diff --git a/src/content/docs/reference/security/known-gaps.md b/src/content/docs/reference/security/known-gaps.md
index f3af1cf..48d98c3 100644
--- a/src/content/docs/reference/security/known-gaps.md
+++ b/src/content/docs/reference/security/known-gaps.md
@@ -9,7 +9,7 @@ sidebar:
 
 <!-- Generated by tools/refgen from spin:docs/security/README.md. Edit the source, not this file. -->
 
-The open items of Spinbox's security model, from spin's [`docs/security/README.md`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/docs/security/README.md) at `77380b13d`. The numbers are [its rules](/reference/security/rules/).
+The open items of Spinbox's security model, from spin's [`docs/security/README.md`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/docs/security/README.md) at `b3598142d`. The numbers are [its rules](/reference/security/rules/).
 
 What no line keeps yet. Each is a design change, not a patch, which is why it is here.
 
diff --git a/src/content/docs/reference/security/rules.md b/src/content/docs/reference/security/rules.md
index a7d573a..2db656f 100644
--- a/src/content/docs/reference/security/rules.md
+++ b/src/content/docs/reference/security/rules.md
@@ -9,7 +9,7 @@ sidebar:
 
 <!-- Generated by tools/refgen from spin:docs/security/README.md. Edit the source, not this file. -->
 
-The rules every entry point must keep, from spin's [`docs/security/README.md`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/docs/security/README.md) at `77380b13d`. Code cites a rule's number at the line that keeps it. **Gate** is what fails a build when the rule is broken; *none* marks a rule kept only by each place remembering it. What is still open is on [Known gaps](/reference/security/known-gaps/).
+The rules every entry point must keep, from spin's [`docs/security/README.md`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/docs/security/README.md) at `b3598142d`. Code cites a rule's number at the line that keeps it. **Gate** is what fails a build when the rule is broken; *none* marks a rule kept only by each place remembering it. What is still open is on [Known gaps](/reference/security/known-gaps/).
 
 | # | Rule | Gate |
 |---|---|---|
diff --git a/src/content/docs/reference/status/index.md b/src/content/docs/reference/status/index.md
index 9e2b162..045a2f6 100644
--- a/src/content/docs/reference/status/index.md
+++ b/src/content/docs/reference/status/index.md
@@ -9,7 +9,7 @@ sidebar:
 
 <!-- Generated by tools/refgen from spin:internal/features/features.go. Edit the source, not this file. -->
 
-Every row of this page is a line of `internal/features` in spin, and a test there resolves it against the tree. A row that says **built** names what shows the feature exists - a procedure the control plane serves, a command the CLI has, or a test - and, under **End to end**, the tests that drive a real runner and its guest and check what the feature did, or what no test checks yet. spin's build checks that each of those tests is there and not quarantined; whether it checks the whole feature is its review's. A row that says **not built** is an item of [`docs/ROADMAP.md`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/docs/ROADMAP.md). The page is written by `task reference` from `spin features` at spin `77380b13d`, and cannot say a feature the binary does not.
+Every row of this page is a line of `internal/features` in spin, and a test there resolves it against the tree. A row that says **built** names what shows the feature exists - a procedure the control plane serves, a command the CLI has, or a test - and, under **End to end**, the tests that drive a real runner and its guest and check what the feature did, or what no test checks yet. spin's build checks that each of those tests is there and not quarantined; whether it checks the whole feature is its review's. A row that says **not built** is an item of [`docs/ROADMAP.md`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/docs/ROADMAP.md). The page is written by `task reference` from `spin features` at spin `b3598142d`, and cannot say a feature the binary does not.
 
 ## Built
 
@@ -17,116 +17,116 @@ Every row of this page is a line of `internal/features` in spin, and a test ther
 
