(
+      yield* Layer.build(State.layer({ root: path.dirname(path.dirname(root)) })),
+      State.Service,
+    );
+    yield* state.save(saved);
+    const owner = yield* ownerFor({ saved, state, root, cacheRoot });
+    yield* Effect.addFinalizer(() => owner.namespace.destroy.pipe(Effect.ignore));
+
+    const composed = yield* owner.rpc.supabaseComposition({ services });
+    const idOf = (service: string) => {
+      const id = composed.find((entry) => entry.creation.service === service)?.id;
+      return id === undefined ? Effect.die(`${service} was not composed`) : Effect.succeed(id);
+    };
+    const analyticsId = yield* idOf("analytics");
+    if (analyticsIdleMillis !== undefined) {
+      const composition = (yield* state.read(stackId))?.composition;
+      if (composition === undefined) return yield* Effect.die("composition was not saved");
+      yield* owner.rpc.configureComposition({
+        ...composition,
+        members: composition.members.map((member) =>
+          member.id === analyticsId ? { ...member, idleMillis: analyticsIdleMillis } : member,
+        ),
+      });
+    }
+    yield* owner.rpc.startComposition();
+
+    const analyticsUrl = (yield* owner.rpc.credentials({ id: analyticsId, from: "host" })).url;
+    if (analyticsUrl === undefined) return yield* Effect.die("the Analytics URL is missing");
+    const awaitAnalytics = (
+      predicate: (observation: {
+        lifecycle: string;
+        health?: string;
+        wakeEnabled: boolean;
+      }) => boolean,
+    ) =>
+      owner.rpc
+        .followStatus({ id: analyticsId })
+        .pipe(Stream.filter(predicate), Stream.take(1), Stream.runDrain);
+    return {
+      owner,
+      state,
+      stackId,
+      idOf,
+      analyticsUrl,
+      awaitAnalytics,
+      wakeAnalytics: client
+        .get(`${analyticsUrl}/health`)
+        .pipe(
+          Effect.andThen(
+            awaitAnalytics(
+              ({ lifecycle, health }) => lifecycle === "running" && health === "healthy",
+            ),
+          ),
+        ),
+      keepAwake: client
+        .get(`${analyticsUrl}/health`)
+        .pipe(Effect.ignore, Effect.repeat(Schedule.spaced("1 second"))),
+    };
+  });
+
+it.live(
+  "ships persisted service logs to Analytics, catching up after it wakes from idle",
+  () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const client = yield* HttpClient.HttpClient;
+        // A short idle timer lets the test observe Analytics sleeping while services keep logging.
+        const { owner, state, stackId, idOf, awaitAnalytics, wakeAnalytics, keepAwake } =
+          yield* startStack(
+            "owner-logs",
+            [
+              database,
+              { service: "rest", config: {}, endpoints: { http: { port: "auto" } } },
+              analytics,
+            ],
+            3_000,
+          );
+        const [databaseId, restId] = yield* Effect.all([idOf("database"), idOf("rest")]);
+        const { databaseUrl, internalDatabaseUrl } = yield* owner.rpc.credentials({
+          id: databaseId,
+          from: "host",
+        });
+        const rest = yield* owner.rpc.credentials({ id: restId, from: "host" });
+        if (databaseUrl === undefined || internalDatabaseUrl === undefined)
+          return yield* Effect.die("database credentials are missing");
+        if (rest.url === undefined) return yield* Effect.die("the REST URL is missing");
+
+        const raise = (marker: string) =>
+          query(databaseUrl, `DO $$ BEGIN RAISE LOG '${marker}'; END $$`);
+        const stored = (source: string, filter: string) =>
+          Effect.gen(function* () {
+            const table = yield* eventsTable(internalDatabaseUrl, source);
+            if (table === undefined) return [];
+            return yield* query<StoredEvent>(
+              internalDatabaseUrl,
+              `SELECT body->>'event_message' AS message, body->'metadata'->'parsed'->>'error_severity' AS severity, body->'metadata'->>'host' AS host, to_char(timestamp, 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"') AS timestamp FROM ${table} WHERE ${filter}`,
+            );
+          });
+        // Logflare ingests asynchronously and exposes no completion signal; polling is the guard.
+        const awaitStored = (source: string, filter: string) =>
+          stored(source, filter).pipe(
+            Effect.filterOrFail((rows) => rows.length > 0),
+            Effect.retry(Schedule.spaced("500 millis")),
+            Effect.timeout("120 seconds"),
+          );
+
+        yield* wakeAnalytics;
+        const keeper = yield* Effect.forkScoped(keepAwake);
+        const awakeMarker = `${stackId}-awake`;
+        yield* raise(awakeMarker);
+        expect(
+          yield* awaitStored(
+            "postgres.logs",
+            `body->>'event_message' LIKE '%LOG:  ${awakeMarker}'`,
+          ),
+        ).toEqual([
+          {
+            message: expect.stringContaining(`LOG:  ${awakeMarker}`),
+            severity: "LOG",
+            host: "db-default",
+            timestamp: expect.any(String),
+          },
+        ]);
+        // The cursor passes a body only once shipping read its events back from Analytics' tables.
+        const awakeRecord = Option.getOrUndefined(
+          yield* owner.rpc.readLogs({ id: databaseId, follow: false }).pipe(
+            Stream.filter((record) => record.text?.includes(`LOG:  ${awakeMarker}`) === true),
+            Stream.runHead,
+          ),
+        );
+        const passedAwake = ({ generation, byteOffset }: typeof Confirmed.Type) =>
+          awakeRecord?.position !== undefined &&
+          (generation > awakeRecord.position.generation ||
+            (generation === awakeRecord.position.generation &&
+              byteOffset >= awakeRecord.position.byteOffset));
+        const confirmed = yield* fs
+          .readFileString(path.join(state.logsRoot(stackId), "database", databaseId, "cursor.json"))
+          .pipe(
+            Effect.flatMap(decodeConfirmed),
+            Effect.filterOrFail(passedAwake),
+            Effect.retry(Schedule.spaced("250 millis")),
+            Effect.timeout("60 seconds"),
+          );
+        expect(passedAwake(confirmed)).toBe(true);
+        const restPath = `/${stackId}-probe`;
+        yield* client.get(`${rest.url}${restPath}`);
+        expect(
+          yield* awaitStored("postgREST.logs.prod", `body->'metadata'->>'path' = '${restPath}'`),
+        ).toEqual([
+          {
+            message: expect.stringContaining(`"GET ${restPath} HTTP/1.1" 404`),
+            severity: null,
+            host: "default",
+            timestamp: expect.any(String),
+          },
+        ]);
+
+        yield* Fiber.interrupt(keeper);
+        const noise = yield* Effect.forkScoped(
+          raise(`${stackId}-noise`).pipe(Effect.repeat(Schedule.spaced("250 millis"))),
+        );
+        yield* awaitAnalytics(
+          ({ lifecycle, wakeEnabled }) => lifecycle === "stopped" && wakeEnabled,
+        ).pipe(Effect.timeout("90 seconds"));
+        yield* Fiber.interrupt(noise);
+        const asleepMarker = `${stackId}-asleep`;
+        const persistedAsleep = yield* owner.rpc.readLogs({ id: databaseId, follow: true }).pipe(
+          Stream.filter((record) => record.text?.includes(`LOG:  ${asleepMarker}`) === true),
+          Stream.runHead,
+          Effect.forkScoped,
+        );
+        const raisedAt = DateTime.toEpochMillis(yield* DateTime.now);
+        yield* raise(asleepMarker);
+        const asleepRecord = Option.getOrUndefined(yield* Fiber.join(persistedAsleep));
+        const wakeRequestedAt = DateTime.toEpochMillis(yield* DateTime.now);
+
+        yield* wakeAnalytics;
+        yield* Effect.forkScoped(keepAwake);
+        const [shippedAsleep] = yield* awaitStored(
+          "postgres.logs",
+          `body->>'event_message' LIKE '%LOG:  ${asleepMarker}'`,
+        );
+        expect(shippedAsleep?.timestamp).toBe(asleepRecord?.timestamp);
+        // The owner stamps a line with host time on arrival, possibly in the millisecond it is read.
+        const shippedAt = Date.parse(shippedAsleep?.timestamp ?? "");
+        expect(shippedAt).toBeGreaterThanOrEqual(raisedAt);
+        expect(shippedAt).toBeLessThanOrEqual(wakeRequestedAt);
+      }),
+    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  { timeout: 600_000 },
+);
+
+it.live(
+  "Logflare accepts a batch holding an already stored id and then stores none of its events",
+  () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const crypto = yield* Crypto.Crypto;
+        const client = yield* HttpClient.HttpClient;
+        const { owner, idOf, analyticsUrl, wakeAnalytics, keepAwake } = yield* startStack(
+          "owner-logflare",
+          [database, analytics],
+        );
+        const { internalDatabaseUrl } = yield* owner.rpc.credentials({
+          id: yield* idOf("database"),
+          from: "host",
+        });
+        if (internalDatabaseUrl === undefined)
+          return yield* Effect.die("database credentials are missing");
+        // No composed service ships to this source, so only this test's posts reach its batches.
+        const source = logflareSources.realtime;
+        const event = Effect.fnUntraced(function* (message: string) {
+          const id = yield* crypto.randomUUIDv4;
+          const timestamp = DateTime.formatIso(yield* DateTime.now);
+          return { id, ...logflareEvent("realtime", timestamp, message) };
+        });
+        const post = (events: ReadonlyArray<{ readonly id: string }>) =>
+          client
+            .execute(
+              HttpClientRequest.post(`${analyticsUrl}/api/logs`).pipe(
+                HttpClientRequest.setUrlParam("source_name", source),
+                HttpClientRequest.setHeader("x-api-key", "owner-logs-key"),
+                HttpClientRequest.bodyText(JSON.stringify({ batch: events }), "application/json"),
+              ),
+            )
+            .pipe(Effect.flatMap(HttpClientResponse.filterStatusOk));
+        const storedIds = (ids: ReadonlyArray<string>) =>
+          Effect.gen(function* () {
+            const table = yield* eventsTable(internalDatabaseUrl, source);
+            if (table === undefined) return [];
+            const rows = yield* query<{ readonly id: string }>(
+              internalDatabaseUrl,
+              `SELECT id::text AS id FROM ${table} WHERE id IN (${ids.map((id) => `'${id}'`).join(", ")})`,
+            );
+            return rows.map(({ id }) => id);
+          });
+        // Logflare ingests asynchronously and exposes no completion signal; polling is the guard.
+        const awaitStored = (id: string, attempts: number) =>
+          storedIds([id]).pipe(
+            Effect.filterOrFail((rows) => rows.length > 0),
+            Effect.retry({ schedule: Schedule.spaced("500 millis"), times: attempts }),
+          );
+
+        yield* wakeAnalytics;
+        yield* Effect.forkScoped(keepAwake);
+        const first = yield* event("stored first");
+        yield* post([first]);
+        yield* awaitStored(first.id, 240);
+        const added = [yield* event("added 1"), yield* event("added 2")];
+        yield* post([{ ...first, event_message: "stored again" }, ...added]);
+        // A stored sentinel shows Logflare processed the batch before it; a sentinel inserted with
+        // that batch is dropped too, so fresh ones follow until one is stored.
+        yield* event("sentinel").pipe(
+          Effect.tap((sentinel) => post([sentinel])),
+          Effect.flatMap(({ id }) => awaitStored(id, 10)),
+          Effect.retry({ times: 24 }),
+        );
+
+        expect(yield* storedIds([first.id, ...added.map(({ id }) => id)])).toEqual([first.id]);
+      }),
+    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+  { timeout: 600_000 },
+);
diff --git a/packages/stack/src/Owner.logs.integration.test.ts b/packages/stack/src/Owner.logs.integration.test.ts
new file mode 100644
index 0000000000..0d85931690
--- /dev/null
+++ b/packages/stack/src/Owner.logs.integration.test.ts
@@ -0,0 +1,347 @@
+import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { describe, expect, it } from "@effect/vitest";
+import {
+  Context,
+  Crypto,
+  Effect,
+  Exit,
+  Fiber,
+  FileSystem,
+  Layer,
+  Path,
+  Queue,
+  Redacted,
+  Scope,
+  Stream,
+} from "effect";
+import { tmpdir } from "node:os";
+import { ownerFor } from "../tests/owner-rpc.ts";
+import type { LogRecord } from "./host/LogRecord.ts";
+import { StackError, streamStackLogs } from "./effect.ts";
+import * as LogStore from "./host/LogStore.ts";
+import * as State from "./State.ts";
+import type { SavedStack } from "./State.ts";
+
+const cacheRoot = `${tmpdir()}/supabase-stack-artifacts`;
+const services = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+
+const stackFor = (id: string, runtime: SavedStack["runtime"]): SavedStack => ({
+  id,
+  identity: { projectRoot: "/tmp/project", branchContext: "owner-logs-test", stackName: id },
+  runtime,
+  instances: [],
+  lifetime: "detached",
+  composition: { members: [], dependencies: [] },
+  ports: [],
+});
+
+/** Opens an owner that destroys its stack on scope exit unless `kept` preserves it for a later read. */
+const openOwner = (
+  prefix: string,
+  runtime: SavedStack["runtime"],
+  kept?: { readonly root: string },
+) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const crypto = yield* Crypto.Crypto;
+    const root = kept?.root ?? (yield* fs.makeTempDirectoryScoped({ prefix }));
+    const stack = stackFor(
+      `owner-logs-${(yield* crypto.randomUUIDv4).replaceAll("-", "")}`,
+      runtime,
+    );
+    const state = Context.get(
+      yield* Layer.build(State.layer({ root: `${root}/state` })),
+      State.Service,
+    );
+    yield* state.save(stack);
+    const owner = yield* ownerFor({ saved: stack, state, root: `${root}/data`, cacheRoot });
+    if (kept === undefined)
+      yield* Effect.addFinalizer(() => owner.namespace.destroy.pipe(Effect.ignore));
+    return {
+      ...owner,
+      state,
+      stack,
+      stateRoot: `${root}/state`,
+      logsRoot: state.logsRoot(stack.id),
+    };
+  });
+
+const isOutput = (record: LogRecord) => record.kind === "stdout" || record.kind === "stderr";
+
+const firstOutput = (records: Stream.Stream<LogRecord, StackError>) =>
+  records.pipe(Stream.filter(isOutput), Stream.take(1), Stream.runCollect);
+
+/** Follows from the oldest record until `count` launch markers are persisted. */
+const awaitLaunches = (records: Stream.Stream<LogRecord, StackError>, count: number) =>
+  records.pipe(
+    Stream.filter(({ kind }) => kind === "launch"),
+    Stream.take(count),
+    Stream.runDrain,
+    Effect.forkScoped({ startImmediately: true }),
+  );
+
+describe("owner persisted logs", () => {
+  it.live("persists native output, serves history and follow, and deletes it on destroy", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const owner = yield* openOwner("owner-logs-native-", "native");
+        const mail = yield* owner.rpc.createService({
+          service: "mail",
+          config: {},
+          endpoints: { http: { port: "auto" } },
+        });
+        yield* owner.rpc.startService({ id: mail.id });
+        yield* owner.rpc.readyService({ id: mail.id });
+
+        const [followed] = yield* firstOutput(owner.rpc.readLogs({ id: mail.id, follow: true }));
+        const history = Array.from(
+          yield* owner.rpc.readLogs({ id: mail.id, follow: false }).pipe(Stream.runCollect),
+        );
+
+        expect(history[0]).toMatchObject({ kind: "launch", launchId: 1 });
+        expect(history).toContainEqual(followed);
+        const directory = path.join(owner.logsRoot, "mail", mail.id);
+        expect(yield* fs.exists(directory)).toBe(true);
+        const offline = yield* LogStore.streamStackLogs({ root: owner.logsRoot }).pipe(
+          Stream.runCollect,
+        );
+        expect(offline.slice(0, history.length).map(({ position }) => position)).toEqual(
+          history.map(({ position }) => position),
+        );
+
+        yield* owner.rpc.destroyService({ id: mail.id });
+        expect(yield* fs.exists(directory)).toBe(false);
+      }),
+    ).pipe(Effect.provide(services)),
+  );
+
+  it.live("streams history through the public API after the owner stops", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const root = yield* fs.makeTempDirectoryScoped({ prefix: "owner-logs-offline-" });
+        const ownerScope = yield* Scope.make();
+        const owner = yield* openOwner("owner-logs-offline-", "native", { root }).pipe(
+          Scope.provide(ownerScope),
+        );
+        const mail = yield* owner.rpc.createService({
+          service: "mail",
+          config: {},
+          endpoints: { http: { port: "auto" } },
+        });
+        yield* owner.rpc.startService({ id: mail.id });
+        yield* owner.rpc.readyService({ id: mail.id });
+        const [followed] = yield* firstOutput(owner.rpc.readLogs({ id: mail.id, follow: true }));
+        yield* owner.rpc.stopService({ id: mail.id });
+        yield* Scope.close(ownerScope, Exit.void);
+
+        const selection = { stateRoot: owner.stateRoot, stackId: owner.stack.id };
+        const records = yield* streamStackLogs(selection).pipe(Stream.runCollect);
+        const invalid = yield* streamStackLogs({ ...selection, since: "soon" }).pipe(
+          Stream.runDrain,
+          Effect.flip,
+        );
+
+        expect(records[0]).toMatchObject({ kind: "launch", service: "mail", instanceId: mail.id });
+        expect(records.map(({ text }) => text)).toContain(followed?.text);
+        expect(invalid).toBeInstanceOf(StackError);
+      }),
+    ).pipe(Effect.provide(services)),
+  );
+
+  it.live("continues an instance's launch ids after the owner restarts", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const root = yield* fs.makeTempDirectoryScoped({ prefix: "owner-logs-relaunch-" });
+        const firstRun = yield* Scope.make();
+        const owner = yield* openOwner("owner-logs-relaunch-", "native", { root }).pipe(
+          Scope.provide(firstRun),
+        );
+        const mail = yield* owner.rpc.createService({
+          service: "mail",
+          config: {},
+          endpoints: { http: { port: "auto" } },
+        });
+        yield* owner.rpc.startService({ id: mail.id });
+        yield* owner.rpc.readyService({ id: mail.id });
+        yield* owner.rpc.stopService({ id: mail.id });
+        yield* Scope.close(firstRun, Exit.void);
+        const state = Context.get(
+          yield* Layer.build(State.layer({ root: owner.stateRoot })),
+          State.Service,
+        );
+        const saved = yield* state.read(owner.stack.id);
+        if (saved === undefined) return yield* Effect.die("stack state missing");
+        const restarted = yield* ownerFor({ saved, state, root: `${root}/data`, cacheRoot });
+        yield* Effect.addFinalizer(() => restarted.namespace.destroy.pipe(Effect.ignore));
+
+        const launched = yield* awaitLaunches(
+          restarted.rpc.readLogs({ id: mail.id, follow: true }),
+          2,
+        );
+        yield* restarted.rpc.startService({ id: mail.id });
+        yield* restarted.rpc.readyService({ id: mail.id });
+        yield* Fiber.join(launched);
+        const records = yield* restarted.rpc
+          .readLogs({ id: mail.id, follow: false })
+          .pipe(Stream.runCollect);
+
+        expect(
+          records.filter(({ kind }) => kind === "launch").map(({ launchId }) => launchId),
+        ).toEqual([1, 2]);
+      }),
+    ).pipe(Effect.provide(services)),
+  );
+
+  it.live("continues after the launch ids in its logs when its saved state has none", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const root = yield* fs.makeTempDirectoryScoped({ prefix: "owner-logs-unsaved-launch-" });
+        const firstRun = yield* Scope.make();
+        const owner = yield* openOwner("owner-logs-unsaved-launch-", "native", { root }).pipe(
+          Scope.provide(firstRun),
+        );
+        const mail = yield* owner.rpc.createService({
+          service: "mail",
+          config: {},
+          endpoints: { http: { port: "auto" } },
+        });
+        yield* Scope.close(firstRun, Exit.void);
+        const state = Context.get(
+          yield* Layer.build(State.layer({ root: owner.stateRoot })),
+          State.Service,
+        );
+        const saved = yield* state.read(owner.stack.id);
+        if (saved === undefined) return yield* Effect.die("stack state missing");
+        // Logs a state saved before launch ids were persisted left behind at launch 3.
+        const directory = `${owner.logsRoot}/mail/${mail.id}`;
+        yield* fs.makeDirectory(directory, { recursive: true });
+        yield* fs.writeFileString(
+          `${directory}/0000000001.log`,
+          "2026-01-01T00:00:00.000Z launch 3 | \n2026-01-01T00:00:00.001Z stdout 3 | earlier\n",
+        );
+        const restarted = yield* ownerFor({ saved, state, root: `${root}/data`, cacheRoot });
+        yield* Effect.addFinalizer(() => restarted.namespace.destroy.pipe(Effect.ignore));
+
+        const launched = yield* awaitLaunches(
+          restarted.rpc.readLogs({ id: mail.id, follow: true }),
+          2,
+        );
+        yield* restarted.rpc.startService({ id: mail.id });
+        yield* restarted.rpc.readyService({ id: mail.id });
+        yield* Fiber.join(launched);
+        const records = yield* restarted.rpc
+          .readLogs({ id: mail.id, follow: false })
+          .pipe(Stream.runCollect);
+
+        expect(saved.instances.find(({ id }) => id === mail.id)?.launchId).toBeUndefined();
+        expect(
+          records.filter(({ kind }) => kind === "launch").map(({ launchId }) => launchId),
+        ).toEqual([3, 4]);
+      }),
+    ).pipe(Effect.provide(services)),
+  );
+
+  it.live("resumes a follow at a record position without replaying earlier records", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const owner = yield* openOwner("owner-logs-resume-", "native");
+        const mail = yield* owner.rpc.createService({
+          service: "mail",
+          config: {},
+          endpoints: { http: { port: "auto" } },
+        });
+        yield* owner.rpc.startService({ id: mail.id });
+        yield* owner.rpc.readyService({ id: mail.id });
+        const history = Array.from(
+          yield* owner.rpc.readLogs({ id: mail.id, follow: false }).pipe(Stream.runCollect),
+        );
+        const last = history.at(-1);
+        if (last?.position === undefined) return yield* Effect.die("mail wrote no records");
+        const resumed = yield* Queue.unbounded<LogRecord>();
+        yield* owner.rpc.readLogs({ id: mail.id, from: last.position, follow: true }).pipe(
+          Stream.runForEach((record) => Queue.offer(resumed, record)),
+          Effect.forkScoped,
+        );
+
+        yield* owner.rpc.restartService({ id: mail.id });
+        const first = yield* Queue.take(resumed);
+        const relaunched = yield* Queue.take(resumed).pipe(
+          Effect.repeat({ until: (record) => record.kind === "launch" }),
+        );
+
+        expect(first).toEqual(last);
+        expect(relaunched).toMatchObject({ kind: "launch", launchId: 2 });
+      }),
+    ).pipe(Effect.provide(services)),
+  );
+
+  it.live(
+    "keeps database logs across a data reset and removes all logs with the stack",
+    () =>
+      Effect.scoped(
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const owner = yield* openOwner("owner-logs-reset-", "native");
+          const database = yield* owner.rpc.createService({
+            service: "database",
+            config: {
+              version: "17",
+              databasePassword: Redacted.make("owner-logs-reset-password"),
+              jwtExpiry: 3600,
+            },
+            endpoints: { sql: { port: "auto" } },
+          });
+          yield* owner.rpc.startService({ id: database.id });
+          yield* owner.rpc.readyService({ id: database.id });
+          yield* owner.rpc.stopService({ id: database.id });
+          const before = Array.from(
+            yield* owner.rpc.readLogs({ id: database.id, follow: false }).pipe(Stream.runCollect),
+          );
+
+          yield* owner.rpc.resetData({ id: database.id });
+          const after = Array.from(
+            yield* owner.rpc.readLogs({ id: database.id, follow: false }).pipe(Stream.runCollect),
+          );
+
+          expect(before.some(isOutput)).toBe(true);
+          expect(after.slice(0, before.length)).toEqual(before);
+          yield* owner.namespace.destroy;
+          expect(yield* fs.exists(owner.logsRoot)).toBe(false);
+        }),
+      ).pipe(Effect.provide(services)),
+    { timeout: 120_000 },
+  );
+
+  it.live.skipIf(process.platform === "win32")(
+    "persists container output",
+    () =>
+      Effect.scoped(
+        Effect.gen(function* () {
+          const owner = yield* openOwner("owner-logs-docker-", "docker");
+          const mail = yield* owner.rpc.createService({
+            service: "mail",
+            config: {},
+            endpoints: { http: { port: "auto" } },
+          });
+          yield* owner.rpc.startService({ id: mail.id });
+          yield* owner.rpc.readyService({ id: mail.id });
+
+          const [followed] = yield* firstOutput(owner.rpc.readLogs({ id: mail.id, follow: true }));
+          const persisted = yield* LogStore.streamStackLogs({ root: owner.logsRoot }).pipe(
+            Stream.runCollect,
+          );
+
+          expect(followed).toMatchObject({ launchId: 1 });
+          expect(Array.from(persisted, ({ position }) => position)).toContainEqual(
+            followed?.position,
+          );
+        }),
+      ).pipe(Effect.provide(services)),
+    { timeout: 120_000 },
+  );
+});
diff --git a/packages/stack/src/Owner.ts b/packages/stack/src/Owner.ts
index b36d9fcfa1..d8549c3956 100644
--- a/packages/stack/src/Owner.ts
+++ b/packages/stack/src/Owner.ts
@@ -67,6 +67,9 @@ import { stackError, type OwnerRpc } from "./Rpc.ts";
 import * as State from "./State.ts";
 import type { SavedStack, StackCredentials, StackKeysInput } from "./State.ts";
 import { makeDockerHelperRegistry } from "./storage/DockerHelperRegistry.ts";
+import * as LogForwarder from "./host/LogForwarder.ts";
+import * as LogflareStorage from "./host/LogflareStorage.ts";
+import * as LogStore from "./host/LogStore.ts";
 
 export interface OwnerOptions {
   readonly saved: SavedStack;
@@ -184,6 +187,35 @@ const makeOwner = Effect.fn("Owner.make")(function* (options: OwnerOptions) {
   const network = yield* Network.Service;
   const orchestrator = yield* Orchestrator.make<Entry>();
   const helpers = yield* makeDockerHelperRegistry(yield* crypto.randomUUIDv4);
+  const logStore = yield* LogStore.make({ root: options.state.logsRoot(options.saved.id) }).pipe(
+    Effect.provideContext(services),
+  );
+  /** The database Analytics stores events in, as the host reaches it. */
+  const analyticsDatabase = (analyticsId: string) =>
+    Effect.gen(function* () {
+      const creation = yield* Ref.get((yield* orchestrator.get(analyticsId)).creation);
+      const databaseUrl =
+        creation.service === "analytics" ? creation.config.databaseUrl : undefined;
+      if (databaseUrl === undefined)
+        return yield* new ServiceError({
+          operation: "analytics",
+          message: "Analytics has no database URL",
+        });
+      const dependency = (yield* orchestrator.composition).dependencies.find(
+        ({ to, bindings }) =>
+          to === analyticsId && bindings?.some(({ input }) => input === "databaseUrl") === true,
+      );
+      const bound =
+        dependency === undefined
+          ? undefined
+          : yield* (yield* orchestrator.get(dependency.from)).recipe.endpoint("sql");
+      return yield* LogflareStorage.analyticsDatabase(databaseUrl, bound);
+    });
+  const forwarder = yield* LogForwarder.make({
+    composition: orchestrator.composition,
+    logs: logStore,
+    storedEvents: (analytics) => LogflareStorage.make(analyticsDatabase(analytics.id)),
+  }).pipe(Effect.provideContext(services));
   const definitionGate = yield* Semaphore.make(1);
   const draining = yield* Ref.make(false);
   const { id: stackId, runtime } = options.saved;
@@ -288,39 +320,59 @@ const makeOwner = Effect.fn("Owner.make")(function* (options: OwnerOptions) {
   });
 
   const recipeFor = (creation: ServiceCreation, id: string) =>
-    makeServiceRecipe(creation, {
-      stackId,
-      instanceId: id,
-      project,
-      root: options.root,
-      cacheRoot: options.cacheRoot,
-      runtime,
-      helpers,
-      ...(options.hostGateway === undefined ? {} : { hostGateway: options.hostGateway }),
-    }).pipe(Effect.provideContext(services));
-
-  const persistCreation = (entry: Pick<Entry, "id" | "creation">, creation: ServiceCreation) =>
+    makeServiceRecipe(
+      creation,
+      {
+        stackId,
+        instanceId: id,
+        project,
+        root: options.root,
+        cacheRoot: options.cacheRoot,
+        runtime,
+        helpers,
+        ...(options.hostGateway === undefined ? {} : { hostGateway: options.hostGateway }),
+      },
+      options.state.claims,
+    ).pipe(Effect.provideContext(services));
+
+  const persistCreation = (
+    entry: Pick<Entry, "id" | "creation">,
+    creation: ServiceCreation,
+    launchId?: number,
+  ) =>
     updateState((current) => ({
       ...current,
       instances: current.instances.map((instance) =>
-        instance.id === entry.id ? { ...instance, creation } : instance,
+        instance.id === entry.id
+          ? { ...instance, creation, ...(launchId === undefined ? {} : { launchId }) }
+          : instance,
       ),
     })).pipe(Effect.andThen(Ref.set(entry.creation, creation)));
 
-  const register = Effect.fn("Owner.register")(function* (id: string, recipe: CatalogRecipe) {
+  const register = Effect.fn("Owner.register")(function* (
+    id: string,
+    recipe: CatalogRecipe,
+    lastLaunchId?: number,
+  ) {
     if (Option.isSome(yield* orchestrator.get(id).pipe(Effect.option)))
       return yield* new Orchestrator.OrchestratorError({
         operation: "register",
         message: `Duplicate instance ${id}`,
       });
     const initial = recipe.creation;
+    // A state saved before launch ids were persisted continues after the ids its logs hold.
+    const resumeAfter =
+      lastLaunchId ??
+      Option.getOrUndefined(
+        yield* logStore.latestLaunchId({ service: initial.service, instanceId: id }),
+      );
     const creation = yield* Ref.make(initial);
     const namespaceRef = yield* Ref.make<NetworkNamespace | undefined>(undefined);
     const core = yield* makeService(
       {
         ...recipe.definition,
         launch: (context) =>
-          persistCreation({ id, creation }, context.config).pipe(
+          persistCreation({ id, creation }, context.config, context.launchId).pipe(
             Effect.mapError(serviceError("state")),
             Effect.andThen(recipe.definition.launch(context)),
           ),
@@ -337,11 +389,26 @@ const makeOwner = Effect.fn("Owner.make")(function* (options: OwnerOptions) {
                 Effect.mapError(serviceError("state")),
               ),
             ),
+            // Shipping writes its cursor into the instance's logs, so it stops before they go.
+            Effect.andThen(forwarder.detach(id)),
+            Effect.andThen(
+              logStore
+                .remove({ service: initial.service, instanceId: id })
+                .pipe(
+                  Effect.catch((cause) =>
+                    Effect.logWarning(
+                      `${cause.message}; the next owner start or stack destroy retries`,
+                      cause,
+                    ),
+                  ),
+                ),
+            ),
           ),
       },
       {
         id,
         config: initial,
+        ...(resumeAfter === undefined ? {} : { lastLaunchId: resumeAfter }),
         coordinate: (operation, transition) =>
           (drainingBlocks.includes(operation) ? rejectWhileDraining : Effect.void).pipe(
             Effect.andThen(orchestrator.admissionFor(id)(operation, transition)),
@@ -416,11 +483,28 @@ const makeOwner = Effect.fn("Owner.make")(function* (options: OwnerOptions) {
     yield* orchestrator
       .register(entry)
       .pipe(Effect.catch((cause) => namespace.release.pipe(Effect.andThen(Effect.fail(cause)))));
+    yield* logStore.attach({
+      service: initial.service,
+      instanceId: id,
+      logs: recipe.logs,
+      observation: core.observation,
+    });
+    yield* forwarder.attach({
+      id,
+      service: initial.service,
+      endpoint: recipe.endpoint,
+      creation: Ref.get(creation),
+      observation: core.observation,
+    });
   });
 
   for (const saved of options.saved.instances)
-    yield* register(saved.id, yield* recipeFor(saved.creation, saved.id));
+    yield* register(saved.id, yield* recipeFor(saved.creation, saved.id), saved.launchId);
+  yield* logStore.removeOrphans.pipe(
+    Effect.catch((cause) => Effect.logWarning("Orphaned instance logs were not removed", cause)),
+  );
   yield* orchestrator.configure(options.saved.composition);
+  yield* forwarder.rebind;
 
   const removeSaved = (id: string) => updateState((current) => withoutInstance(current, id));
 
@@ -442,14 +526,16 @@ const makeOwner = Effect.fn("Owner.make")(function* (options: OwnerOptions) {
 
   const configure = (configuration: CompositionConfig) =>
     options.state.withLock(
-      orchestrator.configure(
-        configuration,
-        readSaved.pipe(
-          Effect.flatMap((current) =>
-            options.state.save({ ...current, composition: configuration }),
+      orchestrator
+        .configure(
+          configuration,
+          readSaved.pipe(
+            Effect.flatMap((current) =>
+              options.state.save({ ...current, composition: configuration }),
+            ),
           ),
-        ),
-      ),
+        )
+        .pipe(Effect.andThen(forwarder.rebind)),
     );
 
   // A failed cleanup must not replace the failure that triggered it.
@@ -630,11 +716,17 @@ const makeOwner = Effect.fn("Owner.make")(function* (options: OwnerOptions) {
             ),
           ),
       ).pipe(Stream.mapError((cause) => stackError("followStatus", cause))),
-    logs: ({ id }) =>
-      Stream.unwrap(orchestrator.get(id).pipe(Effect.map((entry) => entry.recipe.logs))).pipe(
-        Stream.map(({ stream, bytes }) => ({ stream, bytes })),
-        Stream.mapError((cause) => stackError("logs", cause)),
-      ),
+    readLogs: ({ id, from, since, tail, follow }) =>
+      Stream.unwrap(
+        Effect.gen(function* () {
+          return yield* logStore.read(id, {
+            from: from ?? "oldest",
+            follow,
+            ...(since === undefined ? {} : { since: yield* LogStore.sinceMillis(since) }),
+            ...(tail === undefined ? {} : { tail }),
+          });
+        }),
+      ).pipe(Stream.mapError((cause) => stackError("readLogs", cause))),
     credentials: ({ id, from }) =>
       orchestrator.get(id).pipe(
         Effect.flatMap((entry) =>
@@ -695,6 +787,7 @@ const makeOwner = Effect.fn("Owner.make")(function* (options: OwnerOptions) {
       destroy: orchestrator.destroyNamespace.pipe(
         Effect.andThen(network.release),
         Effect.andThen(sweep),
+        Effect.andThen(logStore.close),
         Effect.andThen(options.state.remove(stackId)),
         definitionGate.withPermits(1),
         Effect.withSpan("Owner.destroyNamespace"),
diff --git a/packages/stack/src/Ports.integration.test.ts b/packages/stack/src/Ports.integration.test.ts
index e5c4f9bb0d..c7f4df0938 100644
--- a/packages/stack/src/Ports.integration.test.ts
+++ b/packages/stack/src/Ports.integration.test.ts
@@ -1,7 +1,7 @@
 import { NodeServices, NodeSocketServer } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import { Cause, Context, Effect, Exit, FileSystem, Layer, Option, Ref, Scope } from "effect";
-import { makePorts, PortError } from "./Ports.ts";
+import { makePorts, portBase, portSpan, PortError, reserveNativePort } from "./Ports.ts";
 import * as State from "./State.ts";
 
 const makeTestState = (root: string) =>
@@ -421,3 +421,91 @@ it.live("lets exactly one of two stacks sharing a saved port bind it when both s
     }),
   ).pipe(Effect.provide(NodeServices.layer)),
 );
+
+// Fixed so a test can force two reservations to the same candidate; production uses randomPortSpanStart.
+const fixedStart = Effect.succeed(0);
+
+// Binds a real listener directly in the native-reservation span, retrying past occupied
+// candidates, instead of reserving then releasing a port that something else could grab meanwhile.
+const bindBlockingPort = (host: string) =>
+  Effect.gen(function* () {
+    for (let offset = 0; offset < portSpan; offset++) {
+      const attempt = yield* Effect.exit(bind(host, portBase + offset));
+      if (Exit.isSuccess(attempt)) return { port: portBase + offset, listener: attempt.value };
+    }
+    return yield* Effect.die("No port in the native reservation span was free for the fixture");
+  });
+
+it.live("skips a native backend port claimed by another saved stack", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped();
+      const state = yield* makeTestState(root);
+
+      const probeScope = yield* Scope.make();
+      const probe = yield* reserveNativePort([], "pooler", fixedStart).pipe(
+        Effect.provideService(Scope.Scope, probeScope),
+      );
+      yield* Scope.close(probeScope, Exit.void);
+
+      yield* saveStack(state, root, "claimer", [
+        { key: "db/sql", host: "127.0.0.1", port: probe.port },
+      ]);
+
+      const reserved = yield* reserveNativePort(yield* state.claims, "pooler", fixedStart);
+      expect(reserved.port).not.toBe(probe.port);
+    }),
+  ).pipe(Effect.provide(NodeServices.layer)),
+);
+
+it.live("skips a native backend port a wildcard listener holds", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      // A wildcard bind is reachable through loopback, so a loopback-only probe would miss it.
+      const blocked = yield* bindBlockingPort("0.0.0.0");
+      const forcedStart = Effect.succeed(blocked.port - portBase);
+
+      const reserved = yield* reserveNativePort([], "pooler", forcedStart);
+      expect(reserved.port).not.toBe(blocked.port);
+    }),
+  ).pipe(Effect.provide(NodeServices.layer)),
+);
+
+it.live("excludes a port a previous attempt lost from the next reservation", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const firstScope = yield* Scope.make();
+      const first = yield* reserveNativePort([], "pooler", fixedStart).pipe(
+        Effect.provideService(Scope.Scope, firstScope),
+      );
+      yield* Scope.close(firstScope, Exit.void);
+
+      const second = yield* reserveNativePort([], "pooler", fixedStart, new Set([first.port]));
+      expect(second.port).not.toBe(first.port);
+    }),
+  ).pipe(Effect.provide(NodeServices.layer)),
+);
+
+it.live("skips a public auto candidate a loopback listener already holds", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped();
+      const state = yield* makeTestState(root);
+      yield* saveStack(state, root, "stack");
+      const ports = yield* makePorts(state);
+      // A container-runtime stack's bind to the wildcard host would otherwise succeed here too.
+      const request = { stackId: "stack", key: "api", host: "0.0.0.0", port: "auto" as const };
+      const accept = (_host: string, port: number) => Effect.succeed(port);
+
+      // A loopback-only listener keeps occupying the port while only its saved claim is released,
+      // so the next auto allocation has to skip it for real via loopbackOccupied, not a real bind.
+      const probe = yield* ports.acquire(request, (_host, port) => bind("127.0.0.1", port));
+      yield* ports.release("stack", "api");
+
+      const acquired = yield* ports.acquire(request, accept);
+      expect(acquired.port).not.toBe(probe.port);
+    }),
+  ).pipe(Effect.provide(NodeServices.layer)),
+);
diff --git a/packages/stack/src/Ports.ts b/packages/stack/src/Ports.ts
index d45216416b..8b55842335 100644
--- a/packages/stack/src/Ports.ts
+++ b/packages/stack/src/Ports.ts
@@ -1,10 +1,10 @@
-import { Cause, Data, Effect, Exit, Hash, Option, Scope } from "effect";
+import { Cause, Crypto, Data, Effect, Exit, Hash, Option, Scope } from "effect";
 import * as Net from "node:net";
 import type * as State from "./State.ts";
 
-const portBase = 20000;
+export const portBase = 20000;
 /** Stays below the Linux ephemeral range, per the [architecture ADR](../../../docs/adr/0017-simplified-managed-stack-architecture.md). */
-const portSpan = 12768;
+export const portSpan = 12768;
 /** Co-prime with the span, so the scan visits every port once and steps past reserved ranges. */
 const portStride = 257;
 
@@ -88,6 +88,100 @@ const resolveRequest = (
   return Effect.succeed({ saved, requested });
 };
 
+export interface NativePortReservation {
+  readonly port: number;
+  readonly server: Net.Server;
+}
+
+const closeNativePort = (server: Net.Server): Effect.Effect<void> =>
+  Effect.callback<void, never>((resume) => {
+    if (!server.listening) {
+      resume(Effect.void);
+      return Effect.void;
+    }
+    server.close(() => resume(Effect.void));
+    return Effect.void;
+  });
+
+const bindNativePort = (
+  key: string,
+  port: number,
+): Effect.Effect<NativePortReservation, PortError> =>
+  Effect.callback<NativePortReservation, PortError>((resume) => {
+    const server = Net.createServer((socket) => socket.destroy());
+    const onError = (cause: Error) =>
+      resume(
+        Effect.fail(
+          new PortError({ key, message: "Unable to reserve native service port", cause }),
+        ),
+      );
+    server.once("error", onError);
+    server.listen({ host: "127.0.0.1", port }, () => {
+      const address = server.address();
+      if (address === null || typeof address === "string") {
+        onError(new Error("Native service port reservation returned no address"));
+      } else {
+        resume(Effect.succeed({ port: address.port, server }));
+      }
+    });
+    return Effect.sync(() => {
+      server.off("error", onError);
+      if (server.listening) server.close();
+    });
+  });
+
+const emptyPortSet: ReadonlySet<number> = new Set();
+
+/** Random, so a reopened stack doesn't retry a backend port still in server-side `TIME_WAIT`. */
+export const randomPortSpanStart = (crypto: Crypto.Crypto): Effect.Effect<number> =>
+  crypto.randomIntBetween(0, portSpan, { halfOpen: true });
+
+/**
+ * Scans the below-ephemeral span for a backend port, skipping claimed and excluded ports; reuses
+ * `loopbackOccupied` so a wildcard listener a loopback-only bind would miss on macOS, BSD or
+ * Windows still rules out the candidate. Never persists one of its own.
+ */
+export const reserveNativePort = Effect.fn("Ports.reserveNativePort")(
+  (
+    claims: ReadonlyArray<State.StackClaims>,
+    key: string,
+    randomStart: Effect.Effect<number>,
+    excluded: ReadonlySet<number> = emptyPortSet,
+  ): Effect.Effect<NativePortReservation, PortError, Scope.Scope> =>
+    Effect.acquireRelease(
+      Effect.gen(function* () {
+        const claimed = new Set(claims.flatMap((stack) => stack.ports.map((claim) => claim.port)));
+        const start = yield* randomStart;
+        let failures = 0;
+        let lastFailure: PortError | undefined;
+        for (let attempt = 0; attempt < portSpan && failures < 64; attempt++) {
+          const port = portBase + ((start + attempt * portStride) % portSpan);
+          if (claimed.has(port) || excluded.has(port)) continue;
+          if (yield* loopbackOccupied(port)) {
+            failures++;
+            lastFailure = new PortError({ key, message: `Port ${port} is already in use` });
+            continue;
+          }
+          const result = yield* Effect.exit(bindNativePort(key, port));
+          if (Exit.isSuccess(result)) return result.value;
+          const error = Cause.findErrorOption(result.cause);
+          if (Option.isNone(error)) return yield* Effect.failCause(result.cause);
+          failures++;
+          lastFailure = error.value;
+        }
+        return yield* new PortError({
+          key,
+          message:
+            lastFailure === undefined
+              ? "No native service port is available"
+              : `No native service port is available: ${lastFailure.message}`,
+          cause: lastFailure,
+        });
+      }),
+      ({ server }) => closeNativePort(server),
+    ),
+);
+
 /** Claims steer auto allocation away from saved stacks; live listeners and binds decide conflicts for fixed ports. */
 export const makePorts = (state: State.Interface, platform: NodeJS.Platform = process.platform) =>
   Effect.sync(() => {
@@ -174,6 +268,14 @@ export const makePorts = (state: State.Interface, platform: NodeJS.Platform = pr
                 ? portBase + ((start + attempt * portStride) % portSpan)
                 : requested;
             if (requested === "auto" && claimed.has(port)) continue;
+            if (requested === "auto" && (yield* loopbackOccupied(port))) {
+              failures++;
+              lastFailure = new PortError({
+                key: request.key,
+                message: `Port ${port} is already in use`,
+              });
+              continue;
+            }
             const result = yield* Effect.uninterruptibleMask((restore) =>
               Effect.gen(function* () {
                 const scope = yield* Scope.fork(owner, "sequential");
diff --git a/packages/stack/src/PromiseClient.ts b/packages/stack/src/PromiseClient.ts
index e834f6cb37..245c83f748 100644
--- a/packages/stack/src/PromiseClient.ts
+++ b/packages/stack/src/PromiseClient.ts
@@ -35,8 +35,8 @@ type PlainArguments<P extends ReadonlyArray<unknown>> = { [K in keyof P]: Plain<
 type Effectful = Effect.Effect<unknown, unknown, unknown>;
 /**
  * The Promise form of an Effect handle: an Effect becomes a call, an Effect-returning function
- * gains trailing call options and plain inputs, and a Stream becomes an async iterable. Results
- * are data; operations that return handles are adapted explicitly.
+ * gains trailing call options and plain inputs, and a Stream, or a function returning one, yields
+ * an async iterable. Results are data; operations that return handles are adapted explicitly.
  */
 export type Promised<T> = T extends Effectful
   ? (options?: CallOptions) => Promise<Effect.Success<T>>
@@ -45,7 +45,9 @@ export type Promised<T> = T extends Effectful
     : T extends (...args: infer P) => infer R
       ? R extends Effectful
         ? (...args: [...PlainArguments<P>, callOptions?: CallOptions]) => Promise<Effect.Success<R>>
-        : T
+        : R extends Stream.Stream<infer A, unknown, unknown>
+          ? (...args: PlainArguments<P>) => AsyncIterable<A>
+          : T
       : T extends object
         ? { readonly [K in keyof T]: Promised<T[K]> }
         : T;
@@ -264,7 +266,11 @@ const isCallOptions = (value: unknown): value is CallOptions =>
 /** Adapts the operations of an Effect handle; their results pass through as data. */
 const makeAdapter = (client: Client) => {
   const call = (result: unknown, options: CallOptions | undefined) =>
-    isOperation(result) ? client.run(result, options) : result;
+    isOperation(result)
+      ? client.run(result, options)
+      : isStream(result)
+        ? client.iterable(result)
+        : result;
   function promised<T>(value: T): Promised<T>;
   function promised(value: unknown): unknown {
     if (isStream(value)) return () => client.iterable(value);
diff --git a/packages/stack/src/Rpc.ts b/packages/stack/src/Rpc.ts
index 9b296509c4..873f1b7b70 100644
--- a/packages/stack/src/Rpc.ts
+++ b/packages/stack/src/Rpc.ts
@@ -6,6 +6,7 @@ import { causeMessage, CompositionConfig, OrchestratorError } from "./Orchestrat
 import { CommandInvocation } from "./Commands.ts";
 import { StackKeysInput } from "./State.ts";
 import { failureMessage } from "./internal/failure-message.ts";
+import { LogPosition, LogRecord } from "./host/LogRecord.ts";
 
 const Outcome = Schema.Struct({
   id: Schema.String,
@@ -79,11 +80,9 @@ export const Definition = Schema.Struct({ id: Schema.String, creation: ServiceCr
 export interface Definition extends Schema.Schema.Type<typeof Definition> {}
 
 const Instance = { id: Schema.String };
+/** How many of the latest log records a read starts with. */
+const LogTail = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));
 const SnapshotScope = Schema.Literals(snapshotScopes);
-const Log = Schema.Struct({
-  stream: Schema.Literals(["stdout", "stderr"]),
-  bytes: Schema.Uint8ArrayFromBase64,
-});
 
 export const CommandEvent = Schema.TaggedUnion({
   Attached: { attachmentId: Schema.String },
@@ -120,7 +119,18 @@ export const OwnerRpc = RpcGroup.make(
     error: StackError,
     stream: true,
   }),
-  Rpc.make("logs", { payload: Instance, success: Log, error: StackError, stream: true }),
+  Rpc.make("readLogs", {
+    payload: {
+      ...Instance,
+      from: Schema.optionalKey(LogPosition),
+      since: Schema.optionalKey(Schema.String),
+      tail: Schema.optionalKey(LogTail),
+      follow: Schema.Boolean,
+    },
+    success: LogRecord,
+    error: StackError,
+    stream: true,
+  }),
   Rpc.make("credentials", {
     payload: { ...Instance, from: Schema.Literals(["host", "runtime"]) },
     success: Schema.Record(Schema.String, Schema.String),
diff --git a/packages/stack/src/Service.ts b/packages/stack/src/Service.ts
index d711c7faa6..17e0e0883a 100644
--- a/packages/stack/src/Service.ts
+++ b/packages/stack/src/Service.ts
@@ -84,7 +84,7 @@ export interface ServiceDefinition<Config> {
   readonly prepare?: (config: Config) => Effect.Effect<void, ServiceError>;
   /** Failures after resource acquisition carry the session for ordinary cleanup. */
   readonly launch: (
-    context: ServiceInstanceContext<Config>,
+    context: ServiceLaunchContext<Config>,
   ) => Effect.Effect<RuntimeSession, ServiceError | ServiceLaunchError>;
   readonly removeData: (
     context: ServiceInstanceContext<Config>,
@@ -98,6 +98,11 @@ export interface ServiceInstanceContext<Config> {
   readonly scope: Scope.Closeable;
 }
 
+/** One launch of an instance; every output chunk the launch publishes carries its `launchId`. */
+export interface ServiceLaunchContext<Config> extends ServiceInstanceContext<Config> {
+  readonly launchId: number;
+}
+
 export interface ServiceInstance<Config> {
   readonly id: string;
   readonly observation: Stream.Stream<ServiceObservation<Config>>;
@@ -179,6 +184,8 @@ export const makeService = <Config>(
   options: {
     readonly id: string;
     readonly config: Config;
+    /** Launch ids continue after this one. */
+    readonly lastLaunchId?: number;
     readonly coordinate?: (
       operation: ServiceAdmission,
       transition: Effect.Effect<void, ServiceError>,
@@ -189,7 +196,7 @@ export const makeService = <Config>(
     const owner = yield* Scope.Scope;
     const gate = yield* Semaphore.make(1);
     const revision = yield* Ref.make(0);
-    const launchCounter = yield* Ref.make(0);
+    const launchCounter = yield* Ref.make(options.lastLaunchId ?? 0);
     const current = yield* Ref.make<SessionRecord | undefined>(undefined);
     // stopNow clears observation.launchId while keeping the error, so readiness must not read that field.
     const launchError = yield* Ref.make<
@@ -293,6 +300,7 @@ export const makeService = <Config>(
       retainWake = false,
       discard = false,
     ) {
+      yield* Effect.annotateCurrentSpan({ member_id: options.id });
       yield* Effect.gen(function* () {
         const record = yield* Ref.get(current);
         if (expected !== undefined && record !== expected) return;
@@ -347,6 +355,7 @@ export const makeService = <Config>(
     const launchNow = Effect.fn("Service.launchNow")(function* (
       guard: Effect.Effect<void, ServiceError>,
     ) {
+      yield* Effect.annotateCurrentSpan({ member_id: options.id });
       yield* Effect.gen(function* () {
         let observation = yield* SubscriptionRef.get(observations);
         if (!observation.registered) return yield* new ServiceDestroyed({ id: options.id });
@@ -380,12 +389,17 @@ export const makeService = <Config>(
         );
         const runtimeScope = yield* Scope.fork(owner, "parallel");
         const launchExit = yield* Effect.exit(
-          definition.launch(contextFor(options.id, yield* Ref.get(config), runtimeScope)).pipe(
-            Effect.map((runtime) => ({ runtime, failure: undefined })),
-            Effect.catchTag("ServiceLaunchError", ({ runtime, failure }) =>
-              Effect.succeed({ runtime, failure }),
+          definition
+            .launch({
+              ...contextFor(options.id, yield* Ref.get(config), runtimeScope),
+              launchId,
+            })
+            .pipe(
+              Effect.map((runtime) => ({ runtime, failure: undefined })),
+              Effect.catchTag("ServiceLaunchError", ({ runtime, failure }) =>
+                Effect.succeed({ runtime, failure }),
+              ),
             ),
-          ),
         );
         if (Exit.isFailure(launchExit)) {
           yield* Scope.close(runtimeScope, launchExit);
@@ -542,6 +556,7 @@ export const makeService = <Config>(
       expectedRevision: number,
       guard: Effect.Effect<void, ServiceError> = Effect.void,
     ) {
+      yield* Effect.annotateCurrentSpan({ member_id: options.id });
       yield* run(
         Effect.gen(function* () {
           if (!(yield* SubscriptionRef.get(observations)).registered)
@@ -573,6 +588,7 @@ export const makeService = <Config>(
     });
 
     const stop = Effect.fn("Service.stop")(function* () {
+      yield* Effect.annotateCurrentSpan({ member_id: options.id });
       yield* run(
         Effect.gen(function* () {
           const observation = yield* SubscriptionRef.get(observations);
@@ -589,6 +605,7 @@ export const makeService = <Config>(
       requestedRevision?: number,
       guard: Effect.Effect<void, ServiceError> = Effect.void,
     ) {
+      yield* Effect.annotateCurrentSpan({ member_id: options.id });
       const expectedRevision = requestedRevision ?? (yield* Ref.get(revision));
       const nextConfig = candidate ?? (yield* Ref.get(config));
       if (definition.prepare !== undefined) yield* definition.prepare(nextConfig);
@@ -687,6 +704,7 @@ export const makeService = <Config>(
     const storage = Effect.fn("Service.storage")(function* <A>(
       operation: Effect.Effect<A, ServiceError>,
     ) {
+      yield* Effect.annotateCurrentSpan({ member_id: options.id });
       return yield* run(
         Effect.gen(function* () {
           const observation = yield* SubscriptionRef.get(observations);
@@ -705,6 +723,7 @@ export const makeService = <Config>(
     });
 
     const destroy = Effect.fn("Service.destroy")(function* () {
+      yield* Effect.annotateCurrentSpan({ member_id: options.id });
       yield* run(
         Effect.gen(function* () {
           const observation = yield* SubscriptionRef.get(observations);
diff --git a/packages/stack/src/StackHost.integration.test.ts b/packages/stack/src/StackHost.integration.test.ts
index 914f877ed2..0bb65d4a65 100644
--- a/packages/stack/src/StackHost.integration.test.ts
+++ b/packages/stack/src/StackHost.integration.test.ts
@@ -626,7 +626,9 @@ it.live(
         const idleSocket = yield* Effect.acquireRelease(openIdleSocket(endpoint.port), (socket) =>
           Effect.sync(() => socket.destroy()),
         );
-        const logs = yield* Effect.forkScoped(client.logs({ id: mail.id }).pipe(Stream.runDrain));
+        const logs = yield* Effect.forkScoped(
+          client.readLogs({ id: mail.id, follow: true }).pipe(Stream.runDrain),
+        );
         const ready = yield* Deferred.make<void>();
         const drainingTool = yield* Effect.forkScoped(
           client
diff --git a/packages/stack/src/StackHost.ts b/packages/stack/src/StackHost.ts
index e2571409c3..23f2a5b813 100644
--- a/packages/stack/src/StackHost.ts
+++ b/packages/stack/src/StackHost.ts
@@ -437,6 +437,15 @@ export const runStackHost = Effect.fn("StackHost.run")(
               ),
             ),
           );
+          // After the sweep, so no leftover Vector container still mounts the files it removes.
+          // The loaded state already omits Vector, so a failed migration waits for a later start.
+          yield* state
+            .migrate(id)
+            .pipe(
+              Effect.catch((error) =>
+                Effect.logWarning(`Unable to migrate the saved state of stack ${id}`, error),
+              ),
+            );
           const hostGateway = yield* makeHostGateway;
           const services = yield* Layer.build(
             Layer.merge(
diff --git a/packages/stack/src/State.integration.test.ts b/packages/stack/src/State.integration.test.ts
index 19a1548de3..cc1f9c3b63 100644
--- a/packages/stack/src/State.integration.test.ts
+++ b/packages/stack/src/State.integration.test.ts
@@ -611,6 +611,90 @@ describe("durable stack state", () => {
     ),
   );
 
+  it.live("removes persisted logs with the stack, retrying a Windows sharing violation", () =>
+    run(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-state-remove-logs-" });
+        const held = yield* Ref.make(2);
+        const injectedFs = Layer.succeed(FileSystem.FileSystem, {
+          ...fs,
+          remove: (target: string, options?: Parameters<typeof fs.remove>[1]) =>
+            Effect.gen(function* () {
+              if (
+                target.endsWith(`${path.sep}logs`) &&
+                (yield* Ref.getAndUpdate(held, (n) => n - 1)) > 0
+              )
+                return yield* PlatformError.systemError({
+                  _tag: "Busy",
+                  module: "FileSystem",
+                  method: "remove",
+                  pathOrDescriptor: target,
+                  cause: Object.assign(new Error("open by a reader"), { code: "EBUSY" }),
+                });
+              return yield* fs.remove(target, options);
+            }),
+        });
+        const store = yield* Layer.build(
+          State.layer({ root, platform: "win32" }).pipe(Layer.provide(injectedFs)),
+        ).pipe(Effect.map((context) => Context.get(context, State.Service)));
+        yield* store.save(initial);
+        const segment = path.join(store.logsRoot(initial.id), "auth", "instance", "0000000001.log");
+        yield* fs.makeDirectory(path.dirname(segment), { recursive: true });
+        yield* fs.writeFileString(segment, "record\n");
+
+        yield* store.remove(initial.id);
+
+        expect(yield* fs.exists(path.join(root, initial.id))).toBe(false);
+      }),
+    ),
+  );
+
+  it.live("keeps a stack listed when its logs cannot be removed, so a second removal retries", () =>
+    run(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-state-remove-failed-" });
+        const denied = yield* Ref.make(true);
+        const injectedFs = Layer.succeed(FileSystem.FileSystem, {
+          ...fs,
+          remove: (target: string, options?: Parameters<typeof fs.remove>[1]) =>
+            Effect.gen(function* () {
+              if (target.endsWith(`${path.sep}logs`) && (yield* Ref.get(denied)))
+                return yield* PlatformError.systemError({
+                  _tag: "PermissionDenied",
+                  module: "FileSystem",
+                  method: "remove",
+                  pathOrDescriptor: target,
+                });
+              return yield* fs.remove(target, options);
+            }),
+        });
+        const store = yield* Layer.build(
+          State.layer({ root }).pipe(Layer.provide(injectedFs)),
+        ).pipe(Effect.map((context) => Context.get(context, State.Service)));
+        yield* store.save(initial);
+        const segment = path.join(store.logsRoot(initial.id), "auth", "instance", "0000000001.log");
+        yield* fs.makeDirectory(path.dirname(segment), { recursive: true });
+        yield* fs.writeFileString(segment, "record\n");
+
+        const failed = yield* store.remove(initial.id).pipe(Effect.exit);
+        const listed = (yield* store.list).map(({ id }) => id);
+        const logsKept = yield* fs.exists(segment);
+        yield* Ref.set(denied, false);
+        yield* store.remove(initial.id);
+
+        expect(Exit.isFailure(failed)).toBe(true);
+        expect(listed).toEqual([initial.id]);
+        expect(logsKept).toBe(true);
+        expect(yield* store.read(initial.id)).toBeUndefined();
+        expect(yield* fs.exists(path.join(root, initial.id))).toBe(false);
+      }),
+    ),
+  );
+
   it.live.skipIf(process.platform === "win32")(
     "restricts the state root to its owner while keeping a traverse-only grant",
     () =>
diff --git a/packages/stack/src/State.ts b/packages/stack/src/State.ts
index 7b738ac908..ba5ef7e4a3 100644
--- a/packages/stack/src/State.ts
+++ b/packages/stack/src/State.ts
@@ -1,7 +1,6 @@
 import {
   Clock,
   Data,
-  Duration,
   Effect,
   Exit,
   FileSystem,
@@ -20,6 +19,7 @@ import { rmdir } from "node:fs/promises";
 import { DatabaseSync } from "node:sqlite";
 import { pathToFileURL } from "node:url";
 import { CompositionConfig } from "./Orchestrator.ts";
+import { errorCode, retrySharingViolation } from "./internal/sharing-violation.ts";
 import { restrictDirectoryToOwner } from "./runtime/postgres-user.ts";
 import { ServiceCreation } from "./services/Catalog.ts";
 
@@ -33,6 +33,8 @@ const SafeId = Schema.String.pipe(
 const SavedInstance = Schema.Struct({
   id: SafeId,
   creation: Schema.toCodecJson(ServiceCreation),
+  /** The latest launch id; the next owner continues after it, so launch ids keep increasing. */
+  launchId: Schema.optionalKey(Schema.Int),
 });
 interface SavedInstance extends Schema.Schema.Type<typeof SavedInstance> {}
 
@@ -128,7 +130,13 @@ export class StateError extends Data.TaggedError("StateError")<{
 }> {}
 
 export interface Interface {
+  /** Omits saved Vector instances and their composition entries without rewriting the file. */
   readonly read: (id: string) => Effect.Effect<SavedStack | undefined, StateError>;
+  /**
+   * Persists the removal of saved Vector instances and deletes their stack-owned files. Call while
+   * holding the stack's lease, before any of its services run.
+   */
+  readonly migrate: (id: string) => Effect.Effect<void, StateError>;
   /** Skips each stack entry that stays unreadable after transient retries, reporting it to `onInvalidState`. */
   readonly list: Effect.Effect<ReadonlyArray<SavedStack>, StateError>;
   /** Decodes only each stack's port claims and silently skips entries that cannot provide them. */
@@ -153,6 +161,8 @@ export interface Interface {
   readonly retractHolder: (id: string) => Effect.Effect<void, StateError>;
   /** The file that receives the stack owner's stdout and stderr. */
   readonly ownerLog: (id: string) => string;
+  /** The directory that holds the stack's persisted service logs. */
+  readonly logsRoot: (id: string) => string;
 }
 
 export class Service extends Context.Service<Service, Interface>()("@supabase/stack/State") {}
@@ -169,12 +179,67 @@ const checkId = (id: string): Effect.Effect<void, StateError> =>
     ? Effect.void
     : Effect.fail(stateError("identity", `Invalid state id: ${id}`));
 
+const retainedEntries = (
+  entries: unknown,
+  retired: (entry: Readonly<Record<string, unknown>>) => boolean,
+): unknown =>
+  Array.isArray(entries)
+    ? entries.filter((entry: unknown) => !(Predicate.isReadonlyObject(entry) && retired(entry)))
+    : entries;
+
+/**
+ * Drops saved Vector instances, which the stack no longer runs, with every composition member,
+ * dependency and port claim that references them. An instance with an unsafe id stays, so decoding
+ * rejects the document.
+ */
+const withoutVectorInstances = (
+  document: unknown,
+): { readonly document: unknown; readonly removed: ReadonlyArray<string> } => {
+  if (!Predicate.isReadonlyObject(document) || !Array.isArray(document.instances))
+    return { document, removed: [] };
+  const removed = document.instances.flatMap((instance: unknown) =>
+    Predicate.isReadonlyObject(instance) &&
+    Schema.is(SafeId)(instance.id) &&
+    Predicate.isReadonlyObject(instance.creation) &&
+    instance.creation.service === "vector"
+      ? [instance.id]
+      : [],
+  );
+  if (removed.length === 0) return { document, removed };
+  const ids: ReadonlySet<unknown> = new Set(removed);
+  const { composition } = document;
+  return {
+    removed,
+    document: {
+      ...document,
+      instances: retainedEntries(document.instances, (instance) => ids.has(instance.id)),
+      composition: Predicate.isReadonlyObject(composition)
+        ? {
+            ...composition,
+            members: retainedEntries(composition.members, (member) => ids.has(member.id)),
+            dependencies: retainedEntries(
+              composition.dependencies,
+              (dependency) => ids.has(dependency.from) || ids.has(dependency.to),
+            ),
+          }
+        : composition,
+      ports: retainedEntries(
+        document.ports,
+        ({ key }) => typeof key === "string" && removed.some((id) => key.startsWith(`${id}:`)),
+      ),
+    },
+  };
+};
+
 const decodeState = (
   text: string,
   id: string,
   target: string,
 ): Effect.Effect<SavedStack, StateError> =>
-  Schema.decodeEffect(Schema.fromJsonString(SavedStack))(text).pipe(
+  Schema.decodeEffect(Schema.fromJsonString(Schema.Unknown))(text).pipe(
+    Effect.flatMap((document) =>
+      Schema.decodeUnknownEffect(SavedStack)(withoutVectorInstances(document).document),
+    ),
     Effect.mapError(
       (cause) =>
         new StateError({
@@ -193,12 +258,22 @@ interface Options {
   readonly onLeaseContended?: (id: string) => Effect.Effect<void>;
 }
 
+const logsDirectory = "logs";
+
+/** Resolves the persisted service logs directory of a stack without opening the state root. */
+export const stackLogsRoot = (
+  path: Path.Path,
+  stateRoot: string,
+  id: string,
+): Effect.Effect<string, StateError> =>
+  checkId(id).pipe(Effect.as(path.join(path.normalize(stateRoot), id, logsDirectory)));
+
 const stateWritePrefix = ".state-write-";
 /** A state write takes milliseconds, so a temporary directory this old belongs to a dead writer. */
 const staleWriteAgeMillis = 24 * 60 * 60 * 1000;
 
 /** Best-effort removal of temporary write directories a killed writer left behind. */
-const reapStaleWrites = (fs: FileSystem.FileSystem, path: Path.Path, root: string) =>
+export const reapStaleWrites = (fs: FileSystem.FileSystem, path: Path.Path, root: string) =>
   Effect.gen(function* () {
     const now = yield* Clock.currentTimeMillis;
     const entries = yield* fs.readDirectory(root);
@@ -219,6 +294,49 @@ const reapStaleWrites = (fs: FileSystem.FileSystem, path: Path.Path, root: strin
     );
   }).pipe(Effect.ignore);
 
