diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..35f7e00
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,44 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: [18, 20, 22]
+    steps:
+      - name: Check out
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+          cache-dependency-path: package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build dashboard
+        run: npm run build:dashboard
+
+      - name: Verify
+        run: npm run verify
+
+      - name: Verify package payload
+        run: npm run verify:package
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..585544d
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,299 @@
+name: Publish
+
+# Manual-only. Every publish and tag is bound to the version-bump commit, even
+# when a rerun happens after main has advanced.
+on:
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: "Version bump"
+        required: true
+        default: "patch"
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+
+permissions:
+  contents: write
+
+concurrency:
+  group: publish
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Check out
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+          cache: npm
+          cache-dependency-path: package-lock.json
+
+      - name: Refuse to publish from a non-main ref
+        run: |
+          set -euo pipefail
+          if [[ "${GITHUB_REF}" != "refs/heads/main" ]]; then
+            echo "Publish must run from main; got ${GITHUB_REF}."
+            exit 1
+          fi
+
+      - name: Refresh current main
+        run: |
+          set -euo pipefail
+          git fetch origin main
+          git checkout --detach origin/main
+
+      - name: Determine release action
+        id: release-state
+        run: |
+          set -euo pipefail
+          current="$(node -p "require('./package.json').version")"
+          tag="v${current}"
+          npm_error="$(mktemp)"
+          if npm_version="$(npm view "burnlist@${current}" version 2>"$npm_error")"; then
+            if [[ "$npm_version" != "$current" ]]; then
+              echo "npm returned version '$npm_version', expected '$current'."
+              exit 1
+            fi
+            npm_state=present
+          elif grep -Eq '(^|[^[:alnum:]])E404([^[:alnum:]]|$)' "$npm_error"; then
+            npm_state=missing
+          else
+            echo "npm view failed while checking burnlist@${current}:"
+            cat "$npm_error"
+            exit 1
+          fi
+          rm -f "$npm_error"
+
+          if [[ "$npm_state" == "missing" ]]; then
+            action=publish
+          else
+            git_error="$(mktemp)"
+            if git ls-remote --exit-code --tags origin "refs/tags/${tag}" >"$git_error" 2>&1; then
+              action=verify-tag
+            else
+              status=$?
+              if [[ "$status" -eq 2 ]]; then
+                action=tag
+              else
+                echo "git ls-remote failed while checking ${tag}:"
+                cat "$git_error"
+                exit 1
+              fi
+            fi
+            rm -f "$git_error"
+          fi
+          echo "current=${current}" >> "$GITHUB_OUTPUT"
+          echo "action=${action}" >> "$GITHUB_OUTPUT"
+          echo "Release action: ${action} (${tag})"
+
+      - name: Verify completed release tag
+        if: steps.release-state.outputs.action == 'verify-tag'
+        env:
+          VERSION: v${{ steps.release-state.outputs.current }}
+        run: |
+          set -euo pipefail
+          npm_error="$(mktemp)"
+          if ! artifact_commit="$(npm view "burnlist@${VERSION#v}" gitHead 2>"$npm_error")"; then
+            echo "npm view failed while reading ${VERSION} gitHead:"
+            cat "$npm_error"
+            exit 1
+          fi
+          rm -f "$npm_error"
+          if [[ ! "$artifact_commit" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "npm metadata for ${VERSION} does not contain a full gitHead SHA."
+            exit 1
+          fi
+          git cat-file -e "${artifact_commit}^{commit}"
+          git merge-base --is-ancestor "$artifact_commit" origin/main
+          tag_refs="$(git ls-remote --exit-code --tags origin "refs/tags/${VERSION}" "refs/tags/${VERSION}^{}")"
+          tag_target="$(awk -v ref="refs/tags/${VERSION}" '$2 == ref { direct = $1 } $2 == ref "^{}" { peeled = $1 } END { print peeled ? peeled : direct }' <<<"$tag_refs")"
+          if [[ ! "$tag_target" =~ ^[0-9a-f]{40}$ || "$tag_target" != "$artifact_commit" ]]; then
+            echo "Remote tag ${VERSION} does not point to npm artifact ${artifact_commit}."
+            exit 1
+          fi
+
+      - name: Bump version
+        id: bump
+        if: steps.release-state.outputs.action == 'verify-tag'
+        run: |
+          set -euo pipefail
+          next="$(npm version "${{ inputs.bump }}" --no-git-tag-version)"
+          echo "version=${next}" >> "$GITHUB_OUTPUT"
+          echo "Bumped to ${next}"
+
+      - name: Set release version
+        id: release
+        env:
+          ACTION: ${{ steps.release-state.outputs.action }}
+          CURRENT_VERSION: ${{ steps.release-state.outputs.current }}
+          BUMPED_VERSION: ${{ steps.bump.outputs.version }}
+        run: |
+          set -euo pipefail
+          version="v${CURRENT_VERSION}"
+          if [[ "$ACTION" == "verify-tag" ]]; then version="$BUMPED_VERSION"; fi
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+
+      - name: Commit and push version bump
+        if: steps.release-state.outputs.action == 'verify-tag'
+        env:
+          NEXT_VERSION: ${{ steps.release.outputs.version }}
+          ACTOR: ${{ github.actor }}
+          ACTOR_ID: ${{ github.actor_id }}
+        run: |
+          set -euo pipefail
+          git config user.name "$ACTOR"
+          git config user.email "${ACTOR_ID}+${ACTOR}@users.noreply.github.com"
+          git add package.json package-lock.json
+          git commit -m "chore(release): ${NEXT_VERSION}"
+          git push origin HEAD:main
+
+      - name: Resolve and verify release commit
+        id: release-commit
+        env:
+          ACTION: ${{ steps.release-state.outputs.action }}
+          VERSION: ${{ steps.release.outputs.version }}
+        run: |
+          set -euo pipefail
+          if [[ "$ACTION" == "verify-tag" ]]; then
+            release_commit="$(git rev-parse HEAD)"
+          elif [[ "$ACTION" == "tag" ]]; then
+            npm_error="$(mktemp)"
+            if ! release_commit="$(npm view "burnlist@${VERSION#v}" gitHead 2>"$npm_error")"; then
+              echo "npm view failed while reading ${VERSION} gitHead:"
+              cat "$npm_error"
+              exit 1
+            fi
+            rm -f "$npm_error"
+          else
+            release_commit="$(git log -1 --format=%H --grep="^chore(release): ${VERSION}$" origin/main)"
+            if [[ -z "$release_commit" ]]; then
+              echo "Could not find the version-bump commit for ${VERSION} on origin/main."
+              exit 1
+            fi
+          fi
+          if [[ ! "$release_commit" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "Release commit for ${VERSION} is not a full SHA."
+            exit 1
+          fi
+          git cat-file -e "${release_commit}^{commit}"
+          git merge-base --is-ancestor "$release_commit" origin/main
+          commit_version="$(git show "${release_commit}:package.json" | node -p "JSON.parse(require('fs').readFileSync(0, 'utf8')).version")"
+          if [[ "$commit_version" != "${VERSION#v}" ]]; then
+            echo "Release commit ${release_commit} does not contain version ${VERSION}."
+            exit 1
+          fi
+          echo "sha=${release_commit}" >> "$GITHUB_OUTPUT"
+
+      - name: Check out exact release commit
+        env:
+          RELEASE_COMMIT: ${{ steps.release-commit.outputs.sha }}
+        run: git checkout --detach "$RELEASE_COMMIT"
+
+      # Install from the RELEASE commit's lockfile so gate + publish match the released tree.
+      - name: Install dependencies for the release commit
+        run: npm ci
+
+      - name: Verify any existing remote tag
+        env:
+          VERSION: ${{ steps.release.outputs.version }}
+          RELEASE_COMMIT: ${{ steps.release-commit.outputs.sha }}
+        run: |
+          set -euo pipefail
+          git_error="$(mktemp)"
+          if tag_refs="$(git ls-remote --exit-code --tags origin "refs/tags/${VERSION}" "refs/tags/${VERSION}^{}" 2>"$git_error")"; then
+            tag_target="$(awk -v ref="refs/tags/${VERSION}" '$2 == ref { direct = $1 } $2 == ref "^{}" { peeled = $1 } END { print peeled ? peeled : direct }' <<<"$tag_refs")"
+            if [[ ! "$tag_target" =~ ^[0-9a-f]{40}$ || "$tag_target" != "$RELEASE_COMMIT" ]]; then
+              echo "Remote tag ${VERSION} does not point to release commit ${RELEASE_COMMIT}."
+              exit 1
+            fi
+          else
+            status=$?
+            if [[ "$status" -ne 2 ]]; then
+              echo "git ls-remote failed while checking ${VERSION}:"
+              cat "$git_error"
+              exit 1
+            fi
+          fi
+          rm -f "$git_error"
+
+      - name: Gate exact release commit
+        run: |
+          npm run build:dashboard
+          npm run verify
+          npm run verify:package
+
+      - name: Publish to npm
+        if: steps.release-state.outputs.action != 'tag'
+        run: npm publish
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Bind npm artifact to release commit
+        id: artifact
+        env:
+          VERSION: ${{ steps.release.outputs.version }}
+          RELEASE_COMMIT: ${{ steps.release-commit.outputs.sha }}
+        run: |
+          set -euo pipefail
+          npm_error="$(mktemp)"
+          if ! npm_version="$(npm view "burnlist@${VERSION#v}" version 2>"$npm_error")"; then
+            echo "npm view failed while confirming ${VERSION}:"
+            cat "$npm_error"
+            exit 1
+          fi
+          if [[ "$npm_version" != "${VERSION#v}" ]]; then
+            echo "npm returned version '$npm_version', expected '${VERSION#v}'."
+            exit 1
+          fi
+          if ! artifact_commit="$(npm view "burnlist@${VERSION#v}" gitHead 2>>"$npm_error")"; then
+            echo "npm view failed while reading ${VERSION} gitHead:"
+            cat "$npm_error"
+            exit 1
+          fi
+          rm -f "$npm_error"
+          if [[ ! "$artifact_commit" =~ ^[0-9a-f]{40}$ || "$artifact_commit" != "$RELEASE_COMMIT" ]]; then
+            echo "npm artifact ${VERSION} is not bound to release commit ${RELEASE_COMMIT}."
+            exit 1
+          fi
+          git cat-file -e "${artifact_commit}^{commit}"
+          git merge-base --is-ancestor "$artifact_commit" origin/main
+          echo "sha=${artifact_commit}" >> "$GITHUB_OUTPUT"
+
+      - name: Tag published release
+        env:
+          NEXT_VERSION: ${{ steps.release.outputs.version }}
+          ARTIFACT_COMMIT: ${{ steps.artifact.outputs.sha }}
+        run: |
+          set -euo pipefail
+          git_error="$(mktemp)"
+          if tag_refs="$(git ls-remote --exit-code --tags origin "refs/tags/${NEXT_VERSION}" "refs/tags/${NEXT_VERSION}^{}" 2>"$git_error")"; then
+            tag_target="$(awk -v ref="refs/tags/${NEXT_VERSION}" '$2 == ref { direct = $1 } $2 == ref "^{}" { peeled = $1 } END { print peeled ? peeled : direct }' <<<"$tag_refs")"
+            if [[ ! "$tag_target" =~ ^[0-9a-f]{40}$ || "$tag_target" != "$ARTIFACT_COMMIT" ]]; then
+              echo "Remote tag ${NEXT_VERSION} does not point to npm artifact ${ARTIFACT_COMMIT}."
+              exit 1
+            fi
+            echo "Tag ${NEXT_VERSION} already points to the npm artifact."
+            exit 0
+          fi
+          status=$?
+          if [[ "$status" -ne 2 ]]; then
+            echo "git ls-remote failed while checking ${NEXT_VERSION}:"
+            cat "$git_error"
+            exit 1
+          fi
+          rm -f "$git_error"
+          git tag "${NEXT_VERSION}" "${ARTIFACT_COMMIT}"
+          git push origin "${NEXT_VERSION}"
diff --git a/README.md b/README.md
index a2320d2..ed3336c 100644
--- a/README.md
+++ b/README.md
@@ -51,7 +51,7 @@ Burnlist ships with two default Ovens:
 - **Checklist** tracks the active work queue.
 - **Differential Testing** renders aligned reference and candidate series, optional aggregate telemetry, and optional exact-first evidence.
 
-Custom Ovens use the same two-file package. An Oven cannot run commands, collect or transform project data, mutate project files, import arbitrary UI, or start an agent. See the [Oven contract](skills/burnlist/references/oven-contract.md) for the complete boundary.
+Custom Ovens use the same two-file package and are scoped to the repository that owns their ignored local state; built-in Ovens are global. An Oven cannot run commands, collect or transform project data, mutate project files, import arbitrary UI, or start an agent. `--ovens-dir` overrides custom Oven storage only for the dashboard's launch repository, while other observed repositories continue to use their own `.local/burnlist/ovens/`. See the [Oven contract](skills/burnlist/references/oven-contract.md) for the complete boundary.
 
 ## Differential Testing
 
diff --git a/bin/burnlist.mjs b/bin/burnlist.mjs
index 22da17c..1cbfc88 100755
--- a/bin/burnlist.mjs
+++ b/bin/burnlist.mjs
@@ -120,7 +120,7 @@ Usage:
   burnlist differential-testing validate-bundle <bundle/current.json>
   burnlist differential-testing schema
   burnlist differential-testing sdk
-  burnlist oven <list|view|create|update> ...
+  burnlist oven <list|view|bind|unbind|bindings|create|update> ...
   burnlist new [--repo <path>]
   burnlist show <id>[#<item>] [--repo <path>]
   burnlist ready <id> [--repo <path>]
@@ -137,7 +137,7 @@ Options:
   --auto-port           Try the next available loopback port.
   --host <host>         Bind host; loopback is required by default.
   --state-dir <path>    Override ignored dashboard observer state.
-  --ovens-dir <path>    Override custom Oven storage.
+  --ovens-dir <path>    Override launch-repository custom Oven storage only.
   --runs-dir <path>     Override Run snapshot storage.
   --oven-data <id=path> Bind one Oven to a read-only normalized JSON payload.
   --version, -v         Print the installed Burnlist version.
diff --git a/dashboard/src/App.tsx b/dashboard/src/App.tsx
index 06601f8..a068380 100644
--- a/dashboard/src/App.tsx
+++ b/dashboard/src/App.tsx
@@ -7,7 +7,7 @@ import type { Filter } from "@lib";
 
 export function App() {
   const section = currentSection();
-  const selected = useMemo(selectedBurnlist, [window.location.pathname]);
+  const selected = useMemo(selectedBurnlist, [window.location.pathname, window.location.search]);
   const [filter, setFilter] = useState(() => filterFromUrl(FILTERS));
   const { projects, progress, error, loading } = useDashboardData({ section, selected });
 
diff --git a/dashboard/src/components/BurnOvens/BurnOvens.tsx b/dashboard/src/components/BurnOvens/BurnOvens.tsx
index fee7510..4b100b6 100644
--- a/dashboard/src/components/BurnOvens/BurnOvens.tsx
+++ b/dashboard/src/components/BurnOvens/BurnOvens.tsx
@@ -25,6 +25,8 @@ import {
   X,
 } from "lucide-react";
 import { Button } from "@layout";
+import { ovenActionUrl, ovenCatalogKey, ovenTargetRepoRoot } from "@lib/oven-identity.mjs";
+import type { OvenSummary, RepoSummary } from "@lib/types";
 import {
   Card,
   CardContent,
@@ -33,15 +35,6 @@ import {
   CardTitle,
 } from "@layout";
 
-type OvenSummary = {
-  id: string;
-  name: string;
-  description: string;
-  builtIn: boolean;
-};
-
-type RepoSummary = { name: string; root: string };
-
 type DetailSection = {
   id: string;
   title: string;
@@ -573,14 +566,19 @@ export function NewOvenPage() {
     cells: [],
   });
   const [writeToken, setWriteToken] = useState("");
+  const [repos, setRepos] = useState<RepoSummary[]>([]);
+  const [repoKey, setRepoKey] = useState("");
   const [status, setStatus] = useState("");
   const [error, setError] = useState("");
   const [saving, setSaving] = useState(false);
 
   useEffect(() => {
-    fetch("/api/ovens")
-      .then((response) => response.json())
-      .then((payload) => setWriteToken(payload.writeToken || ""))
+    Promise.all([fetch("/api/ovens").then((response) => response.json()), fetch("/api/repos").then((response) => response.json())])
+      .then(([ovensPayload, reposPayload]) => {
+        setWriteToken(ovensPayload.writeToken || "");
+        setRepos(reposPayload.repos || []);
+        setRepoKey(reposPayload.repos?.[0]?.repoKey || "");
+      })
       .catch(() => setError("Could not initialize Oven saving."));
   }, []);
 
@@ -626,7 +624,7 @@ export function NewOvenPage() {
           "content-type": "application/json",
           "x-burnlist-token": writeToken,
         },
-        body: JSON.stringify({ id, name, instructions, detail }),
+        body: JSON.stringify({ id, name, instructions, detail, ...(repoKey ? { repoKey } : {}) }),
       });
       const payload = await response.json();
       if (!response.ok) {
@@ -657,6 +655,12 @@ export function NewOvenPage() {
           </CardHeader>
           <CardContent className="oven-form-content">
             <div className="oven-fields-row">
+              <label className="form-field">
+                Repository
+                <select className={fieldClass} onChange={(event) => setRepoKey(event.target.value)} required value={repoKey}>
+                  {repos.map((repo) => <option key={repo.repoKey} value={repo.repoKey}>{repo.name}</option>)}
+                </select>
+              </label>
               <label className="form-field">
                 Oven name
                 <input
@@ -760,6 +764,7 @@ export function RunBurnPage() {
   const [repos, setRepos] = useState<RepoSummary[]>([]);
   const [writeToken, setWriteToken] = useState("");
   const [ovenId, setOvenId] = useState("checklist");
+  const [ovenRepoKey, setOvenRepoKey] = useState<string | null>(null);
   const [repoRoot, setRepoRoot] = useState("");
   const [title, setTitle] = useState("");
   const [objective, setObjective] = useState("");
@@ -787,13 +792,21 @@ export function RunBurnPage() {
     setError("");
     setStatus("Creating run manifest...");
     try {
+      const oven = ovens.find((candidate) => candidate.id === ovenId && candidate.repoKey === ovenRepoKey);
+      if (!oven) throw new Error("Select an Oven.");
       const response = await fetch("/api/runs", {
         method: "POST",
         headers: {
           "content-type": "application/json",
           "x-burnlist-token": writeToken,
         },
-        body: JSON.stringify({ ovenId, repoRoot, title, objective }),
+        body: JSON.stringify({
+          ovenId: oven.id,
+          ovenRepoKey: oven.repoKey,
+          repoRoot: ovenTargetRepoRoot(oven, repos) ?? repoRoot,
+          title,
+          objective,
+        }),
       });
       const payload = await response.json();
       if (!response.ok) {
@@ -833,12 +846,18 @@ export function RunBurnPage() {
             Oven
             <select
               className={fieldClass}
-              onChange={(event) => setOvenId(event.target.value)}
+              onChange={(event) => {
+                const oven = ovens.find((candidate) => ovenCatalogKey(candidate) === event.target.value);
+                setOvenId(oven?.id || "");
+                setOvenRepoKey(oven?.repoKey ?? null);
+                const targetRepoRoot = oven ? ovenTargetRepoRoot(oven, repos) : null;
+                if (targetRepoRoot) setRepoRoot(targetRepoRoot);
+              }}
               required
-              value={ovenId}
+              value={ovenCatalogKey({ id: ovenId, repoKey: ovenRepoKey })}
             >
               {ovens.map((oven) => (
-                <option key={oven.id} value={oven.id}>
+                <option data-oven-url={ovenActionUrl(oven)} key={ovenCatalogKey(oven)} value={ovenCatalogKey(oven)}>
                   {oven.name} · {oven.builtIn ? "default" : "custom"}
                 </option>
               ))}
diff --git a/dashboard/src/components/DifferentialTesting/DifferentialTesting.tsx b/dashboard/src/components/DifferentialTesting/DifferentialTesting.tsx
index 6250b4a..f3c5a99 100644
--- a/dashboard/src/components/DifferentialTesting/DifferentialTesting.tsx
+++ b/dashboard/src/components/DifferentialTesting/DifferentialTesting.tsx
@@ -1,4 +1,5 @@
 import { useEffect, useRef } from "react";
+import { ovenRepoKey } from "@lib";
 // @ts-expect-error The canonical renderer is plain ESM so React and the direct Oven route share one implementation.
 import { startDifferentialTestingLiveUpdates } from "../../../../ovens/differential-testing/renderer/differential-testing-renderer.js";
 
@@ -12,7 +13,7 @@ export function DifferentialTestingPage() {
 
   useEffect(() => {
     if (!root.current) return;
-    const controller = startDifferentialTestingLiveUpdates(root.current);
+    const controller = startDifferentialTestingLiveUpdates(root.current, { repoKey: ovenRepoKey() });
     return () => controller.stop();
   }, []);
 
diff --git a/dashboard/src/components/ProjectGroup/BurnlistRow.test.mjs b/dashboard/src/components/ProjectGroup/BurnlistRow.test.mjs
new file mode 100644
index 0000000..c6032dc
--- /dev/null
+++ b/dashboard/src/components/ProjectGroup/BurnlistRow.test.mjs
@@ -0,0 +1,42 @@
+import assert from "node:assert/strict";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { createElement } from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { build } from "esbuild";
+
+const componentPath = new URL("./BurnlistRow.tsx", import.meta.url).pathname;
+const layoutPath = new URL("../../layout", import.meta.url).pathname;
+const libPath = new URL("../../lib", import.meta.url).pathname;
+
+test("a blocked row exposes its reason without rendering navigation semantics", async () => {
+  const outputDir = await mkdtemp(join(tmpdir(), "burnlist-row-test-"));
+  try {
+    const outputPath = join(outputDir, "BurnlistRow.mjs");
+    await build({
+      entryPoints: [componentPath], bundle: true, format: "esm", outfile: outputPath, platform: "node",
+      alias: { "@layout": layoutPath, "@lib": libPath }, jsx: "automatic", target: "node18",
+    });
+    const { BurnlistRow } = await import(`${new URL(`file://${outputPath}`).href}?test=${Date.now()}`);
+    const entry = {
+      id: "blocked-checklist", repo: "fixture", repoKey: null, repoRoot: null,
+      planPath: null, planLabel: null, title: "Checklist data", status: "active", statusLabel: "Blocked",
+      total: 0, done: null, remaining: null, percent: null, errors: 1, warnings: 0,
+      updatedAt: null, lastCompletedAt: null, ovenId: "third-party-oven", ovenName: "Third party",
+      href: "/Oven/blocked-checklist", progressLabel: "Blocked", blockers: "The data binding is unavailable.",
+    };
+    const row = BurnlistRow({ entry, filter: "active", ambiguous: false });
+    const markup = renderToStaticMarkup(createElement("table", null, createElement("tbody", null, row)));
+
+    assert.equal(row.props.onClick, undefined);
+    assert.equal(row.props.role, undefined);
+    assert.equal(row.props.tabIndex, undefined);
+    assert.match(markup, /Blocked: The data binding is unavailable\./u);
+    assert.match(markup, /data-blocked-reason="true"/u);
+    assert.doesNotMatch(markup, /(?:href=|role="link"|tabindex=)/u);
+  } finally {
+    await rm(outputDir, { force: true, recursive: true });
+  }
+});
diff --git a/dashboard/src/components/ProjectGroup/BurnlistRow.tsx b/dashboard/src/components/ProjectGroup/BurnlistRow.tsx
index 9d99591..1094b62 100644
--- a/dashboard/src/components/ProjectGroup/BurnlistRow.tsx
+++ b/dashboard/src/components/ProjectGroup/BurnlistRow.tsx
@@ -1,14 +1,17 @@
-import type { MouseEvent } from "react";
+import type { KeyboardEvent, MouseEvent } from "react";
 import { Button, Progress } from "@layout";
 import { burnlistHref, formatTime } from "@lib";
 import type { Burnlist, Filter } from "@lib";
 
-export function BurnlistRow({ entry, filter }: { entry: Burnlist; filter: Filter }) {
-  const href = entry.ovenId === "checklist" ? burnlistHref(entry, filter) : entry.href;
+export function BurnlistRow({ entry, filter, ambiguous }: { entry: Burnlist; filter: Filter; ambiguous: boolean }) {
+  const blocked = entry.statusLabel === "Blocked";
+  const href = blocked ? entry.href : entry.ovenId === "checklist" ? burnlistHref(entry, filter, ambiguous) : entry.href;
   const open = () => { window.location.href = href; };
   const copy = (event: MouseEvent<HTMLButtonElement>) => {
     event.stopPropagation();
-    const url = window.location.origin + (entry.ovenId === "checklist"
+    const url = window.location.origin + (entry.ovenId === "checklist" && ambiguous
+      ? href
+      : entry.ovenId === "checklist"
       ? (entry.repoKey ? `/r/${encodeURIComponent(entry.repoKey)}/${encodeURIComponent(entry.id)}` : `/${encodeURIComponent(entry.repo)}/${encodeURIComponent(entry.id)}`)
       : entry.href);
     void navigator.clipboard?.writeText(url);
@@ -16,25 +19,28 @@ export function BurnlistRow({ entry, filter }: { entry: Burnlist; filter: Filter
 
   return (
     <tr
-      aria-label={`Open ${entry.repo}/${entry.id}`}
       className="burnlist-table-row"
       data-status={entry.status}
       key={`${entry.repoKey ?? entry.repo}/${entry.status}/${entry.id}/${entry.planLabel}`}
-      onClick={open}
-      onKeyDown={(event) => {
-        if (event.target !== event.currentTarget) return;
-        if (event.key === "Enter" || event.key === " ") {
-          event.preventDefault();
-          open();
-        }
-      }}
-      role="link"
-      tabIndex={0}
+      {...(blocked ? {} : {
+        "aria-label": `Open ${entry.repo}/${entry.id}`,
+        onClick: open,
+        onKeyDown: (event: KeyboardEvent<HTMLTableRowElement>) => {
+          if (event.target !== event.currentTarget) return;
+          if (event.key === "Enter" || event.key === " ") {
+            event.preventDefault();
+            open();
+          }
+        },
+        role: "link",
+        tabIndex: 0,
+      })}
     >
       <td className="burnlist-table-cell burnlist-table-cell-primary">
         <p className="burnlist-table-repo">{entry.repo}/{entry.id}</p>
         <p className="burnlist-table-title">{entry.title}</p>
-        <Button aria-label={`Copy ${entry.repoKey ?? entry.repo}/${entry.id} and title`} className="burnlist-copy-button" onClick={copy} size="xs" type="button" variant="ghost">Copy</Button>
+        {blocked && <p className="burnlist-table-title" data-blocked-reason="true">Blocked: {entry.blockers ?? entry.statusLabel}</p>}
+        {!blocked && <Button aria-label={`Copy ${entry.repoKey ?? entry.repo}/${entry.id} and title`} className="burnlist-copy-button" onClick={copy} size="xs" type="button" variant="ghost">Copy</Button>}
       </td>
       <td className="burnlist-table-cell burnlist-table-cell-oven">{entry.ovenName}</td>
       <td className="burnlist-table-cell burnlist-table-cell-status" data-status={entry.status}>{entry.statusLabel}</td>
diff --git a/dashboard/src/components/ProjectGroup/BurnlistTable.tsx b/dashboard/src/components/ProjectGroup/BurnlistTable.tsx
index 986dc73..ed8bba7 100644
--- a/dashboard/src/components/ProjectGroup/BurnlistTable.tsx
+++ b/dashboard/src/components/ProjectGroup/BurnlistTable.tsx
@@ -1,7 +1,7 @@
 import { BurnlistRow } from "./BurnlistRow";
 import type { Filter, Project } from "@lib";
 
-export function BurnlistTable({ entries, filter, emptyLabel }: { entries: Project["entries"]; filter: Filter; emptyLabel: string }) {
+export function BurnlistTable({ entries, filter, emptyLabel, ambiguousIds }: { entries: Project["entries"]; filter: Filter; emptyLabel: string; ambiguousIds: string[] }) {
   return (
     <div className="burnlist-table-card">
       <div className="burnlist-table-scroll">
@@ -23,7 +23,7 @@ export function BurnlistTable({ entries, filter, emptyLabel }: { entries: Projec
             </tr>
           </thead>
           <tbody className="burnlist-table-body">
-            {entries.length ? entries.map((entry) => <BurnlistRow entry={entry} filter={filter} key={`${entry.repoKey ?? entry.repo}/${entry.status}/${entry.id}/${entry.planLabel}`} />) : (
+            {entries.length ? entries.map((entry) => <BurnlistRow ambiguous={ambiguousIds.includes(entry.id)} entry={entry} filter={filter} key={`${entry.repoKey ?? entry.repo}/${entry.status}/${entry.id}/${entry.planLabel}`} />) : (
               <tr className="burnlist-table-row">
                 <td className="burnlist-table-cell burnlist-table-cell-primary" colSpan={5}>
                   <p className="burnlist-table-title">{emptyLabel}</p>
diff --git a/dashboard/src/components/ProjectGroup/ProjectGroup.tsx b/dashboard/src/components/ProjectGroup/ProjectGroup.tsx
index 99ad1e4..f239804 100644
--- a/dashboard/src/components/ProjectGroup/ProjectGroup.tsx
+++ b/dashboard/src/components/ProjectGroup/ProjectGroup.tsx
@@ -1,5 +1,6 @@
-import { useState } from "react";
+import { useRef, useState } from "react";
 import { Badge } from "@layout";
+import { projectGroupOpen, projectGroupShouldResetOpen } from "@lib/project-open";
 import type { Filter, Project } from "@lib";
 import { BurnlistTable } from "./BurnlistTable";
 
@@ -7,7 +8,13 @@ export function ProjectGroup({ project, filter }: { project: Project; filter: Fi
   // Uncontrolled-with-state: initial open when the current filter has rows, and the user's
   // toggle survives the 5s poll re-render (a bare `open` prop would fight the poll).
   const filteredEntries = project.entries.filter((entry) => filter === "all" || entry.status === filter);
-  const [open, setOpen] = useState(() => filteredEntries.length > 0 || project.counts.total === 0);
+  const derivedOpen = projectGroupOpen(filteredEntries, project.counts.total);
+  const [open, setOpen] = useState(() => derivedOpen);
+  const previousFilter = useRef(filter);
+  if (projectGroupShouldResetOpen(previousFilter.current, filter)) {
+    previousFilter.current = filter;
+    setOpen(derivedOpen);
+  }
   const badge = `${project.registered ? "registered" : "observed"} · ${project.health}`;
   const emptyLabel = project.counts.total === 0
     ? "no burnlists yet — run `burnlist new` here"
@@ -20,7 +27,7 @@ export function ProjectGroup({ project, filter }: { project: Project; filter: Fi
         <span className="dashboard-project-counts">{project.counts.total} lists · {project.counts.active} active</span>
         <Badge className="dashboard-project-badge" variant="ghost">{badge}</Badge>
       </summary>
-      <BurnlistTable emptyLabel={emptyLabel} entries={filteredEntries} filter={filter} />
+      <BurnlistTable ambiguousIds={project.ambiguousIds} emptyLabel={emptyLabel} entries={filteredEntries} filter={filter} />
     </details>
   );
 }
diff --git a/dashboard/src/lib/hrefs.ts b/dashboard/src/lib/hrefs.ts
index 48c9dbd..02cbc36 100644
--- a/dashboard/src/lib/hrefs.ts
+++ b/dashboard/src/lib/hrefs.ts
@@ -7,8 +7,16 @@ export function currentSection() {
   return "burnlists";
 }
 
+export function ovenRepoKey() {
+  return currentSection() === "differential-testing"
+    ? new URLSearchParams(window.location.search).get("repoKey")
+    : null;
+}
+
 export function selectedBurnlist(): SelectedBurnlist | null {
   if (currentSection() !== "burnlists") return null;
+  const plan = new URLSearchParams(window.location.search).get("plan");
+  if (plan) return { plan };
   const parts = window.location.pathname.split("/").filter(Boolean).map(decodeURIComponent);
   if (parts.length === 3 && parts[0] === "r") return { repoKey: parts[1], id: parts[2] };
   return parts.length === 2 ? { repo: parts[0], id: parts[1] } : null;
@@ -23,7 +31,8 @@ export function listHref(filter: Filter) {
   return filter === "all" ? "/" : `/?filter=${encodeURIComponent(filter)}`;
 }
 
-export function burnlistHref(entry: Burnlist, filter: Filter) {
+export function burnlistHref(entry: Burnlist, filter: Filter, ambiguous = false) {
+  if (ambiguous) return `/?plan=${encodeURIComponent(entry.planPath ?? "")}&filter=${encodeURIComponent(filter)}`;
   const path = entry.repoKey
     ? `/r/${encodeURIComponent(entry.repoKey)}/${encodeURIComponent(entry.id)}`
     : `/${encodeURIComponent(entry.repo)}/${encodeURIComponent(entry.id)}`;
diff --git a/dashboard/src/lib/index.ts b/dashboard/src/lib/index.ts
index 32ca9ba..94d9d5b 100644
--- a/dashboard/src/lib/index.ts
+++ b/dashboard/src/lib/index.ts
@@ -1,5 +1,5 @@
 export { formatTime } from "./format";
-export { burnlistHref, currentSection, filterFromUrl, listHref, selectedBurnlist } from "./hrefs";
+export { burnlistHref, currentSection, filterFromUrl, listHref, ovenRepoKey, selectedBurnlist } from "./hrefs";
 export type { Burnlist, ChecklistProgressData, ChecklistItem, CompletedItem, Filter, HistoryPoint, ProgressData, Project, SelectedBurnlist, Warning } from "./types";
 export { cn, joinClasses } from "./utils";
 export type { ClassValue } from "./utils";
diff --git a/dashboard/src/lib/oven-identity.mjs b/dashboard/src/lib/oven-identity.mjs
new file mode 100644
index 0000000..f47350d
--- /dev/null
+++ b/dashboard/src/lib/oven-identity.mjs
@@ -0,0 +1,13 @@
+export function ovenCatalogKey({ id, repoKey }) {
+  return `${repoKey ?? "built-in"}:${id}`;
+}
+
+export function ovenActionUrl({ id, repoKey }) {
+  const path = `/api/ovens/${encodeURIComponent(id)}`;
+  return repoKey === null ? path : `${path}?repoKey=${encodeURIComponent(repoKey)}`;
+}
+
+export function ovenTargetRepoRoot(oven, repos) {
+  if (oven.repoKey === null) return null;
+  return repos.find((repo) => repo.repoKey === oven.repoKey)?.root ?? null;
+}
diff --git a/dashboard/src/lib/oven-identity.test.mjs b/dashboard/src/lib/oven-identity.test.mjs
new file mode 100644
index 0000000..74b6744
--- /dev/null
+++ b/dashboard/src/lib/oven-identity.test.mjs
@@ -0,0 +1,14 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { ovenActionUrl, ovenCatalogKey, ovenTargetRepoRoot } from "./oven-identity.mjs";
+
+test("custom Oven identity keeps same-id rows distinct and carries repoKey into actions", () => {
+  const first = { id: "shared", repoKey: "aaaaaaaaaaaa", builtIn: false };
+  const second = { id: "shared", repoKey: "bbbbbbbbbbbb", builtIn: false };
+  const repos = [{ repoKey: first.repoKey, root: "/repos/a" }, { repoKey: second.repoKey, root: "/repos/b" }];
+  assert.notEqual(ovenCatalogKey(first), ovenCatalogKey(second));
+  assert.equal(ovenActionUrl(second), "/api/ovens/shared?repoKey=bbbbbbbbbbbb");
+    assert.equal(ovenTargetRepoRoot(second, repos), "/repos/b");
+    assert.equal(ovenTargetRepoRoot({ id: "checklist", repoKey: null }, repos), null);
+  assert.equal(ovenActionUrl({ id: "checklist", repoKey: null }), "/api/ovens/checklist");
+});
diff --git a/dashboard/src/lib/project-open.mjs b/dashboard/src/lib/project-open.mjs
new file mode 100644
index 0000000..f4ecb9d
--- /dev/null
+++ b/dashboard/src/lib/project-open.mjs
@@ -0,0 +1,7 @@
+export function projectGroupShouldResetOpen(previousFilter, filter) {
+  return previousFilter !== filter;
+}
+
+export function projectGroupOpen(filteredEntries, total) {
+  return filteredEntries.length > 0 || total === 0;
+}
diff --git a/dashboard/src/lib/project-open.test.mjs b/dashboard/src/lib/project-open.test.mjs
new file mode 100644
index 0000000..ca4f0ac
--- /dev/null
+++ b/dashboard/src/lib/project-open.test.mjs
@@ -0,0 +1,14 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { projectGroupOpen, projectGroupShouldResetOpen } from "./project-open.mjs";
+
+test("project groups reset their derived open state only for lifecycle filter changes", () => {
+  const active = [{ id: "active" }];
+  const completed = [{ id: "completed" }];
+  assert.equal(projectGroupOpen(active, 1), true);
+  assert.equal(projectGroupOpen([], 1), false);
+  assert.equal(projectGroupOpen([], 0), true);
+  assert.equal(projectGroupShouldResetOpen("active", "active"), false);
+  assert.equal(projectGroupShouldResetOpen("active", "complete"), true);
+  assert.equal(projectGroupOpen(completed, 1), true);
+});
diff --git a/dashboard/src/lib/types.ts b/dashboard/src/lib/types.ts
index 81ce43e..b9902ee 100644
--- a/dashboard/src/lib/types.ts
+++ b/dashboard/src/lib/types.ts
@@ -26,8 +26,9 @@ export type Burnlist = {
   repo: string;
   repoKey: string | null;
   repoRoot: string | null;
+  planPath: string | null;
   title: string;
-  planLabel: string;
+  planLabel: string | null;
   status: Exclude<Filter, "all">;
   statusLabel: string;
   total: number;
@@ -38,10 +39,12 @@ export type Burnlist = {
   warnings: number;
   updatedAt: string | null;
   lastCompletedAt: string | null;
-  ovenId: "checklist" | "differential-testing";
+  /** Server-validated Oven identifier. */
+  ovenId: string;
   ovenName: string;
   href: string;
   progressLabel: string;
+  blockers?: string;
 };
 
 export type Project = {
@@ -57,5 +60,15 @@ export type Project = {
   ambiguousIds: string[];
 };
 