 | Feature | Exists | End to end |
 |---|---|---|
-| A machine per workspace: KVM, its own kernel, root, a persistent disk, SSH | [`TestAWorkspaceBootsARealGuest`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/vm_test.go#L167), a test of `internal/e2e` | [`TestAWorkspaceBootsARealGuest`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/vm_test.go#L167) |
-| Create, start, stop and delete | [`WorkspaceService/CreateWorkspace`](/reference/api/workspaceservice/) | [`TestE2E_WorkspaceCRUD`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/e2e_test.go#L397) |
-| A trash: a deleted workspace stays whole, for its owner to undelete, until its days are up | [`TestAWorkspaceWhoseDaysInTheTrashAreUpIsErasedFromItsHost`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/background_test.go#L379), a test of `internal/e2e` | [`TestATrashedWorkspaceIsWholeWhenItsOwnerUndeletesIt`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/background_test.go#L411)<br/>[`TestAWorkspaceWhoseDaysInTheTrashAreUpIsErasedFromItsHost`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/background_test.go#L379) |
-| Idle suspend, with a question before it that a keep answers | [`TestAWorkspaceIsAskedBeforeItsSuspensionAndAKeepAnswersIt`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/background_test.go#L107), a test of `internal/e2e` | [`TestAWorkspaceIsAskedBeforeItsSuspensionAndAKeepAnswersIt`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/background_test.go#L107) |
-| A workspace that ran as long as the installation allows is suspended | [`TestAWorkspaceThatRanForAsLongAsAllowedIsSuspended`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/background_test.go#L69), a test of `internal/e2e` | [`TestAWorkspaceThatRanForAsLongAsAllowedIsSuspended`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/background_test.go#L69) |
-| A process inside holds its workspace awake while it lives | [`TestAProcessHoldsItsWorkspaceAwakeWhileItLives`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/background_test.go#L190), a test of `internal/e2e` | [`TestAProcessHoldsItsWorkspaceAwakeWhileItLives`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/background_test.go#L190) |
-| Suspend with the processes where they are; a start resumes them | [`TestAWorkspaceNobodyUsesIsSuspendedAndAStartResumesIt`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/background_test.go#L35), a test of `internal/e2e` | [`TestE2E_ASuspendedWorkspaceResumesWhereItWas`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/journeys_e2e_test.go#L160)<br/>[`TestAWorkspaceNobodyUsesIsSuspendedAndAStartResumesIt`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/background_test.go#L35) |
-| Cores and memory lent while the host has them, and taken back | [`TestABusyWorkspaceIsLentCoresAndGivesThemBack`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/background_test.go#L342), a test of `internal/e2e` | not yet: memory lent and taken back, and a loan refused while the host is full |
-| A grant of cores and memory of its own, for a while | [`TestAGrantWhoseTimeIsUpIsGivenBackToTheMachine`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/background_test.go#L288), a test of `internal/e2e` | [`TestAGrantWhoseTimeIsUpIsGivenBackToTheMachine`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/background_test.go#L288) |
-| Move a running workspace to another host, its processes as they are | [`TestHostsAMoveTakesARunningWorkspaceToAnotherHost`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/hosts_flows_test.go#L65), a test of `internal/e2e` | [`TestHostsAMoveTakesARunningWorkspaceToAnotherHost`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/hosts_flows_test.go#L65) |
-| Clone a workspace: its disk, team, project, size, policies and environment, in one | [`TestACloneHoldsWhatItsSourceWroteAndItsShape`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/clone_test.go#L68), a test of `internal/e2e` | [`TestACloneHoldsWhatItsSourceWroteAndItsShape`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/clone_test.go#L68) |
-| Recover a workspace whose host is gone, at a cost its owner accepts | [`TestHostsAWorkspaceWhoseHostIsGoneIsRecoveredOnAnother`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/hosts_flows_test.go#L99), a test of `internal/e2e` | not yet: the cost asked of the owner before a recovery, and what was written after the snapshot gone |
-| A workspace outlives its runner | [`TestAWorkspaceOutlivesItsRunner`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/vm_test.go#L250), a test of `internal/e2e` | [`TestAWorkspaceOutlivesItsRunner`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/vm_test.go#L250) |
-| Quarantine, by an administrator | [`WorkspaceService/QuarantineWorkspace`](/reference/api/workspaceservice/) | [`TestE2E_AQuarantinedWorkspaceIsHeldUntilReleased`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/journeys_e2e_test.go#L209) |
-| Why a workspace is not behaving: status, console, history | [`spin workspace status`](/reference/cli/workspace/) | [`TestE2E_AQuarantinedWorkspaceIsHeldUntilReleased`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/journeys_e2e_test.go#L209)<br/>[`TestE2E_AWorkspacesConsoleIsWhatItsMachinePrinted`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/journeys_e2e_test.go#L243) |
-| The owner's shell, environment, editor settings, Taskfile and dotfiles reach the guest | [`TestAWorkspacesOwnEnvironmentIsInItsOwnersLoginShell`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/env_test.go#L23), a test of `internal/e2e` | [`TestTheOwnersSettingsArriveInTheGuest`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/env_test.go#L64)<br/>[`TestAWorkspacesOwnEnvironmentIsInItsOwnersLoginShell`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/env_test.go#L23) |
-| Reset a disk to what it was created from | [`spin workspace reset`](/reference/cli/workspace/) | [`TestE2E_ResetPutsAWorkspaceBackToWhatItWasCreatedFrom`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/e2e_test.go#L1182) |
-| Claude Code and Codex on every workspace's PATH, at the versions the release pins, with their own defaults | [`TestTheAgentCLIsAreOnPathWithThePinnedVersions`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/agentclis_test.go#L20), a test of `internal/e2e` | [`TestTheAgentCLIsAreOnPathWithThePinnedVersions`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/agentclis_test.go#L20) |
+| A machine per workspace: KVM, its own kernel, root, a persistent disk, SSH | [`TestAWorkspaceBootsARealGuest`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/vm_test.go#L167), a test of `internal/e2e` | [`TestAWorkspaceBootsARealGuest`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/vm_test.go#L167) |
+| Create, start, stop and delete | [`WorkspaceService/CreateWorkspace`](/reference/api/workspaceservice/) | [`TestE2E_WorkspaceCRUD`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/e2e_test.go#L397) |
+| A trash: a deleted workspace stays whole, for its owner to undelete, until its days are up | [`TestAWorkspaceWhoseDaysInTheTrashAreUpIsErasedFromItsHost`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/background_test.go#L379), a test of `internal/e2e` | [`TestATrashedWorkspaceIsWholeWhenItsOwnerUndeletesIt`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/background_test.go#L411)<br/>[`TestAWorkspaceWhoseDaysInTheTrashAreUpIsErasedFromItsHost`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/background_test.go#L379) |
+| Idle suspend, with a question before it that a keep answers | [`TestAWorkspaceIsAskedBeforeItsSuspensionAndAKeepAnswersIt`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/background_test.go#L107), a test of `internal/e2e` | [`TestAWorkspaceIsAskedBeforeItsSuspensionAndAKeepAnswersIt`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/background_test.go#L107) |
+| A workspace that ran as long as the installation allows is suspended | [`TestAWorkspaceThatRanForAsLongAsAllowedIsSuspended`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/background_test.go#L69), a test of `internal/e2e` | [`TestAWorkspaceThatRanForAsLongAsAllowedIsSuspended`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/background_test.go#L69) |
+| A process inside holds its workspace awake while it lives | [`TestAProcessHoldsItsWorkspaceAwakeWhileItLives`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/background_test.go#L190), a test of `internal/e2e` | [`TestAProcessHoldsItsWorkspaceAwakeWhileItLives`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/background_test.go#L190) |
+| Suspend with the processes where they are; a start resumes them | [`TestAWorkspaceNobodyUsesIsSuspendedAndAStartResumesIt`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/background_test.go#L35), a test of `internal/e2e` | [`TestE2E_ASuspendedWorkspaceResumesWhereItWas`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/journeys_e2e_test.go#L160)<br/>[`TestAWorkspaceNobodyUsesIsSuspendedAndAStartResumesIt`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/background_test.go#L35) |
+| Cores and memory lent while the host has them, and taken back | [`TestABusyWorkspaceIsLentCoresAndGivesThemBack`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/background_test.go#L342), a test of `internal/e2e` | not yet: memory lent and taken back, and a loan refused while the host is full |
+| A grant of cores and memory of its own, for a while | [`TestAGrantWhoseTimeIsUpIsGivenBackToTheMachine`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/background_test.go#L288), a test of `internal/e2e` | [`TestAGrantWhoseTimeIsUpIsGivenBackToTheMachine`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/background_test.go#L288) |
+| Move a running workspace to another host, its processes as they are | [`TestHostsAMoveTakesARunningWorkspaceToAnotherHost`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/hosts_flows_test.go#L65), a test of `internal/e2e` | [`TestHostsAMoveTakesARunningWorkspaceToAnotherHost`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/hosts_flows_test.go#L65) |
+| Clone a workspace: its disk, team, project, size, policies and environment, in one | [`TestACloneHoldsWhatItsSourceWroteAndItsShape`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/clone_test.go#L68), a test of `internal/e2e` | [`TestACloneHoldsWhatItsSourceWroteAndItsShape`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/clone_test.go#L68) |
+| Recover a workspace whose host is gone, at a cost its owner accepts | [`TestHostsAWorkspaceWhoseHostIsGoneIsRecoveredOnAnother`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/hosts_flows_test.go#L99), a test of `internal/e2e` | not yet: the cost asked of the owner before a recovery, and what was written after the snapshot gone |
+| A workspace outlives its runner | [`TestAWorkspaceOutlivesItsRunner`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/vm_test.go#L250), a test of `internal/e2e` | [`TestAWorkspaceOutlivesItsRunner`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/vm_test.go#L250) |
+| Quarantine, by an administrator | [`WorkspaceService/QuarantineWorkspace`](/reference/api/workspaceservice/) | [`TestE2E_AQuarantinedWorkspaceIsHeldUntilReleased`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/journeys_e2e_test.go#L209) |
+| Why a workspace is not behaving: status, console, history | [`spin workspace status`](/reference/cli/workspace/) | [`TestE2E_AQuarantinedWorkspaceIsHeldUntilReleased`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/journeys_e2e_test.go#L209)<br/>[`TestE2E_AWorkspacesConsoleIsWhatItsMachinePrinted`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/journeys_e2e_test.go#L243) |
+| The owner's shell, environment, editor settings, Taskfile and dotfiles reach the guest | [`TestAWorkspacesOwnEnvironmentIsInItsOwnersLoginShell`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/env_test.go#L23), a test of `internal/e2e` | [`TestTheOwnersSettingsArriveInTheGuest`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/env_test.go#L64)<br/>[`TestAWorkspacesOwnEnvironmentIsInItsOwnersLoginShell`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/env_test.go#L23) |
+| Reset a disk to what it was created from | [`spin workspace reset`](/reference/cli/workspace/) | [`TestE2E_ResetPutsAWorkspaceBackToWhatItWasCreatedFrom`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/e2e_test.go#L1182) |
+| Claude Code and Codex on every workspace's PATH, at the versions the release pins, with their own defaults | [`TestTheAgentCLIsAreOnPathWithThePinnedVersions`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/agentclis_test.go#L20), a test of `internal/e2e` | [`TestTheAgentCLIsAreOnPathWithThePinnedVersions`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/agentclis_test.go#L20) |
 
