diff --git a/cmd/flue/main.go b/cmd/flue/main.go
index a07d806..bcca7c7 100644
--- a/cmd/flue/main.go
+++ b/cmd/flue/main.go
@@ -111,6 +111,7 @@ const usageText = `flue — your terminal, as a browser tab
   flue relay status       show the configured relay
   flue relay update       redeploy this release's relay; secret and pairings kept
   flue relay address URL  repoint this machine at a custom domain on the same relay
+  flue relay reset        empty the relay's fleet directory; the fleet republishes
   flue open [path]        spawn a session in path and open it in the browser
   flue serve [--port N] [--open]   run the daemon in the foreground
   flue update             download the newest release, swap this binary, restart the daemon
@@ -411,17 +412,63 @@ func startRelay(ctx context.Context, srv *daemon.Server, identity daemon.Identit
 			return false
 		}
 	}
-	cfg := relay.Config{URL: rc.URL, Secret: rc.Secret, Origin: rc.Origin, MachineID: rc.MachineID, FleetPub: fleetKey.Public()}
+	cfg := relay.Config{
+		URL:         rc.URL,
+		Secret:      rc.Secret,
+		Origin:      rc.Origin,
+		MachineID:   rc.MachineID,
+		MachineCert: rc.MachineCert,
+		FleetPub:    fleetKey.Public(),
+	}
 	t, err := relay.New(cfg, srv, identity.Key, identity.Devices, logger)
 	if err != nil {
 		logger.Warn("relay not started", "err", err)
 		return false
 	}
+	// The directory leg, beside the hub leg and independent of it: one keeps
+	// this machine's browsers connected, the other keeps this machine's idea
+	// of who the fleet trusts up to date (spec/fleet-trust.md, "The fleet
+	// directory"). It is started here rather than inside the transport
+	// because neither needs the other — a daemon whose hub socket is down
+	// still has to hear a revocation, and one whose directory is down still
+	// serves every device paired to it.
+	//
+	// A directory this daemon cannot build is a warning and nothing more, for
+	// the reason every fault in this function is: flue's promise is a terminal
+	// in a browser tab, and the fleet is what makes that tab openable from the
+	// next machine along.
+	dir, err := relay.NewDirectory(cfg, srv, identity.Key, identity.Devices, logger)
+	if err != nil {
+		logger.Warn("fleet directory not started", "err", err)
+	} else {
+		// Installed before the goroutine, so a pairing or a revoke that
+		// happens while the first dial is still in flight is queued rather
+		// than lost.
+		srv.SetFleetPublisher(dir)
+		srv.SetDirectoryCounts(func() daemon.DirectoryCounts {
+			c := dir.Counts()
+			return daemon.DirectoryCounts(c)
+		})
+		go func() {
+			if err := dir.Run(ctx); err != nil {
+				logger.Warn("fleet directory stopped", "err", err)
+			}
+		}()
+	}
 	// The machine's identity rides every welcome alongside the status, so the
 	// UI can build /client/<id> URLs for this machine. It is configuration
 	// rather than socket state, which is why it is set here — once, by the
 	// process that read relay.json — and not by the transport's callbacks.
 	srv.SetRelayMachine(rc.MachineID, rc.MachineName)
+	// And the origin, for the Content-Security-Policy this daemon serves its own
+	// UI under. A loopback tab talks to the relay for everything that is not
+	// this machine — `wss://<relay>/client/<id>` per sibling machine, and
+	// `https://<relay>/directory` to learn which siblings exist — and neither is
+	// covered by `'self'`. Set from relay.json rather than from the transport's
+	// status because a document's policy is fixed when it is served, and a tab
+	// opened while the relay is still dialling still has to be allowed to reach
+	// it (daemon.LocalCSPFor).
+	srv.SetRelayOrigin(rc.Origin)
 	// Before the goroutine, never after it. The transport reports this itself
 	// the moment it starts dialling, and this only covers the window before it
 	// is scheduled — but a seed written *after* the goroutine started races the
diff --git a/cmd/flue/main_test.go b/cmd/flue/main_test.go
index 4d76f6f..9522986 100644
--- a/cmd/flue/main_test.go
+++ b/cmd/flue/main_test.go
@@ -1297,16 +1297,27 @@ func TestStatusReportsAConfiguredRelayWithoutItsSecret(t *testing.T) {
 func TestStartRelayDialsAConfiguredRelay(t *testing.T) {
 	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
 
-	var attempts atomic.Int64
-	var auth, path atomic.Value
+	// Both legs dial the same host, so what is recorded is per path: the hub
+	// leg at /daemon/<id> and the fleet directory at /directory. Recording a
+	// single "last dial" would be a race between two goroutines that both
+	// start here.
+	var mu sync.Mutex
+	dialed := map[string]string{} // path -> Authorization
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		auth.Store(r.Header.Get("Authorization"))
-		path.Store(r.URL.Path)
-		attempts.Add(1)
+		mu.Lock()
+		dialed[r.URL.Path] = r.Header.Get("Authorization")
+		mu.Unlock()
 		http.Error(w, "unauthorized", http.StatusUnauthorized)
 	}))
 	defer ts.Close()
 
+	sawDial := func(path string) (string, bool) {
+		mu.Lock()
+		defer mu.Unlock()
+		auth, ok := dialed[path]
+		return auth, ok
+	}
+
 	const secret = "s3cr3t-daemon-secret"
 	if err := config.SaveRelay(config.Relay{
 		URL:         "ws" + strings.TrimPrefix(ts.URL, "http"),
@@ -1336,20 +1347,26 @@ func TestStartRelayDialsAConfiguredRelay(t *testing.T) {
 	defer cancel()
 	startRelay(ctx, srv, id)
 
-	deadline := time.Now().Add(3 * time.Second)
-	for attempts.Load() == 0 {
-		if time.Now().After(deadline) {
-			t.Fatal("the daemon never dialled the configured relay")
+	// One relay.json, two legs: the hub the browsers arrive on, and the fleet
+	// directory the revocations arrive on. The machine id from relay.json
+	// rides the hub path — it is how the Worker knows which machine's hub this
+	// socket is — and the directory has no id in its path at all, because one
+	// relay is one fleet.
+	for _, want := range []string{"/daemon/karns-macbook-pro-a1b2-0f9a12cd", "/directory"} {
+		deadline := time.Now().Add(3 * time.Second)
+		for {
+			auth, ok := sawDial(want)
+			if ok {
+				if auth != "Bearer "+secret {
+					t.Errorf("Authorization on %s = %q, want %q", want, auth, "Bearer "+secret)
+				}
+				break
+			}
+			if time.Now().After(deadline) {
+				t.Fatalf("the daemon never dialled %s", want)
+			}
+			time.Sleep(5 * time.Millisecond)
 		}
-		time.Sleep(5 * time.Millisecond)
-	}
-	if got, want := auth.Load().(string), "Bearer "+secret; got != want {
-		t.Errorf("Authorization = %q, want %q", got, want)
-	}
-	// The machine id from relay.json rides the dial path — it is how the
-	// Worker knows which machine's hub this socket is.
-	if got, want := path.Load().(string), "/daemon/karns-macbook-pro-a1b2-0f9a12cd"; got != want {
-		t.Errorf("dial path = %q, want %q", got, want)
 	}
 }
 
diff --git a/cmd/flue/relay.go b/cmd/flue/relay.go
index 7a3afa2..e5ddb73 100644
--- a/cmd/flue/relay.go
+++ b/cmd/flue/relay.go
@@ -3,12 +3,15 @@ package main
 import (
 	"bufio"
 	"context"
+	"crypto/ed25519"
 	"crypto/rand"
+	"encoding/json"
 	"errors"
 	"flag"
 	"fmt"
 	"io"
 	"io/fs"
+	"net/http"
 	"net/url"
 	"os"
 	"strconv"
@@ -18,9 +21,11 @@ import (
 
 	"github.com/karnstack/flue/internal/cloudflare"
 	"github.com/karnstack/flue/internal/config"
+	"github.com/karnstack/flue/internal/crypto"
 	"github.com/karnstack/flue/internal/daemon"
 	"github.com/karnstack/flue/internal/fleet"
 	"github.com/karnstack/flue/internal/relaydeploy"
+	"github.com/karnstack/flue/internal/transport/relay"
 	relaybundle "github.com/karnstack/flue/relay"
 	"github.com/karnstack/flue/web"
 )
@@ -69,7 +74,7 @@ const (
 // number, and EOF alone is not enough of a guarantee to rely on.
 const accountPromptAttempts = 3
 
-const relayUsage = "usage: flue relay <setup|join|status|update|address>"
+const relayUsage = "usage: flue relay <setup|join|status|update|address|reset>"
 
 func cmdRelay(args []string) error {
 	if len(args) == 0 {
@@ -88,6 +93,8 @@ func cmdRelay(args []string) error {
 		return runRelayUpdate(os.Stdout, os.Stdin, &cloudflare.Client{}, args[1:])
 	case "address":
 		return runRelayAddress(os.Stdout, args[1:])
+	case "reset":
+		return runRelayReset(os.Stdout, os.Stdin, args[1:])
 	default:
 		return fmt.Errorf("unknown relay subcommand %q; %s", args[0], relayUsage)
 	}
@@ -268,6 +275,9 @@ func runRelaySetup(w io.Writer, r io.Reader, api *cloudflare.Client, args []stri
 		AssetHeaders: relayAssetHeaders,
 		Version:      deployStamp(),
 		OnStep:       func(line string) { fmt.Fprintf(w, "  ✓ %s\n", line) },
+		// No tick: a note is something the deploy could not fix, and the same
+		// two-space indent every soft failure in this file already wears.
+		OnNote: func(line string) { fmt.Fprintf(w, "  %s\n", line) },
 	})
 	if err != nil {
 		return err
@@ -298,6 +308,17 @@ func runRelaySetup(w io.Writer, r io.Reader, api *cloudflare.Client, args []stri
 	machineID := config.MintMachineID(hostname, secret, rand.Reader)
 	machineName := truncateRunes(hostname, machineNameMaxRunes)
 
+	// The machine's own certificate, signed under the fleet key just minted:
+	// what the daemon publishes to the relay's fleet directory so every
+	// browser in the fleet can reach this machine without pairing to it
+	// (spec/fleet-trust.md, "The fleet directory"). Not fatal — a relay whose
+	// machines cannot be discovered still carries every device paired
+	// directly to them — and the line says which half is missing.
+	machineCert, err := mintMachineCert(fleetKey, machineID, machineName)
+	if err != nil {
+		fmt.Fprintf(w, "  could not mint this machine's fleet certificate (%v); other devices will not discover this machine\n", err)
+	}
+
 	// Last, deliberately. relay.json is what makes the daemon dial, and every
 	// step above can fail; writing it earlier would leave a daemon dialling a
 	// relay that was never finished. Re-running setup is the fix for anything
@@ -316,6 +337,7 @@ func runRelaySetup(w io.Writer, r io.Reader, api *cloudflare.Client, args []stri
 		Origin:      origin,
 		MachineID:   machineID,
 		MachineName: machineName,
+		MachineCert: machineCert,
 		Worker:      worker,
 	}); err != nil {
 		return fmt.Errorf("save the relay configuration: %w", err)
@@ -353,6 +375,47 @@ func runRelaySetup(w io.Writer, r io.Reader, api *cloudflare.Client, args []stri
 // a machine list rendering as a list.
 const machineNameMaxRunes = 64
 
+// mintMachineCert signs this machine's fleet machine certificate: the id it
+// holds on the relay, its display name, and the Noise static key every device
+// that reaches it must pin (spec/fleet-trust.md, Certificates).
+//
+// It is minted here — in the three commands that write relay.json — rather
+// than by the daemon, and the reason is the directory's shape rather than
+// convenience. The relay stores blobs by the hash of their own bytes, so a
+// cert re-minted at each start would carry a fresh `iat`, land under a fresh
+// key, and spend one of the directory's 512 entries every time the daemon
+// restarted. Minting it exactly where the facts it asserts are decided means
+// one blob, for the life of this machine's place on this relay.
+//
+// It reads (and, on a machine that has never served, creates) the daemon's
+// static key, which is the same key `flue serve` would load a moment later:
+// the cert has to name the key devices will actually meet, and a cert naming a
+// key that did not exist yet would be a browser pinning nothing.
+//
+// A failure is returned, not swallowed. Every caller treats it as "this
+// machine joins without a machine cert" and says so — the honest half of a
+// half-configured relay, exactly as `flue relay setup` already treats a fleet
+// key it cannot mint.
+func mintMachineCert(key fleet.Key, machineID, machineName string) ([]byte, error) {
+	if !key.Valid() {
+		return nil, fleet.ErrNoKey
+	}
+	dir, err := config.Dir()
+	if err != nil {
+		return nil, fmt.Errorf("locate the config directory: %w", err)
+	}
+	static, err := crypto.LoadOrCreateStaticKey(dir)
+	if err != nil {
+		return nil, fmt.Errorf("load the daemon static key: %w", err)
+	}
+	return key.Sign(fleet.MachineCert{
+		ID:    machineID,
+		Name:  machineName,
+		Noise: static.Public,
+		IAT:   time.Now().Unix(),
+	})
+}
+
 const relayJoinUsage = "usage: flue relay join <url> --secret <secret> --fleet <fleet key> [--name <label>]"
 
 // relayJoinDone mirrors relaySetupDone's restart note without the token line:
@@ -435,6 +498,17 @@ func runRelayJoin(w io.Writer, args []string) error {
 	// the daemon leg's 401 reports, found one dial later.
 	machineID := config.MintMachineID(hostname, *secret, rand.Reader)
 
+	// This machine's certificate under the fleet key that arrived on the join
+	// line — the artifact the daemon publishes so the fleet's browsers can
+	// find this machine at all (spec/fleet-trust.md, "New machine"). Its
+	// absence costs discovery and nothing else, so it is reported rather than
+	// fatal: a join that stopped here would leave a machine with no relay
+	// config over a convenience.
+	machineCert, err := mintMachineCert(fleetKey, machineID, machineName)
+	if err != nil {
+		fmt.Fprintf(w, "  could not mint this machine's fleet certificate (%v); other devices will not discover this machine\n", err)
+	}
+
 	// The same shape setup writes, derived the same way: bare wss:// URL, the
 	// https origin on the same host. SaveRelay is 0600 — the file holds the
 	// relay's whole credential, the fleet key now included. The seed is
@@ -448,6 +522,7 @@ func runRelayJoin(w io.Writer, args []string) error {
 		Origin:      "https://" + host,
 		MachineID:   machineID,
 		MachineName: machineName,
+		MachineCert: machineCert,
 	}); err != nil {
 		return fmt.Errorf("save the relay configuration: %w", err)
 	}
@@ -498,10 +573,372 @@ func truncateRunes(s string, n int) string {
 	return string(runes[:n])
 }
 
-// runRelayStatus prints what is configured, which is the same line flue status
-// carries — one answer, one place it is decided.
+// runRelayStatus prints what is configured — the same line `flue status`
+// carries, one answer decided in one place — and then asks the relay itself
+// about the fleet directory.
+//
+// The second line is why this command exists separately from `flue status`.
+// relayLine reports a file on disk and says so; the directory is the one part
+// of a fleet whose health cannot be read from any local file, and it is
+// readable from here without the daemon's help because `GET /directory` needs
+// no credential and its contents are signed. So a user asking "is my fleet
+// actually wired up" gets an answer that came from the relay, in a command
+// they ran on purpose — while `flue status`, which is printed on every
+// enable/disable and reads no network, stays local.
 func runRelayStatus(w io.Writer) error {
 	fmt.Fprintln(w, relayLine())
+	rc, ok, err := config.LoadRelay()
+	if err != nil || !ok {
+		// relayLine already said which of the two this is, in its own words.
+		return nil
+	}
+	fmt.Fprintln(w, directoryLine(rc))
+	return nil
+}
+
+// directoryLine is what the relay's fleet directory says about this fleet,
+// read live and verified locally.
+//
+// Verified is the number that means something. The relay hands out whatever it
+// is holding, so "entries" is the relay's claim; what a fleet key can check is
+// how many of those blobs it signed, and the breakdown after it is the fleet
+// as this machine's own key can prove it: machines, devices, revocations. A
+// gap between the two numbers is worth seeing — it is a rotated fleet key, or
+// a relay that is not the one this machine thinks it is.
+func directoryLine(rc config.Relay) string {
+	if rc.FleetSeed == "" {
+		// relayLine already names this as the fault that stops the daemon
+		// dialling at all; there is nothing this line could verify.
+		return "fleet:    unknown (this relay.json carries no fleet key)"
+	}
+	key, err := fleet.Parse(rc.FleetSeed)
+	if err != nil {
+		return "fleet:    unknown (the fleet key in relay.json cannot be parsed)"
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), relayStepTimeout)
+	defer cancel()
+	counts, err := fetchDirectory(ctx, rc, key.Public())
+	if err != nil {
+		// Named without the URL: relayLine printed it one line up.
+		return fmt.Sprintf("fleet:    unreachable (%v)", err)
+	}
+	line := fmt.Sprintf("fleet:    %s, %d verified under this fleet key",
+		plural(counts.Entries, "entry", "entries"), counts.Verified)
+	// Machines and revocations, which is what the directory carries. Device
+	// certificates are not published to it — they go to the device that owns
+	// them (spec/fleet-trust.md) — so a count of them here would read as "this
+	// fleet has no devices" when it means "the directory does not list them",
+	// which are different claims and only the second is true. It is still
+	// *counted*, because a non-zero value is a real signal.
+	//
+	// The line does not name a cause, because there is no honest one to name.
+	// No released flue has a fleet directory at all, so "an older flue is
+	// still publishing them" — which this line used to say — cannot ever be
+	// true; what is left is a build from between the two, or a hand-written
+	// PUT by whoever holds the daemon secret. Both deserve a look and neither
+	// is a diagnosis a status line can make from a count.
+	line += fmt.Sprintf(" (%s, %s)",
+		plural(counts.Machines, "machine", "machines"),
+		plural(counts.Revocations, "revocation", "revocations"))
+	if counts.Devices > 0 {
+		line += fmt.Sprintf("\n          %s in the directory; nothing in this fleet should be publishing one",
+			plural(counts.Devices, "device certificate", "device certificates"))
+	}
+	if counts.Entries != counts.Verified {
+		line += fmt.Sprintf("\n          %s signed by something else; this relay may belong to another fleet",
+			plural(counts.Entries-counts.Verified, "entry is", "entries are"))
+	}
+	line += capacityLine(counts.Entries)
+	if counts.MachineListed {
+		return line
+	}
+	return line + "\n          this machine is not in the directory: other devices will not discover it"
+}
+
+// capacityLine is the warning that the directory is filling up, or the flatter
+// statement that it is already full. Empty for a fleet with room, because a
+// status report that says "everything is fine" in three ways is one nobody
+// reads.
+//
+// It is here because the cap fails hard and silently. At MaxDirectoryEntries
+// the relay refuses every new blob — before storing it and therefore before
+// pushing it, so a revocation made past that point reaches nobody — and no
+// deploy, update or re-setup frees an entry. Without this line the first thing
+// an operator sees is a 507 in a daemon log after a revoke they believed had
+// crossed the fleet.
+func capacityLine(entries int) string {
+	switch {
+	case entries >= relay.MaxDirectoryEntries:
+		return fmt.Sprintf("\n          the directory is full (%d of %d): nothing new is distributed, not even a revocation. `flue relay reset` empties it and the fleet republishes",
+			entries, relay.MaxDirectoryEntries)
+	case entries >= relay.DirectoryWarnAt:
+		return fmt.Sprintf("\n          the directory is %d of %d entries full; at %d nothing new is distributed, not even a revocation. `flue relay reset` empties it and the fleet republishes",
+			entries, relay.MaxDirectoryEntries, relay.MaxDirectoryEntries)
+	default:
+		return ""
+	}
+}
+
+// plural is the one-or-many spelling of a count. The status report is prose a
+// person reads, and "1 machines" is the kind of thing that makes a tool look
+// like it is guessing.
+func plural(n int, one, many string) string {
+	if n == 1 {
+		return fmt.Sprintf("%d %s", n, one)
+	}
+	return fmt.Sprintf("%d %s", n, many)
+}
+
+// directoryCounts is what one read of the directory found.
+type directoryCounts struct {
+	Entries     int
+	Verified    int
+	Machines    int
+	Devices     int
+	Revocations int
+	// MachineListed is whether one of the verified machine certs names this
+	// machine's id — the difference between "the fleet is fine" and "the fleet
+	// is fine and cannot see me".
+	MachineListed bool
+}
+
+// fetchDirectory reads `GET /directory` and verifies every entry under pub.
+//
+// It presents the daemon secret even though the route is credential-less, for
+// the reason the daemon's own reader does: the Worker meters exactly the
+// callers that present none, and that budget exists for browsers.
+func fetchDirectory(ctx context.Context, rc config.Relay, pub ed25519.PublicKey) (directoryCounts, error) {
+	var out directoryCounts
+	url := directoryURL(rc.URL)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return out, err
+	}
+	if rc.Secret != "" {
+		req.Header.Set("Authorization", "Bearer "+rc.Secret)
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return out, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		if resp.StatusCode == http.StatusServiceUnavailable {
+			// The Worker's own answer for a deploy that predates the directory
+			// binding (relay/src/index.ts). Naming it is worth a sentence: the
+			// fix is `flue relay update`, not anything about this machine.
+			return out, errors.New("this relay has no directory; run `flue relay update` to redeploy it")
+		}
+		return out, fmt.Errorf("the relay answered HTTP %d", resp.StatusCode)
+	}
+	var doc struct {
+		Entries []struct {
+			Blob []byte `json:"blob"`
+		} `json:"entries"`
+	}
+	// The same ceiling the daemon reads under: a status command must not be an
+	// unbounded read from a machine on the internet either.
+	if err := json.NewDecoder(io.LimitReader(resp.Body, maxDirectoryRead)).Decode(&doc); err != nil {
+		return out, errors.New("the relay answered something that is not a directory")
+	}
+	out.Entries = len(doc.Entries)
+	for _, e := range doc.Entries {
+		cert, err := fleet.Verify(pub, e.Blob)
+		if err != nil {
+			continue
+		}
+		out.Verified++
+		switch c := cert.(type) {
+		case fleet.MachineCert:
+			out.Machines++
+			if c.ID == rc.MachineID {
+				out.MachineListed = true
+			}
+		case fleet.DeviceCert:
+			out.Devices++
+		case fleet.Revocation:
+			out.Revocations++
+		}
+	}
+	return out, nil
+}
+
+// maxDirectoryRead bounds the body this command will parse: the directory's
+// own ceiling (512 entries of 4 KiB) in base64, with room to spare.
+const maxDirectoryRead = 4 << 20
+
+// directoryURL is `/directory` on the host relay.json dials, as HTTP.
+//
+// Derived from the socket URL rather than from Origin, the same way the
+// daemon's own directory leg derives it: the directory to ask about a fleet is
+// the one attached to the relay this machine dials, and a half-edited
+// relay.json should not be able to send the question somewhere else. ws is
+// handled beside wss because a local relay under `pnpm dev` is spelled that
+// way.
+func directoryURL(relayURL string) string {
+	base := strings.TrimRight(relayURL, "/")
+	switch {
+	case strings.HasPrefix(base, "wss://"):
+		base = "https://" + strings.TrimPrefix(base, "wss://")
+	case strings.HasPrefix(base, "ws://"):
+		base = "http://" + strings.TrimPrefix(base, "ws://")
+	}
+	return base + "/directory"
+}
+
+// resetDirectory empties the relay's fleet directory: `DELETE /directory` under
+// the daemon secret, which wipes every blob and the entry count with it and
+// closes the push sockets so each daemon reconnects and re-publishes at once.
+//
+// The secret is the whole credential here, as it is on a PUT. The relay holds
+// no fleet key and can judge no blob, so what it can gate is who may *write*,
+// and emptying the store is the largest write there is.
+func resetDirectory(ctx context.Context, rc config.Relay) (removed int, err error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodDelete, directoryURL(rc.URL), nil)
+	if err != nil {
+		return 0, err
+	}
+	req.Header.Set("Authorization", "Bearer "+rc.Secret)
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return 0, err
+	}
+	defer resp.Body.Close()
+	switch resp.StatusCode {
+	case http.StatusOK:
+	case http.StatusUnauthorized:
+		return 0, errors.New("the relay refused this machine's credential; the secret in relay.json is not the one this Worker holds")
+	case http.StatusServiceUnavailable:
+		// The Worker's own answer for a deploy that predates the directory
+		// binding (relay/src/index.ts), and the same sentence fetchDirectory
+		// gives it: there is nothing to reset because there is nothing there.
+		return 0, errors.New("this relay has no directory; run `flue relay update` to redeploy it")
+	default:
+		return 0, fmt.Errorf("the relay answered HTTP %d", resp.StatusCode)
+	}
+	var doc struct {
+		Reset   bool `json:"reset"`
+		Removed int  `json:"removed"`
+	}
+	// A small, fixed-shape answer, read under a bound for the reason every
+	// other read of this relay is: the far end is a machine on the internet and
+	// this process is not obliged to trust its brevity.
+	if err := json.NewDecoder(io.LimitReader(resp.Body, 1<<10)).Decode(&doc); err != nil || !doc.Reset {
+		return 0, errors.New("the relay answered something that is not a directory reset")
+	}
+	return doc.Removed, nil
+}
+
+const relayResetUsage = "usage: flue relay reset [--yes]"
+
+// relayResetWarning is what the command says before it asks. Both halves are
+// load-bearing: the first is why an operator would ever run this, the second is
+// the one thing a wipe can cost that re-publishing does not put back.
+const relayResetWarning = `this empties the relay's fleet directory: every machine certificate
+and every revocation the relay is holding.
+
+every machine re-publishes everything it holds when it reconnects, so a
+fleet that is switched on refills the directory within seconds. what does
+not come back is a blob whose only remaining holder never reconnects —
+in practice a revocation published by a machine that is now gone. every
+machine that already heard that revocation still holds it and re-publishes
+it; if you are unsure, revoke the device again from any machine afterwards.
+
+`
+
+// relayResetDone is the note after the wipe: what happens next, without the
+// user having to know that publishAll runs on every connect.
+const relayResetDone = `
+the directory is empty. every connected machine was disconnected from it and
+re-publishes what it holds on reconnect, so it refills on its own; a machine
+that is switched off refills its share when it next starts.
+`
+
+// runRelayReset empties the relay's fleet directory — the escape hatch for a
+// full one, and the only one there is.
+//
+// It exists because the directory refuses a 513th entry rather than evicting
+// (relay/src/directory.ts, full), nothing there ever deletes a single entry,
+// and Durable Object storage outlives every redeploy: neither `flue relay
+// update` nor a fresh `flue relay setup` against a new script name reaches it.
+// A directory that has filled up therefore stays full forever, and a full
+// directory is a fleet whose *revocations* stop crossing machines — the one
+// failure mode in this design that costs more than visibility. So there has to
+// be a way to empty it, and this is it.
+//
+// It is a wipe rather than a prune, and that is not laziness — nor is it a
+// judgement that a prune would be unsafe. There is next to nothing to prune:
+// a revocation is never superseded, a device certificate is not in the store
+// at all, and what is left is a machine certificate a machine re-minted, which
+// is single digits out of 512 over a fleet's whole life (spec/fleet-trust.md
+// works the count). Removing any *named* entry would mean the relay reading
+// the blobs, or checking a signature over the digests, and both give this leg
+// an opinion about what it holds. Deleting all of them needs no opinion about
+// any of them.
+//
+// The confirmation is a typed "yes" rather than a flag alone, because the one
+// unrecoverable case — a revocation whose last holder never reconnects — is not
+// something a person should meet by autocompleting a command. --yes is there
+// for the scripted path.
+//
+// **Why `flue relay setup` does not do this too, having been asked.** It has a
+// claim to: a re-setup mints a fresh fleet key, which turns every blob already
+// in the directory into a signature no machine in the new fleet can verify —
+// dead weight against a 512-entry cap that nothing else ever frees. But setup
+// would have to send this request in the seconds after it enabled the
+// workers.dev subdomain and bound a *new* secret, and neither of those is live
+// at the edge the moment the API accepts it: the reset would be racing two
+// propagations at once, so it would fail often, on the one command a user runs
+// before they have any idea what a fleet directory is, and it would fail
+// loudest on a first deploy where there was nothing to clear. A step that
+// unreliable is worse than a separate command that always works. So this is the
+// separate command, `flue relay status` says when it is needed, and
+// docs/RELAY.md names it as the way out.
+func runRelayReset(w io.Writer, r io.Reader, args []string) error {
+	fs := flag.NewFlagSet("relay reset", flag.ContinueOnError)
+	fs.SetOutput(io.Discard)
+	yes := fs.Bool("yes", false, "do not ask for confirmation")
+	if err := fs.Parse(args); err != nil {
+		return fmt.Errorf("%w; %s", err, relayResetUsage)
+	}
+	if fs.NArg() != 0 {
+		return fmt.Errorf("unexpected argument %q; %s", fs.Arg(0), relayResetUsage)
+	}
+
+	cfg, ok, err := config.LoadRelay()
+	if err != nil {
+		return err
+	}
+	if !ok {
+		return errors.New("no relay is configured on this machine; `flue relay setup` deploys one first")
+	}
+	if cfg.Secret == "" {
+		// The daemon secret is the whole credential on this route. Said here
+		// rather than met as a 401 from a relay that is not at fault.
+		return errors.New("relay.json carries no daemon secret; re-run the join line printed by `flue relay setup`")
+	}
+
+	if !*yes {
+		fmt.Fprint(w, relayResetWarning)
+		fmt.Fprint(w, "type yes to continue: ")
+		line, readErr := bufio.NewReader(r).ReadString('\n')
+		if readErr != nil && !errors.Is(readErr, io.EOF) {
+			return fmt.Errorf("read the confirmation: %w", readErr)
+		}
+		if strings.TrimSpace(line) != "yes" {
+			fmt.Fprintln(w, "  nothing was reset")
+			return nil
+		}
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), relayStepTimeout)
+	defer cancel()
+	removed, err := resetDirectory(ctx, cfg)
+	if err != nil {
+		return fmt.Errorf("reset the fleet directory: %w", err)
+	}
+	fmt.Fprintf(w, "  ✓ fleet directory reset (%s cleared)\n", plural(removed, "entry", "entries"))
+	fmt.Fprint(w, relayResetDone)
 	return nil
 }
 