-export type SelectedBurnlist = { repo?: string; repoKey?: string; id: string };
+export type OvenSummary = {
+  id: string;
+  name: string;
+  description: string;
+  builtIn: boolean;
+  repoKey: string | null;
+};
+
+export type RepoSummary = { name: string; root: string; repoKey: string };
+
+export type SelectedBurnlist = { repo?: string; repoKey?: string; id?: string; plan?: string };
 export type ProgressData = ChecklistProgressData;
diff --git a/ovens/differential-testing/engine/differential-testing-data-contract.test.mjs b/ovens/differential-testing/engine/differential-testing-data-contract.test.mjs
index 72b9dfb..d7cf14c 100644
--- a/ovens/differential-testing/engine/differential-testing-data-contract.test.mjs
+++ b/ovens/differential-testing/engine/differential-testing-data-contract.test.mjs
@@ -1501,6 +1501,7 @@ test("live Differential Testing dashboard polls and updates only when the payloa
       return 17;
     },
     clearIntervalImpl: (timer) => { clearedTimer = timer; },
+    repoKey: "0123456789ab",
     mount: (_root, _oven, initialPayload) => {
       mountedPayloads.push(initialPayload);
       return { update: (_nextOven, nextPayload) => updatedPayloads.push(nextPayload) };
@@ -1520,7 +1521,7 @@ test("live Differential Testing dashboard polls and updates only when the payloa
   assert.deepEqual(updatedPayloads, [payload]);
   payload = { publishedAt: "2026-01-01T12:00:04.000Z" };
   await controller.selectScenario("0123456789abcdef");
-  assert.equal(requests.at(-1)[0], "/api/oven-data/differential-testing?scenario=0123456789abcdef");
+  assert.equal(requests.at(-1)[0], "/api/oven-data/differential-testing?scenario=0123456789abcdef&repoKey=0123456789ab");
   assert.deepEqual(updatedPayloads, [{ publishedAt: "2026-01-01T12:00:02.000Z" }, payload]);
   assert.equal(requests.filter(([url]) => url === "/api/ovens/differential-testing").length, 1);
   assert.ok(requests.every(([, options]) => options.cache === "no-store"));
diff --git a/ovens/differential-testing/engine/differential-testing-handler.mjs b/ovens/differential-testing/engine/differential-testing-handler.mjs
new file mode 100644
index 0000000..8773e38
--- /dev/null
+++ b/ovens/differential-testing/engine/differential-testing-handler.mjs
@@ -0,0 +1,246 @@
+import { createHash } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { basename, dirname, relative, resolve } from "node:path";
+import { registerOvenHandler } from "../../../src/ovens/oven-registry.mjs";
+import { readTextFileWithLimit, safeStat } from "../../../src/server/fs-safe.mjs";
+import { assertDifferentialTestingData } from "./differential-testing-data-contract.mjs";
+import {
+  DIFFERENTIAL_TESTING_PAGE_SCHEMA,
+  isDifferentialTestingBundle,
+  queryDifferentialTestingFieldPage,
+  readDifferentialTestingBundleManifest,
+  readDifferentialTestingBundleScenario,
+} from "./differential-testing-transport.mjs";
+
+function differentialTestingIndexCache(ctx, path) {
+  const readPath = resolve(realpathSync(dirname(path)), basename(path));
+  const cacheKey = `index:${readPath}`;
+  const stat = safeStat(readPath);
+  if (!stat?.isFile()) throw new Error("configured Differential Testing data is missing");
+  const signature = `${readPath}\0${stat.ino}\0${stat.size}\0${stat.mtimeMs}`;
+  const cached = ctx.cache.get(cacheKey);
+  if (cached?.signature === signature) return cached;
+  const source = readTextFileWithLimit(readPath, ctx.maxOvenDataBytes, "Oven differential-testing data");
+  const document = JSON.parse(source);
+  let index;
+  if (isDifferentialTestingBundle(document)) {
+    const bundle = readDifferentialTestingBundleManifest(readPath, { maxDocumentBytes: ctx.maxOvenDataBytes });
+    const emptyPayload = bundle.selectedScenarioId === null ? bundle.manifest.emptyData : null;
+    const emptySource = emptyPayload ? JSON.stringify(emptyPayload) : "";
+    index = {
+      kind: "bundle",
+      signature,
+      readPath: bundle.readPath,
+      source: emptySource,
+      sourceBytes: Buffer.byteLength(emptySource),
+      etag: `W/\"dtb-${bundle.sha256}\"`,
+      selectedScenarioId: bundle.selectedScenarioId,
+      scenarios: structuredClone(bundle.scenarios),
+      bundle,
+      scenarioDocuments: new Map(),
+      scenarioResponses: new Map(),
+      responseExtras: emptyPayload ? {
+        transport: {
+          schema: DIFFERENTIAL_TESTING_PAGE_SCHEMA,
+          bundleSha256: bundle.sha256,
+          scenarioSha256: null,
+        },
+        fieldPage: null,
+        frameDeltaMetrics: null,
+      } : null,
+    };
+  } else {
+    assertDifferentialTestingData(document);
+    index = {
+      kind: "legacy",
+      signature,
+      readPath,
+      source,
+      sourceBytes: stat.size,
+      etag: `W/\"dt-${stat.ino}-${stat.size}-${Math.trunc(stat.mtimeMs)}\"`,
+      selectedScenarioId: document.scenarioCatalog.selectedScenarioId,
+      scenarios: structuredClone(document.scenarioCatalog.scenarios),
+      scenarioResponses: new Map(),
+    };
+  }
+  ctx.cache.set(cacheKey, index);
+  return index;
+}
+
+function differentialTestingQueryValue(searchParams, name) {
+  const values = searchParams.getAll(name);
+  if (values.length > 1) throw Object.assign(new Error(`${name} must be supplied at most once`), { status: 400 });
+  return values[0] ?? null;
+}
+
+function differentialTestingIntegerQuery(searchParams, name, fallback) {
+  const value = differentialTestingQueryValue(searchParams, name);
+  if (value === null) return fallback;
+  if (!/^(?:0|[1-9]\d*)$/u.test(value)) throw Object.assign(new Error(`${name} must be a non-negative integer`), { status: 400 });
+  const number = Number(value);
+  if (!Number.isSafeInteger(number)) throw Object.assign(new Error(`${name} must be a safe integer`), { status: 400 });
+  return number;
+}
+
+function differentialTestingBundleScenario(ctx, index, scenarioId) {
+  const cached = index.scenarioDocuments.get(scenarioId);
+  if (cached) return cached;
+  const scenario = readDifferentialTestingBundleScenario(index.bundle, scenarioId, { maxDocumentBytes: ctx.maxOvenDataBytes });
+  scenario.source = JSON.stringify(scenario.data);
+  scenario.sourceBytes = Buffer.byteLength(scenario.source);
+  index.scenarioDocuments.set(scenarioId, scenario);
+  return scenario;
+}
+
+function differentialTestingBundleResponse(ctx, index, scenarioId, searchParams) {
+  const search = differentialTestingQueryValue(searchParams, "search") ?? "";
+  const filter = differentialTestingQueryValue(searchParams, "filter") ?? "all";
+  const scenario = differentialTestingBundleScenario(ctx, index, scenarioId);
+  const sort = differentialTestingQueryValue(searchParams, "sort")
+    ?? (scenario.data.telemetry?.status === "comparable" ? "changed" : "default");
+  const page = differentialTestingIntegerQuery(searchParams, "page", 0);
+  const pageSize = differentialTestingIntegerQuery(searchParams, "pageSize", 25);
+  const fieldPage = queryDifferentialTestingFieldPage(scenario, { search, filter, sort, page, pageSize });
+  const queryKey = new URLSearchParams({ search: fieldPage.search, filter: fieldPage.filter, sort: fieldPage.sort, page: String(fieldPage.page), pageSize: String(fieldPage.pageSize) }).toString();
+  const etagDigest = createHash("sha256").update(index.bundle.sha256).update("\0").update(scenario.scenarioSha256).update("\0").update(queryKey).digest("hex");
+  return {
+    signature: `${index.signature}\0${scenario.scenarioSha256}\0${queryKey}`,
+    readPath: index.readPath,
+    source: scenario.source,
+    sourceBytes: scenario.sourceBytes,
+    etag: `W/\"dtb-${etagDigest}\"`,
+    selectedScenarioId: scenarioId,
+    responseExtras: {
+      transport: { schema: DIFFERENTIAL_TESTING_PAGE_SCHEMA, bundleSha256: index.bundle.sha256, scenarioSha256: scenario.scenarioSha256 },
+      fieldPage,
+      frameDeltaMetrics: scenario.frameDeltaMetrics,
+    },
+  };
+}
+
+function differentialTestingScenarioCache(ctx, index, scenarioId) {
+  const cached = index.scenarioResponses.get(scenarioId);
+  const scenariosDir = resolve(dirname(index.readPath), "scenarios");
+  const scenarioPath = resolve(scenariosDir, `${scenarioId}.json`);
+  const scenarioRelativePath = relative(scenariosDir, scenarioPath);
+  if (!scenarioRelativePath || scenarioRelativePath.startsWith("..") || resolve(scenariosDir, scenarioRelativePath) !== scenarioPath) {
+    throw Object.assign(new Error("scenario path escapes the published bundle"), { status: 400 });
+  }
+  const stat = safeStat(scenarioPath);
+  if (!stat?.isFile()) throw Object.assign(new Error(`published data for scenario ${scenarioId} is missing`), { status: 404 });
+  const signature = `${index.signature}\0${scenarioPath}\0${stat.ino}\0${stat.size}\0${stat.mtimeMs}`;
+  if (cached?.signature === signature) return cached;
+  const sourcePayload = JSON.parse(readTextFileWithLimit(scenarioPath, ctx.maxOvenDataBytes, `Differential Testing scenario ${scenarioId}`));
+  assertDifferentialTestingData(sourcePayload);
+  if (sourcePayload.scenarioCatalog.selectedScenarioId !== scenarioId) {
+    throw Object.assign(new Error(`scenario file ${scenarioId} selects ${sourcePayload.scenarioCatalog.selectedScenarioId}`), { status: 422 });
+  }
+  const indexScenario = index.scenarios.find((scenario) => scenario.id === scenarioId);
+  const payloadScenario = sourcePayload.scenarioCatalog.scenarios.find((scenario) => scenario.id === scenarioId);
+  if (JSON.stringify(payloadScenario) !== JSON.stringify(indexScenario)) {
+    throw Object.assign(new Error(`scenario file ${scenarioId} does not match its published catalog entry`), { status: 422 });
+  }
+  const payload = { ...sourcePayload, scenarioCatalog: { selectedScenarioId: scenarioId, scenarios: index.scenarios } };
+  assertDifferentialTestingData(payload);
+  const source = JSON.stringify(payload);
+  const result = {
+    signature,
+    readPath: scenarioPath,
+    source,
+    sourceBytes: Buffer.byteLength(source),
+    etag: `W/\"dt-${stat.ino}-${stat.size}-${Math.trunc(stat.mtimeMs)}-${index.etag.slice(3, -1)}\"`,
+    selectedScenarioId: scenarioId,
+  };
+  index.scenarioResponses.set(scenarioId, result);
+  return result;
+}
+
+function sendDifferentialTestingData(req, res, cached) {
+  if (req.headers["if-none-match"] === cached.etag) {
+    res.writeHead(304, { etag: cached.etag, "cache-control": "no-store" });
+    res.end();
+    return;
+  }
+  const prefix = `${JSON.stringify({ ovenId: "differential-testing", path: cached.readPath, scenarioId: cached.selectedScenarioId, ...(cached.responseExtras || {}) }).slice(0, -1)},\"payload\":`;
+  const suffix = "}";
+  res.writeHead(200, {
+    "content-type": "application/json; charset=utf-8",
+    "cache-control": "no-store",
+    etag: cached.etag,
+    "content-length": Buffer.byteLength(prefix) + cached.sourceBytes + Buffer.byteLength(suffix),
+  });
+  res.write(prefix);
+  res.write(cached.source);
+  res.end(suffix);
+}
+
+export const differentialTestingHandler = Object.freeze({
+  id: "differential-testing",
+  warmIntervalMs: 1_000,
+
+  dashboardEntries(ctx) {
+    const bindings = ctx.ovenDataBindings.get("differential-testing") ?? [];
+    return bindings.flatMap((binding) => {
+      try {
+        const index = differentialTestingIndexCache(ctx, binding.path);
+        const repo = binding.repoKey === null
+          ? "differential-testing"
+          : ctx.discoveredRepos().find((entry) => entry.repoKey === binding.repoKey)?.name ?? basename(binding.repoRoot);
+        return index.scenarios.map((scenario) => ({
+          id: scenario.id, repo, repoKey: binding.repoKey, repoRoot: binding.repoRoot, title: scenario.label,
+          planPath: null, planLabel: null,
+          status: "active", statusLabel: "Active", total: scenario.frameCount, done: null, remaining: null,
+          percent: null, errors: 0, warnings: 0, lastCompletedAt: null, updatedAt: scenario.updatedAt,
+          ovenId: "differential-testing", ovenName: "Differential Testing",
+          href: `/ovens/differential-testing/view?scenario=${encodeURIComponent(scenario.id)}${binding.repoKey === null ? "" : `&repoKey=${encodeURIComponent(binding.repoKey)}`}`,
+          progressLabel: `${scenario.frameCount} frames`,
+        }));
+      } catch (error) {
+        const repo = binding.repoKey === null ? "differential-testing" : basename(binding.repoRoot);
+        return [{
+          id: `blocked-${binding.repoKey ?? "global"}`, repo, repoKey: binding.repoKey, repoRoot: binding.repoRoot,
+          title: "Differential Testing", planPath: null, planLabel: "Oven data binding",
+          status: "active", statusLabel: "Blocked", total: 0, done: null, remaining: null, percent: null,
+          errors: 1, warnings: 0, lastCompletedAt: null, updatedAt: null,
+          ovenId: "differential-testing", ovenName: "Differential Testing", href: "/ovens/differential-testing/view",
+          progressLabel: "Blocked", blockers: String(error?.message ?? error ?? "Data binding is unavailable.").slice(0, 200),
+        }];
+      }
+    });
+  },
+
+  serveData(ctx) {
+    const index = differentialTestingIndexCache(ctx, ctx.bindingPath);
+    const requestedScenarioIds = ctx.url.searchParams.getAll("scenario");
+    if (requestedScenarioIds.length > 1) throw Object.assign(new Error("scenario must be supplied at most once"), { status: 400 });
+    const requestedScenarioId = requestedScenarioIds[0] ?? "";
+    if (!requestedScenarioId || requestedScenarioId === index.selectedScenarioId) {
+      const selected = index.kind === "bundle" && index.selectedScenarioId
+        ? differentialTestingBundleResponse(ctx, index, index.selectedScenarioId, ctx.url.searchParams)
+        : index;
+      sendDifferentialTestingData(ctx.req, ctx.res, selected);
+      return;
+    }
+    if (!/^[a-f0-9]{16}$/u.test(requestedScenarioId)) throw Object.assign(new Error("scenario must be a lowercase 16-character hexadecimal id"), { status: 400 });
+    if (!index.scenarios.some((scenario) => scenario.id === requestedScenarioId)) {
+      throw Object.assign(new Error(`scenario ${requestedScenarioId} is not in the published catalog`), { status: 404 });
+    }
+    const selected = index.kind === "bundle"
+      ? differentialTestingBundleResponse(ctx, index, requestedScenarioId, ctx.url.searchParams)
+      : differentialTestingScenarioCache(ctx, index, requestedScenarioId);
+    sendDifferentialTestingData(ctx.req, ctx.res, selected);
+  },
+
+  warm(ctx) {
+    const paths = new Set((ctx.ovenDataBindings.get("differential-testing") ?? []).map((binding) => binding.path));
+    for (const path of paths) {
+      try {
+        differentialTestingIndexCache(ctx, path);
+      } catch {
+        // The request path reports validation errors; background warming remains silent.
+      }
+    }
+  },
+});
+
+registerOvenHandler("differential-testing", differentialTestingHandler);
diff --git a/ovens/differential-testing/renderer/differential-testing-renderer.js b/ovens/differential-testing/renderer/differential-testing-renderer.js
index 84974ed..8dd5b4c 100644
--- a/ovens/differential-testing/renderer/differential-testing-renderer.js
+++ b/ovens/differential-testing/renderer/differential-testing-renderer.js
@@ -1792,6 +1792,7 @@ export function startDifferentialTestingLiveUpdates(root, {
   locationImpl = globalThis.location,
   historyImpl = globalThis.history,
   mount = mountDifferentialTestingDashboard,
+  repoKey = null,
   refreshMs = DIFFERENTIAL_TESTING_REFRESH_MS,
   onError = (error, hasDashboard) => {
     if (!hasDashboard) root.innerHTML = `<div class="empty">${escapeHtml(String(error?.message || error))}</div>`;
@@ -1818,6 +1819,7 @@ export function startDifferentialTestingLiveUpdates(root, {
   const payloadUrl = (scenarioId) => {
     const searchParams = new URLSearchParams();
     if (scenarioId) searchParams.set("scenario", scenarioId);
+    if (repoKey) searchParams.set("repoKey", repoKey);
     if (fieldViewQuery) {
       searchParams.set("search", fieldViewQuery.search);
       searchParams.set("filter", fieldViewQuery.filter);
diff --git a/scripts/verify-oven-assertions.mjs b/scripts/verify-oven-assertions.mjs
new file mode 100644
index 0000000..68dd12c
--- /dev/null
+++ b/scripts/verify-oven-assertions.mjs
@@ -0,0 +1,49 @@
+import { readFileSync, readdirSync } from "node:fs";
+import { resolve } from "node:path";
+import { normalizeOvenPackage } from "../src/ovens/oven-contract.mjs";
+
+export function assertBuiltInOvenSet(repoRoot, expected) {
+  const ovensRoot = resolve(repoRoot, "ovens");
+  const actual = readdirSync(ovensRoot, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => entry.name)
+    .sort();
+  const wanted = [...expected].sort();
+  if (JSON.stringify(actual) !== JSON.stringify(wanted)) {
+    console.error(`Default Oven ids must be exactly ${wanted.join(", ")}; found ${actual.join(", ") || "none"}.`);
+    process.exit(1);
+  }
+}
+
+export function assertSkillSet(repoRoot, expected) {
+  const skillsRoot = resolve(repoRoot, "skills");
+  const actual = readdirSync(skillsRoot, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => entry.name)
+    .sort();
+  const wanted = [...expected].sort();
+  if (JSON.stringify(actual) !== JSON.stringify(wanted)) {
+    console.error(`Published skill ids must be exactly ${wanted.join(", ")}; found ${actual.join(", ") || "none"}.`);
+    process.exit(1);
+  }
+}
+
+export function assertBuiltInOven(repoRoot, id, expectedName) {
+  const root = resolve(repoRoot, "ovens", id);
+  try {
+    const ovenPackage = normalizeOvenPackage({
+      id,
+      instructions: readFileSync(resolve(root, "instructions.md"), "utf8"),
+      detail: JSON.parse(readFileSync(resolve(root, "detail.json"), "utf8")),
+    });
+    const heading = ovenPackage.instructions
+      .split(/\r?\n/u)
+      .find((line) => /^#\s+\S/u.test(line.trim()))
+      ?.trim()
+      .replace(/^#\s+/u, "");
+    if (heading !== expectedName) throw new Error(`expected heading "${expectedName}", found "${heading || "none"}"`);
+  } catch (error) {
+    console.error(`Default oven ${id} violates the Oven contract: ${error.message}`);
+    process.exit(1);
+  }
+}
diff --git a/scripts/verify-test-files.mjs b/scripts/verify-test-files.mjs
new file mode 100644
index 0000000..7602eb2
--- /dev/null
+++ b/scripts/verify-test-files.mjs
@@ -0,0 +1,33 @@
+export const verificationTestFiles = [
+  "src/server/dashboard-routes.test.mjs",
+  "src/server/oven-routes.test.mjs",
+  "src/server/run-routes.test.mjs",
+  "src/server/dashboard-entry-isolation.test.mjs",
+  "src/server/burnlist-discovery.test.mjs",
+  "src/ovens/oven-contract.test.mjs",
+  "src/ovens/oven-registry.test.mjs",
+  "src/server/projects.test.mjs",
+  "src/server/projects-api.test.mjs",
+  "ovens/differential-testing/engine/differential-testing-adapter-sdk.test.mjs",
+  "ovens/differential-testing/engine/differential-testing-contract.test.mjs",
+  "ovens/differential-testing/engine/differential-testing-data-contract.test.mjs",
+  "ovens/differential-testing/engine/differential-testing-transport-server.test.mjs",
+  "src/server/discovery.test.mjs",
+  "src/server/plan-model.test.mjs",
+  "src/server/fs-safe.test.mjs",
+  "src/cli/lifecycle-cli.test.mjs",
+  "src/cli/lifecycle-moves.test.mjs",
+  "src/cli/registry-cli.test.mjs",
+  "src/cli/git-ignore.test.mjs",
+  "src/cli/oven-cli.test.mjs",
+  "src/cli/oven-storage.test.mjs",
+  "src/cli/umbrella.test.mjs",
+  "src/server/oven-bindings.test.mjs",
+  "src/server/oven-warm.test.mjs",
+  "src/server/registry.test.mjs",
+  "src/server/repo-map.test.mjs",
+  "src/server/repo-state.test.mjs",
+  "dashboard/src/components/ProjectGroup/BurnlistRow.test.mjs",
+  "dashboard/src/lib/project-open.test.mjs",
+  "dashboard/src/lib/oven-identity.test.mjs",
+];
diff --git a/scripts/verify.mjs b/scripts/verify.mjs
index 8e8b0a9..19c9a21 100755
--- a/scripts/verify.mjs
+++ b/scripts/verify.mjs
@@ -3,7 +3,8 @@ import { spawnSync } from "node:child_process";
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { normalizeOvenPackage } from "../src/ovens/oven-contract.mjs";
+import { assertBuiltInOven, assertBuiltInOvenSet, assertSkillSet } from "./verify-oven-assertions.mjs";
+import { verificationTestFiles } from "./verify-test-files.mjs";
 
 const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const packageJson = JSON.parse(readFileSync(resolve(repoRoot, "package.json"), "utf8"));
@@ -113,53 +114,6 @@ function assertSourceExcludes(path, needle, message) {
   }
 }
 
-function assertBuiltInOvenSet(expected) {
-  const ovensRoot = resolve(repoRoot, "ovens");
-  const actual = readdirSync(ovensRoot, { withFileTypes: true })
-    .filter((entry) => entry.isDirectory())
-    .map((entry) => entry.name)
-    .sort();
-  const wanted = [...expected].sort();
-  if (JSON.stringify(actual) !== JSON.stringify(wanted)) {
-    console.error(`Default Oven ids must be exactly ${wanted.join(", ")}; found ${actual.join(", ") || "none"}.`);
-    process.exit(1);
-  }
-}
-
-function assertSkillSet(expected) {
-  const skillsRoot = resolve(repoRoot, "skills");
-  const actual = readdirSync(skillsRoot, { withFileTypes: true })
-    .filter((entry) => entry.isDirectory())
-    .map((entry) => entry.name)
-    .sort();
-  const wanted = [...expected].sort();
-  if (JSON.stringify(actual) !== JSON.stringify(wanted)) {
-    console.error(`Published skill ids must be exactly ${wanted.join(", ")}; found ${actual.join(", ") || "none"}.`);
-    process.exit(1);
-  }
-}
-
-function assertBuiltInOven(id, expectedName) {
-  const root = resolve(repoRoot, "ovens", id);
-  const instructionsPath = resolve(root, "instructions.md");
-  const detailPath = resolve(root, "detail.json");
-  try {
-    const ovenPackage = normalizeOvenPackage({
-      id,
-      instructions: readFileSync(instructionsPath, "utf8"),
-      detail: JSON.parse(readFileSync(detailPath, "utf8")),
-    });
-    const heading = ovenPackage.instructions
-      .split(/\r?\n/u)
-      .find((line) => /^#\s+\S/u.test(line.trim()))
-      ?.trim()
-      .replace(/^#\s+/u, "");
-    if (heading !== expectedName) throw new Error(`expected heading "${expectedName}", found "${heading || "none"}"`);
-  } catch (error) {
-    console.error(`Default oven ${id} violates the Oven contract: ${error.message}`);
-    process.exit(1);
-  }
-}
 
 function assertDifferentialTestingContractAssets() {
   const schemaPath = resolve(repoRoot, "ovens/differential-testing/schema/differential-testing-data.schema.json");
@@ -260,14 +214,18 @@ function assertPublishablePackage() {
   }
 }
 
-const jsFiles = [
+const jsFiles = [...new Set([
   ...walkFiles(resolve(repoRoot, "bin"), (path) => path.endsWith(".mjs")),
   ...walkFiles(resolve(repoRoot, "scripts"), (path) => path.endsWith(".mjs")),
   ...walkFiles(resolve(repoRoot, "src"), (path) => path.endsWith(".mjs")),
   ...walkFiles(resolve(repoRoot, "ovens/differential-testing/engine"), (path) => path.endsWith(".mjs")),
+  resolve(repoRoot, "src/ovens/oven-registry.mjs"),
+  resolve(repoRoot, "src/ovens/built-in-handlers.mjs"),
+  resolve(repoRoot, "src/ovens/handlers/generic-json-handler.mjs"),
+  resolve(repoRoot, "ovens/differential-testing/engine/differential-testing-handler.mjs"),
   resolve(repoRoot, "ovens/differential-testing/renderer/differential-testing-progress-chart.js"),
   resolve(repoRoot, "ovens/differential-testing/renderer/differential-testing-renderer.js"),
-].sort();
+])].sort();
 
 for (const file of jsFiles) {
   run(process.execPath, ["--check", relative(repoRoot, file)]);
@@ -286,10 +244,14 @@ assertSourceIncludes("src/server/burnlist-dashboard-server.mjs", "/api\\/oven-da
 assertSourceIncludes("src/server/burnlist-dashboard-server.mjs", 'url.pathname === "/api/repo-map"', "Read-only repository map API is missing.");
 assertSourceIncludes("src/server/repo-map.mjs", 'REPO_MAP_SCHEMA = "burnlist-repo-map@1"', "Repository map API does not expose its strict v1 schema.");
 assertSourceIncludes("src/server/burnlist-dashboard-server.mjs", 'assertKnownKeys(value, new Set(["id", "name", "instructions", "detail"]), "Oven")', "Oven creation does not reject fields outside the strict Oven contract.");
-assertSourceIncludes("src/server/burnlist-dashboard-server.mjs", 'assertKnownKeys(value, new Set(["ovenId", "repoRoot", "title", "objective"]), "Burn run")', "Burn run creation does not reject fields outside the strict Oven contract.");
+assertSourceIncludes("src/server/burnlist-dashboard-server.mjs", 'assertKnownKeys(value, new Set(["ovenId", "ovenRepoKey", "repoRoot", "title", "objective"]), "Burn run")', "Burn run creation does not reject fields outside the strict Oven contract.");
+assertSourceIncludes(".github/workflows/publish.yml", "git fetch origin main", "Publish reruns must refresh origin/main before release-state checks.");
+assertSourceIncludes(".github/workflows/publish.yml", '"refs/tags/${VERSION}^{}"', "Publish tag verification must request annotated-tag peeled refs.");
 assertSourceIncludes("src/server/burnlist-dashboard-server.mjs", "ovenId(record.ovenId);", "Burn run reads do not require the canonical ovenId.");
-assertSourceIncludes("src/server/burnlist-dashboard-server.mjs", "assertDifferentialTestingData(payload)", "Differential Testing data is not validated at the server boundary.");
-assertSourceIncludes("src/server/burnlist-dashboard-server.mjs", 'ovenName: "Differential Testing"', "Differential Testing scenarios are missing from the shared dashboard table.");
+assertSourceIncludes("ovens/differential-testing/engine/differential-testing-handler.mjs", "assertDifferentialTestingData(payload)", "Differential Testing data is not validated at the server boundary.");
+assertSourceIncludes("ovens/differential-testing/engine/differential-testing-handler.mjs", 'ovenName: "Differential Testing"', "Differential Testing scenarios are missing from the shared dashboard table.");
+assertSourceIncludes("ovens/differential-testing/engine/differential-testing-handler.mjs", "queryDifferentialTestingFieldPage", "Differential Testing server is missing bounded field-page transport.");
+assertSourceExcludes("src/server/burnlist-dashboard-server.mjs", 'id === "differential-testing"', "Dashboard server still hardcodes the Differential Testing Oven.");
 assertSourceIncludes("dashboard/src/lib/hrefs.ts", '? value! : "active"', "Dashboard table is not filtered to Active by default.");
 assertSourceIncludes("dashboard/src/components/ProjectGroup/BurnlistTable.tsx", '<th className="burnlist-table-heading">Oven</th>', "Shared dashboard table does not identify each row's Oven.");
 assertSourceIncludes("bin/burnlist.mjs", "--oven-data <id=path>", "Burnlist CLI is missing read-only Oven data binding help.");
@@ -332,7 +294,8 @@ assertSourceExcludes("src/server/burnlist-dashboard-server.mjs", "builder-hint",
 assertSourceExcludes("dashboard/src/components/BurnOvens/BurnOvens.tsx", "Drag to place a detail section", "React New Oven still renders the removed skeleton helper text.");
 assertSourceExcludes("src/server/burnlist-dashboard-server.mjs", "grid-ruler", "Oven detail skeleton still renders grid ruler numbers.");
 assertSourceExcludes("src/server/burnlist-dashboard-server.mjs", 'class="form-card oven-builder"', "Oven detail skeleton is still wrapped in a card container.");
-assertSourceExcludes("src/server/burnlist-dashboard-server.mjs", "ovenRevision", "Burn runs still claim a fixed Oven revision.");
+assertSourceIncludes("src/server/burnlist-dashboard-server.mjs", "schemaVersion: 4", "Burn runs do not write manifest schema version 4.");
+assertSourceIncludes("src/server/burnlist-dashboard-server.mjs", "ovenRevision: oven.ovenRevision", "Burn runs do not pin the Oven revision.");
 assertSourceIncludes("dashboard/src/components/BurnOvens/BurnOvens.tsx", 'useState("checklist")', "React Run Burn does not default to Checklist.");
 assertSourceIncludes("ovens/checklist/instructions.md", "## Active Checklist", "Checklist no longer preserves the Burnlist active queue contract.");
 assertSourceIncludes("ovens/differential-testing/instructions.md", "fix the capture, adapter, or comparison seam", "Differential Testing is missing source-fix discipline.");
@@ -362,7 +325,6 @@ assertSourceIncludes("ovens/differential-testing/renderer/differential-testing-r
 assertSourceIncludes("ovens/differential-testing/renderer/differential-testing-renderer.js", 'role="button" tabindex="0" aria-expanded=', "Differential Testing rows do not preserve the expand interaction contract.");
 assertSourceIncludes("ovens/differential-testing/renderer/differential-testing-renderer.js", 'placeholder="Search Fields..."', "Differential Testing does not preserve the canonical search control.");
 assertSourceIncludes("ovens/differential-testing/renderer/differential-testing-renderer.js", 'data-driving-parity-chart="delta"', "Differential Testing does not preserve the canonical Value and Delta controls.");
-assertSourceIncludes("src/server/burnlist-dashboard-server.mjs", "queryDifferentialTestingFieldPage", "Differential Testing server is missing bounded field-page transport.");
 assertSourceIncludes("ovens/differential-testing/renderer/differential-testing-renderer.js", 'data-driving-parity-sort="improved"', "Differential Testing does not preserve the canonical Changed control.");
 assertSourceIncludes("ovens/differential-testing/renderer/differential-testing-renderer.js", 'data-driving-parity-filter="failing"', "Differential Testing does not preserve the canonical Failed control.");
 assertSourceIncludes("ovens/differential-testing/renderer/differential-testing-renderer.js", 'class="hybrid-cell hybrid-field"', "Differential Testing does not preserve the canonical hybrid field cell.");
@@ -406,31 +368,14 @@ assertSourceExcludes("README.md", "**Target**", "README still advertises the rem
 assertSourceExcludes("src/server/burnlist-dashboard-server.mjs", '"/targets"', "Dashboard server still exposes the removed Targets route.");
 assertSourceExcludes("dashboard/src/App.tsx", '"/targets"', "React dashboard still exposes the removed Targets route.");
 assertSourceExcludes("src/ovens/oven-contract.mjs", '"target"', "Oven contract still accepts the removed Target widget.");
-assertSkillSet(["burnlist"]);
-assertBuiltInOvenSet(["checklist", "differential-testing"]);
-assertBuiltInOven("checklist", "Checklist");
-assertBuiltInOven("differential-testing", "Differential Testing");
+assertSkillSet(repoRoot, ["burnlist"]);
+assertBuiltInOvenSet(repoRoot, ["checklist", "differential-testing"]);
+assertBuiltInOven(repoRoot, "checklist", "Checklist");
+assertBuiltInOven(repoRoot, "differential-testing", "Differential Testing");
 assertDifferentialTestingContractAssets();
 assertPublishablePackage();
 
-run(process.execPath, [
-  "--test",
-  "src/server/dashboard-routes.test.mjs",
-  "src/server/projects.test.mjs",
-  "src/server/projects-api.test.mjs",
-  "ovens/differential-testing/engine/differential-testing-adapter-sdk.test.mjs",
-  "ovens/differential-testing/engine/differential-testing-contract.test.mjs",
-  "ovens/differential-testing/engine/differential-testing-data-contract.test.mjs",
-  "src/server/discovery.test.mjs",
-  "src/server/plan-model.test.mjs",
-  "src/cli/lifecycle-cli.test.mjs",
-  "src/cli/lifecycle-moves.test.mjs",
-  "src/cli/registry-cli.test.mjs",
-  "src/cli/umbrella.test.mjs",
-  "src/server/registry.test.mjs",
-  "src/server/repo-map.test.mjs",
-  "src/server/repo-state.test.mjs",
-]);
+run(process.execPath, ["--test", ...verificationTestFiles]);
 
 run(process.execPath, ["scripts/register-skills.mjs", "--force-global", "--dry-run"], {
   env: { ...process.env, HOME: resolve(repoRoot, "fixtures", "npm-home") },
diff --git a/src/cli/git-ignore.mjs b/src/cli/git-ignore.mjs
new file mode 100644
index 0000000..da0fa6e
--- /dev/null
+++ b/src/cli/git-ignore.mjs
@@ -0,0 +1,34 @@
+import { spawnSync } from "node:child_process";
+import { relative, resolve, sep } from "node:path";
+
+export function gitProbe(dir, args) {
+  return spawnSync("git", ["-C", dir, ...args], {
+    cwd: dir,
+    encoding: "utf8",
+    shell: false,
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+}
+
+function repoRelativePath(repoRoot, targetPath) {
+  const root = resolve(repoRoot);
+  const target = resolve(root, targetPath);
+  return relative(root, target).split(sep).join("/") || ".";
+}
+
+function isNotGitRepository(result) {
+  return result.status === 128 && /not a git repository/iu.test(result.stderr ?? "");
+}
+
+export function assertGitIgnored(repoRoot, targetPath) {
+  const root = resolve(repoRoot);
+  const target = repoRelativePath(root, targetPath);
+  const result = gitProbe(root, ["check-ignore", "-q", "--", target]);
+  if (result.status === 0) return;
+  if (result.status === 1) {
+    throw new Error(`refusing to write ${target}: not git-ignored; run \`burnlist init\` or add it to .gitignore`);
+  }
+  if (isNotGitRepository(result)) return;
+  const reason = result.error?.message || result.stderr?.trim() || `git exited with status ${result.status}`;
+  throw new Error(`could not check whether ${target} is git-ignored: ${reason}`);
+}
diff --git a/src/cli/git-ignore.test.mjs b/src/cli/git-ignore.test.mjs
new file mode 100644
index 0000000..067b8c2
--- /dev/null
+++ b/src/cli/git-ignore.test.mjs
@@ -0,0 +1,68 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+
+const repoRoot = resolve(fileURLToPath(new URL("../..", import.meta.url)));
+const binPath = join(repoRoot, "bin", "burnlist.mjs");
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), "burnlist-git-ignore-"));
+  const repo = join(root, "repo");
+  mkdirSync(repo);
+  return { repo, home: join(root, "home"), cleanup: () => rmSync(root, { recursive: true, force: true }) };
+}
+
+function run(context, ...args) {
+  return execFileSync(process.execPath, [binPath, ...args], {
+    cwd: context.repo,
+    encoding: "utf8",
+    env: { ...process.env, HOME: context.home },
+  });
+}
+
+function ovenPackage() {
+  return {
+    instructions: "# Local Oven\n\nKeep this local.",
+    detail: {
+      version: 1,
+      columns: 2,
+      rows: 2,
+      rowHeight: 48,
+      cells: [{
+        id: "summary", title: "Summary", description: "Current state.", widget: "metric", source: "/summary", format: "plain",
+        column: 1, row: 1, columnSpan: 2, rowSpan: 1,
+      }],
+    },
+  };
+}
+
+test("oven writes require ignored local storage only in Git repositories", () => {
+  const gitContext = fixture();
+  const gitPackage = join(gitContext.repo, "oven.json");
+  const gitOven = join(gitContext.repo, ".local", "burnlist", "ovens", "guarded-oven");
+  try {
+    execFileSync("git", ["init", "--quiet"], { cwd: gitContext.repo, stdio: "ignore" });
+    writeFileSync(gitPackage, JSON.stringify(ovenPackage()));
+    assert.throws(
+      () => run(gitContext, "oven", "create", "guarded-oven", "--package", gitPackage),
+      (error) => String(error.stderr).includes("refusing to write .local/burnlist/ovens: not git-ignored"),
+    );
+    assert.equal(existsSync(gitOven), false);
+
+    run(gitContext, "init", gitContext.repo);
+    run(gitContext, "oven", "create", "guarded-oven", "--package", gitPackage);
+    assert.equal(existsSync(join(gitOven, "current")), true);
+  } finally { gitContext.cleanup(); }
+
+  const nonGitContext = fixture();
+  const nonGitPackage = join(nonGitContext.repo, "oven.json");
+  try {
+    writeFileSync(nonGitPackage, JSON.stringify(ovenPackage()));
+    run(nonGitContext, "oven", "create", "non-git-oven", "--package", nonGitPackage);
+    assert.equal(existsSync(join(nonGitContext.repo, ".local", "burnlist", "ovens", "non-git-oven", "current")), true);
+  } finally { nonGitContext.cleanup(); }
+});
diff --git a/src/cli/lifecycle-cli.test.mjs b/src/cli/lifecycle-cli.test.mjs
index b028321..5314019 100644
--- a/src/cli/lifecycle-cli.test.mjs
+++ b/src/cli/lifecycle-cli.test.mjs
@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
+import { execFileSync, spawn, spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
@@ -75,6 +75,30 @@ test("new allocates incrementing ids and skips an existing draft reservation", (
   }
 });
 
+test("concurrent new commands allocate distinct ids", async () => {
+  const context = fixture();
+  try {
+    const create = () => new Promise((resolve, reject) => {
+      const child = spawn(process.execPath, [binPath, "new"], {
+        cwd: context.repo,
+        env: { ...process.env, HOME: context.home },
+        stdio: ["ignore", "pipe", "pipe"],
+      });
+      let output = "";
+      let errors = "";
+      child.stdout.on("data", (chunk) => { output += chunk; });
+      child.stderr.on("data", (chunk) => { errors += chunk; });
+      child.on("error", reject);
+      child.on("close", (status) => resolve({ status, output, errors }));
+    });
+    const results = await Promise.all([create(), create()]);
+    assert.deepEqual(results.map((result) => result.status), [0, 0]);
+    assert.deepEqual(new Set(results.map((result) => result.output.trim().split("\n")[0])).size, 2);
+  } finally {
+    context.cleanup();
+  }
+});
+
 function addActiveItem(planPath, repo) {
   writeFileSync(planPath, [
     "# Sample Burnlist",
@@ -180,19 +204,34 @@ test("start moves a ready Burnlist to inprogress", () => {
   }
 });
 
-test("lifecycle moves reject an existing target folder", () => {
+test("lifecycle moves reject a populated target folder", () => {
   const context = fixture();
   try {
     const result = newPlan(context);
     addActiveItem(result.planPath, context.repo);
     mkdirSync(lifecycleFolder(context.repo, "ready", result.id), { recursive: true });
+    writeFileSync(join(lifecycleFolder(context.repo, "ready", result.id), "existing"), "keep\n");
     assert.match(runFailure(context, "ready", result.id), /target exists/u);
   } finally {
     context.cleanup();
   }
 });
 
-test("close requires a finished queue and writes a completion digest before moving", () => {
+test("lifecycle moves reclaim an empty target folder", () => {
+  const context = fixture();
+  try {
+    const result = newPlan(context);
+    addActiveItem(result.planPath, context.repo);
+    mkdirSync(lifecycleFolder(context.repo, "ready", result.id), { recursive: true });
+    assert.match(run(context, "ready", result.id), new RegExp(`${result.id}  draft -> ready`));
+    assert.equal(existsSync(lifecycleFolder(context.repo, "draft", result.id)), false);
+    assert.equal(existsSync(lifecycleFolder(context.repo, "ready", result.id)), true);
+  } finally {
+    context.cleanup();
+  }
+});
+
+test("close requires a finished queue and writes a completion digest in the target", () => {
   const context = fixture();
   try {
     const result = newPlan(context);
@@ -278,8 +317,7 @@ test("lifecycle verbs reject an existing per-id lock", () => {
   try {
     const result = newPlan(context);
     addActiveItem(result.planPath, context.repo);
-    mkdirSync(join(dirname(result.planPath), ".lock"));
-    writeFileSync(join(dirname(result.planPath), ".lock", "owner.json"), JSON.stringify({ token: "foreign", pid: process.pid }));
+    writeFileSync(join(dirname(result.planPath), ".lock"), JSON.stringify({ token: "foreign", pid: process.pid }));
     assert.match(runFailure(context, "ready", result.id), new RegExp(`${result.id} is busy \\(locked\\)`));
   } finally {
     context.cleanup();
@@ -291,14 +329,47 @@ test("lifecycle verbs reclaim a dead lock owner", () => {
   try {
     const result = newPlan(context);
     addActiveItem(result.planPath, context.repo);
-    mkdirSync(join(dirname(result.planPath), ".lock"));
-    writeFileSync(join(dirname(result.planPath), ".lock", "pid"), "999999999\n");
+    writeFileSync(join(dirname(result.planPath), ".lock"), JSON.stringify({ token: "dead", pid: 999999999 }));
     assert.match(run(context, "ready", result.id), new RegExp(`${result.id}  draft -> ready`));
   } finally {
     context.cleanup();
   }
 });
 
