diff --git a/AGENTS.md b/AGENTS.md
index 9a4daaf374c..d67e4df548b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,5 +1,3 @@
-# CLAUDE.md
-
 Estuary is a real-time data platform with:
 - Control plane: user-facing catalog management APIs
 - Data planes: distributed runtime execution
@@ -38,17 +36,18 @@ mise run ci:sql-tap
 
 # E2E tests over derivation examples (SLOW)
 mise run ci:catalog-test
-```
 
-### Development
-
-A development Supabase instance is available:
-```bash
+# Start (just) local Supabase.
+mise run local:supabase
 # Reset with current migrations as needed
 supabase db reset
-
 # Interact directly with dev DB
 psql postgresql://postgres:postgres@localhost:5432/postgres -c 'SELECT 1;'
+
+# Start a complete local stack (see local/README.md)
+mise run local:stack
+# CLI for interacting with the platform.
+cargo run -p flowctl -- --profile local --help
 ```
 
 ## Architecture Overview
@@ -69,6 +68,13 @@ The control plane compiles the user's catalog model into
 **built specs** that have extra specifics required by the runtime,
 and activates specs into their associated data plane.
 
+Collections and tasks live in a unified, hierarchical namespace.
+`/`-delimited prefixes act as "roles" and are the unit of AuthZ.
+Users are granted capabilities to roles (`user_grants` table),
+and roles are granted capabilities to other roles (`role_grants`).
+A top-level prefix like `acmeCo/` homes an organization and
+is called a "tenant".
+
 ### Control-plane components
 - **Supabase**: catalog and platform config DB
 - **Agent**: APIs and background automation
@@ -83,9 +89,9 @@ and activates specs into their associated data plane.
 ### Protocols
 
 - `go/protocols/flow/flow.proto` - core types and built specs
-- `go/protocols/capture/capture.proto` - protocol for capture tasks
-- `go/protocols/derive/derive.proto` - for derivation tasks
-- `go/protocols/materialize/materialize.proto` - for materialization tasks
+- `go/protocols/capture/capture.proto`
+- `go/protocols/derive/derive.proto`
+- `go/protocols/materialize/materialize.proto`
 
 ## README.md
 
@@ -115,8 +121,8 @@ Keep READMEs current - update with code changes.
   The exception is state machines: structs and enums that encapsulate fine-grain
   POD state into higher-order transitions that are easier to reason about.
   DO seek to decompose problems into state machines.
-- Avoid trivial impl routines which could be inlined by the caller.
-  Indirection is harder to read; routines must buy us something.
+- Avoid routines with trivial bodies that could be inlined into the caller.
+  Indirection has cost (hard to read): each routine must buy us something.
 - Decompose IO and POD processing into separate routines where possible.
   Routines should gravitate towards IO or processing, and not mix both.
 
diff --git a/CLAUDE.md b/CLAUDE.md
deleted file mode 100644
index 9a4daaf374c..00000000000
--- a/CLAUDE.md
+++ /dev/null
@@ -1,133 +0,0 @@
-# CLAUDE.md
-
-Estuary is a real-time data platform with:
-- Control plane: user-facing catalog management APIs
-- Data planes: distributed runtime execution
-- Connectors: OCI images integrating external systems
-
-This repo lives at `https://github.com/estuary/flow`
-
-## Repository Overview
-
-Estuary is built with:
-- **Rust** (primary language)
-  - Third-party sources under `~/.cargo/registry/src/`
-- **Go** - integration glue with the Gazette consumer framework
-  - Third-party sources under `~/go/pkg/mod/`
-- **Protobuf** - communication between control plane, data planes, and connectors
-- **Supabase** - migrations are under `supabase/migrations/`
-  - pgTAP tests under `supabase/tests/`
-- **Docs** - external user-facing product documentation under `site/` (Docusaurus)
-
-## Essential Commands
-
-### Build & Test
-
-Use regular `cargo` and `go` tools to build and test crates.
-
-```bash
-# libsqlite3 tag is required for `bindings` and `flowctl-go` packages.
-go build -tags libsqlite3 ./go/bindings
-
-# Regenerate checked-in protobuf (required after .proto changes)
-mise run build:go-protobufs
-mise run build:rust-protobufs
-
-# Run pgTAP SQL Tests
-mise run ci:sql-tap
-
-# E2E tests over derivation examples (SLOW)
-mise run ci:catalog-test
-```
-
-### Development
-
-A development Supabase instance is available:
-```bash
-# Reset with current migrations as needed
-supabase db reset
-
-# Interact directly with dev DB
-psql postgresql://postgres:postgres@localhost:5432/postgres -c 'SELECT 1;'
-```
-
-## Architecture Overview
-
-### Core Concepts
-
-Users interact with the control plane to manage a catalog of:
-- **Captures**: tasks which capture from a user endpoint into target collections
-- **Collections**: collections of data with enforced JSON Schema
-- **Derivations**: both a collection and a task - the task builds its collection through transformation of other collections
-- **Materializations**: tasks which maintain materialized views of source collections in an endpoint
-- **Tests**: fixtures of source collection inputs and expected derivation outputs
-
-Collections and tasks have a declarative (JSON/YAML) **model**.
-Users refine model changes in **drafts**, which are **published**
-to the control plane for verification and testing.
-The control plane compiles the user's catalog model into
-**built specs** that have extra specifics required by the runtime,
-and activates specs into their associated data plane.
-
-### Control-plane components
-- **Supabase**: catalog and platform config DB
-- **Agent**: APIs and background automation
-- **Data-plane controller**: provisions data planes
-
-### Data-plane components
-- **Gazette**: brokers serve the journals that back collections
-- **Reactors**: runtime written to Gazette consumer framework;
-  executes tasks and runs connectors as sidecars over gRPC
-- **Etcd**: config for gazette and reactors
-
-### Protocols
-
-- `go/protocols/flow/flow.proto` - core types and built specs
-- `go/protocols/capture/capture.proto` - protocol for capture tasks
-- `go/protocols/derive/derive.proto` - for derivation tasks
-- `go/protocols/materialize/materialize.proto` - for materialization tasks
-
-## README.md
-
-Every crate/module should have a README.md with essential context:
-- Purpose and fit within the project
-- Key types and entry points
-- Brief architecture and non-obvious details
-
-A README.md is ONLY a roadmap for expert developers,
-orienting them where to look next.
-
-Keep READMEs current - update with code changes.
-
-## Development Guidelines
-
-### Implementation
-- Use `var myVar = ...` in Go. Do NOT use `myVar := ...` (unless required due to shadowing)
-- Write comments that document "why" - rationale, broader context, and non-obvious detail
-- Do NOT write comments which describe the obvious behavior of code.
-  Don't write `// Get credentials` before a call `getCredentials()`
-- Use early-return over nested conditionals
-- Use at least one level of name qualification for third-party types and functions.
-  For example, `axum::Router::new()` instead of `use axum::Router; Router::new()`.
-  Types / functions should be unqualified ONLY if they're in the current module.
-- Prefer pure functions that take and act over POD states.
-  AVOID structures that mix complex state and impl behaviors, where possible.
-  The exception is state machines: structs and enums that encapsulate fine-grain
-  POD state into higher-order transitions that are easier to reason about.
-  DO seek to decompose problems into state machines.
-- Avoid trivial impl routines which could be inlined by the caller.
-  Indirection is harder to read; routines must buy us something.
-- Decompose IO and POD processing into separate routines where possible.
-  Routines should gravitate towards IO or processing, and not mix both.
-
-### Testing
-- Prefer snapshots over fine-grain assertions (`insta` / `cupaloy`)
-
-### Errors
-- Wrap errors with context (`anyhow::Context` / `fmt.Errorf`)
-- Return errors up the stack rather than logging
-- Panic on impossible states (do NOT add spurious error handling)
-
-### Logging
-- Structured logging with context (`tracing` / `logrus`)
-- Avoid verbose logging in hot paths
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 120000
index 00000000000..47dc3e3d863
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1 @@
+AGENTS.md
\ No newline at end of file
diff --git a/Cargo.lock b/Cargo.lock
index f93a95f221c..703697f0bbe 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1030,7 +1030,7 @@ dependencies = [
  "http 1.3.1",
  "http-body 0.4.6",
  "hyper 0.14.32",
- "hyper 1.7.0",
+ "hyper 1.9.0",
  "hyper-rustls 0.24.2",
  "hyper-rustls 0.27.7",
  "hyper-util",
@@ -1178,7 +1178,7 @@ dependencies = [
  "http 1.3.1",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.7.0",
+ "hyper 1.9.0",
  "hyper-util",
  "itoa",
  "matchit",
@@ -1258,16 +1258,16 @@ dependencies = [
 
 [[package]]
 name = "axum-server"
-version = "0.7.2"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "495c05f60d6df0093e8fb6e74aa5846a0ad06abaf96d76166283720bf740f8ab"
+checksum = "c1ab4a3ec9ea8a657c72d99a03a824af695bd0fb5ec639ccbd9cd3543b41a5f9"
 dependencies = [
  "arc-swap",
  "bytes",
  "fs-err",
  "http 1.3.1",
  "http-body 1.0.1",
- "hyper 1.7.0",
+ "hyper 1.9.0",
  "hyper-util",
  "pin-project-lite",
  "rustls 0.23.32",
@@ -1412,6 +1412,8 @@ dependencies = [
  "prost",
  "proto-flow",
  "runtime",
+ "runtime-next",
+ "rustls 0.23.32",
  "serde",
  "serde_json",
  "thiserror 2.0.17",
@@ -3135,6 +3137,17 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "evmap"
+version = "11.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b8874945f036109c72242964c1174cf99434e30cfa45bf45fedc983f50046f8"
+dependencies = [
+ "hashbag",
+ "left-right",
+ "smallvec",
+]
+
 [[package]]
 name = "extractors"
 version = "0.0.0"
@@ -3330,7 +3343,6 @@ dependencies = [
  "assert_cmd",
  "async-process",
  "axum",
- "base64 0.22.1",
  "build",
  "bytes",
  "chrono",
@@ -3620,6 +3632,7 @@ dependencies = [
  "hexdump",
  "jsonwebtoken",
  "memchr",
+ "metrics",
  "ops",
  "pin-project-lite",
  "proto-gazette",
@@ -3639,6 +3652,21 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "generator"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52f04ae4152da20c76fe800fa48659201d5cf627c5149ca0b707b69d7eef6cf9"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "libc",
+ "log",
+ "rustversion",
+ "windows-link 0.2.0",
+ "windows-result 0.4.0",
+]
+
 [[package]]
 name = "generic-array"
 version = "0.14.7"
@@ -3859,6 +3887,12 @@ dependencies = [
  "thiserror 2.0.17",
 ]
 
+[[package]]
+name = "hashbag"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7040a10f52cba493ddb09926e15d10a9d8a28043708a405931fe4c6f19fac064"
+
 [[package]]
 name = "hashbrown"
 version = "0.12.3"
@@ -4138,9 +4172,9 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.7.0"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb3aa54a13a0dfe7fbe3a59e0c76093041720fdc77b110cc0fc260fafb4dc51e"
+checksum = "6299f016b246a94207e63da54dbe807655bf9e00044f73ded42c3ac5305fbcca"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -4153,7 +4187,6 @@ dependencies = [
  "httpdate",
  "itoa",
  "pin-project-lite",
- "pin-utils",
  "smallvec",
  "tokio",
  "want",
@@ -4182,7 +4215,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
 dependencies = [
  "http 1.3.1",
- "hyper 1.7.0",
+ "hyper 1.9.0",
  "hyper-util",
  "rustls 0.23.32",
  "rustls-native-certs 0.8.1",
@@ -4199,7 +4232,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
 dependencies = [
- "hyper 1.7.0",
+ "hyper 1.9.0",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -4227,7 +4260,7 @@ checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
 dependencies = [
  "bytes",
  "http-body-util",
- "hyper 1.7.0",
+ "hyper 1.9.0",
  "hyper-util",
  "native-tls",
  "tokio",
@@ -4248,7 +4281,7 @@ dependencies = [
  "futures-util",
  "http 1.3.1",
  "http-body 1.0.1",
- "hyper 1.7.0",
+ "hyper 1.9.0",
  "ipnet",
  "libc",
  "percent-encoding",
@@ -4746,6 +4779,17 @@ dependencies = [
  "spin",
 ]
 
+[[package]]
+name = "left-right"
+version = "0.11.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f0c21e4c8ff95f487fb34e6f9182875f42c84cef966d29216bf115d9bba835a"
+dependencies = [
+ "crossbeam-utils",
+ "loom",
+ "slab",
+]
+
 [[package]]
 name = "lexical-core"
 version = "1.0.6"
@@ -4971,6 +5015,19 @@ version = "0.4.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"
 
+[[package]]
+name = "loom"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "419e0dc8046cb947daa77eb95ae174acfbddb7673b4151f56d1eed8e93fbfaca"
+dependencies = [
+ "cfg-if",
+ "generator",
+ "scoped-tls",
+ "tracing",
+ "tracing-subscriber",
+]
+
 [[package]]
 name = "lru"
 version = "0.12.5"
@@ -5064,23 +5121,24 @@ checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
 
 [[package]]
 name = "metrics"
-version = "0.24.2"
+version = "0.24.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25dea7ac8057892855ec285c440160265225438c3c45072613c25a4b26e98ef5"
+checksum = "89550ee9f79e88fef3119de263694973a8adb26c21d75322164fb8c493039fe2"
 dependencies = [
- "ahash",
  "portable-atomic",
+ "rapidhash",
 ]
 
 [[package]]
 name = "metrics-exporter-prometheus"
-version = "0.17.2"
+version = "0.18.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b166dea96003ee2531cf14833efedced545751d800f03535801d833313f8c15"
+checksum = "1db0d8f1fc9e62caebd0319e11eaec5822b0186c171568f0480b46a0137f9108"
 dependencies = [
  "base64 0.22.1",
+ "evmap",
  "http-body-util",
- "hyper 1.7.0",
+ "hyper 1.9.0",
  "hyper-rustls 0.27.7",
  "hyper-util",
  "indexmap 2.11.4",
@@ -5088,6 +5146,7 @@ dependencies = [
  "metrics",
  "metrics-util",
  "quanta",
+ "rustls 0.23.32",
  "thiserror 2.0.17",
  "tokio",
  "tracing",
@@ -5099,11 +5158,15 @@ version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fe8db7a05415d0f919ffb905afa37784f71901c9a773188876984b4f769ab986"
 dependencies = [
+ "aho-corasick",
  "crossbeam-epoch",
  "crossbeam-utils",
  "hashbrown 0.15.5",
+ "indexmap 2.11.4",
  "metrics",
+ "ordered-float 4.6.0",
  "quanta",
+ "radix_trie",
  "rand 0.9.2",
  "rand_xoshiro",
  "sketches-ddsketch",
@@ -5617,6 +5680,15 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "ordered-float"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7bb71e1b3fa6ca1c61f383464aaf2bb0e2f8e772a1f01d486832464de363b951"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "outref"
 version = "0.5.2"
@@ -6681,6 +6753,15 @@ dependencies = [
  "rand_core 0.9.3",
 ]
 
+[[package]]
+name = "rapidhash"
+version = "4.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e48930979c155e2f33aa36ab3119b5ee81332beb6482199a8ecd6029b80b59"
+dependencies = [
+ "rustversion",
+]
+
 [[package]]
 name = "raw-cpuid"
 version = "11.6.0"
@@ -6898,7 +6979,7 @@ dependencies = [
  "http 1.3.1",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.7.0",
+ "hyper 1.9.0",
  "hyper-rustls 0.27.7",
  "hyper-tls 0.6.0",
  "hyper-util",
@@ -7129,6 +7210,7 @@ dependencies = [
  "labels",
  "librocksdb-sys",
  "locate-bin",
+ "metrics",
  "models",
  "ops",
  "pbjson-types",
@@ -7143,6 +7225,7 @@ dependencies = [
  "rocksdb",
  "serde",
  "serde_json",
+ "service-kit",
  "shuffle",
  "simd-doc",
  "tables",
@@ -7163,6 +7246,29 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "runtime-sidecar"
+version = "0.0.0"
+dependencies = [
+ "anyhow",
+ "clap",
+ "flow-client-next",
+ "futures",
+ "gazette",
+ "proto-gazette",
+ "runtime-next",
+ "rustls 0.23.32",
+ "service-kit",
+ "shuffle",
+ "tokens",
+ "tokio",
+ "tokio-stream",
+ "tonic",
+ "tracing",
+ "tracing-subscriber",
+ "url",
+]
+
 [[package]]
 name = "rusqlite"
 version = "0.32.1"
@@ -7428,6 +7534,12 @@ dependencies = [
  "syn 2.0.106",
 ]
 
+[[package]]
+name = "scoped-tls"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
+
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
@@ -7687,6 +7799,26 @@ dependencies = [
  "unsafe-libyaml",
 ]
 
+[[package]]
+name = "service-kit"
+version = "0.0.0"
+dependencies = [
+ "anyhow",
+ "axum",
+ "chrono",
+ "metrics",
+ "metrics-exporter-prometheus",
+ "metrics-util",
+ "proto-gazette",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tower",
+ "tower-http",
+ "tracing",
+ "tracing-subscriber",
+]
+
 [[package]]
 name = "sha1"
 version = "0.10.6"
@@ -7744,6 +7876,7 @@ dependencies = [
  "lz4",
  "md5",
  "memchr",
+ "metrics",
  "models",
  "ops",
  "pbjson-types",
@@ -7760,6 +7893,7 @@ dependencies = [
  "serde-transcode",
  "serde_json",
  "serde_yaml",
+ "service-kit",
  "simd-doc",
  "superslice",
  "tables",
@@ -8498,7 +8632,7 @@ checksum = "7e54bc85fc7faa8bc175c4bab5b92ba8d9a3ce893d0e9f42cc455c8ab16a9e09"
 dependencies = [
  "byteorder",
  "integer-encoding",
- "ordered-float",
+ "ordered-float 2.10.1",
 ]
 
 [[package]]
@@ -8778,7 +8912,7 @@ dependencies = [
  "http 1.3.1",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.7.0",
+ "hyper 1.9.0",
  "hyper-timeout",
  "hyper-util",
  "percent-encoding",
diff --git a/Cargo.toml b/Cargo.toml
index 255691eed56..395880fc5d3 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -102,8 +102,9 @@ lz4 = "1"
 lz4_flex = "0"
 mime = "0"
 memchr = "2"
-metrics = "0"
-metrics-exporter-prometheus = "0"
+metrics = "0.24"
+metrics-exporter-prometheus = "0.18"
+metrics-util = "0.20"
 prometheus = "0"
 md5 = "0"
 num-bigint = "0"
@@ -169,7 +170,7 @@ sqlx = { version = "0", features = [
 ] }
 
 tokio-rustls = "0"
-rustls = { version = "0" }
+rustls = { version = "0", features = ["aws_lc_rs"] }
 rustls-pemfile = "2"
 webpki = "0"
 tempfile = "3"
@@ -234,7 +235,7 @@ aws-sdk-sts = "1"
 
 # Used for the agent http server
 axum = { version = "0", features = ["macros"] }
-axum-server = { version = "0", features = ["tls-rustls"] }
+axum-server = { version = "0.7.3", features = ["tls-rustls"] }
 axum-extra = { version = "0", features = ["typed-header", "query"] }
 async-graphql = { version = "7", features = [
     "chrono",
diff --git a/crates/bindings/Cargo.toml b/crates/bindings/Cargo.toml
index ea67f81b669..d49061f0cce 100644
--- a/crates/bindings/Cargo.toml
+++ b/crates/bindings/Cargo.toml
@@ -18,6 +18,7 @@ derive = { path = "../derive" }
 ops = { path = "../ops" }
 proto-flow = { path = "../proto-flow" }
 runtime = { path = "../runtime" }
+runtime-next = { path = "../runtime-next" }
 
 anyhow = { workspace = true }
 bytes = { workspace = true }
@@ -25,6 +26,7 @@ futures = { workspace = true }
 prost = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
+rustls = { workspace = true }
 thiserror = { workspace = true }
 time = { workspace = true }
 tracing = { workspace = true }
diff --git a/crates/bindings/flow_bindings.h b/crates/bindings/flow_bindings.h
index a395842f506..ccd2af6d1ea 100644
--- a/crates/bindings/flow_bindings.h
+++ b/crates/bindings/flow_bindings.h
@@ -112,6 +112,17 @@ typedef struct TaskService {
   uintptr_t err_cap;
 } TaskService;
 
+typedef struct TaskServiceV2ImplPtr {
+  uint8_t _private[0];
+} TaskServiceV2ImplPtr;
+
+typedef struct TaskServiceV2 {
+  struct TaskServiceV2ImplPtr *svc_ptr;
+  uint8_t *err_ptr;
+  uintptr_t err_len;
+  uintptr_t err_cap;
+} TaskServiceV2;
+
 struct Channel *extract_create(int32_t log_level, int32_t log_dest_fd);
 
 void extract_invoke1(struct Channel *ch, struct In1 i);
@@ -131,6 +142,10 @@ struct TaskService *new_task_service(const uint8_t *config_ptr, uint32_t config_
 
 void task_service_drop(struct TaskService *svc);
 
+struct TaskServiceV2 *new_task_service_v2(const uint8_t *config_ptr, uint32_t config_len);
+
+void task_service_v2_drop(struct TaskServiceV2 *svc);
+
 struct Channel *upper_case_create(int32_t log_level, int32_t log_dest_fd);
 
 void upper_case_invoke1(struct Channel *ch, struct In1 i);
diff --git a/crates/bindings/src/lib.rs b/crates/bindings/src/lib.rs
index cadaba0747a..d98f78e6446 100644
--- a/crates/bindings/src/lib.rs
+++ b/crates/bindings/src/lib.rs
@@ -2,4 +2,15 @@ mod extract;
 mod metrics;
 mod service;
 mod task_service;
+mod task_service_v2;
 mod upper_case;
+
+fn install_crypto_provider() {
+    static ONCE: std::sync::Once = std::sync::Once::new();
+
+    ONCE.call_once(|| {
+        // `bindings` is linked into Go binaries through CGO, so Rust binary
+        // entrypoints cannot install rustls' process-wide provider for us.
+        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
+    });
+}
diff --git a/crates/bindings/src/task_service.rs b/crates/bindings/src/task_service.rs
index 31107336766..771a2d95a79 100644
--- a/crates/bindings/src/task_service.rs
+++ b/crates/bindings/src/task_service.rs
@@ -21,6 +21,8 @@ pub struct TaskService {
 
 #[unsafe(no_mangle)]
 pub extern "C" fn new_task_service(config_ptr: *const u8, config_len: u32) -> *mut TaskService {
+    crate::install_crypto_provider();
+
     let config = unsafe { std::slice::from_raw_parts(config_ptr, config_len as usize) };
     let config = proto_flow::runtime::TaskServiceConfig::decode(config).unwrap();
 
diff --git a/crates/bindings/src/task_service_v2.rs b/crates/bindings/src/task_service_v2.rs
new file mode 100644
index 00000000000..5fcd9f9bc58
--- /dev/null
+++ b/crates/bindings/src/task_service_v2.rs
@@ -0,0 +1,85 @@
+use prost::Message;
+
+// Opaque pointer for a TaskService instance in the ABI.
+#[repr(C)]
+pub struct TaskServiceV2ImplPtr {
+    _private: [u8; 0],
+}
+
+#[repr(C)]
+pub struct TaskServiceV2 {
+    // Opaque service pointer.
+    svc_ptr: *mut TaskServiceV2ImplPtr,
+
+    // Terminal error returned by the TaskService.
+    err_ptr: *mut u8,
+    err_len: usize,
+    err_cap: usize,
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn new_task_service_v2(
+    config_ptr: *const u8,
+    config_len: u32,
+) -> *mut TaskServiceV2 {
+    crate::install_crypto_provider();
+
+    let config = unsafe { std::slice::from_raw_parts(config_ptr, config_len as usize) };
+    let config = proto_flow::runtime::TaskServiceConfig::decode(config).unwrap();
+
+    let log_file = unsafe {
+        use std::os::unix::io::FromRawFd;
+        std::fs::File::from_raw_fd(config.log_file_fd)
+    };
+
+    let svc_abi = match runtime_next::TaskService::new(config, log_file) {
+        Ok(svc) => {
+            let svc_ptr = Box::leak(Box::new(svc)) as *mut runtime_next::TaskService
+                as *mut TaskServiceV2ImplPtr;
+
+            TaskServiceV2 {
+                svc_ptr,
+                err_ptr: 0 as *mut u8,
+                err_len: 0,
+                err_cap: 0,
+            }
+        }
+        Err(err) => {
+            let mut err = format!("{:?}", err);
+            let err_ptr = err.as_mut_ptr();
+            let err_cap = err.capacity();
+            let err_len = err.len();
+            std::mem::forget(err);
+
+            TaskServiceV2 {
+                svc_ptr: 0 as *mut TaskServiceV2ImplPtr,
+                err_ptr,
+                err_len,
+                err_cap,
+            }
+        }
+    };
+
+    Box::leak(Box::new(svc_abi))
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn task_service_v2_drop(svc: *mut TaskServiceV2) {
+    let TaskServiceV2 {
+        svc_ptr,
+        err_ptr,
+        err_len,
+        err_cap,
+    } = *unsafe { Box::from_raw(svc) };
+
+    if svc_ptr != 0 as *mut TaskServiceV2ImplPtr {
+        let svc = unsafe { Box::from_raw(svc_ptr as *mut runtime_next::TaskService) };
+        svc.graceful_stop();
+    }
+    let err_ptr = if err_cap == 0 {
+        std::ptr::NonNull::dangling().as_ptr()
+    } else {
+        err_ptr
+    };
+    unsafe { String::from_raw_parts(err_ptr, err_len, err_cap) };
+}
diff --git a/crates/control-plane-api/src/server/authorize_task.rs b/crates/control-plane-api/src/server/authorize_task.rs
index f062914f886..deb4f1be21f 100644
--- a/crates/control-plane-api/src/server/authorize_task.rs
+++ b/crates/control-plane-api/src/server/authorize_task.rs
@@ -39,20 +39,14 @@ pub async fn authorize_task(
     // checking that the requested capability contains a particular grant isn't enough.
     // For example, we wouldn't want to allow a request for `REPLICATE` just
     // because it also requests `READ`.
+    use proto_gazette::capability::{APPEND, APPLY, LIST, READ};
     let required_role = match cap {
-        cap if (cap == proto_gazette::capability::LIST)
-            || (cap == proto_gazette::capability::READ)
-            || (cap == (proto_gazette::capability::LIST | proto_gazette::capability::READ)) =>
-        {
-            models::Capability::Read
-        }
-        // We're intentionally rejecting requests for both APPLY and APPEND, as those two
-        // grants authorize wildly different capabilities, and no sane logic should
-        // need both at the same time. So as a sanity check/defense-in-depth measure
-        // we won't grant you a token that has both, even if we technically could.
-        cap if (cap == proto_gazette::capability::APPLY)
-            || (cap == proto_gazette::capability::APPEND) =>
-        {
+        // Legacy go shuffle module obtains LIST and READ separately.
+        // The `shuffle` crate and `dekaf` obtain LIST | READ jointly.
+        cap if (cap == LIST) || (cap == READ) || (cap == (LIST | READ)) => models::Capability::Read,
+        // Legacy publisher separately obtains APPLY vs APPEND tokens.
+        // The `publisher` crates obtains APPEND | APPLY | LIST jointly.
+        cap if (cap == APPLY) || (cap == APPEND) || (cap == (APPEND | APPLY | LIST)) => {
             models::Capability::Write
         }
         cap => {
diff --git a/crates/dekaf/tests/e2e/harness.rs b/crates/dekaf/tests/e2e/harness.rs
index bca972aa946..457ec1daa25 100644
--- a/crates/dekaf/tests/e2e/harness.rs
+++ b/crates/dekaf/tests/e2e/harness.rs
@@ -3,9 +3,12 @@ use std::collections::BTreeMap;
 use std::sync::OnceLock;
 use std::time::Duration;
 
-/// Prefix for test namespaces. Requires storage mappings and user grants
-/// provisioned by `mise run local:test-tenant`.
-const TEST_NAMESPACE_PREFIX: &str = "test/dekaf";
+/// Prefix for test namespaces, provisioned by `mise run local:test-tenant`,
+/// which must match FLOW_AUTH_TOKEN credential.
+fn test_namespace_prefix() -> String {
+    let tenant = std::env::var("FLOW_TEST_TENANT").expect("FLOW_TEST_TENANT must be set");
+    format!("{tenant}/dekaf")
+}
 
 pub fn init_tracing() {
     let _ = tracing_subscriber::fmt()
@@ -19,7 +22,7 @@ pub fn init_tracing() {
 }
 
 /// Create a flowctl command configured for local stack.
-/// Requires FLOW_ACCESS_TOKEN environment variable to be set.
+/// Requires FLOW_AUTH_TOKEN environment variable to be set.
 fn flowctl_command() -> anyhow::Result<async_process::Command> {
     // Try to find flowctl in cargo-target/debug first (where `cargo build` puts it),
     // falling back to locate_bin (which checks alongside the test binary and PATH).
@@ -36,11 +39,10 @@ fn flowctl_command() -> anyhow::Result<async_process::Command> {
     let home = std::env::var("HOME").unwrap();
     let ca_cert =
         std::env::var("SSL_CERT_FILE").unwrap_or_else(|_| format!("{}/flow-local/ca.crt", home));
-    let access_token = std::env::var("FLOW_ACCESS_TOKEN")
-        .context("FLOW_ACCESS_TOKEN environment variable must be set for e2e tests")?;
+    let auth_token = std::env::var("FLOW_AUTH_TOKEN").context("FLOW_AUTH_TOKEN must be set")?;
 
     let mut cmd = async_process::Command::new(flowctl);
-    cmd.env("FLOW_ACCESS_TOKEN", access_token);
+    cmd.env("FLOW_AUTH_TOKEN", auth_token);
     cmd.env("SSL_CERT_FILE", ca_cert);
     cmd.arg("--profile").arg("local");
     Ok(cmd)
@@ -61,7 +63,7 @@ impl DekafTestEnv {
     /// rewritten to include a unique test namespace.
     pub async fn setup(test_name: &str, fixture_yaml: &str) -> anyhow::Result<Self> {
         let suffix = format!("{:04x}", rand::random::<u16>());
-        let namespace = format!("{TEST_NAMESPACE_PREFIX}/{test_name}/{suffix}");
+        let namespace = format!("{}/{test_name}/{suffix}", test_namespace_prefix());
 
         tracing::info!(%namespace, "Setting up test environment");
 
diff --git a/crates/e2e-support/tests/hello_world.rs b/crates/e2e-support/tests/hello_world.rs
index c6e4b30c2da..1ed0c65e9b1 100644
--- a/crates/e2e-support/tests/hello_world.rs
+++ b/crates/e2e-support/tests/hello_world.rs
@@ -53,7 +53,7 @@ async fn hello_world(build: Arc<build::Output>, journal_client: gazette::journal
         .as_ref()
         .expect("built collection should have a spec");
 
-    let binding = publisher::Binding::from_collection_spec(collection_spec, None)
+    let binding = publisher::Binding::from_collection_spec(collection_spec)
         .expect("should build binding from collection spec");
 
     let factory: gazette::journal::ClientFactory = Arc::new({
@@ -118,7 +118,7 @@ async fn hello_world(build: Arc<build::Output>, journal_client: gazette::journal
         .expect("ACK write should succeed");
 
     // Snapshot the partition listing from the Publisher's own watch.
-    let (_client, partitions) = publisher.binding_client(0);
+    let (_client, partitions) = publisher.mapped_binding_client(0);
     let partitions_watch = partitions.ready().await;
     let splits = partitions_watch.token();
     let splits = splits.result().expect("partitions should be available");
diff --git a/crates/flow-client-next/src/workflows/task_collection_auth.rs b/crates/flow-client-next/src/workflows/task_collection_auth.rs
index 196a451f714..d53a4b96fea 100644
--- a/crates/flow-client-next/src/workflows/task_collection_auth.rs
+++ b/crates/flow-client-next/src/workflows/task_collection_auth.rs
@@ -28,9 +28,8 @@ pub struct TaskCollectionAuth {
 ///
 /// `capability` is the requested capability level of the authorization.
 /// This is NOT a models::Capability. Rather, it's a bit-mask in the u32
-/// Gazette capability namespace and is restricted to:
-/// - proto_gazette::capability::READ
-/// - proto_gazette::capability::APPEND
+/// Gazette capability namespace and is restricted to
+/// proto_gazette::capability::{APPEND, APPLY, LIST, READ}.
 ///
 /// `data_plane_fqdn` is the FQDN of the data-plane hosting the task.
 ///
diff --git a/crates/flowctl/Cargo.toml b/crates/flowctl/Cargo.toml
index 6b997abb0c3..30872ed1d1e 100644
--- a/crates/flowctl/Cargo.toml
+++ b/crates/flowctl/Cargo.toml
@@ -45,7 +45,6 @@ validation = { path = "../validation" }
 
 anyhow = { workspace = true }
 axum = { workspace = true }
-base64 = { workspace = true }
 bytes = { workspace = true }
 chrono = { workspace = true }
 clap = { workspace = true }
diff --git a/crates/flowctl/src/config.rs b/crates/flowctl/src/config.rs
index 68865e02193..29968810cbf 100644
--- a/crates/flowctl/src/config.rs
+++ b/crates/flowctl/src/config.rs
@@ -1,5 +1,4 @@
 use anyhow::Context;
-use base64::Engine;
 use std::path::PathBuf;
 
 use flow_client::{
@@ -158,26 +157,26 @@ impl Config {
             config.user_refresh_token = refresh_token;
         }
 
-        // If a refresh token is not defined, attempt to parse one from the environment.
-        if config.user_refresh_token.is_none() {
-            if let Ok(env_token) = std::env::var(FLOW_AUTH_TOKEN) {
-                let decoded = base64::engine::general_purpose::STANDARD
-                    .decode(env_token)
+        // FLOW_AUTH_TOKEN, if present, overrides a refresh or access token
+        // loaded from disk. A value with three dot-delimited segments is a JWT
+        // access token; anything else is a base64-encoded refresh token JSON.
+        if let Ok(env_token) = std::env::var(FLOW_AUTH_TOKEN) {
+            if env_token.split('.').count() == 3 {
+                tracing::info!("using FLOW_AUTH_TOKEN environment access token");
+                config.user_refresh_token = None;
+                config.user_access_token = Some(env_token);
+            } else {
+                let decoded = tokens::jwt::parse_base64(&env_token)
                     .context("FLOW_AUTH_TOKEN is not base64")?;
                 let token: RefreshToken =
                     serde_json::from_slice(&decoded).context("FLOW_AUTH_TOKEN is invalid JSON")?;
 
-                tracing::info!("using refresh token from environment variable {FLOW_AUTH_TOKEN}");
+                tracing::info!("using FLOW_AUTH_TOKEN environment refresh token");
                 config.user_refresh_token = Some(token);
+                config.user_access_token = None;
             }
         }
 
-        // Allow overriding access token via environment variable for CI/automation.
-        if let Ok(token) = std::env::var(FLOW_ACCESS_TOKEN) {
-            tracing::info!("using access token from environment variable {FLOW_ACCESS_TOKEN}");
-            config.user_access_token = Some(token);
-        }
-
         config.is_local = profile == "local";
 
         Ok(config)
@@ -231,7 +230,6 @@ impl Config {
     }
 }
 
-// Environment variable which is inspected for a base64-encoded refresh token.
+// Environment variable inspected for an auth credential: either a JWT access
+// token, or a base64-encoded refresh token JSON.
 const FLOW_AUTH_TOKEN: &str = "FLOW_AUTH_TOKEN";
-// Environment variable which is inspected for an access token (for CI/automation).
-const FLOW_ACCESS_TOKEN: &str = "FLOW_ACCESS_TOKEN";
diff --git a/crates/flowctl/src/raw/preview_next/driver.rs b/crates/flowctl/src/raw/preview_next/driver.rs
index 93188122a71..316ccf7a156 100644
--- a/crates/flowctl/src/raw/preview_next/driver.rs
+++ b/crates/flowctl/src/raw/preview_next/driver.rs
@@ -108,6 +108,7 @@ async fn drive_one_shard(
         None,
         task_name,
         publisher_factory,
+        Default::default(), // Inert service_kit::Registry.
     );
 
     let mut response_rx = shard_svc.spawn_materialize(UnboundedReceiverStream::new(request_rx));
@@ -161,8 +162,6 @@ async fn drive_one_shard(
                 .send(Ok(proto::Materialize {
                     task: Some(proto::Task {
                         spec: spec_bytes.clone(),
-                        ops_stats_journal: String::new(),
-                        ops_stats_spec: None,
                         preview: true,
                         max_transactions: target_txns,
                     }),
diff --git a/crates/flowctl/src/raw/preview_next/services.rs b/crates/flowctl/src/raw/preview_next/services.rs
index eeed25d8234..0cbc7e50cae 100644
--- a/crates/flowctl/src/raw/preview_next/services.rs
+++ b/crates/flowctl/src/raw/preview_next/services.rs
@@ -59,15 +59,20 @@ impl Run {
             user_tokens,
         );
         // 2 GiB matches the runtime-next default for sidecar-hosted shuffle services.
-        let shuffle_svc =
-            shuffle::Service::new(peer_endpoint.clone(), factory, 2 * 1024 * 1024 * 1024);
+        let shuffle_svc = shuffle::Service::new(
+            peer_endpoint.clone(),
+            factory,
+            2 * 1024 * 1024 * 1024,
+            Default::default(), // Inert service_kit::Registry.
+        );
 
         let publisher_factory: gazette::journal::ClientFactory = std::sync::Arc::new({
             move |_authz_sub: String, _authz_obj: String| -> gazette::journal::Client {
                 unreachable!("live Publisher is not used by preview ({_authz_sub}, {_authz_obj})")
             }
         });
-        let runtime_svc = runtime_next::Service::new(shuffle_svc.clone(), publisher_factory);
+        let runtime_svc =
+            runtime_next::Service::new(shuffle_svc.clone(), publisher_factory, Default::default());
 
         let router = tonic::transport::Server::builder()
             .add_service(runtime_svc.into_tonic_service())
diff --git a/crates/gazette/Cargo.toml b/crates/gazette/Cargo.toml
index 9a4cb3dc3c8..a379fadb39d 100644
--- a/crates/gazette/Cargo.toml
+++ b/crates/gazette/Cargo.toml
@@ -25,6 +25,7 @@ futures = { workspace = true }
 futures-core = { workspace = true }
 jsonwebtoken = { workspace = true }
 memchr = { workspace = true }
+metrics = { workspace = true }
 rand = { workspace = true }
 reqwest = { workspace = true }
 thiserror = { workspace = true }
diff --git a/crates/gazette/src/journal/append.rs b/crates/gazette/src/journal/append.rs
index 6c9f0e9a22d..dcc874dd1a3 100644
--- a/crates/gazette/src/journal/append.rs
+++ b/crates/gazette/src/journal/append.rs
@@ -19,9 +19,10 @@ impl Client {
     {
         coroutines::coroutine(move |mut co| async move {
             let mut attempt = 0;
+            let metrics = Metrics::new(&req.journal);
 
             loop {
-                let err = match self.try_append(&mut req, source()).await {
+                let err = match self.try_append(metrics.clone(), &mut req, source()).await {
                     Ok(resp) => {
                         () = co.yield_(Ok(resp)).await;
                         return;
@@ -49,6 +50,7 @@ impl Client {
 
     async fn try_append<S>(
         &self,
+        metrics: Metrics,
         req: &mut broker::AppendRequest,
         source: S,
     ) -> crate::Result<AppendResponse>
@@ -67,16 +69,19 @@ impl Client {
         // the initial metadata request containing the journal name and any other request metadata, then
         // "data" requests that contain chunks of data to write, then the final EOF indicating completion.
         let source = futures::stream::once(async move { Ok(req_clone) })
-            .chain(source.filter_map(|input| {
+            .chain(source.filter_map(move |input| {
                 futures::future::ready(match input {
                     // It's technically possible to get an empty set of bytes when reading
                     // from the input stream. Filter these out as otherwise they would look
                     // like EOFs to the append RPC and cause confusion.
                     Ok(content) if content.len() == 0 => None,
-                    Ok(content) => Some(Ok(broker::AppendRequest {
-                        content,
-                        ..Default::default()
-                    })),
+                    Ok(content) => {
+                        metrics.append.increment(content.len() as u64);
+                        Some(Ok(broker::AppendRequest {
+                            content,
+                            ..Default::default()
+                        }))
+                    }
                     Err(err) => Some(Err(err)),
                 })
             }))
@@ -120,3 +125,24 @@ impl Client {
         }
     }
 }
+
+#[derive(Clone)]
+struct Metrics {
+    append: metrics::Counter,
+}
+
+impl Metrics {
+    fn new(journal: &str) -> Self {
+        static DESCRIBE: std::sync::Once = std::sync::Once::new();
+        DESCRIBE.call_once(|| {
+            metrics::describe_counter!(
+                "gazette_append",
+                metrics::Unit::Bytes,
+                "number of bytes appended to a journal",
+            );
+        });
+        let append = metrics::counter!("gazette_append", "journal" => journal.to_string());
+
+        Self { append }
+    }
+}
diff --git a/crates/gazette/src/journal/read/mod.rs b/crates/gazette/src/journal/read/mod.rs
index e64bf88d998..3729edcc0a0 100644
--- a/crates/gazette/src/journal/read/mod.rs
+++ b/crates/gazette/src/journal/read/mod.rs
@@ -20,8 +20,9 @@ impl Client {
     ) -> impl futures::Stream<Item = crate::RetryResult<broker::ReadResponse>> + Send + 'static
     {
         coroutines::coroutine(move |mut co| async move {
-            let mut write_head = i64::MAX;
             let mut attempt = 0;
+            let mut write_head = i64::MAX;
+            let metrics = Metrics::new(&req.journal);
 
             loop {
                 // Have we read through requested `end_offset`?
@@ -33,7 +34,10 @@ impl Client {
                     return;
                 }
 
-                let err = match self.read_some(&mut co, &mut req, &mut write_head).await {
+                let err = match self
+                    .read_some(&mut co, metrics.clone(), &mut req, &mut write_head)
+                    .await
+                {
                     Ok(()) => {
                         attempt = 0;
                         continue;
@@ -62,6 +66,7 @@ impl Client {
     async fn read_some(
         &self,
         co: &mut coroutines::Suspend<crate::RetryResult<broker::ReadResponse>, ()>,
+        metrics: Metrics,
         req: &mut broker::ReadRequest,
         write_head: &mut i64,
     ) -> crate::Result<()> {
@@ -95,7 +100,10 @@ impl Client {
         {
             *write_head = metadata.write_head;
             req.offset = metadata.write_head;
+
             () = co.yield_(Ok(metadata)).await;
+            metrics.tick(req.offset, *write_head);
+
             return Ok(());
         } else if metadata.status() != broker::Status::Ok {
             // Note: we used to fall through and retry below on !Ok. That was
@@ -115,11 +123,32 @@ impl Client {
                 tracing::info!(req.journal, req.offset, metadata.offset, "offset jump");
                 req.offset = metadata.offset;
             }
-
             *write_head = metadata.write_head;
+
             let (fragment, fragment_url) = (fragment.clone(), metadata.fragment_url.clone());
             () = co.yield_(Ok(metadata)).await;
-            return read_fragment_url(co, fragment, &self.fragment_client, fragment_url, req).await;
+            metrics.tick(req.offset, *write_head);
+
+            return read_fragment_url(
+                co,
+                metrics,
+                fragment,
+                &self.fragment_client,
+                fragment_url,
+                req,
+                *write_head,
+            )
+            .await;
+        }
+
+        // We skipped the direct-fragment path. If the broker returned a
+        // `file://` URL, the fragment is persisted but lives on the broker's
+        // local filesystem — we have no transport to read it ourselves, so
+        // we must ask the broker to proxy. With `do_not_proxy=true` and no
+        // open spool file, `serveRead` short-circuits after sending only the
+        // fragment metadata, EOFs the stream, and the outer loop spins.
+        if metadata.fragment_url.starts_with("file://") {
+            req.do_not_proxy = false;
         }
 
         tracing::trace!(req.offset, write_head, "started direct journal read");
@@ -148,12 +177,16 @@ impl Client {
                         req.offset = resp.offset;
                     }
                     *write_head = resp.write_head;
+
                     () = co.yield_(Ok(resp)).await;
+                    metrics.tick(req.offset, *write_head);
                 }
                 // Content response.
                 (broker::Status::Ok, None, false) => {
                     req.offset += resp.content.len() as i64;
+
                     () = co.yield_(Ok(resp)).await;
+                    metrics.tick(req.offset, *write_head);
                 }
                 // All other statuses end the stream, and are handled by the caller.
                 (status, _, _) => return Err(Error::BrokerStatus(status)),
@@ -166,10 +199,12 @@ impl Client {
 
 async fn read_fragment_url(
     co: &mut coroutines::Suspend<crate::RetryResult<broker::ReadResponse>, ()>,
+    metrics: Metrics,
     fragment: broker::Fragment,
     fragment_client: &reqwest::Client,
     fragment_url: String,
     req: &mut broker::ReadRequest,
+    write_head: i64,
 ) -> crate::Result<()> {
     let mut get = fragment_client.get(fragment_url);
 
@@ -201,16 +236,16 @@ async fn read_fragment_url(
 
     match fragment.compression_codec() {
         broker::CompressionCodec::None | broker::CompressionCodec::GzipOffloadDecompression => {
-            read_fragment_url_body(co, fragment, raw_reader, req).await
+            read_fragment_url_body(co, metrics, fragment, raw_reader, req, write_head).await
         }
         broker::CompressionCodec::Gzip => {
             let mut decoder = async_compression::futures::bufread::GzipDecoder::new(raw_reader);
             decoder.multiple_members(true);
-            read_fragment_url_body(co, fragment, decoder, req).await
+            read_fragment_url_body(co, metrics, fragment, decoder, req, write_head).await
         }
         broker::CompressionCodec::Zstandard => {
             let decoder = async_compression::futures::bufread::ZstdDecoder::new(raw_reader);
-            read_fragment_url_body(co, fragment, decoder, req).await
+            read_fragment_url_body(co, metrics, fragment, decoder, req, write_head).await
         }
         broker::CompressionCodec::Snappy => Err(Error::Protocol(
             "snappy compression is not yet implemented by this client",
@@ -223,9 +258,11 @@ async fn read_fragment_url(
 
 async fn read_fragment_url_body(
     co: &mut coroutines::Suspend<crate::RetryResult<broker::ReadResponse>, ()>,
+    metrics: Metrics,
     fragment: broker::Fragment,
     r: impl futures::io::AsyncRead,
     req: &mut broker::ReadRequest,
+    write_head: i64,
 ) -> crate::Result<()> {
     use bytes::Buf;
     use tokio_util::compat::FuturesAsyncReadCompatExt;
@@ -275,7 +312,53 @@ async fn read_fragment_url_body(
             .await;
 
         req.offset += content_len;
+        metrics.tick(req.offset, write_head);
+        metrics.fragment.increment(content_len as u64);
     }
 
     Ok(())
 }
+
+#[derive(Clone)]
+struct Metrics {
+    offset: metrics::Gauge,
+    remainder: metrics::Gauge,
+    fragment: metrics::Counter,
+}
+
+impl Metrics {
+    fn new(journal: &str) -> Self {
+        static DESCRIBE: std::sync::Once = std::sync::Once::new();
+        DESCRIBE.call_once(|| {
+            metrics::describe_gauge!(
+                "gazette_read_offset",
+                metrics::Unit::Bytes,
+                "current read offset for a journal",
+            );
+            metrics::describe_gauge!(
+                "gazette_read_remainder",
+                metrics::Unit::Bytes,
+                "distance from current read offset to write head for a journal",
+            );
+            metrics::describe_counter!(
+                "gazette_read_fragment",
+                metrics::Unit::Bytes,
+                "number of bytes directly read from journal fragment files",
+            );
+        });
+        let offset = metrics::gauge!("gazette_read_offset", "journal" => journal.to_string());
+        let remainder = metrics::gauge!("gazette_read_remainder", "journal" => journal.to_string());
+        let fragment = metrics::counter!("gazette_read_fragment", "journal" => journal.to_string());
+
+        Self {
+            offset,
+            remainder,
+            fragment,
+        }
+    }
+
+    fn tick(&self, offset: i64, write_head: i64) {
+        self.offset.set(offset as f64);
+        self.remainder.set((write_head - offset) as f64);
+    }
+}
diff --git a/crates/labels/src/lib.rs b/crates/labels/src/lib.rs
index 535f421fb67..32362fd7438 100644
--- a/crates/labels/src/lib.rs
+++ b/crates/labels/src/lib.rs
@@ -23,7 +23,7 @@ pub const TASK_TYPE_CAPTURE: &str = "capture";
 pub const TASK_TYPE_DERIVATION: &str = "derivation";
 pub const TASK_TYPE_MATERIALIZATION: &str = "materialization";
 pub const RCLOCK_BEGIN: &str = "estuary.dev/rclock-begin";
-pub const RCLOCK_BEGIN_MIN: &str = KEY_BEGIN;
+pub const RCLOCK_BEGIN_MIN: &str = KEY_BEGIN_MIN;
 pub const RCLOCK_END: &str = "estuary.dev/rclock-end";
 pub const RCLOCK_END_MAX: &str = KEY_END_MAX;
 pub const SPLIT_TARGET: &str = "estuary.dev/split-target";
diff --git a/crates/models/src/schemas.rs b/crates/models/src/schemas.rs
index 3e09c32e61e..5c1f4a914f4 100644
--- a/crates/models/src/schemas.rs
+++ b/crates/models/src/schemas.rs
@@ -215,6 +215,8 @@ struct RelaxedSchemaObj {
     _min_length: Option<serde_json::Value>,
     #[serde(rename = "maxLength", default, skip_serializing)]
     _max_length: Option<serde_json::Value>,
+    #[serde(rename = "redact", default, skip_serializing)]
+    _redact: Option<serde_json::Value>,
 
     // Other keywords are passed-through.
     #[serde(flatten)]
@@ -416,6 +418,33 @@ mod test {
         );
     }
 
+    #[test]
+    fn test_relaxation_drops_redact() {
+        let schema = schema!({
+            "type": "object",
+            "properties": {
+                "email": {
+                    "type": "string",
+                    "redact": { "strategy": "sha256" },
+                    "description": "Sensitive key component"
+                }
+            }
+        });
+
+        let relaxed = schema.to_relaxed_schema().unwrap().to_value();
+
+        assert_eq!(
+            relaxed,
+            json!({
+                "properties": {
+                    "email": {
+                        "description": "Sensitive key component"
+                    }
+                }
+            })
+        );
+    }
+
     #[test]
     fn test_relaxation_drops_additional_properties_false() {
         let schema = schema!({
diff --git a/crates/proto-flow/build.rs b/crates/proto-flow/build.rs
index e22c5f8c3b0..added534998 100644
--- a/crates/proto-flow/build.rs
+++ b/crates/proto-flow/build.rs
@@ -40,7 +40,7 @@ fn main() {
     //   to BTreeMap<&str, &RawValue>, and deserialize in reverse.
     // * Fields ending in "_json_vec" are mapped from Vec<byte::Bytes> to Vec<&RawValue>,
     //   and deserialize in reverse as well.
-    // * Our stats documents' bytesTotal and docsTotal fields are typed as u64 to allow for
+    // * Our stats documents' bytesTotal, docsTotal, and bytesBehind fields are typed as u64 to allow for
     //   tallying relatively large values in a single document but we do not want
     //   this value serialized as a string, so we remove the string conversion.
 
@@ -53,7 +53,7 @@ fn main() {
         regex::Regex::new(r#"struct_ser\.serialize_field\((".+"), &(self\..*_json_vec)\.iter\(\).map\(pbjson::private::base64::encode\).collect::<Vec<_>>\(\)\)\?"#)
             .unwrap();
     let ser_int64_re =
-        regex::Regex::new(r#"struct_ser\.serialize_field\("(bytesTotal|docsTotal)", ToString::to_string\(&self\.(bytes_total|docs_total)\).as_str\(\)\)\?;"#)
+        regex::Regex::new(r#"struct_ser\.serialize_field\("(bytesTotal|docsTotal|bytesBehind)", ToString::to_string\(&self\.(bytes_total|docs_total|bytes_behind)\).as_str\(\)\)\?;"#)
             .unwrap();
 
     let de_json_re =
@@ -121,7 +121,7 @@ fn main() {
             buf.replace_range(range, &format!("crate::RawJSONDeserialize"));
         }
 
-        // Handle serializing "bytesTotal"/"docsTotal" as an integer rather than a quoted integer.
+        // Handle serializing stats counters as integers rather than quoted integers.
         while let Some(capture) = ser_int64_re.captures(&buf) {
             let range = capture.get(0).unwrap().range();
             buf.replace_range(
diff --git a/crates/proto-flow/src/ops.serde.rs b/crates/proto-flow/src/ops.serde.rs
index b18f3cffd54..1d9777f6cdc 100644
--- a/crates/proto-flow/src/ops.serde.rs
+++ b/crates/proto-flow/src/ops.serde.rs
@@ -1353,7 +1353,7 @@ impl serde::Serialize for stats::derive::Transform {
         if self.bytes_behind != 0 {
             #[allow(clippy::needless_borrow)]
             #[allow(clippy::needless_borrows_for_generic_args)]
-            struct_ser.serialize_field("bytesBehind", ToString::to_string(&self.bytes_behind).as_str())?;
+            struct_ser.serialize_field("bytesBehind", &self.bytes_behind)?;
         }
         struct_ser.end()
     }
@@ -1739,7 +1739,7 @@ impl serde::Serialize for stats::MaterializeBinding {
         if self.bytes_behind != 0 {
             #[allow(clippy::needless_borrow)]
             #[allow(clippy::needless_borrows_for_generic_args)]
-            struct_ser.serialize_field("bytesBehind", ToString::to_string(&self.bytes_behind).as_str())?;
+            struct_ser.serialize_field("bytesBehind", &self.bytes_behind)?;
         }
         struct_ser.end()
     }
diff --git a/crates/proto-flow/src/runtime.rs b/crates/proto-flow/src/runtime.rs
index b4abfa0eebf..dc2c872073d 100644
--- a/crates/proto-flow/src/runtime.rs
+++ b/crates/proto-flow/src/runtime.rs
@@ -485,22 +485,16 @@ pub struct Joined {
 /// Task which is being processed by the runtime.
 /// Sent from Controller to Shard, and from Shard zero (only) to Leader
 /// after Joined. Other shards do not forward Task.
-#[derive(Clone, PartialEq, ::prost::Message)]
+#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
 pub struct Task {
     /// Task specification (protobuf-encoded bytes).
     #[prost(bytes = "bytes", tag = "1")]
     pub spec: ::prost::bytes::Bytes,
-    /// Collection journal partition to which task states are written.
-    #[prost(string, tag = "2")]
-    pub ops_stats_journal: ::prost::alloc::string::String,
-    /// Collection to which task stats are written.
-    #[prost(message, optional, tag = "3")]
-    pub ops_stats_spec: ::core::option::Option<super::flow::CollectionSpec>,
     /// When true, documents and stats are written to output and not directed to collections.
-    #[prost(bool, tag = "4")]
+    #[prost(bool, tag = "2")]
     pub preview: bool,
     /// Preview / harness control. Zero means unlimited.
-    #[prost(uint32, tag = "5")]
+    #[prost(uint32, tag = "3")]
     pub max_transactions: u32,
 }
 /// Recover is sent by each shard to the leader after Joined, and carries
@@ -574,7 +568,7 @@ pub struct Recover {
 /// zero's RocksDB. Absent fields are inert.
 ///
 /// All fields of a Persist land together in a single WriteBatch.
-/// `nonce` is echoed back by the shard's Persisted response, allowing
+/// `seq_no` is echoed back by the shard's Persisted response, allowing
 /// the leader to match a Persisted response to its originating request.
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct Persist {
@@ -582,7 +576,7 @@ pub struct Persist {
     /// `Persisted` response. The leader chooses any value and the shard
     /// does not interpret it.
     #[prost(uint64, tag = "1")]
-    pub nonce: u64,
+    pub seq_no: u64,
     /// Delete previously-persisted ACK intents. Applies ahead of `ack_intents`.
     /// Effect: DeleteRange("AI:")
     #[prost(bool, tag = "2")]
@@ -599,55 +593,64 @@ pub struct Persist {
     /// Effect: Put under "committed-close-clock".
     #[prost(fixed64, tag = "4")]
     pub committed_close_clock: u64,
+    /// Delete all previously-persisted committed Frontier entries.
+    /// Applies ahead of `committed_frontier`.
+    /// Effect: DeleteRange("FC:")
+    #[prost(bool, tag = "5")]
+    pub delete_committed_frontier: bool,
     /// Committed Frontier entries.
     /// Effect: Put under "FC:..." keys.
-    #[prost(message, optional, tag = "5")]
+    #[prost(message, optional, tag = "6")]
     pub committed_frontier: ::core::option::Option<super::shuffle::Frontier>,
     /// Connector state patches. State Update Wire Format.
     /// Effect: Merge each patch under "connector-state".
-    #[prost(bytes = "bytes", tag = "6")]
+    #[prost(bytes = "bytes", tag = "7")]
     pub connector_patches_json: ::prost::bytes::Bytes,
     /// Clock at which the hinted transaction closed.
     /// Effect: Put under "hinted-close-clock".
-    #[prost(fixed64, tag = "7")]
+    #[prost(fixed64, tag = "8")]
     pub hinted_close_clock: u64,
     /// Delete a previously-persisted hinted frontier. Applies ahead of `hinted_frontier`.
     /// Effect: DeleteRange("FH:")
-    #[prost(bool, tag = "8")]
+    #[prost(bool, tag = "9")]
     pub delete_hinted_frontier: bool,
     /// Hinted Frontier entries.
     /// Effect: Put under "FH:" keys.
-    #[prost(message, optional, tag = "9")]
+    #[prost(message, optional, tag = "10")]
     pub hinted_frontier: ::core::option::Option<super::shuffle::Frontier>,
     /// Last-applied task specification (protobuf-encoded bytes), or empty.
     /// Effect: Put under "last-applied" key.
-    #[prost(bytes = "bytes", tag = "10")]
+    #[prost(bytes = "bytes", tag = "11")]
     pub last_applied: ::prost::bytes::Bytes,
-    /// Legacy checkpoint, required for rollback to legacy runtime.
+    /// Delete a previously-persisted legacy checkpoint.
+    /// Effect: Delete the "checkpoint" key.
+    #[prost(bool, tag = "12")]
+    pub delete_legacy_checkpoint: bool,
+    /// Legacy checkpoint, required for rollback to the V1 runtime.
     /// Effect: Put under "checkpoint" key.
-    #[prost(message, optional, tag = "11")]
+    #[prost(message, optional, tag = "13")]
     pub legacy_checkpoint: ::core::option::Option<::proto_gazette::consumer::Checkpoint>,
     /// Per-binding max-key updates, reduced to per-binding maximum across shards.
     /// Key: binding index; Value: packed composite key tuple.
     /// Effect: Put value under "MK-v2:{state_key}" (state_key resolved by the encoder).
-    #[prost(btree_map = "uint32, bytes", tag = "12")]
+    #[prost(btree_map = "uint32, bytes", tag = "14")]
     pub max_keys: ::prost::alloc::collections::BTreeMap<u32, ::prost::bytes::Bytes>,
     /// Delete previously-persisted trigger parameters. Applies ahead of `trigger_params_json`.
     /// Effect: Delete the "trigger-params" key.
-    #[prost(bool, tag = "13")]
+    #[prost(bool, tag = "15")]
     pub delete_trigger_params: bool,
     /// Materialization trigger parameters.
     /// Effect: Put under "trigger-params" key.
-    #[prost(bytes = "bytes", tag = "14")]
+    #[prost(bytes = "bytes", tag = "16")]
     pub trigger_params_json: ::prost::bytes::Bytes,
 }
 /// Persisted is sent by shard zero to the leader after the state is durable
 /// in the recovery log.
 #[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
 pub struct Persisted {
-    /// Echoed back from the originating `Persist.nonce` request.
+    /// Echoed back from the originating `Persist.seq_no` request.
     #[prost(uint64, tag = "1")]
-    pub nonce: u64,
+    pub seq_no: u64,
 }
 /// Apply asks shard zero to invoke its connector's Apply action, both for
 /// the initial application of a new spec and for re-application after a
@@ -744,6 +747,12 @@ pub struct Materialize {
     /// Shard → Controller. Connector's reply to `validate`.
     #[prost(message, optional, tag = "4")]
     pub validated: ::core::option::Option<super::materialize::response::Validated>,
+    /// Controller → Shard. Effective only on unary `spec` / `validate`
+    /// messages, which never see the Join-time labeling that supplies the
+    /// log level for session-bound work. Ignored on all other variants
+    /// (the leader → shard messages MUST NOT set this).
+    #[prost(enumeration = "super::ops::log::Level", tag = "5")]
+    pub log_level: i32,
     /// Controller → Shard. First message of a session-loop stream;
     /// never sent to the Leader.
     #[prost(message, optional, tag = "20")]
diff --git a/crates/proto-flow/src/runtime.serde.rs b/crates/proto-flow/src/runtime.serde.rs
index 89c06951649..664eeb3af60 100644
--- a/crates/proto-flow/src/runtime.serde.rs
+++ b/crates/proto-flow/src/runtime.serde.rs
@@ -3330,6 +3330,9 @@ impl serde::Serialize for Materialize {
         if self.validated.is_some() {
             len += 1;
         }
+        if self.log_level != 0 {
+            len += 1;
+        }
         if self.session_loop.is_some() {
             len += 1;
         }
@@ -3415,6 +3418,11 @@ impl serde::Serialize for Materialize {
         if let Some(v) = self.validated.as_ref() {
             struct_ser.serialize_field("validated", v)?;
         }
+        if self.log_level != 0 {
+            let v = super::ops::log::Level::try_from(self.log_level)
+                .map_err(|_| serde::ser::Error::custom(format!("Invalid variant {}", self.log_level)))?;
+            struct_ser.serialize_field("logLevel", &v)?;
+        }
         if let Some(v) = self.session_loop.as_ref() {
             struct_ser.serialize_field("sessionLoop", v)?;
         }
@@ -3502,6 +3510,8 @@ impl<'de> serde::Deserialize<'de> for Materialize {
             "specResponse",
             "validate",
             "validated",
+            "log_level",
+            "logLevel",
             "session_loop",
             "sessionLoop",
             "join",
@@ -3538,6 +3548,7 @@ impl<'de> serde::Deserialize<'de> for Materialize {
             SpecResponse,
             Validate,
             Validated,
+            LogLevel,
             SessionLoop,
             Join,
             Joined,
@@ -3587,6 +3598,7 @@ impl<'de> serde::Deserialize<'de> for Materialize {
                             "specResponse" | "spec_response" => Ok(GeneratedField::SpecResponse),
                             "validate" => Ok(GeneratedField::Validate),
                             "validated" => Ok(GeneratedField::Validated),
+                            "logLevel" | "log_level" => Ok(GeneratedField::LogLevel),
                             "sessionLoop" | "session_loop" => Ok(GeneratedField::SessionLoop),
                             "join" => Ok(GeneratedField::Join),
                             "joined" => Ok(GeneratedField::Joined),
@@ -3634,6 +3646,7 @@ impl<'de> serde::Deserialize<'de> for Materialize {
                 let mut spec_response__ = None;
                 let mut validate__ = None;
                 let mut validated__ = None;
+                let mut log_level__ = None;
                 let mut session_loop__ = None;
                 let mut join__ = None;
                 let mut joined__ = None;
@@ -3684,6 +3697,12 @@ impl<'de> serde::Deserialize<'de> for Materialize {
                             }
                             validated__ = map_.next_value()?;
                         }
+                        GeneratedField::LogLevel => {
+                            if log_level__.is_some() {
+                                return Err(serde::de::Error::duplicate_field("logLevel"));
+                            }
+                            log_level__ = Some(map_.next_value::<super::ops::log::Level>()? as i32);
+                        }
                         GeneratedField::SessionLoop => {
                             if session_loop__.is_some() {
                                 return Err(serde::de::Error::duplicate_field("sessionLoop"));
@@ -3835,6 +3854,7 @@ impl<'de> serde::Deserialize<'de> for Materialize {
                     spec_response: spec_response__,
                     validate: validate__,
                     validated: validated__,
+                    log_level: log_level__.unwrap_or_default(),
                     session_loop: session_loop__,
                     join: join__,
                     joined: joined__,
@@ -5921,7 +5941,7 @@ impl serde::Serialize for Persist {
     {
         use serde::ser::SerializeStruct;
         let mut len = 0;
-        if self.nonce != 0 {
+        if self.seq_no != 0 {
             len += 1;
         }
         if self.delete_ack_intents {
@@ -5933,6 +5953,9 @@ impl serde::Serialize for Persist {
         if self.committed_close_clock != 0 {
             len += 1;
         }
+        if self.delete_committed_frontier {
+            len += 1;
+        }
         if self.committed_frontier.is_some() {
             len += 1;
         }
@@ -5951,6 +5974,9 @@ impl serde::Serialize for Persist {
         if !self.last_applied.is_empty() {
             len += 1;
         }
+        if self.delete_legacy_checkpoint {
+            len += 1;
+        }
         if self.legacy_checkpoint.is_some() {
             len += 1;
         }
@@ -5964,10 +5990,10 @@ impl serde::Serialize for Persist {
             len += 1;
         }
         let mut struct_ser = serializer.serialize_struct("runtime.Persist", len)?;
-        if self.nonce != 0 {
+        if self.seq_no != 0 {
             #[allow(clippy::needless_borrow)]
             #[allow(clippy::needless_borrows_for_generic_args)]
-            struct_ser.serialize_field("nonce", ToString::to_string(&self.nonce).as_str())?;
+            struct_ser.serialize_field("seqNo", ToString::to_string(&self.seq_no).as_str())?;
         }
         if self.delete_ack_intents {
             struct_ser.serialize_field("deleteAckIntents", &self.delete_ack_intents)?;
@@ -5982,6 +6008,9 @@ impl serde::Serialize for Persist {
             #[allow(clippy::needless_borrows_for_generic_args)]
             struct_ser.serialize_field("committedCloseClock", ToString::to_string(&self.committed_close_clock).as_str())?;
         }
+        if self.delete_committed_frontier {
+            struct_ser.serialize_field("deleteCommittedFrontier", &self.delete_committed_frontier)?;
+        }
         if let Some(v) = self.committed_frontier.as_ref() {
             struct_ser.serialize_field("committedFrontier", v)?;
         }
@@ -6006,6 +6035,9 @@ impl serde::Serialize for Persist {
             #[allow(clippy::needless_borrows_for_generic_args)]
             struct_ser.serialize_field("lastApplied", pbjson::private::base64::encode(&self.last_applied).as_str())?;
         }
+        if self.delete_legacy_checkpoint {
+            struct_ser.serialize_field("deleteLegacyCheckpoint", &self.delete_legacy_checkpoint)?;
+        }
         if let Some(v) = self.legacy_checkpoint.as_ref() {
             struct_ser.serialize_field("legacyCheckpoint", v)?;
         }
@@ -6032,13 +6064,16 @@ impl<'de> serde::Deserialize<'de> for Persist {
         D: serde::Deserializer<'de>,
     {
         const FIELDS: &[&str] = &[
-            "nonce",
+            "seq_no",
+            "seqNo",
             "delete_ack_intents",
             "deleteAckIntents",
             "ack_intents",
             "ackIntents",
             "committed_close_clock",
             "committedCloseClock",
+            "delete_committed_frontier",
+            "deleteCommittedFrontier",
             "committed_frontier",
             "committedFrontier",
             "connector_patches_json",
@@ -6051,6 +6086,8 @@ impl<'de> serde::Deserialize<'de> for Persist {
             "hintedFrontier",
             "last_applied",
             "lastApplied",
+            "delete_legacy_checkpoint",
+            "deleteLegacyCheckpoint",
             "legacy_checkpoint",
             "legacyCheckpoint",
             "max_keys",
@@ -6063,16 +6100,18 @@ impl<'de> serde::Deserialize<'de> for Persist {
 
         #[allow(clippy::enum_variant_names)]
         enum GeneratedField {
-            Nonce,
+            SeqNo,
             DeleteAckIntents,
             AckIntents,
             CommittedCloseClock,
+            DeleteCommittedFrontier,
             CommittedFrontier,
             ConnectorPatchesJson,
             HintedCloseClock,
             DeleteHintedFrontier,
             HintedFrontier,
             LastApplied,
+            DeleteLegacyCheckpoint,
             LegacyCheckpoint,
             MaxKeys,
             DeleteTriggerParams,
@@ -6098,16 +6137,18 @@ impl<'de> serde::Deserialize<'de> for Persist {
                         E: serde::de::Error,
                     {
                         match value {
-                            "nonce" => Ok(GeneratedField::Nonce),
+                            "seqNo" | "seq_no" => Ok(GeneratedField::SeqNo),
                             "deleteAckIntents" | "delete_ack_intents" => Ok(GeneratedField::DeleteAckIntents),
                             "ackIntents" | "ack_intents" => Ok(GeneratedField::AckIntents),
                             "committedCloseClock" | "committed_close_clock" => Ok(GeneratedField::CommittedCloseClock),
+                            "deleteCommittedFrontier" | "delete_committed_frontier" => Ok(GeneratedField::DeleteCommittedFrontier),
                             "committedFrontier" | "committed_frontier" => Ok(GeneratedField::CommittedFrontier),
                             "connectorPatches" | "connector_patches_json" => Ok(GeneratedField::ConnectorPatchesJson),
                             "hintedCloseClock" | "hinted_close_clock" => Ok(GeneratedField::HintedCloseClock),
                             "deleteHintedFrontier" | "delete_hinted_frontier" => Ok(GeneratedField::DeleteHintedFrontier),
                             "hintedFrontier" | "hinted_frontier" => Ok(GeneratedField::HintedFrontier),
                             "lastApplied" | "last_applied" => Ok(GeneratedField::LastApplied),
+                            "deleteLegacyCheckpoint" | "delete_legacy_checkpoint" => Ok(GeneratedField::DeleteLegacyCheckpoint),
                             "legacyCheckpoint" | "legacy_checkpoint" => Ok(GeneratedField::LegacyCheckpoint),
                             "maxKeys" | "max_keys" => Ok(GeneratedField::MaxKeys),
                             "deleteTriggerParams" | "delete_trigger_params" => Ok(GeneratedField::DeleteTriggerParams),
@@ -6131,27 +6172,29 @@ impl<'de> serde::Deserialize<'de> for Persist {
                 where
                     V: serde::de::MapAccess<'de>,
             {
-                let mut nonce__ = None;
+                let mut seq_no__ = None;
                 let mut delete_ack_intents__ = None;
                 let mut ack_intents__ = None;
                 let mut committed_close_clock__ = None;
+                let mut delete_committed_frontier__ = None;
                 let mut committed_frontier__ = None;
                 let mut connector_patches_json__ = None;
                 let mut hinted_close_clock__ = None;
                 let mut delete_hinted_frontier__ = None;
                 let mut hinted_frontier__ = None;
                 let mut last_applied__ = None;
+                let mut delete_legacy_checkpoint__ = None;
                 let mut legacy_checkpoint__ = None;
                 let mut max_keys__ = None;
                 let mut delete_trigger_params__ = None;
                 let mut trigger_params_json__ = None;
                 while let Some(k) = map_.next_key()? {
                     match k {
-                        GeneratedField::Nonce => {
-                            if nonce__.is_some() {
-                                return Err(serde::de::Error::duplicate_field("nonce"));
+                        GeneratedField::SeqNo => {
+                            if seq_no__.is_some() {
+                                return Err(serde::de::Error::duplicate_field("seqNo"));
                             }
-                            nonce__ = 
+                            seq_no__ = 
                                 Some(map_.next_value::<::pbjson::private::NumberDeserialize<_>>()?.0)
                             ;
                         }
@@ -6178,6 +6221,12 @@ impl<'de> serde::Deserialize<'de> for Persist {
                                 Some(map_.next_value::<::pbjson::private::NumberDeserialize<_>>()?.0)
                             ;
                         }
+                        GeneratedField::DeleteCommittedFrontier => {
+                            if delete_committed_frontier__.is_some() {
+                                return Err(serde::de::Error::duplicate_field("deleteCommittedFrontier"));
+                            }
+                            delete_committed_frontier__ = Some(map_.next_value()?);
+                        }
                         GeneratedField::CommittedFrontier => {
                             if committed_frontier__.is_some() {
                                 return Err(serde::de::Error::duplicate_field("committedFrontier"));
@@ -6220,6 +6269,12 @@ impl<'de> serde::Deserialize<'de> for Persist {
                                 Some(map_.next_value::<::pbjson::private::BytesDeserialize<_>>()?.0)
                             ;
                         }
+                        GeneratedField::DeleteLegacyCheckpoint => {
+                            if delete_legacy_checkpoint__.is_some() {
+                                return Err(serde::de::Error::duplicate_field("deleteLegacyCheckpoint"));
+                            }
+                            delete_legacy_checkpoint__ = Some(map_.next_value()?);
+                        }
                         GeneratedField::LegacyCheckpoint => {
                             if legacy_checkpoint__.is_some() {
                                 return Err(serde::de::Error::duplicate_field("legacyCheckpoint"));
@@ -6252,16 +6307,18 @@ impl<'de> serde::Deserialize<'de> for Persist {
                     }
                 }
                 Ok(Persist {
-                    nonce: nonce__.unwrap_or_default(),
+                    seq_no: seq_no__.unwrap_or_default(),
                     delete_ack_intents: delete_ack_intents__.unwrap_or_default(),
                     ack_intents: ack_intents__.unwrap_or_default(),
                     committed_close_clock: committed_close_clock__.unwrap_or_default(),
+                    delete_committed_frontier: delete_committed_frontier__.unwrap_or_default(),
                     committed_frontier: committed_frontier__,
                     connector_patches_json: connector_patches_json__.unwrap_or_default(),
                     hinted_close_clock: hinted_close_clock__.unwrap_or_default(),
                     delete_hinted_frontier: delete_hinted_frontier__.unwrap_or_default(),
                     hinted_frontier: hinted_frontier__,
                     last_applied: last_applied__.unwrap_or_default(),
+                    delete_legacy_checkpoint: delete_legacy_checkpoint__.unwrap_or_default(),
                     legacy_checkpoint: legacy_checkpoint__,
                     max_keys: max_keys__.unwrap_or_default(),
                     delete_trigger_params: delete_trigger_params__.unwrap_or_default(),
@@ -6280,14 +6337,14 @@ impl serde::Serialize for Persisted {
     {
         use serde::ser::SerializeStruct;
         let mut len = 0;
-        if self.nonce != 0 {
+        if self.seq_no != 0 {
             len += 1;
         }
         let mut struct_ser = serializer.serialize_struct("runtime.Persisted", len)?;
-        if self.nonce != 0 {
+        if self.seq_no != 0 {
             #[allow(clippy::needless_borrow)]
             #[allow(clippy::needless_borrows_for_generic_args)]
-            struct_ser.serialize_field("nonce", ToString::to_string(&self.nonce).as_str())?;
+            struct_ser.serialize_field("seqNo", ToString::to_string(&self.seq_no).as_str())?;
         }
         struct_ser.end()
     }
@@ -6299,12 +6356,13 @@ impl<'de> serde::Deserialize<'de> for Persisted {
         D: serde::Deserializer<'de>,
     {
         const FIELDS: &[&str] = &[
-            "nonce",
+            "seq_no",
+            "seqNo",
         ];
 
         #[allow(clippy::enum_variant_names)]
         enum GeneratedField {
-            Nonce,
+            SeqNo,
         }
         impl<'de> serde::Deserialize<'de> for GeneratedField {
             fn deserialize<D>(deserializer: D) -> std::result::Result<GeneratedField, D::Error>
@@ -6326,7 +6384,7 @@ impl<'de> serde::Deserialize<'de> for Persisted {
                         E: serde::de::Error,
                     {
                         match value {
-                            "nonce" => Ok(GeneratedField::Nonce),
+                            "seqNo" | "seq_no" => Ok(GeneratedField::SeqNo),
                             _ => Err(serde::de::Error::unknown_field(value, FIELDS)),
                         }
                     }
@@ -6346,21 +6404,21 @@ impl<'de> serde::Deserialize<'de> for Persisted {
                 where
                     V: serde::de::MapAccess<'de>,
             {
-                let mut nonce__ = None;
+                let mut seq_no__ = None;
                 while let Some(k) = map_.next_key()? {
                     match k {
-                        GeneratedField::Nonce => {
-                            if nonce__.is_some() {
-                                return Err(serde::de::Error::duplicate_field("nonce"));
+                        GeneratedField::SeqNo => {
+                            if seq_no__.is_some() {
+                                return Err(serde::de::Error::duplicate_field("seqNo"));
                             }
-                            nonce__ = 
+                            seq_no__ = 
                                 Some(map_.next_value::<::pbjson::private::NumberDeserialize<_>>()?.0)
                             ;
                         }
                     }
                 }
                 Ok(Persisted {
-                    nonce: nonce__.unwrap_or_default(),
+                    seq_no: seq_no__.unwrap_or_default(),
                 })
             }
         }
@@ -7624,12 +7682,6 @@ impl serde::Serialize for Task {
         if !self.spec.is_empty() {
             len += 1;
         }
-        if !self.ops_stats_journal.is_empty() {
-            len += 1;
-        }
-        if self.ops_stats_spec.is_some() {
-            len += 1;
-        }
         if self.preview {
             len += 1;
         }
@@ -7642,12 +7694,6 @@ impl serde::Serialize for Task {
             #[allow(clippy::needless_borrows_for_generic_args)]
             struct_ser.serialize_field("spec", pbjson::private::base64::encode(&self.spec).as_str())?;
         }
-        if !self.ops_stats_journal.is_empty() {
-            struct_ser.serialize_field("opsStatsJournal", &self.ops_stats_journal)?;
-        }
-        if let Some(v) = self.ops_stats_spec.as_ref() {
-            struct_ser.serialize_field("opsStatsSpec", v)?;
-        }
         if self.preview {
             struct_ser.serialize_field("preview", &self.preview)?;
         }
@@ -7665,10 +7711,6 @@ impl<'de> serde::Deserialize<'de> for Task {
     {
         const FIELDS: &[&str] = &[
             "spec",
-            "ops_stats_journal",
-            "opsStatsJournal",
-            "ops_stats_spec",
-            "opsStatsSpec",
             "preview",
             "max_transactions",
             "maxTransactions",
@@ -7677,8 +7719,6 @@ impl<'de> serde::Deserialize<'de> for Task {
         #[allow(clippy::enum_variant_names)]
         enum GeneratedField {
             Spec,
-            OpsStatsJournal,
-            OpsStatsSpec,
             Preview,
             MaxTransactions,
         }
@@ -7703,8 +7743,6 @@ impl<'de> serde::Deserialize<'de> for Task {
                     {
                         match value {
                             "spec" => Ok(GeneratedField::Spec),
-                            "opsStatsJournal" | "ops_stats_journal" => Ok(GeneratedField::OpsStatsJournal),
-                            "opsStatsSpec" | "ops_stats_spec" => Ok(GeneratedField::OpsStatsSpec),
                             "preview" => Ok(GeneratedField::Preview),
                             "maxTransactions" | "max_transactions" => Ok(GeneratedField::MaxTransactions),
                             _ => Err(serde::de::Error::unknown_field(value, FIELDS)),
@@ -7727,8 +7765,6 @@ impl<'de> serde::Deserialize<'de> for Task {
                     V: serde::de::MapAccess<'de>,
             {
                 let mut spec__ = None;
-                let mut ops_stats_journal__ = None;
-                let mut ops_stats_spec__ = None;
                 let mut preview__ = None;
                 let mut max_transactions__ = None;
                 while let Some(k) = map_.next_key()? {
@@ -7741,18 +7777,6 @@ impl<'de> serde::Deserialize<'de> for Task {
                                 Some(map_.next_value::<::pbjson::private::BytesDeserialize<_>>()?.0)
                             ;
                         }
-                        GeneratedField::OpsStatsJournal => {
-                            if ops_stats_journal__.is_some() {
-                                return Err(serde::de::Error::duplicate_field("opsStatsJournal"));
-                            }
-                            ops_stats_journal__ = Some(map_.next_value()?);
-                        }
-                        GeneratedField::OpsStatsSpec => {
-                            if ops_stats_spec__.is_some() {
-                                return Err(serde::de::Error::duplicate_field("opsStatsSpec"));
-                            }
-                            ops_stats_spec__ = map_.next_value()?;
-                        }
                         GeneratedField::Preview => {
                             if preview__.is_some() {
                                 return Err(serde::de::Error::duplicate_field("preview"));
@@ -7771,8 +7795,6 @@ impl<'de> serde::Deserialize<'de> for Task {
                 }
                 Ok(Task {
                     spec: spec__.unwrap_or_default(),
-                    ops_stats_journal: ops_stats_journal__.unwrap_or_default(),
-                    ops_stats_spec: ops_stats_spec__,
                     preview: preview__.unwrap_or_default(),
                     max_transactions: max_transactions__.unwrap_or_default(),
                 })
diff --git a/crates/proto-flow/src/shuffle.rs b/crates/proto-flow/src/shuffle.rs
index 8ff3b4c7574..227f6da83d1 100644
--- a/crates/proto-flow/src/shuffle.rs
+++ b/crates/proto-flow/src/shuffle.rs
@@ -2,16 +2,22 @@
 /// Shard represents a participant in the shuffle topology (e.x. a task shard).
 #[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
 pub struct Shard {
+    /// Fully-qualified identifier of this shard, e.g.
+    /// `<task-type>/<task-name>/<key-range>_<rclock-range>`.
+    /// Used to label metrics and diagnostics, and as an authorization subject
+    /// for the shard's RPCs.
+    #[prost(string, tag = "1")]
+    pub id: ::prost::alloc::string::String,
     /// Key and r-clock document range owned by this shard.
-    #[prost(message, optional, tag = "1")]
+    #[prost(message, optional, tag = "2")]
     pub range: ::core::option::Option<super::flow::RangeSpec>,
     /// gRPC endpoint of this shard's shuffle service.
-    #[prost(string, tag = "2")]
+    #[prost(string, tag = "3")]
     pub endpoint: ::prost::alloc::string::String,
     /// Filesystem path where the Log actor writes segment files for this shard.
     /// The consumer joins over shuffle-produced log segments via this directory.
     /// Multiple shard indices may share a single directory.
-    #[prost(string, tag = "3")]
+    #[prost(string, tag = "4")]
     pub directory: ::prost::alloc::string::String,
 }
 #[derive(Clone, PartialEq, ::prost::Message)]
diff --git a/crates/proto-flow/src/shuffle.serde.rs b/crates/proto-flow/src/shuffle.serde.rs
index 900287889be..b102ea59a44 100644
--- a/crates/proto-flow/src/shuffle.serde.rs
+++ b/crates/proto-flow/src/shuffle.serde.rs
@@ -2029,6 +2029,9 @@ impl serde::Serialize for Shard {
     {
         use serde::ser::SerializeStruct;
         let mut len = 0;
+        if !self.id.is_empty() {
+            len += 1;
+        }
         if self.range.is_some() {
             len += 1;
         }
@@ -2039,6 +2042,9 @@ impl serde::Serialize for Shard {
             len += 1;
         }
         let mut struct_ser = serializer.serialize_struct("shuffle.Shard", len)?;
+        if !self.id.is_empty() {
+            struct_ser.serialize_field("id", &self.id)?;
+        }
         if let Some(v) = self.range.as_ref() {
             struct_ser.serialize_field("range", v)?;
         }
@@ -2058,6 +2064,7 @@ impl<'de> serde::Deserialize<'de> for Shard {
         D: serde::Deserializer<'de>,
     {
         const FIELDS: &[&str] = &[
+            "id",
             "range",
             "endpoint",
             "directory",
@@ -2065,6 +2072,7 @@ impl<'de> serde::Deserialize<'de> for Shard {
 
         #[allow(clippy::enum_variant_names)]
         enum GeneratedField {
+            Id,
             Range,
             Endpoint,
             Directory,
@@ -2089,6 +2097,7 @@ impl<'de> serde::Deserialize<'de> for Shard {
                         E: serde::de::Error,
                     {
                         match value {
+                            "id" => Ok(GeneratedField::Id),
                             "range" => Ok(GeneratedField::Range),
                             "endpoint" => Ok(GeneratedField::Endpoint),
                             "directory" => Ok(GeneratedField::Directory),
@@ -2111,11 +2120,18 @@ impl<'de> serde::Deserialize<'de> for Shard {
                 where
                     V: serde::de::MapAccess<'de>,
             {
+                let mut id__ = None;
                 let mut range__ = None;
                 let mut endpoint__ = None;
                 let mut directory__ = None;
                 while let Some(k) = map_.next_key()? {
                     match k {
+                        GeneratedField::Id => {
+                            if id__.is_some() {
+                                return Err(serde::de::Error::duplicate_field("id"));
+                            }
+                            id__ = Some(map_.next_value()?);
+                        }
                         GeneratedField::Range => {
                             if range__.is_some() {
                                 return Err(serde::de::Error::duplicate_field("range"));
@@ -2137,6 +2153,7 @@ impl<'de> serde::Deserialize<'de> for Shard {
                     }
                 }
                 Ok(Shard {
+                    id: id__.unwrap_or_default(),
                     range: range__,
                     endpoint: endpoint__.unwrap_or_default(),
                     directory: directory__.unwrap_or_default(),
diff --git a/crates/proto-flow/tests/snapshots/regression__stats_json.snap b/crates/proto-flow/tests/snapshots/regression__stats_json.snap
index e2de5a6c91d..dce700cb0f7 100644
--- a/crates/proto-flow/tests/snapshots/regression__stats_json.snap
+++ b/crates/proto-flow/tests/snapshots/regression__stats_json.snap
@@ -39,7 +39,7 @@ expression: json_test(msg)
           "bytesTotal": 369
         },
         "lastSourcePublishedAt": "1970-01-01T00:00:06.000000007+00:00",
-        "bytesBehind": "1000"
+        "bytesBehind": 1000
       },
       "otherTransform": {
         "source": "other/collection",
@@ -48,7 +48,7 @@ expression: json_test(msg)
           "bytesTotal": 2389
         },
         "lastSourcePublishedAt": "1970-01-01T00:00:06.000000007+00:00",
-        "bytesBehind": "2000"
+        "bytesBehind": 2000
       }
     },
     "published": {
@@ -76,7 +76,7 @@ expression: json_test(msg)
         "bytesTotal": 300
       },
       "lastSourcePublishedAt": "1970-01-01T00:00:06.000000007+00:00",
-      "bytesBehind": "5000"
+      "bytesBehind": 5000
     }
   },
   "interval": {
diff --git a/crates/publisher/src/binding.rs b/crates/publisher/src/binding.rs
index d82f4f2f0be..07261392ec2 100644
--- a/crates/publisher/src/binding.rs
+++ b/crates/publisher/src/binding.rs
@@ -2,8 +2,18 @@ use anyhow::Context;
 use proto_flow::flow;
 use proto_gazette::broker;
 
-/// Metadata for mapping documents to collection partitions.
-pub struct Binding {
+/// Metadata for routing publications to a specific journal.
+pub enum Binding {
+    /// `Mapped` bindings dynamically resolve documents to one of a collection's
+    /// physical partitions, creating partitions on-demand.
+    Mapped(MappedBinding),
+    /// `Fixed` bindings target a single, pre-existing journal by name.
+    Fixed(FixedBinding),
+}
+
+/// Routes documents to a collection's physical partitions via key hashing
+/// and partition-field extraction.
+pub struct MappedBinding {
     /// Target collection name (for logging/debugging).
     pub collection: models::Collection,
     /// Pre-built key extractors for the collection key pointers.
@@ -16,9 +26,14 @@ pub struct Binding {
     pub partitions_template: broker::JournalSpec,
     /// Maximum number of allowed partitions for this binding.
     pub partitions_limit: usize,
-    /// Collection partitions prefix ("{partitions_template.name}/"), or a
-    /// more-specific prefix or journal name to which this binding is scoped.
-    pub partitions_prefix_or_name: String,
+    /// Collection partitions prefix ("{partitions_template.name}/").
+    pub partitions_prefix: String,
+}
+
+/// Routes documents to a single named journal that already exists.
+pub struct FixedBinding {
+    /// Journal to which the binding publishes.
+    pub journal: String,
 }
 
 impl Binding {
@@ -33,25 +48,17 @@ impl Binding {
                     .as_ref()
                     .with_context(|| format!("capture binding {index} missing collection"))?;
 
-                Self::from_collection_spec(collection_spec, None).with_context(|| {
+                Self::from_collection_spec(collection_spec).with_context(|| {
                     format!("building binding for collection {}", collection_spec.name)
                 })
             })
             .collect()
     }
 
-    /// Build a Binding from a built CollectionSpec.
-    ///
-    /// If `partitions_prefix_or_name` is Some, the Binding will authorize-to and
-    /// watch only that sub-prefix or specific journal. When None, the Binding
-    /// authorizes to all partitions of the collection.
+    /// Build a Mapped Binding from a built CollectionSpec.
     ///
-    /// `partitions_prefix_or_name` must be prefixed by the CollectionSpec's
-    /// actual partition template prefix, or this routine errors.
-    pub fn from_collection_spec(
-        spec: &flow::CollectionSpec,
-        partitions_prefix_or_name: Option<&str>,
-    ) -> anyhow::Result<Self> {
+    /// The Binding authorizes to and watches all partitions of the collection.
+    pub fn from_collection_spec(spec: &flow::CollectionSpec) -> anyhow::Result<Self> {
         let flow::CollectionSpec {
             name,
             key,
@@ -67,17 +74,6 @@ impl Binding {
             .clone();
         let partitions_prefix = format!("{}/", &partitions_template.name);
 
-        let partitions_prefix_or_name = if let Some(fixed) = partitions_prefix_or_name {
-            if !fixed.starts_with(&partitions_prefix) {
-                anyhow::bail!(
-                    "prefix or name {fixed} must begin with collection prefix {partitions_prefix}"
-                );
-            }
-            fixed.to_string()
-        } else {
-            partitions_prefix
-        };
-
         let policy = doc::SerPolicy::noop();
         let key_extractors =
             extractors::for_key(key, projections, &policy).context("building key extractors")?;
@@ -94,14 +90,31 @@ impl Binding {
             100
         };
 
-        Ok(Self {
+        Ok(Self::Mapped(MappedBinding {
             collection: models::Collection::new(name),
             key_extractors,
             partition_fields: partition_fields.clone(),
             partition_extractors,
             partitions_template,
             partitions_limit,
-            partitions_prefix_or_name,
+            partitions_prefix,
+        }))
+    }
+
+    /// Build a Fixed Binding that publishes to a single named journal.
+    /// The binding skips the partitions watch and partition-mapping machinery.
+    pub fn for_fixed_journal(journal: impl Into<String>) -> Self {
+        Self::Fixed(FixedBinding {
+            journal: journal.into(),
         })
     }
+
+    /// AuthZ object string for this binding's lazy journal Client. For Mapped
+    /// bindings this is the partitions prefix; for Fixed it's the journal name.
+    pub(crate) fn authz_object(&self) -> &str {
+        match self {
+            Self::Mapped(b) => &b.partitions_prefix,
+            Self::Fixed(b) => &b.journal,
+        }
+    }
 }
diff --git a/crates/publisher/src/lib.rs b/crates/publisher/src/lib.rs
index 8ab94e9d5c1..17ddb09997b 100644
--- a/crates/publisher/src/lib.rs
+++ b/crates/publisher/src/lib.rs
@@ -6,34 +6,55 @@ pub mod publisher;
 pub mod watch;
 
 pub use appender::{Appender, AppenderGroup};
-pub use binding::Binding;
+pub use binding::{Binding, FixedBinding, MappedBinding};
 pub use publisher::Publisher;
 
-/// Boxed closure for lazy initialization of a partitions watch and journal Client.
-/// Callers of `Binding::from_collection_spec` provide this to control how the
-/// journal Client and partitions watch are created.
-type PartitionsClientInit = Box<
+/// Boxed closure for lazy initialization of a Mapped binding's partitions
+/// watch and journal Client.
+type MappedClientInit = Box<
     dyn FnOnce() -> (
             gazette::journal::Client,
             tokens::PendingWatch<Vec<watch::PartitionSplit>>,
         ) + Send,
 >;
 
-/// LazyPartitionsClient uses a LazyCell to defer initialization of a partitions
-/// watch and a paired journal Client for List, Apply, and Append RPCs.
+/// Boxed closure for lazy initialization of a Fixed binding's journal Client.
+type FixedClientInit = Box<dyn FnOnce() -> gazette::journal::Client + Send>;
+
+/// LazyBindingClient defers initialization of per-binding journal resources
+/// until first use.
+///
+/// Mapped bindings need both a journal Client and a long-lived list-watch
+/// stream of partitions. Fixed bindings only need a Client (the journal is
+/// known by name; no listing is required).
 ///
 /// An instantiated client and watch each consume background resources:
-/// periodic token refreshes for the client, and a long-lived list RPC for the watch.
-/// However, many (most?) bindings and collections are infrequently written and
-/// a Publisher instance may never interact with the binding during its lifetime,
-/// so avoid paying this cost until we know it's needed.
-type LazyPartitionsClient = std::sync::LazyLock<
-    (
-        gazette::journal::Client,
-        tokens::PendingWatch<Vec<watch::PartitionSplit>>,
+/// periodic token refreshes for the client, and a long-lived list RPC for the
+/// watch. However, many (most?) bindings and collections are infrequently
+/// written and a Publisher instance may never interact with the binding during
+/// its lifetime, so avoid paying this cost until we know it's needed.
+pub(crate) enum LazyBindingClient {
+    Mapped(
+        std::sync::LazyLock<
+            (
+                gazette::journal::Client,
+                tokens::PendingWatch<Vec<watch::PartitionSplit>>,
+            ),
+            MappedClientInit,
+        >,
     ),
-    PartitionsClientInit,
->;
+    Fixed(std::sync::LazyLock<gazette::journal::Client, FixedClientInit>),
+}
+
+impl LazyBindingClient {
+    /// Force initialization and return the underlying journal Client.
+    pub(crate) fn client(&self) -> &gazette::journal::Client {
+        match self {
+            Self::Mapped(lazy) => &lazy.0,
+            Self::Fixed(lazy) => &**lazy,
+        }
+    }
+}
 
 /// Sanity-check that `intents` is non-empty NDJSON: terminated by a newline,
 /// with every line a syntactically-valid JSON document.
diff --git a/crates/publisher/src/mapping.rs b/crates/publisher/src/mapping.rs
index f01253ea0be..57d7619949d 100644
--- a/crates/publisher/src/mapping.rs
+++ b/crates/publisher/src/mapping.rs
@@ -14,8 +14,14 @@ use proto_gazette::broker;
 ///
 /// Port of Go's `Mapper.Map` (`go/flow/mapping.go`).
 pub(crate) async fn map_partition<N: json::AsNode>(
-    binding: &super::Binding,
-    client: &super::LazyPartitionsClient,
+    binding: &super::MappedBinding,
+    lazy: &std::sync::LazyLock<
+        (
+            gazette::journal::Client,
+            tokens::PendingWatch<Vec<watch::PartitionSplit>>,
+        ),
+        crate::MappedClientInit,
+    >,
     doc: &N,
     prefix: String,
     packed_key: bytes::BytesMut,
@@ -23,7 +29,7 @@ pub(crate) async fn map_partition<N: json::AsNode>(
     let (mut prefix, packed_key, key_hash) =
         extract_mapping_context(binding, doc, prefix, packed_key)?;
 
-    let (client, partitions) = &(**client);
+    let (client, partitions) = &(**lazy);
     let partitions = partitions.ready().await;
 
     loop {
@@ -72,7 +78,7 @@ pub(crate) async fn map_partition<N: json::AsNode>(
 }
 
 fn extract_mapping_context<N: json::AsNode>(
-    binding: &super::Binding,
+    binding: &super::MappedBinding,
     doc: &N,
     mut prefix: String,
     mut packed_key: bytes::BytesMut,
@@ -150,7 +156,7 @@ fn pick_partition(
 // Panics if field extraction fails, as build_logical_prefix() should have
 // already been called.
 fn build_partition_apply<N: json::AsNode>(
-    binding: &super::Binding,
+    binding: &super::MappedBinding,
     doc: &N,
 ) -> tonic::Result<(String, broker::ApplyRequest)> {
     let mut spec = binding.partitions_template.clone();
@@ -173,13 +179,6 @@ fn build_partition_apply<N: json::AsNode>(
     spec.name = name.clone();
     spec.labels = Some(labels);
 
-    if !name.starts_with(&binding.partitions_prefix_or_name) {
-        return Err(tonic::Status::invalid_argument(format!(
-            "candidate partition to create is {name}, but this publisher is restricted to {}",
-            binding.partitions_prefix_or_name
-        )));
-    }
-
     Ok((
         name,
         broker::ApplyRequest {
@@ -287,8 +286,8 @@ mod test {
         assert_eq!(pick_partition(&p, "coll/a=1/", 0), None);
     }
 
-    /// Build a test Binding from a built CollectionSpec.
-    fn test_binding(spec: &flow::CollectionSpec) -> super::super::Binding {
+    /// Build a test MappedBinding from a built CollectionSpec.
+    fn test_binding(spec: &flow::CollectionSpec) -> super::super::MappedBinding {
         let flow::CollectionSpec {
             name,
             partition_template,
@@ -299,21 +298,21 @@ mod test {
         } = spec;
 
         let partition_template = partition_template.clone().unwrap();
-        let partitions_prefix_or_name = format!("{}/", &partition_template.name);
+        let partitions_prefix = format!("{}/", &partition_template.name);
         let policy = doc::SerPolicy::noop();
 
         let key_extractors = extractors::for_key(key, projections, &policy).unwrap();
         let partition_extractors =
             extractors::for_fields(partition_fields, projections, &policy).unwrap();
 
-        super::super::Binding {
+        super::super::MappedBinding {
             collection: models::Collection::new(name),
             key_extractors,
             partition_fields: partition_fields.clone(),
             partition_extractors,
             partitions_template: partition_template,
             partitions_limit: 100,
-            partitions_prefix_or_name,
+            partitions_prefix,
         }
     }
 
@@ -331,7 +330,7 @@ mod test {
             .unwrap();
 
         let spec = spec.as_ref().unwrap();
-        let mut binding = test_binding(spec);
+        let binding = test_binding(spec);
 
         // extract_mapping_context encodes partition field values into a logical prefix.
         let (prefix_1, _, _) = extract_mapping_context(
@@ -375,25 +374,5 @@ mod test {
                 "change": request.changes.into_iter().next().unwrap(),
             })
         );
-
-        // A more-specific prefix that still covers the candidate partition is OK.
-        binding.partitions_prefix_or_name =
-            "example/collection/2020202020202020/a_bool=%_true/".to_string();
-        build_partition_apply(
-            &binding,
-            &json!({"a_key": "k", "a_bool": true, "a_str": "hello"}),
-        )
-        .unwrap();
-
-        // A sibling prefix that does NOT cover the candidate partition is rejected.
-        binding.partitions_prefix_or_name =
-            "example/collection/2020202020202020/a_bool=%_false/".to_string();
-        let err = build_partition_apply(
-            &binding,
-            &json!({"a_key": "k", "a_bool": true, "a_str": "hello"}),
-        )
-        .unwrap_err();
-        assert_eq!(err.code(), tonic::Code::InvalidArgument);
-        insta::assert_snapshot!(err.message(), @"candidate partition to create is example/collection/2020202020202020/a_bool=%_true/a_str=hello/pivot=00, but this publisher is restricted to example/collection/2020202020202020/a_bool=%_false/");
     }
 }
diff --git a/crates/publisher/src/publisher.rs b/crates/publisher/src/publisher.rs
index 482a5ec60bd..79e786e06d7 100644
--- a/crates/publisher/src/publisher.rs
+++ b/crates/publisher/src/publisher.rs
@@ -10,8 +10,9 @@ pub struct Publisher {
     authz_subject: String,
     // Bindings of this Publisher.
     bindings: Vec<super::Binding>,
-    // Lazily-initialized journal Client and partitions watch for each `bindings` entry.
-    binding_clients: Vec<super::LazyPartitionsClient>,
+    // Lazily-initialized journal Client (and, for Mapped bindings, partitions
+    // watch) for each `bindings` entry.
+    binding_clients: Vec<super::LazyBindingClient>,
     // Factory for building journal Clients on demand.
     client_factory: gazette::journal::ClientFactory,
     // Clock used to stamp published document UUIDs.
@@ -31,7 +32,7 @@ impl Publisher {
     /// (one per entry of `bindings`), and to build ephemeral clients inside
     /// `write_intents` for ACK intents that do not match any current binding.
     /// `authz_subject` is passed through to this factory without modification,
-    /// and `Binding::partitions_prefix_or_name` is the AuthZ object.
+    /// and a binding's `authz_object()` is the AuthZ object.
     ///
     /// The `producer` identifies this Publisher as a distinct writer and is
     /// embedded in every UUID it generates. The `clock` provides a monotonic
@@ -46,17 +47,26 @@ impl Publisher {
         let binding_clients = bindings
             .iter()
             .map(|b| {
-                let client_factory = client_factory.clone();
+                let factory = client_factory.clone();
                 let authz_subject = authz_subject.clone();
-                let authz_object = b.partitions_prefix_or_name.clone();
+                let authz_object = b.authz_object().to_string();
 
-                let init: crate::PartitionsClientInit = Box::new(move || {
-                    let client = client_factory(authz_subject, authz_object.clone());
-                    let partitions = crate::watch::watch_partitions(client.clone(), &authz_object);
-                    (client, partitions)
-                });
-
-                std::sync::LazyLock::new(init)
+                match b {
+                    super::Binding::Mapped(_) => {
+                        let init: crate::MappedClientInit = Box::new(move || {
+                            let client = factory(authz_subject, authz_object.clone());
+                            let partitions =
+                                crate::watch::watch_partitions(client.clone(), &authz_object);
+                            (client, partitions)
+                        });
+                        super::LazyBindingClient::Mapped(std::sync::LazyLock::new(init))
+                    }
+                    super::Binding::Fixed(_) => {
+                        let init: crate::FixedClientInit =
+                            Box::new(move || factory(authz_subject, authz_object));
+                        super::LazyBindingClient::Fixed(std::sync::LazyLock::new(init))
+                    }
+                }
             })
             .collect();
 
@@ -89,11 +99,13 @@ impl Publisher {
     /// Enqueue a document for publication to the appropriate journal partition.
     ///
     /// Assigns a UUID with the given `flags` and passes it to `doc`, which
-    /// returns `(binding_index, document)`. The document is mapped to a physical
-    /// partition (creating one if needed, which may issue an Apply RPC), serialized
-    /// as newline-delimited JSON into the partition's Appender buffer, and
-    /// checkpoint'd. The checkpoint may start a background Append RPC if the
-    /// buffer exceeds the flush threshold.
+    /// returns `(binding_index, document)`. For Mapped bindings the document
+    /// is mapped to a physical partition (creating one if needed, which may
+    /// issue an Apply RPC). For Fixed bindings the binding's journal is used
+    /// directly, with no key extraction or partition mapping. The document is
+    /// serialized as newline-delimited JSON into the partition's Appender
+    /// buffer, and checkpoint'd. The checkpoint may start a background Append
+    /// RPC if the buffer exceeds the flush threshold.
     pub async fn enqueue<N: json::AsNode>(
         &mut self,
         doc: impl FnOnce(uuid::Uuid) -> (usize, N),
@@ -105,18 +117,24 @@ impl Publisher {
 
         // Sequence the document.
         let uuid = proto_gazette::uuid::build(self.producer, self.clock.tick(), flags);
-        let (binding, doc) = doc(uuid);
-
-        let (mut journal, mut packed_key) = super::mapping::map_partition(
-            &self.bindings[binding],
-            &self.binding_clients[binding],
-            &doc,
-            prefix,
-            packed_key,
-        )
-        .await?;
-
-        let (client, _partitions) = &(*self.binding_clients[binding]);
+        let (binding_idx, doc) = doc(uuid);
+
+        let (mut journal, mut packed_key) = match &self.bindings[binding_idx] {
+            super::Binding::Mapped(mapped) => {
+                let super::LazyBindingClient::Mapped(lazy) = &self.binding_clients[binding_idx]
+                else {
+                    unreachable!("Mapped binding has Mapped lazy client");
+                };
+                super::mapping::map_partition(mapped, lazy, &doc, prefix, packed_key).await?
+            }
+            super::Binding::Fixed(fixed) => {
+                let mut prefix = prefix;
+                prefix.push_str(&fixed.journal);
+                (prefix, packed_key)
+            }
+        };
+
+        let client = self.binding_clients[binding_idx].client();
         let appender = self.appenders.activate(&journal, client);
 
         // Enqueue the serialization to the Appender's buffer, then checkpoint.
@@ -167,8 +185,9 @@ impl Publisher {
     /// Takes the output of `intents::build_transaction_intents()` — per-journal
     /// NDJSON `Bytes` — and appends each to its journal in parallel. For each
     /// journal, this uses a hybrid client strategy:
-    /// - If the journal is a prefix-match of an existing binding's
-    ///   `auth_prefix_or_name`, reuse that binding's client.
+    /// - If the journal matches a binding, reuse that binding's client.
+    ///   For Mapped bindings the match is a prefix-match on the binding's
+    ///   partitions prefix; for Fixed bindings it's an exact name match.
     /// - Otherwise, build an ephemeral client. This supports recovered ACK
     ///   intents that may reference journals no longer bound to the current
     ///   task (e.g. from a prior published task). For this class of journals,
@@ -192,8 +211,11 @@ impl Publisher {
             let binding_client = self
                 .bindings
                 .iter()
-                .position(|b| journal.starts_with(&b.partitions_prefix_or_name))
-                .map(|i| &(*self.binding_clients[i]).0);
+                .position(|b| match b {
+                    super::Binding::Mapped(m) => journal.starts_with(&m.partitions_prefix),
+                    super::Binding::Fixed(f) => journal == f.journal,
+                })
+                .map(|i| self.binding_clients[i].client());
 
             let appender = if let Some(client) = binding_client {
                 self.appenders.activate(&journal, client)
@@ -226,15 +248,20 @@ impl Publisher {
         Ok(())
     }
 
-    /// Access the lazy Client and partitions watch for the binding at `index`.
-    /// Primarily used by tests.
-    pub fn binding_client(
+    /// Access the lazy Client and partitions watch for the Mapped binding at
+    /// `index`. Panics if the binding is Fixed. Primarily used by tests.
+    pub fn mapped_binding_client(
         &self,
         index: usize,
     ) -> &(
         gazette::journal::Client,
         tokens::PendingWatch<Vec<super::watch::PartitionSplit>>,
     ) {
-        &*self.binding_clients[index]
+        match &self.binding_clients[index] {
+            super::LazyBindingClient::Mapped(lazy) => &**lazy,
+            super::LazyBindingClient::Fixed(_) => {
+                panic!("binding {index} is Fixed, not Mapped")
+            }
+        }
     }
 }
diff --git a/crates/runtime-next/Cargo.toml b/crates/runtime-next/Cargo.toml
index 0c541b58a92..35387fd5e1f 100644
--- a/crates/runtime-next/Cargo.toml
+++ b/crates/runtime-next/Cargo.toml
@@ -37,6 +37,7 @@ proto-grpc = { path = "../proto-grpc", features = [
     "runtime_server",
 ] }
 publisher = { path = "../publisher" }
+service-kit = { path = "../service-kit" }
 shuffle = { path = "../shuffle" }
 simd-doc = { path = "../simd-doc" }
 tables = { path = "../tables" }
@@ -56,6 +57,7 @@ handlebars = { workspace = true }
 json-patch = { workspace = true }
 jsonwebtoken = { workspace = true }
 librocksdb-sys = { workspace = true }
+metrics = { workspace = true }
 pbjson-types = { workspace = true }
 prost = { workspace = true }
 rand = { workspace = true }
diff --git a/crates/runtime-next/README.md b/crates/runtime-next/README.md
index 6587a75d6c2..22e2f76cee5 100644
--- a/crates/runtime-next/README.md
+++ b/crates/runtime-next/README.md
@@ -32,10 +32,10 @@ Reactor machine
   │         │    (RocksDB + Go Recorder on the shard hosting the recovery log)
   │         └─ Capture: per-shard RocksDB with Go Recorder
   │
-  └─ shuffle sidecar process (Rust, one per machine)
+  └─ runtime sidecar process (Rust, one per machine)
        ├─ Shuffle Leader service (this crate, per-task via Join)
        ├─ Shuffle service (`crates/shuffle`, Session/Slice/Log RPCs)
-       └─ Listens on the fixed shuffle port, shared fleet-wide
+       └─ Listens on the fixed sidecar port, shared fleet-wide
 ```
 