+/**
+ * Replaces `target` with `content` (mode 0600) through a temporary file in a fresh directory under
+ * `directory`, which must share the target's file system, retrying Windows sharing violations.
+ */
+export const writeFileAtomically = (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  options: {
+    readonly directory: string;
+    readonly target: string;
+    readonly content: string;
+    readonly platform?: NodeJS.Platform;
+  },
+): Effect.Effect<void, StateError> =>
+  Effect.acquireUseRelease(
+    fs
+      .makeTempDirectory({ directory: options.directory, prefix: stateWritePrefix })
+      .pipe(Effect.mapError((cause) => stateError("write", cause))),
+    (directory) =>
+      Effect.gen(function* () {
+        const temporary = path.join(directory, path.basename(options.target));
+        yield* fs
+          .writeFileString(temporary, options.content, { mode: 0o600 })
+          .pipe(Effect.mapError((cause) => stateError("write", cause)));
+        yield* fs.rename(temporary, options.target).pipe(
+          retrySharingViolation(options.platform),
+          Effect.mapError(
+            (cause) =>
+              new StateError({
+                operation: "publish",
+                message: `Unable to publish state to ${options.target}${errorCode(cause) ? ` (${errorCode(cause)})` : ""}: ${cause instanceof Error ? cause.message : String(cause)}`,
+                cause,
+              }),
+          ),
+          Effect.withSpan("State.publish"),
+        );
+      }),
+    (directory) =>
+      fs
+        .remove(directory, { recursive: true, force: true })
+        .pipe(Effect.mapError((cause) => stateError("cleanup", cause))),
+  );
+
 const makeState = (
   options: Options,
 ): Effect.Effect<Interface, StateError, FileSystem.FileSystem | Path.Path> =>
@@ -242,40 +360,13 @@ const makeState = (
     const leasePath = (id: string) => path.join(stackRoot(id), "owner.lock");
     const ownerPath = (id: string) => path.join(stackRoot(id), "owner.json");
     const ownerLog = (id: string) => path.join(stackRoot(id), "owner.log");
-    const publishRetrySchedule = Schedule.exponential("10 millis", 2).pipe(
-      Schedule.modifyDelay(({ duration }) =>
-        Effect.succeed(Duration.min(duration, Duration.millis(100))),
-      ),
-      Schedule.upTo({ times: 12 }),
-    );
-    const errorCode = (error: unknown): string | undefined => {
-      if (!Predicate.hasProperty(error, "cause")) return undefined;
-      return Predicate.hasProperty(error.cause, "code") && typeof error.cause.code === "string"
-        ? error.cause.code
-        : undefined;
-    };
-    /** Windows reports a file that another process is replacing as a transient sharing violation. */
-    const sharingViolation = (error: unknown) =>
-      (options.platform ?? process.platform) === "win32" &&
-      ["EPERM", "EACCES", "EBUSY"].includes(errorCode(error) ?? "");
+    const logsRoot = (id: string) => path.join(stackRoot(id), logsDirectory);
+    const retryShared = retrySharingViolation(options.platform);
     const retryTransientRead = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
       effect.pipe(
-        Effect.retry({ schedule: publishRetrySchedule, while: sharingViolation }),
+        retryShared,
         Effect.mapError((cause) => stateError("read", cause)),
       );
-    const publish = Effect.fn("State.publish")(function* (temporary: string, target: string) {
-      yield* fs.rename(temporary, target).pipe(
-        Effect.retry({ schedule: publishRetrySchedule, while: sharingViolation }),
-        Effect.mapError(
-          (cause) =>
-            new StateError({
-              operation: "publish",
-              message: `Unable to publish state to ${target}${errorCode(cause) ? ` (${errorCode(cause)})` : ""}: ${cause instanceof Error ? cause.message : String(cause)}`,
-              cause,
-            }),
-        ),
-      );
-    });
     const removeEmptyDirectory = (directory: string) =>
       Effect.tryPromise({
         try: () => rmdir(directory),
@@ -335,28 +426,17 @@ const makeState = (
       );
     const claims = Effect.fn("State.claims")(() => readEntries(readClaims, () => Effect.void));
     const writeAtomically = (id: string, target: string, serialized: string) =>
-      Effect.gen(function* () {
-        yield* fs
-          .makeDirectory(stackRoot(id), { recursive: true, mode: 0o700 })
-          .pipe(Effect.mapError((cause) => stateError("write", cause)));
-        yield* Effect.acquireUseRelease(
-          fs
-            .makeTempDirectory({ directory: root, prefix: stateWritePrefix })
-            .pipe(Effect.mapError((cause) => stateError("write", cause))),
-          (directory) =>
-            Effect.gen(function* () {
-              const temporary = path.join(directory, path.basename(target));
-              yield* fs
-                .writeFileString(temporary, serialized, { mode: 0o600 })
-                .pipe(Effect.mapError((cause) => stateError("write", cause)));
-              yield* publish(temporary, target);
-            }),
-          (directory) =>
-            fs
-              .remove(directory, { recursive: true, force: true })
-              .pipe(Effect.mapError((cause) => stateError("cleanup", cause))),
-        );
-      });
+      fs.makeDirectory(stackRoot(id), { recursive: true, mode: 0o700 }).pipe(
+        Effect.mapError((cause) => stateError("write", cause)),
+        Effect.andThen(
+          writeFileAtomically(fs, path, {
+            directory: root,
+            target,
+            content: serialized,
+            ...(options.platform === undefined ? {} : { platform: options.platform }),
+          }),
+        ),
+      );
     const save = Effect.fn("State.save")(function* (state: SavedStack) {
       yield* checkId(state.id);
       const serialized = yield* Schema.encodeEffect(Schema.fromJsonString(SavedStack))(state).pipe(
@@ -366,6 +446,11 @@ const makeState = (
     });
     const remove = Effect.fn("State.remove")(function* (id: string) {
       yield* checkId(id);
+      // Logs go before the state file, so a stack whose logs remain stays listed for another removal.
+      yield* fs.remove(logsRoot(id), { recursive: true, force: true }).pipe(
+        retryShared,
+        Effect.mapError((cause) => stateError("remove", cause)),
+      );
       for (const file of [statePath(id), ownerPath(id), ownerLog(id)])
         yield* fs
           .remove(file, { force: true })
@@ -577,8 +662,111 @@ const makeState = (
         .remove(ownerPath(id), { force: true })
         .pipe(Effect.mapError((cause) => stateError("remove", cause)));
     });
+    const vectorConfigRoot = (instanceRoot: string) => path.join(instanceRoot, "runtime", "vector");
+    const isVectorRecipe = (entry: string) =>
+      entry === "vector.yaml" ||
+      entry === "vector-api.yaml" ||
+      entry === "vector.rendered.yaml" ||
+      entry.startsWith(".vector-write-");
+    /**
+     * Resolved instance data roots that still hold Vector recipe files. Found by layout rather than
+     * by saved ids, so a cleanup that failed is retried after the document no longer names Vector.
+     * A root whose config directory resolves elsewhere is skipped, so removal stays in the stack.
+     */
+    const vectorDataRoots = (id: string) =>
+      Effect.gen(function* () {
+        const dataRoot = path.join(stackRoot(id), "data");
+        const entries = yield* fs.readDirectory(dataRoot).pipe(
+          Effect.catchIf(
+            (error) => error.reason._tag === "NotFound",
+            () => Effect.succeed([]),
+          ),
+          retryTransientRead,
+        );
+        if (entries.length === 0) return [];
+        const realDataRoot = path.join(
+          yield* fs.realPath(stackRoot(id)).pipe(retryTransientRead),
+          "data",
+        );
+        const roots: Array<string> = [];
+        for (const entry of entries.filter(Schema.is(SafeId))) {
+          const instanceRoot = path.join(realDataRoot, entry);
+          const configRoot = vectorConfigRoot(instanceRoot);
+          // Another service's data directory may be unreadable to this process.
+          const configEntries = yield* fs
+            .realPath(vectorConfigRoot(path.join(dataRoot, entry)))
+            .pipe(
+              Effect.flatMap((resolved) =>
+                resolved === configRoot ? fs.readDirectory(configRoot) : Effect.succeed([]),
+              ),
+              Effect.orElseSucceed((): ReadonlyArray<string> => []),
+            );
+          if (configEntries.some(isVectorRecipe)) roots.push(instanceRoot);
+        }
+        return roots;
+      });
+    // A caller's Vector configPath may live under the instance root, so only recipe files and
+    // empty directories go.
+    const removeVectorData = (instanceRoot: string) =>
+      Effect.gen(function* () {
+        const configRoot = vectorConfigRoot(instanceRoot);
+        for (const entry of yield* fs.readDirectory(configRoot))
+          if (isVectorRecipe(entry))
+            yield* fs.remove(path.join(configRoot, entry), { recursive: true, force: true });
+        for (const directory of [configRoot, path.dirname(configRoot), instanceRoot])
+          yield* removeEmptyDirectory(directory);
+      }).pipe(
+        Effect.catchCause((cause) =>
+          Effect.logWarning(
+            `Unable to remove the Vector files in ${instanceRoot}; the next owner start retries`,
+            cause,
+          ),
+        ),
+      );
+    /** Whether the saved document still holds a Vector instance. */
+    const holdsVector = (target: string) =>
+      Effect.gen(function* () {
+        if (!(yield* fs.exists(target).pipe(retryTransientRead))) return false;
+        const text = yield* fs.readFileString(target).pipe(retryTransientRead);
+        const { removed } = yield* Schema.decodeEffect(Schema.fromJsonString(Schema.Unknown))(
+          text,
+        ).pipe(
+          Effect.map(withoutVectorInstances),
+          Effect.orElseSucceed(() => ({ removed: [] })),
+        );
+        return removed.length > 0;
+      });
+    /** What a migration still has to do, or `undefined` when the stack no longer holds Vector. */
+    const vectorLeftovers = (id: string) =>
+      Effect.gen(function* () {
+        const legacy = yield* holdsVector(statePath(id));
+        const candidates = yield* vectorDataRoots(id);
+        if (!legacy && candidates.length === 0) return undefined;
+        const saved = yield* read(id);
+        // Vector files in a saved instance's root belong to that instance, e.g. a caller's config.
+        const live = new Set(saved?.instances.map((instance) => instance.id));
+        const roots = candidates.filter((root) => !live.has(path.basename(root)));
+        return legacy || roots.length > 0
+          ? { saved: legacy ? saved : undefined, roots }
+          : undefined;
+      });
+    const migrate = Effect.fn("State.migrate")(function* (id: string) {
+      yield* checkId(id);
+      // Only a stack that still holds Vector takes the registry lock, to migrate it.
+      if ((yield* vectorLeftovers(id)) === undefined) return;
+      yield* withLock(
+        Effect.gen(function* () {
+          const leftovers = yield* vectorLeftovers(id);
+          if (leftovers === undefined) return;
+          yield* Effect.annotateCurrentSpan({ vector_data_roots: leftovers.roots.length });
+          yield* Effect.forEach(leftovers.roots, removeVectorData, { discard: true });
+          if (leftovers.saved !== undefined) yield* save(leftovers.saved);
+        }),
+      );
+    });
     return {
       read,
+      migrate,
       list: list(),
       claims: claims(),
       save,
@@ -590,6 +778,7 @@ const makeState = (
       publishHolder,
       retractHolder,
       ownerLog,
+      logsRoot,
     };
   });
 
diff --git a/packages/stack/src/State.vector-migration.integration.test.ts b/packages/stack/src/State.vector-migration.integration.test.ts
new file mode 100644
index 0000000000..29dca51126
--- /dev/null
+++ b/packages/stack/src/State.vector-migration.integration.test.ts
@@ -0,0 +1,399 @@
+import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { describe, expect, it } from "@effect/vitest";
+import {
+  Context,
+  Deferred,
+  Effect,
+  Exit,
+  Fiber,
+  FileSystem,
+  Layer,
+  Path,
+  PlatformError,
+  Ref,
+  Schema,
+} from "effect";
+import { create, open } from "./effect.ts";
+import * as State from "./State.ts";
+import { destroyTestStack } from "../tests/stack-cleanup.ts";
+
+const layer = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+const Json = Schema.fromJsonString(Schema.Unknown);
+const savedServices = (text: string) =>
+  Schema.decodeEffect(
+    Schema.fromJsonString(
+      Schema.Struct({
+        instances: Schema.Array(
+          Schema.Struct({ creation: Schema.Struct({ service: Schema.String }) }),
+        ),
+      }),
+    ),
+  )(text).pipe(Effect.map(({ instances }) => instances.map(({ creation }) => creation.service)));
+
+const stateFor = (root: string) =>
+  Layer.build(State.layer({ root })).pipe(
+    Effect.map((context) => Context.get(context, State.Service)),
+  );
+
+/** A state document saved before the stack dropped its Vector service kind. */
+const legacyDocument = (id: string, projectRoot: string) => ({
+  id,
+  lifetime: "detached",
+  identity: { projectRoot, branchContext: "main", stackName: "local" },
+  runtime: "native",
+  instances: [
+    { id: "analytics", creation: { service: "analytics", config: { backend: "postgres" } } },
+    { id: "mail", creation: { service: "mail", config: {} } },
+    {
+      id: "vector",
+      creation: {
+        service: "vector",
+        config: { analyticsUrl: "http://127.0.0.1:1", configPath: `${projectRoot}/vector.yaml` },
+      },
+    },
+    { id: "vector-owned", creation: { service: "vector", config: {} } },
+  ],
+  composition: {
+    members: [
+      { id: "analytics", activation: "eager" },
+      { id: "mail", activation: "eager" },
+      { id: "vector", activation: "eager" },
+      { id: "vector-owned", activation: "eager" },
+    ],
+    dependencies: [
+      {
+        from: "analytics",
+        to: "vector",
+        bindings: [{ output: "url", input: "analyticsUrl" }],
+      },
+      { from: "analytics", to: "vector-owned" },
+      { from: "mail", to: "analytics" },
+    ],
+  },
+  ports: [
+    { key: "vector:http", host: "127.0.0.1", port: 24_501 },
+    { key: "mail:http", host: "127.0.0.1", port: 24_502 },
+  ],
+});
+
+const writeLegacyState = Effect.fn("test.writeLegacyState")(function* (
+  stateRoot: string,
+  id: string,
+  projectRoot: string,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const data = path.join(stateRoot, id, "data");
+  yield* fs.makeDirectory(path.join(data, "vector", "runtime", "vector"), { recursive: true });
+  yield* fs.writeFileString(path.join(data, "vector", "runtime", "vector", "vector.yaml"), "");
+  yield* fs.writeFileString(path.join(data, "vector", "runtime", "vector", "vector-api.yaml"), "");
+  yield* fs.writeFileString(
+    path.join(data, "vector", "runtime", "vector", "vector.rendered.yaml"),
+    "rendered",
+  );
+  yield* fs.writeFileString(path.join(data, "vector", "pipeline.yaml"), "caller");
+  const owned = path.join(data, "vector-owned", "runtime", "vector");
+  yield* fs.makeDirectory(path.join(owned, ".vector-write-1"), { recursive: true });
+  yield* fs.writeFileString(path.join(owned, "vector-api.yaml"), "");
+  const file = path.join(stateRoot, id, "state.json");
+  yield* fs.writeFileString(
+    file,
+    yield* Schema.encodeEffect(Json)(legacyDocument(id, projectRoot)),
+  );
+  return file;
+});
+
+describe("saved Vector instance migration", () => {
+  it.live("reads a legacy state without Vector and leaves the file for the lease holder", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-state-vector-read-" });
+      const state = yield* stateFor(root);
+      const file = yield* writeLegacyState(root, "legacy", root);
+      const before = yield* fs.readFileString(file);
+
+      const saved = yield* state.read("legacy");
+
+      expect(saved?.instances.map(({ id }) => id)).toEqual(["analytics", "mail"]);
+      expect(saved?.composition).toEqual({
+        members: [
+          { id: "analytics", activation: "eager" },
+          { id: "mail", activation: "eager" },
+        ],
+        dependencies: [{ from: "mail", to: "analytics" }],
+      });
+      expect(saved?.ports.map(({ key }) => key)).toEqual(["mail:http"]);
+      expect((yield* state.list).map(({ id }) => id)).toEqual(["legacy"]);
+      expect(yield* fs.readFileString(file)).toBe(before);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("persists the migration once and keeps files a caller owns", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-state-vector-migrate-" });
+      const state = yield* stateFor(root);
+      const file = yield* writeLegacyState(root, "legacy", root);
+      const data = path.join(root, "legacy", "data");
+
+      yield* state.migrate("legacy");
+
+      const migrated = yield* fs.readFileString(file);
+      expect(yield* savedServices(migrated)).toEqual(["analytics", "mail"]);
+      expect(yield* Schema.decodeEffect(Schema.fromJsonString(State.SavedStack))(migrated)).toEqual(
+        yield* state.read("legacy"),
+      );
+      expect(yield* fs.exists(path.join(data, "vector", "runtime"))).toBe(false);
+      expect(yield* fs.readFileString(path.join(data, "vector", "pipeline.yaml"))).toBe("caller");
+      expect(yield* fs.exists(path.join(data, "vector-owned"))).toBe(false);
+
+      yield* state.migrate("legacy");
+      expect(yield* fs.readFileString(file)).toBe(migrated);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live(
+    "retries removing Vector files that a failed migration left after the state is saved again",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-state-vector-retry-" });
+        const failNext = yield* Ref.make(true);
+        const injected: FileSystem.FileSystem = {
+          ...fs,
+          remove: (target, options) =>
+            Effect.gen(function* () {
+              if (
+                target.endsWith("vector.rendered.yaml") &&
+                (yield* Ref.getAndSet(failNext, false))
+              )
+                return yield* PlatformError.systemError({
+                  _tag: "PermissionDenied",
+                  module: "FileSystem",
+                  method: "remove",
+                  pathOrDescriptor: target,
+                });
+              return yield* fs.remove(target, options);
+            }),
+        };
+        const state = yield* stateFor(root).pipe(
+          Effect.provideService(FileSystem.FileSystem, injected),
+        );
+        const file = yield* writeLegacyState(root, "legacy", root);
+        const runtime = path.join(root, "legacy", "data", "vector", "runtime");
+
+        yield* state.migrate("legacy");
+        const keptFiles = yield* fs.exists(runtime);
+        const saved = yield* state.read("legacy");
+        if (saved === undefined) return yield* Effect.die("the legacy stack is not saved");
+        yield* state.save(saved);
+        yield* state.migrate("legacy");
+
+        expect(keptFiles).toBe(true);
+        expect(yield* savedServices(yield* fs.readFileString(file))).toEqual(["analytics", "mail"]);
+        expect(yield* fs.exists(runtime)).toBe(false);
+      }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live.skipIf(process.platform === "win32")(
+    "keeps Vector-named files that a symlinked data directory reaches outside the stack",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-state-vector-symlink-" });
+        const state = yield* stateFor(root);
+        yield* writeLegacyState(root, "legacy", root);
+        const outside = path.join(root, "outside", "runtime", "vector");
+        yield* fs.makeDirectory(outside, { recursive: true });
+        yield* fs.writeFileString(path.join(outside, "vector.yaml"), "outside");
+        const data = path.join(root, "legacy", "data");
+        yield* fs.symlink(path.join(root, "outside"), path.join(data, "linked-root"));
+        yield* fs.makeDirectory(path.join(data, "linked-config", "runtime"), { recursive: true });
+        yield* fs.symlink(outside, path.join(data, "linked-config", "runtime", "vector"));
+
+        yield* state.migrate("legacy");
+
+        expect(yield* fs.readFileString(path.join(outside, "vector.yaml"))).toBe("outside");
+        expect(yield* fs.exists(path.join(data, "vector", "runtime"))).toBe(false);
+      }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("keeps Vector-named files in the data directory of a saved instance", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-state-vector-live-" });
+      const state = yield* stateFor(root);
+      yield* writeLegacyState(root, "legacy", root);
+      const mailConfig = path.join(root, "legacy", "data", "mail", "runtime", "vector");
+      yield* fs.makeDirectory(mailConfig, { recursive: true });
+      yield* fs.writeFileString(path.join(mailConfig, "vector.yaml"), "mail");
+
+      yield* state.migrate("legacy");
+
+      expect(yield* fs.readFileString(path.join(mailConfig, "vector.yaml"))).toBe("mail");
+      expect(yield* fs.exists(path.join(root, "legacy", "data", "vector-owned"))).toBe(false);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("rejects a saved Vector id that escapes the stack without touching other stacks", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-state-vector-escape-" });
+      const state = yield* stateFor(root);
+      const sibling = path.join(root, "other", "data", "vector", "runtime", "vector");
+      yield* fs.makeDirectory(sibling, { recursive: true });
+      yield* fs.writeFileString(path.join(sibling, "vector.yaml"), "sibling");
+      const escaping = "../../other/data/vector";
+      const document = legacyDocument("legacy", root);
+      yield* fs.makeDirectory(path.join(root, "legacy", "data"), { recursive: true });
+      yield* fs.writeFileString(
+        path.join(root, "legacy", "state.json"),
+        yield* Schema.encodeEffect(Json)({
+          ...document,
+          instances: [
+            ...document.instances.filter(({ creation }) => creation.service !== "vector"),
+            { id: escaping, creation: { service: "vector", config: {} } },
+          ],
+          composition: {
+            members: [...document.composition.members, { id: escaping, activation: "eager" }],
+            dependencies: [],
+          },
+        }),
+      );
+
+      yield* state.migrate("legacy");
+      const failure = yield* state.read("legacy").pipe(Effect.flip);
+
+      expect(failure.operation).toBe("decode");
+      expect(yield* fs.readFileString(path.join(sibling, "vector.yaml"))).toBe("sibling");
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("checks a state without Vector while another operation holds the registry lock", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-state-vector-unlocked-" });
+      const state = yield* stateFor(root);
+      yield* writeLegacyState(root, "legacy", root);
+      yield* state.migrate("legacy");
+      const callerConfig = path.join(root, "legacy", "data", "vector", "runtime", "vector");
+      yield* fs.makeDirectory(callerConfig, { recursive: true });
+      yield* fs.writeFileString(path.join(callerConfig, "pipeline.yaml"), "caller");
+      const held = yield* Deferred.make<void>();
+      const release = yield* Deferred.make<void>();
+      const holder = yield* state
+        .withLock(Deferred.succeed(held, undefined).pipe(Effect.andThen(Deferred.await(release))))
+        .pipe(Effect.forkChild);
+      yield* Deferred.await(held);
+
+      const checked = yield* state.migrate("legacy").pipe(Effect.timeout("1 second"), Effect.exit);
+      yield* Deferred.succeed(release, undefined);
+      yield* Fiber.join(holder);
+
+      expect(Exit.isSuccess(checked)).toBe(true);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("refuses to migrate a state document copied from another stack", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-state-vector-copied-" });
+      const state = yield* stateFor(root);
+      const file = yield* writeLegacyState(root, "copied", root);
+      yield* fs.writeFileString(
+        file,
+        yield* Schema.encodeEffect(Json)(legacyDocument("original", root)),
+      );
+      const before = yield* fs.readFileString(file);
+
+      const failure = yield* state.migrate("copied").pipe(Effect.flip);
+
+      expect(failure.operation).toBe("identity");
+      expect(yield* fs.readFileString(file)).toBe(before);
+      expect(yield* fs.exists(path.join(root, "original"))).toBe(false);
+      expect(
+        yield* fs.exists(path.join(root, "copied", "data", "vector", "runtime", "vector")),
+      ).toBe(true);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("starts the owner of a legacy stack and drops Vector from its saved state", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-state-vector-owner-" });
+      const options = {
+        projectRoot: root,
+        stateRoot: `${root}/state`,
+        cacheRoot: `${root}/cache`,
+        runtime: "native",
+      } satisfies Parameters<typeof create>[0];
+      const created = yield* create(options);
+      const file = yield* writeLegacyState(options.stateRoot, created.id, root);
+
+      const stack = yield* open({ ...options, id: created.id, startOwner: true });
+      yield* Effect.ensuring(
+        Effect.gen(function* () {
+          expect((yield* stack.services.list).map(({ id }) => id)).toEqual(["analytics", "mail"]);
+          expect(yield* stack.composition.describe).toEqual({
+            members: [
+              { id: "analytics", activation: "eager" },
+              { id: "mail", activation: "eager" },
+            ],
+            dependencies: [{ from: "mail", to: "analytics" }],
+          });
+          const migrated = yield* fs.readFileString(file);
+          expect(yield* savedServices(migrated)).toEqual(["analytics", "mail"]);
+
+          yield* stack.stop;
+          const reopened = yield* open({ ...options, id: created.id, startOwner: true });
+          expect((yield* reopened.services.list).map(({ id }) => id)).toEqual([
+            "analytics",
+            "mail",
+          ]);
+          expect(yield* fs.readFileString(file)).toBe(migrated);
+        }),
+        destroyTestStack(stack),
+      );
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live.skipIf(process.platform === "win32" || process.getuid?.() === 0)(
+    "starts the owner of a legacy stack whose Vector migration fails",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-state-vector-failed-" });
+        const options = {
+          projectRoot: root,
+          stateRoot: `${root}/state`,
+          cacheRoot: `${root}/cache`,
+          runtime: "native",
+        } satisfies Parameters<typeof create>[0];
+        const created = yield* create(options);
+        const file = yield* writeLegacyState(options.stateRoot, created.id, root);
+        const legacy = yield* fs.readFileString(file);
+        const data = path.join(options.stateRoot, created.id, "data");
+        // Unlistable but writable: the migration cannot find Vector files, the owner still runs.
+        yield* fs.chmod(data, 0o300);
+
+        const stack = yield* open({ ...options, id: created.id, startOwner: true }).pipe(
+          Effect.ensuring(fs.chmod(data, 0o700).pipe(Effect.orDie)),
+        );
+        yield* Effect.ensuring(
+          Effect.gen(function* () {
+            expect((yield* stack.services.list).map(({ id }) => id)).toEqual(["analytics", "mail"]);
+            expect(yield* fs.readFileString(file)).toBe(legacy);
+          }),
+          destroyTestStack(stack),
+        );
+      }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+});
diff --git a/packages/stack/src/Sweep.integration.test.ts b/packages/stack/src/Sweep.integration.test.ts
index 70c1754af0..e57462b0f1 100644
--- a/packages/stack/src/Sweep.integration.test.ts
+++ b/packages/stack/src/Sweep.integration.test.ts
@@ -11,12 +11,14 @@ import {
   Layer,
   Option,
   Path,
+  Schema,
   Stream,
 } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
 import { launchHost } from "./HostProcess.ts";
 import { makeContainerRuntime } from "./runtime/Container.ts";
 import * as State from "./State.ts";
+import { reclaimStack } from "./Sweep.ts";
 import { makeDockerDatabaseRoot } from "../tests/docker-fixture.ts";
 import { shutdownOwner, watchLeaseRelease } from "../tests/owner.ts";
 
@@ -208,3 +210,39 @@ it.live.skipIf(process.platform === "win32")(
     ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
   { timeout: 180_000 },
 );
+
+it.live("destroys a dead session stack whose saved Vector instance fails to migrate", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const stateRoot = yield* fs.makeTempDirectoryScoped({ prefix: "stack-sweep-migrate-" });
+      const real = Context.get(yield* Layer.build(State.layer({ root: stateRoot })), State.Service);
+      const state: State.Interface = {
+        ...real,
+        migrate: () =>
+          Effect.fail(new State.StateError({ operation: "lock", message: "registry is busy" })),
+      };
+      const id = "session-vector";
+      yield* fs.makeDirectory(path.join(stateRoot, id), { recursive: true });
+      yield* fs.writeFileString(
+        path.join(stateRoot, id, "state.json"),
+        yield* Schema.encodeEffect(Schema.fromJsonString(Schema.Unknown))({
+          ...saved(id, path.join(stateRoot, "project"), "native", "session"),
+          instances: [{ id: "vector", creation: { service: "vector", config: {} } }],
+          composition: { members: [{ id: "vector", activation: "eager" }], dependencies: [] },
+        }),
+      );
+
+      const reclaimed = yield* reclaimStack({
+        state,
+        stateRoot,
+        cacheRoot: path.join(stateRoot, "cache"),
+        id,
+      });
+
+      expect(reclaimed).toBe(true);
+      expect(yield* real.read(id)).toBeUndefined();
+    }),
+  ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+);
diff --git a/packages/stack/src/Sweep.ts b/packages/stack/src/Sweep.ts
index 6817993f21..e6376d7b25 100644
--- a/packages/stack/src/Sweep.ts
+++ b/packages/stack/src/Sweep.ts
@@ -47,9 +47,17 @@ export const reclaimStack = Effect.fn("Sweep.reclaimStack")(function* (options:
       const saved = yield* state.read(id);
       if (saved === undefined) return true;
       const dataRoot = path.join(yield* fs.realPath(options.stateRoot), id, "data");
+      yield* Owner.sweepContainers(saved, dataRoot);
+      // Reading drops saved Vector instances, so destroying does not depend on the migration.
+      yield* state
+        .migrate(id)
+        .pipe(
+          Effect.catch((error) =>
+            Effect.logWarning(`Unable to migrate the saved state of stack ${id}`, error),
+          ),
+        );
       if (saved.lifetime === "session")
         yield* destroyStack(state, saved, dataRoot, options.cacheRoot);
-      else yield* Owner.sweepContainers(saved, dataRoot);
       return true;
     }),
   ).pipe(Effect.timeout(sweepTimeout));
diff --git a/packages/stack/src/composition/Supabase.ts b/packages/stack/src/composition/Supabase.ts
index 19fb3eeaf9..7cdf0538c6 100644
--- a/packages/stack/src/composition/Supabase.ts
+++ b/packages/stack/src/composition/Supabase.ts
@@ -104,13 +104,6 @@ const managedBindings: ReadonlyArray<{
     targetKind: "studio",
     input: "analyticsUrl",
   },
-  {
-    sourceKind: "analytics",
-    sourceEndpoint: "http",
-    output: "url",
-    targetKind: "vector",
-    input: "analyticsUrl",
-  },
   {
     sourceKind: "functions",
     sourceEndpoint: "http",
diff --git a/packages/stack/src/effect.ts b/packages/stack/src/effect.ts
index 40e09273f6..19ff8424bf 100644
--- a/packages/stack/src/effect.ts
+++ b/packages/stack/src/effect.ts
@@ -45,6 +45,8 @@ import { failureMessage } from "./internal/failure-message.ts";
 import * as State from "./State.ts";
 import type { SavedStack, StackCredentials, StackKeysInput } from "./State.ts";
 import { StackError, type Definition, type Observation } from "./Rpc.ts";
+import { sinceMillis, streamStackLogs as streamPersistedLogs } from "./host/LogStore.ts";
+import type { LogPosition, LogRecord, StackLogRecord } from "./host/LogRecord.ts";
 import { reclaimStack } from "./Sweep.ts";
 import {
   ServiceCreationInput as ServiceCreationInputSchema,
@@ -77,6 +79,7 @@ export { StackIdSchema as StackId } from "./identity/StackId.ts";
 export type { SavedStack } from "./State.ts";
 export type { StackCredentials, StackKeysInput };
 export type { Observation } from "./Rpc.ts";
+export type { LogPosition, LogRecord, StackLogRecord };
 export type {
   Command,
   InitializationCommand,
@@ -152,14 +155,23 @@ export interface ServiceInstance<K extends Kind = Kind> {
   readonly prepare: Effect.Effect<void, StackError>;
   readonly status: Effect.Effect<Observation, StackError>;
   readonly followStatus: Stream.Stream<Observation, StackError>;
-  readonly logs: Stream.Stream<
-    { readonly stream: "stdout" | "stderr"; readonly bytes: Uint8Array },
-    StackError
-  >;
+  /** Streams the instance's persisted records through its live owner, which it never launches. */
+  readonly readLogs: (options?: ReadLogsOptions) => Stream.Stream<LogRecord, StackError>;
   readonly credentials: (options?: {
     readonly from?: "host" | "runtime";
   }) => Effect.Effect<Readonly<Record<string, string>>, StackError>;
 }
+/** Selects the records {@link ServiceInstance.readLogs} streams. */
+export interface ReadLogsOptions {
+  /** Starts at this record instead of the oldest retained one; the read fails with `tail`. */
+  readonly from?: LogPosition;
+  /** An ISO-8601 timestamp; older records are skipped. */
+  readonly since?: string;
+  /** Starts with only this many of the latest records; the read fails with `from`. */
+  readonly tail?: number;
+  /** Keeps streaming new records until interrupted; `false` by default. */
+  readonly follow?: boolean;
+}
 /** Snapshot placement; `cache` is the default. */
 export interface DatabaseSnapshotOptions {
   /**
@@ -645,7 +657,16 @@ const makeHandle = Effect.fn("Stack.makeHandle")(function* (
     prepare: call("prepare", (rpc) => rpc.prepareService({ id })),
     status: call("status", (rpc) => rpc.status({ id }), "attach"),
     followStatus: stream("followStatus", (rpc) => rpc.followStatus({ id })),
-    logs: stream("logs", (rpc) => rpc.logs({ id })),
+    readLogs: (options) =>
+      stream("readLogs", (rpc) =>
+        rpc.readLogs({
+          id,
+          follow: options?.follow ?? false,
+          ...(options?.from === undefined ? {} : { from: options.from }),
+          ...(options?.since === undefined ? {} : { since: options.since }),
+          ...(options?.tail === undefined ? {} : { tail: options.tail }),
+        }),
+      ),
     credentials: (options) =>
       call("credentials", (rpc) => rpc.credentials({ id, from: options?.from ?? "host" })),
   });
@@ -687,8 +708,6 @@ const makeHandle = Effect.fn("Stack.makeHandle")(function* (
         return common(id, "mail");
       case "analytics":
         return common(id, "analytics");
-      case "vector":
-        return common(id, "vector");
       case "pooler":
         return common(id, "pooler");
     }
@@ -969,19 +988,32 @@ export const open = Effect.fn("Stack.open")(
   Effect.mapError((cause) => failure("open", cause)),
 );
 
-/** Lists readable saved stacks with their live owners; `onInvalidState` observes skipped entries. */
+/**
+ * Lists readable saved stacks with their live owners; `onInvalidState` observes skipped entries.
+ * `idPrefix` limits both, and the owner probes, to stacks whose id starts with it.
+ */
 export const discover = Effect.fn("Stack.discover")(
   function* (
     options: Pick<StackLocations, "stateRoot"> & {
+      readonly idPrefix?: string;
       readonly onInvalidState?: (id: string, error: State.StateError) => Effect.Effect<void>;
     },
   ) {
+    const selected = (id: string) =>
+      options.idPrefix === undefined || id.startsWith(options.idPrefix);
+    const onInvalidState = options.onInvalidState;
     const state = yield* State.Service.pipe(
       Effect.provide(
-        State.layer({ root: options.stateRoot, onInvalidState: options.onInvalidState }),
+        State.layer({
+          root: options.stateRoot,
+          onInvalidState:
+            onInvalidState === undefined
+              ? undefined
+              : (id, error) => (selected(id) ? onInvalidState(id, error) : Effect.void),
+        }),
       ),
     );
-    const saved = yield* state.list;
+    const saved = (yield* state.list).filter(({ id }) => selected(id));
     return yield* Effect.forEach(
       saved,
       (definition) =>
@@ -1014,3 +1046,28 @@ export const find = Effect.fn("Stack.find")(
   },
   Effect.mapError((cause) => failure("find", cause)),
 );
+
+/** Selects the persisted logs of a stack; its owner does not need to run. */
+export interface StreamStackLogsOptions extends Pick<StackLocations, "stateRoot"> {
+  readonly stackId: string;
+  /** Instance ids to read; every instance with persisted logs by default. */
+  readonly instances?: ReadonlyArray<string>;
+  /** An ISO-8601 timestamp; older records are skipped. */
+  readonly since?: string;
+}
+
+/** Streams a stack's persisted records one instance after another, each in file order. */
+export const streamStackLogs = (
+  options: StreamStackLogsOptions,
+): Stream.Stream<StackLogRecord, StackError, FileSystem.FileSystem | Path.Path> =>
+  Stream.unwrap(
+    Effect.gen(function* () {
+      const path = yield* Path.Path;
+      const root = yield* State.stackLogsRoot(path, options.stateRoot, options.stackId);
+      return streamPersistedLogs({
+        root,
+        ...(options.instances === undefined ? {} : { instances: options.instances }),
+        ...(options.since === undefined ? {} : { since: yield* sinceMillis(options.since) }),
+      });
+    }),
+  ).pipe(Stream.mapError((cause) => failure("streamStackLogs", cause)));
diff --git a/packages/stack/src/host/Credentials.ts b/packages/stack/src/host/Credentials.ts
index 64705e0452..55d95eed28 100644
--- a/packages/stack/src/host/Credentials.ts
+++ b/packages/stack/src/host/Credentials.ts
@@ -184,7 +184,6 @@ const credentialInputs: {
   pgmeta: {},
   mail: {},
   analytics: {},
-  vector: {},
 };
 