@@ -597,6 +1034,12 @@ func runRelayUpdate(w io.Writer, r io.Reader, api *cloudflare.Client, args []str
 		Assets:       assets,
 		AssetHeaders: relayAssetHeaders,
 		Version:      deployStamp(),
+		// OnStep is deliberately unset — this command prints its own ✓ lines
+		// in its own words — but a note must not go with it: this is the
+		// command that meets a relay deployed by a newer flue, and the whole
+		// point of the note is that the 10061 which follows says nothing about
+		// why.
+		OnNote: func(line string) { fmt.Fprintf(w, "  %s\n", line) },
 	}); err != nil {
 		return err
 	}
diff --git a/cmd/flue/relay_test.go b/cmd/flue/relay_test.go
index 0e13da4..dda63f3 100644
--- a/cmd/flue/relay_test.go
+++ b/cmd/flue/relay_test.go
@@ -14,6 +14,7 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"reflect"
 	"regexp"
 	"strings"
 	"sync"
@@ -21,8 +22,10 @@ import (
 
 	"github.com/karnstack/flue/internal/cloudflare"
 	"github.com/karnstack/flue/internal/config"
+	"github.com/karnstack/flue/internal/crypto"
 	"github.com/karnstack/flue/internal/daemon"
 	"github.com/karnstack/flue/internal/fleet"
+	"github.com/karnstack/flue/internal/transport/relay"
 	relaybundle "github.com/karnstack/flue/relay"
 	"github.com/karnstack/flue/web"
 )
@@ -66,6 +69,7 @@ type wireMetadata struct {
 	} `json:"bindings"`
 	KeepBindings []string `json:"keep_bindings"`
 	Migrations   *struct {
+		OldTag string `json:"old_tag"`
 		NewTag string `json:"new_tag"`
 		Steps  []struct {
 			NewSQLiteClasses []string `json:"new_sqlite_classes"`
@@ -113,10 +117,16 @@ type fakeCloudflare struct {
 	secretType       string
 	subdomainEnabled bool
 	scriptPuts       int
-	// migrated records that the Durable Object migration has been applied, so
-	// that a second deploy is refused the way the real API refuses one. This is
-	// what a re-run of `flue relay setup` actually meets.
-	migrated bool
+	// migrationTag is what the account's copy of the script carries, exactly
+	// as the real API reports it on the script list — empty until a deploy
+	// applies a migration, and then whatever that migration's new_tag was.
+	//
+	// Modelling it is what makes a re-run of `flue relay setup` behave here the
+	// way it does in production: the client reads this tag first and sends no
+	// migration when there is nothing outstanding, so the already-applied
+	// refusal below is reached only when a deploy insists on a migration the
+	// tag says is done.
+	migrationTag string
 }
 
 func newFakeCloudflare(t *testing.T, accounts []cloudflare.Account, subdomain string) *fakeCloudflare {
@@ -178,6 +188,18 @@ func (f *fakeCloudflare) route(w http.ResponseWriter, r *http.Request) {
 		writeResult(w, map[string]bool{"enabled": true})
 	case strings.HasSuffix(p, "/workers/subdomain"):
 		writeResult(w, map[string]string{"subdomain": f.subdomain})
+	case strings.HasSuffix(p, "/workers/scripts"):
+		// The account's script list, which is where the deploy reads the
+		// migration tag from. An account that has never been deployed to
+		// answers an empty list.
+		f.mu.Lock()
+		tag := f.migrationTag
+		f.mu.Unlock()
+		if tag == "" {
+			writeResult(w, []any{})
+			return
+		}
+		writeResult(w, []any{map[string]string{"id": f.script, "migration_tag": tag}})
 	case strings.HasSuffix(p, "/scripts/"+f.script):
 		f.putScript(w, r, body)
 	default:
@@ -272,9 +294,17 @@ func (f *fakeCloudflare) putScript(w http.ResponseWriter, r *http.Request, body
 
 	f.mu.Lock()
 	f.scriptPuts++
-	repeat := f.migrated && f.meta.Migrations != nil
+	// The precondition the real API enforces: a migration is applied only if
+	// the script's tag is the one the request claims it is. old_tag empty means
+	// "this script has no migration history", which is false the moment one has
+	// been applied.
+	claimed, carried := "", f.migrationTag
 	if f.meta.Migrations != nil {
-		f.migrated = true
+		claimed = f.meta.Migrations.OldTag
+	}
+	repeat := f.meta.Migrations != nil && claimed != carried
+	if f.meta.Migrations != nil && !repeat {
+		f.migrationTag = f.meta.Migrations.NewTag
 	}
 	keepsSecrets := false
 	for _, k := range f.meta.KeepBindings {
@@ -284,12 +314,15 @@ func (f *fakeCloudflare) putScript(w http.ResponseWriter, r *http.Request, body
 	}
 	f.mu.Unlock()
 	if repeat {
-		// The refusal the real API actually sends on a re-deploy, verbatim
-		// from the first live `flue relay update` (error 10079). An earlier
-		// fake used a "class … already depended on" wording that the real
-		// API apparently reserves for other cases; the matcher missed this
-		// one in production, so the fake now speaks the observed dialect.
-		writeAPIErrorCode(w, 10079, "Actor migration tag precondition failed, got tag '' when expected tag is 'v1'. Please make sure the tags match and try again.")
+		// The refusal the real API actually sends when the precondition does
+		// not hold, verbatim from the first live `flue relay update` (error
+		// 10079). An earlier fake used a "class … already depended on" wording
+		// that the real API apparently reserves for other cases; the matcher
+		// missed this one in production, so the fake speaks the observed
+		// dialect. Both tags are named the way the real message names them.
+		writeAPIErrorCode(w, 10079, fmt.Sprintf(
+			"Actor migration tag precondition failed, got tag '%s' when expected tag is '%s'. Please make sure the tags match and try again.",
+			claimed, carried))
 		return
 	}
 
@@ -489,13 +522,19 @@ func TestRunRelaySetupDeploysTheWorkerAndTheWebApp(t *testing.T) {
 	// running: without the ASSETS binding every /api/* fallthrough calls fetch
 	// on undefined, and without observability there are no logs to find out
 	// with. Both are silent in a deploy that otherwise reports success.
-	var gotAssets, gotHub, gotVersion, gotRate bool
+	var gotAssets, gotHub, gotDirectory, gotVersion, gotRate bool
 	for _, b := range f.meta.Bindings {
 		switch {
 		case b.Type == "assets" && b.Name == "ASSETS":
 			gotAssets = true
 		case b.Type == "durable_object_namespace" && b.Name == "HUB" && b.ClassName == "DaemonHub":
 			gotHub = true
+		case b.Type == "durable_object_namespace" && b.Name == "DIRECTORY" && b.ClassName == "FleetDirectory":
+			// The fleet directory: one object for the whole relay. Without the
+			// binding the Worker answers /directory with 503 by design, which
+			// is a relay that carries every session and no fleet — no machine
+			// discovery, and no revocation reaching a second machine.
+			gotDirectory = true
 		case b.Type == "plain_text" && b.Name == "FLUE_VERSION" && b.Text == deployStamp():
 			// The version stamp: what the Worker reports on /api/health, and
 			// what lets a daemon see a relay older than itself.
@@ -519,6 +558,9 @@ func TestRunRelaySetupDeploysTheWorkerAndTheWebApp(t *testing.T) {
 	if !gotHub {
 		t.Fatalf("no HUB -> DaemonHub durable object binding in %+v", f.meta.Bindings)
 	}
+	if !gotDirectory {
+		t.Fatalf("no DIRECTORY -> FleetDirectory durable object binding in %+v; the deployed relay would answer /directory with 503 and no revocation would ever reach a second machine", f.meta.Bindings)
+	}
 	if !gotRate {
 		t.Fatalf("no CLIENT_RATE ratelimit binding in %+v; the deployed relay would serve its credential-less routes unmetered", f.meta.Bindings)
 	}
@@ -533,15 +575,29 @@ func TestRunRelaySetupDeploysTheWorkerAndTheWebApp(t *testing.T) {
 		t.Fatalf("keep_bindings = %v, want [secret_text]; this deploy would unbind %s", f.meta.KeepBindings, daemonSecretName)
 	}
 
-	if f.meta.Migrations == nil || len(f.meta.Migrations.Steps) != 1 ||
-		len(f.meta.Migrations.Steps[0].NewSQLiteClasses) != 1 ||
-		f.meta.Migrations.Steps[0].NewSQLiteClasses[0] != "DaemonHub" {
-		t.Fatalf("migrations = %+v, want one step introducing the SQLite class DaemonHub", f.meta.Migrations)
+	// A first deploy into an empty account applies the whole history, in
+	// order, and claims no precondition: the two SQLite classes this relay
+	// runs on (spec/fleet-trust.md gives the second one its own tag, because
+	// v1 is already applied on every relay deployed before the directory
+	// existed and an applied migration cannot be edited).
+	if f.meta.Migrations == nil {
+		t.Fatal("no durable object migration was sent; neither class would exist")
+	}
+	if f.meta.Migrations.OldTag != "" {
+		t.Fatalf("old_tag = %q on a first deploy, want none", f.meta.Migrations.OldTag)
+	}
+	if f.meta.Migrations.NewTag != "v2" {
+		t.Fatalf("new_tag = %q, want v2", f.meta.Migrations.NewTag)
+	}
+	if len(f.meta.Migrations.Steps) != 2 ||
+		!slicesEqual(f.meta.Migrations.Steps[0].NewSQLiteClasses, []string{"DaemonHub"}) ||
+		!slicesEqual(f.meta.Migrations.Steps[1].NewSQLiteClasses, []string{"FleetDirectory"}) {
+		t.Fatalf("migrations = %+v, want v1 introducing DaemonHub then v2 introducing FleetDirectory", f.meta.Migrations)
 	}
 	if f.meta.Assets == nil {
 		t.Fatal("no assets attached to the script")
 	}
-	if got, want := f.meta.Assets.Config.RunWorkerFirst, []string{"/daemon", "/daemon/*", "/client", "/client/*", "/api/*"}; !slicesEqual(got, want) {
+	if got, want := f.meta.Assets.Config.RunWorkerFirst, []string{"/daemon", "/daemon/*", "/client", "/client/*", "/api/*", "/directory", "/directory/*"}; !slicesEqual(got, want) {
 		t.Fatalf("run_worker_first = %v, want %v", got, want)
 	}
 
@@ -605,6 +661,22 @@ func TestRunRelaySetupDeploysTheWorkerAndTheWebApp(t *testing.T) {
 		t.Fatalf("the fleet key should be in relay.json and nowhere else, got %v", hits)
 	}
 
+	// And the first thing that key signs: this machine's own certificate,
+	// which the daemon publishes to the relay's fleet directory so the rest of
+	// the fleet's browsers can find it. Setup is where it is minted, because
+	// setup is where the id and the name it asserts are decided.
+	fleetKey, err := fleet.Parse(saved.FleetSeed)
+	if err != nil {
+		t.Fatalf("fleet.Parse: %v", err)
+	}
+	machineCert, err := fleet.Verify(fleetKey.Public(), saved.MachineCert)
+	if err != nil {
+		t.Fatalf("relay.json holds no machine certificate this fleet key signed: %v", err)
+	}
+	if mc, ok := machineCert.(fleet.MachineCert); !ok || mc.ID != saved.MachineID {
+		t.Fatalf("machine certificate = %+v, want one naming %q", machineCert, saved.MachineID)
+	}
+
 	// The URL is the bare host — the /daemon/<machine id> leg is the
 	// transport's to append, so a relay.json is one machine's whole
 	// registration: address, credential, and which machine it is.
@@ -772,11 +844,17 @@ func TestRunRelaySetupIsSafeToRerun(t *testing.T) {
 	if second.URL != first.URL || second.Origin != first.Origin {
 		t.Fatalf("the second run changed the address: %+v then %+v", first, second)
 	}
-	// Three PUTs, not two: the second run's first attempt is the one the
-	// already-applied migration rejects. Two would mean the fake never refused
-	// anything and this test proved nothing about re-running.
-	if f.scriptPuts != 3 {
-		t.Fatalf("script PUTs = %d, want 3 (deploy, refused re-deploy, retry without the migration)", f.scriptPuts)
+	// Two PUTs, one per run, and the second one carries no migration at all:
+	// the deploy reads the tag the account's script already carries and finds
+	// the history applied. This used to be three, the extra one being a
+	// migration sent blind, refused on the tag precondition, and re-sent
+	// without it — a round trip that only ever existed because the client
+	// could not ask.
+	if f.scriptPuts != 2 {
+		t.Fatalf("script PUTs = %d, want 2 (one per run, the second with nothing to migrate)", f.scriptPuts)
+	}
+	if f.meta.Migrations != nil {
+		t.Fatalf("the re-run sent a migration for a script already at its last tag: %+v", f.meta.Migrations)
 	}
 	// f.meta is the retry PUT: the upload that lands on a Worker that already
 	// holds a live secret. Asserted on the decoded request, not on the fake's
@@ -815,7 +893,9 @@ func TestRunRelaySetupRerunLeavesALiveRelayWorking(t *testing.T) {
 	if f.secretText != live.Secret {
 		t.Fatalf("the worker's %s is %q after a failed re-run, want the live relay's unchanged secret", daemonSecretName, f.secretText)
 	}
-	if got := loadSavedRelay(t); got != live {
+	// reflect rather than ==: the record carries the machine certificate now,
+	// and a []byte field is not comparable.
+	if got := loadSavedRelay(t); !reflect.DeepEqual(got, live) {
 		t.Fatalf("relay.json changed under a failed re-run: %+v, want %+v", got, live)
 	}
 }
@@ -973,6 +1053,63 @@ func TestRunRelayJoinWritesTheRelayConfig(t *testing.T) {
 	}
 }
 
+// TestRunRelayJoinMintsThisMachinesFleetCertificate: the join line is where a
+// machine joins the fleet, so it is where the machine's own certificate is
+// signed — the artifact the daemon publishes to the relay's directory, and the
+// only way a browser paired on another machine ever learns that this one
+// exists and which Noise key to pin for it (spec/fleet-trust.md, "New
+// machine").
+//
+// It is minted here, once, rather than at every daemon start, because the
+// directory is content-addressed: a cert re-signed on each boot carries a
+// fresh iat, hashes to a fresh key, and spends one of the directory's 512
+// entries every time the daemon restarts.
+func TestRunRelayJoinMintsThisMachinesFleetCertificate(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+
+	var out bytes.Buffer
+	if err := runRelayJoin(&out, []string{"wss://r.example", "--secret", "s", "--fleet", testFleetSeed}); err != nil {
+		t.Fatalf("runRelayJoin: %v", err)
+	}
+	saved := loadSavedRelay(t)
+	if len(saved.MachineCert) == 0 {
+		t.Fatal("relay.json carries no machine certificate; this machine would never appear in the fleet directory")
+	}
+
+	key, err := fleet.Parse(testFleetSeed)
+	if err != nil {
+		t.Fatalf("fleet.Parse: %v", err)
+	}
+	cert, err := fleet.Verify(key.Public(), saved.MachineCert)
+	if err != nil {
+		t.Fatalf("the stored machine certificate does not verify under the fleet key: %v", err)
+	}
+	mc, ok := cert.(fleet.MachineCert)
+	if !ok {
+		t.Fatalf("relay.json holds a %s certificate where a machine certificate belongs", cert.Kind())
+	}
+	if mc.ID != saved.MachineID {
+		t.Errorf("the certificate names machine %q, want the id in relay.json %q", mc.ID, saved.MachineID)
+	}
+	if mc.Name != saved.MachineName {
+		t.Errorf("the certificate names %q, want the machine name in relay.json %q", mc.Name, saved.MachineName)
+	}
+	// The load-bearing field: browsers pin this key for this machine, so a
+	// certificate naming anything but the daemon's own static key is a machine
+	// every device dials and none can handshake with.
+	dir, err := config.Dir()
+	if err != nil {
+		t.Fatalf("config.Dir: %v", err)
+	}
+	static, err := crypto.LoadOrCreateStaticKey(dir)
+	if err != nil {
+		t.Fatalf("LoadOrCreateStaticKey: %v", err)
+	}
+	if !bytes.Equal(mc.Noise, static.Public) {
+		t.Errorf("the certificate names a static key this machine does not hold")
+	}
+}
+
 // TestRunRelayJoinNormalizesTheAddress: the address arrives however the user
 // came by it — the https origin off a browser's address bar as often as the
 // wss url setup printed, in whatever case a hand retyped it — and every
@@ -1071,11 +1208,16 @@ func TestRunRelayStatusReportsTheConfiguredRelay(t *testing.T) {
 		t.Fatalf("status = %q, want it to say there is no relay", out.String())
 	}
 
+	// A stand-in relay, so this command reads a directory rather than the
+	// internet. Its host is what relay.json points at: `flue relay status`
+	// asks the relay itself about the fleet, which is the one fact no local
+	// file carries.
+	dir := statusDirectory(t)
 	if err := config.SaveRelay(config.Relay{
-		URL:         "wss://flue-relay.karn.workers.dev",
+		URL:         dir.url,
 		Secret:      "s3cret-value",
 		FleetSeed:   testFleetSeed,
-		Origin:      "https://flue-relay.karn.workers.dev",
+		Origin:      strings.Replace(dir.url, "wss://", "https://", 1),
 		MachineID:   "karns-macbook-pro-a1b2-0f9a12cd",
 		MachineName: "Karn's MacBook Pro",
 	}); err != nil {
@@ -1086,7 +1228,7 @@ func TestRunRelayStatusReportsTheConfiguredRelay(t *testing.T) {
 		t.Fatalf("runRelayStatus: %v", err)
 	}
 	got := out.String()
-	if !strings.Contains(got, "wss://flue-relay.karn.workers.dev") {
+	if !strings.Contains(got, dir.url) {
 		t.Fatalf("status = %q, want the relay's URL", got)
 	}
 	if strings.Contains(got, "s3cret-value") {
@@ -1100,6 +1242,385 @@ func TestRunRelayStatusReportsTheConfiguredRelay(t *testing.T) {
 	}
 }
 
+// statusDirectory is a relay serving a fleet directory with one entry of each
+// kind under testFleetSeed, plus one blob signed by nobody.
+type fakeStatusRelay struct {
+	url       string
+	machineID string
+}
+
+func statusDirectory(t *testing.T) fakeStatusRelay {
+	t.Helper()
+	key, err := fleet.Parse(testFleetSeed)
+	if err != nil {
+		t.Fatalf("fleet.Parse: %v", err)
+	}
+	sign := func(c fleet.Cert) []byte {
+		blob, err := key.Sign(c)
+		if err != nil {
+			t.Fatalf("signing a %s: %v", c.Kind(), err)
+		}
+		return blob
+	}
+	thirtyTwo := func(fill byte) []byte {
+		b := make([]byte, 32)
+		for i := range b {
+			b[i] = fill
+		}
+		return b
+	}
+	const machineID = "karns-macbook-pro-a1b2-0f9a12cd"
+	blobs := [][]byte{
+		sign(fleet.MachineCert{ID: machineID, Name: "Karn's MacBook Pro", Noise: thirtyTwo(0x01), IAT: 1}),
+		sign(fleet.DeviceCert{Device: thirtyTwo(0x02), Name: "phone", PairedOn: machineID, IAT: 2}),
+		sign(fleet.Revocation{Device: thirtyTwo(0x03), IAT: 3}),
+		// Signed by nothing this fleet key knows: the gap between "entries"
+		// and "verified" is the number worth printing.
+		[]byte("not a certificate at all"),
+	}
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/directory" || r.Method != http.MethodGet {
+			http.Error(w, "not found", http.StatusNotFound)
+			return
+		}
+		entries := make([]map[string]any, 0, len(blobs))
+		for _, b := range blobs {
+			entries = append(entries, map[string]any{"key": "k", "blob": b})
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]any{"v": 1, "entries": entries})
+	}))
+	t.Cleanup(ts.Close)
+	return fakeStatusRelay{url: "ws" + strings.TrimPrefix(ts.URL, "http"), machineID: machineID}
+}
+
+// TestRunRelayStatusReportsTheFleetDirectory: the second line, and the reason
+// this command talks to the network at all. It reports what the relay is
+// holding, how much of it this fleet key actually signed, and — the one thing
+// an operator most wants to know after adding a machine — whether this machine
+// is in there at all.
+func TestRunRelayStatusReportsTheFleetDirectory(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	dir := statusDirectory(t)
+	if err := config.SaveRelay(config.Relay{
+		URL:         dir.url,
+		Secret:      "s",
+		FleetSeed:   testFleetSeed,
+		Origin:      strings.Replace(dir.url, "wss://", "https://", 1),
+		MachineID:   dir.machineID,
+		MachineName: "Karn's MacBook Pro",
+	}); err != nil {
+		t.Fatalf("SaveRelay: %v", err)
+	}
+
+	var out bytes.Buffer
+	if err := runRelayStatus(&out); err != nil {
+		t.Fatalf("runRelayStatus: %v", err)
+	}
+	got := out.String()
+	for _, want := range []string{
+		"4 entries",
+		"3 verified",
+		"1 machine, 1 revocation",
+		// Device certificates are not published to the directory any more, so
+		// one that is there is worth naming as the anomaly it is rather than
+		// counting silently beside the machines — and worth naming without a
+		// cause attached, since no released flue has a directory at all and
+		// so none can have published one.
+		"1 device certificate in the directory; nothing in this fleet should be publishing one",
+		// The entry nobody in this fleet signed, named as such rather than
+		// quietly counted: a relay serving blobs this key did not sign is
+		// either a rotated fleet key or somebody else's relay.
+		"1 entry is signed by something else",
+	} {
+		if !strings.Contains(got, want) {
+			t.Errorf("status does not say %q:\n%s", want, got)
+		}
+	}
+	if strings.Contains(got, "this machine is not in the directory") {
+		t.Errorf("status says this machine is missing, but its certificate is there:\n%s", got)
+	}
+}
+
+// TestRunRelayStatusSaysWhenThisMachineIsMissing: the failure a new machine
+// actually has — it joined, but nothing published its certificate, so no
+// browser in the fleet can discover it. Silence there looks exactly like
+// health.
+func TestRunRelayStatusSaysWhenThisMachineIsMissing(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	dir := statusDirectory(t)
+	if err := config.SaveRelay(config.Relay{
+		URL:         dir.url,
+		Secret:      "s",
+		FleetSeed:   testFleetSeed,
+		Origin:      strings.Replace(dir.url, "wss://", "https://", 1),
+		MachineID:   "some-other-machine-a1b2-0f9a12cd",
+		MachineName: "Someone Else",
+	}); err != nil {
+		t.Fatalf("SaveRelay: %v", err)
+	}
+
+	var out bytes.Buffer
+	if err := runRelayStatus(&out); err != nil {
+		t.Fatalf("runRelayStatus: %v", err)
+	}
+	if !strings.Contains(out.String(), "this machine is not in the directory") {
+		t.Errorf("status does not report the missing machine certificate:\n%s", out.String())
+	}
+}
+
+// TestRunRelayStatusWarnsBeforeTheDirectoryFills: the cap has no gentle
+// failure — at 512 the relay refuses every new blob before storing it and
+// therefore before pushing it, so a revocation made past that point reaches
+// nobody — and nothing frees an entry short of `flue relay reset`. Without a
+// line here the first signal an operator gets is a 507 in a daemon log, after
+// a revoke they believed had crossed the fleet.
+func TestRunRelayStatusWarnsBeforeTheDirectoryFills(t *testing.T) {
+	// A relay holding n entries, none of which need to verify: the warning is
+	// about how full the relay is, which is its own claim about itself.
+	crowded := func(t *testing.T, n int) string {
+		t.Helper()
+		ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			entries := make([]map[string]any, 0, n)
+			for i := range n {
+				entries = append(entries, map[string]any{"key": "k", "blob": []byte(fmt.Sprintf("blob-%d", i))})
+			}
+			w.Header().Set("Content-Type", "application/json")
+			_ = json.NewEncoder(w).Encode(map[string]any{"v": 1, "entries": entries})
+		}))
+		t.Cleanup(ts.Close)
+		return "ws" + strings.TrimPrefix(ts.URL, "http")
+	}
+
+	for _, tc := range []struct {
+		name    string
+		entries int
+		want    string
+		absent  string
+	}{
+		{name: "room to spare", entries: relay.DirectoryWarnAt - 1, absent: "flue relay reset"},
+		{name: "filling up", entries: relay.DirectoryWarnAt, want: "entries full"},
+		{name: "full", entries: relay.MaxDirectoryEntries, want: "the directory is full"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+			if err := config.SaveRelay(config.Relay{
+				URL:       crowded(t, tc.entries),
+				Secret:    "s",
+				FleetSeed: testFleetSeed,
+				MachineID: "karns-macbook-pro-a1b2-0f9a12cd",
+			}); err != nil {
+				t.Fatalf("SaveRelay: %v", err)
+			}
+			var out bytes.Buffer
+			if err := runRelayStatus(&out); err != nil {
+				t.Fatalf("runRelayStatus: %v", err)
+			}
+			got := out.String()
+			if tc.want != "" && !strings.Contains(got, tc.want) {
+				t.Errorf("status does not say %q:\n%s", tc.want, got)
+			}
+			if tc.want != "" && !strings.Contains(got, "flue relay reset") {
+				t.Errorf("status warns about the cap without naming the way out:\n%s", got)
+			}
+			if tc.absent != "" && strings.Contains(got, tc.absent) {
+				t.Errorf("status warns about a directory with room to spare:\n%s", got)
+			}
+		})
+	}
+}
+
+// TestRunRelayStatusSurvivesARelayWithNoDirectory: a relay deployed by a flue
+// older than the directory answers 503 there by design. The status has to name
+// the fix rather than print a bare HTTP code, and must not fail the command —
+// the first line is still true.
+func TestRunRelayStatusSurvivesARelayWithNoDirectory(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusServiceUnavailable)
+		_, _ = w.Write([]byte(`{"error":"directory unavailable"}`))
+	}))
+	t.Cleanup(ts.Close)
+	if err := config.SaveRelay(config.Relay{
+		URL:         "ws" + strings.TrimPrefix(ts.URL, "http"),
+		Secret:      "s",
+		FleetSeed:   testFleetSeed,
+		Origin:      "http" + strings.TrimPrefix(ts.URL, "http"),
+		MachineID:   "karns-macbook-pro-a1b2-0f9a12cd",
+		MachineName: "Karn's MacBook Pro",
+	}); err != nil {
+		t.Fatalf("SaveRelay: %v", err)
+	}
+
+	var out bytes.Buffer
+	if err := runRelayStatus(&out); err != nil {
+		t.Fatalf("runRelayStatus on a relay with no directory: %v", err)
+	}
+	if !strings.Contains(out.String(), "flue relay update") {
+		t.Errorf("status does not name the fix for a relay with no directory:\n%s", out.String())
+	}
+}
+
+// --- flue relay reset --------------------------------------------------------
+
+// fakeResetRelay is a relay that answers the one route `flue relay reset`
+// speaks, and remembers what it was asked.
+type fakeResetRelay struct {
+	url string
+
+	mu      sync.Mutex
+	deletes int
+	auth    string
+	held    int
+}
+
+func resetRelay(t *testing.T, held int) *fakeResetRelay {
+	t.Helper()
+	f := &fakeResetRelay{held: held}
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/directory" || r.Method != http.MethodDelete {
+			http.Error(w, "not found", http.StatusNotFound)
+			return
+		}
+		f.mu.Lock()
+		f.deletes++
+		f.auth = r.Header.Get("Authorization")
+		removed := f.held
+		f.held = 0
+		f.mu.Unlock()
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]any{"reset": true, "removed": removed})
+	}))
+	t.Cleanup(ts.Close)
+	f.url = "ws" + strings.TrimPrefix(ts.URL, "http")
+	return f
+}
+
+func (f *fakeResetRelay) seen() (deletes int, auth string) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.deletes, f.auth
+}
+
+func saveResetRelay(t *testing.T, url string) {
+	t.Helper()
+	if err := config.SaveRelay(config.Relay{
+		URL:         url,
+		Secret:      "the-daemon-secret",
+		FleetSeed:   testFleetSeed,
+		Origin:      strings.Replace(url, "wss://", "https://", 1),
+		MachineID:   "karns-macbook-pro-a1b2-0f9a12cd",
+		MachineName: "Karn's MacBook Pro",
+	}); err != nil {
+		t.Fatalf("SaveRelay: %v", err)
+	}
+}
+
+// TestRunRelayResetEmptiesTheDirectory is the escape hatch working: a full
+// directory refuses every later PUT — including a revocation, which is the
+// fleet-wide kill switch — and nothing else in flue can clear it, because
+// nothing evicts and Durable Object storage outlives every redeploy.
+func TestRunRelayResetEmptiesTheDirectory(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	relay := resetRelay(t, 512)
+	saveResetRelay(t, relay.url)
+
+	var out bytes.Buffer
+	if err := runRelayReset(&out, strings.NewReader("yes\n"), nil); err != nil {
+		t.Fatalf("runRelayReset: %v", err)
+	}
+	deletes, auth := relay.seen()
+	if deletes != 1 {
+		t.Fatalf("the reset sent %d DELETEs, want 1", deletes)
+	}
+	// The daemon secret is the whole credential on this route: the relay holds
+	// no fleet key and cannot judge a blob, so what it gates is who may write.
+	if auth != "Bearer the-daemon-secret" {
+		t.Errorf("the reset presented %q, not the daemon secret", auth)
+	}
+	got := out.String()
+	if !strings.Contains(got, "512 entries cleared") {
+		t.Errorf("the reset does not report what it removed:\n%s", got)
+	}
+	// The one thing the count does not say: the fleet puts it back by itself.
+	if !strings.Contains(got, "re-publishes") {
+		t.Errorf("the reset does not say the fleet refills the directory:\n%s", got)
+	}
+}
+
+// TestRunRelayResetNeedsConfirmation: the wipe has one cost re-publishing does
+// not put back — a revocation whose last holder never reconnects — so it must
+// not be reachable by a mistyped command.
+func TestRunRelayResetNeedsConfirmation(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	relay := resetRelay(t, 7)
+	saveResetRelay(t, relay.url)
+
+	var out bytes.Buffer
+	if err := runRelayReset(&out, strings.NewReader("n\n"), nil); err != nil {
+		t.Fatalf("runRelayReset declined: %v", err)
+	}
+	if deletes, _ := relay.seen(); deletes != 0 {
+		t.Fatalf("a declined reset still sent %d DELETEs", deletes)
+	}
+	if !strings.Contains(out.String(), "nothing was reset") {
+		t.Errorf("a declined reset does not say so:\n%s", out.String())
+	}
+	// And the warning has to name the one thing that does not come back.
+	if !strings.Contains(out.String(), "never reconnects") {
+		t.Errorf("the confirmation does not state the residual risk:\n%s", out.String())
+	}
+}
+
+// TestRunRelayResetYesSkipsThePrompt: the scripted path, which must not hang
+// on a reader nobody is going to type into.
+func TestRunRelayResetYesSkipsThePrompt(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	relay := resetRelay(t, 1)
+	saveResetRelay(t, relay.url)
+
+	var out bytes.Buffer
+	if err := runRelayReset(&out, strings.NewReader(""), []string{"--yes"}); err != nil {
+		t.Fatalf("runRelayReset --yes: %v", err)
+	}
+	if deletes, _ := relay.seen(); deletes != 1 {
+		t.Fatalf("--yes sent %d DELETEs, want 1", deletes)
+	}
+	if !strings.Contains(out.String(), "1 entry cleared") {
+		t.Errorf("the reset does not report one entry in the singular:\n%s", out.String())
+	}
+}
+
+// TestRunRelayResetWithoutARelayPointsAtSetup: the same shape every other relay
+// subcommand takes on a machine that has none.
+func TestRunRelayResetWithoutARelayPointsAtSetup(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	var out bytes.Buffer
+	err := runRelayReset(&out, strings.NewReader("yes\n"), nil)
+	if err == nil || !strings.Contains(err.Error(), "flue relay setup") {
+		t.Fatalf("reset without a relay: %v", err)
+	}
+}
+
+// TestRunRelayResetNamesTheUpdateForARelayWithNoDirectory: a Worker deployed by
+// a flue older than the directory answers 503 on this route by design, and the
+// fix is a redeploy rather than anything about this machine.
+func TestRunRelayResetNamesTheUpdateForARelayWithNoDirectory(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusServiceUnavailable)
+		_, _ = w.Write([]byte(`{"error":"directory unavailable"}`))
+	}))
+	t.Cleanup(ts.Close)
+	saveResetRelay(t, "ws"+strings.TrimPrefix(ts.URL, "http"))
+
+	var out bytes.Buffer
+	err := runRelayReset(&out, strings.NewReader("yes\n"), []string{"--yes"})
+	if err == nil || !strings.Contains(err.Error(), "flue relay update") {
+		t.Fatalf("reset against a relay with no directory: %v", err)
+	}
+}
+
 func TestCmdRelayRejectsAnUnknownSubcommand(t *testing.T) {
 	if err := cmdRelay(nil); err == nil {
 		t.Fatal("cmdRelay with no subcommand should fail")
@@ -1112,7 +1633,7 @@ func TestCmdRelayRejectsAnUnknownSubcommand(t *testing.T) {
 // TestUsageMentionsRelay keeps the relay lines in the help text: a subcommand
 // nobody can discover may as well not exist.
 func TestUsageMentionsRelay(t *testing.T) {
-	for _, want := range []string{"flue relay setup", "flue relay join", "flue relay status"} {
+	for _, want := range []string{"flue relay setup", "flue relay join", "flue relay status", "flue relay reset"} {
 		if !strings.Contains(usageText, want) {
 			t.Fatalf("usage text does not mention %q:\n%s", want, usageText)
 		}
diff --git a/cmd/flue/relayui.go b/cmd/flue/relayui.go
index 2a08348..9625024 100644
--- a/cmd/flue/relayui.go
+++ b/cmd/flue/relayui.go
@@ -355,6 +355,12 @@ func (s *relayUIService) Provision(ctx context.Context, req daemon.RelayUIDeploy
 	}
 	machineID := config.MintMachineID(hostname, secret, rand.Reader)
 	machineName := truncateRunes(hostname, machineNameMaxRunes)
+	// And this machine's own certificate under it, for the same reason
+	// runRelaySetup mints one: the fleet directory is how the browsers in this
+	// fleet learn that this machine exists, and a machine with no cert is a
+	// machine only the devices paired directly to it can reach. A failure is a
+	// step line, not a failed deploy.
+	machineCert, certErr := mintMachineCert(fleetKey, machineID, machineName)
 	if err := config.SaveRelay(config.Relay{
 		URL:         "wss://" + host,
 		Secret:      secret,
@@ -362,12 +368,16 @@ func (s *relayUIService) Provision(ctx context.Context, req daemon.RelayUIDeploy
 		Origin:      "https://" + host,
 		MachineID:   machineID,
 		MachineName: machineName,
+		MachineCert: machineCert,
 		Worker:      worker,
 	}); err != nil {
 		return daemon.RelayUIDeployResult{}, fmt.Errorf("save the relay configuration: %w", err)
 	}
 	steps = append(steps, "fleet key minted (stays on your machines; Cloudflare never sees it)")
 	steps = append(steps, fmt.Sprintf("this machine joined as %s (%s)", machineName, machineID))
+	if certErr != nil {
+		steps = append(steps, "could not mint this machine's fleet certificate ("+certErr.Error()+"); other devices will not discover this machine")
+	}
 	// Said out loud because the transport this deploy is about to start does
 	// not cover it. daemon.Identity is fixed at construction, so the fleet key
 	// this process signs with is whatever relay.json held when it booted —
diff --git a/docs/FOLLOW-UPS.md b/docs/FOLLOW-UPS.md
index 45bee9e..05a1bd4 100644
--- a/docs/FOLLOW-UPS.md
+++ b/docs/FOLLOW-UPS.md
@@ -136,6 +136,17 @@ terminal see a login shell under the login service too.
   `ws://127.0.0.1:7717` from an `http://127.0.0.1:7717` page — narrowing it needs
   the port, which the daemon knows and this constant does not.
 