 The Gazette consumer framework's transaction lifecycle is **bypassed
@@ -74,7 +74,7 @@ src/
 │
 └── shard/             # per-shard controller-facing service
     ├── service.rs       # gRPC entry, dispatches by task type
-    ├── recovery.rs      # Persist <-> RocksDB WriteBatch encode/decode + scan
+    ├── recovery.rs      # Persist <-> RocksDB WriteBatch encode/decode + scan-time FC: pruning
     ├── rocksdb.rs       # single Persist application path (capture will reuse)
     └── materialize/
         ├── handler.rs       # gRPC stream handler
@@ -92,7 +92,7 @@ src/
   signing key), constructs a `shard::Service`, and serves it over a per-shard
   Unix domain socket.
 - **`leader::Service::new`** (`leader/service.rs`) — sidecar process builds
-  one of these and registers it on the shuffle port alongside `shuffle::Service`.
+  one of these and registers it on the sidecar port alongside `shuffle::Service`.
 - **`shard::Service`** (`shard/service.rs`) — implements the controller-facing
   `Shard` trait. Each bidi stream terminates *both* the controller-bound
   protocol and the leader-bound protocol, translating between them and the
@@ -136,10 +136,31 @@ documented inline in the proto.
 This crate ships **deployed inert** alongside the existing `runtime` crate;
 both coexist on the same reactor. Per-task feature flags on shard labels
 select which runtime serves a given task — all shards of a task use the
-same runtime. The shuffle sidecar runs uniformly on every reactor machine
+same runtime. The runtime sidecar runs uniformly on every reactor machine
 regardless of which tasks are assigned; old-runtime tasks simply don't talk
 to it. Rollback for any task is a feature-flag flip.
 
+Once a task has stably cut over, the per-task `drop-runtime-v1-rollback`
+shard-label flag tells the leader to stop maintaining the legacy V1
+`consumer.Checkpoint`; the leader deletes the persisted one during startup
+(see below), forfeiting rollback in exchange for shedding compatibility state.
+
+## Startup checkpoint reconciliation
+
+The legacy V1 `consumer.Checkpoint` holds a *complete* committed frontier,
+whereas the V2 `FC:` keys are written per-transaction as *deltas*. So at a
+V1→V2 cutover the recovered `FC:` keys are not yet a sound recovery baseline.
+`leader::materialize::startup` reconciles this synchronously: after the
+connector `Open`/`Opened` exchange, when the final status of the recovered V1
+checkpoint and any remote-authoritative connector checkpoint is known, it
+issues a single cleanup `Persist` to shard zero. If a checkpoint was
+*authoritative* (its mapped frontier replaced the recovered one), the cleanup
+clears all `FC:` keys and rewrites the complete baseline; if
+`drop-runtime-v1-rollback` is set, it also deletes the legacy `checkpoint`
+key. An authoritative (unmarked) checkpoint implies no V2 transaction has
+committed, so clearing `FC:` loses no V2 state. The transaction loop then
+only ever writes `FC:` deltas.
+
 ## Status
 
 - `leader::materialize` and `shard::materialize` are implemented.
diff --git a/crates/runtime-next/src/leader/materialize/actor.rs b/crates/runtime-next/src/leader/materialize/actor.rs
index 3ca2eb93ddf..4465f8deb3f 100644
--- a/crates/runtime-next/src/leader/materialize/actor.rs
+++ b/crates/runtime-next/src/leader/materialize/actor.rs
@@ -16,6 +16,8 @@ pub struct Actor {
     intents_write_fut: Option<BoxFuture<'static, tonic::Result<crate::Publisher>>>,
     // Optional full Frontier and Checkpoint, used for V1 rollback support.
     legacy_checkpoint: Option<(shuffle::Frontier, consumer::Checkpoint)>,
+    // Per-task metrics counters and gauges.
+    metrics: super::Metrics,
     // Publisher for stats and ACK intents, parked while no async operation is in-flight.
     parked_publisher: Option<crate::Publisher>,
     // ACK intents to persist and append at later transaction stages.
@@ -37,6 +39,7 @@ impl Actor {
     pub fn new(
         http_client: reqwest::Client,
         legacy_checkpoint: Option<shuffle::Frontier>,
+        metrics: super::Metrics,
         publisher: crate::Publisher,
         shard_tx: Vec<mpsc::UnboundedSender<tonic::Result<proto::Materialize>>>,
         task: Task,
@@ -45,6 +48,7 @@ impl Actor {
             http_client,
             intents_write_fut: None,
             legacy_checkpoint: legacy_checkpoint.map(|f| (f, consumer::Checkpoint::default())),
+            metrics,
             parked_publisher: Some(publisher),
             pending_ack_intents: BTreeMap::new(),
             shard_tx,
@@ -62,7 +66,12 @@ impl Actor {
         session: shuffle::SessionClient,
         shard_rx: Vec<BoxStream<'static, tonic::Result<proto::Materialize>>>,
     ) -> anyhow::Result<()> {
-        tracing::info!(self.task.n_shards, "materialize actor started");
+        service_kit::event!(
+            tracing::Level::INFO,
+            "leader",
+            n_shards = self.task.n_shards,
+            "materialize Actor::serve started",
+        );
         assert_eq!(self.task.n_shards, shard_rx.len());
         assert_eq!(self.task.n_shards, self.shard_tx.len());
 
@@ -119,6 +128,7 @@ impl Actor {
 
             // Drive `tail` to idle.
             let action: fsm::Action;
+            let prev_kind = tail.kind();
             (action, tail) = tail.step(
                 self.intents_write_fut.is_none(),
                 now,
@@ -128,6 +138,17 @@ impl Actor {
                 self.trigger_fut.is_some(),
             );
 
+            if prev_kind != tail.kind() {
+                service_kit::event!(
+                    tracing::Level::DEBUG,
+                    "tail",
+                    prev = prev_kind,
+                    action = action.kind(),
+                    next = tail.kind(),
+                    "transition",
+                );
+            }
+
             match action {
                 fsm::Action::Idle => (),
                 fsm::Action::Sleep { .. } => unreachable!("Tail does not Sleep"),
@@ -140,6 +161,7 @@ impl Actor {
 
             // Drive `head` to idle or stop.
             let action: fsm::Action;
+            let prev_kind = head.kind();
             (action, head) = head.step(
                 &mut binding_bytes_behind,
                 &mut close_requested,
@@ -155,6 +177,17 @@ impl Actor {
                 &self.task,
             );
 
+            if prev_kind != head.kind() {
+                service_kit::event!(
+                    tracing::Level::DEBUG,
+                    "head",
+                    prev = prev_kind,
+                    action = action.kind(),
+                    next = head.kind(),
+                    "transition",
+                );
+            }
+
             match action {
                 fsm::Action::Idle => (),
                 fsm::Action::Sleep { wake_after: w } => wake_after = w,
@@ -165,6 +198,7 @@ impl Actor {
                         &mut transactions_completed,
                         &mut stopping,
                     );
+                    self.metrics.transactions.increment(1);
                     tail = fsm::Tail::Begin(fsm::TailBegin { pending });
                     continue;
                 }
@@ -198,6 +232,15 @@ impl Actor {
                     self.parked_publisher = Some(publisher);
                     self.pending_ack_intents = intents;
                     self.stats_write_fut = None;
+
+                    service_kit::event!(
+                        tracing::Level::DEBUG,
+                        "leader",
+                        "completed ops stats publish",
+                    );
+                    // Having just written stats, we know this measure is fresh.
+                    let total: i64 = binding_bytes_behind.iter().copied().sum();
+                    self.metrics.bytes_behind.set(total as f64);
                 }
                 Some(result) = maybe_fut(&mut self.intents_write_fut) => {
                     let publisher = result.map_err(crate::status_to_anyhow)
@@ -205,10 +248,22 @@ impl Actor {
 
                     self.parked_publisher = Some(publisher);
                     self.intents_write_fut = None;
+
+                    service_kit::event!(
+                        tracing::Level::DEBUG,
+                        "leader",
+                        "completed ACK intents write",
+                    );
                 }
                 Some(result) = maybe_fut(&mut self.trigger_fut) => {
                     () = result?;
                     self.trigger_fut = None;
+
+                    service_kit::event!(
+                        tracing::Level::DEBUG,
+                        "leader",
+                        "completed trigger dispatch",
+                    );
                 }
                 // Process shard messages next.
                 Some((shard_index, msg, rx)) = shard_rx.next() => {
@@ -224,7 +279,21 @@ impl Actor {
                 }
                 // Poll for a next frontier when otherwise idle.
                 Some(result) = frontier_rx.next(), if ready_frontier.is_none() => {
-                    ready_frontier = Some(result?);
+                    let frontier = result?;
+                    let (journals, journal_producers, bytes_read_delta, bytes_behind_delta) = frontier.measures();
+                    let unresolved_hints = frontier.unresolved_hints;
+                    ready_frontier = Some(frontier);
+
+                    service_kit::event!(
+                        tracing::Level::DEBUG,
+                        "leader",
+                        bytes_behind_delta,
+                        bytes_read_delta,
+                        journal_producers,
+                        journals,
+                        unresolved_hints,
+                        "received Frontier from shuffle Session",
+                    );
                 }
 
                 // Lowest priority.
@@ -234,7 +303,11 @@ impl Actor {
             now.update(now_clock()); // Resync after blocking IO.
         }
 
-        tracing::info!("materialize actor exiting");
+        service_kit::event!(
+            tracing::Level::INFO,
+            "leader",
+            "materialize Actor::serve exiting; broadcasting Stopped",
+        );
 
         for tx in &self.shard_tx {
             let _ = tx.send(Ok(proto::Materialize {
@@ -255,7 +328,7 @@ impl Actor {
             }
 
             fsm::Action::Load { frontier } => {
-                tracing::debug!(journals = frontier.journals.len(), "broadcasting L:Load");
+                service_kit::event!(tracing::Level::DEBUG, "shard", "broadcasting L:Load");
                 self.broadcast(proto::Materialize {
                     load: Some(proto::materialize::Load {
                         frontier: Some(frontier.encode()),
@@ -265,10 +338,7 @@ impl Actor {
             }
 
             fsm::Action::Flush { connector_patches } => {
-                tracing::debug!(
-                    patches_bytes = connector_patches.len(),
-                    "broadcasting L:Flush"
-                );
+                service_kit::event!(tracing::Level::DEBUG, "shard", "broadcasting L:Flush");
                 self.broadcast(proto::Materialize {
                     flush: Some(proto::materialize::Flush {
                         connector_patches_json: connector_patches,
@@ -278,7 +348,7 @@ impl Actor {
             }
 
             fsm::Action::Store => {
-                tracing::debug!("broadcasting L:Store");
+                service_kit::event!(tracing::Level::DEBUG, "shard", "broadcasting L:Store");
                 self.broadcast(proto::Materialize {
                     store: Some(proto::materialize::Store {}),
                     ..Default::default()
@@ -289,11 +359,7 @@ impl Actor {
                 connector_checkpoint,
                 connector_patches,
             } => {
-                tracing::debug!(
-                    patches_bytes = connector_patches.len(),
-                    "broadcasting L:StartCommit"
-                );
-
+                service_kit::event!(tracing::Level::DEBUG, "shard", "broadcasting L:StartCommit");
                 self.broadcast(proto::Materialize {
                     start_commit: Some(proto::materialize::StartCommit {
                         connector_checkpoint: Some(connector_checkpoint),
@@ -304,10 +370,7 @@ impl Actor {
             }
 
             fsm::Action::Acknowledge { connector_patches } => {
-                tracing::debug!(
-                    patches_bytes = connector_patches.len(),
-                    "broadcasting L:Acknowledge"
-                );
+                service_kit::event!(tracing::Level::DEBUG, "shard", "broadcasting L:Acknowledge");
                 self.broadcast(proto::Materialize {
                     acknowledge: Some(proto::materialize::Acknowledge {
                         connector_patches_json: connector_patches,
@@ -317,8 +380,7 @@ impl Actor {
             }
 
             fsm::Action::Persist { persist } => {
-                tracing::debug!("dispatching L:Persist to shard zero");
-
+                service_kit::event!(tracing::Level::DEBUG, "shard", "sending L:Persist");
                 let _ = self.shard_tx[0].send(Ok(proto::Materialize {
                     persist: Some(persist),
                     ..Default::default()
@@ -326,6 +388,11 @@ impl Actor {
             }
 
             fsm::Action::WriteStats { stats } => {
+                service_kit::event!(
+                    tracing::Level::DEBUG,
+                    "leader",
+                    "starting ops stats publish"
+                );
                 let mut publisher = self
                     .parked_publisher
                     .take()
@@ -349,6 +416,11 @@ impl Actor {
             }
 
             fsm::Action::WriteIntents { ack_intents } => {
+                service_kit::event!(
+                    tracing::Level::DEBUG,
+                    "leader",
+                    "starting ACK intents write"
+                );
                 let mut publisher = self
                     .parked_publisher
                     .take()
@@ -364,10 +436,17 @@ impl Actor {
             }
 
             fsm::Action::CallTrigger { trigger_params } => {
+                service_kit::event!(
+                    tracing::Level::DEBUG,
+                    "leader",
+                    "starting trigger execution"
+                );
                 let Some(compiled) = self.task.triggers.clone() else {
-                    tracing::info!(
+                    service_kit::event!(
+                        tracing::Level::INFO,
+                        "leader",
                         trigger_params_bytes = trigger_params.len(),
-                        "discarding recovered trigger parameters for materialization without triggers"
+                        "discarding recovered trigger parameters for materialization without triggers",
                     );
                     return Ok(());
                 };
@@ -377,6 +456,7 @@ impl Actor {
                 let client = self.http_client.clone();
                 self.trigger_fut = Some(
                     async move {
+                        // TODO(johnny): Periodic writes into task ops logs if it takes a while.
                         super::triggers::fire_pending_triggers(&compiled, &variables, &client).await
                     }
                     .boxed(),
@@ -433,7 +513,13 @@ impl Actor {
         } else {
             "(other)"
         };
-        tracing::debug!(shard_index, kind, "received from shard");
+        service_kit::event!(
+            tracing::Level::DEBUG,
+            "shard",
+            shard_index,
+            kind,
+            "received from shard",
+        );
 
         Ok(Some(msg))
     }
@@ -460,8 +546,10 @@ fn on_transaction_completed(
 
     *transactions_completed = transactions_completed.saturating_add(1);
     if *transactions_completed >= max_transactions {
-        tracing::info!(
-            transactions_completed,
+        service_kit::event!(
+            tracing::Level::INFO,
+            "leader",
+            transactions_completed = *transactions_completed,
             max_transactions,
             "materialize transaction limit reached; stopping gracefully",
         );
@@ -527,6 +615,7 @@ mod tests {
         let actor = Actor::new(
             reqwest::Client::new(),
             None,
+            super::super::Metrics::new("test/task/shard"),
             crate::Publisher::new_preview(),
             shard_tx,
             task,
diff --git a/crates/runtime-next/src/leader/materialize/fsm.rs b/crates/runtime-next/src/leader/materialize/fsm.rs
index 41391a96a82..a4d6316b61e 100644
--- a/crates/runtime-next/src/leader/materialize/fsm.rs
+++ b/crates/runtime-next/src/leader/materialize/fsm.rs
@@ -144,6 +144,25 @@ pub enum Action {
     },
 }
 
+impl Action {
+    pub fn kind(&self) -> &'static str {
+        match self {
+            Self::Acknowledge { .. } => "Acknowledge",
+            Self::CallTrigger { .. } => "CallTrigger",
+            Self::Flush { .. } => "Flush",
+            Self::Idle => "Idle",
+            Self::Load { .. } => "Load",
+            Self::Persist { .. } => "Persist",
+            Self::Rotate { .. } => "Rotate",
+            Self::Sleep { .. } => "Sleep",
+            Self::StartCommit { .. } => "StartCommit",
+            Self::Store => "Store",
+            Self::WriteIntents { .. } => "WriteIntents",
+            Self::WriteStats { .. } => "WriteStats",
+        }
+    }
+}
+
 impl Head {
     /// Dispatch to the current sub-state's `step()`.
     pub fn step(
@@ -178,6 +197,19 @@ impl Head {
             Head::Stop => panic!("HeadFSM::Stop observed at step boundary"),
         }
     }
+
+    pub fn kind(&self) -> &'static str {
+        match self {
+            Self::Idle(_) => "Idle",
+            Self::Extend(_) => "Extend",
+            Self::Flush(_) => "Flush",
+            Self::Persist(_) => "Persist",
+            Self::Store(_) => "Store",
+            Self::WriteStats(_) => "WriteStats",
+            Self::StartCommit(_) => "StartCommit",
+            Self::Stop => "Stop",
+        }
+    }
 }
 
 impl Tail {
@@ -200,6 +232,17 @@ impl Tail {
             Tail::Done(_) => (Action::Idle, self),
         }
     }
+
+    pub fn kind(&self) -> &'static str {
+        match self {
+            Self::Begin(_) => "Begin",
+            Self::Acknowledge(_) => "Acknowledge",
+            Self::WriteIntents(_) => "WriteIntents",
+            Self::Trigger(_) => "Trigger",
+            Self::Persist(_) => "Persist",
+            Self::Done(_) => "Done",
+        }
+    }
 }
 
 /// HeadIdle awaits a first ready Frontier that begins a transaction.
@@ -323,9 +366,8 @@ impl HeadExtend {
                 let max_source_clock = uuid::Clock::from_u64(max_source_clock);
                 let extent = self.extents.bindings.entry(index).or_default();
 
-                if !max_key_delta.is_empty() {
-                    extent.max_key_delta = max_key_delta;
-                }
+                extent.max_key_delta = std::mem::take(&mut extent.max_key_delta).max(max_key_delta);
+
                 if extent.sourced.docs_total == 0 {
                     extent.max_source_clock = max_source_clock;
                     extent.min_source_clock = min_source_clock;
@@ -515,7 +557,7 @@ impl HeadFlush {
 
         // Persist extents for idempotent transaction replay.
         let persist = proto::Persist {
-            nonce: now.as_u64(),
+            seq_no: now.as_u64(),
             connector_patches_json: take_patches(&mut pending.persist_patches),
             delete_hinted_frontier: true,
             hinted_close_clock: extents.close.as_u64(),
@@ -531,7 +573,7 @@ impl HeadFlush {
             shard_stored: vec![false; task.n_shards],
         };
         let persist_state = HeadPersist {
-            nonce: persist.nonce,
+            seq_no: persist.seq_no,
             next_action: Action::Store,
             next_state: Box::new(Head::Store(store_state)),
         };
@@ -544,7 +586,7 @@ impl HeadFlush {
 /// and chains its contained action and state.
 #[derive(Debug)]
 pub struct HeadPersist {
-    pub nonce: u64,
+    pub seq_no: u64,
     pub next_action: Action,
     pub next_state: Box<Head>,
 }
@@ -554,16 +596,16 @@ impl HeadPersist {
         if let Some((
             0,
             proto::Materialize {
-                persisted: Some(proto::Persisted { nonce }),
+                persisted: Some(proto::Persisted { seq_no }),
                 ..
             },
         )) = shard_rx
-            && *nonce == self.nonce
+            && *seq_no == self.seq_no
         {
             shard_rx.take();
 
             let Self {
-                nonce: _,
+                seq_no: _,
                 next_action,
                 next_state,
             } = self;
@@ -644,7 +686,7 @@ impl HeadStore {
         }
 
         // Compose the trigger payload now that we have a complete txn-wide view.
-        if task.triggers.is_some() {
+        if task.triggers.is_some() && !extents.bindings.is_empty() {
             let collection_names: Vec<String> = extents
                 .bindings
                 .keys()
@@ -826,7 +868,7 @@ impl HeadStartCommit {
             .map(|(_full_frontier, full_checkpoint)| full_checkpoint.clone());
 
         let persist = proto::Persist {
-            nonce: now.as_u64(),
+            seq_no: now.as_u64(),
             ack_intents: pending.ack_intents.clone(),
             committed_close_clock: close.as_u64(),
             committed_frontier: Some(shuffle::JournalFrontier::encode(&frontier.journals)),
@@ -860,7 +902,7 @@ impl HeadStartCommit {
         };
 
         let state = HeadPersist {
-            nonce: persist.nonce,
+            seq_no: persist.seq_no,
             next_action,
             next_state: Box::new(next_state),
         };
@@ -987,16 +1029,16 @@ impl TailAcknowledge {
 
         // If Acknowledged returned patches, wrap with a Persist that runs first.
         if !persist_patches.is_empty() {
-            let nonce = now.as_u64();
+            let seq_no = now.as_u64();
 
             state = Tail::Persist(TailPersist {
-                nonce,
+                seq_no,
                 next_action: action,
                 next_state: Box::new(state),
             });
             action = Action::Persist {
                 persist: proto::Persist {
-                    nonce,
+                    seq_no,
                     connector_patches_json: persist_patches,
                     ..Default::default()
                 },
@@ -1043,16 +1085,16 @@ impl TailTrigger {
 
         let Self { shard_patches } = self;
 
-        let nonce = now.as_u64();
+        let seq_no = now.as_u64();
         let action = Action::Persist {
             persist: proto::Persist {
-                nonce,
+                seq_no,
                 delete_trigger_params: true,
                 ..Default::default()
             },
         };
         let state = TailPersist {
-            nonce,
+            seq_no,
             next_action: Action::Idle,
             next_state: Box::new(Tail::Done(TailDone { shard_patches })),
         };
@@ -1065,7 +1107,7 @@ impl TailTrigger {
 /// and chains its contained action and state.
 #[derive(Debug)]
 pub struct TailPersist {
-    pub nonce: u64,
+    pub seq_no: u64,
     pub next_action: Action,
     pub next_state: Box<Tail>,
 }
@@ -1075,16 +1117,16 @@ impl TailPersist {
         if let Some((
             0,
             proto::Materialize {
-                persisted: Some(proto::Persisted { nonce }),
+                persisted: Some(proto::Persisted { seq_no }),
                 ..
             },
         )) = shard_rx
-            && *nonce == self.nonce
+            && *seq_no == self.seq_no
         {
             shard_rx.take();
 
             let Self {
-                nonce: _,
+                seq_no: _,
                 next_action,
                 next_state,
             } = self;
@@ -1136,9 +1178,9 @@ pub struct CloseDecision {
 /// - `close_requested`, or `idempotent_replay && !unresolved_hints`: force close.
 /// - `unresolved_hints`: forces extend; suppresses close until hints resolve.
 /// - `idempotent_replay`: suppresses extend (replay is one-shot).
-/// - `stopping` with `may_close=true`: suppresses extend so Head can stop after
-///   the next commit. With Tail still draining, extend is permitted to keep the
-///   pipeline full.
+/// - `close_requested` or `stopping` with `may_close=true`: suppresses extend so
+///   the current txn closes promptly (and Head can stop after the next commit).
+///   With Tail still draining, extend is permitted to keep the pipeline full.
 /// - `!tail_done`: suppresses close (must hold open while Tail finishes).
 pub fn decide_close_policy(inputs: CloseInputs, task: &Task) -> CloseDecision {
     let CloseInputs {
@@ -1160,17 +1202,23 @@ pub fn decide_close_policy(inputs: CloseInputs, task: &Task) -> CloseDecision {
         && read_bytes < task.read_bytes.end
         && read_docs < task.read_docs.end;
 
-    let mut policy_close = open_age > task.open_duration.start
-        && last_age > task.last_close_age.start
-        && (!policy_extend || max_combiner > task.combiner_usage_bytes.start)
-        && (!policy_extend || read_bytes > task.read_bytes.start)
-        && (!policy_extend || read_docs > task.read_docs.start);
+    let mut policy_close = open_age >= task.open_duration.start
+        && last_age >= task.last_close_age.start
+        && (!policy_extend || max_combiner >= task.combiner_usage_bytes.start)
+        && (!policy_extend || read_bytes >= task.read_bytes.start)
+        && (!policy_extend || read_docs >= task.read_docs.start);
     policy_close |= idempotent_replay && !unresolved_hints;
     policy_close |= close_requested;
 
     let may_close = policy_close && !unresolved_hints && tail_done;
+
+    // A requested or stopping close stops extending the current txn once
+    // we're actually able to close it, so the txn finishes promptly. While
+    // we cannot yet close (Tail still draining, or unresolved hints), we
+    // keep extending if policy allows — maximizing parallelism as Tail works.
+    let finishing = close_requested || stopping;
     let may_extend =
-        (!idempotent_replay && policy_extend && (!stopping || !may_close)) || unresolved_hints;
+        (!idempotent_replay && policy_extend && (!finishing || !may_close)) || unresolved_hints;
 
     CloseDecision {
         may_extend,
@@ -1213,10 +1261,17 @@ fn build_stats_doc(
                 .copied()
                 .unwrap_or_default(),
         );
+        // Note that this measure can be clobbered if multiple bindings source
+        // from the same collection. This is a little unfortunate, and implied by
+        // the stats data-model. It's tempting to put a max() here, but that
+        // doesn't fundamentally solve the problem (updates can arrive in distinct
+        // txns, and then be reduded LWW by reporting). This can happen only when
+        // two bindings share the *same* collection and *different* priorities
+        // (otherwise they're same-cohort and process in lock-step).
         entry.last_source_published_at = extents.max_source_clock.to_pb_json_timestamp();
 
-        ops::merge_docs_and_bytes(&extents.sourced, &mut entry.left);
-        ops::merge_docs_and_bytes(&extents.loaded, &mut entry.right);
+        ops::merge_docs_and_bytes(&extents.sourced, &mut entry.right);
+        ops::merge_docs_and_bytes(&extents.loaded, &mut entry.left);
         ops::merge_docs_and_bytes(&extents.stored, &mut entry.out);
     }
 
@@ -1335,6 +1390,14 @@ mod tests {
         )
     }
 
+    /// `mk_loaded` variant that overrides `max_key_delta` on the (sole)
+    /// binding, for tests that exercise its per-binding reduction.
+    fn mk_loaded_with_key(shard: usize, key: &'static [u8]) -> (usize, proto::Materialize) {
+        let (shard, mut msg) = mk_loaded(shard);
+        msg.loaded.as_mut().unwrap().bindings[0].max_key_delta = Bytes::from_static(key);
+        (shard, msg)
+    }
+
     fn mk_flushed(shard: usize, patches: &'static [u8]) -> (usize, proto::Materialize) {
         (
             shard,
@@ -1393,28 +1456,28 @@ mod tests {
     }
 
     fn mk_head_persisted(head: &Head) -> (usize, proto::Materialize) {
-        let nonce = match head {
-            Head::Persist(p) => p.nonce,
+        let seq_no = match head {
+            Head::Persist(p) => p.seq_no,
             other => panic!("expected Head::Persist, got {other:?}"),
         };
         (
             0,
             proto::Materialize {
-                persisted: Some(proto::Persisted { nonce }),
+                persisted: Some(proto::Persisted { seq_no }),
                 ..Default::default()
             },
         )
     }
 
     fn mk_tail_persisted(tail: &Tail) -> (usize, proto::Materialize) {
-        let nonce = match tail {
-            Tail::Persist(p) => p.nonce,
+        let seq_no = match tail {
+            Tail::Persist(p) => p.seq_no,
             other => panic!("expected Tail::Persist, got {other:?}"),
         };
         (
             0,
             proto::Materialize {
-                persisted: Some(proto::Persisted { nonce }),
+                persisted: Some(proto::Persisted { seq_no }),
                 ..Default::default()
             },
         )
@@ -1505,7 +1568,7 @@ mod tests {
                 want: want(false, false),
             },
             Case {
-                name: "close_requested overrides policy floor",
+                name: "close_requested with may_close: extend suppressed, close",
                 inputs: CloseInputs {
                     open_age: Duration::ZERO,
                     last_age: Duration::ZERO,
@@ -1515,7 +1578,7 @@ mod tests {
                     close_requested: true,
                     ..mid
                 },
-                want: want(true, true),
+                want: want(false, true),
             },
             Case {
                 name: "close_requested but tail still busy: hold open",
@@ -1637,32 +1700,33 @@ mod tests {
         assert!(matches!(action, Action::Load { .. }));
         assert!(matches!(head, Head::Extend(_)));
 
-        // Loaded responses arrive from each shard. After both have landed
-        // HeadExtend rests (policy allows extend-or-close, neither input is
-        // provided) — the action is Sleep/Idle, which we don't assert.
-        for s in 0..2 {
-            ctx.shard_rx = Some(mk_loaded(s));
-            let (_action, h) = ctx.step_head(head, &mut tail);
-            head = h;
-            assert!(ctx.shard_rx.is_none(), "Loaded was consumed");
-        }
+        // Loaded(0) lands; HeadExtend still awaits Loaded(1) and rests.
+        ctx.shard_rx = Some(mk_loaded(0));
+        let (_action, h) = ctx.step_head(head, &mut tail);
+        head = h;
         assert!(matches!(head, Head::Extend(_)));
 
-        // Extend the open transaction with a second ready Frontier.
+        // A second ready Frontier becomes available before Loaded(1) arrives —
+        // simulating the actor's loop pre-fetching the next frontier while
+        // awaiting the prior round's Loaded responses.
         ctx.ready_frontier = Some(shuffle::Frontier::default());
+        ctx.shard_rx = Some(mk_loaded(1));
         let (action, h) = ctx.step_head(head, &mut tail);
         head = h;
+        // With both inputs available the FSM extends rather than closes.
         assert!(matches!(action, Action::Load { .. }));
+        assert!(matches!(head, Head::Extend(_)));
 
-        for s in 0..2 {
-            ctx.shard_rx = Some(mk_loaded(s));
-            let (_action, h) = ctx.step_head(head, &mut tail);
-            head = h;
-        }
+        // Second Load round: Loaded x2 arrive without another frontier queued.
+        // After the final Loaded the close-policy fires: ready_frontier is
+        // None and may_close is true (Tail::Done), so
+        // HeadExtend transitions straight into HeadFlush.
+        ctx.shard_rx = Some(mk_loaded(0));
+        let (_action, h) = ctx.step_head(head, &mut tail);
+        head = h;
+        assert!(matches!(head, Head::Extend(_)));
 
-        // Close: with Tail::Done and no unresolved hints, `close_requested`
-        // forces may_close and we begin L:Flush.
-        ctx.close_requested = true;
+        ctx.shard_rx = Some(mk_loaded(1));
         let (action, h) = ctx.step_head(head, &mut tail);
         head = h;
         assert!(matches!(action, Action::Flush { .. }));
@@ -1721,18 +1785,18 @@ mod tests {
           "_meta": {},
           "shard": {},
           "ts": "2023-11-14T22:13:20.000000004+00:00",
-          "openSecondsTotal": 0.000000024,
+          "openSecondsTotal": 0.000000016,
           "txnCount": 1,
           "materialize": {
             "test/collection": {
               "left": {
-                "docsTotal": 12,
-                "bytesTotal": 1200
-              },
-              "right": {
                 "docsTotal": 4,
                 "bytesTotal": 400
               },
+              "right": {
+                "docsTotal": 12,
+                "bytesTotal": 1200
+              },
               "out": {
                 "docsTotal": 8,
                 "bytesTotal": 800
@@ -1940,6 +2004,68 @@ mod tests {
         assert!(matches!(tail, Tail::Done(_)));
     }
 
+    /// Verifies aggregation of L:Loaded `max_key_delta` across shards and Load cycles.
+    #[test]
+    fn loaded_max_key_delta_reduction() {
+        let task = mk_task(2);
+        let mut ctx = Ctx {
+            binding_bytes_behind: vec![0; task.binding_collection_names.len()],
+            close_requested: false,
+            intents_idle: true,
+            legacy_checkpoint: None,
+            now: uuid::Clock::from_unix(1_700_000_000, 0),
+            pending_ack_intents: BTreeMap::new(),
+            ready_frontier: None,
+            shard_rx: None,
+            stats_idle: false,
+            stopping: false,
+            task,
+            trigger_running: false,
+        };
+        let mut head = Head::Idle(HeadIdle::default());
+        let mut tail = Tail::Done(TailDone::default());
+
+        // Open the first transaction.
+        ctx.ready_frontier = Some(shuffle::Frontier::default());
+        let (_a, h) = ctx.step_head(head, &mut tail);
+        head = h;
+
+        // Each row is one Load cycle: per-shard Loaded values for `max_key_delta`
+        // and the expected aggregated value after the cycle. The cycles share
+        // a single open transaction, so reductions must compose across cycles.
+        let cycles: &[(&[&'static [u8]], &'static [u8])] = &[
+            // Cross-shard reduction: shard 1's "Z" beats shard 0's "M".
+            (&[b"M", b"Z"], b"Z"),
+            // Smaller "A" and an empty report must not clobber the prior "Z".
+            (&[b"", b"A"], b"Z"),
+            // Strictly-larger "Z9" ratchets the maximum forward.
+            (&[b"Z9", b""], b"Z9"),
+        ];
+
+        for (i, (per_shard_keys, expected)) in cycles.iter().enumerate() {
+            for (shard, key) in per_shard_keys.iter().enumerate() {
+                // Queue the next frontier alongside the last Loaded so the FSM
+                // extends back into a fresh Load cycle rather than closing.
+                // Mirrors the actor's pre-fetch pattern in `happy_path`.
+                if shard + 1 == per_shard_keys.len() {
+                    ctx.ready_frontier = Some(shuffle::Frontier::default());
+                }
+                ctx.shard_rx = Some(mk_loaded_with_key(shard, *key));
+                let (_a, h) = ctx.step_head(head, &mut tail);
+                head = h;
+            }
+            let aggregated = match &head {
+                Head::Extend(s) => s.extents.bindings[&0].max_key_delta.clone(),
+                other => panic!("expected Head::Extend after cycle {i}, got {other:?}"),
+            };
+            assert_eq!(
+                aggregated,
+                Bytes::from_static(expected),
+                "after cycle {i} keys={per_shard_keys:?}",
+            );
+        }
+    }
+
     /// Fuzz Head and Tail by perturbing every Ctx field at each step.
     /// Random shard responses, frontiers, and idle/stopping flags drive
     /// arbitrary state transitions; the test asserts no panics. The FSMs
@@ -1952,12 +2078,12 @@ mod tests {
         use rand::{Rng, SeedableRng, rngs::SmallRng};
 
         // Synthesize a Materialize message of a randomly chosen variant. The
-        // `expected_nonce` is plumbed through so Persisted occasionally matches
-        // the in-progress nonce and lets HeadPersist / TailPersist actually
+        // `expected_seq_no` is plumbed through so Persisted occasionally matches
+        // the in-progress seq_no and lets HeadPersist / TailPersist actually
         // chain forward — without it, fuzz traces would rarely leave Persist.
         fn random_message(
             shard: usize,
-            expected_nonce: u64,
+            expected_seq_no: u64,
             rng: &mut SmallRng,
         ) -> (usize, proto::Materialize) {
             let mut msg = proto::Materialize::default();
@@ -2007,28 +2133,28 @@ mod tests {
                     });
                 }
                 _ => {
-                    // Most of the time, target the in-progress Persist's nonce so
+                    // Most of the time, target the in-progress Persist's seq_no so
                     // the FSM can actually chain forward; otherwise emit garbage.
-                    let nonce = if rng.random_bool(0.9) {
-                        expected_nonce
+                    let seq_no = if rng.random_bool(0.9) {
+                        expected_seq_no
                     } else {
                         rng.random()
                     };
-                    msg.persisted = Some(proto::Persisted { nonce });
+                    msg.persisted = Some(proto::Persisted { seq_no });
                 }
             }
             (shard, msg)
         }
 
-        // Pick a "best-guess" nonce to hand to `random_message`. When Head or
-        // Tail is awaiting Persisted we surface its nonce so the message is
+        // Pick a "best-guess" seq_no to hand to `random_message`. When Head or
+        // Tail is awaiting Persisted we surface its seq_no so the message is
         // sometimes accepted; otherwise return random noise.
-        fn pick_nonce(head: &Head, tail: &Tail, rng: &mut SmallRng) -> u64 {
+        fn pick_seq_no(head: &Head, tail: &Tail, rng: &mut SmallRng) -> u64 {
             if let Head::Persist(p) = head {
-                return p.nonce;
+                return p.seq_no;
             }
             if let Tail::Persist(p) = tail {
-                return p.nonce;
+                return p.seq_no;
             }
             rng.random()
         }
@@ -2075,8 +2201,8 @@ mod tests {
             // (sometimes out-of-range) to exercise bounds handling.
             if rng.random_bool(0.50) {
                 let shard = rng.random_range(0..=ctx.task.n_shards);
-                let nonce = pick_nonce(head, tail, rng);
-                ctx.shard_rx = Some(random_message(shard, nonce, rng));
+                let seq_no = pick_seq_no(head, tail, rng);
+                ctx.shard_rx = Some(random_message(shard, seq_no, rng));
             }
 
             // Add an ACK intent occasionally; HeadWriteStats drains them.
diff --git a/crates/runtime-next/src/leader/materialize/handler.rs b/crates/runtime-next/src/leader/materialize/handler.rs
index c6795da175f..331c285dad1 100644
--- a/crates/runtime-next/src/leader/materialize/handler.rs
+++ b/crates/runtime-next/src/leader/materialize/handler.rs
@@ -2,11 +2,31 @@ use super::{actor, fsm, startup};
 use crate::{leader, proto};
 use futures::StreamExt;
 use tokio::sync::mpsc;
+use tracing::Instrument;
 
 pub(crate) async fn serve<R>(
+    service: crate::Service,
+    request_rx: R,
+    response_tx: mpsc::UnboundedSender<tonic::Result<proto::Materialize>>,
+) -> anyhow::Result<()>
+where
+    R: futures::Stream<Item = tonic::Result<proto::Materialize>> + Send + Unpin + 'static,
+{
+    // Run the whole handler inside its span so operator trace overrides (see
+    // `service_kit::trace`) reach every log line — the actor loop's periodic
+    // instrumentation included.
+    let handler = service.registry.register("leader.materialize");
+    let span = handler.span();
+    serve_inner(service, request_rx, response_tx, handler)
+        .instrument(span)
+        .await
+}
+
+async fn serve_inner<R>(
     service: crate::Service,
     mut request_rx: R,
     response_tx: mpsc::UnboundedSender<tonic::Result<proto::Materialize>>,
+    mut handler: service_kit::HandlerGuard,
 ) -> anyhow::Result<()>
 where
     R: futures::Stream<Item = tonic::Result<proto::Materialize>> + Send + Unpin + 'static,
@@ -22,13 +42,17 @@ where
     };
     let task_name = leader::validate_join(&join)?.to_string();
 
-    tracing::info!(
-        %task_name,
-        shards = join.shards.len(),
+    handler.set_label(&join.shards[0].id);
+    handler.set_field("shards", join.shards.len());
+    handler.set_field("etcd_mod_revision", join.etcd_mod_revision);
+    handler.set_phase("joining");
+
+    service_kit::event!(
+        tracing::Level::INFO,
+        "shard",
         shard_index = join.shard_index,
         etcd_mod_revision = join.etcd_mod_revision,
-        shuffle_directory = %join.shuffle_directory,
-        "received Join",
+        "received Join from shard",
     );
 
     // Scope `guard` to prove it's not held across await points.
@@ -48,12 +72,15 @@ where
 
     let slots = match outcome {
         leader::JoinOutcome::Pending { filled, target } => {
-            tracing::debug!(
-                %task_name,
+            service_kit::event!(
+                tracing::Level::DEBUG,
+                "leader",
                 filled,
                 target,
-                "registered pending Join",
+                "registered pending Join (awaiting consensus)",
             );
+            handler.set_phase("awaiting-consensus");
+            handler.finish_ok();
             return Ok(());
         }
         leader::JoinOutcome::Disagreement(slots) => {
@@ -63,8 +90,9 @@ where
                 .max()
                 .unwrap();
 
-            tracing::info!(
-                %task_name,
+            service_kit::event!(
+                tracing::Level::INFO,
+                "leader",
                 max_etcd_revision,
                 retrying = slots.len(),
                 "broadcasting retry due to topology disagreement",
@@ -76,19 +104,26 @@ where
             for slot in slots {
                 let _ = slot.response_tx.send(Ok(retry.clone()));
             }
+            handler.set_phase("topology-disagreement");
+            handler.finish_ok();
             return Ok(());
         }
 
         leader::JoinOutcome::Consensus(slots) => slots,
     };
 
-    tracing::info!(
-        task_name,
-        shards = slots.len(),
+    handler.set_phase("starting");
+    let metrics = super::Metrics::new(&slots[0].join.shards[0].id);
+
+    service_kit::event!(
+        tracing::Level::INFO,
+        "leader",
         "consensus reached; starting session",
     );
 
     let mut build = String::new();
+    let mut drop_v1_rollback = false;
+    let mut ops_stats_journal = String::new();
     let mut reactors: Vec<String> = Vec::new();
     let mut shard_rx = Vec::with_capacity(slots.len());
     let mut shard_tx = Vec::with_capacity(slots.len());
@@ -122,19 +157,26 @@ where
         reactors.push(reactor.unwrap_or_default().suffix);
         shard_rx.push(slot_rx);
         shard_tx.push(slot_tx);
-        shard_ids.push(id);
+        shard_ids.push(id.clone());
         shard_shuffles.push(shuffle::proto::Shard {
+            id,
             range: labeling.range,
             directory,
             endpoint,
         });
+
+        // Labels are identical across shards (enforced by Join equality check).
         build = labeling.build;
+        drop_v1_rollback = leader::flag_enabled(&labeling.flags, leader::DROP_V1_ROLLBACK_FLAG);
+        ops_stats_journal = labeling.stats_journal;
     }
 
     let error_tx = shard_tx.clone();
 
-    // Run startup, and then the Actor transaction loop.
-    let result = async move {
+    // Run startup, and then the Actor transaction loop. The inner block is a
+    // try-scope: an error from either gets a best-effort broadcast to all shards
+    // below before propagating.
+    let result = async {
         let startup::Startup {
             committed_close,
             committed_frontier,
@@ -146,6 +188,8 @@ where
             task,
         } = startup::run(
             build,
+            drop_v1_rollback,
+            ops_stats_journal,
             reactors,
             &mut shard_rx,
             &mut shard_tx,
@@ -166,23 +210,36 @@ where
         };
         let tail = fsm::Tail::Begin(fsm::TailBegin { pending });
 
-        // TODO: Make this toggle-able for dropping rollback support.
-        let legacy_checkpoint = Some(committed_frontier);
+        // Maintain the legacy V1 `consumer.Checkpoint` from the recovered
+        // committed Frontier, unless the task has opted out of V1 rollback via
+        // `drop-runtime-v1-rollback`.
+        let legacy_checkpoint = if drop_v1_rollback {
+            None
+        } else {
+            Some(committed_frontier)
+        };
 
         let mut actor = actor::Actor::new(
             service.http_client.clone(),
             legacy_checkpoint,
+            metrics,
             publisher,
             shard_tx,
             task,
         );
+        handler.set_phase("running");
         actor.serve(head, tail, session, shard_rx).await
     }
     .await;
 
-    let Err(err) = result else {
-        return Ok(());
+    let err = match result {
+        Ok(()) => {
+            handler.finish_ok();
+            return Ok(());
+        }
+        Err(err) => err,
     };
+    handler.finish_err(&format!("{err:#}"));
 
     // Best-effort broadcast of terminal error to all shards.
     let status = match err.downcast_ref::<tonic::Status>() {
diff --git a/crates/runtime-next/src/leader/materialize/mod.rs b/crates/runtime-next/src/leader/materialize/mod.rs
index 6caee52a03d..3ab43ab62f1 100644
--- a/crates/runtime-next/src/leader/materialize/mod.rs
+++ b/crates/runtime-next/src/leader/materialize/mod.rs
@@ -8,6 +8,44 @@ mod triggers;
 
 pub(crate) use handler::serve;
 
+#[derive(Clone)]
+pub(crate) struct Metrics {
+    /// Total transactions completed by this leader session.
+    transactions: metrics::Counter,
+    /// Aggregate bytes-behind across all bindings, observed at each frontier.
+    bytes_behind: metrics::Gauge,
+}
+
+impl Metrics {
+    pub(crate) fn new(shard_zero: &str) -> Self {
+        static DESCRIBE: std::sync::Once = std::sync::Once::new();
+        DESCRIBE.call_once(|| {
+            metrics::describe_counter!(
+                "runtime_leader_transactions",
+                metrics::Unit::Count,
+                "transactions completed by this leader session",
+            );
+            metrics::describe_gauge!(
+                "runtime_leader_behind",
+                metrics::Unit::Bytes,
+                "aggregate bytes-behind across all bindings, observed when writing stats",
+            );
+        });
+
+        let shard_zero = || shard_zero.to_string();
+        Self {
+            transactions: metrics::counter!(
+                "runtime_leader_transactions",
+                "shard_zero" => shard_zero(),
+            ),
+            bytes_behind: metrics::gauge!(
+                "runtime_leader_behind",
+                "shard_zero" => shard_zero(),
+            ),
+        }
+    }
+}
+
 // Task configuration, as understood by the leader.
 //
 // Several fields express "close" vs "extend" policy thresholds:
diff --git a/crates/runtime-next/src/leader/materialize/startup.rs b/crates/runtime-next/src/leader/materialize/startup.rs
index 90760f81cca..7c49b04458b 100644
--- a/crates/runtime-next/src/leader/materialize/startup.rs
+++ b/crates/runtime-next/src/leader/materialize/startup.rs
@@ -37,6 +37,8 @@ pub(super) struct Startup {
 )]
 pub(super) async fn run(
     build: String,
+    drop_v1_rollback: bool,
+    ops_stats_journal: String,
     reactors: Vec<String>,
     shard_rx: &mut Vec<BoxStream<'static, tonic::Result<proto::Materialize>>>,
     shard_tx: &Vec<mpsc::UnboundedSender<tonic::Result<proto::Materialize>>>,
@@ -77,8 +79,6 @@ pub(super) async fn run(
 
     // Build task definition.
     let proto::Task {
-        ops_stats_journal,
-        ops_stats_spec,
         preview,
         max_transactions,
         spec: spec_bytes,
@@ -94,13 +94,10 @@ pub(super) async fn run(
     let publisher = if preview {
         crate::Publisher::new_preview()
     } else {
-        let ops_stats_spec = ops_stats_spec.as_ref().context("missing ops stats spec")?;
-
         crate::Publisher::new_real(
             shard_ids[0].clone(), // Shard zero is AuthZ subject.
             &service.publisher_factory,
             &ops_stats_journal,
-            ops_stats_spec,
             [], // No additional bindings.
         )
         .context("creating publisher")?
@@ -124,7 +121,6 @@ pub(super) async fn run(
 
     let mut committed_close = uuid::Clock::from_u64(committed_close);
     let hinted_close = uuid::Clock::from_u64(hinted_close);
-    let legacy_checkpoint = legacy_checkpoint.unwrap_or_default();
 
     let mut hinted_frontier = shuffle::Frontier::decode(hinted_frontier.unwrap_or_default())
         .context("validating hinted Frontier")?;
@@ -188,14 +184,21 @@ pub(super) async fn run(
         .collect();
     journal_read_suffix_index.sort();
 
+    // Set when a recovered checkpoint (legacy V1 or connector) is authoritative
+    // and its mapped Frontier replaces `committed_frontier`.
+    let mut committed_frontier_rebuilt = false;
+
     // Handle migration from `legacy_checkpoint`.
-    if !legacy_checkpoint.sources.is_empty() {
+    let legacy_checkpoint_present = legacy_checkpoint.is_some();
+    if let Some(legacy_checkpoint) = legacy_checkpoint {
         let clock = frontier_mapping::extract_committed_close(&legacy_checkpoint);
 
         if clock == Some(committed_close) {
-            tracing::debug!(
-                ?committed_close,
-                "legacy_checkpoint present but matches Recover::committed_close (ignoring)"
+            service_kit::event!(
+                tracing::Level::DEBUG,
+                "leader",
+                committed_close,
+                "legacy_checkpoint present but matches Recover::committed_close (ignoring)",
             );
         } else if let Some(clock) = clock {
             // Implementation error: these update together and should always sync.
@@ -203,21 +206,27 @@ pub(super) async fn run(
                 "legacy_checkpoint has clock {clock:?} that doesn't match Recover's committed_close ({committed_close:?})"
             );
         } else {
-            tracing::debug!(
-                ?committed_close,
-                ?legacy_checkpoint,
-                "legacy_checkpoint doesn't contain committed-close-clock; treating as authoritative"
+            service_kit::event!(
+                tracing::Level::DEBUG,
+                "leader",
+                committed_close,
+                "legacy_checkpoint doesn't contain committed-close-clock; treating as authoritative",
             );
             committed_frontier = frontier_mapping::checkpoint_to_frontier(
                 &legacy_checkpoint.sources,
                 &journal_read_suffix_index,
             )
             .context("mapping recovered legacy checkpoint into Frontier")?;
+            committed_frontier_rebuilt = true;
 
             pending_ack_intents = legacy_checkpoint.ack_intents;
         }
     } else {
-        tracing::debug!("no legacy_checkpoint present");
+        service_kit::event!(
+            tracing::Level::DEBUG,
+            "leader",
+            "no legacy_checkpoint present",
+        );
     }
 
     // Handle a `connector_checkpoint` from remote-authoritative connectors.
@@ -227,17 +236,20 @@ pub(super) async fn run(
         let clock = frontier_mapping::extract_committed_close(&connector_checkpoint);
 
         if clock == Some(committed_close) {
-            tracing::debug!(
-                ?committed_close,
-                "connector_checkpoint present but matches Recover::committed_close (ignoring)"
+            service_kit::event!(
+                tracing::Level::DEBUG,
+                "leader",
+                committed_close,
+                "connector_checkpoint present but matches Recover::committed_close (ignoring)",
             );
         } else if clock == Some(hinted_close) {
             // Connector declares that the hinted txn did in fact commit.
-            tracing::debug!(
-                ?committed_close,
-                ?hinted_close,
-                ?hinted_frontier,
-                "connector_checkpoint present and matches Recover::hinted_close; applying delta"
+            service_kit::event!(
+                tracing::Level::DEBUG,
+                "leader",
+                committed_close,
+                hinted_close,
+                "connector_checkpoint present and matches Recover::hinted_close; applying delta",
             );
             committed_close = hinted_close;
             committed_frontier = committed_frontier.reduce(std::mem::take(&mut hinted_frontier));
@@ -250,10 +262,11 @@ pub(super) async fn run(
                  committed_close ({committed_close:?}) or hinted_close ({hinted_close:?})"
             );
         } else {
-            tracing::debug!(
-                ?committed_close,
-                ?connector_checkpoint,
-                "connector_checkpoint doesn't contain committed-close-clock; treating as authoritative"
+            service_kit::event!(
+                tracing::Level::DEBUG,
+                "leader",
+                committed_close,
+                "connector_checkpoint doesn't contain committed-close-clock; treating as authoritative",
             );
 
             committed_frontier = frontier_mapping::checkpoint_to_frontier(
@@ -261,11 +274,47 @@ pub(super) async fn run(
                 &journal_read_suffix_index,
             )
             .context("mapping recovered connector checkpoint into Frontier")?;
+            committed_frontier_rebuilt = true;
 
             pending_ack_intents = connector_checkpoint.ack_intents;
         }
     } else {
-        tracing::debug!("no connector_checkpoint present");
+        service_kit::event!(
+            tracing::Level::DEBUG,
+            "leader",
+            "no connector_checkpoint present",
+        );
+    }
+
+    // Reconcile RocksDB now that the final status of the recovered V1 and
+    // connector checkpoints is known. If `committed_frontier_rebuilt`, then
+    // `committed_frontier` is not natively represented in RocksDB and must be
+    // persisted (clearing stale state). This establishes a baseline for future
+    // recoveries. Go-forward commits are deltas that apply atop this base.
+    let delete_legacy_checkpoint = drop_v1_rollback && legacy_checkpoint_present;
+    if committed_frontier_rebuilt || delete_legacy_checkpoint {
+        service_kit::event!(
+            tracing::Level::INFO,
+            "leader",
+            committed_frontier_rebuilt,
+            delete_legacy_checkpoint,
+            "reconciling recovered checkpoint state",
+        );
+        send_persist(
+            &mut shard_rx[0],
+            &shard_tx[0],
+            &task.peers[0],
+            proto::Persist {
+                seq_no: 0,
+                delete_committed_frontier: committed_frontier_rebuilt,
+                committed_frontier: committed_frontier_rebuilt
+                    .then(|| shuffle::JournalFrontier::encode(&committed_frontier.journals)),
+                delete_legacy_checkpoint,
+                ..Default::default()
+            },
+        )
+        .await
+        .context("sending startup cleanup Persist")?;
     }
 
     // Compose the session resume Frontier: project the recovered hinted
@@ -326,6 +375,31 @@ async fn recv_recovers(
     Ok(recovers.swap_remove(0))
 }
 
+/// Send a `Persist` to a shard and await the matching `Persisted` echo.
+async fn send_persist(
+    rx: &mut BoxStream<'static, tonic::Result<proto::Materialize>>,
+    tx: &mpsc::UnboundedSender<tonic::Result<proto::Materialize>>,
+    peer: &str,
+    persist: proto::Persist,
+) -> anyhow::Result<()> {
+    let verify = crate::verify("Materialize", "Persisted", peer);
+    let seq_no = persist.seq_no;
+
+    // Sends are best-effort: a closed peer surfaces on the next `rx`.
+    let _ = tx.send(Ok(proto::Materialize {
+        persist: Some(persist),
+        ..Default::default()
+    }));
+
+    match verify.not_eof(rx.next().await)? {
+        proto::Materialize {
+            persisted: Some(proto::Persisted { seq_no: got }),
+            ..
+        } if got == seq_no => Ok(()),
+        other => Err(verify.fail_msg(other)),
+    }
+}
+
 // The apply loop's persistent state machine is `(last_applied,
 // connector_state_json)`. Each iteration may persist new connector state
 // patches; `last_applied` is bumped only on the FINAL iteration once the
@@ -343,7 +417,6 @@ async fn apply_loop(
     connector_state_json: &mut Bytes,
 ) -> anyhow::Result<()> {
     let verify_applied = crate::verify("Materialize", "Applied", peer);
-    let verify_persisted = crate::verify("Materialize", "Persisted", peer);
     let last_version = if last_applied.is_empty() {
         String::new()
     } else {
@@ -378,14 +451,14 @@ async fn apply_loop(
                     }),
                 ..
             } => {
-                tracing::info!(
+                let patches_clone: bytes::Bytes = connector_patches_json.clone();
+                service_kit::event!(
+                    tracing::Level::INFO,
+                    "leader",
                     iteration,
-                    action_description,
-                    patches = ?ops::DebugJson(
-                        serde_json::from_slice::<models::RawValue>(&connector_patches_json)
-                            .unwrap_or_default()
-                    ),
-                    "connector Apply completed"
+                    action_description = action_description.clone(),
+                    patches = service_kit::event::debug(patches_clone),
+                    "connector Apply completed",
                 );
                 connector_patches_json
             }
@@ -393,28 +466,28 @@ async fn apply_loop(
         };
 
         if applied_patches_json.is_empty() {
-            tracing::debug!(iteration, "apply loop complete");
+            service_kit::event!(
+                tracing::Level::DEBUG,
+                "leader",
+                iteration,
+                "apply loop complete",
+            );
 
             if last_applied == next_applied {
                 return Ok(());
             }
 
-            let _ = tx.send(Ok(proto::Materialize {
-                persist: Some(proto::Persist {
-                    nonce: iteration,
+            send_persist(
+                rx,
+                tx,
+                peer,
+                proto::Persist {
+                    seq_no: iteration,
                     last_applied: next_applied.clone(),
                     ..Default::default()
-                }),
-                ..Default::default()
-            }));
-
-            match verify_persisted.not_eof(rx.next().await)? {
-                proto::Materialize {
-                    persisted: Some(proto::Persisted { nonce }),
-                    ..
-                } if nonce == iteration => {}
-                other => return Err(verify_persisted.fail_msg(other)),
-            }
+                },
+            )
+            .await?;
 
             return Ok(());
         }
@@ -425,23 +498,17 @@ async fn apply_loop(
             crate::patches::apply_state_patches(connector_state_json, &applied_patches_json)?;
 
         // Persist the iteration's patches to shard zero.
-        let _ = tx.send(Ok(proto::Materialize {
-            persist: Some(proto::Persist {
-                nonce: iteration, // End-of-sequence.
+        send_persist(
+            rx,
+            tx,
+            peer,
+            proto::Persist {
+                seq_no: iteration, // End-of-sequence.
                 connector_patches_json: applied_patches_json,
                 ..Default::default()
-            }),
-            ..Default::default()
-        }));
-
-        // Receive Persisted.
-        match verify_persisted.not_eof(rx.next().await)? {
-            proto::Materialize {
-                persisted: Some(proto::Persisted { nonce }),
-                ..
-            } if nonce == iteration => {}
-            other => return Err(verify_persisted.fail_msg(other)),
-        }
+            },
+        )
+        .await?;
     }
 
     anyhow::bail!(
@@ -516,9 +583,9 @@ mod tests {
         }
     }
 
-    fn persisted(nonce: u64) -> proto::Materialize {
+    fn persisted(seq_no: u64) -> proto::Materialize {
         proto::Materialize {
-            persisted: Some(proto::Persisted { nonce }),
+            persisted: Some(proto::Persisted { seq_no }),
             ..Default::default()
         }
     }
@@ -550,7 +617,7 @@ mod tests {
     #[tokio::test]
     async fn apply_loop_persists_last_applied_when_no_patches_but_spec_changed() {
         // No patches but next != last: loop sends Apply, then Persist
-        // marking next_applied as the new last_applied with matching nonce.
+        // marking next_applied as the new last_applied with matching seq_no.
         let (mut rx, peer_tx, leader_tx, mut leader_rx) = channel_pair();
         peer_tx.send(Ok(applied(b""))).unwrap();
         peer_tx.send(Ok(persisted(1))).unwrap();
@@ -570,7 +637,7 @@ mod tests {
 
         let m2 = leader_rx.try_recv().unwrap().unwrap();
         let p = m2.persist.unwrap();
-        assert_eq!(p.nonce, 1);
+        assert_eq!(p.seq_no, 1);
         assert_eq!(p.last_applied, next);
         assert!(p.connector_patches_json.is_empty());
 
@@ -610,7 +677,7 @@ mod tests {
         );
         // Persist iter 1 carries the connector's patches but no last_applied.
         let p1 = leader_rx.try_recv().unwrap().unwrap().persist.unwrap();
-        assert_eq!(p1.nonce, 1);
+        assert_eq!(p1.seq_no, 1);
         assert!(p1.last_applied.is_empty());
         assert_eq!(p1.connector_patches_json.as_ref(), patch1);
 
@@ -622,7 +689,7 @@ mod tests {
             serde_json::json!({"nested":{"a":1},"keep":"v1","drop":"x"}),
         );
         let p2 = leader_rx.try_recv().unwrap().unwrap().persist.unwrap();
-        assert_eq!(p2.nonce, 2);
+        assert_eq!(p2.seq_no, 2);
         assert!(p2.last_applied.is_empty());
         assert_eq!(p2.connector_patches_json.as_ref(), patch2);
 
@@ -635,7 +702,7 @@ mod tests {
         );
         // Final Persist promotes spec and carries no patches.
         let p3 = leader_rx.try_recv().unwrap().unwrap().persist.unwrap();
-        assert_eq!(p3.nonce, 3);
+        assert_eq!(p3.seq_no, 3);
         assert_eq!(p3.last_applied, next);
         assert!(p3.connector_patches_json.is_empty());
 
@@ -660,16 +727,16 @@ mod tests {
                 // Connector returns patches forever; we cap at MAX_APPLY_ITERATIONS.
                 name: "no_convergence",
                 seed: |tx| {
-                    for nonce in 1..=4 {
+                    for seq_no in 1..=4 {
                         tx.send(Ok(applied(b"[{\"x\":1}\n]"))).unwrap();
-                        tx.send(Ok(persisted(nonce))).unwrap();
+                        tx.send(Ok(persisted(seq_no))).unwrap();
                     }
                 },
                 expect: "did not converge",
             },
             Case {
-                // Peer returns Persisted with a wrong nonce — protocol error.
-                name: "persisted_nonce_mismatch",
+                // Peer returns Persisted with a wrong seq_no — protocol error.
+                name: "persisted_seq_no_mismatch",
                 seed: |tx| {
                     tx.send(Ok(applied(b"[{\"x\":1}\n]"))).unwrap();
                     tx.send(Ok(persisted(99))).unwrap();
diff --git a/crates/runtime-next/src/leader/materialize/task.rs b/crates/runtime-next/src/leader/materialize/task.rs
index 8db1c29b722..dcee0e583b8 100644
--- a/crates/runtime-next/src/leader/materialize/task.rs
+++ b/crates/runtime-next/src/leader/materialize/task.rs
@@ -80,12 +80,11 @@ impl Task {
 
         // Close-policy thresholds, many with placeholder defaults.
         // TODO: thread these through from the spec once they're supported there.
-        let open_duration: std::ops::Range<std::time::Duration> =
-            min_txn_duration..max_txn_duration;
-        let last_close_age = std::time::Duration::ZERO..std::time::Duration::from_secs(300);
         let combiner_usage_bytes = 0..(30 * 1024 * 1024 * 1024);
-        let read_docs = 0..u64::MAX;
+        let last_close_age = std::time::Duration::ZERO..std::time::Duration::MAX;
+        let open_duration = min_txn_duration..max_txn_duration;
         let read_bytes = 0..u64::MAX;
+        let read_docs = 0..u64::MAX;
 