+const gitAvailable = spawnSync("git", ["--version"], { stdio: "ignore" }).status === 0;
+
+test("full lifecycle from a linked worktree uses the primary repository", { skip: !gitAvailable }, () => {
+  const root = mkdtempSync(join(tmpdir(), "burnlist-lifecycle-worktree-"));
+  const primary = join(root, "primary");
+  const linked = join(root, "linked");
+  const home = join(root, "home");
+  try {
+    mkdirSync(primary);
+    mkdirSync(home);
+    execFileSync("git", ["init", "--quiet", primary]);
+    execFileSync("git", ["-C", primary, "config", "user.email", "test@example.com"]);
+    execFileSync("git", ["-C", primary, "config", "user.name", "Burnlist Test"]);
+    mkdirSync(join(primary, "notes", "burnlists"), { recursive: true });
+    writeFileSync(join(primary, "README.md"), "# primary\n");
+    execFileSync("git", ["-C", primary, "add", "README.md"]);
+    execFileSync("git", ["-C", primary, "commit", "--quiet", "-m", "initial"]);
+    execFileSync("git", ["-C", primary, "worktree", "add", "--detach", linked], { stdio: "ignore" });
+
+    const context = { repo: linked, home };
+    const result = newPlan(context);
+    assert.equal(result.planPath.startsWith(`${realpathSync(primary)}/`), true);
+    addActiveItem(result.planPath, primary);
+    run(context, "ready", result.id);
+    run(context, "start", result.id);
+    run(context, "burn", result.id, "B1");
+    run(context, "close", result.id);
+    assert.equal(existsSync(lifecycleFolder(primary, "completed", result.id)), true);
+    assert.equal(existsSync(lifecycleFolder(linked, "completed", result.id)), false);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
 test("dashboard stop leaves malformed and foreign live global runtime records alone", () => {
   const context = fixture();
   try {
diff --git a/src/cli/lifecycle-moves.mjs b/src/cli/lifecycle-moves.mjs
index 561c401..100641c 100644
--- a/src/cli/lifecycle-moves.mjs
+++ b/src/cli/lifecycle-moves.mjs
@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, renameSync, rmSync, rmdirSync, writeFileSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 import {
   LIFECYCLES,
@@ -8,7 +8,9 @@ import {
   parsePlan,
   validatePlan,
 } from "../server/plan-model.mjs";
-import { safeStat } from "../server/fs-safe.mjs";
+import { safeStat, withLock } from "../server/fs-safe.mjs";
+
+export { withLock } from "../server/fs-safe.mjs";
 
 function lifecycleRoot(repoRoot, lifecycle) {
   return join(repoRoot, "notes", "burnlists", lifecycle.folder);
@@ -52,81 +54,28 @@ export function findBurnlistDir(repoRoot, id) {
   return matches[0];
 }
 
-function isPositivePid(pid) {
-  return Number.isInteger(pid) && pid > 0;
+function appendCompletionDigestIfMissing(plan) {
+  if (/^##\s+Completion Digest\b/m.test(plan.markdown)) return false;
+  atomicWrite(plan.planPath, `${plan.markdown.replace(/\s*$/u, "")}\n\n${completionDigestMarkdown(plan)}\n`);
+  return true;
 }
 
-function lockOwner(lock) {
-  try {
-    const owner = JSON.parse(readFileSync(join(lock, "owner.json"), "utf8"));
-    return isPositivePid(owner?.pid) && typeof owner.token === "string" && owner.token ? owner : null;
-  } catch {
-    return null;
-  }
+function targetExists(id) {
+  return new Error(`${id}: target exists`);
 }
 
-function pidIsAlive(pid) {
-  if (!isPositivePid(pid)) return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return error?.code !== "ESRCH";
-  }
-}
-
-export function withLock(dir, fn) {
-  let lockedDir = dir;
-  const token = randomBytes(12).toString("hex");
-  const lock = join(lockedDir, ".lock");
-  try {
-    mkdirSync(lock);
-  } catch (error) {
-    if (error?.code !== "EEXIST") throw error;
-    const owner = lockOwner(lock);
-    if (owner && pidIsAlive(owner.pid)) throw new Error(`${basename(dir)} is busy (locked)`);
-    const currentOwner = lockOwner(lock);
-    if (currentOwner?.token !== owner?.token) throw new Error(`${basename(dir)} is busy (locked)`);
-    const retired = `${lock}.${token}.stale`;
-    try {
-      renameSync(lock, retired);
-    } catch (takeoverError) {
-      if (takeoverError?.code === "EEXIST" || takeoverError?.code === "ENOENT") {
-        throw new Error(`${basename(dir)} is busy (locked)`);
-      }
-      throw takeoverError;
-    }
-    rmSync(retired, { recursive: true, force: true });
-    try {
-      mkdirSync(lock);
-    } catch (takeoverError) {
-      if (takeoverError?.code === "EEXIST") throw new Error(`${basename(dir)} is busy (locked)`);
-      throw takeoverError;
-    }
-  }
+function reclaimEmptyTarget(targetDir, id) {
   try {
-    atomicWrite(join(lock, "owner.json"), `${JSON.stringify({ token, pid: process.pid })}\n`);
+    rmdirSync(targetDir);
+    return;
   } catch (error) {
-    if (lockOwner(lock)?.token === token) rmSync(lock, { recursive: true, force: true });
+    if (error?.code === "ENOENT") return;
+    if (error?.code === "ENOTEMPTY") throw targetExists(id);
     throw error;
   }
-  try {
-    const movedDir = fn();
-    if (typeof movedDir === "string") lockedDir = movedDir;
-    return movedDir;
-  } finally {
-    const finalLock = join(lockedDir, ".lock");
-    if (lockOwner(finalLock)?.token === token) rmSync(finalLock, { recursive: true, force: true });
-  }
 }
 
-function appendCompletionDigestIfMissing(plan) {
-  if (/^##\s+Completion Digest\b/m.test(plan.markdown)) return false;
-  atomicWrite(plan.planPath, `${plan.markdown.replace(/\s*$/u, "")}\n\n${completionDigestMarkdown(plan)}\n`);
-  return true;
-}
-
-export function moveLifecycle({ repoRoot, id, from, to, gate, beforeMove }) {
+export function moveLifecycle({ repoRoot, id, from, to, gate, afterMove }) {
   assertValidBurnlistId(id);
   const sourceLifecycle = LIFECYCLES.find((lifecycle) => lifecycle.folder === from);
   const sourceDir = join(lifecycleRoot(repoRoot, sourceLifecycle), id);
@@ -136,20 +85,20 @@ export function moveLifecycle({ repoRoot, id, from, to, gate, beforeMove }) {
   }
   const targetRoot = join(repoRoot, "notes", "burnlists", to);
   const targetDir = join(targetRoot, id);
-  return withLock(sourceDir, () => {
+  return withLock(sourceDir, ({ retarget }) => {
     const plan = parsePlan(join(sourceDir, "burnlist.md"));
     validateOrThrow(plan);
     gate(plan);
-    if (safeStat(targetDir)) throw new Error(`${id}: target exists`);
-    beforeMove?.(plan);
     mkdirSync(targetRoot, { recursive: true });
-    if (safeStat(targetDir)) throw new Error(`${id}: target exists`);
+    reclaimEmptyTarget(targetDir, id);
+    renameSync(sourceDir, targetDir);
     try {
-      renameSync(sourceDir, targetDir);
+      afterMove?.(parsePlan(join(targetDir, "burnlist.md")));
     } catch (error) {
-      if (error?.code === "EEXIST" || error?.code === "ENOTEMPTY") throw new Error(`${id}: target exists`);
+      renameSync(targetDir, sourceDir);
       throw error;
     }
+    retarget(targetDir);
     console.log(`${id}  ${from} -> ${to}`);
     return targetDir;
   });
@@ -177,20 +126,35 @@ export function startLifecycle(repoRoot, id) {
 }
 
 export function closeLifecycle(repoRoot, id) {
+  assertValidBurnlistId(id);
+  const inprogressDir = join(repoRoot, "notes", "burnlists", "inprogress", id);
+  const completedDir = join(repoRoot, "notes", "burnlists", "completed", id);
+  if (!safeStat(inprogressDir)?.isDirectory() && safeStat(completedDir)?.isDirectory()) {
+    return withLock(completedDir, () => {
+      const plan = parsePlan(join(completedDir, "burnlist.md"));
+      validateOrThrow(plan);
+      assertCloseGate(plan);
+      const repaired = appendCompletionDigestIfMissing(plan);
+      console.log(repaired ? `${id} completed (digest repaired)` : `${id} already completed`);
+      return completedDir;
+    });
+  }
   return moveLifecycle({
     repoRoot,
     id,
     from: "inprogress",
     to: "completed",
-    gate(plan) {
-      if (plan.items.length || !plan.completed.length) {
-        throw new Error("not ready to close: active checklist must be empty with completed entries");
-      }
-    },
-    beforeMove: appendCompletionDigestIfMissing,
+    gate: assertCloseGate,
+    afterMove: appendCompletionDigestIfMissing,
   });
 }
 
+function assertCloseGate(plan) {
+  if (plan.items.length || !plan.completed.length) {
+    throw new Error("not ready to close: active checklist must be empty with completed entries");
+  }
+}
+
 function activeRange(lines) {
   const start = lines.findIndex((line) => line.trim() === "## Active Checklist");
   if (start < 0) throw new Error("Missing ## Active Checklist section.");
diff --git a/src/cli/lifecycle-moves.test.mjs b/src/cli/lifecycle-moves.test.mjs
index 89b2442..bebf888 100644
--- a/src/cli/lifecycle-moves.test.mjs
+++ b/src/cli/lifecycle-moves.test.mjs
@@ -1,9 +1,10 @@
 import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
 import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
-import { burnItem, findBurnlistDir, moveLifecycle, withLock } from "./lifecycle-moves.mjs";
+import { burnItem, closeLifecycle, findBurnlistDir, moveLifecycle, withLock } from "./lifecycle-moves.mjs";
 
 function fixture() {
   const root = mkdtempSync(join(tmpdir(), "burnlist-lifecycle-moves-"));
@@ -30,26 +31,52 @@ function writePlan(root, lifecycle, id) {
   return { dir, planPath };
 }
 
+function writeClosablePlan(root, lifecycle, id) {
+  const result = writePlan(root, lifecycle, id);
+  writeFileSync(result.planPath, [
+    "# Test Burnlist",
+    "",
+    "## Active Checklist",
+    "",
+    "## Completed",
+    "- B1 | 2026-07-13T12:00:00+00:00 | Test staged burn",
+    "",
+  ].join("\n"));
+  return result;
+}
+
+function captureConsole(callback) {
+  const original = console.log;
+  let output = "";
+  console.log = (message) => { output += `${message}\n`; };
+  try {
+    const result = callback();
+    return { output, result };
+  } finally {
+    console.log = original;
+  }
+}
+
 test("withLock takes over a dead owner and preserves a replacement owner on release", () => {
   const context = fixture();
   try {
     const dir = join(context.root, "260713-001");
     const lock = join(dir, ".lock");
-    mkdirSync(lock, { recursive: true });
-    writeFileSync(join(lock, "owner.json"), JSON.stringify({ token: "dead", pid: 999999999 }));
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(lock, JSON.stringify({ token: "dead", pid: 999999999 }));
     let owner;
     withLock(dir, () => {
-      owner = JSON.parse(readFileSync(join(lock, "owner.json"), "utf8"));
+      owner = JSON.parse(readFileSync(lock, "utf8"));
     });
     assert.equal(owner.pid, process.pid);
     assert.notEqual(owner.token, "dead");
     assert.equal(existsSync(lock), false);
 
     withLock(dir, () => {
-      writeFileSync(join(lock, "owner.json"), JSON.stringify({ token: "replacement", pid: process.pid }));
+      writeFileSync(lock, JSON.stringify({ token: "replacement", pid: process.pid }));
     });
-    assert.equal(JSON.parse(readFileSync(join(lock, "owner.json"), "utf8")).token, "replacement");
-    rmSync(lock, { recursive: true, force: true });
+    assert.equal(JSON.parse(readFileSync(lock, "utf8")).token, "replacement");
+    rmSync(lock, { force: true });
   } finally {
     context.cleanup();
   }
@@ -60,14 +87,79 @@ test("withLock rejects a live foreign owner", () => {
   try {
     const dir = join(context.root, "260713-001");
     const lock = join(dir, ".lock");
-    mkdirSync(lock, { recursive: true });
-    writeFileSync(join(lock, "owner.json"), JSON.stringify({ token: "foreign", pid: process.pid }));
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(lock, JSON.stringify({ token: "foreign", pid: process.pid }));
     assert.throws(() => withLock(dir, () => {}), /260713-001 is busy \(locked\)/u);
   } finally {
     context.cleanup();
   }
 });
 
+test("withLock treats a malformed lock as busy", () => {
+  const context = fixture();
+  try {
+    const dir = join(context.root, "260713-001");
+    const lock = join(dir, ".lock");
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(lock, "");
+    assert.throws(() => withLock(dir, () => {}), /260713-001 is busy \(locked\)/u);
+    assert.equal(readFileSync(lock, "utf8"), "");
+  } finally {
+    context.cleanup();
+  }
+});
+
+test("two racing lock acquirers have exactly one winner", async () => {
+  const context = fixture();
+  try {
+    const dir = join(context.root, "260713-001");
+    mkdirSync(dir, { recursive: true });
+    const script = [
+      `import { withLock } from ${JSON.stringify(new URL("./lifecycle-moves.mjs", import.meta.url).href)};`,
+      "try {",
+      "  withLock(process.argv[1], () => {",
+      "    process.stdout.write('won\\n');",
+      "    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 750);",
+      "  });",
+      "} catch (error) { process.stderr.write(error.message); process.exitCode = 1; }",
+    ].join("\n");
+    const run = () => new Promise((resolve) => {
+      const child = spawn(process.execPath, ["--input-type=module", "--eval", script, dir]);
+      let output = "";
+      child.stdout.on("data", (chunk) => { output += chunk; });
+      child.on("close", (status) => resolve({ output, status }));
+    });
+    const results = await Promise.all([run(), run()]);
+    assert.deepEqual(results.map((result) => result.status).sort(), [0, 1]);
+    assert.equal(results.filter((result) => result.output === "won\n").length, 1);
+  } finally {
+    context.cleanup();
+  }
+});
+
+test("concurrent same-id lifecycle moves publish only one target", async () => {
+  const context = fixture();
+  try {
+    const id = "260713-001";
+    writePlan(context.root, "draft", id);
+    const script = [
+      `import { moveLifecycle } from ${JSON.stringify(new URL("./lifecycle-moves.mjs", import.meta.url).href)};`,
+      "try {",
+      "  moveLifecycle({ repoRoot: process.argv[1], id: process.argv[2], from: 'draft', to: 'ready', gate() {} });",
+      "} catch (error) { process.stderr.write(error.message); process.exitCode = 1; }",
+    ].join("\n");
+    const run = () => new Promise((resolve) => {
+      const child = spawn(process.execPath, ["--input-type=module", "--eval", script, context.root, id]);
+      child.on("close", (status) => resolve(status));
+    });
+    assert.deepEqual((await Promise.all([run(), run()])).sort(), [0, 1]);
+    assert.equal(existsSync(folder(context.root, "draft", id)), false);
+    assert.equal(existsSync(folder(context.root, "ready", id)), true);
+  } finally {
+    context.cleanup();
+  }
+});
+
 test("burn rejects an id duplicated across lifecycle folders", () => {
   const context = fixture();
   try {
@@ -116,3 +208,115 @@ test("burn validates its staged markdown before replacing burnlist.md", () => {
     context.cleanup();
   }
 });
+
+test("close leaves its source unchanged when a populated target prevents the rename", () => {
+  const context = fixture();
+  try {
+    const id = "260713-001";
+    const { planPath } = writeClosablePlan(context.root, "inprogress", id);
+    const before = readFileSync(planPath, "utf8");
+    const target = folder(context.root, "completed", id);
+    mkdirSync(target, { recursive: true });
+    writeFileSync(join(target, "existing"), "keep\n");
+    assert.throws(() => closeLifecycle(context.root, id), /260713-001: target exists/u);
+    assert.equal(readFileSync(planPath, "utf8"), before);
+    assert.equal(readFileSync(planPath, "utf8").includes("## Completion Digest"), false);
+    assert.equal(readFileSync(join(target, "existing"), "utf8"), "keep\n");
+  } finally {
+    context.cleanup();
+  }
+});
+
+test("close reclaims an empty stale target reservation", () => {
+  const context = fixture();
+  try {
+    const id = "260713-001";
+    writeClosablePlan(context.root, "inprogress", id);
+    mkdirSync(folder(context.root, "completed", id), { recursive: true });
+    closeLifecycle(context.root, id);
+    assert.equal(existsSync(folder(context.root, "inprogress", id)), false);
+    assert.equal(readFileSync(join(folder(context.root, "completed", id), "burnlist.md"), "utf8").includes("## Completion Digest"), true);
+  } finally {
+    context.cleanup();
+  }
+});
+
+test("close repairs a digest-less burnlist already in completed", () => {
+  const context = fixture();
+  try {
+    const id = "260713-001";
+    const { planPath } = writeClosablePlan(context.root, "completed", id);
+    const { output } = captureConsole(() => closeLifecycle(context.root, id));
+    assert.match(output, /260713-001 completed \(digest repaired\)/u);
+    assert.equal(readFileSync(planPath, "utf8").includes("## Completion Digest"), true);
+  } finally {
+    context.cleanup();
+  }
+});
+
+test("close reports an already-completed burnlist with a digest", () => {
+  const context = fixture();
+  try {
+    const id = "260713-001";
+    const { planPath } = writeClosablePlan(context.root, "completed", id);
+    writeFileSync(planPath, `${readFileSync(planPath, "utf8")}\n## Completion Digest\n- Complete\n`);
+    const { output } = captureConsole(() => closeLifecycle(context.root, id));
+    assert.match(output, /260713-001 already completed/u);
+  } finally {
+    context.cleanup();
+  }
+});
+
+test("resumable close validates and re-applies the close gate before digesting", () => {
+  const context = fixture();
+  try {
+    const id = "260713-001";
+    const { planPath } = writePlan(context.root, "completed", id);
+    assert.throws(
+      () => closeLifecycle(context.root, id),
+      /not ready to close: active checklist must be empty with completed entries/u,
+    );
+    assert.equal(readFileSync(planPath, "utf8").includes("## Completion Digest"), false);
+
+    writeFileSync(planPath, "# Test Burnlist\n\n## Active Checklist\n\n## Completed\n- B1 | not-a-timestamp | Test staged burn\n");
+    assert.throws(() => closeLifecycle(context.root, id), /invalid timestamp/u);
+    assert.equal(readFileSync(planPath, "utf8").includes("## Completion Digest"), false);
+  } finally {
+    context.cleanup();
+  }
+});
+
+test("close normally moves an in-progress burnlist before writing its digest", () => {
+  const context = fixture();
+  try {
+    const id = "260713-001";
+    writeClosablePlan(context.root, "inprogress", id);
+    const { output } = captureConsole(() => closeLifecycle(context.root, id));
+    assert.match(output, /260713-001  inprogress -> completed/u);
+    assert.equal(existsSync(folder(context.root, "inprogress", id)), false);
+    assert.equal(readFileSync(join(folder(context.root, "completed", id), "burnlist.md"), "utf8").includes("## Completion Digest"), true);
+  } finally {
+    context.cleanup();
+  }
+});
+
+test("afterMove failure rolls back a lifecycle move without changing its plan", () => {
+  const context = fixture();
+  try {
+    const id = "260713-001";
+    const { planPath } = writePlan(context.root, "inprogress", id);
+    const before = readFileSync(planPath, "utf8");
+    assert.throws(() => moveLifecycle({
+      repoRoot: context.root,
+      id,
+      from: "inprogress",
+      to: "completed",
+      gate() {},
+      afterMove() { throw new Error("digest failed"); },
+    }), /digest failed/u);
+    assert.equal(readFileSync(planPath, "utf8"), before);
+    assert.equal(existsSync(folder(context.root, "completed", id)), false);
+  } finally {
+    context.cleanup();
+  }
+});
diff --git a/src/cli/oven-cli.mjs b/src/cli/oven-cli.mjs
index c353cd0..f356a20 100644
--- a/src/cli/oven-cli.mjs
+++ b/src/cli/oven-cli.mjs
@@ -7,15 +7,14 @@
 // own file plumbing so it never has to import the dashboard server (which
 // boots an HTTP listener on import). Like the dashboard, it can only create or
 // replace custom Ovens under ignored local state; it never executes anything.
-import { randomBytes } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { normalizeOvenDetail, normalizeOvenPackage, ovenId } from "../ovens/oven-contract.mjs";
+import { normalizeOvenPackage, ovenId, ovenRevision } from "../ovens/oven-contract.mjs";
+import { bindingStorePath, readBindingStore, removeBinding, writeBinding } from "../server/oven-bindings.mjs";
+import { resolveCustomOvensDir } from "../server/oven-storage.mjs";
 import { renderGrid, sectionTable } from "./oven-cli-render.mjs";
-
-const MAX_INSTRUCTION_BYTES = 65536;
-const MAX_DETAIL_BYTES = 131072;
+import { createOvenCatalog, persistOven, resolvePackageInput } from "./oven-storage.mjs";
+import { resolveUmbrella } from "./umbrella.mjs";
 
 // ── argv ────────────────────────────────────────────────────────────────────
 // process.argv is [node, bin/burnlist.mjs, "oven", <subcommand>, ...rest].
@@ -46,99 +45,34 @@ function fail(message) {
   process.exit(1);
 }
 
-// ── storage locations (mirror the dashboard server) ──────────────────────────
-const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
-const builtInOvensDir = resolve(packageRoot, "ovens");
-const legacyBuiltInTypesDir = resolve(packageRoot, "types");
-const launchCwd = process.cwd();
-const customOvensDir = resolve(launchCwd, flags.get("ovens-dir") ?? ".local/burnlist/ovens");
-const legacyCustomTypesDir = resolve(launchCwd, flags.get("types-dir") ?? ".local/burnlist/types");
-
-function safeStat(path) {
-  try {
-    return statSync(path);
-  } catch {
-    return null;
-  }
-}
-
-function readTextFileWithLimit(path, maxBytes, label) {
-  const stat = statSync(path);
-  if (stat.size > maxBytes) throw new Error(`${label} is ${stat.size} bytes, over the ${maxBytes} byte limit.`);
-  return readFileSync(path, "utf8");
-}
-
-function instructionsName(instructions, fallback) {
-  const heading = instructions.split(/\r?\n/u).find((line) => /^#\s+\S/u.test(line.trim()));
-  return heading ? heading.trim().replace(/^#\s+/u, "").trim() : fallback;
+function repoRoot() {
+  if (flags.get("repo") === "true") fail("--repo requires a path.");
+  return flags.has("repo") ? resolve(launchCwd, flags.get("repo")) : resolveUmbrella(launchCwd);
 }
 
-function instructionsDescription(instructions) {
-  return (
-    instructions
-      .split(/\r?\n/u)
-      .map((line) => line.trim())
-      .find((line) => line && !line.startsWith("#")) ?? ""
-  );
+function bindingRepo() {
+  return repoRoot();
 }
 
-// Read one Oven directory, tolerating the legacy definition.md/dashboard.json
-// filenames so `view`/`list` match what the dashboard discovers.
-function readOvenDir(root, id, builtIn) {
-  const safeId = ovenId(id);
-  const ovenRoot = join(root, safeId);
-  const instructionsPath = safeStat(join(ovenRoot, "instructions.md"))?.isFile()
-    ? join(ovenRoot, "instructions.md")
-    : join(ovenRoot, "definition.md");
-  const detailPath = safeStat(join(ovenRoot, "detail.json"))?.isFile()
-    ? join(ovenRoot, "detail.json")
-    : join(ovenRoot, "dashboard.json");
-  if (!safeStat(instructionsPath)?.isFile() || !safeStat(detailPath)?.isFile()) return null;
-  const ovenPackage = normalizeOvenPackage({
-    id: safeId,
-    instructions: readTextFileWithLimit(instructionsPath, MAX_INSTRUCTION_BYTES, "Oven instructions"),
-    detail: JSON.parse(readTextFileWithLimit(detailPath, MAX_DETAIL_BYTES, "Oven detail template")),
-  });
-  return {
-    id: ovenPackage.id,
-    name: instructionsName(ovenPackage.instructions, safeId),
-    description: instructionsDescription(ovenPackage.instructions),
-    builtIn,
-    path: ovenRoot,
-    instructions: ovenPackage.instructions,
-    detail: ovenPackage.detail,
-  };
-}
-
-function ovensIn(root, builtIn) {
-  if (!safeStat(root)?.isDirectory()) return [];
-  return readdirSync(root)
-    .filter((id) => /^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(id))
-    .map((id) => {
-      try {
-        return readOvenDir(root, id, builtIn);
-      } catch {
-        return null;
-      }
-    })
-    .filter(Boolean);
-}
-
-function discoverOvens() {
-  const byId = new Map();
-  for (const oven of ovensIn(builtInOvensDir, true)) byId.set(oven.id, oven);
-  for (const oven of ovensIn(legacyBuiltInTypesDir, true)) if (!byId.has(oven.id)) byId.set(oven.id, oven);
-  for (const oven of ovensIn(legacyCustomTypesDir, false)) if (!byId.has(oven.id)) byId.set(oven.id, oven);
-  for (const oven of ovensIn(customOvensDir, false)) if (!byId.get(oven.id)?.builtIn) byId.set(oven.id, oven);
-  return [...byId.values()].sort(
-    (left, right) => Number(right.builtIn) - Number(left.builtIn) || left.name.localeCompare(right.name),
-  );
-}
-
-function findOven(id) {
-  const safeId = ovenId(id);
-  return discoverOvens().find((oven) => oven.id === safeId) ?? null;
-}
+// ── storage locations (mirror the dashboard server) ──────────────────────────
+const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const builtInOvensDir = resolve(packageRoot, "ovens");
+const launchCwd = process.cwd();
+const customRepoRoot = repoRoot();
+if (flags.get("ovens-dir") === "true") fail("--ovens-dir requires a path.");
+const unsafeOvensDir = flags.has("unsafe-ovens-dir");
+const customOvensDir = resolveCustomOvensDir(
+  customRepoRoot,
+  flags.has("ovens-dir") ? flags.get("ovens-dir") : undefined,
+  { unsafe: unsafeOvensDir },
+);
+
+const { readOvenDir, discoverOvens, findOven } = createOvenCatalog({
+  builtInOvensDir,
+  customOvensDir,
+  customRepoRoot,
+  unsafeOvensDir,
+});
 
 function printOven(oven) {
   const cellWidth = Number(flags.get("cell-width") ?? 8);
@@ -149,6 +83,7 @@ function printOven(oven) {
   console.log(`${oven.name}  (${oven.id} · ${kind})`);
   if (oven.description) console.log(oven.description);
   console.log(`grid: ${oven.detail.columns} cols × ${oven.detail.rows} rows · ${oven.detail.cells.length} sections`);
+  console.log(`revision: ${oven.ovenRevision}`);
   console.log(`path: ${oven.path}`);
   console.log("");
   console.log(renderGrid(oven.detail, cellWidth, cellHeight));
@@ -156,87 +91,10 @@ function printOven(oven) {
   console.log(sectionTable(oven.detail));
 }
 
-// ── input resolution for create/update ───────────────────────────────────────
-function readInput(spec, maxBytes, label) {
-  if (spec === "-") {
-    const value = readFileSync(0, "utf8");
-    if (Buffer.byteLength(value, "utf8") > maxBytes) throw new Error(`${label} exceeds the ${maxBytes} byte limit.`);
-    return value;
-  }
-  return readTextFileWithLimit(resolve(spec), maxBytes, label);
-}
-
-function resolvePackageInput() {
-  const pkg = {};
-  if (flags.has("package")) {
-    Object.assign(pkg, JSON.parse(readInput(flags.get("package"), MAX_DETAIL_BYTES, "Oven package")));
-  }
-  if (flags.has("dir")) {
-    const dir = resolve(flags.get("dir"));
-    const instructionsPath = safeStat(join(dir, "instructions.md"))?.isFile()
-      ? join(dir, "instructions.md")
-      : join(dir, "definition.md");
-    const detailPath = safeStat(join(dir, "detail.json"))?.isFile() ? join(dir, "detail.json") : join(dir, "dashboard.json");
-    pkg.instructions = readTextFileWithLimit(instructionsPath, MAX_INSTRUCTION_BYTES, "Oven instructions");
-    pkg.detail = JSON.parse(readTextFileWithLimit(detailPath, MAX_DETAIL_BYTES, "Oven detail template"));
-  }
-  if (flags.has("instructions")) pkg.instructions = readInput(flags.get("instructions"), MAX_INSTRUCTION_BYTES, "Oven instructions");
-  if (flags.has("detail")) pkg.detail = JSON.parse(readInput(flags.get("detail"), MAX_DETAIL_BYTES, "Oven detail template"));
-
-  const id = ovenId(positionals[0] ?? pkg.id ?? flags.get("id") ?? "");
-  const name = flags.has("name") ? String(flags.get("name")).trim() : String(pkg.name ?? "").trim();
-  if (pkg.instructions === undefined) throw new Error("Provide instructions via --instructions, --package, or --dir.");
-  if (pkg.detail === undefined) throw new Error("Provide a detail skeleton via --detail, --package, or --dir.");
-
-  // Match the dashboard: an explicit name owns the level-one heading; otherwise
-  // the instructions must already carry one (normalizeOvenPackage enforces it).
-  let instructions = String(pkg.instructions);
-  if (name) {
-    const lines = instructions.split(/\r?\n/u);
-    const headingIndex = lines.findIndex((line) => /^#\s+\S/u.test(line.trim()));
-    if (headingIndex === -1) lines.unshift(`# ${name}`, "");
-    else lines[headingIndex] = `# ${name}`;
-    instructions = lines.join("\n");
-  }
-
-  const normalized = normalizeOvenPackage({ id, instructions, detail: normalizeOvenDetail(pkg.detail) });
-  return normalized;
-}
-
-function writeFileAtomic(dir, name, contents) {
-  const temporary = join(dir, `.${name}.${randomBytes(6).toString("hex")}`);
-  writeFileSync(temporary, contents);
-  renameSync(temporary, join(dir, name));
-}
-
-function persistOven(pkg, { allowReplace }) {
-  const files = {
-    "instructions.md": `${pkg.instructions}\n`,
-    "detail.json": `${JSON.stringify(pkg.detail, null, 2)}\n`,
-  };
-  const target = join(customOvensDir, pkg.id);
-  if (existsSync(target)) {
-    if (!allowReplace) throw new Error(`Oven ${pkg.id} already exists. Use \`oven update ${pkg.id}\` or --force.`);
-    for (const [name, contents] of Object.entries(files)) writeFileAtomic(target, name, contents);
-    return target;
-  }
-  mkdirSync(customOvensDir, { recursive: true });
-  const temporary = join(customOvensDir, `.${pkg.id}.${randomBytes(6).toString("hex")}`);
-  mkdirSync(temporary);
-  try {
-    for (const [name, contents] of Object.entries(files)) writeFileSync(join(temporary, name), contents);
-    renameSync(temporary, target);
-  } catch (error) {
-    rmSync(temporary, { recursive: true, force: true });
-    throw error;
-  }
-  return target;
-}
-
 function assertCustomTarget(id, verb) {
   const existing = findOven(id);
   if (existing?.builtIn) {
-    throw new Error(`Oven ${id} is built-in and read-only. Fork it: \`oven create <new-id> --dir ${existing.path}\`.`);
+    throw new Error(`Oven ${id} is built-in and read-only. Fork it: \`oven fork ${id} <new-id>\`.`);
   }
   if (verb === "update" && !existing) throw new Error(`Oven ${id} does not exist. Use \`oven create\` instead.`);
 }
@@ -247,10 +105,14 @@ const HELP = `burnlist oven — author and inspect Ovens
 Usage:
   burnlist oven list [--json]
   burnlist oven view <id> [--json] [--cell-width <n>] [--cell-height <n>]
+  burnlist oven bind <id> <path> [--repo <path>]
+  burnlist oven unbind <id> [--repo <path>]
+  burnlist oven bindings [--repo <path>]
   burnlist oven create <id> --instructions <file|-> --detail <file|-> [--name <text>]
   burnlist oven create <id> --dir <dir>            (reads instructions.md + detail.json)
   burnlist oven create <id> --package <file|->     (JSON: {name?, instructions, detail})
   burnlist oven update <id> [same inputs as create]
+  burnlist oven fork <id> <newId>
 
 Options:
   --name <text>        Set the Oven name (owns the level-one heading).
@@ -258,7 +120,9 @@ Options:
   --detail <p>         detail.json file, or - for stdin.
   --dir <p>            Directory containing instructions.md and detail.json.
   --package <p>        JSON package file, or - for stdin.
+  --repo <p>           Repository whose local Oven bindings to use.
   --ovens-dir <p>      Custom Oven storage (default .local/burnlist/ovens).
+  --unsafe-ovens-dir   Permit --ovens-dir outside repo-local state.
   --force              On create, replace an existing custom Oven.
   --json               Machine-readable output for list/view.
 
@@ -287,8 +151,9 @@ try {
       oven.builtIn ? "built-in" : "custom",
       `${oven.detail.columns}×${oven.detail.rows}`,
       String(oven.detail.cells.length),
+      oven.ovenRevision,
     ]);
-    const header = ["id", "name", "kind", "grid", "sections"];
+    const header = ["id", "name", "kind", "grid", "sections", "revision"];
     const widths = header.map((label, index) => Math.max(label.length, ...rows.map((row) => row[index].length)));
     const line = (cols) => cols.map((value, index) => value.padEnd(widths[index])).join("  ").trimEnd();
     console.log(line(header));
@@ -303,24 +168,78 @@ try {
     const oven = findOven(id);
     if (!oven) fail(`Unknown Oven "${id}". Run \`burnlist oven list\`.`);
     if (flags.has("json")) {
-      console.log(JSON.stringify({ id: oven.id, name: oven.name, builtIn: oven.builtIn, instructions: oven.instructions, detail: oven.detail }, null, 2));
+      console.log(JSON.stringify({
+        id: oven.id,
+        name: oven.name,
+        builtIn: oven.builtIn,
+        instructions: oven.instructions,
+        detail: oven.detail,
+        ovenRevision: oven.ovenRevision,
+        ...(oven.forkedFrom ? { forkedFrom: oven.forkedFrom } : {}),
+      }, null, 2));
       process.exit(0);
     }
     printOven(oven);
     process.exit(0);
   }
 
+  if (subcommand === "bind") {
+    const [id, logicalPath] = positionals;
+    if (!id || logicalPath === undefined) fail("Usage: burnlist oven bind <id> <path> [--repo <path>]");
+    const repoRoot = bindingRepo();
+    const result = writeBinding(repoRoot, id, logicalPath, new Date().toISOString());
+    console.log(`Bound Oven ${ovenId(id)} to ${logicalPath}\nStore: ${result.path}`);
+    process.exit(0);
+  }
+
+  if (subcommand === "unbind") {
+    const id = positionals[0];
+    if (!id) fail("Usage: burnlist oven unbind <id> [--repo <path>]");
+    const repoRoot = bindingRepo();
+    if (removeBinding(repoRoot, id)) console.log(`Unbound Oven ${ovenId(id)} from ${bindingStorePath(repoRoot)}`);
+    else console.log(`No binding exists for Oven ${ovenId(id)} in ${bindingStorePath(repoRoot)}.`);
+    process.exit(0);
+  }
+
+  if (subcommand === "bindings") {
+    const repoRoot = bindingRepo();
+    const store = readBindingStore(repoRoot);
+    const entries = Object.entries(store.bindings).sort(([left], [right]) => left.localeCompare(right));
+    if (entries.length === 0) console.log(`No Oven bindings in ${bindingStorePath(repoRoot)}.`);
+    else {
+      console.log(`Oven bindings: ${bindingStorePath(repoRoot)}`);
+      for (const [id, binding] of entries) console.log(`${id}  ${binding.path}  ${binding.boundAt}`);
+    }
+    process.exit(0);
+  }
+
   if (subcommand === "create" || subcommand === "update") {
-    const pkg = resolvePackageInput();
+    const pkg = resolvePackageInput({ flags, positionals });
     assertCustomTarget(pkg.id, subcommand);
     const allowReplace = subcommand === "update" || flags.has("force");
-    const path = persistOven(pkg, { allowReplace });
+    const path = persistOven({ customRepoRoot, customOvensDir, unsafeOvensDir }, pkg, { allowReplace });
     const saved = readOvenDir(customOvensDir, pkg.id, false);
     console.log(`${subcommand === "update" ? "Updated" : "Created"} Oven ${pkg.id} at ${path}\n`);
     printOven(saved);
     process.exit(0);
   }
 