 ### Teams and projects
 
 | Feature | Exists | End to end |
 |---|---|---|
-| Open a repository, branch, commit or pull request from its URL, in the dashboard (/launch) and from the terminal<br/>*From the terminal; the dashboard's /launch page makes the same create and has no test of its own against the stack.* | [`spin open --no-connect`](/reference/cli/open/) | [`TestE2E_AURLOpensTheWorkspaceItNames`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/journeys_e2e_test.go#L97) |
-| A workspace opened at a commit or a pull request, checked out as pr-&lt;n> | [`TestAProjectsWorkspaceOpensAtTheCommitItWasAskedFor`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/project_test.go#L91), a test of `internal/e2e` | [`TestAProjectsWorkspaceOpensAtTheCommitItWasAskedFor`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/project_test.go#L91)<br/>[`TestE2E_AURLOpensTheWorkspaceItNames`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/journeys_e2e_test.go#L97) |
-| Teams, with owner, admin and member | [`spin team member role`](/reference/cli/team/) | [`TestE2E_ATeamRoleIsWhatItsHolderMayDo`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/e2e_test.go#L473) |
-| A team's own identity providers | [`TeamService/CreateIdentityProvider`](/reference/api/teamservice/) | [`TestE2E_ATeamsIdentityProviderIsItsAdminsAndSignsNobodyIn`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/e2e_test.go#L505) |
+| Open a repository, branch, commit or pull request from its URL, in the dashboard (/launch) and from the terminal<br/>*From the terminal; the dashboard's /launch page makes the same create and has no test of its own against the stack.* | [`spin open --no-connect`](/reference/cli/open/) | [`TestE2E_AURLOpensTheWorkspaceItNames`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/journeys_e2e_test.go#L97) |
+| A workspace opened at a commit or a pull request, checked out as pr-&lt;n> | [`TestAProjectsWorkspaceOpensAtTheCommitItWasAskedFor`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/project_test.go#L91), a test of `internal/e2e` | [`TestAProjectsWorkspaceOpensAtTheCommitItWasAskedFor`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/project_test.go#L91)<br/>[`TestE2E_AURLOpensTheWorkspaceItNames`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/journeys_e2e_test.go#L97) |
+| Teams, with owner, admin and member | [`spin team member role`](/reference/cli/team/) | [`TestE2E_ATeamRoleIsWhatItsHolderMayDo`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/e2e_test.go#L473) |
+| A team's own identity providers | [`TeamService/CreateIdentityProvider`](/reference/api/teamservice/) | [`TestE2E_ATeamsIdentityProviderIsItsAdminsAndSignsNobodyIn`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/e2e_test.go#L505) |
 | A team's forge app: private repositories cloned and pushed with nothing on the disk | [`spin team forge set`](/reference/cli/team/) | not yet: a real GitHub App and a private repository for the lane to clone and push |
-| A team's own network policies, where the installation allows them | [`spin team policy set`](/reference/cli/team/) | [`TestATeamsOwnPolicyIsWhatItsWorkspacesReach`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/team_policy_test.go#L24) |
-| Projects: a repository and the shape of the workspace that opens it | [`TestAProjectsWorkspaceHasItsRepositoryCheckedOutAtTheRef`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/project_test.go#L27), a test of `internal/e2e` | [`TestAProjectsWorkspaceHasItsRepositoryCheckedOutAtTheRef`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/project_test.go#L27) |
-| Prebuilds of a project's refs, as the floor of the workspaces that open them | [`TestAProjectOpensAsItsPrebuildMadeIt`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/prebuild_test.go#L29), a test of `internal/e2e` | [`TestAProjectOpensAsItsPrebuildMadeIt`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/prebuild_test.go#L29) |
-| A team's workspaces run on the installation's hosts | [`TestATeamsWorkspaceRunsOnTheInstallationsHost`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/team_test.go#L20), a test of `internal/e2e` | [`TestATeamsWorkspaceRunsOnTheInstallationsHost`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/team_test.go#L20) |
+| A team's own network policies, where the installation allows them | [`spin team policy set`](/reference/cli/team/) | [`TestATeamsOwnPolicyIsWhatItsWorkspacesReach`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/team_policy_test.go#L24) |
+| Projects: a repository and the shape of the workspace that opens it | [`TestAProjectsWorkspaceHasItsRepositoryCheckedOutAtTheRef`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/project_test.go#L27), a test of `internal/e2e` | [`TestAProjectsWorkspaceHasItsRepositoryCheckedOutAtTheRef`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/project_test.go#L27) |
+| Prebuilds of a project's refs, as the floor of the workspaces that open them | [`TestAProjectOpensAsItsPrebuildMadeIt`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/prebuild_test.go#L29), a test of `internal/e2e` | [`TestAProjectOpensAsItsPrebuildMadeIt`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/prebuild_test.go#L29) |
+| A team's workspaces run on the installation's hosts | [`TestATeamsWorkspaceRunsOnTheInstallationsHost`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/team_test.go#L20), a test of `internal/e2e` | [`TestATeamsWorkspaceRunsOnTheInstallationsHost`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/team_test.go#L20) |
 