         Ok(Self {
             binding_collection_names,
diff --git a/crates/runtime-next/src/leader/materialize/triggers.rs b/crates/runtime-next/src/leader/materialize/triggers.rs
index 9e4975f8b18..77302e6ddf5 100644
--- a/crates/runtime-next/src/leader/materialize/triggers.rs
+++ b/crates/runtime-next/src/leader/materialize/triggers.rs
@@ -52,7 +52,9 @@ pub async fn fire_pending_triggers(
     .await
     .context("trigger webhook delivery failed")?;
 
-    tracing::info!(
+    service_kit::event!(
+        tracing::Level::INFO,
+        "leader",
         num_triggers = compiled.configs.len(),
         elapsed_ms = started_at.elapsed().as_millis() as u64,
         "trigger webhooks delivered successfully",
@@ -174,24 +176,28 @@ async fn send_single_webhook(
                     );
                 }
 
-                tracing::warn!(
+                service_kit::event!(
+                    tracing::Level::WARN,
+                    "trigger",
                     trigger_index = index,
-                    url = %trigger.url,
-                    %status,
-                    attempt = attempt + 1,
+                    url = trigger.url.clone(),
+                    status = status.as_u16(),
+                    attempt,
                     total_attempts,
-                    "trigger webhook received non-success response, will retry"
+                    "trigger webhook received non-success response, will retry",
                 );
             }
             Err(err) => {
                 last_err = err.to_string();
-                tracing::warn!(
+                service_kit::event!(
+                    tracing::Level::WARN,
+                    "trigger",
                     trigger_index = index,
-                    url = %trigger.url,
-                    error = %err,
-                    attempt = attempt + 1,
+                    url = trigger.url.clone(),
+                    error = service_kit::event::lazy(move || err.to_string()),
+                    attempt,
                     total_attempts,
-                    "trigger webhook request failed, will retry"
+                    "trigger webhook request failed, will retry",
                 );
             }
         }
diff --git a/crates/runtime-next/src/leader/mod.rs b/crates/runtime-next/src/leader/mod.rs
index 04bfe0cab67..54ec8545246 100644
--- a/crates/runtime-next/src/leader/mod.rs
+++ b/crates/runtime-next/src/leader/mod.rs
@@ -11,3 +11,13 @@ mod materialize;
 // mod capture; // TODO: implement.
 
 pub use service::Service;
+
+/// Shard-label feature flag (under the `estuary.dev/flag/` prefix) that, when
+/// set to `"true"`, tells the leader to drop V1 rollback support for the task.
+const DROP_V1_ROLLBACK_FLAG: &str = "drop-runtime-v1-rollback";
+
+/// Reports whether `flags` (an `ops::ShardLabeling.flags` map) sets `flag` to
+/// `"true"`, mirroring the Go runtime's feature-flag convention.
+fn flag_enabled(flags: &std::collections::BTreeMap<String, String>, flag: &str) -> bool {
+    flags.get(flag).map(String::as_str) == Some("true")
+}
diff --git a/crates/runtime-next/src/leader/service.rs b/crates/runtime-next/src/leader/service.rs
index b92b81cd6b8..eeabc55c6b9 100644
--- a/crates/runtime-next/src/leader/service.rs
+++ b/crates/runtime-next/src/leader/service.rs
@@ -18,18 +18,22 @@ pub struct ServiceImpl {
     pub(crate) publisher_factory: gazette::journal::ClientFactory,
     /// Process-wide HTTP client used by the actor to deliver trigger webhooks.
     pub(crate) http_client: reqwest::Client,
+    /// Registry of in-flight Leader session handlers, for the admin surface.
+    pub(crate) registry: service_kit::Registry,
 }
 
 impl Service {
     pub fn new(
         shuffle_service: shuffle::Service,
         publisher_factory: gazette::journal::ClientFactory,
+        registry: service_kit::Registry,
     ) -> Self {
         Self(Arc::new(ServiceImpl {
             materialize_joins: std::sync::Mutex::new(HashMap::new()),
             shuffle_service,
             publisher_factory,
             http_client: reqwest::Client::new(),
+            registry,
         }))
     }
 
diff --git a/crates/runtime-next/src/publish.rs b/crates/runtime-next/src/publish.rs
index 4ef8a81b4c0..2fcf695184b 100644
--- a/crates/runtime-next/src/publish.rs
+++ b/crates/runtime-next/src/publish.rs
@@ -11,12 +11,11 @@
 //!   print to stdout in the `["{collection}",{...doc...}]` format used by
 //!   `flowctl preview`.
 //!
-//! Construction is decided in `startup::run` based on the presence of
-//! ops_logs / ops_stats specs in `L:Open`: present ⇒ `Real`, absent ⇒
-//! `Preview`. The leader actor parks the `Publisher` across IO futures.
+//! Construction is decided in `startup::run` based on the `preview` flag in
+//! `L:Task`: `false` ⇒ `Real`, `true` ⇒ `Preview`. The leader actor parks the
+//! `Publisher` across IO futures.
 
 use bytes::Bytes;
-use proto_flow::flow;
 use proto_gazette::uuid;
 use std::collections::BTreeMap;
 
@@ -36,28 +35,24 @@ pub enum Publisher {
 }
 
 impl Publisher {
-    /// Build a real `Publisher` backed by a `publisher::Publisher` for
-    /// `ops_logs_spec` / `ops_stats_spec` journals plus any additional
-    /// supplied collection specs.
+    /// Build a real `Publisher` backed by a `publisher::Publisher` for the
+    /// pre-created `ops_stats_journal` plus any additional supplied collection
+    /// specs.
     pub fn new_real<'a, I>(
         authz_subject: String,
         client_factory: &gazette::journal::ClientFactory,
         ops_stats_journal: &str,
-        ops_stats_spec: &flow::CollectionSpec,
         collection_specs: I,
     ) -> anyhow::Result<Self>
     where
-        I: IntoIterator<Item = &'a flow::CollectionSpec>,
+        I: IntoIterator<Item = &'a proto_flow::flow::CollectionSpec>,
     {
         let mut bindings = Vec::new();
 
-        bindings.push(publisher::Binding::from_collection_spec(
-            ops_stats_spec,
-            Some(ops_stats_journal),
-        )?);
+        bindings.push(publisher::Binding::for_fixed_journal(ops_stats_journal));
 
         for spec in collection_specs {
-            bindings.push(publisher::Binding::from_collection_spec(spec, None)?);
+            bindings.push(publisher::Binding::from_collection_spec(spec)?);
         }
 
         let mut producer: [u8; 6] = rand::random();
@@ -101,7 +96,7 @@ impl Publisher {
             Self::Real(p) => {
                 p.enqueue(
                     |uuid| {
-                        // Binding index 0 is ops_stats_spec.
+                        // Binding index 0 is the fixed ops_stats journal.
                         stats.meta.as_mut().unwrap().uuid = uuid.to_string();
                         (0, serde_json::to_value(&stats).unwrap())
                     },
diff --git a/crates/runtime-next/src/shard/materialize/actor.rs b/crates/runtime-next/src/shard/materialize/actor.rs
index 8ef18bd9c60..da5faad22bc 100644
--- a/crates/runtime-next/src/shard/materialize/actor.rs
+++ b/crates/runtime-next/src/shard/materialize/actor.rs
@@ -51,6 +51,8 @@ pub(super) struct Actor {
     // committed at transaction close (and not before; this lets us filter keys
     // above "committed" but below "current" during scans).
     max_keys: Vec<(Bytes, Bytes)>,
+    // Per-session metrics counters.
+    metrics: super::Metrics,
 }
 
 impl Actor {
@@ -62,6 +64,7 @@ impl Actor {
         disable_load_optimization: bool,
         leader_tx: mpsc::UnboundedSender<proto::Materialize>,
         max_keys: Vec<(Bytes, Bytes)>,
+        metrics: super::Metrics,
     ) -> Self {
         Self {
             bindings,
@@ -74,6 +77,7 @@ impl Actor {
             leader_tx,
             load_keys: Default::default(),
             max_keys,
+            metrics,
         }
     }
 
@@ -139,10 +143,20 @@ impl Actor {
                     let (accumulator, shuffle_reader, shuffle_remainders, active) =
                         scanner.into_parts();
 
+                    let combiner_bytes = accumulator.combiner_byte_usage();
+                    service_kit::event!(
+                        tracing::Level::DEBUG,
+                        "leader",
+                        active_bindings = active.len(),
+                        combiner_bytes,
+                        "sending L:Loaded after frontier scan",
+                    );
+                    self.metrics.scans_completed.increment(1);
+
                     _ = self.leader_tx.send(proto::Materialize {
                         loaded: Some(proto::materialize::Loaded {
                             bindings: active.into_values().collect(),
-                            combiner_usage_bytes: accumulator.combiner_byte_usage(),
+                            combiner_usage_bytes: combiner_bytes,
                         }),
                         ..Default::default()
                     });
@@ -161,6 +175,14 @@ impl Actor {
                     let (accumulator, shuffle_reader, shuffle_remainders, active) =
                         drainer.into_parts()?;
 
+                    service_kit::event!(
+                        tracing::Level::DEBUG,
+                        "leader",
+                        active_bindings = active.len(),
+                        "sending L:Stored after memtable drain",
+                    );
+                    self.metrics.drains_completed.increment(1);
+
                     _ = self.leader_tx.send(proto::Materialize {
                         stored: Some(proto::materialize::Stored { bindings: active }),
                         ..Default::default()
@@ -197,8 +219,17 @@ impl Actor {
                 // Next, a Persist completion.
                 result = maybe_fut(&mut self.db_persist_fut) => {
                     let (db, persisted) = result?;
+                    let seq_no = persisted.seq_no;
                     self.db = Some(db);
 
+                    service_kit::event!(
+                        tracing::Level::DEBUG,
+                        "leader",
+                        seq_no,
+                        "RocksDB persist completed; sending L:Persisted",
+                    );
+                    self.metrics.persists.increment(1);
+
                     _ = self.leader_tx.send(proto::Materialize {
                         persisted: Some(persisted),
                         ..Default::default()
@@ -348,7 +379,7 @@ impl Actor {
                 ..Default::default()
             });
         } else if let Some(persist) = msg.persist {
-            let nonce = persist.nonce;
+            let seq_no = persist.seq_no;
 
             let (db, binding_state_keys) = self
                 .db
@@ -358,7 +389,7 @@ impl Actor {
             self.db_persist_fut = Some(
                 async move {
                     let db = db.persist(&persist, &binding_state_keys).await?;
-                    Ok(((db, binding_state_keys), proto::Persisted { nonce }))
+                    Ok(((db, binding_state_keys), proto::Persisted { seq_no }))
                 }
                 .boxed(),
             );
@@ -388,6 +419,9 @@ impl Actor {
             active.loaded_docs_total += 1;
             active.loaded_bytes_total += doc_json.len() as u64;
 
+            self.metrics.loaded_docs.increment(1);
+            self.metrics.loaded_bytes.increment(doc_json.len() as u64);
+
             // C:Loaded responses arrive at the connector's pace, which may
             // straddle phase transitions:
             // * Phase::Scanning — a common case, mid-scan response.
@@ -520,6 +554,7 @@ mod tests {
                 load_keys: Default::default(),
                 flushed: HashMap::new(),
                 max_keys: Vec::new(),
+                metrics: super::super::Metrics::new("test/shard"),
             },
             leader_rx,
             connector_rx,
@@ -621,6 +656,7 @@ mod tests {
             load_keys: Default::default(),
             flushed: HashMap::new(),
             max_keys: Vec::new(),
+            metrics: super::super::Metrics::new("test/shard"),
         };
 
         let accumulator =
@@ -755,11 +791,11 @@ mod tests {
         let resp = actor_to_leader_rx.recv().await.unwrap();
         assert!(resp.started_commit.is_some());
 
-        // 5) L:Persist → RocksDB write → L:Persisted echoes nonce.
+        // 5) L:Persist → RocksDB write → L:Persisted echoes seq_no.
         leader_to_actor_tx
             .send(Ok(proto::Materialize {
                 persist: Some(proto::Persist {
-                    nonce: 42,
+                    seq_no: 42,
                     last_applied: Bytes::from_static(b"persisted-spec-bytes"),
                     ..Default::default()
                 }),
@@ -768,7 +804,7 @@ mod tests {
             .unwrap();
 
         let resp = actor_to_leader_rx.recv().await.unwrap();
-        assert_eq!(resp.persisted.unwrap().nonce, 42);
+        assert_eq!(resp.persisted.unwrap().seq_no, 42);
 
         // 6) Controller Stop + CloseNow → forwarded to the leader.
         controller_to_actor_tx
diff --git a/crates/runtime-next/src/shard/materialize/connector.rs b/crates/runtime-next/src/shard/materialize/connector.rs
index 8e82716c109..06cff02c0b0 100644
--- a/crates/runtime-next/src/shard/materialize/connector.rs
+++ b/crates/runtime-next/src/shard/materialize/connector.rs
@@ -11,13 +11,13 @@ use zeroize::Zeroize;
 // plus OpenExtras with decrypted trigger configs and connector metadata.
 pub async fn start<L: crate::LogHandler>(
     service: &crate::shard::Service<L>,
+    log_level: ops::LogLevel,
     mut initial: materialize::Request,
 ) -> anyhow::Result<(
     mpsc::Sender<materialize::Request>,
     BoxStream<'static, tonic::Result<materialize::Response>>,
     Option<crate::proto::Container>,
 )> {
-    let log_level = initial.get_internal()?.log_level();
     let (endpoint, config_json, connector_type, catalog_name) = extract_endpoint(&mut initial)?;
     let (connector_tx, connector_rx) = mpsc::channel(crate::CHANNEL_BUFFER);
 
diff --git a/crates/runtime-next/src/shard/materialize/handler.rs b/crates/runtime-next/src/shard/materialize/handler.rs
index 5d06ee2fc2b..4391e6320b5 100644
--- a/crates/runtime-next/src/shard/materialize/handler.rs
+++ b/crates/runtime-next/src/shard/materialize/handler.rs
@@ -4,6 +4,7 @@ use anyhow::Context;
 use futures::StreamExt;
 use proto_flow::materialize;
 use tokio::sync::mpsc;
+use tracing::Instrument;
 
 pub(crate) async fn serve<R, L: crate::LogHandler>(
     service: crate::shard::Service<L>,
@@ -34,25 +35,34 @@ where
             }
 
             proto::Materialize {
-                spec: Some(spec), ..
+                spec: Some(spec),
+                log_level,
+                ..
             } => {
+                let log_level =
+                    ops::LogLevel::try_from(log_level).unwrap_or(ops::LogLevel::UndefinedLevel);
+                service.set_log_level(log_level);
                 let request = materialize::Request {
                     spec: Some(spec),
                     ..Default::default()
                 };
-                let response = serve_unary(&service, request).await?;
+                let response = serve_unary(&service, request, log_level).await?;
                 _ = controller_tx.send(Ok(response));
             }
 
             proto::Materialize {
                 validate: Some(validate),
+                log_level,
                 ..
             } => {
+                let log_level =
+                    ops::LogLevel::try_from(log_level).unwrap_or(ops::LogLevel::UndefinedLevel);
+                service.set_log_level(log_level);
                 let request = materialize::Request {
                     validate: Some(validate),
                     ..Default::default()
                 };
-                let response = serve_unary(&service, request).await?;
+                let response = serve_unary(&service, request, log_level).await?;
                 _ = controller_tx.send(Ok(response));
             }
 
@@ -65,12 +75,14 @@ where
 pub async fn serve_unary<L: crate::LogHandler>(
     service: &crate::shard::Service<L>,
     request: materialize::Request,
+    log_level: ops::LogLevel,
 ) -> anyhow::Result<proto::Materialize> {
     let is_spec = request.spec.is_some();
     let is_validate = request.validate.is_some();
     let is_apply = request.apply.is_some();
 
-    let (connector_tx, mut connector_rx, _container) = connector::start(service, request).await?;
+    let (connector_tx, mut connector_rx, _container) =
+        connector::start(service, log_level, request).await?;
     std::mem::drop(connector_tx); // Send EOF.
 
     // Read connector response, and verify it matches the request type.
@@ -146,6 +158,27 @@ async fn serve_session<R, L: crate::LogHandler>(
     db: crate::shard::RocksDB,
     join: proto::Join,
 ) -> anyhow::Result<crate::shard::RocksDB>
+where
+    R: futures::Stream<Item = tonic::Result<proto::Materialize>> + Send + Unpin + 'static,
+{
+    // Run the whole session inside its handler span so operator trace overrides
+    // (see `service_kit::trace`) reach every log line — the actor loop's
+    // periodic instrumentation included.
+    let handler = service.registry.register("shard.materialize");
+    let span = handler.span();
+    serve_session_inner(service, controller_rx, controller_tx, db, join, handler)
+        .instrument(span)
+        .await
+}
+
+async fn serve_session_inner<R, L: crate::LogHandler>(
+    service: &crate::shard::Service<L>,
+    controller_rx: &mut R,
+    controller_tx: &mpsc::UnboundedSender<tonic::Result<proto::Materialize>>,
+    db: crate::shard::RocksDB,
+    join: proto::Join,
+    mut handler: service_kit::HandlerGuard,
+) -> anyhow::Result<crate::shard::RocksDB>
 where
     R: futures::Stream<Item = tonic::Result<proto::Materialize>> + Send + Unpin + 'static,
 {
@@ -160,10 +193,28 @@ where
         .context("missing shard for shard index")?;
 
     let labeling = labeling.as_ref().context("missing shard labeling")?.clone();
+    let log_level = labeling.log_level();
     let shard_id = shard_id.clone();
     let shard_index = join.shard_index;
     let shuffle_directory = join.shuffle_directory.clone();
 
+    service.set_log_level(log_level);
+
+    handler.set_label(&shard_id);
+    handler.set_field("shard_index", shard_index);
+    handler.set_field("etcd_mod_revision", join.etcd_mod_revision);
+    handler.set_phase("joining");
+
+    let metrics = super::Metrics::new(&shard_id);
+
+    service_kit::event!(
+        tracing::Level::INFO,
+        "leader",
+        shard_index,
+        leader_endpoint = join.leader_endpoint.clone(),
+        "dialing leader and sending Join",
+    );
+
     let (joined, leader_stream) = startup::dial_and_join(join).await?;
 
     // Forward Joined to controller.
@@ -172,9 +223,18 @@ where
         ..Default::default()
     }));
     let Some((leader_tx, leader_rx)) = leader_stream else {
+        service_kit::event!(
+            tracing::Level::DEBUG,
+            "leader",
+            "leader returned non-zero max_etcd_revision; controller must retry Join",
+        );
+        handler.set_phase("awaiting-retry");
+        handler.finish_ok();
         return Ok(db); // Controller must retry Join/Joined.
     };
 
+    handler.set_phase("starting");
+
     let startup::Startup {
         accumulator,
         bindings,
@@ -194,6 +254,7 @@ where
         labeling,
         leader_rx,
         leader_tx,
+        log_level,
         service,
         shard_id,
         shard_index,
@@ -201,7 +262,9 @@ where
     )
     .await?;
 
-    let db = super::actor::Actor::new(
+    handler.set_phase("running");
+
+    let result = super::actor::Actor::new(
         bindings,
         binding_state_keys,
         connector_tx,
@@ -209,6 +272,7 @@ where
         disable_load_optimization,
         leader_tx,
         max_keys,
+        metrics,
     )
     .serve(
         accumulator,
@@ -217,7 +281,18 @@ where
         &mut leader_rx,
         shuffle_reader,
     )
-    .await?;
+    .await;
+
+    let db = match result {
+        Ok(db) => {
+            handler.finish_ok();
+            db
+        }
+        Err(err) => {
+            handler.finish_err(&format!("{err:#}"));
+            return Err(err);
+        }
+    };
 
     _ = controller_tx.send(Ok(proto::Materialize {
         stopped: Some(proto::Stopped {}),
diff --git a/crates/runtime-next/src/shard/materialize/mod.rs b/crates/runtime-next/src/shard/materialize/mod.rs
index 54e9f11c869..c52371becc6 100644
--- a/crates/runtime-next/src/shard/materialize/mod.rs
+++ b/crates/runtime-next/src/shard/materialize/mod.rs
@@ -8,6 +8,77 @@ mod task;
 
 pub(crate) use handler::serve;
 
+#[derive(Clone)]
+pub(crate) struct Metrics {
+    /// RocksDB persists committed by this session.
+    persists: metrics::Counter,
+    /// Connector C:Loaded responses received.
+    loaded_docs: metrics::Counter,
+    /// Total bytes of C:Loaded document JSON received.
+    loaded_bytes: metrics::Counter,
+    /// Frontier scans completed (one per leader L:Load).
+    scans_completed: metrics::Counter,
+    /// Memtable drains completed (one per leader L:Store).
+    drains_completed: metrics::Counter,
+}
+
+impl Metrics {
+    pub(crate) fn new(shard_id: &str) -> Self {
+        static DESCRIBE: std::sync::Once = std::sync::Once::new();
+        DESCRIBE.call_once(|| {
+            metrics::describe_counter!(
+                "runtime_shard_materialize_persists",
+                metrics::Unit::Count,
+                "RocksDB persists committed by this session",
+            );
+            metrics::describe_counter!(
+                "runtime_shard_materialize_loaded_docs",
+                metrics::Unit::Count,
+                "connector C:Loaded responses received",
+            );
+            metrics::describe_counter!(
+                "runtime_shard_materialize_loaded_bytes",
+                metrics::Unit::Bytes,
+                "total bytes of C:Loaded document JSON received",
+            );
+            metrics::describe_counter!(
+                "runtime_shard_materialize_scans_completed",
+                metrics::Unit::Count,
+                "frontier scans completed (one per leader L:Load)",
+            );
+            metrics::describe_counter!(
+                "runtime_shard_materialize_drains_completed",
+                metrics::Unit::Count,
+                "memtable drains completed (one per leader L:Store)",
+            );
+        });
+
+        let shard_id = || shard_id.to_string();
+        Self {
+            persists: metrics::counter!(
+                "runtime_shard_materialize_persists",
+                "shard_id" => shard_id(),
+            ),
+            loaded_docs: metrics::counter!(
+                "runtime_shard_materialize_loaded_docs",
+                "shard_id" => shard_id(),
+            ),
+            loaded_bytes: metrics::counter!(
+                "runtime_shard_materialize_loaded_bytes",
+                "shard_id" => shard_id(),
+            ),
+            scans_completed: metrics::counter!(
+                "runtime_shard_materialize_scans_completed",
+                "shard_id" => shard_id(),
+            ),
+            drains_completed: metrics::counter!(
+                "runtime_shard_materialize_drains_completed",
+                "shard_id" => shard_id(),
+            ),
+        }
+    }
+}
+
 #[derive(Debug)]
 struct Binding {
     collection_name: String,             // Source collection.
diff --git a/crates/runtime-next/src/shard/materialize/startup.rs b/crates/runtime-next/src/shard/materialize/startup.rs
index efbca991ecb..b649f0fd725 100644
--- a/crates/runtime-next/src/shard/materialize/startup.rs
+++ b/crates/runtime-next/src/shard/materialize/startup.rs
@@ -81,6 +81,7 @@ pub(super) async fn run<R, L: crate::LogHandler>(
     labeling: ops::proto::ShardLabeling,
     mut leader_rx: tonic::Streaming<proto::Materialize>,
     leader_tx: mpsc::UnboundedSender<proto::Materialize>,
+    log_level: ops::LogLevel,
     service: &crate::shard::Service<L>,
     shard_id: String,
     shard_index: u32,
@@ -107,8 +108,6 @@ where
 
     let proto::Task {
         max_transactions: _,
-        ops_stats_journal,
-        ops_stats_spec,
         preview,
         spec: spec_bytes,
     } = l_task;
@@ -126,13 +125,10 @@ where
     let publisher = if preview {
         crate::Publisher::new_preview()
     } else {
-        let ops_stats_spec = ops_stats_spec.as_ref().context("missing ops stats spec")?;
-
         crate::Publisher::new_real(
             shard_id, // Shard ID is AuthZ subject.
             &service.publisher_factory,
-            &ops_stats_journal,
-            ops_stats_spec,
+            &labeling.stats_journal,
             [], // No additional bindings.
         )
         .context("creating publisher")?
@@ -204,6 +200,7 @@ where
                             apply: Some(apply),
                             ..Default::default()
                         },
+                        log_level,
                     )
                     .await?,
                 );
@@ -219,7 +216,7 @@ where
 
                 _ = leader_tx.send(proto::Materialize {
                     persisted: Some(proto::Persisted {
-                        nonce: persist.nonce,
+                        seq_no: persist.seq_no,
                     }),
                     ..Default::default()
                 });
@@ -254,7 +251,7 @@ where
         ..Default::default()
     };
     let (connector_tx, mut connector_rx, container) =
-        super::connector::start(service, initial).await?;
+        super::connector::start(service, log_level, initial).await?;
 
     // Read C:Opened from the connector.
     let verify = crate::verify("Materialize", "Opened", "connector");
diff --git a/crates/runtime-next/src/shard/recovery.rs b/crates/runtime-next/src/shard/recovery.rs
index fa61a288ffc..805e1bf0c82 100644
--- a/crates/runtime-next/src/shard/recovery.rs
+++ b/crates/runtime-next/src/shard/recovery.rs
@@ -7,6 +7,9 @@
 //! `(key, value)` pair from a full `rocksdb::DB` scan on session startup,
 //! folding singleton state directly into a `proto::Recover` while collecting
 //! frontier entries separately for final sort and proto encoding.
+//! [`prune_committed_frontier`] then drops stale `FC:` entries (conservatively;
+//! see [`FRONTIER_PRUNE_CLOCK_HORIZON`] / [`FRONTIER_PRUNE_BYTE_HORIZON`]) so
+//! `shard::rocksdb` can delete them from the DB before returning `Recover`.
 //!
 //! `{state_key}` below is the binding-stable `state_key` field of
 //! `flow::MaterializationSpec.Binding` — distinct from `journal_read_suffix`,
@@ -41,6 +44,8 @@ pub const PREFIX_HINTED_FRONTIER_END: &[u8] = b"FH;";
 /// Key prefix for committed Frontier entries:
 /// `FC:{journal}\0{state_key}\0{producer}`.
 pub const PREFIX_COMMITTED_FRONTIER: &[u8] = b"FC:";
+/// Exclusive upper bound used for `DeleteRange` over `PREFIX_COMMITTED_FRONTIER`.
+pub const PREFIX_COMMITTED_FRONTIER_END: &[u8] = b"FC;";
 /// Key prefix for per-journal ACK intent entries: `AI:{journal}`.
 pub const PREFIX_ACK_INTENT: &[u8] = b"AI:";
 /// Exclusive upper bound used for `DeleteRange` over `PREFIX_ACK_INTENT`.
@@ -60,6 +65,23 @@ pub const KEY_LAST_APPLIED: &[u8] = b"last-applied";
 /// Trigger parameters (JSON `models::TriggerVariables`).
 pub const KEY_TRIGGER_PARAMS: &[u8] = b"trigger-params";
 
+/// Minimum clock distance between a committed-frontier producer and the most
+/// recent committing producer of the same `(journal, state_key)` before the
+/// stale producer becomes a pruning candidate. Time protects high-volume
+/// journals from eager cleanup: when one producer quickly writes far ahead of
+/// another, the byte-distance horizon alone would prune the laggard even though
+/// little wall-clock time has actually passed. See [`prune_committed_frontier`].
+pub const FRONTIER_PRUNE_CLOCK_HORIZON: std::time::Duration =
+    std::time::Duration::from_secs(2 * 60 * 60);
+
+/// Minimum journal byte distance between a committed-frontier producer's read
+/// offset and the furthest-along read offset of the same `(journal, state_key)`
+/// before the stale producer becomes a pruning candidate. Byte distance is the
+/// real operational cost of keeping an old pending span replayable: a retained
+/// positive-offset entry forces the next session to re-read from that offset.
+/// See [`prune_committed_frontier`].
+pub const FRONTIER_PRUNE_BYTE_HORIZON: i64 = 8 * 1024 * 1024 * 1024;
+
 /// A single write effect contributed by a `Persist`. Values are carried as
 /// [`Bytes`] so shared allocations (e.g. a proto-decoded
 /// `connector_patches_json` buffer) can be split without copies.
@@ -153,6 +175,12 @@ pub fn encode_persist<S: AsRef<str>>(
         });
     }
 
+    if persist.delete_committed_frontier {
+        emit(KeyOp::DeleteRange {
+            from: Bytes::from_static(PREFIX_COMMITTED_FRONTIER),
+            to: Bytes::from_static(PREFIX_COMMITTED_FRONTIER_END),
+        });
+    }
     if let Some(frontier) = &persist.committed_frontier {
         encode_frontier(
             PREFIX_COMMITTED_FRONTIER,
@@ -200,6 +228,11 @@ pub fn encode_persist<S: AsRef<str>>(
         });
     }
 
+    if persist.delete_legacy_checkpoint {
+        emit(KeyOp::Delete {
+            key: Bytes::from_static(KEY_LEGACY_CHECKPOINT),
+        });
+    }
     if let Some(checkpoint) = &persist.legacy_checkpoint {
         checkpoint
             .encode(&mut buf)
@@ -304,6 +337,21 @@ fn append_frontier_key(
     out.extend_from_slice(producer);
 }
 
+/// Build a `FC:{journal}\0{state_key}\0{producer}` committed-frontier key.
+/// Used by `shard::rocksdb` to delete entries chosen by
+/// [`prune_committed_frontier`].
+pub fn committed_frontier_key(journal: &str, state_key: &str, producer: &uuid::Producer) -> Bytes {
+    let mut buf = BytesMut::new();
+    append_frontier_key(
+        &mut buf,
+        PREFIX_COMMITTED_FRONTIER,
+        journal,
+        state_key,
+        producer.as_bytes(),
+    );
+    buf.freeze()
+}
+
 // ---------------------------------------------------------------------------
 // Decoder
 // ---------------------------------------------------------------------------
@@ -480,6 +528,78 @@ fn decode_frontier_entry(
     Ok(())
 }
 
+// ---------------------------------------------------------------------------
+// Frontier pruning
+// ---------------------------------------------------------------------------
+
+/// Drop stale committed-frontier producers from `committed` in place, returning
+/// the `(journal, binding, producer)` of each removed entry so the caller can
+/// issue the matching RocksDB deletes. `JournalFrontier`s left without any
+/// producers are removed from `committed`.
+///
+/// Pruning is conservative: within a `(journal, binding)` group — equivalently a
+/// `(journal, state_key)` group, since each state_key maps to a single binding —
+/// a producer `P` is pruned only when **all** of:
+///
+/// 1. No `FH:` (hinted) entry exists for the same `(journal, binding, producer)`
+///    — a hinted producer's committed entry is its idempotent-replay baseline
+///    and must be retained.
+/// 2. `P.last_commit` trails the group's newest `last_commit` by at least
+///    [`FRONTIER_PRUNE_CLOCK_HORIZON`].
+/// 3. `P`'s read offset (`offset.abs()`) trails the group's furthest-along read
+///    offset by at least [`FRONTIER_PRUNE_BYTE_HORIZON`].
+///
+/// `committed` and `hinted` are the per-`(journal, binding)` chunks collected by
+/// [`decode_recover_key_value`]; both are grouped (consecutive RocksDB key
+/// order) but neither need be globally sorted.
+pub fn prune_committed_frontier(
+    committed: &mut Vec<shuffle::JournalFrontier>,
+    hinted: &[shuffle::JournalFrontier],
+) -> Vec<(Box<str>, u16, uuid::Producer)> {
+    // Protected set: `(journal, binding, producer)` of every hinted entry.
+    let protected: std::collections::HashSet<(&str, u16, uuid::Producer)> = hinted
+        .iter()
+        .flat_map(|jf| {
+            jf.producers
+                .iter()
+                .map(move |p| (jf.journal.as_ref(), jf.binding, p.producer))
+        })
+        .collect();
+
+    let mut pruned = Vec::new();
+
+    committed.retain_mut(|jf| {
+        let group_clock = jf
+            .producers
+            .iter()
+            .map(|p| p.last_commit)
+            .max()
+            .unwrap_or_default();
+        let group_offset = jf
+            .producers
+            .iter()
+            .map(|p| p.offset.unsigned_abs())
+            .max()
+            .unwrap_or(0);
+
+        jf.producers.retain(|p| {
+            let stale = !protected.contains(&(jf.journal.as_ref(), jf.binding, p.producer))
+                && uuid::Clock::delta(group_clock, p.last_commit) >= FRONTIER_PRUNE_CLOCK_HORIZON
+                && group_offset.saturating_sub(p.offset.unsigned_abs())
+                    >= FRONTIER_PRUNE_BYTE_HORIZON as u64;
+
+            if stale {
+                pruned.push((jf.journal.clone(), jf.binding, p.producer));
+            }
+            !stale
+        });
+
+        !jf.producers.is_empty()
+    });
+
+    pruned
+}
+
 #[cfg(test)]
 mod test {
     use super::*;
@@ -488,11 +608,7 @@ mod test {
         [0x01, tag, 0, 0, 0, 0]
     }
 
-    fn producer_frontier(
-        tag: u8,
-        last_commit: u64,
-        offset: i64,
-    ) -> shuffle::proto::ProducerFrontier {
+    fn proto_pf(tag: u8, last_commit: u64, offset: i64) -> shuffle::proto::ProducerFrontier {
         shuffle::proto::ProducerFrontier {
             producer: uuid::Producer::from_bytes(producer_id(tag)).as_i64(),
             last_commit,
@@ -509,17 +625,14 @@ mod test {
                 shuffle::proto::JournalFrontier {
                     journal_name_suffix: "acme/events/000".into(),
                     binding: 0,
-                    producers: vec![
-                        producer_frontier(0xaa, 100, 250),
-                        producer_frontier(0xbb, 90, -300),
-                    ],
+                    producers: vec![proto_pf(0xaa, 100, 250), proto_pf(0xbb, 90, -300)],
                     ..Default::default()
                 },
                 shuffle::proto::JournalFrontier {
                     journal_name_truncate_delta: 3,
                     journal_name_suffix: "001".into(),
                     binding: 1,
-                    producers: vec![producer_frontier(0xcc, 50, -50)],
+                    producers: vec![proto_pf(0xcc, 50, -50)],
                     ..Default::default()
                 },
             ],
@@ -644,6 +757,16 @@ mod test {
                     ..Default::default()
                 },
             ),
+            // V1 rollback dropped: the leader deletes the legacy "checkpoint"
+            // key and persists no replacement.
+            (
+                "drop_legacy_checkpoint",
+                proto::Persist {
+                    committed_close_clock: 789,
+                    delete_legacy_checkpoint: true,
+                    ..Default::default()
+                },
+            ),
             // committed_frontier without the AI: prelude: the new proto
             // decouples delete_ack_intents from committed_frontier.
             (
@@ -653,6 +776,18 @@ mod test {
                     ..Default::default()
                 },
             ),
+            // Startup checkpoint reconciliation: clear all FC: keys and rewrite
+            // the recovered baseline, also deleting the legacy "checkpoint" key.
+            // Pins the DeleteRange-before-Put ordering for committed_frontier.
+            (
+                "reconcile_committed_frontier",
+                proto::Persist {
+                    delete_committed_frontier: true,
+                    committed_frontier: Some(frontier_fixture()),
+                    delete_legacy_checkpoint: true,
+                    ..Default::default()
+                },
+            ),
             // Standalone ack clear: DeleteRange alone, no Put follow-up.
             (
                 "delete_ack_alone",
@@ -733,6 +868,47 @@ mod test {
         insta::assert_debug_snapshot!(decode_pairs(store, &mapping).unwrap());
     }
 
+    #[test]
+    fn delete_committed_frontier_clears_stale_keys() {
+        // A prior session left a stale/partial committed Frontier in `FC:`.
+        let stale = proto::Persist {
+            committed_frontier: Some(shuffle::proto::Frontier {
+                journals: vec![shuffle::proto::JournalFrontier {
+                    journal_name_suffix: "stale/journal".into(),
+                    binding: 0,
+                    producers: vec![proto_pf(0x99, 1, 1)],
+                    ..Default::default()
+                }],
+                ..Default::default()
+            }),
+            ..Default::default()
+        };
+        // The startup cleanup Persist clears every `FC:` key, then rewrites the
+        // recovered baseline.
+        let cleanup = proto::Persist {
+            delete_committed_frontier: true,
+            committed_frontier: Some(frontier_fixture()),
+            ..Default::default()
+        };
+
+        let binding_state_keys = &["materialize/mat/t1", "materialize/mat/t2"];
+        let mut store: Vec<(Bytes, Bytes)> = Vec::new();
+        for persist in [&stale, &cleanup] {
+            encode_persist(persist, binding_state_keys, |op| apply_op(&mut store, op)).unwrap();
+        }
+        store.sort_by(|a, b| a.0.cmp(&b.0));
+
+        // Only the rewritten baseline survives; the stale journal is gone.
+        let mapping = state_key_index(&[("materialize/mat/t1", 0), ("materialize/mat/t2", 1)]);
+        let decoded = decode_pairs(store, &mapping).unwrap();
+        let journals: Vec<&str> = decoded
+            .committed_frontier
+            .iter()
+            .map(|jf| jf.journal.as_ref())
+            .collect();
+        assert_eq!(journals, vec!["acme/events/000", "acme/events/001"]);
+    }
+
     #[test]
     fn encode_persist_errors() {
         let cases: Vec<(&str, proto::Persist, &[&str], &str)> = vec![(
@@ -756,8 +932,8 @@ mod test {
 
     #[test]
     fn decode_recover_classifies_ranges() {
-        let fh_value = producer_frontier(0xaa, 777, 12345).encode_to_vec();
-        let fc_value = producer_frontier(0xbb, 999, 4242).encode_to_vec();
+        let fh_value = proto_pf(0xaa, 777, 12345).encode_to_vec();
+        let fc_value = proto_pf(0xbb, 999, 4242).encode_to_vec();
 
         let pairs = vec![
             (
@@ -822,7 +998,7 @@ mod test {
         // FH:/FC: and MK-v2: entries whose state_key is not in the
         // current binding mapping are silently discarded — they belong
         // to backfilled or removed bindings.
-        let fh = producer_frontier(0xaa, 1, 0).encode_to_vec();
+        let fh = proto_pf(0xaa, 1, 0).encode_to_vec();
         let pairs = vec![
             (
                 frontier_key(
@@ -845,7 +1021,7 @@ mod test {
 
     #[test]
     fn decode_recover_errors() {
-        let valid_value = Bytes::from(producer_frontier(0xaa, 1, 0).encode_to_vec());
+        let valid_value = Bytes::from(proto_pf(0xaa, 1, 0).encode_to_vec());
 
         // FH:/FC: layout: rest = journal \0 state_key \0 producer[6].
         #[allow(clippy::type_complexity)]
@@ -930,6 +1106,94 @@ mod test {
         }
     }
 
+    fn pf(tag: u8, last_commit_secs: u64, offset: i64) -> shuffle::ProducerFrontier {
+        shuffle::ProducerFrontier {
+            producer: uuid::Producer::from_bytes(producer_id(tag)),
+            last_commit: uuid::Clock::from_unix(last_commit_secs, 0),
+            hinted_commit: uuid::Clock::zero(),
+            offset,
+        }
+    }
+
+    fn jf(
+        journal: &str,
+        binding: u16,
+        producers: Vec<shuffle::ProducerFrontier>,
+    ) -> shuffle::JournalFrontier {
+        shuffle::JournalFrontier {
+            journal: journal.into(),
+            binding,
+            producers,
+            bytes_read_delta: 0,
+            bytes_behind_delta: 0,
+        }
+    }
+
+    const GIB: i64 = 1024 * 1024 * 1024;
+
+    #[test]
+    fn prune_committed_frontier_policy() {
+        // `j/old` exists only on binding 0; `j/two` exists on bindings 0 and 1.
+        // Within `(j/old, binding 0)`, 0xff is the "fresh" producer pinning the
+        // group's latest clock (~11.5 days) and read offset (20 GiB); the other
+        // producers each exercise one prune predicate.
+        let mut committed = vec![
+            jf(
+                "j/old",
+                0,
+                vec![
+                    pf(0xff, 1_000_000, -20 * GIB), // group clock/offset leader
+                    pf(0xaa, 0, 5 * GIB),           // old clock AND 15 GiB behind -> prune
+                    pf(0xbb, 0, 8 * GIB),           // old clock AND 12 GiB behind -> prune
+                    pf(0xcc, 0, 13 * GIB), // old clock but only 7 GiB behind (< 8 GiB) -> retain
+                    pf(0xdd, 999_000, 0),  // 20 GiB behind but only 1000s old (< 2h) -> retain
+                    pf(0xee, 0, GIB),      // old + 19 GiB behind, but FH-protected -> retain
+                ],
+            ),
+            jf("j/two", 0, vec![pf(0xff, 5, -GIB)]), // group's only producer (the leader) -> retain
+            jf("j/two", 1, vec![pf(0xaa, 0, GIB)]),  // group's only producer (the leader) -> retain
+        ];
+        // 0xee on (j/old, binding 0) is hinted: its committed entry is the
+        // idempotent-replay baseline and must survive pruning.
+        let hinted = vec![jf("j/old", 0, vec![pf(0xee, 0, 0)])];
+
+        let pruned = prune_committed_frontier(&mut committed, &hinted);
+
+        let mut pruned_tags: Vec<_> = pruned
+            .iter()
+            .map(|(j, b, p)| (j.to_string(), *b, p.as_bytes()[1]))
+            .collect();
+        pruned_tags.sort();
+        assert_eq!(
+            pruned_tags,
+            vec![
+                ("j/old".to_string(), 0, 0xaa),
+                ("j/old".to_string(), 0, 0xbb),
+            ],
+        );
+
+        // Surviving producers of (j/old, binding 0): ff, cc, dd, ee.
+        let old0 = &committed[0];
+        assert_eq!(old0.journal.as_ref(), "j/old");
+        let mut survivors: Vec<u8> = old0
+            .producers
+            .iter()
+            .map(|p| p.producer.as_bytes()[1])
+            .collect();
+        survivors.sort();
+        assert_eq!(survivors, vec![0xcc, 0xdd, 0xee, 0xff]);
+
+        // Both (j/two, _) journals retained intact.
+        assert_eq!(committed.len(), 3);
+        assert_eq!(committed[1].journal.as_ref(), "j/two");
+        assert_eq!(committed[1].binding, 0);
+        assert_eq!(committed[2].journal.as_ref(), "j/two");
+        assert_eq!(committed[2].binding, 1);
+
+        // Pruning an already-pruned frontier is a no-op.
+        assert!(prune_committed_frontier(&mut committed, &hinted).is_empty());
+    }
+
     // Apply a KeyOp to an in-memory sorted store, respecting DeleteRange.
     // Merge is treated as append-with-newline so the round-trip snapshot sees
     // the framed accumulation; real RocksDB would reduce via the merge operator.
diff --git a/crates/runtime-next/src/shard/rocksdb.rs b/crates/runtime-next/src/shard/rocksdb.rs
index 1a7d166c5f4..fd498bc22bf 100644
--- a/crates/runtime-next/src/shard/rocksdb.rs
+++ b/crates/runtime-next/src/shard/rocksdb.rs
@@ -57,6 +57,15 @@ impl RocksDB {
         opts.create_if_missing(true);
         opts.create_missing_column_families(true);
 
+        // The MANIFEST file is a WAL of database file state, including current live
+        // SST files and their begin & ending key ranges. A new MANIFEST-00XYZ is
+        // created at database start, where XYZ is the next available sequence number,
+        // and CURRENT is updated to point at the live MANIFEST. By default MANIFEST
+        // files may grow to 4GB, but they are typically written very slowly and thus
+        // artificially inflate the recovery log horizon. We use a much smaller limit
+        // to encourage more frequent compactions into new files.
+        opts.set_max_manifest_file_size(1 << 17); // 131072 bytes
+
         let db = rocksdb::DB::open_cf_descriptors(&opts, &path, cf_descriptors)
             .context("failed to open RocksDB")?;
 
@@ -107,6 +116,10 @@ impl RocksDB {
     ///
     /// `binding_state_keys` is a sorted slice of `(state_key, binding_index)`
     /// tuples used to map from stable `state_key` to current binding index.
+    ///
+    /// As a side effect, stale committed-frontier (`FC:`) entries identified by
+    /// [`recovery::prune_committed_frontier`] are deleted from the DB before
+    /// `Recover` is returned, so the leader never observes them.
     pub async fn scan(
         self,
         binding_state_keys: Vec<(String, u32)>,
@@ -139,6 +152,37 @@ impl RocksDB {
                 () = it.status()?;
                 std::mem::drop(it);
 
+                // Drop stale committed-frontier (`FC:`) entries: remove them
+                // from the recovered frontier and delete them from RocksDB so
+                // the leader never sees them and they stop costing scan time.
+                let pruned =
+                    recovery::prune_committed_frontier(&mut committed_frontier, &hinted_frontier);
+                if !pruned.is_empty() {
+                    // Invert `(state_key, binding)` → `binding → state_key`.
+                    let state_key_of: std::collections::HashMap<u32, &str> = binding_state_keys
+                        .iter()
+                        .map(|(sk, idx)| (*idx, sk.as_str()))
+                        .collect();
+
+                    let mut wb = rocksdb::WriteBatch::default();
+                    for (journal, binding, producer) in &pruned {
+                        let state_key = state_key_of
+                            .get(&(*binding as u32))
+                            .expect("pruned binding is present in the binding mapping");
+                        wb.delete(recovery::committed_frontier_key(
+                            journal, state_key, producer,
+                        ));
+                    }
+                    // `wo` is not sync because this is GC, not a commit.
+                    let wo = rocksdb::WriteOptions::new();
+                    self.db.write_opt(wb, &wo)?;
+
+                    tracing::info!(
+                        producers = pruned.len(),
+                        "pruned stale committed-frontier entries during recovery scan"
+                    );
+                }
+
                 for (frontier, slot) in [
                     (&mut committed_frontier, &mut recover.committed_frontier),
                     (&mut hinted_frontier, &mut recover.hinted_frontier),
@@ -594,6 +638,83 @@ mod test {
         assert_eq!(hinted[1].binding, 1);
     }
 
+    /// `scan` drops stale `FC:` producers (old clock AND far behind in bytes)
+    /// from both the recovered frontier and the DB, but never an `FH:`-protected
+    /// producer's committed baseline.
+    #[tokio::test]
+    async fn scan_prunes_stale_committed_frontier() {
+        let db = RocksDB::open(None).await.unwrap();
+        let producer = |tag: u8| proto_gazette::uuid::Producer::from_bytes([0x01, tag, 0, 0, 0, 0]);
+        let clock_secs = |s: u64| proto_gazette::uuid::Clock::from_unix(s, 0);
+        const GIB: i64 = 1024 * 1024 * 1024;
+
+        let pf = |tag: u8, last_commit_secs: u64, offset: i64| shuffle::ProducerFrontier {
+            producer: producer(tag),
+            last_commit: clock_secs(last_commit_secs),
+            hinted_commit: proto_gazette::uuid::Clock::zero(),
+            offset,
+        };
+        let committed = shuffle::JournalFrontier::encode(&[shuffle::JournalFrontier {
+            journal: "j/s".into(),
+            binding: 0,
+            producers: vec![
+                pf(0x11, 1_000_000, -20 * GIB), // fresh leader: pins group clock + 20 GiB read offset
+                pf(0x22, 0, 0),                 // old clock + 20 GiB behind -> pruned
+                pf(0x33, 0, 0),                 // same, but FH-protected below -> retained
+            ],
+            bytes_read_delta: 0,
+            bytes_behind_delta: 0,
+        }]);
+        let hinted = shuffle::JournalFrontier::encode(&[shuffle::JournalFrontier {
+            journal: "j/s".into(),
+            binding: 0,
+            producers: vec![pf(0x33, 42, 7)],
+            bytes_read_delta: 0,
+            bytes_behind_delta: 0,
+        }]);
+
+        let db = db
+            .persist(
+                &proto::Persist {
+                    committed_frontier: Some(committed),
+                    hinted_frontier: Some(hinted),
+                    ..Default::default()
+                },
+                &["sk0"],
+            )
+            .await
+            .unwrap();
+
+        let mapping = vec![("sk0".to_string(), 0)];
+        let (db, recover) = db.scan(mapping.clone()).await.unwrap();
+
+        let tags = |f: Option<shuffle::proto::Frontier>| -> Vec<Vec<u8>> {
+            f.into_iter()
+                .flat_map(shuffle::JournalFrontier::decode)
+                .map(|jf| {
+                    jf.producers
+                        .iter()
+                        .map(|p| p.producer.as_bytes()[1])
+                        .collect()
+                })
+                .collect()
+        };
+        assert_eq!(
+            tags(recover.committed_frontier),
+            vec![vec![0x11_u8, 0x33]],
+            "0x22 pruned from recovered committed frontier"
+        );
+        assert_eq!(
+            tags(recover.hinted_frontier),
+            vec![vec![0x33_u8]],
+            "hinted frontier untouched"
+        );
+
+        // A second scan confirms 0x22's FC: key was actually deleted.
+        let (_db, recover2) = db.scan(mapping).await.unwrap();
+        assert_eq!(tags(recover2.committed_frontier), vec![vec![0x11_u8, 0x33]]);
+    }
+
     /// Verify merge batching handles many operands that would exceed memory
     /// threshold. Connectors may emit many small merge-patch updates, and this
     /// can turn into many merge operands (hundreds of thousands). We handle this
@@ -828,21 +949,21 @@ mod test {
 
         for persist in [
             crate::proto::Persist {
-                nonce: 1,
+                seq_no: 1,
                 ack_intents: [("j/A".to_string(), bytes::Bytes::from_static(b"INTENT-A"))]
                     .into_iter()
                     .collect(),
                 ..Default::default()
             },
             crate::proto::Persist {
-                nonce: 2,
+                seq_no: 2,
                 ack_intents: [("j/B".to_string(), bytes::Bytes::from_static(b"INTENT-B"))]
                     .into_iter()
                     .collect(),
                 ..Default::default()
             },
             crate::proto::Persist {
-                nonce: 99,
+                seq_no: 99,
                 last_applied: bytes::Bytes::from_static(b"v9"),
                 ..Default::default()
             },
diff --git a/crates/runtime-next/src/shard/service.rs b/crates/runtime-next/src/shard/service.rs
index 301564caba3..332fe97f782 100644
--- a/crates/runtime-next/src/shard/service.rs
+++ b/crates/runtime-next/src/shard/service.rs
@@ -22,6 +22,7 @@ pub struct Service<L: crate::LogHandler> {
     pub set_log_level: Option<std::sync::Arc<dyn Fn(ops::LogLevel) + Send + Sync>>,
     pub task_name: String,
     pub publisher_factory: gazette::journal::ClientFactory,
+    pub registry: service_kit::Registry,
 }
 
 impl<L: crate::LogHandler> Service<L> {
@@ -32,6 +33,7 @@ impl<L: crate::LogHandler> Service<L> {
     /// - `set_log_level`: callback for adjusting the log level implied by runtime requests.
     /// - `task_name`: name which is used to label any started connector containers.
     /// - `publisher_factory`: client factory for creating and appending to collection partitions.
+    /// - `registry`: in-flight handler registry, shared with any co-hosted admin surface.
     pub fn new(
         plane: crate::Plane,
         container_network: String,
@@ -39,6 +41,7 @@ impl<L: crate::LogHandler> Service<L> {
         set_log_level: Option<std::sync::Arc<dyn Fn(ops::LogLevel) + Send + Sync>>,
         task_name: String,
         publisher_factory: gazette::journal::ClientFactory,
+        registry: service_kit::Registry,
     ) -> Self {
         Self {
             plane,
@@ -47,6 +50,7 @@ impl<L: crate::LogHandler> Service<L> {
             set_log_level,
             task_name,
             publisher_factory,
+            registry,
         }
     }
 
diff --git a/crates/runtime-next/src/shard/snapshots/runtime_next__shard__recovery__test__encode_persist_snapshots.snap b/crates/runtime-next/src/shard/snapshots/runtime_next__shard__recovery__test__encode_persist_snapshots.snap
index 15ab86ecc13..c77437870d9 100644
--- a/crates/runtime-next/src/shard/snapshots/runtime_next__shard__recovery__test__encode_persist_snapshots.snap
+++ b/crates/runtime-next/src/shard/snapshots/runtime_next__shard__recovery__test__encode_persist_snapshots.snap
@@ -1,6 +1,5 @@
 ---
 source: crates/runtime-next/src/shard/recovery.rs
-assertion_line: 758
 expression: snapshot
 ---
 [
@@ -86,6 +85,18 @@ expression: snapshot
             },
         ],
     ),
+    (
+        "drop_legacy_checkpoint",
+        [
+            Put {
+                key: b"committed-close",
+                value: b"\x15\x03\0\0\0\0\0\0",
+            },
+            Delete {
+                key: b"checkpoint",
+            },
+        ],
+    ),
     (
         "committed_no_acks",
         [
@@ -103,6 +114,30 @@ expression: snapshot
             },
         ],
     ),
+    (
+        "reconcile_committed_frontier",
+        [
+            DeleteRange {
+                from: b"FC:",
+                to: b"FC;",
+            },
+            Put {
+                key: b"FC:acme/events/000\0materialize/mat/t1\0\x01\xaa\0\0\0\0",
+                value: b"\x11d\0\0\0\0\0\0\0 \xfa\x01",
+            },
+            Put {
+                key: b"FC:acme/events/000\0materialize/mat/t1\0\x01\xbb\0\0\0\0",
+                value: b"\x11Z\0\0\0\0\0\0\0 \xd4\xfd\xff\xff\xff\xff\xff\xff\xff\x01",
+            },
+            Put {
+                key: b"FC:acme/events/001\0materialize/mat/t2\0\x01\xcc\0\0\0\0",
+                value: b"\x112\0\0\0\0\0\0\0 \xce\xff\xff\xff\xff\xff\xff\xff\xff\x01",
+            },
+            Delete {
+                key: b"checkpoint",
+            },
+        ],
+    ),
     (
         "delete_ack_alone",
         [
diff --git a/crates/runtime-next/src/task_service.rs b/crates/runtime-next/src/task_service.rs
index bdddee39797..d0d2fc1f47a 100644
--- a/crates/runtime-next/src/task_service.rs
+++ b/crates/runtime-next/src/task_service.rs
@@ -31,7 +31,7 @@ impl TaskService {
             std::env::var("FLOW_DATA_PLANE_FQDN").context("FLOW_DATA_PLANE_FQDN not set")?;
         let control_api_endpoint =
             std::env::var("FLOW_CONTROL_API").context("FLOW_CONTROL_API not set")?;
-        let availability_zone = std::env::var("ZONE").unwrap_or_else(|_| "local".to_string());
+        let availability_zone = std::env::var("CONSUMER_ZONE").context("CONSUMER_ZONE not set")?;
         let data_plane_signing_key = first_consumer_auth_key()?;
 
         let log_handler = ::ops::new_encoded_json_write_handler(std::sync::Arc::new(
@@ -47,10 +47,11 @@ impl TaskService {
         let control_api_endpoint: url::Url =
             url::Url::parse(&control_api_endpoint).context("invalid control API endpoint URL")?;
 
+        use proto_gazette::capability::{APPEND, APPLY, LIST};
         let publisher_factory =
             flow_client_next::workflows::task_collection_auth::new_journal_client_factory(
                 flow_client_next::rest::Client::new(&control_api_endpoint, "task-service"),
-                proto_gazette::capability::APPEND | proto_gazette::capability::APPLY,
+                APPEND | APPLY | LIST,
                 gazette::Router::new(&availability_zone),
                 data_plane_fqdn,
                 tokens::jwt::EncodingKey::from_secret(&data_plane_signing_key),
@@ -65,6 +66,9 @@ impl TaskService {
             Some(tokio_context.set_log_level_fn()),
             task_name,
             publisher_factory,
+            // Inert registry: TaskService is the CGO entry point and does not
+            // serve an admin surface; event! tracks still capture per-handler.
+            service_kit::Registry::default(),
         );
 
         let uds = tokio_context
diff --git a/crates/runtime-sidecar/Cargo.toml b/crates/runtime-sidecar/Cargo.toml
new file mode 100644
index 00000000000..9b593664187
--- /dev/null
+++ b/crates/runtime-sidecar/Cargo.toml
@@ -0,0 +1,33 @@
+[package]
+name = "runtime-sidecar"
+version.workspace = true
+rust-version.workspace = true
+edition.workspace = true
+authors.workspace = true
+homepage.workspace = true
+repository.workspace = true
+license.workspace = true
+
+[[bin]]
+name = "runtime-sidecar"
+path = "src/main.rs"
+
+[dependencies]
+flow-client-next = { path = "../flow-client-next" }
+gazette = { path = "../gazette" }
+proto-gazette = { path = "../proto-gazette" }
+runtime-next = { path = "../runtime-next" }
+service-kit = { path = "../service-kit" }
+shuffle = { path = "../shuffle" }
+tokens = { path = "../tokens" }
+
+anyhow = { workspace = true }
+clap = { workspace = true }
+futures = { workspace = true }
+rustls = { workspace = true }
+tokio = { workspace = true }
+tokio-stream = { workspace = true }
+tonic = { workspace = true, features = ["tls-aws-lc"] }
+tracing = { workspace = true }
+tracing-subscriber = { workspace = true }
+url = { workspace = true }
diff --git a/crates/runtime-sidecar/README.md b/crates/runtime-sidecar/README.md
new file mode 100644
index 00000000000..aaee123c4b5
--- /dev/null
+++ b/crates/runtime-sidecar/README.md
@@ -0,0 +1,23 @@
+# runtime-sidecar
+
+Production sidecar process for the runtime-v2 architecture
+(`plans/runtime-v2/plan.md`). One per reactor machine, supervised by
+systemd, hosting two gRPC services on a fixed fleet-wide port:
+
+- **Shuffle Leader** — `runtime_next::leader::Service`, the per-task
+  Join rendezvous and HeadFSM/TailFSM coordination for tasks whose
+  shard zero is on this machine.
+- **Shuffle** — `shuffle::Service`, the Session/Slice/Log RPCs.
+
+## Listeners
+
+`--listen-port` binds a TCP listener at `[::]:<port>`. TLS is on if
+`--certificate-file` and `--certificate-key-file` are both provided.
+
+## Auth
+
+`--data-plane-auth-keys` is whitespace- or comma-separated base64
+HMAC keys, matching gazette's `auth-keys` semantics. The first key
+signs outgoing `/authorize/task` requests issued by the leader and
+shuffle to obtain Gazette journal tokens. (Incoming-gRPC verification
+against the full key list is wired in a follow-up change.)
diff --git a/crates/runtime-sidecar/src/lib.rs b/crates/runtime-sidecar/src/lib.rs
new file mode 100644
index 00000000000..b94556bcdaa
--- /dev/null
+++ b/crates/runtime-sidecar/src/lib.rs
@@ -0,0 +1,197 @@
+use anyhow::Context;
+use clap::Parser;
+use std::path::PathBuf;
+
+/// Command-line arguments for the runtime-sidecar process.
+///
+/// Naming aligns with sibling Rust services (`dekaf`) for unprefixed
+/// `DATA_PLANE_*`, `CERTIFICATE_*`, and `AGENT_ENDPOINT` envs. The
+/// reactor (Go consumer) uses `FLOW_*` and `CONSUMER_*` namespaced
+/// envs because that's `go-flags`/gazette `mainboilerplate` convention;
+/// we follow the unprefixed form here.
+#[derive(Debug, Parser)]
+#[command(about, version)]
+pub struct Args {
+    #[arg(long = "log-format", env = "LOG_FORMAT", default_value = "text")]
+    pub log_format: LogFormat,
+
+    /// TCP port to listen on, binding `[::]:<port>`.
+    #[arg(long, env = "LISTEN_PORT")]
+    pub listen_port: u16,
+
+    /// When set, serve the admin surface (live gRPC handler inventory) on
+    /// `127.0.0.1:<port>`. Loopback-only: this surface has no authentication.
+    #[arg(long, env = "ADMIN_PORT")]
+    pub admin_port: Option<u16>,
+
+    /// Externally-reachable URL of this sidecar, advertised to peer
+    /// shuffle clients (e.g. `https://reactor-foo.flow.localhost:9100`).
+    #[arg(long, env = "PEER_ENDPOINT")]
+    pub peer_endpoint: String,
+
+    /// Fully-qualified domain name of the data-plane that this sidecar
+    /// belongs to; used as the issuer claim of authorization tokens.
+    #[arg(long, env = "DATA_PLANE_FQDN")]
+    pub data_plane_fqdn: String,
+
+    /// Whitespace- or comma-separated base64 HMAC keys recognized by
+    /// the data plane. The first key signs outgoing `/authorize/task`
+    /// requests; all keys are accepted as verifiers for incoming
+    /// gRPC traffic (incoming verification is wired in a follow-up).
+    #[arg(long, env = "DATA_PLANE_AUTH_KEYS")]
+    pub data_plane_auth_keys: String,
+
+    /// TLS server certificate PEM. Both `--certificate-file` and
+    /// `--certificate-key-file` must be provided together.
+    #[arg(long, env = "CERTIFICATE_FILE", requires = "certificate_key_file")]
+    pub certificate_file: Option<PathBuf>,
+
+    /// TLS server private key PEM. Required iff `--certificate-file` is set.
+    #[arg(long, env = "CERTIFICATE_KEY_FILE", requires = "certificate_file")]
+    pub certificate_key_file: Option<PathBuf>,
+
+    /// Estuary agent REST base URL used to issue `/authorize/task` calls.
+    #[arg(long, env = "AGENT_ENDPOINT")]
+    pub agent_endpoint: url::Url,
+
+    /// Broker zone passed to `gazette::Router::new`.
+    #[arg(long, env = "GAZETTE_ZONE", default_value = "local")]
+    pub gazette_zone: String,
+
+    /// On-disk shuffle log overflow threshold in bytes. Default is 2 GiB.
+    #[arg(long, env = "DISK_BACKLOG_THRESHOLD", default_value_t = 2 * 1024 * 1024 * 1024)]
+    pub disk_backlog_threshold: u64,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, clap::ValueEnum)]
+pub enum LogFormat {
+    Text,
+    Json,
+}
+
+pub async fn run(args: Args, registry: service_kit::Registry) -> anyhow::Result<()> {
+    // Parse comma/whitespace-separated base64 HMAC keys. First key signs
+    // outgoing /authorize/task requests; the remaining keys are reserved
+    // for future incoming-gRPC verification (see plan).
+    let keys: Vec<String> = args
+        .data_plane_auth_keys
+        .split(|c: char| c == ',' || c.is_whitespace())
+        .filter(|s| !s.is_empty())
+        .map(str::to_owned)
+        .collect();
+    anyhow::ensure!(
+        !keys.is_empty(),
+        "--data-plane-auth-keys must contain at least one key"
+    );
+    let signing_key = tokens::jwt::EncodingKey::from_base64_secret(&keys[0])
+        .context("parsing first data-plane auth key (base64)")?;
+    let _verification_keys = keys; // TODO(runtime-v2): wire up incoming-gRPC verification.
+
+    // Build REST + Router.
+    let api_client = flow_client_next::rest::Client::new(&args.agent_endpoint, "runtime-sidecar");
+    let router = gazette::Router::new(&args.gazette_zone);
+
+    use proto_gazette::capability::{APPEND, APPLY, LIST, READ};
+    // Shuffle read factory watches (LIST) and reads (READ) source journals.
+    let read_factory =
+        flow_client_next::workflows::task_collection_auth::new_journal_client_factory(
+            api_client.clone(),
+            LIST | READ,
+            router.clone(),
+            args.data_plane_fqdn.clone(),
+            signing_key.clone(),
+        );
+    // Publisher factory watches (LIST), creates partitions (APPLY),
+    // and appends (APPEND) to dest journals.
+    let publisher_factory =
+        flow_client_next::workflows::task_collection_auth::new_journal_client_factory(
+            api_client,
+            APPEND | APPLY | LIST,
+            router,
+            args.data_plane_fqdn,
+            signing_key,
+        );
+
+    let shuffle_svc = shuffle::Service::new(
+        args.peer_endpoint,
+        read_factory,
+        args.disk_backlog_threshold,
+        registry.clone(),
+    );
+    let runtime_svc =
+        runtime_next::Service::new(shuffle_svc.clone(), publisher_factory, registry.clone());
+
+    // Build a TLS identity if both files were given.
+    // clap `requires` enforces both-or-neither.
+    let tls_identity = if let (Some(cert), Some(key)) = (
+        args.certificate_file.as_ref(),
+        args.certificate_key_file.as_ref(),
+    ) {
+        let cert_bytes = tokio::fs::read(cert)
+            .await
+            .with_context(|| format!("reading {}", cert.display()))?;
+        let key_bytes = tokio::fs::read(key)
+            .await
+            .with_context(|| format!("reading {}", key.display()))?;
+        Some(tonic::transport::Identity::from_pem(cert_bytes, key_bytes))
+    } else {
+        None
+    };
+
+    // SIGTERM (systemd) and SIGINT (interactive Ctrl+C) both initiate graceful shutdown.
+    let (shutdown_tx, mut shutdown_rx) = tokio::sync::broadcast::channel::<()>(1);
+    {
+        let shutdown_tx = shutdown_tx.clone();
+        tokio::spawn(async move {
+            let mut term =
+                tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate())
+                    .expect("install SIGTERM handler");
+            tokio::select! {
+                _ = term.recv() => tracing::info!("SIGTERM received"),
+                _ = tokio::signal::ctrl_c() => tracing::info!("SIGINT received"),
+            }
+            let _ = shutdown_tx.send(());
+        });
+    }
+
+    // Optionally serve the loopback admin surface (handler dashboard).
+    if let Some(admin_port) = args.admin_port {
+        let addr = std::net::SocketAddr::from(([127, 0, 0, 1], admin_port));
+        let registry = registry.clone();
+        let mut shutdown_rx = shutdown_rx.resubscribe();
+        tokio::spawn(async move {
+            let shutdown = async move {
+                let _ = shutdown_rx.recv().await;
+            };
+            if let Err(err) =
+                service_kit::admin::serve("runtime-sidecar", registry, addr, shutdown).await
+            {
+                tracing::error!(?err, "runtime-sidecar admin surface exited with error");
+            }
+        });
+    }
+
+    let addr = format!("[::]:{}", args.listen_port);
+    let tcp = tokio::net::TcpListener::bind(&addr)
+        .await
+        .with_context(|| format!("binding TCP {addr}"))?;
+    tracing::info!(%addr, tls = tls_identity.is_some(), "runtime-sidecar listening on TCP");
+
+    let mut builder = tonic::transport::Server::builder();
+    if let Some(identity) = tls_identity {
+        builder = builder
+            .tls_config(tonic::transport::ServerTlsConfig::new().identity(identity))
+            .context("configuring TCP TLS")?;
+    }
+    builder
+        .add_service(runtime_svc.into_tonic_service())
+        .add_service(shuffle_svc.into_tonic_service())
+        .serve_with_incoming_shutdown(
+            tokio_stream::wrappers::TcpListenerStream::new(tcp),
+            async move {
+                let _ = shutdown_rx.recv().await;
+            },
+        )
+        .await
+        .context("serving runtime-sidecar TCP")
+}
diff --git a/crates/runtime-sidecar/src/main.rs b/crates/runtime-sidecar/src/main.rs
new file mode 100644
index 00000000000..552511bbbdd
--- /dev/null
+++ b/crates/runtime-sidecar/src/main.rs
@@ -0,0 +1,64 @@
+use clap::Parser;
+
+fn main() -> Result<(), anyhow::Error> {
+    // Required for libraries that use rustls (tonic TLS, gazette client TLS).
+    // See https://docs.rs/rustls/latest/rustls/crypto/struct.CryptoProvider.html
+    rustls::crypto::aws_lc_rs::default_provider()
+        .install_default()
+        .expect("failed to install default crypto provider");
+
+    let args = runtime_sidecar::Args::parse();
+    // The handler registry is shared between the tracing subscriber (which
+    // consults per-handler trace overrides) and the services (which populate it
+    // and expose it via the admin surface).
+    let registry = service_kit::Registry::new();
+    install_tracing(args.log_format, registry.clone());
+
+    let runtime = tokio::runtime::Builder::new_multi_thread()
+        .enable_all()
+        .build()?;
+
+    let result = runtime.block_on(runtime.spawn(runtime_sidecar::run(args, registry)));
+    runtime.shutdown_timeout(std::time::Duration::from_secs(5));
+    result?
+}
+
+/// Install a tracing subscriber that writes structured application logs to
+/// stderr. The base `EnvFilter` (`RUST_LOG`, default `info`) is composed with
+/// `service_kit::trace`'s per-handler override filter, so an operator can raise
+/// a handler's verbosity at runtime via the admin dashboard; `service_kit::event`
+/// additionally captures opt-in `event!` breadcrumbs into per-handler tracks
+/// shown on the dashboard's handler drill-down page.
+fn install_tracing(log_format: runtime_sidecar::LogFormat, registry: service_kit::Registry) {
+    use tracing_subscriber::Layer;
+    use tracing_subscriber::layer::SubscriberExt;
+    use tracing_subscriber::util::SubscriberInitExt;
+
+    let env_filter = tracing_subscriber::EnvFilter::try_from_default_env()
+        .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info"));
+
+    // `fmt` layer, boxed so the JSON and text variants share one assembly path.
+    let fmt_layer: Box<dyn Layer<tracing_subscriber::Registry> + Send + Sync> = match log_format {
+        runtime_sidecar::LogFormat::Json => Box::new(
+            tracing_subscriber::fmt::layer()
+                .json()
+                .with_writer(std::io::stderr),
+        ),
+        runtime_sidecar::LogFormat::Text => {
+            let no_color = matches!(std::env::var("NO_COLOR"), Ok(v) if v == "1");
+            Box::new(
+                tracing_subscriber::fmt::layer()
+                    .with_ansi(!no_color)
+                    .with_writer(std::io::stderr),
+            )
+        }
+    };
+
+    tracing_subscriber::registry()
+        .with(fmt_layer.with_filter(service_kit::trace::layer_filter(
+            env_filter,
+            registry.clone(),
+        )))
+        .with(service_kit::event::layer(registry))
+        .init();
+}
diff --git a/crates/runtime/src/materialize/protocol.rs b/crates/runtime/src/materialize/protocol.rs
index 3bfaa8d608f..238bb5a21cb 100644
--- a/crates/runtime/src/materialize/protocol.rs
+++ b/crates/runtime/src/materialize/protocol.rs
@@ -572,7 +572,7 @@ pub fn recv_client_start_commit(
     txn: &mut Transaction,
 ) -> anyhow::Result<(Request, rocksdb::WriteBatch)> {
     let verify = verify("client", "StartCommit with runtime_checkpoint");
-    let request = verify.not_eof(request)?;
+    let mut request = verify.not_eof(request)?;
 
     let Request {
         start_commit:
@@ -581,7 +581,7 @@ pub fn recv_client_start_commit(
                 ..
             }),
         ..
-    } = &request
+    } = &mut request
     else {
         return verify.fail(request);
     };
@@ -590,6 +590,17 @@ pub fn recv_client_start_commit(
     // merge-able, incremental update that's written to the WriteBatch.
     let _last_checkpoint = last_checkpoint;
 
+    // The V2 leader stamps a synthetic "committed-close" source into the
+    // consumer.Checkpoint on each commit, recording the V2 RocksDB epoch.
+    // If V1 inherits a checkpoint from a prior V2 run, the marker is
+    // preserved verbatim across V1 commits. A subsequent V2 rollforward
+    // would then mistake the stale marker for an in-sync RocksDB state
+    // and ignore the legacy_checkpoint, resuming from V2's stale frontier
+    // and re-processing whatever V1 had advanced past. Strip the marker
+    // so V2 startup treats V1's advanced sources as authoritative.
+    runtime_checkpoint.sources.remove("committed-close");
+    let runtime_checkpoint = runtime_checkpoint.clone();
+
     let mut wb = rocksdb::WriteBatch::default();
 
     tracing::debug!(
@@ -598,7 +609,7 @@ pub fn recv_client_start_commit(
     );
     wb.put(RocksDB::CHECKPOINT_KEY, runtime_checkpoint.encode_to_vec());
 
-    txn.checkpoint = runtime_checkpoint.clone();
+    txn.checkpoint = runtime_checkpoint;
 