+  if (subcommand === "fork") {
+    const [sourceId, newId] = positionals;
+    if (!sourceId || !newId) fail("Usage: burnlist oven fork <id> <newId>");
+    const source = findOven(sourceId);
+    if (!source) fail(`Unknown Oven "${sourceId}". Run \`burnlist oven list\`.`);
+    const pkg = normalizeOvenPackage({ id: ovenId(newId), instructions: source.instructions, detail: source.detail });
+    const sourceRevision = ovenRevision(source);
+    if (findOven(pkg.id)) throw new Error(`Oven ${pkg.id} already exists.`);
+    const path = persistOven({ customRepoRoot, customOvensDir, unsafeOvensDir }, pkg, {
+      allowReplace: false,
+      sidecar: { forkedFrom: { ovenId: source.id, revision: sourceRevision } },
+    });
+    console.log(`Forked Oven ${pkg.id} at ${path}\nForked from ${source.id}@${sourceRevision}`);
+    process.exit(0);
+  }
+
   fail(`Unknown subcommand "${subcommand}". Run \`burnlist oven help\`.`);
 } catch (error) {
   fail(error.message);
diff --git a/src/cli/oven-cli.test.mjs b/src/cli/oven-cli.test.mjs
new file mode 100644
index 0000000..e19f5c9
--- /dev/null
+++ b/src/cli/oven-cli.test.mjs
@@ -0,0 +1,400 @@
+import assert from "node:assert/strict";
+import { execFileSync, spawn } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import test from "node:test";
+import { ovenRevision } from "../ovens/oven-contract.mjs";
+import { resolveOvenPackageDir } from "../server/fs-safe.mjs";
+import { assertCustomOvenPath } from "../server/oven-storage.mjs";
+const repoRoot = resolve(new URL("../..", import.meta.url).pathname);
+const binPath = join(repoRoot, "bin", "burnlist.mjs");
+const serverPath = join(repoRoot, "src", "server", "burnlist-dashboard-server.mjs");
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), "burnlist-oven-cli-"));
+  const repo = join(root, "repo");
+  mkdirSync(repo);
+  return { repo, cleanup: () => rmSync(root, { recursive: true, force: true }) };
+}
+function run(context, ...args) {
+  return execFileSync(process.execPath, [binPath, ...args], { cwd: context.repo, encoding: "utf8" });
+}
+function runFrom(cwd, ...args) {
+  return execFileSync(process.execPath, [binPath, ...args], { cwd, encoding: "utf8" });
+}
+function detailFixture() {
+  return {
+    version: 1,
+    columns: 2,
+    rows: 2,
+    rowHeight: 48,
+    cells: [{
+      id: "summary",
+      title: "Summary",
+      description: "Current status.",
+      widget: "metric",
+      source: "/summary",
+      format: "plain",
+      column: 1,
+      row: 1,
+      columnSpan: 2,
+      rowSpan: 1,
+    }],
+  };
+}
+
+function writeOven(root, id, ovenJson) {
+  const ovenRoot = join(root, id);
+  mkdirSync(ovenRoot, { recursive: true });
+  writeFileSync(join(ovenRoot, "instructions.md"), "# Forked Oven\n\nFollow the checklist.\n");
+  writeFileSync(join(ovenRoot, "detail.json"), `${JSON.stringify(detailFixture())}\n`);
+  if (ovenJson !== undefined) writeFileSync(join(ovenRoot, "oven.json"), ovenJson);
+}
+
+function pausedUpdate(context, ovensDir, packagePath) {
+  const script = [
+    'import fs, { readFileSync } from "node:fs";',
+    'import { syncBuiltinESMExports } from "node:module";',
+    'import { join } from "node:path";',
+    'const [bin, root] = process.argv.slice(1, 3);',
+    'const rename = fs.renameSync;',
+    'fs.renameSync = (from, to, ...rest) => {',
+    '  if (to === join(root, "sample-oven", "current")) { process.stdout.write("staged\\n"); readFileSync(0, "utf8"); }',
+    '  return rename(from, to, ...rest);',
+    '};',
+    'syncBuiltinESMExports();',
+    'process.argv = [process.argv[0], bin, ...process.argv.slice(3)];',
+    'await import(bin);',
+  ].join("\n");
+  return spawn(process.execPath, [
+    "--input-type=module", "--eval", script, binPath, ovensDir,
+    "oven", "update", "sample-oven", "--package", packagePath, "--ovens-dir", ovensDir,
+  ], { cwd: context.repo, stdio: ["pipe", "pipe", "pipe"] });
+}
+
+function waitForBarrier(child, timeoutMs = 5_000) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error(`update did not reach its publish barrier within ${timeoutMs}ms`)), timeoutMs);
+    child.stdout.on("data", (chunk) => { if (chunk.toString().includes("staged")) { clearTimeout(timer); resolve(); } });
+    child.on("error", (error) => { clearTimeout(timer); reject(error); });
+    child.on("close", (status) => { clearTimeout(timer); reject(new Error(`update ended before reaching its publish barrier: ${status}`)); });
+  });
+}
+
+const childClose = (child, timeoutMs = 2_000) => new Promise((resolve, reject) => { const timer = setTimeout(() => reject(new Error(`update did not close within ${timeoutMs}ms`)), timeoutMs); child.on("close", (status) => { clearTimeout(timer); resolve(status); }); });
+
+test("oven bind, bindings, and unbind persist a logical repo-local binding", () => {
+  const context = fixture();
+  const logicalPath = "../generated/current.json";
+  const storePath = join(context.repo, ".local", "burnlist", "bindings.json");
+  try {
+    const bound = run(context, "oven", "bind", "sample-oven", logicalPath, "--repo", context.repo);
+    assert.match(bound, /Bound Oven sample-oven to \.\.\/generated\/current\.json/u);
+    assert.match(bound, new RegExp(`Store: ${storePath}`));
+    const store = JSON.parse(readFileSync(storePath, "utf8"));
+    assert.equal(store.schemaVersion, 1);
+    assert.equal(store.bindings["sample-oven"].path, logicalPath);
+    assert.match(store.bindings["sample-oven"].boundAt, /^\d{4}-\d{2}-\d{2}T/u);
+    assert.match(run(context, "oven", "bindings", "--repo", context.repo), /sample-oven  \.\.\/generated\/current\.json/u);
+    assert.match(run(context, "oven", "unbind", "sample-oven", "--repo", context.repo), /Unbound Oven sample-oven/u);
+    assert.deepEqual(JSON.parse(readFileSync(storePath, "utf8")), { schemaVersion: 1, bindings: {} });
+    assert.match(run(context, "oven", "unbind", "sample-oven", "--repo", context.repo), /No binding exists for Oven sample-oven/u);
+  } finally { context.cleanup(); }
+});
+
+test("oven view reads optional fork lineage and rejects malformed sidecars", () => {
+  const context = fixture();
+  const ovensDir = join(context.repo, ".local", "burnlist", "ovens");
+  try {
+    writeOven(ovensDir, "forked-oven", JSON.stringify({
+      forkedFrom: { ovenId: "source-oven", revision: `o1-sha256:${"a".repeat(64)}` },
+    }));
+    writeOven(ovensDir, "standalone-oven");
+    const forked = JSON.parse(run(context, "oven", "view", "forked-oven", "--json", "--ovens-dir", ovensDir));
+    assert.deepEqual(forked.forkedFrom, { ovenId: "source-oven", revision: `o1-sha256:${"a".repeat(64)}` });
+    const standalone = JSON.parse(run(context, "oven", "view", "standalone-oven", "--json", "--ovens-dir", ovensDir));
+    assert.equal(Object.hasOwn(standalone, "forkedFrom"), false);
+
+    writeOven(ovensDir, "broken-oven", "{");
+    assert.throws(
+      () => run(context, "oven", "view", "broken-oven", "--json", "--ovens-dir", ovensDir),
+      (error) => String(error.stderr).includes("lineage sidecar is invalid"),
+    );
+  } finally { context.cleanup(); }
+});
+
+test("oven list warns and omits a malformed package while view stays fail-closed", () => {
+  const context = fixture();
+  const ovensDir = join(context.repo, ".local", "burnlist", "ovens");
+  try {
+    writeOven(ovensDir, "healthy-oven");
+    writeOven(ovensDir, "broken-oven", "{");
+    const listed = JSON.parse(run(context, "oven", "list", "--json", "--ovens-dir", ovensDir));
+    assert.equal(listed.some((oven) => oven.id === "healthy-oven"), true);
+    assert.equal(listed.some((oven) => oven.id === "broken-oven"), false);
+    assert.throws(
+      () => run(context, "oven", "view", "broken-oven", "--json", "--ovens-dir", ovensDir),
+      (error) => String(error.stderr).includes("lineage sidecar is invalid"),
+    );
+  } finally { context.cleanup(); }
+});
+
+test("oven create and update swap the package while preserving sibling files", () => {
+  const context = fixture();
+  const ovensDir = join(context.repo, ".local", "burnlist", "ovens");
+  try {
+    const packagePath = join(context.repo, "replacement.json");
+    writeFileSync(packagePath, JSON.stringify({
+      instructions: "# Initial Oven\n\nInitial checklist.", detail: detailFixture(),
+    }));
+    run(context, "oven", "create", "sample-oven", "--package", packagePath, "--ovens-dir", ovensDir);
+    writeFileSync(join(resolveOvenPackageDir(join(ovensDir, "sample-oven")), "oven.json"), JSON.stringify({
+      forkedFrom: { ovenId: "source-oven", revision: `o1-sha256:${"a".repeat(64)}` },
+    }));
+    writeFileSync(packagePath, JSON.stringify({
+      instructions: "# Updated Oven\n\nUpdated checklist.", detail: detailFixture(),
+    }));
+    run(context, "oven", "update", "sample-oven", "--package", packagePath, "--ovens-dir", ovensDir);
+    const current = resolveOvenPackageDir(join(ovensDir, "sample-oven"));
+    assert.match(readFileSync(join(current, "instructions.md"), "utf8"), /Updated checklist/u);
+    assert.deepEqual(JSON.parse(readFileSync(join(current, "detail.json"), "utf8")), detailFixture());
+    assert.equal(JSON.parse(readFileSync(join(current, "oven.json"), "utf8")).forkedFrom.ovenId, "source-oven");
+    assert.equal(readdirSync(join(ovensDir, "sample-oven")).filter((name) => name.startsWith("rev-")).length, 2);
+  } finally { context.cleanup(); }
+});
+
+test("oven update migrates a legacy plain directory to a pointer package", () => {
+  const context = fixture();
+  const ovensDir = join(context.repo, ".local", "burnlist", "ovens");
+  try {
+    writeOven(ovensDir, "legacy-oven", JSON.stringify({
+      forkedFrom: { ovenId: "source-oven", revision: `o1-sha256:${"a".repeat(64)}` },
+    }));
+    const packagePath = join(context.repo, "replacement.json");
+    writeFileSync(packagePath, JSON.stringify({ instructions: "# Updated Oven\n\nMigrated safely.", detail: detailFixture() }));
+    run(context, "oven", "update", "legacy-oven", "--package", packagePath, "--ovens-dir", ovensDir);
+    assert.match(readFileSync(join(ovensDir, "legacy-oven", "current"), "utf8"), /^rev-[a-f0-9]+\n$/u);
+    assert.equal(existsSync(join(ovensDir, "legacy-oven", "instructions.md")), false);
+    const oven = JSON.parse(run(context, "oven", "view", "legacy-oven", "--json", "--ovens-dir", ovensDir));
+    assert.match(oven.instructions, /Migrated safely/u);
+    assert.equal(oven.forkedFrom.ovenId, "source-oven");
+  } finally { context.cleanup(); }
+});
+
+test("oven storage follows the umbrella root when launched from a subdirectory", () => {
+  const context = fixture();
+  const subdirectory = join(context.repo, "work", "nested");
+  try {
+    mkdirSync(join(context.repo, "notes", "burnlists"), { recursive: true });
+    mkdirSync(subdirectory, { recursive: true });
+    const packagePath = join(context.repo, "package.json");
+    writeFileSync(packagePath, JSON.stringify({
+      instructions: "# Umbrella Oven\n\nStored with the umbrella.", detail: detailFixture(),
+    }));
+    runFrom(subdirectory, "oven", "create", "umbrella-oven", "--package", packagePath);
+    const ovenPath = join(context.repo, ".local", "burnlist", "ovens", "umbrella-oven");
+    assert.match(readFileSync(join(resolveOvenPackageDir(ovenPath), "instructions.md"), "utf8"), /Stored with the umbrella/u);
+    const ovens = JSON.parse(runFrom(subdirectory, "oven", "list", "--json"));
+    assert.equal(ovens.some((oven) => oven.id === "umbrella-oven"), true);
+  } finally { context.cleanup(); }
+});
+
+test("oven publication rejects oversized stored bytes without replacing a readable package", () => {
+  const context = fixture();
+  const detailPath = join(context.repo, "detail.json");
+  const instructionsPath = join(context.repo, "instructions.md");
+  const ovenPath = join(context.repo, ".local", "burnlist", "ovens", "sized-oven");
+  try {
+    writeFileSync(detailPath, JSON.stringify(detailFixture()));
+    writeFileSync(instructionsPath, `# ${"x".repeat(65_534)}`);
+    assert.throws(
+      () => run(context, "oven", "create", "sized-oven", "--instructions", instructionsPath, "--detail", detailPath),
+      (error) => String(error.stderr).includes("instructions.md") && String(error.stderr).includes("65536 byte limit"),
+    );
+    assert.equal(existsSync(ovenPath), false);
+
+    writeFileSync(instructionsPath, `# ${"x".repeat(65_533)}`);
+    run(context, "oven", "create", "sized-oven", "--instructions", instructionsPath, "--detail", detailPath);
+    const priorPointer = readFileSync(join(ovenPath, "current"), "utf8");
+    const priorInstructions = readFileSync(join(resolveOvenPackageDir(ovenPath), "instructions.md"), "utf8");
+    assert.equal(Buffer.byteLength(priorInstructions), 65_536);
+
+    writeFileSync(instructionsPath, `# ${"\u0800".repeat(21_844)}xy`);
+    assert.throws(
+      () => run(context, "oven", "update", "sized-oven", "--instructions", instructionsPath, "--detail", detailPath),
+      (error) => String(error.stderr).includes("instructions.md") && String(error.stderr).includes("65536 byte limit"),
+    );
+    assert.equal(readFileSync(join(ovenPath, "current"), "utf8"), priorPointer);
+    assert.equal(readFileSync(join(resolveOvenPackageDir(ovenPath), "instructions.md"), "utf8"), priorInstructions);
+  } finally { context.cleanup(); }
+});
+
+test("oven storage rejects escaped overrides and catches a later local-state symlink", () => {
+  const context = fixture();
+  const packagePath = join(context.repo, "package.json");
+  const outside = join(dirname(context.repo), "outside");
+  try {
+    writeFileSync(packagePath, JSON.stringify({ instructions: "# Contained Oven\n\nStay in the repo.", detail: detailFixture() }));
+    mkdirSync(outside);
+    assert.throws(
+      () => run(context, "oven", "create", "escaped-oven", "--package", packagePath, "--ovens-dir", outside),
+      (error) => String(error.stderr).includes("escapes repo state"),
+    );
+    assert.throws(
+      () => execFileSync(process.execPath, [serverPath, "--stamp", "--ovens-dir", outside], { cwd: context.repo, encoding: "utf8" }),
+      (error) => String(error.stderr).includes("escapes repo state"),
+    );
+    run(context, "oven", "create", "allowed-oven", "--package", packagePath, "--ovens-dir", outside, "--unsafe-ovens-dir");
+    assert.match(
+      execFileSync(process.execPath, [serverPath, "--stamp", "--ovens-dir", outside, "--unsafe-ovens-dir"], { cwd: context.repo, encoding: "utf8" }),
+      /^\d{4}-\d{2}-\d{2}T/u,
+    );
+    assert.equal(existsSync(join(outside, "allowed-oven", "current")), true);
+
+    run(context, "oven", "create", "local-oven", "--package", packagePath);
+    const defaultOvens = join(context.repo, ".local", "burnlist", "ovens");
+    assertCustomOvenPath(context.repo, defaultOvens, "local-oven");
+    rmSync(join(context.repo, ".local"), { recursive: true, force: true });
+    symlinkSync(outside, join(context.repo, ".local"), "dir");
+    assert.throws(() => assertCustomOvenPath(context.repo, defaultOvens, "local-oven"), /escapes repo state/u);
+    assert.throws(
+      () => run(context, "oven", "view", "local-oven", "--json"),
+      (error) => String(error.stderr).includes("escapes repo state"),
+    );
+  } finally { context.cleanup(); }
+});
+
+test("oven storage rejects symlink escapes for its state directory and individual Oven ids", () => {
+  const context = fixture();
+  const packagePath = join(context.repo, "package.json");
+  const outside = join(dirname(context.repo), "outside");
+  try {
+    writeFileSync(packagePath, JSON.stringify({ instructions: "# Contained Oven\n\nStay in the repo.", detail: detailFixture() }));
+    mkdirSync(outside);
+    symlinkSync(outside, join(context.repo, ".local"), "dir");
+    assert.throws(
+      () => run(context, "oven", "create", "unsafe-oven", "--package", packagePath),
+      (error) => String(error.stderr).includes("escapes"),
+    );
+    assert.equal(existsSync(join(outside, "burnlist", "ovens", "unsafe-oven")), false);
+  } finally { context.cleanup(); }
+
+  const second = fixture();
+  try {
+    const ovensDir = join(second.repo, ".local", "burnlist", "ovens");
+    const idOutside = join(second.repo, "id-outside");
+    const packagePath = join(second.repo, "package.json");
+    mkdirSync(ovensDir, { recursive: true });
+    mkdirSync(idOutside);
+    symlinkSync(idOutside, join(ovensDir, "escaped-oven"), "dir");
+    writeFileSync(packagePath, JSON.stringify({ instructions: "# Escaped Oven\n\nNope.", detail: detailFixture() }));
+    assert.throws(
+      () => run(second, "oven", "view", "escaped-oven", "--json"),
+      (error) => String(error.stderr).includes("escapes"),
+    );
+    assert.throws(
+      () => run(second, "oven", "create", "escaped-oven", "--package", packagePath),
+      (error) => String(error.stderr).includes("escapes"),
+    );
+  } finally { second.cleanup(); }
+});
+
+test("oven view and list read complete packages on both sides of a publish barrier", async () => {
+  const context = fixture();
+  const ovensDir = join(context.repo, ".local", "burnlist", "ovens");
+  try {
+    const packagePath = join(context.repo, "replacement.json");
+    writeFileSync(packagePath, JSON.stringify({
+      instructions: "# Initial Oven\n\nInitial checklist.", detail: detailFixture(),
+    }));
+    run(context, "oven", "create", "sample-oven", "--package", packagePath, "--ovens-dir", ovensDir);
+    writeFileSync(packagePath, JSON.stringify({
+      instructions: "# Updated Oven\n\nUpdated checklist.", detail: detailFixture(),
+    }));
+    const writer = pausedUpdate(context, ovensDir, packagePath);
+    try {
+      const writerStatus = childClose(writer);
+      await waitForBarrier(writer);
+      const oldView = JSON.parse(run(context, "oven", "view", "sample-oven", "--json", "--ovens-dir", ovensDir));
+      const oldList = JSON.parse(run(context, "oven", "list", "--json", "--ovens-dir", ovensDir)).find((oven) => oven.id === "sample-oven");
+      assert.match(oldView.instructions, /Initial checklist/u);
+      assert.equal(oldList.name, "Initial Oven");
+      writer.stdin.end("publish\n");
+      const status = await writerStatus;
+      assert.equal(status, 0);
+      const newView = JSON.parse(run(context, "oven", "view", "sample-oven", "--json", "--ovens-dir", ovensDir));
+      const newList = JSON.parse(run(context, "oven", "list", "--json", "--ovens-dir", ovensDir)).find((oven) => oven.id === "sample-oven");
+      assert.match(newView.instructions, /Updated checklist/u);
+      assert.equal(newList.name, "Updated Oven");
+    } finally { writer.stdin.end(); writer.kill("SIGKILL"); }
+  } finally { context.cleanup(); }
+});
+
+test("a killed writer leaves the prior pointer package readable", async () => {
+  const context = fixture();
+  const ovensDir = join(context.repo, ".local", "burnlist", "ovens");
+  try {
+    const packagePath = join(context.repo, "replacement.json");
+    writeFileSync(packagePath, JSON.stringify({ instructions: "# Initial Oven\n\nInitial checklist.", detail: detailFixture() }));
+    run(context, "oven", "create", "sample-oven", "--package", packagePath, "--ovens-dir", ovensDir);
+    writeFileSync(packagePath, JSON.stringify({ instructions: "# Interrupted Oven\n\nNever published.", detail: detailFixture() }));
+    const writer = pausedUpdate(context, ovensDir, packagePath);
+    try {
+      await waitForBarrier(writer);
+      const priorCurrent = readFileSync(join(ovensDir, "sample-oven", "current"), "utf8");
+      writer.kill("SIGKILL");
+      await childClose(writer);
+      const oldView = JSON.parse(run(context, "oven", "view", "sample-oven", "--json", "--ovens-dir", ovensDir));
+      const oldList = JSON.parse(run(context, "oven", "list", "--json", "--ovens-dir", ovensDir)).find((oven) => oven.id === "sample-oven");
+      assert.match(oldView.instructions, /Initial checklist/u);
+      assert.equal(oldList.name, "Initial Oven");
+      assert.equal(readFileSync(join(ovensDir, "sample-oven", "current"), "utf8"), priorCurrent);
+      writeFileSync(packagePath, JSON.stringify({ instructions: "# Recovered Oven\n\nPublished after recovery.", detail: detailFixture() }));
+      run(context, "oven", "update", "sample-oven", "--package", packagePath, "--ovens-dir", ovensDir);
+      assert.match(JSON.parse(run(context, "oven", "view", "sample-oven", "--json", "--ovens-dir", ovensDir)).instructions, /Published after recovery/u);
+      assert.notEqual(readFileSync(join(ovensDir, "sample-oven", "current"), "utf8"), priorCurrent);
+    } finally { writer.stdin.end(); writer.kill("SIGKILL"); }
+  } finally { context.cleanup(); }
+});
+
+test("oven fork writes source revision lineage and discovery exposes it", () => {
+  const context = fixture();
+  const ovensDir = join(context.repo, ".local", "burnlist", "ovens");
+  try {
+    writeOven(ovensDir, "source-oven");
+    const source = JSON.parse(run(context, "oven", "view", "source-oven", "--json", "--ovens-dir", ovensDir));
+    const expectedRevision = ovenRevision({ instructions: source.instructions, detail: source.detail });
+    const output = run(context, "oven", "fork", "source-oven", "forked-oven", "--ovens-dir", ovensDir);
+    assert.match(output, new RegExp(`Forked from source-oven@${expectedRevision}`));
+    assert.deepEqual(JSON.parse(readFileSync(join(resolveOvenPackageDir(join(ovensDir, "forked-oven")), "oven.json"), "utf8")), {
+      forkedFrom: { ovenId: "source-oven", revision: expectedRevision },
+    });
+    const forked = JSON.parse(run(context, "oven", "list", "--json", "--ovens-dir", ovensDir))
+      .find((oven) => oven.id === "forked-oven");
+    assert.deepEqual(forked.forkedFrom, { ovenId: "source-oven", revision: expectedRevision });
+  } finally { context.cleanup(); }
+});
+
+test("oven ignores legacy files and accepts only the two-file package layout", () => {
+  const context = fixture();
+  const ovensDir = join(context.repo, ".local", "burnlist", "ovens");
+  const legacyDir = join(ovensDir, "legacy-only");
+  try {
+    mkdirSync(legacyDir, { recursive: true });
+    writeFileSync(join(legacyDir, "definition.md"), "# Legacy Oven\n");
+    writeFileSync(join(legacyDir, "dashboard.json"), JSON.stringify(detailFixture()));
+    writeOven(ovensDir, "two-file-oven");
+    const ovens = JSON.parse(run(context, "oven", "list", "--json", "--ovens-dir", ovensDir));
+    assert.equal(ovens.some((oven) => oven.id === "legacy-only"), false);
+    assert.equal(ovens.some((oven) => oven.id === "two-file-oven"), true);
+    assert.throws(
+      () => run(context, "oven", "view", "legacy-only", "--json", "--ovens-dir", ovensDir),
+      (error) => String(error.stderr).includes('Unknown Oven "legacy-only"'),
+    );
+    assert.throws(
+      () => run(context, "oven", "create", "copied-legacy", "--dir", legacyDir, "--ovens-dir", ovensDir),
+      (error) => String(error.stderr).includes("instructions.md"),
+    );
+  } finally { context.cleanup(); }
+});
diff --git a/src/cli/oven-storage.mjs b/src/cli/oven-storage.mjs
new file mode 100644
index 0000000..5e4d1b3
--- /dev/null
+++ b/src/cli/oven-storage.mjs
@@ -0,0 +1,199 @@
+import { readFileSync, readSync, readdirSync, realpathSync, statSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { normalizeOvenDetail, normalizeOvenForkedFrom, normalizeOvenPackage, ovenId, ovenRevision } from "../ovens/oven-contract.mjs";
+import { atomicOvenPackage, resolveOvenPackageDir, withOvenPackageLock } from "../server/fs-safe.mjs";
+import {
+  assertCustomOvensDir,
+  assertCustomOvenPath,
+  OVEN_DETAIL_MAX_BYTES,
+  OVEN_INSTRUCTIONS_MAX_BYTES,
+  OVEN_LINEAGE_MAX_BYTES,
+  serializeOvenPackage,
+} from "../server/oven-storage.mjs";
+import { assertGitIgnored } from "./git-ignore.mjs";
+
+// This carries both stored files plus JSON escaping and authoring whitespace.
+// It is intentionally a transport limit, not a stored-file limit.
+export const OVEN_PACKAGE_MAX_BYTES = 1_048_576;
+
+function safeStat(path) {
+  try {
+    return statSync(path);
+  } catch {
+    return null;
+  }
+}
+
+function readTextFileWithLimit(path, maxBytes, label) {
+  const stat = statSync(path);
+  if (stat.size > maxBytes) throw new Error(`${label} is ${stat.size} bytes, over the ${maxBytes} byte limit.`);
+  return readFileSync(path, "utf8");
+}
+
+function instructionsName(instructions, fallback) {
+  const heading = instructions.split(/\r?\n/u).find((line) => /^#\s+\S/u.test(line.trim()));
+  return heading ? heading.trim().replace(/^#\s+/u, "").trim() : fallback;
+}
+
+function instructionsDescription(instructions) {
+  return instructions
+    .split(/\r?\n/u)
+    .map((line) => line.trim())
+    .find((line) => line && !line.startsWith("#")) ?? "";
+}
+
+export function createOvenCatalog({ builtInOvensDir, customOvensDir, customRepoRoot, unsafeOvensDir }) {
+  function readOvenDir(root, id, builtIn) {
+    const safeId = ovenId(id);
+    let ovenRoot;
+    try {
+      const path = builtIn ? join(root, safeId) : assertCustomOvenPath(customRepoRoot, root, safeId, { unsafe: unsafeOvensDir });
+      ovenRoot = resolveOvenPackageDir(realpathSync(path));
+    } catch (error) {
+      if (error?.code === "ENOENT") return null;
+      throw error;
+    }
+    try {
+      const instructionsPath = join(ovenRoot, "instructions.md");
+      const detailPath = join(ovenRoot, "detail.json");
+      if (!safeStat(instructionsPath)?.isFile() || !safeStat(detailPath)?.isFile()) return null;
+      const ovenPackage = normalizeOvenPackage({
+        id: safeId,
+        instructions: readTextFileWithLimit(instructionsPath, OVEN_INSTRUCTIONS_MAX_BYTES, "Oven instructions"),
+        detail: JSON.parse(readTextFileWithLimit(detailPath, OVEN_DETAIL_MAX_BYTES, "Oven detail template")),
+      });
+      const lineagePath = join(ovenRoot, "oven.json");
+      let forkedFrom;
+      if (safeStat(lineagePath)?.isFile()) {
+        try {
+          forkedFrom = normalizeOvenForkedFrom(
+            JSON.parse(readTextFileWithLimit(lineagePath, OVEN_LINEAGE_MAX_BYTES, "Oven lineage sidecar")),
+          ).forkedFrom;
+        } catch (error) {
+          throw new Error(`Oven ${safeId} lineage sidecar is invalid: ${error.message}`);
+        }
+      }
+      return {
+        id: ovenPackage.id,
+        name: instructionsName(ovenPackage.instructions, safeId),
+        description: instructionsDescription(ovenPackage.instructions),
+        builtIn,
+        path: ovenRoot,
+        instructions: ovenPackage.instructions,
+        detail: ovenPackage.detail,
+        ovenRevision: ovenRevision(ovenPackage),
+        ...(forkedFrom ? { forkedFrom } : {}),
+      };
+    } catch (error) {
+      if (error?.code === "ENOENT") return null;
+      throw error;
+    }
+  }
+
+  function ovensIn(root, builtIn) {
+    if (!builtIn) assertCustomOvensDir(customRepoRoot, root, { unsafe: unsafeOvensDir });
+    let entries;
+    try {
+      entries = readdirSync(root, { withFileTypes: true });
+    } catch (error) {
+      if (error?.code === "ENOENT") return [];
+      throw error;
+    }
+    return entries
+      .map((entry) => entry.name)
+      .filter((id) => !id.startsWith(".") && /^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(id))
+      .map((id) => {
+        try {
+          return readOvenDir(root, id, builtIn);
+        } catch (error) {
+          console.warn(`Ignoring malformed Oven ${id}: ${error.message}`);
+          return null;
+        }
+      })
+      .filter(Boolean);
+  }
+
+  return {
+    readOvenDir,
+    discoverOvens() {
+      const byId = new Map();
+      for (const oven of ovensIn(builtInOvensDir, true)) byId.set(oven.id, oven);
+      for (const oven of ovensIn(customOvensDir, false)) if (!byId.get(oven.id)?.builtIn) byId.set(oven.id, oven);
+      return [...byId.values()].sort(
+        (left, right) => Number(right.builtIn) - Number(left.builtIn) || left.name.localeCompare(right.name),
+      );
+    },
+    findOven(id) {
+      const safeId = ovenId(id);
+      return readOvenDir(builtInOvensDir, safeId, true) ?? readOvenDir(customOvensDir, safeId, false);
+    },
+  };
+}
+
+function readInput(spec, maxBytes, label) {
+  if (spec === "-") {
+    const chunks = [];
+    let total = 0;
+    const buffer = Buffer.allocUnsafe(Math.min(65_536, maxBytes + 1));
+    while (total <= maxBytes) {
+      const bytes = readSync(0, buffer, 0, Math.min(buffer.length, maxBytes + 1 - total), null);
+      if (bytes === 0) break;
+      chunks.push(Buffer.from(buffer.subarray(0, bytes)));
+      total += bytes;
+    }
+    if (total > maxBytes) throw new Error(`${label} exceeds the ${maxBytes} byte limit.`);
+    return Buffer.concat(chunks, total).toString("utf8");
+  }
+  return readTextFileWithLimit(resolve(spec), maxBytes, label);
+}
+
+export function resolvePackageInput({ flags, positionals }) {
+  const pkg = {};
+  if (flags.has("package")) Object.assign(pkg, JSON.parse(readInput(flags.get("package"), OVEN_PACKAGE_MAX_BYTES, "Oven package")));
+  if (flags.has("dir")) {
+    const dir = resolve(flags.get("dir"));
+    pkg.instructions = readTextFileWithLimit(join(dir, "instructions.md"), OVEN_INSTRUCTIONS_MAX_BYTES, "Oven instructions");
+    pkg.detail = JSON.parse(readTextFileWithLimit(join(dir, "detail.json"), OVEN_DETAIL_MAX_BYTES, "Oven detail template"));
+  }
+  if (flags.has("instructions")) pkg.instructions = readInput(flags.get("instructions"), OVEN_INSTRUCTIONS_MAX_BYTES, "Oven instructions");
+  if (flags.has("detail")) pkg.detail = JSON.parse(readInput(flags.get("detail"), OVEN_DETAIL_MAX_BYTES, "Oven detail template"));
+
+  const id = ovenId(positionals[0] ?? pkg.id ?? flags.get("id") ?? "");
+  const name = flags.has("name") ? String(flags.get("name")).trim() : String(pkg.name ?? "").trim();
+  if (pkg.instructions === undefined) throw new Error("Provide instructions via --instructions, --package, or --dir.");
+  if (pkg.detail === undefined) throw new Error("Provide a detail skeleton via --detail, --package, or --dir.");
+
+  let instructions = String(pkg.instructions);
+  if (name) {
+    const lines = instructions.split(/\r?\n/u);
+    const headingIndex = lines.findIndex((line) => /^#\s+\S/u.test(line.trim()));
+    if (headingIndex === -1) lines.unshift(`# ${name}`, "");
+    else lines[headingIndex] = `# ${name}`;
+    instructions = lines.join("\n");
+  }
+  const normalized = normalizeOvenPackage({ id, instructions, detail: normalizeOvenDetail(pkg.detail) });
+  // Serialize here as well as at persist time so every input shape receives
+  // the same independent instructions.md and detail.json byte checks.
+  serializeOvenPackage(normalized);
+  return normalized;
+}
+
+export function persistOven({ customRepoRoot, customOvensDir, unsafeOvensDir }, pkg, { allowReplace, sidecar }) {
+  const files = serializeOvenPackage({ ...pkg, sidecar });
+  try {
+    assertCustomOvenPath(customRepoRoot, customOvensDir, pkg.id, { unsafe: unsafeOvensDir });
+    assertGitIgnored(customRepoRoot, customOvensDir);
+    return withOvenPackageLock(customOvensDir, pkg.id, () => atomicOvenPackage(customOvensDir, pkg.id, files, {
+      replace: allowReplace,
+      assertPath: () => {
+        assertCustomOvenPath(customRepoRoot, customOvensDir, pkg.id, { unsafe: unsafeOvensDir });
+        assertGitIgnored(customRepoRoot, customOvensDir);
+      },
+    }));
+  } catch (error) {
+    if (!allowReplace && error.message === `${pkg.id} already exists.`) {
+      throw new Error(`Oven ${pkg.id} already exists. Use \`oven update ${pkg.id}\` or --force.`);
+    }
+    throw error;
+  }
+}
diff --git a/src/cli/oven-storage.test.mjs b/src/cli/oven-storage.test.mjs
new file mode 100644
index 0000000..e3354c3
--- /dev/null
+++ b/src/cli/oven-storage.test.mjs
@@ -0,0 +1,97 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import test from "node:test";
+import { resolveOvenPackageDir } from "../server/fs-safe.mjs";
+
+const repoRoot = resolve(new URL("../..", import.meta.url).pathname);
+const binPath = join(repoRoot, "bin", "burnlist.mjs");
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), "burnlist-oven-storage-"));
+  const repo = join(root, "repo");
+  mkdirSync(repo);
+  return { repo, cleanup: () => rmSync(root, { recursive: true, force: true }) };
+}
+
+function run(context, args, input) {
+  return execFileSync(process.execPath, [binPath, ...args], { cwd: context.repo, encoding: "utf8", input });
+}
+
+function detailWithStoredBytes(targetBytes, fill = "d") {
+  const detail = {
+    version: 1,
+    columns: 2,
+    rows: 32,
+    rowHeight: 48,
+    cells: Array.from({ length: 32 }, (_, index) => ({
+      id: `cell-${index + 1}`,
+      title: "Title",
+      description: "",
+      widget: "metric",
+      source: "/metric",
+      format: "plain",
+      column: 1,
+      row: index + 1,
+      columnSpan: 1,
+      rowSpan: 1,
+    })),
+  };
+  let remaining = targetBytes - Buffer.byteLength(`${JSON.stringify(detail, null, 2)}\n`);
+  for (const cell of detail.cells) {
+    const amount = Math.min(2_000, Math.ceil(remaining / Buffer.byteLength(fill)));
+    cell.description = fill.repeat(amount);
+    remaining -= Buffer.byteLength(cell.description);
+  }
+  assert.equal(remaining, 0, "test fixture cannot reach its requested detail size");
+  return detail;
+}
+
+test("--package accepts a 133KB envelope when each stored component fits", () => {
+  const context = fixture();
+  try {
+    const instructions = `# ${"x".repeat(65_533)}`;
+    const detail = detailWithStoredBytes(69 * 1024);
+    const packageInput = JSON.stringify({ instructions, detail });
+    const instructionsPath = join(context.repo, "instructions.md");
+    const detailPath = join(context.repo, "detail.json");
+    writeFileSync(instructionsPath, instructions);
+    writeFileSync(detailPath, JSON.stringify(detail));
+
+    run(context, ["oven", "create", "from-package", "--package", "-"], packageInput);
+    run(context, ["oven", "create", "from-files", "--instructions", instructionsPath, "--detail", detailPath]);
+
+    const packageDir = resolveOvenPackageDir(join(context.repo, ".local", "burnlist", "ovens", "from-package"));
+    const filesDir = resolveOvenPackageDir(join(context.repo, ".local", "burnlist", "ovens", "from-files"));
+    const packageInstructions = readFileSync(join(packageDir, "instructions.md"), "utf8");
+    const packageDetail = readFileSync(join(packageDir, "detail.json"), "utf8");
+    assert.equal(Buffer.byteLength(packageInstructions), 64 * 1024);
+    assert.equal(Buffer.byteLength(packageDetail), 69 * 1024);
+    assert.ok(Buffer.byteLength(packageInput) > 128 * 1024);
+    assert.equal(packageInstructions, readFileSync(join(filesDir, "instructions.md"), "utf8"));
+    assert.equal(packageDetail, readFileSync(join(filesDir, "detail.json"), "utf8"));
+  } finally { context.cleanup(); }
+});
+
+test("--package rejects oversized stored instructions and detail independently", () => {
+  const context = fixture();
+  try {
+    const detail = detailWithStoredBytes(69 * 1024);
+    assert.throws(
+      () => run(context, ["oven", "create", "large-instructions", "--package", "-"], JSON.stringify({
+        instructions: `# ${"\u0800".repeat(21_845)}`, detail,
+      })),
+      (error) => String(error.stderr).includes("instructions.md") && String(error.stderr).includes("65536 byte limit"),
+    );
+    const oversizedDetail = detailWithStoredBytes(69 * 1024);
+    for (const cell of oversizedDetail.cells) cell.description = "\u0800".repeat(2_000);
+    assert.throws(
+      () => run(context, ["oven", "create", "large-detail", "--package", "-"], JSON.stringify({
+        instructions: "# Valid", detail: oversizedDetail,
+      })),
+      (error) => String(error.stderr).includes("detail.json") && String(error.stderr).includes("131072 byte limit"),
+    );
+  } finally { context.cleanup(); }
+});
diff --git a/src/cli/registry-cli.mjs b/src/cli/registry-cli.mjs
index c56a563..5376de7 100644
--- a/src/cli/registry-cli.mjs
+++ b/src/cli/registry-cli.mjs
@@ -1,6 +1,5 @@
 #!/usr/bin/env node
 import { randomBytes } from "node:crypto";
-import { spawnSync } from "node:child_process";
 import {
   existsSync,
   mkdirSync,
@@ -16,9 +15,10 @@ import {
   registerRoot,
   unregisterRoot,
 } from "../server/registry.mjs";
+import { gitProbe } from "./git-ignore.mjs";
 
 const LIFECYCLE_FOLDERS = ["draft", "ready", "inprogress", "completed"];
-const IGNORE_LINE = "/notes/burnlists/";
+const IGNORE_LINES = ["/notes/burnlists/", "/.local/"];
 
 function parseArgs(tokens) {
   const flags = new Set();
@@ -45,24 +45,15 @@ function atomicWrite(path, text) {
   }
 }
 
-function gitProbe(dir, args) {
-  return spawnSync("git", ["-C", dir, ...args], {
-    cwd: dir,
-    encoding: "utf8",
-    shell: false,
-    stdio: ["ignore", "pipe", "ignore"],
-  });
-}
-
 function excludePath(dir) {
   const result = gitProbe(dir, ["rev-parse", "--git-path", "info/exclude"]);
   if (result.status !== 0 || !result.stdout.trim()) return null;
   return resolve(dir, result.stdout.trim());
 }
 
-function isIgnoreLine(line) {
+function isIgnoreLine(line, ignoredLines = IGNORE_LINES) {
   const trimmed = line.trim();
-  return trimmed === IGNORE_LINE || trimmed === "notes/burnlists/";
+  return ignoredLines.some((ignore) => trimmed === ignore || trimmed === ignore.slice(1));
 }
 
 function readExclude(path) {
@@ -74,18 +65,20 @@ function readExclude(path) {
   }
 }
 
-function appendIgnoreLine(path) {
+function appendIgnoreLines(path, lines) {
   const content = readExclude(path);
-  if (content.split(/\r?\n/u).some(isIgnoreLine)) return false;
+  const existing = content.split(/\r?\n/u).map((line) => line.trim());
+  const missing = lines.filter((line) => !existing.includes(line) && !existing.includes(line.slice(1)));
+  if (missing.length === 0) return false;
   const prefix = content.length === 0 || content.endsWith("\n") ? content : `${content}\n`;
-  atomicWrite(path, `${prefix}${IGNORE_LINE}\n`);
+  atomicWrite(path, `${prefix}${missing.join("\n")}\n`);
   return true;
 }
 
-function removeIgnoreLine(path) {
+function removeIgnoreLines(path, ignoredLines) {
   const content = readExclude(path);
   const lines = content.split(/\r?\n/u);
-  const kept = lines.filter((line) => !isIgnoreLine(line));
+  const kept = lines.filter((line) => !isIgnoreLine(line, ignoredLines));
   if (kept.length === lines.length) return false;
   atomicWrite(path, kept.join("\n"));
   return true;
@@ -104,17 +97,15 @@ function initializeFolders(dir, track) {
 }
 
 function configureIgnore(dir, track) {
-  if (!track) {
-    const ignored = gitProbe(dir, ["check-ignore", "-q", "notes/burnlists"]);
-    if (ignored.status === 0) return "already ignored";
-  }
   const path = excludePath(dir);
   if (!path) return "not a git repository";
   if (track) {
-    removeIgnoreLine(path);
+    removeIgnoreLines(path, ["/notes/burnlists/"]);
+    appendIgnoreLines(path, ["/.local/"]);
     return "tracked";
   }
-  return appendIgnoreLine(path) ? "ignored" : "already ignored";
+  const missing = IGNORE_LINES.filter((line) => gitProbe(dir, ["check-ignore", "-q", "--", line.slice(1)]).status !== 0);
+  return appendIgnoreLines(path, missing) ? "ignored" : "already ignored";
 }
 
 function printUsage() {
@@ -154,8 +145,8 @@ function runInit(path, track) {
   console.log(`Initialized ${folders.created} lifecycle ${folders.created === 1 ? "folder" : "folders"} in ${dir}.`);
   if (track) console.log("Tracking notes/burnlists/ with .gitkeep files.");
   else if (ignoreState === "not a git repository") console.log("No Git repository; local ignore skipped.");
-  else if (ignoreState === "already ignored") console.log("notes/burnlists/ is already ignored locally.");
-  else console.log("Ignored /notes/burnlists/ locally.");
+  else if (ignoreState === "already ignored") console.log("notes/burnlists/ and .local/ are already ignored locally.");
+  else console.log("Ignored /notes/burnlists/ and /.local/ locally.");
   console.log(`${registration.added ? "Registered" : "Already registered"} ${registration.root}.`);
 }
 
diff --git a/src/cli/registry-cli.test.mjs b/src/cli/registry-cli.test.mjs
index 7975585..b5d47b8 100644
--- a/src/cli/registry-cli.test.mjs
+++ b/src/cli/registry-cli.test.mjs
@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import { execFileSync } from "node:child_process";
-import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -89,16 +89,18 @@ test("init creates lifecycle folders, ignores them, and registers the repo", ()
       assert.equal(statSync(join(repo, "notes", "burnlists", folder)).isDirectory(), true);
     }
     assert.match(exclude(repo), /^\/notes\/burnlists\/$/mu);
+    assert.match(exclude(repo), /^\/\.local\/$/mu);
     assert.match(run(home, "roots"), new RegExp(`empty\\s+${canonicalRepo}`));
-    assert.match(first, /Ignored \/notes\/burnlists\/ locally\./u);
+    assert.match(first, /Ignored \/notes\/burnlists\/ and \/\.local\/ locally\./u);
     run(home, "init", repo);
     assert.equal(exclude(repo).split("\n").filter((line) => line === "/notes/burnlists/").length, 1);
+    assert.equal(exclude(repo).split("\n").filter((line) => line === "/.local/").length, 1);
   } finally {
     cleanup();
   }
 });
 