+  The daemon's policy also names **one** relay origin now (`daemon.LocalCSPFor`,
+  from `relay.json`), and that is a widening worth reading as a separate fact.
+  It is not defence-in-depth slippage: a loopback tab reaches every *other*
+  machine in the fleet over `wss://<relay>/client/<id>` and reads
+  `https://<relay>/directory` to learn they exist, and `'self'` covers neither,
+  so before it the fleet silently collapsed to one machine on a loopback tab —
+  silently because `readDirectory` answers "no machines" for every fault. One
+  exact origin, two schemes, from a file this daemon already dials, is a much
+  narrower grant than the wildcard ports beside it. Narrowing *those* is still
+  the open item.
+
 ## Crypto and pairing
 
 Carried out of the crypto+pairing milestone (Noise IK, the device registry, the
diff --git a/docs/RELAY.md b/docs/RELAY.md
index 962dc24..09b2130 100644
--- a/docs/RELAY.md
+++ b/docs/RELAY.md
@@ -69,7 +69,7 @@ daemon  ---- wss /daemon/<id> ---->  Worker + one DO per machine  <---- wss /cli
 ```sh
 flue relay setup     # machine 1: paste a Cloudflare API token, watch it deploy
 flue relay join …    # every other machine: the one line setup printed, verbatim
-flue relay status    # what is configured
+flue relay status    # what is configured, and what the fleet directory holds
 ```
 
 Setup needs a token from the **"Edit Cloudflare Workers"** template. It verifies
@@ -106,6 +106,12 @@ worse failure than not joining.
 and rides the pairing link's query (`n=`) so the pairing browser can write it
 down, never a path, and never anything the Worker routes on.
 
+Join also mints this machine's own **machine certificate** — its id, its name
+and its Noise static key, signed under the fleet key — and stores it. That is
+what a browser reads out of the directory to reach a machine it never paired
+with, so a machine that joined and was never restarted is a machine the fleet
+cannot see; the restart is not optional.
+
 Run it from a **release binary** (`make build`, or an installed flue). The
 Worker and the web app are both compiled into that binary, and a dev build
 carries neither, setup refuses rather than deploying something that is not
@@ -203,6 +209,28 @@ A relay's version is the version of the flue that deployed it, the Worker
 ships inside the binary, so `brew upgrade flue && flue relay update` is the
 whole upgrade story.
 
+**A relay deployed before the fleet directory needs this run once.** The
+directory is a second Durable Object class (`FleetDirectory`), and a Worker
+that predates it has no such binding: `/directory` answers
+`503 {"error":"directory unavailable"}`, and `flue relay status` says so in
+as many words —
+
+```
+fleet:    unreachable (this relay has no directory; run `flue relay update` to redeploy it)
+```
+
+— which is the whole of the flag day. Until it is run, no revocation crosses
+machines and no browser learns of a machine it did not pair with by hand.
+(Device certificates are unaffected either way: they never travel through the
+directory. A device gets its own from the machine that paired it, over the
+pairing answer and every welcome, and that works on a relay of any vintage.)
+Nothing else is affected: sessions, pairing and every
+machine you already paired keep working exactly as before, which is what makes
+this an upgrade rather than an outage. `flue relay update` adds the class (the
+deploy reads the migration tag the account's copy of the script already
+carries and sends only the steps behind it), and the daemons publish
+everything they hold on their next connect.
+
 ### A custom domain
 
 Route a domain to the Worker in the Cloudflare dashboard (Workers → your
@@ -289,14 +317,200 @@ The honest cost sits on the other side of the same line. Every machine holds
 the same private key — trust inside the fleet is symmetric, any machine can
 sign for the fleet, and there is no ceremony between machines — so a
 compromised machine can mint a device certificate every other machine will
-honour, and the shared-secret analysis above understates what it can do by
-exactly that much. That is the trade that buys pairing once for a fleet
-instead of once per machine, for the one-operator model this is built for,
-and it is why re-setup (fresh secret, fresh fleet key, everyone re-joins and
-re-pairs) is the whole of compromise recovery. Revoking a *device* is
-per-machine today; making a revocation reach the fleet needs the directory
-that distributes it, which is the next stage of
-[`spec/fleet-trust.md`](../spec/fleet-trust.md).
+honour — and a *machine* certificate naming a Noise key of its own, which a
+browser that has never paired the machine it names will pin and dial. (A
+browser that did pair it keeps the key from its own ceremony, which is
+stronger evidence than anything read off the relay, so that one is not
+repointed.) The shared-secret analysis above understates what a compromised
+machine can do by exactly that much. That is the trade that buys pairing once
+for a fleet instead of once per machine, for the one-operator model this is
+built for, and it is why re-setup (fresh secret, fresh fleet key, everyone
+re-joins and re-pairs) is the whole of compromise recovery.
+
+### The fleet directory
+
+Certificates only mean something once they reach the machines and devices
+that check them. Daemons do not talk to each other and should not start to,
+so the relay carries them: one more Durable Object, not per machine, holding
+the signed blobs the fleet has produced — machine certificates and
+revocations.
+
+Your *device* certificates are not in there, deliberately. The machine that
+paired a device hands that device its certificate directly — in the pairing
+answer, and again every time it connects — so there is no reason to publish a
+list of your devices' keys and the names you gave them on a route that needs no
+credential, and no reason to spend one of the directory's 512 permanent entries
+every time you pair something.
+
+```
+PUT    /directory  the daemon secret; one signed blob
+GET    /directory  no credential at all; the whole set
+DELETE /directory  the daemon secret; empties the whole set (`flue relay reset`)
+WS     /directory  the daemon secret; one push per new entry
+```
+
+**The relay stores and serves, and verifies nothing.** It holds no fleet key,
+so it cannot tell a machine certificate from a revocation from 200 bytes of
+noise — and must not try. Every reader, daemon and browser both, checks every
+signature under the fleet public key and drops what fails. What a hostile
+relay can do here is serve the set stale, cut short or empty, which is the
+same power it always had (it could refuse to route); what it cannot do is mint
+an entry.
+
+One caveat on "the cost of a hostile relay is availability, and nothing else",
+which is true everywhere else in this document. For a *certificate*, a relay
+that withholds one subtracts: you see fewer machines, or a device has to pair
+by hand. For a *revocation*, withholding adds — a machine that never receives
+one keeps admitting a device you cut off — and nothing in the answer says so,
+because entries are signed one by one and the set is not signed at all. What
+holds it in check is that every machine that knows a revocation re-publishes it
+on every connect and every half hour, so burying one means withholding it from
+everybody, continuously, forever; a machine that heard it once never unhears
+it; and the relay still cannot mint the certificate the revocation was about.
+The real fix is a signed statement about the whole set, and
+[`spec/relay-protocol.md`](../spec/relay-protocol.md), "What withholding
+costs", records it as future work rather than pretending it is done.
+
+Three things follow that an operator sees:
+
+- **A machine joined later needs no ceremony.** `flue relay join` mints that
+  machine's certificate and publishes it; the next directory read on every
+  paired browser puts the machine in the list, and the certificate each of
+  those devices already holds is what the new machine lets them in on.
+- **Pair a device once, for the fleet.** The ceremony's machine signs the
+  device certificate and hands it to the device it is about. The browser being
+  paired takes the fleet *public* key out of the same QR that carries the
+  daemon's own
+  (`f=` beside `k=`) and pins it — the QR is the one leg of the ceremony no
+  intermediary can sit in — and from then on it accepts any machine whose
+  certificate verifies under that key, pinning the Noise key the certificate
+  names. The device presents its own certificate in the handshake, which is
+  how a machine that has never seen it admits it.
+- **A revoke crosses machines.** Revoking on any machine's Devices screen
+  publishes a revocation; every connected daemon hears the push within
+  seconds, drops the key from its own registry and closes that device's
+  channels. A revocation permanently outranks a device certificate for the
+  same key whatever the timestamps say, on every reader — un-revoking is
+  pairing again, under a new key.
+
+**Entries are content-addressed and no single entry is ever deleted.** The
+storage key is the SHA-256 of the exact bytes, so a `PUT` can only add, a blob
+comes back byte for byte, and re-publishing costs nothing. Nothing prunes,
+deliberately: every eviction policy can drop a revocation, and a directory that
+forgets a revocation re-admits the device it revoked to every machine that had
+not yet heard. The whole set can be emptied at once — see the reset below —
+because that needs no opinion about what any one blob means, which is the only
+kind of deletion a relay holding no fleet key is entitled to perform.
+
+Which is why it can fill up. A blob is capped at 4 KiB and the set at **512
+entries**, and at the cap a new blob is refused with
+`507 {"error":"directory full"}` rather than making room. What that means to
+you: nothing already published stops working — every certificate and every
+revocation in there keeps being served and honoured — but the *next* thing
+your fleet signs **is not stored and is not pushed to anybody**. The refusal
+comes before both: the relay does not keep the blob, so there is no new entry
+to fan out, and the push socket carries new entries and nothing else. Nobody is
+notified, including the machines that are connected right now.
+
+So a device paired after that point works on the machine that paired it and
+nowhere else. And, far more seriously, a revocation made after that point takes
+effect **only on the machine it was typed on** — that machine drops the key
+from its own registry and closes that device's channels, because a revoke is
+local first — while every other machine in the fleet goes on admitting the
+device on the certificate it already holds. Re-publishing does not rescue it
+either: the machine re-offers that revocation on every reconnect and every half
+hour, and is answered 507 every time. The daemon that hit it logs
+
+```
+the fleet directory is full; this artifact was not stored and was not pushed
+to anyone, so no machine will learn of it from here — run `flue relay reset`
+to empty the directory
+```
+
+and `flue relay status` shows the count sitting at 512. 512 is years of
+pair-and-revoke churn for one operator (entries are machines, devices, and one
+revocation per device ever revoked), so reaching it is a signal worth reading:
+either something is publishing in a loop, or the relay is shared with a fleet
+it should not be.
+
+**The way out is `flue relay reset`**, and it is the only way out. Redeploying
+does not clear the directory and neither does re-running setup: the Durable
+Object is named by a constant, its storage outlives every deploy of the script,
+and a fresh fleet key does not delete the blobs it orphans — it just leaves 512
+signatures nobody can verify occupying the cap. So there is one command:
+
+```
+$ flue relay reset
+this empties the relay's fleet directory: every machine certificate
+and every revocation the relay is holding.
+...
+type yes to continue: yes
+  ✓ fleet directory reset (512 entries cleared)
+```
+
+It empties the set — never a chosen part of it, because choosing needs the
+fleet key the relay must never hold — and the fleet then puts itself back:
+every machine re-publishes everything it holds on connect and every 30 minutes,
+and the reset disconnects the push sockets so that reconnect happens in seconds
+rather than at the next half hour. A machine that is switched off republishes
+its share when it next starts.
+
+What a wipe costs, stated rather than buried: **a blob whose only remaining
+holder never reconnects is gone.** The one that matters is a revocation
+published by a machine that has since been decommissioned — every machine that
+already heard it still holds it in its own `revocations.json` and re-publishes
+it from there, so this is a narrow window and not a general loss, but it is not
+an empty one. If you are not sure, revoke the device again from any machine
+after the reset; a revocation is idempotent everywhere it lands.
+
+**What the relay learns from it.** The blobs are opaque to the *code* and not
+to whoever runs the Worker: machine ids and display names, and who revoked what
+and when, are in there, signed rather than secret. The relay already routed by
+machine id; the delta is machine names and the revocation history. None of it
+opens anything — reaching a machine still needs the private half of a device
+key that never leaves the browser holding it — but it is a real change in what
+a relay operator can see, and on your own Worker, in front of your own
+machines, that is the trade this document would rather state than leave to be
+discovered.
+
+**What keeping device certificates out of it does and does not buy, precisely.**
+It does *not* hide them from your relay's operator. When you pair through the
+relay, the whole ceremony transits the Worker in cleartext — the token, your
+device's public key, the label you typed, and the certificate that comes back
+in the answer — and no arrangement of the directory changes that, because the
+request *is* the ceremony. What it removes is a different exposure: `GET
+/directory` takes no credential, by design, since what it carries is signed
+rather than secret. A device certificate published there was readable by
+anybody who knew your relay's address, forever — a list of your devices' public
+keys and the names you gave them, on the open internet — and it spent one of
+512 permanent entries every time you paired anything. So: still seen by the
+operator you already trust to route your terminals; no longer readable by
+strangers. If you would rather your operator not see a ceremony either, pair
+over the daemon's own origin, which is the advice
+[`spec/relay-protocol.md`](../spec/relay-protocol.md) gives for the pairing
+token as well. The full list of what a relay sees is in that document, under
+"What the relay sees".
+
+**Reading it.** `flue relay status` asks the relay directly and verifies every
+blob locally, which is why the second number is the one that means anything:
+
+```
+relay:    configured (wss://flue-relay.<sub>.workers.dev), status unknown from here
+fleet:    4 entries, 4 verified under this fleet key (2 machines, 2 revocations)
+```
+
+`entries` is what the relay claims to hold; `verified` is how much of it this
+machine's fleet key actually signed. A gap between them is worth looking at —
+it is a fleet key that has rotated, or a relay that is not the one this machine
+thinks it is — and status says so on a second line when it happens. It also
+says when this machine's own certificate is missing from the set, which is the
+one fault a freshly joined machine really has: other devices will not discover
+it; when the directory is past 90% of its 512 entries, so a full one is a
+decision rather than a discovery; and when there are device certificates in
+there at all, which nothing in your fleet should be publishing. It does not
+guess how one got there — no released flue has a fleet directory to have
+published it from — but it is worth a look. The same counts ride
+`GET /api/relay/info`, which is where the Remote screen reads them.
 
 ## Cost model
 
diff --git a/internal/cloudflare/client.go b/internal/cloudflare/client.go
index 4184654..1974c93 100644
--- a/internal/cloudflare/client.go
+++ b/internal/cloudflare/client.go
@@ -26,6 +26,8 @@ import (
 	"mime/multipart"
 	"net/http"
 	"net/textproto"
+	"regexp"
+	"slices"
 	"sort"
 	"strings"
 )
@@ -38,11 +40,12 @@ const defaultBase = "https://api.cloudflare.com/client/v4"
 // ESM bundle, so one name serves both.
 const mainModule = "index.js"
 
-// migrationTag is the Durable Object migration tag this client applies. It
-// matches the `"tag": "v1"` in relay/wrangler.jsonc: a Worker deployed by
-// `flue relay setup` and one deployed by wrangler must agree on the tag, or
-// Cloudflare sees two different migration histories for the same class.
-const migrationTag = "v1"
+// The migration tags are no longer a constant here: the history is
+// DeployInput.Migrations, supplied by the caller so that it can be the same
+// list relay/wrangler.jsonc holds (internal/relaydeploy, Migrations). A Worker
+// deployed by `flue relay setup` and one deployed by wrangler must agree tag
+// for tag, or Cloudflare sees two different migration histories for the same
+// classes.
 
 // notFoundHandling makes the asset router serve index.html for unmatched
 // paths, which is what a single-page app needs and what relay/wrangler.jsonc
@@ -372,14 +375,28 @@ type DeployInput struct {
 	Module            []byte // the built worker, ESM
 	CompatibilityDate string // "2026-08-01"
 
-	// NewSQLiteClasses names Durable Object classes being introduced. It is
-	// set on the first deploy and empty afterwards; Deploy also recovers on its
-	// own when Cloudflare says the migration is already applied.
+	// Migrations is the Durable Object migration history, oldest first — the
+	// whole of it, on every deploy, exactly as relay/wrangler.jsonc holds it.
+	// Deploy sends only the part this account has not applied yet; see
+	// deployedMigrationTag and pendingMigrations.
 	//
-	// These must be *SQLite* classes: the free plan offers no other storage
-	// backend for Durable Objects, so a key-value migration would shut free
-	// accounts out of the relay entirely.
-	NewSQLiteClasses []string
+	// It is the history and not "what is new this time" because only the
+	// history can answer that question: which steps are outstanding depends on
+	// the tag the deployed script carries, which is a fact about the account
+	// rather than about this binary.
+	Migrations []Migration
+
+	// OnNote, when set, hears the conditions this client can detect and cannot
+	// fix — one line, already a whole sentence, for the caller to show a human.
+	// It is not progress: nothing routine reaches it, and a deploy that has
+	// nothing to say says nothing.
+	//
+	// It exists for one case today and that case used to be silent: a script
+	// carrying a migration tag this binary has never heard of. Deploy then
+	// sends no migration at all, deliberately, and if the upload is refused the
+	// user is left with a 10061 about a Durable Object class and no hint that
+	// the relay was deployed by a newer flue than the one they are running.
+	OnNote func(line string)
 
 	DOBindings           map[string]string // name -> class: {"HUB": "DaemonHub"}
 	Assets               []Asset
@@ -480,12 +497,36 @@ type observability struct {
 	Enabled bool `json:"enabled"`
 }
 
-// migrations is the API's migration object. Note that this is an object with a
-// tag and a list of steps, not the array of tagged steps that a wrangler config
-// file holds: wrangler diffs its config against the deployed tag and sends the
-// result in this shape. The multipart-metadata documentation calls the field an
-// "array[object]", which describes the config file rather than the wire.
+// Migration is one entry of the Durable Object migration history: a tag, and
+// the classes that entry introduces. It is the Go spelling of one element of
+// `migrations` in relay/wrangler.jsonc, and the two must stay identical —
+// tags included — or a Worker deployed by wrangler and one deployed by `flue
+// relay setup` carry different histories for the same classes and neither tool
+// can deploy over the other's.
+//
+// The classes must be *SQLite* classes: the free plan offers no other storage
+// backend for Durable Objects, so a key-value migration would shut free
+// accounts out of the relay entirely.
+type Migration struct {
+	Tag              string
+	NewSQLiteClasses []string
+}
+
+// migrations is the API's migration object. Note that this is an object with
+// tags and a list of steps, not the array of tagged steps that a wrangler
+// config file holds: wrangler diffs its config against the deployed tag and
+// sends the result in this shape. The multipart-metadata documentation calls
+// the field an "array[object]", which describes the config file rather than the
+// wire.
+//
+// old_tag is the precondition: Cloudflare applies the steps only if the
+// deployed script carries exactly that tag, and an absent old_tag means "this
+// script has no migration history yet". Getting it wrong is not silent — the
+// upload is refused with error 10079, whose message names both tags — which is
+// why pendingMigrations computes it from what the account actually reports
+// rather than assuming.
 type migrations struct {
+	OldTag string          `json:"old_tag,omitempty"`
 	NewTag string          `json:"new_tag"`
 	Steps  []migrationStep `json:"steps"`
 }
@@ -494,6 +535,136 @@ type migrationStep struct {
 	NewSQLiteClasses []string `json:"new_sqlite_classes,omitempty"`
 }
 
+// pendingMigrations is the migration object for a script that currently carries
+// deployedTag, given the whole history. Nil when there is nothing to apply.
+//
+// known says whether deployedTag is a fact or a guess. It is a fact when the
+// account's script list answered; it is a guess when that read failed, and the
+// guess is the empty tag — a first deploy — because that is the only shape that
+// can create the classes and it is what this client sent before it could ask at
+// all. A guess that is wrong is not left to rot: the upload is refused on the
+// precondition, Cloudflare's message names the tag the script really carries,
+// and Deploy recomputes from *that* and retries (expectedMigrationTag).
+//
+// The rule is wrangler's, step for step, because the account's state is shared
+// with it and a second opinion about which steps are outstanding would be a
+// second migration history:
+//
+//   - No deployed tag: send everything, with no old_tag. This is a first
+//     deploy, and it is also the only shape that can create the classes.
+//   - A deployed tag inside the history: send what comes after it, with
+//     old_tag set. This is the upgrade — the relay that has DaemonHub at v1
+//     and needs FleetDirectory at v2 — and it is the case a client that only
+//     ever sent "the new classes" could not express at all.
+//   - The last tag in the history: nothing to send. A re-deploy of an
+//     up-to-date relay carries no migration, which is what keeps it from
+//     meeting the already-applied refusal at all.
+//   - A tag from outside the history: nothing to send, deliberately. That is a
+//     script deployed by a *newer* flue than this one, and re-applying an
+//     older history over it would be this binary undoing a migration it does
+//     not know about. wrangler replays the whole history here instead, which
+//     is right for a config file a human is editing and wrong for a history
+//     compiled into a binary that may be the older of the two.
+func pendingMigrations(history []Migration, deployedTag string, known bool) *migrations {
+	if len(history) == 0 {
+		return nil
+	}
+	newTag := history[len(history)-1].Tag
+	steps := func(from []Migration) []migrationStep {
+		out := make([]migrationStep, 0, len(from))
+		for _, m := range from {
+			out = append(out, migrationStep{NewSQLiteClasses: m.NewSQLiteClasses})
+		}
+		return out
+	}
+	if !known || deployedTag == "" {
+		return &migrations{NewTag: newTag, Steps: steps(history)}
+	}
+	for i, m := range history {
+		if m.Tag != deployedTag {
+			continue
+		}
+		if i == len(history)-1 {
+			return nil
+		}
+		return &migrations{OldTag: deployedTag, NewTag: newTag, Steps: steps(history[i+1:])}
+	}
+	return nil
+}
+
+// sameMigrations reports whether two migration objects would produce the same
+// request. It is what stops Deploy retrying an upload byte-identical to the one
+// that just failed: Cloudflare naming a tag the client already assumed means
+// the refusal was about something else, and a second identical attempt would
+// only bury the first error behind the same one.
+func sameMigrations(a, b *migrations) bool {
+	if a == nil || b == nil {
+		return a == b
+	}
+	if a.OldTag != b.OldTag || a.NewTag != b.NewTag || len(a.Steps) != len(b.Steps) {
+		return false
+	}
+	for i := range a.Steps {
+		if !slices.Equal(a.Steps[i].NewSQLiteClasses, b.Steps[i].NewSQLiteClasses) {
+			return false
+		}
+	}
+	return true
+}
+
+// deployedMigrationTag is the migration tag the account's copy of this script
+// carries. known is false when the question could not be answered at all — the
+// call failed, or the body was not the list it should be — and is true with an
+// empty tag when the account answered and this script is simply not in it, or
+// is there with no migration history.
+//
+// The endpoint is the account's script list, which is where wrangler reads the
+// same fact from (`getMigrationsToUpload`: GET /accounts/<id>/workers/scripts,
+// then find the entry whose `id` is the script name and take its
+// `migration_tag`). It is not paginated there and is not paginated here; the
+// response is metadata only, no script bodies, and maxResponseBytes bounds it.
+//
+// The two answers are kept apart because they mean opposite things and only one
+// of them is safe to act on. "The account says this script has no tag" is a
+// first deploy: send the whole history with no old_tag, which is the only shape
+// that can create the classes. "I could not ask" is not a first deploy — it is
+// no information — and treating it as one is what turned a five-second network
+// blip into an upgrade that could not be performed at all: the whole history
+// with no old_tag is refused on the precondition by an existing v1 relay, and
+// the blanket recovery that then dropped migrations uploaded a script binding
+// FleetDirectory to a class no migration had created, which Cloudflare refuses
+// in turn. Two failures and no deploy, from a read-only pre-flight call.
+//
+// So an unreadable tag still sends the whole history — a first deploy must
+// work for a token that cannot list scripts — but Deploy no longer treats the
+// precondition refusal as noise. Cloudflare's 10079 names the tag the script
+// actually carries; that answer is better than the pre-flight read's, and it is
+// what the retry is computed from (expectedMigrationTag).
+func (c *Client) deployedMigrationTag(ctx context.Context, accountID, script string) (tag string, known bool) {
+	raw, err := c.call(ctx, apiCall{
+		method: http.MethodGet,
+		path:   fmt.Sprintf("/accounts/%s/workers/scripts", accountID),
+	})
+	if err != nil {
+		return "", false
+	}
+	var scripts []struct {
+		ID           string `json:"id"`
+		MigrationTag string `json:"migration_tag"`
+	}
+	if err := json.Unmarshal(raw, &scripts); err != nil {
+		return "", false
+	}
+	for _, s := range scripts {
+		if s.ID == script {
+			return s.MigrationTag, true
+		}
+	}
+	// The account answered and this script is not in the list: it does not
+	// exist yet, which is a fact and a first deploy.
+	return "", true
+}
+
 type assetsMetadata struct {
 	JWT    string       `json:"jwt"`
 	Config assetsConfig `json:"config"`
@@ -585,10 +756,28 @@ func (c *Client) Deploy(ctx context.Context, in DeployInput) error {
 		meta.Bindings = append(meta.Bindings, binding{Type: "assets", Name: in.AssetsBinding})
 	}
 