     Ok((request, wb))
 }
diff --git a/crates/service-kit/Cargo.toml b/crates/service-kit/Cargo.toml
new file mode 100644
index 00000000000..7753a52642d
--- /dev/null
+++ b/crates/service-kit/Cargo.toml
@@ -0,0 +1,28 @@
+[package]
+name = "service-kit"
+version.workspace = true
+rust-version.workspace = true
+edition.workspace = true
+authors.workspace = true
+homepage.workspace = true
+repository.workspace = true
+license.workspace = true
+
+[dependencies]
+proto-gazette = { path = "../proto-gazette" }
+
+anyhow = { workspace = true }
+axum = { workspace = true }
+chrono = { workspace = true }
+metrics-exporter-prometheus = { workspace = true }
+metrics-util = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+tokio = { workspace = true }
+tower-http = { workspace = true }
+tracing = { workspace = true }
+tracing-subscriber = { workspace = true }
+
+[dev-dependencies]
+metrics = { workspace = true }
+tower = { workspace = true }
diff --git a/crates/service-kit/README.md b/crates/service-kit/README.md
new file mode 100644
index 00000000000..dedc28b84ec
--- /dev/null
+++ b/crates/service-kit/README.md
@@ -0,0 +1,70 @@
+# service-kit
+
+Building blocks for the operational surface of a long-running async service:
+a loopback HTTP port exposing what the process is doing right now, with
+controls to debug it without restarting.
+
+Service-agnostic. Used by Estuary reactors and runtime-next; nothing here
+knows about Flow.
+
+## Surface
+
+A service constructs a [`Registry`], wires its tracing/event/metrics layers
+in, and serves the admin router on a loopback port. Every spawned unit of
+work registers a [`HandlerGuard`]; its lifecycle, identity, and recent events
+become visible on the dashboard.
+
+| Module             | Role                                                                                    |
+| ------------------ | --------------------------------------------------------------------------------------- |
+| [`handlers`]       | `Registry` / `HandlerGuard` — in-flight handler inventory plus a recently-finished ring |
+| [`admin`]          | HTML dashboard, JSON views, per-handler drill-down, trace-override `POST` endpoint      |
+| [`trace`]          | Per-handler `tracing` verbosity override — additive filter composed with the base       |
+| [`event`]          | Opt-in per-handler event tracks (named ring buffers) + `event!` macro; lazy capture     |
+| [`metrics`]        | Prometheus `/metrics` exporter folded into the admin router; histogram upkeep tick      |
+
+## Entry points
+
+- `Registry::new()` / `Registry::register(kind)` — register a handler; run
+  its body inside `guard.span()` so tracing/event layers can find it.
+- `admin::serve(name, registry, addr, shutdown)` — bind the loopback admin
+  port and serve until shutdown.
+- `trace::layer_filter(base, registry)` — wrap a `tracing_subscriber`
+  `EnvFilter` so operator overrides bypass it.
+- `event::layer(registry)` — install alongside `fmt` so `event!` calls
+  capture into per-handler tracks.
+- `metrics::install_recorder()` — idempotently install the global
+  `metrics` recorder; called transitively by `admin::build_router`.
+
+## Non-obvious details
+
+- **No auth.** Bind admin on loopback only.
+- **Trace-override is additive** — it raises verbosity for one handler but
+  never suppresses what the base filter would keep. Cost when no override
+  is set is one extra `enabled()` check per disabled callsite (atomic load,
+  short scope walk only inside a handler span).
+- **Handler spans must always be created.** `OverrideFilter` short-circuits
+  to `true` for the `service_kit::handler` target — that's where override
+  state is hung. Don't filter the target out at the base.
+- **`event!` capture is lazy.** A literal message stays `&'static str`; an
+  interpolated message stores `(template, captured args)` and is rendered
+  only when read. Values must be cheap-to-capture types (numbers, bools,
+  `&'static str`, `String`, `Arc<str>`, `Clock`) or a `lazy`/`json`/`debug`
+  thunk — borrowed `&str` or `?x`/`%x` formatters won't compile; the call
+  site converts. See [`event`] for the full contract.
+- **`event!` is a no-op outside a handler span** *and* under any subscriber
+  that isn't a `tracing_subscriber::registry::Registry`. The accompanying
+  `tracing` event still fires.
+- **Prometheus histogram upkeep** isn't driven by scrapes; `install_recorder`
+  spawns its own tick because we own the HTTP surface (the upstream
+  `PrometheusBuilder::install` convenience constructor isn't used). Idle-
+  metric pruning *is* scrape-driven, so it only fires when a scraper polls.
+- **`metrics` recorder install is process-global and panics on conflict.**
+  Service-kit owns that slot.
+
+[`Registry`]: src/handlers.rs
+[`HandlerGuard`]: src/handlers.rs
+[`handlers`]: src/handlers.rs
+[`admin`]: src/admin.rs
+[`trace`]: src/trace.rs
+[`event`]: src/event.rs
+[`metrics`]: src/metrics.rs
diff --git a/crates/service-kit/src/admin.rs b/crates/service-kit/src/admin.rs
new file mode 100644
index 00000000000..65e1e953712
--- /dev/null
+++ b/crates/service-kit/src/admin.rs
@@ -0,0 +1,569 @@
+//! The admin surface: a loopback HTTP endpoint presenting a service's
+//! [`Registry`] as an auto-refreshing HTML dashboard, a per-handler drill-down
+//! page (identity, phase, and recent [`crate::event`] tracks), plus JSON views.
+//! The Prometheus scrape endpoint from [`crate::metrics`] is folded in too, so
+//! `/metrics` is reachable on the same loopback port.
+
+use crate::{HandlerDetail, Registry, Snapshot};
+use std::fmt::Write;
+use std::net::SocketAddr;
+
+#[derive(Clone)]
+struct AdminState {
+    registry: Registry,
+    // Service name shown in the page title; the dashboard serves one service.
+    title: std::sync::Arc<str>,
+}
+
+/// Build the admin router for `service_name`.
+/// Must be called from within a Tokio runtime.
+pub fn build_router(service_name: impl Into<String>, registry: Registry) -> axum::Router<()> {
+    use axum::routing::{get, post};
+
+    let state = AdminState {
+        registry,
+        title: service_name.into().into(),
+    };
+    axum::Router::new()
+        .route("/", get(index))
+        .route("/debug/handlers.json", get(handlers_json))
+        .route("/debug/handlers/{id}", get(handler))
+        .route("/debug/handlers/{id}/detail.json", get(handler_detail_json))
+        // POST (not GET): this mutates process state, so it shouldn't be
+        // reachable by a link prefetch or an open-all-tabs.
+        .route("/debug/handlers/{id}/level/{level}", post(set_level))
+        .with_state(state)
+        // `merge` (not `nest`): keep `/metrics` at the root of the admin port,
+        // matching what Prometheus scrapers expect by default.
+        .merge(crate::metrics::install_recorder())
+        .layer(tower_http::trace::TraceLayer::new_for_http())
+}
+
+/// Bind `addr` and serve the admin surface until `shutdown` resolves. `addr`
+/// should be loopback-only — there is no authentication on this surface.
+pub async fn serve(
+    service_name: impl Into<String>,
+    registry: Registry,
+    addr: SocketAddr,
+    shutdown: impl std::future::Future<Output = ()> + Send + 'static,
+) -> anyhow::Result<()> {
+    let service_name = service_name.into();
+    let listener = tokio::net::TcpListener::bind(addr)
+        .await
+        .map_err(|err| anyhow::anyhow!("binding {service_name} admin surface on {addr}: {err}"))?;
+    tracing::info!(%addr, service = %service_name, "service-kit admin surface listening");
+
+    axum::serve(listener, build_router(service_name.clone(), registry))
+        .with_graceful_shutdown(shutdown)
+        .await
+        .map_err(|err| anyhow::anyhow!("serving {service_name} admin surface: {err}"))
+}
+
+async fn handlers_json(
+    axum::extract::State(state): axum::extract::State<AdminState>,
+) -> axum::Json<Snapshot> {
+    axum::Json(state.registry.snapshot())
+}
+
+async fn handler(
+    axum::extract::State(state): axum::extract::State<AdminState>,
+    axum::extract::Path(id): axum::extract::Path<u64>,
+    axum::extract::Query(params): axum::extract::Query<std::collections::HashMap<String, String>>,
+) -> axum::response::Result<axum::response::Html<String>> {
+    let detail = state
+        .registry
+        .handler_detail(id)
+        .ok_or((axum::http::StatusCode::NOT_FOUND, "no such handler"))?;
+    // Drill-down time display: `?t=zulu` to flip from the default relative ages
+    // to absolute RFC-3339 timestamps; preserved across the page's 2s refresh.
+    let zulu = params.get("t").is_some_and(|v| v == "zulu");
+    Ok(axum::response::Html(render_handler(
+        &state.title,
+        &detail,
+        zulu,
+    )))
+}
+
+async fn handler_detail_json(
+    axum::extract::State(state): axum::extract::State<AdminState>,
+    axum::extract::Path(id): axum::extract::Path<u64>,
+) -> axum::response::Result<axum::Json<HandlerDetail>> {
+    let detail = state
+        .registry
+        .handler_detail(id)
+        .ok_or((axum::http::StatusCode::NOT_FOUND, "no such handler"))?;
+    Ok(axum::Json(detail))
+}
+
+/// `POST` target of the dashboard's trace-level buttons; replies with a
+/// see-other redirect back to the index (post/redirect/get).
+async fn set_level(
+    axum::extract::State(state): axum::extract::State<AdminState>,
+    axum::extract::Path((id, level)): axum::extract::Path<(u64, String)>,
+) -> axum::response::Result<axum::response::Redirect> {
+    let level =
+        parse_level(&level).ok_or((axum::http::StatusCode::BAD_REQUEST, "unknown trace level"))?;
+    // A miss (handler already finished) is unremarkable — fall through to the
+    // refreshed index, which will no longer list it.
+    let _ = state.registry.set_trace_override(id, level);
+    Ok(axum::response::Redirect::to("/"))
+}
+
+/// Parse a path segment into a trace-override level; `Some(None)` clears it.
+fn parse_level(s: &str) -> Option<Option<tracing::Level>> {
+    Some(match s {
+        "off" | "clear" | "none" => None,
+        "error" => Some(tracing::Level::ERROR),
+        "warn" => Some(tracing::Level::WARN),
+        "info" => Some(tracing::Level::INFO),
+        "debug" => Some(tracing::Level::DEBUG),
+        "trace" => Some(tracing::Level::TRACE),
+        _ => return None,
+    })
+}
+
+async fn index(
+    axum::extract::State(state): axum::extract::State<AdminState>,
+) -> axum::response::Html<String> {
+    axum::response::Html(render_index(&state.title, &state.registry.snapshot()))
+}
+
+/// Inline page styling shared by [`render_index`] and [`render_handler`].
+const PAGE_STYLE: &str = "body{font:13px/1.4 ui-monospace,Menlo,Consolas,monospace;margin:1.5rem;color:#222}\
+h1,h2,h3{font-size:1rem;margin:1.2rem 0 .4rem}\
+table{border-collapse:collapse;width:100%;margin-bottom:.8rem}\
+th,td{text-align:left;padding:.25rem .6rem;border-bottom:1px solid #ddd;vertical-align:top}\
+th{background:#f3f3f3}\
+a{color:#06c;text-decoration:none}a:hover{text-decoration:underline}\
+form{display:inline}\
+button{font:inherit;color:#06c;background:none;border:0;padding:0;cursor:pointer}button:hover{text-decoration:underline}\
+.kind{color:#06c}.phase{font-weight:bold}.muted{color:#888}.on{font-weight:bold;color:#c30}";
+
+/// Open an auto-refreshing HTML page with the shared style; `head_title` is the
+/// already-escaped `<title>` text.
+fn page_open(out: &mut String, head_title: &str) {
+    let _ = write!(
+        out,
+        "<!doctype html><html><head><meta charset=\"utf-8\">\
+         <meta http-equiv=\"refresh\" content=\"2\">\
+         <title>{head_title}</title><style>{PAGE_STYLE}</style></head><body>",
+    );
+}
+
+/// A link to a handler's drill-down page, wrapping the given (pre-escaped) text.
+fn handler_link(id: u64, text: &str) -> String {
+    format!("<a href=\"/debug/handlers/{id}\">{text}</a>")
+}
+
+fn render_index(title: &str, snapshot: &Snapshot) -> String {
+    let title = esc(title);
+    let mut out = String::new();
+    page_open(&mut out, &format!("{title} handlers"));
+
+    let _ = write!(
+        out,
+        "<h1>{title} handlers</h1><p class=\"muted\">{} live, {} recently finished — auto-refreshes every 2s · <a href=\"/debug/handlers.json\">json</a></p>",
+        snapshot.live.len(),
+        snapshot.recent.len(),
+    );
+
+    out.push_str("<h2>Live</h2>");
+    if snapshot.live.is_empty() {
+        out.push_str("<p class=\"muted\">(none)</p>");
+    } else {
+        out.push_str(
+            "<table><tr><th>id</th><th>kind</th><th>label</th><th>age</th><th>phase</th><th>trace</th><th>fields</th></tr>",
+        );
+        for h in &snapshot.live {
+            let _ = write!(
+                out,
+                "<tr><td>{}</td><td class=\"kind\">{}</td><td>{}</td><td>{}</td><td class=\"phase\">{} <span class=\"muted\">({})</span></td><td>{}</td><td>{}</td></tr>",
+                handler_link(h.id, &h.id.to_string()),
+                handler_link(h.id, &esc(h.kind)),
+                esc(&h.label),
+                fmt_age(h.age_seconds),
+                esc(&h.phase),
+                fmt_age(h.phase_age_seconds),
+                fmt_trace_controls(h.id, h.trace_override),
+                fmt_fields(&h.fields),
+            );
+        }
+        out.push_str("</table>");
+    }
+
+    out.push_str("<h2>Recently finished</h2>");
+    if snapshot.recent.is_empty() {
+        out.push_str("<p class=\"muted\">(none)</p>");
+    } else {
+        out.push_str(
+            "<table><tr><th>id</th><th>kind</th><th>label</th><th>ran for</th><th>final phase</th></tr>",
+        );
+        // Newest first.
+        for h in snapshot.recent.iter().rev() {
+            let _ = write!(
+                out,
+                "<tr><td>{}</td><td class=\"kind\">{}</td><td>{}</td><td>{}</td><td>{}</td></tr>",
+                handler_link(h.id, &h.id.to_string()),
+                handler_link(h.id, &esc(h.kind)),
+                esc(&h.label),
+                fmt_age(h.age_seconds),
+                esc(&h.final_phase),
+            );
+        }
+        out.push_str("</table>");
+    }
+
+    out.push_str("</body></html>");
+    out
+}
+
+fn render_handler(title: &str, h: &HandlerDetail, zulu: bool) -> String {
+    let title = esc(title);
+    let mut out = String::new();
+    page_open(&mut out, &format!("{title} handler #{}", h.id));
+
+    let status = if h.finished { "finished" } else { "live" };
+    // Toggle: the currently-active mode is bold, the alternative is a link
+    // back to the same handler with the opposite `t=` query.
+    let toggle = if zulu {
+        format!("<a href=\"/debug/handlers/{}\">age</a> · <b>zulu</b>", h.id)
+    } else {
+        format!(
+            "<b>age</b> · <a href=\"/debug/handlers/{}?t=zulu\">zulu</a>",
+            h.id,
+        )
+    };
+    let _ = write!(
+        out,
+        "<p class=\"muted\"><a href=\"/\">← {title} handlers</a> · <a href=\"/debug/handlers/{}/detail.json\">json</a> · times: {toggle}</p>\
+         <h1>handler #{} <span class=\"muted\">({status})</span></h1>",
+        h.id, h.id,
+    );
+
+    out.push_str("<table>");
+    let _ = write!(
+        out,
+        "<tr><th>kind</th><td class=\"kind\">{}</td></tr>",
+        esc(h.kind)
+    );
+    let _ = write!(out, "<tr><th>label</th><td>{}</td></tr>", esc(&h.label));
+
+    // Phase parenthetical: phase age (default) or absolute phase-change time
+    // (zulu). `phase_since_rfc3339` and `phase_age_seconds` are both `None`
+    // on a finished handler, in which case there is no parenthetical.
+    let phase_paren = match (zulu, &h.phase_since_rfc3339, h.phase_age_seconds) {
+        (true, Some(at), _) => {
+            format!(" <span class=\"muted\">(since {})</span>", esc(at))
+        }
+        (false, _, Some(s)) => format!(" <span class=\"muted\">({})</span>", fmt_age(s)),
+        _ => String::new(),
+    };
+    let _ = write!(
+        out,
+        "<tr><th>phase</th><td class=\"phase\">{}{phase_paren}</td></tr>",
+        esc(&h.phase),
+    );
+
+    // Age row. For a finished handler, `age_seconds` is the total runtime —
+    // a duration with no zulu equivalent, so it renders the same in both
+    // modes. For a live handler in zulu mode, show the absolute start time.
+    let (age_label, age_value) = if h.finished {
+        ("ran for", fmt_age(h.age_seconds))
+    } else if zulu {
+        match &h.started_at_rfc3339 {
+            Some(at) => ("started", esc(at)),
+            None => ("age", fmt_age(h.age_seconds)),
+        }
+    } else {
+        ("age", fmt_age(h.age_seconds))
+    };
+    let _ = write!(out, "<tr><th>{age_label}</th><td>{age_value}</td></tr>");
+
+    if !h.finished {
+        let _ = write!(
+            out,
+            "<tr><th>trace</th><td>{}</td></tr>",
+            fmt_trace_controls(h.id, h.trace_override),
+        );
+    }
+    if !h.fields.is_empty() {
+        let _ = write!(
+            out,
+            "<tr><th>fields</th><td>{}</td></tr>",
+            fmt_fields(&h.fields)
+        );
+    }
+    out.push_str("</table>");
+
+    out.push_str("<h2>Tracks</h2>");
+    if h.tracks.is_empty() {
+        out.push_str("<p class=\"muted\">(no events captured)</p>");
+    } else {
+        let time_col = if zulu { "at" } else { "age" };
+        for (name, events) in &h.tracks {
+            let _ = write!(out, "<h3>{}</h3>", esc(name));
+            let _ = write!(
+                out,
+                "<table><tr><th>{time_col}</th><th>level</th><th>message</th><th>fields</th></tr>",
+            );
+            // Oldest first: the operator reads top-to-bottom following the
+            // sequence of events that led to the handler's current state.
+            for e in events {
+                let when = if zulu {
+                    esc(&e.at_rfc3339)
+                } else {
+                    fmt_age(e.age_seconds)
+                };
+                let _ = write!(
+                    out,
+                    "<tr><td>{when}</td><td>{}</td><td>{}</td><td>{}</td></tr>",
+                    e.level,
+                    esc(&e.message),
+                    fmt_fields(&e.fields),
+                );
+            }
+            out.push_str("</table>");
+        }
+    }
+
+    out.push_str("</body></html>");
+    out
+}
+
+/// The current override (highlighted if set) plus the buttons to change it —
+/// tiny `POST` forms rather than links, since the target mutates process state.
+fn fmt_trace_controls(id: u64, current: Option<&'static str>) -> String {
+    let mut out = String::new();
+    match current {
+        Some(level) => {
+            let _ = write!(out, "<span class=\"on\">{level}</span> ");
+        }
+        None => out.push_str("<span class=\"muted\">base</span> "),
+    }
+    for label in ["trace", "debug", "off"] {
+        let _ = write!(
+            out,
+            "<form method=\"post\" action=\"/debug/handlers/{id}/level/{label}\"><button>[{label}]</button></form> ",
+        );
+    }
+    out
+}
+
+fn fmt_fields(fields: &[(&'static str, String)]) -> String {
+    fields
+        .iter()
+        .map(|(k, v)| format!("{}=<b>{}</b>", esc(k), esc(v)))
+        .collect::<Vec<_>>()
+        .join(" ")
+}
+
+fn fmt_age(secs: u64) -> String {
+    if secs < 60 {
+        format!("{secs}s")
+    } else if secs < 3600 {
+        format!("{}m{}s", secs / 60, secs % 60)
+    } else {
+        format!("{}h{}m", secs / 3600, (secs % 3600) / 60)
+    }
+}
+
+/// Minimal HTML-escaping for text interpolated into the dashboard.
+fn esc(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    for c in s.chars() {
+        match c {
+            '&' => out.push_str("&amp;"),
+            '<' => out.push_str("&lt;"),
+            '>' => out.push_str("&gt;"),
+            '"' => out.push_str("&quot;"),
+            '\'' => out.push_str("&#39;"),
+            _ => out.push(c),
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::event::EventView;
+    use crate::{FinishedView, HandlerDetail, HandlerView};
+
+    #[test]
+    fn render_index_includes_handlers_and_escapes() {
+        let snapshot = Snapshot {
+            live: vec![HandlerView {
+                id: 7,
+                kind: "leader.materialize",
+                label: "acmeCo/<svc>".to_string(),
+                phase: "running".to_string(),
+                age_seconds: 65,
+                phase_age_seconds: 3,
+                fields: vec![("shards", "2".to_string())],
+                trace_override: Some("TRACE"),
+            }],
+            recent: vec![FinishedView {
+                id: 6,
+                kind: "shuffle.log",
+                label: "dir/0".to_string(),
+                final_phase: "done".to_string(),
+                age_seconds: 4000,
+                tracks: Default::default(),
+            }],
+        };
+
+        let html = render_index("my-service", &snapshot);
+        assert!(html.contains("<title>my-service handlers</title>"));
+        assert!(html.contains("leader.materialize"));
+        assert!(html.contains("acmeCo/&lt;svc&gt;"));
+        assert!(!html.contains("acmeCo/<svc>"));
+        assert!(html.contains("shards=<b>2</b>"));
+        assert!(html.contains("1m5s"));
+        assert!(html.contains("1h6m"));
+        assert!(html.contains("shuffle.log"));
+        assert!(html.contains("<a href=\"/debug/handlers/7\">7</a>"));
+        assert!(html.contains("<a href=\"/debug/handlers/7\">leader.materialize</a>"));
+        assert!(html.contains("<a href=\"/debug/handlers/6\">6</a>"));
+        assert!(html.contains("<a href=\"/debug/handlers/6\">shuffle.log</a>"));
+        assert!(html.contains("running <span class=\"muted\">(3s)</span>"));
+        // Trace controls for the live handler — `POST` forms, not links.
+        assert!(html.contains(">TRACE</span>"));
+        assert!(
+            html.contains(
+                "<form method=\"post\" action=\"/debug/handlers/7/level/trace\"><button>"
+            )
+        );
+        assert!(html.contains("/debug/handlers/7/level/off"));
+    }
+
+    fn sample_live_detail() -> HandlerDetail {
+        HandlerDetail {
+            id: 7,
+            kind: "leader.materialize",
+            label: "acmeCo/<svc>".to_string(),
+            phase: "running".to_string(),
+            finished: false,
+            age_seconds: 65,
+            started_at_rfc3339: Some("2026-05-14T18:00:00Z".to_string()),
+            phase_age_seconds: Some(3),
+            phase_since_rfc3339: Some("2026-05-14T18:01:02Z".to_string()),
+            fields: vec![("shards", "2".to_string())],
+            trace_override: Some("DEBUG"),
+            tracks: std::collections::BTreeMap::from([(
+                "io".to_string(),
+                vec![
+                    EventView {
+                        age_seconds: 9,
+                        at_rfc3339: "2026-05-14T18:00:56Z".to_string(),
+                        level: "DEBUG",
+                        message: "read <chunk>".to_string(),
+                        fields: vec![("bytes", "3".to_string())],
+                    },
+                    EventView {
+                        age_seconds: 1,
+                        at_rfc3339: "2026-05-14T18:01:04Z".to_string(),
+                        level: "INFO",
+                        message: "done".to_string(),
+                        fields: vec![],
+                    },
+                ],
+            )]),
+        }
+    }
+
+    #[test]
+    fn render_handler_includes_tracks_and_escapes() {
+        let detail = sample_live_detail();
+        let html = render_handler("my-service", &detail, false);
+        assert!(html.contains("<title>my-service handler #7</title>"));
+        assert!(html.contains("handler #7 <span class=\"muted\">(live)</span>"));
+        assert!(html.contains("<a href=\"/\">"));
+        assert!(html.contains("/debug/handlers/7/detail.json"));
+        assert!(html.contains("/debug/handlers/7/level/trace"));
+        // Time-mode toggle: age is active (bold), zulu is a link.
+        assert!(html.contains("<b>age</b>"));
+        assert!(html.contains("/debug/handlers/7?t=zulu\">zulu</a>"));
+        assert!(html.contains("<h3>io</h3>"));
+        // The track table header is `age`, not `at`, in age mode.
+        assert!(html.contains("<th>age</th><th>level</th>"));
+        // Oldest event first; HTML in the message is escaped.
+        let done_at = html.find("done").unwrap();
+        let read_at = html.find("read &lt;chunk&gt;").unwrap();
+        assert!(read_at < done_at);
+        assert!(!html.contains("read <chunk>"));
+        assert!(html.contains("bytes=<b>3</b>"));
+        assert!(html.contains("shards=<b>2</b>"));
+        // RFC-3339 strings stay out of the page in age mode.
+        assert!(!html.contains("2026-05-14T"));
+    }
+
+    #[test]
+    fn render_handler_zulu_mode_shows_absolute_times() {
+        let detail = sample_live_detail();
+        let html = render_handler("my-service", &detail, true);
+        // Toggle is flipped: zulu is active, age links back to bare path.
+        assert!(html.contains("<b>zulu</b>"));
+        assert!(html.contains("/debug/handlers/7\">age</a>"));
+        // The age row is relabeled `started` and shows the absolute start time.
+        assert!(html.contains("<th>started</th><td>2026-05-14T18:00:00Z</td>"));
+        // Phase parenthetical is `(since <zulu>)` instead of `(3s)`.
+        assert!(html.contains("(since 2026-05-14T18:01:02Z)"));
+        assert!(!html.contains(">(3s)</span>"));
+        // Track time column is `at`, with absolute event times.
+        assert!(html.contains("<th>at</th><th>level</th>"));
+        assert!(html.contains("<td>2026-05-14T18:00:56Z</td>"));
+        assert!(html.contains("<td>2026-05-14T18:01:04Z</td>"));
+    }
+
+    #[test]
+    fn render_handler_finished_has_no_trace_controls() {
+        let detail = HandlerDetail {
+            id: 3,
+            kind: "shuffle.log",
+            label: "dir/0".to_string(),
+            phase: "done".to_string(),
+            finished: true,
+            age_seconds: 12,
+            started_at_rfc3339: None,
+            phase_age_seconds: None,
+            phase_since_rfc3339: None,
+            fields: vec![],
+            trace_override: None,
+            tracks: Default::default(),
+        };
+        let html = render_handler("svc", &detail, false);
+        assert!(html.contains("(finished)"));
+        assert!(!html.contains("/level/trace"));
+        assert!(html.contains("(no events captured)"));
+        // `ran for` shows the duration; phase has no parenthetical.
+        assert!(html.contains("<th>ran for</th><td>12s</td>"));
+        assert!(!html.contains("(since"));
+        // The zulu form still works on a finished handler — duration stays a
+        // duration; the toggle is still present.
+        let html_zulu = render_handler("svc", &detail, true);
+        assert!(html_zulu.contains("<b>zulu</b>"));
+        assert!(html_zulu.contains("<th>ran for</th><td>12s</td>"));
+    }
+
+    #[test]
+    fn render_index_handles_empty() {
+        let html = render_index(
+            "svc",
+            &Snapshot {
+                live: vec![],
+                recent: vec![],
+            },
+        );
+        assert!(html.contains("0 live, 0 recently finished"));
+        assert!(html.contains("(none)"));
+    }
+
+    #[test]
+    fn parse_level_round_trip() {
+        assert_eq!(parse_level("trace"), Some(Some(tracing::Level::TRACE)));
+        assert_eq!(parse_level("info"), Some(Some(tracing::Level::INFO)));
+        assert_eq!(parse_level("off"), Some(None));
+        assert_eq!(parse_level("clear"), Some(None));
+        assert_eq!(parse_level("bogus"), None);
+    }
+}
diff --git a/crates/service-kit/src/event.rs b/crates/service-kit/src/event.rs
new file mode 100644
index 00000000000..82a0e6122bf
--- /dev/null
+++ b/crates/service-kit/src/event.rs
@@ -0,0 +1,952 @@
+//! Per-handler event tracks: an opt-in, in-memory tail of recent events —
+//! IO completions, RX/TX boundaries, future completions, anything notable
+//! happening inside an asynchronous actor or handler — grouped onto named
+//! ring-buffer **tracks**, hung off the enclosing handler's span, and surfaced
+//! on the [`crate::admin`] handler drill-down page.
+//!
+//! Emit one with the [`event!`](crate::event!) macro, whose shape mirrors
+//! `tracing`'s event macros — leading `name = value` fields, a message literal,
+//! then positional `{}` interpolation args. A bare identifier is shorthand for
+//! `name = name` — same as `tracing::debug!` et al.:
+//!
+//! ```ignore
+//! service_kit::event!(tracing::Level::DEBUG, "io", "opened connection");
+//! service_kit::event!(tracing::Level::DEBUG, "io", bytes = n, offset = off, "read chunk");
+//! service_kit::event!(tracing::Level::DEBUG, "io", bytes, offset, "read chunk"); // shorthand
+//! service_kit::event!(tracing::Level::INFO,  "io", "read {} bytes at {}", n, off);
+//! ```
+//!
+//! `event!` does two things, cheaply: it appends to the **track** named by its
+//! second argument on the handler span the call site is running within (found
+//! via the current `tracing` span — outside any handler span it's a no-op),
+//! *and* it emits an ordinary `tracing` event at the given level. That event is
+//! usually filtered out, but it surfaces in the log stream when the process —
+//! or just that handler, via [`crate::trace`] — is turned up; rendering the
+//! message for it is deferred to that moment.
+//!
+//! Pair `event!` with `tracing::trace!`: emit an `event!` at RX/TX boundaries
+//! and at future-completion points (the events that define *what happened*),
+//! and use `tracing::trace!` for periodic fine-grain logging of internal
+//! state and decisions. When debugging a stuck task an operator can then turn
+//! the log level up on the admin dashboard to see ongoing tracing of internal
+//! state, *and* review the historical event tracks captured before the turn-up
+//! — the sequence of events that led the task to its current state.
+//!
+//! The track side reaches the handler's buffers by downcasting the active
+//! `tracing` dispatcher to a [`tracing_subscriber::registry::Registry`] — so
+//! it's silently a no-op under any other subscriber, even though the `tracing`
+//! event still fires. In practice that's fine: a process that wants track
+//! capture installs [`layer`] on a `tracing_subscriber` registry stack anyway.
+//!
+//! Laziness — the track capture path does as little as possible, because most
+//! tracks are never looked at:
+//! - a literal message is stored as the `&'static str` it already is — no
+//!   allocation, no formatting;
+//! - an interpolated message is stored as `(template, captured args)` and
+//!   assembled by [`render_args`] only when it's actually read — by the
+//!   drill-down page, or by the (usually-filtered) log event;
+//! - field/argument values are stored in [`Captured`] — scalars stay scalars,
+//!   `&'static str` stays static — so capture allocates only the (small) vectors
+//!   holding them, and only when there are any;
+//! - a value whose *text* rendering is itself expensive — or that's simply not
+//!   one of the cheap types above — can be a [`lazy`] thunk (`event::lazy(|| …)`,
+//!   [`json`] for a `serde::Serialize`, or [`debug`] for a `std::fmt::Debug`):
+//!   the `Fn() -> String` is stored as-is and called only if the event is read —
+//!   a drill-down snapshot, or the usually-filtered log event — possibly more
+//!   than once.
+//!
+//! The contract that buys this (see [`IntoCaptured`]): an `event!` value must
+//! be a number, `bool`, `&'static str`, `String`, `Arc<str>`,
+//! `proto_gazette::uuid::Clock`, or a [`lazy`]/[`json`]/[`debug`] thunk. Anything
+//! else — notably a borrowed `&str` or a `?x`/`%x`-style value — must be turned
+//! into one of those at the call site (`x.to_string()` for a `Display`,
+//! `event::debug(x)` for a `Debug`), making the cost visible.
+
+use crate::Registry;
+use crate::trace::HandlerIdVisitor;
+use std::borrow::Cow;
+use std::collections::{BTreeMap, VecDeque};
+use std::fmt::Write as _;
+use std::sync::Arc;
+use std::time::SystemTime;
+
+/// Events retained per track.
+const TRACK_CAPACITY: usize = 10;
+
+/// A handler's set of event tracks. Created by [`Registry::register`], hung off
+/// the handler's span by the [`layer`] this module installs (so
+/// [`event!`](crate::event!) reaches it via the current span), and snapshotted
+/// for the admin surface and the recently-finished ring.
+///
+/// Keyed by track name — a `&'static str`, because [`event!`](crate::event!)
+/// only accepts a string literal there — so there's one entry per distinct
+/// `event!` track name in the handler's code, a handful; a `Vec` with linear
+/// scan beats a map.
+#[derive(Default)]
+pub struct Tracks(std::sync::Mutex<Vec<(&'static str, VecDeque<Event>)>>);
+
+struct Event {
+    at: SystemTime,
+    level: tracing::Level,
+    message: Message,
+    fields: Vec<(&'static str, Captured)>,
+}
+
+/// An event's message: a bare literal (kept as-is) or a deferred interpolation
+/// (template + captured args, assembled by [`render_args`] at read time). Built
+/// by [`record`] from the `(template, args)` the macro passes.
+enum Message {
+    Static(&'static str),
+    Formatted {
+        template: &'static str,
+        args: Vec<Captured>,
+    },
+}
+
+/// A cheaply-owned value captured for an event field or interpolation argument;
+/// see [`IntoCaptured`]. Rendered to text via its [`std::fmt::Display`] impl
+/// only when the drill-down page (or the deferred `tracing` event) needs it.
+pub enum Captured {
+    Bool(bool),
+    I64(i64),
+    U64(u64),
+    F64(f64),
+    Static(&'static str),
+    Owned(String),
+    Shared(Arc<str>),
+    Clock(proto_gazette::uuid::Clock),
+    Lazy(Box<dyn Fn() -> String + Send>),
+}
+
+impl std::fmt::Display for Captured {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Captured::Bool(v) => v.fmt(f),
+            Captured::I64(v) => v.fmt(f),
+            Captured::U64(v) => v.fmt(f),
+            Captured::F64(v) => v.fmt(f),
+            Captured::Static(v) => f.write_str(v),
+            Captured::Owned(v) => f.write_str(v),
+            Captured::Shared(v) => f.write_str(v),
+            Captured::Clock(c) => f.write_str(&crate::handlers::rfc3339_millis(c.to_time())),
+            Captured::Lazy(render) => f.write_str(&render()),
+        }
+    }
+}
+
+/// Capture a value whose *text* rendering is expensive enough to defer: `f` is
+/// stored as-is and called only if the event is read — the drill-down page, or
+/// the `event!`-emitted `tracing` event when it isn't filtered out — and then
+/// possibly more than once. Use it for an [`event!`](crate::event!) field or
+/// interpolation argument whose rendering you don't want to pay for on the
+/// common path where the track is never looked at:
+///
+/// ```ignore
+/// service_kit::event!(
+///     tracing::Level::DEBUG, "rpc",
+///     body = service_kit::event::lazy(move || serde_json::to_string(&msg).unwrap()),
+///     "received {}", kind,
+/// );
+/// ```
+///
+/// The closure is `Send + 'static` — the track outlives the `event!` call and
+/// is shared across threads — so it must own what it renders; clone or `Arc` a
+/// borrow at the call site, keeping that cost visible.
+#[inline]
+pub fn lazy(f: impl Fn() -> String + Send + 'static) -> Captured {
+    Captured::Lazy(Box::new(f))
+}
+
+/// A [`lazy`] thunk that compact-encodes `value` as JSON when the event is read
+/// — for an `event!` field or interpolation argument that's a `serde::Serialize`
+/// you don't want to pay to serialize on the common path. `value` is moved into
+/// the thunk (it's `Send + 'static`, see [`lazy`]); a serialization error
+/// renders as a placeholder rather than panicking on the read path.
+#[inline]
+pub fn json(value: impl serde::Serialize + Send + 'static) -> Captured {
+    Captured::Lazy(Box::new(move || match serde_json::to_string(&value) {
+        Ok(s) => s,
+        Err(err) => format!("<unserializable: {err}>"),
+    }))
+}
+
+/// A [`lazy`] thunk that renders `value` with its [`std::fmt::Debug`] impl when
+/// the event is read. `value` is moved into the thunk (it's `Send + 'static`, see
+/// [`lazy`]); if the type is `Clone` and held by reference at the call site,
+/// clone it in (`event::debug(x.clone())`) — keeping the cost visible.
+#[inline]
+pub fn debug(value: impl std::fmt::Debug + Send + 'static) -> Captured {
+    Captured::Lazy(Box::new(move || format!("{value:?}")))
+}
+
+/// Conversion into [`Captured`] — implemented only for values that are cheap to
+/// own (no allocation, or at most a small move/clone). This is what restricts
+/// [`event!`](crate::event!) to lazily-capturable values.
+pub trait IntoCaptured {
+    fn into_captured(self) -> Captured;
+}
+
+impl IntoCaptured for bool {
+    #[inline]
+    fn into_captured(self) -> Captured {
+        Captured::Bool(self)
+    }
+}
+impl IntoCaptured for &'static str {
+    #[inline]
+    fn into_captured(self) -> Captured {
+        Captured::Static(self)
+    }
+}
+impl IntoCaptured for String {
+    #[inline]
+    fn into_captured(self) -> Captured {
+        Captured::Owned(self)
+    }
+}
+impl IntoCaptured for Arc<str> {
+    #[inline]
+    fn into_captured(self) -> Captured {
+        Captured::Shared(self)
+    }
+}
+impl IntoCaptured for Captured {
+    /// Identity — lets [`lazy`] (and any explicit [`Captured`]) flow through the
+    /// `event!` macro's per-value `into_captured` call unchanged.
+    #[inline]
+    fn into_captured(self) -> Captured {
+        self
+    }
+}
+impl IntoCaptured for proto_gazette::uuid::Clock {
+    #[inline]
+    fn into_captured(self) -> Captured {
+        Captured::Clock(self)
+    }
+}
+impl IntoCaptured for f32 {
+    #[inline]
+    fn into_captured(self) -> Captured {
+        Captured::F64(self as f64)
+    }
+}
+impl IntoCaptured for f64 {
+    #[inline]
+    fn into_captured(self) -> Captured {
+        Captured::F64(self)
+    }
+}
+macro_rules! impl_into_captured_int {
+    ($($signed:ty),+ ; $($unsigned:ty),+) => {
+        $( impl IntoCaptured for $signed { #[inline] fn into_captured(self) -> Captured { Captured::I64(self as i64) } } )+
+        $( impl IntoCaptured for $unsigned { #[inline] fn into_captured(self) -> Captured { Captured::U64(self as u64) } } )+
+    };
+}
+impl_into_captured_int!(i8, i16, i32, i64, isize ; u8, u16, u32, u64, usize);
+
+/// Append an event to the per-handler track `$track`, *and* emit it as a
+/// `tracing` event at `$level`. See the [`event`](crate::event) module docs.
+///
+/// The shape mirrors `tracing`'s event macros — leading `name = value` fields,
+/// a message literal, then positional `{}` interpolation args. A bare
+/// identifier is shorthand for `name = name`:
+/// - `event!(level, track, "literal")`
+/// - `event!(level, track, "fmt {} {}", a, b)` — positional `{}` interpolation
+/// - `event!(level, track, k1 = v1, k2 = v2, "literal")` — structured fields
+/// - `event!(level, track, k1, k2 = v2, "literal")` — `k1` is sugar for `k1 = k1`
+/// - `event!(level, track, k1 = v1, "fmt {}", a)` — fields *and* interpolation
+/// - `event!(level, track, k1 = v1, k2 = v2)` — fields only, no message
+///
+/// `track` must be a string literal — the track topology of a handler is a
+/// deliberate, greppable set of call sites, not a dynamically-derived thing.
+/// `level` must be a `tracing::Level` constant (`tracing::Level::DEBUG`, …), as
+/// for [`tracing::event!`]. Interpolation is positional `{}` only: a `{name}`,
+/// `{0}`, or `{:spec}` is **rejected at compile time** (via
+/// [`check_template`](crate::event::check_template)) — write `{}` and pass the
+/// value positionally. The `tracing` event renders the same text as the track,
+/// so use `Display`-friendly values; a placeholder/argument count mismatch
+/// trips a `debug_assert!`. Each `event!` value must implement
+/// [`IntoCaptured`](crate::event::IntoCaptured) (number, `bool`, `&'static str`,
+/// `String`, `Arc<str>`, `proto_gazette::uuid::Clock`); turn anything else into
+/// one of those at the call site, or defer its rendering until — and only if —
+/// the event is read with
+/// [`lazy`](crate::event::lazy) (a `Fn() -> String`),
+/// [`json`](crate::event::json) (a `serde::Serialize`), or
+/// [`debug`](crate::event::debug) (a `std::fmt::Debug`).
+///
+/// The `tracing` event always carries a structured `track = <name>` field so an
+/// `fmt` consumer can group/filter log lines by track. `track` is therefore
+/// reserved.
+#[macro_export]
+macro_rules! event {
+    // Zero or more leading `name [= value]` fields, a message literal, then
+    // zero or more positional `{}` interpolation args. Each field is either
+    // `name = val,` or the bare `name,` shorthand for `name = name` — same as
+    // `tracing::debug!` et al. (The trailing comma on every field — including
+    // the one before `$msg` — lets the repetition end cleanly at the literal
+    // without a separator-comma ambiguity.)
+    ($level:expr, $track:literal, $($name:ident $(= $val:expr)?,)* $msg:literal $(, $arg:expr)* $(,)?) => {{
+        // Compile-time: the template must use only bare `{}` placeholders. Its
+        // placeholder count is also the expected argument count, debug-checked
+        // below against what was actually passed.
+        const __EVENT_PLACEHOLDERS: usize = $crate::event::check_template($msg);
+        let __event_fields: ::std::vec::Vec<(&'static str, $crate::event::Captured)> = ::std::vec![
+            $( (
+                ::std::stringify!($name),
+                $crate::event::IntoCaptured::into_captured($crate::__event_value!($name $(= $val)?)),
+            ), )*
+        ];
+        let __event_args: ::std::vec::Vec<$crate::event::Captured> = ::std::vec![
+            $( $crate::event::IntoCaptured::into_captured($arg), )*
+        ];
+        ::std::debug_assert_eq!(
+            __EVENT_PLACEHOLDERS, __event_args.len(),
+            "event!: format string {:?} has {} placeholder(s) but {} argument(s) were passed",
+            $msg, __EVENT_PLACEHOLDERS, __event_args.len(),
+        );
+        ::tracing::event!(
+            $level,
+            track = $track,
+            $( $name = %$crate::event::lookup_field(&__event_fields, ::std::stringify!($name)), )*
+            "{}", $crate::event::render_args($msg, &__event_args)
+        );
+        $crate::event::record($level, $track, $msg, __event_args, __event_fields);
+    }};
+    // Fields only, no message. (Defers to the form above with an empty message,
+    // as `tracing`'s `info!(field = v)` produces an event with no message.)
+    ($level:expr, $track:literal, $($name:ident $(= $val:expr)?),+ $(,)?) => {
+        $crate::event!($level, $track, $($name $(= $val)?,)+ "")
+    };
+}
+
+/// Pick the value for an `event!` field: the explicit `$val` when given,
+/// otherwise the identifier itself (the `foo` → `foo = foo` shorthand). Lifted
+/// to its own macro because `macro_rules` can't expand an `$(= $val:expr)?`
+/// repetition into "use `$val` if present, else `$name`" inline.
+#[doc(hidden)]
+#[macro_export]
+macro_rules! __event_value {
+    ($name:ident) => {
+        $name
+    };
+    ($name:ident = $val:expr) => {
+        $val
+    };
+}
+
+/// Append an event to the current handler's track `track` — a literal message
+/// (`args` empty) or a deferred interpolation of `template` by `args`. Used by
+/// the [`event!`](crate::event!) macro; no-op outside a handler span.
+#[doc(hidden)]
+#[inline]
+pub fn record(
+    level: tracing::Level,
+    track: &'static str,
+    template: &'static str,
+    args: Vec<Captured>,
+    fields: Vec<(&'static str, Captured)>,
+) {
+    let Some(tracks) = current_handler_tracks() else {
+        return;
+    };
+    let message = if args.is_empty() {
+        Message::Static(template)
+    } else {
+        Message::Formatted { template, args }
+    };
+    tracks.record(
+        track,
+        Event {
+            at: SystemTime::now(),
+            level,
+            message,
+            fields,
+        },
+    );
+}
+
+/// Look a field's value up by name within an `event!`-built field vector. The
+/// name is always present (the macro just inserted it); this exists only so the
+/// expanded [`tracing::event!`] can name fields without re-evaluating their
+/// values. Macro plumbing — not part of the intended API.
+#[doc(hidden)]
+pub fn lookup_field<'a>(fields: &'a [(&'static str, Captured)], name: &str) -> &'a Captured {
+    fields
+        .iter()
+        .find(|(n, _)| *n == name)
+        .map(|(_, v)| v)
+        .expect("event! just inserted this field")
+}
+
+/// Compile-time check, invoked by [`event!`](crate::event!), that `template`
+/// uses only bare `{}` placeholders (it returns their count, used for a
+/// debug-time placeholder/argument count assertion). A `{name}`, `{0}`, or
+/// `{:spec}` would be taken as a plain positional slot with its contents
+/// silently dropped — and a stray `}` would be a literal — so all of those are
+/// rejected at the call site. `{{` / `}}` are escaped literal braces.
+#[doc(hidden)]
+pub const fn check_template(template: &str) -> usize {
+    let b = template.as_bytes();
+    let mut count = 0usize;
+    let mut i = 0;
+    while i < b.len() {
+        if b[i] == b'{' {
+            if i + 1 < b.len() && b[i + 1] == b'{' {
+                i += 2; // escaped `{{`
+            } else if i + 1 < b.len() && b[i + 1] == b'}' {
+                count += 1;
+                i += 2; // bare `{}` placeholder
+            } else {
+                panic!(
+                    "event! format strings allow only bare positional placeholders: \
+                     write a brace pair and pass the value as an argument \
+                     (named or indexed args and format specs are not supported)"
+                );
+            }
+        } else if b[i] == b'}' {
+            if i + 1 < b.len() && b[i + 1] == b'}' {
+                i += 2; // escaped `}}`
+            } else {
+                panic!(
+                    "event! format string has an unmatched closing brace; double it for a literal"
+                );
+            }
+        } else {
+            i += 1;
+        }
+    }
+    count
+}
+
+/// Render an `event!` message: substitute each `{}` in `template` with the next
+/// arg's `Display`, collapse `{{` / `}}` to single braces, return `template`
+/// borrowed when it has neither. Lazy — called only when the message is read
+/// (a drill-down snapshot, or the macro's `tracing` event when unfiltered).
+///
+/// [`check_template`] has already rejected any non-`{}` placeholder by the time
+/// an `event!` template reaches here; the leftover handling (treat any `{…}` as
+/// a slot, emit `{?}` when out of args, ignore an unmatched brace) is just so
+/// this is total rather than panicking on input that can't actually occur.
+#[doc(hidden)]
+pub fn render_args<'a>(template: &'a str, args: &[Captured]) -> Cow<'a, str> {
+    if !template.contains(['{', '}']) {
+        return Cow::Borrowed(template);
+    }
+    let mut out = String::with_capacity(template.len() + 8 * args.len());
+    let mut args = args.iter();
+    let mut rest = template;
+    while let Some(i) = rest.find(['{', '}']) {
+        out.push_str(&rest[..i]);
+        let bytes = rest.as_bytes();
+        let here = bytes[i];
+        if bytes.get(i + 1) == Some(&here) {
+            out.push(here as char); // `{{` or `}}`
+            rest = &rest[i + 2..];
+        } else if here == b'{' {
+            // A placeholder `{…}`: skip to its closing `}`, dropping whatever's
+            // between (a name / index / format spec — `event!` rejects those).
+            rest = match rest[i + 1..].find('}') {
+                Some(j) => &rest[i + 1 + j + 1..],
+                None => "", // malformed; stop.
+            };
+            match args.next() {
+                Some(v) => {
+                    let _ = write!(out, "{v}");
+                }
+                None => out.push_str("{?}"),
+            }
+        } else {
+            out.push('}'); // stray `}`
+            rest = &rest[i + 1..];
+        }
+    }
+    out.push_str(rest);
+    Cow::Owned(out)
+}
+
+fn render_message(message: &Message) -> Cow<'_, str> {
+    match message {
+        Message::Static(s) => Cow::Borrowed(s),
+        Message::Formatted { template, args } => render_args(template, args),
+    }
+}
+
+impl Tracks {
+    #[inline]
+    fn record(&self, track: &'static str, event: Event) {
+        let mut tracks = self.0.lock().unwrap();
+        let idx = match tracks.iter().position(|(name, _)| *name == track) {
+            Some(idx) => idx,
+            None => {
+                tracks.push((track, VecDeque::with_capacity(TRACK_CAPACITY)));
+                tracks.len() - 1
+            }
+        };
+        let events = &mut tracks[idx].1;
+        if events.len() == TRACK_CAPACITY {
+            events.pop_front();
+        }
+        events.push_back(event);
+    }
+
+    /// Snapshot and render every track (newest event last within each), keyed
+    /// by track name, with both an age (relative to now) and an absolute
+    /// RFC-3339 timestamp on each event.
+    pub fn snapshot(&self) -> BTreeMap<String, Vec<EventView>> {
+        let now = SystemTime::now();
+        let tracks = self.0.lock().unwrap();
+        tracks
+            .iter()
+            .map(|(name, events)| {
+                let views = events
+                    .iter()
+                    .map(|e| EventView {
+                        age_seconds: now.duration_since(e.at).unwrap_or_default().as_secs(),
+                        at_rfc3339: crate::handlers::rfc3339_millis(e.at),
+                        level: e.level.as_str(),
+                        message: render_message(&e.message).into_owned(),
+                        fields: e.fields.iter().map(|(n, v)| (*n, v.to_string())).collect(),
+                    })
+                    .collect();
+                (name.to_string(), views)
+            })
+            .collect()
+    }
+}
+
+/// One captured event, as presented by the admin surface.
+#[derive(Clone, serde::Serialize)]
+pub struct EventView {
+    pub age_seconds: u64,
+    pub at_rfc3339: String,
+    pub level: &'static str,
+    pub message: String,
+    pub fields: Vec<(&'static str, String)>,
+}
+
+/// A `tracing_subscriber` layer that hangs each handler's [`Tracks`] off the
+/// handler span, so [`event!`](crate::event!) can find it via the current span.
+/// Add it to the registry stack:
+/// `tracing_subscriber::registry().with(fmt_layer…).with(event::layer(registry))`.
+pub fn layer<S>(registry: Registry) -> impl tracing_subscriber::Layer<S>
+where
+    S: tracing::Subscriber + for<'a> tracing_subscriber::registry::LookupSpan<'a>,
+{
+    use tracing_subscriber::Layer as _;
+    EventLayer { registry }.with_filter(EventFilter)
+}
+
+struct EventLayer {
+    registry: Registry,
+}
+
+/// Span extension on a handler span: that handler's event tracks.
+struct EventExt(Arc<Tracks>);
+
+impl<S> tracing_subscriber::Layer<S> for EventLayer
+where
+    S: tracing::Subscriber + for<'a> tracing_subscriber::registry::LookupSpan<'a>,
+{
+    fn on_new_span(
+        &self,
+        attrs: &tracing::span::Attributes<'_>,
+        id: &tracing::span::Id,
+        ctx: tracing_subscriber::layer::Context<'_, S>,
+    ) {
+        let mut visitor = HandlerIdVisitor(None);
+        attrs.record(&mut visitor);
+        let Some(handler_id) = visitor.0 else { return };
+        let Some(tracks) = self.registry.tracks_handle(handler_id) else {
+            return;
+        };
+        if let Some(span) = ctx.span(id) {
+            span.extensions_mut().insert(EventExt(tracks));
+        }
+    }
+}
+
+/// Per-layer filter: [`EventLayer`] cares only about handler spans (where it
+/// hangs the `EventExt`); everything else — every event, every other span —
+/// bypasses it entirely.
+struct EventFilter;
+
+impl<S> tracing_subscriber::layer::Filter<S> for EventFilter {
+    fn callsite_enabled(
+        &self,
+        meta: &'static tracing::Metadata<'static>,
+    ) -> tracing::subscriber::Interest {
+        if meta.is_span() && meta.target() == crate::handlers::HANDLER_SPAN_TARGET {
+            tracing::subscriber::Interest::always()
+        } else {
+            tracing::subscriber::Interest::never()
+        }
+    }
+
+    fn enabled(
+        &self,
+        _meta: &tracing::Metadata<'_>,
+        _cx: &tracing_subscriber::layer::Context<'_, S>,
+    ) -> bool {
+        // `callsite_enabled` answers definitively for every callsite.
+        true
+    }
+
+    fn max_level_hint(&self) -> Option<tracing_subscriber::filter::LevelFilter> {
+        // The handler span is an `info_span!`; advertise `INFO` so that callsite
+        // stays live, and our `on_new_span` fires for it.
+        Some(tracing_subscriber::filter::LevelFilter::INFO)
+    }
+}
+
+/// The [`Tracks`] of the handler whose span (or a descendant of it) is
+/// currently entered, if any — via the active `tracing` dispatcher's span store.
+#[inline]
+fn current_handler_tracks() -> Option<Arc<Tracks>> {
+    use tracing_subscriber::registry::LookupSpan as _;
+
+    tracing::dispatcher::get_default(|dispatch| {
+        let id = dispatch.current_span().id()?.clone();
+        let registry = dispatch.downcast_ref::<tracing_subscriber::registry::Registry>()?;
+        let mut span = registry.span(&id)?;
+        loop {
+            if let Some(ext) = span.extensions().get::<EventExt>() {
+                return Some(ext.0.clone());
+            }
+            span = span.parent()?;
+        }
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tracing_subscriber::prelude::*;
+
+    fn ev(at: SystemTime) -> Event {
+        Event {
+            at,
+            level: tracing::Level::INFO,
+            message: Message::Static("x"),
+            fields: Vec::new(),
+        }
+    }
+
+    #[test]
+    fn track_evicts_oldest_within_each_name() {
+        let tracks = Tracks::default();
+        for i in 0..(TRACK_CAPACITY + 3) {
+            tracks.record(
+                "io",
+                Event {
+                    message: Message::Formatted {
+                        template: "e{}",
+                        args: vec![Captured::I64(i as i64)],
+                    },
+                    ..ev(SystemTime::now())
+                },
+            );
+        }
+        tracks.record("rpc", ev(SystemTime::now()));
+
+        let snap = tracks.snapshot();
+        assert_eq!(snap["io"].len(), TRACK_CAPACITY);
+        assert_eq!(snap["io"].first().unwrap().message, "e3");
+        assert_eq!(
+            snap["io"].last().unwrap().message,
+            format!("e{}", TRACK_CAPACITY + 2)
+        );
+        // A second distinct track name gets its own buffer.
+        assert_eq!(snap["rpc"].len(), 1);
+    }
+
+    #[test]
+    fn render_args_substitutes_and_escapes_braces() {
+        let a = [Captured::I64(3), Captured::Static("ok")];
+        assert_eq!(render_args("read {} bytes: {}", &a), "read 3 bytes: ok");
+        // `render_args` itself is lenient about specs / stray braces; the
+        // `event!` macro rejects them at compile time (see `check_template`).
+        assert_eq!(
+            render_args("spec {:>8?} ignored", &a[..1]),
+            "spec 3 ignored"
+        );
+        assert_eq!(
+            render_args("braces {{}} and {}", &a[..1]),
+            "braces {} and 3"
+        );
+        assert_eq!(render_args("missing {}", &[]), "missing {?}");
+        // Nothing to substitute or escape — borrowed, not reallocated.
+        assert!(matches!(
+            render_args("plain message", &a),
+            Cow::Borrowed("plain message")
+        ));
+    }
+
+    #[test]
+    fn lazy_capture_renders_only_when_read() {
+        use std::sync::atomic::{AtomicUsize, Ordering};
+
+        let calls = Arc::new(AtomicUsize::new(0));
+        let tracks = Tracks::default();
+        let c = calls.clone();
+        tracks.record(
+            "io",
+            Event {
+                fields: vec![(
+                    "body",
+                    lazy(move || {
+                        c.fetch_add(1, Ordering::Relaxed);
+                        "rendered".to_string()
+                    }),
+                )],
+                ..ev(SystemTime::now())
+            },
+        );
+        // Captured, but not yet rendered.
+        assert_eq!(calls.load(Ordering::Relaxed), 0);
+
+        let snap = tracks.snapshot();
+        assert_eq!(snap["io"][0].fields, vec![("body", "rendered".to_string())]);
+        assert_eq!(calls.load(Ordering::Relaxed), 1);
+        // Each read re-runs the thunk.
+        let _ = tracks.snapshot();
+        assert_eq!(calls.load(Ordering::Relaxed), 2);
+    }
+
+    #[test]
+    fn json_capture_renders_compact_json() {
+        let tracks = Tracks::default();
+        tracks.record(
+            "io",
+            Event {
+                fields: vec![("body", json(serde_json::json!({"n": 3, "ok": true})))],
+                ..ev(SystemTime::now())
+            },
+        );
+        assert_eq!(
+            tracks.snapshot()["io"][0].fields,
+            vec![("body", r#"{"n":3,"ok":true}"#.to_string())]
+        );
+    }
+
+    #[test]
+    fn debug_capture_renders_debug_fmt() {
+        let tracks = Tracks::default();
+        tracks.record(
+            "io",
+            Event {
+                fields: vec![("v", debug(vec![1u32, 2, 3]))],
+                ..ev(SystemTime::now())
+            },
+        );
+        assert_eq!(
+            tracks.snapshot()["io"][0].fields,
+            vec![("v", "[1, 2, 3]".to_string())]
+        );
+    }
+
+    #[test]
+    fn clock_capture_renders_rfc3339() {
+        let tracks = Tracks::default();
+        tracks.record(
+            "io",
+            Event {
+                fields: vec![(
+                    "at",
+                    proto_gazette::uuid::Clock::from_unix(1_700_000_000, 500_000_000)
+                        .into_captured(),
+                )],
+                ..ev(SystemTime::now())
+            },
+        );
+        assert_eq!(
+            tracks.snapshot()["io"][0].fields,
+            vec![("at", "2023-11-14T22:13:20.500Z".to_string())]
+        );
+    }
+
+    #[test]
+    fn check_template_counts_placeholders() {
+        assert_eq!(check_template(""), 0);
+        assert_eq!(check_template("plain message"), 0);
+        assert_eq!(check_template("read {} bytes at {}"), 2);
+        assert_eq!(check_template("escaped {{}} braces, one {} slot"), 1);
+        // It's a `const fn` — also usable in const position.
+        const N: usize = check_template("a {} b {} c {}");
+        assert_eq!(N, 3);
+    }
+
+    #[test]
+    #[should_panic(expected = "bare positional placeholders")]
+    fn check_template_rejects_named_placeholder() {
+        check_template("hello {name}");
+    }
+
+    #[test]
+    #[should_panic(expected = "bare positional placeholders")]
+    fn check_template_rejects_format_spec() {
+        check_template("padded {:>8}");
+    }
+
+    #[test]
+    #[should_panic(expected = "unmatched closing brace")]
+    fn check_template_rejects_stray_close() {
+        check_template("oops }");
+    }
+
+    #[test]
+    fn macro_captures_into_current_handler_track() {
+        let registry = Registry::new();
+        let subscriber = tracing_subscriber::registry().with(layer(registry.clone()));
+
+        tracing::subscriber::with_default(subscriber, || {
+            let mut handler = registry.register("test.kind");
+            let id = registry.snapshot().live[0].id;
+            let span = handler.span();
+            let entered = span.enter();
+
+            crate::event!(tracing::Level::DEBUG, "io", "opened");
+            crate::event!(
+                tracing::Level::INFO,
+                "io",
+                bytes = 3usize,
+                eof = false,
+                "read chunk"
+            );
+            // Reached via an intermediate (non-handler) span.
+            tracing::info_span!("inner").in_scope(|| {
+                crate::event!(tracing::Level::WARN, "io", "slow read {} of {}", 2, 9);
+            });
+            crate::event!(tracing::Level::DEBUG, "io", tag = "x", "tagged {}", 7);
+            crate::event!(tracing::Level::TRACE, "io", attempt = 4u32);
+
+            let detail = registry.handler_detail(id).expect("live");
+            let io = &detail.tracks["io"];
+            assert_eq!(io.len(), 5);
+            assert_eq!((io[0].level, io[0].message.as_str()), ("DEBUG", "opened"));
+            assert!(io[0].fields.is_empty());
+            assert_eq!(
+                (io[1].level, io[1].message.as_str()),
+                ("INFO", "read chunk")
+            );
+            assert_eq!(
+                io[1].fields,
+                vec![("bytes", "3".to_string()), ("eof", "false".to_string())]
+            );
+            assert_eq!(
+                (io[2].level, io[2].message.as_str()),
+                ("WARN", "slow read 2 of 9")
+            );
+            assert_eq!(
+                (io[3].message.as_str(), &io[3].fields[..]),
+                ("tagged 7", &[("tag", "x".to_string())][..])
+            );
+            // Fields-only: empty message, the field is present.
+            assert_eq!(
+                (io[4].message.as_str(), &io[4].fields[..]),
+                ("", &[("attempt", "4".to_string())][..])
+            );
+
+            drop(entered);
+            handler.finish_ok();
+        });
+
+        // The tracks survive into the recently-finished entry.
+        let detail = registry.handler_detail(0).expect("finished");
+        assert!(detail.finished);
+        assert_eq!(detail.tracks["io"].len(), 5);
+    }
+
+    #[test]
+    fn macro_accepts_bare_ident_shorthand() {
+        let registry = Registry::new();
+        let subscriber = tracing_subscriber::registry().with(layer(registry.clone()));
+
+        tracing::subscriber::with_default(subscriber, || {
+            let mut handler = registry.register("test.kind");
+            let id = registry.snapshot().live[0].id;
+            let span = handler.span();
+            let _entered = span.enter();
+
+            let bytes = 7usize;
+            let eof = false;
+            // Bare `bytes` is sugar for `bytes = bytes`; mix freely with the
+            // `name = value` form, and with a message + positional args.
+            crate::event!(
+                tracing::Level::INFO,
+                "io",
+                bytes,
+                eof,
+                tag = "x",
+                "read {} bytes",
+                bytes,
+            );
+            // Fields-only with a bare ident at the tail.
+            let attempt = 4u32;
+            crate::event!(tracing::Level::TRACE, "io", attempt);
+
+            let detail = registry.handler_detail(id).expect("live");
+            let io = &detail.tracks["io"];
+            assert_eq!(
+                (io[0].message.as_str(), &io[0].fields[..]),
+                (
+                    "read 7 bytes",
+                    &[
+                        ("bytes", "7".to_string()),
+                        ("eof", "false".to_string()),
+                        ("tag", "x".to_string()),
+                    ][..],
+                ),
+            );
+            assert_eq!(
+                (io[1].message.as_str(), &io[1].fields[..]),
+                ("", &[("attempt", "4".to_string())][..]),
+            );
+
+            handler.finish_ok();
+        });
+    }
+
+    #[test]
+    fn macro_accepts_lazy_thunks() {
+        let registry = Registry::new();
+        let subscriber = tracing_subscriber::registry().with(layer(registry.clone()));
+
+        tracing::subscriber::with_default(subscriber, || {
+            let mut handler = registry.register("test.kind");
+            let id = registry.snapshot().live[0].id;
+            let span = handler.span();
+            let _entered = span.enter();
+
+            // Lazy thunk as a field, and as an interpolation argument.
+            crate::event!(
+                tracing::Level::DEBUG,
+                "io",
+                body = crate::event::lazy(|| "the body".to_string()),
+                "got {} ({})",
+                "hello",
+                crate::event::lazy(|| "lazy arg".to_string()),
+            );
+
+            let detail = registry.handler_detail(id).expect("live");
+            let io = &detail.tracks["io"];
+            assert_eq!(io[0].message, "got hello (lazy arg)");
+            assert_eq!(io[0].fields, vec![("body", "the body".to_string())]);
+
+            handler.finish_ok();
+        });
+    }
+
+    #[test]
+    fn macro_outside_a_handler_is_a_noop() {
+        let registry = Registry::new();
+        let subscriber = tracing_subscriber::registry().with(layer(registry.clone()));
+        tracing::subscriber::with_default(subscriber, || {
+            crate::event!(tracing::Level::INFO, "io", "no handler span");
+            tracing::info_span!("plain").in_scope(|| {
+                crate::event!(tracing::Level::INFO, "io", "still no handler span");
+            });
+        });
+        assert!(registry.snapshot().live.is_empty());
+        assert!(registry.snapshot().recent.is_empty());
+    }
+}
diff --git a/crates/service-kit/src/handlers.rs b/crates/service-kit/src/handlers.rs
new file mode 100644
index 00000000000..5a4f02c0aa7
--- /dev/null
+++ b/crates/service-kit/src/handlers.rs
@@ -0,0 +1,522 @@
+use crate::event;
+use std::borrow::Cow;
+use std::collections::{BTreeMap, VecDeque};
+use std::sync::atomic::{AtomicU8, Ordering};
+use std::sync::{Arc, Mutex};
+use std::time::SystemTime;
+
+/// Number of recently-finished handlers retained for the dashboard.
+const RECENT_CAPACITY: usize = 64;
+
+/// Target of the per-handler `tracing` span opened by [`Registry::register`].
+/// [`crate::trace`]'s filter recognizes spans with this target, hangs the
+/// handler's trace-override atomic off them, and walks the span scope to decide
+/// whether an otherwise-filtered event should be admitted.
+pub(crate) const HANDLER_SPAN_TARGET: &str = "service_kit::handler";
+
+/// Registry tracks the lifecycle of in-flight units of work — gRPC handlers,
+/// jobs, connections, whatever a service spawns — so an operator (via
+/// [`crate::admin`]) can see what the process is doing right now.
+///
+/// It's cheap to construct and clone; callers that don't expose an admin
+/// surface construct one and ignore it.
+#[derive(Clone, Default)]
+pub struct Registry(Arc<Mutex<Inner>>);
+
+#[derive(Default)]
+struct Inner {
+    next_id: u64,
+    live: BTreeMap<u64, Arc<Slot>>,
+    // Newest-last ring of handlers that have finished.
+    recent: VecDeque<FinishedView>,
+}
+
+struct Slot {
+    id: u64,
+    kind: &'static str,
+    started_at: SystemTime,
+    // Verbosity floor for an operator-set trace override: 0 = none,
+    // 1..=5 = ERROR..TRACE (see `level_to_u8`). Read on the tracing hot path
+    // by `crate::trace`, written by `Registry::set_trace_override`.
+    trace_override: Arc<AtomicU8>,
+    // Per-handler set of event tracks (named ring buffers) emitted within the
+    // handler span. Populated on the tracing hot path by `crate::event`, hung
+    // off the handler span by it too; snapshotted for the admin surface and,
+    // on drop, into the recently-finished ring. See `crate::event`.
+    tracks: Arc<event::Tracks>,
+    // Mutable as the handler learns its identity and advances through phases.
+    state: Mutex<SlotState>,
+}
+
+struct SlotState {
+    label: String,
+    phase: Cow<'static, str>,
+    phase_since: SystemTime,
+    fields: Vec<(&'static str, String)>,
+}
+
+impl Registry {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Register a new handler of the given `kind` (a stable, short identifier
+    /// like `"leader.materialize"` or `"shuffle.session"`). The returned guard
+    /// removes the handler from the registry when dropped, recording it in the
+    /// recently-finished ring.
+    ///
+    /// The guard also carries a [`tracing::Span`] (see [`HandlerGuard::span`]):
+    /// the handler should run its body inside it (`.instrument(handler.span())`)
+    /// so that operator-directed trace overrides reach the handler's events.
+    pub fn register(&self, kind: &'static str) -> HandlerGuard {
+        let now = SystemTime::now();
+
+        let (id, slot) = {
+            let mut inner = self.0.lock().unwrap();
+            let id = inner.next_id;
+            inner.next_id += 1;
+
+            let slot = Arc::new(Slot {
+                id,
+                kind,
+                started_at: now,
+                trace_override: Arc::new(AtomicU8::new(0)),
+                tracks: Arc::new(event::Tracks::default()),
+                state: Mutex::new(SlotState {
+                    label: String::new(),
+                    phase: Cow::Borrowed("new"),
+                    phase_since: now,
+                    fields: Vec::new(),
+                }),
+            });
+            inner.live.insert(id, slot.clone());
+            (id, slot)
+        };
+
+        // Root span carrying the handler's identity, so every log line a handler
+        // emits is attributable. Created with the registry lock released — span creation re-enters
+        // the registry via `crate::trace`'s `on_new_span` (`override_handle`).
+        let span = tracing::info_span!(
+            target: HANDLER_SPAN_TARGET,
+            parent: None,
+            "handler",
+            id,
+            kind,
+            label = tracing::field::Empty,
+        );
+
+        HandlerGuard {
+            registry: self.clone(),
+            slot,
+            span,
+            terminal: None,
+        }
+    }
+
+    /// Snapshot the current registry contents for presentation.
+    pub fn snapshot(&self) -> Snapshot {
+        let now = SystemTime::now();
+        let inner = self.0.lock().unwrap();
+
+        let live = inner
+            .live
+            .values()
+            .map(|slot| {
+                let state = slot.state.lock().unwrap();
+                HandlerView {
+                    id: slot.id,
+                    kind: slot.kind,
+                    label: state.label.clone(),
+                    phase: state.phase.to_string(),
+                    age_seconds: secs_since(now, slot.started_at),
+                    phase_age_seconds: secs_since(now, state.phase_since),
+                    fields: state.fields.clone(),
+                    trace_override: u8_to_level_name(slot.trace_override.load(Ordering::Relaxed)),
+                }
+            })
+            .collect();
+
+        Snapshot {
+            live,
+            recent: inner.recent.iter().cloned().collect(),
+        }
+    }
+
+    /// Set (or, with `None`, clear) the trace-verbosity override of the live
+    /// handler `id`. Returns false if no live handler has that id. Events at
+    /// `level` or above emitted within the handler's span are admitted even if
+    /// the process's base filter would drop them; this is additive — it never
+    /// suppresses events the base filter would keep.
+    pub fn set_trace_override(&self, id: u64, level: Option<tracing::Level>) -> bool {
+        let inner = self.0.lock().unwrap();
+        let Some(slot) = inner.live.get(&id) else {
+            return false;
+        };
+        let value = level.map(|l| level_to_u8(&l)).unwrap_or(0);
+        slot.trace_override.store(value, Ordering::Relaxed);
+        true
+    }
+
+    /// The trace-override atomic of live handler `id`, for [`crate::trace`] to
+    /// stash on the handler span when it's created.
+    pub(crate) fn override_handle(&self, id: u64) -> Option<Arc<AtomicU8>> {
+        let inner = self.0.lock().unwrap();
+        inner.live.get(&id).map(|slot| slot.trace_override.clone())
+    }
+
+    /// The event tracks of live handler `id`, for [`crate::event`] to stash on
+    /// the handler span when it's created.
+    pub(crate) fn tracks_handle(&self, id: u64) -> Option<Arc<event::Tracks>> {
+        let inner = self.0.lock().unwrap();
+        inner.live.get(&id).map(|slot| slot.tracks.clone())
+    }
+
+    /// Snapshot one handler for the drill-down view: a live handler (with its
+    /// current phase, fields, trace override, and event tracks) or, failing
+    /// that, a recently-finished one (with its final phase and the event tracks
+    /// captured at the moment it ended). Returns `None` if neither has that `id`.
+    pub fn handler_detail(&self, id: u64) -> Option<HandlerDetail> {
+        let now = SystemTime::now();
+        let inner = self.0.lock().unwrap();
+
+        if let Some(slot) = inner.live.get(&id) {
+            let state = slot.state.lock().unwrap();
+            return Some(HandlerDetail {
+                id: slot.id,
+                kind: slot.kind,
+                label: state.label.clone(),
+                phase: state.phase.to_string(),
+                finished: false,
+                age_seconds: secs_since(now, slot.started_at),
+                started_at_rfc3339: Some(rfc3339_millis(slot.started_at)),
+                phase_age_seconds: Some(secs_since(now, state.phase_since)),
+                phase_since_rfc3339: Some(rfc3339_millis(state.phase_since)),
+                fields: state.fields.clone(),
+                trace_override: u8_to_level_name(slot.trace_override.load(Ordering::Relaxed)),
+                tracks: slot.tracks.snapshot(),
+            });
+        }
+
+        let finished = inner.recent.iter().find(|v| v.id == id)?;
+        Some(HandlerDetail {
+            id: finished.id,
+            kind: finished.kind,
+            label: finished.label.clone(),
+            phase: finished.final_phase.clone(),
+            finished: true,
+            age_seconds: finished.age_seconds,
+            // `FinishedView` carries only enough to list a finished handler;
+            // start time and current phase aren't retained.
+            started_at_rfc3339: None,
+            phase_age_seconds: None,
+            phase_since_rfc3339: None,
+            fields: Vec::new(),
+            trace_override: None,
+            tracks: finished.tracks.clone(),
+        })
+    }
+
+    fn finish(&self, id: u64, view: FinishedView) {
+        let mut inner = self.0.lock().unwrap();
+        inner.live.remove(&id);
+        if inner.recent.len() == RECENT_CAPACITY {
+            inner.recent.pop_front();
+        }
+        inner.recent.push_back(view);
+    }
+}
+
+/// HandlerGuard is the RAII handle returned by [`Registry::register`]. The
+/// handler updates its label / phase / fields through this guard; dropping it
+/// (when the handler future completes, for any reason) removes the live entry
+/// and appends a [`FinishedView`] to the recently-finished ring.
+pub struct HandlerGuard {
+    registry: Registry,
+    slot: Arc<Slot>,
+    // Per-handler `tracing` span; see `Registry::register` and `Self::span`.
+    span: tracing::Span,
+    // Terminal phase recorded by `finish_ok`/`finish_err`. When unset, `Drop`
+    // synthesizes one from the last phase, so abrupt error or early-return
+    // paths still leave a breadcrumb.
+    terminal: Option<Cow<'static, str>>,
+}
+
+impl HandlerGuard {
+    /// The handler's `tracing` span. Run the handler body inside it — typically
+    /// `some_inner_future.instrument(handler.span()).await` — so that operator
+    /// trace overrides (and the handler's identity fields) apply to its events.
+    pub fn span(&self) -> tracing::Span {
+        self.span.clone()
+    }
+
+    pub fn set_label(&self, label: impl Into<String>) {
+        let label = label.into();
+        self.span.record("label", label.as_str());
+        self.slot.state.lock().unwrap().label = label;
+    }
+
+    pub fn set_phase(&self, phase: impl Into<Cow<'static, str>>) {
+        let mut state = self.slot.state.lock().unwrap();
+        state.phase = phase.into();
+        state.phase_since = SystemTime::now();
+    }
+
+    pub fn set_field(&self, name: &'static str, value: impl std::fmt::Display) {
+        let value = value.to_string();
+        let mut state = self.slot.state.lock().unwrap();
+        match state.fields.iter_mut().find(|(n, _)| *n == name) {
+            Some((_, v)) => *v = value,
+            None => state.fields.push((name, value)),
+        }
+    }
+
+    pub fn finish_ok(&mut self) {
+        self.terminal = Some(Cow::Borrowed("done"));
+    }
+
+    pub fn finish_err(&mut self, error: &str) {
+        self.terminal = Some(Cow::Owned(format!("error: {error}")));
+    }
+}
+
+impl Drop for HandlerGuard {
+    fn drop(&mut self) {
+        let now = SystemTime::now();
+        // Snapshot the event tracks before taking any registry/slot lock — the
+        // handler span (and its `Tracks` extension) is about to go away, so
+        // this is the last chance to preserve them for the drill-down view.
+        let tracks = self.slot.tracks.snapshot();
+        let view = {
+            let state = self.slot.state.lock().unwrap();
+            FinishedView {
+                id: self.slot.id,
+                kind: self.slot.kind,
+                label: state.label.clone(),
+                final_phase: self
+                    .terminal
+                    .clone()
+                    .unwrap_or_else(|| Cow::Owned(format!("ended ({})", state.phase)))
+                    .into_owned(),
+                age_seconds: secs_since(now, self.slot.started_at),
+                tracks,
+            }
+        };
+        self.registry.finish(self.slot.id, view);
+    }
+}
+
+#[derive(serde::Serialize)]
+pub struct Snapshot {
+    pub live: Vec<HandlerView>,
+    pub recent: Vec<FinishedView>,
+}
+
+#[derive(serde::Serialize)]
+pub struct HandlerView {
+    pub id: u64,
+    pub kind: &'static str,
+    pub label: String,
+    pub phase: String,
+    pub age_seconds: u64,
+    pub phase_age_seconds: u64,
+    pub fields: Vec<(&'static str, String)>,
+    /// Current operator trace override, as a level name (`"TRACE"`, ...), or
+    /// `None` when the handler runs at the process's base verbosity.
+    pub trace_override: Option<&'static str>,
+}
+
+#[derive(Clone, serde::Serialize)]
+pub struct FinishedView {
+    pub id: u64,
+    pub kind: &'static str,
+    pub label: String,
+    pub final_phase: String,
+    pub age_seconds: u64,
+    /// Event tracks as of the moment the handler finished; see [`crate::event`].
+    #[serde(skip_serializing_if = "BTreeMap::is_empty")]
+    pub tracks: BTreeMap<String, Vec<event::EventView>>,
+}
+
+/// One handler in detail, for the drill-down view: a live handler, or a
+/// recently-finished one. Produced by [`Registry::handler_detail`].
+#[derive(serde::Serialize)]
+pub struct HandlerDetail {
+    pub id: u64,
+    pub kind: &'static str,
+    pub label: String,
+    /// The current phase of a live handler, or the final phase of a finished one.
+    pub phase: String,
+    /// True if this is a recently-finished handler rather than a live one.
+    pub finished: bool,
+    pub age_seconds: u64,
+    /// Absolute start time as RFC-3339 (millisecond precision); `None` for
+    /// finished handlers (the start time isn't retained past finish).
+    pub started_at_rfc3339: Option<String>,
+    /// Time spent in the current phase; `None` for finished handlers.
+    pub phase_age_seconds: Option<u64>,
+    /// Absolute time of the last phase change as RFC-3339; `None` for finished
+    /// handlers (no current phase).
+    pub phase_since_rfc3339: Option<String>,
+    /// Identifier fields; always empty for finished handlers (not retained).
+    pub fields: Vec<(&'static str, String)>,
+    /// Current operator trace override, or `None` (always `None` if finished).
+    pub trace_override: Option<&'static str>,
+    /// Recent events captured per track; see [`crate::event`].
+    pub tracks: BTreeMap<String, Vec<event::EventView>>,
+}
+
+fn secs_since(now: SystemTime, then: SystemTime) -> u64 {
+    now.duration_since(then).unwrap_or_default().as_secs()
+}
+
+/// RFC-3339 / ISO-8601 in UTC with `Z` suffix and millisecond precision —
+/// what the drill-down's zulu mode renders.
+pub(crate) fn rfc3339_millis(t: SystemTime) -> String {
+    chrono::DateTime::<chrono::Utc>::from(t).to_rfc3339_opts(chrono::SecondsFormat::Millis, true)
+}
+
+/// Verbosity floor for a trace override, where larger is more verbose:
+/// `1 = ERROR` … `5 = TRACE`. (`0`, used elsewhere, means "no override".)
+pub(crate) fn level_to_u8(level: &tracing::Level) -> u8 {
+    if *level == tracing::Level::ERROR {
+        1
+    } else if *level == tracing::Level::WARN {
+        2
+    } else if *level == tracing::Level::INFO {
+        3
+    } else if *level == tracing::Level::DEBUG {
+        4
+    } else {
+        5 // TRACE
+    }
+}
+
+/// Inverse of [`level_to_u8`]; `0` (no override) maps to `None`.
+pub(crate) fn u8_to_level_name(v: u8) -> Option<&'static str> {
+    match v {
+        1 => Some("ERROR"),
+        2 => Some("WARN"),
+        3 => Some("INFO"),
+        4 => Some("DEBUG"),
+        5 => Some("TRACE"),
+        _ => None,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn register_snapshot_and_drop() {
+        let registry = Registry::new();
+        assert!(registry.snapshot().live.is_empty());
+
+        let handler_id;
+        {
+            let mut h = registry.register("shuffle.session");
+            handler_id = registry.snapshot().live[0].id;
+            h.set_label("acmeCo/widgets");
+            h.set_field("session_id", 42u32);
+            h.set_field("shards", 3usize);
+            h.set_phase("running");
+            // Last write wins for a repeated field.
+            h.set_field("shards", 4usize);
+
+            assert!(registry.set_trace_override(handler_id, Some(tracing::Level::TRACE)));
+
+            let snap = registry.snapshot();
+            assert_eq!(snap.live.len(), 1);
+            let v = &snap.live[0];
+            assert_eq!(v.kind, "shuffle.session");
+            assert_eq!(v.label, "acmeCo/widgets");
+            assert_eq!(v.phase, "running");
+            assert_eq!(v.trace_override, Some("TRACE"));
+            assert_eq!(
+                v.fields,
+                vec![
+                    ("session_id", "42".to_string()),
+                    ("shards", "4".to_string())
+                ]
+            );
+
+            assert!(registry.set_trace_override(handler_id, None));
+            assert_eq!(registry.snapshot().live[0].trace_override, None);
+
+            h.finish_ok();
+        }
+
+        // Override of a finished handler is reported as not-found.
+        assert!(!registry.set_trace_override(handler_id, Some(tracing::Level::TRACE)));
+
+        let snap = registry.snapshot();
+        assert!(snap.live.is_empty());
+        assert_eq!(snap.recent.len(), 1);
+        assert_eq!(snap.recent[0].final_phase, "done");
+        assert_eq!(snap.recent[0].label, "acmeCo/widgets");
+    }
+
+    #[test]
+    fn drop_without_finish_records_last_phase() {
+        let registry = Registry::new();
+        {
+            let h = registry.register("leader.materialize");
+            h.set_phase("joining");
+        }
+        let snap = registry.snapshot();
+        assert_eq!(snap.recent[0].final_phase, "ended (joining)");
+    }
+
+    #[test]
+    fn handler_detail_covers_live_and_finished() {
+        let registry = Registry::new();
+        assert!(registry.handler_detail(0).is_none());
+
+        let id;
+        {
+            let mut h = registry.register("leader.materialize");
+            id = registry.snapshot().live[0].id;
+            h.set_label("acmeCo/widgets");
+            h.set_field("shards", 3usize);
+            h.set_phase("running");
+            registry.set_trace_override(id, Some(tracing::Level::DEBUG));
+
+            let d = registry.handler_detail(id).expect("live");
+            assert!(!d.finished);
+            assert_eq!(d.kind, "leader.materialize");
+            assert_eq!(d.label, "acmeCo/widgets");
+            assert_eq!(d.phase, "running");
+            assert_eq!(d.trace_override, Some("DEBUG"));
+            assert_eq!(d.fields, vec![("shards", "3".to_string())]);
+            assert!(d.phase_age_seconds.is_some());
+            assert!(d.tracks.is_empty()); // no `crate::event` layer installed here
+
+            h.finish_ok();
+        }
+
+        let d = registry.handler_detail(id).expect("finished");
+        assert!(d.finished);
+        assert_eq!(d.phase, "done");
+        assert_eq!(d.trace_override, None);
+        assert!(d.phase_age_seconds.is_none());
+        assert!(d.fields.is_empty());
+    }
+
+    #[test]
+    fn recent_ring_evicts_oldest() {
+        let registry = Registry::new();
+        for i in 0..(RECENT_CAPACITY + 5) {
+            let mut h = registry.register("shuffle.log");
+            h.set_label(format!("dir-{i}"));
+            h.finish_ok();
+        }
+        let snap = registry.snapshot();
+        assert_eq!(snap.recent.len(), RECENT_CAPACITY);
+        // Oldest (`dir-0`..`dir-4`) were evicted; newest is last.
+        assert_eq!(snap.recent.first().unwrap().label, "dir-5");
+        assert_eq!(
+            snap.recent.last().unwrap().label,
+            format!("dir-{}", RECENT_CAPACITY + 4)
+        );
+    }
+}
diff --git a/crates/service-kit/src/lib.rs b/crates/service-kit/src/lib.rs
new file mode 100644
index 00000000000..f560a632619
--- /dev/null
+++ b/crates/service-kit/src/lib.rs
@@ -0,0 +1,27 @@
+//! Building blocks for productionized async task servers: an operational
+//! surface a long-running service exposes over a loopback HTTP port.
+//!
+//! - [`Registry`] tracks the lifecycle of in-flight units of work (gRPC
+//!   handlers, jobs, connections — whatever a service spawns), so an operator
+//!   can see what the process is doing right now.
+//! - [`admin`] serves that inventory as an HTML dashboard plus a JSON endpoint,
+//!   a per-handler drill-down page, and lets an operator raise the trace
+//!   verbosity of one handler at runtime.
+//! - [`trace`] is the dynamic-verbosity mechanism behind that control: a
+//!   [`tracing_subscriber`] filter, composed with the service's base filter via
+//!   [`trace::layer_filter`].
+//! - [`event!`] appends an opt-in breadcrumb to a small per-handler ring (and
+//!   also emits a `tracing` event), surfaced on the drill-down page; install
+//!   [`event::layer`] alongside the `fmt` layer. Capture is lazy — see [`event`].
+//! - [`metrics`] folds a Prometheus scrape endpoint into the same admin port,
+//!   capturing anything emitted via the `metrics` facade.
+//!
+//! Nothing here is specific to any one service; see `README.md`.
+
+pub mod admin;
+pub mod event;
+mod handlers;
+pub mod metrics;
+pub mod trace;
+
+pub use handlers::{FinishedView, HandlerDetail, HandlerGuard, HandlerView, Registry, Snapshot};
diff --git a/crates/service-kit/src/metrics.rs b/crates/service-kit/src/metrics.rs
new file mode 100644
index 00000000000..6ca96b56e8d
--- /dev/null
+++ b/crates/service-kit/src/metrics.rs
@@ -0,0 +1,120 @@
+//! Prometheus `/metrics` exporter, folded into the [`crate::admin`] router so a
+//! service exposes its scrape endpoint on the same loopback admin port.
+//!
+//! [`install_recorder`] sets the global [`metrics`](https://docs.rs/metrics)
+//! recorder to a [`PrometheusRecorder`](metrics_exporter_prometheus::PrometheusRecorder)
+//! (so any crate emitting via the `metrics` facade is captured), spawns a
+//! background tick that calls [`PrometheusHandle::run_upkeep`] to bound
+//! histogram memory growth, and returns an `axum::Router` exposing
+//! `GET /metrics`. The install is idempotent — repeated calls reuse the same
+//! handle and don't re-spawn the upkeep tick.
+//!
+//! ## Two distinct kinds of upkeep
+//!
+//! - **Histogram draining** (`PrometheusHandle::run_upkeep`) is *not* driven by
+//!   scrapes; without a periodic tick, raw histogram samples accumulate
+//!   indefinitely. The convenience constructors `PrometheusBuilder::install` /
+//!   `::build` spawn this for you, but `install_recorder` (which we use,
+//!   because we own the HTTP surface) does not — see the **Upkeep and
+//!   maintenance** section of the upstream crate docs. This module spawns the
+//!   tick.
+//!
+//! - **Idle-metric pruning** (`idle_timeout`, configured here at 10 minutes) is
+//!   driven by [`PrometheusHandle::render`] itself, which calls the recency
+//!   check per metric on every scrape. No background tick is required for it;
+//!   the trade-off is that idle metrics are only actually freed when a scrape
+//!   arrives. With the typical 15-30s Prometheus scrape interval that's fine.
+
+use metrics_exporter_prometheus::{PrometheusBuilder, PrometheusHandle};
+use metrics_util::MetricKindMask;
+use std::sync::OnceLock;
+use std::time::Duration;
+
+/// Idle metrics older than this are dropped from the registry on the next
+/// scrape — picked to be longer than any reasonable Prometheus scrape interval
+/// so we never drop a metric an active scraper is still tracking.
+const IDLE_TIMEOUT: Duration = Duration::from_secs(600);
+
+/// How often to call [`PrometheusHandle::run_upkeep`] to drain accumulated
+/// histogram samples. Matches the upstream `PrometheusBuilder` default.
+const UPKEEP_INTERVAL: Duration = Duration::from_secs(5);
+
+static HANDLE: OnceLock<PrometheusHandle> = OnceLock::new();
+
+/// Install the process-wide Prometheus recorder (idempotent), spawn the
+/// histogram-upkeep tick, and return an `axum::Router` exposing `GET /metrics`.
+///
+/// Must be called from within a Tokio runtime — the upkeep tick is
+/// `tokio::spawn`ed on first call. Panics if some other crate has already
+/// installed a global `metrics` recorder; service-kit owns this slot.
+pub fn install_recorder() -> axum::Router<()> {
+    let handle = HANDLE.get_or_init(|| {
+        let handle = PrometheusBuilder::new()
+            .with_recommended_naming(true)
+            .idle_timeout(MetricKindMask::ALL, Some(IDLE_TIMEOUT))
+            .install_recorder()
+            .expect("installing prometheus recorder");
+
+        let upkeep_handle = handle.clone();
+        tokio::spawn(async move {
+            let mut tick = tokio::time::interval(UPKEEP_INTERVAL);
+            tick.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
+            loop {
+                tick.tick().await;
+                upkeep_handle.run_upkeep();
+            }
+        });
+
+        handle
+    });
+
+    axum::Router::new()
+        .route("/metrics", axum::routing::get(render))
+        .with_state(handle.clone())
+}
+
+async fn render(
+    axum::extract::State(handle): axum::extract::State<PrometheusHandle>,
+) -> (axum::http::StatusCode, String) {
+    (axum::http::StatusCode::OK, handle.render())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use axum::body::Body;
+    use axum::http::{Request, StatusCode};
+    use tower::ServiceExt;
+
+    #[tokio::test]
+    async fn metrics_route_renders_recorded_counter() {
+        // Install before emitting — `metrics::counter!` discards into a no-op
+        // recorder until a global one is set. The same recorder lives for the
+        // whole test process (OnceLock), so a unique counter name avoids
+        // collisions with any future test in this crate.
+        let router = install_recorder();
+        // `with_recommended_naming(true)` suffixes counters with `_total`, so
+        // assert on the rendered name below.
+        ::metrics::counter!("service_kit_metrics_test_hits").increment(3);
+
+        let response = router
+            .oneshot(
+                Request::builder()
+                    .uri("/metrics")
+                    .body(Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::OK);
+
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX)
+            .await
+            .unwrap();
+        let body = std::str::from_utf8(&body).unwrap();
+        assert!(
+            body.contains("service_kit_metrics_test_hits_total 3"),
+            "expected counter in scrape output, got:\n{body}",
+        );
+    }
+}
diff --git a/crates/service-kit/src/trace.rs b/crates/service-kit/src/trace.rs
new file mode 100644
index 00000000000..b6cf3550d3c
--- /dev/null
+++ b/crates/service-kit/src/trace.rs
@@ -0,0 +1,201 @@
+//! Dynamic, per-handler `tracing` verbosity.
+//!
+//! A long-running service runs at a modest base level (typically `INFO`). When
+//! one in-flight handler needs debugging, an operator can raise *its* verbosity at
+//! runtime — via the [`crate::admin`] surface, which calls
+//! [`Registry::set_trace_override`] — and see what it's doing without restarting
+//! the process or drowning in every other handler's output.
+//!
+//! Mechanism: each handler runs inside a [`tracing::Span`] owned by its
+//! [`crate::HandlerGuard`] (with the target `service_kit::handler`).
+//! [`OverrideFilter`] — a [`tracing_subscriber`] per-layer filter, composed with
+//! the service's base filter via [`layer_filter`] — stashes that handler's
+//! override atomic on the span when it's created, and for every otherwise-
+//! filtered event walks the current span scope: if an ancestor handler span's
+//! override admits the event's level, it passes. The override is *additive* —
+//! it never suppresses an event the base filter would keep.
+//!
+//! Cost when no override is active: [`OverrideFilter`]'s `max_level_hint` is
+//! `TRACE`, so disabled `trace!`/`debug!` callsites do one extra `enabled()`
+//! check (an atomic load, plus — only inside a handler span — a short scope
+//! walk) rather than being statically skipped.
+
+use crate::Registry;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicU8, Ordering};
+
+/// Compose `base` with an [`OverrideFilter`] over `registry`, yielding a filter
+/// to attach to a `fmt` (or other) layer via `Layer::with_filter`. Events pass
+/// if `base` admits them *or* an active handler trace-override does.
+pub fn layer_filter<S>(
+    base: tracing_subscriber::EnvFilter,
+    registry: Registry,
+) -> impl tracing_subscriber::layer::Filter<S> + 'static
+where
+    S: tracing::Subscriber + for<'a> tracing_subscriber::registry::LookupSpan<'a>,
+{
+    use tracing_subscriber::filter::FilterExt as _;
+    base.or(OverrideFilter { registry })
+}
+
+/// A [`tracing_subscriber`] per-layer filter that admits events at or above the
+/// trace-override level of an enclosing handler span. See the module docs;
+/// normally used through [`layer_filter`] rather than directly.
+pub struct OverrideFilter {
+    registry: Registry,
+}
+
+/// Span extension: the trace-override atomic of the handler whose span this is.
+struct TraceOverride(Arc<AtomicU8>);
+
+impl<S> tracing_subscriber::layer::Filter<S> for OverrideFilter
+where
+    S: tracing::Subscriber + for<'a> tracing_subscriber::registry::LookupSpan<'a>,
+{
+    fn enabled(
+        &self,
+        meta: &tracing::Metadata<'_>,
+        cx: &tracing_subscriber::layer::Context<'_, S>,
+    ) -> bool {
+        // Handler spans must always be created — they're where overrides live.
+        if meta.target() == crate::handlers::HANDLER_SPAN_TARGET {
+            return true;
+        }
+        let want = crate::handlers::level_to_u8(meta.level());
+        let Some(span) = cx.lookup_current() else {
+            return false;
+        };
+        span.scope().any(|span| {
+            span.extensions()
+                .get::<TraceOverride>()
+                .is_some_and(|ov| want <= ov.0.load(Ordering::Relaxed))
+        })
+    }
+
+    fn callsite_enabled(
+        &self,
+        meta: &'static tracing::Metadata<'static>,
+    ) -> tracing::subscriber::Interest {
+        if meta.target() == crate::handlers::HANDLER_SPAN_TARGET {
+            tracing::subscriber::Interest::always()
+        } else {
+            // An override set later may admit this callsite, so we can't cache
+            // a static decision: ask `enabled` per event.
+            tracing::subscriber::Interest::sometimes()
+        }
+    }
+
+    fn max_level_hint(&self) -> Option<tracing_subscriber::filter::LevelFilter> {
+        Some(tracing_subscriber::filter::LevelFilter::TRACE)
+    }
+
+    fn on_new_span(
+        &self,
+        attrs: &tracing::span::Attributes<'_>,
+        id: &tracing::span::Id,
+        ctx: tracing_subscriber::layer::Context<'_, S>,
+    ) {
+        if attrs.metadata().target() != crate::handlers::HANDLER_SPAN_TARGET {
+            return;
+        }
+        let mut visitor = HandlerIdVisitor(None);
+        attrs.record(&mut visitor);
+
+        let Some(handler_id) = visitor.0 else { return };
+        let Some(handle) = self.registry.override_handle(handler_id) else {
+            return;
+        };
+        if let Some(span) = ctx.span(id) {
+            span.extensions_mut().insert(TraceOverride(handle));
+        }
+    }
+}
+
+/// Pulls the `id` field out of a handler span's attributes. Also used by
+/// [`crate::event`], which hangs its own extension off the same handler span.
+pub(crate) struct HandlerIdVisitor(pub(crate) Option<u64>);
+
+impl tracing::field::Visit for HandlerIdVisitor {
+    fn record_u64(&mut self, field: &tracing::field::Field, value: u64) {
+        if field.name() == "id" {
+            self.0 = Some(value);
+        }
+    }
+    fn record_debug(&mut self, _field: &tracing::field::Field, _value: &dyn std::fmt::Debug) {}
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::atomic::AtomicUsize;
+    use tracing_subscriber::prelude::*;
+
+    /// Counts the events that reach it (after its filter).
+    #[derive(Clone, Default)]
+    struct CountLayer(Arc<AtomicUsize>);
+
+    impl<S: tracing::Subscriber> tracing_subscriber::Layer<S> for CountLayer {
+        fn on_event(
+            &self,
+            _event: &tracing::Event<'_>,
+            _cx: tracing_subscriber::layer::Context<'_, S>,
+        ) {
+            self.0.fetch_add(1, Ordering::Relaxed);
+        }
+    }
+
+    #[test]
+    fn override_admits_handler_trace_events() {
+        let registry = Registry::new();
+        let count = Arc::new(AtomicUsize::new(0));
+        let n = || count.load(Ordering::Relaxed);
+
+        let subscriber =
+            tracing_subscriber::registry().with(CountLayer(count.clone()).with_filter(
+                layer_filter(tracing_subscriber::EnvFilter::new("info"), registry.clone()),
+            ));
+
+        tracing::subscriber::with_default(subscriber, || {
+            let mut handler = registry.register("test.kind");
+            let id = registry.snapshot().live[0].id;
+            let span = handler.span();
+            let _entered = span.enter();
+
+            tracing::trace!("dropped: below base, no override");
+            assert_eq!(n(), 0);
+
+            // INFO always passes — it's at the base level.
+            tracing::info!("kept: at base level");
+            assert_eq!(n(), 1);
+
+            assert!(registry.set_trace_override(id, Some(tracing::Level::TRACE)));
+            tracing::trace!("kept: admitted by override");
+            tracing::debug!("kept: admitted by override");
+            assert_eq!(n(), 3);
+
+            // A nested non-handler span doesn't break scope-walking.
+            tracing::info_span!("inner").in_scope(|| {
+                tracing::trace!("kept: override reached via ancestor handler span");
+            });
+            assert_eq!(n(), 4);
+
+            assert!(registry.set_trace_override(id, None));
+            tracing::trace!("dropped: override cleared");
+            assert_eq!(n(), 4);
+
+            handler.finish_ok();
+        });
+
+        // Trace events outside any handler span are unaffected by overrides.
+        let count2 = Arc::new(AtomicUsize::new(0));
+        let n2 = || count2.load(Ordering::Relaxed);
+        let subscriber =
+            tracing_subscriber::registry().with(CountLayer(count2.clone()).with_filter(
+                layer_filter(tracing_subscriber::EnvFilter::new("info"), registry.clone()),
+            ));
+        tracing::subscriber::with_default(subscriber, || {
+            tracing::trace!("dropped: no enclosing handler span");
+            assert_eq!(n2(), 0);
+        });
+    }
+}
diff --git a/crates/shuffle/Cargo.toml b/crates/shuffle/Cargo.toml
index 2a94840308e..72c9ab959f8 100644
--- a/crates/shuffle/Cargo.toml
+++ b/crates/shuffle/Cargo.toml
@@ -23,6 +23,7 @@ proto-grpc = { path = "../proto-grpc", features = [
     "shuffle_server",
 ] }
 publisher = { path = "../publisher" }
+service-kit = { path = "../service-kit" }
 simd-doc = { path = "../simd-doc" }
 tables = { path = "../tables" }
 tokens = { path = "../tokens" }
@@ -36,6 +37,7 @@ libc = { workspace = true }
 lz4 = { workspace = true }
 md5 = { workspace = true }
 memchr = { workspace = true }
+metrics = { workspace = true }
 pbjson-types = { workspace = true }
 pin-project-lite = { workspace = true }
 rkyv = { workspace = true }
diff --git a/crates/shuffle/src/binding.rs b/crates/shuffle/src/binding.rs
index c25fcd03e49..1d442526a3a 100644
--- a/crates/shuffle/src/binding.rs
+++ b/crates/shuffle/src/binding.rs
@@ -75,13 +75,11 @@ pub struct Binding {
 }
 
 impl Binding {
-    /// Extract the shard prefix, bindings, and per-binding validators of a shuffle::Task.
+    /// Extract the bindings and per-binding validators of a shuffle::Task.
     /// Validators are returned separately so that callers can store them independently
     /// (e.g. on SliceActor) or discard them (e.g. SessionActor).
-    pub fn from_task(
-        task: &shuffle::Task,
-    ) -> anyhow::Result<(String, Vec<Self>, Vec<doc::Validator>)> {
-        let (shard_prefix, pairs) = match &task.task {
+    pub fn from_task(task: &shuffle::Task) -> anyhow::Result<(Vec<Self>, Vec<doc::Validator>)> {
+        let pairs = match &task.task {
             Some(shuffle::task::Task::Derivation(collection_spec)) => {
                 let derivation = collection_spec
                     .derivation
@@ -97,14 +95,7 @@ impl Binding {
                     })
                     .collect::<anyhow::Result<Vec<_>>>()?;
 