 ### Snapshots
 
 | Feature | Exists | End to end |
 |---|---|---|
-| Snapshots of a running workspace's disk | [`WorkspaceService/CreateSnapshot`](/reference/api/workspaceservice/) | [`TestACloneHoldsWhatItsSourceWroteAndItsShape`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/clone_test.go#L68)<br/>[`TestADiskSnapshottedPastTheThresholdIsCompactedWhileItRuns`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/compaction_test.go#L19) |
-| Snapshots with memory, resumed with their processes | [`TestARunningWorkspaceResumesFromASnapshotsMemory`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/restore_test.go#L175), a test of `internal/e2e` | [`TestARunningWorkspaceResumesFromASnapshotsMemory`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/restore_test.go#L175) |
-| Restore a workspace to a snapshot | [`TestARestoredWorkspaceBootsOnTheSnapshotItWasRestoredTo`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/restore_test.go#L29), a test of `internal/e2e` | [`TestARestoredWorkspaceBootsOnTheSnapshotItWasRestoredTo`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/restore_test.go#L29) |
-| A diff of the files that changed between two snapshots | [`TestADiffOfTwoSnapshotsIsWhatChangedBetweenThem`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/diff_test.go#L28), a test of `internal/e2e` | [`TestADiffOfTwoSnapshotsNamesWhatWasAddedChangedAndRemoved`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/diff_test.go#L95) |
-| Share a snapshot with a person or make it public, and create a workspace from it | [`TestACloneOfASnapshotRegistersAsItself`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/clone_test.go#L24), a test of `internal/e2e` | [`TestASharedSnapshotIsCreatedFromByThePersonItIsSharedWith`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/share_test.go#L22) |
-| What looks like a credential is found before a share, and the share refused unless acknowledged | [`ShareService/ShareSnapshot`](/reference/api/shareservice/) | [`TestE2E_ASharedSnapshotIsScannedForCredentials`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/journeys_e2e_test.go#L46) |
-| A long chain is compacted while the workspace runs | [`TestADiskSnapshottedPastTheThresholdIsCompactedWhileItRuns`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/compaction_test.go#L19), a test of `internal/e2e` | [`TestADiskSnapshottedPastTheThresholdIsCompactedWhileItRuns`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/compaction_test.go#L19) |
+| Snapshots of a running workspace's disk | [`WorkspaceService/CreateSnapshot`](/reference/api/workspaceservice/) | [`TestACloneHoldsWhatItsSourceWroteAndItsShape`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/clone_test.go#L68)<br/>[`TestADiskSnapshottedPastTheThresholdIsCompactedWhileItRuns`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/compaction_test.go#L19) |
+| Snapshots with memory, resumed with their processes | [`TestARunningWorkspaceResumesFromASnapshotsMemory`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/restore_test.go#L175), a test of `internal/e2e` | [`TestARunningWorkspaceResumesFromASnapshotsMemory`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/restore_test.go#L175) |
+| Restore a workspace to a snapshot | [`TestARestoredWorkspaceBootsOnTheSnapshotItWasRestoredTo`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/restore_test.go#L29), a test of `internal/e2e` | [`TestARestoredWorkspaceBootsOnTheSnapshotItWasRestoredTo`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/restore_test.go#L29) |
+| A diff of the files that changed between two snapshots | [`TestADiffOfTwoSnapshotsIsWhatChangedBetweenThem`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/diff_test.go#L28), a test of `internal/e2e` | [`TestADiffOfTwoSnapshotsNamesWhatWasAddedChangedAndRemoved`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/diff_test.go#L95) |
+| Share a snapshot with a person or make it public, and create a workspace from it | [`TestACloneOfASnapshotRegistersAsItself`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/clone_test.go#L24), a test of `internal/e2e` | [`TestASharedSnapshotIsCreatedFromByThePersonItIsSharedWith`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/share_test.go#L22) |
+| What looks like a credential is found before a share, and the share refused unless acknowledged | [`ShareService/ShareSnapshot`](/reference/api/shareservice/) | [`TestE2E_ASharedSnapshotIsScannedForCredentials`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/journeys_e2e_test.go#L46) |
+| A long chain is compacted while the workspace runs | [`TestADiskSnapshottedPastTheThresholdIsCompactedWhileItRuns`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/compaction_test.go#L19), a test of `internal/e2e` | [`TestADiskSnapshottedPastTheThresholdIsCompactedWhileItRuns`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/compaction_test.go#L19) |
 