-	if len(in.NewSQLiteClasses) > 0 {
-		meta.Migrations = &migrations{
-			NewTag: migrationTag,
-			Steps:  []migrationStep{{NewSQLiteClasses: in.NewSQLiteClasses}},
+	// Which steps are outstanding is a fact about the account, so it is read
+	// from the account. The alternative — sending the same migration every
+	// time and letting migrationAlreadyApplied absorb the refusal — worked
+	// only while the history was one step long: a relay sitting at v1 that
+	// needs v2 gets its v2 request refused on the precondition, and the retry
+	// that drops migrations then uploads a script whose DIRECTORY binding
+	// names a class no migration ever created. Cloudflare refuses that too,
+	// so nothing deploys silently wrong — but nothing deploys at all, which is
+	// every existing relay unable to take the update that adds the directory.
+	if len(in.Migrations) > 0 {
+		tag, known := c.deployedMigrationTag(ctx, in.AccountID, in.ScriptName)
+		meta.Migrations = pendingMigrations(in.Migrations, tag, known)
+		// The one silent branch in pendingMigrations, given a voice. A tag this
+		// binary has never heard of means the account's relay was deployed by a
+		// *newer* flue, and sending an older history over it would undo a
+		// migration this binary does not know about — so nothing is sent, which
+		// is right and looks like nothing happening. If that newer Worker
+		// introduced a class this module does not export, the upload that
+		// follows is refused with a 10061 naming a Durable Object, and without
+		// this line there is nothing anywhere connecting the two.
+		if known && tag != "" && !slices.ContainsFunc(in.Migrations, func(m Migration) bool { return m.Tag == tag }) && in.OnNote != nil {
+			in.OnNote(fmt.Sprintf("this relay is at migration %s, which this flue does not know: it was deployed by a newer flue. no migration is being applied, and the upload will be refused if that flue's worker had Durable Object classes this one does not carry — update flue first", tag))
 		}
 	}
 
@@ -613,34 +802,71 @@ func (c *Client) Deploy(ctx context.Context, in DeployInput) error {
 	}
 
 	err := c.putScript(ctx, in, meta)
-	if err != nil && meta.Migrations != nil && migrationAlreadyApplied(err) {
-		// Re-running setup against an account that already has the Worker is an
-		// ordinary thing to do — after a failed run, or to pick up a new build.
-		// Cloudflare refuses to apply a migration it has already applied, so the
-		// deploy is retried once without it. The classes still exist; only the
-		// migration is redundant.
+	if err == nil || meta.Migrations == nil {
+		return err
+	}
+	switch {
+	case isMigrationPrecondition(err):
+		// Cloudflare refused the migration because the script does not carry
+		// the tag this upload claimed it did — and its message names the tag it
+		// *does* carry. That is a better answer than the pre-flight read gave,
+		// so it is the one the retry is computed from: the same rule
+		// pendingMigrations applies to a tag off the script list, applied to a
+		// tag off the refusal.
+		//
+		// This is the path an existing v1 relay lands on when the pre-flight
+		// read failed and this deploy therefore guessed "first deploy". Before,
+		// it was answered by dropping migrations altogether, which uploaded a
+		// script binding FleetDirectory to a class no migration had created —
+		// refused in turn, so `flue relay update` died on every existing relay
+		// whose pre-flight read had a bad second. Now it is answered by sending
+		// the v2 step with old_tag: v1, which is what it needed.
+		want, ok := expectedMigrationTag(err)
+		if !ok {
+			// The refusal is a tag precondition and its message did not name
+			// the expected tag. Fail closed, which is what wrangler does here:
+			// there is nothing to compute a correct migration from, and the
+			// alternative — retry with none — is the very move that produces
+			// the second, more confusing refusal.
+			return err
+		}
+		next := pendingMigrations(in.Migrations, want, true)
+		if sameMigrations(next, meta.Migrations) {
+			// Cloudflare named the tag this upload already assumed, so the
+			// refusal was not about the tag being wrong. Retrying byte for byte
+			// would bury the real error behind a copy of itself.
+			return err
+		}
+		meta.Migrations = next
+	case migrationAlreadyApplied(err):
+		// A migration Cloudflare has already run. Distinct from the
+		// precondition above and left as it was: there is nothing to recompute
+		// — the classes exist, only the migration is redundant — so the retry
+		// simply drops it. The cases that reach here are a deploy racing
+		// another and an account whose script list lags its script.
 		meta.Migrations = nil
+	default:
+		return err
+	}
 
-		// The asset completion token was spent on the PUT that just failed, and
-		// Cloudflare does not document whether it survives a rejected upload.
-		// Rather than bet the whole idempotent-re-run path on it being reusable,
-		// the retry opens a fresh upload session. That session costs one request
-		// and no uploads in the normal case: every file is already stored, so it
-		// comes back with no buckets and its own token is the completion token.
-		if meta.Assets != nil {
-			jwt, refreshErr := c.uploadAssets(ctx, in.AccountID, in.ScriptName, in.Assets)
-			if refreshErr != nil {
-				// Both halves are wrapped. The refresh failure is what stopped
-				// the retry, but the deploy failure is why there was a retry at
-				// all, and dropping it leaves the user with a session error and
-				// no sign that a migration conflict is the thing to fix.
-				return fmt.Errorf("cloudflare: re-attaching the assets to retry without the already-applied migration: %w (the deploy this retried failed with: %w)", refreshErr, err)
-			}
-			meta.Assets.JWT = jwt
+	// The asset completion token was spent on the PUT that just failed, and
+	// Cloudflare does not document whether it survives a rejected upload.
+	// Rather than bet the whole idempotent-re-run path on it being reusable,
+	// the retry opens a fresh upload session. That session costs one request
+	// and no uploads in the normal case: every file is already stored, so it
+	// comes back with no buckets and its own token is the completion token.
+	if meta.Assets != nil {
+		jwt, refreshErr := c.uploadAssets(ctx, in.AccountID, in.ScriptName, in.Assets)
+		if refreshErr != nil {
+			// Both halves are wrapped. The refresh failure is what stopped the
+			// retry, but the deploy failure is why there was a retry at all,
+			// and dropping it leaves the user with a session error and no sign
+			// that a migration conflict is the thing to fix.
+			return fmt.Errorf("cloudflare: re-attaching the assets to retry the migration: %w (the deploy this retried failed with: %w)", refreshErr, err)
 		}
-		err = c.putScript(ctx, in, meta)
+		meta.Assets.JWT = jwt
 	}
-	return err
+	return c.putScript(ctx, in, meta)
 }
 
 // putScript sends the multipart script upload: the metadata part and the
@@ -690,6 +916,60 @@ func (c *Client) putScript(ctx context.Context, in DeployInput, meta scriptMetad
 	return err
 }
 
+// isMigrationPrecondition reports whether err is Cloudflare refusing an upload
+// because the script does not carry the migration tag the upload claimed.
+//
+// 10079 is the code: "Actor migration tag precondition failed, got tag '' when
+// expected tag is 'v1'" — the request's `old_tag` (or its absence) did not
+// match what the account has recorded against the script. Seen live on the
+// first real `flue relay update`. The prose is matched beside the code because
+// Cloudflare has reported this condition under more than one code, and this
+// wording carries neither "migration … already" word the redundant-migration
+// refusal does.
+//
+// It is deliberately *not* folded into migrationAlreadyApplied. The two
+// refusals want opposite repairs: this one means "you named the wrong tag, here
+// is the right one", and dropping migrations in answer to it uploads a script
+// whose binding names a class no migration created.
+func isMigrationPrecondition(err error) bool {
+	var apiErr *APIError
+	if !errors.As(err, &apiErr) {
+		return false
+	}
+	return apiErr.Code == 10079 ||
+		strings.Contains(strings.ToLower(apiErr.Message), "migration tag precondition")
+}
+
+// expectedTagPattern pulls the tag out of a precondition refusal. Cloudflare's
+// message names both tags — "got tag 'x' when expected tag is 'y'" — and the
+// expected one is the fact this client is missing: it is what the account has
+// actually recorded against the script, from the account itself, at the moment
+// of the deploy. An empty capture is meaningful and is why the quantifier is
+// `*`: "expected tag is ''" says the script carries no migration history.
+var expectedTagPattern = regexp.MustCompile(`expected tag is '([^']*)'`)
+
+// expectedMigrationTag is the tag Cloudflare says the script really carries,
+// read out of a precondition refusal.
+//
+// ok is false when the refusal is not a precondition at all, or when it is one
+// whose message does not name the expected tag — a wording change, say. The
+// caller fails closed on that rather than guessing, because every guess
+// available here is one that has already been tried and refused.
+func expectedMigrationTag(err error) (tag string, ok bool) {
+	if !isMigrationPrecondition(err) {
+		return "", false
+	}
+	var apiErr *APIError
+	if !errors.As(err, &apiErr) {
+		return "", false
+	}
+	m := expectedTagPattern.FindStringSubmatch(apiErr.Message)
+	if m == nil {
+		return "", false
+	}
+	return m[1], true
+}
+
 // migrationAlreadyApplied reports whether err is Cloudflare refusing a Durable
 // Object migration that the account has already run.
 //
@@ -700,37 +980,28 @@ func (c *Client) putScript(ctx context.Context, in DeployInput, meta scriptMetad
 // also catch a mismatched tag or a class that is not in the script — and for
 // those, retrying without migrations could succeed, deploying a Worker whose
 // Durable Object was never migrated and burying the real error behind a
-// second request.
+// second request. The mismatched-tag half of that is now its own case above,
+// with its own repair.
 //
 // Known residual: "…already depended on by existing Durable Objects" matches
 // here, and it is the message a genuine re-run produces — but Cloudflare uses
 // wording in that family for a *different* condition too, where the class is
 // already in use with a non-SQLite backend. That case is not an idempotent
 // re-run and dropping the migration would leave the mismatch in place. The two
-// are not separable from the text alone, and closing the gap needs a live
-// signal (the deployed script's migration_tag, read before deploying) that
-// this client does not currently fetch. Left open deliberately: the failure
-// mode is a confusing error on an account that cannot work anyway, not a
+// are not separable from the text alone.
+//
+// The live signal that narrows it — the deployed script's migration_tag — is
+// read before deploying (deployedMigrationTag), which is what makes the
+// ordinary re-run send no migration and never reach this function. The residual
+// survives only where that read came back unknown, and its failure mode is
+// unchanged: a confusing error on an account that cannot work anyway, not a
 // silently wrong deploy of a fresh one.
 func migrationAlreadyApplied(err error) bool {
 	var apiErr *APIError
 	if !errors.As(err, &apiErr) {
 		return false
 	}
-	// 10079 is the tag-precondition refusal: "Actor migration tag
-	// precondition failed, got tag '' when expected tag is 'v1'" — the
-	// script already carries the tag this deploy's migration would apply,
-	// and the request's implied "currently untagged" is what failed. Seen
-	// live on the first real `flue relay update`; its wording carries
-	// neither "migration … already" word the older refusal does, which is
-	// why the code is matched and not just the prose.
-	if apiErr.Code == 10079 {
-		return true
-	}
 	msg := strings.ToLower(apiErr.Message)
-	if strings.Contains(msg, "migration tag precondition") {
-		return true
-	}
 	return strings.Contains(msg, "migration") && strings.Contains(msg, "already")
 }
 
diff --git a/internal/cloudflare/client_test.go b/internal/cloudflare/client_test.go
index d8062b2..5da1e28 100644
--- a/internal/cloudflare/client_test.go
+++ b/internal/cloudflare/client_test.go
@@ -43,14 +43,17 @@ const (
 // to reproduce over the REST API.
 func deployFixture() DeployInput {
 	return DeployInput{
-		AccountID:            "acct-123",
-		ScriptName:           "flue-relay",
-		Module:               []byte("export default { fetch() {} };\n"),
-		CompatibilityDate:    "2026-08-01",
-		NewSQLiteClasses:     []string{"DaemonHub"},
-		DOBindings:           map[string]string{"HUB": "DaemonHub"},
+		AccountID:         "acct-123",
+		ScriptName:        "flue-relay",
+		Module:            []byte("export default { fetch() {} };\n"),
+		CompatibilityDate: "2026-08-01",
+		Migrations: []Migration{
+			{Tag: "v1", NewSQLiteClasses: []string{"DaemonHub"}},
+			{Tag: "v2", NewSQLiteClasses: []string{"FleetDirectory"}},
+		},
+		DOBindings:           map[string]string{"HUB": "DaemonHub", "DIRECTORY": "FleetDirectory"},
 		Assets:               []Asset{assetHTML, assetJS, assetCSS},
-		AssetsRunWorkerFirst: []string{"/daemon", "/client", "/api/*"},
+		AssetsRunWorkerFirst: []string{"/daemon", "/client", "/api/*", "/directory", "/directory/*"},
 		AssetHeaders:         "/*\n  X-Fixture: yes\n",
 		AssetsBinding:        "ASSETS",
 		RateLimits:           []RateLimit{{Name: "CLIENT_RATE", NamespaceID: "1001", Limit: 300, Period: 60}},
@@ -77,10 +80,29 @@ type fixture struct {
 	t   *testing.T
 	srv *httptest.Server
 
+	// deployedTag is the migration tag this account's copy of the script
+	// carries, answered on the script-list endpoint Deploy reads it from
+	// (deployedMigrationTag). Empty is the honest default: an account with no
+	// script yet. Tests that model a relay already deployed set it before
+	// calling Deploy.
+	//
+	// It is answered by the fixture itself rather than by each test's handler
+	// because it is a pre-flight read every deploy makes, and thirty handlers
+	// each restating "and this is the script list" would be thirty chances to
+	// state it differently. The request is still recorded, so a test can
+	// assert that the read happened and what it asked for.
+	deployedTag string
+	// noScriptList makes the endpoint 404 through the test's own handler
+	// instead, which is how "the lookup failed" is staged.
+	noScriptList bool
+
 	mu   sync.Mutex
 	reqs []recorded
 }
 
+// scriptListPath is the endpoint Deploy reads the deployed migration tag from.
+const scriptListPath = "/accounts/acct-123/workers/scripts"
+
 func newFixture(t *testing.T, h func(w http.ResponseWriter, r *http.Request, body []byte)) *fixture {
 	t.Helper()
 	f := &fixture{t: t}
@@ -102,12 +124,32 @@ func newFixture(t *testing.T, h func(w http.ResponseWriter, r *http.Request, bod
 			Header:      r.Header.Clone(),
 		})
 		f.mu.Unlock()
+		if r.Method == http.MethodGet && r.URL.Path == scriptListPath && !f.noScriptList {
+			f.writeScriptList(w)
+			return
+		}
 		h(w, r, body)
 	}))
 	t.Cleanup(f.srv.Close)
 	return f
 }
 
+// writeScriptList answers the account's script list the way Cloudflare does:
+// one entry per script, carrying its id and its migration tag. An empty
+// deployedTag answers an empty account, which is a first deploy.
+func (f *fixture) writeScriptList(w http.ResponseWriter) {
+	if f.deployedTag == "" {
+		writeEnvelope(f.t, w, http.StatusOK, []any{})
+		return
+	}
+	writeEnvelope(f.t, w, http.StatusOK, []any{
+		// A neighbouring script, so "find the entry whose id matches" is
+		// tested rather than "take the first one".
+		map[string]any{"id": "someone-elses-worker", "migration_tag": "v9"},
+		map[string]any{"id": "flue-relay", "migration_tag": f.deployedTag},
+	})
+}
+
 func (f *fixture) client() *Client {
 	return &Client{Token: testToken, Base: f.srv.URL}
 }
@@ -156,6 +198,23 @@ func writeEnvelope(t *testing.T, w http.ResponseWriter, status int, result any)
 	fmt.Fprintf(w, `{"success":true,"errors":[],"messages":[],"result":%s}`, raw)
 }
 
+// scriptPut is the one script upload a deploy made, found by method rather
+// than by position: the requests around it (the migration-tag read, the asset
+// session, the buckets) come and go with the input.
+func scriptPut(t *testing.T, f *fixture) recorded {
+	t.Helper()
+	var found []recorded
+	for _, r := range f.requests() {
+		if r.Method == http.MethodPut {
+			found = append(found, r)
+		}
+	}
+	if len(found) != 1 {
+		t.Fatalf("got %d script PUTs, want 1: %s", len(found), f.paths())
+	}
+	return found[0]
+}
+
 // writeAPIError writes a Cloudflare failure envelope.
 func writeAPIError(w http.ResponseWriter, status, code int, message string) {
 	w.Header().Set("Content-Type", "application/json")
@@ -675,12 +734,19 @@ func TestDeployUploadsAssetsThenPutsTheScript(t *testing.T) {
 	}
 
 	reqs := f.requests()
-	if len(reqs) != 4 {
-		t.Fatalf("got %d requests (%s), want 4: session, 2 uploads, script PUT", len(reqs), f.paths())
+	if len(reqs) != 5 {
+		t.Fatalf("got %d requests (%s), want 5: the migration-tag read, the session, 2 uploads, the script PUT", len(reqs), f.paths())
+	}
+
+	// --- the migration tag is read first ----------------------------------
+	// Before anything is uploaded, because it decides what the script upload
+	// at the end of this list will carry.
+	if tagRead := reqs[0]; tagRead.Method != http.MethodGet || tagRead.Path != scriptListPath {
+		t.Errorf("first request = %s %s, want GET %s", tagRead.Method, tagRead.Path, scriptListPath)
 	}
 
 	// --- the upload session carries the manifest -------------------------
-	session := reqs[0]
+	session := reqs[1]
 	if session.Method != http.MethodPost {
 		t.Errorf("session method = %s, want POST", session.Method)
 	}
@@ -724,7 +790,7 @@ func TestDeployUploadsAssetsThenPutsTheScript(t *testing.T) {
 			hashCSS: {assetCSS.Body, "text/css; charset=utf-8"},
 		},
 	}
-	for i, up := range reqs[1:3] {
+	for i, up := range reqs[2:4] {
 		if up.Method != http.MethodPost {
 			t.Errorf("upload %d method = %s, want POST", i, up.Method)
 		}
@@ -762,7 +828,7 @@ func TestDeployUploadsAssetsThenPutsTheScript(t *testing.T) {
 	}
 
 	// --- the script PUT ---------------------------------------------------
-	script := reqs[3]
+	script := reqs[4]
 	if script.Method != http.MethodPut {
 		t.Errorf("script method = %s, want PUT", script.Method)
 	}
@@ -1069,7 +1135,8 @@ func TestDeployMetadataIsDeterministic(t *testing.T) {
 		if err := f.client().Deploy(context.Background(), in); err != nil {
 			t.Fatalf("Deploy: %v", err)
 		}
-		meta := partNamed(t, parseParts(t, f.requests()[1].ContentType, f.requests()[1].Body), "metadata")
+		put := scriptPut(t, f)
+		meta := partNamed(t, parseParts(t, put.ContentType, put.Body), "metadata")
 		if first == nil {
 			first = meta.Body
 			continue
@@ -1135,12 +1202,11 @@ func TestDeployWithoutAssetsSkipsTheSessionEntirely(t *testing.T) {
 	}
 }
 