-                let shard_template_id = derivation
-                    .shard_template
-                    .as_ref()
-                    .context("Derivation missing ShardTemplate")?
-                    .id
-                    .as_str();
-
-                (format!("{shard_template_id}/"), pairs)
+                pairs
             }
             Some(shuffle::task::Task::Materialization(materialization)) => {
                 let pairs = materialization
@@ -116,14 +107,7 @@ impl Binding {
                     })
                     .collect::<anyhow::Result<Vec<_>>>()?;
 
-                let shard_template_id = materialization
-                    .shard_template
-                    .as_ref()
-                    .context("Materialization missing ShardTemplate")?
-                    .id
-                    .as_str();
-
-                (format!("{shard_template_id}/"), pairs)
+                pairs
             }
             Some(shuffle::task::Task::CollectionPartitions(collection_partitions)) => {
                 let shuffle::CollectionPartitions {
@@ -144,10 +128,7 @@ impl Binding {
                     partition_selector,
                 )?];
 
-                (
-                    String::new(), // No applicable shard prefix.
-                    pairs,
-                )
+                pairs
             }
             None => anyhow::bail!("missing task variant"),
         };
@@ -157,7 +138,7 @@ impl Binding {
 
         assign_cohorts(&mut bindings);
 
-        Ok((shard_prefix, bindings, validators))
+        Ok((bindings, validators))
     }
 
     fn from_derivation_transform(
diff --git a/crates/shuffle/src/client.rs b/crates/shuffle/src/client.rs
index 4fb83db4287..d88a3130f89 100644
--- a/crates/shuffle/src/client.rs
+++ b/crates/shuffle/src/client.rs
@@ -9,7 +9,7 @@ use tokio::sync::mpsc;
 /// Spawns an in-process Session actor via the shuffle Service.
 pub struct SessionClient {
     request_tx: mpsc::Sender<shuffle::SessionRequest>,
-    response_rx: mpsc::Receiver<tonic::Result<shuffle::SessionResponse>>,
+    response_rx: mpsc::UnboundedReceiver<tonic::Result<shuffle::SessionResponse>>,
 }
 
 impl SessionClient {
diff --git a/crates/shuffle/src/frontier.rs b/crates/shuffle/src/frontier.rs
index 758690f743f..8b92811d3e1 100644
--- a/crates/shuffle/src/frontier.rs
+++ b/crates/shuffle/src/frontier.rs
@@ -557,6 +557,27 @@ impl Frontier {
             unresolved_hints,
         }
     }
+
+    /// Return high-level measures of this Frontier for logging / diagnostics:
+    ///  (journals, journal_producers, bytes_read_delta, bytes_behind_delta)
+    #[inline]
+    pub fn measures(&self) -> (usize, usize, i64, i64) {
+        let (bytes_read_delta, bytes_behind_delta, journal_producers) =
+            self.journals.iter().fold((0, 0, 0), |(br, bb, jp), jf| {
+                (
+                    br + jf.bytes_read_delta,
+                    bb + jf.bytes_behind_delta,
+                    jp + jf.producers.len(),
+                )
+            });
+
+        (
+            self.journals.len(),
+            journal_producers,
+            bytes_read_delta,
+            bytes_behind_delta,
+        )
+    }
 }
 
 /// Walk a journal list and count producers with `hinted_commit > last_commit`.
diff --git a/crates/shuffle/src/log/actor.rs b/crates/shuffle/src/log/actor.rs
index ccfe53a7485..127a2a8ae01 100644
--- a/crates/shuffle/src/log/actor.rs
+++ b/crates/shuffle/src/log/actor.rs
@@ -47,6 +47,8 @@ pub struct LogActor {
     pub block: BlockState,
     /// Flush lifecycle state: pending requests, in-flight tracking, completed responses.
     pub flush: FlushState,
+    /// Per-task metrics counters and gauges.
+    pub metrics: super::Metrics,
 }
 
 impl LogActor {
@@ -57,7 +59,7 @@ impl LogActor {
         skip_all,
         fields(
             session = self.topology.session_id,
-            shard = self.topology.log_shard_index,
+            shard_id = %self.topology.shards[self.topology.log_shard_index as usize].id,
         )
     )]
     pub async fn serve(
@@ -138,7 +140,14 @@ impl LogActor {
                         Err(true) => {}, // `rx` is parked in self.slice_appends
                         Err(false) => {
                             connected -= 1;
-                            tracing::debug!(shard_index, connected, "Slice LogRequest stream EOF");
+
+                            service_kit::event!(
+                                tracing::Level::DEBUG,
+                                "slice",
+                                shard_index,
+                                connected,
+                                "received EOF from Slice"
+                            );
                         }
                     }
                 }
@@ -147,49 +156,35 @@ impl LogActor {
                 Some(result) = futures::future::OptionFuture::from(flush_handle.as_mut()) => {
                     flush_handle = None;
 
-                    let result = match result {
-                        Ok(r) => r,
+                    let (writer, flushed_lsn, sealed) = match result {
+                        Ok(r) => r?,
                         Err(err) if err.is_cancelled() => continue,
                         Err(err) => std::panic::resume_unwind(err.into_panic()),
                     };
 
-                    let (writer, flushed_lsn, sealed) = result?;
-                    self.writer = Some(writer);
-                    self.flush.on_flushed(flushed_lsn);
-
-                    // Did the flush seal its segment (the writer rolled to the next)?
-                    let Some(sealed) = sealed else {
-                        continue;
-                    };
-                    disk_backlog_bytes += sealed.size;
-
-                    if disk_backlog_bytes >= disk_backlog_threshold {
-                        tracing::debug!(
-                            disk_backlog_mib = disk_backlog_bytes / (1024 * 1024),
-                            "disk back-pressure engaged"
-                        );
-                        disk_back_pressure = true;
+                    self.on_flushed(
+                        writer,
+                        flushed_lsn,
+                        sealed.as_ref(),
+                        &mut disk_backlog_bytes,
+                        disk_backlog_threshold,
+                        &mut disk_back_pressure,
+                    );
+                    if let Some(sealed) = sealed {
+                        sealed_segments.push(Box::pin(sealed.serve()));
                     }
-                    sealed_segments.push(Box::pin(sealed.serve()));
                 }
 
                 // Read an update reclaiming disk from compression or unlink.
                 // This arm is deactivated if no `connected` shards remain,
                 // to allow the `else` arm below to fire and exit.
                 Some(reclaimed) = sealed_segments.next(), if connected != 0 => {
-                    disk_backlog_bytes = disk_backlog_bytes
-                        .checked_sub(reclaimed?)
-                        .expect("disk_backlog_bytes underflow");
-
-                    if disk_back_pressure
-                        && disk_backlog_bytes < disk_backlog_threshold / 2
-                    {
-                        tracing::debug!(
-                            disk_backlog_mib = disk_backlog_bytes / (1024 * 1024),
-                            "disk back-pressure released"
-                        );
-                        disk_back_pressure = false;
-                    }
+                    self.on_reclaimed(
+                        reclaimed?,
+                        &mut disk_backlog_bytes,
+                        disk_backlog_threshold,
+                        &mut disk_back_pressure,
+                    );
                 }
 
                 // Wake when a blocked log_response_tx has capacity.
@@ -248,11 +243,14 @@ impl LogActor {
                 }),
                 ..Default::default()
             }));
-            tracing::debug!(
+
+            service_kit::event!(
+                tracing::Level::DEBUG,
+                "slice",
                 shard_index,
                 cycle,
-                ?flushed_lsn,
-                "sent Flushed response to Slice"
+                flushed_lsn = flushed_lsn.as_u64(),
+                "sent Flushed response to Slice",
             );
         }
 
@@ -297,8 +295,16 @@ impl LogActor {
             } => {
                 let shuffle::log_request::Flush { cycle } = flush;
                 let empty = self.block.is_empty();
-                tracing::debug!(shard_index, cycle, empty, "received Flush from Slice");
                 self.flush.on_flush(shard_index, cycle, empty);
+
+                service_kit::event!(
+                    tracing::Level::DEBUG,
+                    "slice",
+                    shard_index,
+                    cycle,
+                    empty,
+                    "received Flush from Slice",
+                );
                 Ok(Ok(rx))
             }
 
@@ -366,6 +372,10 @@ impl LogActor {
             doc_bytes = append.doc_archived.len(),
             "drained Append from heap"
         );
+        self.metrics.appends.increment(1);
+        self.metrics
+            .bytes_appended
+            .increment(append.source_byte_length as u64);
 
         (shard_index, rx)
     }
@@ -387,11 +397,102 @@ impl LogActor {
 
         let (journals, producers, entries) = self.block.take();
 
+        service_kit::event!(
+            tracing::Level::DEBUG,
+            "writer",
+            journals = journals.len(),
+            producers = producers.len(),
+            entries = entries.len(),
+            "starting block flush"
+        );
+        self.metrics.flushes.increment(1);
+
         *flush_handle = Some(tokio::task::spawn_blocking(move || {
             let (flushed_lsn, sealed) = writer.append_block(journals, producers, entries)?;
             Ok((writer, flushed_lsn, sealed))
         }));
     }
+
+    /// Handle the completion of a background block flush: restore the writer,
+    /// advance flush state, and bookkeep the disk-backlog measure (engaging
+    /// back-pressure if a new segment was sealed).
+    fn on_flushed(
+        &mut self,
+        writer: Writer,
+        flushed_lsn: Lsn,
+        sealed: Option<&SealedSegment>,
+        disk_backlog_bytes: &mut u64,
+        disk_backlog_threshold: u64,
+        disk_back_pressure: &mut bool,
+    ) {
+        self.writer = Some(writer);
+        self.flush.on_flushed(flushed_lsn);
+
+        // Did the flush seal its segment (the writer rolled to the next)?
+        let Some(sealed) = sealed else {
+            service_kit::event!(
+                tracing::Level::TRACE,
+                "writer",
+                disk_back_pressure = *disk_back_pressure,
+                disk_backlog_mib = *disk_backlog_bytes / (1024 * 1024),
+                next_pending = self.flush.has_pending_request(),
+                "log segment flushed (partial segment)"
+            );
+            return;
+        };
+
+        *disk_backlog_bytes += sealed.size;
+
+        if *disk_backlog_bytes >= disk_backlog_threshold {
+            *disk_back_pressure = true;
+        };
+
+        service_kit::event!(
+            tracing::Level::DEBUG,
+            "writer",
+            disk_back_pressure = *disk_back_pressure,
+            disk_backlog_mib = *disk_backlog_bytes / (1024 * 1024),
+            last_segment = service_kit::event::debug(sealed.path.to_owned()),
+            next_pending = self.flush.has_pending_request(),
+            sealed_mib = sealed.size / (1024 * 1024),
+            "log segment flushed (segment sealed)"
+        );
+        self.metrics.segments_sealed.increment(1);
+        self.metrics
+            .disk_backlog_bytes
+            .set(*disk_backlog_bytes as f64);
+    }
+
+    /// Handle a disk-space reclaim from a sealed segment's compress / unlink
+    /// stream: subtract from the backlog measure and release back-pressure
+    /// at the hysteresis threshold (half of `disk_backlog_threshold`).
+    fn on_reclaimed(
+        &mut self,
+        reclaimed: u64,
+        disk_backlog_bytes: &mut u64,
+        disk_backlog_threshold: u64,
+        disk_back_pressure: &mut bool,
+    ) {
+        *disk_backlog_bytes = disk_backlog_bytes
+            .checked_sub(reclaimed)
+            .expect("disk_backlog_bytes underflow");
+
+        if *disk_back_pressure && *disk_backlog_bytes < disk_backlog_threshold / 2 {
+            *disk_back_pressure = false;
+        }
+
+        service_kit::event!(
+            tracing::Level::DEBUG,
+            "writer",
+            disk_back_pressure = *disk_back_pressure,
+            disk_backlog_mib = *disk_backlog_bytes / (1024 * 1024),
+            reclaimed_mib = reclaimed / (1024 * 1024),
+            "log segment reclaimed",
+        );
+        self.metrics
+            .disk_backlog_bytes
+            .set(*disk_backlog_bytes as f64);
+    }
 }
 
 // Helper which builds a future that yields the next request from a shard's Log RPC.
diff --git a/crates/shuffle/src/log/handler.rs b/crates/shuffle/src/log/handler.rs
index c0b853cd4e8..5a8e34245e1 100644
--- a/crates/shuffle/src/log/handler.rs
+++ b/crates/shuffle/src/log/handler.rs
@@ -3,11 +3,31 @@ use anyhow::Context;
 use futures::StreamExt;
 use proto_flow::shuffle;
 use tokio::sync::mpsc;
+use tracing::Instrument;
 
 pub(crate) async fn serve_log<R>(
+    service: crate::Service,
+    request_rx: R,
+    response_tx: mpsc::Sender<tonic::Result<shuffle::LogResponse>>,
+) -> anyhow::Result<()>
+where
+    R: futures::Stream<Item = tonic::Result<shuffle::LogRequest>> + Send + Unpin + 'static,
+{
+    // Run the whole handler inside its span so operator trace overrides (see
+    // `service_kit::trace`) reach every log line — the actor loop's periodic
+    // instrumentation included.
+    let handler = service.registry.register("shuffle.log");
+    let span = handler.span();
+    serve_log_inner(service, request_rx, response_tx, handler)
+        .instrument(span)
+        .await
+}
+
+async fn serve_log_inner<R>(
     service: crate::Service,
     mut request_rx: R,
     response_tx: mpsc::Sender<tonic::Result<shuffle::LogResponse>>,
+    mut handler: service_kit::HandlerGuard,
 ) -> anyhow::Result<()>
 where
     R: futures::Stream<Item = tonic::Result<shuffle::LogRequest>> + Send + Unpin + 'static,
@@ -26,20 +46,32 @@ where
         log_shard_index,
     } = open.open.context("first message must be Open")?;
 
-    let directory = shards
+    // Identity and directory of the shard hosting this Log instance.
+    let (shard_id, directory) = shards
         .get(log_shard_index as usize)
-        .map(|m| m.directory.as_str())
-        .unwrap_or_default();
+        .map(|s| (&s.id, &s.directory))
+        .context("Open log_shard_index out of range")?;
+
+    handler.set_label(shard_id);
+    handler.set_field("session_id", session_id);
+    handler.set_field("log_shard_index", log_shard_index);
+    handler.set_field("shards", shards.len());
+    handler.set_field("directory", directory);
+    handler.set_phase("joining");
+
+    let metrics = super::Metrics::new(shard_id);
 
-    tracing::info!(
+    service_kit::event!(
+        tracing::Level::INFO,
+        "slice",
         session_id,
         shards = shards.len(),
         slice_shard_index,
         log_shard_index,
-        %directory,
-        "Log received Open"
+        directory = directory.clone(),
+        "received Open from Slice",
     );
-    let join_key = (directory.to_string(), log_shard_index);
+    let join_key = (directory.clone(), log_shard_index);
 
     // Scope `guard` to prove it's not held across await points.
     let connections = {
@@ -81,6 +113,9 @@ where
 
         // Are there still more Slices that need to connect?
         if connected != shards.len() as usize {
+            // This invocation only contributed its streams to the rendezvous;
+            // the invocation that completes it runs the LogActor.
+            handler.finish_ok();
             return Ok(());
         }
         // All Slices have connected to this Log.
@@ -111,9 +146,11 @@ where
     }
 
     let shard_count = shards.len();
-    let writer = Writer::new(std::path::Path::new(directory), log_shard_index)?;
+    let writer = Writer::new(std::path::Path::new(&directory), log_shard_index)?;
 
-    super::actor::LogActor {
+    handler.set_phase("running");
+
+    let result = super::actor::LogActor {
         topology: super::state::Topology {
             session_id,
             shards,
@@ -127,7 +164,14 @@ where
         block: state::BlockState::new(),
         flush: state::FlushState::new(),
         log_response_tx,
+        metrics,
     }
     .serve(log_request_rx)
-    .await
+    .await;
+
+    match &result {
+        Ok(()) => handler.finish_ok(),
+        Err(err) => handler.finish_err(&format!("{err:#}")),
+    }
+    result
 }
diff --git a/crates/shuffle/src/log/mod.rs b/crates/shuffle/src/log/mod.rs
index 372e7c7d8ae..26d663de6a7 100644
--- a/crates/shuffle/src/log/mod.rs
+++ b/crates/shuffle/src/log/mod.rs
@@ -127,3 +127,60 @@ pub(crate) struct LogJoin {
         )>,
     >,
 }
+
+#[derive(Clone)]
+pub(crate) struct Metrics {
+    /// Total Append messages drained from the heap into the current block.
+    appends: metrics::Counter,
+    /// Total source bytes of those Appends (sum of `source_byte_length`),
+    /// approximating the bytes of input that resulted in log entries.
+    bytes_appended: metrics::Counter,
+    /// Total block flushes started (encoded and written, partial or sealed).
+    flushes: metrics::Counter,
+    /// Total log segments sealed and rolled over.
+    segments_sealed: metrics::Counter,
+    /// Current on-disk backlog across all living sealed segments. Set on each
+    /// segment seal and on each reclaim from compression / unlink.
+    disk_backlog_bytes: metrics::Gauge,
+}
+
+impl Metrics {
+    fn new(shard_id: &str) -> Self {
+        static DESCRIBE: std::sync::Once = std::sync::Once::new();
+        DESCRIBE.call_once(|| {
+            metrics::describe_counter!(
+                "shuffle_log_appends",
+                metrics::Unit::Count,
+                "Append messages drained from the heap into the current block",
+            );
+            metrics::describe_counter!(
+                "shuffle_log_bytes_appended",
+                metrics::Unit::Bytes,
+                "source bytes of drained Appends (sum of source_byte_length)",
+            );
+            metrics::describe_counter!(
+                "shuffle_log_flushes",
+                metrics::Unit::Count,
+                "block flushes started",
+            );
+            metrics::describe_counter!(
+                "shuffle_log_segments_sealed",
+                metrics::Unit::Count,
+                "log segments sealed and rolled over",
+            );
+            metrics::describe_gauge!(
+                "shuffle_log_disk_backlog_bytes",
+                metrics::Unit::Bytes,
+                "current on-disk backlog across all living sealed segments",
+            );
+        });
+
+        Self {
+            appends: metrics::counter!("shuffle_log_appends", "shard_id" => shard_id.to_string()),
+            bytes_appended: metrics::counter!("shuffle_log_bytes_appended", "shard_id" => shard_id.to_string()),
+            flushes: metrics::counter!("shuffle_log_flushes", "shard_id" => shard_id.to_string()),
+            segments_sealed: metrics::counter!("shuffle_log_segments_sealed", "shard_id" => shard_id.to_string()),
+            disk_backlog_bytes: metrics::gauge!("shuffle_log_disk_backlog_bytes", "shard_id" => shard_id.to_string()),
+        }
+    }
+}
diff --git a/crates/shuffle/src/service.rs b/crates/shuffle/src/service.rs
index 778e16ec383..9d976c8502b 100644
--- a/crates/shuffle/src/service.rs
+++ b/crates/shuffle/src/service.rs
@@ -22,6 +22,8 @@ pub struct ServiceImpl {
     /// Shared state for coordinating Log RPCs from multiple Slices into a single LogActor.
     /// Keyed by (directory, log_shard_index).
     pub(crate) log_joins: std::sync::Mutex<HashMap<(String, u32), log::LogJoin>>,
+    /// Registry of in-flight Session/Slice/Log handlers, for the admin surface.
+    pub(crate) registry: service_kit::Registry,
 }
 
 impl Service {
@@ -29,6 +31,7 @@ impl Service {
         peer_endpoint: String,
         journal_client_factory: gazette::journal::ClientFactory,
         disk_backlog_threshold: u64,
+        registry: service_kit::Registry,
     ) -> Self {
         Self(Arc::new(ServiceImpl {
             peer_endpoint,
@@ -36,6 +39,7 @@ impl Service {
             disk_backlog_threshold,
             channels: std::sync::Mutex::new(HashMap::new()),
             log_joins: std::sync::Mutex::new(HashMap::new()),
+            registry,
         }))
     }
 
@@ -61,17 +65,18 @@ impl Service {
     pub fn spawn_session<R>(
         &self,
         request_rx: R,
-    ) -> mpsc::Receiver<tonic::Result<shuffle::SessionResponse>>
+    ) -> mpsc::UnboundedReceiver<tonic::Result<shuffle::SessionResponse>>
     where
         R: futures::Stream<Item = tonic::Result<shuffle::SessionRequest>> + Send + Unpin + 'static,
     {
         let service = self.clone();
-        let (response_tx, response_rx) = new_channel::<tonic::Result<shuffle::SessionResponse>>();
+        let (response_tx, response_rx) =
+            mpsc::unbounded_channel::<tonic::Result<shuffle::SessionResponse>>();
         let error_tx = response_tx.clone();
 
         tokio::spawn(async move {
             if let Err(e) = session::serve_session(service, request_rx, response_tx).await {
-                let _ = error_tx.send(Err(anyhow_to_status(e))).await;
+                let _ = error_tx.send(Err(anyhow_to_status(e)));
             }
         });
         response_rx
@@ -156,7 +161,7 @@ impl std::ops::Deref for Service {
 #[tonic::async_trait]
 impl proto_grpc::shuffle::shuffle_server::Shuffle for Service {
     type SessionStream =
-        tokio_stream::wrappers::ReceiverStream<tonic::Result<shuffle::SessionResponse>>;
+        tokio_stream::wrappers::UnboundedReceiverStream<tonic::Result<shuffle::SessionResponse>>;
     type SliceStream =
         tokio_stream::wrappers::ReceiverStream<tonic::Result<shuffle::SliceResponse>>;
     type LogStream = tokio_stream::wrappers::ReceiverStream<tonic::Result<shuffle::LogResponse>>;
@@ -166,7 +171,9 @@ impl proto_grpc::shuffle::shuffle_server::Shuffle for Service {
         request: tonic::Request<tonic::Streaming<shuffle::SessionRequest>>,
     ) -> tonic::Result<tonic::Response<Self::SessionStream>> {
         Ok(tonic::Response::new(
-            tokio_stream::wrappers::ReceiverStream::new(self.spawn_session(request.into_inner())),
+            tokio_stream::wrappers::UnboundedReceiverStream::new(
+                self.spawn_session(request.into_inner()),
+            ),
         ))
     }
 
diff --git a/crates/shuffle/src/session/actor.rs b/crates/shuffle/src/session/actor.rs
index cea0e598daa..0555878720d 100644
--- a/crates/shuffle/src/session/actor.rs
+++ b/crates/shuffle/src/session/actor.rs
@@ -11,14 +11,16 @@ pub struct SessionActor {
     /// Bits by-shard indicating whether to send a ProgressRequest.
     pub progress_ready: Vec<bool>,
     /// Channel for sending SessionResponse messages back to the coordinator.
-    pub session_response_tx: mpsc::Sender<tonic::Result<shuffle::SessionResponse>>,
+    /// Unbounded because the coordinator drives req/resp pairs (≤1 in flight),
+    /// so the queue depth is bounded by protocol — no back-pressure needed.
+    pub session_response_tx: mpsc::UnboundedSender<tonic::Result<shuffle::SessionResponse>>,
     /// Per-shard channels for sending SliceRequest messages.
     pub slice_request_tx: Vec<mpsc::Sender<shuffle::SliceRequest>>,
     /// Buffered StartReads to be transmitted to their target Slice channel.
     /// Each entry is (shard_index, StartRead). Drained in FIFO order.
     pub start_reads: std::collections::VecDeque<(usize, shuffle::slice_request::StartRead)>,
-    /// Drain of the checkpoint Frontier to be transmitted.
-    pub checkpoint_drain: Option<shuffle::Frontier>,
+    /// Per-task metrics counters.
+    pub metrics: super::Metrics,
 }
 
 impl SessionActor {
@@ -29,7 +31,7 @@ impl SessionActor {
         skip_all,
         fields(
             session = self.topology.session_id,
-            shard_prefix = %self.topology.shard_prefix,
+            shard_id = %self.topology.shards[0].id,
         )
     )]
     pub async fn serve<R>(
@@ -56,7 +58,6 @@ impl SessionActor {
             tracing::debug!(
                 loop_count,
                 checkpoint = ?self.checkpoint,
-                drain_pending = self.checkpoint_drain.is_some(),
                 progress_ready = ?self.progress_ready,
                 start_reads = self.start_reads.len(),
                 "SessionActor::serve iteration"
@@ -64,7 +65,7 @@ impl SessionActor {
 
             // First, attempt non-blocking sends.
             let wake_slice_request_tx = self.try_slice_request_tx()?;
-            let wake_session_response_tx = self.try_session_response_tx()?;
+            self.try_session_response_tx();
 
             // Then, wait for a blocking future to resolve.
             tokio::select! {
@@ -84,7 +85,6 @@ impl SessionActor {
 
                 // Next priority is draining ready-to-send messages.
                 true = wake_slice_request_tx => {}
-                true = wake_session_response_tx => {}
 
                 // Periodic tick ensures tracing fires even when idle,
                 // and detects stalled causal hint resolution.
@@ -140,6 +140,13 @@ impl SessionActor {
                 progress: Some(shuffle::slice_request::Progress {}),
                 ..Default::default()
             });
+
+            service_kit::event!(
+                tracing::Level::DEBUG,
+                "slice",
+                shard_index,
+                "sent Progress request",
+            );
         }
 
         // Try to drain StartRead requests in FIFO order.
@@ -149,47 +156,47 @@ impl SessionActor {
             let Ok(permit) = tx.try_reserve() else {
                 return Ok(future::Either::Left(tx.clone().reserve_owned().map(ok)));
             };
-            let (_shard_index, start_read) = self.start_reads.pop_front().unwrap();
+            let (shard_index, start_read) = self.start_reads.pop_front().unwrap();
 
             permit.send(shuffle::SliceRequest {
                 start_read: Some(start_read),
                 ..Default::default()
             });
+
+            service_kit::event!(
+                tracing::Level::DEBUG,
+                "slice",
+                shard_index,
+                "sent StartRead request",
+            );
         }
 
         Ok(idle)
     }
 
-    fn try_session_response_tx(&mut self) -> anyhow::Result<impl Future<Output = bool> + 'static> {
-        // Closure for mapping an OwnedPermit Result to Ok (our "poll again" signal).
-        // On Err (channel closed), we don't wake and rely on rx of a causal error / fail-fast teardown.
-        let ok = |result: Result<_, _>| result.is_ok();
-        // Future which represent an absence of an awake signal.
-        let idle = future::Either::Right(std::future::ready(false));
-
-        if self.checkpoint_drain.is_none() {
-            if let Some(frontier) = self.checkpoint.take_ready() {
-                tracing::debug!(?frontier, "sending NextCheckpoint to client");
-                self.checkpoint_drain = Some(frontier.encode());
-            }
-        }
-
-        // Try to drain a NextCheckpoint response.
-        // Ensure channel capacity *before* take() to not lose it.
-        if self.checkpoint_drain.is_some() {
-            let Ok(permit) = self.session_response_tx.try_reserve() else {
-                return Ok(future::Either::Left(
-                    self.session_response_tx.clone().reserve_owned().map(ok),
-                ));
-            };
-
-            permit.send(Ok(shuffle::SessionResponse {
-                next_checkpoint: self.checkpoint_drain.take(),
-                ..Default::default()
-            }));
-        }
-
-        Ok(idle)
+    /// Drain a ready checkpoint Frontier (if any) to the coordinator.
+    fn try_session_response_tx(&mut self) {
+        let Some(frontier) = self.checkpoint.take_ready() else {
+            return;
+        };
+        let (journals, journal_producers, bytes_read_delta, bytes_behind_delta) =
+            frontier.measures();
+
+        let _ = self.session_response_tx.send(Ok(shuffle::SessionResponse {
+            next_checkpoint: Some(frontier.encode()),
+            ..Default::default()
+        }));
+
+        service_kit::event!(
+            tracing::Level::DEBUG,
+            "coordinator",
+            bytes_behind_delta,
+            bytes_read_delta,
+            journal_producers,
+            journals,
+            "sent NextCheckpoint response",
+        );
+        self.metrics.checkpoints.increment(1);
     }
 
     fn on_session_request(
@@ -203,7 +210,11 @@ impl SessionActor {
                 next_checkpoint: Some(shuffle::session_request::NextCheckpoint {}),
                 ..
             } => {
-                tracing::debug!("received NextCheckpoint request from coordinator");
+                service_kit::event!(
+                    tracing::Level::DEBUG,
+                    "coordinator",
+                    "received NextCheckpoint request"
+                );
                 self.checkpoint.request()
             }
             request => Err(verify.fail(request)),
@@ -228,17 +239,17 @@ impl SessionActor {
                 listing_added: Some(added),
                 ..
             } => {
-                let routed = self.topology.route_read(&added)?;
-                tracing::debug!(
+                service_kit::event!(
+                    tracing::Level::DEBUG,
+                    "slice",
                     shard_index,
-                    binding = added.binding,
-                    journal = added.spec.as_ref().map(|s| s.name.as_str()).unwrap_or(""),
-                    target_shard = routed.shard_index,
-                    candidates = routed.shard_stop - routed.shard_start,
-                    "received ListingAdded, assigning read"
+                    "received ListingAdded",
                 );
-                let (shard_index, start_read) = self.topology.build_start_read(&routed, added);
-                self.start_reads.push_back((shard_index, start_read));
+
+                let routed = self.topology.route_read(&added)?;
+                let (routed_shard, start_read) = self.topology.build_start_read(&routed, added);
+                self.start_reads.push_back((routed_shard, start_read));
+
                 Ok(())
             }
 
@@ -246,11 +257,7 @@ impl SessionActor {
                 progressed: Some(proto),
                 ..
             } => {
-                self.checkpoint.on_progressed(shard_index, proto)?;
-                tracing::debug!(
-                    shard_index,
-                    "Progressed received, sending next ProgressRequest"
-                );
+                self.checkpoint.on_progressed(shard_index, proto)?; // Handles event! diagnostic.
                 self.progress_ready[shard_index] = true;
                 Ok(())
             }
diff --git a/crates/shuffle/src/session/handler.rs b/crates/shuffle/src/session/handler.rs
index 3445ee3ac59..86167ef05d8 100644
--- a/crates/shuffle/src/session/handler.rs
+++ b/crates/shuffle/src/session/handler.rs
@@ -2,11 +2,31 @@ use anyhow::Context;
 use futures::StreamExt;
 use proto_flow::shuffle;
 use tokio::sync::mpsc;
+use tracing::Instrument;
 
 pub(crate) async fn serve_session<R>(
+    service: crate::Service,
+    request_rx: R,
+    session_response_tx: mpsc::UnboundedSender<tonic::Result<shuffle::SessionResponse>>,
+) -> anyhow::Result<()>
+where
+    R: futures::Stream<Item = tonic::Result<shuffle::SessionRequest>> + Send + Unpin + 'static,
+{
+    // Run the whole handler inside its span so operator trace overrides (see
+    // `service_kit::trace`) reach every log line — the actor loop's periodic
+    // instrumentation included.
+    let handler = service.registry.register("shuffle.session");
+    let span = handler.span();
+    serve_session_inner(service, request_rx, session_response_tx, handler)
+        .instrument(span)
+        .await
+}
+
+async fn serve_session_inner<R>(
     service: crate::Service,
     mut request_rx: R,
-    session_response_tx: mpsc::Sender<tonic::Result<shuffle::SessionResponse>>,
+    session_response_tx: mpsc::UnboundedSender<tonic::Result<shuffle::SessionResponse>>,
+    mut handler: service_kit::HandlerGuard,
 ) -> anyhow::Result<()>
 where
     R: futures::Stream<Item = tonic::Result<shuffle::SessionRequest>> + Send + Unpin + 'static,
@@ -34,13 +54,21 @@ where
     }
     super::state::validate_shard_ranges(&shards)?;
 
+    handler.set_label(&shards[0].id);
+    handler.set_field("session_id", session_id);
+    handler.set_field("shards", shards.len());
+    handler.set_phase("opening");
+
+    let metrics = super::Metrics::new(&shards[0].id);
     let task = task.context("Open must include task")?;
-    let (shard_prefix, bindings, _validators) = crate::Binding::from_task(&task)?;
+    let (bindings, _validators) = crate::Binding::from_task(&task)?;
 
-    tracing::info!(
+    service_kit::event!(
+        tracing::Level::INFO,
+        "coordinator",
         session_id,
-        shard_count = shards.len(),
-        "Session received Open"
+        shards = shards.len(),
+        "received Open from Coordinator"
     );
 
     // Concurrently Open a Slice RPC with every shard.
@@ -67,14 +95,10 @@ where
     );
 
     // Send Opened response to Session client.
-    // Non-blocking capacity: first message of `session_response_tx`.
-    crate::verify_send(
-        &session_response_tx,
-        Ok(shuffle::SessionResponse {
-            opened: Some(shuffle::session_response::Opened {}),
-            ..Default::default()
-        }),
-    )?;
+    let _ = session_response_tx.send(Ok(shuffle::SessionResponse {
+        opened: Some(shuffle::session_response::Opened {}),
+        ..Default::default()
+    }));
 
     // Read the resume-checkpoint frontier.
     let verify = crate::verify("SessionRequest", "resume_checkpoint", "coordinator", 0);
@@ -107,7 +131,6 @@ where
     let topology = super::state::Topology {
         session_id,
         shards,
-        shard_prefix,
         bindings,
         resume_checkpoint,
     };
@@ -115,17 +138,25 @@ where
     let checkpoint =
         super::state::CheckpointPipeline::new(&topology.resume_checkpoint, binding_cohorts);
 
-    super::actor::SessionActor {
+    handler.set_phase("running");
+
+    let result = super::actor::SessionActor {
         topology,
         checkpoint,
         progress_ready: vec![true; shard_count],
         session_response_tx: session_response_tx.clone(),
         slice_request_tx,
         start_reads: std::collections::VecDeque::new(),
-        checkpoint_drain: None,
+        metrics,
     }
     .serve(request_rx, response_rx)
-    .await
+    .await;
+
+    match &result {
+        Ok(()) => handler.finish_ok(),
+        Err(err) => handler.finish_err(&format!("{err:#}")),
+    }
+    result
 }
 
 #[tracing::instrument(
diff --git a/crates/shuffle/src/session/mod.rs b/crates/shuffle/src/session/mod.rs
index 4f6fbb18983..3641838b371 100644
--- a/crates/shuffle/src/session/mod.rs
+++ b/crates/shuffle/src/session/mod.rs
@@ -3,3 +3,26 @@ mod handler;
 mod state;
 
 pub(crate) use handler::serve_session;
+
+#[derive(Clone)]
+pub(crate) struct Metrics {
+    /// Total NextCheckpoint responses sent to the coordinator.
+    checkpoints: metrics::Counter,
+}
+
+impl Metrics {
+    fn new(shard_id: &str) -> Self {
+        static DESCRIBE: std::sync::Once = std::sync::Once::new();
+        DESCRIBE.call_once(|| {
+            metrics::describe_counter!(
+                "shuffle_session_checkpoints",
+                metrics::Unit::Count,
+                "NextCheckpoint responses sent to coordinator",
+            );
+        });
+
+        Self {
+            checkpoints: metrics::counter!("shuffle_session_checkpoints", "shard_id" => shard_id.to_string()),
+        }
+    }
+}
diff --git a/crates/shuffle/src/session/state.rs b/crates/shuffle/src/session/state.rs
index 55dba56c98b..1b446307a9c 100644
--- a/crates/shuffle/src/session/state.rs
+++ b/crates/shuffle/src/session/state.rs
@@ -10,8 +10,6 @@ pub struct Topology {
     pub session_id: u32,
     /// Ordered shard topology: each shard owns a disjoint key range.
     pub shards: Vec<shuffle::Shard>,
-    /// Shard Template ID prefix of the task that owns this session.
-    pub shard_prefix: String,
     /// Per-binding shuffle configuration extracted from the task spec.
     pub bindings: Vec<crate::Binding>,
     /// Checkpoint frontier restored from the previous session.
@@ -99,9 +97,8 @@ impl Topology {
 
         // Pick a shard within [start, stop). Use a stable hash for test stability.
         // Our intent is merely to balance read assignments across shards.
-        let hash = doc::Extractor::packed_hash(
-            format!("{};{}", spec.name, binding.journal_read_suffix).as_bytes(),
-        ) as usize;
+        let full_name = format!("{};{}", spec.name, binding.journal_read_suffix);
+        let hash = doc::Extractor::packed_hash(full_name.as_bytes()) as usize;
         let shard_index = hash % (stop - start) + start;
 
         let shard_range = self.shards[shard_index]
@@ -109,6 +106,22 @@ impl Topology {
             .as_ref()
             .expect("shard must have a RangeSpec");
 
+        service_kit::event!(
+            tracing::Level::DEBUG,
+            "topology",
+            full_name,
+            hash,
+            key_begin,
+            key_end,
+            shard_index,
+            shard_key_begin = shard_range.key_begin,
+            shard_key_end = shard_range.key_end,
+            shard_start = start,
+            shard_stop = stop,
+            shuffle_key_hash = shuffle_key_hash.unwrap_or_default(),
+            "routed read",
+        );
+
         Ok(RoutedRead {
             journal_key_begin: key_begin,
             journal_key_end: key_end,
@@ -245,11 +258,13 @@ impl CheckpointPipeline {
             .max()
             .map_or(0, |m| m as usize + 1);
 
-        tracing::debug!(
-            unresolved_hints = unresolved.unresolved_hints,
-            recovery_pending = unresolved.unresolved_hints != 0,
+        service_kit::event!(
+            tracing::Level::DEBUG,
+            "pipeline",
             num_cohorts,
-            "CheckpointPipeline initialized"
+            recovery_pending = unresolved.unresolved_hints != 0,
+            unresolved_hints = unresolved.unresolved_hints,
+            "CheckpointPipeline initialized",
         );
 
         let mut completed_clocks = vec![crate::ProducerMap::default(); num_cohorts];
@@ -296,10 +311,11 @@ impl CheckpointPipeline {
             self.ready.flushed_lsn = ready.flushed_lsn.clone();
             self.requested = false;
 
-            tracing::debug!(
-                journals = ready.journals.len(),
+            service_kit::event!(
+                tracing::Level::DEBUG,
+                "pipeline",
                 was_recovery = self.recovery_pending,
-                "checkpoint ready, taken by coordinator"
+                "taking `ready` frontier"
             );
 
             // Clearing recovery_pending may unblock accumulated progress that was
@@ -343,10 +359,11 @@ impl CheckpointPipeline {
             self.requested = false;
             self.unresolved_peek_progress = false;
 
-            tracing::debug!(
-                journals = peek.journals.len(),
-                unresolved_count = self.unresolved.unresolved_hints,
-                "peek of unresolved frontier, taken by coordinator"
+            service_kit::event!(
+                tracing::Level::DEBUG,
+                "pipeline",
+                unresolved_hints = peek.unresolved_hints,
+                "taking peek of `unresolved` frontier"
             );
 
             return Some(peek);
@@ -365,39 +382,42 @@ impl CheckpointPipeline {
         let mut progressed =
             crate::Frontier::decode(proto).context("validating Progressed frontier delta")?;
 
-        tracing::debug!(shard_index, ?progressed, "received Progressed response");
+        let (journals, journal_producers, bytes_read_delta, bytes_behind_delta) =
+            progressed.measures();
 
         // Resolve causal hints in `unresolved` using the incoming progress.
         // `advanced_count` includes producers whose `last_commit` advanced by
-        // any amount (toward but possibly below `hinted_commit`); `resolved_count`
+        // any amount (toward but possibly below `hinted_commit`); `resolved_hints`
         // is the strict subset that reached `hinted_commit`.
-        let (advanced_count, resolved_count) = self.unresolved.resolve_hints(&progressed);
+        let (advanced_count, resolved_hints) = self.unresolved.resolve_hints(&progressed);
 
         // Causal hints can have cyclic cycles, where journal A hints at B,
         // and B hints at A, but are reported in distinct Progressed responses.
         // `progressed` resolves hints in `unresolved`, but `unresolved` may also
         // resolve hints in `progressed`.
-        let (_, progressed_resolved) = progressed.resolve_hints(&self.unresolved);
+        let (_, _resolved_hints_progressed) = progressed.resolve_hints(&self.unresolved);
 
-        if progressed_resolved != 0 {
-            tracing::debug!(
-                progressed_resolved,
-                "unresolved resolved hints of progressed"
-            );
-        }
+        service_kit::event!(
+            tracing::Level::DEBUG,
+            "slice",
+            shard_index,
+            bytes_behind_delta,
+            bytes_read_delta,
+            journal_producers,
+            journals,
+            "received Progressed response",
+        );
 
-        // Any progress in `unresolved` (partial or full) disarms the timeout
-        // and arms the peek emission path.
+        // Was there any progress against `unresolved` (partial or full)?
         if advanced_count != 0 {
+            // Disarm the timeout and arm the peek emission path.
             self.unresolved_armed = false;
             self.unresolved_peek_progress = true;
-        }
 
-        // When progress resolves causal hints, fold its flushed_lsn into
-        // unresolved. Even though progressed is held back to a later checkpoint,
-        // the fact that it resolved a hint means `unresolved`'s consumer must
-        // read through these LSNs to observe the resolving documents.
-        if advanced_count != 0 {
+            // When progress advances causal hints, fold its flushed_lsn into
+            // unresolved. Even though `progressed` is held back to a later checkpoint,
+            // the fact that it resolved a hint means `unresolved`'s consumer must
+            // read through these LSNs to observe the resolving documents.
             self.unresolved.flushed_lsn = crate::Frontier::merge_flushed_lsn(
                 std::mem::take(&mut self.unresolved.flushed_lsn),
                 progressed.flushed_lsn.clone(),
@@ -406,23 +426,26 @@ impl CheckpointPipeline {
 
         // Promote unresolved → ready if all its hints were just resolved.
         // `Frontier::resolve_hints` already decremented `self.unresolved.unresolved_hints`
-        // by `resolved_count`, so a zero count here means everything resolved.
-        if resolved_count != 0 && self.unresolved.unresolved_hints == 0 {
-            tracing::debug!(
-                resolved_count,
-                unresolved_journals = self.unresolved.journals.len(),
-                "all causal hints resolved, promoting unresolved to ready"
+        // by `resolved_hints`, so a zero count here means everything resolved.
+        if resolved_hints != 0 && self.unresolved.unresolved_hints == 0 {
+            service_kit::event!(
+                tracing::Level::DEBUG,
+                "pipeline",
+                resolved_hints,
+                "promoting `unresolved` to `ready` (all hints resolved)"
             );
             let resolved = std::mem::take(&mut self.unresolved);
 
             update_completed_clocks(&mut self.completed_clocks, &self.binding_cohorts, &resolved);
             self.ready = std::mem::take(&mut self.ready).reduce(resolved);
         } else if advanced_count != 0 {
-            tracing::debug!(
+            service_kit::event!(
+                tracing::Level::DEBUG,
+                "pipeline",
                 advanced_count,
-                resolved_count,
-                remaining = self.unresolved.unresolved_hints,
-                "partially advanced causal hints"
+                resolved_hints,
+                unresolved_hints = self.unresolved.unresolved_hints,
+                "partially advanced `unresolved` hints"
             );
         }
 
@@ -446,9 +469,11 @@ impl CheckpointPipeline {
             return Ok(());
         }
         if !self.unresolved_armed {
-            tracing::debug!(
-                unresolved_count = self.unresolved.unresolved_hints,
-                "causal hint resolution armed; will error if no progress by next tick"
+            service_kit::event!(
+                tracing::Level::DEBUG,
+                "pipeline",
+                unresolved_hints = self.unresolved.unresolved_hints,
+                "causal hint resolution timeout armed"
             );
             self.unresolved_armed = true;
             return Ok(());
@@ -491,8 +516,7 @@ impl CheckpointPipeline {
         if self.recovery_pending || !self.unresolved.journals.is_empty() {
             return;
         }
-        let journals = self.progressed.journals.len();
-        if journals == 0 {
+        if self.progressed.journals.is_empty() {
             return;
         }
 
@@ -533,19 +557,21 @@ impl CheckpointPipeline {
         self.unresolved_peek_progress = self.unresolved.unresolved_hints != 0;
 
         if self.unresolved.unresolved_hints == 0 {
-            tracing::debug!(
-                journals,
-                "promoted progressed directly to ready (no unresolved hints)"
+            service_kit::event!(
+                tracing::Level::DEBUG,
+                "pipeline",
+                "promoted `progressed` directly to `ready`"
             );
             let resolved = std::mem::take(&mut self.unresolved);
 
             update_completed_clocks(&mut self.completed_clocks, &self.binding_cohorts, &resolved);
             self.ready = std::mem::take(&mut self.ready).reduce(resolved);
         } else {
-            tracing::debug!(
-                journals,
+            service_kit::event!(
+                tracing::Level::DEBUG,
+                "pipeline",
                 unresolved_hints = self.unresolved.unresolved_hints,
-                "promoted progressed to unresolved (awaiting hint resolution)"
+                "promoted `progressed` to `unresolved`"
             );
         }
     }
@@ -712,7 +738,6 @@ mod test {
         Topology {
             session_id: 1,
             shards,
-            shard_prefix: "materialize/test/task/".to_string(),
             bindings,
             resume_checkpoint: Default::default(),
         }
@@ -1532,6 +1557,7 @@ mod test {
 
         // Valid single shard covering the full 2D space.
         let full = shuffle::Shard {
+            id: "test/full".to_string(),
             range: Some(flow::RangeSpec {
                 key_begin: 0,
                 key_end: u32::MAX,
@@ -1544,6 +1570,7 @@ mod test {
         assert!(validate_shard_ranges(&[full]).is_ok());
 
         let shard = |kb: u32, ke: u32, rb: u32, re: u32| shuffle::Shard {
+            id: "test/shard".to_string(),
             range: Some(flow::RangeSpec {
                 key_begin: kb,
                 key_end: ke,
diff --git a/crates/shuffle/src/slice/actor.rs b/crates/shuffle/src/slice/actor.rs
index f8830f577d1..301dcedb1a8 100644
--- a/crates/shuffle/src/slice/actor.rs
+++ b/crates/shuffle/src/slice/actor.rs
@@ -45,8 +45,8 @@ pub struct SliceActor {
     pub parser: simd_doc::SimdParser,
     /// Ordered heap of reads with ready documents.
     pub ready_read_heap: ReadyReadHeap,
-    /// Drain of the next Progressed response to transmit.
-    pub progressed_drain: Option<shuffle::Frontier>,
+    /// Per-task metrics counters and gauges.
+    pub metrics: super::Metrics,
 }
 
 struct Buffers {
@@ -63,7 +63,7 @@ impl SliceActor {
         skip_all,
         fields(
             session = self.topology.session_id,
-            shard = self.topology.slice_shard_index,
+            shard_id = %self.topology.shards[self.topology.slice_shard_index as usize].id,
         )
     )]
     pub async fn serve<R>(
@@ -129,7 +129,6 @@ impl SliceActor {
                 ready_heap = self.ready_read_heap.len(),
                 flush = ?self.flush,
                 progress = ?self.progress,
-                progressed_drain = ?self.progressed_drain,
                 "SliceActor::serve iteration"
             );
             // First, attempt non-blocking sends.
@@ -172,7 +171,9 @@ impl SliceActor {
             }
         }
 
-        tracing::debug!(
+        service_kit::event!(
+            tracing::Level::DEBUG,
+            "session",
             loop_count,
             total_reads = self.reads.len(),
             flush_cycle = self.flush.cycle,
@@ -250,7 +251,11 @@ impl SliceActor {
                 progress: Some(shuffle::slice_request::Progress {}),
                 ..
             } => {
-                tracing::debug!("received Progress request from Session");
+                service_kit::event!(
+                    tracing::Level::DEBUG,
+                    "session",
+                    "received Progress request"
+                );
                 self.progress.request()
             }
 
@@ -282,22 +287,15 @@ impl SliceActor {
             .get(binding_index as usize)
             .context("StartRead invalid binding")?;
 
+        let binding_state_key = binding.state_key().to_string();
+        let client = (*self.topology.journal_clients[binding.index as usize]).clone();
         let spec = spec.context("StartRead missing spec")?;
         let journal = spec.name.into_boxed_str();
-        let client = (*self.topology.journal_clients[binding.index as usize]).clone();
+        let read_id = self.reads.len() as u32;
 
         // Resolve the checkpoint into producer state and start offset.
         let (offset, producers) = state::resolve_checkpoint(checkpoint);
 
-        tracing::debug!(
-            binding = binding.state_key(),
-            %journal,
-            offset,
-            create_revision,
-            ?producers,
-            "starting journal read"
-        );
-
         let mut request = broker::ReadRequest {
             // Add `journal_read_suffix` as a metadata component to the journal name.
             // This helps identify the sources of reads from the perspective of a gazette broker.
@@ -319,8 +317,19 @@ impl SliceActor {
             }),
         };
 
-        let binding_state_key = binding.state_key().to_string();
-        let read_id = self.reads.len() as u32;
+        service_kit::event!(
+            tracing::Level::DEBUG,
+            "read",
+            read_id,
+            binding = binding.index,
+            journal = journal.to_string(),
+            begin_mod_time = request.begin_mod_time,
+            n_producers = producers.len(),
+            offset,
+            "starting journal read",
+        );
+        self.metrics.reads_started.increment(1);
+
         self.reads.push(ReadState {
             binding_index: binding_index as u16,
             journal,
@@ -346,12 +355,16 @@ impl SliceActor {
             let tailing = offset >= write_head;
             request.header = probe_header;
 
-            tracing::debug!(
-                journal = %request.journal,
+            service_kit::event!(
+                tracing::Level::DEBUG,
+                "read",
+                read_id,
+                binding = binding_index,
+                journal = request.journal.clone(),
                 offset,
-                write_head,
                 tailing,
-                "probed journal write head for started read"
+                write_head,
+                "probed journal write head",
             );
 
             Ok(Box::pin(gazette::journal::read::ReadLines::new(
@@ -371,6 +384,7 @@ impl SliceActor {
         let read = probe_result?;
         if read.tailing() {
             self.tailing_reads += 1;
+            self.metrics.tailing_reads.set(self.tailing_reads as f64);
         }
         self.pending_reads.push(read.into_future());
         Ok(())
@@ -385,16 +399,22 @@ impl SliceActor {
     ) -> anyhow::Result<()> {
         let read_state = &mut self.reads[read.id() as usize];
         let binding = &self.topology.bindings[read_state.binding_index as usize];
+        let journal = read.fragment().journal.clone();
 
         let Some(result) = result else {
-            tracing::info!(
-                binding = binding.state_key(),
-                journal = %read.fragment().journal,
-                "stopping journal read due to EOF"
-            );
             if read.tailing() {
                 self.tailing_reads = self.tailing_reads.strict_sub(1);
+                self.metrics.tailing_reads.set(self.tailing_reads as f64);
             }
+            service_kit::event!(
+                tracing::Level::INFO,
+                "read",
+                read_id = read.id(),
+                binding = binding.index,
+                journal,
+                "stopped journal read (EOF)",
+            );
+            self.metrics.reads_stopped.increment(1);
             return Ok(());
         };
 
@@ -404,34 +424,47 @@ impl SliceActor {
                 inner: err,
             }) => match err {
                 gazette::Error::BrokerStatus(broker::Status::JournalNotFound) => {
-                    tracing::info!(
-                        binding = binding.state_key(),
-                        journal = %read.fragment().journal,
-                        "stopping journal read due to its deletion"
-                    );
                     if read.tailing() {
                         self.tailing_reads = self.tailing_reads.strict_sub(1);
+                        self.metrics.tailing_reads.set(self.tailing_reads as f64);
                     }
+                    service_kit::event!(
+                        tracing::Level::INFO,
+                        "read",
+                        read_id = read.id(),
+                        binding = binding.index,
+                        journal,
+                        "stopped journal read (JOURNAL_NOT_FOUND)",
+                    );
+                    self.metrics.reads_stopped.increment(1);
                     return Ok(());
                 }
                 gazette::Error::BrokerStatus(broker::Status::Suspended) => {
-                    tracing::info!(
-                        binding = binding.state_key(),
-                        journal = %read.fragment().journal,
-                        "stopping journal read due to its full suspension"
-                    );
                     if read.tailing() {
                         self.tailing_reads = self.tailing_reads.strict_sub(1);
+                        self.metrics.tailing_reads.set(self.tailing_reads as f64);
                     }
+                    service_kit::event!(
+                        tracing::Level::INFO,
+                        "read",
+                        read_id = read.id(),
+                        binding = binding.index,
+                        journal,
+                        "stopped journal read (SUSPENDED)",
+                    );
+                    self.metrics.reads_stopped.increment(1);
                     return Ok(());
                 }
                 err if err.is_transient() => {
-                    tracing::warn!(
-                        binding = %binding.state_key(),
-                        journal = %read_state.journal,
-                        attempt = attempt,
-                        %err,
-                        "transient error reading from journal (will retry)"
+                    service_kit::event!(
+                        tracing::Level::WARN,
+                        "read",
+                        read_id = read.id(),
+                        binding = binding.index,
+                        journal,
+                        attempt,
+                        err = service_kit::event::debug(err),
+                        "transient error reading from journal (will retry)",
                     );
                     self.pending_reads.push(read.into_future());
                     return Ok(());
@@ -451,9 +484,23 @@ impl SliceActor {
         // Pending read has now resolved. Update tailing aggregate and write_head.
         if lines_batch.tailing {
             self.tailing_reads = self.tailing_reads.strict_sub(1);
+            self.metrics.tailing_reads.set(self.tailing_reads as f64);
         }
         read_state.write_head = read.write_head();
 
+        service_kit::event!(
+            tracing::Level::TRACE,
+            "read",
+            read_id = read.id(),
+            binding = binding.index,
+            journal,
+            offset = lines_batch.offset,
+            length = lines_batch.content.len(),
+            tailing = lines_batch.tailing,
+            n_tailing = self.tailing_reads,
+            "received LinesBatch",
+        );
+
         let transcoded = match simd_doc::transcode_many(
             &mut self.parser,
             &mut lines_batch.content,
@@ -680,6 +727,7 @@ impl SliceActor {
                 (None, None) => {
                     if read.tailing() {
                         self.tailing_reads += 1;
+                        self.metrics.tailing_reads.set(self.tailing_reads as f64);
                     }
                     self.pending_reads.push(read.into_future());
                 }
@@ -725,11 +773,13 @@ impl SliceActor {
             });
         }
 
-        tracing::debug!(
-            shards = self.log_request_tx.len(),
+        service_kit::event!(
+            tracing::Level::DEBUG,
+            "log",
             cycle = flush_cycle,
-            "sent Flush to all logs"
+            "broadcast Flush request",
         );
+        self.metrics.flushes.increment(1);
 
         Ok(())
     }
@@ -848,27 +898,38 @@ impl SliceActor {
         // Future which represent an absence of an awake signal.
         let idle = future::Either::Right(std::future::ready(false));
 
-        if self.progressed_drain.is_none() {
-            let Some(frontier) = self.progress.take_progressed() else {
-                return Ok(idle);
-            };
-            tracing::debug!(?frontier, "sending Progressed to Session");
-            self.progressed_drain = Some(frontier.encode());
+        if !self.progress.has_progressed() {
+            return Ok(idle);
         }
+        // Reserve capacity *before* taking the Frontier — otherwise an absent
+        // permit would discard progress that hasn't been emitted yet.
+        let Ok(permit) = self.slice_response_tx.try_reserve() else {
+            return Ok(future::Either::Left(
+                self.slice_response_tx.clone().reserve_owned().map(|_| true),
+            ));
+        };
 
-        // Drain a Progressed response.
-        // Ensure channel capacity *before* take() to not lose it.
-        if self.progressed_drain.is_some() {
-            let Ok(permit) = self.slice_response_tx.try_reserve() else {
-                return Ok(future::Either::Left(
-                    self.slice_response_tx.clone().reserve_owned().map(|_| true),
-                ));
-            };
-            permit.send(Ok(shuffle::SliceResponse {
-                progressed: self.progressed_drain.take(),
-                ..Default::default()
-            }));
-        }
+        let frontier = self.progress.take_progressed();
+        let (journals, journal_producers, bytes_read_delta, bytes_behind_delta) =
+            frontier.measures();
+
+        permit.send(Ok(shuffle::SliceResponse {
+            progressed: Some(frontier.encode()),
+            ..Default::default()
+        }));
+
+        service_kit::event!(
+            tracing::Level::DEBUG,
+            "session",
+            bytes_behind_delta,
+            bytes_read_delta,
+            journal_producers,
+            journals,
+            "sent Progressed",
+        );
+        self.metrics
+            .bytes_read
+            .increment(bytes_read_delta.max(0) as u64);
 
         Ok(idle)
     }
diff --git a/crates/shuffle/src/slice/handler.rs b/crates/shuffle/src/slice/handler.rs
index cd268ff2e10..a476ef3097b 100644
--- a/crates/shuffle/src/slice/handler.rs
+++ b/crates/shuffle/src/slice/handler.rs
@@ -3,11 +3,31 @@ use anyhow::Context;
 use futures::{StreamExt, stream};
 use proto_flow::shuffle;
 use tokio::sync::mpsc;
+use tracing::Instrument;
 
 pub(crate) async fn serve_slice<R>(
+    service: crate::Service,
+    slice_request_rx: R,
+    slice_response_tx: mpsc::Sender<tonic::Result<shuffle::SliceResponse>>,
+) -> anyhow::Result<()>
+where
+    R: futures::Stream<Item = tonic::Result<shuffle::SliceRequest>> + Send + Unpin + 'static,
+{
+    // Run the whole handler inside its span so operator trace overrides (see
+    // `service_kit::trace`) reach every log line — the actor loop's periodic
+    // instrumentation included.
+    let handler = service.registry.register("shuffle.slice");
+    let span = handler.span();
+    serve_slice_inner(service, slice_request_rx, slice_response_tx, handler)
+        .instrument(span)
+        .await
+}
+
+async fn serve_slice_inner<R>(
     service: crate::Service,
     mut slice_request_rx: R,
     slice_response_tx: mpsc::Sender<tonic::Result<shuffle::SliceResponse>>,
+    mut handler: service_kit::HandlerGuard,
 ) -> anyhow::Result<()>
 where
     R: futures::Stream<Item = tonic::Result<shuffle::SliceRequest>> + Send + Unpin + 'static,
@@ -32,14 +52,29 @@ where
             service.peer_endpoint,
         );
     }
+    // Identity of the shard hosting this Slice RPC.
+    let shard_id = shards
+        .get(slice_shard_index as usize)
+        .map(|s| &s.id)
+        .context("Open shard_index out of range")?;
+
+    handler.set_label(shard_id);
+    handler.set_field("session_id", session_id);
+    handler.set_field("slice_shard_index", slice_shard_index);
+    handler.set_field("shards", shards.len());
+    handler.set_phase("opening");
+
+    let metrics = super::Metrics::new(shard_id);
     let task = task.context("Open must include task")?;
-    let (shard_prefix, bindings, validators) = crate::Binding::from_task(&task)?;
+    let (bindings, validators) = crate::Binding::from_task(&task)?;
 
-    tracing::info!(
+    service_kit::event!(
+        tracing::Level::INFO,
+        "session",
         session_id,
-        slice_shard_index,
         shards = shards.len(),
-        "Slice received Open"
+        slice_shard_index,
+        "received Open from Session",
     );
 
     // Concurrently Open a Log RPC with every shard.
@@ -85,11 +120,11 @@ where
         .iter()
         .map(|binding| {
             let service = service.clone();
-            let shard_prefix = shard_prefix.clone();
+            let shard_id = shard_id.clone();
             let partition_prefix = binding.partition_prefix.clone().into();
 
             LazyJournalClient::new(Box::new(move || {
-                (service.journal_client_factory)(shard_prefix, partition_prefix)
+                (service.journal_client_factory)(shard_id, partition_prefix)
             }))
         })
         .collect();
@@ -100,13 +135,14 @@ where
         session_id,
         shards,
         slice_shard_index,
-        shard_prefix,
         bindings,
         journal_clients,
         hint_index,
     };
 
-    SliceActor {
+    handler.set_phase("running");
+
+    let result = SliceActor {
         topology,
         validators,
         reads: Vec::new(),
@@ -121,10 +157,16 @@ where
         parser: simd_doc::SimdParser::new(1_000_000),
         ready_read_heap: ReadyReadHeap::new(),
         tailing_reads: 0,
-        progressed_drain: None,
+        metrics,
     }
     .serve(slice_request_rx, log_response_rx)
-    .await
+    .await;
+
+    match &result {
+        Ok(()) => handler.finish_ok(),
+        Err(err) => handler.finish_err(&format!("{err:#}")),
+    }
+    result
 }
 
 /// Open Log RPCs to all shards and wait for Opened responses.
diff --git a/crates/shuffle/src/slice/listing.rs b/crates/shuffle/src/slice/listing.rs
index 6ee656adeef..e731dac5976 100644
--- a/crates/shuffle/src/slice/listing.rs
+++ b/crates/shuffle/src/slice/listing.rs
@@ -2,6 +2,7 @@ use futures::StreamExt;
 use proto_flow::shuffle;
 use proto_gazette::broker;
 use tokio::sync::mpsc;
+use tracing::Instrument;
 
 /// Gazette list::Subscriber that sends listing events to an mpsc channel.
 pub struct Subscriber {
@@ -17,6 +18,7 @@ impl gazette::journal::list::Subscriber for Subscriber {
         mod_revision: i64,
         route: broker::Route,
     ) -> gazette::Result<()> {
+        let journal = journal_spec.name.clone();
         let added = shuffle::slice_response::ListingAdded {
             binding: self.binding,
             create_revision,
@@ -24,10 +26,17 @@ impl gazette::journal::list::Subscriber for Subscriber {
             spec: Some(journal_spec),
             route: Some(route),
         };
-        tracing::debug!(added=?ops::DebugJson(&added), "journal added");
+
+        service_kit::event!(
+            tracing::Level::DEBUG,
+            "watch",
+            binding = self.binding,
+            journal,
+            "journal added to listing",
+        );
 
         // Blocking safety: we may stuff this channel, but we're doing so from a
-        // dedicated task. We may compete with SliceActor::serve(), which obtains
+        // dedicated task. We compete with SliceActor::serve(), which obtains
         // permits to send on this channel.
         let _ignored = self
             .tx
@@ -43,7 +52,13 @@ impl gazette::journal::list::Subscriber for Subscriber {
     async fn remove_journal(&mut self, journal: String) -> gazette::Result<()> {
         // We don't forward removed journals, because readers dynamically detect
         // them via the JOURNAL_NOT_FOUND broker status.
-        tracing::debug!(binding = self.binding, journal, "journal removed");
+        service_kit::event!(
+            tracing::Level::DEBUG,
+            "watch",
+            binding = self.binding,
+            journal,
+            "journal removed from listing",
+        );
         Ok(())
     }
 }
@@ -77,9 +92,11 @@ pub fn spawn_listing(
         loop {
             match list_watch.next().await {
                 Some(Ok((added, removed))) => {
-                    tracing::info!(
+                    service_kit::event!(
+                        tracing::Level::DEBUG,
+                        "watch",
                         binding,
-                        %collection,
+                        collection = collection.to_string(),
                         added,
                         removed,
                         "collection listing updated",
@@ -90,11 +107,13 @@ pub fn spawn_listing(
                     inner: err,
                 })) => {
                     if err.is_transient() {
-                        tracing::warn!(
+                        service_kit::event!(
+                            tracing::Level::WARN,
+                            "watch",
                             binding,
-                            %collection,
+                            collection = collection.to_string(),
                             attempt,
-                            %err,
+                            err = service_kit::event::debug(err),
                             "collection journal listing watch failed (will retry)",
                         );
                     } else {
@@ -116,5 +135,13 @@ pub fn spawn_listing(
         }
     };
 
-    tokio::spawn(cancel.run_until_cancelled_owned(list_watch))
+    // Carry the caller's span (the Slice handler's `service_kit::HandlerGuard`
+    // span) into the spawned task: tokio::spawn does not inherit the current
+    // span, so without this the task's tracing events would not be associated
+    // with the handler's event tracks.
+    tokio::spawn(
+        cancel
+            .run_until_cancelled_owned(list_watch)
+            .instrument(tracing::Span::current()),
+    )
 }
diff --git a/crates/shuffle/src/slice/mod.rs b/crates/shuffle/src/slice/mod.rs
index b54cf3b4e54..f2e1090b794 100644
--- a/crates/shuffle/src/slice/mod.rs
+++ b/crates/shuffle/src/slice/mod.rs
@@ -38,3 +38,58 @@ pub type ReadLines = std::pin::Pin<
 /// Drained into the flush frontier each flush cycle.
 pub type CausalHints =
     std::collections::HashMap<(Box<str>, u16), Vec<(uuid::Producer, uuid::Clock)>>;
+
+#[derive(Clone)]
+pub(crate) struct Metrics {
+    /// Total bytes read from journals, accumulated from each progress flush.
+    bytes_read: metrics::Counter,
+    /// Total flush cycles started (broadcast Flush to Log shards).
+    flushes: metrics::Counter,
+    /// Total journal reads started over the session lifetime.
+    reads_started: metrics::Counter,
+    /// Total journal reads that terminated (EOF, JOURNAL_NOT_FOUND, SUSPENDED).
+    reads_stopped: metrics::Counter,
+    /// Number of active reads currently tailing their journal write head.
+    tailing_reads: metrics::Gauge,
+}
+
+impl Metrics {
+    fn new(shard_id: &str) -> Self {
+        static DESCRIBE: std::sync::Once = std::sync::Once::new();
+        DESCRIBE.call_once(|| {
+            metrics::describe_counter!(
+                "shuffle_slice_bytes_read",
+                metrics::Unit::Bytes,
+                "bytes read from journals, observed at each progress flush",
+            );
+            metrics::describe_counter!(
+                "shuffle_slice_flushes",
+                metrics::Unit::Count,
+                "flush cycles broadcast to Log shards",
+            );
+            metrics::describe_counter!(
+                "shuffle_slice_reads_started",
+                metrics::Unit::Count,
+                "journal reads started over the session lifetime",
+            );
+            metrics::describe_counter!(
+                "shuffle_slice_reads_stopped",
+                metrics::Unit::Count,
+                "journal reads that terminated (EOF, JOURNAL_NOT_FOUND, SUSPENDED)",
+            );
+            metrics::describe_gauge!(
+                "shuffle_slice_tailing_reads",
+                metrics::Unit::Count,
+                "active reads currently tailing their journal write head",
+            );
+        });
+
+        Self {
+            bytes_read: metrics::counter!("shuffle_slice_bytes_read", "shard_id" => shard_id.to_string()),
+            flushes: metrics::counter!("shuffle_slice_flushes", "shard_id" => shard_id.to_string()),
+            reads_started: metrics::counter!("shuffle_slice_reads_started", "shard_id" => shard_id.to_string()),
+            reads_stopped: metrics::counter!("shuffle_slice_reads_stopped", "shard_id" => shard_id.to_string()),
+            tailing_reads: metrics::gauge!("shuffle_slice_tailing_reads", "shard_id" => shard_id.to_string()),
+        }
+    }
+}
diff --git a/crates/shuffle/src/slice/read.rs b/crates/shuffle/src/slice/read.rs
index 478a433893c..72c6172aa5f 100644
--- a/crates/shuffle/src/slice/read.rs
+++ b/crates/shuffle/src/slice/read.rs
@@ -143,12 +143,14 @@ pub async fn probe_write_head(
                 inner: err,
             })) => {
                 if err.is_transient() {
-                    tracing::warn!(
-                        binding = %binding_state_key,
-                        %journal,
+                    service_kit::event!(
+                        tracing::Level::WARN,
+                        "read",
+                        binding = binding_state_key.to_string(),
+                        journal = journal.to_string(),
                         attempt,
-                        %err,
-                        "transient error probing journal write head (will retry)"
+                        err = service_kit::event::debug(err),
+                        "transient error probing journal write head (will retry)",
                     );
                 } else {
                     return Err(map_read_error(
diff --git a/crates/shuffle/src/slice/state.rs b/crates/shuffle/src/slice/state.rs
index d67d44cd964..e5a8d7706cd 100644
--- a/crates/shuffle/src/slice/state.rs
+++ b/crates/shuffle/src/slice/state.rs
@@ -18,8 +18,6 @@ pub struct Topology {
     pub shards: Vec<shuffle::Shard>,
     /// Index of this Slice RPC within `shards`.
     pub slice_shard_index: u32,
-    /// Shard Template ID prefix of the task that owns this session.
-    pub shard_prefix: String,
     /// Per-binding shuffle configuration extracted from the task spec.
     pub bindings: Vec<crate::Binding>,
     /// Lazily-initialized Gazette clients for listing and reading journals, indexed by binding.
@@ -103,12 +101,22 @@ impl FlushState {
         };
 
         *in_flight = false;
+        let n_pending = self.in_flight.iter().filter(|pending| **pending).count();
         self.flushing.flushed_lsn[shard_index] = flushed_lsn;
 
-        if self.in_flight.iter().any(|pending| *pending) {
+        service_kit::event!(
+            tracing::Level::DEBUG,
+            "log",
+            shard_index,
+            cycle = self.cycle,
+            flushed_lsn = flushed_lsn.as_u64(),
+            n_pending,
+            "received Flushed response",
+        );
+
+        if n_pending != 0 {
             return Ok(None);
         }
-        tracing::debug!(cycle = self.cycle, "all shards Flushed");
 
         // We increment `cycle` now to ensure we'll clearly reject a duplicate
         // Flushed from a Log (which would be a protocol violation).
@@ -147,17 +155,34 @@ impl ProgressState {
 
     /// Reduce a completed flush frontier into accumulated progress.
     pub fn on_flush_completed(&mut self, frontier: crate::Frontier) {
+        let (journals, journal_producers, bytes_read_delta, bytes_behind_delta) =
+            frontier.measures();
+
+        service_kit::event!(
+            tracing::Level::DEBUG,
+            "log",
+            bytes_behind_delta,
+            bytes_read_delta,
+            journal_producers,
+            journals,
+            "gathered Flushed responses",
+        );
+
         self.flushed = std::mem::take(&mut self.flushed).reduce(frontier);
     }
 
-    /// If progress was requested and we have flushed progress to report,
-    /// take the flushed frontier and clear both flags.
-    pub fn take_progressed(&mut self) -> Option<crate::Frontier> {
-        if !self.requested || self.flushed.journals.is_empty() {
-            return None;
-        }
+    /// Is progress ready to report? True iff a request is outstanding AND
+    /// we've accumulated flushed progress. Idempotent — gate `take_progressed()`
+    /// on this so a failed permit reservation can be retried.
+    pub fn has_progressed(&self) -> bool {
+        self.requested && !self.flushed.journals.is_empty()
+    }
+
+    /// Unconditionally clear the outstanding request and accumulated flushed
+    /// progress, returning the latter. Callers should gate on `has_progressed()`.
+    pub fn take_progressed(&mut self) -> crate::Frontier {
         self.requested = false;
-        Some(std::mem::take(&mut self.flushed))
+        std::mem::take(&mut self.flushed)
     }
 }
 
@@ -784,12 +809,12 @@ mod test {
     fn test_progress_reporting() {
         let mut progress = ProgressState::new();
 
-        // No request + no flushed → None.
-        assert!(progress.take_progressed().is_none());
+        // No request + no flushed → not ready.
+        assert!(!progress.has_progressed());
 
-        // Request but no flushed → None.
+        // Request but no flushed → not ready.
         progress.request().unwrap();
-        assert!(progress.take_progressed().is_none());
+        assert!(!progress.has_progressed());
         // requested should remain true.
         assert!(progress.requested);
 
@@ -811,8 +836,9 @@ mod test {
             unresolved_hints: 0,
         };
 
-        // Request + flushed → Some(frontier), both cleared.
-        let frontier = progress.take_progressed().expect("request + flushed");
+        // Request + flushed → has_progressed gates, take_progressed consumes.
+        assert!(progress.has_progressed());
+        let frontier = progress.take_progressed();
         assert!(!progress.requested, "requested cleared");
         assert!(progress.flushed.journals.is_empty(), "flushed cleared");
         assert_eq!(frontier.journals.len(), 1);
diff --git a/crates/shuffle/src/testing.rs b/crates/shuffle/src/testing.rs
index baa99144fb8..09e8ee28496 100644
--- a/crates/shuffle/src/testing.rs
+++ b/crates/shuffle/src/testing.rs
@@ -70,6 +70,7 @@ pub fn pf_tuple(pf: &crate::ProducerFrontier) -> (u64, u64, i64) {
 pub fn test_shards_3() -> Vec<shuffle::Shard> {
     vec![
         shuffle::Shard {
+            id: "test/task/shard-0".to_string(),
             range: Some(flow::RangeSpec {
                 key_begin: 0x00000000,
                 key_end: 0x55555554,
@@ -80,6 +81,7 @@ pub fn test_shards_3() -> Vec<shuffle::Shard> {
             directory: "/test/log/shard-0".to_string(),
         },
         shuffle::Shard {
+            id: "test/task/shard-1".to_string(),
             range: Some(flow::RangeSpec {
                 key_begin: 0x55555555,
                 key_end: 0xaaaaaaa9,
@@ -90,6 +92,7 @@ pub fn test_shards_3() -> Vec<shuffle::Shard> {
             directory: "/test/log/shard-1".to_string(),
         },
         shuffle::Shard {
+            id: "test/task/shard-2".to_string(),
             range: Some(flow::RangeSpec {
                 key_begin: 0xaaaaaaaa,
                 key_end: 0xffffffff,
diff --git a/crates/shuffle/tests/scenario_fixtures.rs b/crates/shuffle/tests/scenario_fixtures.rs
index 72db272d2c9..11ccc211b63 100644
--- a/crates/shuffle/tests/scenario_fixtures.rs
+++ b/crates/shuffle/tests/scenario_fixtures.rs
@@ -68,6 +68,7 @@ fn build_shards(
             };
 
             shuffle::proto::Shard {
+                id: format!("scenario-fixtures/shard-{i:03}"),
                 range: Some(flow::RangeSpec {
                     key_begin,
                     key_end,
@@ -214,7 +215,12 @@ async fn shuffle_scenarios() {
         let journal_client = data_plane.journal_client.clone();
         move |_authz_sub, _authz_obj| journal_client.clone()
     });
-    let service = shuffle::Service::new(endpoint.clone(), factory, 10 * 1024 * 1024 * 1024);
+    let service = shuffle::Service::new(
+        endpoint.clone(),
+        factory,
+        10 * 1024 * 1024 * 1024,
+        service_kit::Registry::new(),
+    );
 
     let server = service.clone().build_tonic_server();
     let server_handle = tokio::spawn(async move {
diff --git a/crates/shuffle/tests/scenario_fuzz.rs b/crates/shuffle/tests/scenario_fuzz.rs
index 8e4f7ecd833..b2590cf6402 100644
--- a/crates/shuffle/tests/scenario_fuzz.rs
+++ b/crates/shuffle/tests/scenario_fuzz.rs
@@ -215,7 +215,12 @@ fn get_harness() -> &'static SharedHarness {
                     let journal_client = data_plane.journal_client.clone();
                     move |_authz_sub, _authz_obj| journal_client.clone()
                 });
-                let service = shuffle::Service::new(endpoint, factory, 10 * 1024 * 1024 * 1024);
+                let service = shuffle::Service::new(
+                    endpoint,
+                    factory,
+                    10 * 1024 * 1024 * 1024,
+                    service_kit::Registry::new(),
+                );
 
                 let server = service.clone().build_tonic_server();
                 let server_handle = tokio::spawn(async move {
@@ -290,6 +295,7 @@ fn build_shards(
             };
 
             shuffle::proto::Shard {
+                id: format!("scenario-fuzz/shard-{i:03}"),
                 range: Some(flow::RangeSpec {
                     key_begin,
                     key_end,
diff --git a/crates/validation/tests/scenario_tests.rs b/crates/validation/tests/scenario_tests.rs
index 7cf4cf0a2cb..0ac15926cab 100644
--- a/crates/validation/tests/scenario_tests.rs
+++ b/crates/validation/tests/scenario_tests.rs
@@ -1792,6 +1792,49 @@ test://example/catalog.yaml:
     insta::assert_debug_snapshot!(outcome.errors);
 }
 