 ### Network
 
 | Feature | Exists | End to end |
 |---|---|---|
-| Egress is closed by default; policies, by tag, name what a workspace may reach | [`TestAnOwnerMayOnlyChooseAPolicyTheInstallationDeclares`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/retag_test.go#L163), a test of `internal/e2e` | [`TestAWorkspaceNamedNoPolicyReachesNothing`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/retag_test.go#L71)<br/>[`TestChangingAWorkspacesPoliciesReachesTheHostThatRunsIt`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/retag_test.go#L24) |
-| A policy changed reaches the host that runs the workspace | [`TestChangingAWorkspacesPoliciesReachesTheHostThatRunsIt`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/retag_test.go#L24), a test of `internal/e2e` | [`TestAnEditedPolicyChangesWhatARunningGuestReaches`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/retag_test.go#L100)<br/>[`TestChangingAWorkspacesPoliciesReachesTheHostThatRunsIt`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/retag_test.go#L24) |
+| Egress is closed by default; policies, by tag, name what a workspace may reach | [`TestAnOwnerMayOnlyChooseAPolicyTheInstallationDeclares`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/retag_test.go#L163), a test of `internal/e2e` | [`TestAWorkspaceNamedNoPolicyReachesNothing`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/retag_test.go#L71)<br/>[`TestChangingAWorkspacesPoliciesReachesTheHostThatRunsIt`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/retag_test.go#L24) |
+| A policy changed reaches the host that runs the workspace | [`TestChangingAWorkspacesPoliciesReachesTheHostThatRunsIt`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/retag_test.go#L24), a test of `internal/e2e` | [`TestAnEditedPolicyChangesWhatARunningGuestReaches`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/retag_test.go#L100)<br/>[`TestChangingAWorkspacesPoliciesReachesTheHostThatRunsIt`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/retag_test.go#L24) |
 | Brokered names: the host's proxy stands in and adds what the workspace never holds - a team secret, a forge token, its identity, a cloud role | [`spin team secret set`](/reference/cli/team/) | not yet: the forge, identity and cloud role injections, and the secret's value seen at the origin |
-| A workspace trusts the egress root only by its owner's word | [`TestAGuestTrustsTheEgressRootOnlyByItsOwnersWord`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/egress_root_test.go#L20), a test of `internal/e2e` | [`TestAGuestTrustsTheEgressRootOnlyByItsOwnersWord`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/egress_root_test.go#L20) |
-| What a workspace reached, what it looked up and what it was refused | [`spin workspace egress`](/reference/cli/workspace/) | [`TestE2E_EgressIsAnsweredByTheHostTheWorkspaceRunsOn`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/e2e_test.go#L766) |
-| Each request to a brokered name as the proxy read it, served or refused and why; and whether each injection's secret is the team's to give | [`TestABrokeredRequestIsSeenAsTheProxyReadIt`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/brokered_test.go#L28), a test of `internal/e2e` | [`TestABrokeredRequestIsSeenAsTheProxyReadIt`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/brokered_test.go#L28) |
-| The egress proxy is a process of its own, holding no key of the host's, started again by the runner when it ends | [`TestTheEgressProxyIsAProcessOfItsOwnThatTheRunnerStartsAgain`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/egress_process_test.go#L21), a test of `internal/e2e` | [`TestTheEgressProxyIsAProcessOfItsOwnThatTheRunnerStartsAgain`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/egress_process_test.go#L21) |
-| A brokered rule names whose it is, the agent's or the person's: one policy says what each may reach and with what | [`TestABrokeredNameForTheAgentIsTheAgentsAlone`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/brokered_test.go#L72), a test of `internal/e2e` | [`TestAPersonsRuleAndAnAgentsOnOneNameEachArriveWithTheirOwnInjection`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/brokered_test.go#L100)<br/>[`TestABrokeredNameForTheAgentIsTheAgentsAlone`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/brokered_test.go#L72) |
-| A WebSocket to a brokered name: its handshake under the rule's headers and scope, then bytes each way<br/>*The rule's header on the handshake is not read at the origin: the lane's WebSocket echo answers frames, not headers.* | [`TestAWebSocketToABrokeredNameIsCarriedAfterItsHandshake`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/brokered_test.go#L168), a test of `internal/e2e` | [`TestAWebSocketToABrokeredNameCarriesTheGuestsBytesAndRefusesAPathOutOfScope`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/brokered_test.go#L196)<br/>[`TestAWebSocketToABrokeredNameIsCarriedAfterItsHandshake`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/brokered_test.go#L168) |
-| HTTP/2 to a brokered name, the proxy's ALPN the real host's: a rule's headers set stream by stream, gRPC's trailers both ways | [`TestHTTP2ToABrokeredNameIsTheRealHosts`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/brokered_test.go#L231), a test of `internal/e2e` | not yet: headers on several streams and gRPC's trailers, which need an h2 origin that echoes them |
-| Watch where a workspace connects, into its logs | [`spin workspace watch`](/reference/cli/workspace/) | [`TestE2E_AWatchedWorkspacesConnectionsAreInItsLogs`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/journeys_e2e_test.go#L264) |
-| An agent the supervisor starts is marked, and reaches only brokered names | [`TestARealWorkspaceMarksTheAgentItsSupervisorStarts`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/seal_test.go#L21), a test of `internal/e2e` | [`TestAnAgentReachesOnlyBrokeredNames`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/brokered_test.go#L138)<br/>[`TestARealWorkspaceMarksTheAgentItsSupervisorStarts`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/seal_test.go#L21) |
-| Published ports at https://{port}-{workspace}.{domain}: private, whitelisted or public | [`spin port expose`](/reference/cli/port/) | [`TestAPublicPortIsReachedWithNoSessionAtAll`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/proxy/lane_test.go#L144)<br/>[`workspace-sign-in.spec.ts`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/dashboard/e2e/workspace-sign-in.spec.ts#L31): a visitor signed in to the dashboard reaches their private port |
+| A workspace trusts the egress root only by its owner's word | [`TestAGuestTrustsTheEgressRootOnlyByItsOwnersWord`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/egress_root_test.go#L20), a test of `internal/e2e` | [`TestAGuestTrustsTheEgressRootOnlyByItsOwnersWord`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/egress_root_test.go#L20) |
+| What a workspace reached, what it looked up and what it was refused | [`spin workspace egress`](/reference/cli/workspace/) | [`TestE2E_EgressIsAnsweredByTheHostTheWorkspaceRunsOn`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/e2e_test.go#L766) |
+| Each request to a brokered name as the proxy read it, served or refused and why; and whether each injection's secret is the team's to give | [`TestABrokeredRequestIsSeenAsTheProxyReadIt`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/brokered_test.go#L28), a test of `internal/e2e` | [`TestABrokeredRequestIsSeenAsTheProxyReadIt`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/brokered_test.go#L28) |
+| The egress proxy is a process of its own, holding no key of the host's, started again by the runner when it ends | [`TestTheEgressProxyIsAProcessOfItsOwnThatTheRunnerStartsAgain`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/egress_process_test.go#L21), a test of `internal/e2e` | [`TestTheEgressProxyIsAProcessOfItsOwnThatTheRunnerStartsAgain`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/egress_process_test.go#L21) |
+| A brokered rule names whose it is, the agent's or the person's: one policy says what each may reach and with what | [`TestABrokeredNameForTheAgentIsTheAgentsAlone`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/brokered_test.go#L72), a test of `internal/e2e` | [`TestAPersonsRuleAndAnAgentsOnOneNameEachArriveWithTheirOwnInjection`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/brokered_test.go#L100)<br/>[`TestABrokeredNameForTheAgentIsTheAgentsAlone`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/brokered_test.go#L72) |
+| A WebSocket to a brokered name: its handshake under the rule's headers and scope, then bytes each way<br/>*The rule's header on the handshake is not read at the origin: the lane's WebSocket echo answers frames, not headers.* | [`TestAWebSocketToABrokeredNameIsCarriedAfterItsHandshake`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/brokered_test.go#L168), a test of `internal/e2e` | [`TestAWebSocketToABrokeredNameCarriesTheGuestsBytesAndRefusesAPathOutOfScope`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/brokered_test.go#L196)<br/>[`TestAWebSocketToABrokeredNameIsCarriedAfterItsHandshake`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/brokered_test.go#L168) |
+| HTTP/2 to a brokered name, the proxy's ALPN the real host's: a rule's headers set stream by stream, gRPC's trailers both ways | [`TestHTTP2ToABrokeredNameIsTheRealHosts`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/brokered_test.go#L231), a test of `internal/e2e` | not yet: headers on several streams and gRPC's trailers, which need an h2 origin that echoes them |
+| Watch where a workspace connects, into its logs | [`spin workspace watch`](/reference/cli/workspace/) | [`TestE2E_AWatchedWorkspacesConnectionsAreInItsLogs`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/journeys_e2e_test.go#L264) |
+| An agent the supervisor starts is marked, and reaches only brokered names | [`TestARealWorkspaceMarksTheAgentItsSupervisorStarts`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/seal_test.go#L21), a test of `internal/e2e` | [`TestAnAgentReachesOnlyBrokeredNames`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/brokered_test.go#L138)<br/>[`TestARealWorkspaceMarksTheAgentItsSupervisorStarts`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/seal_test.go#L21) |
+| Published ports at https://{port}-{workspace}.{domain}: private, whitelisted or public | [`spin port expose`](/reference/cli/port/) | [`TestAPublicPortIsReachedWithNoSessionAtAll`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/proxy/lane_test.go#L144)<br/>[`workspace-sign-in.spec.ts`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/dashboard/e2e/workspace-sign-in.spec.ts#L31): a visitor signed in to the dashboard reaches their private port |
 