-// TestDeployOmitsMigrationsWhenNoNewClasses: a re-deploy passes no new SQLite
-// classes, and sending a migration then would be an error on Cloudflare's side.
-func TestDeployOmitsMigrationsWhenNoNewClasses(t *testing.T) {
-	in := deployFixture()
-	in.NewSQLiteClasses = nil
-
+// TestDeployOmitsMigrationsWhenTheScriptIsUpToDate: a relay already carrying
+// the last tag in the history has nothing to migrate, and sending a migration
+// then is the refusal this client used to spend a whole extra script upload
+// recovering from.
+func TestDeployOmitsMigrationsWhenTheScriptIsUpToDate(t *testing.T) {
 	f := deployServer(t, nil, func(w http.ResponseWriter, parts []part) {
 		meta := partNamed(t, parts, "metadata")
 		var m map[string]any
@@ -1148,12 +1214,384 @@ func TestDeployOmitsMigrationsWhenNoNewClasses(t *testing.T) {
 			t.Fatalf("decoding metadata: %v", err)
 		}
 		if _, ok := m["migrations"]; ok {
-			t.Errorf("metadata carries migrations with no new classes: %s", meta.Body)
+			t.Errorf("metadata carries migrations for a script already at the last tag: %s", meta.Body)
 		}
-		// The durable object binding must survive: the class still exists, it
+		// The durable object bindings must survive: the classes still exist, it
 		// is only the migration that has already been applied.
 		if _, ok := m["bindings"]; !ok {
-			t.Errorf("metadata dropped the durable object binding: %s", meta.Body)
+			t.Errorf("metadata dropped the durable object bindings: %s", meta.Body)
+		}
+		writeEnvelope(t, w, http.StatusOK, map[string]any{"id": "flue-relay"})
+	})
+	f.deployedTag = "v2"
+
+	if err := f.client().Deploy(context.Background(), deployFixture()); err != nil {
+		t.Fatalf("Deploy: %v", err)
+	}
+}
+
+// TestDeployMigratesAnExistingRelayForward is the upgrade this whole mechanism
+// exists for: a relay deployed before the fleet directory sits at v1, and the
+// deploy that adds FleetDirectory has to apply v2 *and only* v2, against the
+// precondition that the script is still at v1.
+//
+// The failure it guards is not subtle but it is invisible from here: a client
+// that re-sent v1's step would be refused on the tag precondition, and the
+// retry that drops migrations would then upload a script whose DIRECTORY
+// binding names a class no migration ever created — which Cloudflare also
+// refuses, leaving every existing relay unable to take the update.
+func TestDeployMigratesAnExistingRelayForward(t *testing.T) {
+	var got struct {
+		Migrations *struct {
+			OldTag string `json:"old_tag"`
+			NewTag string `json:"new_tag"`
+			Steps  []struct {
+				NewSQLiteClasses []string `json:"new_sqlite_classes"`
+			} `json:"steps"`
+		} `json:"migrations"`
+	}
+	f := deployServer(t, nil, func(w http.ResponseWriter, parts []part) {
+		if err := json.Unmarshal(partNamed(t, parts, "metadata").Body, &got); err != nil {
+			t.Fatalf("decoding metadata: %v", err)
+		}
+		writeEnvelope(t, w, http.StatusOK, map[string]any{"id": "flue-relay"})
+	})
+	f.deployedTag = "v1"
+
+	if err := f.client().Deploy(context.Background(), deployFixture()); err != nil {
+		t.Fatalf("Deploy: %v", err)
+	}
+	if got.Migrations == nil {
+		t.Fatal("a v1 script was sent no migration; FleetDirectory would never exist")
+	}
+	if got.Migrations.OldTag != "v1" || got.Migrations.NewTag != "v2" {
+		t.Errorf("migration tags = %q -> %q, want v1 -> v2", got.Migrations.OldTag, got.Migrations.NewTag)
+	}
+	if len(got.Migrations.Steps) != 1 ||
+		!reflect.DeepEqual(got.Migrations.Steps[0].NewSQLiteClasses, []string{"FleetDirectory"}) {
+		t.Errorf("steps = %+v, want exactly the v2 step introducing FleetDirectory", got.Migrations.Steps)
+	}
+}
+
+// TestDeployReadsTheDeployedTagFromTheAccount pins where the tag comes from.
+// It is the account's script list — the same fact wrangler reads, from the same
+// endpoint — because a migration precondition can only be computed from what
+// the account actually carries.
+func TestDeployReadsTheDeployedTagFromTheAccount(t *testing.T) {
+	f := deployServer(t, nil, func(w http.ResponseWriter, _ []part) {
+		writeEnvelope(t, w, http.StatusOK, map[string]any{"id": "flue-relay"})
+	})
+	f.deployedTag = "v1"
+	if err := f.client().Deploy(context.Background(), deployFixture()); err != nil {
+		t.Fatalf("Deploy: %v", err)
+	}
+	var asked int
+	for _, r := range f.requests() {
+		if r.Method == http.MethodGet && r.Path == scriptListPath {
+			asked++
+		}
+	}
+	if asked != 1 {
+		t.Errorf("script-list reads = %d, want exactly 1: %s", asked, f.paths())
+	}
+}
+
+// TestDeployFallsBackToTheWholeHistoryWhenTheTagIsUnreadable: the pre-flight
+// read is a convenience, not a gate. A token that cannot list scripts, or an
+// endpoint having a bad minute, must leave the deploy exactly as capable as it
+// was before this client could ask — the whole history, and the already-applied
+// retry behind it — rather than refusing to deploy over a read-only call.
+func TestDeployFallsBackToTheWholeHistoryWhenTheTagIsUnreadable(t *testing.T) {
+	var sentSteps int
+	f := newFixture(t, func(w http.ResponseWriter, r *http.Request, body []byte) {
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == scriptListPath:
+			writeAPIError(w, http.StatusForbidden, 10000, "Authentication error")
+		case strings.HasSuffix(r.URL.Path, "/assets-upload-session"):
+			writeEnvelope(t, w, http.StatusOK, map[string]any{"jwt": "session-jwt", "buckets": [][]string{}})
+		default:
+			var m struct {
+				Migrations *struct {
+					OldTag string `json:"old_tag"`
+					Steps  []any  `json:"steps"`
+				} `json:"migrations"`
+			}
+			if err := json.Unmarshal(partNamed(t, parseParts(t, r.Header.Get("Content-Type"), body), "metadata").Body, &m); err != nil {
+				t.Fatalf("decoding metadata: %v", err)
+			}
+			if m.Migrations == nil {
+				t.Fatal("no migration sent when the tag could not be read")
+			}
+			if m.Migrations.OldTag != "" {
+				t.Errorf("old_tag = %q, want none: an unreadable tag cannot claim a precondition", m.Migrations.OldTag)
+			}
+			sentSteps = len(m.Migrations.Steps)
+			writeEnvelope(t, w, http.StatusOK, map[string]any{"id": "flue-relay"})
+		}
+	})
+	f.noScriptList = true
+
+	if err := f.client().Deploy(context.Background(), deployFixture()); err != nil {
+		t.Fatalf("Deploy: %v", err)
+	}
+	if sentSteps != 2 {
+		t.Errorf("steps sent = %d, want the whole history (2)", sentSteps)
+	}
+}
+
+// sentMigrations decodes the migration object out of one script upload's
+// metadata part, or nil when the upload carried none.
+type sentMigrations struct {
+	OldTag string `json:"old_tag"`
+	NewTag string `json:"new_tag"`
+	Steps  []struct {
+		NewSQLiteClasses []string `json:"new_sqlite_classes"`
+	} `json:"steps"`
+}
+
+func migrationsIn(t *testing.T, r recorded) *sentMigrations {
+	t.Helper()
+	var m struct {
+		Migrations *sentMigrations `json:"migrations"`
+	}
+	body := partNamed(t, parseParts(t, r.ContentType, r.Body), "metadata").Body
+	if err := json.Unmarshal(body, &m); err != nil {
+		t.Fatalf("decoding metadata: %v", err)
+	}
+	return m.Migrations
+}
+
+func scriptPuts(f *fixture) []recorded {
+	var out []recorded
+	for _, r := range f.requests() {
+		if r.Method == http.MethodPut && r.Path == "/accounts/acct-123/workers/scripts/flue-relay" {
+			out = append(out, r)
+		}
+	}
+	return out
+}
+
+// TestDeployRecoversTheUpgradeWhenTheTagReadFailed is the v1 → v2 upgrade
+// surviving a five-second network blip, which is the deploy this whole release
+// requires an existing relay to take.
+//
+// The chain it guards: the pre-flight script-list read times out, so the deploy
+// has no tag and sends the whole history with no old_tag; Cloudflare refuses
+// that on the precondition (10079) and *names the tag the script really
+// carries*. The recovery has to read that name and retry with `old_tag: v1` and
+// v2's step alone. Answering the refusal by dropping migrations instead — which
+// is what a blanket already-applied recovery does — uploads a script whose
+// DIRECTORY binding names a class no migration ever created, is refused again,
+// and leaves `flue relay update` dead on every relay whose pre-flight read had
+// a bad second.
+func TestDeployRecoversTheUpgradeWhenTheTagReadFailed(t *testing.T) {
+	f := newFixture(t, func(w http.ResponseWriter, r *http.Request, body []byte) {
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == scriptListPath:
+			// The transient failure: a read-only pre-flight call having a bad
+			// minute. The deploy has no tag to work from.
+			writeAPIError(w, http.StatusGatewayTimeout, 10000, "internal error")
+		case strings.HasSuffix(r.URL.Path, "/assets-upload-session"):
+			writeEnvelope(t, w, http.StatusOK, map[string]any{"jwt": "session-jwt", "buckets": [][]string{}})
+		default:
+			var m struct {
+				Migrations *sentMigrations `json:"migrations"`
+			}
+			if err := json.Unmarshal(partNamed(t, parseParts(t, r.Header.Get("Content-Type"), body), "metadata").Body, &m); err != nil {
+				t.Fatalf("decoding metadata: %v", err)
+			}
+			switch {
+			case m.Migrations != nil && m.Migrations.OldTag == "v1":
+				// The correct upload for a script at v1.
+				writeEnvelope(t, w, http.StatusOK, map[string]any{"id": "flue-relay"})
+			case m.Migrations == nil:
+				// What a blanket already-applied recovery sends, and what
+				// Cloudflare does with it: the script binds DIRECTORY to a
+				// class no migration created.
+				writeAPIError(w, http.StatusBadRequest, 10061,
+					"Uncaught TypeError: Cannot read properties of undefined; binding DIRECTORY refers to class FleetDirectory which is not exported by the script")
+			default:
+				// The first attempt: the whole history with no old_tag, which
+				// this script — already at v1 — refuses on the precondition.
+				// The message is Cloudflare's own, and naming the expected tag
+				// is the fact the client is missing.
+				writeAPIError(w, http.StatusBadRequest, 10079,
+					"Actor migration tag precondition failed, got tag '' when expected tag is 'v1'")
+			}
+		}
+	})
+	f.noScriptList = true
+
+	if err := f.client().Deploy(context.Background(), deployFixture()); err != nil {
+		t.Fatalf("Deploy after an unreadable tag and a precondition refusal: %v", err)
+	}
+
+	puts := scriptPuts(f)
+	if len(puts) != 2 {
+		t.Fatalf("script PUTs = %d, want 2 (the guess and the correction): %s", len(puts), f.paths())
+	}
+	first := migrationsIn(t, puts[0])
+	if first == nil || first.OldTag != "" || len(first.Steps) != 2 {
+		t.Errorf("first upload = %+v, want the whole history with no old_tag", first)
+	}
+	got := migrationsIn(t, puts[1])
+	if got == nil {
+		t.Fatal("the retry dropped migrations; FleetDirectory would never be created")
+	}
+	if got.OldTag != "v1" || got.NewTag != "v2" {
+		t.Errorf("retry tags = %q -> %q, want v1 -> v2 read out of Cloudflare's own message", got.OldTag, got.NewTag)
+	}
+	if len(got.Steps) != 1 || !reflect.DeepEqual(got.Steps[0].NewSQLiteClasses, []string{"FleetDirectory"}) {
+		t.Errorf("retry steps = %+v, want exactly the v2 step", got.Steps)
+	}
+}
+
+// TestDeployFailsClosedOnAnUnreadablePrecondition: a tag precondition whose
+// message does not name the expected tag leaves nothing to compute a correct
+// migration from. wrangler fails closed there and so does this — the one
+// alternative, retrying with no migrations, is exactly the move that turns one
+// clear refusal into a second, more confusing one.
+func TestDeployFailsClosedOnAnUnreadablePrecondition(t *testing.T) {
+	f := newFixture(t, func(w http.ResponseWriter, r *http.Request, _ []byte) {
+		switch {
+		case r.Method == http.MethodGet && r.URL.Path == scriptListPath:
+			writeAPIError(w, http.StatusForbidden, 10000, "Authentication error")
+		case strings.HasSuffix(r.URL.Path, "/assets-upload-session"):
+			writeEnvelope(t, w, http.StatusOK, map[string]any{"jwt": "session-jwt", "buckets": [][]string{}})
+		default:
+			writeAPIError(w, http.StatusBadRequest, 10079, "Actor migration tag precondition failed")
+		}
+	})
+	f.noScriptList = true
+
+	err := f.client().Deploy(context.Background(), deployFixture())
+	if err == nil {
+		t.Fatal("Deploy succeeded on a precondition it could not repair")
+	}
+	// The refusal reaches the user intact rather than as whatever a blind
+	// second attempt would have produced.
+	if !strings.Contains(err.Error(), "precondition") {
+		t.Errorf("the error lost the precondition refusal: %v", err)
+	}
+	if puts := scriptPuts(f); len(puts) != 1 {
+		t.Errorf("script PUTs = %d, want 1: a refusal with nothing to learn from is not retried", len(puts))
+	}
+}
+
+// TestDeployDoesNotRetryATagItAlreadyClaimed: Cloudflare naming the very tag
+// this upload sent means the refusal was about something else, and a byte-
+// identical second attempt would bury the real error behind a copy of itself.
+func TestDeployDoesNotRetryATagItAlreadyClaimed(t *testing.T) {
+	f := newFixture(t, func(w http.ResponseWriter, r *http.Request, _ []byte) {
+		switch {
+		case strings.HasSuffix(r.URL.Path, "/assets-upload-session"):
+			writeEnvelope(t, w, http.StatusOK, map[string]any{"jwt": "session-jwt", "buckets": [][]string{}})
+		default:
+			writeAPIError(w, http.StatusBadRequest, 10079,
+				"Actor migration tag precondition failed, got tag 'v1' when expected tag is 'v1'")
+		}
+	})
+	f.deployedTag = "v1"
+
+	if err := f.client().Deploy(context.Background(), deployFixture()); err == nil {
+		t.Fatal("Deploy succeeded against a relay that refused every upload")
+	}
+	if puts := scriptPuts(f); len(puts) != 1 {
+		t.Errorf("script PUTs = %d, want 1: the retry would have been identical", len(puts))
+	}
+}
+
+// TestDeployLeavesANewerScriptAlone: a script carrying a tag this binary has
+// never heard of was deployed by a newer flue, and replaying this binary's
+// older history over it would undo a migration it does not know about.
+func TestDeployLeavesANewerScriptAlone(t *testing.T) {
+	f := deployServer(t, nil, func(w http.ResponseWriter, parts []part) {
+		var m map[string]any
+		if err := json.Unmarshal(partNamed(t, parts, "metadata").Body, &m); err != nil {
+			t.Fatalf("decoding metadata: %v", err)
+		}
+		if _, ok := m["migrations"]; ok {
+			t.Errorf("metadata carries a migration for a script from a newer flue: %v", m["migrations"])
+		}
+		writeEnvelope(t, w, http.StatusOK, map[string]any{"id": "flue-relay"})
+	})
+	f.deployedTag = "v7"
+
+	if err := f.client().Deploy(context.Background(), deployFixture()); err != nil {
+		t.Fatalf("Deploy: %v", err)
+	}
+}
+
+// TestDeploySaysWhenTheRelayIsFromANewerFlue: leaving a newer script's
+// migrations alone is right, and it used to be indistinguishable from nothing
+// happening. If that newer Worker carried a Durable Object class this module
+// does not, the upload is refused with a 10061 naming the class — and nothing
+// anywhere connected that to "you are running an older flue than the one that
+// deployed this relay".
+func TestDeploySaysWhenTheRelayIsFromANewerFlue(t *testing.T) {
+	var notes []string
+	in := deployFixture()
+	in.OnNote = func(line string) { notes = append(notes, line) }
+
+	f := deployServer(t, nil, func(w http.ResponseWriter, _ []part) {
+		writeEnvelope(t, w, http.StatusOK, map[string]any{"id": "flue-relay"})
+	})
+	f.deployedTag = "v7"
+
+	if err := f.client().Deploy(context.Background(), in); err != nil {
+		t.Fatalf("Deploy: %v", err)
+	}
+	if len(notes) != 1 {
+		t.Fatalf("notes = %v, want exactly one about the unknown tag", notes)
+	}
+	// The tag is in the line: it is the one fact the user can act on, and
+	// "newer flue" without it is a claim they cannot check.
+	if !strings.Contains(notes[0], "v7") {
+		t.Errorf("the note does not name the tag: %q", notes[0])
+	}
+	if !strings.Contains(notes[0], "newer flue") {
+		t.Errorf("the note does not say what an unknown tag means: %q", notes[0])
+	}
+}
+
+// TestDeploySaysNothingWhenThereIsNothingToSay: a note is not progress, and a
+// deploy that goes to plan must not produce one — an ordinary run, and an
+// upgrade from a tag this binary does know.
+func TestDeploySaysNothingWhenThereIsNothingToSay(t *testing.T) {
+	for _, tag := range []string{"", "v1", "v2"} {
+		t.Run("tag="+tag, func(t *testing.T) {
+			var notes []string
+			in := deployFixture()
+			in.OnNote = func(line string) { notes = append(notes, line) }
+
+			f := deployServer(t, nil, func(w http.ResponseWriter, _ []part) {
+				writeEnvelope(t, w, http.StatusOK, map[string]any{"id": "flue-relay"})
+			})
+			f.deployedTag = tag
+
+			if err := f.client().Deploy(context.Background(), in); err != nil {
+				t.Fatalf("Deploy: %v", err)
+			}
+			if len(notes) != 0 {
+				t.Errorf("notes on an ordinary deploy: %v", notes)
+			}
+		})
+	}
+}
+
+// TestDeployOmitsMigrationsWithNoHistory: a caller with nothing to migrate
+// sends no migration object at all, and asks the account nothing.
+func TestDeployOmitsMigrationsWithNoHistory(t *testing.T) {
+	in := deployFixture()
+	in.Migrations = nil
+
+	f := deployServer(t, nil, func(w http.ResponseWriter, parts []part) {
+		var m map[string]any
+		if err := json.Unmarshal(partNamed(t, parts, "metadata").Body, &m); err != nil {
+			t.Fatalf("decoding metadata: %v", err)
+		}
+		if _, ok := m["migrations"]; ok {
+			t.Errorf("metadata carries migrations with no history: %v", m["migrations"])
 		}
 		writeEnvelope(t, w, http.StatusOK, map[string]any{"id": "flue-relay"})
 	})
@@ -1161,6 +1599,11 @@ func TestDeployOmitsMigrationsWhenNoNewClasses(t *testing.T) {
 	if err := f.client().Deploy(context.Background(), in); err != nil {
 		t.Fatalf("Deploy: %v", err)
 	}
+	for _, r := range f.requests() {
+		if r.Path == scriptListPath {
+			t.Errorf("read the deployed migration tag with nothing to migrate: %s", f.paths())
+		}
+	}
 }
 
 // TestDeployRetriesWithoutMigrationsWhenAlreadyApplied: re-running setup against
diff --git a/internal/cloudflare/testdata/deploy_metadata.json b/internal/cloudflare/testdata/deploy_metadata.json
index cbfd695..2869287 100644
--- a/internal/cloudflare/testdata/deploy_metadata.json
+++ b/internal/cloudflare/testdata/deploy_metadata.json
@@ -2,6 +2,11 @@
   "main_module": "index.js",
   "compatibility_date": "2026-08-01",
   "bindings": [
+    {
+      "type": "durable_object_namespace",
+      "name": "DIRECTORY",
+      "class_name": "FleetDirectory"
+    },
     {
       "type": "durable_object_namespace",
       "name": "HUB",
@@ -23,10 +28,13 @@
   ],
   "keep_bindings": ["secret_text"],
   "migrations": {
-    "new_tag": "v1",
+    "new_tag": "v2",
     "steps": [
       {
         "new_sqlite_classes": ["DaemonHub"]
+      },
+      {
+        "new_sqlite_classes": ["FleetDirectory"]
       }
     ]
   },
@@ -35,7 +43,7 @@
     "config": {
       "html_handling": "auto-trailing-slash",
       "not_found_handling": "single-page-application",
-      "run_worker_first": ["/daemon", "/client", "/api/*"],
+      "run_worker_first": ["/daemon", "/client", "/api/*", "/directory", "/directory/*"],
       "_headers": "/*\n  X-Fixture: yes\n"
     }
   },
diff --git a/internal/config/relay.go b/internal/config/relay.go
index 6c6d135..fe0aa16 100644
--- a/internal/config/relay.go
+++ b/internal/config/relay.go
@@ -60,6 +60,27 @@ type Relay struct {
 	// leaving it to be inferred from the secret's warning.
 	FleetSeed string `json:"fleet_seed,omitempty"`
 
+	// MachineCert is this machine's fleet machine certificate — the signed
+	// blob internal/fleet produces over {id, name, this daemon's Noise
+	// static public key, iat} — minted by whichever command wrote this file
+	// (`flue relay setup`, `flue relay join`, the Remote screen's deploy) and
+	// published to the relay's fleet directory by the daemon when it
+	// connects. It is a public artifact: it is signed, not secret, and every
+	// browser in the fleet reads it out of the directory to learn which Noise
+	// key to pin for this machine (spec/fleet-trust.md).
+	//
+	// It is stored rather than minted at startup because the directory is
+	// content-addressed: a cert re-minted on every boot would carry a fresh
+	// `iat`, hash to a fresh key, and spend one of the directory's 512
+	// entries per daemon restart. Stored, it is one entry forever.
+	//
+	// Empty means "this machine publishes no machine cert" — a relay.json
+	// written before this field, or one whose fleet key could not sign. The
+	// daemon says so once and carries on: a machine missing from the
+	// directory is one browsers cannot auto-discover, not one that stops
+	// working for the devices paired to it directly.
+	MachineCert []byte `json:"machine_cert,omitempty"`
+
 	// MachineID is the slot this machine holds on the relay: the <id> in the
 	// /daemon/<id> leg the daemon dials and the /client/<id> URLs browsers
 	// open. Minted by `flue relay setup` and `flue relay join` (MintMachineID),
diff --git a/internal/config/relay_test.go b/internal/config/relay_test.go
index b46445f..e7a7830 100644
--- a/internal/config/relay_test.go
+++ b/internal/config/relay_test.go
@@ -5,6 +5,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"reflect"
 	"regexp"
 	"runtime"
 	"strings"
@@ -21,6 +22,11 @@ func TestSaveRelayRoundTrips(t *testing.T) {
 		Origin:      "https://flue-relay.karn.workers.dev",
 		MachineID:   "karns-macbook-pro-local-a1b2",
 		MachineName: "Karn's MacBook Pro.local",
+		// Bytes, not a string: the machine certificate is a signed blob, and
+		// the round trip has to preserve it byte for byte — a browser pins the
+		// Noise key inside it, so JSON that mangled one byte would be a
+		// machine nothing in the fleet can handshake with.
+		MachineCert: []byte{0x00, 0xff, 0x10, 'f', 'l', 'u', 'e'},
 	}
 	if err := SaveRelay(want); err != nil {
 		t.Fatalf("SaveRelay: %v", err)
@@ -33,7 +39,7 @@ func TestSaveRelayRoundTrips(t *testing.T) {
 	if !ok {
 		t.Fatal("LoadRelay ok = false after SaveRelay, want true")
 	}
-	if got != want {
+	if !reflect.DeepEqual(got, want) {
 		t.Fatalf("LoadRelay = %+v, want %+v", got, want)
 	}
 }
@@ -147,7 +153,7 @@ func TestLoadRelayReportsAbsence(t *testing.T) {
 	if ok {
 		t.Fatalf("LoadRelay ok = true with no relay.json, want false (got %+v)", got)
 	}
-	if got != (Relay{}) {
+	if !reflect.DeepEqual(got, Relay{}) {
 		t.Errorf("LoadRelay = %+v with no relay.json, want the zero value", got)
 	}
 }
diff --git a/internal/crypto/devices.go b/internal/crypto/devices.go
index 030eba6..991afd1 100644
--- a/internal/crypto/devices.go
+++ b/internal/crypto/devices.go
@@ -204,6 +204,37 @@ func (s *DeviceStore) AddFromFleetCert(label string, publicKey, cert []byte, pai
 	return d, nil
 }
 
+// RemoveByKey unpairs whichever device holds publicKey, reporting whether
+// there was one. Missing is not an error: it is the ordinary answer for a
+// revocation that arrived from the fleet directory naming a device this
+// machine never paired, and for the second delivery of one it did.
+//
+// By key rather than by id, unlike Remove, because its caller holds the key
+// and the id is a 48-bit digest of it (DeviceID). Removing by id would let a
+// key ground out to collide with a paired device's digest unpair that device
+// — the mirror of the attack FindByKey's byte comparison exists to refuse —
+// and here the attacker's blob has already been checked for a fleet signature,
+// so the only thing standing between a hostile *fleet member* and unpairing
+// someone else's device is this comparison being on the bytes.
+func (s *DeviceStore) RemoveByKey(publicKey []byte) (Device, bool, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	devices, err := s.load()
+	if err != nil {
+		return Device{}, false, err
+	}
+	for i, d := range devices {
+		if !bytes.Equal(d.PublicKey, publicKey) {
+			continue
+		}
+		if err := s.save(slices.Delete(devices, i, i+1)); err != nil {
+			return Device{}, false, err
+		}
+		return d, true, nil
+	}
+	return Device{}, false, nil
+}
+
 func (s *DeviceStore) Remove(id string) (Device, bool, error) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
diff --git a/internal/crypto/devices_test.go b/internal/crypto/devices_test.go
index 9e14d5e..73c586d 100644
--- a/internal/crypto/devices_test.go
+++ b/internal/crypto/devices_test.go
@@ -375,3 +375,48 @@ func TestDeviceStoreRemove(t *testing.T) {
 		t.Fatal("second remove reported success")
 	}
 }
+
+// TestRemoveByKeyComparesTheWholeKey is FindByKey's argument applied to the
+// other direction. RemoveByKey is what a fleet revocation reaches — the caller
+// holds 32 bytes off a signed blob — and matching on the id would let a key
+// ground out to collide with a paired device's digest unpair *that* device.
+//
+// The blob is signed, so this is not an attack any stranger can mount; it is
+// an attack one fleet member can mount on another's registry, and the whole
+// point of the fleet key is that its holders are the operator's own machines
+// rather than the operator's own devices.
+func TestRemoveByKeyComparesTheWholeKey(t *testing.T) {
+	dir := t.TempDir()
+	s := NewDeviceStore(dir)
+
+	paired := testKey(t)
+	forged := testKey(t)
+	// The registry holds the paired device's key under the id the forged key
+	// derives: a removal that stops at the id would take it.
+	writeRegistry(t, dir, []Device{planted(DeviceID(forged), paired)})
+
+	if got, ok, err := s.RemoveByKey(forged); err != nil {
+		t.Fatal(err)
+	} else if ok {
+		t.Fatalf("RemoveByKey unpaired a device on an id collision: %+v", got)
+	}
+	if list, err := s.List(); err != nil || len(list) != 1 {
+		t.Fatalf("registry = %+v, %v after a refused removal, want the device untouched", list, err)
+	}
+
+	// The positive, so the above is not passing by refusing everything.
+	got, ok, err := s.RemoveByKey(paired)
+	if err != nil || !ok {
+		t.Fatalf("RemoveByKey(paired) = %+v, %v, %v; want the entry it holds", got, ok, err)
+	}
+	if list, err := s.List(); err != nil || len(list) != 0 {
+		t.Fatalf("registry = %+v, %v after the removal, want empty", list, err)
+	}
+
+	// And missing is not an error: a revocation for a device this machine
+	// never paired is the common case in a fleet, and it arrives again on
+	// every reconnect.
+	if _, ok, err := s.RemoveByKey(paired); err != nil || ok {
+		t.Fatalf("RemoveByKey of an absent key = %v, %v; want false and no error", ok, err)
+	}
+}
diff --git a/internal/daemon/conn.go b/internal/daemon/conn.go
index 8748e2a..00829e9 100644
--- a/internal/daemon/conn.go
+++ b/internal/daemon/conn.go
@@ -187,6 +187,16 @@ type conn struct {
 	// bucket, and nothing else consults it.
 	device string
 
+	// deviceKey is the static public key that connection authenticated with —
+	// the 32 bytes the handshake proved, rather than the 48-bit digest of them
+	// above. Nil for a connection with no device identity.
+	//
+	// Set at construction and never written again, which is why it needs no
+	// lock where `device` does: it is the transport's finding about a
+	// connection that does not exist yet, not registry state that a revoke on
+	// another goroutine can change.
+	deviceKey []byte
+
 	// origin is the absolute origin this connection's upgrade arrived on, and
 	// the only thing pairing can honestly build a URL from: the second device
 	// has to open an address this daemon is really reachable at. It is carried
@@ -208,16 +218,17 @@ type conn struct {
 	attach  map[uint32]*attachment
 }
 
-func newConn(ctx context.Context, cancel context.CancelFunc, mc MessageConn, srv *Server, peer, origin string) *conn {
+func newConn(ctx context.Context, cancel context.CancelFunc, mc MessageConn, srv *Server, peer, origin string, deviceKey []byte) *conn {
 	return &conn{
-		ctx:    ctx,
-		cancel: cancel,
-		mc:     mc,
-		srv:    srv,
-		peer:   peer,
-		origin: origin,
-		out:    make(chan frame, outboxDepth),
-		attach: map[uint32]*attachment{},
+		ctx:       ctx,
+		cancel:    cancel,
+		mc:        mc,
+		srv:       srv,
+		peer:      peer,
+		origin:    origin,
+		deviceKey: deviceKey,
+		out:       make(chan frame, outboxDepth),
+		attach:    map[uint32]*attachment{},
 	}
 }
 
@@ -326,6 +337,20 @@ func (c *conn) serve() {
 		// so what a client holds is what was true when it arrived, which is
 		// also when it decides what to render.
 		Relay: c.srv.relayInfo(),
+		// And the device's own fleet certificate, for the device that just
+		// proved it holds the key the certificate names. This is the re-supply
+		// path: the ceremony hands one over in its answer, and this hands the
+		// same one over again on every connection that has a device identity,
+		// so a browser that never stored it, or lost it, or was paired before
+		// this machine had a fleet key, gets one from any machine it can still
+		// reach *over the relay*.
+		//
+		// Empty over loopback, and not by omission: a session-token connection
+		// has named no device key, so there is no certificate this daemon
+		// could know to be its. A tab that only ever paired over loopback has
+		// no second source for its certificate and re-pairs instead — see
+		// fleetCertFor, and keepDeviceCert in web/src/routes/pair.tsx.
+		FleetCert: c.srv.fleetCertFor(c.deviceKey),
 	})
 
 	for {
@@ -606,17 +631,27 @@ func (c *conn) handleControl(msg any) {
 		}
 		token, expires := c.srv.pairing.start(time.Now())
 		c.srv.logger().Info("pairing started", "peer", c.peer, "expiresAt", expires.Unix())
-		// Two parameters, and they are not the same kind of thing. `t` is the
-		// single-use credential; `k` is the daemon's static public key, and it
-		// is here because this URL is what the QR encodes — a screen the user
-		// physically controls, read by a camera, which is the only leg of the
-		// ceremony no intermediary can sit in. The device pins the key it reads
-		// there and then requires the answer to its POST to match it. Learning
-		// the key from that answer instead would be trust-on-first-use over
-		// precisely the channel the pinned key exists to protect.
+		// Three parameters at most, and they are not the same kind of thing.
+		// `t` is the single-use credential; `k` is the daemon's static public
+		// key; `f` is the fleet public key, when this daemon has one. The last
+		// two are here because this URL is what the QR encodes — a screen the
+		// user physically controls, read by a camera, which is the only leg of
+		// the ceremony no intermediary can sit in. The device pins `k` and then
+		// requires the answer to its POST to match it; it pins `f` and from
+		// then on accepts any machine whose certificate verifies under it
+		// (spec/fleet-trust.md). Learning either key from that answer instead
+		// would be trust-on-first-use over precisely the channel the pinned
+		// keys exist to protect.
 		//
-		// Both are unpadded URL-safe base64 so they can be spliced in raw with
-		// no escaping; see pairingState.start and Server.daemonPubParam.
+		// All three are unpadded URL-safe base64 so they can be spliced in raw
+		// with no escaping; see pairingState.start, Server.daemonPubParam and
+		// Server.fleetPubParam.
+		//
+		// `f` is omitted rather than sent empty on a daemon with no fleet key:
+		// the pairing page reads a present-but-unusable value as a link that
+		// has been tampered with, and a relay from before the fleet key is not
+		// that — it is a browser that pairs with this machine and learns of no
+		// others.
 		//
 		// DaemonPub stays on the message as well. It is the same key in the
 		// encoding the rest of the wire uses, read by a browser that is already
@@ -626,9 +661,13 @@ func (c *conn) handleControl(msg any) {
 		// pairingOrigin decides: a live relay's origin when there is one, and
 		// c.origin otherwise. A QR is read by a phone, and a phone cannot open
 		// the loopback address this connection arrived on.
+		pairURL := c.srv.pairingOrigin(c.origin) + PairPagePath + "?t=" + token + "&k=" + c.srv.daemonPubParam()
+		if fleetPub := c.srv.fleetPubParam(); fleetPub != "" {
+			pairURL += "&f=" + fleetPub
+		}
 		_ = c.sendControl(wire.Pairing{
 			Token:     token,
-			URL:       c.srv.pairingOrigin(c.origin) + PairPagePath + "?t=" + token + "&k=" + c.srv.daemonPubParam(),
+			URL:       pairURL,
 			DaemonPub: c.srv.daemonPub(),
 			ExpiresAt: expires.Unix(),
 		})
diff --git a/internal/daemon/pairing.go b/internal/daemon/pairing.go
index 5b4bbd8..10c3013 100644
--- a/internal/daemon/pairing.go
+++ b/internal/daemon/pairing.go
@@ -244,6 +244,35 @@ func (s *Server) daemonPubParam() string {
 	return base64.RawURLEncoding.EncodeToString(s.identity.Key.Public)
 }
 
+// fleetPubParam is the fleet *public* key as the pairing URL carries it, and
+// the empty string on a daemon that holds no fleet key.
+//
+// It rides the QR beside `k` and for the same reason, one level up: `k`
+// anchors this browser to this machine, and this anchors it to the whole
+// fleet (spec/fleet-trust.md, "What changes in the handshake"). A device that
+// pins it accepts any machine whose machine certificate verifies under it and
+// pins that certificate's `noise` key for the IK handshake — which is what
+// turns "pair once per machine" into "pair once". So it has to arrive by the
+// one leg of the ceremony an intermediary cannot sit in, exactly as the
+// daemon's own key does; a fleet key learned from the relay's answer would be
+// a browser trusting whoever served it a machine list.
+//
+// The public half only, and never the seed: the seed is in the join line and
+// in relay.json, and a browser that held it could mint certificates for the
+// fleet. Same encoding as `k` — unpadded URL-safe base64, spliced raw.
+//
+// Empty is a real answer, not a fault. A daemon whose relay.json predates the
+// fleet key, or one deployed from the Remote screen in a process that booted
+// without one (Identity is fixed at construction), pairs exactly as it always
+// did: the browser pins this machine and learns of no others.
+func (s *Server) fleetPubParam() string {
+	pub := s.identity.Fleet.Public()
+	if len(pub) == 0 {
+		return ""
+	}
+	return base64.RawURLEncoding.EncodeToString(pub)
+}
+
 // PairOutcome is the transport-neutral answer to a pairing attempt: the HTTP
 // status and the JSON body the request should be answered with.
 //
@@ -404,6 +433,18 @@ func (s *Server) PairDevice(body []byte, peer string) PairOutcome {
 
 	s.logger().Info("device paired", "peer", peer, "device", dev.ID, "label", dev.Label)
 
+	// Nothing is published to the fleet directory here, and the absence is the
+	// design rather than an omission (spec/fleet-trust.md, "Device certificates
+	// are deliberately not in the directory"). The cert goes to the one party
+	// it is about: this answer hands it to the device, and every welcome hands
+	// it over again. No daemon ever reads one out of the directory — a roaming
+	// device is admitted on the cert it *presents* in its handshake, which is
+	// rule 2 — so publishing it would only put the device's public key and the
+	// label its owner typed on a credential-less `GET /directory`, and spend
+	// one of 512 permanent entries per ceremony ever performed.
+	//
+	// A revoke still publishes: that one has to reach machines, not devices.
+
 	// The device was registered on a request the user's other screen never
 	// sees, so the screen has to be told. Broadcast before the answer is
 	// returned: the pairing device is not the one waiting for this.
@@ -411,10 +452,29 @@ func (s *Server) PairDevice(body []byte, peer string) PairOutcome {
 