+#[test]
+fn test_redacted_key_with_connector_and_relaxed_write_schema() {
+    let outcome = common::run(
+        include_str!("schema_inference.yaml"),
+        r##"
+driver:
+  liveInferredSchemas:
+    testing/foobar:
+      properties:
+        key:
+          type: string
+          minimum: null
+          maximum: null
+      required: [key]
+
+test://example/catalog.yaml:
+  collections:
+    testing/foobar:
+      writeSchema:
+        $defs:
+          "flow://connector-schema":
+            $id: "flow://connector-schema"
+            type: object
+            properties:
+              key:
+                type: string
+            required: [key]
+            additionalProperties: true
+            x-infer-schema: true
+        allOf:
+          - $ref: "flow://connector-schema"
+        properties:
+          key:
+            type: string
+            minimum: null
+            maximum: null
+            redact: { strategy: sha256 }
+"##,
+    );
+
+    insta::assert_debug_snapshot!(outcome.errors, @"[]");
+}
+
 #[test]
 fn test_collection_inferred_schema_add_blocking() {
     // A redact annotation on a required write schema property raises an error.
diff --git a/go/bindings/build_test.go b/go/bindings/build_test.go
index 035d8f2ccaf..72aadb3f147 100644
--- a/go/bindings/build_test.go
+++ b/go/bindings/build_test.go
@@ -75,7 +75,6 @@ func TestBuildCatalog(t *testing.T) {
 			require.NoError(t, err)
 			cupaloy.SnapshotT(t, out)
 		})
-
 		return nil
 	}))
 }
diff --git a/go/bindings/task_service_v2.go b/go/bindings/task_service_v2.go
new file mode 100644
index 00000000000..1c77c76978c
--- /dev/null
+++ b/go/bindings/task_service_v2.go
@@ -0,0 +1,162 @@
+package bindings
+
+// #include "../../crates/bindings/flow_bindings.h"
+import "C"
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/signal"
+	"reflect"
+	"syscall"
+	"unsafe"
+
+	"github.com/estuary/flow/go/protocols/ops"
+	pr "github.com/estuary/flow/go/protocols/runtime"
+	grpc_prometheus "github.com/grpc-ecosystem/go-grpc-prometheus"
+	"github.com/sirupsen/logrus"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+// TaskServiceV2 wraps the runtime-next CGO `TaskService`. Its lifecycle and
+// pipe-FD log plumbing mirrors `TaskService` exactly; the symbols differ so
+// the two runtimes can be linked side-by-side during the V2 rollout.
+type TaskServiceV2 struct {
+	config pr.TaskServiceConfig
+	cSvc   *C.TaskServiceV2
+	conn   *grpc.ClientConn
+	lwaCh  <-chan struct{}
+}
+
+func NewTaskServiceV2(
+	config pr.TaskServiceConfig,
+	logHandler func(ops.Log),
+) (*TaskServiceV2, error) {
+
+	// We must ignore SIGPIPE!
+	//
+	// This implementation uses a graceful shutdown where it will block on Drop
+	// waiting for all client RPCs to complete. HOWEVER, Rust's hyper crate will
+	// *NOT* wait for the complete shutdown of any underlying transports,
+	// and will immediately close their descriptors. This can cause EPIPE errors
+	// when the HTTP/2 transport coroutines attempt reads or writes over those
+	// transports -- both from Go and also from Rust.
+	//
+	// So, we must mask SIGPIPE so that these become EPIPE errno results, which
+	// both Go and Rust handle reasonably.
+	signal.Ignore(syscall.SIGPIPE)
+
+	var logReader, wDescriptor, err = Pipe()
+	if err != nil {
+		return nil, fmt.Errorf("creating logging pipe: %w", err)
+	}
+	config.LogFileFd = int32(wDescriptor)
+
+	// Log so that we can know the association between tasks and log file descriptors,
+	// for troubleshooting issues with missing logs.
+	logrus.WithFields(logrus.Fields{
+		"task_name":    config.TaskName,
+		"log_fd_write": wDescriptor,
+		"log_fd_read":  logReader.Fd(),
+	}).Info("created new pipe for task logs")
+
+	// Rust services produce canonical JSON encodings of ops::Log into `wDescriptor`.
+	// Parse each and pass to our `publisher`.
+	var lwaCh = make(chan struct{})
+	go func() {
+		defer close(lwaCh)
+		var _, err = io.Copy(ops.NewLogWriteAdapter(logHandler), logReader)
+		if err != nil {
+			logrus.WithFields(logrus.Fields{
+				"error":   err,
+				"service": config.TaskName,
+			}).Error("failed to process cgo V2 service channel logs")
+		}
+	}()
+
+	udsFile, err := os.CreateTemp("", "run-sock")
+	if err != nil {
+		return nil, fmt.Errorf("creating task service socket file: %w", err)
+	}
+	config.UdsPath = udsFile.Name()
+
+	// Rust service will re-create the path.
+	if err = udsFile.Close(); err != nil {
+		return nil, fmt.Errorf("closing task service socket file: %w", err)
+	}
+	if err = os.Remove(config.UdsPath); err != nil {
+		return nil, fmt.Errorf("removing task service socket file: %w", err)
+	}
+
+	configBytes, err := config.Marshal()
+	if err != nil {
+		return nil, err
+	}
+	var h = (*reflect.SliceHeader)(unsafe.Pointer(&configBytes))
+
+	var svc = &TaskServiceV2{
+		config: config,
+		cSvc: C.new_task_service_v2(
+			(*C.uint8_t)(unsafe.Pointer(h.Data)),
+			C.uint32_t(h.Len),
+		),
+		lwaCh: lwaCh,
+	}
+
+	if err := svc.err(); err != nil {
+		svc.Drop()
+		return nil, err
+	}
+
+	svc.conn, err = grpc.DialContext(
+		context.Background(),
+		"unix://"+config.UdsPath,
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		grpc.WithUnaryInterceptor(grpc_prometheus.UnaryClientInterceptor),
+		grpc.WithStreamInterceptor(grpc_prometheus.StreamClientInterceptor),
+		grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(maxMessageSize), grpc.MaxCallSendMsgSize(maxMessageSize)),
+	)
+
+	if err != nil {
+		svc.Drop()
+		return nil, err
+	}
+
+	return svc, nil
+}
+
+func (s *TaskServiceV2) Conn() *grpc.ClientConn {
+	return s.conn
+}
+
+func (s *TaskServiceV2) Drop() {
+	if s.conn != nil {
+		_ = s.conn.Close()
+		s.conn = nil
+	}
+	if s.cSvc != nil {
+		C.task_service_v2_drop(s.cSvc)
+		s.cSvc = nil
+	}
+	if s.lwaCh != nil {
+		// Block until log read loop reads error or EOF.
+		// This happens only after all Rust references of the Pipe have been
+		// dropped and the descriptor has been closed.
+		<-s.lwaCh
+		s.lwaCh = nil
+	}
+	_ = os.Remove(s.config.UdsPath) // Best effort.
+}
+
+func (s *TaskServiceV2) err() error {
+	var err error
+	if s.cSvc.err_len != 0 {
+		err = errors.New(C.GoStringN(
+			(*C.char)(unsafe.Pointer(s.cSvc.err_ptr)),
+			C.int(s.cSvc.err_len)))
+	}
+	return err
+}
diff --git a/go/protocols/runtime/runtime.pb.go b/go/protocols/runtime/runtime.pb.go
index 4db9a9027ea..b78a1895623 100644
--- a/go/protocols/runtime/runtime.pb.go
+++ b/go/protocols/runtime/runtime.pb.go
@@ -1514,14 +1514,10 @@ var xxx_messageInfo_Joined proto.InternalMessageInfo
 type Task struct {
 	// Task specification (protobuf-encoded bytes).
 	Spec []byte `protobuf:"bytes,1,opt,name=spec,proto3" json:"spec,omitempty"`
-	// Collection journal partition to which task states are written.
-	OpsStatsJournal string `protobuf:"bytes,2,opt,name=ops_stats_journal,json=opsStatsJournal,proto3" json:"ops_stats_journal,omitempty"`
-	// Collection to which task stats are written.
-	OpsStatsSpec *flow.CollectionSpec `protobuf:"bytes,3,opt,name=ops_stats_spec,json=opsStatsSpec,proto3" json:"ops_stats_spec,omitempty"`
 	// When true, documents and stats are written to output and not directed to collections.
-	Preview bool `protobuf:"varint,4,opt,name=preview,proto3" json:"preview,omitempty"`
+	Preview bool `protobuf:"varint,2,opt,name=preview,proto3" json:"preview,omitempty"`
 	// Preview / harness control. Zero means unlimited.
-	MaxTransactions      uint32   `protobuf:"varint,5,opt,name=max_transactions,json=maxTransactions,proto3" json:"max_transactions,omitempty"`
+	MaxTransactions      uint32   `protobuf:"varint,3,opt,name=max_transactions,json=maxTransactions,proto3" json:"max_transactions,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -1654,13 +1650,13 @@ var xxx_messageInfo_Recover proto.InternalMessageInfo
 // zero's RocksDB. Absent fields are inert.
 //
 // All fields of a Persist land together in a single WriteBatch.
-// `nonce` is echoed back by the shard's Persisted response, allowing
+// `seq_no` is echoed back by the shard's Persisted response, allowing
 // the leader to match a Persisted response to its originating request.
 type Persist struct {
 	// Request ID picked by the leader and echoed verbatim in the shard's
 	// `Persisted` response. The leader chooses any value and the shard
 	// does not interpret it.
-	Nonce uint64 `protobuf:"varint,1,opt,name=nonce,proto3" json:"nonce,omitempty"`
+	SeqNo uint64 `protobuf:"varint,1,opt,name=seq_no,json=seqNo,proto3" json:"seq_no,omitempty"`
 	// Delete previously-persisted ACK intents. Applies ahead of `ack_intents`.
 	// Effect: DeleteRange("AI:")
 	DeleteAckIntents bool `protobuf:"varint,2,opt,name=delete_ack_intents,json=deleteAckIntents,proto3" json:"delete_ack_intents,omitempty"`
@@ -1671,37 +1667,44 @@ type Persist struct {
 	// Clock at which the last-committed transaction closed.
 	// Effect: Put under "committed-close-clock".
 	CommittedCloseClock uint64 `protobuf:"fixed64,4,opt,name=committed_close_clock,json=committedCloseClock,proto3" json:"committed_close_clock,omitempty"`
+	// Delete all previously-persisted committed Frontier entries.
+	// Applies ahead of `committed_frontier`.
+	// Effect: DeleteRange("FC:")
+	DeleteCommittedFrontier bool `protobuf:"varint,5,opt,name=delete_committed_frontier,json=deleteCommittedFrontier,proto3" json:"delete_committed_frontier,omitempty"`
 	// Committed Frontier entries.
 	// Effect: Put under "FC:..." keys.
-	CommittedFrontier *shuffle.Frontier `protobuf:"bytes,5,opt,name=committed_frontier,json=committedFrontier,proto3" json:"committed_frontier,omitempty"`
+	CommittedFrontier *shuffle.Frontier `protobuf:"bytes,6,opt,name=committed_frontier,json=committedFrontier,proto3" json:"committed_frontier,omitempty"`
 	// Connector state patches. State Update Wire Format.
 	// Effect: Merge each patch under "connector-state".
-	ConnectorPatchesJson []byte `protobuf:"bytes,6,opt,name=connector_patches_json,json=connectorPatches,proto3" json:"connector_patches_json,omitempty"`
+	ConnectorPatchesJson []byte `protobuf:"bytes,7,opt,name=connector_patches_json,json=connectorPatches,proto3" json:"connector_patches_json,omitempty"`
 	// Clock at which the hinted transaction closed.
 	// Effect: Put under "hinted-close-clock".
-	HintedCloseClock uint64 `protobuf:"fixed64,7,opt,name=hinted_close_clock,json=hintedCloseClock,proto3" json:"hinted_close_clock,omitempty"`
+	HintedCloseClock uint64 `protobuf:"fixed64,8,opt,name=hinted_close_clock,json=hintedCloseClock,proto3" json:"hinted_close_clock,omitempty"`
 	// Delete a previously-persisted hinted frontier. Applies ahead of `hinted_frontier`.
 	// Effect: DeleteRange("FH:")
-	DeleteHintedFrontier bool `protobuf:"varint,8,opt,name=delete_hinted_frontier,json=deleteHintedFrontier,proto3" json:"delete_hinted_frontier,omitempty"`
+	DeleteHintedFrontier bool `protobuf:"varint,9,opt,name=delete_hinted_frontier,json=deleteHintedFrontier,proto3" json:"delete_hinted_frontier,omitempty"`
 	// Hinted Frontier entries.
 	// Effect: Put under "FH:" keys.
-	HintedFrontier *shuffle.Frontier `protobuf:"bytes,9,opt,name=hinted_frontier,json=hintedFrontier,proto3" json:"hinted_frontier,omitempty"`
+	HintedFrontier *shuffle.Frontier `protobuf:"bytes,10,opt,name=hinted_frontier,json=hintedFrontier,proto3" json:"hinted_frontier,omitempty"`
 	// Last-applied task specification (protobuf-encoded bytes), or empty.
 	// Effect: Put under "last-applied" key.
-	LastApplied []byte `protobuf:"bytes,10,opt,name=last_applied,json=lastApplied,proto3" json:"last_applied,omitempty"`
-	// Legacy checkpoint, required for rollback to legacy runtime.
+	LastApplied []byte `protobuf:"bytes,11,opt,name=last_applied,json=lastApplied,proto3" json:"last_applied,omitempty"`
+	// Delete a previously-persisted legacy checkpoint.
+	// Effect: Delete the "checkpoint" key.
+	DeleteLegacyCheckpoint bool `protobuf:"varint,12,opt,name=delete_legacy_checkpoint,json=deleteLegacyCheckpoint,proto3" json:"delete_legacy_checkpoint,omitempty"`
+	// Legacy checkpoint, required for rollback to the V1 runtime.
 	// Effect: Put under "checkpoint" key.
-	LegacyCheckpoint *protocol1.Checkpoint `protobuf:"bytes,11,opt,name=legacy_checkpoint,json=legacyCheckpoint,proto3" json:"legacy_checkpoint,omitempty"`
+	LegacyCheckpoint *protocol1.Checkpoint `protobuf:"bytes,13,opt,name=legacy_checkpoint,json=legacyCheckpoint,proto3" json:"legacy_checkpoint,omitempty"`
 	// Per-binding max-key updates, reduced to per-binding maximum across shards.
 	// Key: binding index; Value: packed composite key tuple.
 	// Effect: Put value under "MK-v2:{state_key}" (state_key resolved by the encoder).
-	MaxKeys map[uint32][]byte `protobuf:"bytes,12,rep,name=max_keys,json=maxKeys,proto3" json:"max_keys,omitempty" protobuf_key:"varint,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	MaxKeys map[uint32][]byte `protobuf:"bytes,14,rep,name=max_keys,json=maxKeys,proto3" json:"max_keys,omitempty" protobuf_key:"varint,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
 	// Delete previously-persisted trigger parameters. Applies ahead of `trigger_params_json`.
 	// Effect: Delete the "trigger-params" key.
-	DeleteTriggerParams bool `protobuf:"varint,13,opt,name=delete_trigger_params,json=deleteTriggerParams,proto3" json:"delete_trigger_params,omitempty"`
+	DeleteTriggerParams bool `protobuf:"varint,15,opt,name=delete_trigger_params,json=deleteTriggerParams,proto3" json:"delete_trigger_params,omitempty"`
 	// Materialization trigger parameters.
 	// Effect: Put under "trigger-params" key.
-	TriggerParamsJson    []byte   `protobuf:"bytes,14,opt,name=trigger_params_json,json=triggerParams,proto3" json:"trigger_params_json,omitempty"`
+	TriggerParamsJson    []byte   `protobuf:"bytes,16,opt,name=trigger_params_json,json=triggerParams,proto3" json:"trigger_params_json,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -1743,8 +1746,8 @@ var xxx_messageInfo_Persist proto.InternalMessageInfo
 // Persisted is sent by shard zero to the leader after the state is durable
 // in the recovery log.
 type Persisted struct {
-	// Echoed back from the originating `Persist.nonce` request.
-	Nonce                uint64   `protobuf:"varint,1,opt,name=nonce,proto3" json:"nonce,omitempty"`
+	// Echoed back from the originating `Persist.seq_no` request.
+	SeqNo                uint64   `protobuf:"varint,1,opt,name=seq_no,json=seqNo,proto3" json:"seq_no,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -2115,6 +2118,11 @@ type Materialize struct {
 	Validate *materialize.Request_Validate `protobuf:"bytes,3,opt,name=validate,proto3" json:"validate,omitempty"`
 	// Shard → Controller. Connector's reply to `validate`.
 	Validated *materialize.Response_Validated `protobuf:"bytes,4,opt,name=validated,proto3" json:"validated,omitempty"`
+	// Controller → Shard. Effective only on unary `spec` / `validate`
+	// messages, which never see the Join-time labeling that supplies the
+	// log level for session-bound work. Ignored on all other variants
+	// (the leader → shard messages MUST NOT set this).
+	LogLevel ops.Log_Level `protobuf:"varint,5,opt,name=log_level,json=logLevel,proto3,enum=ops.Log_Level" json:"log_level,omitempty"`
 	// Controller → Shard. First message of a session-loop stream;
 	// never sent to the Leader.
 	SessionLoop *SessionLoop `protobuf:"bytes,20,opt,name=session_loop,json=sessionLoop,proto3" json:"session_loop,omitempty"`
@@ -2920,244 +2928,245 @@ func init() {
 }
 
 var fileDescriptor_73af6e0737ce390c = []byte{
-	// 3784 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xcc, 0x3a, 0x4b, 0x6c, 0x1c, 0x47,
-	0x76, 0x9e, 0xff, 0xf4, 0x9b, 0xe1, 0x70, 0xa6, 0x44, 0xc9, 0xed, 0xb1, 0x2d, 0x52, 0x63, 0x3b,
-	0xe6, 0x4a, 0xd4, 0x90, 0x4b, 0x7b, 0x77, 0x6d, 0x61, 0xb5, 0x16, 0x39, 0x24, 0x6d, 0x6a, 0x29,
-	0x89, 0x29, 0x52, 0x42, 0x92, 0x4b, 0xa3, 0xd9, 0x55, 0x1c, 0xb6, 0xd8, 0xd3, 0xd5, 0xdb, 0xd5,
-	0x43, 0x6a, 0xf6, 0x9a, 0x4b, 0x80, 0x1c, 0x72, 0xc9, 0x2d, 0x97, 0xe4, 0x14, 0x20, 0x48, 0x0e,
-	0xb9, 0xee, 0x21, 0xa7, 0x00, 0xf1, 0x31, 0x48, 0x80, 0x20, 0x27, 0x01, 0xd9, 0x5c, 0x73, 0x73,
-	0x02, 0x24, 0x42, 0x0e, 0x8b, 0xfa, 0xf4, 0x67, 0x3e, 0xa4, 0x25, 0xda, 0x07, 0x1f, 0x24, 0x76,
-	0xbd, 0x5f, 0xbf, 0x7a, 0xf5, 0x7e, 0xf5, 0x7a, 0xa0, 0xd3, 0x67, 0xab, 0x41, 0xc8, 0x22, 0xe6,
-	0x30, 0x8f, 0xaf, 0x86, 0x43, 0x3f, 0x72, 0x07, 0x34, 0xfe, 0xdb, 0x95, 0x18, 0x54, 0xd1, 0xcb,
-	0xf6, 0xcd, 0xa3, 0x90, 0x9d, 0xd2, 0x30, 0x61, 0x48, 0x1e, 0x14, 0x61, 0x7b, 0xc9, 0x61, 0x3e,
-	0x1f, 0x0e, 0x2e, 0xa3, 0x18, 0x7b, 0x1d, 0xa1, 0xa1, 0x7b, 0x46, 0xf5, 0x1f, 0x4d, 0xf1, 0xde,
-	0x18, 0xc5, 0xb1, 0xc7, 0xce, 0xe5, 0x7f, 0x1a, 0x7b, 0x7b, 0x0c, 0x3b, 0xb0, 0x23, 0x1a, 0xba,
-	0xb6, 0xe7, 0xfe, 0x9a, 0x66, 0x9f, 0x35, 0x6d, 0x7b, 0x8c, 0x96, 0x05, 0xf2, 0x9f, 0xc6, 0x8d,
-	0x6f, 0x9b, 0x9f, 0x0c, 0x8f, 0x8f, 0x3d, 0x1a, 0xff, 0xd5, 0x34, 0x0b, 0x7d, 0xd6, 0x67, 0xf2,
-	0x71, 0x55, 0x3c, 0x29, 0x68, 0xe7, 0x1f, 0x72, 0xd0, 0x3a, 0xb4, 0xf9, 0xe9, 0x01, 0x0d, 0xcf,
-	0x5c, 0x87, 0xf6, 0x98, 0x7f, 0xec, 0xf6, 0xd1, 0x4d, 0xa8, 0x79, 0xac, 0x6f, 0x1d, 0xbb, 0x1e,
-	0xb5, 0x8e, 0x89, 0x99, 0x5b, 0xca, 0x2d, 0x97, 0xb0, 0xe1, 0xb1, 0xfe, 0x8e, 0xeb, 0xd1, 0x1d,
-	0x82, 0xde, 0x05, 0x23, 0xb2, 0xf9, 0xa9, 0xe5, 0xdb, 0x03, 0x6a, 0xe6, 0x97, 0x72, 0xcb, 0x06,
-	0xae, 0x0a, 0xc0, 0x63, 0x7b, 0x40, 0xd1, 0x3b, 0x50, 0x1d, 0x12, 0x6e, 0x05, 0x76, 0x74, 0x62,
-	0x16, 0x24, 0xae, 0x32, 0x24, 0x7c, 0xdf, 0x8e, 0x4e, 0xd0, 0x1d, 0x68, 0x39, 0xcc, 0x8f, 0x6c,
-	0xd7, 0xa7, 0xa1, 0xe5, 0xd3, 0xe8, 0x9c, 0x85, 0xa7, 0x66, 0x51, 0xd2, 0x34, 0x13, 0xc4, 0x63,
-	0x05, 0x47, 0x1f, 0x42, 0x29, 0xf0, 0x6c, 0x9f, 0x9a, 0xe5, 0xa5, 0xdc, 0x72, 0x63, 0xbd, 0xd1,
-	0x8d, 0x8f, 0x71, 0x5f, 0x40, 0xb1, 0x42, 0x76, 0xfe, 0xaf, 0x08, 0x8d, 0x03, 0xb5, 0x51, 0x4c,
-	0x7f, 0x35, 0xa4, 0x3c, 0x42, 0xbb, 0x50, 0x79, 0xce, 0x86, 0xa1, 0x6f, 0x7b, 0x52, 0x73, 0x63,
-	0x73, 0xf5, 0xd5, 0xcb, 0xc5, 0x3b, 0x7d, 0xd6, 0xed, 0xdb, 0xbf, 0xa6, 0x51, 0x44, 0xbb, 0x84,
-	0x9e, 0xad, 0x3a, 0x2c, 0xa4, 0xab, 0x13, 0x0e, 0xd0, 0x7d, 0xa8, 0xd8, 0x70, 0xcc, 0x8f, 0x6e,
-	0x40, 0x39, 0xa4, 0x81, 0x67, 0x8f, 0xe4, 0x2e, 0xab, 0x58, 0xaf, 0xc4, 0x1e, 0x8f, 0x86, 0xae,
-	0x47, 0x2c, 0x97, 0xc4, 0x7b, 0x94, 0xeb, 0x5d, 0x82, 0x76, 0xa0, 0xcc, 0x8e, 0x8f, 0x39, 0x8d,
-	0xe4, 0xc6, 0x0a, 0x9b, 0xdd, 0x57, 0x2f, 0x17, 0x6f, 0xbf, 0xce, 0xcb, 0x9f, 0x48, 0x2e, 0xac,
-	0xb9, 0xd1, 0x23, 0x00, 0xea, 0x13, 0x4b, 0xcb, 0x2a, 0x5d, 0x49, 0x96, 0x41, 0x7d, 0xa2, 0x1e,
-	0xd1, 0x1d, 0x28, 0x85, 0xb6, 0xdf, 0x57, 0xd6, 0xac, 0xad, 0xcf, 0x77, 0xa5, 0x1b, 0x62, 0x01,
-	0x3a, 0x08, 0xa8, 0xb3, 0x59, 0xfc, 0xfa, 0xe5, 0xe2, 0x5b, 0x58, 0xd1, 0xa0, 0x03, 0xa8, 0x39,
-	0x8c, 0x85, 0xc4, 0xf5, 0xed, 0x88, 0x85, 0x66, 0x45, 0x5a, 0xf1, 0xc7, 0xaf, 0x5e, 0x2e, 0xde,
-	0x9d, 0xf5, 0xf2, 0xa9, 0x30, 0xe9, 0x1e, 0x9c, 0xd8, 0x21, 0xd9, 0xdd, 0xc2, 0x59, 0x29, 0x68,
-	0x0d, 0x20, 0xa4, 0x9c, 0x79, 0xc3, 0xc8, 0x65, 0xbe, 0x59, 0x95, 0x6a, 0x34, 0xbb, 0x09, 0xcf,
-	0x57, 0xd4, 0x26, 0x34, 0xc4, 0x19, 0x1a, 0xf4, 0x01, 0xcc, 0x69, 0x1f, 0xb6, 0x5c, 0x9f, 0xd0,
-	0x17, 0xa6, 0xb1, 0x94, 0x5b, 0x9e, 0xc3, 0x75, 0x0d, 0xdc, 0x15, 0x30, 0xf4, 0x29, 0x80, 0x8c,
-	0x38, 0x5b, 0x8a, 0x05, 0x29, 0x76, 0x41, 0xed, 0xae, 0xc7, 0x3c, 0x8f, 0x3a, 0x02, 0x2e, 0xb6,
-	0x88, 0x33, 0x74, 0xa8, 0x07, 0xf3, 0x69, 0x88, 0x29, 0xd6, 0x9a, 0x64, 0x7d, 0x47, 0xb1, 0x3e,
-	0x1a, 0x47, 0x4a, 0xfe, 0x49, 0x8e, 0xce, 0xbf, 0x14, 0x61, 0x3e, 0xf1, 0x3d, 0x1e, 0x30, 0x9f,
-	0x53, 0xb4, 0x0c, 0x65, 0x1e, 0xd9, 0xd1, 0x90, 0x4b, 0xdf, 0x6b, 0xac, 0x37, 0xbb, 0xb1, 0x79,
-	0xba, 0x07, 0x12, 0x8e, 0x35, 0x5e, 0x50, 0x9e, 0xc8, 0x3d, 0x4b, 0xdf, 0x9a, 0x65, 0x0b, 0x8d,
-	0x47, 0x1f, 0x41, 0x23, 0xa2, 0xe1, 0xc0, 0xf5, 0x6d, 0xcf, 0xa2, 0x61, 0xc8, 0x42, 0xed, 0x73,
-	0x73, 0x31, 0x74, 0x5b, 0x00, 0xd1, 0xef, 0x43, 0x3d, 0xa4, 0x36, 0xb1, 0xa2, 0x93, 0x90, 0x0d,
-	0xfb, 0x27, 0x57, 0xf4, 0xbf, 0x9a, 0x90, 0x71, 0xa8, 0x44, 0x08, 0x27, 0x3c, 0x0f, 0xdd, 0x88,
-	0x5a, 0x42, 0x93, 0xab, 0x3a, 0xa1, 0x94, 0x20, 0xb6, 0x84, 0x76, 0xa1, 0x64, 0x87, 0xd4, 0xb7,
-	0xa5, 0x13, 0xd6, 0x37, 0x3f, 0x79, 0xf5, 0x72, 0x71, 0xb5, 0xef, 0x46, 0x27, 0xc3, 0xa3, 0xae,
-	0xc3, 0x06, 0xab, 0x94, 0x47, 0x43, 0x3b, 0x1c, 0xa9, 0x34, 0x39, 0x95, 0x38, 0xbb, 0x1b, 0x82,
-	0x15, 0x2b, 0x09, 0xe8, 0x23, 0x28, 0x12, 0xe6, 0x70, 0xb3, 0xb2, 0x54, 0x58, 0xae, 0xad, 0xd7,
-	0xd4, 0xa9, 0x1d, 0x78, 0xae, 0x43, 0xb5, 0x2b, 0x4b, 0x34, 0xfa, 0x0a, 0x2a, 0x2a, 0x82, 0xb8,
-	0x59, 0x5d, 0x2a, 0x5c, 0x41, 0xfb, 0x98, 0x5d, 0xf8, 0xd9, 0x70, 0xe8, 0x12, 0x2b, 0xb0, 0xc3,
-	0x88, 0x9b, 0x86, 0x7c, 0xad, 0x8e, 0xa2, 0xa7, 0x4f, 0x77, 0xb7, 0xf6, 0x05, 0x58, 0xbf, 0xda,
-	0x10, 0x84, 0x12, 0x20, 0x9c, 0x3e, 0xb0, 0x9d, 0x53, 0x4a, 0xac, 0x53, 0x3a, 0x32, 0xe1, 0x22,
-	0x65, 0x0d, 0x45, 0xf4, 0x4b, 0x3a, 0xea, 0x10, 0x68, 0x61, 0xe6, 0x9c, 0xf2, 0xad, 0xcd, 0x2d,
-	0xca, 0x9d, 0xd0, 0x0d, 0x44, 0xec, 0xac, 0x00, 0x0a, 0x05, 0x90, 0x1c, 0x59, 0xd4, 0x3f, 0xb3,
-	0x06, 0x74, 0x10, 0x44, 0xa1, 0xf4, 0xb0, 0x32, 0x6e, 0x6a, 0xcc, 0xb6, 0x7f, 0xf6, 0x48, 0xc2,
-	0xd1, 0x2d, 0xa8, 0xc7, 0xd4, 0x32, 0x0b, 0xab, 0x0c, 0x5d, 0xd3, 0x30, 0x91, 0x89, 0x3b, 0x7f,
-	0x9e, 0x07, 0xa3, 0x17, 0x67, 0x5c, 0xf4, 0x36, 0x54, 0xdc, 0xc0, 0xb2, 0x09, 0x51, 0x32, 0x0d,
-	0x5c, 0x76, 0x83, 0x0d, 0x42, 0x42, 0xf4, 0x53, 0x98, 0xd3, 0x69, 0xda, 0x0a, 0x98, 0xd8, 0x77,
-	0x5e, 0xee, 0xa0, 0xa5, 0x76, 0xa0, 0x33, 0xf5, 0x3e, 0x0b, 0x23, 0x5c, 0xf7, 0xd3, 0x05, 0x47,
-	0x07, 0xd0, 0x1a, 0xd8, 0x41, 0x40, 0x89, 0x75, 0xc2, 0x78, 0xa4, 0x79, 0x0b, 0x92, 0xf7, 0xe3,
-	0x24, 0x8f, 0x27, 0xef, 0xef, 0x3e, 0x92, 0xb4, 0x5f, 0x31, 0x1e, 0x49, 0xf6, 0x6d, 0x3f, 0x0a,
-	0x47, 0x22, 0xdc, 0xc6, 0xa0, 0xe8, 0x7d, 0x80, 0x21, 0xb7, 0xfb, 0xd4, 0x0a, 0xed, 0x88, 0x4a,
-	0xef, 0xce, 0x63, 0x43, 0x42, 0xb0, 0x1d, 0xd1, 0xf6, 0x26, 0x2c, 0xcc, 0x92, 0x83, 0x9a, 0x50,
-	0x10, 0xb6, 0xcf, 0xc9, 0xdc, 0x21, 0x1e, 0xd1, 0x02, 0x94, 0xce, 0x6c, 0x6f, 0x18, 0x97, 0x2e,
-	0xb5, 0xb8, 0x97, 0xff, 0x2c, 0xd7, 0xf9, 0x9b, 0x3c, 0xb4, 0x7a, 0x76, 0x10, 0x0d, 0xc3, 0xb8,
-	0x9a, 0x6c, 0xbf, 0x10, 0xb9, 0x53, 0xd4, 0x3e, 0xcb, 0xa3, 0x67, 0xd4, 0xd3, 0x61, 0xdd, 0xe8,
-	0x8a, 0xea, 0xbb, 0xc7, 0xfa, 0xdd, 0x3d, 0x01, 0xc5, 0x55, 0x8f, 0xf5, 0xe5, 0x13, 0xda, 0x4d,
-	0x8f, 0x8a, 0x24, 0x07, 0xa8, 0x43, 0xbc, 0x9d, 0xec, 0x7d, 0xea, 0x88, 0x71, 0x4b, 0x73, 0x65,
-	0x4e, 0x7d, 0x17, 0xea, 0x3c, 0xb2, 0xc3, 0xc8, 0x72, 0xd8, 0x60, 0xe0, 0x46, 0x32, 0xea, 0x6b,
-	0xeb, 0xbf, 0x97, 0x1a, 0x70, 0x52, 0x53, 0x91, 0x62, 0xc2, 0xa8, 0x27, 0xa9, 0x71, 0x8d, 0xa7,
-	0x8b, 0x36, 0x86, 0x5a, 0x06, 0x87, 0x7a, 0x80, 0xb4, 0x10, 0xcb, 0x39, 0xa1, 0xce, 0x69, 0xc0,
-	0x5c, 0x3f, 0x92, 0x5b, 0x13, 0xc9, 0x33, 0xc9, 0x58, 0xbd, 0x04, 0x87, 0x5b, 0x9a, 0x3e, 0x05,
-	0x75, 0xfe, 0xbf, 0x08, 0x28, 0x51, 0x41, 0xa5, 0x3f, 0x61, 0xad, 0x35, 0x30, 0x92, 0x5a, 0xae,
-	0x45, 0xa2, 0xe9, 0x33, 0xc7, 0x29, 0x11, 0xba, 0x07, 0x65, 0x16, 0x50, 0x9f, 0x12, 0x6d, 0xa6,
-	0xce, 0xf4, 0x0e, 0x13, 0xf1, 0xdd, 0x27, 0x92, 0x12, 0x6b, 0x0e, 0xf4, 0x00, 0xaa, 0x8e, 0x22,
-	0x22, 0xda, 0x3e, 0x1f, 0x5e, 0xc6, 0xad, 0x41, 0x04, 0x27, 0x5c, 0x68, 0x07, 0x20, 0x63, 0x83,
-	0xe2, 0x45, 0x36, 0xce, 0xc8, 0x48, 0xad, 0x92, 0xe1, 0x6c, 0x3f, 0x82, 0xb2, 0xd2, 0xed, 0x7b,
-	0xb1, 0x6e, 0xfb, 0x19, 0x54, 0x63, 0x65, 0x85, 0xe7, 0x9f, 0xd2, 0x91, 0xa5, 0x92, 0x84, 0x14,
-	0x54, 0xc7, 0xc6, 0x29, 0x1d, 0xed, 0x4b, 0x80, 0x68, 0xab, 0x44, 0x56, 0x72, 0x45, 0x51, 0xe2,
-	0x31, 0x55, 0x5e, 0x52, 0x35, 0x53, 0x84, 0x22, 0x6e, 0x9f, 0x03, 0xa4, 0x6f, 0x41, 0x4b, 0x50,
-	0x12, 0xe5, 0x88, 0x6b, 0xed, 0x40, 0xba, 0xb5, 0x28, 0x54, 0x1c, 0x2b, 0x04, 0xfa, 0x12, 0x6a,
-	0x01, 0xf3, 0x3c, 0x2b, 0xa4, 0x7c, 0xe8, 0x45, 0x52, 0x6c, 0xe3, 0x72, 0xfb, 0xec, 0x33, 0xcf,
-	0xc3, 0x92, 0x1a, 0x43, 0x90, 0x3c, 0x77, 0x1e, 0x03, 0xa4, 0x18, 0x54, 0x83, 0xca, 0xee, 0xe3,
-	0x67, 0x1b, 0x7b, 0xbb, 0x5b, 0xcd, 0xb7, 0x90, 0x01, 0x25, 0xbc, 0xbd, 0xb1, 0xf5, 0x87, 0xcd,
-	0x1c, 0x9a, 0x03, 0xe3, 0xf1, 0x93, 0x43, 0x4b, 0x2d, 0xf3, 0xa8, 0x0e, 0xd5, 0xde, 0x93, 0x27,
-	0x7b, 0xd6, 0x93, 0x9d, 0x9d, 0x66, 0x41, 0x30, 0xe1, 0xed, 0x83, 0xc3, 0x0d, 0x7c, 0xd8, 0x2c,
-	0x76, 0xfe, 0x2b, 0x07, 0xcd, 0x2d, 0xd9, 0x6b, 0xff, 0x00, 0x42, 0x75, 0x1d, 0x8a, 0xc2, 0x21,
-	0xb5, 0x0b, 0xde, 0x4c, 0x98, 0x27, 0x15, 0x94, 0xee, 0x8b, 0x25, 0x6d, 0x7b, 0x05, 0x8a, 0x62,
-	0x85, 0x3e, 0x84, 0x06, 0xff, 0x95, 0x27, 0xaa, 0xec, 0xd9, 0x31, 0xb7, 0x86, 0xa1, 0xab, 0x93,
-	0x70, 0x5d, 0x41, 0x9f, 0x1d, 0xf3, 0xa7, 0xa1, 0xdb, 0xf9, 0xef, 0x02, 0xb4, 0x62, 0x69, 0xdf,
-	0x25, 0xd8, 0x3e, 0x9f, 0x08, 0xb6, 0x5b, 0x53, 0xba, 0x5e, 0x18, 0x6b, 0x9b, 0x60, 0x04, 0xc3,
-	0x23, 0xcf, 0xe5, 0x27, 0x33, 0x82, 0x6d, 0x9a, 0x7b, 0x3f, 0xa6, 0xc5, 0x29, 0x1b, 0xfa, 0x39,
-	0x54, 0x8e, 0xbd, 0xa1, 0x94, 0x50, 0x9c, 0x08, 0xf6, 0x69, 0x09, 0x3b, 0x8a, 0x12, 0xc7, 0x2c,
-	0xdf, 0x77, 0x8c, 0x45, 0x60, 0x24, 0x4a, 0x8a, 0x4b, 0xcd, 0xc0, 0x7e, 0x61, 0x39, 0x1e, 0x73,
-	0x4e, 0x75, 0x69, 0xad, 0x0e, 0xec, 0x17, 0x3d, 0xb1, 0x9e, 0x88, 0xc0, 0xfc, 0x6b, 0x45, 0x60,
-	0xe1, 0x82, 0x08, 0xbc, 0x03, 0x15, 0xbd, 0xb1, 0x6f, 0x0f, 0xbf, 0xce, 0x9f, 0xe5, 0xe0, 0x7a,
-	0xda, 0x8c, 0xfe, 0x00, 0x5c, 0xbd, 0xf3, 0x9b, 0x1c, 0xdc, 0x18, 0xd3, 0xe8, 0xbb, 0x78, 0xe3,
-	0x46, 0xea, 0x0e, 0x4a, 0x99, 0xb4, 0x3d, 0x98, 0xfd, 0x8e, 0x69, 0x9f, 0x78, 0x23, 0x73, 0xfe,
-	0xa6, 0x08, 0x8d, 0x1e, 0x1b, 0x1c, 0xb9, 0x7e, 0x72, 0x5d, 0x5c, 0xd3, 0xa1, 0xab, 0x78, 0xde,
-	0xcb, 0xe8, 0x9b, 0x25, 0xcb, 0x04, 0x2e, 0xba, 0x0b, 0x05, 0x9b, 0xc4, 0x0a, 0xbf, 0x7b, 0x11,
-	0xc3, 0x06, 0x21, 0x58, 0xd0, 0xb5, 0xff, 0x2d, 0xaf, 0x03, 0xfd, 0x01, 0x54, 0x8f, 0x5c, 0x9f,
-	0xb8, 0x7e, 0x5f, 0x68, 0x58, 0x18, 0xaf, 0x55, 0xd3, 0x6f, 0xeb, 0x6e, 0x2a, 0x62, 0x9c, 0x70,
-	0xb5, 0xff, 0x34, 0x0f, 0x15, 0x0d, 0x45, 0x08, 0x8a, 0xc7, 0x43, 0x4f, 0x1d, 0x7d, 0x15, 0xcb,
-	0xe7, 0xb8, 0xd7, 0x11, 0x5d, 0x9a, 0xa1, 0x7a, 0x9d, 0xcf, 0xa0, 0x16, 0x84, 0xec, 0xb9, 0xba,
-	0x06, 0xc5, 0x3d, 0x58, 0x53, 0xf5, 0x6f, 0xfb, 0x09, 0x42, 0xb7, 0xa1, 0x59, 0x52, 0x74, 0x1f,
-	0x6a, 0xdc, 0x39, 0xa1, 0x03, 0xdb, 0x7a, 0xce, 0x99, 0x2f, 0xa3, 0xb5, 0xbe, 0xf9, 0xde, 0xab,
-	0x97, 0x8b, 0x26, 0xf5, 0x1d, 0x26, 0x54, 0x58, 0x15, 0x88, 0x2e, 0xb6, 0xcf, 0x1f, 0x51, 0x2e,
-	0xdb, 0x30, 0x50, 0x0c, 0x0f, 0x39, 0xf3, 0x51, 0x17, 0x80, 0xd3, 0xd0, 0x0a, 0x98, 0xe7, 0x3a,
-	0x23, 0x79, 0x75, 0x48, 0xfa, 0xe5, 0x03, 0x1a, 0xee, 0x4b, 0x30, 0x36, 0x78, 0xfc, 0x28, 0xc7,
-	0x06, 0xb2, 0xbf, 0x8e, 0x42, 0x79, 0x3d, 0x30, 0x70, 0x45, 0xb6, 0xd1, 0x51, 0x28, 0x6e, 0xe1,
-	0xb2, 0x45, 0x53, 0xdd, 0xbe, 0x81, 0xf5, 0xaa, 0xed, 0x43, 0x61, 0x83, 0x10, 0x64, 0x42, 0x45,
-	0x1b, 0x48, 0x37, 0x79, 0xf1, 0x12, 0xfd, 0x0c, 0xaa, 0x84, 0x39, 0x4a, 0xff, 0xfc, 0x6b, 0xe8,
-	0x5f, 0x21, 0xcc, 0x91, 0xca, 0x2f, 0x40, 0xe9, 0x38, 0x64, 0xbe, 0x6a, 0xb9, 0xaa, 0x58, 0x2d,
-	0x3a, 0xff, 0x9e, 0x83, 0xf9, 0xe4, 0x9c, 0xf4, 0x7d, 0xef, 0xe2, 0x97, 0x9b, 0x50, 0x21, 0xd4,
-	0xa3, 0x91, 0x76, 0xed, 0x2a, 0x8e, 0x97, 0x63, 0x6a, 0x15, 0xae, 0xa4, 0x56, 0x31, 0xa3, 0xd6,
-	0x44, 0x6e, 0x2a, 0x4d, 0xe6, 0xa6, 0x0f, 0x60, 0x4e, 0xd9, 0x2b, 0xa6, 0x90, 0x97, 0x2f, 0x5c,
-	0x57, 0x40, 0x45, 0xd4, 0x79, 0x1b, 0xae, 0xf7, 0x98, 0xef, 0x53, 0x27, 0x62, 0xe1, 0x7e, 0xc8,
-	0x5e, 0x8c, 0xb4, 0x23, 0x76, 0xfe, 0x22, 0x07, 0x37, 0x26, 0x31, 0x7a, 0xeb, 0x0f, 0xa1, 0x22,
-	0xae, 0x0c, 0x94, 0x73, 0x3d, 0x67, 0x59, 0x7b, 0xf5, 0x72, 0x71, 0xe5, 0x75, 0xee, 0x56, 0xdb,
-	0x3e, 0x51, 0x39, 0x39, 0x16, 0x20, 0x4e, 0x3f, 0x10, 0xc2, 0x2d, 0x97, 0xe8, 0xae, 0xbc, 0x22,
-	0xd7, 0xbb, 0x04, 0xb5, 0xa1, 0xe0, 0xb1, 0xbe, 0xae, 0x37, 0xd5, 0x38, 0xc3, 0x61, 0x01, 0xec,
-	0xfc, 0x7d, 0x01, 0x8a, 0x0f, 0x99, 0xeb, 0xa3, 0xdb, 0xd0, 0xa2, 0x91, 0x43, 0xac, 0x01, 0x23,
-	0x56, 0x48, 0xcf, 0x5c, 0x2e, 0x6e, 0xf4, 0x42, 0xab, 0x02, 0x9e, 0x17, 0x88, 0x47, 0x8c, 0x60,
-	0x0d, 0x46, 0x77, 0xa0, 0xcc, 0x4f, 0xec, 0x90, 0xc4, 0xb7, 0x99, 0x6b, 0x49, 0x10, 0x0a, 0x51,
-	0x6a, 0x78, 0x81, 0x35, 0x09, 0x5a, 0x84, 0x9a, 0x7c, 0xd2, 0x13, 0x88, 0x82, 0x3c, 0x63, 0x90,
-	0x20, 0x35, 0x7f, 0xb8, 0x03, 0xad, 0x78, 0x48, 0x41, 0xdc, 0x50, 0x9a, 0x69, 0x14, 0xcf, 0xb4,
-	0x34, 0x62, 0x2b, 0x86, 0xa3, 0x1f, 0x41, 0x0c, 0xb3, 0xa8, 0xb6, 0x81, 0x3c, 0x30, 0x03, 0xcf,
-	0x6b, 0x78, 0x6c, 0x1a, 0xf4, 0x31, 0xcc, 0x7b, 0xf2, 0xfa, 0x9f, 0x52, 0xaa, 0xb0, 0x68, 0x28,
-	0x70, 0x4c, 0xd8, 0xfe, 0xbb, 0x1c, 0x94, 0xa4, 0xce, 0xa8, 0x01, 0x79, 0x97, 0xe8, 0xe6, 0x21,
-	0xef, 0x12, 0xd4, 0x85, 0xaa, 0x67, 0x1f, 0x51, 0x4f, 0x38, 0x67, 0x5e, 0x67, 0x63, 0x99, 0x11,
-	0x05, 0xf5, 0x9e, 0xc6, 0xe0, 0x84, 0x06, 0xad, 0x43, 0x25, 0xa4, 0xb6, 0xd0, 0x54, 0x5b, 0xdb,
-	0x4c, 0x47, 0x12, 0xfb, 0x21, 0x73, 0x28, 0xe7, 0x07, 0x01, 0x75, 0xba, 0xbb, 0x5b, 0x38, 0x26,
-	0x44, 0x6b, 0xb0, 0x20, 0x0d, 0xef, 0x84, 0xd4, 0x8e, 0x68, 0x6a, 0x7b, 0x39, 0x7c, 0xc0, 0x48,
-	0xe0, 0x7a, 0x12, 0x15, 0x9b, 0xbf, 0xf3, 0x29, 0x94, 0x85, 0x9d, 0x29, 0x11, 0x87, 0x26, 0x2a,
-	0xae, 0xe4, 0x9f, 0x3c, 0xb4, 0x81, 0xfd, 0x62, 0x3b, 0x72, 0x92, 0x43, 0xeb, 0xfc, 0x53, 0x0e,
-	0x8a, 0x87, 0x36, 0x3f, 0x15, 0x69, 0x8f, 0x07, 0xd4, 0xd1, 0x5d, 0xb0, 0x7c, 0x16, 0x82, 0x58,
-	0xc0, 0x2d, 0x99, 0xe2, 0xad, 0x78, 0xf6, 0xa7, 0xdc, 0x68, 0x9e, 0x05, 0x5c, 0x56, 0x00, 0x3d,
-	0xdb, 0x43, 0xf7, 0xa0, 0x91, 0xd2, 0x4a, 0x49, 0x85, 0x4b, 0x66, 0x46, 0xf5, 0x98, 0x5d, 0xac,
-	0x44, 0x48, 0x07, 0x42, 0x51, 0x7a, 0xae, 0x23, 0x30, 0x5e, 0x8a, 0x83, 0x15, 0x5b, 0x89, 0x42,
-	0xdb, 0xe7, 0xb6, 0xce, 0xb5, 0x25, 0xe9, 0x2b, 0x62, 0x27, 0x87, 0x19, 0x70, 0xe7, 0xaf, 0x4a,
-	0x50, 0xc1, 0xd4, 0x61, 0x67, 0xb2, 0xfc, 0xd5, 0x6c, 0xe7, 0xd4, 0x72, 0xfd, 0x88, 0xfa, 0x51,
-	0x5c, 0x14, 0x96, 0xd2, 0x7a, 0xac, 0xc8, 0xba, 0x1b, 0xce, 0xe9, 0xae, 0x22, 0x51, 0x57, 0x63,
-	0xb0, 0x13, 0x00, 0x5a, 0x87, 0xeb, 0xea, 0x7a, 0x18, 0x51, 0x22, 0x9a, 0x17, 0x4e, 0x75, 0x0b,
-	0x93, 0x97, 0x2d, 0xcc, 0xb5, 0x04, 0xd9, 0x13, 0x38, 0xd5, 0xcd, 0x3c, 0x00, 0x94, 0xf2, 0xc8,
-	0x24, 0xe2, 0xd2, 0xf8, 0xcc, 0x5b, 0xdd, 0x78, 0x6e, 0xbc, 0xa3, 0x11, 0xb8, 0x95, 0x10, 0xc7,
-	0x20, 0xb4, 0x02, 0x0b, 0x4e, 0x9c, 0x15, 0xa4, 0x2d, 0x69, 0xa6, 0x4a, 0xe0, 0x46, 0x82, 0x13,
-	0xb6, 0xa3, 0x68, 0x05, 0xd0, 0x89, 0xd8, 0xe3, 0xb8, 0x82, 0x25, 0x35, 0xbe, 0x50, 0x98, 0x8c,
-	0x76, 0xf7, 0x60, 0x5e, 0x53, 0x27, 0xaa, 0x95, 0x2f, 0x52, 0xad, 0xa1, 0x28, 0x13, 0xbd, 0x6e,
-	0x41, 0xdd, 0xb3, 0x79, 0x64, 0xd9, 0x41, 0xe0, 0xb9, 0x94, 0xc8, 0xd1, 0x65, 0x1d, 0xd7, 0x04,
-	0x6c, 0x43, 0x81, 0xd0, 0x06, 0xb4, 0x3c, 0xda, 0xb7, 0x9d, 0x51, 0xb6, 0x71, 0xac, 0x5e, 0xd2,
-	0x38, 0x36, 0x15, 0x79, 0xe6, 0xd6, 0xf4, 0x19, 0x88, 0xce, 0xd0, 0x3a, 0xa5, 0xa3, 0x78, 0x12,
-	0xf4, 0xfe, 0xd4, 0x99, 0x3d, 0xb2, 0x5f, 0xfc, 0x92, 0x8e, 0xf4, 0x81, 0x55, 0x06, 0x6a, 0x85,
-	0x6e, 0xc3, 0xb5, 0x28, 0x74, 0xfb, 0x7d, 0x51, 0x19, 0xed, 0xd0, 0x1e, 0x70, 0x65, 0x36, 0x90,
-	0x6a, 0xce, 0x69, 0xd4, 0xbe, 0xc4, 0xb4, 0xef, 0xc3, 0xfc, 0xc4, 0xc1, 0x67, 0x67, 0x19, 0xc6,
-	0x8c, 0x59, 0x46, 0x3d, 0x33, 0xcb, 0x68, 0xdf, 0x83, 0x7a, 0x56, 0x87, 0x6f, 0x9b, 0x83, 0x64,
-	0x79, 0x3b, 0xff, 0x5a, 0x86, 0xca, 0x3e, 0x0d, 0xb9, 0xcb, 0x23, 0x41, 0xe5, 0x33, 0xdf, 0xa1,
-	0x92, 0xb3, 0x88, 0xd5, 0x42, 0x1c, 0xa9, 0x2a, 0x67, 0x56, 0xd6, 0x81, 0x55, 0xa1, 0x6b, 0x2a,
-	0x4c, 0xaa, 0xfc, 0xa4, 0x9f, 0x17, 0x26, 0xfc, 0x5c, 0xbf, 0xea, 0x6a, 0x7e, 0x5e, 0x7c, 0x53,
-	0x3f, 0x2f, 0xbd, 0x81, 0x9f, 0xaf, 0xc1, 0x8d, 0xd4, 0xcf, 0x03, 0x3b, 0x72, 0x4e, 0xa8, 0x3e,
-	0x32, 0x55, 0x45, 0x9b, 0x09, 0x76, 0x5f, 0x21, 0x2f, 0xf0, 0xf5, 0xca, 0x05, 0xbe, 0xfe, 0x29,
-	0xdc, 0xd0, 0x66, 0x9c, 0x74, 0xf9, 0xaa, 0x34, 0xe5, 0x82, 0xc2, 0x7e, 0x35, 0xee, 0xe5, 0x33,
-	0x22, 0xc4, 0xb8, 0x6a, 0x84, 0xc0, 0x6b, 0x46, 0x48, 0xed, 0xca, 0x11, 0x52, 0x9f, 0x88, 0x90,
-	0xf8, 0xb4, 0x67, 0x47, 0xc8, 0x3a, 0x5c, 0xd7, 0x16, 0x19, 0x0f, 0x14, 0x73, 0x4e, 0x1a, 0xe4,
-	0x9a, 0x42, 0x1e, 0x66, 0x23, 0xe5, 0xa2, 0xa8, 0x6a, 0xfc, 0xc0, 0xa2, 0xea, 0x16, 0x18, 0x7a,
-	0xef, 0x94, 0xcc, 0x0e, 0xab, 0xce, 0x5f, 0xe7, 0xa0, 0x24, 0x8e, 0x61, 0x34, 0xb3, 0xce, 0x99,
-	0x50, 0x39, 0x13, 0x02, 0x74, 0x3b, 0x6b, 0xe0, 0x78, 0x29, 0x2e, 0xaf, 0xf2, 0x54, 0x25, 0x8b,
-	0x4a, 0xc2, 0x55, 0x01, 0x90, 0x65, 0x2b, 0x3e, 0xf2, 0x98, 0x57, 0x75, 0x1c, 0xf2, 0xc8, 0x9f,
-	0x69, 0xfe, 0xb5, 0x0b, 0xf2, 0xb9, 0xf2, 0x72, 0x34, 0x9e, 0xcf, 0x45, 0x2f, 0xda, 0x79, 0x0e,
-	0x95, 0xd8, 0x5f, 0xee, 0x02, 0x52, 0xc5, 0x2d, 0xb9, 0x5b, 0xc6, 0x85, 0xdc, 0xc0, 0x2d, 0x85,
-	0xd9, 0x4a, 0x11, 0x97, 0xc4, 0x54, 0x7e, 0x76, 0x4c, 0x75, 0xbe, 0xc9, 0xe9, 0x1b, 0xd4, 0x9b,
-	0x19, 0xe5, 0xa3, 0xf8, 0x9b, 0x57, 0x61, 0xe6, 0x37, 0xaf, 0xf8, 0x6b, 0xd7, 0x07, 0x97, 0xd6,
-	0x32, 0x79, 0x71, 0xa4, 0xe8, 0x27, 0x19, 0x87, 0x2e, 0x49, 0x87, 0x4e, 0xaf, 0xcd, 0xf2, 0xb2,
-	0x36, 0xd3, 0x9b, 0xbf, 0x93, 0xbb, 0x00, 0x54, 0x65, 0xa6, 0x78, 0xcc, 0xce, 0x3b, 0x65, 0x28,
-	0x1e, 0x44, 0x2c, 0xe8, 0x18, 0x50, 0x11, 0x7f, 0x03, 0x4a, 0x3a, 0x7f, 0x00, 0xb5, 0x03, 0xca,
-	0xc5, 0x46, 0xf7, 0x18, 0x0b, 0x2e, 0xb8, 0xe1, 0xe7, 0xae, 0x72, 0xc3, 0xff, 0xdb, 0x1b, 0x50,
-	0xcb, 0xdc, 0xbe, 0xd1, 0xdd, 0x8c, 0xd5, 0x6b, 0xeb, 0xef, 0x74, 0xb3, 0x1f, 0xa7, 0xe3, 0x0b,
-	0xab, 0x34, 0xa8, 0x3a, 0x90, 0x2f, 0x60, 0x4e, 0xfc, 0xb5, 0x42, 0x7d, 0x51, 0x48, 0xc6, 0x0c,
-	0xe3, 0x7c, 0x0a, 0xa9, 0x18, 0xeb, 0x82, 0x21, 0xb9, 0x58, 0x7c, 0x0e, 0xd5, 0x33, 0xdb, 0x73,
-	0x89, 0x1d, 0xc5, 0x47, 0xf7, 0xfe, 0xcc, 0x77, 0x3e, 0xd3, 0x44, 0x38, 0x21, 0x47, 0xf7, 0xc1,
-	0x88, 0x9f, 0xe3, 0x01, 0xd3, 0xe2, 0xec, 0xf7, 0xc6, 0xcc, 0x04, 0xa7, 0x1c, 0xe8, 0x67, 0x50,
-	0xe7, 0xca, 0xa6, 0x96, 0xc7, 0x58, 0x60, 0x2e, 0xe8, 0xa4, 0x17, 0x9b, 0x2f, 0x63, 0x70, 0x5c,
-	0xe3, 0x19, 0xeb, 0xdf, 0x82, 0xe2, 0x73, 0xe6, 0xfa, 0xe6, 0x75, 0xc9, 0x30, 0x37, 0x76, 0xa3,
-	0xc0, 0x12, 0x85, 0x3e, 0x86, 0xf2, 0x73, 0xd9, 0xf7, 0x9a, 0x37, 0xb4, 0x3b, 0x66, 0x89, 0x28,
-	0xc1, 0x1a, 0x2d, 0x64, 0x45, 0x36, 0x3f, 0x35, 0xdf, 0x9e, 0x90, 0x25, 0xda, 0x5f, 0x2c, 0x51,
-	0xe8, 0xb6, 0xe8, 0xd4, 0x65, 0x9f, 0x61, 0x9a, 0xfa, 0xe3, 0xe1, 0x44, 0xff, 0x81, 0x63, 0x02,
-	0xf4, 0x21, 0x94, 0x44, 0xae, 0x1f, 0x99, 0xef, 0x48, 0xca, 0xf4, 0x3b, 0xba, 0xcc, 0x33, 0x58,
-	0x21, 0x85, 0xc4, 0xb8, 0x22, 0xb4, 0x27, 0x24, 0xea, 0x30, 0xc7, 0x31, 0x81, 0x50, 0x50, 0x4e,
-	0x4c, 0xde, 0x9d, 0x50, 0x30, 0x33, 0x22, 0xf9, 0x24, 0x99, 0x32, 0xbe, 0x37, 0x31, 0x25, 0xc9,
-	0x38, 0xd6, 0xe4, 0x7c, 0xf1, 0x2e, 0x14, 0x3d, 0x66, 0x13, 0x73, 0x59, 0xfb, 0xd9, 0x2c, 0x96,
-	0x3d, 0x66, 0x13, 0x2c, 0xc9, 0xc4, 0x3b, 0xc4, 0x5f, 0x4a, 0xcc, 0x1f, 0x5d, 0xf2, 0x8e, 0x3d,
-	0x49, 0x82, 0x35, 0x29, 0x5a, 0x83, 0x92, 0x1c, 0x1c, 0x99, 0xb7, 0x27, 0x22, 0x23, 0xcb, 0x23,
-	0xe7, 0x49, 0x58, 0x11, 0xa2, 0x9f, 0xa6, 0x23, 0xaa, 0x3b, 0x13, 0x23, 0xa2, 0x29, 0x9e, 0xcc,
-	0x5c, 0x4a, 0xbc, 0x89, 0x47, 0x2c, 0xa4, 0xe6, 0xca, 0x25, 0x6f, 0x3a, 0x10, 0x14, 0x58, 0x11,
-	0x8a, 0x0d, 0xc9, 0x07, 0x62, 0xde, 0xbd, 0x64, 0x43, 0x92, 0x45, 0x5c, 0x50, 0xe5, 0x5f, 0xd4,
-	0x9b, 0xf8, 0x48, 0xd4, 0x95, 0xac, 0x4b, 0x17, 0xb0, 0xce, 0xfe, 0x3c, 0x84, 0x76, 0xa1, 0x21,
-	0x97, 0xa2, 0x6b, 0x51, 0x62, 0x56, 0x27, 0x86, 0xb3, 0x53, 0x62, 0x28, 0xd1, 0x82, 0xe6, 0x78,
-	0x76, 0x89, 0x36, 0x65, 0xab, 0xe7, 0xb3, 0x73, 0x8f, 0x92, 0x3e, 0x35, 0xd7, 0x2e, 0x51, 0x67,
-	0x23, 0xa5, 0xc3, 0x59, 0x26, 0xb4, 0x0d, 0xf5, 0xcc, 0x92, 0x98, 0x3f, 0x9e, 0x98, 0x54, 0x5f,
-	0x20, 0x84, 0xe0, 0x31, 0x36, 0xe1, 0xd3, 0x81, 0xaa, 0xb7, 0xe6, 0xfa, 0x84, 0x4f, 0xeb, 0x3a,
-	0x8c, 0x63, 0x02, 0xb4, 0x06, 0x46, 0x10, 0xd7, 0x66, 0xf3, 0x93, 0x89, 0xd1, 0x65, 0x52, 0xb5,
-	0x71, 0x4a, 0x84, 0xba, 0x60, 0xa8, 0x0e, 0xcf, 0x67, 0xe7, 0xe6, 0xa7, 0xba, 0xfd, 0x4a, 0xc6,
-	0x79, 0x3a, 0x71, 0xe3, 0xaa, 0xa3, 0x9f, 0x44, 0xd4, 0xf0, 0x88, 0x05, 0xe6, 0xcf, 0x27, 0xa2,
-	0x46, 0xe4, 0x73, 0x2c, 0x51, 0x42, 0x61, 0xae, 0xb2, 0xbb, 0x79, 0x7f, 0x42, 0x61, 0x9d, 0xf5,
-	0x71, 0x4c, 0xd0, 0xfe, 0xe3, 0x5c, 0x32, 0x0b, 0x7f, 0xf3, 0xb1, 0xeb, 0x97, 0xd9, 0x92, 0x97,
-	0x69, 0xf2, 0xf2, 0x97, 0x34, 0x79, 0xd7, 0x12, 0x8e, 0xcc, 0x04, 0xfd, 0x27, 0x50, 0x14, 0x01,
-	0x86, 0xee, 0x42, 0x35, 0x69, 0x45, 0x73, 0x17, 0xb5, 0xa2, 0x09, 0x49, 0xfb, 0x9b, 0x3c, 0x94,
-	0x55, 0x60, 0xa2, 0x2f, 0xa6, 0x86, 0xa2, 0x1f, 0x5c, 0x12, 0xc7, 0xd3, 0x33, 0x51, 0xd5, 0xba,
-	0xc8, 0xa1, 0x5c, 0x68, 0xa9, 0xef, 0xc3, 0x47, 0xa3, 0x88, 0xaa, 0xbb, 0x48, 0x51, 0xb4, 0x2e,
-	0x0a, 0xf7, 0x54, 0xa0, 0x36, 0x05, 0xa6, 0xfd, 0x3f, 0xb9, 0x74, 0x8a, 0xba, 0x00, 0x25, 0x35,
-	0xd9, 0x51, 0x25, 0x59, 0x2d, 0xd0, 0x32, 0x34, 0x07, 0xae, 0x6f, 0x71, 0x36, 0x0c, 0x9d, 0xf1,
-	0xfb, 0x74, 0x63, 0xe0, 0xfa, 0x07, 0x12, 0xac, 0x1a, 0xf8, 0x65, 0x75, 0xf1, 0x1f, 0xa3, 0x2c,
-	0x68, 0x4a, 0xfb, 0x45, 0x96, 0x72, 0x05, 0x90, 0xa2, 0x22, 0x16, 0x61, 0x0e, 0xb7, 0x22, 0x16,
-	0xd9, 0x9e, 0xac, 0x51, 0x45, 0xdc, 0xd4, 0x98, 0x2d, 0xe6, 0xf0, 0x43, 0x01, 0x47, 0x5d, 0xb8,
-	0x16, 0x53, 0xcb, 0xed, 0x68, 0xf2, 0x92, 0x24, 0x6f, 0x69, 0x94, 0xdc, 0x8e, 0xa2, 0xef, 0xc0,
-	0x9c, 0xee, 0x4f, 0x2c, 0x42, 0xbd, 0x48, 0xff, 0xc4, 0x02, 0xd7, 0x54, 0x23, 0xb2, 0x25, 0x40,
-	0xed, 0xcf, 0xa1, 0x24, 0xb3, 0xd4, 0x25, 0x1d, 0x58, 0x6e, 0x76, 0x07, 0xd6, 0xfe, 0xdf, 0x5c,
-	0x3a, 0x65, 0xbf, 0x6c, 0x8c, 0x3d, 0x23, 0x23, 0xce, 0x3c, 0xb2, 0x37, 0xec, 0x00, 0xdb, 0xa3,
-	0x6f, 0x3b, 0xb1, 0xdb, 0xd0, 0x52, 0x19, 0x3e, 0x6b, 0x5c, 0xe5, 0x02, 0xf3, 0x0a, 0x91, 0xda,
-	0x76, 0x05, 0x90, 0xa6, 0xcd, 0x9a, 0xb6, 0xa0, 0x4e, 0x42, 0x61, 0x52, 0xcb, 0xb6, 0x2b, 0x50,
-	0x92, 0x29, 0xb7, 0xfd, 0x8f, 0x39, 0x28, 0xab, 0xe4, 0xfb, 0xda, 0x4e, 0xab, 0xc8, 0x67, 0x0c,
-	0xf2, 0x5f, 0x67, 0x3f, 0x2a, 0xc1, 0xcf, 0xd8, 0x8f, 0x42, 0x8c, 0xed, 0x47, 0xd3, 0xce, 0xd8,
-	0x8f, 0xc2, 0x64, 0xf6, 0xf3, 0x27, 0xb9, 0xf1, 0xdf, 0x02, 0xbc, 0xb1, 0x33, 0x7c, 0x7f, 0xd9,
-	0x63, 0x03, 0xe6, 0xc6, 0x6a, 0xc9, 0x15, 0x1c, 0xf3, 0x0b, 0xa8, 0x65, 0x2a, 0xc0, 0x15, 0x04,
-	0x3c, 0x80, 0x7a, 0xb6, 0x84, 0xbc, 0xb9, 0x84, 0xdb, 0x77, 0xa0, 0x24, 0x7f, 0x92, 0x88, 0x00,
-	0xca, 0xfb, 0x4f, 0x37, 0xf7, 0x76, 0x7b, 0xcd, 0xb7, 0x50, 0x0d, 0x2a, 0xfb, 0x78, 0xf7, 0xd9,
-	0xc6, 0xe1, 0x76, 0x33, 0x87, 0x0c, 0x28, 0xed, 0x3d, 0xe9, 0x6d, 0xec, 0x35, 0xf3, 0xeb, 0x0f,
-	0xa1, 0xaa, 0x7f, 0x32, 0x16, 0xa2, 0x5f, 0x40, 0x45, 0x3f, 0xa3, 0xb7, 0xd3, 0x44, 0x3f, 0xf6,
-	0x63, 0xc6, 0xb6, 0x39, 0x8d, 0x50, 0x0d, 0xec, 0x5a, 0x6e, 0x7d, 0x0f, 0xaa, 0xfa, 0x73, 0x44,
-	0x88, 0x1e, 0x40, 0x45, 0x3f, 0x67, 0x64, 0x8d, 0x7f, 0x54, 0xca, 0xc8, 0x9a, 0xf8, 0x8a, 0xb1,
-	0x9c, 0x5b, 0xcb, 0xad, 0x9f, 0x40, 0x63, 0x7c, 0xd0, 0x8f, 0x9e, 0xc1, 0xbc, 0x7c, 0x48, 0xc0,
-	0x1c, 0xdd, 0xcc, 0xd6, 0x95, 0xe9, 0xcf, 0x05, 0xed, 0xc5, 0x0b, 0xf1, 0x99, 0x37, 0x7d, 0x09,
-	0xe5, 0x3d, 0xf5, 0xcb, 0xb6, 0xfb, 0xe3, 0x17, 0x8d, 0x85, 0x59, 0x41, 0xd4, 0x9e, 0x09, 0x95,
-	0x82, 0x76, 0xe2, 0xc9, 0xf7, 0x77, 0x93, 0xb3, 0xf9, 0x8b, 0xaf, 0xff, 0xe3, 0xe6, 0x5b, 0x5f,
-	0xff, 0xf6, 0x66, 0xee, 0x9f, 0x7f, 0x7b, 0x33, 0xf7, 0x97, 0xff, 0x79, 0x33, 0xf7, 0x47, 0x2b,
-	0xaf, 0xf5, 0xb3, 0x34, 0x2d, 0xef, 0xa8, 0x2c, 0x41, 0x9f, 0xfc, 0x2e, 0x00, 0x00, 0xff, 0xff,
-	0xe4, 0x09, 0x98, 0xc9, 0x7f, 0x2c, 0x00, 0x00,
+	// 3794 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xcc, 0x3a, 0x3b, 0x70, 0x1c, 0x47,
+	0x76, 0xda, 0xff, 0xee, 0xdb, 0xc5, 0x62, 0xb7, 0x09, 0x92, 0xc3, 0x95, 0x44, 0x40, 0x2b, 0xc9,
+	0xc2, 0x91, 0xe0, 0x02, 0x07, 0xe9, 0xee, 0x24, 0xd6, 0xf1, 0x44, 0x60, 0x01, 0x48, 0xe0, 0x81,
+	0x24, 0xdc, 0x00, 0x59, 0xb6, 0x93, 0xa9, 0xc1, 0x74, 0x63, 0x31, 0xc4, 0xec, 0xf4, 0x68, 0x7a,
+	0x16, 0xc0, 0x5e, 0xea, 0xc4, 0x55, 0x0e, 0x9c, 0x38, 0x73, 0x62, 0x47, 0xae, 0x72, 0x95, 0x03,
+	0xa7, 0x17, 0x38, 0x72, 0xa0, 0x72, 0xe4, 0x72, 0xe0, 0xb2, 0x13, 0x56, 0xf9, 0x9c, 0x3a, 0x93,
+	0x5d, 0x65, 0xb3, 0x1c, 0xb8, 0xfa, 0x33, 0x9f, 0xfd, 0x41, 0x24, 0xa8, 0x40, 0x01, 0x89, 0xee,
+	0xf7, 0xeb, 0xd7, 0xdd, 0xef, 0xd7, 0x6f, 0x16, 0xda, 0x3d, 0xb6, 0xea, 0x07, 0x2c, 0x64, 0x36,
+	0x73, 0xf9, 0x6a, 0x30, 0xf0, 0x42, 0xa7, 0x4f, 0xa3, 0xbf, 0x1d, 0x89, 0x41, 0x25, 0x3d, 0x6d,
+	0xdd, 0x3e, 0x0a, 0xd8, 0x29, 0x0d, 0x62, 0x86, 0x78, 0xa0, 0x08, 0x5b, 0x4b, 0x36, 0xf3, 0xf8,
+	0xa0, 0x7f, 0x19, 0xc5, 0xc8, 0x72, 0x84, 0x06, 0xce, 0x19, 0xd5, 0x7f, 0x34, 0xc5, 0x7b, 0x23,
+	0x14, 0xc7, 0x2e, 0x3b, 0x97, 0xff, 0x69, 0xec, 0x9d, 0x11, 0x6c, 0xdf, 0x0a, 0x69, 0xe0, 0x58,
+	0xae, 0xf3, 0x1b, 0x9a, 0x1e, 0x6b, 0xda, 0xd6, 0x08, 0x2d, 0xf3, 0xe5, 0x3f, 0x8d, 0x1b, 0xdd,
+	0x36, 0x3f, 0x19, 0x1c, 0x1f, 0xbb, 0x34, 0xfa, 0xab, 0x69, 0x16, 0x7a, 0xac, 0xc7, 0xe4, 0x70,
+	0x55, 0x8c, 0x14, 0xb4, 0xfd, 0xf7, 0x19, 0x68, 0x1e, 0x5a, 0xfc, 0xf4, 0x80, 0x06, 0x67, 0x8e,
+	0x4d, 0xbb, 0xcc, 0x3b, 0x76, 0x7a, 0xe8, 0x36, 0x54, 0x5d, 0xd6, 0x33, 0x8f, 0x1d, 0x97, 0x9a,
+	0xc7, 0xc4, 0xc8, 0x2c, 0x65, 0x96, 0x0b, 0xb8, 0xe2, 0xb2, 0xde, 0x8e, 0xe3, 0xd2, 0x1d, 0x82,
+	0xde, 0x85, 0x4a, 0x68, 0xf1, 0x53, 0xd3, 0xb3, 0xfa, 0xd4, 0xc8, 0x2e, 0x65, 0x96, 0x2b, 0xb8,
+	0x2c, 0x00, 0x4f, 0xac, 0x3e, 0x45, 0xb7, 0xa0, 0x3c, 0x20, 0xdc, 0xf4, 0xad, 0xf0, 0xc4, 0xc8,
+	0x49, 0x5c, 0x69, 0x40, 0xf8, 0xbe, 0x15, 0x9e, 0xa0, 0xbb, 0xd0, 0xb4, 0x99, 0x17, 0x5a, 0x8e,
+	0x47, 0x03, 0xd3, 0xa3, 0xe1, 0x39, 0x0b, 0x4e, 0x8d, 0xbc, 0xa4, 0x69, 0xc4, 0x88, 0x27, 0x0a,
+	0x8e, 0x3e, 0x82, 0x82, 0xef, 0x5a, 0x1e, 0x35, 0x8a, 0x4b, 0x99, 0xe5, 0xfa, 0x7a, 0xbd, 0x13,
+	0x5d, 0xe3, 0xbe, 0x80, 0x62, 0x85, 0x6c, 0xff, 0x6f, 0x1e, 0xea, 0x07, 0x6a, 0xa3, 0x98, 0x7e,
+	0x33, 0xa0, 0x3c, 0x44, 0xbb, 0x50, 0x7a, 0xc1, 0x06, 0x81, 0x67, 0xb9, 0x52, 0xf3, 0xca, 0xe6,
+	0xea, 0xab, 0x97, 0x8b, 0x77, 0x7b, 0xac, 0xd3, 0xb3, 0x7e, 0x43, 0xc3, 0x90, 0x76, 0x08, 0x3d,
+	0x5b, 0xb5, 0x59, 0x40, 0x57, 0xc7, 0x0c, 0xa0, 0xf3, 0x48, 0xb1, 0xe1, 0x88, 0x1f, 0xdd, 0x80,
+	0x62, 0x40, 0x7d, 0xd7, 0x1a, 0xca, 0x5d, 0x96, 0xb1, 0x9e, 0x89, 0x3d, 0x1e, 0x0d, 0x1c, 0x97,
+	0x98, 0x0e, 0x89, 0xf6, 0x28, 0xe7, 0xbb, 0x04, 0xed, 0x40, 0x91, 0x1d, 0x1f, 0x73, 0x1a, 0xca,
+	0x8d, 0xe5, 0x36, 0x3b, 0xaf, 0x5e, 0x2e, 0xde, 0x79, 0x9d, 0xc5, 0x9f, 0x4a, 0x2e, 0xac, 0xb9,
+	0xd1, 0x63, 0x00, 0xea, 0x11, 0x53, 0xcb, 0x2a, 0x5c, 0x49, 0x56, 0x85, 0x7a, 0x44, 0x0d, 0xd1,
+	0x5d, 0x28, 0x04, 0x96, 0xd7, 0x53, 0xa7, 0x59, 0x5d, 0x9f, 0xef, 0x48, 0x33, 0xc4, 0x02, 0x74,
+	0xe0, 0x53, 0x7b, 0x33, 0xff, 0xed, 0xcb, 0xc5, 0x77, 0xb0, 0xa2, 0x41, 0x07, 0x50, 0xb5, 0x19,
+	0x0b, 0x88, 0xe3, 0x59, 0x21, 0x0b, 0x8c, 0x92, 0x3c, 0xc5, 0x9f, 0xbe, 0x7a, 0xb9, 0x78, 0x6f,
+	0xda, 0xe2, 0x13, 0x6e, 0xd2, 0x39, 0x38, 0xb1, 0x02, 0xb2, 0xbb, 0x85, 0xd3, 0x52, 0xd0, 0x1a,
+	0x40, 0x40, 0x39, 0x73, 0x07, 0xa1, 0xc3, 0x3c, 0xa3, 0x2c, 0xd5, 0x68, 0x74, 0x62, 0x9e, 0xaf,
+	0xa9, 0x45, 0x68, 0x80, 0x53, 0x34, 0xe8, 0x43, 0x98, 0xd3, 0x36, 0x6c, 0x3a, 0x1e, 0xa1, 0x17,
+	0x46, 0x65, 0x29, 0xb3, 0x3c, 0x87, 0x6b, 0x1a, 0xb8, 0x2b, 0x60, 0xe8, 0x33, 0x00, 0xe9, 0x71,
+	0x96, 0x14, 0x0b, 0x52, 0xec, 0x82, 0xda, 0x5d, 0x97, 0xb9, 0x2e, 0xb5, 0x05, 0x5c, 0x6c, 0x11,
+	0xa7, 0xe8, 0x50, 0x17, 0xe6, 0x13, 0x17, 0x53, 0xac, 0x55, 0xc9, 0x7a, 0x4b, 0xb1, 0x3e, 0x1e,
+	0x45, 0x4a, 0xfe, 0x71, 0x8e, 0xf6, 0x3f, 0xe7, 0x61, 0x3e, 0xb6, 0x3d, 0xee, 0x33, 0x8f, 0x53,
+	0xb4, 0x0c, 0x45, 0x1e, 0x5a, 0xe1, 0x80, 0x4b, 0xdb, 0xab, 0xaf, 0x37, 0x3a, 0xd1, 0xf1, 0x74,
+	0x0e, 0x24, 0x1c, 0x6b, 0xbc, 0xa0, 0x3c, 0x91, 0x7b, 0x96, 0xb6, 0x35, 0xed, 0x2c, 0x34, 0x1e,
+	0x7d, 0x0c, 0xf5, 0x90, 0x06, 0x7d, 0xc7, 0xb3, 0x5c, 0x93, 0x06, 0x01, 0x0b, 0xb4, 0xcd, 0xcd,
+	0x45, 0xd0, 0x6d, 0x01, 0x44, 0xbf, 0x0f, 0xb5, 0x80, 0x5a, 0xc4, 0x0c, 0x4f, 0x02, 0x36, 0xe8,
+	0x9d, 0x5c, 0xd1, 0xfe, 0xaa, 0x42, 0xc6, 0xa1, 0x12, 0x21, 0x8c, 0xf0, 0x3c, 0x70, 0x42, 0x6a,
+	0x0a, 0x4d, 0xae, 0x6a, 0x84, 0x52, 0x82, 0xd8, 0x12, 0xda, 0x85, 0x82, 0x15, 0x50, 0xcf, 0x92,
+	0x46, 0x58, 0xdb, 0xfc, 0xf4, 0xd5, 0xcb, 0xc5, 0xd5, 0x9e, 0x13, 0x9e, 0x0c, 0x8e, 0x3a, 0x36,
+	0xeb, 0xaf, 0x52, 0x1e, 0x0e, 0xac, 0x60, 0xa8, 0xc2, 0xe4, 0x44, 0xe0, 0xec, 0x6c, 0x08, 0x56,
+	0xac, 0x24, 0xa0, 0x8f, 0x21, 0x4f, 0x98, 0xcd, 0x8d, 0xd2, 0x52, 0x6e, 0xb9, 0xba, 0x5e, 0x55,
+	0xb7, 0x76, 0xe0, 0x3a, 0x36, 0xd5, 0xa6, 0x2c, 0xd1, 0xe8, 0x6b, 0x28, 0x29, 0x0f, 0xe2, 0x46,
+	0x79, 0x29, 0x77, 0x05, 0xed, 0x23, 0x76, 0x61, 0x67, 0x83, 0x81, 0x43, 0x4c, 0xdf, 0x0a, 0x42,
+	0x6e, 0x54, 0xe4, 0xb2, 0xda, 0x8b, 0x9e, 0x3d, 0xdb, 0xdd, 0xda, 0x17, 0x60, 0xbd, 0x74, 0x45,
+	0x10, 0x4a, 0x80, 0x30, 0x7a, 0xdf, 0xb2, 0x4f, 0x29, 0x31, 0x4f, 0xe9, 0xd0, 0x80, 0x59, 0xca,
+	0x56, 0x14, 0xd1, 0xaf, 0xe9, 0xb0, 0x4d, 0xa0, 0x89, 0x99, 0x7d, 0xca, 0xb7, 0x36, 0xb7, 0x28,
+	0xb7, 0x03, 0xc7, 0x17, 0xbe, 0xb3, 0x02, 0x28, 0x10, 0x40, 0x72, 0x64, 0x52, 0xef, 0xcc, 0xec,
+	0xd3, 0xbe, 0x1f, 0x06, 0xd2, 0xc2, 0x8a, 0xb8, 0xa1, 0x31, 0xdb, 0xde, 0xd9, 0x63, 0x09, 0x47,
+	0x1f, 0x40, 0x2d, 0xa2, 0x96, 0x51, 0x58, 0x45, 0xe8, 0xaa, 0x86, 0x89, 0x48, 0xdc, 0xfe, 0xf3,
+	0x2c, 0x54, 0xba, 0x51, 0xc4, 0x45, 0x37, 0xa1, 0xe4, 0xf8, 0xa6, 0x45, 0x88, 0x92, 0x59, 0xc1,
+	0x45, 0xc7, 0xdf, 0x20, 0x24, 0x40, 0x3f, 0x87, 0x39, 0x1d, 0xa6, 0x4d, 0x9f, 0x89, 0x7d, 0x67,
+	0xe5, 0x0e, 0x9a, 0x6a, 0x07, 0x3a, 0x52, 0xef, 0xb3, 0x20, 0xc4, 0x35, 0x2f, 0x99, 0x70, 0x74,
+	0x00, 0xcd, 0xbe, 0xe5, 0xfb, 0x94, 0x98, 0x27, 0x8c, 0x87, 0x9a, 0x37, 0x27, 0x79, 0x3f, 0x89,
+	0xe3, 0x78, 0xbc, 0x7e, 0xe7, 0xb1, 0xa4, 0xfd, 0x9a, 0xf1, 0x50, 0xb2, 0x6f, 0x7b, 0x61, 0x30,
+	0x14, 0xee, 0x36, 0x02, 0x45, 0xef, 0x03, 0x0c, 0xb8, 0xd5, 0xa3, 0x66, 0x60, 0x85, 0x54, 0x5a,
+	0x77, 0x16, 0x57, 0x24, 0x04, 0x5b, 0x21, 0x6d, 0x6d, 0xc2, 0xc2, 0x34, 0x39, 0xa8, 0x01, 0x39,
+	0x71, 0xf6, 0x19, 0x19, 0x3b, 0xc4, 0x10, 0x2d, 0x40, 0xe1, 0xcc, 0x72, 0x07, 0x51, 0xea, 0x52,
+	0x93, 0xfb, 0xd9, 0xcf, 0x33, 0xed, 0xbf, 0xc9, 0x42, 0xb3, 0x6b, 0xf9, 0xe1, 0x20, 0x88, 0xb2,
+	0xc9, 0xf6, 0x85, 0x88, 0x9d, 0x22, 0xf7, 0x99, 0x2e, 0x3d, 0xa3, 0xae, 0x76, 0xeb, 0x7a, 0x47,
+	0x64, 0xdf, 0x3d, 0xd6, 0xeb, 0xec, 0x09, 0x28, 0x2e, 0xbb, 0xac, 0x27, 0x47, 0x68, 0x37, 0xb9,
+	0x2a, 0x12, 0x5f, 0xa0, 0x76, 0xf1, 0x56, 0xbc, 0xf7, 0x89, 0x2b, 0xc6, 0x4d, 0xcd, 0x95, 0xba,
+	0xf5, 0x5d, 0xa8, 0xf1, 0xd0, 0x0a, 0x42, 0xd3, 0x66, 0xfd, 0xbe, 0x13, 0x4a, 0xaf, 0xaf, 0xae,
+	0xff, 0x5e, 0x72, 0x80, 0xe3, 0x9a, 0x8a, 0x10, 0x13, 0x84, 0x5d, 0x49, 0x8d, 0xab, 0x3c, 0x99,
+	0xb4, 0x30, 0x54, 0x53, 0x38, 0xd4, 0x05, 0xa4, 0x85, 0x98, 0xf6, 0x09, 0xb5, 0x4f, 0x7d, 0xe6,
+	0x78, 0xa1, 0xdc, 0x9a, 0x08, 0x9e, 0x71, 0xc4, 0xea, 0xc6, 0x38, 0xdc, 0xd4, 0xf4, 0x09, 0xa8,
+	0xfd, 0x7f, 0x79, 0x40, 0xb1, 0x0a, 0x2a, 0xfc, 0x89, 0xd3, 0x5a, 0x83, 0x4a, 0x9c, 0xcb, 0xb5,
+	0x48, 0x34, 0x79, 0xe7, 0x38, 0x21, 0x42, 0xf7, 0xa1, 0xc8, 0x7c, 0xea, 0x51, 0xa2, 0x8f, 0xa9,
+	0x3d, 0xb9, 0xc3, 0x58, 0x7c, 0xe7, 0xa9, 0xa4, 0xc4, 0x9a, 0x03, 0x3d, 0x84, 0xb2, 0xad, 0x88,
+	0x88, 0x3e, 0x9f, 0x8f, 0x2e, 0xe3, 0xd6, 0x20, 0x82, 0x63, 0x2e, 0xb4, 0x03, 0x90, 0x3a, 0x83,
+	0xfc, 0xac, 0x33, 0x4e, 0xc9, 0x48, 0x4e, 0x25, 0xc5, 0xd9, 0x7a, 0x0c, 0x45, 0xa5, 0xdb, 0x0f,
+	0x72, 0xba, 0xad, 0xe7, 0x50, 0x8e, 0x94, 0x15, 0x96, 0x7f, 0x4a, 0x87, 0xa6, 0x0a, 0x12, 0x52,
+	0x50, 0x0d, 0x57, 0x4e, 0xe9, 0x70, 0x5f, 0x02, 0x44, 0x59, 0x25, 0xa2, 0x92, 0x23, 0x92, 0x12,
+	0x8f, 0xa8, 0xb2, 0x92, 0xaa, 0x91, 0x20, 0x14, 0x71, 0xeb, 0x1c, 0x20, 0x59, 0x05, 0x2d, 0x41,
+	0x41, 0xa4, 0x23, 0xae, 0xb5, 0x03, 0x69, 0xd6, 0x22, 0x51, 0x71, 0xac, 0x10, 0xe8, 0x2b, 0xa8,
+	0xfa, 0xcc, 0x75, 0xcd, 0x80, 0xf2, 0x81, 0x1b, 0x4a, 0xb1, 0xf5, 0xcb, 0xcf, 0x67, 0x9f, 0xb9,
+	0x2e, 0x96, 0xd4, 0x18, 0xfc, 0x78, 0xdc, 0x7e, 0x02, 0x90, 0x60, 0x50, 0x15, 0x4a, 0xbb, 0x4f,
+	0x9e, 0x6f, 0xec, 0xed, 0x6e, 0x35, 0xde, 0x41, 0x15, 0x28, 0xe0, 0xed, 0x8d, 0xad, 0x3f, 0x6c,
+	0x64, 0xd0, 0x1c, 0x54, 0x9e, 0x3c, 0x3d, 0x34, 0xd5, 0x34, 0x8b, 0x6a, 0x50, 0xee, 0x3e, 0x7d,
+	0xba, 0x67, 0x3e, 0xdd, 0xd9, 0x69, 0xe4, 0x04, 0x13, 0xde, 0x3e, 0x38, 0xdc, 0xc0, 0x87, 0x8d,
+	0x7c, 0xfb, 0x3f, 0x33, 0xd0, 0xd8, 0x92, 0xb5, 0xf6, 0x8f, 0xc0, 0x55, 0xd7, 0x21, 0x2f, 0x0c,
+	0x52, 0x9b, 0xe0, 0xed, 0x98, 0x79, 0x5c, 0x41, 0x69, 0xbe, 0x58, 0xd2, 0xb6, 0x56, 0x20, 0x2f,
+	0x66, 0xe8, 0x23, 0xa8, 0xf3, 0x6f, 0x5c, 0x91, 0x65, 0xcf, 0x8e, 0xb9, 0x39, 0x08, 0x1c, 0x1d,
+	0x84, 0x6b, 0x0a, 0xfa, 0xfc, 0x98, 0x3f, 0x0b, 0x9c, 0xf6, 0x7f, 0xe5, 0xa0, 0x19, 0x49, 0x7b,
+	0x1b, 0x67, 0xfb, 0x62, 0xcc, 0xd9, 0x3e, 0x98, 0xd0, 0x75, 0xa6, 0xaf, 0x6d, 0x42, 0xc5, 0x1f,
+	0x1c, 0xb9, 0x0e, 0x3f, 0x99, 0xe2, 0x6c, 0x93, 0xdc, 0xfb, 0x11, 0x2d, 0x4e, 0xd8, 0xd0, 0x2f,
+	0xa1, 0x74, 0xec, 0x0e, 0xa4, 0x84, 0xfc, 0x98, 0xb3, 0x4f, 0x4a, 0xd8, 0x51, 0x94, 0x38, 0x62,
+	0xf9, 0xa1, 0x7d, 0x2c, 0x84, 0x4a, 0xac, 0xa4, 0x78, 0xd4, 0xf4, 0xad, 0x0b, 0xd3, 0x76, 0x99,
+	0x7d, 0xaa, 0x53, 0x6b, 0xb9, 0x6f, 0x5d, 0x74, 0xc5, 0x7c, 0xcc, 0x03, 0xb3, 0xaf, 0xe5, 0x81,
+	0xb9, 0x19, 0x1e, 0x78, 0x17, 0x4a, 0x7a, 0x63, 0xdf, 0xef, 0x7e, 0xed, 0x3f, 0xcb, 0xc0, 0xf5,
+	0xa4, 0x18, 0xfd, 0x11, 0x98, 0x7a, 0xfb, 0xb7, 0x19, 0xb8, 0x31, 0xa2, 0xd1, 0xdb, 0x58, 0xe3,
+	0x46, 0x62, 0x0e, 0x4a, 0x99, 0xa4, 0x3c, 0x98, 0xbe, 0xc6, 0xa4, 0x4d, 0xbc, 0xd1, 0x71, 0xfe,
+	0x36, 0x0f, 0xf5, 0x2e, 0xeb, 0x1f, 0x39, 0x5e, 0xfc, 0x5c, 0x5c, 0xd3, 0xae, 0xab, 0x78, 0xde,
+	0x4b, 0xe9, 0x9b, 0x26, 0x4b, 0x39, 0x2e, 0xba, 0x07, 0x39, 0x8b, 0x44, 0x0a, 0xbf, 0x3b, 0x8b,
+	0x61, 0x83, 0x10, 0x2c, 0xe8, 0x5a, 0xff, 0x92, 0xd5, 0x8e, 0xfe, 0x10, 0xca, 0x47, 0x8e, 0x47,
+	0x1c, 0xaf, 0x27, 0x34, 0xcc, 0x8d, 0xe6, 0xaa, 0xc9, 0xd5, 0x3a, 0x9b, 0x8a, 0x18, 0xc7, 0x5c,
+	0xad, 0x3f, 0xcd, 0x42, 0x49, 0x43, 0x11, 0x82, 0xfc, 0xf1, 0xc0, 0x55, 0x57, 0x5f, 0xc6, 0x72,
+	0x1c, 0xd5, 0x3a, 0xa2, 0x4a, 0xab, 0xa8, 0x5a, 0xe7, 0x73, 0xa8, 0xfa, 0x01, 0x7b, 0xa1, 0x9e,
+	0x41, 0x51, 0x0d, 0xd6, 0x50, 0xf5, 0xdb, 0x7e, 0x8c, 0xd0, 0x65, 0x68, 0x9a, 0x14, 0x3d, 0x80,
+	0x2a, 0xb7, 0x4f, 0x68, 0xdf, 0x32, 0x5f, 0x70, 0xe6, 0x49, 0x6f, 0xad, 0x6d, 0xbe, 0xf7, 0xea,
+	0xe5, 0xa2, 0x41, 0x3d, 0x9b, 0x09, 0x15, 0x56, 0x05, 0xa2, 0x83, 0xad, 0xf3, 0xc7, 0x94, 0xcb,
+	0x32, 0x0c, 0x14, 0xc3, 0x23, 0xce, 0x3c, 0xd4, 0x01, 0xe0, 0x34, 0x30, 0x7d, 0xe6, 0x3a, 0xf6,
+	0x50, 0x3e, 0x1d, 0xe2, 0x7a, 0xf9, 0x80, 0x06, 0xfb, 0x12, 0x8c, 0x2b, 0x3c, 0x1a, 0xca, 0xb6,
+	0x81, 0xac, 0xaf, 0xc3, 0x40, 0x3e, 0x0f, 0x2a, 0xb8, 0x24, 0xcb, 0xe8, 0x30, 0x10, 0xaf, 0x70,
+	0x59, 0xa2, 0xa9, 0x6a, 0xbf, 0x82, 0xf5, 0xac, 0xe5, 0x41, 0x6e, 0x83, 0x10, 0x64, 0x40, 0x49,
+	0x1f, 0x90, 0x2e, 0xf2, 0xa2, 0x29, 0xfa, 0x05, 0x94, 0x09, 0xb3, 0x95, 0xfe, 0xd9, 0xd7, 0xd0,
+	0xbf, 0x44, 0x98, 0x2d, 0x95, 0x5f, 0x80, 0xc2, 0x71, 0xc0, 0x3c, 0x55, 0x72, 0x95, 0xb1, 0x9a,
+	0xb4, 0xff, 0x35, 0x03, 0xf3, 0xf1, 0x3d, 0xe9, 0xf7, 0xde, 0xec, 0xc5, 0x0d, 0x28, 0x11, 0xea,
+	0xd2, 0x50, 0x9b, 0x76, 0x19, 0x47, 0xd3, 0x11, 0xb5, 0x72, 0x57, 0x52, 0x2b, 0x9f, 0x52, 0x6b,
+	0x2c, 0x36, 0x15, 0xc6, 0x63, 0xd3, 0x87, 0x30, 0xa7, 0xce, 0x2b, 0xa2, 0x90, 0x8f, 0x2f, 0x5c,
+	0x53, 0x40, 0x45, 0xd4, 0xbe, 0x09, 0xd7, 0xbb, 0xcc, 0xf3, 0xa8, 0x1d, 0xb2, 0x60, 0x3f, 0x60,
+	0x17, 0x43, 0x6d, 0x88, 0xed, 0xbf, 0xc8, 0xc0, 0x8d, 0x71, 0x8c, 0xde, 0xfa, 0x23, 0x28, 0x89,
+	0x27, 0x03, 0xe5, 0x5c, 0xf7, 0x59, 0xd6, 0x5e, 0xbd, 0x5c, 0x5c, 0x79, 0x9d, 0xb7, 0xd5, 0xb6,
+	0x47, 0x54, 0x4c, 0x8e, 0x04, 0x88, 0xdb, 0xf7, 0x85, 0x70, 0xd3, 0x21, 0xba, 0x2a, 0x2f, 0xc9,
+	0xf9, 0x2e, 0x41, 0x2d, 0xc8, 0xb9, 0xac, 0xa7, 0xf3, 0x4d, 0x39, 0x8a, 0x70, 0x58, 0x00, 0xdb,
+	0x7f, 0x97, 0x83, 0xfc, 0x23, 0xe6, 0x78, 0xe8, 0x0e, 0x34, 0x69, 0x68, 0x13, 0xb3, 0xcf, 0x88,
+	0x19, 0xd0, 0x33, 0x87, 0x8b, 0x17, 0xbd, 0xd0, 0x2a, 0x87, 0xe7, 0x05, 0xe2, 0x31, 0x23, 0x58,
+	0x83, 0xd1, 0x5d, 0x28, 0xf2, 0x13, 0x2b, 0x20, 0xd1, 0x6b, 0xe6, 0x5a, 0xec, 0x84, 0x42, 0x94,
+	0x6a, 0x5e, 0x60, 0x4d, 0x82, 0x16, 0xa1, 0x2a, 0x47, 0xba, 0x03, 0x91, 0x93, 0x77, 0x0c, 0x12,
+	0xa4, 0xfa, 0x0f, 0x77, 0xa1, 0x19, 0x35, 0x29, 0x88, 0x13, 0xc8, 0x63, 0x1a, 0x46, 0x3d, 0x2d,
+	0x8d, 0xd8, 0x8a, 0xe0, 0xe8, 0x27, 0x10, 0xc1, 0x4c, 0xaa, 0xcf, 0x40, 0x5e, 0x58, 0x05, 0xcf,
+	0x6b, 0x78, 0x74, 0x34, 0xe8, 0x13, 0x98, 0x77, 0xe5, 0xf3, 0x3f, 0xa1, 0x54, 0x6e, 0x51, 0x57,
+	0xe0, 0x88, 0xb0, 0xf5, 0xb7, 0x19, 0x28, 0x48, 0x9d, 0x51, 0x1d, 0xb2, 0x0e, 0xd1, 0xc5, 0x43,
+	0xd6, 0x21, 0xa8, 0x03, 0x65, 0xd7, 0x3a, 0xa2, 0xae, 0x30, 0xce, 0xac, 0x8e, 0xc6, 0x32, 0x22,
+	0x0a, 0xea, 0x3d, 0x8d, 0xc1, 0x31, 0x0d, 0x5a, 0x87, 0x52, 0x40, 0x2d, 0xa1, 0xa9, 0x3e, 0x6d,
+	0x23, 0x69, 0x49, 0xec, 0x07, 0xcc, 0xa6, 0x9c, 0x1f, 0xf8, 0xd4, 0xee, 0xec, 0x6e, 0xe1, 0x88,
+	0x10, 0xad, 0xc1, 0x82, 0x3c, 0x78, 0x3b, 0xa0, 0x56, 0x48, 0x93, 0xb3, 0x97, 0xcd, 0x07, 0x8c,
+	0x04, 0xae, 0x2b, 0x51, 0xd1, 0xf1, 0xb7, 0x3f, 0x83, 0xa2, 0x38, 0x67, 0x4a, 0xc4, 0xa5, 0x89,
+	0x8c, 0x2b, 0xf9, 0xc7, 0x2f, 0xad, 0x6f, 0x5d, 0x6c, 0x87, 0x76, 0x7c, 0x69, 0x6d, 0x13, 0xf2,
+	0x87, 0x16, 0x3f, 0x15, 0x51, 0x8f, 0xfb, 0xd4, 0xd6, 0x45, 0xb0, 0x1c, 0x0b, 0x4f, 0xf3, 0x05,
+	0x3f, 0x3d, 0x8f, 0x3c, 0x4d, 0x4f, 0xc5, 0x79, 0x8b, 0x15, 0xc2, 0xc0, 0xf2, 0xb8, 0x15, 0x87,
+	0x40, 0x71, 0x85, 0x62, 0x81, 0xc3, 0x14, 0xb8, 0xfd, 0x57, 0x05, 0x28, 0x61, 0x6a, 0xb3, 0x33,
+	0x99, 0x95, 0xaa, 0x96, 0x7d, 0x6a, 0x3a, 0x5e, 0x48, 0xbd, 0x30, 0x8a, 0xd5, 0x4b, 0x49, 0x9a,
+	0x54, 0x64, 0x9d, 0x0d, 0xfb, 0x74, 0x57, 0x91, 0xa8, 0x17, 0x2b, 0x58, 0x31, 0x00, 0xad, 0xc3,
+	0x75, 0xf5, 0x6a, 0x0b, 0x29, 0x11, 0x35, 0x05, 0xa7, 0xba, 0xb2, 0xc8, 0xca, 0xca, 0xe2, 0x5a,
+	0x8c, 0xec, 0x0a, 0x9c, 0x2a, 0x32, 0x1e, 0x02, 0x4a, 0x78, 0xa4, 0x6f, 0x3b, 0x34, 0xba, 0x8a,
+	0x66, 0x27, 0x6a, 0xe7, 0xee, 0x68, 0x04, 0x6e, 0xc6, 0xc4, 0x11, 0x08, 0xad, 0xc0, 0x82, 0x1d,
+	0x39, 0xab, 0x29, 0x32, 0x1e, 0x4d, 0x05, 0x6f, 0x5c, 0x8f, 0x71, 0x22, 0x27, 0x52, 0xb4, 0x02,
+	0xe8, 0x44, 0xec, 0x71, 0x54, 0xc1, 0x82, 0xea, 0x2a, 0x28, 0x4c, 0x4a, 0xbb, 0xfb, 0x30, 0xaf,
+	0xa9, 0x63, 0xd5, 0x8a, 0xb3, 0x54, 0xab, 0x2b, 0xca, 0x58, 0xaf, 0x0f, 0xa0, 0xe6, 0x5a, 0x3c,
+	0x34, 0x2d, 0xdf, 0x77, 0x1d, 0x4a, 0x64, 0x47, 0xb1, 0x86, 0xab, 0x02, 0xb6, 0xa1, 0x40, 0x68,
+	0x03, 0x9a, 0x2e, 0xed, 0x59, 0xf6, 0x30, 0x5d, 0xcf, 0x95, 0x2f, 0xa9, 0xe7, 0x1a, 0x8a, 0x3c,
+	0xf5, 0x98, 0xf9, 0x1c, 0x44, 0xc1, 0x66, 0x9e, 0xd2, 0x61, 0xd4, 0xa0, 0x79, 0x7f, 0xe2, 0xce,
+	0x1e, 0x5b, 0x17, 0xbf, 0xa6, 0x43, 0x7d, 0x61, 0xa5, 0xbe, 0x9a, 0xa1, 0x3b, 0x70, 0x2d, 0x0c,
+	0x9c, 0x5e, 0x4f, 0x24, 0x2c, 0x2b, 0xb0, 0xfa, 0x5c, 0x1d, 0x1b, 0x48, 0x35, 0xe7, 0x34, 0x6a,
+	0x5f, 0x62, 0x5a, 0x0f, 0x60, 0x7e, 0xec, 0xe2, 0xd3, 0x2d, 0x86, 0xca, 0x94, 0x16, 0x43, 0x2d,
+	0xd5, 0x62, 0x68, 0xdd, 0x87, 0x5a, 0x5a, 0x87, 0xef, 0x6b, 0x4f, 0xa4, 0x79, 0xdb, 0xff, 0x58,
+	0x82, 0xd2, 0x3e, 0x0d, 0xb8, 0xc3, 0x43, 0x74, 0x1d, 0x8a, 0x9c, 0x7e, 0x63, 0x7a, 0x4c, 0xb2,
+	0xe6, 0x71, 0x81, 0xd3, 0x6f, 0x9e, 0x30, 0x71, 0xa7, 0x2a, 0xcd, 0x98, 0x69, 0x0b, 0x56, 0x6e,
+	0xd1, 0x50, 0x98, 0x44, 0xfb, 0x71, 0x43, 0xcf, 0x8d, 0x19, 0xba, 0x5e, 0xeb, 0x6a, 0x86, 0x9e,
+	0x9f, 0x6d, 0xe8, 0xf7, 0xe1, 0x96, 0x56, 0x72, 0x8a, 0xbd, 0x17, 0xa4, 0xae, 0x37, 0x15, 0x41,
+	0x77, 0xc2, 0xc4, 0xa7, 0x3b, 0x49, 0xf1, 0x0d, 0x9c, 0x64, 0x0d, 0x6e, 0x24, 0x4e, 0xe2, 0x5b,
+	0xa1, 0x7d, 0x42, 0xf5, 0x7d, 0x2b, 0xb3, 0x6c, 0xc4, 0xd8, 0x7d, 0x85, 0x9c, 0xe1, 0x28, 0xe5,
+	0x19, 0x8e, 0xf2, 0x19, 0xdc, 0xd0, 0xbb, 0x1b, 0xf7, 0x97, 0x8a, 0xdc, 0xda, 0x82, 0xc2, 0x7e,
+	0x3d, 0xea, 0x22, 0x53, 0xdc, 0x0b, 0xae, 0xea, 0x5e, 0xd5, 0x49, 0xf7, 0xfa, 0x1c, 0x0c, 0xad,
+	0xd4, 0xa4, 0x97, 0xd5, 0xa4, 0x5a, 0x5a, 0xe9, 0xbd, 0x71, 0xaf, 0x9a, 0xea, 0x98, 0x73, 0x57,
+	0x76, 0xcc, 0xfa, 0x98, 0x63, 0x46, 0x36, 0x36, 0xdd, 0x31, 0xd7, 0xe1, 0xba, 0x56, 0x7b, 0xd4,
+	0x3f, 0x8d, 0x79, 0xa9, 0xf3, 0x35, 0x85, 0x3c, 0x4c, 0x3b, 0xe8, 0x2c, 0x67, 0x6e, 0xfc, 0xc8,
+	0x9c, 0xb9, 0x0d, 0x15, 0xbd, 0x77, 0x4a, 0x66, 0x78, 0x73, 0xfb, 0xaf, 0x33, 0x50, 0x10, 0x37,
+	0x38, 0x9c, 0x95, 0xf7, 0xce, 0x84, 0x04, 0x5d, 0xdd, 0x56, 0x70, 0x34, 0x15, 0x6f, 0x59, 0x69,
+	0x10, 0x92, 0x45, 0x05, 0xff, 0xb2, 0x00, 0x88, 0xf4, 0x1d, 0x5b, 0x4b, 0xc4, 0xab, 0x0a, 0x10,
+	0x69, 0x2d, 0xcf, 0x35, 0xff, 0xda, 0x8c, 0x3c, 0xa2, 0x4a, 0x47, 0x34, 0x9a, 0x47, 0x44, 0x69,
+	0xda, 0x7e, 0x01, 0xa5, 0xc8, 0xd4, 0xee, 0x01, 0x52, 0x49, 0x35, 0x7e, 0x6a, 0x46, 0x79, 0xbd,
+	0x82, 0x9b, 0x0a, 0xb3, 0x95, 0x20, 0x2e, 0x71, 0xc7, 0xec, 0x74, 0x77, 0x6c, 0x7f, 0x97, 0xd1,
+	0x0f, 0xaa, 0x37, 0x3b, 0x94, 0x8f, 0xa3, 0x4f, 0x60, 0xb9, 0xa9, 0x9f, 0xc0, 0xa2, 0x8f, 0x5f,
+	0x1f, 0x5e, 0x9a, 0x43, 0xe5, 0x3b, 0x92, 0xa2, 0x9f, 0xa5, 0x2c, 0xba, 0x20, 0x2d, 0x3a, 0x79,
+	0x45, 0xcb, 0xb7, 0xdb, 0x54, 0x73, 0x7e, 0x2b, 0x7b, 0x01, 0x28, 0xcb, 0x20, 0xf3, 0x84, 0x9d,
+	0xb7, 0x8b, 0x90, 0x3f, 0x08, 0x99, 0xdf, 0xae, 0x40, 0x49, 0xfc, 0xf5, 0x29, 0x69, 0xff, 0x01,
+	0x54, 0x0f, 0x28, 0x17, 0x1b, 0xdd, 0x63, 0xcc, 0x9f, 0xf1, 0xe0, 0xcf, 0x5c, 0xe5, 0xc1, 0xff,
+	0x6f, 0x37, 0xa0, 0x9a, 0x7a, 0x8c, 0xa3, 0x7b, 0xa9, 0x53, 0xaf, 0xae, 0xdf, 0xea, 0xa4, 0xbf,
+	0x55, 0x47, 0xef, 0x57, 0x79, 0xa0, 0xea, 0x42, 0xbe, 0x84, 0x39, 0xf1, 0xd7, 0x0c, 0xf4, 0xbb,
+	0x21, 0xee, 0x3a, 0x8c, 0xf2, 0x29, 0xa4, 0x62, 0xac, 0x09, 0x86, 0xf8, 0x9d, 0xf1, 0x05, 0x94,
+	0xcf, 0x2c, 0xd7, 0x21, 0x56, 0x18, 0x5d, 0xdd, 0xfb, 0x53, 0xd7, 0x7c, 0xae, 0x89, 0x70, 0x4c,
+	0x8e, 0x1e, 0x40, 0x25, 0x1a, 0x47, 0xfd, 0xa6, 0xc5, 0xe9, 0xeb, 0x46, 0xcc, 0x04, 0x27, 0x1c,
+	0xa3, 0x2d, 0x96, 0xc2, 0xf7, 0xb4, 0x58, 0x7e, 0x01, 0x35, 0xae, 0x2e, 0xc0, 0x74, 0x19, 0xf3,
+	0x8d, 0x05, 0x1d, 0x22, 0xa3, 0xb3, 0x4e, 0xdd, 0x0e, 0xae, 0xf2, 0xd4, 0x55, 0x7d, 0x00, 0xf9,
+	0x17, 0xcc, 0xf1, 0x8c, 0xeb, 0x92, 0x61, 0x6e, 0xe4, 0x35, 0x82, 0x25, 0x0a, 0x7d, 0x02, 0xc5,
+	0x17, 0xb2, 0x66, 0x36, 0x6e, 0x68, 0xdb, 0x4d, 0x13, 0x51, 0x82, 0x35, 0x5a, 0xc8, 0x0a, 0x2d,
+	0x7e, 0x6a, 0xdc, 0x1c, 0x93, 0x25, 0x6a, 0x67, 0x2c, 0x51, 0xe8, 0x8e, 0xa8, 0xf2, 0x65, 0x31,
+	0x64, 0x18, 0xfa, 0xc3, 0xe3, 0x58, 0x91, 0x84, 0x23, 0x02, 0xf4, 0x11, 0x14, 0x44, 0x4e, 0x19,
+	0x1a, 0xb7, 0x24, 0x65, 0xf2, 0x0d, 0x5e, 0x06, 0x25, 0xac, 0x90, 0x42, 0x62, 0x94, 0x79, 0x5a,
+	0x63, 0x12, 0x75, 0x4c, 0xc0, 0x11, 0x81, 0x50, 0x50, 0x76, 0x5b, 0xde, 0x1d, 0x53, 0x30, 0xd5,
+	0x5e, 0xf9, 0x34, 0xee, 0x50, 0xbe, 0x37, 0xd6, 0x61, 0x49, 0x59, 0xe1, 0x78, 0x6f, 0xf2, 0x1e,
+	0xe4, 0x5d, 0x66, 0x11, 0x63, 0x59, 0x1b, 0xe5, 0x34, 0x96, 0x3d, 0x66, 0x11, 0x2c, 0xc9, 0xc4,
+	0x1a, 0xe2, 0x2f, 0x25, 0xc6, 0x4f, 0x2e, 0x59, 0x63, 0x4f, 0x92, 0x60, 0x4d, 0x8a, 0xd6, 0xa0,
+	0x20, 0x9b, 0x4e, 0xc6, 0x9d, 0x31, 0x37, 0x4a, 0xf3, 0xc8, 0x5e, 0x14, 0x56, 0x84, 0xe8, 0xe7,
+	0x49, 0x7b, 0xeb, 0xee, 0x58, 0x7b, 0x69, 0x82, 0x27, 0xd5, 0xd3, 0x12, 0x2b, 0xf1, 0x90, 0x05,
+	0xd4, 0x58, 0xb9, 0x64, 0xa5, 0x03, 0x41, 0x81, 0x15, 0xa1, 0xd8, 0x90, 0x1c, 0x10, 0xe3, 0xde,
+	0x25, 0x1b, 0x92, 0x2c, 0xe2, 0x71, 0x2b, 0xff, 0xa2, 0xee, 0xd8, 0x07, 0xa6, 0x8e, 0x64, 0x5d,
+	0x9a, 0xc1, 0x3a, 0xfd, 0xd3, 0x12, 0xda, 0x85, 0xba, 0x9c, 0x8a, 0xea, 0x48, 0x89, 0x59, 0x1d,
+	0x6b, 0xec, 0x4e, 0x88, 0xa1, 0x44, 0x0b, 0x9a, 0xe3, 0xe9, 0x29, 0xda, 0x94, 0xe5, 0xa8, 0xc7,
+	0xce, 0x5d, 0x4a, 0x7a, 0xd4, 0x58, 0xbb, 0x44, 0x9d, 0x8d, 0x84, 0x0e, 0xa7, 0x99, 0xd0, 0x36,
+	0xd4, 0x52, 0x53, 0x62, 0xfc, 0x74, 0xac, 0xcb, 0x3d, 0x43, 0x08, 0xc1, 0x23, 0x6c, 0xc2, 0xa6,
+	0x7d, 0x95, 0x9d, 0x8d, 0xf5, 0x31, 0x9b, 0xd6, 0x59, 0x1b, 0x47, 0x04, 0x68, 0x0d, 0x2a, 0x7e,
+	0x94, 0xc9, 0x8d, 0x4f, 0xc7, 0xda, 0x9e, 0x71, 0x8e, 0xc7, 0x09, 0x11, 0xea, 0x40, 0x45, 0x55,
+	0x92, 0x1e, 0x3b, 0x37, 0x3e, 0xd3, 0x65, 0x5e, 0xdc, 0x0a, 0xd4, 0x51, 0x1e, 0x97, 0x6d, 0x3d,
+	0x12, 0x5e, 0xc3, 0x43, 0xe6, 0x1b, 0xbf, 0x1c, 0xf3, 0x1a, 0x11, 0xfc, 0xb1, 0x44, 0x09, 0x85,
+	0xb9, 0x4a, 0x05, 0xc6, 0x83, 0x31, 0x85, 0x75, 0x8a, 0xc0, 0x11, 0x41, 0xeb, 0x8f, 0x33, 0x71,
+	0x1f, 0xfd, 0xcd, 0x5b, 0xb6, 0x5f, 0xa5, 0xf3, 0x63, 0xaa, 0x24, 0xcc, 0x5e, 0x52, 0x12, 0x5e,
+	0x8b, 0x39, 0x52, 0xdd, 0xf7, 0x9f, 0x41, 0x5e, 0x38, 0x18, 0xba, 0x07, 0xe5, 0xb8, 0xe4, 0xcd,
+	0xcc, 0x2a, 0x79, 0x63, 0x92, 0xd6, 0x77, 0x59, 0x28, 0x2a, 0xc7, 0x44, 0x5f, 0x4e, 0x34, 0x54,
+	0x3f, 0xbc, 0xc4, 0x8f, 0x27, 0xfb, 0xa9, 0xaa, 0xce, 0x91, 0x0d, 0xbd, 0xc0, 0x54, 0xdf, 0x96,
+	0x8f, 0x86, 0x21, 0x55, 0xef, 0xa5, 0xbc, 0xa8, 0x73, 0x14, 0xee, 0x99, 0x40, 0x6d, 0x0a, 0x4c,
+	0xeb, 0xbf, 0x33, 0x49, 0x07, 0x76, 0x01, 0x0a, 0xaa, 0x2b, 0xa4, 0xf2, 0xb7, 0x9a, 0xa0, 0x65,
+	0x68, 0xf4, 0x1d, 0xcf, 0xe4, 0x6c, 0x10, 0xd8, 0xa3, 0x8f, 0xfe, 0x7a, 0xdf, 0xf1, 0x0e, 0x24,
+	0x58, 0x3d, 0x14, 0x96, 0x55, 0x77, 0x62, 0x84, 0x32, 0xa7, 0x29, 0xad, 0x8b, 0x34, 0xe5, 0x0a,
+	0x20, 0x45, 0x45, 0x4c, 0xc2, 0x6c, 0x6e, 0x86, 0x2c, 0xb4, 0x5c, 0x99, 0xd0, 0xf2, 0xb8, 0xa1,
+	0x31, 0x5b, 0xcc, 0xe6, 0x87, 0x02, 0x8e, 0x3a, 0x70, 0x2d, 0xa2, 0x96, 0xdb, 0xd1, 0xe4, 0x05,
+	0x49, 0xde, 0xd4, 0x28, 0xb9, 0x1d, 0x45, 0xdf, 0x86, 0x39, 0x5d, 0xcc, 0x98, 0x84, 0xba, 0xa1,
+	0xfe, 0x79, 0x06, 0xae, 0xaa, 0xaa, 0x65, 0x4b, 0x80, 0x5a, 0x5f, 0x40, 0x41, 0x46, 0xa9, 0x4b,
+	0xca, 0xb5, 0xcc, 0xf4, 0x72, 0xad, 0xf5, 0x3f, 0x99, 0xa4, 0x43, 0x7f, 0x59, 0x0b, 0x7c, 0x4a,
+	0x44, 0x9c, 0x7a, 0x65, 0x6f, 0x58, 0x2e, 0xb6, 0x86, 0xdf, 0x77, 0x63, 0x77, 0xa0, 0xa9, 0x22,
+	0x7c, 0xfa, 0x70, 0x95, 0x09, 0xcc, 0x2b, 0x44, 0x72, 0xb6, 0x2b, 0x80, 0x34, 0x6d, 0xfa, 0x68,
+	0x73, 0xea, 0x26, 0x14, 0x26, 0x39, 0xd9, 0x56, 0x09, 0x0a, 0x32, 0xe4, 0xb6, 0xfe, 0x21, 0x03,
+	0x45, 0x15, 0x7c, 0x5f, 0xdb, 0x68, 0x15, 0xf9, 0x94, 0x8f, 0x00, 0xaf, 0xb3, 0x1f, 0x15, 0xe0,
+	0xa7, 0xec, 0x47, 0x21, 0x46, 0xf6, 0xa3, 0x69, 0xa7, 0xec, 0x47, 0x61, 0x52, 0xfb, 0xf9, 0x93,
+	0xcc, 0xe8, 0xef, 0x08, 0xde, 0xd8, 0x18, 0x7e, 0xb8, 0xe8, 0xb1, 0x01, 0x73, 0x23, 0xb9, 0xe4,
+	0x0a, 0x86, 0xf9, 0x25, 0x54, 0x53, 0x19, 0xe0, 0x0a, 0x02, 0x1e, 0x42, 0x2d, 0x9d, 0x42, 0xde,
+	0x5c, 0xc2, 0x9d, 0xbb, 0x50, 0x90, 0x3f, 0x67, 0x44, 0x00, 0xc5, 0xfd, 0x67, 0x9b, 0x7b, 0xbb,
+	0xdd, 0xc6, 0x3b, 0xa8, 0x0a, 0xa5, 0x7d, 0xbc, 0xfb, 0x7c, 0xe3, 0x70, 0xbb, 0x91, 0x41, 0x15,
+	0x28, 0xec, 0x3d, 0xed, 0x6e, 0xec, 0x35, 0xb2, 0xeb, 0x8f, 0xa0, 0xac, 0x7f, 0x6e, 0x16, 0xa0,
+	0x5f, 0x41, 0x49, 0x8f, 0xd1, 0xcd, 0x24, 0xd0, 0x8f, 0xfc, 0x10, 0xb2, 0x65, 0x4c, 0x22, 0x54,
+	0xb5, 0xbb, 0x96, 0x59, 0xdf, 0x83, 0xb2, 0xfe, 0x94, 0x11, 0xa0, 0x87, 0x50, 0xd2, 0xe3, 0x94,
+	0xac, 0xd1, 0x0f, 0x52, 0x29, 0x59, 0x63, 0x5f, 0x40, 0x96, 0x33, 0x6b, 0x99, 0xf5, 0x13, 0xa8,
+	0x8f, 0x7e, 0x24, 0x40, 0xcf, 0x61, 0x5e, 0x0e, 0x62, 0x30, 0x47, 0xb7, 0xd3, 0x79, 0x65, 0xf2,
+	0x53, 0x43, 0x6b, 0x71, 0x26, 0x3e, 0xb5, 0xd2, 0x57, 0x50, 0xdc, 0x53, 0xbf, 0x8a, 0x7b, 0x30,
+	0xfa, 0x2a, 0x59, 0x98, 0xe6, 0x44, 0xad, 0xa9, 0x50, 0x29, 0x68, 0x27, 0xea, 0x9a, 0xbf, 0x9d,
+	0x9c, 0xcd, 0x5f, 0x7d, 0xfb, 0xef, 0xb7, 0xdf, 0xf9, 0xf6, 0x77, 0xb7, 0x33, 0xff, 0xf4, 0xbb,
+	0xdb, 0x99, 0xbf, 0xfc, 0x8f, 0xdb, 0x99, 0x3f, 0x5a, 0x79, 0xad, 0x9f, 0xb4, 0x69, 0x79, 0x47,
+	0x45, 0x09, 0xfa, 0xf4, 0xff, 0x03, 0x00, 0x00, 0xff, 0xff, 0x82, 0xb7, 0xa7, 0x68, 0xbb, 0x2c,
+	0x00, 0x00,
 }
 