-test("init --track writes gitkeep files and removes the local ignore", () => {
+test("init --track writes gitkeep files, tracks burnlists, and keeps local Oven storage ignored", () => {
   const { home, cleanup } = fixture();
   const repo = gitRepo(home, "tracked-repo");
   try {
@@ -108,6 +110,20 @@ test("init --track writes gitkeep files and removes the local ignore", () => {
       assert.equal(readFileSync(join(repo, "notes", "burnlists", folder, ".gitkeep"), "utf8"), "");
     }
     assert.doesNotMatch(exclude(repo), /^\/?notes\/burnlists\/$/mu);
+    assert.match(exclude(repo), /^\/?\.local\/$/mu);
+    const packagePath = join(repo, "oven.json");
+    writeFileSync(packagePath, JSON.stringify({
+      instructions: "# Tracked Oven\n\nKeep Oven state local.",
+      detail: {
+        version: 1, columns: 2, rows: 2, rowHeight: 48,
+        cells: [{
+          id: "summary", title: "Summary", description: "Current state.", widget: "metric", source: "/summary", format: "plain",
+          column: 1, row: 1, columnSpan: 2, rowSpan: 1,
+        }],
+      },
+    }));
+    run(home, "oven", "create", "tracked-oven", "--package", packagePath, "--repo", repo);
+    assert.equal(existsSync(join(repo, ".local", "burnlist", "ovens", "tracked-oven", "current")), true);
   } finally {
     cleanup();
   }
@@ -121,7 +137,7 @@ test("init respects a tracked gitignore rule", () => {
   const before = exclude(repo);
   try {
     run(home, "init", repo);
-    assert.equal(exclude(repo), before);
+    assert.equal(exclude(repo), `${before}/.local/\n`);
   } finally {
     cleanup();
   }
diff --git a/src/ovens/built-in-handlers.mjs b/src/ovens/built-in-handlers.mjs
new file mode 100644
index 0000000..1e6a06e
--- /dev/null
+++ b/src/ovens/built-in-handlers.mjs
@@ -0,0 +1,2 @@
+import "./handlers/checklist.mjs";
+import "../../ovens/differential-testing/engine/differential-testing-handler.mjs";
diff --git a/src/ovens/handlers/checklist.mjs b/src/ovens/handlers/checklist.mjs
new file mode 100644
index 0000000..14ffb83
--- /dev/null
+++ b/src/ovens/handlers/checklist.mjs
@@ -0,0 +1,4 @@
+import { registerOvenHandler } from "../oven-registry.mjs";
+import { genericJsonHandler } from "./generic-json-handler.mjs";
+
+registerOvenHandler("checklist", genericJsonHandler);
diff --git a/src/ovens/handlers/generic-json-handler.mjs b/src/ovens/handlers/generic-json-handler.mjs
new file mode 100644
index 0000000..9cadf70
--- /dev/null
+++ b/src/ovens/handlers/generic-json-handler.mjs
@@ -0,0 +1,25 @@
+import { readTextFileWithLimit, safeStat } from "../../server/fs-safe.mjs";
+
+export const genericJsonHandler = Object.freeze({
+  id: "checklist",
+
+  serveData({ id, bindingPath, maxOvenDataBytes }) {
+    if (!safeStat(bindingPath)?.isFile()) {
+      throw Object.assign(new Error(`configured data for Oven ${id} is missing`), { status: 404 });
+    }
+    const payload = JSON.parse(readTextFileWithLimit(bindingPath, maxOvenDataBytes, `Oven ${id} data`));
+    return { ovenId: id, path: bindingPath, payload, validated: false };
+  },
+
+  dashboardEntries({ id, discoverBurnlists }) {
+    if (id !== "checklist") return [];
+    return discoverBurnlists().map((entry) => ({
+      ...entry,
+      planPath: entry.planPath,
+      ovenId: "checklist",
+      ovenName: "Checklist",
+      href: `/${encodeURIComponent(entry.repo)}/${encodeURIComponent(entry.id)}`,
+      progressLabel: `${entry.done}/${entry.total} done`,
+    }));
+  },
+});
diff --git a/src/ovens/oven-contract.mjs b/src/ovens/oven-contract.mjs
index aaa9791..9174476 100644
--- a/src/ovens/oven-contract.mjs
+++ b/src/ovens/oven-contract.mjs
@@ -1,3 +1,5 @@
+import { createHash } from "node:crypto";
+
 const ovenWidgets = new Set([
   "metric",
   "progress",
@@ -117,3 +119,34 @@ export function normalizeOvenPackage(value) {
     detail: normalizeOvenDetail(value.detail),
   };
 }
+
+function canonicalJson(value) {
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (plainObject(value)) {
+    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+// Callers pass an Oven package whose instructions and detail have already been
+// normalized by normalizeOvenPackage. Only its portable content defines this id.
+export function ovenRevision(pkg) {
+  const instructions = String(pkg.instructions ?? "").replace(/\r\n?/gu, "\n");
+  const contents = canonicalJson({
+    format: "burnlist-oven-content@1",
+    instructions,
+    detail: pkg.detail,
+  });
+  return `o1-sha256:${createHash("sha256").update(contents).digest("hex")}`;
+}
+
+export function normalizeOvenForkedFrom(value) {
+  assertKnownKeys(value, new Set(["forkedFrom"]), "Oven lineage");
+  if (!plainObject(value.forkedFrom)) throw new Error("Oven lineage forkedFrom must be an object.");
+  assertKnownKeys(value.forkedFrom, new Set(["ovenId", "revision"]), "Oven lineage forkedFrom");
+  const revision = boundedText(value.forkedFrom.revision, "Oven lineage revision", 74);
+  if (!/^o1-sha256:[a-f0-9]{64}$/u.test(revision)) {
+    throw new Error("Oven lineage revision must be an o1-sha256 digest.");
+  }
+  return { forkedFrom: { ovenId: ovenId(value.forkedFrom.ovenId), revision } };
+}
diff --git a/src/ovens/oven-contract.test.mjs b/src/ovens/oven-contract.test.mjs
new file mode 100644
index 0000000..a6c5435
--- /dev/null
+++ b/src/ovens/oven-contract.test.mjs
@@ -0,0 +1,66 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { normalizeOvenPackage, ovenRevision } from "./oven-contract.mjs";
+
+function packageFixture(id = "sample-oven") {
+  return {
+    id,
+    instructions: "# Sample Oven\n\nFollow the checklist.\n",
+    detail: {
+      version: 1,
+      columns: 2,
+      rows: 2,
+      rowHeight: 48,
+      cells: [{
+        id: "summary",
+        title: "Summary",
+        description: "Current status.",
+        widget: "metric",
+        source: "/summary",
+        format: "plain",
+        column: 1,
+        row: 1,
+        columnSpan: 2,
+        rowSpan: 1,
+      }],
+    },
+  };
+}
+
+function normalizedFixture(id) {
+  return normalizeOvenPackage(packageFixture(id));
+}
+
+test("unmodified-fork-shares-revision", () => {
+  assert.equal(ovenRevision(normalizedFixture("original-oven")), ovenRevision(normalizedFixture("forked-oven")));
+});
+
+test("content-change-changes-revision", () => {
+  const original = normalizedFixture("sample-oven");
+  const changedInstructions = { ...original, instructions: "# Sample Oven\n\nUse the revised checklist." };
+  const changedTitle = {
+    ...original,
+    detail: { ...original.detail, cells: [{ ...original.detail.cells[0], title: "Revised summary" }] },
+  };
+  const changedVersion = { ...original, detail: { ...original.detail, version: 2 } };
+  const revision = ovenRevision(original);
+  assert.notEqual(ovenRevision(changedInstructions), revision);
+  assert.notEqual(ovenRevision(changedTitle), revision);
+  assert.notEqual(ovenRevision(changedVersion), revision);
+});
+
+test("key-order-invariant", () => {
+  const original = normalizedFixture("sample-oven");
+  const reordered = {
+    id: "other-oven",
+    instructions: original.instructions.replaceAll("\n", "\r\n"),
+    detail: {
+      cells: original.detail.cells.map((cell) => ({ rowSpan: cell.rowSpan, title: cell.title, id: cell.id, ...cell })),
+      rowHeight: original.detail.rowHeight,
+      rows: original.detail.rows,
+      columns: original.detail.columns,
+      version: original.detail.version,
+    },
+  };
+  assert.equal(ovenRevision(original), ovenRevision(reordered));
+});
diff --git a/src/ovens/oven-registry.mjs b/src/ovens/oven-registry.mjs
new file mode 100644
index 0000000..3b568fe
--- /dev/null
+++ b/src/ovens/oven-registry.mjs
@@ -0,0 +1,34 @@
+import { ovenId } from "./oven-contract.mjs";
+
+// Oven handlers are code-owned adapters for declared Oven packages. A handler may
+// provide dashboardEntries(ctx), serveData(ctx), and warm(ctx) with warmIntervalMs.
+// serveData may write directly to ctx.res, or return a value for the server to JSON
+// serialize. Context contains only the request-specific values each hook needs.
+const handlers = new Map();
+
+export function registerOvenHandler(id, handler) {
+  const normalizedId = ovenId(id);
+  if (!handler || typeof handler !== "object") throw new Error(`Oven handler for ${normalizedId} must be an object.`);
+  if (handlers.has(normalizedId)) throw new Error(`Oven handler for ${normalizedId} is already registered.`);
+  if (handler.id !== id) throw new Error(`Oven handler id must equal its registry key ${normalizedId}.`);
+  for (const hook of ["dashboardEntries", "serveData", "warm"]) {
+    if (handler[hook] !== undefined && typeof handler[hook] !== "function") {
+      throw new Error(`Oven handler ${normalizedId} ${hook} must be a function.`);
+    }
+  }
+  if (handler.warmIntervalMs !== undefined
+    && (!Number.isInteger(handler.warmIntervalMs) || handler.warmIntervalMs <= 0)) {
+    throw new Error(`Oven handler ${normalizedId} warmIntervalMs must be a positive integer.`);
+  }
+  const registered = Object.freeze({ ...handler, id: normalizedId });
+  handlers.set(normalizedId, registered);
+  return registered;
+}
+
+export function getOvenHandler(id) {
+  return handlers.get(id) ?? null;
+}
+
+export function listOvenHandlers() {
+  return [...handlers.values()];
+}
diff --git a/src/ovens/oven-registry.test.mjs b/src/ovens/oven-registry.test.mjs
new file mode 100644
index 0000000..fa35ac6
--- /dev/null
+++ b/src/ovens/oven-registry.test.mjs
@@ -0,0 +1,22 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { getOvenHandler, listOvenHandlers, registerOvenHandler } from "./oven-registry.mjs";
+
+test("the Oven handler registry validates and retrieves code-owned handlers", () => {
+  const handler = { id: "registry-test", dashboardEntries() { return []; } };
+  const registered = registerOvenHandler("registry-test", handler);
+
+  assert.equal(getOvenHandler("registry-test"), registered);
+  assert.equal(listOvenHandlers().includes(registered), true);
+  assert.equal(Object.isFrozen(registered), true);
+  handler.id = "mutated-id";
+  assert.equal(getOvenHandler("registry-test").id, "registry-test");
+  assert.equal(listOvenHandlers()[0].id, "registry-test");
+  assert.equal(getOvenHandler("not-registered"), null);
+  assert.equal(getOvenHandler("Invalid id"), null);
+  assert.throws(() => registerOvenHandler("registry-test", { id: "registry-test" }), /already registered/u);
+  assert.throws(() => registerOvenHandler("Invalid id", { id: "Invalid id" }), /lowercase slug/u);
+  assert.throws(() => registerOvenHandler("registry-mismatch", { id: "another-id" }), /must equal/u);
+  assert.throws(() => registerOvenHandler("registry-hook", { id: "registry-hook", warm: true }), /must be a function/u);
+  assert.throws(() => registerOvenHandler("registry-warm", { id: "registry-warm", warmIntervalMs: 0 }), /positive integer/u);
+});
diff --git a/src/server/burnlist-dashboard-server.mjs b/src/server/burnlist-dashboard-server.mjs
index 6b4d03d..d37aad3 100644
--- a/src/server/burnlist-dashboard-server.mjs
+++ b/src/server/burnlist-dashboard-server.mjs
@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { createHash, randomBytes } from "node:crypto";
+import { randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 import {
   existsSync,
@@ -15,26 +15,38 @@ import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import os from "node:os";
 import { mutatorRepoRoots, observerRepoRoots } from "./discovery.mjs";
+import { effectiveBindings } from "./oven-bindings.mjs";
 import { classifyRoots, readRegistry, repoKey } from "./registry.mjs";
 import { buildProjectsSnapshot } from "./projects.mjs";
 import { containedJoin, repoStateDir, withRepoStateLock } from "./repo-state.mjs";
+import { resolveUmbrella } from "../cli/umbrella.mjs";
+import { assertGitIgnored } from "../cli/git-ignore.mjs";
 import {
   assertKnownKeys,
   boundedText,
   normalizeOvenDetail,
+  normalizeOvenForkedFrom,
   normalizeOvenPackage,
   ovenId,
+  ovenRevision,
 } from "../ovens/oven-contract.mjs";
-import { assertDifferentialTestingData } from "../../ovens/differential-testing/engine/differential-testing-data-contract.mjs";
-import {
-  DIFFERENTIAL_TESTING_PAGE_SCHEMA,
-  isDifferentialTestingBundle,
-  queryDifferentialTestingFieldPage,
-  readDifferentialTestingBundleManifest,
-  readDifferentialTestingBundleScenario,
-} from "../../ovens/differential-testing/engine/differential-testing-transport.mjs";
+import "../ovens/built-in-handlers.mjs";
+import { getOvenHandler, listOvenHandlers } from "../ovens/oven-registry.mjs";
+import { genericJsonHandler } from "../ovens/handlers/generic-json-handler.mjs";
 import { buildRepoMapAsync } from "./repo-map.mjs";
-import { readTextFileWithLimit, safeStat } from "./fs-safe.mjs";
+import { discoverBurnlistSummaries } from "./burnlist-discovery.mjs";
+import { isolatedDashboardEntries } from "./dashboard-entry-isolation.mjs";
+import { atomicDirectory, atomicOvenPackage, readTextFileWithLimit, resolveOvenPackageDir, safeStat, withOvenPackageLock } from "./fs-safe.mjs";
+import {
+  assertCustomOvensDir,
+  assertCustomOvenPath,
+  OVEN_DETAIL_MAX_BYTES,
+  OVEN_INSTRUCTIONS_MAX_BYTES,
+  OVEN_LINEAGE_MAX_BYTES,
+  resolveCustomOvensDir,
+  serializeOvenPackage,
+} from "./oven-storage.mjs";
+import { warmOvenHandler } from "./oven-warm.mjs";
 import {
   LIFECYCLES,
   burnlistIdForPlan,
@@ -44,7 +56,6 @@ import {
   lifecycleForPlan,
   localIsoTimestamp,
   parsePlan,
-  summaryForPlan,
   twoDigit,
   validatePlan,
 } from "./plan-model.mjs";
@@ -69,6 +80,7 @@ const allowedArgs = new Set([
   "stamp",
   "state-dir",
   "stop",
+  "unsafe-ovens-dir",
 ]);
 for (let index = 2; index < process.argv.length; index += 1) {
   const arg = process.argv[index];
@@ -107,13 +119,28 @@ const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..")
 const dashboardDistDir = resolve(packageRoot, "dashboard", "dist");
 const dashboardIndexPath = resolve(dashboardDistDir, "index.html");
 const builtInOvensDir = resolve(packageRoot, "ovens");
-const customOvensDir = resolve(launchCwd, args.get("ovens-dir") ?? ".local/burnlist/ovens");
+const umbrellaRoot = resolveUmbrella(launchCwd);
+if (args.get("ovens-dir") === "true") {
+  console.error("--ovens-dir requires a path.");
+  process.exit(2);
+}
+const unsafeOvensDir = args.has("unsafe-ovens-dir");
+// --ovens-dir overrides custom Oven storage for the launch umbrella only.
+// Other observed repositories always use their own .local/burnlist/ovens.
+const launchCustomOvensDir = resolveCustomOvensDir(
+  umbrellaRoot,
+  args.has("ovens-dir") ? args.get("ovens-dir") : undefined,
+  { unsafe: unsafeOvensDir },
+);
+const launchRepoRoot = realpathSync(umbrellaRoot);
 const legacyRunsDir = args.has("runs-dir") ? resolve(launchCwd, args.get("runs-dir")) : null;
-const ovenDataBindings = parseOvenDataBindings(args.get("oven-data") ?? "");
+const ovenDataOverrides = parseOvenDataBindings(args.get("oven-data") ?? "");
 const writeToken = randomBytes(24).toString("hex");
 const repoMapCache = new Map();
-let differentialTestingDataCache = null;
+const ovenHandlerCaches = new Map();
 const REPO_MAP_CACHE_MS = 2_000;
+const RUN_SNAPSHOT_INSTRUCTIONS_MAX_BYTES = 262144;
+const RUN_SNAPSHOT_DETAIL_MAX_BYTES = 393216;
 
 function cachedRepoMap(repo) {
   const key = repo.root;
@@ -129,207 +156,6 @@ function cachedRepoMap(repo) {
   return promise;
 }
 
-function differentialTestingIndexCache(path) {
-  const readPath = resolve(realpathSync(dirname(path)), basename(path));
-  const stat = safeStat(readPath);
-  if (!stat?.isFile()) throw new Error("configured Differential Testing data is missing");
-  const signature = `${readPath}\0${stat.ino}\0${stat.size}\0${stat.mtimeMs}`;
-  if (differentialTestingDataCache?.signature === signature) return differentialTestingDataCache;
-  const source = readTextFileWithLimit(readPath, maxOvenDataBytes, "Oven differential-testing data");
-  const document = JSON.parse(source);
-  if (isDifferentialTestingBundle(document)) {
-    const bundle = readDifferentialTestingBundleManifest(readPath, { maxDocumentBytes: maxOvenDataBytes });
-    const emptyPayload = bundle.selectedScenarioId === null ? bundle.manifest.emptyData : null;
-    const emptySource = emptyPayload ? JSON.stringify(emptyPayload) : "";
-    differentialTestingDataCache = {
-      kind: "bundle",
-      signature,
-      readPath: bundle.readPath,
-      source: emptySource,
-      sourceBytes: Buffer.byteLength(emptySource),
-      etag: `W/\"dtb-${bundle.sha256}\"`,
-      selectedScenarioId: bundle.selectedScenarioId,
-      scenarios: structuredClone(bundle.scenarios),
-      bundle,
-      scenarioDocuments: new Map(),
-      scenarioResponses: new Map(),
-      responseExtras: emptyPayload ? {
-        transport: {
-          schema: DIFFERENTIAL_TESTING_PAGE_SCHEMA,
-          bundleSha256: bundle.sha256,
-          scenarioSha256: null,
-        },
-        fieldPage: null,
-        frameDeltaMetrics: null,
-      } : null,
-    };
-    return differentialTestingDataCache;
-  }
-  assertDifferentialTestingData(document);
-  differentialTestingDataCache = {
-    kind: "legacy",
-    signature,
-    readPath,
-    source,
-    sourceBytes: stat.size,
-    etag: `W/\"dt-${stat.ino}-${stat.size}-${Math.trunc(stat.mtimeMs)}\"`,
-    selectedScenarioId: document.scenarioCatalog.selectedScenarioId,
-    scenarios: structuredClone(document.scenarioCatalog.scenarios),
-    scenarioResponses: new Map(),
-  };
-  return differentialTestingDataCache;
-}
-
-function differentialTestingQueryValue(searchParams, name) {
-  const values = searchParams.getAll(name);
-  if (values.length > 1) throw Object.assign(new Error(`${name} must be supplied at most once`), { status: 400 });
-  return values[0] ?? null;
-}
-
-function differentialTestingIntegerQuery(searchParams, name, fallback) {
-  const value = differentialTestingQueryValue(searchParams, name);
-  if (value === null) return fallback;
-  if (!/^(?:0|[1-9]\d*)$/u.test(value)) {
-    throw Object.assign(new Error(`${name} must be a non-negative integer`), { status: 400 });
-  }
-  const number = Number(value);
-  if (!Number.isSafeInteger(number)) throw Object.assign(new Error(`${name} must be a safe integer`), { status: 400 });
-  return number;
-}
-
-function differentialTestingBundleScenario(index, scenarioId) {
-  const cached = index.scenarioDocuments.get(scenarioId);
-  if (cached) return cached;
-  const scenario = readDifferentialTestingBundleScenario(index.bundle, scenarioId, {
-    maxDocumentBytes: maxOvenDataBytes,
-  });
-  scenario.source = JSON.stringify(scenario.data);
-  scenario.sourceBytes = Buffer.byteLength(scenario.source);
-  index.scenarioDocuments.set(scenarioId, scenario);
-  return scenario;
-}
-
-function differentialTestingBundleResponse(index, scenarioId, searchParams) {
-  const search = differentialTestingQueryValue(searchParams, "search") ?? "";
-  const filter = differentialTestingQueryValue(searchParams, "filter") ?? "all";
-  const scenario = differentialTestingBundleScenario(index, scenarioId);
-  const sort = differentialTestingQueryValue(searchParams, "sort")
-    ?? (scenario.data.telemetry?.status === "comparable" ? "changed" : "default");
-  const page = differentialTestingIntegerQuery(searchParams, "page", 0);
-  const pageSize = differentialTestingIntegerQuery(searchParams, "pageSize", 25);
-  const fieldPage = queryDifferentialTestingFieldPage(scenario, { search, filter, sort, page, pageSize });
-  const queryKey = new URLSearchParams({
-    search: fieldPage.search,
-    filter: fieldPage.filter,
-    sort: fieldPage.sort,
-    page: String(fieldPage.page),
-    pageSize: String(fieldPage.pageSize),
-  }).toString();
-  const etagDigest = createHash("sha256")
-    .update(index.bundle.sha256)
-    .update("\0")
-    .update(scenario.scenarioSha256)
-    .update("\0")
-    .update(queryKey)
-    .digest("hex");
-  const result = {
-    signature: `${index.signature}\0${scenario.scenarioSha256}\0${queryKey}`,
-    readPath: index.readPath,
-    source: scenario.source,
-    sourceBytes: scenario.sourceBytes,
-    etag: `W/\"dtb-${etagDigest}\"`,
-    selectedScenarioId: scenarioId,
-    responseExtras: {
-      transport: {
-        schema: DIFFERENTIAL_TESTING_PAGE_SCHEMA,
-        bundleSha256: index.bundle.sha256,
-        scenarioSha256: scenario.scenarioSha256,
-      },
-      fieldPage,
-      frameDeltaMetrics: scenario.frameDeltaMetrics,
-    },
-  };
-  return result;
-}
-
-function differentialTestingScenarioCache(index, scenarioId) {
-  const cached = index.scenarioResponses.get(scenarioId);
-  const scenariosDir = resolve(dirname(index.readPath), "scenarios");
-  const scenarioPath = resolve(scenariosDir, `${scenarioId}.json`);
-  const scenarioRelativePath = relative(scenariosDir, scenarioPath);
-  if (!scenarioRelativePath || scenarioRelativePath.startsWith("..") || resolve(scenariosDir, scenarioRelativePath) !== scenarioPath) {
-    throw Object.assign(new Error("scenario path escapes the published bundle"), { status: 400 });
-  }
-  const stat = safeStat(scenarioPath);
-  if (!stat?.isFile()) throw Object.assign(new Error(`published data for scenario ${scenarioId} is missing`), { status: 404 });
-  const signature = `${index.signature}\0${scenarioPath}\0${stat.ino}\0${stat.size}\0${stat.mtimeMs}`;
-  if (cached?.signature === signature) return cached;
-  const sourcePayload = JSON.parse(readTextFileWithLimit(
-    scenarioPath,
-    maxOvenDataBytes,
-    `Differential Testing scenario ${scenarioId}`,
-  ));
-  assertDifferentialTestingData(sourcePayload);
-  if (sourcePayload.scenarioCatalog.selectedScenarioId !== scenarioId) {
-    throw Object.assign(new Error(`scenario file ${scenarioId} selects ${sourcePayload.scenarioCatalog.selectedScenarioId}`), { status: 422 });
-  }
-  const indexScenario = index.scenarios.find((scenario) => scenario.id === scenarioId);
-  const payloadScenario = sourcePayload.scenarioCatalog.scenarios.find((scenario) => scenario.id === scenarioId);
-  if (JSON.stringify(payloadScenario) !== JSON.stringify(indexScenario)) {
-    throw Object.assign(new Error(`scenario file ${scenarioId} does not match its published catalog entry`), { status: 422 });
-  }
-  const payload = {
-    ...sourcePayload,
-    scenarioCatalog: { selectedScenarioId: scenarioId, scenarios: index.scenarios },
-  };
-  assertDifferentialTestingData(payload);
-  const source = JSON.stringify(payload);
-  const result = {
-    signature,
-    readPath: scenarioPath,
-    source,
-    sourceBytes: Buffer.byteLength(source),
-    etag: `W/\"dt-${stat.ino}-${stat.size}-${Math.trunc(stat.mtimeMs)}-${index.etag.slice(3, -1)}\"`,
-    selectedScenarioId: scenarioId,
-  };
-  index.scenarioResponses.set(scenarioId, result);
-  return result;
-}
-
-function sendDifferentialTestingData(req, res, cached) {
-  if (req.headers["if-none-match"] === cached.etag) {
-    res.writeHead(304, { etag: cached.etag, "cache-control": "no-store" });
-    res.end();
-    return;
-  }
-  const prefix = `${JSON.stringify({
-    ovenId: "differential-testing",
-    path: cached.readPath,
-    scenarioId: cached.selectedScenarioId,
-    ...(cached.responseExtras || {}),
-  }).slice(0, -1)},\"payload\":`;
-  const suffix = "}";
-  res.writeHead(200, {
-    "content-type": "application/json; charset=utf-8",
-    "cache-control": "no-store",
-    etag: cached.etag,
-    "content-length": Buffer.byteLength(prefix) + cached.sourceBytes + Buffer.byteLength(suffix),
-  });
-  res.write(prefix);
-  res.write(cached.source);
-  res.end(suffix);
-}
-
-function warmDifferentialTestingData() {
-  const path = ovenDataBindings.get("differential-testing");
-  if (!path) return;
-  try {
-    differentialTestingIndexCache(path);
-  } catch {
-    // The request path reports validation errors; background warming remains silent.
-  }
-}
-
 function positiveInteger(value, name) {
   const parsed = Number(value);
   if (!Number.isInteger(parsed) || parsed <= 0) {
@@ -425,13 +251,35 @@ function candidateRepoRoots() {
   return observerRepoRoots({ cwd: launchCwd, home: os.homedir(), scanRoot: args.get("scan-root") });
 }
 
+function resolvedOvenDataBindings() {
+  return effectiveBindings({ repoRoots: ovenScopeRepos().map((repo) => repo.root), override: ovenDataOverrides });
+}
+
+function selectedOvenDataBinding(ovenDataBindings, id, url) {
+  const bindings = ovenDataBindings.get(id) ?? [];
+  const repoKeys = url.searchParams.getAll("repoKey");
+  if (repoKeys.length > 1) throw Object.assign(new Error("repoKey must be supplied at most once"), { status: 400 });
+  if (repoKeys.length === 1) {
+    return bindings.find((binding) => binding.repoKey === repoKeys[0])
+      ?? bindings.find((binding) => binding.repoKey === null)
+      ?? null;
+  }
+  return bindings.find((binding) => binding.repoKey === null) ?? null;
+}
+
 function burnlistPathsFor(repoRoots) {
   const paths = [];
   for (const repoRoot of repoRoots) {
     for (const lifecycle of LIFECYCLES) {
       const lifecycleRoot = join(repoRoot, "notes", "burnlists", lifecycle.folder);
       if (!safeStat(lifecycleRoot)?.isDirectory()) continue;
-      for (const id of readdirSync(lifecycleRoot)) {
+      let ids;
+      try {
+        ids = readdirSync(lifecycleRoot);
+      } catch {
+        continue;
+      }
+      for (const id of ids) {
         if (id.startsWith(".")) continue;
         const planPath = join(lifecycleRoot, id, "burnlist.md");
         if (safeStat(planPath)?.isFile()) paths.push(planPath);
@@ -446,64 +294,48 @@ function burnlistPaths() {
 }
 
 function discoverBurnlists() {
-  return burnlistPaths().map((path) => summaryForPlan(path, maxPlanBytes));
+  return discoverBurnlistSummaries({ repoRoots: candidateRepoRoots(), maxPlanBytes });
 }
 
-function checklistDashboardEntries() {
-  return discoverBurnlists().map((entry) => ({
-    ...entry,
-    ovenId: "checklist",
-    ovenName: "Checklist",
-    href: `/${encodeURIComponent(entry.repo)}/${encodeURIComponent(entry.id)}`,
-    progressLabel: `${entry.done}/${entry.total} done`,
-  }));
+function dashboardEntries(ovenDataBindings) {
+  return isolatedDashboardEntries({
+    handlers: listOvenHandlers(),
+    contextForHandler: (handler) => ovenHandlerContext({ id: handler.id, oven: { id: handler.id }, ovenDataBindings }),
+    repoKeyForRoot: (root) => repoKey(realpathSync(root)),
+    blockedEntry: blockedDashboardEntry,
+  });
 }
 
-function differentialTestingDashboardEntries() {
-  const path = ovenDataBindings.get("differential-testing");
-  if (!path) return [];
-  const index = differentialTestingIndexCache(path);
-  const matchedRepo = discoveredRepos()
-    .filter((entry) => index.readPath === entry.root || index.readPath.startsWith(`${entry.root}/`))
-    .sort((left, right) => right.root.length - left.root.length)[0] ?? null;
-  const repo = matchedRepo?.name ?? "differential-testing";
-  return index.scenarios.map((scenario) => ({
-    id: scenario.id,
-    repo,
-    repoRoot: matchedRepo?.root ?? null,
-    title: scenario.label,
-    status: "active",
-    statusLabel: "Active",
-    total: scenario.frameCount,
-    done: null,
-    remaining: null,
-    percent: null,
-    errors: 0,
-    warnings: 0,
-    lastCompletedAt: null,
-    updatedAt: scenario.updatedAt,
-    ovenId: "differential-testing",
-    ovenName: "Differential Testing",
-    href: `/ovens/differential-testing/view?scenario=${encodeURIComponent(scenario.id)}`,
-    progressLabel: `${scenario.frameCount} frames`,
-  }));
+function blockedDashboardEntry(handler, error) {
+  const blockers = String(error?.message ?? error ?? "Oven dashboard data is unavailable.").slice(0, 200);
+  return {
+    id: `blocked-${handler.id}`, repo: "Oven", repoKey: null, repoRoot: null, planPath: null,
+    title: handler.id, planLabel: "Oven dashboard", status: "active", statusLabel: "Blocked",
+    total: 0, done: null, remaining: null, percent: null, errors: 1, warnings: 0,
+    lastCompletedAt: null, updatedAt: null, ovenId: handler.id, ovenName: handler.id,
+    href: "/", progressLabel: "Blocked", blockers,
+  };
 }
 
-function dashboardEntries() {
-  return [...checklistDashboardEntries(), ...differentialTestingDashboardEntries()]
-    .map((entry) => {
-      let key = null;
-      try {
-        key = entry.repoRoot ? repoKey(realpathSync(entry.repoRoot)) : null;
-      } catch {
-        // Entries for unavailable roots remain visible without a route key.
-      }
-      return { ...entry, repoKey: key };
-    })
-    .sort((left, right) => String(right.updatedAt ?? "").localeCompare(String(left.updatedAt ?? "")));
+function ovenHandlerContext({ id, oven, req, res, url, bindingPath, ovenDataBindings = resolvedOvenDataBindings() } = {}) {
+  const cacheId = id ?? oven?.id;
+  if (cacheId && !ovenHandlerCaches.has(cacheId)) ovenHandlerCaches.set(cacheId, new Map());
+  return {
+    id: cacheId,
+    oven,
+    req,
+    res,
+    url,
+    bindingPath,
+    cache: cacheId ? ovenHandlerCaches.get(cacheId) : new Map(),
+    ovenDataBindings,
+    maxOvenDataBytes,
+    discoverBurnlists,
+    discoveredRepos,
+  };
 }
 
-function projectsSnapshot() {
+function projectsSnapshot(ovenDataBindings) {
   const home = os.homedir();
   const hasScanRootOverride = Boolean(args.get("scan-root"));
   let registeredRoots = [];
@@ -548,7 +380,7 @@ function projectsSnapshot() {
     observerRoots,
     registeredRoots,
     health,
-    entries: dashboardEntries(),
+    entries: dashboardEntries(ovenDataBindings),
     repoKey,
     realpath: realpathSync,
   });
@@ -566,42 +398,107 @@ function instructionsDescription(instructions) {
     .find((line) => line && !line.startsWith("#")) ?? "";
 }
 
-function readOven(root, id, builtIn) {
+function readOven(root, id, builtIn, customRepoRoot = umbrellaRoot) {
   const safeId = ovenId(id);
-  const ovenRoot = join(root, safeId);
-  const instructionsPath = join(ovenRoot, "instructions.md");
-  const detailPath = join(ovenRoot, "detail.json");
-  if (!safeStat(instructionsPath)?.isFile() || !safeStat(detailPath)?.isFile()) return null;
-  const ovenPackage = normalizeOvenPackage({
-    id: safeId,
-    instructions: readTextFileWithLimit(instructionsPath, 65536, "Oven instructions"),
-    detail: JSON.parse(readTextFileWithLimit(detailPath, 131072, "Oven detail template")),
-  });
-  return {
-    id: ovenPackage.id,
-    name: instructionsName(ovenPackage.instructions, safeId),
-    description: instructionsDescription(ovenPackage.instructions),
-    builtIn,
-    instructions: ovenPackage.instructions,
-    detail: ovenPackage.detail,
-  };
+  let ovenRoot;
+  try {
+    const path = builtIn ? join(root, safeId) : assertCustomOvenPath(customRepoRoot, root, safeId, { unsafe: unsafeOvensDir });
+    ovenRoot = resolveOvenPackageDir(realpathSync(path));
+  } catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throw error;
+  }
+  try {
+    const instructionsPath = join(ovenRoot, "instructions.md");
+    const detailPath = join(ovenRoot, "detail.json");
+    if (!safeStat(instructionsPath)?.isFile() || !safeStat(detailPath)?.isFile()) return null;
+    const ovenPackage = normalizeOvenPackage({
+      id: safeId,
+      instructions: readTextFileWithLimit(instructionsPath, OVEN_INSTRUCTIONS_MAX_BYTES, "Oven instructions"),
+      detail: JSON.parse(readTextFileWithLimit(detailPath, OVEN_DETAIL_MAX_BYTES, "Oven detail template")),
+    });
+    const lineagePath = join(ovenRoot, "oven.json");
+    let forkedFrom;
+    if (safeStat(lineagePath)?.isFile()) {
+      try {
+        forkedFrom = normalizeOvenForkedFrom(
+          JSON.parse(readTextFileWithLimit(lineagePath, OVEN_LINEAGE_MAX_BYTES, "Oven lineage sidecar")),
+        ).forkedFrom;
+      } catch (error) {
+        throw new Error(`Oven ${safeId} lineage sidecar is invalid: ${error.message}`);
+      }
+    }
+    return {
+      id: ovenPackage.id,
+      name: instructionsName(ovenPackage.instructions, safeId),
+      description: instructionsDescription(ovenPackage.instructions),
+      builtIn,
+      instructions: ovenPackage.instructions,
+      detail: ovenPackage.detail,
+      ovenRevision: ovenRevision(ovenPackage),
+      ...(forkedFrom ? { forkedFrom } : {}),
+    };
+  } catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throw error;
+  }
 }
 
-function ovensIn(root, builtIn) {
-  if (!safeStat(root)?.isDirectory()) return [];
-  return readdirSync(root)
-    .filter((id) => /^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(id))
-    .map((id) => readOven(root, id, builtIn))
+function ovensIn(root, builtIn, customRepoRoot = umbrellaRoot) {
+  if (!builtIn) assertCustomOvensDir(customRepoRoot, root, { unsafe: unsafeOvensDir });
+  let entries;
+  try {
+    entries = readdirSync(root, { withFileTypes: true });
+  } catch (error) {
+    if (error?.code === "ENOENT") return [];
+    throw error;
+  }
+  return entries
+    .map((entry) => entry.name)
+    .filter((id) => !id.startsWith(".") && /^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(id))
+    .map((id) => {
+      try {
+        return readOven(root, id, builtIn, customRepoRoot);
+      } catch (error) {
+        console.warn(`Ignoring malformed Oven ${id}: ${error.message}`);
+        return null;
+      }
+    })
     .filter(Boolean);
 }
 
 function discoverOvens() {
-  const byId = new Map();
-  for (const oven of ovensIn(builtInOvensDir, true)) byId.set(oven.id, oven);
-  for (const oven of ovensIn(customOvensDir, false)) {
-    if (!byId.get(oven.id)?.builtIn) byId.set(oven.id, oven);
+  const ovens = ovensIn(builtInOvensDir, true).map((oven) => ({ ...oven, repoKey: null, repoRoot: null }));
+  for (const repo of ovenScopeRepos()) {
+    const customOvensDir = customOvensDirFor(repo.root);
+    for (const oven of ovensIn(customOvensDir, false, repo.root)) {
+      ovens.push({ ...oven, repoKey: repo.repoKey, repoRoot: repo.root });
+    }
   }
-  return [...byId.values()].sort((left, right) => Number(right.builtIn) - Number(left.builtIn) || left.name.localeCompare(right.name));
+  return ovens.sort((left, right) => Number(right.builtIn) - Number(left.builtIn)
+    || left.name.localeCompare(right.name) || String(left.repoKey).localeCompare(String(right.repoKey)));
+}
+
+function customOvensDirFor(repoRoot) {
+  return resolve(repoRoot) === launchRepoRoot ? launchCustomOvensDir : containedJoin(repoRoot, "ovens");
+}
+
+function selectedRepoKey(url) {
+  const repoKeys = url.searchParams.getAll("repoKey");
+  if (repoKeys.length > 1) throw Object.assign(new Error("repoKey must be supplied at most once"), { status: 400 });
+  return repoKeys[0] ?? null;
+}
+
+function findOven(id, selectedKey = null) {
+  const safeId = ovenId(id);
+  // Built-ins are global: resolve them by id regardless of repoKey (repoKey only selects a repo's
+  // DATA binding, not the oven's identity). Custom ovens are identified by (repoKey, id).
+  const builtin = readOven(builtInOvensDir, safeId, true);
+  if (builtin) return { ...builtin, repoKey: null, repoRoot: null };
+  if (selectedKey === null) return null;
+  const repo = ovenScopeRepos().find((entry) => entry.repoKey === selectedKey);
+  const oven = repo ? readOven(customOvensDirFor(repo.root), safeId, false, repo.root) : null;
+  return oven ? { ...oven, repoKey: repo.repoKey, repoRoot: repo.root } : null;
 }
 
 function ovenSummary(oven) {
@@ -610,6 +507,9 @@ function ovenSummary(oven) {
     name: oven.name,
     description: oven.description,
     builtIn: oven.builtIn,
+    repoKey: oven.repoKey,
+    ovenRevision: oven.ovenRevision,
+    ...(oven.forkedFrom ? { forkedFrom: oven.forkedFrom } : {}),
     detail: {
       columns: oven.detail.columns,
       rows: oven.detail.rows,
@@ -618,46 +518,59 @@ function ovenSummary(oven) {
   };
 }
 