 	// A map rather than a struct, because the encoder sorts a map's keys and
 	// that is the byte order this endpoint has always answered in.
-	answer, err := json.Marshal(map[string]any{
+	fields := map[string]any{
 		"deviceId":  dev.ID,
 		"daemonPub": s.daemonPub(),
-	})
+	}
+	// And the certificate the ceremony just minted, handed straight to the
+	// device it is about.
+	//
+	// This is what the device presents to every *other* machine in the fleet,
+	// and this answer is where it should come from: the browser pinned the
+	// fleet public key out of the QR a moment ago, so it can check this blob
+	// itself, and a hostile relay in the middle can only make the check fail.
+	// Handing it over here is what lets device certificates stay off the
+	// credential-less `GET /directory` — where they were a roster of every
+	// device's public key and human label, readable by anybody, and one
+	// permanent directory entry per ceremony ever performed.
+	//
+	// Absent when nothing was minted (no fleet key, or no machine id), which is
+	// the same "paired to this machine only" this function already reports up
+	// the page. Base64 like every other []byte on this endpoint.
+	if len(cert) > 0 {
+		fields["deviceCert"] = cert
+	}
+	answer, err := json.Marshal(fields)
 	if err != nil {
 		// Two strings the daemon chose itself; unreachable short of a broken
 		// encoder. The device is paired either way, so the refusal is about
diff --git a/internal/daemon/pairing_test.go b/internal/daemon/pairing_test.go
index a566544..e379e0a 100644
--- a/internal/daemon/pairing_test.go
+++ b/internal/daemon/pairing_test.go
@@ -633,6 +633,66 @@ func TestPairMintsAFleetDeviceCert(t *testing.T) {
 	}
 }
 
+// TestPairHandsTheDeviceItsOwnCert: the ceremony's answer carries the
+// certificate it just minted, to the device it is about.
+//
+// This is what lets device certificates stay off the credential-less
+// `GET /directory`, where they were a public roster of every device's key and
+// human label and spent one of the directory's 512 permanent entries per
+// ceremony ever performed. The browser pinned the fleet public key out of the
+// QR moments earlier, so it can check this blob itself and a hostile relay in
+// the middle can only make the check fail.
+func TestPairHandsTheDeviceItsOwnCert(t *testing.T) {
+	const machineID = "karns-mbp-a1b2-0f9a12cd"
+	srv, fk := newFleetPairServer(t, machineID)
+
+	token, _ := srv.pairing.start(time.Now())
+	key := deviceKey(0x2a)
+	out := srv.PairDevice(pairBody(t, token, base64.StdEncoding.EncodeToString(key), "phone"), "relay")
+	if out.Status != http.StatusOK {
+		t.Fatalf("PairDevice = %d (%s), want 200", out.Status, out.Body)
+	}
+
+	var answer struct {
+		DeviceCert []byte `json:"deviceCert"`
+	}
+	if err := json.Unmarshal(out.Body, &answer); err != nil {
+		t.Fatalf("decoding the pairing answer: %v", err)
+	}
+	if len(answer.DeviceCert) == 0 {
+		t.Fatal("the pairing answer carries no device certificate; the device could reach no other machine")
+	}
+	cert, err := fleet.VerifyDevice(fk.Public(), answer.DeviceCert)
+	if err != nil {
+		t.Fatalf("the answered cert does not verify under this fleet key: %v", err)
+	}
+	if !bytes.Equal(cert.Device, key) {
+		t.Error("the answered cert names a device key other than the one just paired")
+	}
+	// The same artifact the registry holds, byte for byte. A certificate that
+	// differed here would be a second blob for one pairing, and the machine
+	// handing it out would be disagreeing with the machine that stored it.
+	list := devices(t, srv)
+	if len(list) != 1 || !bytes.Equal(list[0].Cert, answer.DeviceCert) {
+		t.Error("the answered cert is not the one the registry stored")
+	}
+}
+
+// TestPairAnswersNoCertWhenNoneWasMinted: a daemon with no place on the relay
+// mints nothing, and must not invent a field. The device is paired to this
+// machine and says so by omission.
+func TestPairAnswersNoCertWhenNoneWasMinted(t *testing.T) {
+	srv, _ := newFleetPairServer(t, "")
+	token, _ := srv.pairing.start(time.Now())
+	out := srv.PairDevice(pairBody(t, token, base64.StdEncoding.EncodeToString(deviceKey(0x2a)), "phone"), "relay")
+	if out.Status != http.StatusOK {
+		t.Fatalf("PairDevice = %d (%s), want 200", out.Status, out.Body)
+	}
+	if bytes.Contains(out.Body, []byte("deviceCert")) {
+		t.Errorf("the answer carries a deviceCert from a daemon that minted none: %s", out.Body)
+	}
+}
+
 // TestPairMintsNoCertWithoutAMachineID: `pairedOn` is a machine id in the
 // spec and the directory the next stage brings keys certs by it, so a cert
 // claiming the empty machine is one nothing can attribute — signing it would
@@ -1024,6 +1084,88 @@ func TestPairStartURLCarriesTheDaemonKey(t *testing.T) {
 	if want := base64.StdEncoding.EncodeToString(raw); got.DaemonPub != want {
 		t.Errorf("daemonPub = %q, want the key from the URL %q", got.DaemonPub, want)
 	}
+
+	// A daemon with no fleet key says so by omission. An `f=` that was present
+	// and empty would read to the pairing page as a link something rewrote,
+	// which is not what a relay from before the fleet key is.
+	if q.Has("f") {
+		t.Errorf("f = %q on a daemon with no fleet key; the parameter should be absent", q.Get("f"))
+	}
+}
+
+// TestPairStartURLCarriesTheFleetKey: the QR is where the browser learns the
+// second key it pins.
+//
+// `k` anchors this browser to this machine; `f` anchors it to the fleet, and
+// from that pin the browser accepts any machine whose machine certificate
+// verifies under it (spec/fleet-trust.md, "What changes in the handshake").
+// That is a fleet-wide trust decision, so it has to arrive by the one leg of
+// the ceremony no intermediary can sit in — the same leg, and the same
+// encoding, as `k`. What must never travel here is the seed: a browser
+// holding it could mint certificates for the fleet.
+func TestPairStartURLCarriesTheFleetKey(t *testing.T) {
+	ts, srv, fk := newFleetPairHTTPServer(t)
+	c := dial(t, ts)
+	writeControl(t, c, wire.Hello{Ver: "test"})
+	writeControl(t, c, wire.PairStart{})
+
+	var got wire.Pairing
+	readUntil(t, c, func(msg any, _ []byte) bool {
+		p, ok := msg.(wire.Pairing)
+		if ok {
+			got = p
+		}
+		return ok
+	})
+
+	u, err := url.Parse(got.URL)
+	if err != nil {
+		t.Fatalf("pairing url %q does not parse: %v", got.URL, err)
+	}
+	f := u.Query().Get("f")
+	if f == "" {
+		t.Fatalf("pairing url %q carries no f=; the device cannot learn the fleet", got.URL)
+	}
+	if strings.ContainsAny(f, "+/=") {
+		t.Errorf("f = %q carries characters that are not URL-safe", f)
+	}
+	raw, err := base64.RawURLEncoding.DecodeString(f)
+	if err != nil {
+		t.Fatalf("f = %q is not unpadded URL-safe base64: %v", f, err)
+	}
+	if !bytes.Equal(raw, fk.Public()) {
+		t.Errorf("f decodes to %x, want the fleet public key %x", raw, fk.Public())
+	}
+	// The public half and nothing else. The seed is the credential that signs
+	// for the whole fleet, and no URL a phone opens may ever carry it.
+	if strings.Contains(got.URL, fk.Seed()) {
+		t.Fatal("the pairing url carries the fleet seed; it must carry the public key alone")
+	}
+	if !bytes.Equal(raw, srv.identity.Fleet.Public()) {
+		t.Error("f is not this daemon's own fleet public key")
+	}
+}
+
+// newFleetPairHTTPServer is newPairServer with a fleet key and a place on the
+// relay — what a machine that has run `flue relay join` looks like.
+func newFleetPairHTTPServer(t *testing.T) (*httptest.Server, *Server, fleet.Key) {
+	t.Helper()
+	dir := t.TempDir()
+	key, err := crypto.LoadOrCreateStaticKey(dir)
+	if err != nil {
+		t.Fatalf("LoadOrCreateStaticKey: %v", err)
+	}
+	fk, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		t.Fatalf("fleet.Mint: %v", err)
+	}
+	srv := New(session.NewRegistry(time.Now), nil, http.NotFoundHandler(), "test",
+		Identity{Key: key, Devices: crypto.NewDeviceStore(dir), Fleet: fk})
+	ts := httptest.NewServer(srv.Handler())
+	t.Cleanup(ts.Close)
+	srv.SetAuth(local.NewAuth(tok, portOf(t, ts)))
+	srv.SetRelayMachine("karns-mbp-a1b2-0f9a12cd", "Karn's MacBook Pro")
+	return ts, srv, fk
 }
 
 func TestPairCancelInvalidatesTheToken(t *testing.T) {
diff --git a/internal/daemon/relayui.go b/internal/daemon/relayui.go
index e8c2945..53f50ab 100644
--- a/internal/daemon/relayui.go
+++ b/internal/daemon/relayui.go
@@ -95,6 +95,55 @@ type RelayUIStatus struct {
 	// service — the handler is the one on the Server that holds the state.
 	Transport       string `json:"transport,omitempty"`
 	TransportOrigin string `json:"transport_origin,omitempty"`
+
+	// Directory is the fleet directory as this daemon last saw it, or nil on a
+	// daemon that is not reading one (no relay, or a relay from before the
+	// directory existed). It is the second half of the answer to "is my fleet
+	// wired up": Transport says this machine can be *reached*, and this says
+	// it can hear what the other machines have signed — which is what a
+	// revocation travels on.
+	Directory *DirectoryCounts `json:"directory,omitempty"`
+}
+
+// DirectoryCounts is what this daemon last read out of the fleet directory.
+//
+// Entries is what the relay claimed; Verified is how much of it carried a
+// signature under this fleet's key, and the gap between the two is the only
+// interesting number here — a relay serving blobs this fleet did not sign is
+// either a fleet key that has rotated or a relay that is not the one this
+// machine thinks it is.
+//
+// It is a layout shared with internal/transport/relay (DirectoryCounts there),
+// converted rather than imported: this package must not depend on a transport,
+// which is the same reason RelayUI is an interface.
+type DirectoryCounts struct {
+	Connected   bool `json:"connected"`
+	Entries     int  `json:"entries"`
+	Verified    int  `json:"verified"`
+	Machines    int  `json:"machines"`
+	Devices     int  `json:"devices"`
+	Revocations int  `json:"revocations"`
+}
+
+// SetDirectoryCounts installs the reader for the line above. A func rather
+// than a value because the numbers change under a socket this package does not
+// own, and a snapshot pushed on every change would be a push per revocation
+// for a field nothing subscribes to.
+func (s *Server) SetDirectoryCounts(read func() DirectoryCounts) {
+	s.fleetPubMu.Lock()
+	defer s.fleetPubMu.Unlock()
+	s.directoryCounts = read
+}
+
+func (s *Server) directoryStatus() *DirectoryCounts {
+	s.fleetPubMu.Lock()
+	read := s.directoryCounts
+	s.fleetPubMu.Unlock()
+	if read == nil {
+		return nil
+	}
+	c := read()
+	return &c
 }
 
 // RelayUIAccount is one Cloudflare account a token can reach, for the picker.
@@ -183,6 +232,9 @@ func (s *Server) handleRelayInfo(w http.ResponseWriter, r *http.Request) {
 	s.relayMu.Lock()
 	st.Transport, st.TransportOrigin = s.relayStatus, s.relayOrigin
 	s.relayMu.Unlock()
+	// Filled by the handler for the same reason Transport is: it is live state
+	// this Server holds, not something the deploy service could know.
+	st.Directory = s.directoryStatus()
 	writeJSON(w, st)
 }
 
diff --git a/internal/daemon/server.go b/internal/daemon/server.go
index 4a19190..2b7a1eb 100644
--- a/internal/daemon/server.go
+++ b/internal/daemon/server.go
@@ -153,6 +153,19 @@ type Server struct {
 	relayUIMu sync.Mutex
 	relayUI   RelayUI
 
+	// fleetPub is where a freshly minted certificate or revocation goes to be
+	// published to the fleet directory, injected by whoever starts the relay
+	// transport (SetFleetPublisher). Nil on a daemon with no relay, and on
+	// every daemon a test constructs, which is why every caller checks: this
+	// daemon pairs and revokes identically without one, and the local
+	// registry is the record either way.
+	fleetPubMu sync.Mutex
+	fleetPub   FleetPublisher
+	// directoryCounts reads what the directory leg last saw, for the Remote
+	// screen's status. Under the same lock as the publisher because it is the
+	// same object installed at the same moment.
+	directoryCounts func() DirectoryCounts
+
 	// release is the update checker behind ReleasePath, injected the same way
 	// and nil by default. See release.go.
 	release releaseState
@@ -210,6 +223,10 @@ type Server struct {
 	// the status callbacks do not carry it.
 	relayMachineID   string
 	relayMachineName string
+	// relayConfigured is the origin relay.json names, whether or not the
+	// transport has reached it. It exists for the Content-Security-Policy and
+	// nothing else — see LocalCSPFor.
+	relayConfigured string
 
 	primaryMu sync.Mutex
 	primary   map[string]*conn // session ID -> primary connection
@@ -399,7 +416,7 @@ func (s *Server) Handler() http.Handler {
 	mux.Handle("/api/", s.withAuth(http.NotFoundHandler()))
 	mux.Handle("/", s.withAuth(s.ui))
 
-	return securityHeaders(methodPolicy(mux))
+	return s.securityHeaders(methodPolicy(mux))
 }
 
 // methodPolicy rejects everything but GET and HEAD, plus POST to the named
@@ -470,7 +487,9 @@ const (
 	// is not same-origin under CSP's rules because the scheme differs.
 	cspLoopbackSockets = " ws://127.0.0.1:* ws://localhost:*"
 
-	// LocalCSP is what this daemon serves its own UI under.
+	// LocalCSP is what this daemon serves its own UI under when it has no relay
+	// configured. A daemon that has one serves LocalCSPFor(origin) instead —
+	// see there for why the relay origin has to be in `connect-src`.
 	LocalCSP = cspHead + cspLoopbackSockets + cspTail
 
 	// RelayCSP is what a relay origin serves the same bundle under. It is
@@ -480,10 +499,116 @@ const (
 	RelayCSP = cspHead + cspTail
 )
 
-func securityHeaders(next http.Handler) http.Handler {
+// LocalCSPFor is what this daemon serves its own UI under when relay.json
+// names a relay: LocalCSP, plus that one origin in `connect-src`.
+//
+// It is not a convenience. A page the daemon served on loopback reaches its own
+// daemon over `ws://127.0.0.1:7717`, and everything *else* it reaches is on the
+// relay: `wss://<relay>/client/<id>` for every other machine in the fleet, and
+// now `https://<relay>/directory` to find out which machines those are. Neither
+// is covered by `'self'` — a different origin is a different origin, whatever
+// this daemon's relationship with it — so under the policy without this clause
+// the browser blocks both. The socket failure looks like a machine that will
+// not connect; the fetch failure looks like nothing at all, because
+// `readDirectory` answers "no machines" for every fault by design. A loopback
+// tab would quietly show a fleet of one.
+//
+// One exact origin, and only the two schemes the page uses on it. That is a far
+// narrower grant than the loopback clause beside it — which carries wildcard
+// ports and is the standing item in docs/FOLLOW-UPS.md §6 — and it is the
+// origin this daemon is configured to dial anyway. It comes from relay.json
+// rather than from the live transport because a policy is fixed when the
+// document is served: a tab loaded while the relay was still dialling would
+// otherwise carry a policy that forbids the connection the page makes a second
+// later, and nothing would correct it short of a reload.
+//
+// The relay-served copy of the same bundle keeps RelayCSP, which grants nothing
+// beyond 'self': there the relay *is* the origin.
+func LocalCSPFor(relayOrigin string) string {
+	if relayOrigin == "" {
+		return LocalCSP
+	}
+	// The socket is the https origin with the scheme swapped, which is exactly
+	// how web/src/relay/socket.ts builds it.
+	ws := "wss://" + strings.TrimPrefix(strings.TrimPrefix(relayOrigin, "https://"), "http://")
+	if strings.HasPrefix(relayOrigin, "http://") {
+		ws = "ws://" + strings.TrimPrefix(relayOrigin, "http://")
+	}
+	return cspHead + cspLoopbackSockets + " " + relayOrigin + " " + ws + cspTail
+}
+
+// fleetCertFor is the fleet device certificate belonging to the device this
+// connection authenticated as, for the welcome to carry.
+//
+// Resolved by the key bytes and not by the id, which is the same discipline
+// crypto.FindByKey keeps and for the same reason: an id is hex(sha256(key))
+// truncated to 48 bits, and Add deliberately permits two devices to hold
+// colliding ids, so a lookup by id alone can name a device that is not this
+// one. The consequence here would be handing a browser somebody else's
+// certificate — recoverable, because the browser checks the subject against
+// its own key before storing it and every machine checks it again at the
+// handshake, but "the other end will notice" is not a reason for this end to
+// answer the wrong question. FindByKey also refuses a revoked key inside the
+// same critical section as the read, so a revocation that landed since the
+// handshake costs this welcome its certificate, which is the right answer.
+//
+// Empty for every connection with no device identity, which is every loopback
+// one: a certificate is a statement about a device key, and a session-token
+// connection has not named one. Empty too when the registry cannot be read, or
+// when the device was paired before this machine held a fleet key — there is no
+// certificate to hand over, and inventing one here would mean minting under the
+// fleet key for a device whose ceremony never earned it.
+//
+// It re-mints nothing. The blob is the one this machine's ceremony signed and
+// devices.json has held ever since, or the one the device itself presented in
+// its handshake after pairing elsewhere (AddFromFleetCert). Handing back the
+// same bytes keeps a certificate one artifact for the life of a pairing, which
+// is what lets a browser compare what it holds against what it is offered.
+func (s *Server) fleetCertFor(deviceKey []byte) []byte {
+	if len(deviceKey) == 0 || s.identity.Devices == nil {
+		return nil
+	}
+	dev, ok, err := s.identity.Devices.FindByKey(deviceKey)
+	if err != nil {
+		// The socket is up and the device is admitted; a registry that cannot
+		// be read right now costs this device its certificate on this
+		// connection and nothing else. The next one carries it. Logged by id,
+		// because that is the identity every other line about this device —
+		// and the Devices screen — speaks in.
+		s.logger().Warn("could not read a device's fleet certificate for the welcome",
+			"device", crypto.DeviceID(deviceKey), "err", err)
+		return nil
+	}
+	if !ok || len(dev.Cert) == 0 {
+		return nil
+	}
+	return dev.Cert
+}
+
+// SetRelayOrigin records the origin relay.json names, for the Content-Security-
+// Policy alone.
+//
+// Deliberately not the same field as the transport's `relayOrigin`, which is
+// socket state and is empty until a dial succeeds. This is configuration: it is
+// true from the moment relay.json is read, and the CSP on a document has to
+// permit the connections that document will make later, including the ones it
+// makes while the relay is still coming up.
+func (s *Server) SetRelayOrigin(origin string) {
+	s.relayMu.Lock()
+	defer s.relayMu.Unlock()
+	s.relayConfigured = origin
+}
+
+func (s *Server) configuredRelayOrigin() string {
+	s.relayMu.RLock()
+	defer s.relayMu.RUnlock()
+	return s.relayConfigured
+}
+
+func (s *Server) securityHeaders(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Referrer-Policy", "no-referrer")
-		w.Header().Set("Content-Security-Policy", LocalCSP)
+		w.Header().Set("Content-Security-Policy", LocalCSPFor(s.configuredRelayOrigin()))
 		next.ServeHTTP(w, r)
 	})
 }
@@ -1181,10 +1306,12 @@ func validDeviceID(id string) bool {
 // acceptance rule while the entry still shows on the Devices screen, and the
 // retry completes it.
 //
-// The signed blob is kept by the store (crypto.StoredRevocation) because it
-// is the same artifact the fleet directory will publish so every other
-// machine drops the key too; until that stage lands, the record is local
-// and this machine is the only one it binds.
+// The signed blob is kept by the store (crypto.StoredRevocation) and handed
+// to the fleet directory, because it is the same artifact every other machine
+// drops the key on — one revoke on any Devices screen, and the key is dead
+// fleet-wide. A daemon with no directory publisher keeps it locally and binds
+// only itself, which is the whole difference between a machine on a relay and
+// one that is not.
 func (s *Server) removeDevice(id string) (crypto.Device, bool, error) {
 	if s.identity.Devices == nil {
 		return crypto.Device{}, false, errNoDeviceRegistry
@@ -1201,10 +1328,122 @@ func (s *Server) removeDevice(id string) (crypto.Device, bool, error) {
 		if err != nil {
 			return crypto.Device{}, false, fmt.Errorf("daemon: recording the revocation: %w", err)
 		}
+		// On file locally, so now to the rest of the fleet: this is the blob
+		// every other machine drops the key on (ApplyFleetRevocation, at the
+		// far end of the directory). Published before the registry write
+		// rather than after, because the revocation is the part that must
+		// travel and the removal below can fail — a revoke that got half way
+		// should have got the *outward* half.
+		s.publishFleetBlob(blob)
 	}
 	return s.identity.Devices.Remove(id)
 }
 
+// --- the fleet directory ---
+
+// FleetPublisher publishes one signed fleet artifact — a device certificate or
+// a revocation this daemon has just minted — to the relay's fleet directory,
+// so the other machines in the fleet learn of it without being asked
+// (spec/fleet-trust.md, "The fleet directory").
+//
+// Publish must not block: its callers are the pairing ceremony and the revoke
+// op, both of which are answering a client that is waiting, and neither has
+// anywhere to put a network failure. Losing a publish is survivable by
+// construction — everything publishable is also written to disk, and the
+// implementation re-publishes what this machine holds on every reconnect — so
+// the contract is "take this and go away", not "deliver this".
+type FleetPublisher interface {
+	PublishFleetBlob(blob []byte)
+}
+
+// SetFleetPublisher installs the directory client. Nil — a daemon with no
+// relay, or any test's — means minted artifacts stay on this machine, which is
+// exactly what a machine that is not on a relay should do with them.
+func (s *Server) SetFleetPublisher(p FleetPublisher) {
+	s.fleetPubMu.Lock()
+	defer s.fleetPubMu.Unlock()
+	s.fleetPub = p
+}
+
+// publishFleetBlob hands one signed artifact to the directory, if there is one
+// to hand it to. Empty blobs are dropped here rather than at each call site: a
+// daemon with no fleet key mints nothing, and its callers should not each have
+// to remember that.
+func (s *Server) publishFleetBlob(blob []byte) {
+	if len(blob) == 0 {
+		return
+	}
+	s.fleetPubMu.Lock()
+	p := s.fleetPub
+	s.fleetPubMu.Unlock()
+	if p == nil {
+		return
+	}
+	p.PublishFleetBlob(blob)
+}
+
+// ApplyFleetRevocation is the receiving half of the fleet-wide kill switch: a
+// revocation minted on some other machine, verified under the fleet public key
+// by the transport that read it out of the directory, and now applied here.
+//
+// Three things, in this order, and the order is the same one revokeDevice
+// keeps for a locally-minted revocation:
+//
+//  1. Record the revocation. This is what makes the key dead to both
+//     acceptance paths — crypto.FindByKey for rule 1, AddFromFleetCert for
+//     rule 2 — and it is first because it is the half that must not be
+//     skipped: an entry removed without its revocation on file is not revoked
+//     at all, since the device's own fleet cert would walk it straight back in
+//     on the next handshake.
+//  2. Drop the local registry row, if this machine had one. By key rather
+//     than by id: the caller holds 32 bytes and the id is a 48-bit digest of
+//     them (crypto.RemoveByKey says what that difference is worth).
+//  3. Close the device's live channels with the reason every revoked device
+//     gets. This is the part that makes it a kill switch rather than a
+//     bookkeeping change — a socket already established is the access, and a
+//     registry nothing re-reads would not take it away.
+//
+// It is idempotent, which the push socket and the reconnect GET both require:
+// hearing the same revocation twice records nothing new, removes nothing
+// twice, and closes an empty set of connections.
+//
+// Verification is deliberately not repeated here. It belongs to the reader
+// that owns the fleet public key, and this method's contract is that it has
+// already happened — which is why the parameters are the parsed key and the
+// blob rather than a blob to be trusted.
+func (s *Server) ApplyFleetRevocation(deviceKey, blob []byte) error {
+	if s.identity.Devices == nil {
+		return errNoDeviceRegistry
+	}
+	if err := s.identity.Devices.AddRevocation(deviceKey, blob); err != nil {
+		return fmt.Errorf("daemon: recording a fleet revocation: %w", err)
+	}
+	dev, removed, err := s.identity.Devices.RemoveByKey(deviceKey)
+	if err != nil {
+		// The revocation is on file, so the key is already refused everywhere
+		// it matters; what failed is the Devices screen catching up. Reported
+		// so the caller logs it, and the next delivery of this revocation —
+		// the reconnect GET, if nothing else — completes it.
+		return fmt.Errorf("daemon: dropping a revoked device from the registry: %w", err)
+	}
+	// Keyed by the id the connection registry is keyed by, which is the digest
+	// of the same key the handshake proved (channel.go).
+	id := crypto.DeviceID(deviceKey)
+	closed := s.disconnectDevice(id, "revoked")
+	if !removed && closed == 0 {
+		// A revocation for a device this machine never paired and is not
+		// carrying. Recorded and nothing else — which is the common case in a
+		// fleet, and must stay silent enough not to drown the log on the
+		// reconnect that re-reads the whole directory.
+		return nil
+	}
+	s.logger().Info("device revoked by the fleet",
+		"device", id, "label", dev.Label, "unpaired", removed, "connections", closed)
+	// The Devices screen is showing a row that no longer exists.
+	s.broadcastDeviceList()
+	return nil
+}
+
 // disconnectDevice tells every connection belonging to deviceID why it is
 // ending and ends it, returning how many there were.
 //
diff --git a/internal/daemon/server_test.go b/internal/daemon/server_test.go
index 73ea265..b33cf23 100644
--- a/internal/daemon/server_test.go
+++ b/internal/daemon/server_test.go
@@ -3,6 +3,8 @@ package daemon
 import (
 	"bytes"
 	"context"
+	"crypto/rand"
+	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -23,6 +25,7 @@ import (
 
 	"github.com/coder/websocket"
 	"github.com/karnstack/flue/internal/crypto"
+	"github.com/karnstack/flue/internal/fleet"
 	"github.com/karnstack/flue/internal/session"
 	"github.com/karnstack/flue/internal/transport/local"
 	"github.com/karnstack/flue/internal/wire"
@@ -1362,6 +1365,81 @@ func TestSecurityHeaders(t *testing.T) {
 	}
 }
 
+// TestLocalCSPAllowsTheRelayThisDaemonDials is the fleet working from a
+// loopback tab at all.
+//
+// A page the daemon served reaches its own daemon over ws://127.0.0.1, and
+// everything else over the relay: wss://<relay>/client/<id> for each sibling
+// machine, and https://<relay>/directory to learn which siblings there are.
+// `connect-src 'self'` covers neither — a different origin is a different
+// origin — so without the relay in the policy the browser blocks both. The
+// socket looks like a machine that will not connect; the fetch looks like
+// nothing at all, because readDirectory answers "no machines" for every fault
+// by design, so a loopback tab would quietly show a fleet of one.
+func TestLocalCSPAllowsTheRelayThisDaemonDials(t *testing.T) {
+	ts, _, srv := newTestServerUI(t, http.NotFoundHandler())
+	srv.SetRelayOrigin("https://flue-relay.example.workers.dev")
+
+	csp := get(t, ts, "/api/sessions", "same-origin").Header.Get("Content-Security-Policy")
+	connect := ""
+	for _, d := range strings.Split(csp, ";") {
+		if strings.HasPrefix(strings.TrimSpace(d), "connect-src ") {
+			connect = strings.TrimSpace(d)
+		}
+	}
+	if connect == "" {
+		t.Fatalf("no connect-src in %q", csp)
+	}
+	for _, want := range []string{
+		// The directory read, and every other plain fetch to the relay.
+		"https://flue-relay.example.workers.dev",
+		// The per-machine socket, which is the same origin with the scheme
+		// swapped — exactly how web/src/relay/socket.ts builds it.
+		"wss://flue-relay.example.workers.dev",
+		// And the daemon's own socket, which is what this clause was for.
+		"ws://127.0.0.1:*",
+	} {
+		if !strings.Contains(connect, want) {
+			t.Errorf("connect-src %q does not allow %q", connect, want)
+		}
+	}
+}
+
+// TestLocalCSPNamesNoRelayWithoutOne: the grant is one exact origin this daemon
+// is configured to dial, and a daemon with no relay grants nothing extra.
+func TestLocalCSPNamesNoRelayWithoutOne(t *testing.T) {
+	ts, _ := newTestServer(t)
+	csp := get(t, ts, "/api/sessions", "same-origin").Header.Get("Content-Security-Policy")
+	if csp != LocalCSP {
+		t.Errorf("CSP without a relay = %q, want %q", csp, LocalCSP)
+	}
+	if strings.Contains(csp, "wss://") {
+		t.Errorf("a daemon with no relay granted a wss origin: %q", csp)
+	}
+}
+
+// TestLocalCSPForBuildsTheSocketOriginFromTheHTTPOne pins the scheme swap,
+// including the ws:// form a `pnpm dev` relay is spelled with — a policy that
+// named https and wss for a plain-http origin would allow the wrong thing and
+// forbid the right one.
+func TestLocalCSPForBuildsTheSocketOriginFromTheHTTPOne(t *testing.T) {
+	for _, tc := range []struct{ origin, wantSocket string }{
+		{origin: "https://relay.example", wantSocket: "wss://relay.example"},
+		{origin: "http://localhost:8787", wantSocket: "ws://localhost:8787"},
+	} {
+		got := LocalCSPFor(tc.origin)
+		if !strings.Contains(got, " "+tc.origin+" ") {
+			t.Errorf("LocalCSPFor(%q) does not name the origin: %q", tc.origin, got)
+		}
+		if !strings.Contains(got, tc.wantSocket) {
+			t.Errorf("LocalCSPFor(%q) does not name %q: %q", tc.origin, tc.wantSocket, got)
+		}
+	}
+	if LocalCSPFor("") != LocalCSP {
+		t.Error("LocalCSPFor(\"\") is not the plain policy")
+	}
+}
+
 // --- the pairing page, served to a device that holds no token ---
 