 /** Names the config inputs the owner fills from the stack credential record. */
diff --git a/packages/stack/src/host/LogForwarder.integration.test.ts b/packages/stack/src/host/LogForwarder.integration.test.ts
new file mode 100644
index 0000000000..663d7c8120
--- /dev/null
+++ b/packages/stack/src/host/LogForwarder.integration.test.ts
@@ -0,0 +1,1186 @@
+import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { describe, expect, it } from "@effect/vitest";
+import {
+  Clock,
+  Deferred,
+  Effect,
+  Exit,
+  Fiber,
+  FileSystem,
+  Layer,
+  Logger,
+  Path,
+  PlatformError,
+  PubSub,
+  Queue,
+  Ref,
+  References,
+  Scope,
+  Stream,
+  SubscriptionRef,
+} from "effect";
+import {
+  makeFakeLogflare,
+  type FakeLogflare,
+  type FakeLogflareOptions,
+  type Received,
+} from "../../tests/fake-logflare.ts";
+import { makeManualClock, type ManualClock } from "../../tests/manual-clock.ts";
+import type { ServiceObservation } from "../Service.ts";
+import type { LaunchOutput } from "../runtime/Session.ts";
+import { CatalogError } from "../services/Recipe.ts";
+import type { LogRecord } from "./LogRecord.ts";
+import * as LogForwarder from "./LogForwarder.ts";
+import * as LogStore from "./LogStore.ts";
+
+const { flushWindowMillis, pollMillis, postTimeoutMillis, retryMillis, stuckMillis } = LogForwarder;
+
+/** Takes the next post, running each stored-id poll the forwarder waits on until one arrives. */
+const nextPost = (logflare: FakeLogflare, manual: ManualClock): Effect.Effect<Received> =>
+  logflare.next.pipe(
+    Effect.raceFirst(
+      manual
+        .sleeping(pollMillis)
+        .pipe(
+          Effect.andThen(manual.advance(pollMillis)),
+          Effect.andThen(Effect.suspend(() => nextPost(logflare, manual))),
+        ),
+    ),
+  );
+
+/**
+ * Stores each post as it arrives and runs out each stored-id wait of the forwarder until `done`
+ * holds for the posts taken so far; returns them.
+ */
+const drive = (
+  logflare: FakeLogflare,
+  manual: ManualClock,
+  done: (posts: ReadonlyArray<Received>) => Effect.Effect<boolean>,
+) =>
+  Effect.gen(function* () {
+    const posts: Array<Received> = [];
+    for (let step = 0; !(yield* done(posts)); step++) {
+      if (step > 5_000) return yield* Effect.die("the forwarder stopped making progress");
+      if ((yield* logflare.unread) > 0) {
+        posts.push(yield* logflare.next);
+        yield* logflare.apply();
+        continue;
+      }
+      yield* manual.sleeping(pollMillis);
+      if ((yield* logflare.unread) === 0) yield* manual.advance(stuckMillis);
+    }
+    return posts;
+  });
+
+const observationOf = (
+  id: string,
+  overrides: Partial<ServiceObservation<unknown>>,
+): ServiceObservation<unknown> => ({
+  id,
+  config: undefined,
+  lifecycle: "stopped",
+  health: undefined,
+  error: undefined,
+  cleanupError: undefined,
+  exit: undefined,
+  currentOperation: undefined,
+  launchId: undefined,
+  intentRevision: 0,
+  wakeEnabled: true,
+  registered: true,
+  ...overrides,
+});
+
+const serving = (id: string) =>
+  observationOf(id, { lifecycle: "running", health: "healthy", launchId: 1 });
+
+const encoder = new TextEncoder();
+
+/** A shipped service instance, named after its service, whose output a real log store persists. */
+const serviceSource = (
+  store: LogStore.Interface,
+  service: "database" | "auth" | "storage" = "database",
+) =>
+  Effect.gen(function* () {
+    const logs = yield* PubSub.unbounded<LaunchOutput>();
+    const observation = yield* SubscriptionRef.make(serving(service));
+    yield* store.attach({
+      service,
+      instanceId: service,
+      logs: PubSub.subscribe(logs),
+      observation: SubscriptionRef.changes(observation).pipe(
+        Stream.map(({ launchId }) => ({ launchId })),
+      ),
+    });
+    let seq = 0;
+    const written = yield* Queue.unbounded<LogRecord>();
+    yield* (yield* store.read(service, { from: "oldest", follow: true })).pipe(
+      Stream.runForEach((record) => Queue.offer(written, record)),
+      Effect.forkScoped,
+    );
+    /** Publishes lines and waits until the store has persisted the last one. */
+    const log = (...lines: ReadonlyArray<string>) =>
+      Effect.gen(function* () {
+        const time = yield* Clock.currentTimeMillis;
+        yield* PubSub.publish(logs, {
+          stream: "stdout",
+          bytes: encoder.encode(lines.map((line) => `${line}\n`).join("")),
+          launchId: 1,
+          part: 0,
+          seq: seq++,
+          time,
+        });
+        const last = lines.at(-1);
+        while ((yield* Queue.take(written)).text !== last);
+      });
+    return {
+      log,
+      instance: {
+        id: service,
+        service,
+        endpoint: () => Effect.fail(new CatalogError({ operation: "endpoint", message: "unused" })),
+        creation: Effect.die("Only the Analytics creation is read"),
+        observation: SubscriptionRef.changes(observation),
+      } satisfies LogForwarder.ForwardedInstance,
+    };
+  });
+
+const analyticsTarget = (port: Effect.Effect<number>) =>
+  Effect.gen(function* () {
+    const observation = yield* SubscriptionRef.make(observationOf("analytics", {}));
+    return {
+      observation,
+      set: (awake: boolean) =>
+        SubscriptionRef.set(
+          observation,
+          awake ? serving("analytics") : observationOf("analytics", { lifecycle: "stopped" }),
+        ),
+      /** Restarts Analytics as a new launch, which loses whatever the previous one had queued. */
+      relaunch: (launchId: number) =>
+        SubscriptionRef.set(observation, observationOf("analytics", { lifecycle: "stopped" })).pipe(
+          Effect.andThen(SubscriptionRef.set(observation, { ...serving("analytics"), launchId })),
+        ),
+      instance: {
+        id: "analytics",
+        service: "analytics" as const,
+        endpoint: () =>
+          port.pipe(
+            Effect.map((current) => ({
+              kind: "tcp" as const,
+              host: "127.0.0.1" as const,
+              port: current,
+            })),
+          ),
+        creation: Effect.succeed({ service: "analytics" as const, config: { apiKey: "test-key" } }),
+        observation: SubscriptionRef.changes(observation),
+      } satisfies LogForwarder.ForwardedInstance,
+    };
+  });
+
+const composition = Effect.succeed({
+  members: [
+    { id: "analytics", activation: "lazy" as const },
+    { id: "database", activation: "eager" as const },
+    { id: "auth", activation: "eager" as const },
+  ],
+  dependencies: [],
+});
+
+/** Starts a forwarder in its own scope so a test can stop it like an owner. */
+const startForwarder = (
+  store: LogStore.Interface,
+  logflare: FakeLogflare,
+  instances: ReadonlyArray<LogForwarder.ForwardedInstance>,
+  clock?: Clock.Clock,
+  stored?: LogForwarder.StoredEvents,
+) =>
+  Effect.gen(function* () {
+    const scope = yield* Scope.make();
+    // Stops before the test's store and temp directory close, so no cursor write races removal.
+    yield* Effect.addFinalizer(() => Scope.close(scope, Exit.void));
+    const forwarder = yield* LogForwarder.make({
+      composition,
+      logs: store,
+      storedEvents: () => (stored === undefined ? logflare.storedEvents : Effect.succeed(stored)),
+    }).pipe(Scope.provide(scope));
+    for (const instance of instances) yield* forwarder.attach(instance);
+    yield* forwarder.rebind;
+    const awaitShipping = (value: boolean) =>
+      forwarder.shipping.pipe(
+        Stream.filter((current) => current === value),
+        Stream.take(1),
+        Stream.runDrain,
+      );
+    return { awaitShipping, detach: forwarder.detach, stop: Scope.close(scope, Exit.void) };
+  }).pipe(clock === undefined ? (effect) => effect : Effect.provideService(Clock.Clock, clock));
+
+/** Without `logflare` options, the fake stores each accepted post right away. */
+const fixture = (
+  options: {
+    readonly store?: Omit<LogStore.LogStoreOptions, "root">;
+    readonly logflare?: FakeLogflareOptions;
+  } = {},
+) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const root = yield* fs.makeTempDirectoryScoped({ prefix: "log-forwarder-" });
+    const store = yield* LogStore.make({ root, ...options.store });
+    const logflare = yield* makeFakeLogflare(options.logflare ?? { flushMillis: 0 });
+    const database = yield* serviceSource(store);
+    const analytics = yield* analyticsTarget(Effect.succeed(logflare.port));
+    return { root, store, logflare, database, analytics };
+  });
+
+const messages = (post: Received) => post.events.map((event) => event.event_message);
+const ids = (post: Received) => post.events.map((event) => event.id);
+const storedMessages = (logflare: FakeLogflare) =>
+  logflare.stored.pipe(Effect.map((events) => events.map((event) => event.event_message)));
+
+const layer = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+
+describe("LogForwarder", () => {
+  it.live(
+    "ships records written while Analytics slept with their timestamps, without markers",
+    () =>
+      Effect.gen(function* () {
+        const { root, store, logflare, database, analytics } = yield* fixture();
+        const forwarder = yield* startForwarder(store, logflare, [
+          analytics.instance,
+          database.instance,
+        ]);
+        yield* database.log("while asleep 1", "while asleep 2");
+
+        yield* analytics.set(true);
+        yield* forwarder.awaitShipping(true);
+        const caughtUp = yield* logflare.next;
+        yield* database.log("while awake");
+        const live = yield* logflare.next;
+
+        expect(caughtUp.url).toBe("/api/logs?source_name=postgres.logs");
+        expect(caughtUp.apiKey).toBe("test-key");
+        expect(messages(caughtUp)).toEqual(["while asleep 1", "while asleep 2"]);
+        expect(messages(live)).toEqual(["while awake"]);
+        const persisted = (yield* LogStore.streamStackLogs({ root }).pipe(
+          Stream.runCollect,
+        )).filter((record) => record.kind === "stdout");
+        expect([...caughtUp.events, ...live.events].map((event) => event.timestamp)).toEqual(
+          persisted.map((record) => record.timestamp),
+        );
+        expect(new Set([...ids(caughtUp), ...ids(live)]).size).toBe(3);
+      }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live(
+    "ships a record persisted while Analytics slept once it wakes on a new port, letting the post in flight across the retarget finish without repeating it",
+    () =>
+      Effect.gen(function* () {
+        const { store, logflare, database } = yield* fixture({ logflare: {} });
+        const manual = yield* makeManualClock;
+        const firstLaunch = yield* Scope.make();
+        const asleepPort = yield* logflare.listen(firstLaunch);
+        const port = yield* Ref.make(asleepPort);
+        const analytics = yield* analyticsTarget(Ref.get(port));
+        yield* analytics.set(true);
+        const forwarder = yield* startForwarder(
+          store,
+          logflare,
+          [analytics.instance, database.instance],
+          manual.clock,
+        );
+        const release = yield* logflare.hold;
+        yield* database.log("while awake");
+        const beforeSleep = yield* logflare.next;
+
+        yield* SubscriptionRef.set(
+          analytics.observation,
+          observationOf("analytics", { lifecycle: "stopping", launchId: 1 }),
+        );
+        yield* forwarder.awaitShipping(false);
+        yield* SubscriptionRef.set(analytics.observation, observationOf("analytics", {}));
+        yield* database.log("while asleep");
+        yield* Ref.set(port, logflare.port);
+        yield* logflare.respond(503);
+        yield* SubscriptionRef.set(
+          analytics.observation,
+          observationOf("analytics", { lifecycle: "starting", health: "starting", launchId: 2 }),
+        );
+        yield* SubscriptionRef.set(
+          analytics.observation,
+          observationOf("analytics", { lifecycle: "running", health: "starting", launchId: 2 }),
+        );
+        yield* SubscriptionRef.set(analytics.observation, { ...serving("analytics"), launchId: 2 });
+        yield* forwarder.awaitShipping(true);
+        yield* logflare.apply();
+        yield* release;
+        yield* Scope.close(firstLaunch, Exit.void);
+        const unavailable = yield* logflare.next;
+        yield* manual.sleeping(pollMillis);
+        yield* manual.advance(flushWindowMillis);
+        const caughtUp = yield* logflare.next;
+        yield* logflare.apply();
+
+        expect(beforeSleep.port).toBe(asleepPort);
+        expect(messages(beforeSleep)).toEqual(["while awake"]);
+        expect(yield* logflare.aborted).toBe(0);
+        expect(unavailable.port).toBe(logflare.port);
+        expect(messages(unavailable)).toEqual(["while asleep"]);
+        expect(ids(caughtUp)).toEqual(ids(unavailable));
+        expect(yield* storedMessages(logflare)).toEqual(["while awake", "while asleep"]);
+        expect(yield* logflare.dropped).toBe(0);
+      }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("ships only instances of the composition", () =>
+    Effect.gen(function* () {
+      const { store, logflare, database, analytics } = yield* fixture();
+      const standalone = yield* serviceSource(store, "storage");
+      yield* analytics.set(true);
+      yield* startForwarder(store, logflare, [
+        analytics.instance,
+        standalone.instance,
+        database.instance,
+      ]);
+
+      yield* standalone.log("standalone line");
+      yield* database.log("composed line");
+      const posted = yield* logflare.next;
+      yield* database.log("later line");
+      const later = yield* logflare.next;
+
+      expect(messages(posted)).toEqual(["composed line"]);
+      expect(messages(later)).toEqual(["later line"]);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("stops shipping quietly when the log store closes", () =>
+    Effect.gen(function* () {
+      const { store, logflare, database, analytics } = yield* fixture();
+      const warnings: Array<unknown> = [];
+      const stopped = yield* Deferred.make<void>();
+      const captured = Logger.layer([
+        Logger.make(({ logLevel, message }) => {
+          if (logLevel === "Warn") warnings.push(message);
+          if (logLevel === "Debug" && String(message).includes("stopped"))
+            Deferred.doneUnsafe(stopped, Effect.void);
+        }),
+      ]);
+      const forwarder = yield* startForwarder(store, logflare, [
+        analytics.instance,
+        database.instance,
+      ]).pipe(Effect.provide(captured), Effect.provideService(References.MinimumLogLevel, "Debug"));
+      yield* analytics.set(true);
+      yield* forwarder.awaitShipping(true);
+      yield* database.log("before removal");
+      const shipped = yield* logflare.next;
+
+      yield* store.close;
+      yield* Deferred.await(stopped);
+      yield* forwarder.stop;
+
+      expect(messages(shipped)).toEqual(["before removal"]);
+      expect(warnings).toEqual([]);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("ships again after a failed log read while Analytics stays healthy", () =>
+    Effect.gen(function* () {
+      const { store, logflare, database, analytics } = yield* fixture();
+      const reads = yield* Ref.make(0);
+      const flaky: LogStore.Interface = {
+        ...store,
+        read: (instanceId, options) =>
+          Ref.getAndUpdate(reads, (count) => count + 1).pipe(
+            Effect.flatMap((count) =>
+              count === 0
+                ? Effect.succeed(
+                    Stream.fail(
+                      new LogStore.LogStoreError({ operation: "read", message: "injected" }),
+                    ),
+                  )
+                : store.read(instanceId, options),
+            ),
+          ),
+      };
+      const warnings: Array<unknown> = [];
+      const captured = Logger.layer([
+        Logger.make(({ logLevel, message }) => {
+          if (logLevel === "Warn") warnings.push(message);
+        }),
+      ]);
+      const manual = yield* makeManualClock;
+      yield* database.log("after a failed read");
+      yield* analytics.set(true);
+
+      yield* startForwarder(
+        flaky,
+        logflare,
+        [analytics.instance, database.instance],
+        manual.clock,
+      ).pipe(Effect.provide(captured));
+      yield* manual.sleeping(retryMillis);
+      yield* manual.advance(retryMillis);
+      const shipped = yield* logflare.next;
+
+      expect(messages(shipped)).toEqual(["after a failed read"]);
+      expect(warnings).toEqual([
+        ["Reading database logs to ship failed; retrying", expect.anything()],
+      ]);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("removes an instance's stale cursor write directories when it attaches", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const { root, store, logflare, database, analytics } = yield* fixture();
+      const directory = path.join(root, "database", "database");
+      const stale = path.join(directory, ".state-write-stale");
+      const recent = path.join(directory, ".state-write-recent");
+      yield* fs.makeDirectory(stale, { recursive: true });
+      yield* fs.makeDirectory(recent, { recursive: true });
+      // A numeric file time is in seconds.
+      const twoDaysAgo = (yield* Clock.currentTimeMillis) / 1000 - 2 * 24 * 60 * 60;
+      yield* fs.utimes(stale, twoDaysAgo, twoDaysAgo);
+
+      yield* startForwarder(store, logflare, [analytics.instance, database.instance]);
+
+      expect(yield* fs.exists(stale)).toBe(false);
+      expect(yield* fs.exists(recent)).toBe(true);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("detaches an instance only once its cursor write landed, so its logs can go", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const { root, store, logflare, database, analytics } = yield* fixture();
+      const renaming = yield* Deferred.make<void>();
+      const release = yield* Deferred.make<void>();
+      const injected: FileSystem.FileSystem = {
+        ...fs,
+        rename: (from, to) =>
+          to.endsWith("cursor.json")
+            ? Deferred.succeed(renaming, undefined).pipe(
+                Effect.andThen(Deferred.await(release)),
+                Effect.andThen(fs.rename(from, to)),
+              )
+            : fs.rename(from, to),
+      };
+      const forwarder = yield* startForwarder(store, logflare, [
+        analytics.instance,
+        database.instance,
+      ]).pipe(Effect.provideService(FileSystem.FileSystem, injected));
+      yield* analytics.set(true);
+      yield* forwarder.awaitShipping(true);
+      yield* database.log("before removal");
+      yield* Deferred.await(renaming);
+
+      const directory = path.join(root, "database", "database");
+      const detaching = yield* Effect.forkChild(forwarder.detach("database"), {
+        startImmediately: true,
+      });
+      yield* Deferred.succeed(release, undefined);
+      yield* Fiber.join(detaching);
+      const cursorLanded = yield* fs.exists(path.join(directory, "cursor.json"));
+      yield* store.remove({ service: "database", instanceId: "database" });
+
+      expect(cursorLanded).toBe(true);
+      expect(yield* fs.exists(directory)).toBe(false);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("resumes from its persisted cursor after the forwarder restarts", () =>
+    Effect.gen(function* () {
+      const { store, logflare, database, analytics } = yield* fixture();
+      yield* analytics.set(true);
+      const first = yield* startForwarder(store, logflare, [analytics.instance, database.instance]);
+      yield* database.log("line 1", "line 2");
+      const shipped = yield* logflare.next;
+      yield* database.log("line 3");
+      const third = yield* logflare.next;
+      yield* first.stop;
+
+      yield* database.log("line 4");
+      yield* startForwarder(store, logflare, [analytics.instance, database.instance]);
+      const resumed = yield* logflare.next;
+
+      expect(messages(shipped)).toEqual(["line 1", "line 2"]);
+      expect(messages(third)).toEqual(["line 3"]);
+      expect(messages(resumed)).toEqual(["line 4"]);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live(
+    "does not post an accepted body again after an interruption before it was confirmed",
+    () =>
+      Effect.gen(function* () {
+        const { store, logflare, database, analytics } = yield* fixture({ logflare: {} });
+        const manual = yield* makeManualClock;
+        const instances = [analytics.instance, database.instance];
+        yield* analytics.set(true);
+        const first = yield* startForwarder(store, logflare, instances, manual.clock);
+        const release = yield* logflare.hold;
+        yield* database.log("line 1");
+        const accepted = yield* logflare.next;
+
+        const stopping = yield* Effect.forkChild(first.stop, { startImmediately: true });
+        yield* release;
+        yield* Fiber.join(stopping);
+        yield* logflare.apply();
+        yield* startForwarder(store, logflare, instances, manual.clock);
+        yield* database.log("line 2");
+        const resumed = yield* logflare.next;
+        yield* logflare.apply();
+
+        expect(messages(accepted)).toEqual(["line 1"]);
+        expect(messages(resumed)).toEqual(["line 2"]);
+        expect(yield* storedMessages(logflare)).toEqual(["line 1", "line 2"]);
+        expect(yield* logflare.dropped).toBe(0);
+      }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("posts again only the events Analytics has not stored when its cursor is lost", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const { root, store, logflare, database, analytics } = yield* fixture({ logflare: {} });
+      const manual = yield* makeManualClock;
+      const instances = [analytics.instance, database.instance];
+      yield* analytics.set(true);
+      const first = yield* startForwarder(store, logflare, instances, manual.clock);
+      yield* database.log("line 1");
+      yield* logflare.next;
+      yield* logflare.apply();
+      yield* database.log("line 2");
+      yield* nextPost(logflare, manual);
+      yield* first.stop;
+      yield* logflare.discard;
+      yield* fs.remove(path.join(root, "database", "database", "cursor.json"), { force: true });
+      yield* database.log("line 3");
+
+      yield* startForwarder(store, logflare, instances, manual.clock);
+      const reposted: Array<string> = [];
+      while (reposted.at(-1) !== "line 3") {
+        reposted.push(...messages(yield* nextPost(logflare, manual)));
+        yield* logflare.apply();
+      }
+
+      expect(reposted).toEqual(["line 2", "line 3"]);
+      expect(yield* logflare.dropped).toBe(0);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("posts a body Analytics failed again before any later body", () =>
+    Effect.gen(function* () {
+      const { store, logflare, database, analytics } = yield* fixture({ logflare: {} });
+      const manual = yield* makeManualClock;
+      yield* analytics.set(true);
+      yield* startForwarder(store, logflare, [analytics.instance, database.instance], manual.clock);
+      yield* logflare.respond(500);
+      const lines = Array.from({ length: 300 }, (_, index) => `burst ${index}`);
+
+      yield* database.log(...lines);
+      const failed = yield* logflare.next;
+      yield* manual.sleeping(pollMillis);
+      yield* manual.advance(flushWindowMillis);
+      const retried = yield* logflare.next;
+      yield* logflare.apply();
+      const rest = yield* nextPost(logflare, manual);
+
+      expect(ids(retried)).toEqual(ids(failed));
+      expect([...messages(retried), ...messages(rest)]).toEqual(lines);
+      expect(failed.events.length).toBeLessThanOrEqual(256);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live(
+    "posts accepted events Analytics has not stored again to its next launch, not to the launch that may still store them",
+    () =>
+      Effect.gen(function* () {
+        const { store, logflare, database, analytics } = yield* fixture({ logflare: {} });
+        const manual = yield* makeManualClock;
+        yield* analytics.set(true);
+        yield* startForwarder(
+          store,
+          logflare,
+          [analytics.instance, database.instance],
+          manual.clock,
+        );
+        yield* database.log("line 1", "line 2");
+        const posted = yield* logflare.next;
+
+        yield* manual.sleeping(pollMillis);
+        yield* manual.advance(stuckMillis - pollMillis);
+        yield* manual.sleeping(pollMillis);
+        const resentToSameLaunch = yield* logflare.unread;
+        yield* logflare.discard;
+        yield* analytics.relaunch(2);
+        const resent = yield* logflare.next;
+        yield* logflare.apply();
+        yield* database.log("line 3");
+        const later = yield* nextPost(logflare, manual);
+
+        expect(resentToSameLaunch).toBe(0);
+        expect(ids(resent)).toEqual(ids(posted));
+        expect(messages(later)).toEqual(["line 3"]);
+        expect(yield* storedMessages(logflare)).toEqual(["line 1", "line 2"]);
+      }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("posts again only the events Analytics did not store", () =>
+    Effect.gen(function* () {
+      const { store, logflare, database, analytics } = yield* fixture({
+        logflare: { batchEvents: 2 },
+      });
+      const manual = yield* makeManualClock;
+      yield* analytics.set(true);
+      yield* startForwarder(store, logflare, [analytics.instance, database.instance], manual.clock);
+      yield* database.log("line 1", "line 2", "line 3", "line 4");
+      const posted = yield* logflare.next;
+      yield* logflare.apply(1);
+      yield* logflare.discard;
+
+      yield* manual.sleeping(pollMillis);
+      yield* manual.advance(postTimeoutMillis + flushWindowMillis);
+      yield* analytics.relaunch(2);
+      const resent = yield* logflare.next;
+      yield* logflare.apply();
+
+      expect(messages(posted)).toEqual(["line 1", "line 2", "line 3", "line 4"]);
+      expect(messages(resent)).toEqual(["line 3", "line 4"]);
+      expect(yield* storedMessages(logflare)).toEqual(["line 1", "line 2", "line 3", "line 4"]);
+      expect(yield* logflare.dropped).toBe(0);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live(
+    "waits for a post that timed out after Analytics queued it instead of posting it again",
+    () =>
+      Effect.gen(function* () {
+        const { store, logflare, database, analytics } = yield* fixture({ logflare: {} });
+        const manual = yield* makeManualClock;
+        yield* analytics.set(true);
+        yield* startForwarder(
+          store,
+          logflare,
+          [analytics.instance, database.instance],
+          manual.clock,
+        );
+        const release = yield* logflare.hold;
+        yield* database.log("line 1");
+        const queued = yield* logflare.next;
+
+        yield* manual.sleeping(postTimeoutMillis);
+        yield* manual.advance(postTimeoutMillis);
+        yield* manual.sleeping(pollMillis);
+        yield* logflare.apply();
+        yield* database.log("line 2");
+        const later = yield* nextPost(logflare, manual);
+        yield* release;
+
+        expect(messages(queued)).toEqual(["line 1"]);
+        expect(messages(later)).toEqual(["line 2"]);
+        expect(yield* logflare.dropped).toBe(0);
+      }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("posts nothing while it cannot save its cursor", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const { store, logflare, database, analytics } = yield* fixture({ logflare: {} });
+      const manual = yield* makeManualClock;
+      const broken = yield* Ref.make(true);
+      const injected: FileSystem.FileSystem = {
+        ...fs,
+        rename: (from, to) =>
+          Ref.get(broken).pipe(
+            Effect.flatMap((failing) =>
+              failing && to.endsWith("cursor.json")
+                ? Effect.fail(
+                    PlatformError.systemError({
+                      _tag: "Unknown",
+                      module: "FileSystem",
+                      method: "rename",
+                      pathOrDescriptor: to,
+                      description: "injected cursor write failure",
+                    }),
+                  )
+                : fs.rename(from, to),
+            ),
+          ),
+      };
+      yield* analytics.set(true);
+      yield* startForwarder(
+        store,
+        logflare,
+        [analytics.instance, database.instance],
+        manual.clock,
+      ).pipe(Effect.provideService(FileSystem.FileSystem, injected));
+
+      yield* database.log("line 1");
+      const first = yield* logflare.next.pipe(
+        Effect.as("posted"),
+        Effect.raceFirst(manual.sleeping(retryMillis).pipe(Effect.as("retrying"))),
+      );
+      yield* Ref.set(broken, false);
+      yield* manual.advance(retryMillis);
+      const posted = yield* logflare.next;
+
+      expect(first).toBe("retrying");
+      expect(messages(posted)).toEqual(["line 1"]);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live(
+    "posts a pending body again after a restart only once the previous owner's launch had time to store it since its slow post ended",
+    () =>
+      Effect.gen(function* () {
+        const { store, logflare, database, analytics } = yield* fixture({ logflare: {} });
+        const manual = yield* makeManualClock;
+        const instances = [analytics.instance, database.instance];
+        const checking = yield* Queue.unbounded<void>();
+        const checked = yield* Deferred.make<void>();
+        const slowCheck: LogForwarder.StoredEvents = {
+          storedIds: (source, eventIds) =>
+            Queue.offer(checking, undefined).pipe(
+              Effect.andThen(Deferred.await(checked)),
+              Effect.andThen(logflare.storedIds(source, eventIds)),
+            ),
+        };
+        yield* analytics.set(true);
+        const first = yield* startForwarder(store, logflare, instances, manual.clock, slowCheck);
+        yield* database.log("line 1");
+        yield* Queue.take(checking);
+        yield* manual.advance(2_000);
+        const release = yield* logflare.hold;
+        yield* Deferred.succeed(checked, undefined);
+        const posted = yield* logflare.next;
+        yield* manual.advance(2_000);
+        yield* release;
+        yield* manual.sleeping(pollMillis);
+        yield* logflare.discard;
+        yield* first.stop;
+
+        yield* startForwarder(store, logflare, instances, manual.clock);
+        yield* manual.sleeping(pollMillis);
+        yield* manual.advance(stuckMillis - 1);
+        yield* manual.sleeping(pollMillis);
+        const resentInWindow = yield* logflare.unread;
+        yield* manual.advance(postTimeoutMillis);
+        const resent = yield* logflare.next;
+
+        expect(resentInWindow).toBe(0);
+        expect(ids(resent)).toEqual(ids(posted));
+      }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live(
+    "does not post a body again after a restart while the previous owner's launch still stores it late",
+    () =>
+      Effect.gen(function* () {
+        const { store, logflare, database, analytics } = yield* fixture({ logflare: {} });
+        const manual = yield* makeManualClock;
+        const instances = [analytics.instance, database.instance];
+        yield* analytics.set(true);
+        const first = yield* startForwarder(store, logflare, instances, manual.clock);
+        yield* database.log("line 1");
+        yield* logflare.next;
+        yield* manual.sleeping(pollMillis);
+        yield* first.stop;
+
+        yield* startForwarder(store, logflare, instances, manual.clock);
+        yield* manual.sleeping(pollMillis);
+        yield* manual.advance(postTimeoutMillis + 2 * flushWindowMillis);
+        yield* manual.sleeping(pollMillis);
+        const resentBeforeDrain = yield* logflare.unread;
+        yield* logflare.apply();
+        yield* database.log("line 2");
+        const later = yield* nextPost(logflare, manual);
+        yield* logflare.apply();
+
+        expect(resentBeforeDrain).toBe(0);
+        expect(messages(later)).toEqual(["line 2"]);
+        expect(yield* storedMessages(logflare)).toEqual(["line 1", "line 2"]);
+        expect(yield* logflare.dropped).toBe(0);
+      }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("posts a body again after 429s without skipping any of it", () =>
+    Effect.gen(function* () {
+      const { store, logflare, database, analytics } = yield* fixture({ logflare: {} });
+      const manual = yield* makeManualClock;
+      const warnings: Array<unknown> = [];
+      const captured = Logger.layer([
+        Logger.make(({ logLevel, message }) => {
+          if (logLevel === "Warn") warnings.push(message);
+        }),
+      ]);
+      yield* analytics.set(true);
+      yield* startForwarder(
+        store,
+        logflare,
+        [analytics.instance, database.instance],
+        manual.clock,
+      ).pipe(Effect.provide(captured));
+      yield* logflare.respond(429, 429, 429);
+
+      yield* database.log("line 1", "line 2");
+      const attempts = [yield* logflare.next];
+      while (attempts.length < 4) {
+        yield* manual.sleeping(pollMillis);
+        yield* manual.advance(flushWindowMillis);
+        attempts.push(yield* logflare.next);
+      }
+      yield* logflare.apply();
+      yield* database.log("line 3");
+      const later = yield* nextPost(logflare, manual);
+      yield* logflare.apply();
+
+      expect(attempts.map(messages)).toEqual(Array.from({ length: 4 }, () => ["line 1", "line 2"]));
+      expect(messages(later)).toEqual(["line 3"]);
+      expect(yield* storedMessages(logflare)).toEqual(["line 1", "line 2", "line 3"]);
+      expect(warnings).toEqual([
+        ["Posting postgres.logs logs of database failed; retrying", expect.anything()],
+      ]);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("warns about pending events retention deleted and ships the retained records", () =>
+    Effect.gen(function* () {
+      const { root, store, logflare, database, analytics } = yield* fixture({
+        store: { rotateBytes: 200, retainBytes: 400 },
+        logflare: {},
+      });
+      const manual = yield* makeManualClock;
+      const instances = [analytics.instance, database.instance];
+      const warnings: Array<unknown> = [];
+      const captured = Logger.layer([
+        Logger.make(({ logLevel, message }) => {
+          if (logLevel === "Warn") warnings.push(message);
+        }),
+      ]);
+      yield* analytics.set(true);
+      const first = yield* startForwarder(store, logflare, instances, manual.clock);
+      yield* database.log("first");
+      yield* logflare.next;
+      yield* logflare.discard;
+      yield* manual.sleeping(pollMillis);
+      yield* first.stop;
+      for (let index = 0; index < 30; index++) yield* database.log(`later ${index}`);
+      const retained = (yield* LogStore.streamStackLogs({ root }).pipe(Stream.runCollect)).filter(
+        (record) => record.kind === "stdout",
+      );
+
+      yield* startForwarder(store, logflare, instances, manual.clock).pipe(
+        Effect.provide(captured),
+      );
+      yield* manual.sleeping(pollMillis);
+      yield* manual.advance(postTimeoutMillis + stuckMillis);
+      const shipped: Array<string> = [];
+      while (shipped.at(-1) !== "later 29") {
+        shipped.push(...messages(yield* nextPost(logflare, manual)));
+        yield* logflare.apply();
+      }
+
+      expect(retained.map((record) => record.text)).not.toContain("first");
+      expect(shipped).toEqual(retained.map((record) => record.text));
+      expect(warnings).toEqual([
+        [
+          "Logs of database instance database were deleted before Analytics stored them; skipping 1 line",
+        ],
+        [
+          "Logs of database instance database were deleted before shipping; resuming from the next retained record",
+        ],
+      ]);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("pauses without advancing when Analytics refuses its credentials", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const { store, logflare, database, analytics } = yield* fixture();
+      const manual = yield* makeManualClock;
+      const refused = yield* Deferred.make<void>();
+      const savedAfterRefusal = yield* Deferred.make<void>();
+      const saved = (file: string) =>
+        Deferred.isDone(refused).pipe(
+          Effect.flatMap((done) =>
+            done && file.endsWith("cursor.json")
+              ? Deferred.succeed(savedAfterRefusal, undefined)
+              : Effect.void,
+          ),
+        );
+      // A cursor with neither a confirmed position nor a pending body is removed, not written.
+      const injected: FileSystem.FileSystem = {
+        ...fs,
+        rename: (from, to) => fs.rename(from, to).pipe(Effect.andThen(saved(to))),
+        remove: (file, options) => fs.remove(file, options).pipe(Effect.andThen(saved(file))),
+      };
+      yield* analytics.set(true);
+      yield* startForwarder(
+        store,
+        logflare,
+        [analytics.instance, database.instance],
+        manual.clock,
+      ).pipe(Effect.provideService(FileSystem.FileSystem, injected));
+      yield* logflare.respond(401);
+
+      yield* database.log("refused line");
+      const refusedPost = yield* logflare.next;
+      yield* Deferred.succeed(refused, undefined);
+      // A retried post first waits on the clock, so the cursor write wins only when it pauses.
+      const outcome = yield* Deferred.await(savedAfterRefusal).pipe(
+        Effect.as("paused"),
+        Effect.raceFirst(manual.sleeping(pollMillis).pipe(Effect.as("retrying"))),
+      );
+      yield* analytics.relaunch(2);
+      const resumed = yield* logflare.next;
+
+      expect(outcome).toBe("paused");
+      expect(messages(refusedPost)).toEqual(["refused line"]);
+      expect(ids(resumed)).toEqual(ids(refusedPost));
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("halves a body Analytics rejects and skips only the line it still rejects alone", () =>
+    Effect.gen(function* () {
+      const { store, logflare, database, analytics } = yield* fixture();
+      yield* analytics.set(true);
+      yield* startForwarder(store, logflare, [analytics.instance, database.instance]);
+      yield* logflare.respond(400, 400);
+
+      yield* database.log("rejected line", "accepted line");
+      const posts = [yield* logflare.next, yield* logflare.next, yield* logflare.next];
+      yield* database.log("next line");
+      const next = yield* logflare.next;
+
+      expect(posts.map(messages)).toEqual([
+        ["rejected line", "accepted line"],
+        ["rejected line"],
+        ["accepted line"],
+      ]);
+      expect(messages(next)).toEqual(["next line"]);
+      // The next line is posted only once the earlier body is confirmed stored.
+      expect((yield* storedMessages(logflare))[0]).toBe("accepted line");
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("stores a line holding NUL, replaced, instead of losing its batch", () =>
+    Effect.gen(function* () {
+      const { store, logflare, database, analytics } = yield* fixture();
+      yield* analytics.set(true);
+      yield* startForwarder(store, logflare, [analytics.instance, database.instance]);
+
+      yield* database.log("before \u0000 after", "next line");
+      const posted = yield* logflare.next;
+      yield* database.log("later");
+      yield* logflare.next;
+
+      expect(messages(posted)).toEqual(["before � after", "next line"]);
+      expect((yield* storedMessages(logflare)).slice(0, 2)).toEqual(messages(posted));
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("keeps shipping an instance's lines after a JSON line nested too deep for metadata", () =>
+    Effect.gen(function* () {
+      const { store, logflare, analytics } = yield* fixture();
+      const auth = yield* serviceSource(store, "auth");
+      yield* analytics.set(true);
+      yield* startForwarder(store, logflare, [analytics.instance, auth.instance]);
+      const depth = 16_000;
+      const deep = `{"detail":${"[".repeat(depth)}${"]".repeat(depth)}}`;
+
+      yield* auth.log(deep);
+      const posted = yield* logflare.next;
+      yield* auth.log("later line");
+      const later = yield* logflare.next;
+
+      expect(messages(posted)).toEqual([deep]);
+      expect(messages(later)).toEqual(["later line"]);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live(
+    "isolates one unstorable event among 256 by halving, skips it alone, and ships the rest",
+    () =>
+      Effect.gen(function* () {
+        const { store, logflare, database, analytics } = yield* fixture({
+          logflare: { unstorable: (event) => event.event_message === "line 100" },
+        });
+        const manual = yield* makeManualClock;
+        const warnings: Array<unknown> = [];
+        const captured = Logger.layer([
+          Logger.make(({ logLevel, message }) => {
+            if (logLevel === "Warn") warnings.push(message);
+          }),
+        ]);
+        yield* analytics.set(true);
+        yield* startForwarder(
+          store,
+          logflare,
+          [analytics.instance, database.instance],
+          manual.clock,
+        ).pipe(Effect.provide(captured));
+        const lines = Array.from({ length: 256 }, (_, index) => `line ${index}`);
+        const storedCount = storedMessages(logflare).pipe(Effect.map((stored) => stored.length));
+
+        yield* database.log(...lines);
+        const posts = yield* drive(logflare, manual, () =>
+          Effect.map(storedCount, (n) => n >= 255),
+        );
+        yield* database.log("later");
+        yield* drive(logflare, manual, () => Effect.map(storedCount, (n) => n >= 256));
+
+        expect(yield* storedMessages(logflare)).toEqual([
+          ...lines.filter((line) => line !== "line 100"),
+          "later",
+        ]);
+        expect(posts.filter((post) => post.events.length === 1).map(messages)).toContainEqual([
+          "line 100",
+        ]);
+        expect(posts.length).toBeLessThan(40);
+        expect(warnings).toEqual([
+          [
+            "Analytics has not stored 256 postgres.logs lines of database it accepted; posting them in halves",
+          ],
+          [
+            "Skipping 1 postgres.logs line of database that Analytics did not store while it stored later posts when posted on their own",
+          ],
+        ]);
+      }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live(
+    "keeps a lone unstored line pending while Analytics stores only another source's posts",
+    () =>
+      Effect.gen(function* () {
+        const { store, logflare, database, analytics } = yield* fixture({
+          logflare: { unstorable: (event) => event.event_message.startsWith("db ") },
+        });
+        const auth = yield* serviceSource(store, "auth");
+        const manual = yield* makeManualClock;
+        const isDatabase = (post: Received) => post.url.includes("source_name=postgres.logs");
+        yield* analytics.set(true);
+        yield* startForwarder(
+          store,
+          logflare,
+          [analytics.instance, database.instance, auth.instance],
+          manual.clock,
+        );
+
+        yield* database.log("db line");
+        yield* drive(logflare, manual, (posts) =>
+          Effect.succeed(posts.filter(isDatabase).length >= 2),
+        );
+        yield* database.log("db later");
+        // Storing before the answer lets auth confirm without a clock tick that could make the
+        // database line stuck; its next post shows the stored one was recorded.
+        const release = yield* logflare.hold;
+        yield* auth.log("auth line");
+        yield* logflare.next;
+        yield* logflare.apply();
+        yield* release;
+        yield* auth.log("auth later");
+        yield* logflare.next;
+        yield* logflare.apply();
+        const posts = yield* drive(logflare, manual, (taken) =>
+          Effect.succeed(taken.some(isDatabase)),
+        );
+
+        expect(posts.filter(isDatabase).map(messages)).toEqual([["db line"]]);
+        expect(yield* storedMessages(logflare)).toEqual(["auth line", "auth later"]);
+      }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("keeps every event while Analytics stores nothing and ships them once it recovers", () =>
+    Effect.gen(function* () {
+      let storing = false;
+      const { store, logflare, database, analytics } = yield* fixture({
+        logflare: { unstorable: () => !storing },
+      });
+      const manual = yield* makeManualClock;
+      const warnings: Array<unknown> = [];
+      const captured = Logger.layer([
+        Logger.make(({ logLevel, message }) => {
+          if (logLevel === "Warn") warnings.push(message);
+        }),
+      ]);
+      yield* analytics.set(true);
+      yield* startForwarder(
+        store,
+        logflare,
+        [analytics.instance, database.instance],
+        manual.clock,
+      ).pipe(Effect.provide(captured));
+      const lines = ["line 1", "line 2", "line 3", "line 4"];
+      const storedCount = storedMessages(logflare).pipe(Effect.map((stored) => stored.length));
+
+      yield* database.log(...lines);
+      yield* drive(logflare, manual, () => Effect.sync(() => warnings.length >= 2));
+      const retried = yield* drive(logflare, manual, (posts) => Effect.succeed(posts.length >= 8));
+      const warnedWhileBroken = [...warnings];
+      storing = true;
+      yield* drive(logflare, manual, () => Effect.map(storedCount, (n) => n >= 4));
+      yield* database.log("later");
+      yield* drive(logflare, manual, () => Effect.map(storedCount, (n) => n >= 5));
+
+      expect(yield* storedMessages(logflare)).toEqual([...lines, "later"]);
+      expect(warnedWhileBroken).toEqual([
+        [
+          "Analytics has not stored 4 postgres.logs lines of database it accepted; posting them in halves",
+        ],
+        [
+          "Analytics stored none of 4 postgres.logs lines of database posted on their own; waiting until it stores them",
+        ],
+      ]);
+      expect(retried.map(messages)).toEqual([...lines, ...lines].map((line) => [line]));
+      expect(warnings).toEqual(warnedWhileBroken);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("ships from the oldest retained record when its cursor is unreadable", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const { root, store, logflare, database, analytics } = yield* fixture();
+      yield* database.log("before a corrupt cursor");
+      yield* fs.writeFileString(path.join(root, "database", "database", "cursor.json"), "{oops");
+
+      yield* analytics.set(true);
+      yield* startForwarder(store, logflare, [analytics.instance, database.instance]);
+      const shipped = yield* logflare.next;
+
+      expect(messages(shipped)).toEqual(["before a corrupt cursor"]);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("restarts from the oldest retained segment when its cursor's segment was deleted", () =>
+    Effect.gen(function* () {
+      const { root, store, logflare, database, analytics } = yield* fixture({
+        store: { rotateBytes: 200, retainBytes: 400 },
+      });
+      yield* analytics.set(true);
+      const forwarder = yield* startForwarder(store, logflare, [
+        analytics.instance,
+        database.instance,
+      ]);
+      yield* database.log("first");
+      yield* logflare.next;
+      yield* database.log("second");
+      yield* logflare.next;
+      yield* analytics.set(false);
+      yield* forwarder.awaitShipping(false);
+      for (let index = 0; index < 30; index++) yield* database.log(`asleep ${index}`);
+      const retained = (yield* LogStore.streamStackLogs({ root }).pipe(Stream.runCollect)).filter(
+        (record) => record.kind === "stdout",
+      );
+
+      yield* analytics.set(true);
+      const shipped: Array<string> = [];
+      while (shipped.at(-1) !== "asleep 29") shipped.push(...messages(yield* logflare.next));
+
+      expect(retained.map((record) => record.text)).not.toContain("second");
+      expect(shipped).toEqual(retained.map((record) => record.text));
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+});
diff --git a/packages/stack/src/host/LogForwarder.ts b/packages/stack/src/host/LogForwarder.ts
new file mode 100644
index 0000000000..7fe0c513e8
--- /dev/null
+++ b/packages/stack/src/host/LogForwarder.ts
@@ -0,0 +1,921 @@
+import {
+  Cause,
+  Clock,
+  Crypto,
+  Data,
+  Duration,
+  Effect,
+  Exit,
+  FiberMap,
+  FileSystem,
+  Option,
+  Path,
+  Ref,
+  Schedule,
+  Schema,
+  Scope,
+  Semaphore,
+  Stream,
+  SubscriptionRef,
+} from "effect";
+import { HttpClient, HttpClientError, HttpClientRequest } from "effect/unstable/http";
+import type { CompositionConfig } from "../Orchestrator.ts";
+import type { ServiceObservation } from "../Service.ts";
+import type { ServiceCreation } from "../services/Catalog.ts";
+import type { CatalogError, ServiceEndpoint } from "../services/Recipe.ts";
+import { errorCode } from "../internal/sharing-violation.ts";
+import { reapStaleWrites, writeFileAtomically } from "../State.ts";
+import {
+  isShippedService,
+  logflareEvent,
+  logflareSources,
+  type LogflareEvent,
+  type ShippedService,
+} from "./LogflareEvents.ts";
+import { LogPosition, type LogRecord } from "./LogRecord.ts";
+import type * as LogStore from "./LogStore.ts";
+
+export interface ForwardedInstance {
+  readonly id: string;
+  readonly service: ServiceCreation["service"];
+  readonly endpoint: (name: string) => Effect.Effect<ServiceEndpoint, CatalogError>;
+  /** The current saved creation; Analytics' API key is read from it per body. */
+  readonly creation: Effect.Effect<ServiceCreation>;
+  readonly observation: Stream.Stream<ServiceObservation<unknown>>;
+}
+
+export class StoredEventsError extends Schema.TaggedError<StoredEventsError>()(
+  "StoredEventsError",
+  { message: Schema.String, cause: Schema.optionalKey(Schema.Defect()) },
+) {}
+
+/** Which shipped events an Analytics instance has stored. */
+export interface StoredEvents {
+  /** The subset of `ids` stored for `source`; failures are retried and reported by the view. */
+  readonly storedIds: (
+    source: string,
+    ids: ReadonlyArray<string>,
+  ) => Effect.Effect<ReadonlySet<string>, StoredEventsError>;
+}
+
+interface Interface {
+  /** Ships a shipped service's persisted logs, or tracks an Analytics instance as the target. */
+  readonly attach: (instance: ForwardedInstance) => Effect.Effect<void>;
+  /** Stops following an instance; returns once no cursor write of it can still land. */
+  readonly detach: (instanceId: string) => Effect.Effect<void>;
+  /** Re-selects the shipping target after the composition changes. */
+  readonly rebind: Effect.Effect<void>;
+  /** Emits whether records are currently shipped; the current value first. */
+  readonly shipping: Stream.Stream<boolean>;
+}
+
+export interface LogForwarderOptions {
+  readonly composition: Effect.Effect<CompositionConfig>;
+  readonly logs: LogStore.Interface;
+  /** Opens the stored-event view of an Analytics target; its scope closes when the target changes. */
+  readonly storedEvents: (
+    analytics: ForwardedInstance,
+  ) => Effect.Effect<StoredEvents, never, Scope.Scope>;
+}
+
+interface Candidate {
+  readonly instance: ForwardedInstance;
+  readonly serving: boolean;
+  readonly launchId: number | undefined;
+}
+
+interface Target {
+  readonly instance: ForwardedInstance;
+  readonly epoch: number;
+  /** Names the Analytics launch; launches seen by different forwarders never share a name. */
+  readonly launch: string;
+  readonly stored: StoredEvents;
+  /** One permit per session using `stored`; the view closes once a retired target has none. */
+  readonly users: Semaphore.Semaphore;
+  /** Per source, the latest post to this launch, by sequence number, that Analytics stored events of. */
+  readonly storedPost: Ref.Ref<ReadonlyMap<string, number>>;
+}
+
+/** A shipped event; its id derives from the instance and record position. */
+interface ShippedEvent extends LogflareEvent {
+  readonly id: string;
+}
+
+class StaleTarget extends Data.TaggedError("StaleTarget")<{}> {}
+
+/** A body's end position, source and event ids. */
+const Shipment = Schema.Struct({
+  ...LogPosition.fields,
+  source: Schema.String,
+  ids: Schema.Array(Schema.String),
+});
+interface Shipment extends Schema.Schema.Type<typeof Shipment> {}
+
+/** A shipment posted to Analytics whose events are not all confirmed stored yet. */
+const Pending = Schema.Struct({
+  ...Shipment.fields,
+  /** The Analytics launch the latest post went to. */
+  launch: Schema.String,
+  /** When the latest post ends at the latest, by its timeout. */
+  postEndsAt: Schema.Finite,
+});
+interface Pending extends Schema.Schema.Type<typeof Pending> {}
+
+/** The last confirmed position, if any, and the pending body after it. */
+const Cursor = Schema.Union([
+  Schema.Struct({ ...LogPosition.fields, pending: Schema.optionalKey(Pending) }),
+  Schema.Struct({ pending: Pending }),
+]);
+type Cursor = Schema.Schema.Type<typeof Cursor>;
+
+interface Progress {
+  readonly confirmed: LogPosition | undefined;
+  readonly pending: Pending | undefined;
+}
+
+/** One instance's shipping against one target. */
+interface Session {
+  readonly instanceId: string;
+  readonly service: ShippedService;
+  readonly directory: string;
+  readonly current: Target;
+  readonly progress: Ref.Ref<Progress>;
+  /** Held while a post is in flight. */
+  readonly posting: Semaphore.Semaphore;
+  /** When this session started serving the target. */
+  readonly resumedAt: number;
+}
+
+/** `unsettled` posts may have reached Analytics without an answer; `failed` ones were not queued. */
+type Delivery = "sent" | "unsettled" | "failed" | "refused" | "rejected";
+
+/** Whether a settle already warned of failed posts and of rejected bodies. */
+interface Warned {
+  readonly post: Ref.Ref<boolean>;
+  readonly rejection: Ref.Ref<boolean>;
+}
+
+const batchEvents = 256;
+export const batchBytes = 1024 * 1024;
+/** How long after a post ended its events may still be stored by a launch that stopped. */
+export const flushWindowMillis = 5_000;
+/** How often stored ids are checked while a body is unconfirmed. */
+export const pollMillis = 250;
+/** The first delay of the shared retry backoff. */
+export const retryMillis = 500;
+/** The longest a post may take, so a pending body knows when its post ended at the latest. */
+export const postTimeoutMillis = 5_000;
+/**
+ * How long a live launch may take to store what it accepted: past it, the serving launch's
+ * unstored events count as dropped, and a previous owner's launch has stopped or drained.
+ */
+export const stuckMillis = 60_000;
+/** More sessions than can share one target. */
+const targetUsers = 2 ** 30;
+const envelopeBytes = '{"batch":[]}'.length;
+const cursorFile = "cursor.json";
+const encoder = new TextEncoder();
+const decodeCursor = Schema.decodeUnknownEffect(Schema.fromJsonString(Cursor));
+const encodeCursor = Schema.encodeEffect(Schema.fromJsonString(Cursor));
+const retrySchedule = Schedule.exponential(Duration.millis(retryMillis), 2).pipe(
+  Schedule.modifyDelay(({ duration }) =>
+    Effect.succeed(Duration.min(duration, Duration.seconds(10))),
+  ),
+);
+
+const after = (position: LogPosition, cursor: LogPosition | undefined) =>
+  cursor === undefined ||
+  position.generation > cursor.generation ||
+  (position.generation === cursor.generation && position.byteOffset > cursor.byteOffset);
+
+const positionOf = ({ generation, byteOffset }: LogPosition): LogPosition => ({
+  generation,
+  byteOffset,
+});
+
+const progressOf = (cursor: Cursor): Progress => ({
+  confirmed: "generation" in cursor ? positionOf(cursor) : undefined,
+  pending: cursor.pending,
+});
+
+const cursorOf = ({ confirmed, pending }: Progress): Cursor | undefined => {
+  if (confirmed !== undefined) return pending === undefined ? confirmed : { ...confirmed, pending };
+  return pending === undefined ? undefined : { pending };
+};
+
+interface Body<A> {
+  readonly body: string;
+  readonly items: ReadonlyArray<A>;
+  readonly last: A;
+}
+
+/** Groups serialized events into request bodies of at most 256 events and `batchBytes` bytes. */
+export const bodies = <A extends { readonly event: ShippedEvent }>(
+  events: ReadonlyArray<A>,
+): ReadonlyArray<Body<A>> => {
+  const result: Array<Body<A>> = [];
+  let current: Array<string> = [];
+  let items: Array<A> = [];
+  let size = envelopeBytes;
+  const close = () => {
+    const last = items.at(-1);
+    if (last !== undefined) result.push({ body: `{"batch":[${current.join(",")}]}`, items, last });
+    current = [];
+    items = [];
+    size = envelopeBytes;
+  };
+  for (const item of events) {
+    const serialized = JSON.stringify(item.event);
+    const bytes = encoder.encode(serialized).length;
+    if (current.length > 0 && (current.length >= batchEvents || size + 1 + bytes > batchBytes))
+      close();
+    size += (current.length > 0 ? 1 : 0) + bytes;
+    current.push(serialized);
+    items.push(item);
+  }
+  close();
+  return result;
+};
+
+const lines = (count: number, source: string) =>
+  `${count} ${source} ${count === 1 ? "line" : "lines"}`;
+
+/** Splits ids into two halves, the first one longer by at most one. */
+const halves = (ids: ReadonlyArray<string>): Array<ReadonlyArray<string>> => {
+  const middle = Math.ceil(ids.length / 2);
+  return [ids.slice(0, middle), ids.slice(middle)].filter((half) => half.length > 0);
+};
+
+const rejectedStatus = (error: unknown): number | undefined =>
+  error instanceof HttpClientError.HttpClientError && error.reason._tag === "StatusCodeError"
+    ? error.reason.response.status
+    : undefined;
+
+/** The target refused its credentials or route, so no body can succeed until it changes. */
+const isTargetRejection = (error: unknown): boolean =>
+  [401, 403, 404].includes(rejectedStatus(error) ?? 0);
+
+/** The body itself was refused and cannot succeed on a repeat. */
+const isBodyRejection = (error: unknown): boolean => {
+  const status = rejectedStatus(error);
+  return (
+    status !== undefined &&
+    status >= 400 &&
+    status < 500 &&
+    ![401, 403, 404, 408, 429].includes(status)
+  );
+};
+
+/** Connection failures that mean a request never reached Analytics. */
+const unsentCodes = new Set([
+  "ECONNREFUSED",
+  "ENOTFOUND",
+  "EHOSTUNREACH",
+  "ENETUNREACH",
+  "EADDRNOTAVAIL",
+  "EAI_AGAIN",
+]);
+
+/** A post that timed out or broke after it was sent, so Analytics may have queued its events. */
+const mayHaveQueued = (error: unknown): boolean => {
+  if (Cause.isTimeoutError(error)) return true;
+  if (!(error instanceof HttpClientError.HttpClientError)) return false;
+  const { reason } = error;
+  if (reason._tag === "TransportError") return !unsentCodes.has(errorCode(reason.cause) ?? "");
+  return reason._tag === "DecodeError" || reason._tag === "EmptyBodyError";
+};
+
+const warnOnce = (warned: Ref.Ref<boolean>, message: string, error: unknown) =>
+  Ref.getAndSet(warned, true).pipe(
+    Effect.flatMap((already) => (already ? Effect.void : Effect.logWarning(message, error))),
+  );
+
+/** Retries with the shared backoff, warning on the first failure only. */
+const retryWarningOnce =
+  (message: string) =>
+  <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+    Ref.make(false).pipe(
+      Effect.flatMap((warned) =>
+        effect.pipe(
+          Effect.tapError((error) => warnOnce(warned, message, error)),
+          Effect.retry(retrySchedule),
+        ),
+      ),
+    );
+
+/**
+ * Ships persisted service logs to Analytics' direct backend while the composed Analytics instance
+ * is running and healthy. Each instance resumes from its cursor, so records written while
+ * Analytics sleeps are shipped after it wakes; shipping never wakes Analytics. Logflare accepts a
+ * post before storing it and drops a whole batch holding an already stored id, so the cursor
+ * passes a body only once `storedEvents` reports all of it, and only missing events are posted.
+ */
+export const make = Effect.fn("LogForwarder.make")(function* (options: LogForwarderOptions) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const crypto = yield* Crypto.Crypto;
+  const client = (yield* HttpClient.HttpClient).pipe(HttpClient.filterStatusOk);
+  const forwarderScope = yield* Effect.scope;
+  const candidates = yield* Ref.make<ReadonlyMap<string, Candidate>>(new Map());
+  const target = yield* SubscriptionRef.make<Target | undefined>(undefined);
+  /** The composition's member ids; instances outside it, such as shadow databases, are not shipped. */
+  const memberIds = yield* SubscriptionRef.make<ReadonlySet<string>>(new Set());
+  const targetScope = yield* Ref.make<
+    { readonly scope: Scope.Closeable; readonly users: Semaphore.Semaphore } | undefined
+  >(undefined);
+  const epochs = yield* Ref.make(0);
+  const rebinding = yield* Semaphore.make(1);
+  const run = yield* crypto.randomUUIDv4;
+  const launchPrefix = `${run}:`;
+  const launchOf = (candidate: Candidate) =>
+    `${launchPrefix}${candidate.instance.id}:${candidate.launchId ?? "unknown"}`;
+  let postSequence = 0;
+
+  const rebind = Effect.gen(function* () {
+    const members = new Set((yield* options.composition).members.map(({ id }) => id));
+    yield* SubscriptionRef.set(memberIds, members);
+    const serving = [...(yield* Ref.get(candidates)).values()].find(
+      (candidate) => candidate.serving && members.has(candidate.instance.id),
+    );
+    const previous = yield* SubscriptionRef.get(target);
+    if (
+      serving?.instance === previous?.instance &&
+      (serving === undefined || launchOf(serving) === previous?.launch)
+    )
+      return;
+    const epoch = yield* Ref.updateAndGet(epochs, (value) => value + 1);
+    const scope = serving === undefined ? undefined : yield* Scope.fork(forwarderScope);
+    const next =
+      serving === undefined || scope === undefined
+        ? undefined
+        : {
+            instance: serving.instance,
+            epoch,
+            launch: launchOf(serving),
+            stored: yield* options.storedEvents(serving.instance).pipe(Scope.provide(scope)),
+            users: yield* Semaphore.make(targetUsers),
+            storedPost: yield* Ref.make<ReadonlyMap<string, number>>(new Map()),
+          };
+    const retired = yield* Ref.getAndSet(
+      targetScope,
+      scope === undefined || next === undefined ? undefined : { scope, users: next.users },
+    );
+    yield* SubscriptionRef.set(target, next);
+    yield* next === undefined
+      ? Effect.logInfo("Log shipping paused until Analytics is running and healthy")
+      : Effect.logInfo(
+          `Log shipping targets Analytics instance ${next.instance.id}, launch ${serving?.launchId ?? "unknown"}`,
+        );
+    if (retired !== undefined)
+      yield* Effect.forkIn(
+        retired.users.take(targetUsers).pipe(Effect.andThen(Scope.close(retired.scope, Exit.void))),
+        forwarderScope,
+      );
+  }).pipe(Semaphore.withPermits(rebinding, 1));
+
+  const trackTarget = (instance: ForwardedInstance) =>
+    instance.observation.pipe(
+      Stream.takeUntil((observation) => !observation.registered),
+      Stream.runForEach((observation) =>
+        Ref.update(candidates, (current) =>
+          new Map(current).set(instance.id, {
+            instance,
+            serving: observation.lifecycle === "running" && observation.health === "healthy",
+            launchId: observation.launchId,
+          }),
+        ).pipe(Effect.andThen(rebind)),
+      ),
+      Effect.ensuring(
+        Ref.update(candidates, (current) => {
+          const next = new Map(current);
+          next.delete(instance.id);
+          return next;
+        }).pipe(Effect.andThen(rebind)),
+      ),
+    );
+
+  const serving = SubscriptionRef.changes(target).pipe(
+    Stream.filter((current) => current !== undefined),
+    Stream.take(1),
+    Stream.runHead,
+    Effect.flatMap(Effect.fromOption),
+    Effect.orDie,
+  );
+  const retargeted = (current: Target) =>
+    SubscriptionRef.changes(target).pipe(
+      Stream.filter((latest) => latest?.epoch !== current.epoch),
+      Stream.take(1),
+      Stream.runDrain,
+    );
+  const requireCurrent = (current: Target) =>
+    SubscriptionRef.get(target).pipe(
+      Effect.flatMap((latest) =>
+        latest?.epoch === current.epoch ? Effect.void : Effect.fail(new StaleTarget()),
+      ),
+    );
+
+  /** A missing or unreadable cursor ships from the oldest retained segment. */
+  const readCursor = (directory: string) =>
+    fs.readFileString(path.join(directory, cursorFile)).pipe(
+      Effect.map(Option.some),
+      Effect.catchIf(
+        (error) => error.reason._tag === "NotFound",
+        () => Effect.succeed(Option.none<string>()),
+      ),
+      Effect.flatMap(
+        Option.match({
+          onNone: () => Effect.succeed<Progress>({ confirmed: undefined, pending: undefined }),
+          onSome: (text) => decodeCursor(text).pipe(Effect.map(progressOf)),
+        }),
+      ),
+      Effect.catch(() =>
+        Effect.logWarning(
+          `Unreadable log cursor in ${directory}; shipping from the oldest retained record`,
+        ).pipe(Effect.as<Progress>({ confirmed: undefined, pending: undefined })),
+      ),
+    );
+  const writeCursor = Effect.fnUntraced(function* (directory: string, progress: Progress) {
+    const cursor = cursorOf(progress);
+    const target = path.join(directory, cursorFile);
+    if (cursor === undefined) return yield* fs.remove(target, { force: true });
+    const content = yield* encodeCursor(cursor);
+    yield* writeFileAtomically(fs, path, { directory, target, content });
+  });
+
+  /** Saves progress before acting on it, so the in-memory position never passes the file. */
+  const persist = (session: Session, next: Progress) =>
+    writeCursor(session.directory, next).pipe(
+      // Detaching waits for a started write instead of leaving files in the directory.
+      Effect.uninterruptible,
+      retryWarningOnce(`Saving the log cursor of ${session.instanceId} failed; retrying`),
+      Effect.andThen(Ref.set(session.progress, next)),
+    );
+
+  const eventId = Effect.fnUntraced(function* (instanceId: string, position: LogPosition) {
+    const digest = yield* crypto.digest(
+      "SHA-256",
+      encoder.encode(`${instanceId}\0${position.generation}\0${position.byteOffset}`),
+    );
+    const hex = Array.from(digest.slice(0, 16), (byte) => byte.toString(16).padStart(2, "0"));
+    hex[6] = `8${(hex[6] ?? "00").slice(1)}`;
+    hex[8] = ((Number.parseInt(hex[8] ?? "00", 16) & 0x3f) | 0x80).toString(16).padStart(2, "0");
+    const text = hex.join("");
+    return `${text.slice(0, 8)}-${text.slice(8, 12)}-${text.slice(12, 16)}-${text.slice(16, 20)}-${text.slice(20)}`;
+  });
+
+  /** The event of an output record, or `undefined` for markers and deletion gaps. */
+  const shippedEvent = Effect.fnUntraced(function* (session: Session, record: LogRecord) {
+    if (record.position === undefined || (record.kind !== "stdout" && record.kind !== "stderr"))
+      return undefined;
+    const shipped: { readonly position: LogPosition; readonly event: ShippedEvent } = {
+      position: record.position,
+      event: {
+        id: yield* eventId(session.instanceId, record.position),
+        ...logflareEvent(session.service, record.timestamp, record.text ?? ""),
+      },
+    };
+    return shipped;
+  });
+
+  const post = Effect.fn("LogForwarder.post")(function* (
+    current: Target,
+    source: string,
+    body: string,
+    deadline: number,
+  ) {
+    yield* requireCurrent(current);
+    const creation = yield* current.instance.creation;
+    const apiKey = creation.service === "analytics" ? creation.config.apiKey : undefined;
+    if (apiKey === undefined) return yield* new StaleTarget();
+    const endpoint = yield* current.instance.endpoint("http");
+    const remaining = deadline - (yield* Clock.currentTimeMillis);
+    yield* client
+      .execute(
+        HttpClientRequest.post(
+          `http://${endpoint.host ?? "127.0.0.1"}:${endpoint.port}/api/logs`,
+        ).pipe(
+          HttpClientRequest.setUrlParam("source_name", source),
+          HttpClientRequest.setHeader("x-api-key", apiKey),
+          HttpClientRequest.bodyText(body, "application/json"),
+        ),
+      )
+      .pipe(
+        Effect.flatMap((response) => response.text),
+        Effect.timeout(Duration.millis(Math.max(remaining, 0))),
+      );
+  });
+
+  /** Posts one body of `lines` events once, ending by `deadline`, and classifies the answer. */
+  const deliver = (
+    session: Session,
+    source: string,
+    body: Body<{ readonly event: ShippedEvent }>,
+    deadline: number,
+    warned: Warned,
+  ) =>
+    post(session.current, source, body.body, deadline).pipe(
+      session.posting.withPermits(1),
+      Effect.as<Delivery>("sent"),
+      Effect.catchIf(isTargetRejection, (error) =>
+        Effect.logWarning(
+          `Analytics refused ${source} logs of ${session.instanceId}; pausing until it changes`,
+          error,
+        ).pipe(Effect.as<Delivery>("refused")),
+      ),
+      Effect.catch((error) => {
+        if (error._tag === "StaleTarget") return Effect.fail(error);
+        if (isBodyRejection(error))
+          return warnOnce(
+            warned.rejection,
+            `Analytics rejected a body of ${lines(body.items.length, source)} of ${session.instanceId}; posting it again in halves to skip only the lines it rejects alone`,
+            error,
+          ).pipe(Effect.as<Delivery>("rejected"));
+        if (!mayHaveQueued(error))
+          return warnOnce(
+            warned.post,
+            `Posting ${source} logs of ${session.instanceId} failed; retrying`,
+            error,
+          ).pipe(Effect.as<Delivery>("failed"));
+        return warnOnce(
+          warned.post,
+          `Posting ${source} logs of ${session.instanceId} got no answer; waiting until Analytics stores them`,
+          error,
+        ).pipe(Effect.as<Delivery>("unsettled"));
+      }),
+    );
+
+  /**
+   * Advances past a shipment once Analytics stored all its events, posting only missing events.
+   * A post that may have been queued is posted again only once the launch that took it can no
+   * longer store it: after `flushWindowMillis` for an ended launch of this owner, after
+   * `stuckMillis` for a previous owner's launch. Events the current launch leaves unstored for
+   * `stuckMillis` are posted again in halves; one that still is not stored on its own is skipped
+   * once a later post to the launch was stored, and kept pending otherwise. A refused
+   * target clears the pending body and pauses; a rejected body is posted in halves until each
+   * event Analytics still rejects on its own is skipped.
+   */
+  const settle = Effect.fn("LogForwarder.settle")(function* (
+    session: Session,
+    shipment: Shipment,
+    events: ReadonlyMap<string, ShippedEvent>,
+    posted: Pending | undefined,
+  ) {
+    const { source } = shipment;
+    yield* Effect.annotateCurrentSpan({
+      source,
+      instance_id: session.instanceId,
+      launch: session.current.launch,
+      event_count: shipment.ids.length,
+    });
+    const warned: Warned = { post: yield* Ref.make(false), rejection: yield* Ref.make(false) };
+    const counts = { checks: 0, checkAttempts: 0, posts: 0, deleted: 0, stuck: 0, skipped: 0 };
+    let remaining = shipment.ids;
+    /** The sequence number of the latest post, and the ids it carried. */
+    let lastPost = 0;
+    let lastPosted: ReadonlySet<string> = new Set();
+    let latest: { readonly queuedIn: string | undefined; readonly endedAt: number } | undefined =
+      posted === undefined ? undefined : { queuedIn: posted.launch, endedAt: posted.postEndsAt };
+
+    /** Only the first attempt of the first check is traced; the rest are counted on this span. */
+    const storedIds = (ids: ReadonlyArray<string>) =>
+      Effect.suspend(() => {
+        const check = session.current.stored.storedIds(source, ids);
+        return counts.checkAttempts++ === 0 ? check : check.pipe(Effect.withTracerEnabled(false));
+      }).pipe(Effect.retry(retrySchedule));
+
+    /** Posts `initial` until Analytics stored it, and returns the ids left unstored for `stuckMillis`. */
+    const deliverAll = Effect.fnUntraced(function* (initial: ReadonlyArray<string>) {
+      let wanted = initial;
+      delivering: while (true) {
+        counts.checks++;
+        const stored = yield* storedIds(wanted);
+        if (lastPost > 0 && [...lastPosted].some((id) => stored.has(id)))
+          yield* Ref.update(session.current.storedPost, (posts) =>
+            new Map(posts).set(source, Math.max(posts.get(source) ?? 0, lastPost)),
+          );
+        const missing = wanted.filter((id) => !stored.has(id));
+        if (missing.length === 0) return [];
+        const now = yield* Clock.currentTimeMillis;
+        if (latest !== undefined) {
+          const { queuedIn, endedAt } = latest;
+          if (queuedIn === session.current.launch) {
+            // Only time this session served the launch counts, not time Analytics was unhealthy.
+            if (now >= Math.max(endedAt, session.resumedAt) + stuckMillis) return missing;
+            yield* Effect.sleep(pollMillis);
+            continue;
+          }
+          // This owner starts a launch only after the previous one exited; another owner's launch
+          // may still be draining its queue.
+          const drained =
+            queuedIn === undefined || queuedIn.startsWith(launchPrefix)
+              ? flushWindowMillis
+              : stuckMillis;
+          if (now < endedAt + drained) {
+            yield* Effect.sleep(pollMillis);
+            continue;
+          }
+        }
+        const deleted = new Set(missing.filter((id) => !events.has(id)));
+        if (deleted.size > 0) {
+          yield* Effect.logWarning(
+            `Logs of ${session.service} instance ${session.instanceId} were deleted before Analytics stored them; skipping ${deleted.size === 1 ? "1 line" : `${deleted.size} lines`}`,
+          );
+          counts.deleted += deleted.size;
+          wanted = wanted.filter((id) => !deleted.has(id));
+          remaining = remaining.filter((id) => !deleted.has(id));
+        }
+        const resend = missing.flatMap((id) => {
+          const event = events.get(id);
+          return event === undefined ? [] : [{ event }];
+        });
+        if (resend.length === 0) return [];
+        let queuedIn: string | undefined;
+        for (const body of bodies(resend)) {
+          const deadline = (yield* Clock.currentTimeMillis) + postTimeoutMillis;
+          yield* persist(session, {
+            confirmed: (yield* Ref.get(session.progress)).confirmed,
+            pending: {
+              ...positionOf(shipment),
+              source,
+              ids: remaining,
+              launch: session.current.launch,
+              postEndsAt: deadline,
+            },
+          });
+          // A slow cursor write leaves no time to post by the saved deadline.
+          if ((yield* Clock.currentTimeMillis) >= deadline) continue delivering;
+          counts.posts++;
+          lastPost = ++postSequence;
+          lastPosted = new Set(body.items.map(({ event }) => event.id));
+          const delivery = yield* deliver(session, source, body, deadline, warned);
+          if (delivery === "refused") {
+            yield* persist(session, {
+              confirmed: (yield* Ref.get(session.progress)).confirmed,
+              pending: undefined,
+            });
+            return yield* new StaleTarget();
+          }
+          if (delivery === "rejected") return "rejected";
+          if (delivery !== "failed") queuedIn = session.current.launch;
+        }
+        latest = { queuedIn, endedAt: yield* Clock.currentTimeMillis };
+      }
+    });
+
+    /**
+     * Posts the ids Analytics left unstored in halves until each unstored one was posted alone.
+     * A lone unstored id is skipped only once a later post to this launch got stored, which shows
+     * Analytics is storing; otherwise it is posted alone again in the next round.
+     */
+    const isolate = Effect.fnUntraced(function* (initial: ReadonlyArray<string>) {
+      const idleWarned = yield* Ref.make(false);
+      let groups = halves(initial);
+      while (groups.length > 0) {
+        const suspects: Array<{ readonly id: string; readonly post: number }> = [];
+        const skipped = new Set<string>();
+        let rejected = 0;
+        for (let group = groups.shift(); group !== undefined; group = groups.shift()) {
+          latest = undefined;
+          const left = yield* deliverAll(group);
+          const [lone] = group;
+          if (left === "rejected") {
+            if (group.length === 1 && lone !== undefined) {
+              skipped.add(lone);
+              rejected++;
+            } else groups.unshift(...halves(group));
+          } else if (left.length > 0) {
+            if (group.length === 1 && lone !== undefined)
+              suspects.push({ id: lone, post: lastPost });
+            else groups.unshift(...halves(left));
+          }
+        }
+        const proof = (yield* Ref.get(session.current.storedPost)).get(source) ?? 0;
+        for (const suspect of suspects) if (proof > suspect.post) skipped.add(suspect.id);
+        if (skipped.size > 0) {
+          yield* Effect.logWarning(
+            `Skipping ${lines(skipped.size, source)} of ${session.instanceId} that Analytics ${
+              rejected === skipped.size
+                ? "rejected"
+                : rejected === 0
+                  ? "did not store while it stored later posts"
+                  : `rejected (${rejected}) or did not store while it stored later posts`
+            } when posted on their own`,
+          );
+          remaining = remaining.filter((id) => !skipped.has(id));
+          counts.skipped += skipped.size;
+        }
+        groups = suspects.flatMap(({ id }) => (skipped.has(id) ? [] : [[id]]));
+        if (groups.length > 0)
+          yield* Ref.getAndSet(idleWarned, true).pipe(
+            Effect.flatMap((already) =>
+              already
+                ? Effect.void
+                : Effect.logWarning(
+                    `Analytics stored none of ${lines(groups.length, source)} of ${session.instanceId} posted on their own; waiting until it stores them`,
+                  ),
+            ),
+          );
+      }
+    });
+
+    yield* Effect.gen(function* () {
+      const stuck = yield* deliverAll(shipment.ids);
+      if (stuck === "rejected") yield* isolate([...lastPosted]);
+      else if (stuck.length > 0) {
+        counts.stuck = stuck.length;
+        yield* Effect.logWarning(
+          `Analytics has not stored ${lines(stuck.length, source)} of ${session.instanceId} it accepted; posting them in halves`,
+        );
+        yield* isolate(stuck);
+      }
+      yield* persist(session, { confirmed: positionOf(shipment), pending: undefined });
+    }).pipe(
+      // Counted on every exit, so a stuck or retargeted settle still shows its progress.
+      Effect.ensuring(
+        Effect.suspend(() =>
+          Effect.annotateCurrentSpan({
+            check_count: counts.checks,
+            check_attempt_count: counts.checkAttempts,
+            post_count: counts.posts,
+            deleted_count: counts.deleted,
+            stuck_count: counts.stuck,
+            skipped_count: counts.skipped,
+          }),
+        ),
+      ),
+    );
+  });
+
+  /** Rebuilds a pending body from its retained records and settles it. */
+  const reconcile = Effect.fn("LogForwarder.reconcile")(function* (
+    session: Session,
+    confirmed: LogPosition | undefined,
+    pending: Pending,
+  ) {
+    yield* Effect.annotateCurrentSpan({
+      instance_id: session.instanceId,
+      source: pending.source,
+      pending_count: pending.ids.length,
+    });
+    const end = positionOf(pending);
+    const wanted = new Set(pending.ids);
+    const events = new Map<string, ShippedEvent>();
+    yield* Effect.scoped(
+      options.logs.read(session.instanceId, { from: confirmed ?? "oldest", follow: false }).pipe(
+        Effect.flatMap((records) =>
+          records.pipe(
+            Stream.takeWhile((record) => {
+              const at = record.position ?? record.resumeAt;
+              return at === undefined || !after(at, end);
+            }),
+            Stream.runForEach((record) =>
+              shippedEvent(session, record).pipe(
+                Effect.map((shipped) => {
+                  if (shipped !== undefined && wanted.has(shipped.event.id))
+                    events.set(shipped.event.id, shipped.event);
+                }),
+              ),
+            ),
+          ),
+        ),
+      ),
+    );
+    yield* Effect.annotateCurrentSpan({ recovered_count: events.size });
+    yield* settle(session, pending, events, pending);
+  });
+
+  /** Ships one instance's records from its cursor until the target changes. */
+  const session = (
+    instanceId: string,
+    service: ShippedService,
+    current: Target,
+    failing: Ref.Ref<boolean>,
+    posting: Semaphore.Semaphore,
+  ) =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const directory = yield* options.logs.directory(instanceId);
+        const saved = yield* readCursor(directory);
+        const progress = yield* Ref.make(saved);
+        const shipping: Session = {
+          instanceId,
+          service,
+          directory,
+          current,
+          progress,
+          posting,
+          resumedAt: yield* Clock.currentTimeMillis,
+        };
+        if (saved.pending !== undefined) yield* reconcile(shipping, saved.confirmed, saved.pending);
+        const from = (yield* Ref.get(progress)).confirmed ?? "oldest";
+        const records = yield* options.logs.read(instanceId, { from, follow: true });
+        const source = logflareSources[service];
+        yield* records.pipe(
+          Stream.runForEachArray((page) =>
+            Effect.gen(function* () {
+              const { confirmed } = yield* Ref.get(progress);
+              const unshipped: Array<{
+                readonly position: LogPosition;
+                readonly event: ShippedEvent;
+              }> = [];
+              for (const record of page) {
+                if (record.position === undefined) {
+                  yield* Effect.logWarning(
+                    `Logs of ${service} instance ${instanceId} were deleted before shipping; resuming from the next retained record`,
+                  );
+                  continue;
+                }
+                if (!after(record.position, confirmed)) continue;
+                const shipped = yield* shippedEvent(shipping, record);
+                if (shipped !== undefined) unshipped.push(shipped);
+              }
+              for (const { items, last } of bodies(unshipped)) {
+                yield* settle(
+                  shipping,
+                  { ...last.position, source, ids: items.map(({ event }) => event.id) },
+                  new Map(items.map(({ event }) => [event.id, event])),
+                  undefined,
+                );
+                yield* Ref.set(failing, false);
+              }
+            }),
+          ),
+        );
+      }),
+    ).pipe(current.users.withPermits(1));
+
+  const unregistered = (instance: ForwardedInstance) =>
+    instance.observation.pipe(
+      Stream.filter((observation) => !observation.registered),
+      Stream.take(1),
+      Stream.runDrain,
+    );
+
+  /** Waits until the instance joins the composition, or leaves it. */
+  const membership = (instanceId: string, member: boolean) =>
+    SubscriptionRef.changes(memberIds).pipe(
+      Stream.filter((ids) => ids.has(instanceId) === member),
+      Stream.take(1),
+      Stream.runDrain,
+    );
+
+  /** Ships until the instance unregisters or the store detaches its logs, which ends a session. */
+  const forward = (instance: ForwardedInstance, service: ShippedService) =>
+    Effect.gen(function* () {
+      while (true) {
+        yield* membership(instance.id, true);
+        const current = yield* serving;
+        const failing = yield* Ref.make(false);
+        const posting = yield* Semaphore.make(1);
+        // A stopped or refused target pauses shipping until it changes; a failed log read resumes
+        // from the cursor after a backoff.
+        const detached = yield* session(instance.id, service, current, failing, posting).pipe(
+          Effect.tapError((error) =>
+            error._tag === "StaleTarget"
+              ? Effect.void
+              : warnOnce(failing, `Reading ${instance.id} logs to ship failed; retrying`, error),
+          ),
+          Effect.retry({
+            schedule: retrySchedule,
+            while: (error) => error._tag !== "StaleTarget",
+          }),
+          Effect.as(true),
+          Effect.catch(() => retargeted(current).pipe(Effect.as(false))),
+          // A retarget or leaving the composition lets a started post finish, so its answer decides
+          // the pending body.
+          Effect.raceFirst(
+            Effect.raceFirst(retargeted(current), membership(instance.id, false)).pipe(
+              Effect.andThen(posting.take(1)),
+              Effect.as(false),
+            ),
+          ),
+        );
+        if (detached)
+          return yield* Effect.logDebug(`Log shipping of ${instance.id} stopped with its logs`);
+      }
+    }).pipe(Effect.raceFirst(unregistered(instance)));
+
+  const followers = yield* FiberMap.make<string>();
+  const attach = Effect.fn("LogForwarder.attach")(function* (instance: ForwardedInstance) {
+    if (instance.service === "analytics")
+      yield* FiberMap.run(followers, instance.id, trackTarget(instance));
+    else if (isShippedService(instance.service)) {
+      // A cursor write cut short by a crash leaves its temporary directory behind.
+      yield* options.logs.directory(instance.id).pipe(
+        Effect.flatMap((directory) => reapStaleWrites(fs, path, directory)),
+        Effect.ignore,
+      );
+      yield* FiberMap.run(followers, instance.id, forward(instance, instance.service));
+    }
+  });
+
+  return {
+    attach,
+    detach: (instanceId) => FiberMap.remove(followers, instanceId),
+    rebind,
+    shipping: SubscriptionRef.changes(target).pipe(
+      Stream.map((current) => current !== undefined),
+      Stream.changes,
+    ),
+  } satisfies Interface;
+});
diff --git a/packages/stack/src/host/LogForwarder.unit.test.ts b/packages/stack/src/host/LogForwarder.unit.test.ts
new file mode 100644
index 0000000000..c81292313a
--- /dev/null
+++ b/packages/stack/src/host/LogForwarder.unit.test.ts
@@ -0,0 +1,36 @@
+import { expect, it } from "@effect/vitest";
+import { batchBytes, bodies } from "./LogForwarder.ts";
+
+const encoder = new TextEncoder();
+
+const eventWith = (message: string) => ({
+  event: {
+    id: "00000000-0000-8000-8000-000000000000",
+    appname: "database" as const,
+    event_message: message,
+    timestamp: "2026-09-30T10:00:00.000Z",
+    metadata: {},
+  },
+});
+
+// Ten events whose single `{"batch":[...]}` body would be exactly `total` bytes.
+const eventsForBody = (total: number) => {
+  const empty = JSON.stringify(eventWith("").event).length;
+  const available = total - '{"batch":[]}'.length - 9 - 10 * empty;
+  return Array.from({ length: 10 }, (_, index) =>
+    eventWith("x".repeat(Math.floor(available / 10) + (index === 9 ? available % 10 : 0))),
+  );
+};
+
+const sizes = (events: ReturnType<typeof eventsForBody>) =>
+  bodies(events).map(({ body }) => encoder.encode(body).length);
+
+it("keeps a body whose full JSON envelope is exactly the byte limit in one request", () => {
+  expect(sizes(eventsForBody(batchBytes))).toEqual([batchBytes]);
+});
+
+it("splits a body that the JSON envelope would push past the byte limit", () => {
+  const split = sizes(eventsForBody(batchBytes + 1));
+  expect(split).toHaveLength(2);
+  expect(split.every((size) => size <= batchBytes)).toBe(true);
+});
diff --git a/packages/stack/src/host/LogRecord.ts b/packages/stack/src/host/LogRecord.ts
new file mode 100644
index 0000000000..fb4fba125d
--- /dev/null
+++ b/packages/stack/src/host/LogRecord.ts
@@ -0,0 +1,363 @@
+import { DateTime, Schema } from "effect";
+import type { LaunchOutput } from "../runtime/Session.ts";
+
+const OutputStream = Schema.Literals(["stdout", "stderr"]);
+type OutputStream = Schema.Schema.Type<typeof OutputStream>;
+
+/** A byte position in an instance's log segments. */
+export const LogPosition = Schema.Struct({
+  generation: Schema.Int,
+  byteOffset: Schema.Int,
+});
+export interface LogPosition extends Schema.Schema.Type<typeof LogPosition> {}
+
+/**
+ * One output line, launch, or `lost` marker; a gap over deleted segments has `resumeAt` instead
+ * of `position`.
+ */
+export const LogRecord = Schema.Struct({
+  kind: Schema.Literals(["stdout", "stderr", "launch", "lost"]),
+  timestamp: Schema.String,
+  launchId: Schema.optionalKey(Schema.Int),
+  text: Schema.optionalKey(Schema.String),
+  truncated: Schema.optionalKey(Schema.Boolean),
+  stream: Schema.optionalKey(OutputStream),
+  count: Schema.optionalKey(Schema.Int),
+  position: Schema.optionalKey(LogPosition),
+  resumeAt: Schema.optionalKey(LogPosition),
+});
+export interface LogRecord extends Schema.Schema.Type<typeof LogRecord> {}
+
+/** A log record of one service instance in a stack. */
+export const StackLogRecord = LogRecord.pipe(
+  Schema.fieldsAssign({ service: Schema.String, instanceId: Schema.String }),
+);
+export interface StackLogRecord extends Schema.Schema.Type<typeof StackLogRecord> {}
+
+/** A record before it is written; `timestamp` is epoch milliseconds. */
+export type LogEntry =
+  | {
+      readonly kind: OutputStream;
+      readonly timestamp: number;
+      readonly launchId: number;
+      readonly text: string;
+      readonly truncated: boolean;
+    }
+  | { readonly kind: "launch"; readonly timestamp: number; readonly launchId: number }
+  | {
+      readonly kind: "lost";
+      readonly timestamp: number;
+      readonly launchId: number;
+      /** Absent when the dropped chunks' streams are unknown. */
+      readonly stream?: OutputStream;
+      readonly count: number;
+    };
+
+/** Lines are cut at this many UTF-8 bytes. */
+const maxLineBytes = 32 * 1024;
+
+const encoder = new TextEncoder();
+
+/** Encodes one record as `<ISO time> <kind> <launch id>[ truncated] | <text>\n`. */
+export const encodeEntry = (entry: LogEntry): string => {
+  const time = DateTime.formatIso(DateTime.makeUnsafe(entry.timestamp));
+  switch (entry.kind) {
+    case "launch":
+      return `${time} launch ${entry.launchId} | \n`;
+    case "lost":
+      return `${time} lost ${entry.launchId} | ${entry.count} ${entry.stream ?? "output"}\n`;
+    default:
+      return `${time} ${entry.kind} ${entry.launchId}${entry.truncated ? " truncated" : ""} | ${entry.text}\n`;
+  }
+};
+
+const recordLine = /^(\S+) (stdout|stderr|launch|lost) (\d+)( truncated)? \| (.*)$/su;
+const lostText = /^(\d+) (stdout|stderr|output)$/u;
+
+/** Parses one record line without its trailing newline; unrecognized lines yield `undefined`. */
+export const parseRecord = (line: string, position: LogPosition): LogRecord | undefined => {
+  const match = recordLine.exec(line);
+  if (match === null) return undefined;
+  const [, timestamp = "", kind, launch = "", truncated, text = ""] = match;
+  const launchId = Number(launch);
+  if (kind === "stdout" || kind === "stderr")
+    return {
+      kind,
+      timestamp,
+      launchId,
+      text,
+      ...(truncated === undefined ? {} : { truncated: true }),
+      position,
+    };
+  if (kind === "launch") return { kind, timestamp, launchId, position };
+  const lost = lostText.exec(text);
+  const stream = lost?.[2];
+  return {
+    kind: "lost",
+    timestamp,
+    launchId,
+    ...(lost === null ? {} : { count: Number(lost[1]) }),
+    ...(stream === "stdout" || stream === "stderr" ? { stream } : {}),
+    position,
+  };
+};
+
+/** The file name of a segment generation. */
+export const segmentName = (generation: number) => `${String(generation).padStart(10, "0")}.log`;
+
+/** The generation a segment file name encodes, or `undefined` for other files. */
+export const segmentGeneration = (name: string): number | undefined => {
+  const match = /^(\d+)\.log$/u.exec(name);
+  const generation = match === null ? Number.NaN : Number(match[1]);
+  // Only the name `segmentName` gives a generation, so a listed segment can be opened again.
+  return Number.isSafeInteger(generation) && segmentName(generation) === name
+    ? generation
+    : undefined;
+};
+
+interface LineState {
+  readonly launchId: number;
+  readonly part: number;
+  readonly stream: OutputStream;
+  decoder: TextDecoder;
+  text: string;
+  bytes: number;
+  since: number | undefined;
+  /** Bytes the decoder holds until their character completes. */
+  held: Uint8Array;
+  /** Publish time of the first held byte. */
+  heldSince: number | undefined;
+  /** Publish time of the latest chunk. */
+  lastChunk: number;
+  midCarriageReturn: boolean;
+  discarding: boolean;
+}
+
+/** Converts tagged output chunks into records, keeping line state per launch, part and stream. */
+export interface Splitter {
+  /** Records take the publish time of their first byte. */
+  readonly push: (chunk: LaunchOutput) => ReadonlyArray<LogEntry>;
+  /** Marks a launch ended; `flushEnded` flushes its partial lines. */
+  readonly endLaunch: (launchId: number) => void;
+  /**
+   * Flushes partial lines of ended launches: those of launches still ending once `idle` proves
+   * every published chunk split, and late ones once they are idle for a grace.
+   */
+  readonly flushEnded: (now: number, idle: boolean) => ReadonlyArray<LogEntry>;
+  /** The earliest time `flushEnded` has a partial line to flush, already past while a launch ends. */
+  readonly endedDue: () => number | undefined;
+  readonly flush: (now: number) => ReadonlyArray<LogEntry>;
+}
+
+/** Launches older than this many launches behind the newest lose their line state. */
+const retainedLaunches = 4;
+/** A launch first seen this far behind the newest may get a second `launch` record. */
+const seenLaunches = 64;
+/** A late partial line of an ended launch waits this long for its newline. */
+export const endedLineGraceMillis = 2_000;
+
+const noBytes = new Uint8Array(0);
+
+/** The length of the UTF-8 sequence that `bytes` ends inside and a later chunk completes. */
+const incompleteLength = (bytes: Uint8Array) => {
+  for (let index = bytes.length - 1; index >= Math.max(0, bytes.length - 4); index--) {
+    const byte = bytes[index] ?? 0;
+    if ((byte & 0xc0) === 0x80) continue;
+    const width = byte >= 0xf0 ? 4 : byte >= 0xe0 ? 3 : byte >= 0xc0 ? 2 : 1;
+    return bytes.length - index < width ? bytes.length - index : 0;
+  }
+  return 0;
+};
+
+/** The last four bytes of the held bytes followed by `bytes`. */
+const lastBytes = (held: Uint8Array, bytes: Uint8Array) => {
+  if (bytes.length >= 4) return bytes.subarray(bytes.length - 4);
+  const joined = new Uint8Array(held.length + bytes.length);
+  joined.set(held);
+  joined.set(bytes, held.length);
+  return joined.subarray(Math.max(0, joined.length - 4));
+};
+
+/** Splits lines like `Stream.decodeText` plus `Stream.splitLines`, per launch, part and stream. */
+export const makeSplitter = (limit = maxLineBytes): Splitter => {
+  const states = new Map<string, LineState>();
+  const ended = new Set<number>();
+  /** Ended launches whose partial lines wait only for the output published before the end. */
+  const ending = new Set<number>();
+  const latestParts = new Map<number, number>();
+  /** Next expected `seq` per launch, which spans the launch's streams and parts. */
+  const expected = new Map<number, number>();
+  const seen = new Set<number>();
+  let latest = 0;
+
+  const resetLine = (state: LineState) => {
+    state.text = "";
+    state.bytes = 0;
+    state.since = undefined;
+    state.discarding = false;
+  };
+  const append = (state: LineState, piece: string, time: number, out: Array<LogEntry>) => {
+    if (piece.length === 0 || state.discarding) return;
+    state.since ??= time;
+    const size = encoder.encode(piece).length;
+    if (state.bytes + size <= limit) {
+      state.text += piece;
+      state.bytes += size;
+      return;
+    }
+    const kept = piece.slice(
+      0,
+      encoder.encodeInto(piece, new Uint8Array(limit - state.bytes)).read,
+    );
+    out.push({
+      kind: state.stream,
+      timestamp: state.since,
+      launchId: state.launchId,
+      text: state.text + kept,
+      truncated: true,
+    });
+    resetLine(state);
+    state.discarding = true;
+  };
+  const terminate = (state: LineState, now: number, out: Array<LogEntry>) => {
+    if (!state.discarding)
+      out.push({
+        kind: state.stream,
+        timestamp: state.since ?? now,
+        launchId: state.launchId,
+        text: state.text,
+        truncated: false,
+      });
+    resetLine(state);
+  };
+  const resetDecoder = (state: LineState) => {
+    state.decoder = new TextDecoder();
+    state.held = noBytes;
+    state.heldSince = undefined;
+    state.midCarriageReturn = false;
+  };
+  const flushLine = (state: LineState, now: number, out: Array<LogEntry>) => {
+    append(state, state.decoder.decode(), state.heldSince ?? now, out);
+    resetDecoder(state);
+    if (state.since !== undefined && !state.discarding) terminate(state, now, out);
+    else resetLine(state);
+  };
+  const pending = (state: LineState) => state.since !== undefined || state.heldSince !== undefined;
+
+  const push = (chunk: LaunchOutput) => {
+    const now = chunk.time;
+    const out: Array<LogEntry> = [];
+    if (chunk.launchId > latest) {
+      for (const state of states.values())
+        if (state.launchId < chunk.launchId) flushLine(state, now, out);
+      latest = chunk.launchId;
+      const stale = (launchId: number) => launchId <= latest - retainedLaunches;
+      for (const [key, state] of states) if (stale(state.launchId)) states.delete(key);
+      for (const launchId of ended) if (stale(launchId)) ended.delete(launchId);
+      for (const launchId of ending) if (stale(launchId)) ending.delete(launchId);
+      for (const launchId of latestParts.keys()) if (stale(launchId)) latestParts.delete(launchId);
+      for (const launchId of expected.keys()) if (stale(launchId)) expected.delete(launchId);
+      for (const launchId of seen) if (launchId <= latest - seenLaunches) seen.delete(launchId);
+    }
+    if (!seen.has(chunk.launchId)) {
+      seen.add(chunk.launchId);
+      out.push({ kind: "launch", timestamp: now, launchId: chunk.launchId });
+    }
+    const latestPart = latestParts.get(chunk.launchId);
+    if (latestPart === undefined || chunk.part > latestPart) {
+      for (const state of states.values())
+        if (state.launchId === chunk.launchId && state.part < chunk.part)
+          flushLine(state, now, out);
+      latestParts.set(chunk.launchId, chunk.part);
+    }
+    const key = `${chunk.launchId}:${chunk.part}:${chunk.stream}`;
+    let state = states.get(key);
+    if (state === undefined) {
+      state = {
+        launchId: chunk.launchId,
+        part: chunk.part,
+        stream: chunk.stream,
+        decoder: new TextDecoder(),
+        text: "",
+        bytes: 0,
+        since: undefined,
+        held: noBytes,
+        heldSince: undefined,
+        lastChunk: now,
+        midCarriageReturn: false,
+        discarding: false,
+      };
+      states.set(key, state);
+    }
+    state.lastChunk = now;
+    const next = expected.get(chunk.launchId) ?? 0;
+    if (chunk.seq > next) {
+      out.push({ kind: "lost", timestamp: now, launchId: chunk.launchId, count: chunk.seq - next });
+      // The dropped chunks may have torn a line of any stream of the launch.
+      for (const torn of states.values())
+        if (torn.launchId === chunk.launchId) {
+          resetLine(torn);
+          resetDecoder(torn);
+        }
+    }
+    expected.set(chunk.launchId, Math.max(next, chunk.seq + 1));
+    const carried = state.heldSince;
+    const text = state.decoder.decode(chunk.bytes, { stream: true });
+    const tail = lastBytes(state.held, chunk.bytes);
+    const held = incompleteLength(tail);
+    state.held = tail.slice(tail.length - held);
+    state.heldSince = held === 0 ? undefined : held > chunk.bytes.length ? (carried ?? now) : now;
+    if (text.length > 0) {
+      let from = state.midCarriageReturn && text.startsWith("\n") ? 1 : 0;
+      state.midCarriageReturn = false;
+      let time = carried ?? now;
+      const terminator = /\r\n|\r|\n/gu;
+      terminator.lastIndex = from;
+      for (let match = terminator.exec(text); match !== null; match = terminator.exec(text)) {
+        append(state, text.slice(from, match.index), time, out);
+        terminate(state, now, out);
+        time = now;
+        from = match.index + match[0].length;
+      }
+      append(state, text.slice(from), time, out);
+      state.midCarriageReturn = text.endsWith("\r");
+    }
+    return out;
+  };
+
+  const endLaunch = (launchId: number) => {
+    if (ended.has(launchId)) return;
+    ended.add(launchId);
+    ending.add(launchId);
+  };
+
+  const flushEnded = (now: number, idle: boolean) => {
+    const out: Array<LogEntry> = [];
+    for (const state of states.values())
+      if (
+        ended.has(state.launchId) &&
+        pending(state) &&
+        ((idle && ending.has(state.launchId)) || now - state.lastChunk >= endedLineGraceMillis)
+      )
+        flushLine(state, now, out);
+    if (idle) ending.clear();
+    return out;
+  };
+
+  const endedDue = () => {
+    if (ending.size > 0) return Number.NEGATIVE_INFINITY;
+    let due: number | undefined;
+    for (const state of states.values())
+      if (ended.has(state.launchId) && pending(state))
+        due = Math.min(due ?? Number.POSITIVE_INFINITY, state.lastChunk + endedLineGraceMillis);
+    return due;
+  };
+
+  const flush = (now: number) => {
+    const out: Array<LogEntry> = [];
+    for (const state of states.values()) flushLine(state, now, out);
+    return out;
+  };
+
+  return { push, endLaunch, flushEnded, endedDue, flush };
+};
diff --git a/packages/stack/src/host/LogRecord.unit.test.ts b/packages/stack/src/host/LogRecord.unit.test.ts
new file mode 100644
index 0000000000..4cdd384f2a
--- /dev/null
+++ b/packages/stack/src/host/LogRecord.unit.test.ts
@@ -0,0 +1,346 @@
+import { describe, expect, it } from "@effect/vitest";
+import type { LaunchOutput } from "../runtime/Session.ts";
+import {
+  encodeEntry,
+  makeSplitter,
+  endedLineGraceMillis,
+  parseRecord,
+  segmentGeneration,
+  segmentName,
+  type LogEntry,
+  type Splitter,
+} from "./LogRecord.ts";
+
+const bytes = (text: string) => new TextEncoder().encode(text);
+const chunk = (
+  launchId: number,
+  seq: number,
+  text: string,
+  stream: "stdout" | "stderr" = "stdout",
+  part = 0,
+): LaunchOutput => ({ stream, bytes: bytes(text), launchId, part, seq, time: 0 });
+/** Pushes a chunk as if it had been published at `time`. */
+const push = (splitter: Splitter, value: LaunchOutput, time: number) =>
+  splitter.push({ ...value, time });
+const lines = (entries: ReadonlyArray<LogEntry>) =>
+  entries.flatMap((entry) =>
+    entry.kind === "stdout" || entry.kind === "stderr" ? [entry.text] : [],
+  );
+const position = { generation: 3, byteOffset: 42 };
+
+describe("record format", () => {
+  it("round-trips every record kind with its launch id", () => {
+    const entries: ReadonlyArray<LogEntry> = [
+      { kind: "stdout", timestamp: 0, launchId: 2, text: "ready | with a pipe", truncated: false },
+      { kind: "stderr", timestamp: 1_000, launchId: 2, text: "cut", truncated: true },
+      { kind: "launch", timestamp: 2_000, launchId: 3 },
+      { kind: "lost", timestamp: 3_000, launchId: 3, stream: "stderr", count: 7 },
+      { kind: "lost", timestamp: 4_000, launchId: 3, count: 1 },
+    ];
+
+    const encoded = entries.map(encodeEntry);
+    const parsed = encoded.map((line) => parseRecord(line.slice(0, -1), position));
+
+    expect(encoded[0]).toBe("1970-01-01T00:00:00.000Z stdout 2 | ready | with a pipe\n");
+    expect(encoded[1]).toBe("1970-01-01T00:00:01.000Z stderr 2 truncated | cut\n");
+    expect(encoded[4]).toBe("1970-01-01T00:00:04.000Z lost 3 | 1 output\n");
+    expect(parsed).toEqual([
+      {
+        kind: "stdout",
+        timestamp: "1970-01-01T00:00:00.000Z",
+        launchId: 2,
+        text: "ready | with a pipe",
+        position,
+      },
+      {
+        kind: "stderr",
+        timestamp: "1970-01-01T00:00:01.000Z",
+        launchId: 2,
+        text: "cut",
+        truncated: true,
+        position,
+      },
+      { kind: "launch", timestamp: "1970-01-01T00:00:02.000Z", launchId: 3, position },
+      {
+        kind: "lost",
+        timestamp: "1970-01-01T00:00:03.000Z",
+        launchId: 3,
+        stream: "stderr",
+        count: 7,
+        position,
+      },
+      { kind: "lost", timestamp: "1970-01-01T00:00:04.000Z", launchId: 3, count: 1, position },
+    ]);
+  });
+
+  it("ignores lines that are not records", () => {
+    expect(parseRecord("half a rec", position)).toBeUndefined();
+    expect(parseRecord("2026-09-29T10:00:00.000Z info 1 | text", position)).toBeUndefined();
+  });
+
+  it("names segments so only generation files are listed", () => {
+    expect(segmentName(12)).toBe("0000000012.log");
+    expect(segmentGeneration(segmentName(12))).toBe(12);
+    expect(segmentGeneration("cursor.json")).toBeUndefined();
+    expect(segmentGeneration("0000000012.log.tmp")).toBeUndefined();
+    expect(segmentGeneration("12.log")).toBeUndefined();
+    expect(segmentGeneration("99999999999999999999.log")).toBeUndefined();
+  });
+});
+
+describe("splitter", () => {
+  it("joins lines across chunk boundaries, including split CRLF and multibyte text", () => {
+    const splitter = makeSplitter();
+    const euro = bytes("€");
+    const first = push(splitter, chunk(1, 0, "alpha\r"), 10);
+    const second = push(splitter, chunk(1, 1, "\nbe"), 20);
+    const third = push(
+      splitter,
+      {
+        stream: "stdout",
+        bytes: new Uint8Array([...bytes("ta "), ...euro.subarray(0, 1)]),
+        launchId: 1,
+        part: 0,
+        seq: 2,
+        time: 0,
+      },
+      30,
+    );
+    const fourth = push(
+      splitter,
+      {
+        stream: "stdout",
+        bytes: new Uint8Array([...euro.subarray(1), 0x0a]),
+        launchId: 1,
+        part: 0,
+        seq: 3,
+        time: 0,
+      },
+      40,
+    );
+
+    expect(first[0]).toEqual({ kind: "launch", timestamp: 10, launchId: 1 });
+    expect(lines(first)).toEqual(["alpha"]);
+    expect(lines(second)).toEqual([]);
+    expect(third).toEqual([]);
+    expect(fourth).toEqual([
+      { kind: "stdout", timestamp: 20, launchId: 1, text: "beta €", truncated: false },
+    ]);
+  });
+
+  it("treats a lone carriage return and empty lines as line ends", () => {
+    const splitter = makeSplitter();
+
+    expect(lines(push(splitter, chunk(1, 0, "10%\r20%\r\n\nnext\n"), 0))).toEqual([
+      "10%",
+      "20%",
+      "",
+      "next",
+    ]);
+  });
+
+  it("keeps a late chunk of an earlier launch in that launch after a later launch starts", () => {
+    const splitter = makeSplitter();
+    push(splitter, chunk(1, 0, "failed par"), 10);
+
+    const relaunched = push(splitter, chunk(2, 0, "second\n"), 20);
+    const late = push(splitter, chunk(1, 1, "late\n"), 30);
+
+    expect(relaunched).toEqual([
+      { kind: "stdout", timestamp: 10, launchId: 1, text: "failed par", truncated: false },
+      { kind: "launch", timestamp: 20, launchId: 2 },
+      { kind: "stdout", timestamp: 20, launchId: 2, text: "second", truncated: false },
+    ]);
+    expect(late).toEqual([
+      { kind: "stdout", timestamp: 30, launchId: 1, text: "late", truncated: false },
+    ]);
+  });
+
+  it("keeps an ended launch's lines open until its published output is split", () => {
+    const splitter = makeSplitter();
+    const euro = bytes("€");
+    push(
+      splitter,
+      { ...chunk(1, 0, ""), bytes: new Uint8Array([...bytes("price "), euro[0] ?? 0]) },
+      10,
+    );
+    push(splitter, chunk(1, 1, "busy\r", "stderr"), 10);
+
+    splitter.endLaunch(1);
+    const queued = [
+      ...push(
+        splitter,
+        { ...chunk(1, 2, ""), bytes: new Uint8Array([...euro.subarray(1), ...bytes("\ntail")]) },
+        15,
+      ),
+      ...push(splitter, chunk(1, 3, "\nnext\n", "stderr"), 15),
+      ...splitter.flushEnded(15, false),
+    ];
+    const flushed = splitter.flushEnded(20, true);
+
+    expect(lines(queued)).toEqual(["price €", "next"]);
+    expect(flushed).toEqual([
+      { kind: "stdout", timestamp: 15, launchId: 1, text: "tail", truncated: false },
+    ]);
+  });
+
+  it("flushes a launch's partial line after it ends and keeps a late line whole across batches", () => {
+    const splitter = makeSplitter();
+    push(splitter, chunk(1, 0, "no newline"), 10);
+
+    splitter.endLaunch(1);
+    const ended = splitter.flushEnded(20, true);
+    const early = [...push(splitter, chunk(1, 1, "late "), 30), ...splitter.flushEnded(31, true)];
+    const completed = [
+      ...push(splitter, chunk(1, 2, "tail\n"), 40),
+      ...splitter.flushEnded(41, true),
+    ];
+
+    expect(ended).toEqual([
+      { kind: "stdout", timestamp: 10, launchId: 1, text: "no newline", truncated: false },
+    ]);
+    expect(early).toEqual([]);
+    expect(completed).toEqual([
+      { kind: "stdout", timestamp: 30, launchId: 1, text: "late tail", truncated: false },
+    ]);
+  });
+
+  it("flushes a late partial of an ended launch once it stays idle for the grace", () => {
+    const splitter = makeSplitter();
+    splitter.endLaunch(1);
+    splitter.flushEnded(0, true);
+    push(splitter, chunk(1, 0, "idle partial"), 50);
+
+    const waiting = splitter.flushEnded(50 + endedLineGraceMillis - 1, true);
+    const flushed = splitter.flushEnded(50 + endedLineGraceMillis, true);
+
+    expect(waiting).toEqual([]);
+    expect(lines(flushed)).toEqual(["idle partial"]);
+  });
+  it("reports a whole process of a launch whose chunks were dropped", () => {
+    const splitter = makeSplitter();
+    push(splitter, chunk(1, 0, "startup\n", "stdout", 0), 10);
+
+    const main = push(splitter, chunk(1, 3, "main\n", "stdout", 2), 20);
+
+    expect(main).toEqual([
+      { kind: "lost", timestamp: 20, launchId: 1, count: 2 },
+      { kind: "stdout", timestamp: 20, launchId: 1, text: "main", truncated: false },
+    ]);
+  });
+
+  it("stamps a line with the publish time of its first byte when a character spans chunks", () => {
+    const splitter = makeSplitter();
+    const euro = bytes("€");
+
+    const first = push(splitter, { ...chunk(1, 0, ""), bytes: euro.subarray(0, 1) }, 10);
+    const second = push(
+      splitter,
+      { ...chunk(1, 1, ""), bytes: new Uint8Array([...euro.subarray(1), 0x0a]) },
+      20,
+    );
+
+    expect(first).toEqual([{ kind: "launch", timestamp: 10, launchId: 1 }]);
+    expect(second).toEqual([
+      { kind: "stdout", timestamp: 10, launchId: 1, text: "€", truncated: false },
+    ]);
+  });
+
+  it.each(["€", "😀"])(
+    "stamps a line with its first byte's time when %s spans one chunk per byte",
+    (character) => {
+      const splitter = makeSplitter();
+      const encoded = bytes(`${character}\n`);
+
+      const pushed = Array.from(encoded, (byte, seq) =>
+        push(splitter, { ...chunk(1, seq, ""), bytes: new Uint8Array([byte]) }, 10 * (seq + 1)),
+      );
+
+      expect(pushed.at(-1)).toEqual([
+        { kind: "stdout", timestamp: 10, launchId: 1, text: character, truncated: false },
+      ]);
+    },
+  );
+
+  it("ends a startup command's unterminated line when the main process of the launch starts", () => {
+    const splitter = makeSplitter();
+    push(splitter, chunk(1, 0, "migrations applied", "stdout", 0), 10);
+
+    const main = push(splitter, chunk(1, 1, "listening\n", "stdout", 1), 20);
+
+    expect(main).toEqual([
+      { kind: "stdout", timestamp: 10, launchId: 1, text: "migrations applied", truncated: false },
+      { kind: "stdout", timestamp: 20, launchId: 1, text: "listening", truncated: false },
+    ]);
+  });
+
+  it("reports a sequence gap as lost chunks and drops the interrupted partial line", () => {
+    const splitter = makeSplitter();
+    push(splitter, chunk(1, 0, "interrupted"), 10);
+
+    const resumed = push(splitter, chunk(1, 4, "resumed\n", "stdout"), 20);
+
+    expect(resumed).toEqual([
+      { kind: "lost", timestamp: 20, launchId: 1, count: 3 },
+      { kind: "stdout", timestamp: 20, launchId: 1, text: "resumed", truncated: false },
+    ]);
+  });
+
+  it("reports a dropped final stderr chunk as lost output when only stdout follows", () => {
+    const splitter = makeSplitter();
+    push(splitter, chunk(1, 0, "before\n"), 10);
+    push(splitter, chunk(1, 1, "warning\n", "stderr"), 20);
+
+    const after = push(splitter, chunk(1, 3, "after\n"), 30);
+
+    expect(after).toEqual([
+      { kind: "lost", timestamp: 30, launchId: 1, count: 1 },
+      { kind: "stdout", timestamp: 30, launchId: 1, text: "after", truncated: false },
+    ]);
+  });
+
+  it("marks the first chunk of an earlier launch that arrives after a later launch", () => {
+    const splitter = makeSplitter();
+    push(splitter, chunk(2, 0, "second\n"), 10);
+
+    const late = push(splitter, chunk(1, 0, "failed early\n"), 20);
+
+    expect(late).toEqual([
+      { kind: "launch", timestamp: 20, launchId: 1 },
+      { kind: "stdout", timestamp: 20, launchId: 1, text: "failed early", truncated: false },
+    ]);
+  });
+
+  it("reports chunks lost before the first one it sees", () => {
+    const splitter = makeSplitter();
+
+    expect(push(splitter, chunk(5, 2, "x\n", "stderr"), 0).slice(0, 2)).toEqual([
+      { kind: "launch", timestamp: 0, launchId: 5 },
+      { kind: "lost", timestamp: 0, launchId: 5, count: 2 },
+    ]);
+  });
+
+  it("truncates an over-long line at a character boundary and drops the rest of it", () => {
+    const splitter = makeSplitter(8);
+
+    const first = push(splitter, chunk(1, 0, "abcdefg€"), 10);
+    const rest = push(splitter, chunk(1, 1, "more\nnext\n", "stdout"), 20);
+
+    expect(first.slice(1)).toEqual([
+      { kind: "stdout", timestamp: 10, launchId: 1, text: "abcdefg", truncated: true },
+    ]);
+    expect(rest).toEqual([
+      { kind: "stdout", timestamp: 20, launchId: 1, text: "next", truncated: false },
+    ]);
+  });
+
+  it("keeps stdout and stderr lines apart", () => {
+    const splitter = makeSplitter();
+    push(splitter, chunk(1, 0, "out "), 0);
+    push(splitter, chunk(1, 1, "err\n", "stderr"), 0);
+
+    expect(splitter.flush(1)).toEqual([
+      { kind: "stdout", timestamp: 0, launchId: 1, text: "out ", truncated: false },
+    ]);
+  });
+});
diff --git a/packages/stack/src/host/LogStore.integration.test.ts b/packages/stack/src/host/LogStore.integration.test.ts
new file mode 100644
index 0000000000..6afa5b2a60
--- /dev/null
+++ b/packages/stack/src/host/LogStore.integration.test.ts
@@ -0,0 +1,1002 @@
+import { NodeServices } from "@effect/platform-node";
+import { describe, expect, it } from "@effect/vitest";
+import {
+  Clock,
+  Deferred,
+  Effect,
+  Exit,
+  Fiber,
+  FileSystem,
+  Latch,
+  Path,
+  PlatformError,
+  PubSub,
+  Queue,
+  Scope,
+  Stream,
+  SubscriptionRef,
+} from "effect";
+import { TestClock } from "effect/testing";
+import type { LaunchOutput } from "../runtime/Session.ts";
+import {
+  endedLineGraceMillis,
+  segmentGeneration,
+  segmentName,
+  type LogRecord,
+} from "./LogRecord.ts";
+import * as LogStore from "./LogStore.ts";
+
+const encoder = new TextEncoder();
+
+const fakeInstance = (
+  instanceId: string,
+  options: { readonly service?: string; readonly capacity?: number } = {},
+) =>
+  Effect.gen(function* () {
+    const logs =
+      options.capacity === undefined
+        ? yield* PubSub.unbounded<LaunchOutput>()
+        : yield* PubSub.sliding<LaunchOutput>(options.capacity);
+    const launch = yield* SubscriptionRef.make<{ readonly launchId: number | undefined }>({
+      launchId: undefined,
+    });
+    const sequences = new Map<number, number>();
+    const chunk = (launchId: number, text: string, stream: "stdout" | "stderr" = "stdout") => {
+      const seq = sequences.get(launchId) ?? 0;
+      sequences.set(launchId, seq + 1);
+      const next: LaunchOutput = {
+        stream,
+        bytes: encoder.encode(text),
+        launchId,
+        part: 0,
+        seq,
+        time: 0,
+      };
+      return next;
+    };
+    return {
+      service: options.service ?? "auth",
+      instanceId,
+      logs: PubSub.subscribe(logs),
+      observation: SubscriptionRef.changes(launch),
+      publish: (...chunks: ReadonlyArray<LaunchOutput>) =>
+        Clock.currentTimeMillis.pipe(
+          Effect.flatMap((time) =>
+            PubSub.publishAll(
+              logs,
+              chunks.map((chunk) => ({ ...chunk, time })),
+            ),
+          ),
+        ),
+      chunk,
+      setLaunch: (launchId: number | undefined) => SubscriptionRef.set(launch, { launchId }),
+    };
+  });
+
+/** Opens a store in a child of the test's scope so a test can close it like an owner stop. */
+const openStore = (root: string, options: Omit<LogStore.LogStoreOptions, "root"> = {}) =>
+  Effect.gen(function* () {
+    const scope = yield* Scope.fork(yield* Scope.Scope);
+    const store = yield* LogStore.make({ root, ...options }).pipe(Scope.provide(scope));
+    return { store, close: Scope.close(scope, Exit.void) };
+  });
+
+/** A file system whose segment writes run `writeAll` in place of the real file's. */
+const replaceWrites = (
+  fs: FileSystem.FileSystem,
+  writeAll: (
+    file: FileSystem.File,
+    buffer: Uint8Array,
+  ) => Effect.Effect<void, PlatformError.PlatformError>,
+): FileSystem.FileSystem => ({
+  ...fs,
+  open: (target, options) =>
+    fs.open(target, options).pipe(
+      Effect.map((file): FileSystem.File => ({
+        [FileSystem.FileTypeId]: FileSystem.FileTypeId,
+        stat: file.stat,
+        seek: (offset, from) => file.seek(offset, from),
+        sync: file.sync,
+        read: (buffer) => file.read(buffer),
+        readAlloc: (size) => file.readAlloc(size),
+        truncate: (length) => file.truncate(length),
+        write: (buffer) => file.write(buffer),
+        writeAll: (buffer) => writeAll(file, buffer),
+      })),
+    ),
+});
+
+/** Reads persisted records offline, one instance after another in file order. */
+const persisted = (options: Parameters<typeof LogStore.streamStackLogs>[0]) =>
+  LogStore.streamStackLogs(options).pipe(Stream.runCollect);
+
+const lostCounts = (records: Iterable<LogRecord>) =>
+  Array.from(records).flatMap(({ kind, launchId, stream, count }) =>
+    kind === "lost" ? [{ launchId, stream, count }] : [],
+  );
+
+/** Takes `count` items; `Queue.takeN` returns fewer once it has waited for the first. */
+const takeExactly = <A>(queue: Queue.Dequeue<A>, count: number) =>
+  Effect.gen(function* () {
+    const taken: Array<A> = [];
+    while (taken.length < count)
+      taken.push(...(yield* Queue.takeBetween(queue, 1, count - taken.length)));
+    return taken;
+  });
+
+/** Collects records from a stream into a queue for incremental assertions. */
+const collect = (
+  opened: Effect.Effect<
+    Stream.Stream<LogRecord, LogStore.LogStoreError>,
+    LogStore.LogStoreError,
+    Scope.Scope
+  >,
+) =>
+  Effect.gen(function* () {
+    const stream = yield* opened;
+    const records = yield* Queue.unbounded<LogRecord>();
+    const fiber = yield* stream.pipe(
+      Stream.runForEach((record) => Queue.offer(records, record)),
+      Effect.forkScoped,
+    );
+    return { records, fiber, take: (count: number) => takeExactly(records, count) };
+  });
+
+/** Takes records until one carries `text`, returning every record taken. */
+const untilLast = (
+  reader: { readonly take: (count: number) => Effect.Effect<Iterable<LogRecord>> },
+  text: string,
+) =>
+  Effect.gen(function* () {
+    const taken: Array<LogRecord> = [];
+    while (taken.at(-1)?.text !== text) taken.push(...(yield* reader.take(1)));
+    return taken;
+  });
+
+const texts = (records: Iterable<LogRecord>) =>
+  Array.from(records).flatMap((record) =>
+    record.kind === "stdout" || record.kind === "stderr" ? [record.text ?? ""] : [],
+  );
+
+const tempRoot = (prefix: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    return yield* fs.makeTempDirectoryScoped({ prefix });
+  });
+
+describe("LogStore", () => {
+  it.effect("follows a burst larger than the live buffer and sees every record exactly once", () =>
+    Effect.gen(function* () {
+      const root = yield* tempRoot("log-store-burst-");
+      const { store } = yield* openStore(root);
+      const instance = yield* fakeInstance("burst");
+      yield* store.attach(instance);
+      const release = yield* Latch.make();
+      const seen: Array<LogRecord> = [];
+      const follower = yield* (yield* store.read("burst", { from: "oldest", follow: true })).pipe(
+        Stream.tap((record) => (record.kind === "launch" ? release.await : Effect.void)),
+        Stream.take(1_001),
+        Stream.runForEach((record) => Effect.sync(() => seen.push(record))),
+        Effect.forkScoped,
+      );
+
+      yield* instance.publish(
+        ...Array.from({ length: 1_000 }, (_, index) => instance.chunk(1, `line ${index}\n`)),
+      );
+      yield* release.open;
+      yield* Fiber.join(follower);
+
+      expect(texts(seen)).toEqual(Array.from({ length: 1_000 }, (_, index) => `line ${index}`));
+      const offline = yield* persisted({ root });
+      expect(offline.map(({ position }) => position)).toEqual(seen.map(({ position }) => position));
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("records chunks the upstream buffer dropped as lost", () =>
+    Effect.gen(function* () {
+      const root = yield* tempRoot("log-store-overflow-");
+      const { store } = yield* openStore(root);
+      const instance = yield* fakeInstance("overflow", { capacity: 4 });
+      yield* store.attach(instance);
+      const reader = yield* collect(store.read("overflow", { from: "oldest", follow: true }));
+
+      yield* instance.publish(
+        ...Array.from({ length: 10 }, (_, index) => instance.chunk(1, `line ${index}\n`)),
+      );
+      const [launch, lost] = yield* reader.take(2);
+      const lines = yield* reader.take(10 - (lost?.count ?? 0));
+
+      expect(launch?.kind).toBe("launch");
+      expect(lost).toMatchObject({ kind: "lost", launchId: 1 });
+      expect(lost?.count).toBeGreaterThan(0);
+      expect(texts(lines).at(-1)).toBe("line 9");
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("writes a launch's partial line when its observation leaves the launch", () =>
+    Effect.gen(function* () {
+      const root = yield* tempRoot("log-store-partial-");
+      const { store } = yield* openStore(root);
+      const instance = yield* fakeInstance("partial");
+      yield* store.attach(instance);
+      const reader = yield* collect(store.read("partial", { from: "oldest", follow: true }));
+      yield* instance.setLaunch(1);
+
+      yield* instance.publish(instance.chunk(1, "no trailing newline"));