-function atomicDirectory(parent, id, files) {
-  mkdirSync(parent, { recursive: true });
-  const target = join(parent, id);
-  if (existsSync(target)) throw new Error(`${id} already exists.`);
-  const temporary = join(parent, `.${id}.${randomBytes(6).toString("hex")}`);
-  mkdirSync(temporary);
-  try {
-    for (const [name, contents] of Object.entries(files)) writeFileSync(join(temporary, name), contents);
-    renameSync(temporary, target);
-  } catch (error) {
-    rmSync(temporary, { recursive: true, force: true });
-    throw error;
-  }
-  return target;
+function assertOvenInput(value) {
+  assertKnownKeys(value, new Set(["id", "name", "instructions", "detail"]), "Oven");
 }
 
 function createOven(value) {
-  assertKnownKeys(value, new Set(["id", "name", "instructions", "detail"]), "Oven");
-  const id = ovenId(value.id);
-  if (discoverOvens().some((oven) => oven.id === id)) throw new Error(`Oven ${id} already exists.`);
-  const name = boundedText(value.name, "Oven name", 80);
-  let instructions = boundedText(value.instructions, "Markdown instructions", 65536);
+  const { repoKey: targetRepoKey, repoRoot: targetRepoRoot, ...ovenValue } = value;
+  assertOvenInput(ovenValue);
+  const hasRepoKey = targetRepoKey !== undefined;
+  const hasRepoRoot = targetRepoRoot !== undefined;
+  if (hasRepoKey && hasRepoRoot) throw new Error("Specify repoKey or repoRoot, not both.");
+  const repo = hasRepoKey
+    ? ovenScopeRepos().find((entry) => entry.repoKey === boundedText(targetRepoKey, "Repository key", 64))
+    : hasRepoRoot
+      ? ovenScopeRepos().find((entry) => entry.root === resolve(boundedText(targetRepoRoot, "Repository", 4096)))
+      : { root: launchRepoRoot, repoKey: repoKey(launchRepoRoot) };
+  if (!repo) throw new Error("Repository must be one of the dashboard scan roots.");
+  const customOvensDir = customOvensDirFor(repo.root);
+  const id = ovenId(ovenValue.id);
+  if (readOven(builtInOvensDir, id, true) || readOven(customOvensDir, id, false, repo.root)) {
+    throw new Error(`Oven ${id} already exists.`);
+  }
+  const name = boundedText(ovenValue.name, "Oven name", 80);
+  let instructions = boundedText(ovenValue.instructions, "Markdown instructions", 65536);
   const instructionLines = instructions.split(/\r?\n/u);
   const titleLine = instructionLines.findIndex((line) => /^#\s+\S/u.test(line.trim()));
   if (titleLine === -1) instructionLines.unshift(`# ${name}`, "");
   else instructionLines[titleLine] = `# ${name}`;
   instructions = instructionLines.join("\n");
-  const detail = normalizeOvenDetail(value.detail);
+  const detail = normalizeOvenDetail(ovenValue.detail);
   const ovenPackage = normalizeOvenPackage({ id, instructions, detail });
-  const path = atomicDirectory(customOvensDir, id, {
-    "instructions.md": `${ovenPackage.instructions}\n`,
-    "detail.json": `${JSON.stringify(ovenPackage.detail, null, 2)}\n`,
-  });
-  return { ...readOven(customOvensDir, id, false), path };
+  const files = serializeOvenPackage(ovenPackage);
+  assertCustomOvenPath(repo.root, customOvensDir, id, { unsafe: unsafeOvensDir });
+  assertGitIgnored(repo.root, customOvensDir);
+  const path = withOvenPackageLock(customOvensDir, id, () => atomicOvenPackage(customOvensDir, id, files, {
+    assertPath: () => {
+      assertCustomOvenPath(repo.root, customOvensDir, id, { unsafe: unsafeOvensDir });
+      assertGitIgnored(repo.root, customOvensDir);
+    },
+  }));
+  return { ...readOven(customOvensDir, id, false, repo.root), repoKey: repo.repoKey, repoRoot: repo.root, path };
 }
 
 function discoveredRepos() {
   return candidateRepoRoots().map((root) => ({ name: basename(root), root, repoKey: repoKey(realpathSync(root)) }));
 }
 
+function ovenScopeRepos() {
+  const repos = new Map(discoveredRepos().map((repo) => [repo.repoKey, repo]));
+  const launchRepo = { name: basename(launchRepoRoot), root: launchRepoRoot, repoKey: repoKey(launchRepoRoot) };
+  if (!repos.has(launchRepo.repoKey)) repos.set(launchRepo.repoKey, launchRepo);
+  return [...repos.values()];
+}
+
 function repoMapSelection(url) {
   const queryKeys = [...url.searchParams.keys()];
   if (queryKeys.some((key) => key !== "repo" && key !== "repoKey")) {
@@ -692,22 +605,35 @@ function runId(date = new Date()) {
   ].join("");
 }
 
+function assertSnapshotSize(contents, maxBytes, label) {
+  const bytes = Buffer.byteLength(contents);
+  if (bytes > maxBytes) throw new Error(`${label} snapshot exceeds ${maxBytes} bytes.`);
+}
+
 function createBurnRun(value) {
-  assertKnownKeys(value, new Set(["ovenId", "repoRoot", "title", "objective"]), "Burn run");
+  assertKnownKeys(value, new Set(["ovenId", "ovenRepoKey", "repoRoot", "title", "objective"]), "Burn run");
   const selectedOvenId = ovenId(value.ovenId);
-  const oven = discoverOvens().find((entry) => entry.id === selectedOvenId);
-  if (!oven) throw new Error(`Unknown oven ${selectedOvenId}.`);
+  if (!Object.hasOwn(value, "ovenRepoKey") || (value.ovenRepoKey !== null && typeof value.ovenRepoKey !== "string")) {
+    throw new Error("Burn run ovenRepoKey must be null or a repository key.");
+  }
+  const selectedOvenRepoKey = value.ovenRepoKey === null
+    ? null
+    : boundedText(value.ovenRepoKey, "Oven repository key", 64);
   const requestedRoot = resolve(boundedText(value.repoRoot, "Repository", 4096));
-  const repo = discoveredRepos().find((entry) => entry.root === requestedRoot);
+  const repo = ovenScopeRepos().find((entry) => entry.root === requestedRoot);
   if (!repo) throw new Error("Repository must be one of the dashboard scan roots.");
+  const oven = findOven(selectedOvenId, selectedOvenRepoKey);
+  if (!oven) throw new Error(`Unknown oven ${selectedOvenId}.`);
   const title = boundedText(value.title, "Run title", 120);
   const objective = boundedText(value.objective, "Run objective", 12000);
   const id = runId();
   const createdAt = new Date().toISOString();
   const record = {
-    schemaVersion: 3,
+    schemaVersion: 4,
     id,
     ovenId: selectedOvenId,
+    ovenRepoKey: selectedOvenRepoKey,
+    ovenRevision: oven.ovenRevision,
     repoRoot: repo.root,
     repo: repo.name,
     title,
@@ -718,10 +644,14 @@ function createBurnRun(value) {
     summary: {},
     sections: [],
   };
+  const instructionsSnapshot = `${oven.instructions.trim()}\n`;
+  const detailSnapshot = `${JSON.stringify(oven.detail, null, 2)}\n`;
+  assertSnapshotSize(instructionsSnapshot, RUN_SNAPSHOT_INSTRUCTIONS_MAX_BYTES, "Run Oven instructions");
+  assertSnapshotSize(detailSnapshot, RUN_SNAPSHOT_DETAIL_MAX_BYTES, "Run Oven detail template");
   const files = {
     "run.json": `${JSON.stringify(record, null, 2)}\n`,
-    "instructions.md": `${oven.instructions.trim()}\n`,
-    "detail.json": `${JSON.stringify(oven.detail, null, 2)}\n`,
+    "instructions.md": instructionsSnapshot,
+    "detail.json": detailSnapshot,
   };
   const path = withRepoStateLock(repo.root, () => {
     if (legacyRunsDir) return atomicDirectory(legacyRunsDir, id, files);
@@ -745,6 +675,8 @@ function readBurnRun(id) {
       "schemaVersion",
       "id",
       "ovenId",
+      "ovenRepoKey",
+      "ovenRevision",
       "repoRoot",
       "repo",
       "title",
@@ -756,7 +688,30 @@ function readBurnRun(id) {
       "sections",
     ]), "Burn run");
     ovenId(record.ovenId);
-    return record;
+    if (![3, 4].includes(record.schemaVersion)) {
+      throw new Error("Burn run schemaVersion must be 3 or 4.");
+    }
+    const runRoot = dirname(path);
+    const ovenPackage = normalizeOvenPackage({
+      id: record.ovenId,
+      instructions: readTextFileWithLimit(join(runRoot, "instructions.md"), RUN_SNAPSHOT_INSTRUCTIONS_MAX_BYTES, "Run Oven instructions"),
+      detail: JSON.parse(readTextFileWithLimit(join(runRoot, "detail.json"), RUN_SNAPSHOT_DETAIL_MAX_BYTES, "Run Oven detail template")),
+    });
+    const snapshotRevision = ovenRevision(ovenPackage);
+    if (record.schemaVersion === 4) {
+      if (Object.hasOwn(record, "ovenRepoKey") && record.ovenRepoKey !== null && typeof record.ovenRepoKey !== "string") {
+        throw new Error("Burn run ovenRepoKey must be null or a repository key.");
+      }
+      const ovenRevisionValue = boundedText(record.ovenRevision, "Burn run ovenRevision", 74);
+      if (!/^o1-sha256:[a-f0-9]{64}$/u.test(ovenRevisionValue)) {
+        throw new Error("Burn run ovenRevision must be an o1-sha256 digest.");
+      }
+      if (ovenRevisionValue !== snapshotRevision) {
+        throw new Error(`Burn run ${safeId} revision does not match its snapshot.`);
+      }
+      return record;
+    }
+    return { ...record, ovenRevision: snapshotRevision };
   }
   return null;
 }
@@ -1099,12 +1054,12 @@ const server = createServer(async (req, res) => {
     }
     if (url.pathname === "/api/projects") {
       if (method !== "GET") return json(res, 405, { error: "method not allowed" });
-      json(res, 200, projectsSnapshot());
+      json(res, 200, projectsSnapshot(resolvedOvenDataBindings()));
       return;
     }
     if (url.pathname === "/api/burnlists") {
       if (method !== "GET") return json(res, 405, { error: "method not allowed" });
-      json(res, 200, { generatedAt: new Date().toISOString(), burnlists: dashboardEntries() });
+      json(res, 200, { generatedAt: new Date().toISOString(), burnlists: dashboardEntries(resolvedOvenDataBindings()) });
       return;
     }
     if (url.pathname === "/api/progress") {
@@ -1137,7 +1092,7 @@ const server = createServer(async (req, res) => {
     const ovenRoute = url.pathname.match(/^\/api\/ovens\/([a-z0-9]+(?:-[a-z0-9]+)*)$/u);
     if (ovenRoute) {
       if (method !== "GET") return json(res, 405, { error: "method not allowed" });
-      const oven = discoverOvens().find((entry) => entry.id === ovenRoute[1]);
+      const oven = findOven(ovenRoute[1], selectedRepoKey(url));
       if (!oven) return json(res, 404, { error: "oven not found" });
       json(res, 200, { oven });
       return;
@@ -1146,33 +1101,17 @@ const server = createServer(async (req, res) => {
     if (ovenDataRoute) {
       if (method !== "GET") return json(res, 405, { error: "method not allowed" });
       const id = ovenDataRoute[1];
-      const path = ovenDataBindings.get(id);
-      if (!path) return json(res, 404, { error: `no data binding configured for Oven ${id}` });
+      const requestedRepoKey = selectedRepoKey(url);
+      const oven = findOven(id, requestedRepoKey);
+      const handler = oven?.builtIn || !oven ? getOvenHandler(id) : null;
+      const ovenDataBindings = resolvedOvenDataBindings();
+      const binding = selectedOvenDataBinding(ovenDataBindings, id, url);
+      if (!handler && !oven) return json(res, 404, { validated: false, error: `Oven ${id} is not available` });
+      if (!binding) return json(res, 404, { error: `no data binding configured for Oven ${id}` });
       try {
-        if (id === "differential-testing") {
-          const index = differentialTestingIndexCache(path);
-          const requestedScenarioIds = url.searchParams.getAll("scenario");
-          if (requestedScenarioIds.length > 1) return json(res, 400, { error: "scenario must be supplied at most once" });
-          const requestedScenarioId = requestedScenarioIds[0] ?? "";
-          if (!requestedScenarioId || requestedScenarioId === index.selectedScenarioId) {
-            const selected = index.kind === "bundle" && index.selectedScenarioId
-              ? differentialTestingBundleResponse(index, index.selectedScenarioId, url.searchParams)
-              : index;
-            sendDifferentialTestingData(req, res, selected);
-            return;
-          }
-          if (!/^[a-f0-9]{16}$/u.test(requestedScenarioId)) return json(res, 400, { error: "scenario must be a lowercase 16-character hexadecimal id" });
-          if (!index.scenarios.some((scenario) => scenario.id === requestedScenarioId)) return json(res, 404, { error: `scenario ${requestedScenarioId} is not in the published catalog` });
-          const selected = index.kind === "bundle"
-            ? differentialTestingBundleResponse(index, requestedScenarioId, url.searchParams)
-            : differentialTestingScenarioCache(index, requestedScenarioId);
-          sendDifferentialTestingData(req, res, selected);
-          return;
-        }
-        const readPath = path;
-        if (!safeStat(readPath)?.isFile()) return json(res, 404, { error: `configured data for Oven ${id} is missing` });
-        const indexPayload = JSON.parse(readTextFileWithLimit(readPath, maxOvenDataBytes, `Oven ${id} data`));
-        json(res, 200, { ovenId: id, path: readPath, payload: indexPayload });
+        const active = handler ?? genericJsonHandler;
+        const response = active.serveData?.(ovenHandlerContext({ id, oven, req, res, url, bindingPath: binding.path, ovenDataBindings }));
+        if (response !== undefined) json(res, 200, response);
       } catch (error) {
         json(res, Number.isInteger(error.status) ? error.status : 422, {
           error: error instanceof SyntaxError ? `Oven ${id} data is not valid JSON: ${error.message}` : error.message,
@@ -1194,7 +1133,7 @@ const server = createServer(async (req, res) => {
     }
     if (url.pathname === "/api/repos") {
       if (method !== "GET") return json(res, 405, { error: "method not allowed" });
-      json(res, 200, { repos: discoveredRepos() });
+      json(res, 200, { repos: ovenScopeRepos() });
       return;
     }
     if (url.pathname === "/api/runs") {
@@ -1212,7 +1151,9 @@ const server = createServer(async (req, res) => {
       json(res, 200, { run });
       return;
     }
-    if (["/", "/index.html", "/ovens/new", "/ovens/differential-testing/view", "/runs/new"].includes(url.pathname) || routeSelection(url)) {
+    const ovenViewRoute = url.pathname.match(/^\/ovens\/([a-z0-9]+(?:-[a-z0-9]+)*)\/view$/u);
+    const isKnownOvenView = Boolean(ovenViewRoute && findOven(ovenViewRoute[1], selectedRepoKey(url)));
+    if (["/", "/index.html", "/ovens/new", "/runs/new"].includes(url.pathname) || isKnownOvenView || routeSelection(url)) {
       if (method !== "GET") return json(res, 405, { error: "method not allowed" });
       serveDashboardShell(res);
       return;
@@ -1253,10 +1194,19 @@ function listen(port) {
   });
 }
 
-if (!reportMode && ovenDataBindings.has("differential-testing")) {
-  warmDifferentialTestingData();
-  const differentialTestingWarmTimer = setInterval(warmDifferentialTestingData, 1_000);
-  differentialTestingWarmTimer.unref();
+if (!reportMode) {
+  for (const handler of listOvenHandlers()) {
+    if (typeof handler.warm !== "function" || !handler.warmIntervalMs) continue;
+    if (!handler.id) continue;
+    const warm = () => warmOvenHandler(
+      handler,
+      resolvedOvenDataBindings,
+      (context) => ovenHandlerContext(context),
+    );
+    warm();
+    const warmTimer = setInterval(warm, handler.warmIntervalMs);
+    warmTimer.unref();
+  }
 }
 
 listen(initialPort);
diff --git a/src/server/burnlist-discovery.mjs b/src/server/burnlist-discovery.mjs
new file mode 100644
index 0000000..63044c6
--- /dev/null
+++ b/src/server/burnlist-discovery.mjs
@@ -0,0 +1,36 @@
+import { readdirSync } from "node:fs";
+import { join } from "node:path";
+import { safeStat } from "./fs-safe.mjs";
+import { LIFECYCLES, summaryForPlan } from "./plan-model.mjs";
+
+// Discovery is deliberately best-effort: a broken lifecycle directory or plan
+// must not make every other repository disappear from the observer dashboard.
+export function discoverBurnlistSummaries({
+  repoRoots, maxPlanBytes, lifecycles = LIFECYCLES, summaryForPlan: summarize = summaryForPlan,
+} = {}) {
+  const entries = [];
+  for (const repoRoot of repoRoots ?? []) {
+    for (const lifecycle of lifecycles) {
+      const lifecycleRoot = join(repoRoot, "notes", "burnlists", lifecycle.folder);
+      if (!safeStat(lifecycleRoot)?.isDirectory()) continue;
+      let ids;
+      try {
+        ids = readdirSync(lifecycleRoot);
+      } catch {
+        continue;
+      }
+      for (const id of ids) {
+        if (id.startsWith(".")) continue;
+        const planPath = join(lifecycleRoot, id, "burnlist.md");
+        if (!safeStat(planPath)?.isFile()) continue;
+        try {
+          entries.push(summarize(planPath, maxPlanBytes));
+        } catch {
+          // summaryForPlan normally turns malformed plans into blocked rows. This
+          // final guard also keeps an unexpected per-plan filesystem failure local.
+        }
+      }
+    }
+  }
+  return entries.sort((left, right) => left.planPath.localeCompare(right.planPath));
+}
diff --git a/src/server/burnlist-discovery.test.mjs b/src/server/burnlist-discovery.test.mjs
new file mode 100644
index 0000000..fc07520
--- /dev/null
+++ b/src/server/burnlist-discovery.test.mjs
@@ -0,0 +1,37 @@
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { discoverBurnlistSummaries } from "./burnlist-discovery.mjs";
+
+function validPlan(title) {
+  return `# ${title}\n\n## Active Checklist\n\n- [ ] ISO-01 | Keep discovery isolated\n\n## Completed\n`;
+}
+
+test("Burnlist discovery keeps later healthy plans when one summary throws", () => {
+  const root = mkdtempSync(join(tmpdir(), "burnlist-discovery-"));
+  try {
+    const lifecycle = join(root, "notes", "burnlists", "inprogress");
+    mkdirSync(join(lifecycle, "a-broken"), { recursive: true });
+    mkdirSync(join(lifecycle, "z-healthy"), { recursive: true });
+    writeFileSync(join(lifecycle, "a-broken", "burnlist.md"), validPlan("Broken"));
+    writeFileSync(join(lifecycle, "z-healthy", "burnlist.md"), validPlan("Healthy"));
+    let forcedFailure = false;
+    const summaries = discoverBurnlistSummaries({
+      repoRoots: [root],
+      maxPlanBytes: 1024,
+      summaryForPlan: (planPath) => {
+        if (planPath.includes("a-broken")) {
+          forcedFailure = true;
+          throw new Error("forced summary failure");
+        }
+        return { id: "z-healthy", planPath };
+      },
+    });
+    assert.equal(forcedFailure, true);
+    assert.deepEqual(summaries.map((entry) => entry.id), ["z-healthy"]);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
diff --git a/src/server/dashboard-entry-isolation.mjs b/src/server/dashboard-entry-isolation.mjs
new file mode 100644
index 0000000..941b2ac
--- /dev/null
+++ b/src/server/dashboard-entry-isolation.mjs
@@ -0,0 +1,100 @@
+import { ovenId } from "../ovens/oven-contract.mjs";
+
+const blockedRowPrefix = "\u0000blocked:";
+
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function requiredText(value, field) {
+  if (typeof value !== "string" || !value.trim()) throw new Error(`Dashboard row ${field} must be a non-empty string.`);
+  return value;
+}
+
+function dashboardRowId(value) {
+  const id = requiredText(value, "id");
+  if (id.startsWith(blockedRowPrefix)) throw new Error("Dashboard row id uses a reserved blocked-row prefix.");
+  return id;
+}
+
+function nullableText(value, field) {
+  if (value == null) return null;
+  if (typeof value !== "string") throw new Error(`Dashboard row ${field} must be a string or null.`);
+  return value;
+}
+
+function nullableRequiredText(value, field) {
+  if (value == null) return null;
+  if (typeof value !== "string" || !value.trim()) throw new Error(`Dashboard row ${field} must be a non-empty string or null.`);
+  return value;
+}
+
+function count(value, field, { nullable = false } = {}) {
+  if (value == null && nullable) return null;
+  if (!Number.isInteger(value) || value < 0) throw new Error(`Dashboard row ${field} must be a non-negative integer${nullable ? " or null" : ""}.`);
+  return value;
+}
+
+function dashboardRow(row, repoKeyForRoot) {
+  if (!isRecord(row)) throw new Error("Dashboard handler returned a malformed row.");
+  const repoRoot = row.repoRoot == null ? null : requiredText(row.repoRoot, "repoRoot");
+  let key = row.repoKey == null ? null : requiredText(row.repoKey, "repoKey");
+  if (repoRoot) key = repoKeyForRoot(repoRoot);
+  return {
+    ...row,
+    id: dashboardRowId(row.id),
+    repo: requiredText(row.repo, "repo"),
+    repoKey: key,
+    repoRoot,
+    planPath: nullableRequiredText(row.planPath, "planPath"),
+    planLabel: nullableRequiredText(row.planLabel, "planLabel"),
+    title: requiredText(row.title, "title"),
+    status: requiredText(row.status, "status"),
+    statusLabel: requiredText(row.statusLabel, "statusLabel"),
+    total: count(row.total, "total"),
+    done: count(row.done, "done", { nullable: true }),
+    remaining: count(row.remaining, "remaining", { nullable: true }),
+    percent: count(row.percent, "percent", { nullable: true }),
+    errors: count(row.errors, "errors"),
+    warnings: count(row.warnings, "warnings"),
+    lastCompletedAt: nullableText(row.lastCompletedAt, "lastCompletedAt"),
+    updatedAt: nullableText(row.updatedAt, "updatedAt"),
+    ovenId: ovenId(row.ovenId),
+    ovenName: requiredText(row.ovenName, "ovenName"),
+    href: requiredText(row.href, "href"),
+    progressLabel: requiredText(row.progressLabel, "progressLabel"),
+    ...(row.blockers == null ? {} : { blockers: requiredText(row.blockers, "blockers") }),
+  };
+}
+
+function blockedRow(blockedEntry, handler, error, handlerIndex, rowIndex) {
+  return { ...blockedEntry(handler, error), id: `${blockedRowPrefix}${handlerIndex}:${rowIndex}` };
+}
+
+// A handler's call, row normalization, repo key derivation, and sorting share
+// isolation boundaries: no malformed adapter result can poison other rows or Ovens.
+export function isolatedDashboardEntries({ handlers, contextForHandler, repoKeyForRoot, blockedEntry }) {
+  const entries = [];
+  for (const [handlerIndex, handler] of handlers.entries()) {
+    let rows;
+    try {
+      rows = handler.dashboardEntries?.(contextForHandler(handler)) ?? [];
+      if (!Array.isArray(rows)) throw new Error("Dashboard handler must return an array of rows.");
+    } catch (error) {
+      entries.push(blockedRow(blockedEntry, handler, error, handlerIndex, -1));
+      continue;
+    }
+    const normalizedRows = [];
+    for (const [index, row] of rows.entries()) {
+      try {
+        normalizedRows.push(dashboardRow(row, repoKeyForRoot));
+      } catch (error) {
+        normalizedRows.push(blockedRow(blockedEntry, handler, error, handlerIndex, index));
+      }
+    }
+    entries.push(...normalizedRows.sort(
+      (left, right) => String(right.updatedAt ?? "").localeCompare(String(left.updatedAt ?? "")),
+    ));
+  }
+  return entries.sort((left, right) => String(right.updatedAt ?? "").localeCompare(String(left.updatedAt ?? "")));
+}
diff --git a/src/server/dashboard-entry-isolation.test.mjs b/src/server/dashboard-entry-isolation.test.mjs
new file mode 100644
index 0000000..a7547c2
--- /dev/null
+++ b/src/server/dashboard-entry-isolation.test.mjs
@@ -0,0 +1,60 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { isolatedDashboardEntries } from "./dashboard-entry-isolation.mjs";
+
+function validRow(id) {
+  return {
+    id, repo: "fixture", repoKey: null, repoRoot: null, planPath: null, planLabel: null, title: id,
+    status: "active", statusLabel: "Active", total: 1, done: 0, remaining: 1, percent: 0,
+    errors: 0, warnings: 0, lastCompletedAt: null, updatedAt: null, ovenId: id, ovenName: id,
+    href: "/", progressLabel: "0/1 done",
+  };
+}
+
+function blockedEntry(handler, error) {
+  return { ...validRow(`blocked-${handler.id}`), ovenId: handler.id, blockers: error.message };
+}
+
+test("dashboard row normalization isolates malformed rows without hiding their healthy siblings", () => {
+  const handlers = [
+    {
+      id: "mixed", dashboardEntries: () => [
+        { ...validRow("older"), updatedAt: "2026-01-01T00:00:00Z" },
+        null,
+        { ...validRow("newer"), updatedAt: "2026-01-03T00:00:00Z" },
+      ],
+    },
+    { id: "throws", dashboardEntries: () => { throw new Error("handler failed"); } },
+  ];
+  const entries = isolatedDashboardEntries({
+    handlers,
+    contextForHandler: () => ({}),
+    repoKeyForRoot: (root) => root,
+    blockedEntry,
+  });
+  assert.deepEqual(entries.map((entry) => entry.id), ["newer", "older", "\u0000blocked:0:1", "\u0000blocked:1:-1"]);
+  assert.equal(entries.find((entry) => entry.id === "\u0000blocked:0:1")?.blockers, "Dashboard handler returned a malformed row.");
+  assert.equal(entries.find((entry) => entry.id === "\u0000blocked:1:-1")?.blockers, "handler failed");
+});
+
+test("dashboard row normalization blocks a non-slug oven id", () => {
+  const entries = isolatedDashboardEntries({
+    handlers: [{ id: "contract", dashboardEntries: () => [{ ...validRow("valid"), ovenId: "Not a slug" }] }],
+    contextForHandler: () => ({}),
+    repoKeyForRoot: (root) => root,
+    blockedEntry,
+  });
+  assert.deepEqual(entries.map((entry) => entry.id), ["\u0000blocked:0:0"]);
+  assert.match(entries[0].blockers, /Oven id must be a lowercase slug/u);
+});
+
+test("blocked dashboard row ids cannot collide with valid handler row ids", () => {
+  const entries = isolatedDashboardEntries({
+    handlers: [{ id: "mixed", dashboardEntries: () => [validRow("blocked-mixed-1"), null] }],
+    contextForHandler: () => ({}),
+    repoKeyForRoot: (root) => root,
+    blockedEntry,
+  });
+  assert.deepEqual(entries.map((entry) => entry.id), ["blocked-mixed-1", "\u0000blocked:0:1"]);
+  assert.equal(new Set(entries.map((entry) => entry.id)).size, entries.length);
+});
diff --git a/src/server/dashboard-routes-fixtures.mjs b/src/server/dashboard-routes-fixtures.mjs
new file mode 100644
index 0000000..2626130
--- /dev/null
+++ b/src/server/dashboard-routes-fixtures.mjs
@@ -0,0 +1,250 @@
+import { spawn } from "node:child_process";
+import { existsSync, realpathSync } from "node:fs";
+import { createServer, get, request } from "node:http";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const scriptDirectory = dirname(fileURLToPath(import.meta.url));
+const serverPath = resolve(scriptDirectory, "burnlist-dashboard-server.mjs");
+async function withServer({
+  withBurnlist, burnlists, ovenData = [], ovens = [], runs = [], scanRoots,
+  launchCwd = ".", ovensRoot = ".", setup, serverArgs = [],
+}, callback) {
+  const fixtureRoot = await mkdtemp(join(tmpdir(), "burnlist-dashboard-routes-"));
+  const homeRoot = join(fixtureRoot, "home");
+  const fixtures = burnlists ?? (withBurnlist ? [{}] : []);
+  const planPaths = fixtures.map((fixture) => fixturePlanPath(fixtureRoot, fixture));
+  const rootPaths = scanRoots ?? (fixtures.length
+    ? fixtures.map((fixture) => fixture.repoPath ?? "fixture-repo")
+    : ["fixture-repo"]);
+  let child = null;
+  try {
+    await mkdir(homeRoot, { recursive: true });
+    await Promise.all(fixtures.map(async (fixture, index) => {
+      const planPath = planPaths[index];
+      await mkdir(dirname(planPath), { recursive: true });
+      await Promise.all([
+        writeFile(planPath, burnlistMarkdown(fixture.title ?? "Fixture Burnlist")),
+        writeFile(join(dirname(planPath), "goal.md"), "# Fixture Goal\n\n## Goal\n\nRoute behavior fixture.\n"),
+      ]);
+    }));
+    const writtenOvenData = await Promise.all(ovenData.map(async (entry, index) => {
+      const path = join(fixtureRoot, entry.repoPath ?? "", entry.fileName ?? `${entry.id}-${index}.json`);
+      await mkdir(dirname(path), { recursive: true });
+      await writeFile(path, JSON.stringify(entry.payload));
+      return { ...entry, path };
+    }));
+    const persistedBindings = new Map();
+    for (const entry of writtenOvenData.filter((candidate) => candidate.persisted)) {
+      const repoRoot = join(fixtureRoot, entry.repoPath);
+      const bindings = persistedBindings.get(repoRoot) ?? {};
+      bindings[entry.id] = { path: relative(repoRoot, entry.path), boundAt: "2026-07-14T12:00:00.000Z" };
+      persistedBindings.set(repoRoot, bindings);
+    }
+    await Promise.all([...persistedBindings].map(async ([repoRoot, bindings]) => {
+      const storePath = join(repoRoot, ".local", "burnlist", "bindings.json");
+      await mkdir(dirname(storePath), { recursive: true });
+      await writeFile(storePath, JSON.stringify({ schemaVersion: 1, bindings }));
+    }));
+    if (setup) await setup({ fixtureRoot, homeRoot });
+    await Promise.all(ovens.map((oven) => writeOvenFixture(join(fixtureRoot, oven.repoPath ?? ovensRoot), oven)));
+    await Promise.all(runs.map((run) => writeRunFixture(fixtureRoot, run)));
+    await mkdir(join(fixtureRoot, launchCwd), { recursive: true });
+    const port = await availablePort();
+    const ovenDataBindings = writtenOvenData
+      .filter((entry) => entry.override !== false)
+      .map((entry) => `${entry.id}=${entry.path}`).join(",");
+    child = spawn(process.execPath, [
+      serverPath,
+      "--port", String(port),
+      "--auto-port",
+      "--scan-root", rootPaths.map((path) => join(fixtureRoot, path)).join(","),
+      "--state-dir", join(fixtureRoot, "state"),
+      ...(ovenDataBindings ? ["--oven-data", ovenDataBindings] : []),
+      ...serverArgs,
+    ], {
+      cwd: join(fixtureRoot, launchCwd),
+      env: { ...process.env, HOME: homeRoot },
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    const baseUrl = await waitForServer(child);
+    // The server canonicalizes scan roots (macOS /var → /private/var), so hand back the realpath'd
+    // repo root; POST /api/runs requires the repoRoot to match a canonical scan root.
+    const rawRepoRoot = join(fixtureRoot, rootPaths[0]);
+    const repoRoot = existsSync(rawRepoRoot) ? realpathSync(rawRepoRoot) : rawRepoRoot;
+    return await callback({ baseUrl, planPath: planPaths[0], planPaths, repoRoot });
+  } finally {
+    await stopChild(child);
+    await rm(fixtureRoot, { recursive: true, force: true });
+  }
+}
+
+function fixturePlanPath(fixtureRoot, fixture) {
+  return join(
+    fixtureRoot,
+    fixture.repoPath ?? "fixture-repo",
+    "notes",
+    "burnlists",
+    fixture.lifecycle ?? "inprogress",
+    fixture.id ?? "fixture",
+    "burnlist.md",
+  );
+}
+
+function burnlistMarkdown(title) {
+  return [
+    `# ${title}`,
+    "",
+    "## Active Checklist",
+    "",
+    "- [ ] ROUTE-01 | Keep root on the list",
+    "  Files/search: dashboard",
+    "  Action: Keep list and detail routes distinct.",
+    "  Done/delete when: The route tests pass.",
+    "  Validate: Run the route characterization tests.",
+    "",
+    "## Completed",
+    "",
+  ].join("\n");
+}
+
+function detailFixture() {
+  return {
+    version: 1,
+    columns: 2,
+    rows: 2,
+    rowHeight: 48,
+    cells: [{
+      id: "summary",
+      title: "Summary",
+      description: "Current status.",
+      widget: "metric",
+      source: "/summary",
+      format: "plain",
+      column: 1,
+      row: 1,
+      columnSpan: 2,
+      rowSpan: 1,
+    }],
+  };
+}
+
+async function writeOvenFixture(root, fixture) {
+  const ovenRoot = join(root, ".local", "burnlist", "ovens", fixture.id);
+  await mkdir(ovenRoot, { recursive: true });
+  await Promise.all([
+    writeFile(join(ovenRoot, "instructions.md"), fixture.instructions ?? "# Fixture Oven\n\nFollow the checklist.\n"),
+    writeFile(join(ovenRoot, "detail.json"), JSON.stringify(fixture.detail ?? detailFixture())),
+    ...(fixture.ovenJson === undefined
+      ? []
+      : [writeFile(join(ovenRoot, "oven.json"), typeof fixture.ovenJson === "string" ? fixture.ovenJson : JSON.stringify(fixture.ovenJson))]),
+  ]);
+}
+
+async function writeRunFixture(fixtureRoot, fixture) {
+  const repoRoot = join(fixtureRoot, fixture.repoPath ?? "fixture-repo");
+  const runRoot = join(repoRoot, ".local", "burnlist", "runs", fixture.id);
+  const createdAt = "2026-07-14T12:00:00.000Z";
+  const record = {
+    schemaVersion: fixture.schemaVersion,
+    id: fixture.id,
+    ovenId: fixture.ovenId,
+    repoRoot,
+    repo: "fixture-repo",
+    title: "Fixture run",
+    status: "requested",
+    createdAt,
+    updatedAt: createdAt,
+    inputs: { objective: "Exercise run reads." },
+    summary: {},
+    sections: [],
+    ...(fixture.ovenRevision ? { ovenRevision: fixture.ovenRevision } : {}),
+  };
+  // The repo must be discoverable (repoRoot() requires notes/burnlists) for readBurnRun to search it.
+  await mkdir(join(repoRoot, "notes", "burnlists", "inprogress"), { recursive: true });
+  await mkdir(runRoot, { recursive: true });
+  await Promise.all([
+    writeFile(join(runRoot, "run.json"), JSON.stringify(record)),
+    writeFile(join(runRoot, "instructions.md"), fixture.instructionsSnapshot ?? fixture.instructions),
+    writeFile(join(runRoot, "detail.json"), fixture.detailSnapshot ?? JSON.stringify(fixture.detail)),
+  ]);
+}
+
+function httpGet(baseUrl, path) {
+  return new Promise((resolveResponse, reject) => {
+    const request = get(new URL(path, baseUrl), (response) => {
+      const chunks = [];
+      response.setEncoding("utf8");
+      response.on("data", (chunk) => chunks.push(chunk));
+      response.on("end", () => resolveResponse({
+        status: response.statusCode,
+        body: chunks.join(""),
+      }));
+    });
+    request.once("error", reject);
+  });
+}
+
+function httpRequest(baseUrl, path, { method, headers, body }) {
+  return new Promise((resolveResponse, reject) => {
+    const req = request(new URL(path, baseUrl), { method, headers }, (response) => {
+      const chunks = [];
+      response.setEncoding("utf8");
+      response.on("data", (chunk) => chunks.push(chunk));
+      response.on("end", () => resolveResponse({ status: response.statusCode, body: chunks.join("") }));
+    });
+    req.once("error", reject);
+    req.end(body);
+  });
+}
+
+function availablePort() {
+  return new Promise((resolvePort, reject) => {
+    const probe = createServer();
+    probe.once("error", reject);
+    probe.listen(0, "127.0.0.1", () => {
+      const address = probe.address();
+      const port = typeof address === "object" && address ? address.port : null;
+      probe.close((error) => {
+        if (error) reject(error);
+        else if (!port) reject(new Error("Could not reserve a test port."));
+        else resolvePort(port);
+      });
+    });
+  });
+}
+
+function waitForServer(child) {
+  return new Promise((resolveReady, reject) => {
+    let output = "";
+    const timeout = setTimeout(() => reject(new Error(`Dashboard test server did not start: ${output}`)), 8_000);
+    child.stdout.on("data", (chunk) => {
+      output += chunk.toString();
+      const match = output.match(/http:\/\/127\.0\.0\.1:\d+\//u);
+      if (!match) return;
+      clearTimeout(timeout);
+      resolveReady(match[0]);
+    });
+    child.stderr.on("data", (chunk) => { output += chunk.toString(); });
+    child.once("exit", (code) => {
+      clearTimeout(timeout);
+      reject(new Error(`Dashboard test server exited with ${code}: ${output}`));
+    });
+  });
+}
+
+async function stopChild(child) {
+  if (!child || child.exitCode !== null) return;
+  child.kill("SIGTERM");
+  await new Promise((resolveExit) => {
+    const timeout = setTimeout(resolveExit, 2_000);
+    child.once("exit", () => {
+      clearTimeout(timeout);
+      resolveExit();
+    });
+  });
+}
+
+export { detailFixture, httpGet, httpRequest, withServer };
diff --git a/src/server/dashboard-routes.test.mjs b/src/server/dashboard-routes.test.mjs
index ed2e72d..3f6d2e1 100644
--- a/src/server/dashboard-routes.test.mjs
+++ b/src/server/dashboard-routes.test.mjs
@@ -1,18 +1,6 @@
 import assert from "node:assert/strict";
-import { spawn } from "node:child_process";
-import { createServer, get } from "node:http";
-import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
 import test from "node:test";
-
-const scriptDirectory = dirname(fileURLToPath(import.meta.url));
-const serverPath = resolve(scriptDirectory, "burnlist-dashboard-server.mjs");
-
-// Upstream serves the built dashboard app for shell routes and exposes read-only JSON APIs
-// (/api/progress, /api/burnlists). These tests characterize the JSON data routes our PR-1
-// discovery/selection changes touch (the server no longer renders a no-JS HTML fallback).
+import { httpGet, withServer } from "./dashboard-routes-fixtures.mjs";
 
 test("root serves the dashboard shell", { timeout: 20_000 }, async () => {
   await withServer({ withBurnlist: true }, async ({ baseUrl }) => {
@@ -71,136 +59,8 @@ test("/api/burnlists lists discovered Burnlists across the observer set", { time
     assert.equal(response.status, 200);
     const payload = JSON.parse(response.body);
     assert.equal(Array.isArray(payload.burnlists), true);
-    assert.equal(payload.burnlists.some((entry) => entry.id === "fixture"), true);
+    const entry = payload.burnlists.find((candidate) => candidate.id === "fixture");
+    assert.ok(entry);
+    assert.equal(typeof entry.planPath, "string");
   });
 });
-
-async function withServer({ withBurnlist, burnlists, scanRoots }, callback) {
-  const fixtureRoot = await mkdtemp(join(tmpdir(), "burnlist-dashboard-routes-"));
-  const homeRoot = join(fixtureRoot, "home");
-  const fixtures = burnlists ?? (withBurnlist ? [{}] : []);
-  const planPaths = fixtures.map((fixture) => fixturePlanPath(fixtureRoot, fixture));
-  const rootPaths = scanRoots ?? (fixtures.length
-    ? fixtures.map((fixture) => fixture.repoPath ?? "fixture-repo")
-    : ["fixture-repo"]);
-  let child = null;
-  try {
-    await mkdir(homeRoot, { recursive: true });
-    await Promise.all(fixtures.map(async (fixture, index) => {
-      const planPath = planPaths[index];
-      await mkdir(dirname(planPath), { recursive: true });
-      await Promise.all([
-        writeFile(planPath, burnlistMarkdown(fixture.title ?? "Fixture Burnlist")),
-        writeFile(join(dirname(planPath), "goal.md"), "# Fixture Goal\n\n## Goal\n\nRoute behavior fixture.\n"),
-      ]);
-    }));
-    const port = await availablePort();
-    child = spawn(process.execPath, [
-      serverPath,
-      "--port", String(port),
-      "--auto-port",
-      "--scan-root", rootPaths.map((path) => join(fixtureRoot, path)).join(","),
-      "--state-dir", join(fixtureRoot, "state"),
-    ], {
-      cwd: fixtureRoot,
-      env: { ...process.env, HOME: homeRoot },
-      stdio: ["ignore", "pipe", "pipe"],
-    });
-    const baseUrl = await waitForServer(child);
-    return await callback({ baseUrl, planPath: planPaths[0], planPaths });
-  } finally {
-    await stopChild(child);
-    await rm(fixtureRoot, { recursive: true, force: true });
-  }
-}
-
-function fixturePlanPath(fixtureRoot, fixture) {
-  return join(
-    fixtureRoot,
-    fixture.repoPath ?? "fixture-repo",
-    "notes",
-    "burnlists",
-    fixture.lifecycle ?? "inprogress",
-    fixture.id ?? "fixture",
-    "burnlist.md",
-  );
-}
-
-function burnlistMarkdown(title) {
-  return [
-    `# ${title}`,
-    "",
-    "## Active Checklist",
-    "",
-    "- [ ] ROUTE-01 | Keep root on the list",
-    "  Files/search: dashboard",
-    "  Action: Keep list and detail routes distinct.",
-    "  Done/delete when: The route tests pass.",
-    "  Validate: Run the route characterization tests.",
-    "",
-    "## Completed",
-    "",
-  ].join("\n");
-}
-
-function httpGet(baseUrl, path) {
-  return new Promise((resolveResponse, reject) => {
-    const request = get(new URL(path, baseUrl), (response) => {
-      const chunks = [];
-      response.setEncoding("utf8");
-      response.on("data", (chunk) => chunks.push(chunk));
-      response.on("end", () => resolveResponse({
-        status: response.statusCode,
-        body: chunks.join(""),
-      }));
-    });
-    request.once("error", reject);
-  });
-}
-
-function availablePort() {
-  return new Promise((resolvePort, reject) => {
-    const probe = createServer();
-    probe.once("error", reject);
-    probe.listen(0, "127.0.0.1", () => {
-      const address = probe.address();
-      const port = typeof address === "object" && address ? address.port : null;
-      probe.close((error) => {
-        if (error) reject(error);
-        else if (!port) reject(new Error("Could not reserve a test port."));
-        else resolvePort(port);
-      });
-    });
-  });
-}
-
-function waitForServer(child) {
-  return new Promise((resolveReady, reject) => {
-    let output = "";
-    const timeout = setTimeout(() => reject(new Error(`Dashboard test server did not start: ${output}`)), 8_000);
-    child.stdout.on("data", (chunk) => {
-      output += chunk.toString();
-      const match = output.match(/http:\/\/127\.0\.0\.1:\d+\//u);
-      if (!match) return;
-      clearTimeout(timeout);
-      resolveReady(match[0]);
-    });
-    child.stderr.on("data", (chunk) => { output += chunk.toString(); });
-    child.once("exit", (code) => {
-      clearTimeout(timeout);
-      reject(new Error(`Dashboard test server exited with ${code}: ${output}`));
-    });
-  });
-}
-
-async function stopChild(child) {
-  if (!child || child.exitCode !== null) return;
-  child.kill("SIGTERM");
-  await new Promise((resolveExit) => {
-    const timeout = setTimeout(resolveExit, 2_000);
-    child.once("exit", () => {
-      clearTimeout(timeout);
-      resolveExit();
-    });
-  });
-}
diff --git a/src/server/fs-safe.mjs b/src/server/fs-safe.mjs
index 129acee..d6aa03a 100644
--- a/src/server/fs-safe.mjs
+++ b/src/server/fs-safe.mjs
@@ -1,6 +1,9 @@
 import { randomBytes } from "node:crypto";
-import { mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { cpSync, existsSync, linkSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmdirSync, rmSync, statSync, utimesSync, writeFileSync } from "node:fs";
+import { basename, join } from "node:path";
+import { assertOvenPackageFileLimits } from "./oven-storage.mjs";
+
+export const OVEN_REV_GRACE_MS = 60_000;
 
 export function readTextFileWithLimit(path, maxBytes, label) {
   const stat = statSync(path);
@@ -16,19 +19,328 @@ export function safeStat(path) {
   }
 }
 