 ### Access
 
 | Feature | Exists | End to end |
 |---|---|---|
 | Sign in with GitHub or an OIDC provider | [`AuthService/StartLogin`](/reference/api/authservice/) | not yet: a GitHub provider: the sign-in through it and the verified email it gives |
-| Device login for a terminal | [`AuthService/StartDeviceLogin`](/reference/api/authservice/) | [`TestE2E_Logout`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/e2e_test.go#L1169)<br/>[`auth.spec.ts`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/dashboard/e2e/auth.spec.ts#L19): the CLI's device page stands alone and keeps its code through a sign-in |
-| API keys for scripts and agents | [`spin api-key create`](/reference/cli/api-key/) | [`TestE2E_APIKeyCRUD`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/e2e_test.go#L1124) |
-| SSH keys, and plain ssh to spin.&lt;workspace> | [`spin ssh-config`](/reference/cli/ssh-config/) | [`TestE2E_SSHConfigCarriesSSHToAWorkspace`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/e2e_test.go#L637) |
-| Who logs in to a workspace is what its owner signed | [`TestOnlyThePeopleTheAccessNamesLogInToAWorkspace`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/login_test.go#L259), a test of `internal/e2e` | [`TestOnlyThePeopleTheAccessNamesLogInToAWorkspace`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/login_test.go#L259) |
-| Guests of a workspace, invited by its owner | [`spin workspace guests`](/reference/cli/workspace/) | [`TestOnlyThePeopleTheAccessNamesLogInToAWorkspace`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/login_test.go#L259) |
-| A workspace's identity, signed by its host, for the audiences its owner allows | [`TestAWorkspacesIdentityIsTheHostsSignatureOfWhatItsOwnerSigned`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/identity_test.go#L60), a test of `internal/e2e` | [`TestAWorkspacesIdentityIsTheHostsSignatureOfWhatItsOwnerSigned`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/identity_test.go#L60) |
-| VS Code over SSH, with the server the installation publishes and nothing downloaded<br/>*spin code itself is run by its unit tests only: it opens VS Code desktop, which no lane has.* | [`TestAVSCodeServerOfAnotherCommitIsHandedToTheRunningMachine`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/vscodehotplug_test.go#L23), a test of `internal/e2e` | [`TestTheCarriedVSCodeServerRunsOfflineAndAnswersOverTheSSHTunnel`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/vscodeserver_test.go#L86)<br/>[`TestAVSCodeServerOfAnotherCommitIsHandedToTheRunningMachine`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/vscodehotplug_test.go#L23) |
-| Run a command in a workspace, copy files to and from it | [`spin exec`](/reference/cli/exec/) | [`TestE2E_ADetachedRunIsFollowedToItsEndAndFilesGoBothWays`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/journeys_e2e_test.go#L178) |
+| Device login for a terminal | [`AuthService/StartDeviceLogin`](/reference/api/authservice/) | [`TestE2E_Logout`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/e2e_test.go#L1169)<br/>[`auth.spec.ts`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/dashboard/e2e/auth.spec.ts#L19): the CLI's device page stands alone and keeps its code through a sign-in |
+| API keys for scripts and agents | [`spin api-key create`](/reference/cli/api-key/) | [`TestE2E_APIKeyCRUD`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/e2e_test.go#L1124) |
+| SSH keys, and plain ssh to spin.&lt;workspace> | [`spin ssh-config`](/reference/cli/ssh-config/) | [`TestE2E_SSHConfigCarriesSSHToAWorkspace`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/e2e_test.go#L637) |
+| Who logs in to a workspace is what its owner signed | [`TestOnlyThePeopleTheAccessNamesLogInToAWorkspace`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/login_test.go#L259), a test of `internal/e2e` | [`TestOnlyThePeopleTheAccessNamesLogInToAWorkspace`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/login_test.go#L259) |
+| Guests of a workspace, invited by its owner | [`spin workspace guests`](/reference/cli/workspace/) | [`TestOnlyThePeopleTheAccessNamesLogInToAWorkspace`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/login_test.go#L259) |
+| A workspace's identity, signed by its host, for the audiences its owner allows | [`TestAWorkspacesIdentityIsTheHostsSignatureOfWhatItsOwnerSigned`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/identity_test.go#L60), a test of `internal/e2e` | [`TestAWorkspacesIdentityIsTheHostsSignatureOfWhatItsOwnerSigned`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/identity_test.go#L60) |
+| VS Code over SSH, with the server the installation publishes and nothing downloaded<br/>*spin code itself is run by its unit tests only: it opens VS Code desktop, which no lane has.* | [`TestAVSCodeServerOfAnotherCommitIsHandedToTheRunningMachine`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/vscodehotplug_test.go#L23), a test of `internal/e2e` | [`TestTheCarriedVSCodeServerRunsOfflineAndAnswersOverTheSSHTunnel`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/vscodeserver_test.go#L86)<br/>[`TestAVSCodeServerOfAnotherCommitIsHandedToTheRunningMachine`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/vscodehotplug_test.go#L23) |
+| Run a command in a workspace, copy files to and from it | [`spin exec`](/reference/cli/exec/) | [`TestE2E_ADetachedRunIsFollowedToItsEndAndFilesGoBothWays`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/journeys_e2e_test.go#L178) |
 