+      yield* reader.take(1);
+      yield* instance.setLaunch(undefined);
+      const [flushed] = yield* reader.take(1);
+
+      expect(flushed).toMatchObject({ kind: "stdout", launchId: 1, text: "no trailing newline" });
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("splits output queued when the launch ends before writing its partial lines", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* tempRoot("log-store-queued-end-");
+      const blocked = yield* Deferred.make<void>();
+      const release = yield* Deferred.make<void>();
+      const injected = replaceWrites(fs, (file, buffer) =>
+        new TextDecoder().decode(buffer).includes("busy")
+          ? Deferred.succeed(blocked, undefined).pipe(
+              Effect.andThen(Deferred.await(release)),
+              Effect.andThen(file.writeAll(buffer)),
+            )
+          : file.writeAll(buffer),
+      );
+      const { store } = yield* openStore(root).pipe(
+        Effect.provideService(FileSystem.FileSystem, injected),
+      );
+      const leave = yield* Deferred.make<void>();
+      const left = yield* Deferred.make<void>();
+      const fake = yield* fakeInstance("queued-end");
+      // The store pulls past the transition only after it has handled it.
+      const observation = Stream.make({ launchId: 1 }).pipe(
+        Stream.concat(
+          Stream.fromEffect(Deferred.await(leave).pipe(Effect.as({ launchId: undefined }))),
+        ),
+        Stream.concat(Stream.fromEffectDrain(Deferred.succeed(left, undefined))),
+        Stream.concat(Stream.never),
+      );
+      yield* store.attach({ ...fake, observation });
+      const reader = yield* collect(store.read("queued-end", { from: "oldest", follow: true }));
+      const euro = encoder.encode("€");
+      const withBytes = (chunk: LaunchOutput, bytes: ReadonlyArray<number>): LaunchOutput => ({
+        ...chunk,
+        bytes: new Uint8Array(bytes),
+      });
+
+      yield* fake.publish(
+        withBytes(fake.chunk(1, ""), [...encoder.encode("price "), euro[0] ?? 0]),
+        fake.chunk(1, "busy\r", "stderr"),
+      );
+      yield* Deferred.await(blocked);
+      yield* fake.publish(
+        withBytes(fake.chunk(1, ""), [...euro.subarray(1), ...encoder.encode("\ntail")]),
+        fake.chunk(1, "\nnext\n", "stderr"),
+      );
+      yield* Deferred.succeed(leave, undefined);
+      yield* Deferred.await(left);
+      yield* Deferred.succeed(release, undefined);
+      const records = yield* untilLast(reader, "tail");
+
+      expect(records.map(({ kind, text }) => ({ kind, text }))).toEqual([
+        { kind: "launch", text: undefined },
+        { kind: "stderr", text: "busy" },
+        { kind: "stdout", text: "price €" },
+        { kind: "stderr", text: "next" },
+        { kind: "stdout", text: "tail" },
+      ]);
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("writes a late partial line of an ended launch once it stays quiet for the grace", () =>
+    Effect.gen(function* () {
+      const root = yield* tempRoot("log-store-quiet-");
+      const { store } = yield* openStore(root);
+      const instance = yield* fakeInstance("quiet");
+      yield* store.attach(instance);
+      const reader = yield* collect(store.read("quiet", { from: "oldest", follow: true }));
+      yield* instance.setLaunch(1);
+      yield* instance.publish(instance.chunk(1, "ending"));
+      yield* reader.take(1);
+      yield* instance.setLaunch(undefined);
+      yield* untilLast(reader, "ending");
+
+      yield* instance.publish(instance.chunk(1, "late"), instance.chunk(1, "written\n", "stderr"));
+      yield* untilLast(reader, "written");
+      const beforeGrace = yield* Queue.size(reader.records);
+      yield* TestClock.adjust(endedLineGraceMillis);
+      const [late] = yield* reader.take(1);
+
+      expect(beforeGrace).toBe(0);
+      expect(late).toMatchObject({ kind: "stdout", launchId: 1, text: "late" });
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("keeps a late line whole when its newline was published before the grace ran out", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* tempRoot("log-store-late-newline-");
+      const blocked = yield* Deferred.make<void>();
+      const release = yield* Deferred.make<void>();
+      const injected = replaceWrites(fs, (file, buffer) =>
+        new TextDecoder().decode(buffer).includes("busy")
+          ? Deferred.succeed(blocked, undefined).pipe(
+              Effect.andThen(Deferred.await(release)),
+              Effect.andThen(file.writeAll(buffer)),
+            )
+          : file.writeAll(buffer),
+      );
+      const armed = yield* Deferred.make<void>();
+      const woke = yield* Deferred.make<void>();
+      const clock = yield* TestClock.testClockWith(Effect.succeed);
+      // The store's only sleep before close is the grace flusher's wait for the deadline.
+      const graceClock: Clock.Clock = {
+        currentTimeMillisUnsafe: () => clock.currentTimeMillisUnsafe(),
+        currentTimeMillis: clock.currentTimeMillis,
+        currentTimeNanosUnsafe: () => clock.currentTimeNanosUnsafe(),
+        currentTimeNanos: clock.currentTimeNanos,
+        monotonicTimeNanosUnsafe: () => clock.monotonicTimeNanosUnsafe(),
+        monotonicTimeNanos: clock.monotonicTimeNanos,
+        sleep: (duration) =>
+          Deferred.succeed(armed, undefined).pipe(
+            Effect.andThen(clock.sleep(duration)),
+            Effect.andThen(Deferred.succeed(woke, undefined)),
+          ),
+      };
+      const { store } = yield* openStore(root).pipe(
+        Effect.provideService(FileSystem.FileSystem, injected),
+      );
+      const instance = yield* fakeInstance("newline");
+      yield* store.attach(instance).pipe(Effect.provideService(Clock.Clock, graceClock));
+      const reader = yield* collect(store.read("newline", { from: "oldest", follow: true }));
+      yield* instance.setLaunch(1);
+      yield* instance.publish(instance.chunk(1, "ending"));
+      yield* reader.take(1);
+      yield* instance.setLaunch(undefined);
+      yield* untilLast(reader, "ending");
+
+      yield* instance.publish(instance.chunk(1, "late "));
+      yield* Deferred.await(armed);
+      yield* instance.publish(instance.chunk(1, "busy\n", "stderr"));
+      yield* Deferred.await(blocked);
+      yield* TestClock.adjust(endedLineGraceMillis / 2);
+      yield* instance.publish(instance.chunk(1, "line end\n"));
+      yield* TestClock.adjust(endedLineGraceMillis / 2);
+      yield* Deferred.await(woke);
+      yield* Deferred.succeed(release, undefined);
+      const records: Array<LogRecord> = [];
+      while (!records.some((record) => record.text?.endsWith("line end") === true))
+        records.push(...(yield* reader.take(1)));
+
+      expect(texts(records)).toEqual(["busy", "late line end"]);
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("records each failed write as lost once, including a partial-line flush", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* tempRoot("log-store-failed-write-");
+      const failures = yield* Queue.unbounded<string>();
+      const failOnce = new Set(["pending", "doomed"]);
+      const injected = replaceWrites(fs, (file, buffer) => {
+        const text = new TextDecoder().decode(buffer);
+        const word = [...failOnce].find((candidate) => text.includes(candidate));
+        if (word === undefined) return file.writeAll(buffer);
+        failOnce.delete(word);
+        // Leaves part of the first record behind, like a write that fails part-way.
+        return file.writeAll(buffer.subarray(0, 10)).pipe(
+          Effect.andThen(Queue.offer(failures, word)),
+          Effect.andThen(
+            Effect.fail(
+              PlatformError.systemError({
+                _tag: "Unknown",
+                module: "FileSystem",
+                method: "write",
+              }),
+            ),
+          ),
+        );
+      });
+      const { store } = yield* openStore(root, { rotateBytes: 1 }).pipe(
+        Effect.provideService(FileSystem.FileSystem, injected),
+      );
+      const instance = yield* fakeInstance("failing");
+      yield* store.attach(instance);
+      const reader = yield* collect(store.read("failing", { from: "oldest", follow: true }));
+      yield* instance.setLaunch(1);
+      yield* instance.publish(instance.chunk(1, "first\n"));
+      yield* untilLast(reader, "first");
+      yield* instance.publish(instance.chunk(1, "pending"), instance.chunk(1, "sync\n", "stderr"));
+      yield* untilLast(reader, "sync");
+
+      yield* instance.setLaunch(undefined);
+      const flushFailure = yield* Queue.take(failures);
+      yield* TestClock.adjust(100);
+      yield* instance.publish(instance.chunk(2, "doomed\n"));
+      const lineFailure = yield* Queue.take(failures);
+      yield* TestClock.adjust(200);
+      yield* instance.publish(instance.chunk(2, "after\n"));
+      const followed = yield* untilLast(reader, "after");
+      const offline = yield* persisted({ root });
+
+      const expectedLost = [
+        { launchId: 1, stream: "stdout", count: 1 },
+        { launchId: 2, stream: "stdout", count: 1 },
+      ];
+      expect([flushFailure, lineFailure]).toEqual(["pending", "doomed"]);
+      expect(lostCounts(followed)).toEqual(expectedLost);
+      expect(lostCounts(offline)).toEqual(expectedLost);
+      expect(texts(offline)).toEqual(["first", "sync", "after"]);
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("closes by the shutdown deadline while a segment write hangs", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* tempRoot("log-store-hung-write-");
+      const writing = yield* Deferred.make<void>();
+      const injected = replaceWrites(fs, () =>
+        Deferred.succeed(writing, undefined).pipe(Effect.andThen(Effect.never)),
+      );
+      const opened = yield* openStore(root).pipe(
+        Effect.provideService(FileSystem.FileSystem, injected),
+      );
+      const instance = yield* fakeInstance("hung");
+      yield* opened.store.attach(instance);
+      yield* instance.publish(instance.chunk(1, "never written\n"));
+      yield* Deferred.await(writing);
+
+      const closing = yield* Effect.forkChild(opened.close, { startImmediately: true });
+      yield* TestClock.adjust(4_999);
+      const beforeDeadline = closing.pollUnsafe();
+      yield* TestClock.adjust(1);
+      yield* Fiber.join(closing);
+
+      expect(beforeDeadline).toBeUndefined();
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("reads past a partial record a write left at the end of an earlier segment", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* tempRoot("log-store-torn-");
+      const directory = path.join(root, "auth", "torn");
+      const torn = path.join(directory, segmentName(1));
+      const content =
+        "1970-01-01T00:00:00.000Z stdout 1 | whole\n1970-01-01T00:00:00.000Z stdout 1 | to";
+      yield* fs.makeDirectory(directory, { recursive: true });
+      yield* fs.writeFileString(torn, content);
+      const { store } = yield* openStore(root);
+      const instance = yield* fakeInstance("torn");
+      yield* store.attach(instance);
+      const reader = yield* collect(store.read("torn", { from: "oldest", follow: true }));
+
+      yield* instance.publish(instance.chunk(2, "after\n"));
+      const followed = yield* untilLast(reader, "after");
+
+      expect(texts(followed)).toEqual(["whole", "after"]);
+      expect(texts(yield* persisted({ root }))).toEqual(["whole", "after"]);
+      expect(yield* fs.readFileString(torn)).toBe(content);
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("rotates segments while a follower reads and keeps its order", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* tempRoot("log-store-rotate-");
+      const { store } = yield* openStore(root, { rotateBytes: 300 });
+      const instance = yield* fakeInstance("rotate");
+      yield* store.attach(instance);
+      const reader = yield* collect(store.read("rotate", { from: "oldest", follow: true }));
+
+      for (let index = 0; index < 40; index++) {
+        yield* instance.publish(instance.chunk(1, `rotating line ${index}\n`));
+        if (index % 10 === 0) yield* reader.take(index === 0 ? 2 : 10);
+      }
+      const rest = yield* reader.take(9);
+
+      const segments = yield* fs.readDirectory(path.join(root, "auth", "rotate"));
+      expect(segments.length).toBeGreaterThan(3);
+      expect(texts(rest).at(-1)).toBe("rotating line 39");
+      const all = yield* persisted({ root });
+      expect(texts(all)).toEqual(
+        Array.from({ length: 40 }, (_, index) => `rotating line ${index}`),
+      );
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("deletes the oldest segments beyond retention and reports the gap to a reader", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* tempRoot("log-store-retention-");
+      const { store } = yield* openStore(root, { rotateBytes: 200, retainBytes: 400 });
+      const instance = yield* fakeInstance("retention");
+      yield* store.attach(instance);
+      const release = yield* Latch.make();
+      const reader = yield* collect(
+        store
+          .read("retention", { from: "oldest", follow: true })
+          .pipe(
+            Effect.map(
+              Stream.tap((record) => (record.kind === "launch" ? release.await : Effect.void)),
+            ),
+          ),
+      );
+      const progress = yield* collect(store.read("retention", { from: "oldest", follow: true }));
+
+      for (let index = 0; index < 60; index++) {
+        yield* instance.publish(instance.chunk(1, `retained line ${index}\n`));
+        yield* untilLast(progress, `retained line ${index}`);
+      }
+      // An empty tailed read takes the writer lock, so the last rotation's retention finished.
+      yield* store
+        .read("retention", { from: "oldest", tail: 0, follow: false })
+        .pipe(Effect.asVoid);
+
+      const directory = path.join(root, "auth", "retention");
+      const sizes = yield* Effect.forEach(yield* fs.readDirectory(directory), (name) =>
+        fs.stat(path.join(directory, name)).pipe(Effect.map((info) => Number(info.size))),
+      );
+      expect(sizes.reduce((sum, size) => sum + size, 0)).toBeLessThanOrEqual(400 + 200);
+      yield* release.open;
+      const records = yield* untilLast(reader, "retained line 59");
+      const gap = records.find((record) => record.kind === "lost");
+      expect(gap).toBeDefined();
+      expect(gap?.launchId).toBeUndefined();
+      expect(gap?.position).toBeUndefined();
+      expect(gap?.resumeAt?.generation).toBeGreaterThan(1);
+      // Stamped like the first retained record, so history sorted by time keeps the gap before it.
+      expect(gap?.timestamp).toBe(records[records.indexOf(gap ?? records[0]!) + 1]?.timestamp);
+      expect(texts(records).length).toBeLessThan(60);
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("caps the number of retained segments", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* tempRoot("log-store-count-");
+      const { store } = yield* openStore(root, { rotateBytes: 1, retainSegments: 3 });
+      const instance = yield* fakeInstance("count");
+      yield* store.attach(instance);
+      const progress = yield* collect(store.read("count", { from: "oldest", follow: true }));
+
+      for (let index = 0; index < 10; index++) {
+        yield* instance.publish(instance.chunk(1, `counted line ${index}\n`));
+        yield* untilLast(progress, `counted line ${index}`);
+      }
+      // An empty tailed read takes the writer lock, so the last rotation's retention finished.
+      yield* store.read("count", { from: "oldest", tail: 0, follow: false }).pipe(Effect.asVoid);
+
+      const segments = yield* fs.readDirectory(path.join(root, "auth", "count"));
+      expect(segments.length).toBeLessThanOrEqual(3);
+      expect(texts(yield* persisted({ root })).at(-1)).toBe("counted line 9");
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("creates no segment for an instance that wrote nothing", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* tempRoot("log-store-idle-");
+      const opened = yield* openStore(root);
+      yield* opened.store.attach(yield* fakeInstance("idle"));
+      yield* opened.close;
+
+      expect(yield* fs.exists(path.join(root, "auth", "idle"))).toBe(false);
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("tails the newest records across segments and then follows", () =>
+    Effect.gen(function* () {
+      const root = yield* tempRoot("log-store-tail-");
+      const { store } = yield* openStore(root, { rotateBytes: 120 });
+      const instance = yield* fakeInstance("tail");
+      yield* store.attach(instance);
+      const progress = yield* collect(store.read("tail", { from: "oldest", follow: true }));
+      for (let index = 0; index < 20; index++) {
+        yield* instance.publish(instance.chunk(1, `tailed line ${index}\n`));
+        yield* untilLast(progress, `tailed line ${index}`);
+      }
+
+      const tailed = yield* collect(store.read("tail", { from: "oldest", tail: 3, follow: true }));
+      const history = yield* tailed.take(3);
+      yield* instance.publish(instance.chunk(1, "after tail\n"));
+      const [followed] = yield* tailed.take(1);
+
+      expect(texts(history)).toEqual(["tailed line 17", "tailed line 18", "tailed line 19"]);
+      expect(followed?.text).toBe("after tail");
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("skips files that are not service or instance directories when reading offline", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* tempRoot("log-store-stray-");
+      const opened = yield* openStore(root);
+      const instance = yield* fakeInstance("kept");
+      yield* opened.store.attach(instance);
+      const reader = yield* collect(opened.store.read("kept", { from: "oldest", follow: true }));
+      yield* instance.publish(instance.chunk(1, "kept line\n"));
+      yield* reader.take(2);
+      yield* opened.close;
+      yield* fs.writeFileString(path.join(root, ".DS_Store"), "");
+      yield* fs.writeFileString(path.join(root, "auth", ".DS_Store"), "");
+
+      const records = yield* persisted({ root });
+
+      expect(texts(records)).toEqual(["kept line"]);
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("keeps the newest records of one batch larger than the retention limit", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* tempRoot("log-store-big-batch-");
+      const { store } = yield* openStore(root, { rotateBytes: 200, retainBytes: 400 });
+      const instance = yield* fakeInstance("big");
+      yield* store.attach(instance);
+      const progress = yield* collect(store.read("big", { from: "oldest", follow: true }));
+
+      yield* instance.publish(
+        ...Array.from({ length: 60 }, (_, index) => instance.chunk(1, `batched line ${index}\n`)),
+      );
+      yield* untilLast(progress, "batched line 59");
+      // An empty tailed read takes the writer lock, so the last rotation's retention finished.
+      yield* store.read("big", { from: "oldest", tail: 0, follow: false }).pipe(Effect.asVoid);
+
+      const directory = path.join(root, "auth", "big");
+      const sizes = yield* Effect.forEach(yield* fs.readDirectory(directory), (name) =>
+        fs.stat(path.join(directory, name)).pipe(Effect.map((info) => Number(info.size))),
+      );
+      expect(Math.max(...sizes)).toBeLessThanOrEqual(200);
+      const kept = texts(yield* persisted({ root }));
+      expect(kept.length).toBeGreaterThan(0);
+      expect(kept.at(-1)).toBe("batched line 59");
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("writes output still queued when the store closes", () =>
+    Effect.gen(function* () {
+      const root = yield* tempRoot("log-store-drain-");
+      const opened = yield* openStore(root);
+      const instance = yield* fakeInstance("drain");
+      yield* opened.store.attach(instance);
+
+      yield* instance.publish(
+        ...Array.from({ length: 1_000 }, (_, index) => instance.chunk(1, `queued line ${index}\n`)),
+      );
+      yield* opened.close;
+
+      const records = yield* persisted({ root });
+      expect(texts(records)).toEqual(
+        Array.from({ length: 1_000 }, (_, index) => `queued line ${index}`),
+      );
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("tails with since past a newer segment that holds an older flushed line", () =>
+    Effect.gen(function* () {
+      const root = yield* tempRoot("log-store-late-flush-");
+      const { store } = yield* openStore(root, { rotateBytes: 1 });
+      const instance = yield* fakeInstance("flushed");
+      yield* store.attach(instance);
+      const progress = yield* collect(store.read("flushed", { from: "oldest", follow: true }));
+      yield* instance.setLaunch(1);
+
+      yield* TestClock.setTime(1_000);
+      yield* instance.publish(instance.chunk(1, "early partial", "stderr"));
+      yield* TestClock.setTime(2_000);
+      yield* instance.publish(instance.chunk(1, "later line\n"));
+      yield* untilLast(progress, "later line");
+      yield* TestClock.setTime(3_000);
+      yield* instance.setLaunch(undefined);
+      yield* untilLast(progress, "early partial");
+
+      const live = yield* (yield* store.read("flushed", {
+        from: "oldest",
+        follow: false,
+        since: 1_500,
+        tail: 10,
+      })).pipe(Stream.runCollect);
+
+      expect(texts(live)).toEqual(["later line"]);
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("tails the newest record when several newer segments hold older flushed lines", () =>
+    Effect.gen(function* () {
+      const root = yield* tempRoot("log-store-late-flushes-");
+      const { store } = yield* openStore(root, { rotateBytes: 1 });
+      const instance = yield* fakeInstance("flushes");
+      yield* store.attach(instance);
+      const progress = yield* collect(store.read("flushes", { from: "oldest", follow: true }));
+      yield* instance.setLaunch(1);
+
+      // Partial lines of a later process part stay open while part 0 writes a newer line.
+      yield* TestClock.setTime(1_000);
+      yield* instance.publish(
+        { ...instance.chunk(1, "early stdout"), part: 1 },
+        { ...instance.chunk(1, "early stderr", "stderr"), part: 1 },
+      );
+      yield* TestClock.setTime(3_000);
+      yield* instance.publish(instance.chunk(1, "latest\n"));
+      yield* untilLast(progress, "latest");
+      yield* TestClock.setTime(4_000);
+      yield* instance.setLaunch(undefined);
+      yield* untilLast(progress, "early stderr");
+
+      const live = yield* (yield* store.read("flushes", {
+        from: "oldest",
+        follow: false,
+        tail: 1,
+      })).pipe(Stream.runCollect);
+
+      expect(texts(live)).toEqual(["latest"]);
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("sweeps past a segment it cannot delete and reports the deleted ones to a reader", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* tempRoot("log-store-stuck-segment-");
+      const held = segmentName(1);
+      const injected: FileSystem.FileSystem = {
+        ...fs,
+        remove: (target, options) =>
+          target.endsWith(held)
+            ? Effect.fail(
+                PlatformError.systemError({
+                  _tag: "Busy",
+                  module: "FileSystem",
+                  method: "remove",
+                  pathOrDescriptor: target,
+                }),
+              )
+            : fs.remove(target, options),
+      };
+      const { store } = yield* openStore(root, { rotateBytes: 1, retainSegments: 3 }).pipe(
+        Effect.provideService(FileSystem.FileSystem, injected),
+      );
+      const instance = yield* fakeInstance("stuck");
+      yield* store.attach(instance);
+      const progress = yield* collect(store.read("stuck", { from: "oldest", follow: true }));
+
+      for (let index = 0; index < 10; index++) {
+        yield* instance.publish(instance.chunk(1, `stuck line ${index}\n`));
+        yield* untilLast(progress, `stuck line ${index}`);
+      }
+      // An empty tailed read takes the writer lock, so the last rotation's retention finished.
+      yield* store.read("stuck", { from: "oldest", tail: 0, follow: false }).pipe(Effect.asVoid);
+
+      const segments = yield* fs.readDirectory(path.join(root, "auth", "stuck"));
+      const resumed = yield* (yield* store.read("stuck", {
+        from: { generation: 3, byteOffset: 0 },
+        follow: false,
+      })).pipe(Stream.runCollect);
+      const fromHeld = yield* (yield* store.read("stuck", {
+        from: { generation: 1, byteOffset: 0 },
+        follow: false,
+      })).pipe(Stream.runCollect);
+      const afterHeld = segments
+        .map(segmentGeneration)
+        .filter((generation) => generation !== undefined && generation > 1)
+        .toSorted((left, right) => (left ?? 0) - (right ?? 0))[0];
+
+      expect(segments).toContain(held);
+      expect(segments).not.toContain(segmentName(2));
+      expect(segments).not.toContain(segmentName(3));
+      expect(segments.length).toBeLessThanOrEqual(4);
+      const [gap] = resumed;
+      expect(gap?.kind).toBe("lost");
+      expect(gap?.position).toBeUndefined();
+      expect(gap?.resumeAt?.generation).toBeGreaterThan(3);
+      expect(texts(resumed).at(-1)).toBe("stuck line 9");
+      const heldGaps = Array.from(fromHeld).filter((record) => record.kind === "lost");
+      expect(heldGaps).toHaveLength(1);
+      expect(heldGaps[0]?.resumeAt).toEqual({ generation: afterHeld, byteOffset: 0 });
+      expect(fromHeld[0]?.kind).toBe("launch");
+      expect(texts(fromHeld).at(-1)).toBe("stuck line 9");
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("continues after existing generations when the first listing fails", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* tempRoot("log-store-listing-");
+      const directory = path.join(root, "auth", "listing");
+      yield* fs.makeDirectory(directory, { recursive: true });
+      yield* fs.writeFileString(
+        path.join(directory, segmentName(1)),
+        "1970-01-01T00:00:00.000Z stdout 1 | before\n",
+      );
+      let failures = 1;
+      const injected: FileSystem.FileSystem = {
+        ...fs,
+        readDirectory: (target, options) =>
+          target === directory && failures-- > 0
+            ? Effect.fail(
+                PlatformError.systemError({
+                  _tag: "PermissionDenied",
+                  module: "FileSystem",
+                  method: "readDirectory",
+                  pathOrDescriptor: target,
+                }),
+              )
+            : fs.readDirectory(target, options),
+      };
+      const { store } = yield* openStore(root).pipe(
+        Effect.provideService(FileSystem.FileSystem, injected),
+      );
+      const instance = yield* fakeInstance("listing");
+      yield* store.attach(instance);
+      const reader = yield* collect(store.read("listing", { from: "oldest", follow: true }));
+
+      yield* instance.publish(instance.chunk(1, "after\n"));
+      yield* untilLast(reader, "after");
+
+      expect((yield* fs.readDirectory(directory)).toSorted()).toEqual([
+        segmentName(1),
+        segmentName(2),
+      ]);
+      expect(texts(yield* persisted({ root }))).toEqual(["before", "after"]);
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("removes log directories of instances that are no longer attached", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* tempRoot("log-store-orphans-");
+      const orphan = path.join(root, "rest", "ghost");
+      yield* fs.makeDirectory(orphan, { recursive: true });
+      yield* fs.writeFileString(path.join(orphan, segmentName(1)), "");
+      const { store } = yield* openStore(root);
+      const instance = yield* fakeInstance("kept");
+      yield* store.attach(instance);
+      const reader = yield* collect(store.read("kept", { from: "oldest", follow: true }));
+      yield* instance.publish(instance.chunk(1, "kept line\n"));
+      yield* untilLast(reader, "kept line");
+
+      yield* store.removeOrphans;
+
+      expect(yield* fs.exists(orphan)).toBe(false);
+      expect(yield* fs.exists(path.join(root, "auth", "kept", segmentName(1)))).toBe(true);
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("reads persisted records offline after the store closes, per instance", () =>
+    Effect.gen(function* () {
+      const root = yield* tempRoot("log-store-offline-");
+      const opened = yield* openStore(root);
+      const auth = yield* fakeInstance("auth-1", { service: "auth" });
+      const rest = yield* fakeInstance("rest-1", { service: "rest" });
+      yield* opened.store.attach(auth);
+      yield* opened.store.attach(rest);
+      const authReader = yield* collect(
+        opened.store.read("auth-1", { from: "oldest", follow: true }),
+      );
+      const restReader = yield* collect(
+        opened.store.read("rest-1", { from: "oldest", follow: true }),
+      );
+
+      yield* TestClock.setTime(1_000);
+      yield* rest.publish(rest.chunk(1, "rest first\n"));
+      yield* restReader.take(2);
+      yield* TestClock.setTime(2_000);
+      yield* auth.publish(auth.chunk(1, "auth second\n"));
+      yield* authReader.take(2);
+      yield* TestClock.setTime(3_000);
+      yield* rest.publish(rest.chunk(1, "rest third\n"));
+      yield* restReader.take(1);
+      yield* opened.close;
+
+      const all = yield* persisted({ root });
+      const restOnly = yield* persisted({ root, instances: ["rest-1"] });
+      const recent = yield* persisted({ root, since: 2_000, instances: ["rest-1"] });
+
+      expect(texts(all).toSorted()).toEqual(["auth second", "rest first", "rest third"]);
+      expect(restOnly.map(({ kind, text }) => [kind, text])).toEqual([
+        ["launch", undefined],
+        ["stdout", "rest first"],
+        ["stdout", "rest third"],
+      ]);
+      expect(texts(recent)).toEqual(["rest third"]);
+      expect(recent[0]).toMatchObject({ service: "rest", instanceId: "rest-1" });
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("opens a new generation for each owner start without touching earlier ones", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* tempRoot("log-store-restart-");
+      for (const text of ["before restart", "after restart"]) {
+        const opened = yield* openStore(root);
+        const instance = yield* fakeInstance("restart");
+        yield* opened.store.attach(instance);
+        const reader = yield* collect(
+          opened.store.read("restart", { from: "oldest", tail: 0, follow: true }),
+        );
+        yield* instance.publish(instance.chunk(1, `${text}\n`));
+        yield* reader.take(2);
+        yield* opened.close;
+      }
+
+      const directory = path.join(root, "auth", "restart");
+      expect((yield* fs.readDirectory(directory)).toSorted()).toEqual([
+        "0000000001.log",
+        "0000000002.log",
+      ]);
+      const records = yield* persisted({ root });
+      expect(texts(records)).toEqual(["before restart", "after restart"]);
+      expect(records.map(({ position }) => position?.generation)).toEqual([1, 1, 2, 2]);
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("follows only records written after an empty tailed read subscribes", () =>
+    Effect.gen(function* () {
+      const root = yield* tempRoot("log-store-end-");
+      const { store } = yield* openStore(root);
+      const instance = yield* fakeInstance("end");
+      yield* store.attach(instance);
+      const history = yield* collect(store.read("end", { from: "oldest", follow: true }));
+      yield* instance.publish(instance.chunk(1, "old\n"));
+      yield* history.take(2);
+
+      const reader = yield* collect(store.read("end", { from: "oldest", tail: 0, follow: true }));
+      yield* instance.publish(instance.chunk(1, "new\n"));
+      const [record] = yield* reader.take(1);
+
+      expect(record).toMatchObject({ kind: "stdout", text: "new" });
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("rejects a tailed read that also sets a start position", () =>
+    Effect.gen(function* () {
+      const root = yield* tempRoot("log-store-tail-from-");
+      const { store } = yield* openStore(root);
+      yield* store.attach(yield* fakeInstance("tail-from"));
+
+      const error = yield* store
+        .read("tail-from", { from: { generation: 1, byteOffset: 0 }, tail: 5, follow: false })
+        .pipe(Effect.flip);
+
+      expect(error).toBeInstanceOf(LogStore.LogStoreError);
+      expect(error.message).toContain("cannot also set a start position");
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("removes an instance by ending its readers and deleting its segments", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* tempRoot("log-store-remove-");
+      const { store } = yield* openStore(root);
+      const instance = yield* fakeInstance("removed");
+      yield* store.attach(instance);
+      const reader = yield* collect(store.read("removed", { from: "oldest", follow: true }));
+      yield* instance.publish(instance.chunk(1, "doomed\n"));
+      yield* reader.take(2);
+
+      yield* store.remove({ service: "auth", instanceId: "removed" });
+      yield* Fiber.join(reader.fiber);
+
+      expect(yield* fs.exists(path.join(root, "auth", "removed"))).toBe(false);
+      const failure = yield* store
+        .read("removed", { from: "oldest", follow: false })
+        .pipe(Effect.flip);
+      expect(failure.message).toContain("has no logs");
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+});
diff --git a/packages/stack/src/host/LogStore.ts b/packages/stack/src/host/LogStore.ts
new file mode 100644
index 0000000000..51dcdd4973
--- /dev/null
+++ b/packages/stack/src/host/LogStore.ts
@@ -0,0 +1,1146 @@
+import {
+  Clock,
+  DateTime,
+  Deferred,
+  Duration,
+  Effect,
+  Exit,
+  Fiber,
+  FileSystem,
+  Option,
+  Path,
+  PubSub,
+  Queue,
+  Ref,
+  Schema,
+  Scope,
+  Semaphore,
+  Stream,
+} from "effect";
+import { failureMessage } from "../internal/failure-message.ts";
+import { errorCode, retrySharingViolation } from "../internal/sharing-violation.ts";
+import type { LaunchOutput } from "../runtime/Session.ts";
+import type { CatalogLogs } from "../services/Recipe.ts";
+import {
+  encodeEntry,
+  makeSplitter,
+  parseRecord,
+  segmentGeneration,
+  segmentName,
+  type LogEntry,
+  type LogPosition,
+  type LogRecord,
+  type StackLogRecord,
+} from "./LogRecord.ts";
+
+/** A log store operation that failed. */
+export class LogStoreError extends Schema.TaggedError<LogStoreError>()("LogStoreError", {
+  operation: Schema.String,
+  message: Schema.String,
+  cause: Schema.optionalKey(Schema.Defect()),
+}) {}
+
+const storeError = (operation: string) => (cause: unknown) =>
+  new LogStoreError({ operation, message: failureMessage(cause), cause });
+
+const removeError = (directory: string) => (cause: unknown) =>
+  new LogStoreError({
+    operation: "remove",
+    message: `Unable to remove ${directory}: ${failureMessage(cause)}`,
+    cause,
+  });
+
+export interface LogStoreOptions {
+  /** The stack's logs directory. */
+  readonly root: string;
+  /** A segment reaching this size is closed and a new generation is opened. */
+  readonly rotateBytes?: number;
+  /** Oldest closed segments are deleted while an instance's segments exceed this size. */
+  readonly retainBytes?: number;
+  /** Oldest closed segments are deleted while an instance has more segments than this. */
+  readonly retainSegments?: number;
+}
+
+/** Selects the records a read returns. */
+export interface ReadOptions {
+  /** The oldest retained record, or a record position to resume at. */
+  readonly from: "oldest" | LogPosition;
+  /** Epoch milliseconds; older records are skipped. */
+  readonly since?: number;
+  /** Returns only the last records of the history before following; requires `from: "oldest"`. */
+  readonly tail?: number;
+  readonly follow: boolean;
+}
+
+/** An instance whose output the store persists. */
+export interface AttachedInstance {
+  readonly service: string;
+  readonly instanceId: string;
+  readonly logs: CatalogLogs;
+  readonly observation: Stream.Stream<{ readonly launchId: number | undefined }>;
+}
+
+export interface Interface {
+  /** Subscribes to the instance's output before returning; persistence failures never fail it. */
+  readonly attach: (instance: AttachedInstance) => Effect.Effect<void>;
+  /** Fixes the read's start and wake subscription in the scope; the stream reads lazily. */
+  readonly read: (
+    instanceId: string,
+    options: ReadOptions,
+  ) => Effect.Effect<Stream.Stream<LogRecord, LogStoreError>, LogStoreError, Scope.Scope>;
+  /** The directory holding an attached instance's segments and its forwarding cursor. */
+  readonly directory: (instanceId: string) => Effect.Effect<string, LogStoreError>;
+  /** Stops the instance's writer and readers, then deletes its segments. */
+  readonly remove: (instance: {
+    readonly service: string;
+    readonly instanceId: string;
+  }) => Effect.Effect<void, LogStoreError>;
+  /** Deletes log directories of instances that are not attached; failures are logged. */
+  readonly removeOrphans: Effect.Effect<void, LogStoreError>;
+  /** The highest launch id at the end of an instance's newest segment, if one is readable. */
+  readonly latestLaunchId: (instance: {
+    readonly service: string;
+    readonly instanceId: string;
+  }) => Effect.Effect<Option.Option<number>>;
+  /** Stops every writer and reader; later reads fail. */
+  readonly close: Effect.Effect<void>;
+}
+
+const defaultRotateBytes = 5 * 1024 * 1024;
+const defaultRetainBytes = 10 * 1024 * 1024;
+const defaultRetainSegments = 64;
+/** Bounds how much of a segment one read step holds in memory; above the longest record. */
+const readChunkBytes = 256 * 1024;
+/** Concurrent read steps per instance; removal takes them all to wait out in-flight reads. */
+const readerPermits = 1024;
+const retryBaseMillis = 100;
+const retryMaxMillis = 30_000;
+const drainBatch = 4096;
+/** Draining output still queued at close stops here; the rest is recorded as `lost`. */
+const drainTimeout = Duration.seconds(4);
+/** Detaching aborts filesystem work still pending here, so a hung write cannot block shutdown. */
+const shutdownTimeout = Duration.seconds(5);
+
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+
+interface Live {
+  readonly lock: Semaphore.Semaphore;
+  readonly end: Ref.Ref<LogPosition>;
+  readonly wake: PubSub.PubSub<void>;
+  readonly passes: Semaphore.Semaphore;
+}
+
+interface Step {
+  readonly records: ReadonlyArray<LogRecord>;
+  readonly cursor: LogPosition;
+  /** The segment listing to reuse; `undefined` asks the next step to list again. */
+  readonly listed: ReadonlyArray<number> | undefined;
+  /** The cursor reached the last complete record of the newest segment. */
+  readonly atEnd: boolean;
+  /** Bytes after the cursor did not yet form a complete record. */
+  readonly partial: boolean;
+}
+
+interface Chunk {
+  readonly records: ReadonlyArray<LogRecord>;
+  readonly byteOffset: number;
+  /** The read consumed bytes; otherwise it met the end of the segment. */
+  readonly progressed: boolean;
+  readonly partial: boolean;
+}
+
+const before = (cursor: LogPosition, end: LogPosition) =>
+  cursor.generation < end.generation ||
+  (cursor.generation === end.generation && cursor.byteOffset < end.byteOffset);
+
+/** Parses an ISO-8601 `since` bound into epoch milliseconds. */
+export const sinceMillis = (since: string): Effect.Effect<number, LogStoreError> =>
+  Option.match(DateTime.make(since), {
+    onNone: () =>
+      Effect.fail(
+        new LogStoreError({ operation: "read", message: `Invalid since timestamp ${since}` }),
+      ),
+    onSome: (time) => Effect.succeed(DateTime.toEpochMillis(time)),
+  });
+
+const isNotFound = (error: { readonly reason: { readonly _tag: string } }) =>
+  error.reason._tag === "NotFound";
+
+/** A missing directory, or a file where a directory was expected, holds no segments. */
+const isMissingDirectory = (error: { readonly reason: { readonly _tag: string } }) =>
+  isNotFound(error) || errorCode(error) === "ENOTDIR";
+
+interface FollowState {
+  readonly cursor: LogPosition;
+  readonly listed: ReadonlyArray<number> | undefined;
+}
+
+const page = (
+  records: ReadonlyArray<LogRecord>,
+  next: Option.Option<FollowState>,
+): readonly [ReadonlyArray<LogRecord>, Option.Option<FollowState>] => [records, next];
+
+const compareText = (left: string, right: string) => (left < right ? -1 : left > right ? 1 : 0);
+
+const recordPosition = (record: LogRecord) =>
+  record.position ?? record.resumeAt ?? { generation: 0, byteOffset: 0 };
+
+/** Orders an instance's records by timestamp and position; a gap marker precedes its resume. */
+const compareRecords = (left: LogRecord, right: LogRecord) => {
+  const leftPosition = recordPosition(left);
+  const rightPosition = recordPosition(right);
+  return (
+    compareText(left.timestamp, right.timestamp) ||
+    leftPosition.generation - rightPosition.generation ||
+    leftPosition.byteOffset - rightPosition.byteOffset ||
+    Number(left.position !== undefined) - Number(right.position !== undefined)
+  );
+};
+
+const nowIso = Clock.currentTimeMillis.pipe(
+  Effect.map((millis) => DateTime.formatIso(DateTime.makeUnsafe(millis))),
+);
+
+/** Lists the subdirectories of `directory`; files and a missing directory list nothing. */
+const listDirectories = (fs: FileSystem.FileSystem, path: Path.Path, directory: string) =>
+  fs.readDirectory(directory).pipe(
+    Effect.catchIf(isMissingDirectory, () => Effect.succeed<ReadonlyArray<string>>([])),
+    Effect.flatMap((names) =>
+      Effect.filter(names, (name) =>
+        fs.stat(path.join(directory, name)).pipe(
+          Effect.map((info) => info.type === "Directory"),
+          Effect.catchIf(isNotFound, () => Effect.succeed(false)),
+        ),
+      ),
+    ),
+    Effect.mapError(storeError("list")),
+  );
+
+const makeReader = (fs: FileSystem.FileSystem, path: Path.Path) => {
+  const generations = (directory: string) =>
+    fs.readDirectory(directory).pipe(
+      Effect.map((names) =>
+        names
+          .map(segmentGeneration)
+          .filter((generation) => generation !== undefined)
+          .toSorted((left, right) => left - right),
+      ),
+      Effect.catchIf(isMissingDirectory, () => Effect.succeed<ReadonlyArray<number>>([])),
+      Effect.mapError(storeError("list")),
+    );
+
+  const segments = (directory: string) =>
+    generations(directory).pipe(
+      Effect.flatMap((listed) =>
+        Effect.forEach(listed, (generation) =>
+          fs.stat(path.join(directory, segmentName(generation))).pipe(
+            Effect.map((info) => [{ generation, size: Number(info.size) }]),
+            Effect.catchIf(isNotFound, () =>
+              Effect.succeed<ReadonlyArray<{ generation: number; size: number }>>([]),
+            ),
+            Effect.mapError(storeError("list")),
+          ),
+        ),
+      ),
+      Effect.map((listed) => listed.flat()),
+    );
+
+  const readChunk = (file: string, offset: number) =>
+    Effect.scoped(
+      fs.open(file, { flag: "r" }).pipe(
+        Effect.tap((handle) => handle.seek(offset, "start")),
+        Effect.flatMap((handle) => handle.readAlloc(readChunkBytes)),
+        Effect.map(Option.getOrElse(() => new Uint8Array(0))),
+        Effect.map(Option.some),
+      ),
+    ).pipe(
+      Effect.catchIf(isNotFound, () => Effect.succeed(Option.none<Uint8Array>())),
+      Effect.mapError(storeError("read")),
+    );
+
+  /** Reads only the last chunk of the newest segment, skipping its first, possibly cut, line. */
+  const latestLaunchId = (directory: string) =>
+    generations(directory).pipe(
+      Effect.flatMap((listed) => {
+        const newest = listed.at(-1);
+        if (newest === undefined) return Effect.succeed(Option.none<number>());
+        const file = path.join(directory, segmentName(newest));
+        return fs.stat(file).pipe(
+          Effect.mapError(storeError("read")),
+          Effect.flatMap((info) => {
+            const offset = Math.max(0, Number(info.size) - readChunkBytes);
+            return readChunk(file, offset).pipe(
+              Effect.map(
+                Option.match({
+                  onNone: () => Option.none<number>(),
+                  onSome: (bytes) => {
+                    let latest: number | undefined;
+                    for (const line of decoder
+                      .decode(bytes)
+                      .split("\n")
+                      .slice(offset > 0 ? 1 : 0, -1)) {
+                      const launchId = parseRecord(line, {
+                        generation: newest,
+                        byteOffset: 0,
+                      })?.launchId;
+                      if (launchId !== undefined) latest = Math.max(latest ?? 0, launchId);
+                    }
+                    return Option.fromNullishOr(latest);
+                  },
+                }),
+              ),
+            );
+          }),
+        );
+      }),
+    );
+
+  const guarded = <A, E>(live: Live | undefined, effect: Effect.Effect<A, E>) =>
+    live === undefined ? effect : live.passes.withPermits(1)(effect);
+
+  /** Reads the complete records of one chunk at `position`; `none` when the segment is gone. */
+  const readAt = (directory: string, position: LogPosition, live: Live | undefined) =>
+    guarded(
+      live,
+      readChunk(path.join(directory, segmentName(position.generation)), position.byteOffset),
+    ).pipe(
+      Effect.map(
+        Option.map((bytes): Chunk => {
+          const last = bytes.lastIndexOf(0x0a);
+          if (last < 0)
+            return bytes.length === readChunkBytes
+              ? {
+                  records: [],
+                  byteOffset: position.byteOffset + bytes.length,
+                  progressed: true,
+                  partial: false,
+                }
+              : {
+                  records: [],
+                  byteOffset: position.byteOffset,
+                  progressed: false,
+                  partial: bytes.length > 0,
+                };
+          const records: Array<LogRecord> = [];
+          let start = 0;
+          while (start <= last) {
+            const stop = bytes.indexOf(0x0a, start);
+            const record = parseRecord(decoder.decode(bytes.subarray(start, stop)), {
+              generation: position.generation,
+              byteOffset: position.byteOffset + start,
+            });
+            if (record !== undefined) records.push(record);
+            start = stop + 1;
+          }
+          return {
+            records,
+            byteOffset: position.byteOffset + last + 1,
+            progressed: true,
+            partial: false,
+          };
+        }),
+      ),
+    );
+
+  /**
+   * Advances `cursor` by at most one chunk. The segment listing is reused until the cursor reaches
+   * the end of the listed segments or a listed segment disappears.
+   */
+  const step = Effect.fnUntraced(function* (
+    directory: string,
+    cursor: LogPosition,
+    cached: ReadonlyArray<number> | undefined,
+    live: Live | undefined,
+  ) {
+    const fresh = cached === undefined;
+    const listed = cached ?? (yield* generations(directory));
+    const relist = (partial: boolean): Step => ({
+      records: [],
+      cursor,
+      listed: undefined,
+      atEnd: false,
+      partial,
+    });
+    const atEnd = (partial: boolean): Step => ({
+      records: [],
+      cursor,
+      listed,
+      atEnd: true,
+      partial,
+    });
+    /**
+     * Reports segments deleted before `generation` as a gap that resumes there, stamped with the
+     * time of its first retained record so history sorted by time keeps it in place.
+     */
+    const gap = Effect.fnUntraced(function* (generation: number) {
+      const resumeAt = { generation, byteOffset: 0 };
+      if (cursor.generation === 0)
+        return {
+          records: [],
+          cursor: resumeAt,
+          listed,
+          atEnd: false,
+          partial: false,
+        } satisfies Step;
+      const next = yield* readAt(directory, resumeAt, live).pipe(
+        Effect.map((chunk) => Option.getOrUndefined(chunk)?.records[0]?.timestamp),
+        Effect.orElseSucceed(() => undefined),
+      );
+      const records: ReadonlyArray<LogRecord> = [
+        { kind: "lost", timestamp: next ?? (yield* nowIso), resumeAt },
+      ];
+      return { records, cursor: resumeAt, listed, atEnd: false, partial: false } satisfies Step;
+    });
+    const first = listed[0];
+    if (first === undefined) return fresh ? atEnd(false) : relist(false);
+    if (cursor.generation < first) return yield* gap(first);
+    const newer = listed.find((generation) => generation > cursor.generation);
+    const moveOn = (generation: number): Step => ({
+      records: [],
+      cursor: { generation, byteOffset: 0 },
+      listed,
+      atEnd: false,
+      partial: false,
+    });
+    if (!listed.includes(cursor.generation))
+      return newer !== undefined ? yield* gap(newer) : fresh ? atEnd(false) : relist(false);
+    const chunk = yield* readAt(directory, cursor, live);
+    if (Option.isNone(chunk)) return relist(false);
+    if (chunk.value.progressed)
+      return {
+        records: chunk.value.records,
+        cursor: { ...cursor, byteOffset: chunk.value.byteOffset },
+        listed,
+        atEnd: false,
+        partial: false,
+      } satisfies Step;
+    // A segment is closed once a newer one exists, so its incomplete tail never completes.
+    // Generations are contiguous, so a hole before the next one is a deleted segment.
+    if (newer !== undefined)
+      return newer === cursor.generation + 1 ? moveOn(newer) : yield* gap(newer);
+    if (fresh) return atEnd(chunk.value.partial);
+    const writing = live === undefined ? undefined : yield* Ref.get(live.end);
+    return writing !== undefined && writing.generation <= cursor.generation
+      ? atEnd(chunk.value.partial)
+      : relist(chunk.value.partial);
+  });
+
+  const since = (options: Pick<ReadOptions, "since">) => (record: LogRecord) =>
+    options.since === undefined || Date.parse(record.timestamp) >= options.since;
+
+  /** Reads one segment from its start; a segment deleted meanwhile yields what was read. */
+  const readSegment = Effect.fnUntraced(function* (
+    directory: string,
+    generation: number,
+    live: Live | undefined,
+  ) {
+    const records: Array<LogRecord> = [];
+    let position: LogPosition = { generation, byteOffset: 0 };
+    while (true) {
+      const chunk = yield* readAt(directory, position, live);
+      if (Option.isNone(chunk) || !chunk.value.progressed) break;
+      records.push(...chunk.value.records);
+      position = { generation, byteOffset: chunk.value.byteOffset };
+    }
+    return { records, position };
+  });
+
+  /**
+   * Reads the history after `cursor`. With `tail`, every segment is read and only the last `tail`
+   * records are kept.
+   */
+  const history = Effect.fnUntraced(function* (
+    directory: string,
+    cursor: LogPosition,
+    options: Pick<ReadOptions, "since" | "tail">,
+    live: Live | undefined,
+  ) {
+    const keep = since(options);
+    const listed = yield* generations(directory);
+    const tail = options.tail;
+    if (tail !== undefined) {
+      if (tail === 0) return { records: [], cursor, listed };
+      // A partial line is written when it ends, so any segment can hold the newest records.
+      let records: ReadonlyArray<LogRecord> = [];
+      let end: LogPosition = cursor;
+      for (const [index, generation] of listed.toReversed().entries()) {
+        const segment = yield* readSegment(directory, generation, live);
+        if (index === 0) end = segment.position;
+        records = [...records, ...segment.records.filter(keep)]
+          .toSorted(compareRecords)
+          .slice(-tail);
+      }
+      return { records, cursor: end, listed };
+    }
+    const records: Array<LogRecord> = [];
+    let current = cursor;
+    let cached: ReadonlyArray<number> | undefined = listed;
+    while (true) {
+      const next: Step = yield* step(directory, current, cached, live);
+      for (const record of next.records) if (keep(record)) records.push(record);
+      current = next.cursor;
+      cached = next.listed;
+      if (next.atEnd) break;
+    }
+    return { records, cursor: current, listed: cached };
+  });
+
+  /** Streams records from `cursor`; a follower waits on the wake signal it subscribed to first. */
+  const follow = (
+    directory: string,
+    start: { readonly cursor: LogPosition; readonly listed: ReadonlyArray<number> | undefined },
+    options: Pick<ReadOptions, "since" | "follow">,
+    live: Live | undefined,
+    wake: PubSub.Subscription<void> | undefined,
+  ): Stream.Stream<LogRecord, LogStoreError> =>
+    Stream.paginate(start, (current) =>
+      Effect.gen(function* () {
+        const next: Step = yield* step(directory, current.cursor, current.listed, live);
+        const resume = Option.some({ cursor: next.cursor, listed: next.listed });
+        if (!next.atEnd) return page(next.records, resume);
+        if (!options.follow || live === undefined || wake === undefined)
+          return page(next.records, Option.none());
+        const end = yield* live.lock.withPermits(1)(Ref.get(live.end));
+        if (!next.partial && before(next.cursor, end)) return page(next.records, resume);
+        yield* PubSub.take(wake);
+        return page(next.records, resume);
+      }),
+    ).pipe(Stream.filter(since(options)));
+
+  /** Subscribes and fixes the start position now; the returned stream reads lazily. */
+  const read = Effect.fnUntraced(function* (
+    directory: string,
+    options: ReadOptions,
+    live: Live | undefined,
+  ) {
+    if (options.tail !== undefined && options.from !== "oldest")
+      return yield* new LogStoreError({
+        operation: "read",
+        message: "A tailed read starts at the oldest record and cannot also set a start position",
+      });
+    const wake =
+      options.follow && live !== undefined ? yield* PubSub.subscribe(live.wake) : undefined;
+    const start = options.from === "oldest" ? { generation: 0, byteOffset: 0 } : options.from;
+    // An empty tail starts at the writer's end now, before the stream runs.
+    if (options.tail === 0 && live !== undefined) {
+      const end = yield* live.lock.withPermits(1)(Ref.get(live.end));
+      return options.follow
+        ? follow(directory, { cursor: end, listed: undefined }, options, live, wake)
+        : Stream.empty;
+    }
+    if (options.tail === undefined)
+      return follow(directory, { cursor: start, listed: undefined }, options, live, wake);
+    return Stream.unwrap(
+      history(directory, start, options, live).pipe(
+        Effect.map((past) =>
+          Stream.fromIterable(past.records).pipe(
+            Stream.concat(
+              options.follow
+                ? follow(
+                    directory,
+                    { cursor: past.cursor, listed: past.listed },
+                    options,
+                    live,
+                    wake,
+                  )
+                : Stream.empty,
+            ),
+          ),
+        ),
+      ),
+    );
+  });
+
+  /** Streams a directory's records in file order without an owner. */
+  const records = (directory: string, options: Pick<ReadOptions, "since">) =>
+    follow(
+      directory,
+      { cursor: { generation: 0, byteOffset: 0 }, listed: undefined },
+      { ...options, follow: false },
+      undefined,
+      undefined,
+    );
+
+  return { read, history, records, segments, generations, latestLaunchId };
+};
+
+/** Creates the owner's log store; closing its scope flushes and closes every writer. */
+export const make = Effect.fn("LogStore.make")(function* (options: LogStoreOptions) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const storeScope = yield* Scope.Scope;
+  const reader = makeReader(fs, path);
+  const rotateBytes = options.rotateBytes ?? defaultRotateBytes;
+  const retainBytes = options.retainBytes ?? defaultRetainBytes;
+  const retainSegments = options.retainSegments ?? defaultRetainSegments;
+  const retryShared = retrySharingViolation();
+
+  interface Attached extends Live {
+    readonly service: string;
+    readonly instanceId: string;
+    readonly directory: string;
+    readonly closed: Deferred.Deferred<void>;
+    /** Completed at the shutdown deadline; filesystem work then fails at once. */
+    readonly abort: Deferred.Deferred<void>;
+    readonly scope: Scope.Closeable;
+  }
+  const instances = yield* Ref.make<ReadonlyMap<string, Attached>>(new Map());
+  const closed = yield* Ref.make(false);
+  // Forked before the close finalizer is added, so the store's close detaches instances first.
+  const instancesScope = yield* Scope.fork(storeScope, "parallel");
+  const attached = (instanceId: string) =>
+    Ref.get(instances).pipe(
+      Effect.flatMap((current) => {
+        const instance = current.get(instanceId);
+        return instance === undefined
+          ? Effect.fail(
+              new LogStoreError({
+                operation: "read",
+                message: `Instance ${instanceId} has no logs`,
+              }),
+            )
+          : Effect.succeed(instance);
+      }),
+    );
+
+  const detach = Effect.fnUntraced(function* (instance: Attached) {
+    yield* Deferred.succeed(instance.closed, undefined);
+    yield* instance.passes.take(readerPermits);
+    yield* Scope.close(instance.scope, Exit.void);
+  });
+
+  /** Detaches instances together under one deadline that aborts their pending filesystem work. */
+  const detachAll = Effect.fnUntraced(function* (handles: ReadonlyArray<Attached>) {
+    if (handles.length === 0) return;
+    const deadline = yield* Effect.sleep(shutdownTimeout).pipe(
+      Effect.andThen(
+        Effect.forEach(handles, (handle) => Deferred.succeed(handle.abort, undefined)),
+      ),
+      Effect.andThen(
+        Effect.logWarning(
+          "Log persistence did not stop by the shutdown deadline; output not yet written is not recorded",
+        ),
+      ),
+      Effect.forkChild({ startImmediately: true }),
+    );
+    yield* Effect.forEach(handles, detach, { concurrency: "unbounded", discard: true }).pipe(
+      Effect.ensuring(Fiber.interrupt(deadline)),
+    );
+  });
+
+  const attach = Effect.fn("LogStore.attach")(function* (instance: AttachedInstance) {
+    if (yield* Ref.get(closed)) return;
+    const directory = path.join(options.root, instance.service, instance.instanceId);
+    // An unreadable listing defers choosing the next generation to the first append.
+    const existing = yield* reader.segments(directory).pipe(
+      retryShared,
+      Effect.map(Option.some),
+      Effect.catch((error) =>
+        Effect.logWarning(`Unable to list logs in ${directory}`, error).pipe(
+          Effect.as(Option.none<ReadonlyArray<{ generation: number; size: number }>>()),
+        ),
+      ),
+    );
+    const latest = Option.getOrElse(existing, () => []).at(-1);
+    const scope = yield* Scope.fork(instancesScope, "sequential");
+    const handle: Attached = {
+      service: instance.service,
+      instanceId: instance.instanceId,
+      directory,
+      scope,
+      lock: yield* Semaphore.make(1),
+      passes: yield* Semaphore.make(readerPermits),
+      end: yield* Ref.make<LogPosition>({
+        generation: latest?.generation ?? 0,
+        byteOffset: latest?.size ?? 0,
+      }),
+      wake: yield* PubSub.sliding<void>(1),
+      closed: yield* Deferred.make<void>(),
+      abort: yield* Deferred.make<void>(),
+    };
+    const splitter = makeSplitter();
+    let nextGeneration: number | undefined = Option.isSome(existing)
+      ? (latest?.generation ?? 0) + 1
+      : undefined;
+    let file:
+      | {
+          readonly handle: FileSystem.File;
+          readonly scope: Scope.Closeable;
+          readonly generation: number;
+          size: number;
+        }
+      | undefined;
+    /** Scopes of segments a failed or aborted write may have left with a partial record. */
+    const retired: Array<Scope.Closeable> = [];
+    /** Output not persisted, reported as `lost` by the next successful append. */
+    const dropped = new Map<string, Extract<LogEntry, { kind: "lost" }>>();
+    let broken: { readonly attempts: number; readonly retryAt: number } | undefined;
+    /** Launches whose dropped output was already reported in the owner log. */
+    const warnedLaunches = new Set<number>();
+
+    const aborted = new LogStoreError({
+      operation: "write",
+      message: `Log persistence of ${instance.service} instance ${instance.instanceId} passed the shutdown deadline`,
+    });
+    /** Fails at the shutdown deadline instead of waiting for filesystem work that hangs. */
+    const abortable = <A>(effect: Effect.Effect<A, LogStoreError>) =>
+      Deferred.isDone(handle.abort).pipe(
+        Effect.flatMap((done) =>
+          done
+            ? Effect.fail(aborted)
+            : effect.pipe(
+                Effect.raceFirst(
+                  Deferred.await(handle.abort).pipe(Effect.andThen(Effect.fail(aborted))),
+                ),
+              ),
+        ),
+      );
+
+    const closeFile = Effect.suspend(() => {
+      const scopes = [...retired.splice(0), ...(file === undefined ? [] : [file.scope])];
+      file = undefined;
+      return Effect.forEach(scopes, (current) => Scope.close(current, Exit.void), {
+        discard: true,
+      });
+    });
+
+    let retentionWarned = false;
+    /** Removes the oldest closed segments past the limits; a failed removal waits for the next rotation. */
+    const enforceRetention = reader.segments(directory).pipe(
+      Effect.flatMap((listed) =>
+        Effect.gen(function* () {
+          let total = listed.reduce((sum, segment) => sum + segment.size, 0);
+          let count = listed.length;
+          let failure: unknown;
+          // The newest closed segment holds the latest records before the open one.
+          const newestClosed = listed
+            .map(({ generation }) => generation)
+            .filter((generation) => generation !== file?.generation)
+            .at(-1);
+          for (const segment of listed) {
+            if (total <= retainBytes && count <= retainSegments) break;
+            if (segment.generation === file?.generation || segment.generation === newestClosed)
+              break;
+            // A reader holding the file on Windows defers its deletion to the next rotation.
+            const removed = yield* fs
+              .remove(path.join(directory, segmentName(segment.generation)), { force: true })
+              .pipe(
+                retryShared,
+                Effect.as(true),
+                Effect.catch((error) =>
+                  Effect.sync(() => {
+                    failure ??= error;
+                    return false;
+                  }),
+                ),
+              );
+            if (!removed) continue;
+            total -= segment.size;
+            count -= 1;
+          }
+          if (failure !== undefined) return yield* Effect.fail(failure);
+          retentionWarned = false;
+        }),
+      ),
+      Effect.catch((error) => {
+        if (retentionWarned) return Effect.void;
+        retentionWarned = true;
+        return Effect.logWarning(
+          `Removing old logs of ${instance.service} instance ${instance.instanceId} failed; retrying at the next rotation`,
+          error,
+        );
+      }),
+    );
+
+    const openGeneration = Effect.gen(function* () {
+      yield* closeFile;
+      yield* fs.makeDirectory(directory, { recursive: true, mode: 0o700 });
+      const generation =
+        nextGeneration ??
+        ((yield* reader.generations(directory).pipe(retryShared)).at(-1) ?? 0) + 1;
+      nextGeneration = generation + 1;
+      const fileScope = yield* Scope.make("sequential");
+      const opened = yield* fs
+        .open(path.join(directory, segmentName(generation)), { flag: "ax", mode: 0o600 })
+        .pipe(
+          Scope.provide(fileScope),
+          Effect.onError(() =>
+            Scope.close(fileScope, Exit.void).pipe(
+              Effect.andThen(
+                Effect.sync(() => {
+                  nextGeneration = undefined;
+                }),
+              ),
+            ),
+          ),
+        );
+      file = { handle: opened, scope: fileScope, generation, size: 0 };
+      yield* Ref.set(handle.end, { generation, byteOffset: 0 });
+      yield* PubSub.publish(handle.wake, undefined);
+      yield* enforceRetention;
+      return file;
+    }).pipe(Effect.mapError(storeError("open")));
+
+    const writePieces = (pieces: ReadonlyArray<Uint8Array>) =>
+      Effect.gen(function* () {
+        const current = file ?? (yield* openGeneration);
+        const bytes = new Uint8Array(pieces.reduce((sum, piece) => sum + piece.length, 0));
+        let offset = 0;
+        for (const piece of pieces) {
+          bytes.set(piece, offset);
+          offset += piece.length;
+        }
+        yield* current.handle.writeAll(bytes).pipe(
+          Effect.mapError(storeError("write")),
+          // The next record goes to a new segment, never after a partial one.
+          Effect.onError(() =>
+            Effect.sync(() => {
+              retired.push(current.scope);
+              file = undefined;
+            }),
+          ),
+        );
+        current.size += bytes.length;
+        yield* Ref.set(handle.end, { generation: current.generation, byteOffset: current.size });
+        yield* PubSub.publish(handle.wake, undefined);
+      });
+
+    /** Appends records, rotating before a record that would overflow the segment. */
+    const append = (entries: ReadonlyArray<LogEntry>, progress: { written: number }) =>
+      Effect.gen(function* () {
+        let pieces: Array<Uint8Array> = [];
+        let pending = 0;
+        for (const entry of entries) {
+          const bytes = encoder.encode(encodeEntry(entry));
+          const used = (file?.size ?? 0) + pending;
+          if (used > 0 && used + bytes.length > rotateBytes) {
+            if (pieces.length > 0) yield* writePieces(pieces);
+            progress.written += pieces.length;
+            yield* openGeneration;
+            pieces = [];
+            pending = 0;
+          }
+          pieces.push(bytes);
+          pending += bytes.length;
+        }
+        if (pieces.length > 0) yield* writePieces(pieces);
+        progress.written += pieces.length;
+      });
+
+    const dropKey = (launchId: number, stream: LaunchOutput["stream"] | undefined) =>
+      `${launchId}:${stream ?? "output"}`;
+    const drop = (
+      launchId: number,
+      stream: LaunchOutput["stream"] | undefined,
+      time: number,
+      count: number,
+    ) => {
+      const previous = dropped.get(dropKey(launchId, stream));
+      dropped.set(dropKey(launchId, stream), {
+        kind: "lost",
+        timestamp: Math.max(previous?.timestamp ?? time, time),
+        launchId,
+        ...(stream === undefined ? {} : { stream }),
+        count: (previous?.count ?? 0) + count,
+      });
+    };
+    const dropChunks = (chunks: ReadonlyArray<LaunchOutput>) => {
+      for (const chunk of chunks) drop(chunk.launchId, chunk.stream, chunk.time, 1);
+    };
+    /** Records unwritten records as `lost`: a line counts as one chunk, a gap with its count. */
+    const dropRecords = (entries: ReadonlyArray<LogEntry>) => {
+      for (const entry of entries)
+        if (entry.kind === "lost") drop(entry.launchId, entry.stream, entry.timestamp, entry.count);
+        else if (entry.kind !== "launch") drop(entry.launchId, entry.kind, entry.timestamp, 1);
+    };
+
+    /**
+     * Appends records after the pending `lost` markers. After a failure, appends are skipped with
+     * backoff, and every record not written is reported as `lost` once writing works again.
+     */
+    const persist = Effect.fnUntraced(function* (entries: ReadonlyArray<LogEntry>) {
+      const now = yield* Clock.currentTimeMillis;
+      if (broken !== undefined && now < broken.retryAt) return dropRecords(entries);
+      if (entries.length === 0 && dropped.size === 0) return;
+      const markers = [...dropped.values()];
+      const markersWritten = { written: 0 };
+      const entriesWritten = { written: 0 };
+      const written = yield* abortable(
+        append(markers, markersWritten).pipe(Effect.andThen(append(entries, entriesWritten))),
+      ).pipe(Effect.exit);
+      for (const marker of markers.slice(0, markersWritten.written))
+        dropped.delete(dropKey(marker.launchId, marker.stream));
+      if (Exit.isSuccess(written)) {
+        broken = undefined;
+        for (const entry of [...markers, ...entries])
+          if (entry.kind === "lost" && !warnedLaunches.has(entry.launchId)) {
+            warnedLaunches.add(entry.launchId);
+            yield* Effect.logWarning(
+              `${instance.service} instance ${instance.instanceId} dropped ${entry.count} ${entry.stream ?? "output"} ${entry.count === 1 ? "chunk" : "chunks"} of launch ${entry.launchId} before they were persisted; later drops of this launch are recorded only in its logs`,
+            );
+          }
+        return;
+      }
+      dropRecords(entries.slice(entriesWritten.written));
+      if (broken === undefined && !(yield* Deferred.isDone(handle.abort)))
+        yield* Effect.logError(
+          `Unable to persist ${instance.service} logs of instance ${instance.instanceId}; retrying with a new segment`,
+          written.cause,
+        );
+      const attempts = (broken?.attempts ?? 0) + 1;
+      broken = {
+        attempts,
+        retryAt: now + Math.min(retryBaseMillis * 2 ** (attempts - 1), retryMaxMillis),
+      };
+    });
+
+    /** Persists flushed partial lines; only waiting for the writer lock is interruptible. */
+    const persistFlushed = (flushed: (now: number) => ReadonlyArray<LogEntry>) =>
+      Clock.currentTimeMillis.pipe(
+        Effect.flatMap((now) =>
+          handle.lock.withPermits(1)(
+            Effect.uninterruptible(Effect.suspend(() => persist(flushed(now)))),
+          ),
+        ),
+      );
+
+    /** Signals the late-line flusher that an ended launch holds a partial line. */
+    const lateLines = yield* Queue.sliding<void>(1);
+
+    /** The writer took a batch it has not persisted yet. */
+    let holding = false;
+
+    /**
+     * Persists a batch, then the late partial lines its publish times prove idle: every chunk
+     * published before the batch's last one has been split.
+     */
+    const persistBatch = (chunks: ReadonlyArray<LaunchOutput>) =>
+      handle.lock
+        .withPermits(1)(
+          Effect.suspend(() => {
+            const entries = chunks.flatMap((chunk) => splitter.push(chunk));
+            const published = chunks.reduce((latest, chunk) => Math.max(latest, chunk.time), 0);
+            return persist([...entries, ...splitter.flushEnded(published, false)]);
+          }),
+        )
+        .pipe(
+          Effect.andThen(
+            Effect.suspend(() => {
+              holding = false;
+              return splitter.endedDue() === undefined
+                ? Effect.void
+                : Queue.offer(lateLines, undefined);
+            }),
+          ),
+          Effect.uninterruptible,
+        );
+
+    /**
+     * Flushes due partial lines of ended launches unless published output is still unsplit, whose
+     * batch then signals again; `false` when it deferred.
+     */
+    const flushIdle = handle.lock.withPermits(1)(
+      Effect.uninterruptible(
+        Effect.gen(function* () {
+          if (holding || (yield* PubSub.remaining(subscription)) > 0) return false;
+          const now = yield* Clock.currentTimeMillis;
+          yield* persist(splitter.flushEnded(now, true));
+          return true;
+        }),
+      ),
+    );
+
+    /**
+     * Flushes partial lines of ended launches once the output published before the end is split,
+     * and late partial lines once they stay idle for the grace.
+     */
+    const flushLate = Effect.forever(
+      Effect.gen(function* () {
+        yield* Queue.take(lateLines);
+        for (let due = splitter.endedDue(); due !== undefined; due = splitter.endedDue()) {
+          const now = yield* Clock.currentTimeMillis;
+          if (now < due) yield* Effect.sleep(Duration.millis(due - now));
+          else if (!(yield* flushIdle)) break;
+        }
+      }),
+    );
+
+    const flushLaunches = Effect.gen(function* () {
+      const previous = yield* Ref.make<number | undefined>(undefined);
+      yield* instance.observation.pipe(
+        Stream.map(({ launchId }) => launchId),
+        Stream.changes,
+        Stream.runForEach((launchId) =>
+          Ref.getAndSet(previous, launchId).pipe(
+            Effect.flatMap((prior) =>
+              prior === undefined
+                ? Effect.void
+                : Effect.sync(() => splitter.endLaunch(prior)).pipe(
+                    Effect.andThen(Queue.offer(lateLines, undefined)),
+                  ),
+            ),
+          ),
+        ),
+      );
+    });
+
+    const subscription = yield* instance.logs.pipe(Scope.provide(scope));
+    /** Writes output still queued at close, within a bound; the rest is recorded as lost. */
+    const drain = Effect.gen(function* () {
+      while (true) {
+        const chunks = yield* PubSub.takeUpTo(subscription, drainBatch);
+        if (chunks.length === 0) return;
+        yield* persistBatch(chunks);
+      }
+    }).pipe(
+      Effect.timeoutOption(drainTimeout),
+      Effect.flatMap(
+        Option.match({
+          onSome: () => Effect.void,
+          onNone: () =>
+            PubSub.takeUpTo(subscription, Number.MAX_SAFE_INTEGER).pipe(
+              Effect.flatMap((chunks) =>
+                handle.lock.withPermits(1)(
+                  Effect.suspend(() => {
+                    dropChunks(chunks);
+                    broken = undefined;
+                    return persist([]);
+                  }),
+                ),
+              ),
+            ),
+        }),
+      ),
+    );
+    yield* Scope.addFinalizer(
+      scope,
+      drain.pipe(
+        Effect.andThen(persistFlushed((now) => splitter.flush(now))),
+        // Closing outlives the deadline so aborted segments still release their handles.
+        Effect.andThen(
+          Effect.forkDetach(closeFile).pipe(
+            Effect.flatMap((fiber) => abortable(Fiber.join(fiber))),
+          ),
+        ),
+        Effect.ignore,
+      ),
+    );
+    // A taken batch is persisted unless the shutdown deadline aborts it, so interruption only
+    // lands while waiting for output.
+    yield* Effect.forkIn(
+      Effect.forever(
+        Effect.uninterruptibleMask((restore) =>
+          restore(PubSub.takeAll(subscription)).pipe(
+            Effect.flatMap((chunks) => {
+              holding = true;
+              return persistBatch(chunks);
+            }),
+          ),
+        ),
+      ),
+      scope,
+    );
+    yield* Effect.forkIn(flushLaunches, scope);
+    yield* Effect.forkIn(flushLate, scope);
+    yield* Ref.update(instances, (current) => new Map(current).set(instance.instanceId, handle));
+  });
+
+  const read = Effect.fn("LogStore.read")(function* (instanceId: string, readOptions: ReadOptions) {
+    const instance = yield* attached(instanceId);
+    const records = yield* reader.read(instance.directory, readOptions, instance);
+    return records.pipe(Stream.interruptWhen(Deferred.await(instance.closed)));
+  });
+
+  const remove = Effect.fn("LogStore.remove")(function* (target: {
+    readonly service: string;
+    readonly instanceId: string;
+  }) {
+    const directory = path.join(options.root, target.service, target.instanceId);
+    const instance = yield* Ref.modify(
+      instances,
+      (current): readonly [Attached | undefined, ReadonlyMap<string, Attached>] => {
+        const next = new Map(current);
+        next.delete(target.instanceId);
+        return [current.get(target.instanceId), next];
+      },
+    );
+    if (instance !== undefined) yield* detachAll([instance]);
+    yield* fs
+      .remove(directory, { recursive: true, force: true })
+      .pipe(retryShared, Effect.mapError(removeError(directory)));
+  });
+
+  /** Deletes log directories whose instance is no longer attached, left by a failed removal. */
+  const removeOrphans = Effect.fn("LogStore.removeOrphans")(function* () {
+    const current = yield* Ref.get(instances);
+    for (const { service, instanceId } of yield* persistedInstances(fs, path, options.root))
+      if (!current.has(instanceId)) {
+        const directory = path.join(options.root, service, instanceId);
+        yield* fs.remove(directory, { recursive: true, force: true }).pipe(
+          retryShared,
+          Effect.catch((error) =>
+            Effect.logWarning(`Unable to remove orphaned logs ${directory}`, error),
+          ),
+        );
+      }
+  });
+
+  const close = Effect.gen(function* () {
+    yield* Ref.set(closed, true);
+    const current = yield* Ref.getAndSet(instances, new Map());
+    yield* detachAll([...current.values()]);
+  }).pipe(Effect.withSpan("LogStore.close"));
+
+  yield* Effect.addFinalizer(() => close);
+
+  return {
+    attach,
+    read,
+    directory: (instanceId) => Effect.map(attached(instanceId), (instance) => instance.directory),
+    remove,
+    removeOrphans: removeOrphans(),
+    latestLaunchId: (instance) =>
+      reader
+        .latestLaunchId(path.join(options.root, instance.service, instance.instanceId))
+        .pipe(Effect.orElseSucceed(() => Option.none<number>())),
+    close,
+  } satisfies Interface;
+});
+
+/** Lists the instance directories of a stack's logs, limited to `instances` when given. */
+const persistedInstances = Effect.fnUntraced(function* (
+  fs: FileSystem.FileSystem,
+  path: Path.Path,
+  root: string,
+  instances?: ReadonlyArray<string>,
+) {
+  const selected: Array<{ readonly service: string; readonly instanceId: string }> = [];
+  for (const service of yield* listDirectories(fs, path, root))
+    for (const instanceId of yield* listDirectories(fs, path, path.join(root, service)))
+      if (instances === undefined || instances.includes(instanceId))
+        selected.push({ service, instanceId });
+  return selected;
+});
+
+/** Streams persisted records of a stack's instances, one instance after another in file order. */
+export const streamStackLogs = (options: {
+  readonly root: string;
+  readonly instances?: ReadonlyArray<string>;
+  readonly since?: number;
+}): Stream.Stream<StackLogRecord, LogStoreError, FileSystem.FileSystem | Path.Path> =>
+  Stream.unwrap(
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const reader = makeReader(fs, path);
+      const selected = yield* persistedInstances(fs, path, options.root, options.instances);
+      return Stream.fromIterable(selected).pipe(
+        Stream.flatMap(({ service, instanceId }) =>
+          reader
+            .records(path.join(options.root, service, instanceId), options)
+            .pipe(Stream.map((record): StackLogRecord => ({ ...record, service, instanceId }))),
+        ),
+      );
+    }),
+  );
diff --git a/packages/stack/src/host/LogflareEvents.ts b/packages/stack/src/host/LogflareEvents.ts
new file mode 100644
index 0000000000..98fca1af93
--- /dev/null
+++ b/packages/stack/src/host/LogflareEvents.ts
@@ -0,0 +1,210 @@
+import { DateTime, Option, Predicate } from "effect";
+import type { ServiceCreation } from "../services/Catalog.ts";
+
+/** Logflare source per shipped service kind; Studio's Logs pages query these names. */
+export const logflareSources = {
+  auth: "gotrue.logs.prod",
+  rest: "postgREST.logs.prod",
+  realtime: "realtime.logs.prod",
+  storage: "storage.logs.prod.2",
+  functions: "deno-relay-logs",
+  database: "postgres.logs",
+} as const satisfies Partial<Record<ServiceCreation["service"], string>>;
+
+export type ShippedService = keyof typeof logflareSources;
+
+export const isShippedService = (service: ServiceCreation["service"]): service is ShippedService =>
+  Object.hasOwn(logflareSources, service);
+
+/** One ingest event in the shape Studio's local log queries expect. */
+export interface LogflareEvent {
+  readonly project?: string;
+  readonly event_message: string;
+  readonly appname: ShippedService;
+  readonly timestamp: string;
+  readonly metadata: Record<string, unknown>;
+}
+
+/** Deeper JSON lines ship unparsed, since metadata is sanitized and serialized recursively. */
+const maxMetadataDepth = 32;
+
+const withinDepth = (value: unknown, depth: number): boolean =>
+  typeof value !== "object" ||
+  value === null ||
+  (depth < maxMetadataDepth &&
+    Object.values(value).every((child) => withinDepth(child, depth + 1)));
+
+const parseJsonObject = (text: string): Record<string, unknown> | undefined => {
+  if (!text.startsWith("{")) return undefined;
+  try {
+    const value: unknown = JSON.parse(text);
+    return Predicate.isObject(value) && withinDepth(value, 0) ? value : undefined;
+  } catch {
+    return undefined;
+  }
+};
+
+const months: Record<string, number> = {
+  jan: 0,
+  feb: 1,
+  mar: 2,
+  apr: 3,
+  may: 4,
+  jun: 5,
+  jul: 6,
+  aug: 7,
+  sep: 8,
+  oct: 9,
+  nov: 10,
+  dec: 11,
+};
+
+/** Parses PostgREST's `%d/%b/%Y:%H:%M:%S %z` prefix into an ISO-8601 timestamp. */
+const parsePostgrestTime = (text: string): string | undefined => {
+  const match =
+    /^(\d{2})\/([A-Za-z]{3})\/(\d{4}):(\d{2}):(\d{2}):(\d{2}) ([+-])(\d{2})(\d{2})$/u.exec(text);
+  if (match === null) return undefined;
+  const [, day, month, year, hour, minute, second, sign, zoneHours, zoneMinutes] = match;
+  const monthIndex = months[month?.toLowerCase() ?? ""];
+  if (monthIndex === undefined) return undefined;
+  const utc = Date.UTC(
+    Number(year),
+    monthIndex,
+    Number(day),
+    Number(hour),
+    Number(minute),
+    Number(second),
+  );
+  const offsetMinutes = (sign === "-" ? -1 : 1) * (Number(zoneHours) * 60 + Number(zoneMinutes));
+  return Option.getOrUndefined(
+    Option.map(DateTime.make(utc - offsetMinutes * 60_000), DateTime.formatIso),
+  );
+};
+
+/** The time and request of PostgREST's Apache combined request line. */
+const postgrestRequest = /^\S+ \S+ \S+ \[([^\]]+)\] "([A-Z]+) (\S+) ([^"\s]+)" (\d{3}) /u;
+
+const withoutProject = ({ project: _project, ...event }: LogflareEvent): LogflareEvent => event;
+
+const remaps: Record<ShippedService, (event: LogflareEvent) => LogflareEvent> = {
+  auth: (event) => {
+    const parsed = parseJsonObject(event.event_message);
+    return parsed === undefined
+      ? event
+      : { ...event, metadata: { ...event.metadata, timestamp: parsed.time, ...parsed } };
+  },
+  rest: (event) => {
+    const request = postgrestRequest.exec(event.event_message);
+    const requestTime = request === null ? undefined : parsePostgrestTime(request[1] ?? "");
+    if (request !== null && requestTime !== undefined)
+      return {
+        ...event,
+        timestamp: requestTime,
+        metadata: {
+          ...event.metadata,
+          host: event.project,
+          method: request[2],
+          path: request[3],
+          protocol: request[4],
+          status: Number(request[5]),
+        },
+      };
+    const match = /^(.*?): (.*)$/u.exec(event.event_message);
+    const timestamp = match === null ? undefined : parsePostgrestTime(match[1] ?? "");
+    return match === null || timestamp === undefined
+      ? event
+      : {
+          ...event,
+          event_message: match[2] ?? "",
+          timestamp,
+          metadata: { ...event.metadata, host: event.project },
+        };
+  },
+  realtime: (event) => {
+    const match = /^(\d+:\d+:\d+\.\d+) \[(\w+)\] (.*)$/u.exec(event.event_message);
+    const metadata = { ...event.metadata, project: event.project, external_id: event.project };
+    return withoutProject(
+      match === null
+        ? { ...event, metadata }
+        : { ...event, event_message: match[3] ?? "", metadata: { ...metadata, level: match[2] } },
+    );
+  },
+  storage: (event) => {
+    const parsed = parseJsonObject(event.event_message);
+    const metadata = { ...event.metadata, project: event.project, tenantId: event.project };
+    return withoutProject(
+      parsed === undefined
+        ? { ...event, metadata }
+        : {
+            ...event,
+            event_message: typeof parsed.msg === "string" ? parsed.msg : event.event_message,
+            metadata: {
+              ...metadata,
+              level: parsed.level,
+              timestamp: parsed.time,
+              context: [{ host: parsed.hostname, pid: parsed.pid }],
+            },
+          },
+    );
+  },
+  functions: (event) =>
+    withoutProject({ ...event, metadata: { ...event.metadata, project_ref: event.project } }),
+  database: (event) => {
+    const match = /.*(INFO|NOTICE|WARNING|ERROR|LOG|FATAL|PANIC):/u.exec(event.event_message);
+    return {
+      ...event,
+      metadata: {
+        ...event.metadata,
+        host: "db-default",
+        parsed: { timestamp: event.timestamp, error_severity: match?.[1] ?? "LOG" },
+      },
+    };
+  },
+};
+
+/**
+ * Replaces NUL and unpaired surrogates with U+FFFD: Logflare stores events as Postgres `jsonb`,
+ * which rejects both, and one rejected event drops its whole batch.
+ */
+const storableText = (text: string): string => text.replaceAll("\u0000", "�").toWellFormed();
+
+const storableValue = (value: unknown): unknown => {
+  if (typeof value === "string") return storableText(value);
+  if (Array.isArray(value)) return value.map(storableValue);
+  return typeof value === "object" && value !== null ? storableRecord(value) : value;
+};
+
+const storableRecord = (record: object): Record<string, unknown> =>
+  Object.fromEntries(
+    Object.entries(record).map(([key, value]) => [storableText(key), storableValue(value)]),
+  );
+
+const storableEvent = (event: LogflareEvent): LogflareEvent => ({
+  ...event,
+  event_message: storableText(event.event_message),
+  metadata: storableRecord(event.metadata),
+});
+
+/**
+ * Builds the Logflare event for one service log line received at `timestamp`; a line its
+ * service's remap cannot convert ships as its raw message.
+ */
+export const logflareEvent = (
+  service: ShippedService,
+  timestamp: string,
+  message: string,
+): LogflareEvent => {
+  const raw: LogflareEvent = {
+    project: "default",
+    event_message: message,
+    appname: service,
+    timestamp,
+    metadata: {},
+  };
+  // A throwing remap would otherwise end the instance's shipping session for good.
+  try {
+    return storableEvent(remaps[service](raw));
+  } catch {
+    return storableEvent(raw);
+  }
+};
diff --git a/packages/stack/src/host/LogflareEvents.unit.test.ts b/packages/stack/src/host/LogflareEvents.unit.test.ts
new file mode 100644
index 0000000000..4717fb1072
--- /dev/null
+++ b/packages/stack/src/host/LogflareEvents.unit.test.ts
@@ -0,0 +1,149 @@
+import { expect, it } from "@effect/vitest";
+import { logflareEvent } from "./LogflareEvents.ts";
+
+const received = "2026-09-28T10:00:00.000Z";
+
+it("merges structured Auth lines into metadata and keeps the raw message", () => {
+  const line =
+    '{"level":"info","msg":"request completed","time":"2026-09-28T09:59:59Z","path":"/health"}';
+  expect(logflareEvent("auth", received, line)).toEqual({
+    project: "default",
+    appname: "auth",
+    event_message: line,
+    timestamp: received,
+    metadata: {
+      timestamp: "2026-09-28T09:59:59Z",
+      level: "info",
+      msg: "request completed",
+      time: "2026-09-28T09:59:59Z",
+      path: "/health",
+    },
+  });
+});
+
+it("ships an Auth JSON line nested too deep for metadata as its raw message", () => {
+  const depth = 16_000;
+  const line = `{"msg":"deep","detail":${"[".repeat(depth)}${"]".repeat(depth)}}`;
+  expect(logflareEvent("auth", received, line)).toEqual({
+    project: "default",
+    appname: "auth",
+    event_message: line,
+    timestamp: received,
+    metadata: {},
+  });
+});
+
+it("splits PostgREST's timestamp prefix from the message and converts its zone offset", () => {
+  expect(
+    logflareEvent("rest", received, "28/Sep/2026:12:30:15 +0200: Starting PostgREST 13.0.7..."),
+  ).toEqual({
+    project: "default",
+    appname: "rest",
+    event_message: "Starting PostgREST 13.0.7...",
+    timestamp: "2026-09-28T10:30:15.000Z",
+    metadata: { host: "default" },
+  });
+});
+
+it("splits PostgREST's timestamp prefix from a message that contains a colon", () => {
+  const event = logflareEvent(
+    "rest",
+    received,
+    "28/Sep/2026:12:30:15 +0200: Failed to load schema cache: connection refused",
+  );
+  expect(event.event_message).toBe("Failed to load schema cache: connection refused");
+  expect(event.timestamp).toBe("2026-09-28T10:30:15.000Z");
+});
+
+it("parses a PostgREST request line into request metadata stamped with the request time", () => {
+  const line =
+    '172.18.0.1 - anon [28/Sep/2026:12:30:15 +0200] "GET /items?select=id HTTP/1.1" 200 2 "" "curl/8.7.1"';
+  expect(logflareEvent("rest", received, line)).toEqual({
+    project: "default",
+    appname: "rest",
+    event_message: line,
+    timestamp: "2026-09-28T10:30:15.000Z",
+    metadata: {
+      host: "default",
+      method: "GET",
+      path: "/items?select=id",
+      protocol: "HTTP/1.1",
+      status: 200,
+    },
+  });
+});
+
+it("keeps a PostgREST line whose prefix is not a timestamp", () => {
+  const event = logflareEvent("rest", received, "Config: schema cache loaded");
+  expect(event.event_message).toBe("Config: schema cache loaded");
+  expect(event.timestamp).toBe(received);
+});
+
+it("extracts the Realtime level and moves the project into metadata", () => {
+  expect(
+    logflareEvent("realtime", received, "10:00:01.123 [info] Running RealtimeWeb.Endpoint"),
+  ).toEqual({
+    appname: "realtime",
+    event_message: "Running RealtimeWeb.Endpoint",
+    timestamp: received,
+    metadata: { project: "default", external_id: "default", level: "info" },
+  });
+});
+
+it("parses Storage JSON lines into the tenant metadata shape", () => {
+  expect(
+    logflareEvent(
+      "storage",
+      received,
+      '{"level":"info","time":"2026-09-28T09:59:58Z","pid":7,"hostname":"storage","msg":"listening"}',
+    ),
+  ).toEqual({
+    appname: "storage",
+    event_message: "listening",
+    timestamp: received,
+    metadata: {
+      project: "default",
+      tenantId: "default",
+      level: "info",
+      timestamp: "2026-09-28T09:59:58Z",
+      context: [{ host: "storage", pid: 7 }],
+    },
+  });
+});
+
+it("tags Functions lines with the project ref", () => {
+  expect(logflareEvent("functions", received, "booted worker")).toEqual({
+    appname: "functions",
+    event_message: "booted worker",
+    timestamp: received,
+    metadata: { project_ref: "default" },
+  });
+});
+
+it("derives the Postgres severity from the last level marker and defaults to LOG", () => {
+  const line = "2026-09-28 10:00:00.000 UTC [77] ERROR:  relation does not exist";
+  expect(logflareEvent("database", received, line)).toEqual({
+    project: "default",
+    appname: "database",
+    event_message: line,
+    timestamp: received,
+    metadata: { host: "db-default", parsed: { timestamp: received, error_severity: "ERROR" } },
+  });
+  expect(logflareEvent("database", received, "\tat character 15").metadata.parsed).toEqual({
+    timestamp: received,
+    error_severity: "LOG",
+  });
+});
+
+it("replaces NUL and unpaired surrogates, which Postgres jsonb rejects, in the message and metadata", () => {
+  const line = String.raw`{"msg":"a\u0000b","detail":["\ud800"],"k\u0000":"\udc00 x"}`;
+  const event = logflareEvent("auth", received, line);
+
+  expect(logflareEvent("database", received, "a\u0000b").event_message).toBe("a�b");
+  expect(event.metadata).toMatchObject({
+    msg: "a�b",
+    detail: ["�"],
+    "k�": "� x",
+  });
+  expect(event.event_message).toBe(line);
+});
diff --git a/packages/stack/src/host/LogflareStorage.integration.test.ts b/packages/stack/src/host/LogflareStorage.integration.test.ts
new file mode 100644
index 0000000000..e379409061
--- /dev/null
+++ b/packages/stack/src/host/LogflareStorage.integration.test.ts
@@ -0,0 +1,150 @@
+import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { PgClient } from "@effect/sql-pg";
+import { describe, expect, it } from "@effect/vitest";
+import { Context, Effect, Exit, FileSystem, Layer, Redacted, Ref, Scope } from "effect";
+import { connect, createServer, type Socket } from "node:net"; // oxlint-disable-line effecttsgo/node-builtin-import -- real socket fixture.
+import { tmpdir } from "node:os";
+import { makeService } from "../Service.ts";
+import { makeDatabase, type DatabaseConfig } from "../services/Database.ts";
+import * as LogflareStorage from "./LogflareStorage.ts";
+
+const config: DatabaseConfig = {
+  version: "17",
+  databasePassword: Redacted.make("logflare-storage-password"),
+  jwtSecret: Redacted.make("logflare-storage-jwt-secret-with-32-chars"),
+  jwtExpiry: 3600,
+  healthTimeoutMs: 120_000,
+};
+
+const sourceToken = "0b6d7c8e-1f2a-4b3c-8d4e-5f6a7b8c9d0e";
+const uncreatedToken = "1c7e8d9f-2a3b-4c5d-9e6f-7a8b9c0d1e2f";
+const storedId = "8f0e7a9b-6c5d-8e4f-9a3b-2c1d0e9f8a7b";
+const missingId = "9a1b2c3d-4e5f-8a6b-9c7d-8e9f0a1b2c3d";
+/** Analytics' database URL as its runtime addresses the bound database. */
+const databaseUrl = `postgresql://supabase_admin:${Redacted.value(config.databasePassword)}@db-runtime:5432/postgres`;
+
+/** A native stack database whose `_supabase` database holds a Logflare-shaped source table. */
+const analyticsDatabase = Effect.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const root = yield* fs.makeTempDirectoryScoped({ prefix: "stack-logflare-storage-" });
+  const recipe = yield* makeDatabase({
+    stackId: "logflare-storage",
+    instanceId: "database",
+    root,
+    cacheRoot: `${tmpdir()}/supabase-stack-artifacts`,
+    runtime: "native",
+  });
+  // The service runs its operations in its own scope, which must stay open while it is destroyed.
+  const serviceScope = yield* Scope.make();
+  const service = yield* makeService(recipe.definition, { id: "database", config }).pipe(
+    Scope.provide(serviceScope),
+  );
+  yield* Effect.addFinalizer(() =>
+    service.destroy.pipe(Effect.ignore, Effect.andThen(Scope.close(serviceScope, Exit.void))),
+  );
+  yield* service.start;
+  yield* service.ready;
+  const endpoint = yield* recipe.endpoint;
+  if (endpoint.kind !== "unix") return yield* Effect.die("native database has no socket");
+  const database = yield* LogflareStorage.analyticsDatabase(databaseUrl, endpoint);
+  yield* Effect.scoped(
+    Effect.gen(function* () {
+      const services = yield* Layer.build(PgClient.layer({ url: Redacted.make(database.url) }));
+      yield* Context.get(services, PgClient.PgClient).unsafe(`
+        CREATE SCHEMA IF NOT EXISTS _analytics;
+        CREATE TABLE _analytics.sources (name text NOT NULL, token uuid NOT NULL);
+        INSERT INTO _analytics.sources VALUES
+          ('postgres.logs', '${sourceToken}'), ('auth.logs', '${uncreatedToken}');
+        CREATE TABLE _analytics."log_events_${sourceToken.replaceAll("-", "_")}" (id uuid PRIMARY KEY);
+        INSERT INTO _analytics."log_events_${sourceToken.replaceAll("-", "_")}" VALUES ('${storedId}');
+      `);
+    }),
+  );
+  return { database, socket: `${endpoint.path}/.s.PGSQL.${endpoint.port}` };
+});
+
+/** Relays TCP connections to a Unix socket until `cut` drops them all and refuses new ones. */
+const socketRelay = (path: string) =>
+  Effect.acquireRelease(
+    Effect.callback<{
+      readonly port: number;
+      readonly cut: () => void;
+      readonly close: () => void;
+    }>((resume) => {
+      const sockets = new Set<Socket>();
+      let cut = false;
+      const server = createServer((client) => {
+        if (cut) return client.destroy();
+        const upstream = connect(path);
+        for (const socket of [client, upstream]) {
+          sockets.add(socket);
+          socket.on("close", () => sockets.delete(socket));
+          socket.on("error", () => socket.destroy());
+        }
+        client.pipe(upstream);
+        upstream.pipe(client);
+      });
+      server.listen(0, "127.0.0.1", () => {
+        const address = server.address();
+        if (address === null || typeof address === "string")
+          return resume(Effect.die("relay has no address"));
+        resume(
+          Effect.succeed({
+            port: address.port,
+            cut: () => {
+              cut = true;
+              for (const socket of sockets) socket.destroy();
+            },
+            close: () => server.close(),
+          }),
+        );
+      });
+    }),
+    (relay) => Effect.sync(relay.close),
+  );
+
+const layer = Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp);
+
+describe("LogflareStorage", { timeout: 180_000 }, () => {
+  it.live(
+    "reads stored ids from a source's table, none before Analytics creates it, and fails for an unknown source",
+    () =>
+      Effect.gen(function* () {
+        const { database } = yield* analyticsDatabase;
+        const storage = yield* LogflareStorage.make(Effect.succeed(database));
+
+        const stored = yield* storage.storedIds("postgres.logs", [storedId, missingId]);
+        const uncreated = yield* storage.storedIds("auth.logs", [storedId]);
+        const unknown = yield* storage.storedIds("storage.logs", [storedId]).pipe(Effect.flip);
+
+        expect([...stored]).toEqual([storedId]);
+        expect([...uncreated]).toEqual([]);
+        expect(unknown.message).toBe("Analytics has no storage.logs sources");
+      }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.live("connects again after a failed query, so it follows a database that moved", () =>
+    Effect.gen(function* () {
+      const { database, socket } = yield* analyticsDatabase;
+      const relay = yield* socketRelay(socket);
+      const location = yield* Ref.make(
+        yield* LogflareStorage.analyticsDatabase(databaseUrl, {
+          kind: "tcp",
+          host: "127.0.0.1",
+          port: relay.port,
+        }),
+      );
+      const storage = yield* LogflareStorage.make(Ref.get(location));
+      const before = yield* storage.storedIds("postgres.logs", [storedId]);
+
+      relay.cut();
+      yield* Ref.set(location, database);
+      const failed = yield* storage.storedIds("postgres.logs", [storedId]).pipe(Effect.exit);
+      const after = yield* storage.storedIds("postgres.logs", [storedId]);
+
+      expect([...before]).toEqual([storedId]);
+      expect(Exit.isFailure(failed)).toBe(true);
+      expect([...after]).toEqual([storedId]);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+});
diff --git a/packages/stack/src/host/LogflareStorage.ts b/packages/stack/src/host/LogflareStorage.ts
new file mode 100644
index 0000000000..62c5eacf24
--- /dev/null
+++ b/packages/stack/src/host/LogflareStorage.ts
@@ -0,0 +1,170 @@
+import { PgClient } from "@effect/sql-pg";
+import {
+  Cache,
+  Context,
+  Duration,
+  Effect,
+  Exit,
+  Layer,
+  Option,
+  RcRef,
+  Redacted,
+  Ref,
+  Schema,
+} from "effect";
+import { failureMessage } from "../internal/failure-message.ts";
+import { backendConnection, schema } from "../services/Analytics.ts";
+import type { ServiceEndpoint } from "../services/Recipe.ts";
+import { StoredEventsError, type StoredEvents } from "./LogForwarder.ts";
+
+/** The database Analytics' Postgres backend writes to, as the host reaches it. */
+export interface AnalyticsDatabase {
+  /** A connection URL that keeps the query parameters, such as TLS settings, of Analytics' URL. */
+  readonly url: string;
+}
+
+/** Query parameters node-postgres reads to pick the host or TLS, which a bound endpoint replaces. */
+const addressParameters = /^(?:host|port|ssl.*)$/u;
+
+/**
+ * Locates Logflare's backend database from Analytics' database URL. A bound database is reached at
+ * its endpoint, because the bound URL addresses it from Analytics' runtime; the endpoint is a local
+ * port or socket, so TLS settings meant for the runtime's address are dropped.
+ */
+export const analyticsDatabase = Effect.fnUntraced(function* (
+  databaseUrl: string,
+  bound: ServiceEndpoint | undefined,
+) {
+  const backend = yield* backendConnection(databaseUrl);
+  const url = new URL(backend.url);
+  if (bound === undefined) {
+    // node-postgres otherwise reads `sslmode=require` as `verify-full` rather than as libpq does.
+    if ([...url.searchParams.keys()].some((name) => name.startsWith("ssl")))
+      url.searchParams.set("uselibpqcompat", "true");
+    return { url: url.toString() } satisfies AnalyticsDatabase;
+  }
+  const replaced = Array.from(url.searchParams.keys()).filter((name) =>
+    addressParameters.test(name),
+  );
+  for (const name of replaced) url.searchParams.delete(name);
+  // A socket directory is passed as the `host` parameter, which takes precedence over the hostname.
+  if (bound.kind === "unix" && bound.path !== undefined) url.searchParams.set("host", bound.path);
+  else url.hostname = bound.host ?? "127.0.0.1";
+  url.port = String(bound.port);
+  return { url: url.toString() } satisfies AnalyticsDatabase;
+});
+
+/** A source token with `-` replaced by `_`, as Logflare names its event tables. */
+const tablePattern = /^log_events_[0-9a-f]{8}(?:_[0-9a-f]{4}){3}_[0-9a-f]{12}$/u;
+
+/**
+ * Reads stored event ids from the `log_events_<token>` table Logflare's Postgres backend keeps per
+ * source. This couples to Logflare's private table layout, which the owner's Analytics
+ * integration test pins. Failures are retried by the caller and warned about once per outage.
+ */
+export const make = Effect.fn("LogflareStorage.make")(function* <E>(
+  database: Effect.Effect<AnalyticsDatabase, E>,
+) {
+  const client = yield* RcRef.make({
+    acquire: database.pipe(
+      Effect.flatMap((connection) =>
+        Layer.build(
+          PgClient.layer({ url: Redacted.make(connection.url), connectTimeout: "2 seconds" }),
+        ),
+      ),
+      Effect.map((context) => Context.get(context, PgClient.PgClient)),
+      Effect.mapError(
+        (cause) =>
+          new StoredEventsError({
+            message: `Unable to reach the database Analytics stores events in: ${failureMessage(cause)}`,
+            cause,
+          }),
+      ),
+    ),
+    idleTimeToLive: Duration.infinity,
+  });
+  // A failed query can mean the database moved, so the next one connects again.
+  const withClient = <A, E2>(run: (sql: PgClient.PgClient) => Effect.Effect<A, E2>) =>
+    Effect.scoped(RcRef.get(client).pipe(Effect.flatMap(run))).pipe(
+      Effect.tapError(() => RcRef.invalidate(client)),
+    );
+
+  // Only a source Analytics knows answers for its events; its table appears once Analytics uses it.
+  const tables = yield* Cache.makeWith(
+    (source: string) =>
+      withClient(
+        (sql) =>
+          sql<{ readonly name: string; readonly created: boolean }>`
+          SELECT 'log_events_' || replace(token::text, '-', '_') AS name,
+            to_regclass(format('%I.%I', ${schema}::text, 'log_events_' || replace(token::text, '-', '_'))) IS NOT NULL AS created
+          FROM ${sql(schema)}.sources
+          WHERE name = ${source}
+          LIMIT 2`,
+      ).pipe(
+        Effect.flatMap((rows) => {
+          const [row] = rows;
+          if (row === undefined || rows.length > 1)
+            return Effect.fail(
+              new StoredEventsError({
+                message: `Analytics has ${row === undefined ? "no" : "several"} ${source} sources`,
+              }),
+            );
+          if (!tablePattern.test(row.name))
+            return Effect.fail(
+              new StoredEventsError({ message: `Unexpected Analytics table name ${row.name}` }),
+            );
+          return Effect.succeed(row.created ? Option.some(row.name) : Option.none<string>());
+        }),
+      ),
+    {
+      capacity: 64,
+      timeToLive: (exit) =>
+        Exit.isSuccess(exit) && Option.isSome(exit.value) ? Duration.infinity : Duration.zero,
+    },
+  );
+  const warned = yield* Ref.make(false);
+
+  return {
+    storedIds: Effect.fn("LogflareStorage.storedIds")(
+      function* (source: string, ids: ReadonlyArray<string>) {
+        yield* Effect.annotateCurrentSpan({ source, requested_count: ids.length });
+        if (ids.length === 0) return new Set<string>();
+        const table = yield* Cache.get(tables, source);
+        yield* Effect.annotateCurrentSpan({ table_found: Option.isSome(table) });
+        // A failed query looks the table up again, since a replaced source has a new one.
+        const rows = Option.isNone(table)
+          ? []
+          : yield* withClient(
+              (sql) =>
+                sql<{ readonly id: string }>`
+                  SELECT id::text AS id FROM ${sql(schema)}.${sql(table.value)} WHERE id IN ${sql.in(ids)}`,
+            ).pipe(Effect.tapError(() => Cache.invalidate(tables, source)));
+        yield* Effect.annotateCurrentSpan({ stored_count: rows.length });
+        return new Set(rows.map(({ id }) => id));
+      },
+      (effect, source) =>
+        effect.pipe(
+          Effect.mapError((cause) =>
+            Schema.is(StoredEventsError)(cause)
+              ? cause
+              : new StoredEventsError({
+                  message: `Unable to read stored ${source} events: ${failureMessage(cause)}`,
+                  cause,
+                }),
+          ),
+          Effect.tapError((error) =>
+            Ref.getAndSet(warned, true).pipe(
+              Effect.flatMap((already) =>
+                already
+                  ? Effect.void
+                  : Effect.logWarning(
+                      `Log shipping waits until Analytics' stored events can be read: ${error.message}`,
+                    ),
+              ),
+            ),
+          ),
+          Effect.tap(() => Ref.set(warned, false)),
+        ),
+    ),
+  } satisfies StoredEvents;
+});
diff --git a/packages/stack/src/host/LogflareStorage.unit.test.ts b/packages/stack/src/host/LogflareStorage.unit.test.ts
new file mode 100644
index 0000000000..214cc7973e
--- /dev/null
+++ b/packages/stack/src/host/LogflareStorage.unit.test.ts
@@ -0,0 +1,42 @@
+import { expect, it } from "@effect/vitest";
+import { Effect } from "effect";
+import { analyticsDatabase } from "./LogflareStorage.ts";
+
+it.effect("reaches a bound Analytics database at its endpoint with the URL's credentials", () =>
+  Effect.gen(function* () {
+    const { url } = yield* analyticsDatabase(
+      "postgresql://supabase_admin:secret@db-runtime:5432/_supabase",
+      { kind: "unix", path: "/tmp/stack-socket", port: 5432 },
+    );
+
+    expect(url).toBe(
+      "postgresql://supabase_admin:secret@db-runtime:5432/_supabase?host=%2Ftmp%2Fstack-socket",
+    );
+  }),
+);
+
+it.effect("drops host and TLS parameters meant for the runtime's address of a bound database", () =>
+  Effect.gen(function* () {
+    const { url } = yield* analyticsDatabase(
+      "postgresql://supabase_admin:secret@db-runtime:5432/postgres?host=/run/sock&sslmode=verify-full&sslrootcert=/ca.pem&application_name=analytics",
+      { kind: "tcp", host: "127.0.0.1", port: 54322 },
+    );
+
+    expect(url).toBe(
+      "postgresql://supabase_admin:secret@127.0.0.1:54322/_supabase?application_name=analytics",
+    );
+  }),
+);
+
+it.effect("keeps the TLS settings of Analytics' own database URL with libpq's meaning", () =>
+  Effect.gen(function* () {
+    const { url } = yield* analyticsDatabase(
+      "postgresql://admin:secret@db.example.com:6543/postgres?sslmode=require&sslrootcert=/ca.pem",
+      undefined,
+    );
+
+    expect(url).toBe(
+      "postgresql://admin:secret@db.example.com:6543/_supabase?sslmode=require&sslrootcert=%2Fca.pem&uselibpqcompat=true",
+    );
+  }),
+);
diff --git a/packages/stack/src/index.ts b/packages/stack/src/index.ts
index c1df2cbe77..d504bb5fa0 100644
--- a/packages/stack/src/index.ts
+++ b/packages/stack/src/index.ts
@@ -24,10 +24,14 @@ export type {
   DestroyResult,
   FindOptions,
   FoundStack,
+  LogPosition,
+  LogRecord,
   OpenOptions,
   PgProveOptions,
   PlannedInstance,
+  ReadLogsOptions,
   SavedStack,
+  StackLogRecord,
   StackLocations,
   SupabaseCompositionOptions,
 } from "./effect.ts";
diff --git a/packages/stack/src/internal/artifacts.ts b/packages/stack/src/internal/artifacts.ts
index 0ee05f1fac..5d9e1fb81b 100644
--- a/packages/stack/src/internal/artifacts.ts
+++ b/packages/stack/src/internal/artifacts.ts
@@ -7,6 +7,7 @@ export {
   postgresVersion,
   prepareNativeArtifact,
   resolveArtifact,
+  type ArtifactKind,
   type ArtifactPin,
   type NativePin,
   type ServiceKind,
diff --git a/packages/stack/src/internal/attempts.ts b/packages/stack/src/internal/attempts.ts
new file mode 100644
index 0000000000..b44369b1b2
--- /dev/null
+++ b/packages/stack/src/internal/attempts.ts
@@ -0,0 +1,25 @@
+import { Effect, Ref } from "effect";
+
+/**
+ * Runs `retried` over a counted `attempt` and records the total as `retry.attempt_count` on the
+ * current span. Attempts emit no spans unless `traced` is set, so polling stays one span.
+ */
+export const withAttemptCount = <A, E, R, A2, E2, R2>(
+  attempt: Effect.Effect<A, E, R>,
+  retried: (counted: Effect.Effect<A, E, R>) => Effect.Effect<A2, E2, R2>,
+  options?: { readonly traced?: boolean },
+): Effect.Effect<A2, E2, R2> =>
+  Effect.gen(function* () {
+    const count = yield* Ref.make(0);
+    const counted = Ref.update(count, (value) => value + 1).pipe(
+      Effect.andThen(attempt),
+      options?.traced === true ? (effect) => effect : Effect.withTracerEnabled(false),
+    );
+    return yield* retried(counted).pipe(
+      Effect.ensuring(
+        Ref.get(count).pipe(
+          Effect.flatMap((value) => Effect.annotateCurrentSpan({ "retry.attempt_count": value })),
+        ),
+      ),
+    );
+  });
diff --git a/packages/stack/src/internal/attempts.unit.test.ts b/packages/stack/src/internal/attempts.unit.test.ts
new file mode 100644
index 0000000000..fd8dc61505
--- /dev/null
+++ b/packages/stack/src/internal/attempts.unit.test.ts
@@ -0,0 +1,54 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Ref, Schedule, Tracer } from "effect";
+import { withAttemptCount } from "./attempts.ts";
+
+const recordingTracer = Effect.sync(() => {
+  const spans: Array<Tracer.NativeSpan> = [];
+  const tracer = Tracer.make({
+    span: (options) => {
+      const span = new Tracer.NativeSpan(options);
+      spans.push(span);
+      return span;
+    },
+  });
+  return { spans, tracer };
+});
+
+const failTwiceThenSucceed = Ref.make(0).pipe(
+  Effect.map((calls) =>
+    Ref.updateAndGet(calls, (value) => value + 1).pipe(
+      Effect.flatMap((call) => (call < 3 ? Effect.fail("not ready") : Effect.succeed("ready"))),
+      Effect.withSpan("probe"),
+    ),
+  ),
+);
+
+describe("withAttemptCount", () => {
+  it.effect("records the attempt total on the wait span without a span per attempt", () =>
+    Effect.gen(function* () {
+      const { spans, tracer } = yield* recordingTracer;
+      const probe = yield* failTwiceThenSucceed;
+
+      const result = yield* withAttemptCount(probe, (counted) =>
+        counted.pipe(Effect.retry(Schedule.recurs(5))),
+      ).pipe(Effect.withSpan("wait"), Effect.withTracer(tracer), Effect.withTracerEnabled(true));
+
+      expect(result).toBe("ready");
+      expect(spans.map((span) => span.name)).toEqual(["wait"]);
+      expect(spans[0]?.attributes.get("retry.attempt_count")).toBe(3);
+    }),
+  );
+
+  it.effect("keeps attempt spans when the attempts are traced", () =>
+    Effect.gen(function* () {
+      const { spans, tracer } = yield* recordingTracer;
+      const probe = yield* failTwiceThenSucceed;
+
+      yield* withAttemptCount(probe, (counted) => counted.pipe(Effect.retry(Schedule.recurs(5))), {
+        traced: true,
+      }).pipe(Effect.withSpan("wait"), Effect.withTracer(tracer), Effect.withTracerEnabled(true));
+
+      expect(spans.filter((span) => span.name === "probe")).toHaveLength(3);
+    }),
+  );
+});
diff --git a/packages/stack/src/internal/sharing-violation.ts b/packages/stack/src/internal/sharing-violation.ts
new file mode 100644
index 0000000000..a84ad849c7
--- /dev/null
+++ b/packages/stack/src/internal/sharing-violation.ts
@@ -0,0 +1,34 @@
+import { Duration, Effect, Predicate, Schedule } from "effect";
+
+/** The errno code an error carries, itself or on a cause, also when other errors wrap it. */
+export const errorCode = (error: unknown): string | undefined => {
+  let current = error;
+  for (let depth = 0; depth <= 4; depth++) {
+    if (Predicate.hasProperty(current, "code") && typeof current.code === "string")
+      return current.code;
+    if (!Predicate.hasProperty(current, "cause")) return undefined;
+    current = current.cause;
+  }
+  return undefined;
+};
+
+/** Windows reports a file that another process holds or replaces as a transient sharing violation. */
+const isSharingViolation =
+  (platform: NodeJS.Platform = process.platform) =>
+  (error: unknown): boolean =>
+    platform === "win32" && ["EPERM", "EACCES", "EBUSY"].includes(errorCode(error) ?? "");
+
+const sharingViolationSchedule = Schedule.exponential("10 millis", 2).pipe(
+  Schedule.modifyDelay(({ duration }) =>
+    Effect.succeed(Duration.min(duration, Duration.millis(100))),
+  ),
+  Schedule.upTo({ times: 12 }),
+);
+
+/** Retries a file operation with bounded backoff while it fails with a sharing violation. */
+export const retrySharingViolation =
+  (platform?: NodeJS.Platform) =>
+  <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, E, R> =>
+    effect.pipe(
+      Effect.retry({ schedule: sharingViolationSchedule, while: isSharingViolation(platform) }),
+    );
diff --git a/packages/stack/src/internal/sharing-violation.unit.test.ts b/packages/stack/src/internal/sharing-violation.unit.test.ts
new file mode 100644
index 0000000000..b2097f0b49
--- /dev/null
+++ b/packages/stack/src/internal/sharing-violation.unit.test.ts
@@ -0,0 +1,53 @@
+import { describe, expect, it } from "@effect/vitest";
+import { Effect, Fiber, PlatformError } from "effect";
+import { TestClock } from "effect/testing";
+import { LogStoreError } from "../host/LogStore.ts";
+import { retrySharingViolation } from "./sharing-violation.ts";
+
+const wrappedBusy = new LogStoreError({
+  operation: "list",
+  message: "resource busy",
+  cause: PlatformError.systemError({
+    _tag: "Busy",
+    module: "FileSystem",
+    method: "readDirectory",
+    cause: Object.assign(new Error("resource busy"), { code: "EBUSY" }),
+  }),
+});
+
+/** Fails with `wrappedBusy` on its first `failures` attempts. */
+const flaky = (failures: number) => {
+  let attempts = 0;
+  return {
+    attempts: () => attempts,
+    effect: Effect.suspend(() =>
+      attempts++ < failures ? Effect.fail(wrappedBusy) : Effect.succeed("listed"),
+    ),
+  };
+};
+
+describe("retrySharingViolation", () => {
+  it.effect("retries a sharing violation wrapped in another error on Windows", () =>
+    Effect.gen(function* () {
+      const operation = flaky(2);
+
+      const fiber = yield* operation.effect.pipe(retrySharingViolation("win32"), Effect.forkChild);
+      yield* TestClock.adjust("1 second");
+      const result = yield* Fiber.join(fiber);
+
+      expect(result).toBe("listed");
+      expect(operation.attempts()).toBe(3);
+    }),
+  );
+
+  it.effect("fails a wrapped sharing violation at once on other platforms", () =>
+    Effect.gen(function* () {
+      const operation = flaky(1);
+
+      const error = yield* operation.effect.pipe(retrySharingViolation("linux"), Effect.flip);
+
+      expect(error).toBe(wrappedBusy);
+      expect(operation.attempts()).toBe(1);
+    }),
+  );
+});
diff --git a/packages/stack/src/internal/test-run-label.ts b/packages/stack/src/internal/test-run-label.ts
new file mode 100644
index 0000000000..8cdcdefb24
--- /dev/null
+++ b/packages/stack/src/internal/test-run-label.ts
@@ -0,0 +1,28 @@
+import { Config, Effect, Option } from "effect";
+
+/** Environment variable a test run sets so stack-created Docker/Podman resources can be labelled. */
+export const testRunEnvVar = "SUPABASE_STACK_TEST_RUN";
+
+/** Label key stamped on volumes and containers a test run creates. */
+export const testRunLabelKey = "com.supabase.stack-test-run";
+
+const testRunLabelPattern = /^[A-Za-z0-9-]{1,64}$/u;
+
+/** Reads and validates the optional test-run id through Effect `Config`. */
+export const readTestRunId: Effect.Effect<Option.Option<string>, string> = Effect.gen(function* () {
+  const testRun = yield* Config.option(Config.string(testRunEnvVar)).pipe(
+    Effect.mapError((cause) => String(cause)),
+  );
+  if (Option.isNone(testRun)) return testRun;
+  if (!testRunLabelPattern.test(testRun.value))
+    return yield* Effect.fail(
+      `${testRunEnvVar} must match ${testRunLabelPattern.source}, got "${testRun.value}"`,
+    );
+  return testRun;
+});
+
+/** `--label` CLI args for the configured test-run id, empty when the env var is unset. */
+export const testRunLabelArgs: Effect.Effect<ReadonlyArray<string>, string> = Effect.map(
+  readTestRunId,
+  (testRun) => (Option.isNone(testRun) ? [] : ["--label", `${testRunLabelKey}=${testRun.value}`]),
+);
diff --git a/packages/stack/src/preparation/ArtifactStore.ts b/packages/stack/src/preparation/ArtifactStore.ts
index 1bbaf34755..1b21d3c92e 100644
--- a/packages/stack/src/preparation/ArtifactStore.ts
+++ b/packages/stack/src/preparation/ArtifactStore.ts
@@ -944,7 +944,7 @@ export const makeArtifactStore = Effect.fn("ArtifactStore.makeStore")(function*
     const target = path.resolve(cacheRoot, request.key);
     if (!pathWithin(cacheRoot, target, path.sep))
       return yield* artifactError("Artifact key escapes cache root", { key: request.key });
-    return yield* makeArtifactOperation(
+    const prepared = yield* makeArtifactOperation(
       fs,
       path,
       crypto,
@@ -954,6 +954,8 @@ export const makeArtifactStore = Effect.fn("ArtifactStore.makeStore")(function*
       request,
       onProgress,
     );
+    yield* Effect.annotateCurrentSpan({ "artifact.outcome": prepared.outcome });
+    return prepared;
   });
   return { prepare };
 });
diff --git a/packages/stack/src/preparation/SlimServicesSource.ts b/packages/stack/src/preparation/SlimServicesSource.ts
index 97ed1487e5..3f12a10e92 100644
--- a/packages/stack/src/preparation/SlimServicesSource.ts
+++ b/packages/stack/src/preparation/SlimServicesSource.ts
@@ -1,4 +1,4 @@
-import { Effect, FileSystem, Path, Schedule, Schema, Stream } from "effect";
+import { Effect, FileSystem, Path, Ref, Schedule, Schema, Stream } from "effect";
 import { NodeStream } from "@effect/platform-node";
 import { HttpClient, HttpClientError } from "effect/unstable/http";
 import { createZstdDecompress } from "node:zlib";
@@ -57,17 +57,27 @@ export interface TarBoundary {
 /** The system tar boundary is argv-based so archive paths never enter a shell string. */
 const systemTarBoundary: TarBoundary = {
   list: Effect.fn("SlimServicesSource.tarList")(function* (archivePath) {
+    const args = ["-tf", archivePath];
+    yield* Effect.annotateCurrentSpan({
+      "process.executable.name": "tar",
+      "process.arg_count": args.length,
+    });
     const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
     return yield* spawner
-      .string(ChildProcess.make("tar", ["-tf", archivePath]))
+      .string(ChildProcess.make("tar", args))
       .pipe(
         Effect.mapError((cause) => new PreparationError({ message: "tar listing failed", cause })),
       );
   }),
   links: Effect.fn("SlimServicesSource.tarLinks")(function* (archivePath) {
+    const args = ["-tvf", archivePath];
+    yield* Effect.annotateCurrentSpan({
+      "process.executable.name": "tar",
+      "process.arg_count": args.length,
+    });
     const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
     return yield* spawner
-      .string(ChildProcess.make("tar", ["-tvf", archivePath]))
+      .string(ChildProcess.make("tar", args))
       .pipe(
         Effect.mapError(
           (cause) => new PreparationError({ message: "tar link listing failed", cause }),
@@ -75,14 +85,21 @@ const systemTarBoundary: TarBoundary = {
       );
   }),
   extract: Effect.fn("SlimServicesSource.tarExtract")(function* (archivePath, destination) {
+    const args = ["-xf", archivePath, "-C", destination];
+    yield* Effect.annotateCurrentSpan({
+      "process.executable.name": "tar",
+      "process.arg_count": args.length,
+    });
     const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-    return yield* spawner
-      .exitCode(ChildProcess.make("tar", ["-xf", archivePath, "-C", destination]))
+    const code = yield* spawner
+      .exitCode(ChildProcess.make("tar", args))
       .pipe(
         Effect.mapError(
           (cause) => new PreparationError({ message: "tar extraction failed", cause }),
         ),
       );
+    yield* Effect.annotateCurrentSpan("process.exit_code", Number(code));
+    return code;
   }),
 };
 const responseFor = (url: string) =>
@@ -181,6 +198,7 @@ const downloadToFile = Effect.fn("SlimServicesSource.downloadToFile")(function*
   backoff: Schedule.Schedule<unknown>,
 ) {
   const fs = yield* FileSystem.FileSystem;
+  const bytesWritten = yield* Ref.make(0);
   // Each attempt reopens the sink in truncating mode, so a retry replaces any partial transfer.
   const transfer = Effect.gen(function* () {
     const response = yield* responseFor(url);
@@ -189,6 +207,7 @@ const downloadToFile = Effect.fn("SlimServicesSource.downloadToFile")(function*
       catch: (cause) =>
         new PreparationError({ message: "Unable to initialize archive digest", cause }),
     });
+    yield* Ref.set(bytesWritten, 0);
     yield* response.stream.pipe(
       Stream.tap((chunk) =>
         Effect.try({
@@ -196,7 +215,7 @@ const downloadToFile = Effect.fn("SlimServicesSource.downloadToFile")(function*
             hash.update(chunk);
           },
           catch: (cause) => new PreparationError({ message: "Unable to hash archive", cause }),
-        }),
+        }).pipe(Effect.andThen(Ref.update(bytesWritten, (total) => total + chunk.byteLength))),
       ),
       Stream.run(fs.sink(destination, { mode: 0o600 })),
     );
@@ -206,6 +225,8 @@ const downloadToFile = Effect.fn("SlimServicesSource.downloadToFile")(function*
     });
   });
   const actual = yield* transfer.pipe(withTransferRetry(url, backoff));
+  const bytes = yield* Ref.get(bytesWritten);
+  yield* Effect.annotateCurrentSpan({ "artifact.bytes": bytes });
   if (actual !== expectedSha256.toLowerCase())
     return yield* new PreparationError({
       message: `expected ${expectedSha256}, got ${actual}`,
diff --git a/packages/stack/src/promise-api.integration.test.ts b/packages/stack/src/promise-api.integration.test.ts
index d17f2f7792..394f99e4ea 100644
--- a/packages/stack/src/promise-api.integration.test.ts
+++ b/packages/stack/src/promise-api.integration.test.ts
@@ -1,7 +1,7 @@
 import { NodeServices, NodeSocketServer } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
 import { Effect, Exit, FileSystem, Redacted, Schema } from "effect";
-import { discover, StackError, type Observation } from "./index.ts";
+import { discover, StackError, type LogRecord, type Observation } from "./index.ts";
 import { createTestStack } from "./testing.ts";
 