 // Reference imports to suppress errors if they are not otherwise used.
@@ -5405,7 +5414,7 @@ func (m *Task) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 	if m.MaxTransactions != 0 {
 		i = encodeVarintRuntime(dAtA, i, uint64(m.MaxTransactions))
 		i--
-		dAtA[i] = 0x28
+		dAtA[i] = 0x18
 	}
 	if m.Preview {
 		i--
@@ -5415,26 +5424,7 @@ func (m *Task) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			dAtA[i] = 0
 		}
 		i--
-		dAtA[i] = 0x20
-	}
-	if m.OpsStatsSpec != nil {
-		{
-			size, err := m.OpsStatsSpec.MarshalToSizedBuffer(dAtA[:i])
-			if err != nil {
-				return 0, err
-			}
-			i -= size
-			i = encodeVarintRuntime(dAtA, i, uint64(size))
-		}
-		i--
-		dAtA[i] = 0x1a
-	}
-	if len(m.OpsStatsJournal) > 0 {
-		i -= len(m.OpsStatsJournal)
-		copy(dAtA[i:], m.OpsStatsJournal)
-		i = encodeVarintRuntime(dAtA, i, uint64(len(m.OpsStatsJournal)))
-		i--
-		dAtA[i] = 0x12
+		dAtA[i] = 0x10
 	}
 	if len(m.Spec) > 0 {
 		i -= len(m.Spec)
@@ -5611,7 +5601,9 @@ func (m *Persist) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.TriggerParamsJson)
 		i = encodeVarintRuntime(dAtA, i, uint64(len(m.TriggerParamsJson)))
 		i--
-		dAtA[i] = 0x72
+		dAtA[i] = 0x1
+		i--
+		dAtA[i] = 0x82
 	}
 	if m.DeleteTriggerParams {
 		i--
@@ -5621,7 +5613,7 @@ func (m *Persist) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			dAtA[i] = 0
 		}
 		i--
-		dAtA[i] = 0x68
+		dAtA[i] = 0x78
 	}
 	if len(m.MaxKeys) > 0 {
 		for k := range m.MaxKeys {
@@ -5639,7 +5631,7 @@ func (m *Persist) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			dAtA[i] = 0x8
 			i = encodeVarintRuntime(dAtA, i, uint64(baseI-i))
 			i--
-			dAtA[i] = 0x62
+			dAtA[i] = 0x72
 		}
 	}
 	if m.LegacyCheckpoint != nil {
@@ -5652,14 +5644,24 @@ func (m *Persist) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			i = encodeVarintRuntime(dAtA, i, uint64(size))
 		}
 		i--
-		dAtA[i] = 0x5a
+		dAtA[i] = 0x6a
+	}
+	if m.DeleteLegacyCheckpoint {
+		i--
+		if m.DeleteLegacyCheckpoint {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x60
 	}
 	if len(m.LastApplied) > 0 {
 		i -= len(m.LastApplied)
 		copy(dAtA[i:], m.LastApplied)
 		i = encodeVarintRuntime(dAtA, i, uint64(len(m.LastApplied)))
 		i--
-		dAtA[i] = 0x52
+		dAtA[i] = 0x5a
 	}
 	if m.HintedFrontier != nil {
 		{
@@ -5671,7 +5673,7 @@ func (m *Persist) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			i = encodeVarintRuntime(dAtA, i, uint64(size))
 		}
 		i--
-		dAtA[i] = 0x4a
+		dAtA[i] = 0x52
 	}
 	if m.DeleteHintedFrontier {
 		i--
@@ -5681,20 +5683,20 @@ func (m *Persist) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			dAtA[i] = 0
 		}
 		i--
-		dAtA[i] = 0x40
+		dAtA[i] = 0x48
 	}
 	if m.HintedCloseClock != 0 {
 		i -= 8
 		encoding_binary.LittleEndian.PutUint64(dAtA[i:], uint64(m.HintedCloseClock))
 		i--
-		dAtA[i] = 0x39
+		dAtA[i] = 0x41
 	}
 	if len(m.ConnectorPatchesJson) > 0 {
 		i -= len(m.ConnectorPatchesJson)
 		copy(dAtA[i:], m.ConnectorPatchesJson)
 		i = encodeVarintRuntime(dAtA, i, uint64(len(m.ConnectorPatchesJson)))
 		i--
-		dAtA[i] = 0x32
+		dAtA[i] = 0x3a
 	}
 	if m.CommittedFrontier != nil {
 		{
@@ -5706,7 +5708,17 @@ func (m *Persist) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			i = encodeVarintRuntime(dAtA, i, uint64(size))
 		}
 		i--
-		dAtA[i] = 0x2a
+		dAtA[i] = 0x32
+	}
+	if m.DeleteCommittedFrontier {
+		i--
+		if m.DeleteCommittedFrontier {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x28
 	}
 	if m.CommittedCloseClock != 0 {
 		i -= 8
@@ -5745,8 +5757,8 @@ func (m *Persist) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x10
 	}
-	if m.Nonce != 0 {
-		i = encodeVarintRuntime(dAtA, i, uint64(m.Nonce))
+	if m.SeqNo != 0 {
+		i = encodeVarintRuntime(dAtA, i, uint64(m.SeqNo))
 		i--
 		dAtA[i] = 0x8
 	}
@@ -5777,8 +5789,8 @@ func (m *Persisted) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
-	if m.Nonce != 0 {
-		i = encodeVarintRuntime(dAtA, i, uint64(m.Nonce))
+	if m.SeqNo != 0 {
+		i = encodeVarintRuntime(dAtA, i, uint64(m.SeqNo))
 		i--
 		dAtA[i] = 0x8
 	}
@@ -6447,6 +6459,11 @@ func (m *Materialize) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0xa2
 	}
+	if m.LogLevel != 0 {
+		i = encodeVarintRuntime(dAtA, i, uint64(m.LogLevel))
+		i--
+		dAtA[i] = 0x28
+	}
 	if m.Validated != nil {
 		{
 			size, err := m.Validated.MarshalToSizedBuffer(dAtA[:i])
@@ -7839,14 +7856,6 @@ func (m *Task) ProtoSize() (n int) {
 	if l > 0 {
 		n += 1 + l + sovRuntime(uint64(l))
 	}
-	l = len(m.OpsStatsJournal)
-	if l > 0 {
-		n += 1 + l + sovRuntime(uint64(l))
-	}
-	if m.OpsStatsSpec != nil {
-		l = m.OpsStatsSpec.ProtoSize()
-		n += 1 + l + sovRuntime(uint64(l))
-	}
 	if m.Preview {
 		n += 2
 	}
@@ -7931,8 +7940,8 @@ func (m *Persist) ProtoSize() (n int) {
 	}
 	var l int
 	_ = l
-	if m.Nonce != 0 {
-		n += 1 + sovRuntime(uint64(m.Nonce))
+	if m.SeqNo != 0 {
+		n += 1 + sovRuntime(uint64(m.SeqNo))
 	}
 	if m.DeleteAckIntents {
 		n += 2
@@ -7952,6 +7961,9 @@ func (m *Persist) ProtoSize() (n int) {
 	if m.CommittedCloseClock != 0 {
 		n += 9
 	}
+	if m.DeleteCommittedFrontier {
+		n += 2
+	}
 	if m.CommittedFrontier != nil {
 		l = m.CommittedFrontier.ProtoSize()
 		n += 1 + l + sovRuntime(uint64(l))
@@ -7974,6 +7986,9 @@ func (m *Persist) ProtoSize() (n int) {
 	if l > 0 {
 		n += 1 + l + sovRuntime(uint64(l))
 	}
+	if m.DeleteLegacyCheckpoint {
+		n += 2
+	}
 	if m.LegacyCheckpoint != nil {
 		l = m.LegacyCheckpoint.ProtoSize()
 		n += 1 + l + sovRuntime(uint64(l))
@@ -7995,7 +8010,7 @@ func (m *Persist) ProtoSize() (n int) {
 	}
 	l = len(m.TriggerParamsJson)
 	if l > 0 {
-		n += 1 + l + sovRuntime(uint64(l))
+		n += 2 + l + sovRuntime(uint64(l))
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -8009,8 +8024,8 @@ func (m *Persisted) ProtoSize() (n int) {
 	}
 	var l int
 	_ = l
-	if m.Nonce != 0 {
-		n += 1 + sovRuntime(uint64(m.Nonce))
+	if m.SeqNo != 0 {
+		n += 1 + sovRuntime(uint64(m.SeqNo))
 	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
@@ -8184,6 +8199,9 @@ func (m *Materialize) ProtoSize() (n int) {
 		l = m.Validated.ProtoSize()
 		n += 1 + l + sovRuntime(uint64(l))
 	}
+	if m.LogLevel != 0 {
+		n += 1 + sovRuntime(uint64(m.LogLevel))
+	}
 	if m.SessionLoop != nil {
 		l = m.SessionLoop.ProtoSize()
 		n += 2 + l + sovRuntime(uint64(l))
@@ -13149,74 +13167,6 @@ func (m *Task) Unmarshal(dAtA []byte) error {
 			}
 			iNdEx = postIndex
 		case 2:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field OpsStatsJournal", wireType)
-			}
-			var stringLen uint64
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowRuntime
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				stringLen |= uint64(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			intStringLen := int(stringLen)
-			if intStringLen < 0 {
-				return ErrInvalidLengthRuntime
-			}
-			postIndex := iNdEx + intStringLen
-			if postIndex < 0 {
-				return ErrInvalidLengthRuntime
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			m.OpsStatsJournal = string(dAtA[iNdEx:postIndex])
-			iNdEx = postIndex
-		case 3:
-			if wireType != 2 {
-				return fmt.Errorf("proto: wrong wireType = %d for field OpsStatsSpec", wireType)
-			}
-			var msglen int
-			for shift := uint(0); ; shift += 7 {
-				if shift >= 64 {
-					return ErrIntOverflowRuntime
-				}
-				if iNdEx >= l {
-					return io.ErrUnexpectedEOF
-				}
-				b := dAtA[iNdEx]
-				iNdEx++
-				msglen |= int(b&0x7F) << shift
-				if b < 0x80 {
-					break
-				}
-			}
-			if msglen < 0 {
-				return ErrInvalidLengthRuntime
-			}
-			postIndex := iNdEx + msglen
-			if postIndex < 0 {
-				return ErrInvalidLengthRuntime
-			}
-			if postIndex > l {
-				return io.ErrUnexpectedEOF
-			}
-			if m.OpsStatsSpec == nil {
-				m.OpsStatsSpec = &flow.CollectionSpec{}
-			}
-			if err := m.OpsStatsSpec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
-				return err
-			}
-			iNdEx = postIndex
-		case 4:
 			if wireType != 0 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Preview", wireType)
 			}
@@ -13236,7 +13186,7 @@ func (m *Task) Unmarshal(dAtA []byte) error {
 				}
 			}
 			m.Preview = bool(v != 0)
-		case 5:
+		case 3:
 			if wireType != 0 {
 				return fmt.Errorf("proto: wrong wireType = %d for field MaxTransactions", wireType)
 			}
@@ -13831,9 +13781,9 @@ func (m *Persist) Unmarshal(dAtA []byte) error {
 		switch fieldNum {
 		case 1:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Nonce", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SeqNo", wireType)
 			}
-			m.Nonce = 0
+			m.SeqNo = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowRuntime
@@ -13843,7 +13793,7 @@ func (m *Persist) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Nonce |= uint64(b&0x7F) << shift
+				m.SeqNo |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
@@ -14007,6 +13957,26 @@ func (m *Persist) Unmarshal(dAtA []byte) error {
 			m.CommittedCloseClock = uint64(encoding_binary.LittleEndian.Uint64(dAtA[iNdEx:]))
 			iNdEx += 8
 		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DeleteCommittedFrontier", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRuntime
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.DeleteCommittedFrontier = bool(v != 0)
+		case 6:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field CommittedFrontier", wireType)
 			}
@@ -14042,7 +14012,7 @@ func (m *Persist) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 6:
+		case 7:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field ConnectorPatchesJson", wireType)
 			}
@@ -14076,7 +14046,7 @@ func (m *Persist) Unmarshal(dAtA []byte) error {
 				m.ConnectorPatchesJson = []byte{}
 			}
 			iNdEx = postIndex
-		case 7:
+		case 8:
 			if wireType != 1 {
 				return fmt.Errorf("proto: wrong wireType = %d for field HintedCloseClock", wireType)
 			}
@@ -14086,7 +14056,7 @@ func (m *Persist) Unmarshal(dAtA []byte) error {
 			}
 			m.HintedCloseClock = uint64(encoding_binary.LittleEndian.Uint64(dAtA[iNdEx:]))
 			iNdEx += 8
-		case 8:
+		case 9:
 			if wireType != 0 {
 				return fmt.Errorf("proto: wrong wireType = %d for field DeleteHintedFrontier", wireType)
 			}
@@ -14106,7 +14076,7 @@ func (m *Persist) Unmarshal(dAtA []byte) error {
 				}
 			}
 			m.DeleteHintedFrontier = bool(v != 0)
-		case 9:
+		case 10:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field HintedFrontier", wireType)
 			}
@@ -14142,7 +14112,7 @@ func (m *Persist) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 10:
+		case 11:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field LastApplied", wireType)
 			}
@@ -14176,7 +14146,27 @@ func (m *Persist) Unmarshal(dAtA []byte) error {
 				m.LastApplied = []byte{}
 			}
 			iNdEx = postIndex
-		case 11:
+		case 12:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DeleteLegacyCheckpoint", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRuntime
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.DeleteLegacyCheckpoint = bool(v != 0)
+		case 13:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field LegacyCheckpoint", wireType)
 			}
@@ -14212,7 +14202,7 @@ func (m *Persist) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 12:
+		case 14:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field MaxKeys", wireType)
 			}
@@ -14326,7 +14316,7 @@ func (m *Persist) Unmarshal(dAtA []byte) error {
 			}
 			m.MaxKeys[mapkey] = mapvalue
 			iNdEx = postIndex
-		case 13:
+		case 15:
 			if wireType != 0 {
 				return fmt.Errorf("proto: wrong wireType = %d for field DeleteTriggerParams", wireType)
 			}
@@ -14346,7 +14336,7 @@ func (m *Persist) Unmarshal(dAtA []byte) error {
 				}
 			}
 			m.DeleteTriggerParams = bool(v != 0)
-		case 14:
+		case 16:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field TriggerParamsJson", wireType)
 			}
@@ -14433,9 +14423,9 @@ func (m *Persisted) Unmarshal(dAtA []byte) error {
 		switch fieldNum {
 		case 1:
 			if wireType != 0 {
-				return fmt.Errorf("proto: wrong wireType = %d for field Nonce", wireType)
+				return fmt.Errorf("proto: wrong wireType = %d for field SeqNo", wireType)
 			}
-			m.Nonce = 0
+			m.SeqNo = 0
 			for shift := uint(0); ; shift += 7 {
 				if shift >= 64 {
 					return ErrIntOverflowRuntime
@@ -14445,7 +14435,7 @@ func (m *Persisted) Unmarshal(dAtA []byte) error {
 				}
 				b := dAtA[iNdEx]
 				iNdEx++
-				m.Nonce |= uint64(b&0x7F) << shift
+				m.SeqNo |= uint64(b&0x7F) << shift
 				if b < 0x80 {
 					break
 				}
@@ -15520,6 +15510,25 @@ func (m *Materialize) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LogLevel", wireType)
+			}
+			m.LogLevel = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowRuntime
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.LogLevel |= ops.Log_Level(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		case 20:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field SessionLoop", wireType)
diff --git a/go/protocols/runtime/runtime.proto b/go/protocols/runtime/runtime.proto
index 96aac6241a4..f1afd4db86a 100644
--- a/go/protocols/runtime/runtime.proto
+++ b/go/protocols/runtime/runtime.proto
@@ -470,14 +470,10 @@ message Joined {
 message Task {
   // Task specification (protobuf-encoded bytes).
   bytes spec = 1;
-  // Collection journal partition to which task states are written.
-  string ops_stats_journal = 2;
-  // Collection to which task stats are written.
-  flow.CollectionSpec ops_stats_spec = 3;
   // When true, documents and stats are written to output and not directed to collections.
-  bool preview = 4;
+  bool preview = 2;
   // Preview / harness control. Zero means unlimited.
-  uint32 max_transactions = 5;
+  uint32 max_transactions = 3;
 }
 
 // Recover is sent by each shard to the leader after Joined, and carries
@@ -538,13 +534,13 @@ message Recover {
 // zero's RocksDB. Absent fields are inert.
 //
 // All fields of a Persist land together in a single WriteBatch.
-// `nonce` is echoed back by the shard's Persisted response, allowing
+// `seq_no` is echoed back by the shard's Persisted response, allowing
 // the leader to match a Persisted response to its originating request.
 message Persist {
   // Request ID picked by the leader and echoed verbatim in the shard's
   // `Persisted` response. The leader chooses any value and the shard
   // does not interpret it.
-  uint64 nonce = 1;
+  uint64 seq_no = 1;
   // Delete previously-persisted ACK intents. Applies ahead of `ack_intents`.
   // Effect: DeleteRange("AI:")
   bool delete_ack_intents = 2;
@@ -555,44 +551,51 @@ message Persist {
   // Clock at which the last-committed transaction closed.
   // Effect: Put under "committed-close-clock".
   fixed64 committed_close_clock = 4;
+  // Delete all previously-persisted committed Frontier entries.
+  // Applies ahead of `committed_frontier`.
+  // Effect: DeleteRange("FC:")
+  bool delete_committed_frontier = 5;
   // Committed Frontier entries.
   // Effect: Put under "FC:..." keys.
-  shuffle.Frontier committed_frontier = 5;
+  shuffle.Frontier committed_frontier = 6;
   // Connector state patches. State Update Wire Format.
   // Effect: Merge each patch under "connector-state".
-  bytes connector_patches_json = 6 [json_name = "connectorPatches"];
+  bytes connector_patches_json = 7 [json_name = "connectorPatches"];
   // Clock at which the hinted transaction closed.
   // Effect: Put under "hinted-close-clock".
-  fixed64 hinted_close_clock = 7;
+  fixed64 hinted_close_clock = 8;
   // Delete a previously-persisted hinted frontier. Applies ahead of `hinted_frontier`.
   // Effect: DeleteRange("FH:")
-  bool delete_hinted_frontier = 8;
+  bool delete_hinted_frontier = 9;
   // Hinted Frontier entries.
   // Effect: Put under "FH:" keys.
-  shuffle.Frontier hinted_frontier = 9;
+  shuffle.Frontier hinted_frontier = 10;
   // Last-applied task specification (protobuf-encoded bytes), or empty.
   // Effect: Put under "last-applied" key.
-  bytes last_applied = 10;
-  // Legacy checkpoint, required for rollback to legacy runtime.
+  bytes last_applied = 11;
+  // Delete a previously-persisted legacy checkpoint.
+  // Effect: Delete the "checkpoint" key.
+  bool delete_legacy_checkpoint = 12;
+  // Legacy checkpoint, required for rollback to the V1 runtime.
   // Effect: Put under "checkpoint" key.
-  consumer.Checkpoint legacy_checkpoint = 11;
+  consumer.Checkpoint legacy_checkpoint = 13;
   // Per-binding max-key updates, reduced to per-binding maximum across shards.
   // Key: binding index; Value: packed composite key tuple.
   // Effect: Put value under "MK-v2:{state_key}" (state_key resolved by the encoder).
-  map<uint32, bytes> max_keys = 12;
+  map<uint32, bytes> max_keys = 14;
   // Delete previously-persisted trigger parameters. Applies ahead of `trigger_params_json`.
   // Effect: Delete the "trigger-params" key.
-  bool delete_trigger_params = 13;
+  bool delete_trigger_params = 15;
   // Materialization trigger parameters.
   // Effect: Put under "trigger-params" key.
-  bytes trigger_params_json = 14 [ json_name = "triggerParams" ];
+  bytes trigger_params_json = 16 [ json_name = "triggerParams" ];
 }
 
 // Persisted is sent by shard zero to the leader after the state is durable
 // in the recovery log.
 message Persisted {
-  // Echoed back from the originating `Persist.nonce` request.
-  uint64 nonce = 1;
+  // Echoed back from the originating `Persist.seq_no` request.
+  uint64 seq_no = 1;
 }
 
 // Apply asks shard zero to invoke its connector's Apply action, both for
@@ -676,6 +679,12 @@ message Materialize {
   // Shard → Controller. Connector's reply to `validate`.
   materialize.Response.Validated validated = 4;
 
+  // Controller → Shard. Effective only on unary `spec` / `validate`
+  // messages, which never see the Join-time labeling that supplies the
+  // log level for session-bound work. Ignored on all other variants
+  // (the leader → shard messages MUST NOT set this).
+  ops.Log.Level log_level = 5;
+
   // ----- STARTUP -----
 
   // Controller → Shard. First message of a session-loop stream;
diff --git a/go/protocols/shuffle/shuffle.pb.go b/go/protocols/shuffle/shuffle.pb.go
index 742cc83b623..2b3c7f6fcbd 100644
--- a/go/protocols/shuffle/shuffle.pb.go
+++ b/go/protocols/shuffle/shuffle.pb.go
@@ -32,14 +32,19 @@ const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 
 // Shard represents a participant in the shuffle topology (e.x. a task shard).
 type Shard struct {
+	// Fully-qualified identifier of this shard, e.g.
+	// `<task-type>/<task-name>/<key-range>_<rclock-range>`.
+	// Used to label metrics and diagnostics, and as an authorization subject
+	// for the shard's RPCs.
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
 	// Key and r-clock document range owned by this shard.
-	Range *flow.RangeSpec `protobuf:"bytes,1,opt,name=range,proto3" json:"range,omitempty"`
+	Range *flow.RangeSpec `protobuf:"bytes,2,opt,name=range,proto3" json:"range,omitempty"`
 	// gRPC endpoint of this shard's shuffle service.
-	Endpoint string `protobuf:"bytes,2,opt,name=endpoint,proto3" json:"endpoint,omitempty"`
+	Endpoint string `protobuf:"bytes,3,opt,name=endpoint,proto3" json:"endpoint,omitempty"`
 	// Filesystem path where the Log actor writes segment files for this shard.
 	// The consumer joins over shuffle-produced log segments via this directory.
 	// Multiple shard indices may share a single directory.
-	Directory            string   `protobuf:"bytes,3,opt,name=directory,proto3" json:"directory,omitempty"`
+	Directory            string   `protobuf:"bytes,4,opt,name=directory,proto3" json:"directory,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
 	XXX_sizecache        int32    `json:"-"`
@@ -1388,98 +1393,99 @@ func init() {
 }
 
 var fileDescriptor_8851eb1ddb7aa19d = []byte{
-	// 1449 bytes of a gzipped FileDescriptorProto
+	// 1462 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xd4, 0x57, 0x4b, 0x73, 0x14, 0xd5,
 	0x17, 0xa7, 0x33, 0xaf, 0xcc, 0x99, 0x24, 0x93, 0x5c, 0x02, 0xf4, 0xbf, 0x49, 0x42, 0x18, 0xea,
 	0x8f, 0xd1, 0xa2, 0x26, 0x10, 0x10, 0x4a, 0xaa, 0xa4, 0x20, 0x68, 0x0a, 0x34, 0x02, 0xde, 0x61,
-	0xe5, 0xa6, 0xab, 0xd3, 0x7d, 0xa6, 0xa7, 0x4d, 0x4f, 0xdf, 0xb1, 0x6f, 0x0f, 0x66, 0x5c, 0xbb,
-	0x74, 0xa1, 0x55, 0x96, 0x6e, 0x75, 0xed, 0x17, 0x70, 0xe3, 0x96, 0x62, 0xe9, 0x57, 0x10, 0x56,
-	0x7e, 0x09, 0xcb, 0xba, 0x8f, 0x7e, 0xcc, 0xa4, 0x83, 0x2e, 0x5c, 0xe8, 0x26, 0xe9, 0x7b, 0xce,
-	0xef, 0x3c, 0xee, 0x79, 0xdd, 0x33, 0xd0, 0xf1, 0xd9, 0xf6, 0x28, 0x66, 0x09, 0x73, 0x59, 0xc8,
-	0xb7, 0xf9, 0x60, 0xdc, 0xef, 0x87, 0x98, 0xfe, 0xef, 0x4a, 0x0e, 0x69, 0xe8, 0xa3, 0xb5, 0x71,
-	0x10, 0xb3, 0x43, 0x8c, 0x33, 0x81, 0xec, 0x43, 0x01, 0xad, 0xb5, 0x29, 0x65, 0xfd, 0x90, 0x7d,
-	0x2e, 0xff, 0x68, 0xee, 0xaa, 0xcf, 0x7c, 0x26, 0x3f, 0xb7, 0xc5, 0x97, 0xa2, 0x76, 0x06, 0x50,
-	0xeb, 0x0d, 0x9c, 0xd8, 0x23, 0xff, 0x87, 0x5a, 0xec, 0x44, 0x3e, 0x9a, 0xc6, 0xa6, 0xb1, 0xd5,
-	0xda, 0x69, 0x77, 0xa5, 0x28, 0x15, 0xa4, 0xde, 0x08, 0x5d, 0xaa, 0xb8, 0xc4, 0x82, 0x79, 0x8c,
-	0xbc, 0x11, 0x0b, 0xa2, 0xc4, 0x9c, 0xdb, 0x34, 0xb6, 0x9a, 0x34, 0x3b, 0x93, 0x35, 0x68, 0x7a,
-	0x41, 0x8c, 0x6e, 0xc2, 0xe2, 0x89, 0x59, 0x91, 0xcc, 0x9c, 0xd0, 0xf9, 0xd6, 0x80, 0xd5, 0xfb,
-	0x2c, 0x0c, 0xd1, 0x4d, 0x02, 0x16, 0x3d, 0x71, 0xe2, 0x24, 0x10, 0x1f, 0x9c, 0xdc, 0x00, 0x70,
-	0x33, 0xba, 0x36, 0xbf, 0xaa, 0xcc, 0xe7, 0x78, 0xe9, 0x43, 0x01, 0x47, 0xf6, 0x80, 0x8c, 0x52,
-	0x1d, 0x36, 0xc7, 0x50, 0x5a, 0x91, 0x2e, 0xb5, 0x76, 0xce, 0x75, 0xb3, 0xc8, 0xec, 0x3b, 0x07,
-	0x18, 0xf6, 0x34, 0x9b, 0xae, 0x64, 0x22, 0x29, 0xa9, 0xf3, 0xca, 0x80, 0xea, 0x53, 0x87, 0x1f,
-	0x92, 0xa7, 0x70, 0x26, 0x57, 0x6f, 0x67, 0x40, 0xae, 0x3d, 0x5a, 0xef, 0xa6, 0x59, 0x29, 0xbb,
-	0xc4, 0x83, 0x53, 0x74, 0xd5, 0x2d, 0xbb, 0xdc, 0x4d, 0x00, 0x0f, 0xe3, 0xe0, 0x99, 0x23, 0x2f,
-	0x37, 0x77, 0xf2, 0xe5, 0x1e, 0x9c, 0xa2, 0x05, 0x24, 0x79, 0x1f, 0xda, 0x43, 0x27, 0xc1, 0x38,
-	0x70, 0xc2, 0xe0, 0x0b, 0x25, 0x5c, 0x91, 0xc2, 0xff, 0x53, 0xc2, 0x1f, 0x4d, 0x33, 0xb5, 0x86,
-	0x59, 0x99, 0xdd, 0x3a, 0x54, 0x13, 0x87, 0x1f, 0x76, 0xbe, 0x32, 0x60, 0xf9, 0x49, 0xcc, 0xbc,
-	0xb1, 0x8b, 0xf1, 0x5e, 0xcc, 0xa2, 0x24, 0xc0, 0x58, 0xe4, 0x72, 0xa4, 0x69, 0xf2, 0x92, 0x15,
-	0x9a, 0x9d, 0xc9, 0x05, 0x68, 0x85, 0x0e, 0x4f, 0x6c, 0x97, 0x0d, 0x87, 0x81, 0x4a, 0x75, 0x9d,
-	0x82, 0x20, 0xdd, 0x97, 0x14, 0x72, 0x09, 0x16, 0x07, 0x41, 0x94, 0xa0, 0x97, 0x42, 0x2a, 0x12,
-	0xb2, 0xa0, 0x88, 0x1a, 0x74, 0x16, 0xea, 0xac, 0xdf, 0xe7, 0x98, 0x98, 0x55, 0xa9, 0x5f, 0x9f,
-	0x3a, 0x3f, 0xcd, 0x41, 0xfb, 0x03, 0x36, 0x8e, 0x23, 0x27, 0xcc, 0xbc, 0x79, 0x17, 0xce, 0x7f,
-	0xaa, 0x48, 0x76, 0xe4, 0x0c, 0xd1, 0x4e, 0xe2, 0x71, 0xe4, 0x3a, 0x09, 0xda, 0x1e, 0x86, 0x89,
-	0x23, 0x1d, 0xac, 0x51, 0x53, 0x43, 0x1e, 0x39, 0x43, 0x7c, 0xaa, 0x01, 0xef, 0x09, 0x3e, 0xe9,
-	0xc2, 0xe9, 0x29, 0x71, 0x3e, 0xee, 0xf7, 0x83, 0x23, 0x5d, 0xa3, 0x2b, 0x05, 0xb1, 0x9e, 0x64,
-	0x10, 0x13, 0x1a, 0x07, 0x41, 0xe4, 0x05, 0x91, 0x2f, 0x3d, 0x5f, 0xa4, 0xe9, 0x91, 0x6c, 0xc1,
-	0xf2, 0xc1, 0x24, 0x41, 0x6e, 0xc7, 0xe8, 0x78, 0xda, 0xba, 0x72, 0x7f, 0x49, 0xd2, 0x29, 0x3a,
-	0x9e, 0xb2, 0x79, 0x05, 0x88, 0x42, 0x1e, 0xe0, 0x20, 0x88, 0x52, 0x6c, 0x4d, 0x62, 0x95, 0x8e,
-	0x5d, 0xc9, 0x50, 0xe8, 0x5b, 0xd0, 0x4c, 0xc3, 0xcb, 0xcd, 0xfa, 0x66, 0x45, 0x26, 0x33, 0x2d,
-	0xaa, 0xd9, 0xe4, 0xd0, 0x1c, 0xdb, 0x71, 0x60, 0x3e, 0x8b, 0xd2, 0x0d, 0x98, 0xd7, 0x77, 0x11,
-	0x85, 0x29, 0x74, 0x98, 0x99, 0x8e, 0x99, 0x88, 0xd2, 0x0c, 0x29, 0xb2, 0xd9, 0x0f, 0xc7, 0x7c,
-	0x80, 0x9e, 0x1d, 0x72, 0x51, 0x86, 0x95, 0xad, 0x2a, 0x05, 0x4d, 0xda, 0xe7, 0x51, 0xe7, 0xe7,
-	0x39, 0x58, 0xea, 0x21, 0xe7, 0x01, 0x8b, 0x28, 0x7e, 0x36, 0x46, 0x9e, 0x90, 0xab, 0x50, 0x65,
-	0x23, 0x4c, 0x1b, 0x72, 0x2d, 0xb3, 0x32, 0x0d, 0xeb, 0x3e, 0x1e, 0x61, 0x44, 0x25, 0x92, 0xdc,
-	0x81, 0x95, 0x18, 0xf9, 0x78, 0x88, 0xb6, 0x3b, 0x40, 0xf7, 0x30, 0x1f, 0x12, 0xad, 0x9d, 0x95,
-	0x4c, 0x3c, 0xf3, 0x6e, 0x59, 0x61, 0xef, 0x67, 0x50, 0xf2, 0x18, 0xda, 0x11, 0x1e, 0x25, 0x45,
-	0x69, 0x55, 0xf3, 0x97, 0x4f, 0x32, 0xfe, 0x08, 0x8f, 0x92, 0x5c, 0x01, 0x5d, 0x8a, 0xa6, 0xce,
-	0xd6, 0xc7, 0x50, 0x15, 0xee, 0x91, 0x8b, 0xaa, 0x0b, 0xb4, 0x2f, 0x8b, 0x99, 0x36, 0xd1, 0xf7,
-	0x54, 0xb2, 0xc8, 0x65, 0xa8, 0x73, 0x31, 0x07, 0xb9, 0x59, 0x91, 0x51, 0x5d, 0xca, 0x4d, 0x0a,
-	0x32, 0xd5, 0x5c, 0x6b, 0x19, 0x96, 0xa6, 0x8d, 0x76, 0xbe, 0x36, 0xa0, 0x9d, 0xb9, 0xc5, 0x47,
-	0x2c, 0xe2, 0x48, 0x6e, 0x41, 0x5d, 0x44, 0x04, 0x3d, 0x1d, 0xbd, 0x0b, 0xc7, 0x2f, 0xa0, 0x90,
-	0x32, 0x7c, 0xe8, 0x51, 0x0d, 0x27, 0xb7, 0x8f, 0x87, 0xe0, 0xc4, 0x00, 0xce, 0xde, 0x76, 0x1e,
-	0xea, 0x4a, 0x5b, 0xe7, 0xfb, 0x1a, 0x2c, 0xf4, 0xc2, 0xc0, 0xc5, 0x34, 0x97, 0xdd, 0xa9, 0x5c,
-	0x5a, 0xb9, 0x37, 0x05, 0x50, 0x31, 0x93, 0xd7, 0xa0, 0xc6, 0x13, 0x27, 0x4e, 0x8d, 0x9f, 0x2f,
-	0x17, 0xe8, 0x09, 0x08, 0x55, 0x48, 0x72, 0x07, 0x40, 0x7e, 0xc8, 0xae, 0xd1, 0x79, 0xbb, 0xf0,
-	0x3a, 0x39, 0x74, 0x3c, 0xda, 0xe4, 0xe9, 0x27, 0xb9, 0x2d, 0x87, 0x91, 0x1f, 0x23, 0xe7, 0xb2,
-	0xdb, 0x5a, 0x3b, 0x1b, 0xe5, 0xd2, 0x4f, 0x34, 0x8a, 0x66, 0x78, 0xeb, 0x1b, 0x43, 0x27, 0x7a,
-	0x1d, 0x80, 0xab, 0x00, 0xdb, 0x81, 0x8a, 0x7d, 0x83, 0x36, 0x35, 0xe5, 0xa1, 0xf7, 0x0f, 0xd6,
-	0x81, 0xe8, 0x28, 0xf9, 0x65, 0x07, 0x91, 0x87, 0x47, 0xd2, 0xe3, 0x45, 0x0a, 0x92, 0xf4, 0x50,
-	0x50, 0xac, 0x06, 0xd4, 0xe4, 0x3d, 0xad, 0x3f, 0x0c, 0x68, 0x66, 0x37, 0x2e, 0x8e, 0x1d, 0x63,
-	0x7a, 0xec, 0xbc, 0x09, 0x55, 0x3e, 0x42, 0x57, 0x3b, 0x77, 0x26, 0x7f, 0xc2, 0x74, 0x5b, 0xcb,
-	0x17, 0x50, 0x42, 0xc8, 0x1b, 0xd0, 0x76, 0x63, 0x14, 0xb3, 0x31, 0xc6, 0x67, 0x01, 0x4f, 0x1f,
-	0x87, 0x0a, 0x5d, 0x52, 0x64, 0xaa, 0xa9, 0xe4, 0x22, 0x2c, 0x0c, 0x99, 0x97, 0xa3, 0xd4, 0x18,
-	0x6b, 0x0d, 0x99, 0x97, 0x41, 0xc4, 0xbb, 0xcf, 0xc6, 0x09, 0xca, 0xb1, 0x25, 0xde, 0xfd, 0xcc,
-	0x2e, 0x15, 0x64, 0xaa, 0xb8, 0xe4, 0x1d, 0x80, 0x42, 0x4d, 0xfe, 0xe5, 0xf4, 0x2a, 0x80, 0x2d,
-	0x80, 0xf9, 0x34, 0x67, 0x9d, 0xef, 0x2a, 0xb0, 0xa8, 0xb3, 0xa9, 0x5b, 0xe5, 0xed, 0x99, 0x56,
-	0x59, 0x9f, 0xcd, 0x7a, 0x79, 0xa3, 0x3c, 0x80, 0xc5, 0x30, 0xe0, 0x49, 0x10, 0xf9, 0xb6, 0xe3,
-	0x79, 0xe8, 0xe9, 0xb0, 0x5d, 0x3a, 0x41, 0x7a, 0x5f, 0x61, 0xef, 0x09, 0x28, 0x5d, 0x08, 0x0b,
-	0x27, 0x72, 0x0d, 0x20, 0x2d, 0x24, 0x4c, 0x0b, 0xb7, 0xa4, 0xdb, 0x0a, 0xa0, 0xbc, 0xd3, 0xac,
-	0xe7, 0x06, 0x2c, 0x14, 0x75, 0xff, 0x57, 0xf3, 0xdb, 0xf9, 0xbd, 0x06, 0xb0, 0xcf, 0xfc, 0x74,
-	0x60, 0x5c, 0x99, 0x1a, 0x18, 0xf9, 0x13, 0x93, 0x43, 0x8a, 0xe3, 0x62, 0x07, 0xea, 0xce, 0x68,
-	0x84, 0x51, 0x9a, 0x05, 0xab, 0x0c, 0x7f, 0x4f, 0x22, 0xa8, 0x46, 0x92, 0x6d, 0xa8, 0xc9, 0xf7,
-	0x27, 0x5b, 0x6b, 0x4a, 0x44, 0xf6, 0x04, 0x80, 0x2a, 0x9c, 0xf5, 0xe3, 0xdf, 0x6c, 0xf2, 0xbc,
-	0x83, 0xe7, 0x5e, 0xdb, 0xc1, 0x6f, 0xc1, 0x0a, 0x17, 0x35, 0x62, 0x17, 0xfb, 0x58, 0xad, 0x02,
-	0x6d, 0xc9, 0xe8, 0x65, 0xcd, 0x4c, 0x2e, 0x43, 0x3b, 0x64, 0xbe, 0x7d, 0xbc, 0xe3, 0x17, 0x43,
-	0xe6, 0xe7, 0x38, 0xeb, 0xcb, 0x0a, 0xd4, 0xd5, 0x3d, 0xff, 0x3d, 0xeb, 0x8c, 0xdc, 0xf2, 0x02,
-	0x16, 0x07, 0xc9, 0x44, 0x3b, 0x9d, 0x9d, 0x45, 0x28, 0xd3, 0x25, 0xc7, 0x99, 0xc8, 0x0a, 0xa9,
-	0xd2, 0x66, 0xac, 0xf6, 0x1b, 0x67, 0x32, 0xb5, 0x20, 0xd6, 0x67, 0x16, 0xc4, 0x55, 0xa8, 0xb9,
-	0x21, 0x73, 0x0f, 0xcd, 0x86, 0xdc, 0xfb, 0xd4, 0x41, 0x50, 0xfb, 0xa1, 0xe3, 0x73, 0x73, 0x5e,
-	0x5a, 0x52, 0x07, 0x61, 0x66, 0xe4, 0xb8, 0x87, 0xe8, 0xd9, 0x87, 0x38, 0x31, 0x9b, 0x9b, 0xc6,
-	0xd6, 0x02, 0x6d, 0x2a, 0xca, 0x87, 0x38, 0x11, 0x55, 0xec, 0x31, 0xd7, 0x76, 0x62, 0x77, 0x10,
-	0x3c, 0x43, 0xcf, 0x04, 0x09, 0x68, 0x79, 0xcc, 0xbd, 0xa7, 0x49, 0x62, 0xd3, 0xe2, 0x6c, 0x1c,
-	0xbb, 0x68, 0x8b, 0xb5, 0xca, 0x0e, 0x31, 0xf2, 0x93, 0x81, 0xd9, 0x92, 0x46, 0x96, 0x15, 0x67,
-	0x77, 0x92, 0xe0, 0xbe, 0xa4, 0x5b, 0xeb, 0x50, 0x93, 0xa5, 0x23, 0x9d, 0x9c, 0xb8, 0xa1, 0xfa,
-	0x51, 0x53, 0xa5, 0xea, 0xd0, 0x79, 0x6e, 0x40, 0x4b, 0x56, 0x99, 0x1e, 0x41, 0xd7, 0x67, 0x46,
-	0xd0, 0xf9, 0xe9, 0x5a, 0x2c, 0x1f, 0x40, 0x37, 0xa1, 0xa1, 0xf7, 0x27, 0x5d, 0xf4, 0x6b, 0xa5,
-	0x52, 0x7b, 0x0a, 0x43, 0x53, 0x70, 0x61, 0x76, 0xdc, 0x85, 0x86, 0xe6, 0x96, 0xfb, 0x79, 0x7c,
-	0x6b, 0x33, 0xa6, 0xb7, 0xb6, 0x9d, 0x5f, 0x0c, 0x68, 0xf4, 0x94, 0x51, 0x72, 0x17, 0x1a, 0x7a,
-	0xb7, 0x20, 0xe7, 0x4e, 0x58, 0x97, 0x2c, 0xf3, 0xa4, 0x35, 0x64, 0xcb, 0xb8, 0x6a, 0x90, 0xdb,
-	0x50, 0x93, 0x43, 0x93, 0x9c, 0x29, 0x7d, 0x78, 0xad, 0xb3, 0xe5, 0xb3, 0x55, 0xca, 0xde, 0x80,
-	0xca, 0x3e, 0xf3, 0xc9, 0xe9, 0x92, 0x2e, 0xb6, 0x56, 0xcb, 0x02, 0x23, 0xa4, 0x76, 0xef, 0xbc,
-	0xf8, 0x6d, 0xe3, 0xd4, 0x8b, 0x97, 0x1b, 0xc6, 0xaf, 0x2f, 0x37, 0x8c, 0x1f, 0x5e, 0x6d, 0x18,
-	0x9f, 0x5c, 0xf1, 0x83, 0x64, 0x30, 0x3e, 0xe8, 0xba, 0x6c, 0xb8, 0x8d, 0x3c, 0x19, 0x3b, 0xf1,
-	0x44, 0xfd, 0x90, 0x2d, 0xfb, 0x9d, 0x7c, 0x50, 0x97, 0xa4, 0xeb, 0x7f, 0x06, 0x00, 0x00, 0xff,
-	0xff, 0x6f, 0x72, 0xb3, 0x68, 0x46, 0x0f, 0x00, 0x00,
+	0xe5, 0xa6, 0xeb, 0xa6, 0xfb, 0xcc, 0x4c, 0x9b, 0x9e, 0xbe, 0x63, 0xdf, 0x1e, 0xcc, 0xb8, 0x76,
+	0xe9, 0x42, 0xab, 0x2c, 0xdd, 0xea, 0xda, 0x2f, 0xe0, 0xc6, 0x2d, 0xc5, 0xd2, 0xaf, 0x20, 0xac,
+	0xfc, 0x12, 0x96, 0x75, 0x1f, 0xdd, 0xd3, 0x33, 0xe9, 0xa0, 0x0b, 0x17, 0xba, 0x49, 0xfa, 0x9e,
+	0xf3, 0x3b, 0x8f, 0x7b, 0x5e, 0xf7, 0x0c, 0xb4, 0x7a, 0x7c, 0x7b, 0x18, 0xf3, 0x84, 0x7b, 0x3c,
+	0x14, 0xdb, 0xa2, 0x3f, 0xea, 0x76, 0x43, 0x4c, 0xff, 0xb7, 0x15, 0x87, 0xd4, 0xcc, 0xd1, 0xd9,
+	0x38, 0x88, 0xf9, 0x21, 0xc6, 0x99, 0x40, 0xf6, 0xa1, 0x81, 0xce, 0xda, 0x94, 0xb2, 0x6e, 0xc8,
+	0x3f, 0x57, 0x7f, 0x0c, 0x77, 0xb5, 0xc7, 0x7b, 0x5c, 0x7d, 0x6e, 0xcb, 0x2f, 0x4d, 0x6d, 0x1d,
+	0x41, 0xa5, 0xd3, 0x67, 0xb1, 0x4f, 0x96, 0x60, 0x2e, 0xf0, 0x6d, 0x6b, 0xd3, 0xda, 0xaa, 0xd3,
+	0xb9, 0xc0, 0x27, 0xff, 0x87, 0x4a, 0xcc, 0xa2, 0x1e, 0xda, 0x73, 0x9b, 0xd6, 0x56, 0x63, 0xa7,
+	0xd9, 0x56, 0xaa, 0xa8, 0x24, 0x75, 0x86, 0xe8, 0x51, 0xcd, 0x25, 0x0e, 0xcc, 0x63, 0xe4, 0x0f,
+	0x79, 0x10, 0x25, 0x76, 0x49, 0x09, 0x67, 0x67, 0xb2, 0x06, 0x75, 0x3f, 0x88, 0xd1, 0x4b, 0x78,
+	0x3c, 0xb6, 0xcb, 0x8a, 0x39, 0x21, 0xb4, 0xbe, 0xb5, 0x60, 0xf5, 0x3e, 0x0f, 0x43, 0xf4, 0x92,
+	0x80, 0x47, 0x4f, 0x58, 0x9c, 0x04, 0xf2, 0x43, 0x90, 0x1b, 0x00, 0x5e, 0x46, 0x57, 0x1e, 0x35,
+	0x76, 0x56, 0xb5, 0xf9, 0x09, 0x5e, 0xf9, 0x90, 0xc3, 0x91, 0x3d, 0x20, 0xc3, 0x54, 0x87, 0x2b,
+	0x30, 0x54, 0x56, 0x8c, 0xf3, 0xe7, 0xda, 0x59, 0xa4, 0xf6, 0xd9, 0x01, 0x86, 0x1d, 0xc3, 0xa6,
+	0x2b, 0x99, 0x48, 0x4a, 0x6a, 0xbd, 0xb2, 0xa0, 0xfc, 0x94, 0x89, 0x43, 0xf2, 0x14, 0xce, 0x4c,
+	0xd4, 0xbb, 0x19, 0x50, 0x18, 0x8f, 0xd6, 0xdb, 0x69, 0x96, 0x8a, 0x2e, 0xf1, 0xe0, 0x14, 0x5d,
+	0xf5, 0x8a, 0x2e, 0x77, 0x13, 0xc0, 0xc7, 0x38, 0x78, 0xc6, 0xd4, 0xe5, 0xe6, 0x4e, 0xbe, 0xdc,
+	0x83, 0x53, 0x34, 0x87, 0x24, 0xef, 0x43, 0x73, 0xc0, 0x12, 0x8c, 0x03, 0x16, 0x06, 0x5f, 0x68,
+	0xe1, 0x92, 0x12, 0xfe, 0x9f, 0x16, 0xfe, 0x68, 0x9a, 0x69, 0x34, 0xcc, 0xca, 0xec, 0x56, 0xa1,
+	0x9c, 0x30, 0x71, 0xd8, 0xfa, 0xca, 0x82, 0xe5, 0x27, 0x31, 0xf7, 0x47, 0x1e, 0xc6, 0x7b, 0x31,
+	0x8f, 0x92, 0x00, 0x63, 0x99, 0xcb, 0xa1, 0xa1, 0xa9, 0x4b, 0x96, 0x68, 0x76, 0x26, 0x17, 0xa0,
+	0x11, 0x32, 0x91, 0xb8, 0x1e, 0x1f, 0x0c, 0x82, 0x44, 0x39, 0x5e, 0xa5, 0x20, 0x49, 0xf7, 0x15,
+	0x85, 0x5c, 0x82, 0xc5, 0x7e, 0x10, 0x25, 0xe8, 0xa7, 0x90, 0x92, 0x82, 0x2c, 0x68, 0xa2, 0x01,
+	0x9d, 0x85, 0x2a, 0xef, 0x76, 0x05, 0x26, 0xaa, 0x1c, 0x4a, 0xd4, 0x9c, 0x5a, 0x3f, 0xcd, 0x41,
+	0xf3, 0x03, 0x3e, 0x8a, 0x23, 0x16, 0x66, 0xde, 0xbc, 0x0b, 0xe7, 0x3f, 0xd5, 0x24, 0x37, 0x62,
+	0x03, 0x74, 0x93, 0x78, 0x14, 0x79, 0x2c, 0x41, 0xd7, 0xc7, 0x30, 0x61, 0xca, 0xc1, 0x0a, 0xb5,
+	0x0d, 0xe4, 0x11, 0x1b, 0xe0, 0x53, 0x03, 0x78, 0x4f, 0xf2, 0x49, 0x1b, 0x4e, 0x4f, 0x89, 0x8b,
+	0x51, 0xb7, 0x1b, 0x1c, 0x29, 0xc7, 0xeb, 0x74, 0x25, 0x27, 0xd6, 0x51, 0x0c, 0x62, 0x43, 0xed,
+	0x20, 0x88, 0xfc, 0x20, 0xea, 0x29, 0xcf, 0x17, 0x69, 0x7a, 0x24, 0x5b, 0xb0, 0x7c, 0x30, 0x4e,
+	0x50, 0xb8, 0x31, 0x32, 0xdf, 0x58, 0xd7, 0xee, 0x2f, 0x29, 0x3a, 0x45, 0xe6, 0x6b, 0x9b, 0x57,
+	0x80, 0x68, 0xe4, 0x01, 0xf6, 0x83, 0x28, 0xc5, 0x56, 0x14, 0x56, 0xeb, 0xd8, 0x55, 0x0c, 0x8d,
+	0xbe, 0x05, 0xf5, 0x34, 0xbc, 0xc2, 0xae, 0x6e, 0x96, 0x54, 0x32, 0xd3, 0xa2, 0x9a, 0x4d, 0x0e,
+	0x9d, 0x60, 0x5b, 0x0c, 0xe6, 0xb3, 0x28, 0xdd, 0x80, 0x79, 0x73, 0x17, 0x59, 0x98, 0x52, 0x87,
+	0x9d, 0xe9, 0x98, 0x89, 0x28, 0xcd, 0x90, 0x32, 0x9b, 0xdd, 0x70, 0x24, 0xfa, 0xe8, 0xbb, 0xa1,
+	0x90, 0x65, 0x58, 0xda, 0x2a, 0x53, 0x30, 0xa4, 0x7d, 0x11, 0xb5, 0x7e, 0x9e, 0x83, 0xa5, 0x0e,
+	0x0a, 0x11, 0xf0, 0x88, 0xe2, 0x67, 0x23, 0x14, 0x09, 0xb9, 0x0a, 0x65, 0x3e, 0xc4, 0xb4, 0x21,
+	0xd7, 0x32, 0x2b, 0xd3, 0xb0, 0xf6, 0xe3, 0x21, 0x46, 0x54, 0x21, 0xc9, 0x1d, 0x58, 0x89, 0x51,
+	0x8c, 0x06, 0xe8, 0x7a, 0x7d, 0xf4, 0x0e, 0xf5, 0x90, 0xd0, 0x25, 0xbf, 0x92, 0x89, 0x67, 0xde,
+	0x2d, 0x6b, 0xec, 0xfd, 0x0c, 0x4a, 0x1e, 0x43, 0x33, 0xc2, 0xa3, 0x24, 0x2f, 0xad, 0x6b, 0xfe,
+	0xf2, 0x49, 0xc6, 0x1f, 0xe1, 0x51, 0x32, 0x51, 0x40, 0x97, 0xa2, 0xa9, 0xb3, 0xf3, 0x31, 0x94,
+	0xa5, 0x7b, 0xe4, 0xa2, 0xee, 0x02, 0xe3, 0xcb, 0x62, 0xa6, 0x4d, 0xf6, 0x3d, 0x55, 0x2c, 0x72,
+	0x19, 0xaa, 0x42, 0xce, 0x45, 0x61, 0x97, 0x54, 0x54, 0x97, 0x26, 0x26, 0x25, 0x99, 0x1a, 0xae,
+	0xb3, 0x0c, 0x4b, 0xd3, 0x46, 0x5b, 0x5f, 0x5b, 0xd0, 0xcc, 0xdc, 0x12, 0x43, 0x1e, 0x09, 0x24,
+	0xb7, 0xa0, 0x2a, 0x23, 0x82, 0xbe, 0x89, 0xde, 0x85, 0xe3, 0x17, 0xd0, 0x48, 0x15, 0x3e, 0xf4,
+	0xa9, 0x81, 0x93, 0xdb, 0xc7, 0x43, 0x70, 0x62, 0x00, 0x67, 0x6f, 0x3b, 0x0f, 0x55, 0xad, 0xad,
+	0xf5, 0x7d, 0x05, 0x16, 0x3a, 0x61, 0xe0, 0x61, 0x9a, 0xcb, 0xf6, 0x54, 0x2e, 0x9d, 0x89, 0x37,
+	0x39, 0x50, 0x3e, 0x93, 0xd7, 0xa0, 0x22, 0x12, 0x16, 0xa7, 0xc6, 0xcf, 0x17, 0x0b, 0x74, 0x24,
+	0x84, 0x6a, 0x24, 0xb9, 0x03, 0xa0, 0x3e, 0x54, 0xd7, 0x98, 0xbc, 0x5d, 0x78, 0x9d, 0x1c, 0x32,
+	0x9f, 0xd6, 0x45, 0xfa, 0x49, 0x6e, 0xab, 0x61, 0xd4, 0x8b, 0x51, 0x08, 0xd5, 0x6d, 0x8d, 0x9d,
+	0x8d, 0x62, 0xe9, 0x27, 0x06, 0x45, 0x33, 0xbc, 0xf3, 0x8d, 0x65, 0x12, 0xbd, 0x0e, 0x20, 0x74,
+	0x80, 0x5d, 0xf3, 0xb8, 0xd5, 0x68, 0xdd, 0x50, 0x1e, 0xfa, 0xff, 0x60, 0x1d, 0xc8, 0x8e, 0x52,
+	0x5f, 0x6e, 0x10, 0xf9, 0x78, 0xa4, 0x3c, 0x5e, 0xa4, 0xa0, 0x48, 0x0f, 0x25, 0xc5, 0xa9, 0x41,
+	0x45, 0xdd, 0xd3, 0xf9, 0xc3, 0x82, 0x7a, 0x76, 0xe3, 0xfc, 0xd8, 0xb1, 0xa6, 0xc7, 0xce, 0x9b,
+	0x50, 0x16, 0x43, 0xf4, 0x8c, 0x73, 0x67, 0x26, 0x4f, 0x98, 0x69, 0x6b, 0xf5, 0x02, 0x2a, 0x08,
+	0x79, 0x03, 0x9a, 0x5e, 0x8c, 0x72, 0x36, 0xc6, 0xf8, 0x2c, 0x10, 0xe9, 0xe3, 0x50, 0xa2, 0x4b,
+	0x9a, 0x4c, 0x0d, 0x95, 0x5c, 0x84, 0x85, 0x01, 0xf7, 0x27, 0x28, 0x3d, 0xc6, 0x1a, 0x03, 0xee,
+	0x67, 0x10, 0xf9, 0xee, 0xf3, 0x51, 0x82, 0x6a, 0x6c, 0xc9, 0x77, 0x3f, 0xb3, 0x4b, 0x25, 0x99,
+	0x6a, 0x2e, 0x79, 0x07, 0x20, 0x57, 0x93, 0x7f, 0x39, 0xbd, 0x72, 0x60, 0x07, 0x60, 0x3e, 0xcd,
+	0x59, 0xeb, 0xbb, 0x12, 0x2c, 0x9a, 0x6c, 0x9a, 0x56, 0x79, 0x7b, 0xa6, 0x55, 0xd6, 0x67, 0xb3,
+	0x5e, 0xdc, 0x28, 0x0f, 0x60, 0x31, 0x0c, 0x44, 0x12, 0x44, 0x3d, 0x97, 0xf9, 0x3e, 0xfa, 0x26,
+	0x6c, 0x97, 0x4e, 0x90, 0xde, 0xd7, 0xd8, 0x7b, 0x12, 0x4a, 0x17, 0xc2, 0xdc, 0x89, 0x5c, 0x03,
+	0x48, 0x0b, 0x09, 0xd3, 0xc2, 0x2d, 0xe8, 0xb6, 0x1c, 0x68, 0xd2, 0x69, 0xce, 0x73, 0x0b, 0x16,
+	0xf2, 0xba, 0xff, 0xab, 0xf9, 0x6d, 0xfd, 0x5e, 0x01, 0xd8, 0xe7, 0xbd, 0x74, 0x60, 0x5c, 0x99,
+	0x1a, 0x18, 0x93, 0x27, 0x66, 0x02, 0xc9, 0x8f, 0x8b, 0x1d, 0xa8, 0xb2, 0xe1, 0x10, 0xa3, 0x34,
+	0x0b, 0x4e, 0x11, 0xfe, 0x9e, 0x42, 0x50, 0x83, 0x24, 0xdb, 0x50, 0x51, 0xef, 0x4f, 0xb6, 0xd6,
+	0x14, 0x88, 0xec, 0x49, 0x00, 0xd5, 0x38, 0xe7, 0xc7, 0xbf, 0xd9, 0xe4, 0x93, 0x0e, 0x9e, 0x7b,
+	0x6d, 0x07, 0xbf, 0x05, 0x2b, 0x42, 0xd6, 0x88, 0x9b, 0xef, 0x63, 0xbd, 0x0a, 0x34, 0x15, 0xa3,
+	0x93, 0x35, 0x33, 0xb9, 0x0c, 0xcd, 0x90, 0xf7, 0xdc, 0xe3, 0x1d, 0xbf, 0x18, 0xf2, 0xde, 0x04,
+	0xe7, 0x7c, 0x59, 0x82, 0xaa, 0xbe, 0xe7, 0xbf, 0x67, 0x9d, 0x51, 0x5b, 0x5e, 0xc0, 0xe3, 0x20,
+	0x19, 0x1b, 0xa7, 0xb3, 0xb3, 0x0c, 0x65, 0xba, 0xe4, 0xb0, 0xb1, 0xaa, 0x90, 0x32, 0xad, 0xc7,
+	0x7a, 0xbf, 0x61, 0xe3, 0xa9, 0x05, 0xb1, 0x3a, 0xb3, 0x20, 0xae, 0x42, 0xc5, 0x0b, 0xb9, 0x77,
+	0x68, 0xd7, 0xd4, 0xde, 0xa7, 0x0f, 0x92, 0xda, 0x0d, 0x59, 0x4f, 0xd8, 0xf3, 0xca, 0x92, 0x3e,
+	0x48, 0x33, 0x43, 0xe6, 0x1d, 0xa2, 0xef, 0x1e, 0xe2, 0xd8, 0xae, 0x6f, 0x5a, 0x5b, 0x0b, 0xb4,
+	0xae, 0x29, 0x1f, 0xe2, 0x58, 0x56, 0xb1, 0xcf, 0x3d, 0x97, 0xc5, 0x5e, 0x3f, 0x78, 0x86, 0xbe,
+	0x0d, 0x0a, 0xd0, 0xf0, 0xb9, 0x77, 0xcf, 0x90, 0xe4, 0xa6, 0x25, 0xf8, 0x28, 0xf6, 0xd0, 0x95,
+	0x6b, 0x95, 0x1b, 0x62, 0xd4, 0x4b, 0xfa, 0x76, 0x43, 0x19, 0x59, 0xd6, 0x9c, 0xdd, 0x71, 0x82,
+	0xfb, 0x8a, 0xee, 0xac, 0x43, 0x45, 0x95, 0x8e, 0x72, 0x72, 0xec, 0x85, 0xa8, 0xc2, 0x5d, 0xa6,
+	0xfa, 0xd0, 0x7a, 0x6e, 0x41, 0x43, 0x55, 0x99, 0x19, 0x41, 0xd7, 0x67, 0x46, 0xd0, 0xf9, 0xe9,
+	0x5a, 0x2c, 0x1e, 0x40, 0x37, 0xa1, 0x66, 0xf6, 0x27, 0x53, 0xf4, 0x6b, 0x85, 0x52, 0x7b, 0x1a,
+	0x43, 0x53, 0x70, 0x6e, 0x76, 0xdc, 0x85, 0x9a, 0xe1, 0x16, 0xfb, 0x79, 0x7c, 0x6b, 0xb3, 0xa6,
+	0xb7, 0xb6, 0x9d, 0x5f, 0x2c, 0xa8, 0x75, 0xb4, 0x51, 0x72, 0x17, 0x6a, 0x66, 0xb7, 0x20, 0xe7,
+	0x4e, 0x58, 0x97, 0x1c, 0xfb, 0xa4, 0x35, 0x64, 0xcb, 0xba, 0x6a, 0x91, 0xdb, 0x50, 0x51, 0x43,
+	0x93, 0x9c, 0x29, 0x7c, 0x78, 0x9d, 0xb3, 0xc5, 0xb3, 0x55, 0xc9, 0xde, 0x80, 0xd2, 0x3e, 0xef,
+	0x91, 0xd3, 0x05, 0x5d, 0xec, 0xac, 0x16, 0x05, 0x46, 0x4a, 0xed, 0xde, 0x79, 0xf1, 0xdb, 0xc6,
+	0xa9, 0x17, 0x2f, 0x37, 0xac, 0x5f, 0x5f, 0x6e, 0x58, 0x3f, 0xbc, 0xda, 0xb0, 0x3e, 0xb9, 0xd2,
+	0x0b, 0x92, 0xfe, 0xe8, 0xa0, 0xed, 0xf1, 0xc1, 0x36, 0x8a, 0x64, 0xc4, 0xe2, 0xb1, 0xfe, 0x61,
+	0x5b, 0xf4, 0xbb, 0xf9, 0xa0, 0xaa, 0x48, 0xd7, 0xff, 0x0c, 0x00, 0x00, 0xff, 0xff, 0x95, 0xb3,
+	0xf8, 0xec, 0x56, 0x0f, 0x00, 0x00,
 }
 