 ### Administration
 
 | Feature | Exists | End to end |
 |---|---|---|
 | Installation settings seeded from a file; a change in the file is a proposal to apply or dismiss | [`AdminService/DecideConfigChange`](/reference/api/adminservice/) | not yet: the real file read, an apply and its effect, and a dismiss kept when the file is read again |
-| Resource presets | [`AdminService/CreateResourcePreset`](/reference/api/adminservice/) | [`admin.spec.ts`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/dashboard/e2e/admin.spec.ts#L422): an admin's preset sizes a person's workspace, and is gone once deleted |
-| Registration: open, by allowlist, or closed | [`AdminService/SetRegistrationMode`](/reference/api/adminservice/) | [`admin.spec.ts`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/dashboard/e2e/admin.spec.ts#L216): closed, open and a domain on the allowlist decide who registers<br/>[`admin.spec.ts`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/dashboard/e2e/admin.spec.ts#L146): the allowlist lets in who it names, and nobody else |
-| An audit log | [`AdminService/ListAuditLog`](/reference/api/adminservice/) | [`TestE2E_AnAdministratorsActionIsAuditedWithItsActorAndTarget`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/e2e_test.go#L580)<br/>[`admin.spec.ts`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/dashboard/e2e/admin.spec.ts#L895): admin reads the log and can narrow it to one kind of event |
-| The control plane's jobs, and running one now | [`spin admin jobs`](/reference/cli/admin/) | [`TestACarryResumesASuspendedWorkspaceAndStopsIt`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/carry_test.go#L21)<br/>[`admin.spec.ts`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/dashboard/e2e/admin.spec.ts#L705): admin runs a job by hand and sees how it ended |
+| Resource presets | [`AdminService/CreateResourcePreset`](/reference/api/adminservice/) | [`admin.spec.ts`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/dashboard/e2e/admin.spec.ts#L422): an admin's preset sizes a person's workspace, and is gone once deleted |
+| Registration: open, by allowlist, or closed | [`AdminService/SetRegistrationMode`](/reference/api/adminservice/) | [`admin.spec.ts`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/dashboard/e2e/admin.spec.ts#L216): closed, open and a domain on the allowlist decide who registers<br/>[`admin.spec.ts`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/dashboard/e2e/admin.spec.ts#L146): the allowlist lets in who it names, and nobody else |
+| An audit log | [`AdminService/ListAuditLog`](/reference/api/adminservice/) | [`TestE2E_AnAdministratorsActionIsAuditedWithItsActorAndTarget`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/e2e_test.go#L580)<br/>[`admin.spec.ts`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/dashboard/e2e/admin.spec.ts#L895): admin reads the log and can narrow it to one kind of event |
+| The control plane's jobs, and running one now | [`spin admin jobs`](/reference/cli/admin/) | [`TestACarryResumesASuspendedWorkspaceAndStopsIt`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/carry_test.go#L21)<br/>[`admin.spec.ts`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/dashboard/e2e/admin.spec.ts#L705): admin runs a job by hand and sees how it ended |
 | The month's bill, its forecast, and what each workspace cost | [`spin admin costs`](/reference/cli/admin/) | not yet: the cloud's real bill read: no lane has an AWS account, so the bill a test gives the reader stands in for it |
-| The store: every volume, whose it is, and taking out what nothing needs | [`spin admin storage list`](/reference/cli/admin/) | [`TestAVolumeNothingNeedsIsTakenOutOfTheStore`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/orphan_test.go#L26) |
-| Re-key a workspace's disk | [`spin admin volume rekey`](/reference/cli/admin/) | [`TestARekeyedDiskBootsWithWhatItHeldUnderANewKey`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/rekey_test.go#L24) |
+| The store: every volume, whose it is, and taking out what nothing needs | [`spin admin storage list`](/reference/cli/admin/) | [`TestAVolumeNothingNeedsIsTakenOutOfTheStore`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/orphan_test.go#L26) |
+| Re-key a workspace's disk | [`spin admin volume rekey`](/reference/cli/admin/) | [`TestARekeyedDiskBootsWithWhatItHeldUnderANewKey`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/rekey_test.go#L24) |
 | Runners: registration tokens, drain, activate, revoke, and a policy per host | [`spin admin runner drain`](/reference/cli/admin/) | not yet: a runner registered with a token the API made, an expired or revoked token refused, and a revoke carried out |
 | Runners start when a workspace waits for one and stop when nothing runs | [`HostService/GetFleet`](/reference/api/hostservice/) | not yet: an autoscaling group to start and stop: the one group is AWS's, and no lane has an account |
-| A host that reboots brings its workspaces back | [`TestAHostRebootBringsItsWorkspacesBack`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/restart_test.go#L38), a test of `internal/e2e` | [`TestAHostRebootBringsItsWorkspacesBack`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/restart_test.go#L38) |
-| A cloud's reclaim warning empties the host before the machine goes | [`TestACloudsReclaimWarningEmptiesTheHostBeforeAnySignal`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/preemption_test.go#L26), a test of `internal/e2e` | [`TestACloudsReclaimWarningEmptiesTheHostBeforeAnySignal`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/preemption_test.go#L26) |
-| A writeback bound per host, measured on that host before it is taken | [`TestCustomWritebackValuesAreMeasuredOnTheRunner`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/writeback_test.go#L28), a test of `internal/e2e` | [`TestCustomWritebackValuesAreMeasuredOnTheRunner`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/writeback_test.go#L28) |
-| What is running where: the control plane, each runner and its machine | [`spin admin versions`](/reference/cli/admin/) | [`TestE2E_Admin`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/e2e_test.go#L1026) |
+| A host that reboots brings its workspaces back | [`TestAHostRebootBringsItsWorkspacesBack`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/restart_test.go#L38), a test of `internal/e2e` | [`TestAHostRebootBringsItsWorkspacesBack`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/restart_test.go#L38) |
+| A cloud's reclaim warning empties the host before the machine goes | [`TestACloudsReclaimWarningEmptiesTheHostBeforeAnySignal`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/preemption_test.go#L26), a test of `internal/e2e` | [`TestACloudsReclaimWarningEmptiesTheHostBeforeAnySignal`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/preemption_test.go#L26) |
+| A writeback bound per host, measured on that host before it is taken | [`TestCustomWritebackValuesAreMeasuredOnTheRunner`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/writeback_test.go#L28), a test of `internal/e2e` | [`TestCustomWritebackValuesAreMeasuredOnTheRunner`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/writeback_test.go#L28) |
+| What is running where: the control plane, each runner and its machine | [`spin admin versions`](/reference/cli/admin/) | [`TestE2E_Admin`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/e2e_test.go#L1026) |
 