 const databaseSecret = (observation: Observation) =>
@@ -25,6 +25,13 @@ it.live(
       const stopped = yield* Effect.promise(() => database.status());
       expect(Exit.isExit(stopped.exit)).toBe(true);
       expect(Redacted.isRedacted(databaseSecret(stopped))).toBe(true);
+      // oxlint-disable-next-line effecttsgo/async-function -- This test exercises the Promise client API.
+      const tailed = yield* Effect.promise(async () => {
+        const records: Array<LogRecord> = [];
+        for await (const record of database.readLogs({ tail: 1 })) records.push(record);
+        return records;
+      });
+      expect(tailed).toHaveLength(1);
 
       yield* Effect.promise(() => test.stack.composition.start());
       const members = yield* Effect.promise(() => test.stack.composition.stop());
diff --git a/packages/stack/src/promise-api.unit.test.ts b/packages/stack/src/promise-api.unit.test.ts
index 499801b95d..3f0cf7c683 100644
--- a/packages/stack/src/promise-api.unit.test.ts
+++ b/packages/stack/src/promise-api.unit.test.ts
@@ -77,6 +77,9 @@ describe("Promise API derived from the Effect API", () => {
     expectTypeOf<PromiseApi.DatabaseInstance["followStatus"]>().toEqualTypeOf<
       () => AsyncIterable<PromiseApi.Observation>
     >();
+    expectTypeOf<PromiseApi.ServiceInstance["readLogs"]>().toEqualTypeOf<
+      (options?: PromiseApi.ReadLogsOptions) => AsyncIterable<PromiseApi.LogRecord>
+    >();
   });
 
   it("types created and returned handles by service kind", () => {
diff --git a/packages/stack/src/runtime/Container.integration.test.ts b/packages/stack/src/runtime/Container.integration.test.ts
index b724055684..9028e812db 100644
--- a/packages/stack/src/runtime/Container.integration.test.ts
+++ b/packages/stack/src/runtime/Container.integration.test.ts
@@ -2,6 +2,7 @@ import { NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Cause,
+  ConfigProvider,
   Crypto,
   Data,
   Deferred,
@@ -572,6 +573,34 @@ describe("container process adapter", () => {
     ).pipe(Effect.provide(NodeServices.layer)),
   );
 
+  it.live("labels a created container with the configured test run", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const runtime = yield* makeContainerRuntime({ engine: "docker", root: "." });
+        yield* runtime.prepare(image);
+        const crypto = yield* Crypto.Crypto;
+        const testRunId = `container-test-run-${(yield* crypto.randomUUIDv4).slice(0, 8)}`;
+        const process = yield* runtime
+          .launch({
+            image,
+            stackId: "container-test-run",
+            instanceId: "labels-test-run",
+            env: {},
+            args: ["-e", stoppableIdleScript],
+          })
+          .pipe(
+            Effect.provide(
+              ConfigProvider.layer(
+                ConfigProvider.fromEnvRecord({ SUPABASE_STACK_TEST_RUN: testRunId }),
+              ),
+            ),
+          );
+        const labels = yield* inspectLabels(process.id);
+        expect(labels["com.supabase.stack-test-run"]).toBe(testRunId);
+      }),
+    ).pipe(Effect.provide(NodeServices.layer)),
+  );
+
   it.live(
     "publishes two private ports and keeps the second service alive after the first stops",
     () =>
diff --git a/packages/stack/src/runtime/Container.ts b/packages/stack/src/runtime/Container.ts
index 43459fbdf9..cc0b192d55 100644
--- a/packages/stack/src/runtime/Container.ts
+++ b/packages/stack/src/runtime/Container.ts
@@ -1,3 +1,4 @@
+import { withAttemptCount } from "../internal/attempts.ts";
 import {
   Cause,
   Crypto,
@@ -19,6 +20,7 @@ import {
   Stream,
 } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
+import { testRunLabelArgs as readTestRunLabelArgs } from "../internal/test-run-label.ts";
 import { identifyContainer } from "./ContainerName.ts";
 
 export class ContainerError extends Data.TaggedError("ContainerError")<{
@@ -93,6 +95,11 @@ const errorFor = (operation: string, cause: unknown) =>
     cause,
   });
 
+/** Labels containers this run creates, when `SUPABASE_STACK_TEST_RUN` is set. */
+const testRunLabelArgs = readTestRunLabelArgs.pipe(
+  Effect.mapError((cause) => errorFor("config", cause)),
+);
+
 const rateLimited = (error: ContainerError) =>
   /toomanyrequests|too many requests|rate limit|rate exceeded/iu.test(error.message);
 