 // getAnon issues the GET the device being paired makes: no cookie, no header,
@@ -1976,7 +2054,7 @@ func TestShutdownClosesEstablishedWebSockets(t *testing.T) {
 func TestEnqueueNeverBlocksAndDropsABackloggedClient(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
-	c := newConn(ctx, cancel, nil, nil, "", "")
+	c := newConn(ctx, cancel, nil, nil, "", "", nil)
 
 	// Fill the outbox with no writer draining it, i.e. a client that has
 	// stopped reading its socket.
@@ -2020,7 +2098,7 @@ func TestBroadcastDoesNotWaitOnABackloggedPeer(t *testing.T) {
 	newPeer := func() *conn {
 		ctx, cancel := context.WithCancel(context.Background())
 		t.Cleanup(cancel)
-		c := newConn(ctx, cancel, nil, srv, "", "")
+		c := newConn(ctx, cancel, nil, srv, "", "", nil)
 		c.attach[1] = &attachment{ref: 1, s: s, sub: s.Subscribe(0), done: make(chan struct{})}
 		srv.claimPrimaryIfUnset(s.ID(), c)
 		return c
@@ -2831,7 +2909,7 @@ func TestDeviceListBroadcastDoesNotWaitOnABackloggedPeer(t *testing.T) {
 	newPeer := func() *conn {
 		ctx, cancel := context.WithCancel(context.Background())
 		t.Cleanup(cancel)
-		c := newConn(ctx, cancel, nil, srv, "", "")
+		c := newConn(ctx, cancel, nil, srv, "", "", nil)
 		srv.addConn(c, "")
 		return c
 	}
@@ -2900,7 +2978,7 @@ func TestADeviceConnJoinsBothRegistriesAtOnce(t *testing.T) {
 	srv := New(session.NewRegistry(time.Now), local.NewAuth(tok, 0), nil, "test", Identity{})
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
-	c := newConn(ctx, cancel, nil, srv, "relay", "")
+	c := newConn(ctx, cancel, nil, srv, "relay", "", nil)
 
 	// Admission is one step, so a revoke can only observe both registries or
 	// neither.
@@ -3304,3 +3382,306 @@ func TestRelayUIJoinEndpoint(t *testing.T) {
 		t.Fatalf("unconfigured GET join = %d, want 404", resp2.StatusCode)
 	}
 }
+
+// --- the fleet directory's half of revocation -------------------------------
+
+// TestApplyFleetRevocationIsTheFleetWideKillSwitch is the receiving end of a
+// revoke performed on another machine: the operator pressed the button on
+// machine A, machine A published the signed revocation, and this — machine B,
+// which never paired the device and was never asked — is what the directory
+// leg does with it.
+//
+// All three halves are asserted together because any one of them alone is not
+// a revocation. Recording it without dropping the row leaves the device on the
+// Devices screen; dropping the row without recording it lets the device's own
+// fleet cert walk it straight back in on the next handshake
+// (AddFromFleetCert); and doing both without closing the channels leaves the
+// revoked device holding a live, shell-spawning socket — the entry in a
+// registry nothing re-reads is not the access, the socket is.
+func TestApplyFleetRevocationIsTheFleetWideKillSwitch(t *testing.T) {
+	ts, srv := newPairServer(t)
+	buf := &syncBuffer{}
+	srv.SetLogger(slog.New(slog.NewTextHandler(buf, nil)))
+
+	phone := addDevice(t, srv, "phone", 0x2a)
+	laptop := addDevice(t, srv, "laptop", 0x3b)
+
+	device := dial(t, ts)
+	writeControl(t, device, wire.Hello{Ver: "test"})
+	readUntil(t, device, func(msg any, _ []byte) bool { _, ok := msg.(wire.Welcome); return ok })
+	srv.registerDeviceConn(phone.ID, serverConns(t, srv, 1)[0])
+
+	ui := dial(t, ts)
+	writeControl(t, ui, wire.Hello{Ver: "test"})
+	readUntil(t, ui, func(msg any, _ []byte) bool { _, ok := msg.(wire.Welcome); return ok })
+
+	// The blob is opaque here: verifying it is the caller's job, done under
+	// the fleet public key before this method is ever reached.
+	if err := srv.ApplyFleetRevocation(deviceKey(0x2a), []byte("signed-elsewhere")); err != nil {
+		t.Fatalf("ApplyFleetRevocation: %v", err)
+	}
+
+	// Told why, and then cut off.
+	readUntil(t, device, func(msg any, _ []byte) bool {
+		r, ok := msg.(wire.Revoked)
+		if ok && r.Reason != "revoked" {
+			t.Fatalf("revoked reason = %q, want %q", r.Reason, "revoked")
+		}
+		return ok
+	})
+	rctx, rcancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer rcancel()
+	for {
+		if _, _, err := device.Read(rctx); err != nil {
+			if rctx.Err() != nil {
+				t.Fatal("the revoked device's connection outlived a fleet revocation")
+			}
+			break
+		}
+	}
+
+	// Gone from the registry, and every remaining screen told so.
+	readUntil(t, ui, func(msg any, _ []byte) bool {
+		l, ok := msg.(wire.DeviceList)
+		if !ok {
+			return false
+		}
+		if len(l.Devices) != 1 || l.Devices[0].ID != laptop.ID {
+			t.Fatalf("deviceList = %+v, want just the laptop %s", l.Devices, laptop.ID)
+		}
+		return true
+	})
+	if list := devices(t, srv); len(list) != 1 || list[0].ID != laptop.ID {
+		t.Fatalf("registry = %+v after a fleet revocation, want just the laptop", list)
+	}
+
+	// And on the revocation list, which is the half that makes it stick: the
+	// device's own fleet cert must not be able to re-admit it.
+	revoked, err := srv.identity.Devices.IsRevoked(deviceKey(0x2a))
+	if err != nil || !revoked {
+		t.Fatalf("IsRevoked = %v, %v after a fleet revocation, want true", revoked, err)
+	}
+	if _, err := srv.identity.Devices.AddFromFleetCert("phone", deviceKey(0x2a), nil, time.Now()); !errors.Is(err, crypto.ErrDeviceRevoked) {
+		t.Fatalf("AddFromFleetCert after a fleet revocation = %v, want ErrDeviceRevoked", err)
+	}
+	waitForLog(t, buf, "device revoked by the fleet")
+}
+
+// TestApplyFleetRevocationIsIdempotent: the same revocation arrives on the
+// push socket and again in the snapshot of every reconnect, forever. Applying
+// it twice must be a no-op rather than an error, and must not broadcast a
+// device list on every delivery.
+func TestApplyFleetRevocationIsIdempotent(t *testing.T) {
+	_, srv := newPairServer(t)
+	addDevice(t, srv, "phone", 0x2a)
+
+	for i := 0; i < 3; i++ {
+		if err := srv.ApplyFleetRevocation(deviceKey(0x2a), []byte("signed-elsewhere")); err != nil {
+			t.Fatalf("ApplyFleetRevocation #%d: %v", i+1, err)
+		}
+	}
+	if list := devices(t, srv); len(list) != 0 {
+		t.Fatalf("registry = %+v after three deliveries of one revocation, want empty", list)
+	}
+	revs, err := srv.identity.Devices.Revocations()
+	if err != nil {
+		t.Fatalf("Revocations: %v", err)
+	}
+	if len(revs) != 1 {
+		t.Fatalf("revocation list = %d entries after three deliveries, want 1", len(revs))
+	}
+}
+
+// TestApplyFleetRevocationRecordsADeviceThisMachineNeverPaired: the common
+// case in a fleet. Nothing to unpair and nothing to disconnect, and the
+// recording still has to happen — it is what refuses the key when that device
+// eventually presents its cert to *this* machine.
+func TestApplyFleetRevocationRecordsADeviceThisMachineNeverPaired(t *testing.T) {
+	_, srv := newPairServer(t)
+	stranger := deviceKey(0x7c)
+
+	if err := srv.ApplyFleetRevocation(stranger, []byte("signed-elsewhere")); err != nil {
+		t.Fatalf("ApplyFleetRevocation: %v", err)
+	}
+	revoked, err := srv.identity.Devices.IsRevoked(stranger)
+	if err != nil || !revoked {
+		t.Fatalf("IsRevoked = %v, %v, want true", revoked, err)
+	}
+}
+
+// TestApplyFleetRevocationNeedsARegistry: a daemon constructed without an
+// identity has nowhere to record a revocation, and reporting success would
+// tell the directory leg that a key is dead when nothing on this machine
+// believes it.
+func TestApplyFleetRevocationNeedsARegistry(t *testing.T) {
+	srv := New(session.NewRegistry(time.Now), nil, nil, "test", Identity{})
+	t.Cleanup(srv.Shutdown)
+	if err := srv.ApplyFleetRevocation(deviceKey(0x01), []byte("blob")); !errors.Is(err, errNoDeviceRegistry) {
+		t.Fatalf("ApplyFleetRevocation on an identity-less daemon = %v, want errNoDeviceRegistry", err)
+	}
+}
+
+// TestPairingPublishesNothingToTheFleet: a ceremony mints a device
+// certificate and hands it to the device, in the answer and in every welcome
+// after it. It publishes nothing. Publishing the cert as well would put the
+// device's public key and the label its owner typed on the credential-less
+// `GET /directory` and spend one of 512 permanent entries per ceremony ever
+// performed, and would buy nothing — no daemon reads a device cert from
+// there (see the directory leg's ingest).
+//
+// The cert really is minted, and asserted here, because "published nothing"
+// must not be able to pass for the wrong reason: a ceremony that quietly
+// stopped minting would satisfy an empty publisher too.
+func TestPairingPublishesNothingToTheFleet(t *testing.T) {
+	ts, srv := newPairServer(t)
+	fk, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	srv.identity.Fleet = fk
+	srv.SetRelayMachine("sibling-mac-a1b2-0f9a12cd", "sibling")
+	pub := &recordingPublisher{}
+	srv.SetFleetPublisher(pub)
+
+	token, _ := srv.pairing.start(time.Now())
+	key := deviceKey(0x5e)
+	body, err := json.Marshal(map[string]string{
+		"token":     token,
+		"publicKey": base64.StdEncoding.EncodeToString(key),
+		"label":     "phone",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if out := srv.PairDevice(body, "test"); out.Status != http.StatusOK {
+		t.Fatalf("PairDevice = %d, want 200", out.Status)
+	}
+	_ = ts
+
+	if blobs := pub.blobs(); len(blobs) != 0 {
+		kinds := make([]string, 0, len(blobs))
+		for _, b := range blobs {
+			if c, err := fleet.Verify(fk.Public(), b); err == nil {
+				kinds = append(kinds, c.Kind())
+			} else {
+				kinds = append(kinds, "unverifiable")
+			}
+		}
+		t.Fatalf("a pairing published %v to the fleet directory, want nothing", kinds)
+	}
+
+	dev, ok, err := srv.identity.Devices.FindByKey(key)
+	if err != nil || !ok {
+		t.Fatalf("FindByKey after pairing = %v, %v", ok, err)
+	}
+	cert, err := fleet.VerifyDevice(fk.Public(), dev.Cert)
+	if err != nil {
+		t.Fatalf("the ceremony did not mint a device cert for the registry: %v", err)
+	}
+	if !bytes.Equal(cert.Device, key) {
+		t.Errorf("minted a cert for %x, want the device just paired %x", cert.Device, key)
+	}
+}
+
+// TestRevokePublishesTheRevocationToTheFleet: the outward half of the kill
+// switch. A revoke that stayed local would leave every other machine in the
+// fleet still admitting the device on its cert.
+func TestRevokePublishesTheRevocationToTheFleet(t *testing.T) {
+	_, srv := newPairServer(t)
+	fk, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	srv.identity.Fleet = fk
+	pub := &recordingPublisher{}
+	srv.SetFleetPublisher(pub)
+	phone := addDevice(t, srv, "phone", 0x2a)
+
+	if _, ok, err := srv.removeDevice(phone.ID); err != nil || !ok {
+		t.Fatalf("removeDevice = %v, %v", ok, err)
+	}
+	blobs := pub.blobs()
+	if len(blobs) != 1 {
+		t.Fatalf("published %d artifacts on a revoke, want 1", len(blobs))
+	}
+	cert, err := fleet.Verify(fk.Public(), blobs[0])
+	if err != nil {
+		t.Fatalf("the published artifact does not verify under the fleet key: %v", err)
+	}
+	rev, ok := cert.(fleet.Revocation)
+	if !ok {
+		t.Fatalf("published a %s certificate on a revoke", cert.Kind())
+	}
+	if !bytes.Equal(rev.Device, deviceKey(0x2a)) {
+		t.Errorf("published a revocation for %x, want the device revoked %x", rev.Device, deviceKey(0x2a))
+	}
+}
+
+// recordingPublisher stands in for the relay's directory leg.
+type recordingPublisher struct {
+	mu  sync.Mutex
+	got [][]byte
+}
+
+func (p *recordingPublisher) PublishFleetBlob(blob []byte) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.got = append(p.got, append([]byte(nil), blob...))
+}
+
+func (p *recordingPublisher) blobs() [][]byte {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	return append([][]byte(nil), p.got...)
+}
+
+// TestRelayInfoCarriesTheFleetDirectory: the Remote screen's other half of "is
+// my fleet wired up". Transport says this machine can be reached; the
+// directory says it can hear what the other machines have signed, which is
+// what a revocation travels on — a relay leg that is up while the directory is
+// down looks perfectly healthy and silently ignores every revoke performed
+// anywhere else.
+func TestRelayInfoCarriesTheFleetDirectory(t *testing.T) {
+	ts, srv := newPairServer(t)
+	srv.SetRelayUI(&stubRelayUI{})
+
+	read := func() RelayUIStatus {
+		t.Helper()
+		req, err := http.NewRequest(http.MethodGet, ts.URL+RelayInfoPath, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		req.AddCookie(&http.Cookie{Name: tsCookie(ts), Value: tok})
+		req.Header.Set("Sec-Fetch-Site", "same-origin")
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			t.Fatalf("GET info: %v", err)
+		}
+		defer resp.Body.Close()
+		if resp.StatusCode != http.StatusOK {
+			t.Fatalf("GET info = %d, want 200", resp.StatusCode)
+		}
+		var st RelayUIStatus
+		if err := json.NewDecoder(resp.Body).Decode(&st); err != nil {
+			t.Fatalf("decoding info: %v", err)
+		}
+		return st
+	}
+
+	// A daemon with no directory leg reports no directory at all, rather than
+	// an object full of zeroes that reads as "a fleet with nothing in it".
+	if st := read(); st.Directory != nil {
+		t.Fatalf("directory = %+v on a daemon with no directory leg, want nil", st.Directory)
+	}
+
+	srv.SetDirectoryCounts(func() DirectoryCounts {
+		return DirectoryCounts{Connected: true, Entries: 5, Verified: 4, Machines: 2, Devices: 1, Revocations: 1}
+	})
+	st := read()
+	if st.Directory == nil {
+		t.Fatal("directory = nil after the leg reported, want the counts")
+	}
+	if *st.Directory != (DirectoryCounts{Connected: true, Entries: 5, Verified: 4, Machines: 2, Devices: 1, Revocations: 1}) {
+		t.Errorf("directory = %+v, want what the leg reported", *st.Directory)
+	}
+}
diff --git a/internal/daemon/transport.go b/internal/daemon/transport.go
index 63e73a6..e794dd2 100644
--- a/internal/daemon/transport.go
+++ b/internal/daemon/transport.go
@@ -38,6 +38,20 @@ type ConnMeta struct {
 	Peer     string // resolved peer identity, for the audit log
 	Origin   string // absolute origin pairing URLs may be built from
 	DeviceID string // paired device id; "" on the local transport
+
+	// DeviceKey is the device's static public key — the thing the handshake
+	// actually proved, and the identity every registry lookup that decides
+	// something should be made against. Nil on the local transport, which
+	// authenticates a machine-local session token rather than a device.
+	//
+	// It rides alongside DeviceID rather than replacing it because the two
+	// answer different questions. The id is a 48-bit digest of these bytes and
+	// is what the log lines, the Devices screen and the connection buckets
+	// speak in; the bytes are what crypto.FindByKey compares, for the reason
+	// that function spells out at length — Add deliberately permits two
+	// devices with colliding digests, so an id alone can name more than one
+	// key.
+	DeviceKey []byte
 }
 
 // ServeConn serves one established, authenticated connection until it ends.
@@ -65,7 +79,7 @@ func (s *Server) ServeConn(ctx context.Context, mc MessageConn, meta ConnMeta) {
 	// out is unharmed.
 	defer func() { _ = mc.Close() }()
 
-	c := newConn(connCtx, cancel, mc, s, meta.Peer, meta.Origin)
+	c := newConn(connCtx, cancel, mc, s, meta.Peer, meta.Origin, meta.DeviceKey)
 	// Registered before it is served and forgotten however it ends, so the
 	// broadcast set is exactly the set of connections that can be written to.
 	// The device it authenticated as is part of that one registration rather
diff --git a/internal/daemon/transport_test.go b/internal/daemon/transport_test.go
index d25f9fe..ce8aedb 100644
--- a/internal/daemon/transport_test.go
+++ b/internal/daemon/transport_test.go
@@ -3,9 +3,12 @@ package daemon
 import (
 	"bytes"
 	"context"
+	"crypto/rand"
+	"encoding/base64"
 	"errors"
 	"io"
 	"log/slog"
+	"net/http"
 	"os"
 	"path/filepath"
 	"strings"
@@ -14,6 +17,7 @@ import (
 	"time"
 
 	"github.com/karnstack/flue/internal/crypto"
+	"github.com/karnstack/flue/internal/fleet"
 	"github.com/karnstack/flue/internal/session"
 	"github.com/karnstack/flue/internal/transport/local"
 	"github.com/karnstack/flue/internal/wire"
@@ -111,6 +115,99 @@ func TestServeConnSpeaksTheWireProtocol(t *testing.T) {
 	}
 }
 
+// TestWelcomeCarriesTheDevicesFleetCert is the re-supply path, and the reason a
+// device certificate no longer has to live in the relay's credential-less
+// directory.
+//
+// The ceremony hands one over in its answer; every connection after that offers
+// the same blob again, inside Noise, to a device that has just proved it holds
+// the key the certificate names. A browser that never stored one, or lost it,
+// or was paired before this machine had a fleet key, picks one up from any
+// machine it can still reach — and without it, that browser can reach only the
+// machines it paired with by hand.
+func TestWelcomeCarriesTheDevicesFleetCert(t *testing.T) {
+	dir := t.TempDir()
+	key, err := crypto.LoadOrCreateStaticKey(dir)
+	if err != nil {
+		t.Fatalf("LoadOrCreateStaticKey: %v", err)
+	}
+	fk, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		t.Fatalf("fleet.Mint: %v", err)
+	}
+	devices := crypto.NewDeviceStore(dir)
+	srv := New(session.NewRegistry(time.Now), local.NewAuth("tok", 0), nil, "test",
+		Identity{Key: key, Devices: devices, Fleet: fk})
+	t.Cleanup(srv.Shutdown)
+	srv.SetRelayMachine("karns-mbp-a1b2-0f9a12cd", "Karn's MacBook Pro")
+
+	// A device paired the ordinary way, so the registry holds the cert the
+	// ceremony minted.
+	token, _ := srv.pairing.start(time.Now())
+	devPub := deviceKey(0x2a)
+	out := srv.PairDevice(pairBody(t, token, base64.StdEncoding.EncodeToString(devPub), "phone"), "relay")
+	if out.Status != http.StatusOK {
+		t.Fatalf("PairDevice = %d (%s), want 200", out.Status, out.Body)
+	}
+
+	// A connection that authenticated as that device — which is what the relay
+	// transport hands over after a handshake: the id for the log lines and the
+	// key the handshake proved, which is what the certificate is looked up on.
+	p := newPipeConn()
+	go srv.ServeConn(context.Background(), p, ConnMeta{
+		Peer: "relay", DeviceID: crypto.DeviceID(devPub), DeviceKey: devPub,
+	})
+	t.Cleanup(func() { _ = p.Close() })
+
+	w, ok := expectControl(t, p).(wire.Welcome)
+	if !ok {
+		t.Fatal("first frame was not a welcome")
+	}
+	if len(w.FleetCert) == 0 {
+		t.Fatal("the welcome carried no fleet cert; this device could reach no machine it had not paired with")
+	}
+	cert, err := fleet.VerifyDevice(fk.Public(), w.FleetCert)
+	if err != nil {
+		t.Fatalf("the welcome's cert does not verify under this fleet key: %v", err)
+	}
+	if !bytes.Equal(cert.Device, devPub) {
+		t.Error("the welcome offered a certificate for another device's key")
+	}
+
+	// And a connection with no device identity — every loopback one — is
+	// offered nothing: a certificate is a statement about a device key, and a
+	// session-token connection has not named one.
+	local := newPipeConn()
+	go srv.ServeConn(context.Background(), local, ConnMeta{Peer: "test"})
+	t.Cleanup(func() { _ = local.Close() })
+	lw, ok := expectControl(t, local).(wire.Welcome)
+	if !ok {
+		t.Fatal("first frame on the loopback conn was not a welcome")
+	}
+	if len(lw.FleetCert) != 0 {
+		t.Errorf("a loopback welcome carried a fleet cert: %x", lw.FleetCert)
+	}
+
+	// And the lookup is on the key, not on the id. The id is
+	// hex(sha256(key))[:12] — 48 bits — and crypto.Add deliberately permits two
+	// devices to hold colliding ones, so a welcome resolved by id would hand
+	// the wrong device's certificate to whichever of them connected. Here the
+	// id is the paired device's and the key is not, which is exactly what a
+	// collision looks like from this function's side.
+	other := newPipeConn()
+	go srv.ServeConn(context.Background(), other, ConnMeta{
+		Peer: "relay", DeviceID: crypto.DeviceID(devPub), DeviceKey: deviceKey(0x5b),
+	})
+	t.Cleanup(func() { _ = other.Close() })
+	ow, ok := expectControl(t, other).(wire.Welcome)
+	if !ok {
+		t.Fatal("first frame on the colliding-id conn was not a welcome")
+	}
+	if len(ow.FleetCert) != 0 {
+		t.Errorf("a welcome offered another device's certificate to a key it does not name: %x", ow.FleetCert)
+	}
+}
+
 // panicConn is a MessageConn whose read panics, standing in for any unhandled
 // failure on the serve path. It writes and closes like the pipe it embeds.
 type panicConn struct{ *pipeConn }
diff --git a/internal/relaydeploy/deploy.go b/internal/relaydeploy/deploy.go
index ea2997c..89cc1cd 100644
--- a/internal/relaydeploy/deploy.go
+++ b/internal/relaydeploy/deploy.go
@@ -37,6 +37,16 @@ const (
 	DOBinding         = "HUB"
 	AssetsBinding     = "ASSETS"
 
+	// DirectoryClass and DirectoryBinding are the fleet directory: one Durable
+	// Object for the whole relay rather than one per machine, because one relay
+	// is one fleet (spec/fleet-trust.md, "The fleet directory"). Without the
+	// binding the Worker answers /directory with 503 by design
+	// (relay/src/index.ts) — a relay that serves every session and no
+	// directory — which is exactly what `flue relay setup` deployed between
+	// the Worker landing and this line.
+	DirectoryClass   = "FleetDirectory"
+	DirectoryBinding = "DIRECTORY"
+
 	// SecretName is the Worker secret the daemon authenticates its outbound
 	// leg with (relay/src/index.ts, authorizeDaemon).
 	SecretName = "DAEMON_SECRET"
@@ -94,11 +104,43 @@ func ValidWorkerName(name string) error {
 }
 
 // RunWorkerFirst are the paths the Worker handles itself rather than letting
-// the asset router answer from the bundle: the two WebSocket legs and the
-// pairing API. The bare entries matter alongside the globs — "/daemon/*"
-// alone would let the asset router answer a bare /daemon with the SPA before
-// the Worker's "no such machine" could.
-var RunWorkerFirst = []string{"/daemon", "/daemon/*", "/client", "/client/*", "/api/*"}
+// the asset router answer from the bundle: the two WebSocket legs, the pairing
+// API and the fleet directory. The bare entries matter alongside the globs —
+// "/daemon/*" alone would let the asset router answer a bare /daemon with the
+// SPA before the Worker's "no such machine" could, and on /directory the bare
+// path *is* the route while the starred form is the Worker's own 404.
+//
+// Twinned with `assets.run_worker_first` in relay/wrangler.jsonc; edit both or
+// neither.
+var RunWorkerFirst = []string{"/daemon", "/daemon/*", "/client", "/client/*", "/api/*", "/directory", "/directory/*"}
+
+// Migrations is the Durable Object migration history this relay carries, and
+// the twin of `migrations` in relay/wrangler.jsonc — tags included, because
+// the tag is what Cloudflare records against the deployed script and a
+// wrangler deploy and a `flue relay setup` of the same Worker have to agree on
+// it.
+//
+// v2 is its own step rather than an extra class on v1, and that is not a style
+// choice: v1 is already applied on every relay deployed before this build, and
+// a migration's contents cannot be edited after the fact — Cloudflare records
+// that the script is at v1 and would apply nothing further. A new class needs a
+// new tag. The whole list is sent on every deploy and the client applies only
+// the part the account has not reached (internal/cloudflare, pendingMigrations),
+// so a fresh account runs both steps and an existing relay runs only v2.
+var Migrations = []cloudflare.Migration{
+	{Tag: "v1", NewSQLiteClasses: []string{DOClass}},
+	{Tag: "v2", NewSQLiteClasses: []string{DirectoryClass}},
+}
+
+// DOBindings is the Durable Object binding table every deploy sends: the name
+// the Worker reads the namespace off `env` under, and the class behind it.
+//
+// A package-level var rather than a literal inside Deploy so that the drift
+// guard in deploy_test.go can compare *what is sent* against
+// `durable_objects.bindings` in relay/wrangler.jsonc, rather than against a
+// second hand-typed copy that would agree with the file and disagree with the
+// deploy. Twinned with that file; edit both or neither.
+var DOBindings = map[string]string{DOBinding: DOClass, DirectoryBinding: DirectoryClass}
 
 // Input is one deploy's worth of decisions, all made by the caller.
 type Input struct {
@@ -125,6 +167,13 @@ type Input struct {
 	// OnStep, when set, hears one line per completed step — "worker deployed:
 	// x" — in the order they happen. Callers own the formatting.
 	OnStep func(line string)
+
+	// OnNote, when set, hears the conditions a deploy can detect and cannot
+	// fix. Separate from OnStep because it is not progress and should not be
+	// dressed as it: a caller printing "  ✓ %s" for every step would put a tick
+	// on a warning. Unset falls back to OnStep, so a caller that has not
+	// thought about it still shows the line rather than swallowing it.
+	OnNote func(line string)
 }
 
 func (in Input) step(format string, args ...any) {
@@ -133,6 +182,16 @@ func (in Input) step(format string, args ...any) {
 	}
 }
 