 ### Observability
 
 | Feature | Exists | End to end |
 |---|---|---|
-| Platform logs, workspace logs and traces, searched in the product | [`LogService/SearchPlatformLogs`](/reference/api/logservice/) | [`TestAWorkspacesLinesAndTracesAreFoundBySearchingForIt`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/observe_test.go#L22)<br/>[`TestE2E_TheInstallationsLogsAreSearchable`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/e2e_test.go#L928) |
-| Metrics, with Grafana on the control plane | [`AdminService/GetMonitoring`](/reference/api/adminservice/) | [`admin.spec.ts`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/dashboard/e2e/admin.spec.ts#L1149): a series of the lane's host is in the metric store, read through Grafana<br/>[`admin.spec.ts`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/dashboard/e2e/admin.spec.ts#L1126): admin reads the installation's dashboards without leaving the page |
-| A workspace's journal and console are collected only with its owner's consent | [`spin workspace logs-consent`](/reference/cli/workspace/) | [`TestE2E_AWorkspacesConsoleIsKeptAndSearchable`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/e2e_test.go#L949) |
+| Platform logs, workspace logs and traces, searched in the product | [`LogService/SearchPlatformLogs`](/reference/api/logservice/) | [`TestAWorkspacesLinesAndTracesAreFoundBySearchingForIt`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/observe_test.go#L22)<br/>[`TestE2E_TheInstallationsLogsAreSearchable`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/e2e_test.go#L928) |
+| Metrics, with Grafana on the control plane | [`AdminService/GetMonitoring`](/reference/api/adminservice/) | [`admin.spec.ts`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/dashboard/e2e/admin.spec.ts#L1149): a series of the lane's host is in the metric store, read through Grafana<br/>[`admin.spec.ts`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/dashboard/e2e/admin.spec.ts#L1126): admin reads the installation's dashboards without leaving the page |
+| A workspace's journal and console are collected only with its owner's consent | [`spin workspace logs-consent`](/reference/cli/workspace/) | [`TestE2E_AWorkspacesConsoleIsKeptAndSearchable`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/e2e_test.go#L949) |
 
 ### Platform
 
 | Feature | Exists | End to end |
 |---|---|---|
-| A smoke test of what an installation's API promises, with a workspace of its own | [`spin smoke`](/reference/cli/smoke/) | [`TestE2E_SmokePassesAndLeavesNothingBehind`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/cmd/cli/journeys_e2e_test.go#L314) |
-| A host serves only the releases it carries<br/>*A resume whose recorded release was collected since has no test against the stack.* | [`TestAMachineAdoptedWithoutItsReleasesIsSuspendedWithItsDisk`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/suspend_test.go#L126), a test of `internal/e2e` | [`TestAMachineAdoptedWithoutItsReleasesIsSuspendedWithItsDisk`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/suspend_test.go#L126)<br/>[`TestAVSCodeServerOfAnotherCommitIsHandedToTheRunningMachine`](https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/internal/e2e/vscodehotplug_test.go#L23) |
+| A smoke test of what an installation's API promises, with a workspace of its own | [`spin smoke`](/reference/cli/smoke/) | [`TestE2E_SmokePassesAndLeavesNothingBehind`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/cmd/cli/journeys_e2e_test.go#L314) |
+| A host serves only the releases it carries<br/>*A resume whose recorded release was collected since has no test against the stack.* | [`TestAMachineAdoptedWithoutItsReleasesIsSuspendedWithItsDisk`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/suspend_test.go#L126), a test of `internal/e2e` | [`TestAMachineAdoptedWithoutItsReleasesIsSuspendedWithItsDisk`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/suspend_test.go#L126)<br/>[`TestAVSCodeServerOfAnotherCommitIsHandedToTheRunningMachine`](https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/internal/e2e/vscodehotplug_test.go#L23) |
 
 ## Partly there
 
diff --git a/src/data/figures.json b/src/data/figures.json
index c7df7f3..df1cec1 100644
--- a/src/data/figures.json
+++ b/src/data/figures.json
@@ -1,6 +1,6 @@
 {
 	"datapath": {
-		"source": "https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/docs/network/datapath",
+		"source": "https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/docs/network/datapath",
 		"width": 552,
 		"words": [
 			"How a packet leaves a workspace",
@@ -56,7 +56,7 @@
 		]
 	},
 	"egress-policy": {
-		"source": "https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/docs/network/egress-policy",
+		"source": "https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/docs/network/egress-policy",
 		"width": 854,
 		"words": [
 			"What the forward chain decides, in order",
@@ -157,7 +157,7 @@
 		]
 	},
 	"isolation": {
-		"source": "https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/docs/network/isolation",
+		"source": "https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/docs/network/isolation",
 		"width": 499,
 		"words": [
 			"Same address, different segment",
@@ -204,7 +204,7 @@
 		]
 	},
 	"traffic": {
-		"source": "https://github.com/spin-stack/spin/blob/77380b13da641c24e3f79b9c7586c39888f4e7ba/docs/security/traffic",
+		"source": "https://github.com/spin-stack/spin/blob/b3598142dbcd6ef24135066332441a400dd35980/docs/security/traffic",
 		"width": 1889,
 		"words": [
 			"Traffic: every arrow is a connection opened in its direction, and nothing else is let in",
diff --git a/src/data/reference.json b/src/data/reference.json
index 944d094..1858255 100644
--- a/src/data/reference.json
+++ b/src/data/reference.json
@@ -1,8 +1,8 @@
 {
 	"spin": {
 		"installs": "v20261019.02",
-		"commit": "77380b13da641c24e3f79b9c7586c39888f4e7ba",
-		"tag": "",
+		"commit": "b3598142dbcd6ef24135066332441a400dd35980",
+		"tag": "v20261024.01",
 		"machine": "v20261014.01"
 	},
 	"terraform": {
diff --git a/versions.yaml b/versions.yaml
index 71adfcf..2e27376 100644
--- a/versions.yaml
+++ b/versions.yaml
@@ -7,13 +7,13 @@
 - name: spin
   kind: git
   source: https://github.com/spin-stack/spin
-  version: main
-  pin: 77380b13da641c24e3f79b9c7586c39888f4e7ba
+  version: v20261024.01
+  pin: b3598142dbcd6ef24135066332441a400dd35980
   track: github-release
   note: >-
-    A commit of main, not a release: v20261019.02, the newest, has no feature board, and the site
-    documents the release cut from main after it. A bump moves to a release only once one holds
-    this commit, never back to an older one. Private: fetched with the sources App's token.
+    The release the site documents (D2: the newest, exactly). The daily sync moves it to the next
+    release, never back to an older one; spin main past it is in spin's "Site vs spin main"
+    issue. Private: fetched with the sources App's token.
 
 - name: spin-terraform-aws
   kind: git