@@ -289,6 +296,11 @@ export const makeContainerRuntime = (options: {
       args: ReadonlyArray<string>,
       commandOptions: { readonly timeout?: Duration.Input } = { timeout: "30 seconds" },
     ) {
+      yield* Effect.annotateCurrentSpan({
+        "process.executable.name": options.engine,
+        "process.arg_count": args.length,
+        "container.command": args[0] ?? "",
+      });
       return yield* Effect.scoped(
         Effect.gen(function* () {
           const child = yield* spawner.spawn(command(args));
@@ -304,6 +316,7 @@ export const makeContainerRuntime = (options: {
             [tail(child.stdout), tail(child.stderr), child.exitCode],
             { concurrency: "unbounded" },
           );
+          yield* Effect.annotateCurrentSpan("process.exit_code", Number(code));
           if (Number(code) !== 0)
             return yield* errorFor(
               args[0] ?? "command",
@@ -389,26 +402,32 @@ export const makeContainerRuntime = (options: {
     const hostGateway = options.hostGateway ?? (yield* makeHostGateway);
     /** Reads `/etc/hosts` from a throwaway container of an already present image. */
     const readProbeHosts = (image: string, spec: ContainerSpec, addHost: ReadonlyArray<string>) =>
-      run(
-        [
-          "run",
-          "--rm",
-          "--pull",
-          "never",
-          ...addHost,
-          // No instance label: `--rm` removal is asynchronous and must not count as an
-          // instance container; the stack labels keep it sweepable.
-          "--label",
-          `com.supabase.stack=${spec.stackId}`,
-          "--label",
-          `com.supabase.stack-root=${stackRoot}`,
-          "--entrypoint",
-          "cat",
-          image,
-          "/etc/hosts",
-        ],
-        { timeout: undefined },
-      ).pipe(Effect.timeout(HOST_GATEWAY_PROBE_TIMEOUT));
+      testRunLabelArgs.pipe(
+        Effect.flatMap((testRunLabel) =>
+          run(
+            [
+              "run",
+              "--rm",
+              "--pull",
+              "never",
+              ...addHost,
+              // No instance label: `--rm` removal is asynchronous and must not count as an
+              // instance container; the stack labels keep it sweepable.
+              "--label",
+              `com.supabase.stack=${spec.stackId}`,
+              "--label",
+              `com.supabase.stack-root=${stackRoot}`,
+              ...testRunLabel,
+              "--entrypoint",
+              "cat",
+              image,
+              "/etc/hosts",
+            ],
+            { timeout: undefined },
+          ),
+        ),
+        Effect.timeout(HOST_GATEWAY_PROBE_TIMEOUT),
+      );
     /** Resolves the IPv4 host address the engine writes itself, since it rejects `host-gateway`. */
     const engineHostProbe = (image: string, spec: ContainerSpec, rejection: ContainerError) =>
       readProbeHosts(image, spec, []).pipe(
@@ -458,6 +477,11 @@ export const makeContainerRuntime = (options: {
     ) {
       const owner = yield* Scope.Scope;
       const image = (yield* Ref.get(mirrored)).get(spec.image) ?? spec.image;
+      yield* Effect.annotateCurrentSpan({
+        "image.name": image,
+        ...(spec.service === undefined ? {} : { "container.service": spec.service }),
+        "container.ports": spec.ports ?? [],
+      });
       for (const [key, value] of Object.entries(spec.env)) {
         if (!/^[A-Za-z_][A-Za-z0-9_]*$/u.test(key) || /[\0\r\n]/u.test(value)) {
           return yield* errorFor(
@@ -489,6 +513,7 @@ export const makeContainerRuntime = (options: {
       const { name, composeProject, composeService } = identifyContainer(spec, token, oneOff);
       const hostAlias =
         options.engine === "docker" ? yield* hostAliasTarget(image, spec) : undefined;
+      const testRunLabel = yield* testRunLabelArgs;
       const createArgs = (target: string | undefined) => [
         "create",
         "--pull",
@@ -512,6 +537,7 @@ export const makeContainerRuntime = (options: {
         "--label",
         `com.supabase.stack-root=${stackRoot}`,
         ...(spec.service === undefined ? [] : ["--label", `com.supabase.service=${spec.service}`]),
+        ...testRunLabel,
         "--label",
         `com.docker.compose.project=${composeProject}`,
         "--label",
@@ -590,30 +616,36 @@ export const makeContainerRuntime = (options: {
           const reconcileAbsent = Effect.fn("Container.reconcileAbsent")(function* (
             failure: ContainerError,
           ) {
-            const probe = run(
-              [
-                "ps",
-                "--all",
-                "--no-trunc",
-                "--filter",
-                // Docker matches this as a regex; `.` is the only metacharacter a name can hold.
-                `name=^/?${name.replaceAll(".", "\\.")}$`,
-                "--format",
-                "{{.State}}",
-              ],
-              { timeout: "5 seconds" },
-            ).pipe(
-              Effect.map((output) =>
-                output === ""
-                  ? ("absent" as const)
-                  : output === "removing"
-                    ? "removing"
-                    : "present",
+            const probe = withAttemptCount(
+              run(
+                [
+                  "ps",
+                  "--all",
+                  "--no-trunc",
+                  "--filter",
+                  // Docker matches this as a regex; `.` is the only metacharacter a name can hold.
+                  `name=^/?${name.replaceAll(".", "\\.")}$`,
+                  "--format",
+                  "{{.State}}",
+                ],
+                { timeout: "5 seconds" },
+              ).pipe(
+                Effect.map((output) =>
+                  output === ""
+                    ? ("absent" as const)
+                    : output === "removing"
+                      ? "removing"
+                      : "present",
+                ),
               ),
-              Effect.repeat({
-                schedule: Schedule.spaced("250 millis"),
-                while: (state) => state === "removing",
-              }),
+              (counted) =>
+                counted.pipe(
+                  Effect.repeat({
+                    schedule: Schedule.spaced("250 millis"),
+                    while: (state) => state === "removing",
+                  }),
+                ),
+            ).pipe(
               Effect.timeout("10 seconds"),
               Effect.mapError((error) =>
                 error instanceof ContainerError ? error : errorFor("cleanup", error),
diff --git a/packages/stack/src/runtime/NativeProcess.ts b/packages/stack/src/runtime/NativeProcess.ts
index 1678764632..1826d5ca67 100644
--- a/packages/stack/src/runtime/NativeProcess.ts
+++ b/packages/stack/src/runtime/NativeProcess.ts
@@ -105,6 +105,9 @@ const mapProcessError = (error: unknown, spec: NativeProcessSpec): NativeProcess
     cause: error,
   });
 
+/** Guard against a stuck launcher reap/confirm, backed by measured real reap latency; missing it only falls through to a (still correct) forced launcher kill. */
+const launcherReapGuardTimeout: Duration.Input = "1 second";
+
 /**
  * Starts one native process through a tiny parent-loss-aware launcher. The
  * launcher receives an inherited pipe (fd3); closing this process scope closes
@@ -116,6 +119,10 @@ export const spawnNativeProcess = Effect.fn("NativeProcess.spawn")(function* (
   launcher: NativeProcessLauncher = defaultNativeProcessLauncher(),
   identity?: NativeProcessIdentity,
 ) {
+  yield* Effect.annotateCurrentSpan({
+    "process.executable.name": spec.executable.split(/[\\/]/u).pop() ?? spec.executable,
+    "process.arg_count": spec.args?.length ?? 0,
+  });
   return yield* Effect.gen(function* () {
     // Shutdown must precede the spawner's finalizer even when the caller closes in parallel.
     const processScope = yield* Scope.fork(yield* Scope.Scope, "sequential");
@@ -182,6 +189,10 @@ export const spawnNativeProcess = Effect.fn("NativeProcess.spawn")(function* (
       );
     });
     const cleanupProcessGroup = Effect.fn("NativeProcess.cleanupProcessGroup")(function* () {
+      yield* Effect.annotateCurrentSpan({
+        pid: Number(handle.pid),
+        platform: globalThis.process.platform,
+      });
       return yield* Effect.try({
         try: () => {
           if (globalThis.process.platform === "win32") return;
@@ -218,6 +229,8 @@ export const spawnNativeProcess = Effect.fn("NativeProcess.spawn")(function* (
           }
           return Effect.fail(error);
         }),
+        Effect.tap(() => Effect.annotateCurrentSpan({ outcome: "succeeded" })),
+        Effect.tapError(() => Effect.annotateCurrentSpan({ outcome: "failed" })),
       );
     });
     const signalLauncher = (signal: NodeJS.Signals): Effect.Effect<void, NativeProcessError> =>
@@ -237,7 +250,21 @@ export const spawnNativeProcess = Effect.fn("NativeProcess.spawn")(function* (
             : Effect.fail(error);
         }),
       );
+    // A killed launcher reports its exit as a failure (signal-interrupted),
+    // not a success; settling at all, even with that failure, means it is
+    // gone. Only a genuine timeout (never settling) means it is not.
+    const launcherSettled = (timeout: Duration.Input): Effect.Effect<boolean> =>
+      handle.exitCode.pipe(
+        Effect.timeoutOption(timeout),
+        Effect.map(Option.isSome),
+        Effect.orElseSucceed(() => true),
+      );
+    const spanAttributes = () => ({
+      pid: Number(handle.pid),
+      platform: globalThis.process.platform,
+    });
     const killProcess = Effect.fn("NativeProcess.kill")(function* () {
+      yield* Effect.annotateCurrentSpan(spanAttributes());
       const running = yield* handle.isRunning.pipe(
         Effect.mapError((error) => mapProcessError(error, spec)),
       );
@@ -254,15 +281,57 @@ export const spawnNativeProcess = Effect.fn("NativeProcess.spawn")(function* (
             );
       const stopped = yield* graceful.pipe(
         Effect.timeoutOption(spec.gracefulStopTimeout ?? "2 seconds"),
+        Effect.tap((result) =>
+          Effect.annotateCurrentSpan({ outcome: Option.isSome(result) ? "exited" : "timedOut" }),
+        ),
+        Effect.tapError(() => Effect.annotateCurrentSpan({ outcome: "failed" })),
+        Effect.withSpan("NativeProcess.kill.graceful", { attributes: spanAttributes() }),
       );
+      yield* Effect.annotateCurrentSpan({ forcedPathTaken: Option.isNone(stopped) });
       if (Option.isNone(stopped)) {
-        const stillRunning = yield* handle.isRunning.pipe(
-          Effect.mapError((error) => mapProcessError(error, spec)),
-        );
-        if (stillRunning)
-          yield* handle
-            .kill({ killSignal: "SIGKILL" })
-            .pipe(Effect.mapError((error) => mapProcessError(error, spec)));
+        if (globalThis.process.platform === "win32") {
+          const stillRunning = yield* handle.isRunning.pipe(
+            Effect.mapError((error) => mapProcessError(error, spec)),
+          );
+          if (stillRunning)
+            yield* handle
+              .kill({ killSignal: "SIGKILL" })
+              .pipe(Effect.mapError((error) => mapProcessError(error, spec)));
+        } else {
+          // Kill the workload's group first so the still-alive launcher reaps
+          // its direct child itself; only force the launcher if it doesn't. A
+          // failed group cleanup must not skip forcing and confirming it.
+          const cleanupFailure = yield* cleanupProcessGroup().pipe(
+            Effect.as(Option.none<NativeProcessError>()),
+            Effect.catch((error) => Effect.succeed(Option.some(error))),
+          );
+          const reaped = yield* launcherSettled(launcherReapGuardTimeout).pipe(
+            Effect.tap((settled) =>
+              Effect.annotateCurrentSpan({ outcome: settled ? "exited" : "timedOut" }),
+            ),
+            Effect.withSpan("NativeProcess.kill.reapWait", { attributes: spanAttributes() }),
+          );
+          if (!reaped) {
+            yield* Effect.gen(function* () {
+              yield* handle.kill({ killSignal: "SIGKILL" }).pipe(
+                Effect.mapError((error) => mapProcessError(error, spec)),
+                Effect.tapError(() => Effect.annotateCurrentSpan({ outcome: "failed" })),
+              );
+              const confirmed = yield* launcherSettled(launcherReapGuardTimeout);
+              yield* Effect.annotateCurrentSpan({ outcome: confirmed ? "exited" : "timedOut" });
+              if (!confirmed)
+                return yield* new NativeProcessError({
+                  message: "Native launcher did not confirm exit after a forced stop",
+                  executable: spec.executable,
+                });
+            }).pipe(
+              Effect.withSpan("NativeProcess.kill.forcedLauncherKill", {
+                attributes: spanAttributes(),
+              }),
+            );
+          }
+          if (Option.isSome(cleanupFailure)) return yield* cleanupFailure.value;
+        }
       }
       if (globalThis.process.platform !== "win32") yield* cleanupProcessGroup();
     });
diff --git a/packages/stack/src/runtime/Session.ts b/packages/stack/src/runtime/Session.ts
index bc27d3bd44..3647e3aabe 100644
--- a/packages/stack/src/runtime/Session.ts
+++ b/packages/stack/src/runtime/Session.ts
@@ -1,4 +1,4 @@
-import { Cause, Effect, Exit, Fiber, PubSub, Ref, Scope, Stream } from "effect";
+import { Cause, Clock, Effect, Exit, Fiber, PubSub, Ref, Scope, Semaphore, Stream } from "effect";
 import { failureMessage } from "../internal/failure-message.ts";
 import { ServiceError, type RuntimeSession } from "../Service.ts";
 import type { ContainerProcess } from "./Container.ts";
@@ -62,16 +62,58 @@ export const processExit = <E extends { readonly message: string }>(
   );
 
 /**
- * Forks stdout/stderr drains that publish to `logs`; returns the stderr fiber so callers can await
- * drain completion (e.g. before finalizing exit). Optionally captures a rolling stderr tail for
- * folding into exit failure messages.
+ * One output chunk of a launch, stamped with its publish time in epoch milliseconds. Each process
+ * of the launch is a `part`; `seq` counts the launch's chunks from zero across its streams and
+ * parts in publish order, so chunks dropped anywhere in the launch leave a gap.
+ */
+export interface LaunchOutput {
+  readonly stream: "stdout" | "stderr";
+  readonly bytes: Uint8Array;
+  readonly launchId: number;
+  readonly part: number;
+  readonly seq: number;
+  readonly time: number;
+}
+
+/** Publishes one chunk of a process's output. */
+export type PublishOutput = (stream: "stdout" | "stderr", bytes: Uint8Array) => Effect.Effect<void>;
+
+/** Tags a launch's output; each `part` call returns the publisher of the launch's next process. */
+export const launchOutputPublisher = (
+  logs: PubSub.PubSub<LaunchOutput>,
+  launchId: number,
+): Effect.Effect<{ readonly part: Effect.Effect<PublishOutput> }> =>
+  Effect.gen(function* () {
+    const parts = yield* Ref.make(0);
+    const sequence = yield* Ref.make(0);
+    // A sequence number is taken and published in one step, so subscribers see them in order.
+    const ordered = yield* Semaphore.make(1);
+    return {
+      part: Ref.getAndUpdate(parts, (next) => next + 1).pipe(
+        Effect.map(
+          (part): PublishOutput =>
+            (stream, bytes) =>
+              Effect.gen(function* () {
+                const seq = yield* Ref.getAndUpdate(sequence, (next) => next + 1);
+                const time = yield* Clock.currentTimeMillis;
+                yield* PubSub.publish(logs, { stream, bytes, launchId, part, seq, time });
+              }).pipe(ordered.withPermits(1)),
+        ),
+      ),
+    };
+  });
+
+/**
+ * Forks stdout/stderr drains that publish through `publish`; returns the stderr fiber so callers
+ * can await drain completion (e.g. before finalizing exit). Optionally captures a rolling stderr
+ * tail for folding into exit failure messages.
  */
 export const publishProcessLogs = (
   process: {
     readonly stdout: Stream.Stream<Uint8Array, unknown>;
     readonly stderr: Stream.Stream<Uint8Array, unknown>;
   },
-  logs: PubSub.PubSub<{ readonly stream: "stdout" | "stderr"; readonly bytes: Uint8Array }>,
+  publish: PublishOutput,
   scope: Scope.Closeable,
   stderrTail?: Ref.Ref<string>,
 ): Effect.Effect<Fiber.Fiber<void>> => {
@@ -85,7 +127,7 @@ export const publishProcessLogs = (
       Stream.runForEach((bytes) =>
         Effect.gen(function* () {
           if (decoder !== undefined) yield* appendTail(decoder.decode(bytes, { stream: true }));
-          yield* PubSub.publish(logs, { stream: name, bytes });
+          yield* publish(name, bytes);
         }),
       ),
       Effect.andThen(
diff --git a/packages/stack/src/runtime/Session.unit.test.ts b/packages/stack/src/runtime/Session.unit.test.ts
index fcf290afef..6abf8f2192 100644
--- a/packages/stack/src/runtime/Session.unit.test.ts
+++ b/packages/stack/src/runtime/Session.unit.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from "@effect/vitest";
-import { Cause } from "effect";
-import { mapToServiceError } from "./Session.ts";
+import { Cause, Effect, PubSub } from "effect";
+import { launchOutputPublisher, mapToServiceError, type LaunchOutput } from "./Session.ts";
 
 describe("mapToServiceError", () => {
   it("names an error whose cause carries no message", () => {
@@ -16,3 +16,33 @@ describe("mapToServiceError", () => {
     expect(failure.message).toBe("container is gone");
   });
 });
+
+describe("launchOutputPublisher", () => {
+  it.effect(
+    "tags chunks with the launch, a part per process and one sequence across streams and parts",
+    () =>
+      Effect.gen(function* () {
+        const logs = yield* PubSub.unbounded<LaunchOutput>();
+        const subscription = yield* PubSub.subscribe(logs);
+        const output = yield* launchOutputPublisher(logs, 7);
+        const startup = yield* output.part;
+        const main = yield* output.part;
+        const bytes = new Uint8Array([0x61]);
+
+        yield* startup("stdout", bytes);
+        yield* startup("stderr", bytes);
+        yield* startup("stdout", bytes);
+        yield* main("stdout", bytes);
+        const published = yield* PubSub.takeAll(subscription);
+
+        expect(
+          published.map(({ stream, launchId, part, seq }) => ({ stream, launchId, part, seq })),
+        ).toEqual([
+          { stream: "stdout", launchId: 7, part: 0, seq: 0 },
+          { stream: "stderr", launchId: 7, part: 0, seq: 1 },
+          { stream: "stdout", launchId: 7, part: 0, seq: 2 },
+          { stream: "stdout", launchId: 7, part: 1, seq: 3 },
+        ]);
+      }).pipe(Effect.scoped),
+  );
+});
diff --git a/packages/stack/src/runtime/native-process.integration.test.ts b/packages/stack/src/runtime/native-process.integration.test.ts
index a9f50a87a9..0fef4834c0 100644
--- a/packages/stack/src/runtime/native-process.integration.test.ts
+++ b/packages/stack/src/runtime/native-process.integration.test.ts
@@ -1,8 +1,8 @@
 import { describe, expect, it } from "@effect/vitest";
-import { Cause, Deferred, Effect, Exit, Fiber, Option, Ref, Sink, Stream } from "effect";
+import { Cause, Deferred, Effect, Exit, Fiber, Option, Ref, Scope, Sink, Stream } from "effect";
 import * as TestClock from "effect/testing/TestClock";
 import { NodeServices } from "@effect/platform-node";
-import { systemError } from "effect/PlatformError";
+import { systemError, type PlatformError } from "effect/PlatformError";
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
 import type { ChildProcessSpawner as ChildProcessSpawnerType } from "effect/unstable/process/ChildProcessSpawner";
 import type { ExitCode } from "effect/unstable/process/ChildProcessSpawner";
@@ -31,7 +31,11 @@ interface FakeProcessOptions {
   readonly groupStallReady?: Deferred.Deferred<void>;
   readonly groupStallClosed?: Deferred.Deferred<void>;
   readonly exitStarted?: Deferred.Deferred<void>;
-  readonly exitCode?: Deferred.Deferred<ExitCode>;
+  readonly exitCode?: Deferred.Deferred<ExitCode, PlatformError>;
+  /** Reports the launcher as still running instead of the default already-exited fake. */
+  readonly isRunning?: boolean;
+  /** Observes the signal a forced `kill` sends to the launcher. */
+  readonly onForcedKill?: (signal: string | undefined) => void;
 }
 
 const makeSpawner = (options: FakeProcessOptions) => {
@@ -107,8 +111,8 @@ const makeSpawner = (options: FakeProcessOptions) => {
                 return yield* Deferred.await(exit);
               });
         })(),
-        isRunning: Effect.succeed(false),
-        kill: () => Effect.void,
+        isRunning: Effect.succeed(options.isRunning ?? false),
+        kill: (killOptions) => Effect.sync(() => options.onForcedKill?.(killOptions?.killSignal)),
         stdin: Sink.drain,
         stdout: Stream.empty,
         stderr: Stream.empty,
@@ -131,23 +135,30 @@ const makeSpawner = (options: FakeProcessOptions) => {
 
 const spec: NativeProcessSpec = { executable: "test-native-process" };
 
+// Intercepts every signal sent to the positive launcher pid and its negative
+// group so tests using a placeholder pid never reach a real OS process, for
+// the effect and its own scope cleanup (e.g. a finalizer-driven retry).
 const withMockedTargetKill = <A, E, R>(
   effect: Effect.Effect<A, E, R>,
   target: number,
-  code: "EPERM" | "ESRCH" = "EPERM",
+  code: "EPERM" | "ESRCH" | "SUCCEED" = "EPERM",
   failAlways = true,
+  onSignal?: (pid: number, signal: NodeJS.Signals) => void,
 ) =>
   Effect.acquireUseRelease(
     Effect.sync(() => {
       const originalKill = globalThis.process.kill;
       let failed = false;
       globalThis.process.kill = (pid, signal) => {
+        onSignal?.(Number(pid), signal as NodeJS.Signals);
         if (pid === -target) {
+          if (code === "SUCCEED") return true;
           if (!failAlways && failed)
             throw Object.assign(new Error("operation ESRCH"), { code: "ESRCH" });
           failed = true;
           throw Object.assign(new Error(`operation ${code}`), { code });
         }
+        if (pid === target) return true;
         return originalKill(pid, signal);
       };
       return originalKill;
@@ -945,11 +956,157 @@ describe("native process group cleanup", () => {
       ),
   );
 
+  it.effect.skipIf(process.platform === "win32")(
+    "does not settle kill until the launcher's exit is confirmed",
+    () => {
+      const signals: Array<{ readonly pid: number; readonly signal: NodeJS.Signals }> = [];
+      return withMockedTargetKill(
+        Effect.gen(function* () {
+          const exitCode = yield* Deferred.make<ExitCode, PlatformError>();
+          const spawner = makeSpawner({ isRunning: true, exitCode });
+          // A manually owned scope isolates the explicit kill call below from
+          // the scope-finalizer's own kill, which would otherwise race the
+          // assertion.
+          const processScope = yield* Scope.make();
+          const native: NativeProcess = yield* spawnNativeProcess(
+            { ...spec, gracefulStopTimeout: "20 millis" },
+            { command: "test-launcher", args: [] },
+          ).pipe(
+            Scope.provide(processScope),
+            Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner),
+          );
+          const fiber = yield* Effect.forkChild(native.kill);
+          yield* TestClock.adjust("20 millis");
+          yield* Effect.yieldNow;
+          // The graceful signal timed out: the reaping phase (group cleanup)
+          // must have run before the confirmation wait can be pending.
+          expect(signals.some(({ pid }) => pid === -targetPid)).toBe(true);
+          expect(fiber.pollUnsafe()).toBeUndefined();
+          yield* Deferred.succeed(exitCode, ChildProcessSpawner.ExitCode(137));
+          expect(yield* Fiber.join(fiber).pipe(Effect.exit)).toMatchObject({ _tag: "Success" });
+          yield* Scope.close(processScope, Exit.void);
+        }),
+        targetPid,
+        "SUCCEED",
+        true,
+        (pid, signal) => {
+          signals.push({ pid, signal });
+        },
+      );
+    },
+  );
+
+  it.effect.skipIf(process.platform === "win32")(
+    "forces the launcher and waits for its exit to be confirmed",
+    () => {
+      const forcedSignals: Array<string | undefined> = [];
+      return withMockedTargetKill(
+        Effect.gen(function* () {
+          const exitCode = yield* Deferred.make<ExitCode, PlatformError>();
+          const spawner = makeSpawner({
+            isRunning: true,
+            exitCode,
+            onForcedKill: (signal) => forcedSignals.push(signal),
+          });
+          const processScope = yield* Scope.make();
+          const native: NativeProcess = yield* spawnNativeProcess(
+            { ...spec, gracefulStopTimeout: "20 millis" },
+            { command: "test-launcher", args: [] },
+          ).pipe(
+            Scope.provide(processScope),
+            Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner),
+          );
+          const fiber = yield* Effect.forkChild(native.kill);
+          yield* TestClock.adjust("20 millis"); // graceful signal timeout
+          yield* Effect.yieldNow;
+          // launcherReapGuardTimeout in NativeProcess.ts; kept in sync here.
+          yield* TestClock.adjust("1 second"); // launcher reap-grace timeout
+          yield* Effect.yieldNow;
+          expect(forcedSignals).toEqual(["SIGKILL"]);
+          // The launcher was force-killed but its exit is not resolved yet:
+          // kill must still wait for confirmation, not complete right away.
+          expect(fiber.pollUnsafe()).toBeUndefined();
+          // A killed process reports its exit as a signal-interrupted
+          // failure, not a success; that must still count as confirmed.
+          yield* Deferred.fail(
+            exitCode,
+            systemError({
+              _tag: "Unknown",
+              module: "ChildProcess",
+              method: "exitCode",
+              description: "Process interrupted due to receipt of signal: 'SIGKILL'",
+            }),
+          );
+          expect(yield* Fiber.join(fiber).pipe(Effect.exit)).toMatchObject({ _tag: "Success" });
+          yield* Scope.close(processScope, Exit.void);
+        }),
+        targetPid,
+        "SUCCEED",
+      );
+    },
+  );
+
+  it.effect.skipIf(process.platform === "win32")(
+    "forces and confirms the launcher even when group cleanup fails, then reports the cleanup error",
+    () => {
+      const forcedSignals: Array<string | undefined> = [];
+      return withMockedTargetKill(
+        Effect.gen(function* () {
+          const exitCode = yield* Deferred.make<ExitCode, PlatformError>();
+          const spawner = makeSpawner({
+            isRunning: true,
+            exitCode,
+            groupOutput: `${targetPid} S\n`,
+            onForcedKill: (signal) => forcedSignals.push(signal),
+          });
+          const processScope = yield* Scope.make();
+          const native: NativeProcess = yield* spawnNativeProcess(
+            { ...spec, gracefulStopTimeout: "20 millis" },
+            { command: "test-launcher", args: [] },
+          ).pipe(
+            Scope.provide(processScope),
+            Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner),
+          );
+          const fiber = yield* Effect.forkChild(native.kill.pipe(Effect.exit));
+          yield* TestClock.adjust("20 millis");
+          yield* Effect.yieldNow;
+          // launcherReapGuardTimeout in NativeProcess.ts; kept in sync here.
+          yield* TestClock.adjust("1 second");
+          yield* Effect.yieldNow;
+          expect(forcedSignals).toEqual(["SIGKILL"]);
+          // A killed process reports its exit as a signal-interrupted
+          // failure, not a success; that must still count as confirmed.
+          yield* Deferred.fail(
+            exitCode,
+            systemError({
+              _tag: "Unknown",
+              module: "ChildProcess",
+              method: "exitCode",
+              description: "Process interrupted due to receipt of signal: 'SIGKILL'",
+            }),
+          );
+          const result = yield* Fiber.join(fiber);
+          expect(Exit.isFailure(result)).toBe(true);
+          if (Exit.isFailure(result)) {
+            const error = Option.getOrUndefined(Cause.findErrorOption(result.cause));
+            expect(error).toMatchObject({ cause: { code: "EPERM" } });
+          }
+          // The finalizer retries the same still-failing group cleanup; only
+          // the explicit kill result above is under test.
+          yield* Scope.close(processScope, Exit.void).pipe(Effect.exit);
+        }),
+        targetPid,
+        "EPERM",
+        true,
+      );
+    },
+  );
+
   it.live("keeps the shared exit observation alive after a canceled waiter", () =>
     withMockedTargetKill(
       Effect.gen(function* () {
         const exitStarted = yield* Deferred.make<void>();
-        const exitCode = yield* Deferred.make<ExitCode>();
+        const exitCode = yield* Deferred.make<ExitCode, PlatformError>();
         yield* Effect.scoped(
           Effect.gen(function* () {
             const native = yield* spawnNativeProcess(spec, {
diff --git a/packages/stack/src/runtime/postgres-user.ts b/packages/stack/src/runtime/postgres-user.ts
index 975a8e1c87..b53302bee1 100644
--- a/packages/stack/src/runtime/postgres-user.ts
+++ b/packages/stack/src/runtime/postgres-user.ts
@@ -214,13 +214,19 @@ export const handOverNativePostgresFiles = Effect.fn("NativePostgresUser.handOve
     targets.push(getkey);
   }
   // -P never follows symlinks inside the tree, and directories change owner after their contents.
+  const chownArgs = ["-R", "-P", `${user.uid}:${user.gid}`, ...targets];
+  yield* Effect.annotateCurrentSpan({
+    "process.executable.name": "chown",
+    "process.arg_count": chownArgs.length,
+  });
   const status = yield* spawner.exitCode(
-    ChildProcess.make("chown", ["-R", "-P", `${user.uid}:${user.gid}`, ...targets], {
+    ChildProcess.make("chown", chownArgs, {
       stdin: "ignore",
       stdout: "ignore",
       stderr: "ignore",
     }),
   );
+  yield* Effect.annotateCurrentSpan("process.exit_code", Number(status));
   if (Number(status) !== 0)
     return yield* new ServiceError({
       operation: "launch",
diff --git a/packages/stack/src/services/Analytics.ts b/packages/stack/src/services/Analytics.ts
index a8d25fd4b2..ccb807e3ec 100644
--- a/packages/stack/src/services/Analytics.ts
+++ b/packages/stack/src/services/Analytics.ts
@@ -1,9 +1,11 @@
 import { Effect, Schema } from "effect";
+import { ServiceError } from "../Service.ts";
 import { EndpointIntent, serviceCreation } from "./Recipe.ts";
 import { databaseConnection, requiredInput } from "./ServiceConfig.ts";
 import { type ProcessRecipeSpec } from "./ProcessRecipe.ts";
 
 export const Config = Schema.Struct({
+  /** The Postgres server Logflare uses; its path is ignored, as Logflare always uses `_supabase`. */
   databaseUrl: Schema.optionalKey(Schema.String),
   backend: Schema.optionalKey(Schema.Literal("postgres")),
   apiKey: Schema.optionalKey(Schema.String),
@@ -15,8 +17,46 @@ export const Endpoints = Schema.Struct({ http: Schema.optionalKey(EndpointIntent
 export interface Endpoints extends Schema.Schema.Type<typeof Endpoints> {}
 export const Creation = serviceCreation("analytics", Config, Endpoints);
 
+/** The schema holding Analytics' sources and the event tables of its Postgres backend. */
+export const schema = "_analytics";
+
 export interface Creation extends Schema.Schema.Type<typeof Creation> {}
 
+/** The database Logflare keeps its sources and its Postgres backend's event tables in. */
+interface BackendConnection {
+  readonly host: string;
+  readonly port: string;
+  readonly database: string;
+  readonly username: string;
+  readonly password: string;
+  /** The connection as a URL, with the query parameters of Analytics' database URL. */
+  readonly url: string;
+}
+
+/** Derives Logflare's backend database from Analytics' database URL and its credential defaults. */
+export const backendConnection = Effect.fnUntraced(function* (databaseUrl: string) {
+  const db = yield* databaseConnection(databaseUrl);
+  const connection = {
+    host: db.host,
+    port: db.port,
+    database: "_supabase",
+    username: db.username ?? "supabase_admin",
+    password: db.password ?? "postgres",
+  };
+  const url = yield* Effect.try({
+    try: () => {
+      const parsed = new URL(databaseUrl);
+      parsed.username = encodeURIComponent(connection.username);
+      parsed.password = encodeURIComponent(connection.password);
+      parsed.pathname = `/${connection.database}`;
+      return parsed.toString();
+    },
+    catch: (cause) =>
+      new ServiceError({ operation: "launch", message: "Invalid Analytics database URL", cause }),
+  });
+  return { ...connection, url } satisfies BackendConnection;
+});
+
 export const makeSpec = (): ProcessRecipeSpec<Creation> => ({
   service: "analytics",
   executable: "bin/logflare",
@@ -30,26 +70,26 @@ export const makeSpec = (): ProcessRecipeSpec<Creation> => ({
         "databaseUrl",
         creation.config.databaseUrl,
       );
-      const db = yield* databaseConnection(databaseUrl);
+      const backend = yield* backendConnection(databaseUrl);
       return {
         DATABASE_URL: databaseUrl,
         ...(http === undefined
           ? {}
           : { PORT: String(http.port), PHX_HTTP_PORT: String(http.port) }),
-        DB_DATABASE: "_supabase",
-        DB_SCHEMA: "_analytics",
-        DB_HOSTNAME: db.host,
-        DB_PORT: db.port,
-        DB_USERNAME: db.username ?? "supabase_admin",
-        DB_PASSWORD: db.password ?? "postgres",
+        DB_DATABASE: backend.database,
+        DB_SCHEMA: schema,
+        DB_HOSTNAME: backend.host,
+        DB_PORT: backend.port,
+        DB_USERNAME: backend.username,
+        DB_PASSWORD: backend.password,
         LOGFLARE_SUPABASE_MODE: "true",
         LOGFLARE_SINGLE_TENANT: "true",
         ...(container ? {} : { LOGFLARE_GRPC_PORT: "0" }),
         ...(creation.config.apiKey === undefined
           ? {}
           : { LOGFLARE_PRIVATE_ACCESS_TOKEN: creation.config.apiKey }),
-        POSTGRES_BACKEND_URL: databaseUrl,
-        POSTGRES_BACKEND_SCHEMA: "_analytics",
+        POSTGRES_BACKEND_URL: backend.url,
+        POSTGRES_BACKEND_SCHEMA: schema,
       };
     }),
   args: () => Effect.succeed(["start"]),
diff --git a/packages/stack/src/services/Analytics.unit.test.ts b/packages/stack/src/services/Analytics.unit.test.ts
new file mode 100644
index 0000000000..c267474ab9
--- /dev/null
+++ b/packages/stack/src/services/Analytics.unit.test.ts
@@ -0,0 +1,44 @@
+import { expect, it } from "@effect/vitest";
+import { Effect } from "effect";
+import { makeSpec, type Creation } from "./Analytics.ts";
+
+const creation = (databaseUrl: string): Creation => ({
+  service: "analytics",
+  config: { databaseUrl, apiKey: "analytics-key" },
+});
+
+it.effect("keeps Logflare's events in the internal database it keeps its sources in", () =>
+  Effect.gen(function* () {
+    const env = yield* makeSpec().env(
+      creation("postgresql://reader:se%40cret@db.internal:6543/postgres?sslmode=disable"),
+      new Map(),
+      true,
+    );
+
+    expect(env).toMatchObject({
+      DB_HOSTNAME: "db.internal",
+      DB_PORT: "6543",
+      DB_DATABASE: "_supabase",
+      DB_USERNAME: "reader",
+      DB_PASSWORD: "se@cret",
+      POSTGRES_BACKEND_URL:
+        "postgresql://reader:se%40cret@db.internal:6543/_supabase?sslmode=disable",
+    });
+  }),
+);
+
+it.effect("gives Logflare's sources and events the default credentials a URL leaves out", () =>
+  Effect.gen(function* () {
+    const env = yield* makeSpec().env(
+      creation("postgresql://db.internal/_supabase"),
+      new Map(),
+      true,
+    );
+
+    expect(env).toMatchObject({
+      DB_USERNAME: "supabase_admin",
+      DB_PASSWORD: "postgres",
+      POSTGRES_BACKEND_URL: "postgresql://supabase_admin:postgres@db.internal/_supabase",
+    });
+  }),
+);
diff --git a/packages/stack/src/services/AnalyticsVectorImgproxy.integration.test.ts b/packages/stack/src/services/AnalyticsImgproxy.integration.test.ts
similarity index 72%
rename from packages/stack/src/services/AnalyticsVectorImgproxy.integration.test.ts
rename to packages/stack/src/services/AnalyticsImgproxy.integration.test.ts
index de79a2f854..9ad83b0bc4 100644
--- a/packages/stack/src/services/AnalyticsVectorImgproxy.integration.test.ts
+++ b/packages/stack/src/services/AnalyticsImgproxy.integration.test.ts
@@ -4,7 +4,7 @@ import { Effect, FileSystem, Layer, Redacted } from "effect";
 import { HttpClient, HttpClientRequest } from "effect/unstable/http";
 import { makeService } from "../Service.ts";
 import { makeServiceRecipe } from "./Catalog.ts";
-import { makeDockerHttpRelay, makeDockerTcpRelay } from "../../tests/docker-relay.ts";
+import { makeDockerTcpRelay } from "../../tests/docker-relay.ts";
 import { makeDockerDatabaseRoot } from "../../tests/docker-fixture.ts";
 
 const options = (root: string) => ({
@@ -22,7 +22,7 @@ const dockerOptions = (root: string) => ({
 
 describe("service catalog", () => {
   it.live(
-    "serves Analytics, Vector, and Imgproxy with their real endpoints",
+    "serves Analytics and Imgproxy with their real endpoints",
     () =>
       Effect.scoped(
         Effect.gen(function* () {
@@ -41,6 +41,7 @@ describe("service catalog", () => {
               },
             },
             dockerOptions(root),
+            Effect.succeed([]),
           );
           const database = yield* makeService(databaseRecipe.definition, {
             id: "database",
@@ -57,6 +58,7 @@ describe("service catalog", () => {
               config: { databaseUrl, backend: "postgres", apiKey: "catalog-analytics" },
             },
             dockerOptions(root),
+            Effect.succeed([]),
           );
           const analytics = yield* makeService(analyticsRecipe.definition, {
             id: "analytics",
@@ -65,7 +67,6 @@ describe("service catalog", () => {
           yield* analytics.start;
           yield* analytics.ready;
           const analyticsEndpoint = yield* analyticsRecipe.endpoint("http");
-          const analyticsRelay = yield* makeDockerHttpRelay(analyticsRecipe.endpoint("http"));
           const analyticsResponse = yield* client.execute(
             HttpClientRequest.get(
               `http://${analyticsEndpoint.host}:${analyticsEndpoint.port}/health`,
@@ -73,39 +74,12 @@ describe("service catalog", () => {
           );
           expect(analyticsResponse.status).toBe(200);
 
-          const vectorRecipe = yield* makeServiceRecipe(
-            {
-              service: "vector",
-              config: {
-                analyticsUrl: `http://${analyticsRelay.host}:${analyticsRelay.port}`,
-                apiKey: "catalog-analytics",
-                configPath: `${root}/vector.yaml`,
-              },
-            },
-            dockerOptions(root),
-          );
-          yield* fs.writeFileString(
-            `${root}/vector.yaml`,
-            "sources:\n  dummy:\n    type: demo_logs\n    format: syslog\n    interval: 60\n" +
-              "sinks:\n  print:\n    type: console\n    inputs: [dummy]\n    encoding:\n      codec: json\n",
-          );
-          const vector = yield* makeService(vectorRecipe.definition, {
-            id: "vector",
-            config: vectorRecipe.creation,
-          });
-          yield* vector.start;
-          yield* vector.ready;
-          const vectorEndpoint = yield* vectorRecipe.endpoint("http");
-          const vectorResponse = yield* client.execute(
-            HttpClientRequest.get(`http://${vectorEndpoint.host}:${vectorEndpoint.port}/health`),
-          );
-          expect(vectorResponse.status).toBe(200);
-
           const imageRoot = `${root}/images`;
           yield* fs.makeDirectory(imageRoot, { recursive: true });
           const imgproxyRecipe = yield* makeServiceRecipe(
             { service: "imgproxy", config: { filePath: imageRoot } },
             dockerOptions(root),
+            Effect.succeed([]),
           );
           const imgproxy = yield* makeService(imgproxyRecipe.definition, {
             id: "imgproxy",
@@ -122,7 +96,6 @@ describe("service catalog", () => {
           expect(imgproxyResponse.status).toBe(200);
 
           yield* imgproxy.stop;
-          yield* vector.stop;
           yield* analytics.stop;
           yield* database.stop;
         }),
diff --git a/packages/stack/src/services/AuthStorage.integration.test.ts b/packages/stack/src/services/AuthStorage.integration.test.ts
index 437e7975e8..a28f9e6571 100644
--- a/packages/stack/src/services/AuthStorage.integration.test.ts
+++ b/packages/stack/src/services/AuthStorage.integration.test.ts
@@ -42,6 +42,7 @@ describe("service catalog", () => {
               },
             },
             dockerOptions(root),
+            Effect.succeed([]),
           );
           const database = yield* makeService(databaseRecipe.definition, {
             id: "database",
@@ -57,6 +58,7 @@ describe("service catalog", () => {
               config: { databaseUrl, jwtSecret: secret, jwtExpiry: 3600 },
             },
             dockerOptions(root),
+            Effect.succeed([]),
           );
           const auth = yield* makeService(authRecipe.definition, {
             id: "auth",
@@ -98,6 +100,7 @@ describe("service catalog", () => {
           const imgproxyRecipe = yield* makeServiceRecipe(
             { service: "imgproxy", config: { filePath: storageRoot } },
             dockerOptions(root),
+            Effect.succeed([]),
           );
           const imgproxy = yield* makeService(imgproxyRecipe.definition, {
             id: "imgproxy",
@@ -117,6 +120,7 @@ describe("service catalog", () => {
               },
             },
             dockerOptions(root),
+            Effect.succeed([]),
           );
           const storage = yield* makeService(storageRecipe.definition, {
             id: "storage",
diff --git a/packages/stack/src/services/Catalog.integration.test.ts b/packages/stack/src/services/Catalog.integration.test.ts
index be06f948a4..5cad63c214 100644
--- a/packages/stack/src/services/Catalog.integration.test.ts
+++ b/packages/stack/src/services/Catalog.integration.test.ts
@@ -24,6 +24,7 @@ describe("service catalog", () => {
             endpoints: { smtp: { port: "auto" } },
           },
           options(root),
+          Effect.succeed([]),
         ).pipe(Effect.exit);
         expect(Exit.isFailure(result)).toBe(true);
         const misplacedDatabaseVersion = yield* makeServiceRecipe(
@@ -38,6 +39,7 @@ describe("service catalog", () => {
             },
           },
           options(root),
+          Effect.succeed([]),
         ).pipe(Effect.exit);
         expect(Exit.isFailure(misplacedDatabaseVersion)).toBe(true);
       }),
@@ -56,6 +58,7 @@ describe("service catalog", () => {
               config: { databaseUrl: "postgres://db" },
             },
             options(root),
+            Effect.succeed([]),
           ),
         );
         expect(error.operation).toBe("config");
diff --git a/packages/stack/src/services/Catalog.ts b/packages/stack/src/services/Catalog.ts
index 64e7828df5..c7d9e4375c 100644
--- a/packages/stack/src/services/Catalog.ts
+++ b/packages/stack/src/services/Catalog.ts
@@ -1,8 +1,10 @@
-import { Crypto, Effect, FileSystem, Path, Ref, Schema, Stream } from "effect";
+import { Crypto, Effect, FileSystem, Path, Ref, Schema } from "effect";
 import { ChildProcessSpawner } from "effect/unstable/process";
 import { HttpClient } from "effect/unstable/http";
 import { makeContainerRuntime } from "../runtime/Container.ts";
+import { randomPortSpanStart, reserveNativePort } from "../Ports.ts";
 import { ServiceError, type ServiceDefinition } from "../Service.ts";
+import type * as State from "../State.ts";
 import {
   makeDatabase,
   DatabaseConfig,
@@ -21,7 +23,6 @@ import * as Realtime from "./Realtime.ts";
 import * as Rest from "./Rest.ts";
 import * as Storage from "./Storage.ts";
 import * as Studio from "./Studio.ts";
-import * as Vector from "./Vector.ts";
 import {
   CatalogError,
   serviceCreation,
@@ -47,7 +48,6 @@ const endpointSchemas = [
   ["pgmeta", Pgmeta.Endpoints],
   ["mail", Mail.Endpoints],
   ["analytics", Analytics.Endpoints],
-  ["vector", Vector.Endpoints],
   ["pooler", Pooler.Endpoints],
 ] as const;
 
@@ -87,7 +87,6 @@ export const ServiceCreation = Schema.Union([
   Pgmeta.Creation,
   Mail.Creation,
   Analytics.Creation,
-  Vector.Creation,
   Pooler.Creation,
 ]);
 export type ServiceCreation = Schema.Schema.Type<typeof ServiceCreation>;
@@ -101,7 +100,6 @@ const requiredInputs: { readonly [K in ServiceKind]?: ReadonlyArray<string> } =
   pgmeta: ["databaseUrl"],
   analytics: ["databaseUrl"],
   pooler: ["databaseUrl"],
-  vector: ["analyticsUrl"],
 };
 
 /** Rejects a creation that lacks a required input before any lifecycle change. */
@@ -137,7 +135,6 @@ export const ServiceCreationInput = Schema.Union([
   Pgmeta.Creation,
   Mail.Creation,
   Analytics.Creation,
-  Vector.Creation,
   Pooler.Creation,
 ]);
 export type ServiceCreationInput = Schema.Schema.Type<typeof ServiceCreationInput>;
@@ -153,7 +150,6 @@ export const serviceSchemas = {
   pgmeta: Pgmeta.Config,
   mail: Mail.Config,
   analytics: Analytics.Config,
-  vector: Vector.Config,
   pooler: Pooler.Config,
 } as const;
 
@@ -289,16 +285,15 @@ const databaseRecipe = (
             service: "database",
           }),
         ),
-  logs: component.logs.pipe(
-    Stream.mapError(
-      (cause) =>
-        new CatalogError({ operation: "logs", message: cause.message, service: "database", cause }),
-    ),
-  ),
+  logs: component.logs,
 });
 
 export const makeServiceRecipe = Effect.fn("Catalog.makeServiceRecipe")(
-  (input: unknown, options: CatalogOptions) =>
+  (
+    input: unknown,
+    options: CatalogOptions,
+    readPortClaims: Effect.Effect<ReadonlyArray<State.StackClaims>, State.StateError>,
+  ) =>
     Effect.gen(function* () {
       const endpointError = validateEndpointNames(input);
       if (endpointError !== undefined) return yield* endpointError;
@@ -351,78 +346,82 @@ export const makeServiceRecipe = Effect.fn("Catalog.makeServiceRecipe")(
               imageMirrors: slimImageMirrors,
               ...(options.hostGateway === undefined ? {} : { hostGateway: options.hostGateway }),
             });
-      const deps: ProcessDependencies = { fs, path, crypto, client, spawner, container };
+      const deps: ProcessDependencies = {
+        fs,
+        path,
+        crypto,
+        client,
+        spawner,
+        container,
+        readPortClaims,
+        reserveNativePort: (key, claims, excluded) =>
+          reserveNativePort(claims, key, randomPortSpanStart(crypto), excluded),
+      };
       switch (creation.service) {
         case "rest":
           return catalogRecipe(
             creation,
-            yield* makeProcessRecipe(creation, options, deps, Rest.makeSpec()),
+            yield* makeProcessRecipe(options, deps, Rest.makeSpec()),
             Schema.is(Rest.Creation),
           );
         case "auth":
           return catalogRecipe(
             creation,
-            yield* makeProcessRecipe(creation, options, deps, Auth.makeSpec()),
+            yield* makeProcessRecipe(options, deps, Auth.makeSpec()),
             Schema.is(Auth.Creation),
           );
         case "realtime":
           return catalogRecipe(
             creation,
-            yield* makeProcessRecipe(creation, options, deps, Realtime.makeSpec()),
+            yield* makeProcessRecipe(options, deps, Realtime.makeSpec()),
             Schema.is(Realtime.Creation),
           );
         case "storage":
           return catalogRecipe(
             creation,
-            yield* makeProcessRecipe(creation, options, deps, Storage.makeSpec()),
+            yield* makeProcessRecipe(options, deps, Storage.makeSpec()),
             Schema.is(Storage.Creation),
           );
         case "imgproxy":
           return catalogRecipe(
             creation,
-            yield* makeProcessRecipe(creation, options, deps, Imgproxy.makeSpec()),
+            yield* makeProcessRecipe(options, deps, Imgproxy.makeSpec()),
             Schema.is(Imgproxy.Creation),
           );
         case "functions":
           return catalogRecipe(
             creation,
-            yield* Functions.makeRecipe(creation, options, deps),
+            yield* Functions.makeRecipe(options, deps),
             Schema.is(Functions.Creation),
           );
         case "studio":
           return catalogRecipe(
             creation,
-            yield* makeProcessRecipe(creation, options, deps, Studio.makeSpec()),
+            yield* makeProcessRecipe(options, deps, Studio.makeSpec()),
             Schema.is(Studio.Creation),
           );
         case "pgmeta":
           return catalogRecipe(
             creation,
-            yield* makeProcessRecipe(creation, options, deps, Pgmeta.makeSpec()),
+            yield* makeProcessRecipe(options, deps, Pgmeta.makeSpec()),
             Schema.is(Pgmeta.Creation),
           );
         case "mail":
           return catalogRecipe(
             creation,
-            yield* makeProcessRecipe(creation, options, deps, Mail.makeSpec()),
+            yield* makeProcessRecipe(options, deps, Mail.makeSpec()),
             Schema.is(Mail.Creation),
           );
         case "analytics":
           return catalogRecipe(
             creation,
-            yield* makeProcessRecipe(creation, options, deps, Analytics.makeSpec()),
+            yield* makeProcessRecipe(options, deps, Analytics.makeSpec()),
             Schema.is(Analytics.Creation),
           );
-        case "vector":
-          return catalogRecipe(
-            creation,
-            yield* Vector.makeRecipe(creation, options, deps),
-            Schema.is(Vector.Creation),
-          );
         case "pooler":
           return catalogRecipe(
             creation,
-            yield* makeProcessRecipe(creation, options, deps, Pooler.makeSpec()),
+            yield* makeProcessRecipe(options, deps, Pooler.makeSpec()),
             Schema.is(Pooler.Creation),
           );
       }
diff --git a/packages/stack/src/services/Database.integration.test.ts b/packages/stack/src/services/Database.integration.test.ts
index 08afa7397d..0e4d76937c 100644
--- a/packages/stack/src/services/Database.integration.test.ts
+++ b/packages/stack/src/services/Database.integration.test.ts
@@ -234,7 +234,7 @@ describe("database component", { timeout: 180_000 }, () => {
           });
           const observed = yield* Ref.make("");
           const caughtUp = yield* Deferred.make<void>();
-          yield* first.logs.pipe(
+          yield* Stream.fromSubscription(yield* first.logs).pipe(
             Stream.runForEach(({ bytes }) =>
               Ref.updateAndGet(observed, (text) => text + new TextDecoder().decode(bytes)).pipe(
                 Effect.flatMap((text) =>
diff --git a/packages/stack/src/services/Database.ts b/packages/stack/src/services/Database.ts
index dab2a348f2..ea12f21962 100644
--- a/packages/stack/src/services/Database.ts
+++ b/packages/stack/src/services/Database.ts
@@ -1,3 +1,4 @@
+import { withAttemptCount } from "../internal/attempts.ts";
 import { PgClient } from "@effect/sql-pg";
 import {
   Context,
@@ -43,6 +44,8 @@ import {
   processExit as sharedProcessExit,
   publishProcessLogs,
   runtimeSessionFromContainer,
+  launchOutputPublisher,
+  type LaunchOutput,
 } from "../runtime/Session.ts";
 import {
   ServiceError,
@@ -50,6 +53,7 @@ import {
   type RuntimeSession,
   type ServiceDefinition,
   type ServiceInstanceContext,
+  type ServiceLaunchContext,
 } from "../Service.ts";
 import {
   defaultNativeProcessLauncher,
@@ -63,7 +67,7 @@ import {
   resolveNativePostgresUser,
   type PasswdEntry,
 } from "../runtime/postgres-user.ts";
-import { EndpointIntent, serviceCreation } from "./Recipe.ts";
+import { EndpointIntent, serviceCreation, type CatalogLogs } from "./Recipe.ts";
 import {
   containerInstancePath,
   ensureOwnedInstanceRoot,
@@ -118,11 +122,6 @@ export type BackendEndpoint =
   | { readonly kind: "unix"; readonly path: string; readonly port: 5432 }
   | { readonly kind: "tcp"; readonly host: "127.0.0.1"; readonly port: number };
 
-interface DatabaseLog {
-  readonly stream: "stdout" | "stderr";
-  readonly bytes: Uint8Array;
-}
-
 export class DatabaseError extends Data.TaggedError("DatabaseError")<{
   readonly operation: string;
   readonly message: string;
@@ -159,7 +158,7 @@ export interface DatabaseComponent {
     scope: SnapshotScope,
   ) => Effect.Effect<boolean, ServiceError>;
   readonly endpoint: Effect.Effect<BackendEndpoint, DatabaseError>;
-  readonly logs: Stream.Stream<DatabaseLog, DatabaseError>;
+  readonly logs: CatalogLogs;
 }
 
 const errorFor = mapToServiceError;
@@ -196,38 +195,38 @@ export const processExit = <E extends { readonly message: string }>(
 ): Effect.Effect<Exit.Exit<void, ServiceError>> =>
   sharedProcessExit(exitCode, describePostgresExit, stderr);
 
-const reconcileContainerPassword = Effect.fn("Database.reconcileContainerPassword")(
-  (
-    engine: "docker" | "podman",
-    id: string,
-    password: Redacted.Redacted<string>,
-    spawner: ChildProcessSpawnerService["Service"],
-  ) =>
+const reconcileContainerPassword = Effect.fn("Database.reconcileContainerPassword")(function* (
+  engine: "docker" | "podman",
+  id: string,
+  password: Redacted.Redacted<string>,
+  spawner: ChildProcessSpawnerService["Service"],
+) {
+  const args = [
+    "exec",
+    "-i",
+    id,
+    "/opt/postgres/bin/psql",
+    "-h",
+    "/tmp",
+    "-p",
+    "5432",
+    "-U",
+    "supabase_admin",
+    "-d",
+    "postgres",
+    "-X",
+    "-v",
+    "ON_ERROR_STOP=1",
+  ];
+  yield* Effect.annotateCurrentSpan({
+    "process.executable.name": engine,
+    "process.arg_count": args.length,
+  });
+  // Each retry overwrites `process.exit_code`, so the span reports the last attempt's status.
+  return yield* withAttemptCount(
     Effect.scoped(
       Effect.gen(function* () {
-        const child = yield* spawner.spawn(
-          ChildProcess.make(
-            engine,
-            [
-              "exec",
-              "-i",
-              id,
-              "/opt/postgres/bin/psql",
-              "-h",
-              "/tmp",
-              "-p",
-              "5432",
-              "-U",
-              "supabase_admin",
-              "-d",
-              "postgres",
-              "-X",
-              "-v",
-              "ON_ERROR_STOP=1",
-            ],
-            { stdin: "pipe" },
-          ),
-        );
+        const child = yield* spawner.spawn(ChildProcess.make(engine, args, { stdin: "pipe" }));
         const statement = `BEGIN; SET LOCAL log_statement = 'none'; SET LOCAL log_min_error_statement = 'panic'; SET LOCAL log_min_duration_statement = -1; SET LOCAL log_min_duration_sample = -1; SET LOCAL standard_conforming_strings = on; ALTER ROLE supabase_admin PASSWORD '${Redacted.value(password).replaceAll("'", "''")}'; COMMIT;`;
         const [, , , code] = yield* Effect.all(
           [
@@ -238,17 +237,22 @@ const reconcileContainerPassword = Effect.fn("Database.reconcileContainerPasswor
           ],
           { concurrency: "unbounded" },
         );
+        yield* Effect.annotateCurrentSpan("process.exit_code", Number(code));
         if (Number(code) !== 0)
           return yield* errorFor("health", "Local database credential setup has not succeeded");
       }),
-    ).pipe(
-      Effect.mapError(() => errorFor("health", "Local database credential setup failed")),
-      Effect.retry(Schedule.spaced("250 millis")),
     ),
-);
+    (counted) =>
+      counted.pipe(
+        Effect.mapError(() => errorFor("health", "Local database credential setup failed")),
+        Effect.retry(Schedule.spaced("250 millis")),
+      ),
+    { traced: true },
+  );
+});
 
 /** Idempotent readiness reconciliation, so a session also re-runs it as its probe. */
-const health = Effect.fn("Database.health")((
+const health = Effect.fn("Database.health")(function* (
   endpoint: BackendEndpoint,
   config: DatabaseConfig,
   reconcile: Effect.Effect<void, ServiceError>,
@@ -259,7 +263,7 @@ const health = Effect.fn("Database.health")((
     readonly runtime: DatabaseRuntime;
     readonly markInitialized?: Effect.Effect<void, ServiceError>;
   },
-): Effect.Effect<void, ServiceError> => {
+) {
   const host = endpoint.kind === "unix" ? endpoint.path : endpoint.host;
   const probe = Effect.scoped(
     Effect.gen(function* () {
@@ -277,8 +281,10 @@ const health = Effect.fn("Database.health")((
       yield* client.unsafe("SELECT 1");
     }),
   );
-  const retryProbe = probe.pipe(Effect.retry(Schedule.spaced("250 millis")));
-  return reconcile.pipe(
+  const retryProbe = withAttemptCount(probe, (counted) =>
+    counted.pipe(Effect.retry(Schedule.spaced("250 millis"))),
+  );
+  return yield* reconcile.pipe(
     Effect.andThen(retryProbe),
     Effect.andThen(
       Effect.scoped(
@@ -475,7 +481,7 @@ export const makeDatabase = (
     const crypto = yield* Crypto.Crypto;
     const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
     const client = yield* HttpClient.HttpClient;
-    const logs = yield* PubSub.sliding<DatabaseLog>(256);
+    const logs = yield* PubSub.sliding<LaunchOutput>(256);
     const endpoint = yield* Ref.make<BackendEndpoint | undefined>(undefined);
     const prepared = yield* Ref.make<ReadonlyMap<string, PreparedNativeArtifact>>(new Map());
     if (!/^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/u.test(String(options.stackId)))
@@ -765,9 +771,10 @@ export const makeDatabase = (
 
     const launch = Effect.fn("Database.launch")(
       (
-        context: ServiceInstanceContext<DatabaseConfig>,
+        context: ServiceLaunchContext<DatabaseConfig>,
       ): Effect.Effect<RuntimeSession, ServiceError | ServiceLaunchError> =>
         Effect.gen(function* () {
+          const publish = yield* (yield* launchOutputPublisher(logs, context.launchId)).part;
           const postgresUser = yield* resolveNativePostgresUser(options.runtime).pipe(
             Effect.provideService(FileSystem.FileSystem, fs),
           );
@@ -858,7 +865,7 @@ export const makeDatabase = (
             };
             yield* Ref.set(endpoint, selectedEndpoint);
             const stderrTail = yield* Ref.make("");
-            const stderrDrained = yield* publishLogs(process, logs, context.scope, stderrTail);
+            const stderrDrained = yield* publishLogs(process, publish, context.scope, stderrTail);
             const setup = health(selectedEndpoint, config, Effect.void, {
               fs,
               instanceRoot,
@@ -888,7 +895,7 @@ export const makeDatabase = (
             return yield* errorFor("launch", "Container did not publish PostgreSQL");
           const selectedEndpoint: BackendEndpoint = { kind: "tcp", host: "127.0.0.1", port };
           yield* Ref.set(endpoint, selectedEndpoint);
-          yield* publishLogs(launched, logs, context.scope);
+          yield* publishLogs(launched, publish, context.scope);
           const session = runtimeFromContainer(launched, config.stopGraceSeconds === 0);
           const setup = health(
             selectedEndpoint,
@@ -989,6 +996,6 @@ export const makeDatabase = (
             : Effect.succeed(value),
         ),
       ),
-      logs: Stream.fromPubSub(logs),
+      logs: PubSub.subscribe(logs),
     } satisfies DatabaseComponent;
   });
diff --git a/packages/stack/src/services/Functions.integration.test.ts b/packages/stack/src/services/Functions.integration.test.ts
index 12a6ac4d60..0b667ca653 100644
--- a/packages/stack/src/services/Functions.integration.test.ts
+++ b/packages/stack/src/services/Functions.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodePath, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodePath, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import {
   Cause,
@@ -17,10 +17,23 @@ import {
 import { HttpClient, HttpClientRequest } from "effect/unstable/http";
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
 import { ContainerError, type ContainerRuntime } from "../runtime/Container.ts";
+import { randomPortSpanStart, reserveNativePort } from "../Ports.ts";
 import { makeService } from "../Service.ts";
+import type * as State from "../State.ts";
 import { makeServiceRecipe } from "./Catalog.ts";
 import * as Functions from "./Functions.ts";
 
+// No saved stacks to consult; this test never launches the native backend it configures.
+const testReadPortClaims = Effect.succeed([]);
+const testReserveNativePort = (
+  key: string,
+  claims: ReadonlyArray<State.StackClaims>,
+  excluded: ReadonlySet<number>,
+) =>
+  Effect.flatMap(Crypto.Crypto, (crypto) =>
+    reserveNativePort(claims, key, randomPortSpanStart(crypto), excluded),
+  ).pipe(Effect.provide(NodeCrypto.layer));
+
 const options = (root: string) => ({
   stackId: "catalog-functions",
   instanceId: "instance",
@@ -45,86 +58,90 @@ const dockerInfo = Effect.scoped(
 ).pipe(Effect.orElseSucceed(() => "docker info unavailable"));
 
 describe("service catalog", () => {
-  it.live("serves a standalone Functions bootstrap over HTTP", () =>
-    Effect.scoped(
-      Effect.gen(function* () {
-        const fs = yield* FileSystem.FileSystem;
-        const client = yield* HttpClient.HttpClient;
-        const root = yield* fs.makeTempDirectoryScoped({ prefix: "catalog-functions-" });
-        const stackId = "b".repeat(64);
-        const instanceId = "functions-instance";
-        const functionsRoot = root + "/user-functions";
-        yield* fs.makeDirectory(functionsRoot + "/hello", { recursive: true });
-        yield* fs.writeFileString(
-          functionsRoot + "/hello/index.ts",
-          "Deno.serve(() => Response.json({ custom: Deno.env.get('CUSTOM_ENV'), root: Deno.env.get('SUPABASE_INTERNAL_FUNCTIONS_ROOT'), port: Deno.env.get('EDGE_RUNTIME_PORT'), url: Deno.env.get('SUPABASE_URL'), db: Deno.env.get('SUPABASE_DB_URL'), jwt: Deno.env.get('SUPABASE_INTERNAL_JWT_SECRET'), jwks: Deno.env.get('SUPABASE_JWKS'), anon: Deno.env.get('SUPABASE_ANON_KEY'), service: Deno.env.get('SUPABASE_SERVICE_ROLE_KEY'), publishable: Deno.env.get('SUPABASE_PUBLISHABLE_KEYS'), secret: Deno.env.get('SUPABASE_SECRET_KEYS') }));",
-        );
-        const recipe = yield* makeServiceRecipe(
-          {
-            service: "functions",
-            config: {
-              functionsRoot,
-              databaseUrl: "postgres://functions-db",
-              apiUrl: "http://functions-api",
-              jwtSecret: "functions-jwt-secret",
-              jwks: "functions-jwks",
-              anonKey: "active-anon-key",
-              serviceRoleKey: "active-service-role-key",
-              publishableKey: "active-publishable-key",
-              secretKey: "active-secret-key",
-              env: {
-                CUSTOM_ENV: "custom-value",
-                SUPABASE_INTERNAL_FUNCTIONS_ROOT: "overridden-root",
-                EDGE_RUNTIME_PORT: "overridden-port",
-                SUPABASE_URL: "overridden-url",
-                SUPABASE_DB_URL: "overridden-db",
-                SUPABASE_INTERNAL_JWT_SECRET: "overridden-jwt",
-                SUPABASE_ANON_KEY: "overridden-anon",
-                SUPABASE_SERVICE_ROLE_KEY: "overridden-service",
-                SUPABASE_JWKS: "overridden-jwks",
-                SUPABASE_INTERNAL_PUBLISHABLE_KEY: "overridden-publishable",
-                SUPABASE_INTERNAL_SECRET_KEY: "overridden-secret",
+  it.live(
+    "serves a standalone Functions bootstrap over HTTP",
+    () =>
+      Effect.scoped(
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const client = yield* HttpClient.HttpClient;
+          const root = yield* fs.makeTempDirectoryScoped({ prefix: "catalog-functions-" });
+          const stackId = "b".repeat(64);
+          const instanceId = "functions-instance";
+          const functionsRoot = root + "/user-functions";
+          yield* fs.makeDirectory(functionsRoot + "/hello", { recursive: true });
+          yield* fs.writeFileString(
+            functionsRoot + "/hello/index.ts",
+            "Deno.serve(() => Response.json({ custom: Deno.env.get('CUSTOM_ENV'), root: Deno.env.get('SUPABASE_INTERNAL_FUNCTIONS_ROOT'), port: Deno.env.get('EDGE_RUNTIME_PORT'), url: Deno.env.get('SUPABASE_URL'), db: Deno.env.get('SUPABASE_DB_URL'), jwt: Deno.env.get('SUPABASE_INTERNAL_JWT_SECRET'), jwks: Deno.env.get('SUPABASE_JWKS'), anon: Deno.env.get('SUPABASE_ANON_KEY'), service: Deno.env.get('SUPABASE_SERVICE_ROLE_KEY'), publishable: Deno.env.get('SUPABASE_PUBLISHABLE_KEYS'), secret: Deno.env.get('SUPABASE_SECRET_KEYS') }));",
+          );
+          const recipe = yield* makeServiceRecipe(
+            {
+              service: "functions",
+              config: {
+                functionsRoot,
+                databaseUrl: "postgres://functions-db",
+                apiUrl: "http://functions-api",
+                jwtSecret: "functions-jwt-secret",
+                jwks: "functions-jwks",
+                anonKey: "active-anon-key",
+                serviceRoleKey: "active-service-role-key",
+                publishableKey: "active-publishable-key",
+                secretKey: "active-secret-key",
+                env: {
+                  CUSTOM_ENV: "custom-value",
+                  SUPABASE_INTERNAL_FUNCTIONS_ROOT: "overridden-root",
+                  EDGE_RUNTIME_PORT: "overridden-port",
+                  SUPABASE_URL: "overridden-url",
+                  SUPABASE_DB_URL: "overridden-db",
+                  SUPABASE_INTERNAL_JWT_SECRET: "overridden-jwt",
+                  SUPABASE_ANON_KEY: "overridden-anon",
+                  SUPABASE_SERVICE_ROLE_KEY: "overridden-service",
+                  SUPABASE_JWKS: "overridden-jwks",
+                  SUPABASE_INTERNAL_PUBLISHABLE_KEY: "overridden-publishable",
+                  SUPABASE_INTERNAL_SECRET_KEY: "overridden-secret",
+                },
+                verifyJwt: false,
+                inspector: true,
               },
-              verifyJwt: false,
-              inspector: true,
             },
-          },
-          { ...dockerOptions(root), stackId, instanceId },
-        );
-        const instance = yield* makeService(recipe.definition, {
-          id: instanceId,
-          config: recipe.creation,
-        });
-        yield* instance.start;
-        yield* instance.ready;
-        const endpoint = yield* recipe.endpoint("http");
-        const response = yield* client.execute(
-          HttpClientRequest.get("http://" + endpoint.host + ":" + endpoint.port + "/hello"),
-        );
-        expect(response.status).toBe(200);
-        expect(yield* response.json).toEqual(
-          expect.objectContaining({
-            custom: "custom-value",
-            port: "9000",
-            url: "http://functions-api",
-            db: "postgres://functions-db",
-            jwks: "functions-jwks",
-            anon: "active-anon-key",
-            service: "active-service-role-key",
-            publishable: '{"default":"active-publishable-key"}',
-            secret: '{"default":"active-secret-key"}',
-          }),
-        );
-        const inspector = yield* recipe.endpoint("inspector");
-        const inspectorResponse = yield* client.execute(
-          HttpClientRequest.get(
-            "http://" + inspector.host + ":" + inspector.port + "/json/version",
-          ),
-        );
-        expect(inspectorResponse.status).toBe(200);
-        yield* instance.stop;
-      }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+            { ...dockerOptions(root), stackId, instanceId },
+            Effect.succeed([]),
+          );
+          const instance = yield* makeService(recipe.definition, {
+            id: instanceId,
+            config: recipe.creation,
+          });
+          yield* instance.start;
+          yield* instance.ready;
+          const endpoint = yield* recipe.endpoint("http");
+          const response = yield* client.execute(
+            HttpClientRequest.get("http://" + endpoint.host + ":" + endpoint.port + "/hello"),
+          );
+          expect(response.status).toBe(200);
+          expect(yield* response.json).toEqual(
+            expect.objectContaining({
+              custom: "custom-value",
+              port: "9000",
+              url: "http://functions-api",
+              db: "postgres://functions-db",
+              jwks: "functions-jwks",
+              anon: "active-anon-key",
+              service: "active-service-role-key",
+              publishable: '{"default":"active-publishable-key"}',
+              secret: '{"default":"active-secret-key"}',
+            }),
+          );
+          const inspector = yield* recipe.endpoint("inspector");
+          const inspectorResponse = yield* client.execute(
+            HttpClientRequest.get(
+              "http://" + inspector.host + ":" + inspector.port + "/json/version",
+            ),
+          );
+          expect(inspectorResponse.status).toBe(200);
+          yield* instance.stop;
+        }),
+      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
+    { timeout: 120_000 },
   );
 
   const ancestors = [
@@ -190,9 +207,10 @@ describe("service catalog", () => {
                 instanceId: "ancestor",
                 cacheRoot: "/tmp/supabase-stack-artifacts",
               },
+              Effect.succeed([]),
             );
             const logs = yield* Ref.make("");
-            yield* recipe.logs.pipe(
+            yield* Stream.fromSubscription(yield* recipe.logs).pipe(
               Stream.runForEach(({ bytes }) =>
                 Ref.update(logs, (text) => text + new TextDecoder().decode(bytes)),
               ),
@@ -258,9 +276,10 @@ describe("service catalog", () => {
               instanceId: "deno-config",
               cacheRoot: "/tmp/supabase-stack-artifacts",
             },
+            Effect.succeed([]),
           );
           const logs = yield* Ref.make("");
-          yield* recipe.logs.pipe(
+          yield* Stream.fromSubscription(yield* recipe.logs).pipe(
             Stream.runForEach(({ bytes }) =>
               Ref.update(logs, (text) => text + new TextDecoder().decode(bytes)),
             ),
@@ -329,10 +348,11 @@ describe("service catalog", () => {
               instanceId: "plain-deno-config",
               cacheRoot: "/tmp/supabase-stack-artifacts",
             },
+            Effect.succeed([]),
           );
           const logs = yield* Ref.make("");
           const warned = yield* Deferred.make<void>();
-          yield* recipe.logs.pipe(
+          yield* Stream.fromSubscription(yield* recipe.logs).pipe(
             Stream.runForEach(({ bytes }) =>
               Ref.updateAndGet(logs, (text) => text + new TextDecoder().decode(bytes)).pipe(
                 Effect.flatMap((text) =>
@@ -439,9 +459,10 @@ for (const runtime of ["native", "docker"] as const) {
               runtime,
               cacheRoot: "/tmp/supabase-stack-artifacts",
             },
+            Effect.succeed([]),
           );
           const logs = yield* Ref.make("");
-          yield* recipe.logs.pipe(
+          yield* Stream.fromSubscription(yield* recipe.logs).pipe(
             Stream.runForEach(({ bytes }) =>
               Ref.update(logs, (text) => text + new TextDecoder().decode(bytes)),
             ),
@@ -534,7 +555,6 @@ it.effect("passes POSIX project paths to a docker Functions container from a Win
         },
       };
       const recipe = yield* Functions.makeRecipe(
-        creation,
         {
           stackId: "e".repeat(64),
           instanceId: "windows",
@@ -549,11 +569,13 @@ it.effect("passes POSIX project paths to a docker Functions container from a Win
           client: yield* HttpClient.HttpClient,
           spawner: yield* ChildProcessSpawner.ChildProcessSpawner,
           container,
+          readPortClaims: testReadPortClaims,
+          reserveNativePort: testReserveNativePort,
         },
       );
       const scope = yield* Scope.make();
       yield* recipe.definition
-        .launch({ id: "windows", config: creation, scope })
+        .launch({ id: "windows", config: creation, scope, launchId: 1 })
         .pipe(Effect.flip, Effect.ensuring(Scope.close(scope, Exit.void)));
 
       const spec = yield* Ref.get(launched);
diff --git a/packages/stack/src/services/Functions.ts b/packages/stack/src/services/Functions.ts
index d3c81eb740..cbc0df1386 100644
--- a/packages/stack/src/services/Functions.ts
+++ b/packages/stack/src/services/Functions.ts
@@ -233,7 +233,6 @@ const makeSpec = (
 
 export const makeRecipe = Effect.fn("Functions.makeRecipe")(
   (
-    creation: Creation,
     options: CatalogOptions,
     deps: ProcessDependencies,
   ): Effect.Effect<ProcessRecipeResult<Creation>, CatalogError> =>
@@ -269,7 +268,6 @@ export const makeRecipe = Effect.fn("Functions.makeRecipe")(
         ),
       );
       return yield* makeProcessRecipe(
-        creation,
         options,
         deps,
         makeSpec(functionsRoot, bootstrap, deps.path, deps.fs),
diff --git a/packages/stack/src/services/InstanceRoot.integration.test.ts b/packages/stack/src/services/InstanceRoot.integration.test.ts
index 62b9c2fe65..4d8f003f3e 100644
--- a/packages/stack/src/services/InstanceRoot.integration.test.ts
+++ b/packages/stack/src/services/InstanceRoot.integration.test.ts
@@ -1,6 +1,6 @@
 import { NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
-import { Data, Effect, Exit, FileSystem, Path } from "effect";
+import { Cause, Data, Effect, Exit, FileSystem, Option, Path, PlatformError } from "effect";
 import { ensureOwnedInstanceRoot, type OwnedInstanceRootParams } from "./InstanceRoot.ts";
 
 class TestInstanceRootError extends Data.TaggedError("TestInstanceRootError")<{
@@ -42,4 +42,108 @@ describe("InstanceRoot", () => {
       }),
     ),
   );
+
+  it.live("lets exactly one of concurrent conflicting claims of a fresh root win", () =>
+    run(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const parentRoot = yield* fs.makeTempDirectoryScoped({ prefix: "instance-root-conflict-" });
+        const ownerFileName = ".supabase-instance-owner.json";
+        const paramsFor = (stackId: string): OwnedInstanceRootParams => ({
+          fs,
+          path,
+          parentRoot,
+          stackId,
+          instanceId: "instance",
+          ownerFileName,
+          label: "Instance root",
+        });
+        const stackIds = Array.from({ length: 10 }, (_, i) => `stack-${i}`);
+        const results = yield* Effect.all(
+          stackIds.map((stackId) =>
+            Effect.exit(ensureOwnedInstanceRoot(paramsFor(stackId), onError)),
+          ),
+          { concurrency: "unbounded" },
+        );
+        const failures = results.filter(Exit.isFailure);
+        expect(results.filter(Exit.isSuccess)).toHaveLength(1);
+        expect(failures).toHaveLength(9);
+        for (const failure of failures)
+          expect(Option.getOrUndefined(Cause.findErrorOption(failure.cause))?.cause).toBe(
+            "Instance root belongs to another instance",
+          );
+        const marker = yield* fs.readFileString(path.join(parentRoot, "instance", ownerFileName));
+        expect(
+          stackIds.map((stackId) => JSON.stringify({ stackId, instanceId: "instance" })),
+        ).toContain(marker);
+      }),
+    ),
+  );
+
+  it.live("ignores an orphaned staging file when claiming a fresh root", () =>
+    run(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const parentRoot = yield* fs.makeTempDirectoryScoped({ prefix: "instance-root-orphan-" });
+        const ownerFileName = ".supabase-instance-owner.json";
+        const root = path.join(parentRoot, "instance");
+        yield* fs.makeDirectory(root, { recursive: true });
+        yield* fs.writeFileString(path.join(root, `.${ownerFileName}.orphan.tmp`), "leftover");
+        const params: OwnedInstanceRootParams = {
+          fs,
+          path,
+          parentRoot,
+          stackId: "stack",
+          instanceId: "instance",
+          ownerFileName,
+          label: "Instance root",
+        };
+        yield* ensureOwnedInstanceRoot(params, onError);
+        const marker = yield* fs.readFileString(path.join(root, ownerFileName));
+        expect(marker).toBe('{"stackId":"stack","instanceId":"instance"}');
+      }),
+    ),
+  );
+
+  it.live("falls back to an exclusive create when hard links are unsupported", () =>
+    run(
+      Effect.gen(function* () {
+        const realFs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const parentRoot = yield* realFs.makeTempDirectoryScoped({
+          prefix: "instance-root-fallback-",
+        });
+        const ownerFileName = ".supabase-instance-owner.json";
+        const fs: FileSystem.FileSystem = {
+          ...realFs,
+          link: () =>
+            Effect.fail(
+              PlatformError.systemError({
+                _tag: "Unknown",
+                module: "FileSystem",
+                method: "link",
+                description: "injected unsupported-link failure",
+                cause: Object.assign(new Error("Operation not supported"), { code: "EPERM" }),
+              }),
+            ),
+        };
+        const params: OwnedInstanceRootParams = {
+          fs,
+          path,
+          parentRoot,
+          stackId: "stack",
+          instanceId: "instance",
+          ownerFileName,
+          label: "Instance root",
+        };
+        yield* ensureOwnedInstanceRoot(params, onError);
+        const root = path.join(parentRoot, "instance");
+        const marker = yield* realFs.readFileString(path.join(root, ownerFileName));
+        expect(marker).toBe('{"stackId":"stack","instanceId":"instance"}');
+        expect(yield* realFs.readDirectory(root)).toEqual([ownerFileName]);
+      }),
+    ),
+  );
 });
diff --git a/packages/stack/src/services/InstanceRoot.ts b/packages/stack/src/services/InstanceRoot.ts
index 49d7a998d1..4f547c6753 100644
--- a/packages/stack/src/services/InstanceRoot.ts
+++ b/packages/stack/src/services/InstanceRoot.ts
@@ -1,4 +1,6 @@
-import { Effect, type FileSystem, type Path } from "effect";
+import { Effect, Predicate, type FileSystem, type Path } from "effect";
+import type { PlatformError } from "effect/PlatformError";
+import { randomUUID } from "node:crypto";
 