-export function atomicDirectory(parent, id, files) {
+function isPositivePid(pid) {
+  return Number.isInteger(pid) && pid > 0;
+}
+
+function readLock(lockPath) {
+  try {
+    return JSON.parse(readFileSync(lockPath, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function lockOwner(lockPath) {
+  const owner = readLock(lockPath);
+  return isPositivePid(owner?.pid) && typeof owner.token === "string" && owner.token ? owner : null;
+}
+
+function pidIsDead(pid) {
+  if (!isPositivePid(pid)) return false;
+  try {
+    process.kill(pid, 0);
+    return false;
+  } catch (error) {
+    return error?.code === "ESRCH";
+  }
+}
+
+export function withLock(dir, fn) {
+  let lockedDir = dir;
+  const token = randomBytes(16).toString("hex");
+  const lockPath = join(lockedDir, ".lock");
+  const temporary = join(lockedDir, `.lock.${token}.tmp`);
+  const busy = () => Object.assign(new Error(`${basename(dir)} is busy (locked)`), { code: "ELOCKED" });
+  try {
+    writeFileSync(temporary, JSON.stringify({ token, pid: process.pid }));
+    try {
+      linkSync(temporary, lockPath);
+    } catch (error) {
+      if (error?.code !== "EEXIST") throw error;
+      const owner = lockOwner(lockPath);
+      if (!owner || !pidIsDead(owner.pid)) throw busy();
+      const claim = `${lockPath}.claim.${token}`;
+      try {
+        renameSync(lockPath, claim);
+      } catch (takeoverError) {
+        if (takeoverError?.code === "ENOENT") throw busy();
+        throw takeoverError;
+      }
+      try {
+        rmSync(claim, { force: true });
+        linkSync(temporary, lockPath);
+      } catch (takeoverError) {
+        if (takeoverError?.code === "EEXIST") throw busy();
+        throw takeoverError;
+      }
+    }
+  } finally {
+    rmSync(temporary, { force: true });
+  }
+  try {
+    const movedDir = fn({
+      retarget(movedDir) {
+        if (typeof movedDir === "string") lockedDir = movedDir;
+      },
+    });
+    if (typeof movedDir === "string") lockedDir = movedDir;
+    return movedDir;
+  } finally {
+    const finalLockPath = join(lockedDir, ".lock");
+    if (readLock(finalLockPath)?.token === token) rmSync(finalLockPath, { force: true });
+  }
+}
+
+export function ovenPackageLockRoot(root) {
+  return join(root, ".oven-locks");
+}
+
+function removeEmptyDirectory(path) {
+  try {
+    rmdirSync(path);
+  } catch (error) {
+    if (!["ENOENT", "ENOTEMPTY"].includes(error?.code)) throw error;
+  }
+}
+
+export function withOvenPackageLock(root, id, fn, { wait = false } = {}) {
+  const lockRoot = ovenPackageLockRoot(root);
+  const lockDir = join(lockRoot, id);
+  mkdirSync(lockDir, { recursive: true });
+  try {
+    for (let attempt = 0; attempt < 300; attempt += 1) {
+      try {
+        let result;
+        withLock(lockDir, () => { result = fn(); });
+        return result;
+      } catch (error) {
+        if (error?.code === "ENOENT" && attempt < 299) {
+          mkdirSync(lockDir, { recursive: true });
+          continue;
+        }
+        if (!wait || error?.code !== "ELOCKED" || attempt === 299) throw error;
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 10);
+      }
+    }
+  } finally {
+    removeEmptyDirectory(lockDir);
+    removeEmptyDirectory(lockRoot);
+  }
+}
+
+export function atomicDirectory(parent, id, files, { replace = false, preserveExisting = false } = {}) {
   mkdirSync(parent, { recursive: true });
   const temporary = join(parent, `.${id}.${randomBytes(8).toString("hex")}`);
   const target = join(parent, id);
+  if (existsSync(target) && !replace) throw Object.assign(new Error(`${id} already exists.`), { code: "EEXIST" });
   mkdirSync(temporary);
   try {
+    if (preserveExisting && existsSync(target)) cpSync(target, temporary, { recursive: true });
     for (const [name, contents] of Object.entries(files)) {
       writeFileSync(join(temporary, name), contents);
     }
-    renameSync(temporary, target);
+    if (!replace || !existsSync(target)) {
+      renameSync(temporary, target);
+      return target;
+    }
+    const previous = join(parent, `.${id}.old.${randomBytes(8).toString("hex")}`);
+    renameSync(target, previous);
+    try {
+      renameSync(temporary, target);
+    } catch (error) {
+      try {
+        renameSync(previous, target);
+      } catch (rollbackError) {
+        throw new AggregateError(
+          [error, rollbackError],
+          `Could not update ${id}: publish failed and rollback failed; original remains at ${previous}.`,
+        );
+      }
+      throw error;
+    }
+    try {
+      rmSync(previous, { recursive: true, force: true });
+    } catch (cleanupError) {
+      console.warn(`Updated ${id}, but could not clean up ${previous}: ${cleanupError.message}`);
+    }
   } catch (error) {
-    rmSync(temporary, { recursive: true, force: true });
+    try {
+      rmSync(temporary, { recursive: true, force: true });
+    } catch (cleanupError) {
+      throw new AggregateError(
+        [error, cleanupError],
+        `Could not update ${id}: cleanup of temporary directory ${temporary} failed.`,
+      );
+    }
     throw error;
   }
   return target;
 }
+
+function missing(error) {
+  return error?.code === "ENOENT";
+}
+
+function entryAt(path) {
+  try {
+    return lstatSync(path);
+  } catch (error) {
+    if (missing(error)) return null;
+    throw error;
+  }
+}
+
+function cleanupError(errors, message) {
+  if (errors.length === 1) return new Error(`${message}: ${errors[0].message}`, { cause: errors[0] });
+  return new AggregateError(errors, message);
+}
+
+function revisionName(value) {
+  return /^rev-[a-f0-9]+$/u.test(value) ? value : null;
+}
+
+function pointerRevision(value) {
+  const match = /^(rev-[a-f0-9]+)\n?$/u.exec(value);
+  return match ? revisionName(match[1]) : null;
+}
+
+// Readers resolve this once, then use the returned immutable path for every
+// file in their package read. ENOENT is deliberately left for callers to treat
+// as an ordinary concurrent disappearance.
+export function resolveOvenPackageDir(pkgRoot) {
+  const pointer = join(pkgRoot, "current");
+  const entry = entryAt(pointer);
+  if (!entry) return pkgRoot;
+  if (!entry.isFile()) throw new Error(`Invalid Oven current pointer at ${pointer}: not a file.`);
+  const current = pointerRevision(readFileSync(pointer, "utf8"));
+  if (!revisionName(current)) throw new Error(`Invalid Oven current pointer at ${pointer}.`);
+  const revisionDir = join(pkgRoot, current);
+  if (!entryAt(revisionDir)?.isDirectory()) {
+    throw new Error(`Invalid Oven current pointer at ${pointer}: missing revision ${current}.`);
+  }
+  return revisionDir;
+}
+
+function currentRevision(pkgRoot, id) {
+  const pointer = join(pkgRoot, "current");
+  const entry = entryAt(pointer);
+  if (!entry) return null;
+  if (!entry.isFile()) throw new Error(`Oven ${id} current pointer is not a file.`);
+  const revision = pointerRevision(readFileSync(pointer, "utf8"));
+  if (!revisionName(revision)) throw new Error(`Oven ${id} current pointer is invalid.`);
+  const revisionDir = join(pkgRoot, revision);
+  if (!entryAt(revisionDir)?.isDirectory()) {
+    throw new Error(`Oven ${id} current pointer names missing revision ${revision}.`);
+  }
+  return revisionDir;
+}
+
+function legacyPackage(pkgRoot) {
+  return ["instructions.md", "detail.json"].every((name) => entryAt(join(pkgRoot, name))?.isFile());
+}
+
+function copyPackageFiles(from, to) {
+  for (const name of ["instructions.md", "detail.json", "oven.json"]) {
+    if (entryAt(join(from, name))?.isFile()) cpSync(join(from, name), join(to, name));
+  }
+}
+
+function publishCurrent(pkgRoot, id, revision) {
+  const temporary = join(pkgRoot, `.current.${randomBytes(8).toString("hex")}`);
+  try {
+    writeFileSync(temporary, `${revision}\n`);
+    renameSync(temporary, join(pkgRoot, "current"));
+  } catch (error) {
+    try {
+      rmSync(temporary, { force: true });
+    } catch (cleanupFailure) {
+      throw cleanupError([error, cleanupFailure], `Could not publish Oven ${id}`);
+    }
+    throw error;
+  }
+}
+
+function removeLegacyFiles(pkgRoot) {
+  for (const name of ["instructions.md", "detail.json", "oven.json"]) {
+    try {
+      rmSync(join(pkgRoot, name), { force: true });
+    } catch (error) {
+      // The pointer is already durable; a later publish can retry this cleanup.
+      console.warn(`Could not remove legacy Oven file ${join(pkgRoot, name)}: ${error.message}`);
+    }
+  }
+}
+
+function gcOldRevisions(pkgRoot, current) {
+  try {
+    for (const entry of readdirSync(pkgRoot, { withFileTypes: true })) {
+      const path = join(pkgRoot, entry.name);
+      if (entry.isFile() && entry.name.startsWith(".current.")) {
+        try {
+          rmSync(path, { force: true });
+        } catch (error) {
+          if (!missing(error)) throw error;
+        }
+        continue;
+      }
+      if (!entry.isDirectory() || entry.name === current || !revisionName(entry.name)) continue;
+      try {
+        if (Date.now() - statSync(path).mtimeMs >= OVEN_REV_GRACE_MS) rmSync(path, { recursive: true, force: true });
+      } catch (error) {
+        if (!missing(error)) throw error;
+      }
+    }
+  } catch (error) {
+    if (!missing(error)) throw error;
+  }
+}
+
+// Custom Oven packages are immutable nested revisions published by atomically
+// replacing a small pointer file. A reader that resolved the old revision keeps
+// a stable path until grace-period GC makes it eligible for deletion. A reader
+// suspended beyond that grace period mid-read is out of scope for this localhost tool.
+export function atomicOvenPackage(parent, id, files, { replace = false, assertPath } = {}) {
+  assertOvenPackageFileLimits(files);
+  assertPath?.();
+  mkdirSync(parent, { recursive: true });
+  const pkgRoot = join(parent, id);
+  mkdirSync(pkgRoot, { recursive: true });
+  const previous = currentRevision(pkgRoot, id);
+  const legacy = !previous && legacyPackage(pkgRoot);
+  if ((previous || legacy) && !replace) throw Object.assign(new Error(`${id} already exists.`), { code: "EEXIST" });
+
+  const revision = `rev-${randomBytes(8).toString("hex")}`;
+  const revisionDir = join(pkgRoot, revision);
+  mkdirSync(revisionDir);
+  try {
+    if (previous) copyPackageFiles(previous, revisionDir);
+    else if (legacy) copyPackageFiles(pkgRoot, revisionDir);
+    for (const [name, contents] of Object.entries(files)) writeFileSync(join(revisionDir, name), contents);
+    // Touch the outgoing rev to now BEFORE the swap so its grace window starts at retirement even if
+    // the process dies right after publishCurrent (a post-swap touch could leave it stale for GC).
+    if (previous) {
+      const retiredAt = new Date();
+      utimesSync(previous, retiredAt, retiredAt);
+    }
+    publishCurrent(pkgRoot, id, revision);
+  } catch (error) {
+    try {
+      rmSync(revisionDir, { recursive: true, force: true });
+    } catch (cleanupFailure) {
+      throw cleanupError([error, cleanupFailure], `Could not publish Oven ${id}`);
+    }
+    throw error;
+  }
+  for (const cleanup of [
+    () => removeLegacyFiles(pkgRoot),
+    () => gcOldRevisions(pkgRoot, revision),
+  ]) {
+    try {
+      cleanup();
+    } catch (cleanupError) {
+      console.warn(`Published Oven ${id}, but cleanup failed: ${cleanupError.message}`);
+    }
+  }
+  return pkgRoot;
+}
diff --git a/src/server/fs-safe.test.mjs b/src/server/fs-safe.test.mjs
new file mode 100644
index 0000000..83982cc
--- /dev/null
+++ b/src/server/fs-safe.test.mjs
@@ -0,0 +1,277 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, symlinkSync, utimesSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { atomicDirectory, atomicOvenPackage, OVEN_REV_GRACE_MS, resolveOvenPackageDir, withOvenPackageLock } from "./fs-safe.mjs";
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), "burnlist-fs-safe-"));
+  return { root, cleanup: () => rmSync(root, { recursive: true, force: true }) };
+}
+
+test("atomicDirectory reports EEXIST for a populated collision", () => {
+  const context = fixture();
+  try {
+    atomicDirectory(context.root, "260713-001", { "burnlist.md": "first\n" });
+    assert.throws(
+      () => atomicDirectory(context.root, "260713-001", { "burnlist.md": "second\n" }),
+      (error) => error?.code === "EEXIST" && error.message === "260713-001 already exists.",
+    );
+  } finally {
+    context.cleanup();
+  }
+});
+
+function swapFailure(mode, parent) {
+  const script = [
+    'import fs, { existsSync, mkdirSync, readdirSync, writeFileSync } from "node:fs";',
+    'import { syncBuiltinESMExports } from "node:module";',
+    'import { join } from "node:path";',
+    'const [parent, mode, moduleUrl] = process.argv.slice(1);',
+    'const target = join(parent, "oven");',
+    'mkdirSync(target, { recursive: true });',
+    'writeFileSync(join(target, "instructions.md"), "original\\n");',
+    'const nativeRename = fs.renameSync;',
+    'const nativeRm = fs.rmSync;',
+    'fs.renameSync = (from, to) => {',
+    '  if (mode === "rollback" && from.startsWith(join(parent, ".oven.")) && !from.startsWith(join(parent, ".oven.old.")) && to === target) throw new Error("publish blocked");',
+    '  if (mode === "rollback" && from.startsWith(join(parent, ".oven.old.")) && to === target) throw new Error("rollback blocked");',
+    '  return nativeRename(from, to);',
+    '};',
+    'fs.rmSync = (path, options) => {',
+    '  if (mode === "cleanup" && path.startsWith(join(parent, ".oven.old."))) throw new Error("cleanup blocked");',
+    '  return nativeRm(path, options);',
+    '};',
+    'syncBuiltinESMExports();',
+    'const { atomicDirectory } = await import(moduleUrl);',
+    'let error = null;',
+    'try { atomicDirectory(parent, "oven", { "instructions.md": "updated\\n" }, { replace: true, preserveExisting: true }); } catch (caught) { error = caught; }',
+    'process.stdout.write(JSON.stringify({ name: error?.name, message: error?.message, errors: error?.errors?.length ?? 0, old: readdirSync(parent).filter((name) => name.startsWith(".oven.old.")), target: existsSync(target) }));',
+  ].join("\n");
+  const result = spawnSync(process.execPath, ["--input-type=module", "--eval", script, parent, mode, new URL("./fs-safe.mjs", import.meta.url).href], { encoding: "utf8" });
+  assert.equal(result.status, 0, result.stderr);
+  return JSON.parse(result.stdout);
+}
+
+test("atomicDirectory surfaces failed rollback but keeps a successful replacement live after cleanup failure", () => {
+  const rollback = fixture();
+  const cleanup = fixture();
+  try {
+    const rollbackResult = swapFailure("rollback", rollback.root);
+    assert.equal(rollbackResult.name, "AggregateError");
+    assert.equal(rollbackResult.errors, 2);
+    assert.match(rollbackResult.message, /publish failed and rollback failed/u);
+    assert.equal(rollbackResult.target, false);
+    assert.equal(rollbackResult.old.length, 1);
+
+    const cleanupResult = swapFailure("cleanup", cleanup.root);
+    assert.equal(cleanupResult.message, undefined);
+    assert.equal(cleanupResult.target, true);
+    assert.equal(cleanupResult.old.length, 1);
+  } finally {
+    rollback.cleanup();
+    cleanup.cleanup();
+  }
+});
+
+test("Oven package cleanup failures do not undo a published revision, while pre-swap failures throw", () => {
+  const context = fixture();
+  const script = [
+    'import fs, { existsSync, readFileSync } from "node:fs";',
+    'import { syncBuiltinESMExports } from "node:module";',
+    'const [root, moduleUrl] = process.argv.slice(1);',
+    'const { atomicOvenPackage, resolveOvenPackageDir } = await import(moduleUrl);',
+    'const files = (name) => ({ "instructions.md": "# " + name + "\\n", "detail.json": "{}\\n" });',
+    'atomicOvenPackage(root, "oven", files("first"));',
+    'const nativeReaddir = fs.readdirSync;',
+    'fs.readdirSync = (path, ...rest) => path === root + "/oven" ? (() => { throw new Error("gc blocked"); })() : nativeReaddir(path, ...rest);',
+    'syncBuiltinESMExports();',
+    'atomicOvenPackage(root, "oven", files("second"), { replace: true });',
+    'const current = resolveOvenPackageDir(root + "/oven");',
+    'process.stdout.write(JSON.stringify({ current, contents: readFileSync(current + "/instructions.md", "utf8"), exists: existsSync(current) }));',
+  ].join("\n");
+  const preSwapScript = [
+    'import fs from "node:fs";',
+    'import { syncBuiltinESMExports } from "node:module";',
+    'const [root, moduleUrl] = process.argv.slice(1);',
+    'const { atomicOvenPackage } = await import(moduleUrl);',
+    'const nativeWrite = fs.writeFileSync;',
+    'fs.writeFileSync = (path, ...rest) => { if (String(path).includes("instructions.md")) throw new Error("stage blocked"); return nativeWrite(path, ...rest); };',
+    'syncBuiltinESMExports();',
+    'try { atomicOvenPackage(root, "pre-swap", { "instructions.md": "# blocked\\n", "detail.json": "{}\\n" }); } catch (error) { process.stdout.write(error.message); }',
+  ].join("\n");
+  try {
+    const published = spawnSync(process.execPath, ["--input-type=module", "--eval", script, context.root, new URL("./fs-safe.mjs", import.meta.url).href], { encoding: "utf8" });
+    assert.equal(published.status, 0, published.stderr);
+    const result = JSON.parse(published.stdout);
+    assert.equal(result.exists, true);
+    assert.match(result.current, /rev-[a-f0-9]+$/u);
+    assert.match(result.contents, /second/u);
+
+    const failed = spawnSync(process.execPath, ["--input-type=module", "--eval", preSwapScript, context.root, new URL("./fs-safe.mjs", import.meta.url).href], { encoding: "utf8" });
+    assert.equal(failed.status, 0, failed.stderr);
+    assert.match(failed.stdout, /stage blocked/u);
+  } finally {
+    context.cleanup();
+  }
+});
+
+function ovenFiles(version) {
+  return {
+    "instructions.md": `# Oven ${version}\n`,
+    "detail.json": `{ "version": "${version}" }\n`,
+    "oven.json": `{ "source": "${version}" }\n`,
+  };
+}
+
+test("Oven pointer swaps measure revision GC grace from retirement", () => {
+  const context = fixture();
+  const target = join(context.root, "oven");
+  try {
+    withOvenPackageLock(context.root, "oven", () => atomicOvenPackage(context.root, "oven", ovenFiles("one")));
+    const oldPath = resolveOvenPackageDir(target);
+    const longAgo = new Date(Date.now() - OVEN_REV_GRACE_MS - 1_000);
+    utimesSync(oldPath, longAgo, longAgo);
+    withOvenPackageLock(context.root, "oven", () => atomicOvenPackage(context.root, "oven", ovenFiles("two"), { replace: true }));
+
+    for (const [name, contents] of Object.entries(ovenFiles("one"))) {
+      assert.equal(readFileSync(join(oldPath, name), "utf8"), contents);
+    }
+    assert.ok(Date.now() - statSync(oldPath).mtimeMs < OVEN_REV_GRACE_MS);
+
+    const stale = join(target, "rev-deadbeef");
+    mkdirSync(stale);
+    utimesSync(stale, longAgo, longAgo);
+    withOvenPackageLock(context.root, "oven", () => atomicOvenPackage(context.root, "oven", ovenFiles("three"), { replace: true }));
+    assert.equal(existsSync(stale), false);
+    assert.equal(existsSync(oldPath), true);
+    const revisions = readdirSync(target, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory() && entry.name.startsWith("rev-"))
+      .map((entry) => entry.name);
+    assert.equal(revisions.length, 3);
+    assert.match(readFileSync(join(target, "current"), "utf8"), /^rev-[a-f0-9]+\n$/u);
+
+    const currentPath = resolveOvenPackageDir(target);
+    utimesSync(currentPath, longAgo, longAgo);
+    withOvenPackageLock(context.root, "oven", () => atomicOvenPackage(context.root, "oven", ovenFiles("four"), { replace: true }));
+    assert.equal(existsSync(currentPath), true);
+    assert.equal(existsSync(resolveOvenPackageDir(target)), true);
+  } finally {
+    context.cleanup();
+  }
+});
+
+test("Oven publication runs its locked path guard before creating a revision", () => {
+  const context = fixture();
+  const target = join(context.root, "guarded");
+  try {
+    withOvenPackageLock(context.root, "guarded", () => atomicOvenPackage(context.root, "guarded", ovenFiles("old")));
+    const pointer = readFileSync(join(target, "current"), "utf8");
+    assert.throws(
+      () => withOvenPackageLock(context.root, "guarded", () => atomicOvenPackage(context.root, "guarded", ovenFiles("new"), {
+        replace: true,
+        assertPath: () => { throw new Error("custom storage changed"); },
+      })),
+      /custom storage changed/u,
+    );
+    assert.equal(readFileSync(join(target, "current"), "utf8"), pointer);
+    assert.equal(readFileSync(join(resolveOvenPackageDir(target), "instructions.md"), "utf8"), "# Oven old\n");
+  } finally {
+    context.cleanup();
+  }
+});
+
+test("Oven readers only fall back for an absent current pointer", () => {
+  const context = fixture();
+  try {
+    const flat = join(context.root, "flat");
+    mkdirSync(flat);
+    for (const [name, contents] of Object.entries(ovenFiles("flat"))) writeFileSync(join(flat, name), contents);
+    assert.equal(resolveOvenPackageDir(flat), flat);
+
+    const missing = join(context.root, "missing");
+    mkdirSync(missing);
+    writeFileSync(join(missing, "current"), "rev-deadbeef\n");
+    assert.throws(() => resolveOvenPackageDir(missing), /missing revision rev-deadbeef/u);
+
+    const nonFile = join(context.root, "non-file");
+    mkdirSync(join(nonFile, "current"), { recursive: true });
+    assert.throws(() => resolveOvenPackageDir(nonFile), /not a file/u);
+
+    const linked = join(context.root, "linked");
+    mkdirSync(linked);
+    writeFileSync(join(linked, "pointer-target"), "rev-deadbeef\n");
+    symlinkSync("pointer-target", join(linked, "current"));
+    assert.throws(() => resolveOvenPackageDir(linked), /not a file/u);
+  } finally {
+    context.cleanup();
+  }
+});
+
+test("Oven current pointers require one exact revision line", () => {
+  const context = fixture();
+  const target = join(context.root, "oven");
+  try {
+    mkdirSync(target);
+    mkdirSync(join(target, "rev-deadbeef"));
+    for (const contents of [" rev-deadbeef", "rev-deadbeef\nextra", "rev-deadbeef \n"]) {
+      writeFileSync(join(target, "current"), contents);
+      assert.throws(() => resolveOvenPackageDir(target), /Invalid Oven current pointer/u);
+    }
+    for (const contents of ["rev-deadbeef", "rev-deadbeef\n"]) {
+      writeFileSync(join(target, "current"), contents);
+      assert.equal(resolveOvenPackageDir(target), join(target, "rev-deadbeef"));
+    }
+  } finally {
+    context.cleanup();
+  }
+});
+
+test("legacy migration stays readable on either side of current and recovery trusts current", () => {
+  const context = fixture();
+  const target = join(context.root, "legacy");
+  const crashed = join(context.root, "crashed");
+  const orphanRoot = join(context.root, "orphan");
+  try {
+    atomicDirectory(context.root, "legacy", ovenFiles("legacy"));
+    assert.equal(resolveOvenPackageDir(target), target);
+    assert.equal(readFileSync(join(resolveOvenPackageDir(target), "instructions.md"), "utf8"), "# Oven legacy\n");
+    withOvenPackageLock(context.root, "legacy", () => (
+      atomicOvenPackage(context.root, "legacy", ovenFiles("updated"), { replace: true })
+    ));
+    assert.equal(readFileSync(join(resolveOvenPackageDir(target), "instructions.md"), "utf8"), "# Oven updated\n");
+    assert.equal(existsSync(join(target, "instructions.md")), false);
+
+    atomicDirectory(context.root, "crashed", ovenFiles("old"));
+    const publishedBeforeCleanup = join(crashed, "rev-cafebabe");
+    mkdirSync(publishedBeforeCleanup);
+    for (const [name, contents] of Object.entries(ovenFiles("new"))) writeFileSync(join(publishedBeforeCleanup, name), contents);
+    writeFileSync(join(crashed, "current"), "rev-cafebabe\n");
+    assert.equal(readFileSync(join(resolveOvenPackageDir(crashed), "instructions.md"), "utf8"), "# Oven new\n");
+    assert.equal(readFileSync(join(crashed, "instructions.md"), "utf8"), "# Oven old\n");
+    withOvenPackageLock(context.root, "crashed", () => (
+      atomicOvenPackage(context.root, "crashed", ovenFiles("recovered"), { replace: true })
+    ));
+    assert.equal(existsSync(join(crashed, "instructions.md")), false);
+
+    mkdirSync(orphanRoot, { recursive: true });
+    const orphanRevision = join(orphanRoot, "rev-deadbeef");
+    mkdirSync(orphanRevision);
+    for (const [name, contents] of Object.entries(ovenFiles("orphan"))) writeFileSync(join(orphanRevision, name), contents);
+    const orphanPointerTemp = join(orphanRoot, ".current.deadcafe");
+    writeFileSync(orphanPointerTemp, "rev-deadbeef\n");
+    withOvenPackageLock(context.root, "orphan", () => atomicOvenPackage(context.root, "orphan", ovenFiles("created")));
+    assert.equal(readFileSync(join(resolveOvenPackageDir(orphanRoot), "instructions.md"), "utf8"), "# Oven created\n");
+    assert.equal(existsSync(orphanPointerTemp), false);
+
+    writeFileSync(join(target, "current"), "rev-facefeed\n");
+    assert.throws(
+      () => withOvenPackageLock(context.root, "legacy", () => atomicOvenPackage(context.root, "legacy", ovenFiles("bad"), { replace: true })),
+      /missing revision rev-facefeed/u,
+    );
+  } finally {
+    context.cleanup();
+  }
+});
diff --git a/src/server/oven-bindings.mjs b/src/server/oven-bindings.mjs
new file mode 100644
index 0000000..6372474
--- /dev/null
+++ b/src/server/oven-bindings.mjs
@@ -0,0 +1,162 @@
+// Persisted bindings remain scoped to their repository; explicit --oven-data
+// bindings are global defaults. Persisted relative paths resolve per read.
+import { randomBytes } from "node:crypto";
+import { mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { ovenId } from "../ovens/oven-contract.mjs";
+import { repoKey } from "./registry.mjs";
+import { withRepoStateLock } from "./repo-state.mjs";
+
+export const BINDING_SCHEMA_VERSION = 1;
+
+export function bindingStoreDir(repoRoot) {
+  return join(repoRoot, ".local", "burnlist");
+}
+
+export function bindingStorePath(repoRoot) {
+  return join(bindingStoreDir(repoRoot), "bindings.json");
+}
+
+function emptyStore() {
+  return { schemaVersion: BINDING_SCHEMA_VERSION, bindings: {} };
+}
+
+function isPlainObject(value) {
+  return value && typeof value === "object" && !Array.isArray(value);
+}
+
+function isTimestamp(value) {
+  return typeof value === "string"
+    && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?(?:Z|[+-]\d{2}:\d{2})$/u.test(value)
+    && !Number.isNaN(Date.parse(value));
+}
+
+function validateStore(store) {
+  if (!isPlainObject(store) || store.schemaVersion !== BINDING_SCHEMA_VERSION || !isPlainObject(store.bindings)) return false;
+  return Object.entries(store.bindings).every(([id, binding]) => {
+    try {
+      ovenId(id);
+    } catch {
+      return false;
+    }
+    return isPlainObject(binding)
+      && typeof binding.path === "string"
+      && binding.path.length > 0
+      && isTimestamp(binding.boundAt);
+  });
+}
+
+function corruptStore(path) {
+  console.warn(`Ignoring corrupt Oven binding store: ${path}`);
+  return emptyStore();
+}
+
+function storedBindingStore(repoRoot) {
+  const path = bindingStorePath(repoRoot);
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch (error) {
+    if (error?.code === "ENOENT") return { state: "missing", store: emptyStore() };
+    throw error;
+  }
+  try {
+    const store = JSON.parse(text);
+    return validateStore(store) ? { state: "valid", store } : { state: "malformed", store: null };
+  } catch {
+    return { state: "malformed", store: null };
+  }
+}
+
+export function readBindingStore(repoRoot) {
+  const result = storedBindingStore(repoRoot);
+  return result.state === "malformed" ? corruptStore(bindingStorePath(repoRoot)) : result.store;
+}
+
+function mutableBindingStore(repoRoot) {
+  const result = storedBindingStore(repoRoot);
+  if (result.state === "malformed") {
+    throw new Error(`Refusing to modify malformed Oven binding store: ${bindingStorePath(repoRoot)}`);
+  }
+  return result.store;
+}
+
+function writeStore(repoRoot, store) {
+  const dir = bindingStoreDir(repoRoot);
+  const path = bindingStorePath(repoRoot);
+  const temporary = join(dir, `.bindings.json.${randomBytes(12).toString("hex")}`);
+  mkdirSync(dir, { recursive: true });
+  try {
+    writeFileSync(temporary, `${JSON.stringify(store, null, 2)}\n`);
+    renameSync(temporary, path);
+  } catch (error) {
+    rmSync(temporary, { force: true });
+    throw error;
+  }
+}
+
+export function writeBinding(repoRoot, id, logicalPath, boundAt) {
+  const safeId = ovenId(id);
+  if (typeof logicalPath !== "string" || logicalPath.length === 0) throw new Error("Oven binding path must be a non-empty string.");
+  if (!isTimestamp(boundAt)) throw new Error("Oven binding timestamp must be a valid ISO timestamp.");
+  return withRepoStateLock(repoRoot, () => {
+    const store = mutableBindingStore(repoRoot);
+    store.bindings[safeId] = { path: logicalPath, boundAt };
+    writeStore(repoRoot, store);
+    return { path: bindingStorePath(repoRoot), binding: store.bindings[safeId] };
+  });
+}
+
+export function removeBinding(repoRoot, id) {
+  const safeId = ovenId(id);
+  return withRepoStateLock(repoRoot, () => {
+    const store = mutableBindingStore(repoRoot);
+    if (!Object.hasOwn(store.bindings, safeId)) return false;
+    delete store.bindings[safeId];
+    writeStore(repoRoot, store);
+    return true;
+  });
+}
+
+const cachedStores = new Map();
+
+function statSignature(path, stat) {
+  try {
+    const value = stat(path);
+    return [value.dev, value.ino, value.size, value.mtimeMs, value.ctimeMs].join(":");
+  } catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+function cachedStore(repoRoot, stat) {
+  const path = bindingStorePath(repoRoot);
+  const signature = statSignature(path, stat);
+  const cached = cachedStores.get(path);
+  if (cached && cached.signature === signature) return cached.store;
+  const store = readBindingStore(repoRoot);
+  cachedStores.set(path, { signature, store });
+  return store;
+}
+
+export function effectiveBindings({ repoRoots = [], override = new Map(), statFn = statSync } = {}) {
+  const bindings = new Map();
+  for (const repoRoot of [...new Set(repoRoots)].sort((left, right) => left.localeCompare(right))) {
+    try {
+      for (const [id, binding] of Object.entries(cachedStore(repoRoot, statFn).bindings)) {
+        const entries = bindings.get(id) ?? [];
+        entries.push({ repoKey: repoKey(repoRoot), repoRoot, path: resolve(repoRoot, binding.path) });
+        bindings.set(id, entries);
+      }
+    } catch (error) {
+      console.warn(`Ignoring unavailable Oven binding store: ${bindingStorePath(repoRoot)} (${error.message})`);
+    }
+  }
+  for (const [id, path] of override) {
+    const entries = bindings.get(id) ?? [];
+    entries.push({ repoKey: null, repoRoot: null, path });
+    bindings.set(id, entries);
+  }
+  return bindings;
+}
diff --git a/src/server/oven-bindings.test.mjs b/src/server/oven-bindings.test.mjs
new file mode 100644
index 0000000..4882b8f
--- /dev/null
+++ b/src/server/oven-bindings.test.mjs
@@ -0,0 +1,132 @@
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, utimesSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import test from "node:test";
+import {
+  bindingStorePath,
+  effectiveBindings,
+  readBindingStore,
+  removeBinding,
+  writeBinding,
+} from "./oven-bindings.mjs";
+
+const BOUND_AT = "2026-07-14T12:00:00.000Z";
+
+function fixture() {
+  const root = mkdtempSync(join(tmpdir(), "burnlist-oven-bindings-"));
+  return { root, cleanup: () => rmSync(root, { recursive: true, force: true }) };
+}
+
+function quietly(fn) {
+  const warn = console.warn;
+  console.warn = () => {};
+  try {
+    return fn();
+  } finally {
+    console.warn = warn;
+  }
+}
+
+test("binding stores round-trip logical paths atomically", () => {
+  const { root, cleanup } = fixture();
+  try {
+    const result = writeBinding(root, "sample-oven", "../data/current.json", BOUND_AT);
+    assert.equal(result.path, bindingStorePath(root));
+    assert.deepEqual(readBindingStore(root), {
+      schemaVersion: 1,
+      bindings: { "sample-oven": { path: "../data/current.json", boundAt: BOUND_AT } },
+    });
+    assert.equal(removeBinding(root, "sample-oven"), true);
+    assert.equal(removeBinding(root, "sample-oven"), false);
+  } finally { cleanup(); }
+});
+
+test("missing, corrupt, and obsolete binding stores fail closed", () => {
+  const { root, cleanup } = fixture();
+  try {
+    assert.deepEqual(readBindingStore(root), { schemaVersion: 1, bindings: {} });
+    mkdirSync(join(root, ".local", "burnlist"), { recursive: true });
+    writeFileSync(bindingStorePath(root), "not json");
+    assert.deepEqual(quietly(() => readBindingStore(root)), { schemaVersion: 1, bindings: {} });
+    writeFileSync(bindingStorePath(root), '{"schemaVersion":2,"bindings":{}}');
+    assert.deepEqual(quietly(() => readBindingStore(root)), { schemaVersion: 1, bindings: {} });
+  } finally { cleanup(); }
+});
+
+test("binding mutations preserve malformed stores and create or update valid stores", () => {
+  const { root, cleanup } = fixture();
+  const path = bindingStorePath(root);
+  try {
+    const missing = writeBinding(root, "sample-oven", "created.json", BOUND_AT);
+    assert.deepEqual(missing.binding, { path: "created.json", boundAt: BOUND_AT });
+    writeBinding(root, "sample-oven", "updated.json", "2026-07-14T12:01:00.000Z");
+    assert.deepEqual(readBindingStore(root).bindings["sample-oven"], { path: "updated.json", boundAt: "2026-07-14T12:01:00.000Z" });
+    const malformed = '{"schemaVersion":1,"bindings":{"other-oven":';
+    writeFileSync(path, malformed);
+    assert.throws(() => writeBinding(root, "sample-oven", "lost.json", BOUND_AT), /Refusing to modify malformed Oven binding store/u);
+    assert.equal(readFileSync(path, "utf8"), malformed);
+    assert.throws(() => removeBinding(root, "sample-oven"), /Refusing to modify malformed Oven binding store/u);
+    assert.equal(readFileSync(path, "utf8"), malformed);
+  } finally { cleanup(); }
+});
+
+test("effective bindings re-read an atomically replaced store with an identical mtime", () => {
+  const { root, cleanup } = fixture();
+  try {
+    const unchangedMtime = new Date("2026-07-14T12:02:00.000Z");
+    writeBinding(root, "sample-oven", "first.json", BOUND_AT);
+    utimesSync(bindingStorePath(root), unchangedMtime, unchangedMtime);
+    const first = statSync(bindingStorePath(root));
+    assert.equal(effectiveBindings({ repoRoots: [root] }).get("sample-oven")[0].path, resolve(root, "first.json"));
+    writeBinding(root, "sample-oven", "a-longer-second.json", "2026-07-14T12:01:00.000Z");
+    utimesSync(bindingStorePath(root), unchangedMtime, unchangedMtime);
+    const second = statSync(bindingStorePath(root));
+    assert.equal(second.mtimeMs, first.mtimeMs);
+    assert.notEqual(second.ino, first.ino);
+    assert.notEqual(second.size, first.size);
+    assert.notEqual(second.ctimeMs, first.ctimeMs);
+    assert.equal(effectiveBindings({ repoRoots: [root] }).get("sample-oven")[0].path, resolve(root, "a-longer-second.json"));
+  } finally { cleanup(); }
+});
+
+test("effective bindings retain every repository binding and append global overrides", () => {
+  const { root, cleanup } = fixture();
+  const first = join(root, "a-repo");
+  const second = join(root, "b-repo");
+  try {
+    mkdirSync(first);
+    mkdirSync(second);
+    writeBinding(first, "sample-oven", "first.json", BOUND_AT);
+    writeBinding(second, "sample-oven", "second.json", BOUND_AT);
+    const persisted = effectiveBindings({ repoRoots: [second, first] }).get("sample-oven");
+    assert.deepEqual(persisted.map(({ path, repoRoot }) => ({ path, repoRoot })), [
+      { path: resolve(first, "first.json"), repoRoot: first },
+      { path: resolve(second, "second.json"), repoRoot: second },
+    ]);
+    const overridden = effectiveBindings({
+      repoRoots: [first, second],
+      override: new Map([["sample-oven", "/temporary/override.json"]]),
+    }).get("sample-oven");
+    assert.deepEqual(overridden.map(({ path, repoRoot }) => ({ path, repoRoot })), [
+      { path: resolve(first, "first.json"), repoRoot: first },
+      { path: resolve(second, "second.json"), repoRoot: second },
+      { path: "/temporary/override.json", repoRoot: null },
+    ]);
+    assert.equal(overridden.at(-1).repoKey, null);
+  } finally { cleanup(); }
+});
+
+test("effective bindings skip an unreadable repository store without hiding healthy bindings", () => {
+  const { root, cleanup } = fixture();
+  const bad = join(root, "bad-repo");
+  const good = join(root, "good-repo");
+  try {
+    mkdirSync(bad);
+    mkdirSync(good);
+    mkdirSync(bindingStorePath(bad), { recursive: true });
+    writeBinding(good, "sample-oven", "good.json", BOUND_AT);
+    const bindings = quietly(() => effectiveBindings({ repoRoots: [bad, good] }));
+    assert.deepEqual(bindings.get("sample-oven").map((entry) => entry.repoRoot), [good]);
+  } finally { cleanup(); }
+});
diff --git a/src/server/oven-routes.test.mjs b/src/server/oven-routes.test.mjs
new file mode 100644
index 0000000..e88f0ea
--- /dev/null
+++ b/src/server/oven-routes.test.mjs
@@ -0,0 +1,438 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { existsSync, realpathSync } from "node:fs";
+import { mkdir, readFile, symlink, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { buildPayload } from "../../ovens/differential-testing/example/adapter.mjs";
+import test from "node:test";
+import { repoKey } from "./registry.mjs";
+import { detailFixture, httpGet, httpRequest, withServer } from "./dashboard-routes-fixtures.mjs";
+
+test("POST /api/ovens refuses an unignored Git repository without writing an Oven", { timeout: 20_000 }, async () => {
+  await withServer({
+    setup: async ({ fixtureRoot }) => {
+      // Git-init the launch umbrella (where the server writes the oven), not a nested repo.
+      execFileSync("git", ["init", "--quiet"], { cwd: fixtureRoot, stdio: "ignore" });
+    },
+  }, async ({ baseUrl, repoRoot }) => {
+    const catalog = JSON.parse((await httpGet(baseUrl, "/api/ovens")).body);
+    const response = await httpRequest(baseUrl, "/api/ovens", {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-burnlist-token": catalog.writeToken },
+      body: JSON.stringify({
+        id: "unignored-oven", name: "Unignored Oven", instructions: "# Unignored Oven\n\nStay local.", detail: detailFixture(),
+      }),
+    });
+    assert.equal(response.status, 400);
+    assert.match(JSON.parse(response.body).error, /refusing to write \.local\/burnlist\/ovens: not git-ignored/u);
+    assert.equal(existsSync(join(repoRoot, ".local", "burnlist", "ovens", "unignored-oven")), false);
+  });
+});
+test("unreadable binding stores do not affect unrelated routes and healthy Oven data", { timeout: 20_000 }, async () => {
+  await withServer({
+    burnlists: [{ repoPath: "bad" }, { repoPath: "good" }],
+    ovenData: [{ id: "checklist", payload: { source: "good" }, repoPath: "good", persisted: true, override: false }],
+    setup: async ({ fixtureRoot }) => {
+      await mkdir(join(fixtureRoot, "bad", ".local", "burnlist", "bindings.json"), { recursive: true });
+    },
+  }, async ({ baseUrl }) => {
+    assert.equal((await httpGet(baseUrl, "/")).status, 200);
+    assert.equal((await httpGet(baseUrl, "/favicon.svg")).status, 200);
+    assert.equal((await httpGet(baseUrl, "/api/progress?repo=bad&id=fixture")).status, 200);
+    const entries = JSON.parse((await httpGet(baseUrl, "/api/burnlists")).body).burnlists;
+    const good = entries.find((entry) => entry.ovenId === "checklist" && entry.repo === "good");
+    assert.ok(good);
+    const data = await httpGet(baseUrl, `/api/oven-data/checklist?repoKey=${good.repoKey}`);
+    assert.equal(data.status, 200);
+    assert.deepEqual(JSON.parse(data.body).payload, { source: "good" });
+  });
+});
+
+test("registered Oven routes and dashboard entries isolate malformed custom Oven packages", { timeout: 20_000 }, async () => {
+  const timestamp = "2026-01-01T12:00:00.000Z";
+  const differentialTestingPayload = buildPayload(
+    {
+      captureId: "reference-fixture", generatedAt: timestamp,
+      fields: [{ id: "position", label: "Position", sourceOwner: "fixture", meaning: "Position", unit: "units", tolerance: 0 }],
+      samples: [{ tick: 0, values: { position: 1 } }],
+    },
+    { captureId: "candidate-fixture", generatedAt: timestamp, samples: [{ tick: 0, values: { position: 1 } }] },
+  );
+  await withServer({
+    withBurnlist: true,
+    ovens: [{ id: "malformed-oven", ovenJson: "{", repoPath: "fixture-repo" }],
+    ovenData: [
+      { id: "checklist", payload: { source: "generic" } },
+      { id: "differential-testing", payload: differentialTestingPayload },
+    ],
+  }, async ({ baseUrl }) => {
+    const checklist = await httpGet(baseUrl, "/api/oven-data/checklist");
+    assert.equal(checklist.status, 200);
+    const checklistResponse = JSON.parse(checklist.body);
+    assert.deepEqual(checklistResponse.payload, { source: "generic" });
+    assert.equal(checklistResponse.validated, false);
+
+    const differentialTesting = await httpGet(baseUrl, "/api/oven-data/differential-testing");
+    assert.equal(differentialTesting.status, 200);
+    const differentialTestingResponse = JSON.parse(differentialTesting.body);
+    assert.equal(differentialTestingResponse.scenarioId, differentialTestingPayload.scenarioCatalog.selectedScenarioId);
+    assert.equal(Object.hasOwn(differentialTestingResponse, "validated"), false);
+
+    const entries = JSON.parse((await httpGet(baseUrl, "/api/burnlists")).body).burnlists;
+    assert.equal(entries.some((entry) => entry.ovenId === "checklist"), true);
+    assert.equal(entries.some((entry) => entry.ovenId === "differential-testing"), true);
+    const fixtureKey = entries.find((entry) => entry.ovenId === "checklist").repoKey;
+
+    const ovens = await httpGet(baseUrl, "/api/ovens");
+    assert.equal(ovens.status, 200);
+    assert.equal(JSON.parse(ovens.body).ovens.some((oven) => oven.id === "checklist"), true);
+    const malformed = await httpGet(baseUrl, `/api/ovens/malformed-oven?repoKey=${fixtureKey}`);
+    assert.equal(malformed.status, 400);
+    assert.match(JSON.parse(malformed.body).error, /lineage sidecar is invalid/u);
+  });
+});
+
+test("a generated Differential Testing row href resolves (global built-in, repoKey selects data)", { timeout: 20_000 }, async () => {
+  const timestamp = "2026-01-01T12:00:00.000Z";
+  const payload = buildPayload(
+    {
+      captureId: "reference-fixture", generatedAt: timestamp,
+      fields: [{ id: "position", label: "Position", sourceOwner: "fixture", meaning: "Position", unit: "units", tolerance: 0 }],
+      samples: [{ tick: 0, values: { position: 1 } }],
+    },
+    { captureId: "candidate-fixture", generatedAt: timestamp, samples: [{ tick: 0, values: { position: 1 } }] },
+  );
+  await withServer({
+    burnlists: [{ repoPath: "app" }],
+    ovenData: [{ id: "differential-testing", payload, repoPath: "app", persisted: true, override: false }],
+  }, async ({ baseUrl }) => {
+    const rows = JSON.parse((await httpGet(baseUrl, "/api/burnlists")).body).burnlists;
+    const dtRow = rows.find((row) => row.ovenId === "differential-testing" && row.statusLabel !== "Blocked");
+    assert.ok(dtRow, "expected a Differential Testing dashboard row");
+    assert.match(dtRow.href, /\/ovens\/differential-testing\/view\?.*repoKey=/u);
+    // The generated row link (built-in oven + a repoKey data selector) must resolve, not 404.
+    assert.equal((await httpGet(baseUrl, dtRow.href)).status, 200);
+    // The oven itself is global; repoKey only selects that repo's data binding.
+    assert.equal((await httpGet(baseUrl, `/api/ovens/differential-testing?repoKey=${dtRow.repoKey}`)).status, 200);
+    assert.equal((await httpGet(baseUrl, `/api/oven-data/differential-testing?repoKey=${dtRow.repoKey}`)).status, 200);
+  });
+});
+
+test("an unknown Oven with a data binding remains unvalidated", { timeout: 20_000 }, async () => {
+  await withServer({ ovenData: [{ id: "ghost", payload: { ignored: true } }] }, async ({ baseUrl }) => {
+    const unknown = await httpGet(baseUrl, "/api/oven-data/ghost");
+    assert.equal(unknown.status, 404);
+    assert.equal(JSON.parse(unknown.body).validated, false);
+  });
+});
+
+test("a discovered custom Oven with a data binding is served as unvalidated JSON", { timeout: 20_000 }, async () => {
+  await withServer({
+    ovens: [{ id: "custom-oven" }],
+    ovenData: [{ id: "custom-oven", payload: { source: "custom" } }],
+  }, async ({ baseUrl }) => {
+    const catalog = JSON.parse((await httpGet(baseUrl, "/api/ovens")).body);
+    const oven = catalog.ovens.find((entry) => entry.id === "custom-oven");
+    assert.ok(oven);
+    assert.equal((await httpGet(baseUrl, "/api/oven-data/custom-oven")).status, 404);
+    const response = await httpGet(baseUrl, `/api/oven-data/custom-oven?repoKey=${oven.repoKey}`);
+    assert.equal(response.status, 200);
+    assert.deepEqual(JSON.parse(response.body).payload, { source: "custom" });
+    assert.equal(JSON.parse(response.body).validated, false);
+  });
+});
+
+test("a launched repository custom Oven is listed and requires its umbrella repoKey", { timeout: 20_000 }, async () => {
+  await withServer({ ovens: [{ id: "launch-only" }] }, async ({ baseUrl }) => {
+    const catalog = JSON.parse((await httpGet(baseUrl, "/api/ovens")).body).ovens;
+    const launchOven = catalog.find((oven) => oven.id === "launch-only");
+    assert.ok(launchOven);
+    assert.notEqual(launchOven.repoKey, null);
+
+    const response = await httpGet(baseUrl, "/api/ovens/launch-only");
+    assert.equal(response.status, 404);
+    assert.equal((await httpGet(baseUrl, `/api/ovens/launch-only?repoKey=${launchOven.repoKey}`)).status, 200);
+    const repos = JSON.parse((await httpGet(baseUrl, "/api/repos")).body).repos;
+    assert.equal(repos.some((repo) => repo.repoKey === launchOven.repoKey), true);
+  });
+});
+
+test("custom Ovens are identified by repository while built-ins remain global", { timeout: 20_000 }, async () => {
+  await withServer({
+    burnlists: [{ repoPath: "a" }, { repoPath: "b" }, { repoPath: "c" }],
+    scanRoots: ["a", "b", "c"],
+    launchCwd: "a",
+    ovens: [
+      { id: "shared", repoPath: "a", instructions: "# Oven A\n\nA definition.\n" },
+      { id: "shared", repoPath: "b", instructions: "# Oven B\n\nB definition.\n" },
+    ],
+    ovenData: [
+      { id: "shared", payload: { source: "A" }, repoPath: "a", persisted: true, override: false },
+      { id: "shared", payload: { source: "B" }, repoPath: "b", persisted: true, override: false },
+    ],
+  }, async ({ baseUrl }) => {
+    const catalog = JSON.parse((await httpGet(baseUrl, "/api/ovens")).body);
+    const shared = catalog.ovens.filter((oven) => oven.id === "shared");
+    assert.equal(shared.length, 2);
+    assert.equal(new Set(shared.map((oven) => oven.repoKey)).size, 2);
+    assert.equal(catalog.ovens.find((oven) => oven.id === "checklist").repoKey, null);
+    assert.equal(catalog.ovens.find((oven) => oven.id === "differential-testing").repoKey, null);
+
+    const [first, second] = shared;
+    const firstOven = await httpGet(baseUrl, `/api/ovens/shared?repoKey=${first.repoKey}`);
+    const secondOven = await httpGet(baseUrl, `/api/ovens/shared?repoKey=${second.repoKey}`);
+    assert.equal(firstOven.status, 200);
+    assert.equal(secondOven.status, 200);
+    assert.notEqual(JSON.parse(firstOven.body).oven.instructions, JSON.parse(secondOven.body).oven.instructions);
+    // Custom ovens never resolve without their own repository identity.
+    const bare = await httpGet(baseUrl, "/api/ovens/shared");
+    assert.equal(bare.status, 404);
+    assert.equal((await httpGet(baseUrl, "/api/ovens/shared?repoKey=missing")).status, 404);
+
+    const firstData = await httpGet(baseUrl, `/api/oven-data/shared?repoKey=${first.repoKey}`);
+    const secondData = await httpGet(baseUrl, `/api/oven-data/shared?repoKey=${second.repoKey}`);
+    assert.notEqual(JSON.parse(firstData.body).payload.source, JSON.parse(secondData.body).payload.source);
+
+    const repos = JSON.parse((await httpGet(baseUrl, "/api/repos")).body).repos;
+    const b = repos.find((repo) => repo.name === "b");
+    const c = repos.find((repo) => repo.name === "c");
+    assert.ok(b);
+    assert.ok(c);
+    const authored = await httpRequest(baseUrl, "/api/ovens", {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-burnlist-token": catalog.writeToken },
+      body: JSON.stringify({
+        id: "b-authored", name: "B Authored", instructions: "# B Authored\n\nB only.\n", detail: detailFixture(), repoKey: b.repoKey,
+      }),
+    });
+    assert.equal(authored.status, 201);
+    assert.equal(JSON.parse(authored.body).oven.repoKey, b.repoKey);
+    assert.equal((await httpGet(baseUrl, `/api/ovens/b-authored?repoKey=${b.repoKey}`)).status, 200);
+    const created = await httpRequest(baseUrl, "/api/runs", {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-burnlist-token": catalog.writeToken },
+      body: JSON.stringify({ ovenId: "shared", ovenRepoKey: b.repoKey, repoRoot: b.root, title: "B run", objective: "Use B's Oven." }),
+    });
+    assert.equal(created.status, 201);
+    const run = JSON.parse(created.body).run;
+    assert.equal(run.repoRoot, b.root);
+    const runDirectory = run.path;
+    const snapshot = await readFile(`${runDirectory}/instructions.md`, "utf8");
+    assert.match(snapshot, /Oven B/u);
+    const wrongOvenRepo = await httpRequest(baseUrl, "/api/runs", {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-burnlist-token": catalog.writeToken },
+      body: JSON.stringify({ ovenId: "shared", ovenRepoKey: c.repoKey, repoRoot: b.root, title: "Rejected run", objective: "Reject a missing Oven." }),
+    });
+    assert.equal(wrongOvenRepo.status, 400);
+    assert.match(JSON.parse(wrongOvenRepo.body).error, /Unknown oven shared/u);
+  });
+});
+
+test("Differential Testing bindings remain distinct for each repository", { timeout: 20_000 }, async () => {
+  const timestamp = "2026-01-01T12:00:00.000Z";
+  const payloadFor = (captureId) => buildPayload(
+    {
+      captureId, generatedAt: timestamp,
+      fields: [{ id: "position", label: "Position", sourceOwner: "fixture", meaning: "Position", unit: "units", tolerance: 0 }],
+      samples: [{ tick: 0, values: { position: 1 } }],
+    },
+    { captureId: `${captureId}-candidate`, generatedAt: timestamp, samples: [{ tick: 0, values: { position: 1 } }] },
+  );
+  const first = payloadFor("first-repo");
+  const second = payloadFor("second-repo");
+  await withServer({
+    burnlists: [{ repoPath: "a/first" }, { repoPath: "b/second" }],
+    scanRoots: ["a", "b"],
+    ovenData: [
+      { id: "differential-testing", payload: first, repoPath: "a/first", persisted: true, override: false },
+      { id: "differential-testing", payload: second, repoPath: "b/second", persisted: true, override: false },
+    ],
+  }, async ({ baseUrl }) => {
+    const entries = JSON.parse((await httpGet(baseUrl, "/api/burnlists")).body).burnlists
+      .filter((entry) => entry.ovenId === "differential-testing");
+    assert.equal(entries.length, 2);
+    assert.equal(new Set(entries.map((entry) => entry.repoKey)).size, 2);
+    for (const entry of entries) {
+      assert.equal(entry.planPath, null);
+      assert.equal(entry.planLabel, null);
+      assert.match(entry.href, new RegExp(`^/ovens/differential-testing/view\\?scenario=${entry.id}&repoKey=${entry.repoKey}$`, "u"));
+    }
+
+    const firstEntry = entries.find((entry) => entry.title === "first-repo");
+    const secondEntry = entries.find((entry) => entry.title === "second-repo");
+    assert.ok(firstEntry);
+    assert.ok(secondEntry);
+    const firstResponse = await httpGet(baseUrl, `/api/oven-data/differential-testing?repoKey=${firstEntry.repoKey}`);
+    const secondResponse = await httpGet(baseUrl, `/api/oven-data/differential-testing?repoKey=${secondEntry.repoKey}`);
+    assert.equal(firstResponse.status, 200);
+    assert.equal(secondResponse.status, 200);
+    assert.equal(JSON.parse(firstResponse.body).payload.subtitle, "first-repo / first-repo-candidate");
+    assert.equal(JSON.parse(secondResponse.body).payload.subtitle, "second-repo / second-repo-candidate");
+  });
+});
+
+test("invalid Differential Testing bindings render blocked rows without hiding valid bindings or Checklists", { timeout: 20_000 }, async () => {
+  const timestamp = "2026-01-01T12:00:00.000Z";
+  const valid = buildPayload(
+    {
+      captureId: "valid-repo", generatedAt: timestamp,
+      fields: [{ id: "position", label: "Position", sourceOwner: "fixture", meaning: "Position", unit: "units", tolerance: 0 }],
+      samples: [{ tick: 0, values: { position: 1 } }],
+    },
+    { captureId: "valid-repo-candidate", generatedAt: timestamp, samples: [{ tick: 0, values: { position: 1 } }] },
+  );
+  await withServer({
+    burnlists: [{ repoPath: "a/broken" }, { repoPath: "b/valid" }],
+    scanRoots: ["a", "b"],
+    ovenData: [
+      { id: "differential-testing", payload: {}, repoPath: "a/broken", persisted: true, override: false },
+      { id: "differential-testing", payload: valid, repoPath: "b/valid", persisted: true, override: false },
+    ],
+  }, async ({ baseUrl }) => {
+    const response = await httpGet(baseUrl, "/api/burnlists");
+    assert.equal(response.status, 200);
+    const entries = JSON.parse(response.body).burnlists;
+    assert.equal(entries.filter((entry) => entry.ovenId === "checklist").length, 2);
+    const blocked = entries.find((entry) => entry.ovenId === "differential-testing" && entry.statusLabel === "Blocked");
+    assert.ok(blocked);
+    assert.equal(blocked.status, "active");
+    assert.equal(typeof blocked.blockers, "string");
+    assert.equal(entries.some((entry) => entry.ovenId === "differential-testing" && entry.statusLabel === "Active"), true);
+  });
+});
+
+test("Oven data repo binding falls back to the global override", { timeout: 20_000 }, async () => {
+  const timestamp = "2026-01-01T12:00:00.000Z";
+  const payloadFor = (captureId) => buildPayload(
+    {
+      captureId, generatedAt: timestamp,
+      fields: [{ id: "position", label: "Position", sourceOwner: "fixture", meaning: "Position", unit: "units", tolerance: 0 }],
+      samples: [{ tick: 0, values: { position: 1 } }],
+    },
+    { captureId: `${captureId}-candidate`, generatedAt: timestamp, samples: [{ tick: 0, values: { position: 1 } }] },
+  );
+  const override = payloadFor("global-override");
+  const exact = payloadFor("exact-repo");
+  await withServer({
+    burnlists: [
+      { repoPath: "a/first", title: "First repository" },
+      { repoPath: "b/second", title: "Second repository" },
+    ],
+    scanRoots: ["a", "b"],
+    ovenData: [
+      { id: "differential-testing", payload: override },
+      { id: "differential-testing", payload: exact, repoPath: "a/first", persisted: true, override: false },
+    ],
+  }, async ({ baseUrl }) => {
+    const burnlists = JSON.parse((await httpGet(baseUrl, "/api/burnlists")).body).burnlists;
+    const dtEntries = burnlists.filter((entry) => entry.ovenId === "differential-testing");
+    // repoKeys come from the checklist entries (DT entry titles are scenario labels, not repo titles).
+    const firstChecklist = burnlists.find((entry) => entry.ovenId === "checklist" && entry.title === "First repository");
+    const secondChecklist = burnlists.find((entry) => entry.ovenId === "checklist" && entry.title === "Second repository");
+    assert.ok(firstChecklist);
+    assert.ok(secondChecklist);
+    // a/first has its own persisted binding → a DT row; b/second (unbound) gets no fabricated row.
+    assert.equal(dtEntries.some((entry) => entry.repoKey === firstChecklist.repoKey), true);
+    assert.equal(dtEntries.some((entry) => entry.repoKey === secondChecklist.repoKey), false);
+    const exactResponse = await httpGet(baseUrl, `/api/oven-data/differential-testing?repoKey=${firstChecklist.repoKey}`);
+    const fallbackResponse = await httpGet(baseUrl, `/api/oven-data/differential-testing?repoKey=${secondChecklist.repoKey}`);
+    assert.equal(exactResponse.status, 200);
+    assert.equal(fallbackResponse.status, 200);
+    assert.equal(JSON.parse(exactResponse.body).payload.subtitle, "exact-repo / exact-repo-candidate");
+    assert.equal(JSON.parse(fallbackResponse.body).payload.subtitle, "global-override / global-override-candidate");
+  });
+});
+
+test("Oven discovery exposes optional lineage, skips malformed catalog entries, and keeps direct reads closed", { timeout: 20_000 }, async () => {
+  const forkedFrom = { ovenId: "source-oven", revision: `o1-sha256:${"a".repeat(64)}` };
+  await withServer({
+    ovens: [
+      { id: "forked-oven", ovenJson: { forkedFrom } },
+      { id: "standalone-oven" },
+    ],
+  }, async ({ baseUrl }) => {
+    const catalog = JSON.parse((await httpGet(baseUrl, "/api/ovens")).body).ovens;
+    const forkedKey = catalog.find((oven) => oven.id === "forked-oven").repoKey;
+    const standaloneKey = catalog.find((oven) => oven.id === "standalone-oven").repoKey;
+    const forked = JSON.parse((await httpGet(baseUrl, `/api/ovens/forked-oven?repoKey=${forkedKey}`)).body).oven;
+    const standalone = JSON.parse((await httpGet(baseUrl, `/api/ovens/standalone-oven?repoKey=${standaloneKey}`)).body).oven;
+    assert.deepEqual(forked.forkedFrom, forkedFrom);
+    assert.equal(Object.hasOwn(standalone, "forkedFrom"), false);
+  });
+  await withServer({
+    withBurnlist: true,
+    ovens: [{ id: "broken-oven", ovenJson: "{", repoPath: "fixture-repo" }],
+  }, async ({ baseUrl }) => {
+    const brokenKey = JSON.parse((await httpGet(baseUrl, "/api/burnlists")).body).burnlists
+      .find((entry) => entry.ovenId === "checklist").repoKey;
+    const response = await httpGet(baseUrl, "/api/ovens");
+    assert.equal(response.status, 200);
+    assert.equal(JSON.parse(response.body).ovens.some((oven) => oven.id === "broken-oven"), false);
+    const direct = await httpGet(baseUrl, `/api/ovens/broken-oven?repoKey=${brokenKey}`);
+    assert.equal(direct.status, 400);
+    assert.match(JSON.parse(direct.body).error, /lineage sidecar is invalid/u);
+  });
+});
+
+test("dashboard custom Oven storage follows its umbrella root and rejects symlink escapes", { timeout: 20_000 }, async () => {
+  await withServer({
+    withBurnlist: true,
+    launchCwd: "fixture-repo/work/nested",
+    ovensRoot: "fixture-repo",
+    ovens: [{ id: "umbrella-oven" }],
+  }, async ({ baseUrl }) => {
+    const response = await httpGet(baseUrl, "/api/ovens");
+    assert.equal(response.status, 200);
+    assert.equal(JSON.parse(response.body).ovens.some((oven) => oven.id === "umbrella-oven"), true);
+  });
+
+  await assert.rejects(() => withServer({
+    withBurnlist: true,
+    launchCwd: "fixture-repo",
+    setup: async ({ fixtureRoot }) => {
+      const repo = join(fixtureRoot, "fixture-repo");
+      const outside = join(fixtureRoot, "outside");
+      await mkdir(outside);
+      await symlink(outside, join(repo, ".local"), "dir");
+    },
+  }, async () => assert.fail("server must refuse an escaped custom Oven directory")), /escapes/u);
+
+  await withServer({
+    withBurnlist: true,
+    launchCwd: "fixture-repo",
+    setup: async ({ fixtureRoot }) => {
+      const ovens = join(fixtureRoot, "fixture-repo", ".local", "burnlist", "ovens");
+      const outside = join(fixtureRoot, "id-outside");
+      await mkdir(ovens, { recursive: true });
+      await mkdir(outside);
+      await symlink(outside, join(ovens, "escaped-oven"), "dir");
+    },
+  }, async ({ baseUrl, repoRoot }) => {
+    const direct = await httpGet(baseUrl, `/api/ovens/escaped-oven?repoKey=${repoKey(realpathSync(repoRoot))}`);
+    assert.equal(direct.status, 400);
+    assert.match(JSON.parse(direct.body).error, /escapes/u);
+  });
+});
+
+test("--ovens-dir applies only to the launch repository custom Ovens", { timeout: 20_000 }, async () => {
+  await withServer({
+    burnlists: [{ repoPath: "a" }, { repoPath: "b" }],
+    scanRoots: ["a", "b"],
+    launchCwd: "a",
+    ovens: [{ id: "b-local", repoPath: "b" }],
+    serverArgs: ["--ovens-dir", ".local/burnlist/launch-ovens"],
+    setup: async ({ fixtureRoot }) => {
+      const ovenRoot = join(fixtureRoot, "a", ".local", "burnlist", "launch-ovens", "a-override");
+      await mkdir(ovenRoot, { recursive: true });
+      await Promise.all([
+        writeFile(join(ovenRoot, "instructions.md"), "# A Override\n\nLaunch only.\n"),
+        writeFile(join(ovenRoot, "detail.json"), JSON.stringify(detailFixture())),
+      ]);
+    },
+  }, async ({ baseUrl }) => {
+    const ovens = JSON.parse((await httpGet(baseUrl, "/api/ovens")).body).ovens;
+    assert.equal(ovens.some((oven) => oven.id === "a-override"), true);
+    assert.equal(ovens.some((oven) => oven.id === "b-local"), true);
+  });
+});
diff --git a/src/server/oven-storage.mjs b/src/server/oven-storage.mjs
new file mode 100644
index 0000000..b54760f
--- /dev/null
+++ b/src/server/oven-storage.mjs
@@ -0,0 +1,104 @@
+import { lstatSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { repoStateDir } from "./repo-state.mjs";
+
+export const OVEN_INSTRUCTIONS_MAX_BYTES = 65_536;
+export const OVEN_DETAIL_MAX_BYTES = 131_072;
+export const OVEN_LINEAGE_MAX_BYTES = OVEN_DETAIL_MAX_BYTES;
+
+function isWithin(parent, child) {
+  const pathFromParent = relative(parent, child);
+  return pathFromParent === ""
+    || (pathFromParent !== ".." && !pathFromParent.startsWith(`..${sep}`) && !isAbsolute(pathFromParent));
+}
+
+function nearestRealPath(path) {
+  const suffix = [];
+  let current = resolve(path);
+  while (true) {
+    try {
+      return resolve(realpathSync(current), ...suffix.reverse());
+    } catch (error) {
+      if (error?.code !== "ENOENT") throw error;
+      const parent = dirname(current);
+      if (parent === current) throw error;
+      suffix.push(basename(current));
+      current = parent;
+    }
+  }
+}
+
+function optionalLstat(path) {
+  try {
+    return lstatSync(path);
+  } catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+function escapeError(root) {
+  return new Error(`Custom Oven storage escapes repo state ${repoStateDir(root)}.`);
+}
+
+export function assertCustomOvensDirContained(repoRoot, ovensDir) {
+  const repo = nearestRealPath(repoRoot);
+  const realState = nearestRealPath(repoStateDir(repoRoot));
+  const realOvens = nearestRealPath(ovensDir);
+  if (!isWithin(repo, realState) || !isWithin(realState, realOvens)) throw escapeError(repoRoot);
+  return ovensDir;
+}
+
+export function resolveCustomOvensDir(repoRoot, override, { unsafe = false } = {}) {
+  const ovensDir = override === undefined ? join(repoStateDir(repoRoot), "ovens") : resolve(repoRoot, override);
+  assertCustomOvensDir(repoRoot, ovensDir, { unsafe });
+  return ovensDir;
+}
+
+export function assertCustomOvensDir(repoRoot, ovensDir, { unsafe = false } = {}) {
+  const rootEntry = optionalLstat(ovensDir);
+  if (rootEntry && !rootEntry.isDirectory() && !rootEntry.isSymbolicLink()) {
+    throw new Error(`Custom Oven storage is not a directory: ${ovensDir}.`);
+  }
+  if (!unsafe) assertCustomOvensDirContained(repoRoot, ovensDir);
+  return ovensDir;
+}
+
+export function assertCustomOvenPath(repoRoot, ovensDir, id, { unsafe = false } = {}) {
+  const path = join(ovensDir, id);
+  assertCustomOvensDir(repoRoot, ovensDir, { unsafe });
+  const rootEntry = optionalLstat(ovensDir);
+  const ovenEntry = optionalLstat(path);
+  if (ovenEntry && !ovenEntry.isDirectory() && !ovenEntry.isSymbolicLink()) {
+    throw new Error(`Custom Oven ${id} is not a directory: ${path}.`);
+  }
+  if (rootEntry && ovenEntry) {
+    const realRoot = realpathSync(ovensDir);
+    const realOven = realpathSync(path);
+    if (!isWithin(realRoot, realOven)) throw new Error(`Custom Oven ${id} escapes ${ovensDir}.`);
+  }
+  return path;
+}
+
+export function serializeOvenPackage({ instructions, detail, sidecar } = {}) {
+  const files = {
+    "instructions.md": `${instructions}\n`,
+    "detail.json": `${JSON.stringify(detail, null, 2)}\n`,
+    ...(sidecar ? { "oven.json": `${JSON.stringify(sidecar, null, 2)}\n` } : {}),
+  };
+  assertOvenPackageFileLimits(files);
+  return files;
+}
+
+export function assertOvenPackageFileLimits(files) {
+  const limits = {
+    "instructions.md": OVEN_INSTRUCTIONS_MAX_BYTES,
+    "detail.json": OVEN_DETAIL_MAX_BYTES,
+    "oven.json": OVEN_LINEAGE_MAX_BYTES,
+  };
+  for (const [name, maxBytes] of Object.entries(limits)) {
+    if (files[name] === undefined) continue;
+    const bytes = Buffer.byteLength(files[name], "utf8");
+    if (bytes > maxBytes) throw new Error(`Oven ${name} is ${bytes} bytes, over the ${maxBytes} byte limit.`);
+  }
+}
diff --git a/src/server/oven-warm.mjs b/src/server/oven-warm.mjs
new file mode 100644
index 0000000..b4b8116
--- /dev/null
+++ b/src/server/oven-warm.mjs
@@ -0,0 +1,11 @@
+// Background Oven warming is opportunistic: data refresh failures must never
+// prevent startup or escape an interval callback.
+export function warmOvenHandler(handler, resolveBindings, createContext) {
+  try {
+    const ovenDataBindings = resolveBindings();
+    if (!ovenDataBindings.has(handler.id)) return;
+    handler.warm(createContext({ id: handler.id, ovenDataBindings }));
+  } catch {
+    // Request routes report data failures; background warming stays silent.
+  }
+}
diff --git a/src/server/oven-warm.test.mjs b/src/server/oven-warm.test.mjs
new file mode 100644
index 0000000..59b278b
--- /dev/null
+++ b/src/server/oven-warm.test.mjs
@@ -0,0 +1,9 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { warmOvenHandler } from "./oven-warm.mjs";
+
+test("warm guard swallows binding refresh and warm callback failures", () => {
+  const handler = { id: "sample-oven", warm() { throw new Error("unavailable"); } };
+  assert.doesNotThrow(() => warmOvenHandler(handler, () => { throw new Error("refresh failed"); }, () => ({})));
+  assert.doesNotThrow(() => warmOvenHandler(handler, () => new Map([[handler.id, [{ path: "/tmp/data.json", repoKey: null, repoRoot: null }]]]), () => ({})));
+});
diff --git a/src/server/projects-api.test.mjs b/src/server/projects-api.test.mjs
index a6b1c0e..777e8eb 100644
--- a/src/server/projects-api.test.mjs
+++ b/src/server/projects-api.test.mjs
@@ -68,6 +68,12 @@ test("/api/projects reports ids duplicated across lifecycle folders", { timeout:
     assert.equal(response.status, 200);
     const [project] = JSON.parse(response.body).projects;
     assert.deepEqual(project.ambiguousIds, ["repeated"]);
+    assert.deepEqual(project.entries.map((entry) => entry.planPath).sort(), [...fixture.planPaths].sort());
+    for (const entry of project.entries) {
+      const progress = await httpGet(fixture.baseUrl, `/api/progress?plan=${encodeURIComponent(entry.planPath)}`);
+      assert.equal(progress.status, 200);
+      assert.equal(JSON.parse(progress.body).planPath, entry.planPath);
+    }
   });
 });
 