 // Reference imports to suppress errors if they are not otherwise used.
@@ -1773,14 +1779,14 @@ func (m *Shard) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 		copy(dAtA[i:], m.Directory)
 		i = encodeVarintShuffle(dAtA, i, uint64(len(m.Directory)))
 		i--
-		dAtA[i] = 0x1a
+		dAtA[i] = 0x22
 	}
 	if len(m.Endpoint) > 0 {
 		i -= len(m.Endpoint)
 		copy(dAtA[i:], m.Endpoint)
 		i = encodeVarintShuffle(dAtA, i, uint64(len(m.Endpoint)))
 		i--
-		dAtA[i] = 0x12
+		dAtA[i] = 0x1a
 	}
 	if m.Range != nil {
 		{
@@ -1792,6 +1798,13 @@ func (m *Shard) MarshalToSizedBuffer(dAtA []byte) (int, error) {
 			i = encodeVarintShuffle(dAtA, i, uint64(size))
 		}
 		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Id) > 0 {
+		i -= len(m.Id)
+		copy(dAtA[i:], m.Id)
+		i = encodeVarintShuffle(dAtA, i, uint64(len(m.Id)))
+		i--
 		dAtA[i] = 0xa
 	}
 	return len(dAtA) - i, nil
@@ -3146,6 +3159,10 @@ func (m *Shard) ProtoSize() (n int) {
 	}
 	var l int
 	_ = l
+	l = len(m.Id)
+	if l > 0 {
+		n += 1 + l + sovShuffle(uint64(l))
+	}
 	if m.Range != nil {
 		l = m.Range.ProtoSize()
 		n += 1 + l + sovShuffle(uint64(l))
@@ -3788,6 +3805,38 @@ func (m *Shard) Unmarshal(dAtA []byte) error {
 		}
 		switch fieldNum {
 		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Id", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowShuffle
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthShuffle
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthShuffle
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Id = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Range", wireType)
 			}
@@ -3823,7 +3872,7 @@ func (m *Shard) Unmarshal(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
-		case 2:
+		case 3:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Endpoint", wireType)
 			}
@@ -3855,7 +3904,7 @@ func (m *Shard) Unmarshal(dAtA []byte) error {
 			}
 			m.Endpoint = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
-		case 3:
+		case 4:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field Directory", wireType)
 			}
diff --git a/go/protocols/shuffle/shuffle.proto b/go/protocols/shuffle/shuffle.proto
index a79ca873b15..55d32d45657 100644
--- a/go/protocols/shuffle/shuffle.proto
+++ b/go/protocols/shuffle/shuffle.proto
@@ -15,14 +15,19 @@ option (gogoproto.goproto_getters_all) = false;
 
 // Shard represents a participant in the shuffle topology (e.x. a task shard).
 message Shard {
+  // Fully-qualified identifier of this shard, e.g.
+  // `<task-type>/<task-name>/<key-range>_<rclock-range>`.
+  // Used to label metrics and diagnostics, and as an authorization subject
+  // for the shard's RPCs.
+  string id = 1;
   // Key and r-clock document range owned by this shard.
-  flow.RangeSpec range = 1;
+  flow.RangeSpec range = 2;
   // gRPC endpoint of this shard's shuffle service.
-  string endpoint = 2;
+  string endpoint = 3;
   // Filesystem path where the Log actor writes segment files for this shard.
   // The consumer joins over shuffle-produced log segments via this directory.
   // Multiple shard indices may share a single directory.
-  string directory = 3;
+  string directory = 4;
 }
 
 message CollectionPartitions {
diff --git a/go/runtime/flow_consumer.go b/go/runtime/flow_consumer.go
index 3b81d1f3da9..cf0e3169bed 100644
--- a/go/runtime/flow_consumer.go
+++ b/go/runtime/flow_consumer.go
@@ -42,6 +42,7 @@ type FlowConsumerConfig struct {
 		DataPlaneFQDN string      `long:"data-plane-fqdn" env:"DATA_PLANE_FQDN" description:"Fully-qualified domain name of the data-plane to which this reactor belongs"`
 		Network       string      `long:"network" env:"NETWORK" description:"The Docker network that connector containers are given access to. Defaults to the bridge network"`
 		ProxyRuntimes int         `long:"proxy-runtimes" default:"2" description:"The number of proxy connector runtimes that may run concurrently"`
+		SidecarPort   uint16      `long:"sidecar-port" env:"SIDECAR_PORT" description:"Port of the runtime-sidecar co-located on every reactor machine (fleet-wide, fixed). Required when any task uses the runtime-v2 feature flag."`
 		TestAPIs      bool        `long:"test-apis" description:"Enable APIs exclusively used while running catalog tests"`
 	} `group:"flow" namespace:"flow" env-namespace:"FLOW"`
 }
@@ -58,6 +59,19 @@ func (c *FlowConsumerConfig) Execute(args []string) error {
 	}.Execute(args)
 }
 
+// SidecarEndpoint maps a reactor's `ProcessSpec.Endpoint` to the dial-able URL
+// of the runtime-sidecar co-located with that reactor. The sidecar listens on a
+// fixed fleet-wide port (--sidecar-port); we preserve the reactor URL's scheme
+// (TLS choice mirrors the reactor) and substitute the host's port.
+func (c *FlowConsumerConfig) SidecarEndpoint(reactor pb.Endpoint) (string, error) {
+	if c.Flow.SidecarPort == 0 {
+		return "", fmt.Errorf("--sidecar-port (or env SIDECAR_PORT) is required for runtime-v2 tasks")
+	}
+	var u = reactor.URL()
+	u.Host = fmt.Sprintf("%s:%d", u.Hostname(), c.Flow.SidecarPort)
+	return u.String(), nil
+}
+
 // Plane returns the data-plane context in which this FlowConsumerConfig is running.
 func (c *FlowConsumerConfig) Plane() pr.Plane {
 	// AllowLocal flag is only passed in allowed local contexts.
@@ -152,16 +166,32 @@ func (f *FlowConsumer) NewStore(shard consumer.Shard, rec *recoverylog.Recorder)
 			return d, nil
 		}
 	case ops.TaskType_materialization.String():
-		if m, err := newMaterializeApp(f, shard, rec); err != nil {
-			return nil, err
+		if useRuntimeV2(shard.Spec().LabelSet) {
+			if m, err := newMaterializeAppV2(f, shard, rec); err != nil {
+				return nil, err
+			} else {
+				return m, nil
+			}
 		} else {
-			return m, nil
+			if m, err := newMaterializeApp(f, shard, rec); err != nil {
+				return nil, err
+			} else {
+				return m, nil
+			}
 		}
 	default:
 		return nil, fmt.Errorf("don't know how to serve catalog task type %q", taskType)
 	}
 }
 
+// runtimeV2Flag is the shard-label flag selecting the runtime-next (V2) path.
+const runtimeV2Flag = labels.FlagPrefix + "enable-runtime-v2"
+
+// useRuntimeV2 reports whether the shard's labels select the runtime-next path.
+func useRuntimeV2(set pf.LabelSet) bool {
+	return set.ValueOf(runtimeV2Flag) == "true"
+}
+
 // NewMessage panics if called.
 func (f *FlowConsumer) NewMessage(*pb.JournalSpec) (message.Message, error) {
 	panic("NewMessage is never called")
diff --git a/go/runtime/flow_consumer_test.go b/go/runtime/flow_consumer_test.go
index 742a9a6313d..8ab1c53182a 100644
--- a/go/runtime/flow_consumer_test.go
+++ b/go/runtime/flow_consumer_test.go
@@ -3,7 +3,10 @@ package runtime
 import (
 	"testing"
 
+	"github.com/estuary/flow/go/labels"
+	pf "github.com/estuary/flow/go/protocols/flow"
 	pr "github.com/estuary/flow/go/protocols/runtime"
+	pb "go.gazette.dev/core/broker/protocol"
 	"github.com/stretchr/testify/require"
 )
 
@@ -52,3 +55,57 @@ func TestFlowConsumerConfig_Plane(t *testing.T) {
 		})
 	}
 }
+
+func TestUseRuntimeV2(t *testing.T) {
+	tests := []struct {
+		name   string
+		labels []pb.Label
+		want   bool
+	}{
+		{
+			name:   "no flag",
+			labels: []pb.Label{{Name: labels.TaskName, Value: "task"}},
+			want:   false,
+		},
+		{
+			name:   "enable-runtime-v2=true",
+			labels: []pb.Label{{Name: labels.FlagPrefix + "enable-runtime-v2", Value: "true"}},
+			want:   true,
+		},
+		{
+			name:   "enable-runtime-v2=false",
+			labels: []pb.Label{{Name: labels.FlagPrefix + "enable-runtime-v2", Value: "false"}},
+			want:   false,
+		},
+		{
+			name:   "unrelated flag",
+			labels: []pb.Label{{Name: labels.FlagPrefix + "some-other-flag", Value: "true"}},
+			want:   false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var set = pf.LabelSet{Labels: tt.labels}
+			require.Equal(t, tt.want, useRuntimeV2(set))
+		})
+	}
+}
+
+func TestSidecarEndpoint(t *testing.T) {
+	var config = FlowConsumerConfig{}
+	config.Flow.SidecarPort = 9100
+
+	got, err := config.SidecarEndpoint(pb.Endpoint("https://reactor-foo.flow.localhost:8080"))
+	require.NoError(t, err)
+	require.Equal(t, "https://reactor-foo.flow.localhost:9100", got)
+
+	got, err = config.SidecarEndpoint(pb.Endpoint("http://10.0.0.5:8080"))
+	require.NoError(t, err)
+	require.Equal(t, "http://10.0.0.5:9100", got)
+
+	// No port configured: error.
+	config.Flow.SidecarPort = 0
+	_, err = config.SidecarEndpoint(pb.Endpoint("https://reactor-foo.flow.localhost:8080"))
+	require.ErrorContains(t, err, "sidecar-port")
+}
diff --git a/go/runtime/materialize.go b/go/runtime/materialize.go
index 62b8d0c402e..c2976cb6525 100644
--- a/go/runtime/materialize.go
+++ b/go/runtime/materialize.go
@@ -59,6 +59,16 @@ func (m *materializeApp) RestoreCheckpoint(shard consumer.Shard) (_ pf.Checkpoin
 		return pf.Checkpoint{}, err
 	}
 
+	// Fail the shard if its runtime-v2 flag has been turned on. NewStore is
+	// invoked only on the initial PRIMARY transition, so a publish that
+	// flips the flag on a running shard cannot otherwise reroute it. We
+	// surface a functional error so the controller restarts the shard,
+	// at which point NewStore re-evaluates the flag and selects V2.
+	if useRuntimeV2(shard.Spec().LabelSet) {
+		return pf.Checkpoint{}, fmt.Errorf(
+			"runtime-v2 feature flag is set but this shard is running the V1 materialize runtime; failing to force a restart")
+	}
+
 	var requestExt = &pr.MaterializeRequestExt{
 		LogLevel: m.term.labels.LogLevel,
 	}
diff --git a/go/runtime/materialize_v2.go b/go/runtime/materialize_v2.go
new file mode 100644
index 00000000000..b7290eb52c4
--- /dev/null
+++ b/go/runtime/materialize_v2.go
@@ -0,0 +1,415 @@
+package runtime
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"strings"
+
+	"github.com/estuary/flow/go/bindings"
+	"github.com/estuary/flow/go/flow"
+	"github.com/estuary/flow/go/labels"
+	pf "github.com/estuary/flow/go/protocols/flow"
+	pr "github.com/estuary/flow/go/protocols/runtime"
+	"github.com/estuary/flow/go/shuffle"
+	"github.com/sirupsen/logrus"
+	"go.gazette.dev/core/allocator"
+	pb "go.gazette.dev/core/broker/protocol"
+	"go.gazette.dev/core/consumer"
+	pc "go.gazette.dev/core/consumer/protocol"
+	"go.gazette.dev/core/consumer/recoverylog"
+	"go.gazette.dev/core/message"
+)
+
+// materializeAppV2 is the runtime-next backed materialization Application.
+// It bypasses the Gazette transaction lifecycle entirely (drains
+// StartReadingMessages, panics in BeginTxn / ConsumeMessage / FinalizeTxn /
+// StartCommit) and instead drives the V2 protocol over the per-shard
+// `Shard.Materialize` bidi stream. The Rust side handles all document I/O,
+// shuffle, combining, publishing, and stat aggregation; the Go controller
+// only manages session startup (Join → Joined → Task → Opened) and
+// teardown (Stop → Stopped) per term.
+type materializeAppV2 struct {
+	*taskBase[*pf.MaterializationSpec]
+
+	client pr.Shard_MaterializeClient
+	// shuffleDir hosts per-shard shuffle files for this assignment.
+	shuffleDir string
+
+	// respCh is fed by a long-lived pump goroutine on `m.client.Recv()`.
+	respCh <-chan recvResult
+}
+
+// recvResult is one outcome of m.client.Recv(): either a Materialize
+// response or a terminal error (io.EOF on graceful close).
+type recvResult struct {
+	resp *pr.Materialize
+	err  error
+}
+
+var _ application = (*materializeAppV2)(nil)
+
+func newMaterializeAppV2(host *FlowConsumer, shard consumer.Shard, recorder *recoverylog.Recorder) (*materializeAppV2, error) {
+	if host.config.Flow.SidecarPort == 0 {
+		return nil, fmt.Errorf("runtime-v2 requires --sidecar-port (or env SIDECAR_PORT)")
+	}
+
+	var shuffleDir, err = os.MkdirTemp("", "flow-runtime-v2-shuffle-")
+	if err != nil {
+		return nil, fmt.Errorf("creating runtime-v2 shuffle tempdir: %w", err)
+	}
+
+	var base *taskBase[*pf.MaterializationSpec]
+	base, err = newTaskBaseV2[*pf.MaterializationSpec](host, shard, recorder, extractMaterializationSpec)
+	if err != nil {
+		_ = os.RemoveAll(shuffleDir)
+		return nil, err
+	}
+	go base.heartbeatLoop(shard)
+
+	var client pr.Shard_MaterializeClient
+	client, err = pr.NewShardClient(base.svc.Conn()).Materialize(shard.Context())
+	if err != nil {
+		base.drop()
+		_ = os.RemoveAll(shuffleDir)
+		return nil, fmt.Errorf("opening V2 Shard.Materialize stream: %w", err)
+	}
+
+	// SessionLoop is the first message of the stream and lasts its lifetime.
+	// It carries the RocksDB handle that runtime-next opens and reuses across
+	// every leader session within this stream.
+	var rocksDBDescriptor *pr.RocksDBDescriptor
+	if recorder != nil {
+		rocksDBDescriptor = bindings.NewRocksDBDescriptor(recorder)
+	}
+	_ = client.Send(&pr.Materialize{
+		SessionLoop: &pr.SessionLoop{
+			RocksdbDescriptor: rocksDBDescriptor,
+		},
+	})
+
+	var respCh = make(chan recvResult, 4)
+	go func() {
+		defer close(respCh)
+		for {
+			var resp, err = client.Recv()
+			// Bias towards send, but bail if full AND cancelled.
+			select {
+			case respCh <- recvResult{resp: resp, err: err}:
+			default:
+				select {
+				case respCh <- recvResult{resp: resp, err: err}:
+				case <-shard.Context().Done():
+					return
+				}
+			}
+			if err != nil {
+				return
+			}
+		}
+	}()
+
+	return &materializeAppV2{
+		taskBase:   base,
+		client:     client,
+		shuffleDir: shuffleDir,
+		respCh:     respCh,
+	}, nil
+}
+
+func (m *materializeAppV2) recv() (*pr.Materialize, error) {
+	var r, ok = <-m.respCh
+	if !ok {
+		return nil, io.ErrUnexpectedEOF
+	}
+	return r.resp, r.err
+}
+
+func (m *materializeAppV2) RestoreCheckpoint(shard consumer.Shard) (pf.Checkpoint, error) {
+	if err := shard.Context().Err(); err != nil {
+		return pf.Checkpoint{}, err
+	} else if err := m.initTerm(shard); err != nil {
+		m.term.cancel()
+		return pf.Checkpoint{}, err
+	}
+	// Note that RestoreCheckpoint is called at the transition from
+	// STANDBY to PRIMARY: the shard is updated to PRIMARY only after its
+	// return, and before StartReadingMessages.
+
+	// Fail the shard if its runtime-v2 flag has been turned off. NewStore is
+	// invoked only on the initial PRIMARY transition, so a publish that
+	// flips the flag on a running shard cannot otherwise reroute it. We
+	// surface a functional error so the controller restarts the shard,
+	// at which point NewStore re-evaluates the flag and selects V1.
+	if !useRuntimeV2(shard.Spec().LabelSet) {
+		m.term.cancel()
+		return pf.Checkpoint{}, fmt.Errorf(
+			"runtime-v2 feature flag is unset but this shard is running the V2 materialize runtime; failing to force a restart")
+	}
+
+	// The Rust runtime owns checkpoint persistence, recovery, ACK intent
+	// publishing, and the core transaction loop. Nothing to recover here.
+	return pf.Checkpoint{}, nil
+}
+
+func (m *materializeAppV2) StartReadingMessages(shard consumer.Shard, _ pc.Checkpoint, _ *flow.Timepoint, ch chan<- consumer.EnvelopeOrError) {
+	go m.runOneSession(shard, ch)
+}
+
+// runOneSession drives one session of the V2 protocol from end to end:
+//
+//  1. Load and marshal per-term task inputs.
+//  2. Build & send Join once every task shard is PRIMARY-assigned, retrying
+//     on disagreement until consensus.
+//  3. Send Task and wait for Opened (which carries the connector Container).
+//  4. Run the steady-state select loop until term cancellation, shard
+//     cancellation, or a stream error.
+//
+// On term cancellation (spec update) we send Stop and wait for Stopped, then
+// return nil so the framework loops back through RestoreCheckpoint. Any
+// non-nil return is forwarded onto `ch` by the deferred sentinel before
+// the channel is closed.
+func (m *materializeAppV2) runOneSession(shard consumer.Shard, ch chan<- consumer.EnvelopeOrError) (err error) {
+	defer func() {
+		if err != nil {
+			ch <- consumer.EnvelopeOrError{Error: err}
+		}
+		close(ch)
+	}()
+
+	var specBytes []byte
+	if specBytes, err = m.term.taskSpec.Marshal(); err != nil {
+		return fmt.Errorf("marshaling MaterializationSpec: %w", err)
+	}
+
+	// Run the Join/Joined protocol loop until consensus is met.
+	var waitForRevision int64
+	for {
+		var ks = m.host.service.State.KS
+		ks.Mu.RLock()
+		err = ks.WaitForRevision(m.term.ctx, waitForRevision)
+		ks.Mu.RUnlock()
+		if err != nil {
+			return fmt.Errorf("awaiting Etcd revision %d: %w", waitForRevision, err)
+		}
+
+		// Build Join from the current topology view, and send.
+		var join, rev, err = m.buildJoin()
+		if err != nil {
+			return fmt.Errorf("building Join: %w", err)
+		} else if join == nil {
+			waitForRevision = rev + 1
+			continue
+		}
+		_ = m.client.Send(&pr.Materialize{Join: join})
+
+		// Receive Joined and check consensus.
+		var resp *pr.Materialize
+		if resp, err = m.recv(); err != nil {
+			return fmt.Errorf("receiving Joined: %w", pf.UnwrapGRPCError(err))
+		} else if resp.Joined == nil {
+			return fmt.Errorf("expected Joined, got %#v", resp)
+		} else if resp.Joined.MaxEtcdRevision == 0 {
+			break // Consensus.
+		} else {
+			// Disagreement: await the indicated revision, then re-poll topology.
+			waitForRevision = resp.Joined.MaxEtcdRevision
+		}
+	}
+
+	// Send Task.
+	_ = m.client.Send(&pr.Materialize{
+		Task: &pr.Task{
+			Spec:            specBytes,
+			Preview:         false,
+			MaxTransactions: 0,
+		},
+	})
+
+	// Receive Opened.
+	var resp *pr.Materialize
+	if resp, err = m.recv(); err != nil {
+		return fmt.Errorf("receiving Opened: %w", pf.UnwrapGRPCError(err))
+	} else if resp.Opened == nil {
+		return fmt.Errorf("expected Opened, got %#v", resp)
+	}
+	m.container.Store(resp.Opened.Container)
+
+	// Steady-state: drive teardown signals and surface stream errors.
+	// termDone is nil-ed once we've sent Stop, so the case stops firing.
+	// Future CloseNow plumbing slots in as another case alongside termDone.
+	var termDone = m.term.ctx.Done()
+	for {
+		select {
+		case <-termDone:
+			// Spec update: initiate graceful drain. The leader replies with
+			// Stopped, read from `respCh` below.
+			_ = m.client.Send(&pr.Materialize{Stop: &pr.Stop{}})
+			termDone = nil
+
+		case <-shard.Context().Done():
+			return shard.Context().Err() // Immediate, non-graceful shutdown.
+
+		case r, ok := <-m.respCh:
+			if !ok || r.err == io.EOF {
+				return nil
+			}
+			if r.err != nil {
+				return pf.UnwrapGRPCError(r.err)
+			}
+			if r.resp.Stopped != nil {
+				return nil // Graceful drain complete.
+			}
+			logrus.WithFields(logrus.Fields{
+				"shardId": shard.Spec().Id,
+				"msg":     r.resp,
+			}).Panic("unexpected Rust runtime message after Opened")
+		}
+	}
+}
+
+func (m *materializeAppV2) Destroy() {
+	if m.client != nil {
+		_ = m.client.CloseSend()
+		m.client = nil
+	}
+	m.taskBase.drop()
+	m.taskBase.opsCancel()
+	_ = os.RemoveAll(m.shuffleDir)
+}
+
+func (m *materializeAppV2) ReplayRange(_ consumer.Shard, _ pb.Journal, _, _ pb.Offset) message.Iterator {
+	panic("runtime-v2: ReplayRange unreachable (no Gazette message pipeline)")
+}
+
+func (m *materializeAppV2) ReadThrough(_ pb.Offsets) (pb.Offsets, error) {
+	return pb.Offsets{}, nil
+}
+
+func (m *materializeAppV2) BeginTxn(_ consumer.Shard) error {
+	panic("runtime-v2: BeginTxn unreachable (StartReadingMessages drains)")
+}
+func (m *materializeAppV2) ConsumeMessage(_ consumer.Shard, _ message.Envelope, _ *message.Publisher) error {
+	panic("runtime-v2: ConsumeMessage unreachable (StartReadingMessages drains)")
+}
+func (m *materializeAppV2) FinalizeTxn(_ consumer.Shard, _ *message.Publisher) error {
+	panic("runtime-v2: FinalizeTxn unreachable (StartReadingMessages drains)")
+}
+func (m *materializeAppV2) StartCommit(_ consumer.Shard, _ pf.Checkpoint, _ consumer.OpFutures) consumer.OpFuture {
+	panic("runtime-v2: StartCommit unreachable (StartReadingMessages drains)")
+}
+func (m *materializeAppV2) FinishedTxn(_ consumer.Shard, _ consumer.OpFuture) {}
+
+func (m *materializeAppV2) Coordinator() *shuffle.Coordinator {
+	panic("runtime-v2: Coordinator unreachable (no Go shuffle)")
+}
+
+// buildJoin enumerates the task topology under read lock. If any shard does
+// not yet have a PRIMARY assignment, it returns nil plus the observed Etcd
+// revision so the caller can wait and try again. A non-nil Join describes every
+// shard, sorted by ShardID (which matches the proto's ordering contract on
+// (key_begin, r_clock_begin) ascending).
+func (m *materializeAppV2) buildJoin() (*pr.Join, int64, error) {
+	var ks = m.host.service.State.KS
+	var itemPrefix = allocator.ItemKey(ks, taskShardPrefix(m.term.shardSpec.Id))
+
+	ks.Mu.RLock()
+	defer ks.Mu.RUnlock()
+	var state = m.host.service.State
+	var rev = ks.Header.Revision
+
+	if state.LocalMemberInd == -1 {
+		return nil, rev, fmt.Errorf("local reactor member not present in Etcd state")
+	}
+	var selfEndpoint = state.Members[state.LocalMemberInd].
+		Decoded.(allocator.Member).MemberValue.(*pc.ConsumerSpec).Endpoint
+	var selfSidecar, err = m.host.config.SidecarEndpoint(selfEndpoint)
+	if err != nil {
+		return nil, rev, err
+	}
+
+	var (
+		shards   []*pr.Join_Shard
+		shardIdx = -1
+	)
+	for i, kv := range state.Items.Prefixed(itemPrefix) {
+		var spec = kv.Decoded.(allocator.Item).ItemValue.(*pc.ShardSpec)
+		var asn, createRev, ok = primaryAssignment(state, spec.Id)
+		if !ok {
+			return nil, rev, nil
+		}
+		var labeling, err = labels.ParseShardLabels(spec.LabelSet)
+		if err != nil {
+			return nil, rev, fmt.Errorf("parsing labels for %s: %w", spec.Id, err)
+		}
+		shards = append(shards, &pr.Join_Shard{
+			Id:                 spec.Id.String(),
+			Labeling:           &labeling,
+			Reactor:            &pb.ProcessSpec_ID{Zone: asn.MemberZone, Suffix: asn.MemberSuffix},
+			EtcdCreateRevision: createRev,
+		})
+		if spec.Id == m.term.shardSpec.Id {
+			shardIdx = i
+		}
+	}
+	if len(shards) == 0 {
+		return nil, rev, nil
+	}
+	if shardIdx < 0 {
+		return nil, rev, fmt.Errorf("local shard %s not in topology", m.term.shardSpec.Id)
+	}
+
+	var leaderEndpoint, ok = memberEndpoint(state, *shards[0].Reactor)
+	if !ok {
+		return nil, rev, fmt.Errorf("leader reactor %+v not present in Etcd state", shards[0].Reactor)
+	}
+	var leaderSidecar string
+	if leaderSidecar, err = m.host.config.SidecarEndpoint(leaderEndpoint); err != nil {
+		return nil, rev, err
+	}
+
+	return &pr.Join{
+		EtcdModRevision:  rev,
+		Shards:           shards,
+		ShardIndex:       uint32(shardIdx),
+		ShuffleDirectory: m.shuffleDir,
+		ShuffleEndpoint:  selfSidecar,
+		LeaderEndpoint:   leaderSidecar,
+	}, rev, nil
+}
+
+// taskShardPrefix returns the keyspace directory under which all of the
+// task's shard items live. ShardIDs are `<task-type>/<task-name>/<range>`;
+// the prefix is everything up to and including the last `/`.
+func taskShardPrefix(id pc.ShardID) string {
+	var s = id.String()
+	return s[:strings.LastIndexByte(s, '/')+1]
+}
+
+// memberEndpoint returns the ConsumerSpec endpoint for `id`. Caller must hold
+// `state.KS.Mu` for read.
+func memberEndpoint(state *allocator.State, id pb.ProcessSpec_ID) (pb.Endpoint, bool) {
+	for _, kv := range state.Members {
+		var member = kv.Decoded.(allocator.Member)
+		if member.Zone != id.Zone || member.Suffix != id.Suffix {
+			continue
+		}
+		var spec = member.MemberValue.(*pc.ConsumerSpec)
+		return spec.Endpoint, true
+	}
+	return "", false
+}
+
+// primaryAssignment returns the slot-0 PRIMARY allocator.Assignment for `id`
+// and its Etcd CreateRevision. Caller must hold `state.KS.Mu` for read.
+func primaryAssignment(state *allocator.State, id pc.ShardID) (allocator.Assignment, int64, bool) {
+	for _, akv := range state.KS.KeyValues.Prefixed(
+		allocator.ItemAssignmentsPrefix(state.KS, id.String())) {
+		var asn = akv.Decoded.(allocator.Assignment)
+		var status = asn.AssignmentValue.(*pc.ReplicaStatus)
+		if asn.Slot == 0 && status.Code == pc.ReplicaStatus_PRIMARY {
+			return asn, akv.Raw.CreateRevision, true
+		}
+	}
+	return allocator.Assignment{}, 0, false
+}
diff --git a/go/runtime/task.go b/go/runtime/task.go
index 2095701aaa1..ec63e8f62c1 100644
--- a/go/runtime/task.go
+++ b/go/runtime/task.go
@@ -30,8 +30,16 @@ import (
 	"go.gazette.dev/core/consumer/recoverylog"
 	"go.gazette.dev/core/keyspace"
 	"go.gazette.dev/core/message"
+	"google.golang.org/grpc"
 )
 
+// taskService is the subset of bindings.TaskService / bindings.TaskServiceV2
+// behavior consumed by taskBase, so a single struct can host either runtime.
+type taskService interface {
+	Conn() *grpc.ClientConn
+	Drop()
+}
+
 type taskBase[TaskSpec pf.Task] struct {
 	container    atomic.Pointer[pr.Container]            // Current Container of this shard, or nil.
 	extractFn    func(*sql.DB, string) (TaskSpec, error) // Extracts a TaskSpec from a build DB.
@@ -39,7 +47,7 @@ type taskBase[TaskSpec pf.Task] struct {
 	opsCancel    context.CancelFunc                      // Cancels ops.Publisher context.
 	opsPublisher *OpsPublisher                           // ops.Publisher of task ops.Logs and ops.Stats.
 	recorder     *recoverylog.Recorder                   // Recorder of the shard's recovery log.
-	svc          *bindings.TaskService                   // Associated Rust runtime service.
+	svc          taskService                             // Associated Rust runtime service (legacy or V2).
 	term         taskTerm[TaskSpec]                      // Current task term.
 	termCount    int                                     // Number of initialized task terms.
 }
@@ -75,6 +83,7 @@ func newTaskBase[TaskSpec pf.Task](
 
 	term, err := newTaskTerm[TaskSpec](nil, extractFn, host, opsPublisher, shard)
 	if err != nil {
+		opsCancel()
 		return nil, err
 	}
 
@@ -88,6 +97,7 @@ func newTaskBase[TaskSpec pf.Task](
 		opsPublisher.PublishLog,
 	)
 	if err != nil {
+		opsCancel()
 		return nil, fmt.Errorf("creating task service: %w", err)
 	}
 
@@ -103,6 +113,54 @@ func newTaskBase[TaskSpec pf.Task](
 	}, nil
 }
 
+// newTaskBaseV2 mirrors newTaskBase but instantiates the runtime-next
+// (V2) TaskService. The legacy and V2 services are independently linked
+// CGO services with distinct gRPC surfaces; only the constructor differs.
+func newTaskBaseV2[TaskSpec pf.Task](
+	host *FlowConsumer,
+	shard consumer.Shard,
+	recorder *recoverylog.Recorder,
+	extractFn func(*sql.DB, string) (TaskSpec, error),
+) (*taskBase[TaskSpec], error) {
+
+	var opsCtx, opsCancel = context.WithCancel(host.opsContext)
+	opsCtx = pprof.WithLabels(opsCtx, pprof.Labels(
+		"shard", shard.Spec().Id.String(),
+	))
+	var opsPublisher = NewOpsPublisher(message.NewPublisher(
+		client.NewAppendService(opsCtx, host.service.Journals), nil))
+
+	term, err := newTaskTerm[TaskSpec](nil, extractFn, host, opsPublisher, shard)
+	if err != nil {
+		opsCancel()
+		return nil, err
+	}
+
+	svc, err := bindings.NewTaskServiceV2(
+		pr.TaskServiceConfig{
+			ContainerNetwork: host.config.Flow.Network,
+			TaskName:         term.labels.TaskName,
+			Plane:            host.config.Plane(),
+		},
+		opsPublisher.PublishLog,
+	)
+	if err != nil {
+		opsCancel()
+		return nil, fmt.Errorf("creating V2 task service: %w", err)
+	}
+
+	return &taskBase[TaskSpec]{
+		container:    atomic.Pointer[pr.Container]{},
+		extractFn:    extractFn,
+		host:         host,
+		opsCancel:    opsCancel,
+		opsPublisher: opsPublisher,
+		recorder:     recorder,
+		svc:          svc,
+		term:         *term,
+	}, nil
+}
+
 func (t *taskBase[TaskSpec]) initTerm(shard consumer.Shard) error {
 	var next, err = newTaskTerm[TaskSpec](&t.term, t.extractFn, t.host, t.opsPublisher, shard)
 	if err != nil {
diff --git a/local/README.md b/local/README.md
new file mode 100644
index 00000000000..1e9f112d6e4
--- /dev/null
+++ b/local/README.md
@@ -0,0 +1,219 @@
+# Local Stack Architecture & Operations
+
+This directory holds the systemd units and helper scripts that `mise run local:*`
+glues together into a working Estuary stack. The interesting machinery is in
+`local/systemd/` (unit files) and `mise/tasks/local/` (drivers that emit env
+files and dropins, then `systemctl --user start`).
+
+## Topology
+
+```
+flow-supabase.service ──┐
+flow-config-encryption ─┤      flow-control-plane.target
+flow-control-agent.service ─┘   (8675 agent, 8765 config-encryption)
+
+flow-etcd.service  (single-node, http://etcd.flow.localhost:2379)
+
+flow-plane@<dp>.target ───────────  one per data plane
+  ├─ flow-gazette@<dp>-<port>            broker(s),  base_port + 0..9
+  ├─ flow-reactor@<dp>-<port>            reactor(s), base_port + 99..90
+  ├─ flow-runtime-sidecar@<dp>           Rust sidecar, base_port + 60 (gRPC) / +61 (admin HTTP)
+  ├─ flow-dekaf@<dp>                     Kafka shim,  base_port + 50/51/52
+  └─ flow-plane-link@<dp>                oneshot: POSTs to agent to register
+
+flow-dekaf-kafka.service                 Confluent Kafka in Docker, fixed :29092
+```
+
+`local:stack` boots the control plane plus a `local-cluster` data plane at
+port-block 8000 with 4 brokers, 1 reactor, dekaf, and link, and then publishes
+`ops-catalog/local-view.bundle.json` into it.
+
+## The port scheme is load-bearing
+
+Each data plane gets a 100-wide block starting on a multiple of 100; the
+per-service offsets within it (annotated in the topology diagram above) are
+fixed by the mise tasks, and the data-plane script rejects a base port that
+isn't `% 100 == 0`. One surprising consequence worth internalizing:
+reactors count *down* from the end of the block, so a "single reactor"
+lands on `block+99` — `local-cluster`'s sole reactor is at **8099**, not 8004.
+
+`mise/tasks/vm/port-forward` hardcodes three reserved blocks — **8000–8099**,
+**10000–10099**, **10100–10199** — so those are your three forwardable data
+planes from a VM.
+
+The dockerized Kafka that backs Dekaf consumer groups lives outside any block,
+on **:29092**, and is shared across all data planes.
+
+## Topology is built from drop-ins, not static units
+
+The template units in `local/systemd/` are deliberately minimal — they don't
+know about any specific data plane. mise tasks write out dropins under
+`~/.config/systemd/user/`:
+
+- `flow-plane@<dp>.target.d/wants-*.conf` — `Wants=` to pull each instance in
+- `flow-<svc>@<i>.service.d/plane.conf` — `PartOf=`/`After=` to bind to the target
+
+`PartOf=` is what makes `systemctl --user stop flow-plane@local-cluster.target`
+cascade-stop every broker, reactor, sidecar, dekaf, and link. `Wants=` does
+**not** cascade in reverse — starting the target pulls children up, but
+starting a child doesn't pull the target up.
+
+Useful incantations:
+
+```bash
+systemctl --user list-dependencies flow-plane@local-cluster.target
+systemctl --user list-units 'flow-*'
+journalctl --user -u flow-gazette@local-cluster-8000 -f
+journalctl --user -u flow-runtime-sidecar@local-cluster -f
+
+# Sidecar admin surface (loopback only): live Leader/Shuffle handlers, plus a
+# runtime trace-level control. E.g. raise handler 0 to TRACE, then clear it
+# (the level route is a POST — it mutates process state):
+curl -s localhost:8061/debug/handlers.json | jq
+curl -s -X POST localhost:8061/debug/handlers/0/level/trace
+curl -s -X POST localhost:8061/debug/handlers/0/level/off
+```
+
+## You don't have to run the whole stack
+
+`local:stack` is a convenience that chains `local:control-plane` →
+`local:data-plane local-cluster 8000 ...` → bundled-catalog publish. Each
+piece is its own task and pulls only what it needs via `#MISE depends=`:
+
+| Task | Pulls in | When you want it |
+| --- | --- | --- |
+| `local:supabase` | (just supabase) | Hacking migrations / pgTAP; running Rust integration tests |
+| `local:control-plane` | supabase, config-encryption, agent | Agent / controller work without any data plane |
+| `local:data-plane <name> <port>` | etcd, brokers, reactor, runtime-sidecar | A second data plane alongside `local-cluster` (use port-block 10000 or 10100), or a data plane with no control plane at all if you skip `--link` |
+| `local:data-plane-controller` | supabase | Dry-run controller convergence loop |
+
+There's no "down" for an individual task — use `systemctl --user stop` on the
+specific unit (or `flow-plane@<dp>.target` for a whole data plane). `local:stop`
+is the "burn it all" button.
+
+## `local:stop` is a guillotine
+
+It does much more than `systemctl stop`:
+
+```
+systemctl --user stop 'flow-*'
+rm -r ~/.config/systemd/user                 # ALL unit symlinks + dropins
+rm -r ~/flow-local/{builds,env,etcd,fragments}
+```
+
+So journal fragments, Etcd state, generated env files, and the topology dropins
+all vanish. If you want to bounce a service without nuking state, stop it
+directly. If you want to keep state across a planned restart, stop the target
+but leave `~/flow-local/` and `~/.config/systemd/user/` alone.
+
+Also note: `flow-plane-link@.service` has an `ExecStop=` that deletes
+`live_specs` + the data plane row from Postgres. That fires whenever the link
+service stops — even on a tidy `systemctl stop flow-plane@<dp>.target`.
+
+## Supabase: first start vs every subsequent start
+
+`flow-supabase.service` is unusual. Its `ExecStartPre`s:
+
+1. `supabase start --exclude edge-runtime` (idempotent, starts Docker containers)
+2. **If `~/flow-local/.supabase-started` exists**, `supabase db reset` — wipes
+   and re-applies migrations
+3. `touch ~/flow-local/.supabase-started`
+
+Then `ExecStart` runs `supabase functions serve` as the foreground process.
+`ExecStopPost` runs `supabase stop` to tear down the Docker containers.
+
+The implication: **every restart after the first one wipes the database**. If
+you `systemctl restart flow-supabase`, you lose all catalog state. If you want
+to preserve it, delete the flag file beforehand or just don't restart.
+
+## Secrets you might think are real but aren't
+
+- **`super-secret-jwt-token-with-at-least-32-characters-long`** — the Supabase
+  JWT secret. The pre-minted `SYSTEM_USER_TOKEN` baked into `plane-link-*.env`
+  is just a JWT signed with it for user `ffffffff-ffff-ffff-ffff-ffffffffffff`
+  (the `support@estuary.dev` system user), with exp in 2055.
+- **`AGE-SECRET-KEY-1UX6ZHA...`** — SOPS age key used by both reactor and
+  dekaf. Its public counterpart `age1z2qskpk...` is the `KMS_KEY` the
+  config-encryption service is configured with. Anything sops-encrypted by the
+  local stack opens with `export SOPS_AGE_KEY=AGE-SECRET-KEY-1UX...`.
+- **`key-<data-plane-name>`**, base64-encoded — the HMAC auth key shared by
+  brokers, reactors, runtime-sidecar, and the agent (via the link payload).
+  For `local-cluster` that's `a2V5LWxvY2FsLWNsdXN0ZXI=`.
+
+If you ever wonder "is this real" — none of these are; they're checked into
+the repo. If something else is hardcoded in mise tasks, assume the same.
+
+## TLS — one CA, one wildcard, everywhere
+
+`mise/tasks/local/tls-cert` generates a single self-signed CA and a single
+server cert in `~/flow-local/` with SAN `DNS:*.flow.localhost,DNS:flow.localhost,IP:127.0.0.1`.
+The cert is reused by every broker, reactor, and sidecar. Hosts use names like
+`broker-<dp>.flow.localhost` and `reactor-<dp>.flow.localhost` precisely so
+they validate against the wildcard. Certs are long-lived (365 days).
+
+`.flow.localhost` works without `/etc/hosts` entries: systemd-resolved
+implements RFC 6761 and resolves any `*.localhost` to `::1`/`127.0.0.1`.
+
+## Where state lives
+
+| Path | What |
+| --- | --- |
+| `~/flow-local/ca.{crt,key}`, `server.{crt,key}` | TLS material |
+| `~/flow-local/env/*.env` | Generated systemd env files, one per instance |
+| `~/flow-local/etcd/` | Etcd data dir |
+| `~/flow-local/fragments/<dp>/` | Gazette journal fragments (file-only mode) |
+| `~/flow-local/builds/` | Catalog builds emitted by the agent |
+| `~/flow-local/.supabase-started` | Sentinel that triggers `db reset` on next supabase start |
+| `~/.config/systemd/user/flow-*` | Linked unit files + drop-in topology |
+
+Binaries: the unit files run `~/cargo-target/debug/<crate>` because
+`CARGO_TARGET_DIR=~/cargo-target` is set by mise, not under the repo. Most
+units have an `ExecStartPre=cargo build -p <crate>` so a unit restart picks up
+your latest source — handy when iterating.
+
+## Provisioning tenant credentials
+
+After data plane(s) are started, register a new tenant and credentials:
+```bash
+mise run local:test-tenant --tenant acmeCo --user alice@example.com
+source ~/flow-local/test-tenant.env # Written by test-tenant.
+flowctl --profile local catalog list
+```
+
+flowctl picks up and uses `FLOW_AUTH_TOKEN` (a refresh token),
+which takes precedence over loaded config.
+
+## flowctl against the local stack
+
+`flowctl --profile local` flips a single boolean in flowctl's config that
+swaps every URL to a localhost equivalent:
+
+| | local | default |
+| --- | --- | --- |
+| agent | `http://localhost:8675` | `https://api.estuary.dev` |
+| postgrest | `http://localhost:5431/rest/v1` | hosted |
+| dashboard | `http://localhost:3000` | hosted |
+| config-encryption | `http://localhost:8765` | hosted |
+
+The `--profile` flag also controls which config file in
+`~/.config/flowctl/` is loaded.
+
+## Connectors run on the Supabase Docker network
+
+Reactor and agent set `FLOW_NETWORK=supabase_network_flow` (see
+`mise/tasks/local/reactor`), so connector containers — at build/discover time
+and at runtime — run on that Docker network, not the default bridge. The handy
+consequence: a connector endpoint config can point straight at the Supabase
+Postgres, which sits on the same network as `supabase_db_flow` and answers to
+`db:5432`. Any *other* service a connector needs has to be `docker network
+connect supabase_network_flow`'d first, and then addressed by container name.
+
+## What `local:stack` is actually publishing
+
+After the data plane comes up, `local:stack` opens a psql session and writes a
+draft + publication of `ops-catalog/local-view.bundle.json` to the
+`ops/dp/public/local-cluster` data plane, as the system user
+`support@estuary.dev`. This is what makes `flowctl --profile local catalog list`
+return the `ops/rollups/...` and `ops/dp/public/local-cluster/...` specs.
+`local/ops-publication.sh` is the standalone version of that same SQL if you
+want to publish your own bundle the same way.
diff --git a/local/systemd/flow-runtime-sidecar@.service b/local/systemd/flow-runtime-sidecar@.service
new file mode 100644
index 00000000000..b9030f2de64
--- /dev/null
+++ b/local/systemd/flow-runtime-sidecar@.service
@@ -0,0 +1,16 @@
+[Unit]
+Description=Flow Runtime Sidecar (%i)
+Documentation=https://github.com/estuary/flow
+
+[Service]
+Type=simple
+TimeoutStartSec=600
+
+EnvironmentFile=%h/flow-local/env/common.env
+EnvironmentFile=%h/flow-local/env/runtime-sidecar-%i.env
+
+ExecStartPre=sh -c 'cd ${FLOW_ROOT} && cargo build -p runtime-sidecar'
+ExecStart=%h/cargo-target/debug/runtime-sidecar
+
+Restart=on-failure
+RestartSec=5s
diff --git a/mise.toml b/mise.toml
index 145b0efe403..355d60d3a73 100644
--- a/mise.toml
+++ b/mise.toml
@@ -9,7 +9,7 @@ go = { version = "1.25" }
 "github:wasm-bindgen/wasm-pack" = { version = "0.13.1" }
 "github:etcd-io/etcd" = { version = "3.5.24" }
 "github:getsops/sops" = { version = "3.11.0", bin = "sops" }
-"github:jdx/usage" = { version = "2.6.0" }
+"github:jdx/usage" = { version = "2.11.0" }
 "github:mozilla/sccache" = { version = "0.12.0", platforms = { linux-arm64 = { asset_pattern = "sccache-v*-aarch64-unknown-linux-musl.tar.gz" }, linux-x64 = { asset_pattern = "sccache-v*-x86_64-unknown-linux-musl.tar.gz" }, macos-arm64 = { asset_pattern = "sccache-v*-aarch64-apple-darwin.tar.gz" } } }
 "github:nextest-rs/nextest" = { version = "cargo-nextest-0.9.114" }
 "github:rui314/mold" = { version = "2.40.4" }
diff --git a/mise/README.md b/mise/README.md
index e244745d5f2..68a920b4a3e 100644
--- a/mise/README.md
+++ b/mise/README.md
@@ -291,6 +291,7 @@ mise tasks
 | `local:control-plane`            | Start control plane only                                    |
 | `local:data-plane <name> <port>` | Start a data plane                                          |
 | `local:data-plane-controller`    | Start data-plane-controller (service + job) in dry-run mode |
+| `local:runtime-sidecar`          | Start runtime-v2 sidecar for a local data plane             |
 | `local:seed-controller-job`      | Seed a controller job to trigger data plane converge        |
 | `local:supabase`                 | Start Supabase only                                         |
 | `local:stop`                     | Stop all services and clean up                              |
diff --git a/mise/tasks/ci/dekaf-e2e b/mise/tasks/ci/dekaf-e2e
index 6a212dda889..ba4485b2759 100755
--- a/mise/tasks/ci/dekaf-e2e
+++ b/mise/tasks/ci/dekaf-e2e
@@ -2,7 +2,6 @@
 set -euo pipefail
 
 #MISE description="Run Dekaf E2E tests"
-#MISE depends=["local:test-tenant"]
 #USAGE flag "--filter <filter>" help="Test filter pattern for nextest"
 #USAGE flag "--update-snapshots" help="Update insta snapshots"
 #USAGE flag "--concurrency <concurrency>" help="How many tests to run at once"
@@ -20,36 +19,18 @@ CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-${HOME}/cargo-target}"
 DEKAF1_KAFKA_PORT=8050  # 8000 + 50
 DEKAF2_KAFKA_PORT=8250  # 8200 + 50
 
-SYSTEM_USER_TOKEN="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjU0MzEvYXV0aC92MSIsInN1YiI6ImZmZmZmZmZmLWZmZmYtZmZmZi1mZmZmLWZmZmZmZmZmZmZmZiIsImF1ZCI6ImF1dGhlbnRpY2F0ZWQiLCJleHAiOjI3MDAwMDAwMDAsImlhdCI6MTcwMDAwMDAwMCwiZW1haWwiOiJzdXBwb3J0QGVzdHVhcnkuZGV2Iiwicm9sZSI6ImF1dGhlbnRpY2F0ZWQiLCJpc19hbm9ueW1vdXMiOmZhbHNlfQ.Nb-N4s_YnObBHGivSTe_8FEniVUUpehzrRkF5JgNWWU"
-
-# Wait for agent to be ready by checking if it's listening
-echo "Waiting for agent..."
-TIMEOUT=120
-ELAPSED=0
-until nc -z localhost 8675 2>/dev/null; do
-    sleep 1
-    ELAPSED=$((ELAPSED + 1))
-    if [ "${ELAPSED}" -ge "${TIMEOUT}" ]; then
-        echo "Error: Agent failed to start within ${TIMEOUT} seconds"
-        exit 1
-    fi
-done
-echo "Agent is ready"
-
 echo "Building flowctl..."
 cargo build -p flowctl --quiet
 
-# local-cluster with Dekaf is expected to already be running from local:stack
-# Only set up local-cluster-2 for migration tests
+# local-cluster with Dekaf is expected to already be running from local:stack.
+# Bring up local-cluster-2 BEFORE provisioning the tenant so that its
+# initialized storage mapping picks up both public planes.
 echo "Setting up local-cluster-2 dataplane with Dekaf..."
 mise run local:data-plane local-cluster-2 8200 --num-brokers 4 --num-reactors 1 --link --dekaf
 
-echo "Updating storage mappings for migration tests..."
-psql "postgresql://postgres:postgres@localhost:5432/postgres" -c "
-    UPDATE storage_mappings
-    SET spec = jsonb_set(spec::jsonb, '{data_planes}', '[\"ops/dp/public/local-cluster\", \"ops/dp/public/local-cluster-2\"]')
-    WHERE catalog_prefix = 'test/';
-"
+echo "Provisioning test tenant..."
+mise run local:test-tenant
+source "${FLOW_LOCAL}/test-tenant.env"
 
 echo "Waiting for Dekaf instances..."
 TIMEOUT=60
@@ -72,7 +53,6 @@ echo "Running Dekaf E2E tests..."
 export DEKAF_BROKER="localhost:${DEKAF1_KAFKA_PORT}"
 export DEKAF_REGISTRY="http://localhost:$((DEKAF1_KAFKA_PORT + 1))"
 export SSL_CERT_FILE="${FLOW_LOCAL}/ca.crt"
-export FLOW_ACCESS_TOKEN="${SYSTEM_USER_TOKEN}"
 export DEKAF_UPSTREAM_BROKER_URLS="tcp://localhost:29092"
 export DEKAF_ENCRYPTION_SECRET="test-encryption-secret-32-bytes!"
 
diff --git a/mise/tasks/local/common b/mise/tasks/local/common
index 9301bf855fd..41f667ad980 100755
--- a/mise/tasks/local/common
+++ b/mise/tasks/local/common
@@ -14,7 +14,9 @@ cat > "${FLOW_LOCAL}/env/common.env" <<EOF
 # Generated by mise ($(date))
 
 # PATH includes mise-installed binaries, cargo target directories for debug
-# and musl-debug binaries, and the Go bin dir.
+# and musl-debug binaries, and the Go bin dir. We prefer musl over glibc.
+# If we didn't, an over-broad "cargo build" can build a flow-connector-init
+# that's preferred over the musl one when injecting into a container.
 
 CARGO_TARGET_DIR="${CARGO_TARGET_DIR}"
 CGO_CFLAGS="${CGO_CFLAGS}"
@@ -22,7 +24,7 @@ CGO_CPPFLAGS="${CGO_CPPFLAGS}"
 CGO_LDFLAGS="${CGO_LDFLAGS}"
 FLOW_ROOT="$(pwd)"
 JEMALLOC_OVERRIDE="${JEMALLOC_OVERRIDE}"
-PATH="${PATH}:${CARGO_TARGET_DIR}/debug/:${CARGO_TARGET_DIR}/$(uname -m)-unknown-linux-musl/debug/:${HOME}/go/bin/"
+PATH="${PATH}:${CARGO_TARGET_DIR}/$(uname -m)-unknown-linux-musl/debug/:${CARGO_TARGET_DIR}/debug/:${HOME}/go/bin/"
 ROCKSDB_INCLUDE_DIR="${ROCKSDB_INCLUDE_DIR}"
 ROCKSDB_LIB_DIR="${ROCKSDB_LIB_DIR}"
 ROCKSDB_VERSION="${ROCKSDB_VERSION}"
diff --git a/mise/tasks/local/data-plane b/mise/tasks/local/data-plane
index 8a57e910d67..74a229107b8 100755
--- a/mise/tasks/local/data-plane
+++ b/mise/tasks/local/data-plane
@@ -23,20 +23,26 @@ if [ $((PORT_BLOCK % 100)) -ne 0 ]; then
     exit 1
 fi
 
-# Validate that we don't exceed the 100-port block limit
-TOTAL_INSTANCES=$((N_BROKERS + N_REACTORS))
-if [ "${TOTAL_INSTANCES}" -gt 100 ]; then
-    echo "Error: Total instances (${N_BROKERS} brokers + ${N_REACTORS} reactors = ${TOTAL_INSTANCES}) exceeds 100-port block limit" >&2
+# Cap brokers and reactors at 10 each. Brokers occupy base_port+0..+9 and
+# reactors occupy base_port+90..+99, leaving the +50/+51/+52 Dekaf ports
+# and the +60 runtime-sidecar gRPC / +61 runtime-sidecar admin ports reserved.
+if [ "${N_BROKERS}" -gt 10 ]; then
+    echo "Error: --num-brokers ${N_BROKERS} exceeds the per-data-plane limit of 10" >&2
+    exit 1
+fi
+if [ "${N_REACTORS}" -gt 10 ]; then
+    echo "Error: --num-reactors ${N_REACTORS} exceeds the per-data-plane limit of 10" >&2
     exit 1
 fi
 
 FLOW_LOCAL="${HOME}/flow-local"
 HMAC_KEY=$(echo -n "key-${DATA_PLANE}" | base64 | tr -d '\n')
 
-# Deterministic Dekaf port allocation within the 100-port block
+# Deterministic port allocations within the 100-port block
 DEKAF_KAFKA_PORT=$((PORT_BLOCK + 50))
 DEKAF_REGISTRY_PORT=$((PORT_BLOCK + 51))
 DEKAF_METRICS_PORT=$((PORT_BLOCK + 52))
+SIDECAR_PORT=$((PORT_BLOCK + 60))
 
 # Start broker instances if requested
 if [ "${N_BROKERS}" -gt 0 ] 2>/dev/null; then
diff --git a/mise/tasks/local/gazette b/mise/tasks/local/gazette
index 3fd883b5439..cf63e86d13c 100755
--- a/mise/tasks/local/gazette
+++ b/mise/tasks/local/gazette
@@ -10,6 +10,11 @@ DATA_PLANE="${usage_data_plane}"
 BASE_PORT="${usage_base_port}"
 COUNT="${usage_count}"
 
+if [ "${COUNT}" -gt 10 ]; then
+    echo "Error: --count ${COUNT} exceeds the per-data-plane broker limit of 10" >&2
+    exit 1
+fi
+
 FLOW_LOCAL="${HOME}/flow-local"
 HMAC_KEY=$(echo -n "key-${DATA_PLANE}" | base64 | tr -d '\n')
 
diff --git a/mise/tasks/local/reactor b/mise/tasks/local/reactor
index 02081930329..e52317d66aa 100755
--- a/mise/tasks/local/reactor
+++ b/mise/tasks/local/reactor
@@ -12,8 +12,16 @@ BASE_PORT="${usage_base_port}"
 BROKER_PORT="${usage_broker_port}"
 COUNT="${usage_count}"
 
+if [ "${COUNT}" -gt 10 ]; then
+    echo "Error: --count ${COUNT} exceeds the per-data-plane reactor limit of 10" >&2
+    exit 1
+fi
+
 FLOW_LOCAL="${HOME}/flow-local"
 HMAC_KEY=$(echo -n "key-${DATA_PLANE}" | base64 | tr -d '\n')
+SIDECAR_PORT=$((BROKER_PORT + 60))
+
+mise run local:runtime-sidecar "${DATA_PLANE}" "${BROKER_PORT}"
 
 # Configure all reactor instances
 for i in $(seq 0 $((COUNT - 1))); do
@@ -29,7 +37,7 @@ for i in $(seq 0 $((COUNT - 1))); do
 
 # Note the local cert is signed with a wildcard of *.flow.localhost,
 # and CONSUMER_HOST must match for the connector networking feature to function.
-# SSL_CERT_FILE is required for calls to the control agent API.
+# SSL_CERT_FILE is required for calls to the runtime sidecar and agent API.
 
 BROKER_ADDRESS=https://broker-${DATA_PLANE}.flow.localhost:${BROKER_PORT}
 BROKER_AUTH_KEYS=${HMAC_KEY}
@@ -44,6 +52,7 @@ CONSUMER_PEER_CA_FILE=${FLOW_LOCAL}/ca.crt
 CONSUMER_PORT=${REACTOR_PORT}
 CONSUMER_SERVER_CERT_FILE=${FLOW_LOCAL}/server.crt
 CONSUMER_SERVER_CERT_KEY_FILE=${FLOW_LOCAL}/server.key
+CONSUMER_ZONE=local
 ETCD_ADDRESS=http://etcd.flow.localhost:2379
 ETCD_PREFIX=/flow/${DATA_PLANE}
 FLOW_ALLOW_LOCAL=true
@@ -52,8 +61,9 @@ FLOW_CONTROL_API=http://agent.flow.localhost:8675
 FLOW_DASHBOARD=http://localhost:3000
 FLOW_DATA_PLANE_FQDN=${DATA_PLANE}.dp.estuary-data.com
 FLOW_NETWORK=supabase_network_flow
+FLOW_SIDECAR_PORT=${SIDECAR_PORT}
 LOG_LEVEL=info
-SSL_CERT_FILE=${FLOW_LOCAL}/ca.crt # Required for agent API calls.
+SSL_CERT_FILE=${FLOW_LOCAL}/ca.crt
 
 # Test (non-production) key for local development.
 # This matches KMS_KEY in the control-plane development task.
@@ -67,6 +77,7 @@ EOF
 [Unit]
 PartOf=flow-plane@${DATA_PLANE}.target
 After=flow-plane@${DATA_PLANE}.target
+After=flow-runtime-sidecar@${DATA_PLANE}.service
 EOF
 
     DROPIN_DIR="${HOME}/.config/systemd/user/flow-plane@${DATA_PLANE}.target.d"
diff --git a/mise/tasks/local/runtime-sidecar b/mise/tasks/local/runtime-sidecar
new file mode 100755
index 00000000000..2fc26fa6eb4
--- /dev/null
+++ b/mise/tasks/local/runtime-sidecar
@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+#MISE description="Start runtime-v2 sidecar for a local data plane via systemd"
+#MISE depends=["local:common", "local:tls-cert"]
+#USAGE arg "<data_plane>" help="Name of the data plane"
+#USAGE arg "<base_port>" help="Base port block for the data plane"
+
+DATA_PLANE="${usage_data_plane}"
+BASE_PORT="${usage_base_port}"
+
+FLOW_LOCAL="${HOME}/flow-local"
+HMAC_KEY=$(echo -n "key-${DATA_PLANE}" | base64 | tr -d '\n')
+SIDECAR_PORT=$((BASE_PORT + 60))
+ADMIN_PORT=$((BASE_PORT + 61))
+
+if [ $((BASE_PORT % 100)) -ne 0 ]; then
+    echo "Error: Port block ${BASE_PORT} must be divisible by 100 (e.g., 8100, 9600)" >&2
+    exit 1
+fi
+
+cat > "${FLOW_LOCAL}/env/runtime-sidecar-${DATA_PLANE}.env" <<EOF
+# Runtime sidecar environment for ${DATA_PLANE}
+# Generated by mise ($(date))
+
+ADMIN_PORT=${ADMIN_PORT}
+AGENT_ENDPOINT=http://agent.flow.localhost:8675
+CERTIFICATE_FILE=${FLOW_LOCAL}/server.crt
+CERTIFICATE_KEY_FILE=${FLOW_LOCAL}/server.key
+DATA_PLANE_AUTH_KEYS=${HMAC_KEY}
+DATA_PLANE_FQDN=${DATA_PLANE}.dp.estuary-data.com
+GAZETTE_ZONE=local
+LISTEN_PORT=${SIDECAR_PORT}
+NO_COLOR=1
+PEER_ENDPOINT=https://reactor-${DATA_PLANE}.flow.localhost:${SIDECAR_PORT}
+RUST_LOG=info
+SSL_CERT_FILE=${FLOW_LOCAL}/ca.crt
+EOF
+
+# Bind this sidecar to the data-plane target.
+DROPIN_DIR="${HOME}/.config/systemd/user/flow-runtime-sidecar@${DATA_PLANE}.service.d"
+mkdir -p "$DROPIN_DIR"
+cat > "${DROPIN_DIR}/plane.conf" <<EOF
+[Unit]
+PartOf=flow-plane@${DATA_PLANE}.target
+After=flow-plane@${DATA_PLANE}.target
+EOF
+
+DROPIN_DIR="${HOME}/.config/systemd/user/flow-plane@${DATA_PLANE}.target.d"
+mkdir -p "$DROPIN_DIR"
+cat > "${DROPIN_DIR}/wants-runtime-sidecar.conf" <<EOF
+[Unit]
+Wants=flow-runtime-sidecar@${DATA_PLANE}.service
+EOF
+
+TEMPLATE_UNIT="${HOME}/.config/systemd/user/flow-runtime-sidecar@.service"
+if [ ! -f "$TEMPLATE_UNIT" ]; then
+    ln -sf "$(pwd)/local/systemd/flow-plane@.target" "${HOME}/.config/systemd/user/flow-plane@.target"
+    ln -sf "$(pwd)/local/systemd/flow-runtime-sidecar@.service" "$TEMPLATE_UNIT"
+fi
+
+systemctl --user daemon-reload
+systemctl --user restart "flow-runtime-sidecar@${DATA_PLANE}.service"
+
+echo "Created flow-runtime-sidecar@${DATA_PLANE} on port ${SIDECAR_PORT} (admin: http://127.0.0.1:${ADMIN_PORT}/)"
diff --git a/mise/tasks/local/test-tenant b/mise/tasks/local/test-tenant
index 2013e47e480..79247b3a3c6 100755
--- a/mise/tasks/local/test-tenant
+++ b/mise/tasks/local/test-tenant
@@ -1,31 +1,145 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-#MISE description="Provision test/ tenant for integration tests"
+#MISE description="Provision a tenant via the onboarding API and emit flowctl credentials"
+#MISE depends=["local:control-plane"]
+#USAGE flag "--tenant <tenant>" help="Tenant name without trailing slash (default: test)"
+#USAGE flag "--user <user>" help="Email of an auth.users row to own the tenant (default: alice@example.com). NOTE: onboarding API rejects users that already hold any grants, so each seeded user (alice/bob/carol/dave from seed.sql) can own at most one tenant."
 
+TENANT="${usage_tenant:-test}"
+USER_EMAIL="${usage_user:-alice@example.com}"
 PGURL="postgresql://postgres:postgres@localhost:5432/postgres"
-DATA_PLANE_NAME="ops/dp/public/local-cluster"
-
-echo "Provisioning test/ tenant..."
-
-psql "${PGURL}" -c "
-INSERT INTO public.storage_mappings (catalog_prefix, spec)
-VALUES
-  ('test/', '{\"stores\": [{\"provider\": \"GCS\", \"bucket\": \"estuary-trial\", \"prefix\": \"collection-data/\"}], \"data_planes\": [\"${DATA_PLANE_NAME}\"]}'),
-  ('recovery/test/', '{\"stores\": [{\"provider\": \"GCS\", \"bucket\": \"estuary-trial\"}]}')
-ON CONFLICT (catalog_prefix) DO NOTHING;
-"
-
-# Grant admin access to support@estuary.dev for test/ prefix
-psql "${PGURL}" -c "
-INSERT INTO public.user_grants (user_id, object_role, capability)
-VALUES ('ffffffff-ffff-ffff-ffff-ffffffffffff', 'test/', 'admin')
-ON CONFLICT (user_id, object_role) DO NOTHING;
-"
-
-# Grant role permissions so tasks within test/ can read/write to each other
-psql "${PGURL}" -c "
-INSERT INTO public.role_grants (subject_role, object_role, capability)
-VALUES ('test/', 'test/', 'admin')
-ON CONFLICT (subject_role, object_role) DO NOTHING;
-"
+ENV_FILE="${HOME}/flow-local/test-tenant.env"
+AGENT_PORT=8675
+
+# Onboarding rejects names that don't satisfy the catalog_tenant regex.
+if [[ ! "${TENANT}" =~ ^[A-Za-z0-9._-]+$ ]]; then
+    echo "Error: --tenant '${TENANT}' must match [A-Za-z0-9._-]+ (no trailing slash, no '/')" >&2
+    exit 1
+fi
+# Guard against SQL injection through unquoted interpolations below.
+if [[ ! "${USER_EMAIL}" =~ ^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+$ ]]; then
+    echo "Error: --user '${USER_EMAIL}' is not a valid email address" >&2
+    exit 1
+fi
+
+echo "Waiting for agent on :${AGENT_PORT}..."
+ELAPSED=0
+TIMEOUT=120
+until nc -z localhost "${AGENT_PORT}" 2>/dev/null; do
+    sleep 1
+    ELAPSED=$((ELAPSED + 1))
+    if [ "${ELAPSED}" -ge "${TIMEOUT}" ]; then
+        echo "Error: agent did not start within ${TIMEOUT}s" >&2
+        exit 1
+    fi
+done
+
+USER_ID=$(psql "${PGURL}" -tAqc \
+    "SELECT id FROM auth.users WHERE email = '${USER_EMAIL}'")
+if [ -z "${USER_ID}" ]; then
+    echo "Error: no auth.users row with email '${USER_EMAIL}'" >&2
+    echo "Hint: seed.sql provisions alice/bob/carol/dave@example.com" >&2
+    exit 1
+fi
+
+PREFIX="${TENANT}/"
+TENANT_EXISTS=$(psql "${PGURL}" -tAqc \
+    "SELECT 1 FROM public.tenants WHERE tenant = '${PREFIX}'")
+
+if [ -z "${TENANT_EXISTS}" ]; then
+    # Onboarding snapshots the set of `ops/dp/public/*` data planes into
+    # storage_mappings.data_planes at provisioning time. Adding a data plane
+    # later and re-running this task will NOT update that snapshot — bring up
+    # every data plane the tenant should use before provisioning.
+    echo "Provisioning tenant ${PREFIX} owned by ${USER_EMAIL} via onboarding API..."
+
+    # Insert with the default queued status; the create_directive_task trigger
+    # enqueues an agent task and applied_directives_agent_notifications wakes
+    # the agent. user_claims must be set or the trigger won't fire.
+    APPLIED_ID=$(psql "${PGURL}" -tAqc "
+        INSERT INTO public.applied_directives (directive_id, user_id, user_claims)
+        SELECT id, '${USER_ID}'::uuid, '{\"requestedTenant\":\"${TENANT}\"}'::json_obj
+        FROM public.directives
+        WHERE token = '453e00cd-e12a-4ce5-b12d-3837aa385751'
+        RETURNING id
+    ")
+    if [ -z "${APPLIED_ID}" ]; then
+        echo "Error: betaOnboard directive (token 453e00cd-...) not found in directives table" >&2
+        exit 1
+    fi
+
+    echo "Waiting for agent to apply directive ${APPLIED_ID}..."
+    ELAPSED=0
+    TIMEOUT=60
+    while true; do
+        STATUS=$(psql "${PGURL}" -tAqc \
+            "SELECT job_status->>'type' FROM public.applied_directives WHERE id = '${APPLIED_ID}'")
+        case "${STATUS}" in
+            success)
+                break
+                ;;
+            queued)
+                ;;
+            *)
+                ERR=$(psql "${PGURL}" -tAqc \
+                    "SELECT job_status->>'error' FROM public.applied_directives WHERE id = '${APPLIED_ID}'")
+                echo "Error: betaOnboard returned status '${STATUS}': ${ERR}" >&2
+                exit 1
+                ;;
+        esac
+        sleep 1
+        ELAPSED=$((ELAPSED + 1))
+        if [ "${ELAPSED}" -ge "${TIMEOUT}" ]; then
+            echo "Error: directive did not apply within ${TIMEOUT}s (still ${STATUS})" >&2
+            exit 1
+        fi
+    done
+    echo "Tenant ${PREFIX} provisioned."
+else
+    echo "Tenant ${PREFIX} already exists; skipping provisioning."
+fi
+
+# Onboarding stamps the default per-tenant quotas (10 tasks / 500 collections).
+# Raise the ceiling well above anything a test run could reach.
+psql "${PGURL}" -tAqc \
+    "UPDATE public.tenants SET tasks_quota = 1000, collections_quota = 1000 WHERE tenant = '${PREFIX}'" >/dev/null
+
+echo "Minting multi-use refresh token for ${USER_EMAIL}..."
+# Insert directly (bypassing create_refresh_token's SECURITY DEFINER + auth_uid())
+# so we don't need to fake JWT claims. We control the DB here.
+TOKEN_JSON=$(psql "${PGURL}" -tAqc "
+    WITH gen AS (
+        SELECT gen_random_uuid()::text AS secret
+    ),
+    ins AS (
+        INSERT INTO public.refresh_tokens (user_id, multi_use, valid_for, hash, detail)
+        SELECT '${USER_ID}'::uuid, true, interval '90 days', crypt(gen.secret, gen_salt('bf')),
+               'local:test-tenant'
+        FROM gen
+        RETURNING id
+    )
+    SELECT json_build_object('id', ins.id, 'secret', gen.secret)::text
+    FROM ins, gen
+")
+if [ -z "${TOKEN_JSON}" ]; then
+    echo "Error: failed to mint refresh token" >&2
+    exit 1
+fi
+
+FLOW_AUTH_TOKEN=$(printf '%s' "${TOKEN_JSON}" | base64 -w0)
+
+mkdir -p "$(dirname "${ENV_FILE}")"
+cat > "${ENV_FILE}" <<EOF
+# Generated by mise run local:test-tenant.
+# Source this to authenticate flowctl --profile local as ${USER_EMAIL}
+# against tenant ${PREFIX}.
+export FLOW_AUTH_TOKEN='${FLOW_AUTH_TOKEN}'
+export FLOW_TEST_TENANT='${TENANT}'
+export FLOW_TEST_USER_EMAIL='${USER_EMAIL}'
+export FLOW_TEST_USER_ID='${USER_ID}'
+EOF
+
+echo "Wrote credentials to ${ENV_FILE}"
+echo "  source ${ENV_FILE}"
+echo "  flowctl --profile local catalog list"
diff --git a/plans/runtime-v2/plan.md b/plans/runtime-v2/plan.md
index 63ef8a52943..76e9690e9f5 100644
--- a/plans/runtime-v2/plan.md
+++ b/plans/runtime-v2/plan.md
@@ -38,10 +38,10 @@ Reactor machine
   │         │    (RocksDB + Go Recorder on the shard hosting the recovery log)
   │         └─ Capture: per-shard RocksDB with Go Recorder
   │
-  └─ shuffle sidecar process (Rust, one per machine, systemd-supervised)
+  └─ runtime sidecar process (Rust, one per machine, systemd-supervised)
        ├─ Shuffle Leader service (per-task, via join pattern)
        ├─ Shuffle service (Session/Slice/Log RPCs)
-       └─ Listens on the fixed shuffle port (same across the fleet)
+       └─ Listens on the fixed sidecar port (same across the fleet)
 ```
 
 Three layers interact:
@@ -75,7 +75,7 @@ Three layers interact:
    - For captures: each shard manages its own state independently,
      persisting to its own RocksDB via its own recovery log.
 
-3. **Shuffle sidecar process** (pure Rust), one per reactor machine,
+3. **Runtime sidecar process** (pure Rust), one per reactor machine,
    supervised by systemd with the same lifetime as the reactor
    process(es). Hosts two gRPC services for *all* tasks on the machine:
 
@@ -85,7 +85,7 @@ Three layers interact:
    - **Shuffle** (`crates/shuffle/`, Session/Slice/Log RPCs): accepts
      shuffle RPCs from any reactor participating in a task.
 
-   Both listen on the **shuffle port**: a fixed CLI argument, shared
+   Both listen on the **sidecar port**: a fixed CLI argument, shared
    fleet-wide. A reactor reaches any peer sidecar by replacing the
    port of that peer's `ProcessSpec.endpoint`. One sidecar serves
    multiple co-located reactor processes on the same machine (used
@@ -95,6 +95,24 @@ Three layers interact:
    logs, not task logs. Captures don't use the Shuffle Leader or
    shuffle services, but the sidecar runs uniformly regardless.
 
+   - **Admin surface** (`crates/service-kit/`): when `--admin-port` is
+     set, the sidecar serves a loopback-only HTTP page (and
+     `/debug/handlers.json`) listing every in-flight Leader / Shuffle
+     handler with a coarse lifecycle phase, and a `POST
+     /debug/handlers/{id}/level/{level}` control that raises one
+     handler's `tracing` verbosity at runtime — useful for inspecting a
+     wedged handler whose actor loops emit `trace!`-level instrumentation
+     on a ticker. Each handler runs inside a `service_kit::handler` span;
+     `service_kit::trace::layer_filter` composes the sidecar's base
+     `EnvFilter` with a per-handler override filter that admits events at
+     or above an enclosing handler span's override level. Both gRPC
+     services register their spawned handlers in a shared
+     `service_kit::Registry`. `runtime-next` and `shuffle` both depend on
+     `service-kit` (it's a leaf, service-agnostic crate; `shuffle` can't
+     depend on `runtime-next`). Local stacks bind the admin surface at
+     `base_port + 61`. `service-kit` is also the intended home for a
+     future Prometheus `/metrics` handler.
+
    *Why a sidecar rather than in-process via CGO.* The shuffle stack
    and per-shard TaskService already communicate solely by gRPC with
    no shared memory, so the process boundary aligns with an existing
@@ -102,6 +120,15 @@ Three layers interact:
    a smaller reactor Rust + CGO surface. A sidecar crash fail-stops
    every joined session on the machine.
 
+   **Local stack exception.** Production continues to run one sidecar
+   per reactor machine. Local development runs one sidecar per data
+   plane on a deterministic port inside that plane's 100-port block:
+   `base_port + 60`. The local sidecar advertises
+   `https://reactor-${DATA_PLANE}.flow.localhost:${SIDECAR_PORT}` and
+   uses the same per-data-plane HMAC key and FQDN as the local reactor.
+   This preserves per-plane auth isolation without teaching the
+   sidecar to multiplex credentials for multiple local data planes.
+
 The sidecar and per-shard TaskServices communicate only via the
 Shuffle Leader protocol and the shuffle Session/Slice/Log RPCs over
 gRPC — never via shared memory.
@@ -183,6 +210,35 @@ new code must continue to honor:
   the task still has per-shard committed state, and startup fails
   explicitly instead of proceeding with an unsafe consolidation.
 
+## Frontier pruning
+
+Long-lived tasks can accumulate committed frontier entries for producers
+that have stopped writing, including producers that wrote `CONTINUE_TXN`
+documents but never later committed them. V2 should eventually retain
+only enough producer frontier state to preserve exactly-once recovery for
+plausibly active producers, while bounding startup cost, RocksDB size, and
+the replay distance implied by abandoned transactions.
+
+Pruning should be conservative. A producer is a candidate only after both
+the clock horizon and byte-distance horizon say that enough newer activity
+has passed within the same source journal and binding. Time protects
+high-volume journals from eager cleanup when another producer quickly
+writes far ahead; byte distance captures the real operational cost of
+keeping an old pending span replayable. Frontier
+entries that participate in recovered hinted state are not ordinary stale
+state and must not be silently removed.
+
+The cleanup point is recovery scan, not `Persist`. `Persist` writes
+frontiers as fine-grained `FC:{journal}\0{state_key}\0{producer}` and
+`FH:{journal}\0{state_key}\0{producer}` key updates, and the leader should
+not need to hold or rewrite a fully reduced committed frontier after V1
+migration is complete. During RocksDB scan, shard zero can group recovered
+`FC:` entries by raw `(journal, state_key)`, compute the latest producer
+clock and read offset for the group, drop entries that satisfy the pruning
+policy, and write a small delete batch for the pruned `FC:` keys before
+returning `Recover`. `FH:` entries form a protected set: matching `FC:`
+entries are retained so idempotent replay has its committed baseline.
+
 ## Capture architecture
 
 Capture shards operate **independently** — each shard has its own
@@ -229,10 +285,26 @@ complete runtime in stages of increasing blast radius.
 - **Per-task**: feature flags on shard labels select old vs new runtime.
   All shards of a task use the same runtime.
 - **Coexistence**: old-runtime and new-runtime tasks run on the same
-  reactor. The shuffle sidecar runs uniformly on every reactor
+  reactor. The runtime sidecar runs uniformly on every reactor
   machine regardless of which tasks are assigned; old-runtime tasks
   simply don't talk to it. The only change to the existing `runtime`
   crate is Frontier-aware rollback (the migration swap on startup,
   using `runtime_next::leader::materialize::frontier_mapping`).
 - **Rollback**: switching a task's feature flag back to the old runtime
   is a per-task operation. No global rollback needed.
+- **Dropping rollback support**: while V1 rollback is retained, the leader
+  keeps maintaining a legacy `consumer.Checkpoint` (the `checkpoint` RocksDB
+  key) so the old runtime can resume from it. Once a task has stably cut
+  over, the per-task `estuary.dev/flag/drop-runtime-v1-rollback` shard label
+  tells the leader to stop maintaining it.
+- **Startup checkpoint reconciliation**: the legacy V1 checkpoint holds a
+  *complete* committed frontier, but V2 writes `FC:` keys as per-transaction
+  *deltas* — so at cutover the recovered `FC:` keys are not yet a sound
+  recovery baseline. After the connector `Open`/`Opened` exchange, once the
+  final status of the recovered V1 checkpoint and any remote-authoritative
+  connector checkpoint is known, `startup` issues one cleanup `Persist` to
+  shard zero: if a checkpoint was authoritative (its mapped frontier replaced
+  the recovered one) it clears all `FC:` keys and rewrites the complete
+  baseline; if `drop-runtime-v1-rollback` is set it also deletes the legacy
+  `checkpoint` key. An authoritative (unmarked) checkpoint implies no V2
+  transaction has committed, so clearing `FC:` loses no V2 state.
diff --git a/plans/runtime-v2/preview-harness.md b/plans/runtime-v2/preview-harness.md
index c3d219ec594..91ae6a0fb88 100644
--- a/plans/runtime-v2/preview-harness.md
+++ b/plans/runtime-v2/preview-harness.md
@@ -9,6 +9,18 @@ branch is checked out and built.
 crate; the runtime-next harness lives under `raw` while the new stack
 is in development. They share most flags and the same test spec format.
 
+**Scope.** `preview-next` runs `runtime-next` + `leader` + `shuffle`
+*in-process inside flowctl* (its own tonic server, inert
+`service_kit::Registry`). It does **not** go through the reactor, the
+runtime-sidecar process, or the sidecar admin surface. To exercise
+those, publish a real materialization to a local data plane with
+`shards: { flags: { enable-runtime-v2: "true" } }` (the
+`estuary.dev/flag/enable-runtime-v2` shard label that `useRuntimeV2` in
+`go/runtime/flow_consumer.go` checks); the sidecar's handler dashboard
+is then at `http://127.0.0.1:<base_port+61>/`. Note connectors on the
+local stack run on the `supabase_network_flow` Docker network — see
+`local/README.md` for the endpoint-address implications.
+
 ## One-time setup
 
 Done once per workstation. Skip the steps you've already completed.