 /** The container mount target for an instance-scoped directory owned on the host. */
 export const containerInstancePath = "/instance";
@@ -8,6 +10,23 @@ const safeInstanceIdPattern = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/u;
 /** True when `instanceId` is safe to join to a root as one path segment, without traversal. */
 const isSafeInstanceId = (instanceId: string): boolean => safeInstanceIdPattern.test(instanceId);
 
+/** Name a staging file for `ownerFileName`, recognizable so directory scans can ignore it. */
+const stagingFileName = (ownerFileName: string) => `.${ownerFileName}.${randomUUID()}.tmp`;
+
+/** True when `entry` looks like one of our own staging files for `ownerFileName`. */
+const isStagingEntry = (ownerFileName: string, entry: string): boolean =>
+  entry.startsWith(`.${ownerFileName}.`) && entry.endsWith(".tmp");
+
+/** True when `error` signals the filesystem does not support hard links. */
+const isUnsupportedLink = (error: unknown): boolean => {
+  if (!Predicate.hasProperty(error, "cause")) return false;
+  const code =
+    Predicate.hasProperty(error.cause, "code") && typeof error.cause.code === "string"
+      ? error.cause.code
+      : undefined;
+  return code === "EPERM" || code === "ENOTSUP" || code === "EOPNOTSUPP";
+};
+
 export interface OwnedInstanceRootParams {
   readonly fs: FileSystem.FileSystem;
   readonly path: Path.Path;
@@ -36,6 +55,34 @@ export const ensureOwnedInstanceRoot = Effect.fn("InstanceRoot.ensureOwnedInstan
     if (existing !== marker)
       return yield* Effect.fail(onError("data", `${label} belongs to another instance`));
   });
+  const claimIfAlreadyExists = (effect: Effect.Effect<void, PlatformError>) =>
+    effect.pipe(
+      Effect.catchIf(
+        (error) => error.reason._tag === "AlreadyExists",
+        () => Effect.void,
+      ),
+    );
+  // Staging the full marker next to `ownerFile` and hard-linking it into place keeps `wx`'s
+  // exclusivity without ever exposing the partial content a direct write there could risk.
+  const writeMarkerAtomically = Effect.suspend(() => {
+    const tempFile = path.join(root, stagingFileName(ownerFileName));
+    return fs.writeFileString(tempFile, marker, { mode: 0o600, flag: "wx" }).pipe(
+      Effect.andThen(() =>
+        fs.link(tempFile, ownerFile).pipe(
+          claimIfAlreadyExists,
+          // Filesystems without hard links (e.g. exFAT, some network shares) fall back to the
+          // direct exclusive create this replaced; it stays correct, just racy on those alone.
+          Effect.catchIf(isUnsupportedLink, () =>
+            fs
+              .writeFileString(ownerFile, marker, { mode: 0o600, flag: "wx" })
+              .pipe(claimIfAlreadyExists),
+          ),
+        ),
+      ),
+      Effect.ensuring(fs.remove(tempFile, { force: true }).pipe(Effect.ignore)),
+      Effect.mapError((cause) => onError("data", cause)),
+    );
+  });
   return Effect.gen(function* () {
     if (!isSafeInstanceId(instanceId))
       return yield* Effect.fail(onError("data", `${label} instance id is not a safe path segment`));
@@ -46,24 +93,18 @@ export const ensureOwnedInstanceRoot = Effect.fn("InstanceRoot.ensureOwnedInstan
       .exists(ownerFile)
       .pipe(Effect.mapError((cause) => onError("data", cause)));
     if (present) return yield* claimExistingMarker;
-    const entries = yield* fs
-      .readDirectory(root)
-      .pipe(Effect.mapError((cause) => onError("data", cause)));
+    const entries = yield* fs.readDirectory(root).pipe(
+      Effect.map((entries) => entries.filter((entry) => !isStagingEntry(ownerFileName, entry))),
+      Effect.mapError((cause) => onError("data", cause)),
+    );
     if (entries.length > 0) {
       // A concurrent first claim may have written the marker between the `exists` and
       // `readDirectory` calls above; an otherwise-empty root is still safe to compare.
       if (entries.length === 1 && entries[0] === ownerFileName) return yield* claimExistingMarker;
       return yield* Effect.fail(onError("data", `${label} is non-empty and unmarked`));
     }
-    yield* fs.writeFileString(ownerFile, marker, { mode: 0o600, flag: "wx" }).pipe(
-      // A concurrent first claim may win the exclusive create; the loser re-reads the marker
-      // instead of failing, since both wrote the same stack+instance marker.
-      Effect.catchIf(
-        (error) => error.reason._tag === "AlreadyExists",
-        () => claimExistingMarker,
-      ),
-      Effect.catchTag("PlatformError", (cause) => Effect.fail(onError("data", cause))),
-    );
+    yield* writeMarkerAtomically;
+    return yield* claimExistingMarker;
   });
 });
 
diff --git a/packages/stack/src/services/Mail.integration.test.ts b/packages/stack/src/services/Mail.integration.test.ts
index f80d9a3073..1b6b262f88 100644
--- a/packages/stack/src/services/Mail.integration.test.ts
+++ b/packages/stack/src/services/Mail.integration.test.ts
@@ -64,6 +64,7 @@ describe("service catalog", () => {
         const recipe = yield* makeServiceRecipe(
           { service: "mail", config: {} },
           dockerOptions(root),
+          Effect.succeed([]),
         );
         const instance = yield* makeService(recipe.definition, {
           id: "mail",
@@ -90,7 +91,11 @@ describe("service catalog", () => {
           const path = yield* Path.Path;
           const root = yield* fs.makeTempDirectoryScoped({ prefix: "catalog-mail-isolation-" });
           const recipeFor = (instanceId: string) =>
-            makeServiceRecipe({ service: "mail", config: {} }, { ...options(root), instanceId });
+            makeServiceRecipe(
+              { service: "mail", config: {} },
+              { ...options(root), instanceId },
+              Effect.succeed([]),
+            );
           const first = yield* recipeFor("mail-a");
           const second = yield* recipeFor("mail-b");
           const firstInstance = yield* makeService(first.definition, {
@@ -121,7 +126,11 @@ describe("service catalog", () => {
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
         const root = yield* fs.makeTempDirectoryScoped({ prefix: "catalog-mail-persistence-" });
-        const recipe = yield* makeServiceRecipe({ service: "mail", config: {} }, options(root));
+        const recipe = yield* makeServiceRecipe(
+          { service: "mail", config: {} },
+          options(root),
+          Effect.succeed([]),
+        );
         const instance = yield* makeService(recipe.definition, {
           id: "mail",
           config: recipe.creation,
@@ -155,6 +164,7 @@ describe("service catalog", () => {
         const recipe = yield* makeServiceRecipe(
           { service: "mail", config: {} },
           dockerOptions(root),
+          Effect.succeed([]),
         );
         const instance = yield* makeService(recipe.definition, {
           id: "mail",
@@ -185,7 +195,11 @@ describe("service catalog", () => {
         const fs = yield* FileSystem.FileSystem;
         const path = yield* Path.Path;
         const root = yield* fs.makeTempDirectoryScoped({ prefix: "catalog-mail-destroy-" });
-        const recipe = yield* makeServiceRecipe({ service: "mail", config: {} }, options(root));
+        const recipe = yield* makeServiceRecipe(
+          { service: "mail", config: {} },
+          options(root),
+          Effect.succeed([]),
+        );
         const instance = yield* makeService(recipe.definition, {
           id: "mail",
           config: recipe.creation,
@@ -209,6 +223,7 @@ describe("service catalog", () => {
         const recipe = yield* makeServiceRecipe(
           { service: "mail", config: {} },
           { ...options(root), instanceId: "../escaped" },
+          Effect.succeed([]),
         );
         const instance = yield* makeService(recipe.definition, {
           id: "mail",
diff --git a/packages/stack/src/services/Pooler.integration.test.ts b/packages/stack/src/services/Pooler.integration.test.ts
index d6e0866bc4..e853e7f01f 100644
--- a/packages/stack/src/services/Pooler.integration.test.ts
+++ b/packages/stack/src/services/Pooler.integration.test.ts
@@ -41,6 +41,7 @@ describe("service catalog", () => {
               },
             },
             dockerOptions(root),
+            Effect.succeed([]),
           );
           const database = yield* makeService(databaseRecipe.definition, {
             id: "database",
@@ -70,6 +71,7 @@ describe("service catalog", () => {
                   },
                 },
                 runtime === "native" ? options(root) : dockerOptions(root),
+                Effect.succeed([]),
               );
               const pooler = yield* makeService(poolerRecipe.definition, {
                 id: `pooler-${runtime}-${poolMode}`,
diff --git a/packages/stack/src/services/ProcessRecipe.integration.test.ts b/packages/stack/src/services/ProcessRecipe.integration.test.ts
index 9f14cc70ce..d91b480694 100644
--- a/packages/stack/src/services/ProcessRecipe.integration.test.ts
+++ b/packages/stack/src/services/ProcessRecipe.integration.test.ts
@@ -1,4 +1,4 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeHttpClient, NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import {
   PlatformError,
@@ -25,6 +25,8 @@ import * as Net from "node:net";
 // oxlint-disable-next-line effecttsgo/node-builtin-import -- the collision fixture owns a local HTTP listener.
 import * as NodeHttp from "node:http";
 import { catalogPins, resolveArtifact, type ServiceKind } from "../Artifacts.ts";
+import { randomPortSpanStart, reserveNativePort } from "../Ports.ts";
+import type * as State from "../State.ts";
 import {
   makeArtifactStore,
   type ArtifactRequest,
@@ -98,6 +100,17 @@ const isPortOccupied = (port: number): Effect.Effect<boolean> =>
     });
   });
 
+// No saved stacks to consult.
+const testReadPortClaims = Effect.succeed([]);
+const testReserveNativePort = (
+  key: string,
+  claims: ReadonlyArray<State.StackClaims>,
+  excluded: ReadonlySet<number>,
+) =>
+  Effect.flatMap(Crypto.Crypto, (crypto) =>
+    reserveNativePort(claims, key, randomPortSpanStart(crypto), excluded),
+  ).pipe(Effect.provide(NodeCrypto.layer));
+
 describe("ProcessRecipe launch cleanup", () => {
   for (const scenario of [
     "partial launch",
@@ -188,8 +201,10 @@ describe("ProcessRecipe launch cleanup", () => {
             client: yield* HttpClient.HttpClient,
             spawner: yield* ChildProcessSpawner.ChildProcessSpawner,
             container,
+            readPortClaims: testReadPortClaims,
+            reserveNativePort: testReserveNativePort,
           } satisfies ProcessDependencies;
-          const recipe = yield* makeProcessRecipe(creation, options, dependencies, spec);
+          const recipe = yield* makeProcessRecipe(options, dependencies, spec);
           const service = yield* makeService(recipe.definition, {
             id: `rest-process-recipe-${scenario}`,
             config: creation,
@@ -275,8 +290,10 @@ describe("ProcessRecipe launch cleanup", () => {
           client,
           spawner,
           container: undefined,
+          readPortClaims: testReadPortClaims,
+          reserveNativePort: testReserveNativePort,
         } satisfies ProcessDependencies;
-        const recipe = yield* makeProcessRecipe(creation, nativeOptions, dependencies, nativeSpec);
+        const recipe = yield* makeProcessRecipe(nativeOptions, dependencies, nativeSpec);
         const service = yield* makeService(recipe.definition, {
           id: "rest-process-recipe-native",
           config: creation,
@@ -385,8 +402,10 @@ describe("ProcessRecipe launch cleanup", () => {
           client,
           spawner,
           container: undefined,
+          readPortClaims: testReadPortClaims,
+          reserveNativePort: testReserveNativePort,
         } satisfies ProcessDependencies;
-        const recipe = yield* makeProcessRecipe(creation, nativeOptions, dependencies, nativeSpec);
+        const recipe = yield* makeProcessRecipe(nativeOptions, dependencies, nativeSpec);
         const service = yield* makeService(recipe.definition, {
           id: "rest-process-recipe-port-order",
           config: creation,
@@ -443,7 +462,6 @@ const realtimeService = Effect.fn(function* (container: ContainerRuntime) {
     config: { databaseUrl: "postgresql://postgres:postgres@host.docker.internal:54322/postgres" },
   };
   const recipe = yield* makeProcessRecipe(
-    creation,
     {
       stackId: "process-recipe-test",
       instanceId: "instance",
@@ -458,6 +476,8 @@ const realtimeService = Effect.fn(function* (container: ContainerRuntime) {
       client: yield* HttpClient.HttpClient,
       spawner: yield* ChildProcessSpawner.ChildProcessSpawner,
       container,
+      readPortClaims: testReadPortClaims,
+      reserveNativePort: testReserveNativePort,
     },
     Realtime.makeSpec(),
   );
@@ -647,7 +667,6 @@ const nativeRestRecipe = Effect.fn(function* (
   const cacheRoot = path.join(root, "cache");
   yield* nativeRestArtifact(cacheRoot, program);
   return yield* makeProcessRecipe(
-    creation,
     {
       ...options,
       root,
@@ -655,7 +674,16 @@ const nativeRestRecipe = Effect.fn(function* (
       runtime: "native",
       platform: { os: process.platform, arch: process.arch },
     },
-    { fs, path, crypto, client, spawner, container: undefined },
+    {
+      fs,
+      path,
+      crypto,
+      client,
+      spawner,
+      container: undefined,
+      readPortClaims: testReadPortClaims,
+      reserveNativePort: testReserveNativePort,
+    },
     {
       ...spec,
       env: (_creation, endpoints) =>
@@ -915,7 +943,6 @@ describe("process recipe startup", () => {
             ),
         };
         const recipe = yield* makeProcessRecipe(
-          creation,
           {
             stackId: "process-recipe-port-race",
             instanceId: "instance",
@@ -924,13 +951,23 @@ describe("process recipe startup", () => {
             runtime: "native",
             platform: { os: process.platform, arch: process.arch },
           },
-          { fs, path, crypto, client, spawner: interceptingSpawner, container: undefined },
+          {
+            fs,
+            path,
+            crypto,
+            client,
+            spawner: interceptingSpawner,
+            container: undefined,
+            readPortClaims: testReadPortClaims,
+            reserveNativePort: testReserveNativePort,
+          },
           Pooler.makeSpec(),
         );
         if (recipe.definition.prepare !== undefined) yield* recipe.definition.prepare(creation);
         const scope = yield* Scope.fork(testScope, "sequential");
         const runtime = yield* recipe.definition.launch({
           id: "pooler",
+          launchId: 1,
           config: creation,
           scope,
         });
@@ -957,6 +994,79 @@ describe("process recipe startup", () => {
     ).pipe(Effect.provide(platform)),
   );
 
+  it.live("reserves a native backend port below the default ephemeral range", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const crypto = yield* Crypto.Crypto;
+        const client = yield* HttpClient.HttpClient;
+        const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+        const root = yield* fs.makeTempDirectoryScoped({ prefix: "process-recipe-port-range-" });
+        const cacheRoot = path.join(root, "cache");
+        yield* nativePoolerArtifact(cacheRoot);
+        const creation: Pooler.Creation = {
+          service: "pooler",
+          config: {
+            databaseUrl: "postgresql://postgres:postgres@127.0.0.1:5432/postgres",
+            jwtSecret: "pooler-port-range-test-secret-with-more-than-32-characters",
+            tenant: "port-range-test",
+            poolMode: "transaction",
+          },
+        };
+        // Pooler reserves "http" and "sql" concurrently; sharing one scan start forces both
+        // to contend for the same first candidate so the reservation has to skip one of them.
+        const sharedStart = Effect.succeed(yield* randomPortSpanStart(crypto));
+        const contendingReserveNativePort = (
+          key: string,
+          claims: ReadonlyArray<State.StackClaims>,
+          excluded: ReadonlySet<number>,
+        ) => reserveNativePort(claims, key, sharedStart, excluded);
+        const recipe = yield* makeProcessRecipe(
+          {
+            stackId: "process-recipe-port-range",
+            instanceId: "instance",
+            root,
+            cacheRoot,
+            runtime: "native",
+            platform: { os: process.platform, arch: process.arch },
+          },
+          {
+            fs,
+            path,
+            crypto,
+            client,
+            spawner,
+            container: undefined,
+            readPortClaims: testReadPortClaims,
+            reserveNativePort: contendingReserveNativePort,
+          },
+          Pooler.makeSpec(),
+        );
+        if (recipe.definition.prepare !== undefined) yield* recipe.definition.prepare(creation);
+        const scope = yield* Scope.fork(yield* Effect.scope, "sequential");
+        const runtime = yield* recipe.definition.launch({
+          id: "pooler",
+          launchId: 1,
+          config: creation,
+          scope,
+        });
+        yield* runtime.health;
+        const endpoints = yield* Ref.get(recipe.endpoints);
+        const endpoint = endpoints.get("http");
+        // Below Linux's default ephemeral range, so the released probe port isn't handed to an
+        // outgoing connection there; a custom host dynamic range can still overlap (ADR 0017).
+        expect(endpoint?.port).toBeGreaterThanOrEqual(20000);
+        expect(endpoint?.port).toBeLessThan(32768);
+        // Pooler reserves "http" and "sql" concurrently; they must never settle on the same port.
+        const sql = endpoints.get("sql");
+        expect(sql?.port).toBeDefined();
+        expect(sql?.port).not.toBe(endpoint?.port);
+        yield* runtime.stop;
+      }),
+    ).pipe(Effect.provide(platform)),
+  );
+
   it.live("stops after three consecutive native Pooler port collisions", () =>
     Effect.scoped(
       Effect.gen(function* () {
@@ -982,7 +1092,6 @@ describe("process recipe startup", () => {
           },
         };
         const recipe = yield* makeProcessRecipe(
-          creation,
           {
             stackId: "process-recipe-port-exhaustion",
             instanceId: "instance",
@@ -998,6 +1107,8 @@ describe("process recipe startup", () => {
             client,
             spawner: countingSpawner(spawner, mainLaunches, startupLaunches, true),
             container: undefined,
+            readPortClaims: testReadPortClaims,
+            reserveNativePort: testReserveNativePort,
           },
           Pooler.makeSpec(),
         );
@@ -1116,7 +1227,6 @@ describe("process recipe startup", () => {
           },
         };
         const recipe = yield* makeProcessRecipe(
-          creation,
           {
             stackId: "process-recipe-deadline",
             instanceId: "instance",
@@ -1125,12 +1235,26 @@ describe("process recipe startup", () => {
             runtime: "native",
             platform: { os: process.platform, arch: process.arch },
           },
-          { fs, path, crypto, client, spawner: deadlineSpawner, container: undefined },
+          {
+            fs,
+            path,
+            crypto,
+            client,
+            spawner: deadlineSpawner,
+            container: undefined,
+            readPortClaims: testReadPortClaims,
+            reserveNativePort: testReserveNativePort,
+          },
           Pooler.makeSpec(),
         );
         if (recipe.definition.prepare !== undefined) yield* recipe.definition.prepare(creation);
         const scope = yield* Scope.fork(yield* Effect.scope, "sequential");
-        const runtime = yield* recipe.definition.launch({ id: "pooler", config: creation, scope });
+        const runtime = yield* recipe.definition.launch({
+          id: "pooler",
+          launchId: 1,
+          config: creation,
+          scope,
+        });
         const health = yield* Effect.flip(runtime.health).pipe(Effect.forkChild);
         yield* Deferred.await(clockAdvanced);
         const failure = yield* Fiber.join(health);
@@ -1171,7 +1295,6 @@ describe("process recipe startup", () => {
           },
         };
         const recipe = yield* makeProcessRecipe(
-          creation,
           {
             stackId: "process-recipe-unrelated-failure",
             instanceId: "instance",
@@ -1187,12 +1310,19 @@ describe("process recipe startup", () => {
             client,
             spawner: countingSpawner(spawner, mainLaunches, startupLaunches),
             container: undefined,
+            readPortClaims: testReadPortClaims,
+            reserveNativePort: testReserveNativePort,
           },
           Pooler.makeSpec(),
         );
         if (recipe.definition.prepare !== undefined) yield* recipe.definition.prepare(creation);
         const scope = yield* Scope.fork(yield* Effect.scope, "sequential");
-        const runtime = yield* recipe.definition.launch({ id: "pooler", config: creation, scope });
+        const runtime = yield* recipe.definition.launch({
+          id: "pooler",
+          launchId: 1,
+          config: creation,
+          scope,
+        });
         const health = yield* Effect.exit(runtime.health);
         expect(yield* Ref.get(mainLaunches)).toBe(1);
         expect(yield* Ref.get(startupLaunches)).toEqual(["prepare", "provision-tenant"]);
@@ -1275,7 +1405,6 @@ describe("process recipe startup", () => {
           },
         };
         const recipe = yield* makeProcessRecipe(
-          creation,
           {
             stackId: "process-recipe-exit-failure",
             instanceId: "instance",
@@ -1284,12 +1413,26 @@ describe("process recipe startup", () => {
             runtime: "native",
             platform: { os: process.platform, arch: process.arch },
           },
-          { fs, path, crypto, client, spawner: failingSpawner, container: undefined },
+          {
+            fs,
+            path,
+            crypto,
+            client,
+            spawner: failingSpawner,
+            container: undefined,
+            readPortClaims: testReadPortClaims,
+            reserveNativePort: testReserveNativePort,
+          },
           Pooler.makeSpec(),
         );
         if (recipe.definition.prepare !== undefined) yield* recipe.definition.prepare(creation);
         const scope = yield* Scope.fork(yield* Effect.scope, "sequential");
-        const runtime = yield* recipe.definition.launch({ id: "pooler", config: creation, scope });
+        const runtime = yield* recipe.definition.launch({
+          id: "pooler",
+          launchId: 1,
+          config: creation,
+          scope,
+        });
         const health = yield* Effect.exit(runtime.health);
         expect(Exit.isFailure(health)).toBe(true);
         const exit = yield* runtime.exit;
diff --git a/packages/stack/src/services/ProcessRecipe.ts b/packages/stack/src/services/ProcessRecipe.ts
index 73a81799b9..1845cef70e 100644
--- a/packages/stack/src/services/ProcessRecipe.ts
+++ b/packages/stack/src/services/ProcessRecipe.ts
@@ -1,3 +1,4 @@
+import { withAttemptCount } from "../internal/attempts.ts";
 import {
   Cause,
   Clock,
@@ -19,9 +20,9 @@ import {
 import { ChildProcessSpawner } from "effect/unstable/process";
 import type { ChildProcessSpawner as ChildProcessSpawnerService } from "effect/unstable/process/ChildProcessSpawner";
 import { HttpClient, HttpClientRequest } from "effect/unstable/http";
-import * as Net from "node:net";
 import { prepareNativeArtifact, resolveArtifact, type ServiceKind } from "../Artifacts.ts";
-import { accepts } from "../Ports.ts";
+import { accepts, type NativePortReservation, type PortError } from "../Ports.ts";
+import type * as State from "../State.ts";
 import {
   type ContainerError,
   type ContainerProcess,
@@ -35,20 +36,26 @@ import {
   spawnNativeProcess,
 } from "../runtime/NativeProcess.ts";
 import {
+  launchOutputPublisher,
   mapToServiceError,
   processExit as sharedProcessExit,
   publishProcessLogs,
   runtimeSessionFromContainer,
+  type LaunchOutput,
+  type PublishOutput,
 } from "../runtime/Session.ts";
-import { ServiceError, ServiceLaunchError, type RuntimeSession } from "../Service.ts";
+import {
+  ServiceError,
+  ServiceLaunchError,
+  type RuntimeSession,
+  type ServiceLaunchContext,
+} from "../Service.ts";
 import {
   containerInstancePath,
   ensureOwnedInstanceRoot,
   removeOwnedInstanceRoot,
 } from "./InstanceRoot.ts";
 import {
-  type CatalogLog,
-  CatalogError,
   type CatalogOptions,
   type ProcessRecipeResult,
   type RecipeCreation,
@@ -161,20 +168,18 @@ export interface ProcessDependencies {
   readonly client: HttpClient.HttpClient;
   readonly spawner: ChildProcessSpawnerService["Service"];
   readonly container: ContainerRuntime | undefined;
+  readonly readPortClaims: Effect.Effect<ReadonlyArray<State.StackClaims>, State.StateError>;
+  readonly reserveNativePort: (
+    key: string,
+    claims: ReadonlyArray<State.StackClaims>,
+    excluded: ReadonlySet<number>,
+  ) => Effect.Effect<NativePortReservation, PortError, Scope.Scope>;
 }
 
 const serviceError = mapToServiceError;
 
 const describeProcessExit = (code: number) => `Process exited with ${code}`;
 
-const catalogError = (operation: string, message: string, service?: ServiceKind, cause?: unknown) =>
-  new CatalogError({
-    operation,
-    message,
-    ...(service === undefined ? {} : { service }),
-    ...(cause === undefined ? {} : { cause }),
-  });
-
 const processExit = (
   exitCode: Effect.Effect<number, { readonly message: string }>,
 ): Effect.Effect<Exit.Exit<void, ServiceError>> => sharedProcessExit(exitCode, describeProcessExit);
@@ -189,50 +194,6 @@ const runtimeFromNative = (process: NativeProcess): RuntimeSession => ({
   remove: Effect.void,
 });
 
-interface NativePortReservation {
-  readonly port: number;
-  readonly server: Net.Server;
-}
-
-const closeNativePort = (server: Net.Server): Effect.Effect<void> =>
-  Effect.callback<void, never>((resume) => {
-    if (!server.listening) {
-      resume(Effect.void);
-      return Effect.void;
-    }
-    server.close(() => resume(Effect.void));
-    return Effect.void;
-  });
-
-const reserveNativePort = Effect.fn("ProcessRecipe.reserveNativePort")(
-  (requested: number): Effect.Effect<NativePortReservation, CatalogError, Scope.Scope> =>
-    Effect.acquireRelease(
-      Effect.callback<NativePortReservation, CatalogError>((resume) => {
-        const server = Net.createServer((socket) => socket.destroy());
-        const onError = (cause: Error) =>
-          resume(
-            Effect.fail(
-              catalogError("launch", "Unable to reserve native service port", undefined, cause),
-            ),
-          );
-        server.once("error", onError);
-        server.listen({ host: "127.0.0.1", port: requested }, () => {
-          const address = server.address();
-          if (address === null || typeof address === "string") {
-            onError(new Error("Native service port reservation returned no address"));
-          } else {
-            resume(Effect.succeed({ port: address.port, server }));
-          }
-        });
-        return Effect.sync(() => {
-          server.off("error", onError);
-          if (server.listening) server.close();
-        });
-      }),
-      ({ server }) => closeNativePort(server),
-    ),
-);
-
 const startupTimeoutSeconds = 60;
 const nativeLaunchAttempts = 3;
 const probeTimeout = Duration.seconds(10);
@@ -240,7 +201,7 @@ const outputDrainGrace = Duration.seconds(2);
 const startupOutputTailLines = 20;
 const startupOutputLineChars = 1_000;
 
-type StartupOutput = Readonly<Record<CatalogLog["stream"], ReadonlyArray<string>>>;
+type StartupOutput = Readonly<Record<LaunchOutput["stream"], ReadonlyArray<string>>>;
 
 const clipLine = (line: string) =>
   line.length > startupOutputLineChars
@@ -263,14 +224,14 @@ const awaitStartup = Effect.fn("ProcessRecipe.awaitStartup")(
       readonly stderr: Stream.Stream<Uint8Array, NativeProcessError | ContainerError>;
       readonly exitCode: Effect.Effect<number, NativeProcessError | ContainerError>;
     },
-    logs: PubSub.PubSub<CatalogLog>,
+    publish: PublishOutput,
   ): Effect.Effect<
     Readonly<{ readonly code: number; readonly output: StartupOutput }>,
     ServiceError
   > =>
     awaitCommandOutput(process, {
       timeout: Duration.seconds(startupTimeoutSeconds),
-      onOutput: (stream, bytes) => PubSub.publish(logs, { stream, bytes }),
+      onOutput: publish,
     }).pipe(
       Effect.mapError((cause) => serviceError("launch", cause)),
       Effect.flatMap((result) =>
@@ -313,7 +274,7 @@ const anotherListenerHolds = (endpoints: ReadonlyMap<string, ServiceEndpoint>) =
 
 const collectNativeOutput = Effect.fn("ProcessRecipe.collectNativeOutput")(function* (
   process: NativeProcess,
-  logs: PubSub.PubSub<CatalogLog>,
+  publish: PublishOutput,
   endpoints: ReadonlyMap<string, ServiceEndpoint>,
   readinessOutput:
     | ((line: string, endpoints: ReadonlyMap<string, ServiceEndpoint>) => boolean)
@@ -328,7 +289,7 @@ const collectNativeOutput = Effect.fn("ProcessRecipe.collectNativeOutput")(funct
 
   const consume = Effect.fnUntraced(function* (
     stream: Stream.Stream<Uint8Array, NativeProcessError>,
-    name: CatalogLog["stream"],
+    name: LaunchOutput["stream"],
     tail: Ref.Ref<ReadonlyArray<string>>,
   ) {
     const partial = yield* Ref.make("");
@@ -348,7 +309,7 @@ const collectNativeOutput = Effect.fn("ProcessRecipe.collectNativeOutput")(funct
         { discard: true },
       );
     yield* stream.pipe(
-      Stream.tap((bytes) => PubSub.publish(logs, { stream: name, bytes })),
+      Stream.tap((bytes) => publish(name, bytes)),
       Stream.decodeText,
       Stream.runForEach((text) =>
         Ref.modify(
@@ -385,14 +346,15 @@ const collectNativeOutput = Effect.fn("ProcessRecipe.collectNativeOutput")(funct
   return { bindReady, bindError, stdout, stderr, drained };
 });
 
-const readiness = Effect.fn("ProcessRecipe.readiness")(
-  (
-    client: HttpClient.HttpClient,
-    endpoint: ServiceEndpoint,
-    path: string,
-    timeout: Duration.Input = "60 seconds",
-  ): Effect.Effect<void, ServiceError> =>
-    client.execute(HttpClientRequest.get(`http://${endpoint.host}:${endpoint.port}${path}`)).pipe(
+const readiness = Effect.fn("ProcessRecipe.readiness")(function* (
+  client: HttpClient.HttpClient,
+  endpoint: ServiceEndpoint,
+  path: string,
+  timeout: Duration.Input = "60 seconds",
+) {
+  const attempt = client
+    .execute(HttpClientRequest.get(`http://${endpoint.host}:${endpoint.port}${path}`))
+    .pipe(
       Effect.flatMap((response) =>
         (response.status >= 200 && response.status < 300) || response.status === 401
           ? Effect.void
@@ -400,15 +362,18 @@ const readiness = Effect.fn("ProcessRecipe.readiness")(
               new ServiceError({ operation: "health", message: `HTTP ${response.status}` }),
             ),
       ),
+    );
+  return yield* withAttemptCount(attempt, (counted) =>
+    counted.pipe(
       Effect.retry({ schedule: Schedule.spaced("250 millis") }),
       Effect.timeout(timeout),
       Effect.mapError((cause) => serviceError("health", cause)),
       Effect.asVoid,
     ),
-);
+  );
+});
 
 export const makeProcessRecipe = <C extends RecipeCreation<ServiceKind, unknown>>(
-  creation: C,
   options: CatalogOptions,
   deps: ProcessDependencies,
   spec: ProcessRecipeSpec<C>,
@@ -417,7 +382,7 @@ export const makeProcessRecipe = <C extends RecipeCreation<ServiceKind, unknown>
     const prepared = yield* Ref.make<string | undefined>(undefined);
     const preparedRoot = yield* Ref.make<string | undefined>(undefined);
     const endpoints = yield* Ref.make<ReadonlyMap<string, ServiceEndpoint>>(new Map());
-    const logs = yield* PubSub.sliding<CatalogLog>(256);
+    const logs = yield* PubSub.sliding<LaunchOutput>(256);
     const instanceRoot = deps.path.join(options.root, options.instanceId);
     const ownedInstanceRoot = {
       fs: deps.fs,
@@ -464,11 +429,8 @@ export const makeProcessRecipe = <C extends RecipeCreation<ServiceKind, unknown>
       }
     });
 
-    const launch = Effect.fn("ProcessRecipe.launch")(function* (context: {
-      readonly id: string;
-      readonly config: C;
-      readonly scope: Scope.Closeable;
-    }) {
+    const launch = Effect.fn("ProcessRecipe.launch")(function* (context: ServiceLaunchContext<C>) {
+      const output = yield* launchOutputPublisher(logs, context.launchId);
       const portNames = Object.entries(spec.ports).filter(
         ([name]) => spec.enabledPort === undefined || spec.enabledPort(context.config, name),
       );
@@ -479,13 +441,26 @@ export const makeProcessRecipe = <C extends RecipeCreation<ServiceKind, unknown>
           return yield* serviceError("launch", "Artifact was not prepared");
         if (artifactRoot === undefined)
           return yield* serviceError("launch", "Artifact root was not prepared");
+        const keyFor = (name: string) => `${options.instanceId}:${context.id}:${name}`;
+        // A port a prior attempt lost stays excluded so a retry advances instead of repeating it.
+        const excludedByKey = yield* Ref.make<ReadonlyMap<string, ReadonlySet<number>>>(new Map());
         const reserveEndpoints = Effect.fn("ProcessRecipe.reserveEndpoints")(function* (
           parent: Scope.Closeable,
         ) {
           const portScope = yield* Scope.fork(parent, "sequential");
-          const reservations = yield* Effect.forEach(portNames, () => reserveNativePort(0), {
-            concurrency: 1,
-          }).pipe(
+          const excluded = yield* Ref.get(excludedByKey);
+          // Read once and share across this batch; a later retry attempt re-reads it.
+          const claims = yield* deps.readPortClaims.pipe(
+            Effect.mapError((cause) => serviceError("launch", cause)),
+          );
+          const reservations = yield* Effect.forEach(
+            portNames,
+            ([name]) =>
+              deps.reserveNativePort(keyFor(name), claims, excluded.get(keyFor(name)) ?? new Set()),
+            // Each reservation holds its bound probe listener until the batch releases, so two
+            // endpoints never settle on the same port even when reserved concurrently.
+            { concurrency: "unbounded" },
+          ).pipe(
             Scope.provide(portScope),
             Effect.mapError((cause) => serviceError("launch", cause)),
           );
@@ -543,7 +518,11 @@ export const makeProcessRecipe = <C extends RecipeCreation<ServiceKind, unknown>
               Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, deps.spawner),
               Effect.mapError((cause) => serviceError("launch", cause)),
             );
-            const result = yield* awaitStartup(context.config.service, startupProcess, logs).pipe(
+            const result = yield* awaitStartup(
+              context.config.service,
+              startupProcess,
+              yield* output.part,
+            ).pipe(
               Effect.mapError(
                 (failure) =>
                   new ServiceLaunchError({ failure, runtime: runtimeFromNative(startupProcess) }),
@@ -588,15 +567,15 @@ export const makeProcessRecipe = <C extends RecipeCreation<ServiceKind, unknown>
             Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, deps.spawner),
             Effect.mapError((cause) => serviceError("launch", cause)),
           );
-          const output = yield* collectNativeOutput(
+          const collected = yield* collectNativeOutput(
             native,
-            logs,
+            yield* output.part,
             selected,
             spec.nativeReadinessOutput,
             scope,
           );
           yield* Ref.set(endpoints, selected);
-          return { native, output, selected, scope };
+          return { native, output: collected, selected, scope };
         });
         type NativeAttempt = Effect.Success<ReturnType<typeof spawnAttempt>>;
 
@@ -701,6 +680,15 @@ export const makeProcessRecipe = <C extends RecipeCreation<ServiceKind, unknown>
               (!(yield* Deferred.isDone(attempt.output.bindReady)) &&
                 (yield* anotherListenerHolds(attempt.selected))));
           if (!collided) return yield* settleFailure(failure);
+          yield* Ref.update(excludedByKey, (current) => {
+            const next = new Map(current);
+            for (const [name, endpoint] of attempt.selected) {
+              if (endpoint.kind !== "tcp") continue;
+              const key = keyFor(name);
+              next.set(key, new Set([...(next.get(key) ?? []), endpoint.port]));
+            }
+            return next;
+          });
           return yield* new NativePortCollision({
             failure: serviceError(
               "launch",
@@ -777,7 +765,11 @@ export const makeProcessRecipe = <C extends RecipeCreation<ServiceKind, unknown>
             ),
             Scope.provide(context.scope),
           );
-        const result = yield* awaitStartup(context.config.service, startupProcess, logs).pipe(
+        const result = yield* awaitStartup(
+          context.config.service,
+          startupProcess,
+          yield* output.part,
+        ).pipe(
           Effect.mapError(
             (failure) =>
               new ServiceLaunchError({
@@ -844,7 +836,7 @@ export const makeProcessRecipe = <C extends RecipeCreation<ServiceKind, unknown>
         selected.set(name, { kind: "tcp", host: "127.0.0.1", port: published });
       }
       yield* Ref.set(endpoints, selected);
-      yield* publishProcessLogs(launched, logs, context.scope);
+      yield* publishProcessLogs(launched, yield* output.part, context.scope);
       const runtime = runtimeFromContainer(launched);
       const ready = selected.get("http");
       const noReadinessEndpoint = Effect.fail(
@@ -879,8 +871,6 @@ export const makeProcessRecipe = <C extends RecipeCreation<ServiceKind, unknown>
           ).pipe(Effect.andThen(Ref.set(endpoints, new Map()))),
       },
       endpoints,
-      logs: Stream.fromPubSub(logs).pipe(
-        Stream.mapError((cause) => catalogError("logs", String(cause), creation.service)),
-      ),
+      logs: PubSub.subscribe(logs),
     };
   });
diff --git a/packages/stack/src/services/Realtime.integration.test.ts b/packages/stack/src/services/Realtime.integration.test.ts
index 3d495a5ef9..06922425c0 100644
--- a/packages/stack/src/services/Realtime.integration.test.ts
+++ b/packages/stack/src/services/Realtime.integration.test.ts
@@ -40,6 +40,7 @@ describe("service catalog", () => {
               },
             },
             dockerOptions(root),
+            Effect.succeed([]),
           );
           const database = yield* makeService(databaseRecipe.definition, {
             id: "database",
@@ -53,6 +54,7 @@ describe("service catalog", () => {
           const realtimeRecipe = yield* makeServiceRecipe(
             { service: "realtime", config: { databaseUrl, jwtSecret: secret } },
             dockerOptions(root),
+            Effect.succeed([]),
           );
           const realtime = yield* makeService(realtimeRecipe.definition, {
             id: "realtime",
@@ -71,6 +73,7 @@ describe("service catalog", () => {
           const pgmetaRecipe = yield* makeServiceRecipe(
             { service: "pgmeta", config: { databaseUrl } },
             dockerOptions(root),
+            Effect.succeed([]),
           );
           const pgmeta = yield* makeService(pgmetaRecipe.definition, {
             id: "pgmeta",
@@ -99,6 +102,7 @@ describe("service catalog", () => {
               },
             },
             dockerOptions(root),
+            Effect.succeed([]),
           );
           const studio = yield* makeService(studioRecipe.definition, {
             id: "studio",
diff --git a/packages/stack/src/services/Recipe.ts b/packages/stack/src/services/Recipe.ts
index 940e1f5f38..e6e9aa3a00 100644
--- a/packages/stack/src/services/Recipe.ts
+++ b/packages/stack/src/services/Recipe.ts
@@ -1,7 +1,7 @@
 import { Data, Schema } from "effect";
-import type { Stream } from "effect";
-import type { Effect, Ref } from "effect";
+import type { Effect, PubSub, Ref, Scope } from "effect";
 import type { ServiceKind } from "../Artifacts.ts";
+import type { LaunchOutput } from "../runtime/Session.ts";
 import type { ServiceDefinition } from "../Service.ts";
 import type { HostGateway } from "../runtime/Container.ts";
 import type { DockerHelperRegistry } from "../storage/DockerHelperRegistry.ts";
@@ -58,16 +58,14 @@ export interface CatalogOptions {
   readonly hostGateway?: HostGateway;
 }
 
-export interface CatalogLog {
-  readonly stream: "stdout" | "stderr";
-  readonly bytes: Uint8Array;
-}
+/** Subscribes to a recipe's launch output; chunks published before the subscription are missed. */
+export type CatalogLogs = Effect.Effect<PubSub.Subscription<LaunchOutput>, never, Scope.Scope>;
 
 export interface CatalogRecipe<C> {
   readonly creation: C;
   readonly definition: ServiceDefinition<C>;
   readonly endpoint: (name: string) => Effect.Effect<ServiceEndpoint, CatalogError>;
-  readonly logs: Stream.Stream<CatalogLog, CatalogError>;
+  readonly logs: CatalogLogs;
 }
 
 export interface RecipeCreation<K extends ServiceKind, C> {
@@ -80,5 +78,5 @@ export interface RecipeCreation<K extends ServiceKind, C> {
 export interface ProcessRecipeResult<C> {
   readonly definition: ServiceDefinition<C>;
   readonly endpoints: Ref.Ref<ReadonlyMap<string, ServiceEndpoint>>;
-  readonly logs: Stream.Stream<CatalogLog, CatalogError>;
+  readonly logs: CatalogLogs;
 }
diff --git a/packages/stack/src/services/Rest.integration.test.ts b/packages/stack/src/services/Rest.integration.test.ts
index a8d87db95f..0f902e8bbe 100644
--- a/packages/stack/src/services/Rest.integration.test.ts
+++ b/packages/stack/src/services/Rest.integration.test.ts
@@ -74,6 +74,7 @@ describe("service catalog", () => {
               },
             },
             dockerOptions(root),
+            Effect.succeed([]),
           );
           const database = yield* makeService(databaseRecipe.definition, {
             id: "database",
@@ -139,6 +140,7 @@ describe("service catalog", () => {
               },
             },
             dockerOptions(root),
+            Effect.succeed([]),
           );
           const rest = yield* makeService(restRecipe.definition, {
             id: "rest",
@@ -216,6 +218,7 @@ describe("service catalog", () => {
             },
           },
           { ...options(root), stackId, cacheRoot: `${tmpdir()}/supabase-stack-artifacts` },
+          Effect.succeed([]),
         );
         const database = yield* makeService(databaseRecipe.definition, {
           id: "database",
@@ -256,6 +259,7 @@ describe("service catalog", () => {
             },
           },
           { ...options(root), stackId, cacheRoot: `${tmpdir()}/supabase-stack-artifacts` },
+          Effect.succeed([]),
         );
         const rest = yield* makeService(restRecipe.definition, {
           id: "rest",
diff --git a/packages/stack/src/services/Rest.ts b/packages/stack/src/services/Rest.ts
index bbd80ef641..0d913c6158 100644
--- a/packages/stack/src/services/Rest.ts
+++ b/packages/stack/src/services/Rest.ts
@@ -42,6 +42,8 @@ export const makeSpec = (): ProcessRecipeSpec<Creation> => ({
           : { PGRST_DB_EXTRA_SEARCH_PATH: creation.config.extraSearchPath }),
         PGRST_DB_ANON_ROLE: creation.config.anonRole ?? "anon",
         PGRST_DB_MAX_ROWS: String(creation.config.maxRows ?? 1000),
+        // `info` logs every request, which Studio's PostgREST logs page shows.
+        PGRST_LOG_LEVEL: "info",
         ...(jwtSecret === undefined ? {} : { PGRST_JWT_SECRET: jwtSecret }),
         ...(creation.config.externalApiUrl === undefined
           ? {}
diff --git a/packages/stack/src/services/Vector.integration.test.ts b/packages/stack/src/services/Vector.integration.test.ts
deleted file mode 100644
index 2eba9f07ec..0000000000
--- a/packages/stack/src/services/Vector.integration.test.ts
+++ /dev/null
@@ -1,122 +0,0 @@
-import { NodeHttpClient, NodeServices } from "@effect/platform-node";
-import { describe, expect, it } from "@effect/vitest";
-import { tmpdir } from "node:os";
-import { Effect, FileSystem, Layer } from "effect";
-import { HttpClient, HttpClientRequest } from "effect/unstable/http";
-import { makeService } from "../Service.ts";
-import { makeServiceRecipe } from "./Catalog.ts";
-
-const options = (root: string, runtime: "docker" | "native") => ({
-  stackId: "catalog-test",
-  instanceId: "vector",
-  root,
-  cacheRoot: `${tmpdir()}/supabase-stack-artifacts`,
-  runtime,
-});
-
-describe("vector recipe", () => {
-  for (const runtime of ["docker", "native"] as const) {
-    it.live(
-      `serves health without a custom config and cleans up on destroy, including interrupted writes (${runtime})`,
-      () =>
-        Effect.scoped(
-          Effect.gen(function* () {
-            const fs = yield* FileSystem.FileSystem;
-            const client = yield* HttpClient.HttpClient;
-            const root = yield* fs.makeTempDirectoryScoped({
-              prefix: `catalog-vector-${runtime}-`,
-            });
-            const recipe = yield* makeServiceRecipe(
-              {
-                service: "vector",
-                config: { analyticsUrl: "http://analytics", apiKey: "api-key" },
-                endpoints: { http: { port: "auto" } },
-              },
-              options(root, runtime),
-            );
-            const vector = yield* makeService(recipe.definition, {
-              id: "vector",
-              config: recipe.creation,
-            });
-            yield* vector.start;
-            yield* vector.ready;
-            const endpoint = yield* recipe.endpoint("http");
-            const response = yield* client.execute(
-              HttpClientRequest.get(`http://${endpoint.host}:${endpoint.port}/health`),
-            );
-            expect(response.status).toBe(200);
-            yield* fs.makeDirectory(`${root}/vector/runtime/vector/.vector-write-interrupted`);
-            yield* vector.destroy;
-            expect(yield* fs.exists(`${root}/vector`)).toBe(false);
-          }),
-        ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
-      { timeout: 120_000 },
-    );
-  }
-
-  it.live(
-    "keeps a caller pipeline stored beside the recipe config on destroy",
-    () =>
-      Effect.scoped(
-        Effect.gen(function* () {
-          const fs = yield* FileSystem.FileSystem;
-          const root = yield* fs.makeTempDirectoryScoped({ prefix: "catalog-vector-caller-" });
-          const pipeline = `${root}/vector/runtime/vector/pipeline.yaml`;
-          yield* fs.makeDirectory(`${root}/vector/runtime/vector`, { recursive: true });
-          yield* fs.writeFileString(
-            pipeline,
-            "sources:\n  s:\n    type: internal_logs\nsinks:\n  d:\n    type: blackhole\n    inputs: [s]\n",
-          );
-          const recipe = yield* makeServiceRecipe(
-            {
-              service: "vector",
-              config: { analyticsUrl: "http://analytics", configPath: pipeline },
-              endpoints: { http: { port: "auto" } },
-            },
-            options(root, "docker"),
-          );
-          const vector = yield* makeService(recipe.definition, {
-            id: "vector",
-            config: recipe.creation,
-          });
-          yield* vector.start;
-          yield* vector.ready;
-          yield* vector.destroy;
-          expect(yield* fs.exists(pipeline)).toBe(true);
-          expect(yield* fs.exists(`${root}/vector/runtime/vector/vector-api.yaml`)).toBe(false);
-        }),
-      ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
-    { timeout: 120_000 },
-  );
-
-  it.live("rejects a caller pipeline that resolves to a stack-owned config file", () =>
-    Effect.scoped(
-      Effect.gen(function* () {
-        const fs = yield* FileSystem.FileSystem;
-        const root = yield* fs.makeTempDirectoryScoped({ prefix: "catalog-vector-reject-" });
-        const owned = `${root}/vector/runtime/vector/vector-api.yaml`;
-        yield* fs.makeDirectory(`${root}/vector/runtime/vector`, { recursive: true });
-        yield* fs.writeFileString(owned, "api:\n  enabled: true\n");
-        yield* fs.symlink(owned, `${root}/alias.yaml`);
-        const start = (configPath: string) =>
-          Effect.gen(function* () {
-            const recipe = yield* makeServiceRecipe(
-              {
-                service: "vector",
-                config: { analyticsUrl: "http://analytics", configPath },
-                endpoints: { http: { port: "auto" } },
-              },
-              options(root, "docker"),
-            );
-            const vector = yield* makeService(recipe.definition, {
-              id: "vector",
-              config: recipe.creation,
-            });
-            return yield* vector.start.pipe(Effect.flip);
-          });
-        for (const configPath of [owned, `${root}/alias.yaml`])
-          expect((yield* start(configPath)).message).toContain("stack-owned Vector config file");
-      }),
-    ).pipe(Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp))),
-  );
-});
diff --git a/packages/stack/src/services/Vector.ts b/packages/stack/src/services/Vector.ts
deleted file mode 100644
index aeab546a93..0000000000
--- a/packages/stack/src/services/Vector.ts
+++ /dev/null
@@ -1,252 +0,0 @@
-import { Effect, type FileSystem, type Path, Schema } from "effect";
-import { ServiceError } from "../Service.ts";
-import { type CatalogOptions, EndpointIntent, serviceCreation } from "./Recipe.ts";
-import { requiredInput } from "./ServiceConfig.ts";
-import {
-  makeProcessRecipe,
-  type ProcessDependencies,
-  type ProcessRecipeSpec,
-} from "./ProcessRecipe.ts";
-
-export const Config = Schema.Struct({
-  analyticsUrl: Schema.optionalKey(Schema.String),
-  apiKey: Schema.optionalKey(Schema.String),
-  /** Pipeline config without an `api` block; the recipe adds its own. */
-  configPath: Schema.optionalKey(Schema.String),
-});
-export interface Config extends Schema.Schema.Type<typeof Config> {}
-export const Endpoints = Schema.Struct({ http: Schema.optionalKey(EndpointIntent) });
-export interface Endpoints extends Schema.Schema.Type<typeof Endpoints> {}
-export const Creation = serviceCreation("vector", Config, Endpoints);
-export interface Creation extends Schema.Schema.Type<typeof Creation> {}
-
-/**
- * Vector has no API flag or env var, so the recipe loads this alongside the pipeline config.
- * `address` is templated directly into the file content at write time (not through Vector's own
- * `${VAR}` config interpolation, which 0.58 disabled by default) — this is the only stack-owned
- * config Vector loads that ever varied per launch, so no interpolation flag is needed at all.
- */
-const apiConfigFor = (address: string | undefined): string =>
-  address === undefined
-    ? "api:\n  enabled: false\n"
-    : `api:\n  enabled: true\n  address: "${address}"\n`;
-
-/**
- * Every `${VAR}` name the recipe's own `env` sets and documents for a pipeline config
- * (`Config.analyticsUrl`/`apiKey`, mirrored into `LOGFLARE_URL`/`LOGFLARE_PRIVATE_ACCESS_TOKEN`).
- * A caller-supplied pipeline (`Config.configPath`) may reference these the same way the recipe's
- * own API config used to. `renderKnownPlaceholders` substitutes only this closed, recipe-owned
- * set directly into the file at write time — never a caller's or the process's arbitrary
- * environment — so a caller config keeps working on Vector 0.58 without the recipe ever passing
- * `--dangerously-allow-env-var-interpolation` (which would expose every env var, not just these).
- */
-const renderKnownPlaceholders = (
-  content: string,
-  values: Readonly<Record<string, string | undefined>>,
-): string =>
-  Object.entries(values).reduce(
-    (rendered, [name, value]) =>
-      value === undefined ? rendered : rendered.replaceAll(`\${${name}}`, value),
-    content,
-  );
-
-// Vector requires at least one source and sink; the default forwards nothing.
-const defaultPipelineConfig = [
-  "sources:",
-  "  vector_logs:",
-  "    type: internal_logs",
-  "sinks:",
-  "  discard:",
-  "    type: blackhole",
-  "    inputs: [vector_logs]",
-  "    print_interval_secs: 0",
-  "",
-].join("\n");
-
-const containerPipelinePath = "/etc/vector/vector.yaml";
-const containerApiPath = "/etc/supabase/vector-api.yaml";
-const temporaryPrefix = ".vector-write-";
-
-const writeAtomically = Effect.fn("Vector.writeAtomically")(
-  function* (fs: FileSystem.FileSystem, path: Path.Path, target: string, content: string) {
-    const directory = path.dirname(target);
-    yield* fs.makeDirectory(directory, { recursive: true, mode: 0o700 });
-    yield* Effect.acquireUseRelease(
-      fs.makeTempDirectory({ directory, prefix: temporaryPrefix }),
-      (temporaryDirectory) =>
-        Effect.gen(function* () {
-          const temporary = path.join(temporaryDirectory, path.basename(target));
-          yield* fs.writeFileString(temporary, content, { mode: 0o644 });
-          yield* fs.rename(temporary, target);
-        }),
-      (temporaryDirectory) =>
-        fs
-          .remove(temporaryDirectory, { recursive: true, force: true })
-          .pipe(Effect.catchTag("PlatformError", () => Effect.void)),
-    );
-  },
-  Effect.mapError(
-    (cause) =>
-      new ServiceError({ operation: "prepare", message: "Unable to write Vector config", cause }),
-  ),
-);
-
-const makeSpec = (
-  instanceId: string,
-  instanceRoot: string,
-  fs: FileSystem.FileSystem,
-  path: Path.Path,
-): ProcessRecipeSpec<Creation> => {
-  const configRoot = path.join(instanceRoot, "runtime", "vector");
-  const apiConfigPath = path.join(configRoot, "vector-api.yaml");
-  const defaultPipelinePath = path.join(configRoot, "vector.yaml");
-  const renderedPipelinePath = path.join(configRoot, "vector.rendered.yaml");
-  /** What Vector actually loads: a caller's file is rendered to a recipe-owned copy first. */
-  const resolvedPipelinePath = (creation: Creation) =>
-    creation.config.configPath === undefined ? defaultPipelinePath : renderedPipelinePath;
-  const ownedInstance = (operation: string) =>
-    /^[a-zA-Z0-9_-]+$/u.test(instanceId)
-      ? Effect.void
-      : Effect.fail(new ServiceError({ operation, message: "Invalid Vector instance identity" }));
-  return {
-    service: "vector",
-    executable: "bin/vector",
-    ports: { http: 9001 },
-    healthPath: "/health",
-    env: (creation, _endpoints, _container) =>
-      requiredInput("vector", "analyticsUrl", creation.config.analyticsUrl).pipe(
-        Effect.map((analyticsUrl) => ({
-          LOGFLARE_URL: analyticsUrl,
-          ...(creation.config.apiKey === undefined
-            ? {}
-            : { LOGFLARE_PRIVATE_ACCESS_TOKEN: creation.config.apiKey }),
-        })),
-      ),
-    args: (creation, endpoints, context) =>
-      Effect.gen(function* () {
-        const http = endpoints.get("http");
-        const address =
-          http === undefined
-            ? undefined
-            : `${context.container ? "0.0.0.0" : "127.0.0.1"}:${http.port}`;
-        yield* writeAtomically(fs, path, apiConfigPath, apiConfigFor(address));
-        if (creation.config.configPath !== undefined) {
-          const source = yield* fs.readFileString(creation.config.configPath).pipe(
-            Effect.mapError(
-              (cause) =>
-                new ServiceError({
-                  operation: "prepare",
-                  message: "Unable to read Vector configPath",
-                  cause,
-                }),
-            ),
-          );
-          const rendered = renderKnownPlaceholders(source, {
-            LOGFLARE_URL: creation.config.analyticsUrl,
-            LOGFLARE_PRIVATE_ACCESS_TOKEN: creation.config.apiKey,
-          });
-          yield* writeAtomically(fs, path, renderedPipelinePath, rendered);
-        }
-        return context.container
-          ? ["--config", containerPipelinePath, "--config", containerApiPath]
-          : ["--config", resolvedPipelinePath(creation), "--config", apiConfigPath];
-      }),
-    mounts: (creation) =>
-      Effect.succeed([
-        { source: resolvedPipelinePath(creation), target: containerPipelinePath, readOnly: true },
-        { source: apiConfigPath, target: containerApiPath, readOnly: true },
-      ]),
-    startupCommands: [],
-    prepare: (creation) =>
-      Effect.gen(function* () {
-        yield* ownedInstance("prepare");
-        const callerPath = creation.config.configPath;
-        if (callerPath !== undefined) {
-          const canonical = (file: string) =>
-            fs
-              .exists(file)
-              .pipe(
-                Effect.flatMap((exists) =>
-                  exists ? fs.realPath(file) : Effect.succeed(path.resolve(file)),
-                ),
-              );
-          const caller = yield* fs.realPath(callerPath).pipe(
-            Effect.mapError(
-              (cause) =>
-                new ServiceError({
-                  operation: "prepare",
-                  message: "Unable to read Vector configPath",
-                  cause,
-                }),
-            ),
-          );
-          const owned = yield* Effect.all([
-            canonical(apiConfigPath),
-            canonical(defaultPipelinePath),
-            canonical(renderedPipelinePath),
-          ]).pipe(
-            Effect.mapError(
-              (cause) =>
-                new ServiceError({
-                  operation: "prepare",
-                  message: "Unable to resolve Vector config paths",
-                  cause,
-                }),
-            ),
-          );
-          if (owned.includes(caller))
-            return yield* new ServiceError({
-              operation: "prepare",
-              message: "Vector configPath must not point at a stack-owned Vector config file",
-            });
-        }
-        // A safe placeholder until `args` writes the real address — the listening port isn't
-        // known until endpoints are reserved for an actual launch, which happens after `prepare`.
-        yield* writeAtomically(fs, path, apiConfigPath, apiConfigFor(undefined));
-        if (callerPath === undefined)
-          yield* writeAtomically(fs, path, defaultPipelinePath, defaultPipelineConfig);
-      }),
-    // A caller configPath may live anywhere under the instance root, so only recipe files and empty directories go.
-    removeData: () =>
-      Effect.gen(function* () {
-        yield* ownedInstance("destroy");
-        yield* fs.remove(apiConfigPath, { force: true });
-        yield* fs.remove(defaultPipelinePath, { force: true });
-        yield* fs.remove(renderedPipelinePath, { force: true });
-        if (yield* fs.exists(configRoot))
-          for (const entry of yield* fs.readDirectory(configRoot))
-            if (entry.startsWith(temporaryPrefix))
-              yield* fs.remove(path.join(configRoot, entry), { recursive: true, force: true });
-        for (const directory of [configRoot, path.dirname(configRoot), instanceRoot]) {
-          if (!(yield* fs.exists(directory))) continue;
-          if ((yield* fs.readDirectory(directory)).length > 0) return;
-          yield* fs.remove(directory, { recursive: true });
-        }
-      }).pipe(
-        Effect.mapError((cause) =>
-          cause instanceof ServiceError
-            ? cause
-            : new ServiceError({
-                operation: "destroy",
-                message: "Unable to remove Vector config",
-                cause,
-              }),
-        ),
-      ),
-  };
-};
-
-export const makeRecipe = Effect.fn("Vector.makeRecipe")(
-  (creation: Creation, options: CatalogOptions, deps: ProcessDependencies) =>
-    makeProcessRecipe(
-      creation,
-      options,
-      deps,
-      makeSpec(
-        options.instanceId,
-        deps.path.join(options.root, options.instanceId),
-        deps.fs,
-        deps.path,
-      ),
-    ),
-);
diff --git a/packages/stack/src/storage/DirectoryCopy.integration.test.ts b/packages/stack/src/storage/DirectoryCopy.integration.test.ts
index 39321e98c2..25114e747a 100644
--- a/packages/stack/src/storage/DirectoryCopy.integration.test.ts
+++ b/packages/stack/src/storage/DirectoryCopy.integration.test.ts
@@ -14,6 +14,7 @@ import {
   Scope,
   Sink,
   Stream,
+  Tracer,
 } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
 import { copyDirectory } from "./DirectoryCopy.ts";
@@ -192,6 +193,44 @@ describe("copyDirectory", () => {
     ),
   );
 
+  it.live("records each host process on its own span", () =>
+    run(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const root = yield* fs.makeTempDirectoryScoped({ prefix: "directory-copy-spans-" });
+        const source = path.join(root, "source");
+        yield* fs.makeDirectory(source);
+        yield* fs.writeFileString(path.join(source, "file.txt"), "file\n");
+        const spans: Array<Tracer.NativeSpan> = [];
+        const tracer = Tracer.make({
+          span: (options) => {
+            const span = new Tracer.NativeSpan(options);
+            spans.push(span);
+            return span;
+          },
+        });
+
+        yield* copyDirectory(source, path.join(root, "destination")).pipe(
+          Effect.withTracer(tracer),
+          Effect.withTracerEnabled(true),
+        );
+
+        const execs = spans
+          .filter((span) => span.name === "DirectoryCopy.exec")
+          .map((span) => Object.fromEntries(span.attributes));
+        expect(execs.map((attributes) => attributes["process.executable.name"])).toEqual(
+          process.platform === "win32" ? ["robocopy"] : ["find", "cp"],
+        );
+        expect(
+          execs.every((attributes) => typeof attributes["process.exit_code"] === "number"),
+        ).toBe(true);
+        const copy = spans.find((span) => span.name === "DirectoryCopy.copyDirectory");
+        expect(copy?.attributes.has("process.executable.name")).toBe(false);
+      }),
+    ),
+  );
+
   it.live("removes a failed host copy and reports the failure", () =>
     run(
       Effect.gen(function* () {
diff --git a/packages/stack/src/storage/DirectoryCopy.ts b/packages/stack/src/storage/DirectoryCopy.ts
index 2c976c1619..12d25998ad 100644
--- a/packages/stack/src/storage/DirectoryCopy.ts
+++ b/packages/stack/src/storage/DirectoryCopy.ts
@@ -111,6 +111,10 @@ const runExec = (
 ): Effect.Effect<string, DirectoryCopyError, ChildProcessSpawner.ChildProcessSpawner> =>
   Effect.scoped(
     Effect.gen(function* () {
+      yield* Effect.annotateCurrentSpan({
+        "process.executable.name": command,
+        "process.arg_count": args.length,
+      });
       const child = yield* ChildProcess.make(command, [...args], {
         stdin: "ignore",
         stdout: "pipe",
@@ -125,12 +129,13 @@ const runExec = (
         { concurrency: 3 },
       ).pipe(Effect.mapError((cause) => errorFor(operation, source, destination, cause)));
       const status = Number(exitCode);
+      yield* Effect.annotateCurrentSpan("process.exit_code", status);
       if (status !== 0 && !acceptStatus(status)) {
         return yield* errorFor(operation, source, destination, new Error(stderr));
       }
       return text;
     }),
-  );
+  ).pipe(Effect.withSpan("DirectoryCopy.exec"));
 
 const findUnsupportedEntry = (
   source: string,
diff --git a/packages/stack/src/storage/DockerDatabaseStorage.integration.test.ts b/packages/stack/src/storage/DockerDatabaseStorage.integration.test.ts
index 14021aa972..16619a0b77 100644
--- a/packages/stack/src/storage/DockerDatabaseStorage.integration.test.ts
+++ b/packages/stack/src/storage/DockerDatabaseStorage.integration.test.ts
@@ -1,6 +1,7 @@
 import { NodeServices } from "@effect/platform-node";
 import { describe, expect, it } from "@effect/vitest";
 import {
+  ConfigProvider,
   Crypto,
   Data,
   Deferred,
@@ -23,6 +24,7 @@ import { makeContainerRuntime } from "../runtime/Container.ts";
 import { makeDatabaseSnapshots } from "../services/DatabaseSnapshot.ts";
 import { makeDockerDatabaseStorage } from "./DockerDatabaseStorage.ts";
 import { makeDockerHelperRegistry } from "./DockerHelperRegistry.ts";
+import { removeTestRunVolumes } from "../../tests/docker-volume-run.ts";
 import type { DockerHelperRegistry } from "./DockerHelperRegistry.ts";
 
 const postgresImage = (version: string) =>
@@ -607,6 +609,62 @@ describe("Docker database storage", { timeout: 120_000 }, () => {
     ).pipe(Effect.provide(NodeServices.layer)),
   );
 