diff --git a/src/server/run-routes.test.mjs b/src/server/run-routes.test.mjs
new file mode 100644
index 0000000..8ba2e6e
--- /dev/null
+++ b/src/server/run-routes.test.mjs
@@ -0,0 +1,87 @@
+import assert from "node:assert/strict";
+import { normalizeOvenPackage, ovenRevision } from "../ovens/oven-contract.mjs";
+import test from "node:test";
+import { detailFixture, httpGet, httpRequest, withServer } from "./dashboard-routes-fixtures.mjs";
+test("Burn runs read legacy v3 revisions and write/read v4 revisions", { timeout: 20_000 }, async () => {
+  const legacyInstructions = "# Legacy Oven\n\nFollow the checklist.\n";
+  const legacyDetail = detailFixture();
+  const expectedLegacyRevision = ovenRevision(normalizeOvenPackage({
+    id: "legacy-oven",
+    instructions: legacyInstructions,
+    detail: legacyDetail,
+  }));
+  const legacyRunId = "20260714-120000-a1b2c3";
+  const unsupportedRunId = "20260714-120001-a1b2c4";
+  const matchingV4RunId = "20260714-120002-a1b2c5";
+  const mismatchedV4RunId = "20260714-120003-a1b2c6";
+  await withServer({
+    runs: [
+      { id: legacyRunId, schemaVersion: 3, ovenId: "legacy-oven", instructions: legacyInstructions, detail: legacyDetail },
+      { id: unsupportedRunId, schemaVersion: 99, ovenId: "legacy-oven", instructions: legacyInstructions, detail: legacyDetail },
+      { id: matchingV4RunId, schemaVersion: 4, ovenId: "legacy-oven", instructions: legacyInstructions, detail: legacyDetail, ovenRevision: expectedLegacyRevision },
+      { id: mismatchedV4RunId, schemaVersion: 4, ovenId: "legacy-oven", instructions: legacyInstructions, detail: legacyDetail, ovenRevision: `o1-sha256:${"f".repeat(64)}` },
+    ],
+  }, async ({ baseUrl, repoRoot }) => {
+    const legacy = JSON.parse((await httpGet(baseUrl, `/api/runs/${legacyRunId}`)).body).run;
+    assert.equal(legacy.schemaVersion, 3);
+    assert.equal(legacy.ovenRevision, expectedLegacyRevision);
+    const matchingV4 = await httpGet(baseUrl, `/api/runs/${matchingV4RunId}`);
+    assert.equal(matchingV4.status, 200);
+    assert.equal(JSON.parse(matchingV4.body).run.ovenRevision, expectedLegacyRevision);
+    const mismatchedV4 = await httpGet(baseUrl, `/api/runs/${mismatchedV4RunId}`);
+    assert.equal(mismatchedV4.status, 400);
+    assert.match(JSON.parse(mismatchedV4.body).error, /revision does not match its snapshot/u);
+    const unsupported = await httpGet(baseUrl, `/api/runs/${unsupportedRunId}`);
+    assert.equal(unsupported.status, 400);
+    assert.match(JSON.parse(unsupported.body).error, /schemaVersion must be 3 or 4/u);
+
+    const ovens = JSON.parse((await httpGet(baseUrl, "/api/ovens")).body);
+    const created = await httpRequest(baseUrl, "/api/runs", {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-burnlist-token": ovens.writeToken,
+      },
+      body: JSON.stringify({ ovenId: "checklist", ovenRepoKey: null, repoRoot, title: "Current run", objective: "Verify revision pinning." }),
+    });
+    assert.equal(created.status, 201);
+    const current = JSON.parse(created.body).run;
+    assert.equal(current.schemaVersion, 4);
+    assert.equal(current.ovenRepoKey, null);
+    assert.match(current.ovenRevision, /^o1-sha256:[a-f0-9]{64}$/u);
+    const reread = JSON.parse((await httpGet(baseUrl, `/api/runs/${current.id}`)).body).run;
+    assert.equal(reread.ovenRevision, current.ovenRevision);
+  });
+});
+
+test("Burn runs read max-size normalized v4 Oven snapshots", { timeout: 20_000 }, async () => {
+  const maxText = (length) => "\u0800".repeat(length);
+  const instructions = `# ${maxText(65534)}`;
+  const detail = {
+    version: 1, columns: 24, rows: 32, rowHeight: 120,
+    cells: Array.from({ length: 32 }, (_, index) => ({
+      id: `section-${String(index).padStart(2, "0")}-${"a".repeat(37)}`,
+      title: maxText(80), description: maxText(2000), widget: "comparison",
+      source: `/${maxText(159)}`, format: "timestamp",
+      column: (index % 24) + 1, row: Math.floor(index / 24) + 1, columnSpan: 1, rowSpan: 1,
+    })),
+  };
+  const oven = normalizeOvenPackage({ id: "max-size-oven", instructions, detail });
+  const instructionsSnapshot = `${oven.instructions}\n`;
+  const detailSnapshot = `${JSON.stringify(oven.detail, null, 2)}\n`;
+  assert.ok(Buffer.byteLength(instructionsSnapshot) > 65536);
+  assert.ok(Buffer.byteLength(detailSnapshot) > 131072);
+  assert.ok(Buffer.byteLength(instructionsSnapshot) <= 262144);
+  assert.ok(Buffer.byteLength(detailSnapshot) <= 393216);
+  const id = "20260714-120004-a1b2c7";
+  await withServer({
+    runs: [{
+      id, schemaVersion: 4, ovenId: oven.id, instructions: oven.instructions, detail: oven.detail,
+      ovenRevision: ovenRevision(oven), instructionsSnapshot, detailSnapshot,
+    }],
+  }, async ({ baseUrl }) => {
+    const response = await httpGet(baseUrl, `/api/runs/${id}`);
+    assert.equal(response.status, 200);
+    assert.equal(JSON.parse(response.body).run.ovenRevision, ovenRevision(oven));
+  });
+});