+  it.live("labels its volume with the configured test run", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const crypto = yield* Crypto.Crypto;
+        const root = yield* fs.makeTempDirectoryScoped({ prefix: "docker-storage-test-run-" });
+        const storageRoot = path.join(root, "state", "stack", "data");
+        const cacheRoot = path.join(root, "cache");
+        const instanceRoot = path.join(storageRoot, "database");
+        yield* fs.makeDirectory(instanceRoot, { recursive: true });
+        const container = yield* makeContainerRuntime({ engine: "docker", root });
+        const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+        const stackId = `storage-test-run-${yield* crypto.randomUUIDv4}`;
+        const testRunId = `storage-test-run-${(yield* crypto.randomUUIDv4).slice(0, 8)}`;
+        // This run id overrides the ambient one, so the shared run teardown never sees the volume.
+        yield* Effect.addFinalizer(() => removeTestRunVolumes(testRunId).pipe(Effect.orDie));
+        const storage = yield* makeDockerDatabaseStorage({
+          runtime: "docker",
+          stackId,
+          instanceId: "database",
+          instanceRoot,
+          root: storageRoot,
+          cacheRoot,
+          fs,
+          path,
+          crypto,
+          container,
+          spawner,
+        });
+        yield* storage
+          .prepare("17")
+          .pipe(
+            Effect.provide(
+              ConfigProvider.layer(
+                ConfigProvider.fromEnvRecord({ SUPABASE_STACK_TEST_RUN: testRunId }),
+              ),
+            ),
+          );
+        const marker = yield* Schema.decodeEffect(Schema.fromJsonString(Marker))(
+          yield* fs.readFileString(path.join(instanceRoot, ".supabase-database-storage.json")),
+        );
+        if (marker.backend !== "docker" || marker.volume === undefined)
+          return yield* new DockerTestError({ message: "Docker test selected host fallback" });
+        const labels = yield* docker([
+          "volume",
+          "inspect",
+          "--format",
+          '{{ index .Labels "com.supabase.stack-test-run" }}',
+          marker.volume,
+        ]);
+        expect(labels).toBe(testRunId);
+      }),
+    ).pipe(Effect.provide(NodeServices.layer)),
+  );
+
   it.live("removes an unprepared storage without requiring Docker", () =>
     Effect.scoped(
       Effect.gen(function* () {
diff --git a/packages/stack/src/storage/DockerDatabaseStorage.ts b/packages/stack/src/storage/DockerDatabaseStorage.ts
index 5bf4fcec34..f35f5d9a4f 100644
--- a/packages/stack/src/storage/DockerDatabaseStorage.ts
+++ b/packages/stack/src/storage/DockerDatabaseStorage.ts
@@ -15,6 +15,7 @@ import { ChildProcess } from "effect/unstable/process";
 import type { ChildProcessSpawner as ChildProcessSpawnerService } from "effect/unstable/process/ChildProcessSpawner";
 import { postgresVersion, resolveArtifact } from "../Artifacts.ts";
 import { failureMessage } from "../internal/failure-message.ts";
+import { testRunLabelArgs as readTestRunLabelArgs } from "../internal/test-run-label.ts";
 import type { ContainerRuntime } from "../runtime/Container.ts";
 import { composeProjectFor } from "../runtime/ContainerName.ts";
 import type { DatabaseRuntime } from "../services/Database.ts";
@@ -108,8 +109,12 @@ const parseMajor = (version: string): number | undefined => {
 };
 
 /** Derives the shared Docker volume name from a state-root/daemon identity digest. */
-export const volumeNameFor = (stateDigest: string): string =>
-  `supabase-db-${stateDigest.slice(0, 32)}`;
+const volumeNameFor = (stateDigest: string): string => `supabase-db-${stateDigest.slice(0, 32)}`;
+
+/** Labels volumes and containers this run creates, when `SUPABASE_STACK_TEST_RUN` is set. */
+const testRunLabelArgs = Effect.fn("DockerDatabaseStorage.testRunLabelArgs")(function* () {
+  return yield* readTestRunLabelArgs.pipe(Effect.mapError((cause) => errorFor("config", cause)));
+});
 
 /** Owns the placement and lifecycle of one database's Docker data and snapshot namespaces. */
 export const makeDockerDatabaseStorage = Effect.fn("DockerDatabaseStorage.make")(
@@ -274,15 +279,21 @@ export const makeDockerDatabaseStorage = Effect.fn("DockerDatabaseStorage.make")
                     Effect.catchTag("DockerDatabaseStorageError", (cause) =>
                       !validMarker.initialized &&
                       /(?:no such volume|not found)/iu.test(cause.message)
-                        ? engineCommand([
-                            "volume",
-                            "create",
-                            "--label",
-                            "com.supabase.stack-managed=true",
-                            "--label",
-                            `com.supabase.stack-state-root=${resolved.stateDigest}`,
-                            resolved.volume,
-                          ]).pipe(Effect.asVoid)
+                        ? testRunLabelArgs().pipe(
+                            Effect.flatMap((testRunLabel) =>
+                              engineCommand([
+                                "volume",
+                                "create",
+                                "--label",
+                                "com.supabase.stack-managed=true",
+                                "--label",
+                                `com.supabase.stack-state-root=${resolved.stateDigest}`,
+                                ...testRunLabel,
+                                resolved.volume,
+                              ]),
+                            ),
+                            Effect.asVoid,
+                          )
                         : Effect.fail(cause),
                     ),
                   );
@@ -320,15 +331,21 @@ export const makeDockerDatabaseStorage = Effect.fn("DockerDatabaseStorage.make")
               yield* engineCommand(["volume", "inspect", resolved.volume]).pipe(
                 Effect.catchTag("DockerDatabaseStorageError", (cause) =>
                   /no such volume|not found/iu.test(cause.message)
-                    ? engineCommand([
-                        "volume",
-                        "create",
-                        "--label",
-                        "com.supabase.stack-managed=true",
-                        "--label",
-                        `com.supabase.stack-state-root=${resolved.stateDigest}`,
-                        resolved.volume,
-                      ]).pipe(Effect.asVoid)
+                    ? testRunLabelArgs().pipe(
+                        Effect.flatMap((testRunLabel) =>
+                          engineCommand([
+                            "volume",
+                            "create",
+                            "--label",
+                            "com.supabase.stack-managed=true",
+                            "--label",
+                            `com.supabase.stack-state-root=${resolved.stateDigest}`,
+                            ...testRunLabel,
+                            resolved.volume,
+                          ]),
+                        ),
+                        Effect.asVoid,
+                      )
                     : Effect.fail(cause),
                 ),
                 Effect.asVoid,
@@ -348,6 +365,10 @@ export const makeDockerDatabaseStorage = Effect.fn("DockerDatabaseStorage.make")
         (args: ReadonlyArray<string>): Effect.Effect<string, DockerDatabaseStorageError> =>
           Effect.scoped(
             Effect.gen(function* () {
+              yield* Effect.annotateCurrentSpan({
+                "process.executable.name": options.runtime,
+                "process.arg_count": args.length,
+              });
               const child = yield* options.spawner
                 .spawn(ChildProcess.make(options.runtime, args, { stdin: "ignore" }))
                 .pipe(Effect.mapError((cause) => errorFor("engine", cause)));
@@ -371,6 +392,7 @@ export const makeDockerDatabaseStorage = Effect.fn("DockerDatabaseStorage.make")
                 ],
                 { concurrency: "unbounded" },
               );
+              yield* Effect.annotateCurrentSpan("process.exit_code", Number(code));
               if (Number(code) !== 0)
                 return yield* errorFor(
                   "engine",
@@ -579,6 +601,7 @@ export const makeDockerDatabaseStorage = Effect.fn("DockerDatabaseStorage.make")
                 Effect.mapError((cause) => errorFor("helper", cause)),
               );
               const name = `supabase-db-helper-${token}`;
+              const testRunLabel = yield* testRunLabelArgs();
               // Register the deterministic owned name before the remote create starts so an
               // interrupted docker run can still be removed by the same scope.
               yield* Ref.set(helperId, name);
@@ -597,6 +620,7 @@ export const makeDockerDatabaseStorage = Effect.fn("DockerDatabaseStorage.make")
                 "--label",
                 `com.supabase.stack-root=${options.path.resolve(options.root)}`,
                 ...composeHelperLabels,
+                ...testRunLabel,
                 ...mountArgs(mounts),
                 preparedImage,
                 "/bin/sh",
@@ -672,6 +696,7 @@ export const makeDockerDatabaseStorage = Effect.fn("DockerDatabaseStorage.make")
           const preparedImage = yield* options.container
             .prepareImage(image)
             .pipe(Effect.mapError((cause) => errorFor("helper", cause)));
+          const testRunLabel = yield* testRunLabelArgs();
           return yield* Effect.uninterruptible(
             engineCommand([
               "run",
@@ -687,6 +712,7 @@ export const makeDockerDatabaseStorage = Effect.fn("DockerDatabaseStorage.make")
               "--label",
               `com.supabase.stack-root=${options.path.resolve(options.root)}`,
               ...composeHelperLabels,
+              ...testRunLabel,
               ...mountArgs(mounts),
               preparedImage,
               "/bin/sh",
diff --git a/packages/stack/src/testing.ts b/packages/stack/src/testing.ts
index b92c16d860..531b3c4a25 100644
--- a/packages/stack/src/testing.ts
+++ b/packages/stack/src/testing.ts
@@ -20,6 +20,9 @@ import {
   ServiceCreationInput as CreationSchema,
 } from "./services/Catalog.ts";
 
+/** Exposed for test fakes that need to reproduce the package's own saved-stack comparison. */
+export { planSupabaseComposition } from "./composition/Supabase.ts";
+
 type Kind = StackEffect.ServiceCreationInput["service"];
 type Creation<K extends Kind> = Extract<StackEffect.ServiceCreationInput, { readonly service: K }>;
 
diff --git a/packages/stack/tests/docker-fixture.integration.test.ts b/packages/stack/tests/docker-fixture.integration.test.ts
index 8ef4c2f579..17303cf6ab 100644
--- a/packages/stack/tests/docker-fixture.integration.test.ts
+++ b/packages/stack/tests/docker-fixture.integration.test.ts
@@ -54,7 +54,7 @@ const volumeExists = Effect.fn("DockerFixture.volumeExists")((volume: string) =>
 );
 
 describe("Docker database fixture isolation", { timeout: 180_000 }, () => {
-  it.live("isolates equal identities and removes both owned volumes", () =>
+  it.live("isolates equal identities across separate owned volumes", () =>
     Effect.scoped(
       Effect.gen(function* () {
         const fs = yield* FileSystem.FileSystem;
@@ -133,7 +133,7 @@ describe("Docker database fixture isolation", { timeout: 180_000 }, () => {
         ),
       ),
       Effect.tap((results) =>
-        Effect.sync(() => results.forEach(({ exists }) => expect(exists).toBe(false))),
+        Effect.sync(() => results.forEach(({ exists }) => expect(exists).toBe(true))),
       ),
       Effect.provide(Layer.merge(NodeServices.layer, NodeHttpClient.layerNodeHttp)),
     ),
diff --git a/packages/stack/tests/docker-fixture.ts b/packages/stack/tests/docker-fixture.ts
index f986eb7931..a900828687 100644
--- a/packages/stack/tests/docker-fixture.ts
+++ b/packages/stack/tests/docker-fixture.ts
@@ -1,6 +1,5 @@
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
-import { Crypto, Effect, FileSystem, Path, Stream } from "effect";
-import { volumeNameFor } from "../src/storage/DockerDatabaseStorage.ts";
+import { Effect, FileSystem, Stream } from "effect";
 import { cleanupDockerRoot } from "./docker-cleanup.ts";
 
 /** Runs a Docker CLI command and returns its combined output and exit code. */
@@ -24,59 +23,22 @@ export const runDocker = Effect.fn("DockerTest.runDocker")((args: ReadonlyArray<
   ),
 );
 
-/** Allocates the documented state-root layout used by Docker database fixtures. */
+/**
+ * Allocates the documented state-root layout used by Docker database fixtures. The volume this
+ * state root's Docker database creates is removed by the `SUPABASE_STACK_TEST_RUN` test-run
+ * cleanup (see `tests/docker-volume-run.ts`), not by this fixture.
+ */
 export const makeDockerDatabaseRoot = Effect.fn("DockerTest.makeDatabaseRoot")(
   (prefix: string, stackId = "catalog-test") =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
-      const path = yield* Path.Path;
-      const crypto = yield* Crypto.Crypto;
       const temporaryRoot = yield* fs.makeTempDirectoryScoped({ prefix });
       const root = `${temporaryRoot}/state/${stackId}/data`;
       yield* fs.makeDirectory(root, { recursive: true });
-      const stateRoot = yield* fs.realPath(path.dirname(path.dirname(root)));
-      const daemon = yield* runDocker(["info", "--format", "{{.ID}}"]).pipe(
-        Effect.flatMap((result) =>
-          result.code === 0
-            ? Effect.succeed(result.output.trim())
-            : Effect.die(`Docker info failed: ${result.output}`),
-        ),
-      );
-      const stateDigest = yield* crypto
-        .digest("SHA-256", new TextEncoder().encode(`${stateRoot}\0${daemon}`))
-        .pipe(
-          Effect.map((bytes) =>
-            Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join(""),
-          ),
-        );
-      const volume = volumeNameFor(stateDigest);
       yield* Effect.addFinalizer(() =>
         Effect.gen(function* () {
-          const inspected = yield* runDocker([
-            "volume",
-            "inspect",
-            "--format",
-            '{{ index .Labels "com.supabase.stack-managed" }}|{{ index .Labels "com.supabase.stack-state-root" }}',
-            volume,
-          ]);
-          if (inspected.code !== 0) {
-            if (/no such volume|not found/iu.test(inspected.output)) return;
-            return yield* Effect.die(`Docker volume inspect failed: ${inspected.output}`);
-          }
-          const [managed, labeledState] = inspected.output.trim().split("|");
-          if (managed !== "true" || labeledState !== stateDigest)
-            return yield* Effect.die("Docker fixture volume identity did not match its state root");
-          const removed = yield* runDocker(["volume", "rm", volume]);
-          if (removed.code !== 0 && !/no such volume|not found/iu.test(removed.output))
-            return yield* Effect.die(`Docker volume cleanup failed: ${removed.output}`);
-        }).pipe(
-          Effect.andThen(
-            Effect.gen(function* () {
-              if (yield* fs.exists(root)) yield* cleanupDockerRoot(root);
-            }),
-          ),
-          Effect.catchCause(Effect.die),
-        ),
+          if (yield* fs.exists(root)) yield* cleanupDockerRoot(root);
+        }).pipe(Effect.catchCause(Effect.die)),
       );
       return root;
     }),
diff --git a/packages/stack/tests/docker-volume-run.integration.test.ts b/packages/stack/tests/docker-volume-run.integration.test.ts
new file mode 100644
index 0000000000..6233923a8f
--- /dev/null
+++ b/packages/stack/tests/docker-volume-run.integration.test.ts
@@ -0,0 +1,202 @@
+import { NodeServices } from "@effect/platform-node";
+import { describe, expect, it } from "@effect/vitest";
+import { Crypto, DateTime, Effect, FileSystem, Path } from "effect";
+import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
+import { runDocker } from "./docker-fixture.ts";
+import {
+  encodeRunMarker,
+  markerDirectory,
+  markerFile,
+  recoverDeadRuns,
+  removeTestRunVolumes,
+} from "./docker-volume-run.ts";
+
+const volumeExists = Effect.fn("DockerVolumeRunTest.volumeExists")((name: string) =>
+  runDocker(["volume", "inspect", name]).pipe(Effect.map((result) => result.code === 0)),
+);
+
+const createVolume = Effect.fn("DockerVolumeRunTest.createVolume")(
+  (name: string, labels: ReadonlyArray<string>) =>
+    runDocker(["volume", "create", ...labels.flatMap((label) => ["--label", label]), name]).pipe(
+      Effect.flatMap((result) =>
+        result.code === 0
+          ? Effect.void
+          : Effect.die(`docker volume create ${name} failed: ${result.output}`),
+      ),
+    ),
+);
+
+const removeVolume = Effect.fn("DockerVolumeRunTest.removeVolume")((name: string) =>
+  runDocker(["volume", "rm", name]).pipe(
+    Effect.flatMap((result) =>
+      result.code === 0 || /no such volume/iu.test(result.output)
+        ? Effect.void
+        : Effect.die(`docker volume rm ${name} failed: ${result.output}`),
+    ),
+    Effect.orDie,
+  ),
+);
+
+const containerExists = Effect.fn("DockerVolumeRunTest.containerExists")((name: string) =>
+  runDocker(["inspect", name]).pipe(Effect.map((result) => result.code === 0)),
+);
+
+const createContainer = Effect.fn("DockerVolumeRunTest.createContainer")(
+  (name: string, labels: ReadonlyArray<string>) =>
+    runDocker([
+      "create",
+      "--name",
+      name,
+      ...labels.flatMap((label) => ["--label", label]),
+      "busybox:1.36",
+      "true",
+    ]).pipe(
+      Effect.flatMap((result) =>
+        result.code === 0
+          ? Effect.void
+          : Effect.die(`docker create ${name} failed: ${result.output}`),
+      ),
+    ),
+);
+
+const removeContainer = Effect.fn("DockerVolumeRunTest.removeContainer")((name: string) =>
+  runDocker(["rm", "--force", "--volumes", name]).pipe(
+    Effect.flatMap((result) =>
+      result.code === 0 || /no such container/iu.test(result.output)
+        ? Effect.void
+        : Effect.die(`docker rm ${name} failed: ${result.output}`),
+    ),
+    Effect.orDie,
+  ),
+);
+
+describe("test-run Docker volume cleanup", { timeout: 120_000 }, () => {
+  it.live("removes exactly the volumes labelled for this run", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const crypto = yield* Crypto.Crypto;
+        const suffix = (yield* crypto.randomUUIDv4).slice(0, 8);
+        const runId = `run-${suffix}`;
+        const otherRunId = `other-run-${suffix}`;
+        const owned = `sb-test-run-owned-${suffix}`;
+        const foreign = `sb-test-run-foreign-${suffix}`;
+        const unlabelled = `sb-test-run-unlabelled-${suffix}`;
+
+        yield* Effect.addFinalizer(() =>
+          Effect.forEach([owned, foreign, unlabelled], removeVolume, { discard: true }),
+        );
+        yield* createVolume(owned, [
+          "com.supabase.stack-managed=true",
+          `com.supabase.stack-test-run=${runId}`,
+        ]);
+        yield* createVolume(foreign, [
+          "com.supabase.stack-managed=true",
+          `com.supabase.stack-test-run=${otherRunId}`,
+        ]);
+        yield* createVolume(unlabelled, ["com.supabase.stack-managed=true"]);
+        expect(yield* volumeExists(owned)).toBe(true);
+
+        yield* removeTestRunVolumes(runId);
+
+        expect(yield* volumeExists(owned)).toBe(false);
+        expect(yield* volumeExists(foreign)).toBe(true);
+        expect(yield* volumeExists(unlabelled)).toBe(true);
+      }),
+    ).pipe(Effect.provide(NodeServices.layer)),
+  );
+});
+
+describe("dead test-run recovery", { timeout: 120_000 }, () => {
+  it.live(
+    "removes a dead run's labelled container and volume, leaving a live run's and an unlabelled one",
+    () =>
+      Effect.scoped(
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const path = yield* Path.Path;
+          const crypto = yield* Crypto.Crypto;
+          const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+          const suffix = (yield* crypto.randomUUIDv4).slice(0, 8);
+          const deadRunId = `recovery-dead-${suffix}`;
+          const liveRunId = `recovery-live-${suffix}`;
+          const deadVolume = `sb-recovery-dead-volume-${suffix}`;
+          const liveVolume = `sb-recovery-live-volume-${suffix}`;
+          const unlabelledVolume = `sb-recovery-unlabelled-volume-${suffix}`;
+          const deadContainer = `sb-recovery-dead-container-${suffix}`;
+          const liveContainer = `sb-recovery-live-container-${suffix}`;
+          const unlabelledContainer = `sb-recovery-unlabelled-container-${suffix}`;
+          const deadMarker = markerFile(path, deadRunId);
+          const liveMarker = markerFile(path, liveRunId);
+
+          // Guaranteed dead once awaited: a process that has already exited cannot be a live pid.
+          const dying = yield* spawner.spawn(
+            ChildProcess.make(process.execPath, ["-e", "process.exit(0)"], {
+              stdin: "ignore",
+              stdout: "ignore",
+              stderr: "ignore",
+            }),
+          );
+          const deadPid = dying.pid;
+          yield* dying.exitCode;
+
+          yield* Effect.addFinalizer(() =>
+            Effect.forEach([deadVolume, liveVolume, unlabelledVolume], removeVolume, {
+              discard: true,
+            }).pipe(
+              Effect.andThen(
+                Effect.forEach(
+                  [deadContainer, liveContainer, unlabelledContainer],
+                  removeContainer,
+                  { discard: true },
+                ),
+              ),
+              Effect.andThen(
+                Effect.forEach(
+                  [deadMarker, liveMarker],
+                  (file) => fs.remove(file, { force: true }).pipe(Effect.orDie),
+                  { discard: true },
+                ),
+              ),
+            ),
+          );
+
+          yield* createVolume(deadVolume, [
+            "com.supabase.stack-managed=true",
+            `com.supabase.stack-test-run=${deadRunId}`,
+          ]);
+          yield* createVolume(liveVolume, [
+            "com.supabase.stack-managed=true",
+            `com.supabase.stack-test-run=${liveRunId}`,
+          ]);
+          yield* createVolume(unlabelledVolume, ["com.supabase.stack-managed=true"]);
+          yield* createContainer(deadContainer, [`com.supabase.stack-test-run=${deadRunId}`]);
+          yield* createContainer(liveContainer, [`com.supabase.stack-test-run=${liveRunId}`]);
+          yield* createContainer(unlabelledContainer, []);
+
+          const startedAt = DateTime.formatIso(yield* DateTime.now);
+          yield* fs.makeDirectory(markerDirectory(path), { recursive: true });
+          yield* fs.writeFileString(
+            deadMarker,
+            yield* encodeRunMarker({ pid: deadPid, startedAt }),
+          );
+          yield* fs.writeFileString(
+            liveMarker,
+            yield* encodeRunMarker({ pid: process.pid, startedAt }),
+          );
+
+          yield* recoverDeadRuns();
+
+          expect(yield* volumeExists(deadVolume)).toBe(false);
+          expect(yield* containerExists(deadContainer)).toBe(false);
+          expect(yield* fs.exists(deadMarker)).toBe(false);
+
+          expect(yield* volumeExists(liveVolume)).toBe(true);
+          expect(yield* containerExists(liveContainer)).toBe(true);
+          expect(yield* fs.exists(liveMarker)).toBe(true);
+
+          expect(yield* volumeExists(unlabelledVolume)).toBe(true);
+          expect(yield* containerExists(unlabelledContainer)).toBe(true);
+        }),
+      ).pipe(Effect.provide(NodeServices.layer)),
+  );
+});
diff --git a/packages/stack/tests/docker-volume-run.ts b/packages/stack/tests/docker-volume-run.ts
new file mode 100644
index 0000000000..14d469ae63
--- /dev/null
+++ b/packages/stack/tests/docker-volume-run.ts
@@ -0,0 +1,263 @@
+import { randomUUID } from "node:crypto";
+import { tmpdir, userInfo } from "node:os";
+import { NodeServices } from "@effect/platform-node";
+import { DateTime, Effect, FileSystem, Option, Path, Schema } from "effect";
+import {
+  testRunEnvVar as stackTestRunEnvVar,
+  testRunLabelKey,
+} from "../src/internal/test-run-label.ts";
+import { runDocker } from "./docker-fixture.ts";
+
+/**
+ * Docker test state roots must be private to a run (see `makeDockerDatabaseRoot` and
+ * `Commands.integration.test.ts`'s Docker variants): a shared root's volume would be labelled
+ * by whichever run first creates it, and a later run sharing that root could have its data
+ * removed by this cleanup. The `@supabase/stack/testing` default shared root is outside this
+ * cleanup and must not be used for Docker-backed tests.
+ */
+export { stackTestRunEnvVar };
+
+const managedFilter = "label=com.supabase.stack-managed=true";
+const testRunFilter = (id: string) => `label=${testRunLabelKey}=${id}`;
+
+/** One owned test run's marker: the host process that must still be alive for the run to own it. */
+const RunMarker = Schema.Struct({ pid: Schema.Int, startedAt: Schema.String });
+export type RunMarker = Schema.Schema.Type<typeof RunMarker>;
+export const encodeRunMarker = Schema.encodeEffect(Schema.fromJsonString(RunMarker));
+const decodeRunMarker = Schema.decodeEffect(Schema.fromJsonString(RunMarker));
+
+/** Per-user, host-local directory holding one marker file per test run this host has started. */
+export const markerDirectory = (path: Path.Path): string =>
+  path.join(tmpdir(), `supabase-stack-test-runs-${userInfo().uid}`);
+
+/** The marker file path for one test run's id, exported so recovery tests can seed fixtures. */
+export const markerFile = (path: Path.Path, id: string): string =>
+  path.join(markerDirectory(path), `${id}.json`);
+
+/** True when `pid` is a dead process; an unauthorized signal still proves it is alive. */
+const isDead = (pid: number): boolean => {
+  try {
+    process.kill(pid, 0);
+    return false;
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === "ESRCH";
+  }
+};
+
+const dockerUnavailable = runDocker(["info", "--format", "{{.ID}}"]).pipe(
+  Effect.map((result) => result.code !== 0),
+  Effect.catchCause(() => Effect.succeed(true)),
+);
+
+/**
+ * Removes exactly the stack-managed Docker volumes labelled with this test run's id. Prints one
+ * note and does nothing when Docker is missing or its daemon is unreachable.
+ */
+export const removeTestRunVolumes = Effect.fn("DockerVolumeRun.removeTestRunVolumes")(
+  (id: string) =>
+    Effect.gen(function* () {
+      if (yield* dockerUnavailable) {
+        yield* Effect.logWarning(
+          "[docker-volume-run] Skipping test-run Docker volume cleanup: Docker is missing or its daemon is unreachable.",
+        );
+        return;
+      }
+      const listed = yield* runDocker([
+        "volume",
+        "ls",
+        "-q",
+        "--filter",
+        managedFilter,
+        "--filter",
+        testRunFilter(id),
+      ]);
+      if (listed.code !== 0)
+        return yield* Effect.die(`docker volume ls failed: ${listed.output.trim()}`);
+      const volumes = listed.output
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0);
+      if (volumes.length === 0) return;
+      const removals = yield* Effect.forEach(volumes, (volume) =>
+        runDocker(["volume", "rm", volume]).pipe(Effect.map((result) => ({ volume, result }))),
+      );
+      const failed = removals.filter(({ result }) => result.code !== 0);
+      if (failed.length > 0)
+        return yield* Effect.die(
+          `Failed to remove test-run Docker volumes: ${failed
+            .map(({ volume, result }) => `${volume} (${result.output.trim()})`)
+            .join(", ")}`,
+        );
+    }),
+);
+
+// A benign "not found" tolerates a concurrent setup recovering the same dead run first.
+const benign = (output: string) => /no such (?:container|volume)/iu.test(output);
+
+/** Removes a dead run's labelled containers; `Option.none` on success, a message otherwise. */
+const removeDeadRunContainers = Effect.fn("DockerVolumeRun.removeDeadRunContainers")((id: string) =>
+  Effect.gen(function* () {
+    const listed = yield* runDocker([
+      "ps",
+      "--all",
+      "--quiet",
+      "--no-trunc",
+      "--filter",
+      testRunFilter(id),
+    ]);
+    if (listed.code !== 0) return Option.some(`docker ps failed: ${listed.output.trim()}`);
+    const ids = listed.output
+      .split("\n")
+      .map((line) => line.trim())
+      .filter((line) => line.length > 0);
+    if (ids.length === 0) return Option.none<string>();
+    const removed = yield* runDocker(["rm", "--force", "--volumes", ...ids]);
+    return removed.code === 0 || benign(removed.output)
+      ? Option.none<string>()
+      : Option.some(`docker rm failed: ${removed.output.trim()}`);
+  }),
+);
+
+/** Removes a dead run's labelled, stack-managed volumes; `Option.none` on success. */
+const removeDeadRunVolumes = Effect.fn("DockerVolumeRun.removeDeadRunVolumes")((id: string) =>
+  Effect.gen(function* () {
+    const listed = yield* runDocker([
+      "volume",
+      "ls",
+      "-q",
+      "--filter",
+      managedFilter,
+      "--filter",
+      testRunFilter(id),
+    ]);
+    if (listed.code !== 0) return Option.some(`docker volume ls failed: ${listed.output.trim()}`);
+    const volumes = listed.output
+      .split("\n")
+      .map((line) => line.trim())
+      .filter((line) => line.length > 0);
+    if (volumes.length === 0) return Option.none<string>();
+    const removals = yield* Effect.forEach(volumes, (volume) =>
+      runDocker(["volume", "rm", volume]).pipe(Effect.map((result) => ({ volume, result }))),
+    );
+    const failed = removals.filter(({ result }) => result.code !== 0 && !benign(result.output));
+    return failed.length === 0
+      ? Option.none<string>()
+      : Option.some(
+          `docker volume rm failed: ${failed
+            .map(({ volume, result }) => `${volume} (${result.output.trim()})`)
+            .join(", ")}`,
+        );
+  }),
+);
+
+/**
+ * Removes one dead run's labelled containers then volumes, deleting its marker only when both
+ * succeed or find nothing. A failure keeps the marker for the next recovery and logs one warning;
+ * it never fails the run that triggered recovery.
+ */
+const recoverDeadRun = Effect.fn("DockerVolumeRun.recoverDeadRun")(
+  (path: Path.Path, fs: FileSystem.FileSystem, id: string) =>
+    Effect.gen(function* () {
+      const containerFailure = yield* removeDeadRunContainers(id);
+      const volumeFailure = yield* removeDeadRunVolumes(id);
+      const failures = [containerFailure, volumeFailure].filter(Option.isSome).map((o) => o.value);
+      if (failures.length > 0) {
+        yield* Effect.logWarning(
+          `[docker-volume-run] Leaving dead test run ${id}'s marker after a failed recovery: ${failures.join("; ")}`,
+        );
+        return;
+      }
+      yield* fs.remove(markerFile(path, id), { force: true });
+    }),
+);
+
+/**
+ * Recovers Docker resources left by test runs whose process died without running teardown (for
+ * example a SIGKILL, or Bun's vitest exiting on SIGINT/SIGTERM without running globalSetup
+ * teardown). Only a run whose marked pid is dead is touched; a live run, including a concurrent
+ * one, is left alone. Does nothing, keeping every marker, when Docker is unreachable.
+ */
+export const recoverDeadRuns = Effect.fn("DockerVolumeRun.recoverDeadRuns")(() =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const directory = markerDirectory(path);
+    yield* fs.makeDirectory(directory, { recursive: true });
+    if (yield* dockerUnavailable) {
+      yield* Effect.logWarning(
+        "[docker-volume-run] Skipping dead test-run recovery: Docker is missing or its daemon is unreachable.",
+      );
+      return;
+    }
+    const entries = yield* fs.readDirectory(directory);
+    for (const entry of entries) {
+      if (!entry.endsWith(".json")) continue;
+      const id = entry.slice(0, -".json".length);
+      const marker = yield* fs
+        .readFileString(path.join(directory, entry))
+        .pipe(Effect.flatMap(decodeRunMarker), Effect.option);
+      if (Option.isNone(marker) || !isDead(marker.value.pid)) continue;
+      yield* recoverDeadRun(path, fs, id);
+    }
+  }),
+);
+
+/** Writes this run's marker so a later setup can recover its resources if it dies uncleanly. */
+const writeOwnMarker = Effect.fn("DockerVolumeRun.writeOwnMarker")((id: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const marker: RunMarker = {
+      pid: process.pid,
+      startedAt: DateTime.formatIso(yield* DateTime.now),
+    };
+    yield* fs.writeFileString(markerFile(path, id), yield* encodeRunMarker(marker), {
+      mode: 0o600,
+    });
+  }),
+);
+
+const deleteOwnMarker = Effect.fn("DockerVolumeRun.deleteOwnMarker")((id: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    yield* fs.remove(markerFile(path, id), { force: true });
+  }),
+);
+
+/**
+ * Vitest `globalSetup`, wired into the integration and e2e projects of both `packages/stack` and
+ * `apps/cli`. Generates one random id for this invocation and removes the Docker volumes it
+ * labels when the run ends, unless an outer invocation already owns
+ * `SUPABASE_STACK_TEST_RUN`: the root `vitest.config.ts` aggregates every package's projects, so
+ * several project setups can run in one invocation, and only the outermost one should own
+ * cleanup. The outermost setup also recovers resources left by earlier runs that died without
+ * running this teardown.
+ */
+// oxlint-disable-next-line effecttsgo/async-function -- Vitest's globalSetup API requires a Promise-returning function; this is the non-Effect consumer boundary.
+export async function setup(): Promise<(() => Promise<void>) | undefined> {
+  // oxlint-disable-next-line effecttsgo/process-env -- see below.
+  if (process.env[stackTestRunEnvVar] !== undefined) return undefined;
+  const id = randomUUID();
+  // oxlint-disable-next-line effecttsgo/process-env -- must be a real process.env value so vitest workers and spawned CLI subprocesses inherit it.
+  process.env[stackTestRunEnvVar] = id;
+  await Effect.runPromise(
+    recoverDeadRuns().pipe(Effect.andThen(writeOwnMarker(id)), Effect.provide(NodeServices.layer)),
+  );
+  // oxlint-disable-next-line effecttsgo/async-function -- the returned teardown is Vitest's globalSetup contract, not application logic.
+  return async () => {
+    try {
+      await Effect.runPromise(
+        removeTestRunVolumes(id).pipe(
+          Effect.andThen(deleteOwnMarker(id)),
+          Effect.provide(NodeServices.layer),
+        ),
+      );
+    } finally {
+      // oxlint-disable-next-line effecttsgo/process-env -- releases ownership so a later setup in this process owns its own run.
+      if (process.env[stackTestRunEnvVar] === id) delete process.env[stackTestRunEnvVar];
+    }
+  };
+}
+
+export default setup;
diff --git a/packages/stack/tests/fake-logflare.ts b/packages/stack/tests/fake-logflare.ts
new file mode 100644
index 0000000000..280827af72
--- /dev/null
+++ b/packages/stack/tests/fake-logflare.ts
@@ -0,0 +1,193 @@
+import { createServer } from "node:http"; // oxlint-disable-line effecttsgo/node-builtin-import -- real socket fixture.
+import { Effect, Queue, Schema, Scope } from "effect";
+import type { StoredEvents } from "../src/host/LogForwarder.ts";
+
+const Body = Schema.Struct({
+  batch: Schema.Array(
+    Schema.Struct({
+      id: Schema.String,
+      event_message: Schema.String,
+      appname: Schema.String,
+      timestamp: Schema.String,
+      metadata: Schema.Record(Schema.String, Schema.Unknown),
+    }),
+  ),
+});
+export type FakeEvent = Schema.Schema.Type<typeof Body>["batch"][number];
+
+const decodeBody = Schema.decodeUnknownSync(Body);
+
+/** One ingest request as the fake received it. */
+export interface Received {
+  readonly port: number;
+  readonly url: string;
+  readonly apiKey: string | undefined;
+  readonly events: ReadonlyArray<FakeEvent>;
+}
+
+export interface FakeLogflareOptions {
+  /** Events per stored batch; Logflare's Postgres pipeline uses 350. */
+  readonly batchEvents?: number;
+  /** Stores queued events this long after they arrive; without it only `apply` stores them. */
+  readonly flushMillis?: number;
+  /** Events whose batch fails to store, besides those holding text Postgres jsonb rejects. */
+  readonly unstorable?: (event: FakeEvent) => boolean;
+}
+
+/** Postgres jsonb rejects NUL and unpaired surrogates anywhere in a document. */
+const jsonbStorable = (value: unknown): boolean => {
+  if (typeof value === "string") return !value.includes("\u0000") && value.isWellFormed();
+  if (Array.isArray(value)) return value.every(jsonbStorable);
+  return typeof value === "object" && value !== null
+    ? Object.entries(value).every(([key, item]) => jsonbStorable(key) && jsonbStorable(item))
+    : true;
+};
+
+/**
+ * A Logflare stand-in with its asynchronous Postgres pipeline: an accepted post only queues its
+ * events, and each per-source batch is stored atomically, or dropped whole when one of its ids is
+ * already stored or one of its events cannot be stored. Listeners share the storage, like an
+ * Analytics restarted on a new port.
+ */
+export const makeFakeLogflare = (options: FakeLogflareOptions = {}) =>
+  Effect.gen(function* () {
+    const batchEvents = options.batchEvents ?? 350;
+    const received = yield* Queue.unbounded<Received>();
+    const stored = new Map<string, Map<string, FakeEvent>>();
+    const queued = new Map<string, Array<FakeEvent>>();
+    const statuses: Array<number> = [];
+    const holds: Array<{ readonly released: Promise<void>; readonly closed: () => void }> = [];
+    const counts = { dropped: 0, aborted: 0 };
+    const flushes = yield* Queue.unbounded<void>();
+
+    const applyBatches = (limit = Number.POSITIVE_INFINITY) => {
+      let applied = 0;
+      for (const [source, events] of queued) {
+        const table = stored.get(source) ?? new Map<string, FakeEvent>();
+        stored.set(source, table);
+        while (events.length > 0 && applied < limit) {
+          const batch = events.splice(0, batchEvents);
+          applied++;
+          const ids = new Set(batch.map(({ id }) => id));
+          if (
+            ids.size < batch.length ||
+            batch.some(
+              (event) =>
+                table.has(event.id) ||
+                !jsonbStorable(event) ||
+                options.unstorable?.(event) === true,
+            )
+          )
+            counts.dropped += batch.length;
+          else for (const event of batch) table.set(event.id, event);
+        }
+      }
+    };
+    const { flushMillis } = options;
+    if (flushMillis !== undefined)
+      yield* Queue.take(flushes).pipe(
+        Effect.andThen(Effect.sleep(flushMillis)),
+        Effect.andThen(Queue.clear(flushes)),
+        Effect.andThen(Effect.sync(() => applyBatches())),
+        Effect.forever,
+        Effect.forkScoped,
+      );
+
+    const listen = Effect.acquireRelease(
+      Effect.callback<{ readonly port: number; readonly server: ReturnType<typeof createServer> }>(
+        (resume) => {
+          const server = createServer((request, response) => {
+            const chunks: Array<Uint8Array> = [];
+            request.on("data", (chunk: Uint8Array) => chunks.push(chunk));
+            request.on("end", () => {
+              const url = new URL(request.url ?? "", "http://fake");
+              const apiKey = request.headers["x-api-key"];
+              const { batch } = decodeBody(
+                JSON.parse(new TextDecoder().decode(Buffer.concat(chunks))),
+              );
+              const status = statuses.shift() ?? 200;
+              if (status >= 200 && status < 300) {
+                const source = url.searchParams.get("source_name") ?? "";
+                queued.set(source, [...(queued.get(source) ?? []), ...batch]);
+                Queue.offerUnsafe(flushes, undefined);
+              }
+              const hold = holds.shift();
+              response.on("finish", () => hold?.closed());
+              response.on("close", () => {
+                if (!response.writableFinished) counts.aborted++;
+                hold?.closed();
+              });
+              Queue.offerUnsafe(received, {
+                port: Number(request.socket.localPort),
+                url: request.url ?? "",
+                apiKey: typeof apiKey === "string" ? apiKey : undefined,
+                events: batch,
+              });
+              void (hold?.released ?? Promise.resolve()).then(() => {
+                response.statusCode = status;
+                response.end();
+              });
+            });
+          });
+          server.listen(0, "127.0.0.1", () => {
+            const address = server.address();
+            if (address === null || typeof address === "string")
+              return resume(Effect.die("fake Logflare has no address"));
+            resume(Effect.succeed({ port: address.port, server }));
+          });
+        },
+      ),
+      ({ server }) =>
+        Effect.callback<void>((resume) => {
+          server.closeAllConnections();
+          server.close(() => resume(Effect.void));
+        }),
+    ).pipe(Effect.map(({ port }) => port));
+
+    const port = yield* listen;
+    const storedIds: StoredEvents["storedIds"] = (source, ids) =>
+      Effect.sync(() => new Set(ids.filter((id) => stored.get(source)?.has(id) === true)));
+
+    return {
+      port,
+      /** Opens another ingest port sharing this fake's storage. */
+      listen: (scope: Scope.Scope) => listen.pipe(Scope.provide(scope)),
+      next: Queue.take(received),
+      /** How many received posts `next` has not taken yet. */
+      unread: Queue.size(received),
+      /** The next posts answer with these statuses; only a 2xx queues its events. */
+      respond: (...next: ReadonlyArray<number>) => Effect.sync(() => statuses.push(...next)),
+      /** Holds the next post's response until the returned effect runs; it ends once the response does. */
+      hold: Effect.sync(() => {
+        const released = Promise.withResolvers<void>();
+        const closed = Promise.withResolvers<void>();
+        holds.push({ released: released.promise, closed: closed.resolve });
+        return Effect.sync(released.resolve).pipe(
+          Effect.andThen(Effect.promise(() => closed.promise)),
+        );
+      }),
+      /** Stores queued batches now, at most `limit` of them. */
+      apply: (limit?: number) => Effect.sync(() => applyBatches(limit)),
+      /** Loses every queued event, like Analytics stopping before its pipeline flushed. */
+      discard: Effect.sync(() => queued.clear()),
+      storedIds,
+      /** A stored-event view that interrupts its callers once its scope closed, like Logflare's. */
+      storedEvents: Effect.gen(function* () {
+        let closed = false;
+        yield* Effect.addFinalizer(() =>
+          Effect.sync(() => {
+            closed = true;
+          }),
+        );
+        return {
+          storedIds: (source, ids) =>
+            Effect.suspend(() => (closed ? Effect.interrupt : storedIds(source, ids))),
+        } satisfies StoredEvents;
+      }),
+      stored: Effect.sync(() => [...stored.values()].flatMap((table) => [...table.values()])),
+      dropped: Effect.sync(() => counts.dropped),
+      aborted: Effect.sync(() => counts.aborted),
+    };
+  });
+
+export type FakeLogflare = Effect.Success<ReturnType<typeof makeFakeLogflare>>;
diff --git a/packages/stack/tests/manual-clock.ts b/packages/stack/tests/manual-clock.ts
new file mode 100644
index 0000000000..8988fac884
--- /dev/null
+++ b/packages/stack/tests/manual-clock.ts
@@ -0,0 +1,65 @@
+import { Clock, Deferred, Duration, Effect } from "effect";
+
+/**
+ * A clock that moves only when the test advances it; `sleeping` waits for a pending sleep of that
+ * duration. Wake-ups run on a later macrotask, since completing a deferred resumes its fiber
+ * inline and a sleeper and the test would otherwise drive each other without yielding to I/O.
+ */
+export const makeManualClock = Effect.gen(function* () {
+  let now = yield* Clock.currentTimeMillis;
+  const sleeps = new Set<{
+    readonly millis: number;
+    readonly until: number;
+    readonly woken: Deferred.Deferred<void>;
+  }>();
+  const waiters = new Set<{ readonly millis: number; readonly ready: Deferred.Deferred<void> }>();
+  const wake = (deferred: Deferred.Deferred<void>) =>
+    setImmediate(() => Deferred.doneUnsafe(deferred, Effect.void));
+  const nanos = () => BigInt(now) * 1_000_000n;
+  const clock: Clock.Clock = {
+    currentTimeMillisUnsafe: () => now,
+    currentTimeMillis: Effect.sync(() => now),
+    currentTimeNanosUnsafe: nanos,
+    currentTimeNanos: Effect.sync(nanos),
+    monotonicTimeNanosUnsafe: nanos,
+    monotonicTimeNanos: Effect.sync(nanos),
+    sleep: (duration) =>
+      Effect.suspend(() => {
+        const millis = Duration.toMillis(duration);
+        if (millis <= 0) return Effect.void;
+        const entry = { millis, until: now + millis, woken: Deferred.makeUnsafe<void>() };
+        sleeps.add(entry);
+        for (const waiter of waiters)
+          if (waiter.millis === millis) {
+            waiters.delete(waiter);
+            wake(waiter.ready);
+          }
+        return Deferred.await(entry.woken).pipe(
+          Effect.ensuring(Effect.sync(() => sleeps.delete(entry))),
+        );
+      }),
+  };
+  return {
+    clock,
+    sleeping: (millis: number) =>
+      Effect.suspend(() => {
+        if ([...sleeps].some((entry) => entry.millis === millis)) return Effect.void;
+        const waiter = { millis, ready: Deferred.makeUnsafe<void>() };
+        waiters.add(waiter);
+        return Deferred.await(waiter.ready).pipe(
+          Effect.ensuring(Effect.sync(() => waiters.delete(waiter))),
+        );
+      }),
+    advance: (millis: number) =>
+      Effect.sync(() => {
+        now += millis;
+        for (const entry of sleeps)
+          if (entry.until <= now) {
+            sleeps.delete(entry);
+            wake(entry.woken);
+          }
+      }),
+  };
+});
+
+export type ManualClock = Effect.Success<typeof makeManualClock>;
diff --git a/packages/stack/tests/public-client-fixture.ts b/packages/stack/tests/public-client-fixture.ts
index 5e905361ef..4f9bdaa20e 100644
--- a/packages/stack/tests/public-client-fixture.ts
+++ b/packages/stack/tests/public-client-fixture.ts
@@ -20,8 +20,8 @@ try {
   });
   // oxlint-disable-next-line effecttsgo/async-function -- This fixture exercises the Promise client API.
   readLogs = (async () => {
-    for await (const entry of mail.logs()) {
-      logs += `[${entry.stream}] ${new TextDecoder().decode(entry.bytes)}`;
+    for await (const record of mail.readLogs({ follow: true })) {
+      if (record.text !== undefined) logs += `[${record.kind}] ${record.text}\n`;
     }
   })().catch((cause) => {
     logReaderFailure = cause;
diff --git a/packages/stack/tests/whole-stack/analytics.ts b/packages/stack/tests/whole-stack/analytics.ts
index 810025b9fe..898d28acae 100644
--- a/packages/stack/tests/whole-stack/analytics.ts
+++ b/packages/stack/tests/whole-stack/analytics.ts
@@ -21,37 +21,6 @@ class AnalyticsFlowError extends Schema.TaggedError<AnalyticsFlowError>()(
   },
 ) {}
 
-/** Builds the Vector config used by the whole-stack Analytics flow. */
-export const vectorAnalyticsConfig = (marker: string): string =>
-  `sources:
-  demo_logs:
-    type: demo_logs
-    format: json
-    interval: 1
-transforms:
-  fixture_marker:
-    type: remap
-    inputs: [demo_logs]
-    source: |
-      .event_message = ${JSON.stringify(marker)}
-      .message = ${JSON.stringify(marker)}
-sinks:
-  analytics:
-    type: http
-    inputs: [fixture_marker]
-    uri: "${"${LOGFLARE_URL}"}/api/logs?source_name=postgres.logs"
-    method: post
-    encoding:
-      codec: json
-    request:
-      headers:
-        x-api-key: "${"${LOGFLARE_PRIVATE_ACCESS_TOKEN}"}"
-    batch:
-      max_events: 1
-      timeout_secs: 1
-    healthcheck: false
-`;
-
 const request = Effect.fn("WholeStack.analyticsRequest")(
   (request: HttpClientRequest.HttpClientRequest) =>
     Effect.gen(function* () {
@@ -60,7 +29,7 @@ const request = Effect.fn("WholeStack.analyticsRequest")(
     }).pipe(Effect.mapError((cause) => new AnalyticsFlowError({ operation: "request", cause }))),
 );
 
-/** Sends one marker directly to Logflare, for separating API ingest from Vector ingest. */
+/** Sends one marker directly to Logflare. */
 const postAnalyticsMarker = Effect.fn("WholeStack.postAnalyticsMarker")(
   (analyticsUrl: string, apiKey: string, marker: string, timestampMillis: number) =>
     Effect.gen(function* () {
@@ -144,25 +113,22 @@ const queryMarkerUntilVisible = Effect.fn("WholeStack.queryMarkerUntilVisible")(
     ),
 );
 
-/** Exercises direct and Vector Analytics ingestion for one whole-stack phase. */
+/** Names the marker every phase of a stack ingests, for cross-stack isolation checks. */
+export const stackAnalyticsMarker = (stackId: string): string => `stack-${stackId}`;
+
+/** Exercises Analytics ingestion for one whole-stack phase. */
 export const exerciseAnalytics = Effect.fn("WholeStack.exerciseAnalytics")(
-  (analyticsUrl: string, vectorUrl: string, apiKey: string, stackId: string, phase: string) =>
+  (analyticsUrl: string, apiKey: string, stackId: string, phase: string) =>
     Effect.gen(function* () {
       const phaseStartedAtMillis = yield* Clock.currentTimeMillis;
-      const directMarker = `direct-${stackId}-${phase}-${phaseStartedAtMillis}`;
-      const vectorMarker = `vector-${stackId}`;
-      yield* postAnalyticsMarker(analyticsUrl, apiKey, directMarker, phaseStartedAtMillis);
-      const vectorHealth = yield* request(HttpClientRequest.get(`${vectorUrl}/health`));
-      yield* vectorHealth.text;
-      if (vectorHealth.status >= 400)
-        return yield* new AnalyticsFlowError({
-          operation: "vector-health",
-          cause: vectorHealth.status,
-        });
+      const phaseMarker = `direct-${stackId}-${phase}-${phaseStartedAtMillis}`;
+      const stackMarker = stackAnalyticsMarker(stackId);
+      yield* postAnalyticsMarker(analyticsUrl, apiKey, phaseMarker, phaseStartedAtMillis);
+      yield* postAnalyticsMarker(analyticsUrl, apiKey, stackMarker, phaseStartedAtMillis);
       yield* Effect.all(
         [
-          queryMarkerUntilVisible(analyticsUrl, apiKey, directMarker, phaseStartedAtMillis),
-          queryMarkerUntilVisible(analyticsUrl, apiKey, vectorMarker, phaseStartedAtMillis),
+          queryMarkerUntilVisible(analyticsUrl, apiKey, phaseMarker, phaseStartedAtMillis),
+          queryMarkerUntilVisible(analyticsUrl, apiKey, stackMarker, phaseStartedAtMillis),
         ],
         { concurrency: 2, discard: true },
       );
diff --git a/packages/stack/tests/whole-stack/fixture.ts b/packages/stack/tests/whole-stack/fixture.ts
index 98e048cf87..c34c578377 100644
--- a/packages/stack/tests/whole-stack/fixture.ts
+++ b/packages/stack/tests/whole-stack/fixture.ts
@@ -17,7 +17,6 @@ import { homedir, tmpdir } from "node:os";
 import { HttpClient, HttpClientRequest } from "effect/unstable/http";
 import { create, type Stack } from "../../src/effect.ts";
 import type { Observation } from "../../src/Rpc.ts";
-import { vectorAnalyticsConfig } from "./analytics.ts";
 import { cleanupDockerRoot } from "../docker-cleanup.ts";
 import { destroyTestStack } from "../stack-cleanup.ts";
 
@@ -35,7 +34,6 @@ export const serviceNames = [
   "pgmeta",
   "mail",
   "analytics",
-  "vector",
   "pooler",
 ] as const;
 
@@ -62,10 +60,10 @@ const watchServiceLogs = Effect.fn("WholeStack.watchServiceLogs")(
       services,
       (instance) =>
         Effect.forkScoped(
-          instance.logs.pipe(
-            Stream.runForEach(({ bytes }) =>
+          instance.readLogs({ follow: true }).pipe(
+            Stream.runForEach((record) =>
               Ref.update(logTails, (tails) => {
-                const text = new TextDecoder().decode(bytes);
+                const text = record.text === undefined ? "" : `${record.text}\n`;
                 const existing = tails.find(([name]) => name === instance.service)?.[1] ?? "";
                 const updated = `${existing}${text}`.slice(-8192);
                 const without = tails.filter(([name]) => name !== instance.service);
@@ -119,7 +117,6 @@ export const wholeStack = Effect.fn("WholeStack.fixture")((runtime: Runtime) =>
     });
     const functionsRoot = `${root}/functions`;
     const storageRoot = `${root}/storage`;
-    const vectorConfigPath = `${root}/vector.yaml`;
     yield* fs.makeDirectory(`${functionsRoot}/hello`, { recursive: true });
     yield* fs.makeDirectory(storageRoot, { recursive: true });
     yield* fs.writeFileString(
@@ -138,7 +135,6 @@ export const wholeStack = Effect.fn("WholeStack.fixture")((runtime: Runtime) =>
       runtime,
       name: `whole-${runtime}`,
     });
-    yield* fs.writeFileString(vectorConfigPath, vectorAnalyticsConfig(`vector-${stack.id}`));
     const owner = yield* Ref.make<Option.Option<Stack>>(Option.some(stack));
     yield* Effect.addFinalizer(() =>
       Effect.gen(function* () {
@@ -210,14 +206,6 @@ export const wholeStack = Effect.fn("WholeStack.fixture")((runtime: Runtime) =>
           config: { backend: "postgres", apiKey: secret },
           endpoints: { http: endpoint("auto") },
         },
-        {
-          service: "vector",
-          config: {
-            apiKey: secret,
-            configPath: vectorConfigPath,
-          },
-          endpoints: { http: endpoint("auto") },
-        },
         {
           service: "pooler",
           config: {
diff --git a/packages/stack/tests/whole-stack/scenarios.ts b/packages/stack/tests/whole-stack/scenarios.ts
index 5edcc136fa..0c1e42633b 100644
--- a/packages/stack/tests/whole-stack/scenarios.ts
+++ b/packages/stack/tests/whole-stack/scenarios.ts
@@ -23,7 +23,7 @@ import {
   exerciseMetadataAndPooler,
   exerciseStorageAndFunctions,
 } from "./service-flows.ts";
-import { exerciseAnalytics, queryAnalyticsMarker } from "./analytics.ts";
+import { exerciseAnalytics, queryAnalyticsMarker, stackAnalyticsMarker } from "./analytics.ts";
 import { subscribeRealtime } from "./websocket.ts";
 import { watchRecoveryMail } from "./realtime-mail.ts";
 import { assertWorkloadsGone, captureWorkloads } from "./workloads.ts";
@@ -289,10 +289,8 @@ const exerciseStack = Effect.fn("WholeStack.exerciseStack")(
           }),
         );
         const analyticsUrl = (yield* service(fixture, "analytics").credentials()).url;
-        const vectorUrl = (yield* service(fixture, "vector").credentials()).url;
-        if (analyticsUrl === undefined || vectorUrl === undefined)
-          return yield* Effect.die("Analytics or Vector URL missing");
-        yield* exerciseAnalytics(analyticsUrl, vectorUrl, fixture.secret, fixture.stack.id, phase);
+        if (analyticsUrl === undefined) return yield* Effect.die("Analytics URL missing");
+        yield* exerciseAnalytics(analyticsUrl, fixture.secret, fixture.stack.id, phase);
         yield* assertLifecycle(fixture, "running");
         return {
           accessToken: loginBody.access_token,
@@ -444,12 +442,20 @@ export const parallel = (runtime: Runtime) =>
       if (leftAnalyticsUrl === undefined || rightAnalyticsUrl === undefined)
         return yield* Effect.die("Parallel Analytics URL missing");
       expect(
-        (yield* queryAnalyticsMarker(leftAnalyticsUrl, left.secret, `vector-${right.stack.id}`, 0))
-          .length,
+        (yield* queryAnalyticsMarker(
+          leftAnalyticsUrl,
+          left.secret,
+          stackAnalyticsMarker(right.stack.id),
+          0,
+        )).length,
       ).toBe(0);
       expect(
-        (yield* queryAnalyticsMarker(rightAnalyticsUrl, right.secret, `vector-${left.stack.id}`, 0))
-          .length,
+        (yield* queryAnalyticsMarker(
+          rightAnalyticsUrl,
+          right.secret,
+          stackAnalyticsMarker(left.stack.id),
+          0,
+        )).length,
       ).toBe(0);
       const rightRest = service(right, "rest");
       const rightRestUrl = (yield* rightRest.credentials()).url;
diff --git a/packages/stack/tests/whole-stack/workloads.ts b/packages/stack/tests/whole-stack/workloads.ts
index 1e496eab17..da3a1e377d 100644
--- a/packages/stack/tests/whole-stack/workloads.ts
+++ b/packages/stack/tests/whole-stack/workloads.ts
@@ -51,8 +51,12 @@ const snapshotOutput = (runtime: Runtime, fixture: WholeStack, includeStopped: b
       .filter((line) => line.length > 0)
       .map((line) => {
         const [id, instance, managed] = line.split("\t");
-        return { identity: `${id ?? ""} ${instance ?? ""}`.trim(), managed };
-      });
+        return { identity: `${id ?? ""} ${instance ?? ""}`.trim(), instance, managed };
+      })
+      // The stack label alone also tags best-effort containers that carry neither an instance
+      // nor a `stack-managed` identity, such as the host-gateway probe (see `readProbeHosts` in
+      // `Container.ts`); only the two documented identity labels promise a workload.
+      .filter((record) => (record.instance ?? "") !== "" || record.managed === "true");
     return {
       identities: records
         .filter((record) => record.managed !== "true")
diff --git a/packages/stack/vitest.config.ts b/packages/stack/vitest.config.ts
index 88e8c7d186..ca0f72b3de 100644
--- a/packages/stack/vitest.config.ts
+++ b/packages/stack/vitest.config.ts
@@ -27,6 +27,7 @@ export default defineConfig({
           // Integration workers start real service processes and containers.
           maxWorkers: 4,
           sequence: { groupOrder: 1 },
+          globalSetup: ["tests/docker-volume-run.ts"],
         },
       },
       {
@@ -34,6 +35,7 @@ export default defineConfig({
           name: "e2e",
           hookTimeout: 120_000,
           include: ["**/*.e2e.test.ts"],
+          globalSetup: ["tests/docker-volume-run.ts"],
         },
       },
     ],
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 8d31bdf13a..e239809293 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -331,11 +331,11 @@ importers:
         specifier: workspace:*
         version: link:../../packages/config
       '@supabase/pg-delta':
-        specifier: 1.0.0-alpha.56
-        version: 1.0.0-alpha.56(@supabase/pg-topo@1.0.0-alpha.7(supports-color@7.2.0))(supports-color@7.2.0)
+        specifier: 1.0.0-alpha.57
+        version: 1.0.0-alpha.57(@supabase/pg-topo@1.0.0-alpha.8(supports-color@7.2.0))(supports-color@7.2.0)
       '@supabase/pg-topo':
-        specifier: 1.0.0-alpha.7
-        version: 1.0.0-alpha.7(supports-color@7.2.0)
+        specifier: 1.0.0-alpha.8
+        version: 1.0.0-alpha.8(supports-color@7.2.0)
       '@supabase/stack':
         specifier: workspace:*
         version: link:../../packages/stack
@@ -343,8 +343,8 @@ importers:
         specifier: 'catalog:'
         version: 2.112.4
       '@supabase/typegen':
-        specifier: 0.2.1
-        version: 0.2.1(oxfmt@0.66.0)
+        specifier: 0.2.2
+        version: 0.2.2(oxfmt@0.66.0)
       '@tsconfig/bun':
         specifier: 'catalog:'
         version: 1.0.11
@@ -718,11 +718,11 @@ packages:
       zod:
         optional: true
 
-  '@ark/schema@0.56.2':
-    resolution: {integrity: sha512-Qx4D2JFbBWpntiHZaTv7bGG4H/M2rigiknezKg/WVyDSaLdE4YCcWAOoFB7pjjDqHbbV2OqRfntm1nnXvwMexg==}
+  '@ark/schema@0.56.4':
+    resolution: {integrity: sha512-nd4OqaWdKZJeGF5zNmZysDQO7NyyJ1ycl4S7i16Hj1VxqL+x72Z66lOn7ErpsoMUZtCtslAMHMjqJhuQSxciyw==}
 
-  '@ark/util@0.56.2':
-    resolution: {integrity: sha512-9kU2sUE38FZEGG7l3hamYMBieLYEJh2L1mrYD2eXpT+78EnQSV1bhjxJhnxGBMSTbtwpBSDNSK+K60WvaI/DTQ==}
+  '@ark/util@0.56.4':
+    resolution: {integrity: sha512-KKqwGSia44cvuuDY70jGfbiUdG2E8F2cM4npdqvJ22S5a0LknlwG6nIrfQG1nF8fzxpzP30098wp0a8ASs0prQ==}
 
   '@babel/code-frame@7.29.7':
     resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
@@ -2889,18 +2889,18 @@ packages:
     resolution: {integrity: sha512-DQ0aVH8wSQAccVqNoEkec62qCu2QRNyoGN53RqsVZ1k6F1zq4/v8scrlR6LNT2RJmT97apiTmORijPVhErCS2g==}
     engines: {node: '>=22.0.0'}
 
-  '@supabase/pg-delta@1.0.0-alpha.56':
-    resolution: {integrity: sha512-Cerar16vqsLV4dO/IxjDbKBSItB5936JOEE46R/gUjey1hHztkfdcgP0GCoM8i510nxyAT/lUDCdXFraRheizQ==}
+  '@supabase/pg-delta@1.0.0-alpha.57':
+    resolution: {integrity: sha512-RvVdklxDBWgPPrbMzXcREq3YltOykMB0t26Lz5ZV1bQCcLnmqzu851FMcv7h9Hg5rz8DZiARjDq5HPVrawpPYw==}
     engines: {node: '>=20.0.0'}
     hasBin: true
     peerDependencies:
-      '@supabase/pg-topo': ^1.0.0-alpha.7
+      '@supabase/pg-topo': ^1.0.0-alpha.8
     peerDependenciesMeta:
       '@supabase/pg-topo':
         optional: true
 
-  '@supabase/pg-topo@1.0.0-alpha.7':
-    resolution: {integrity: sha512-agvnNRKOSs0A02mW95KW+AKaF0YR/uk0GFBoCfQbGjjdgawk/I2O2wlMWQvbryzsuDr0unWbdPdj3Aah5FexLA==}
+  '@supabase/pg-topo@1.0.0-alpha.8':
+    resolution: {integrity: sha512-YkAaQxscOW4GHrgQufCDYe/a7nouj1VBVlehSysdtvTRPr4BYCwbJnWcoUEMgoBpUkOF8Zm0VFjNNWszO9aYow==}
 
   '@supabase/phoenix@0.4.5':
     resolution: {integrity: sha512-aAn9H9ovVyeApKy11OWOrrOGq8DV68yWeH4ud2lN9fzn4aO8Zb5GLL9m1pUg9nLqIcT+ZDfAcsZe0E/nqdv2lw==}
@@ -2909,8 +2909,8 @@ packages:
     resolution: {integrity: sha512-uaubtPSeg2TR4wrtfQoQWgkTAe+a0qWX2KhmwvTfNl5mGN9+U7owiJt6abk3o/V6O899PSRD1yzxs5RlF4xTug==}
     engines: {node: '>=22.0.0'}
 
-  '@supabase/postgrest-typegen@0.3.1':
-    resolution: {integrity: sha512-FxgP+13VCH0ho3LKAhFHA6+vPk3Rbw54eZmGcDbFUcFzhjigSp8HBrgMJHVcNwjRrHpmItL0SvXAeAkOYxO7hQ==}
+  '@supabase/postgrest-typegen@0.4.0':
+    resolution: {integrity: sha512-WxQ+/LWQYhAHADiSHVhxHghcc0w6U8B6eQ0WTE0CSkNsfqpoX3RGa9odmL/3l/oGpqcy51ajQOK5CKv9mNBpZA==}
     engines: {node: '>=22.12.0'}
     peerDependencies:
       oxfmt: 0.66.0
@@ -2935,8 +2935,8 @@ packages:
       '@opentelemetry/api':
         optional: true
 
-  '@supabase/typegen@0.2.1':
-    resolution: {integrity: sha512-7M86EUD/zp9e3arbcBwXAPlUYowKEfhXXx5lgizjAqXzJeN4LZX8jeN8v+EYBWn3c8O1xXpl+HVG08V1MFLflQ==}
+  '@supabase/typegen@0.2.2':
+    resolution: {integrity: sha512-aFz0tBMbwHNluW0LHFwdPCiKDEjH0ZSUBZp4C4k4CuPz18BDmxjId6OWP+mGGByqm1JXl3dTckbfDc8iADi/aA==}
     engines: {node: '>=22.12.0'}
     peerDependencies:
       oxfmt: 0.66.0
@@ -3441,11 +3441,11 @@ packages:
     resolution: {integrity: sha512-ik3ZgC9dY/lYVVM++OISsaYDeg1tb0VtP5uL3ouh1koGOaUMDPpbFIei4JkFimWUFPn90sbMNMXQAIVOlnYKJA==}
     engines: {node: '>=10'}
 
-  arkregex@0.0.8:
-    resolution: {integrity: sha512-PJcx6G1kQTgLKPUbeYlYecDRaKq15AMSGVajlKFYWlPeJRQL+j3dKE6tyMs40HZ99djS1l9Vhl3ezAHy9JBIqQ==}
+  arkregex@0.0.10:
+    resolution: {integrity: sha512-+iDWBYBjH8w7wqEv8VY4loBwRldFxX84KNwKbobH3FJPay/18XI9sTesmXYpKyIrgbC5z/s16+vSJYHCC9FEvQ==}
 
-  arktype@2.2.3:
-    resolution: {integrity: sha512-7W+0RLTUNJiBFIIZXwOQxSR8Z273IAd6IvqBeG9+gHnQKFsIx2C0iOtGTmMrPnlX4qLXyc5+ll7A0BIj9WrbTg==}
+  arktype@2.2.5:
+    resolution: {integrity: sha512-c9oqY1eBab2LceqvpWX50xae2HB8P/nJPxRhuhPVf5lEDi3WQpf7WQflJFMsyCiA3NGh6zENOlse30gWBzlwDg==}
 
   array-flatten@1.1.1:
     resolution: {integrity: sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==}
@@ -6903,11 +6903,11 @@ snapshots:
     optionalDependencies:
       zod: 4.5.4
 
-  '@ark/schema@0.56.2':
+  '@ark/schema@0.56.4':
     dependencies:
-      '@ark/util': 0.56.2
+      '@ark/util': 0.56.4
 
-  '@ark/util@0.56.2': {}
+  '@ark/util@0.56.4': {}
 
   '@babel/code-frame@7.29.7':
     dependencies:
@@ -8668,7 +8668,7 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
-  '@supabase/pg-delta@1.0.0-alpha.56(@supabase/pg-topo@1.0.0-alpha.7(supports-color@7.2.0))(supports-color@7.2.0)':
+  '@supabase/pg-delta@1.0.0-alpha.57(@supabase/pg-topo@1.0.0-alpha.8(supports-color@7.2.0))(supports-color@7.2.0)':
     dependencies:
       '@types/debug': 4.1.13
       '@types/pg': 8.23.1
@@ -8676,12 +8676,12 @@ snapshots:
       pg: 8.23.0
       pg-connection-string: 2.14.0
     optionalDependencies:
-      '@supabase/pg-topo': 1.0.0-alpha.7(supports-color@7.2.0)
+      '@supabase/pg-topo': 1.0.0-alpha.8(supports-color@7.2.0)
     transitivePeerDependencies:
       - pg-native
       - supports-color
 
-  '@supabase/pg-topo@1.0.0-alpha.7(supports-color@7.2.0)':
+  '@supabase/pg-topo@1.0.0-alpha.8(supports-color@7.2.0)':
     dependencies:
       '@pgsql/traverse': 17.2.6(supports-color@7.2.0)
       plpgsql-parser: 0.5.16(supports-color@7.2.0)
@@ -8694,9 +8694,9 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
-  '@supabase/postgrest-typegen@0.3.1(oxfmt@0.66.0)':
+  '@supabase/postgrest-typegen@0.4.0(oxfmt@0.66.0)':
     dependencies:
-      arktype: 2.2.3
+      arktype: 2.2.5
     optionalDependencies:
       oxfmt: 0.66.0
 
@@ -8718,9 +8718,9 @@ snapshots:
       '@supabase/realtime-js': 2.112.4
       '@supabase/storage-js': 2.112.4
 
-  '@supabase/typegen@0.2.1(oxfmt@0.66.0)':
+  '@supabase/typegen@0.2.2(oxfmt@0.66.0)':
     dependencies:
-      '@supabase/postgrest-typegen': 0.3.1(oxfmt@0.66.0)
+      '@supabase/postgrest-typegen': 0.4.0(oxfmt@0.66.0)
     optionalDependencies:
       oxfmt: 0.66.0
 
@@ -9196,15 +9196,15 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
-  arkregex@0.0.8:
+  arkregex@0.0.10:
     dependencies:
-      '@ark/util': 0.56.2
+      '@ark/util': 0.56.4
 
-  arktype@2.2.3:
+  arktype@2.2.5:
     dependencies:
-      '@ark/schema': 0.56.2
-      '@ark/util': 0.56.2
-      arkregex: 0.0.8
+      '@ark/schema': 0.56.4
+      '@ark/util': 0.56.4
+      arkregex: 0.0.10
 
   array-flatten@1.1.1: {}
 
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 3f28d1bc19..eba62ba6d2 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -108,10 +108,14 @@ minimumReleaseAgeExclude:
   - "@effect/platform-node-shared@4.0.0-rc.112"
   - "@effect/sql-pg@4.0.0-rc.112"
   - "@effect/vitest@4.0.0-rc.112"
-  - "@supabase/pg-delta@1.0.0-alpha.56"
-  - "@supabase/pg-topo@1.0.0-alpha.7"
-  - "@supabase/postgrest-typegen@0.3.1"
-  - "@supabase/typegen@0.2.1"
+  - "@supabase/pg-delta@1.0.0-alpha.57"
+  - "@supabase/pg-topo@1.0.0-alpha.8"
+  - "@supabase/postgrest-typegen@0.4.0"
+  - "@supabase/typegen@0.2.2"
+  - "arktype@2.2.5"
+  - "@ark/schema@0.56.4"
+  - "@ark/util@0.56.4"
+  - "arkregex@0.0.10"
   - "effect@4.0.0-rc.112"
   - "turbo@2.10.11"