+func (in Input) note(line string) {
+	if in.OnNote != nil {
+		in.OnNote(line)
+		return
+	}
+	if in.OnStep != nil {
+		in.OnStep(line)
+	}
+}
+
 func withTimeout(d time.Duration, fn func(context.Context) error) error {
 	ctx, cancel := context.WithTimeout(context.Background(), d)
 	defer cancel()
@@ -154,14 +213,19 @@ func Deploy(in Input) error {
 			ScriptName:        in.Worker,
 			Module:            in.Module,
 			CompatibilityDate: CompatibilityDate,
-			// Sent on every run, including re-runs of an account that already
-			// has the class. Cloudflare refuses a migration it has already
-			// applied and the client recovers from exactly that (see Deploy);
-			// the alternative — asking the account what it has already
-			// migrated — is a request that can only tell us something we can
-			// handle without asking.
-			NewSQLiteClasses:     []string{DOClass},
-			DOBindings:           map[string]string{DOBinding: DOClass},
+			// The whole history, every run. The client reads the tag the
+			// account's copy of the script carries and sends only the steps
+			// behind it, which is the one thing that makes an existing v1
+			// relay able to take v2's FleetDirectory: a client that could only
+			// say "introduce these classes" would have its migration refused
+			// on the tag precondition and then upload a script binding a class
+			// that was never created.
+			Migrations: Migrations,
+			// The client's one way of saying something a deploy cannot act on
+			// — today, a relay deployed by a newer flue than this one, whose
+			// migration history this binary must not replay over.
+			OnNote:               in.note,
+			DOBindings:           DOBindings,
 			Assets:               in.Assets,
 			AssetsRunWorkerFirst: RunWorkerFirst,
 			// Without this the relay serves the same bundle the daemon does,
diff --git a/internal/relaydeploy/deploy_test.go b/internal/relaydeploy/deploy_test.go
new file mode 100644
index 0000000..527d8a1
--- /dev/null
+++ b/internal/relaydeploy/deploy_test.go
@@ -0,0 +1,250 @@
+package relaydeploy
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+)
+
+// One Worker, two configurations, and nothing but prose keeping them level.
+//
+// `pnpm dev` and the vitest pool read relay/wrangler.jsonc; a user's relay is
+// deployed from the constants in this package, which never read that file. Both
+// have to describe the same Worker, and neither fails on its own when they stop
+// doing so — the failure surfaces as a developer and a user running different
+// relays, or worse.
+//
+// The migration history is the sharpest edge. Cloudflare records the applied
+// tag against the deployed script, and internal/cloudflare sends only the steps
+// *behind* that tag. A `v3` added to wrangler.jsonc alone would leave every
+// `flue relay update` believing v2 is the end of the history: the account
+// reports v2, the client finds v2 last, sends nothing, and the new class is
+// never created — silently, because the deploy succeeds. The equivalent guard
+// for the `_headers` document lives at cmd/flue/relay_test.go
+// (TestRelayAssetHeadersMatchTheWranglerCopy) and exists for the same reason.
+
+// wranglerConfig is the part of relay/wrangler.jsonc this package has a twin
+// for. Everything else in that file is `pnpm dev`'s business alone.
+type wranglerConfig struct {
+	Name              string `json:"name"`
+	Main              string `json:"main"`
+	CompatibilityDate string `json:"compatibility_date"`
+	Assets            struct {
+		Binding        string   `json:"binding"`
+		RunWorkerFirst []string `json:"run_worker_first"`
+	} `json:"assets"`
+	DurableObjects struct {
+		Bindings []struct {
+			Name      string `json:"name"`
+			ClassName string `json:"class_name"`
+		} `json:"bindings"`
+	} `json:"durable_objects"`
+	Migrations []struct {
+		Tag              string   `json:"tag"`
+		NewSQLiteClasses []string `json:"new_sqlite_classes"`
+	} `json:"migrations"`
+	RateLimits []struct {
+		Name        string `json:"name"`
+		NamespaceID string `json:"namespace_id"`
+		Simple      struct {
+			Limit  int `json:"limit"`
+			Period int `json:"period"`
+		} `json:"simple"`
+	} `json:"ratelimits"`
+}
+
+func readWrangler(t *testing.T) wranglerConfig {
+	t.Helper()
+	path := filepath.Join("..", "..", "relay", "wrangler.jsonc")
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("reading %s: %v", path, err)
+	}
+	var cfg wranglerConfig
+	if err := json.Unmarshal(stripJSONComments(raw), &cfg); err != nil {
+		t.Fatalf("parsing %s: %v", path, err)
+	}
+	return cfg
+}
+
+// stripJSONComments turns JSONC into JSON by blanking `//` and `/* */`
+// comments. Comments are replaced with spaces rather than removed so that byte
+// offsets in a parse error still point at the right place in the original.
+//
+// String literals are tracked, because a comment marker inside one is not a
+// comment — "https://example" is the case that matters here, and a stripper
+// that missed it would cut the rest of a real line away.
+func stripJSONComments(in []byte) []byte {
+	out := make([]byte, len(in))
+	copy(out, in)
+	const (
+		code = iota
+		inString
+		inLine
+		inBlock
+	)
+	state := code
+	for i := 0; i < len(in); i++ {
+		c := in[i]
+		switch state {
+		case code:
+			switch {
+			case c == '"':
+				state = inString
+			case c == '/' && i+1 < len(in) && in[i+1] == '/':
+				state = inLine
+				out[i], out[i+1] = ' ', ' '
+				i++
+			case c == '/' && i+1 < len(in) && in[i+1] == '*':
+				state = inBlock
+				out[i], out[i+1] = ' ', ' '
+				i++
+			}
+		case inString:
+			if c == '\\' && i+1 < len(in) {
+				i++
+				continue
+			}
+			if c == '"' {
+				state = code
+			}
+		case inLine:
+			if c == '\n' {
+				state = code
+				continue
+			}
+			out[i] = ' '
+		case inBlock:
+			if c == '*' && i+1 < len(in) && in[i+1] == '/' {
+				out[i], out[i+1] = ' ', ' '
+				i++
+				state = code
+				continue
+			}
+			if c != '\n' {
+				out[i] = ' '
+			}
+		}
+	}
+	return out
+}
+
+// TestMigrationHistoryMatchesTheWranglerCopy is the guard that matters most: a
+// step added to one list and not the other is a class that a wrangler deploy
+// creates and a `flue relay setup` does not, or the reverse — and on the update
+// path it fails silently, because the client trusts the last tag in its own
+// history to be the end of the story.
+func TestMigrationHistoryMatchesTheWranglerCopy(t *testing.T) {
+	cfg := readWrangler(t)
+	if len(cfg.Migrations) != len(Migrations) {
+		t.Fatalf("wrangler.jsonc has %d migrations, relaydeploy has %d:\n%+v\nvs\n%+v",
+			len(cfg.Migrations), len(Migrations), cfg.Migrations, Migrations)
+	}
+	for i, want := range Migrations {
+		got := cfg.Migrations[i]
+		// The tag is part of the contract, not a label: Cloudflare records it
+		// against the deployed script, so two tools deploying one Worker have
+		// to name the same history.
+		if got.Tag != want.Tag {
+			t.Errorf("migration %d: wrangler tag %q, relaydeploy tag %q", i, got.Tag, want.Tag)
+		}
+		if !reflect.DeepEqual(got.NewSQLiteClasses, want.NewSQLiteClasses) {
+			t.Errorf("migration %s: wrangler creates %v, relaydeploy creates %v",
+				want.Tag, got.NewSQLiteClasses, want.NewSQLiteClasses)
+		}
+	}
+}
+
+// TestDurableObjectBindingsMatchTheWranglerCopy: a binding present in one and
+// not the other is a Worker that reads `env.DIRECTORY` on one deploy and
+// `undefined` on the other. The Worker fails closed on a missing DIRECTORY
+// (503 on /directory), which is the good case; a *class* mismatch is the bad
+// one, and Cloudflare only catches it if no migration ever created the class.
+func TestDurableObjectBindingsMatchTheWranglerCopy(t *testing.T) {
+	cfg := readWrangler(t)
+	got := map[string]string{}
+	for _, b := range cfg.DurableObjects.Bindings {
+		got[b.Name] = b.ClassName
+	}
+	if !reflect.DeepEqual(got, DOBindings) {
+		t.Errorf("wrangler.jsonc binds %v, the deploy binds %v", got, DOBindings)
+	}
+	// Every class a binding names must also be introduced by some migration, on
+	// both sides at once: a binding to a class no migration created is the
+	// 10061 that killed `flue relay update`.
+	created := map[string]bool{}
+	for _, m := range Migrations {
+		for _, c := range m.NewSQLiteClasses {
+			created[c] = true
+		}
+	}
+	for name, class := range DOBindings {
+		if !created[class] {
+			t.Errorf("binding %s names class %s, which no migration creates", name, class)
+		}
+	}
+}
+
+// TestRunWorkerFirstMatchesTheWranglerCopy: a path the asset router answers
+// before the Worker does is a route that silently becomes the SPA. The bare
+// entries are the subtle half — "/directory" *is* the route, and "/daemon"
+// alone must reach the Worker's 404 rather than the app shell.
+func TestRunWorkerFirstMatchesTheWranglerCopy(t *testing.T) {
+	cfg := readWrangler(t)
+	if !reflect.DeepEqual(cfg.Assets.RunWorkerFirst, RunWorkerFirst) {
+		t.Errorf("run_worker_first differs\n--- wrangler.jsonc ---\n%v\n--- relaydeploy ---\n%v",
+			cfg.Assets.RunWorkerFirst, RunWorkerFirst)
+	}
+	if cfg.Assets.Binding != AssetsBinding {
+		t.Errorf("assets.binding = %q, the deploy sends %q", cfg.Assets.Binding, AssetsBinding)
+	}
+}
+
+// TestDeployMetadataMatchesTheWranglerCopy covers the rest of the twinned
+// surface in one place: the compatibility date, the script name the default
+// worker is deployed under, and the rate rule's three numbers.
+func TestDeployMetadataMatchesTheWranglerCopy(t *testing.T) {
+	cfg := readWrangler(t)
+	if cfg.CompatibilityDate != CompatibilityDate {
+		t.Errorf("compatibility_date = %q, the deploy sends %q", cfg.CompatibilityDate, CompatibilityDate)
+	}
+	if cfg.Name != DefaultWorker {
+		t.Errorf("wrangler name = %q, DefaultWorker = %q", cfg.Name, DefaultWorker)
+	}
+	if len(cfg.RateLimits) != 1 {
+		t.Fatalf("wrangler.jsonc declares %d rate limiters, the deploy sends 1", len(cfg.RateLimits))
+	}
+	rl := cfg.RateLimits[0]
+	if rl.Name != RateLimitBinding || rl.NamespaceID != rateLimitNamespaceID ||
+		rl.Simple.Limit != rateLimitRequests || rl.Simple.Period != rateLimitPeriodSecs {
+		t.Errorf("rate rule differs: wrangler %s/%s %d per %ds, deploy %s/%s %d per %ds",
+			rl.Name, rl.NamespaceID, rl.Simple.Limit, rl.Simple.Period,
+			RateLimitBinding, rateLimitNamespaceID, rateLimitRequests, rateLimitPeriodSecs)
+	}
+}
+
+// TestStripJSONCommentsLeavesStringsAlone: the stripper is only trustworthy if
+// a comment marker inside a string survives, which is what a URL in a config
+// file is made of.
+func TestStripJSONCommentsLeavesStringsAlone(t *testing.T) {
+	in := []byte(`{
+  // a line comment
+  "url": "https://example.test/x", /* trailing block */
+  "escaped": "a \" then // not a comment",
+  /* a
+     block */
+  "n": 1
+}`)
+	var got map[string]any
+	if err := json.Unmarshal(stripJSONComments(in), &got); err != nil {
+		t.Fatalf("stripped JSONC does not parse: %v\n%s", err, stripJSONComments(in))
+	}
+	if got["url"] != "https://example.test/x" {
+		t.Errorf("url = %q, want the whole URL: // inside a string is not a comment", got["url"])
+	}
+	if got["escaped"] != `a " then // not a comment` {
+		t.Errorf("escaped = %q", got["escaped"])
+	}
+}
diff --git a/internal/transport/relay/channel.go b/internal/transport/relay/channel.go
index ed4eed3..b4f7d35 100644
--- a/internal/transport/relay/channel.go
+++ b/internal/transport/relay/channel.go
@@ -400,9 +400,15 @@ func (t *Transport) serveChannel(s *socket, ch *channel, origin string) {
 	// including out of a panic — and that close is what tells the relay to drop
 	// the browser's socket.
 	t.srv.ServeConn(s.ctx, cc, daemon.ConnMeta{
-		Peer:     relayPeer + ":" + dev.ID,
-		Origin:   origin,
-		DeviceID: dev.ID,
+		Peer:   relayPeer + ":" + dev.ID,
+		Origin: origin,
+		// Both identities: the id for the log lines and the connection
+		// buckets, and the key the handshake actually proved for anything
+		// that has to look a device up. `peerStatic` rather than
+		// `dev.PublicKey` — they are equal, both lookups compared them — and
+		// this says which of the two the far end demonstrated it holds.
+		DeviceID:  dev.ID,
+		DeviceKey: peerStatic,
 	})
 	t.log.Debug("relay channel ended", "channel", ch.id, "device", dev.ID)
 }
diff --git a/internal/transport/relay/channel_test.go b/internal/transport/relay/channel_test.go
index d28f74b..5c876b6 100644
--- a/internal/transport/relay/channel_test.go
+++ b/internal/transport/relay/channel_test.go
@@ -422,6 +422,12 @@ func TestRelayChannelServesAPairedDevice(t *testing.T) {
 // over by the time the connection is served. The device id is what revocation
 // finds, the origin is what a pairing URL is built from, and the peer is what
 // the audit log names.
+//
+// The static key rides along with the id, and it is the one the handshake
+// proved rather than the one the registry row happens to hold. Everything on
+// the far side that has to look this device up again resolves on these bytes
+// (daemon.fleetCertFor), because an id is a 48-bit digest and two devices are
+// permitted to share one.
 func TestRelayChannelCarriesTheDeviceIdentity(t *testing.T) {
 	t.Parallel()
 	r := newFakeRelay(t, "s")
@@ -441,8 +447,14 @@ func TestRelayChannelCarriesTheDeviceIdentity(t *testing.T) {
 		time.Sleep(5 * time.Millisecond)
 	}
 	got := srv.served()[0]
-	want := daemon.ConnMeta{Peer: "relay:" + id.device.ID, Origin: testOrigin, DeviceID: id.device.ID}
-	if got != want {
+	want := daemon.ConnMeta{
+		Peer:      "relay:" + id.device.ID,
+		Origin:    testOrigin,
+		DeviceID:  id.device.ID,
+		DeviceKey: id.deviceKey.Public,
+	}
+	if got.Peer != want.Peer || got.Origin != want.Origin || got.DeviceID != want.DeviceID ||
+		!bytes.Equal(got.DeviceKey, want.DeviceKey) {
 		t.Errorf("ConnMeta = %+v, want %+v", got, want)
 	}
 }
diff --git a/internal/transport/relay/directory.go b/internal/transport/relay/directory.go
new file mode 100644
index 0000000..e48125c
--- /dev/null
+++ b/internal/transport/relay/directory.go
@@ -0,0 +1,957 @@
+package relay
+
+// directory.go is the daemon's leg of the relay's fleet directory: the one
+// place a machine learns what the rest of its fleet has signed, and the one
+// place it says what it has signed itself (spec/fleet-trust.md, "The fleet
+// directory"; the routes are in spec/relay-protocol.md).
+//
+// Three shapes on one URL, and the daemon uses all three:
+//
+//	PUT  /directory   the blobs this machine holds for the fleet — its machine
+//	                  cert and every revocation it knows — under the daemon
+//	                  secret. Never a device cert; see `mine`.
+//	GET  /directory   the whole set, on every connect, which is how a machine
+//	                  that was switched off catches up.
+//	WS   /directory   one binary message per new entry, which is how a machine
+//	                  that is switched on hears about a revocation seconds
+//	                  after the operator pressed the button.
+//
+// **Nothing the relay says is trusted, and the relay is not asked to check
+// anything.** Every blob that arrives here — by GET or by push — is verified
+// under the fleet public key before it means anything, and dropped without
+// ceremony if it does not verify. That is the whole reason the directory can
+// be a store the Worker cannot read: a hostile relay can serve this leg stale,
+// truncated or empty, which costs availability, and cannot mint an entry,
+// because minting needs the key Cloudflare never holds.
+//
+// The socket and the snapshot are ordered deliberately: the socket is opened
+// *first* and the GET follows it. A write landing in between arrives by one
+// path or the other, or both — and both is harmless, because ingest is
+// idempotent all the way down (crypto.AddRevocation is by key, and
+// daemon.ApplyFleetRevocation records, removes and disconnects at most once).
+// The reverse order has a window in which a revocation is published, missed by
+// a GET that has already been answered, and missed again by a socket that was
+// not yet open.
+
+import (
+	"bytes"
+	"context"
+	"crypto/ed25519"
+	"crypto/sha256"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/coder/websocket"
+	"github.com/flynn/noise"
+	"github.com/karnstack/flue/internal/crypto"
+	"github.com/karnstack/flue/internal/fleet"
+	"github.com/karnstack/flue/internal/relaywire"
+)
+
+const (
+	// directoryPath is the one route, for all three shapes. There is no id in
+	// it: one relay is one fleet, so the Worker routes it to a single Durable
+	// Object by a constant name (relay/src/index.ts, DIRECTORY_NAME).
+	directoryPath = "/directory"
+
+	// maxBlobBytes is the largest blob this daemon will look at, mirroring
+	// MAX_BLOB_BYTES in relay/src/directory.ts.
+	//
+	// Mirrored rather than imported-in-spirit: the Worker's cap is what an
+	// honest relay enforces on the way in, and this one is what this process
+	// enforces on the way out of a socket it does not control. A cert is a
+	// couple of hundred bytes, so anything near this is already not a
+	// certificate; what the bound actually buys is that a relay cannot make
+	// this daemon spend an Ed25519 verification, or an allocation, per
+	// megabyte it feels like sending.
+	maxBlobBytes = 4096
+
+	// MaxDirectoryEntries is how many entries one GET may carry, mirroring
+	// MAX_ENTRIES in relay/src/directory.ts. Entries past it are dropped
+	// unread: the Worker refuses to store a 513th (it answers 507 rather than
+	// evicting, because evicting could drop a revocation), so a longer answer
+	// is not a bigger fleet, it is a relay that has stopped speaking this
+	// protocol.
+	//
+	// Exported because it is also the number the status surfaces measure a
+	// fleet against — `flue relay status` warns as the directory approaches it
+	// (cmd/flue, directoryLine), and a second copy of 512 in that file would be
+	// a number that could drift from the one the reader actually enforces.
+	MaxDirectoryEntries = 512
+
+	// DirectoryWarnAt is where a status surface starts saying the directory is
+	// filling up: 90% of the cap.
+	//
+	// It exists because the cap has no gentle failure. At 512 the relay refuses
+	// every new blob — and refuses it before storing and before pushing, so a
+	// revocation made past that point reaches nobody at all — and nothing frees
+	// an entry short of `flue relay reset`. Without a warning the first signal
+	// an operator gets is a 507 in a daemon log *after* a revoke they believed
+	// had crossed the fleet, which is precisely the moment it is worth least.
+	DirectoryWarnAt = MaxDirectoryEntries * 9 / 10
+
+	// maxDirectorySnapshot bounds the GET's body before anything parses it.
+	// The worst honest case is MaxDirectoryEntries × maxBlobBytes of base64
+	// (four bytes per three) plus the JSON around it — about 2.8 MiB — and
+	// this is that with room to spare. Without it, `GET /directory` is an
+	// unbounded read from a machine on the internet.
+	maxDirectorySnapshot = 4 << 20
+
+	// directoryStepTimeout bounds one PUT or one GET. Generous: the body is
+	// small and the far end is a Durable Object that may be waking up.
+	directoryStepTimeout = 30 * time.Second
+
+	// publishQueueDepth is how many freshly minted artifacts may be waiting to
+	// be published at once. Publishing is best-effort by contract
+	// (daemon.FleetPublisher) and everything publishable is also on disk, so a
+	// queue this deep overflowing costs a push that the next reconnect's
+	// snapshot re-sends. Deep enough that a burst of revokes — the operator
+	// clearing out a devices list — never reaches that.
+	publishQueueDepth = 64
+
+	// republishEvery is how often a connected daemon re-offers everything it
+	// holds. It is the convergence backstop for the one window the reconnect
+	// snapshot does not cover: a socket that stays up for days, across which a
+	// single publish failed. Every PUT in it is idempotent — the directory
+	// answers 200, stores nothing and pushes nothing for bytes it already has
+	// — so the cost is a handful of requests an hour for a fleet-sized set.
+	republishEvery = 30 * time.Minute
+)
+
+// FleetSink is what a *verified* directory artifact does to this machine.
+//
+// One method, because one of the three kinds of blob has a local consequence.
+// A revocation is the fleet-wide kill switch and has to reach the device store
+// and the live channels; a machine cert is for browsers, which read the
+// directory themselves; and a device cert deliberately does nothing here — see
+// ingest, which explains at length why a daemon that pre-populated its registry
+// from this channel would be widening rule 1 of the acceptance order to keys
+// nobody has proved they hold.
+type FleetSink interface {
+	// ApplyFleetRevocation records a revocation whose signature the caller has
+	// already checked under the fleet public key, drops any local registry row
+	// for the key, and closes that device's live channels. It must be
+	// idempotent: the same revocation arrives on every reconnect.
+	ApplyFleetRevocation(deviceKey, blob []byte) error
+}
+
+// DirectoryCounts is what the last read of the directory found — for the
+// status surfaces, and for nothing else. Verified is the only number with any
+// authority in it; Entries is what the relay claimed to be holding.
+type DirectoryCounts struct {
+	// Connected is whether this daemon is holding the directory socket right
+	// now. The counts below are the last snapshot read *on that socket*, so
+	// they are meaningless without it and are cleared with it.
+	Connected   bool
+	Entries     int
+	Verified    int
+	Machines    int
+	Devices     int
+	Revocations int
+}
+
+// Directory keeps this machine's view of the fleet directory up to date, and
+// the directory's view of this machine.
+//
+// It is a sibling of Transport rather than a part of it, and the split is the
+// honest one: they dial different objects for different reasons and neither
+// needs the other to work. A daemon whose directory leg is down still serves
+// every device paired to it; a daemon whose hub leg is down still hears
+// revocations. What they share is the credential, the reconnect discipline and
+// the fleet public key, which is why they share a Config.
+type Directory struct {
+	cfg     Config
+	sink    FleetSink
+	devices *crypto.DeviceStore
+	log     *slog.Logger
+
+	// noisePub is this daemon's static public key — not for the wire, but to
+	// check the stored machine cert still describes this machine before
+	// publishing it. See publishAll.
+	noisePub []byte
+
+	// wsURL and httpURL are the same route on the same host, reached the two
+	// ways it is reachable. Both are built once, from cfg.URL alone: the
+	// socket and the writes must go to the object the daemon leg dials, and
+	// deriving the second from any other field would let a half-edited
+	// relay.json publish this fleet's certificates somewhere else.
+	wsURL   string
+	httpURL string
+
+	// pub carries freshly minted artifacts from the daemon's own goroutines
+	// (a pairing ceremony, a revoke) to the publisher. Buffered and never
+	// waited on: PublishFleetBlob is called from paths that are answering a
+	// user.
+	pub chan []byte
+
+	// client is the HTTP client for PUT and GET. Its redirect policy is
+	// noRedirects' for the same reason the socket's is: a 3xx off this host
+	// would carry the daemon secret with it (net/http re-sends Authorization
+	// to the same host and its subdomains).
+	client *http.Client
+
+	// keepalive is the interval between flue-pings on the push socket, a field
+	// so a test need not wait 30 s to watch one.
+	keepalive time.Duration
+
+	// heard is when the last message arrived on the push socket, in Unix
+	// nanoseconds — the same field, with the same job, that socket.read is on
+	// the hub leg: it is what tells a quiet relay from an absent one.
+	heard atomic.Int64
+
+	mu sync.Mutex
+	// seenKind is the digests this process has already ingested and what each
+	// one was, so a reconnect's snapshot does not re-verify and re-apply the
+	// whole fleet's history. It is an optimisation and never a correctness
+	// argument — every path behind it is idempotent — which is why it may
+	// simply stop growing at the directory's own ceiling rather than needing
+	// an eviction policy.
+	seenKind map[[32]byte]string
+	counts   DirectoryCounts
+
+	// etag is the `ETag` of the last snapshot this process read *and fully
+	// applied*, and lastCounts is what that snapshot counted. Together they are
+	// the conditional read: the next GET presents the tag, and a 304 means the
+	// set has not changed since — so there is nothing to parse, nothing to
+	// verify, and the counts still stand.
+	//
+	// It is worth having because this is the largest document the relay serves
+	// (512 × 4 KiB of base64, about 2.8 MiB) and a daemon re-reads all of it on
+	// every reconnect, where the usual answer is "nothing new".
+	//
+	// "Fully applied" is the load-bearing half. A snapshot in which a
+	// revocation could not be handed to the sink — a registry that was
+	// unreadable for a moment — leaves the tag *unset*, so the next read is
+	// unconditional and tries again. Caching a tag over a failed apply would
+	// turn "retry on the next connect" into "retry when somebody else next
+	// publishes", and the artifact it dropped is the kill switch.
+	//
+	// Neither field is cleared by markUnreachable: losing the socket does not
+	// make the last read untrue, and a reconnect that answers 304 needs the
+	// counts that went with the tag it presented.
+	etag       string
+	lastCounts DirectoryCounts
+}
+
+// NewDirectory builds the directory leg for a config relay.New has already
+// accepted. It takes the same three things the transport does — the config,
+// the daemon's identity and the device registry — plus the sink a verified
+// revocation acts on.
+//
+// The config's checks are relay.New's, not repeated here: this leg dials the
+// same host with the same secret, and a daemon that has no relay transport has
+// no directory either (cmd/flue starts them together).
+func NewDirectory(cfg Config, sink FleetSink, identity noise.DHKey, devices *crypto.DeviceStore, log *slog.Logger) (*Directory, error) {
+	switch {
+	case cfg.URL == "":
+		return nil, fmt.Errorf("%w: no URL", ErrIncompleteConfig)
+	case cfg.Secret == "":
+		return nil, fmt.Errorf("%w: no daemon secret", ErrIncompleteConfig)
+	case len(cfg.FleetPub) != ed25519.PublicKeySize:
+		// The directory is *only* signed artifacts. Without the fleet public
+		// key there is nothing this leg could honestly do with a single byte
+		// of what it reads, and running it anyway would be a daemon happily
+		// holding a socket to a store it cannot read.
+		return nil, fmt.Errorf("%w: no fleet key; re-run the join line printed by `flue relay setup` on this machine", ErrIncompleteConfig)
+	case sink == nil:
+		return nil, fmt.Errorf("%w: no fleet sink", ErrIncompleteConfig)
+	}
+	if log == nil {
+		log = slog.New(slog.DiscardHandler)
+	}
+	base := strings.TrimRight(cfg.URL, "/")
+	return &Directory{
+		cfg:       cfg,
+		sink:      sink,
+		devices:   devices,
+		log:       log,
+		noisePub:  identity.Public,
+		wsURL:     base + directoryPath,
+		httpURL:   httpScheme(base) + directoryPath,
+		pub:       make(chan []byte, publishQueueDepth),
+		client:    noRedirects,
+		keepalive: defaultKeepalive,
+		seenKind:  map[[32]byte]string{},
+	}, nil
+}
+
+// httpScheme rewrites a WebSocket URL as the HTTP one it is the upgrade of.
+// wss and https are the same origin to every part of the stack that matters —
+// the Worker serves all three shapes of /directory on one URL — and ws/http is
+// the pair a test's httptest.Server speaks.
+func httpScheme(url string) string {
+	switch {
+	case strings.HasPrefix(url, "wss://"):
+		return "https://" + strings.TrimPrefix(url, "wss://")
+	case strings.HasPrefix(url, "ws://"):
+		return "http://" + strings.TrimPrefix(url, "ws://")
+	}
+	return url
+}
+
+// PublishFleetBlob queues one artifact this daemon just minted. It never
+// blocks and never fails, which is daemon.FleetPublisher's contract: the
+// caller is a revoke, with a client waiting and nowhere to put a network
+// error.
+//
+// **A device certificate is dropped here, whoever offers one.** It is the only
+// blob kind this leg refuses, and the refusal is a guard rather than a policy
+// the callers rely on: `mine` does not publish them and the pairing ceremony
+// does not either, so nothing should ever reach this line — but the cost of
+// one that did is permanent (nothing in the directory is deleted one entry at
+// a time) and public (`GET /directory` needs no credential, and a device cert
+// names a device key and the label its owner typed). A future call site that
+// forgets meets a log line here instead of a roster of the operator's devices
+// on the open internet. Why they are not in the directory at all is on `mine`.
+//
+// The parse is a decode of bytes this daemon just signed, on the caller's
+// goroutine: microseconds, and the queue send below is what must not block.
+// Unparseable blobs are passed through rather than dropped — this is not a
+// validator, and the directory's own readers verify everything they ingest.
+//
+// A full queue drops the blob with a log line rather than waiting. That is
+// safe for exactly one reason, and it is worth naming: everything publishable
+// is written to disk first — the revocation into revocations.json, the machine
+// cert into relay.json — and publishAll re-offers all of it on every connect
+// and every republishEvery. A dropped push costs latency, never the artifact.
+func (d *Directory) PublishFleetBlob(blob []byte) {
+	if len(blob) == 0 {
+		return
+	}
+	if cert, err := fleet.Verify(d.cfg.FleetPub, blob); err == nil {
+		if _, isDevice := cert.(fleet.DeviceCert); isDevice {
+			d.log.Warn("refused to publish a device certificate to the fleet directory; device certificates go to the device that owns them, in the pairing answer and in every welcome")
+			return
+		}
+	}
+	select {
+	case d.pub <- bytes.Clone(blob):
+	default:
+		d.log.Warn("dropped a fleet artifact from the publish queue; it will be re-offered on the next directory connect",
+			"bytes", len(blob))
+	}
+}
+
+// Counts is the last read of the directory, for the status surfaces.
+func (d *Directory) Counts() DirectoryCounts {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	return d.counts
+}
+
+// Run holds the directory socket and keeps this machine converged with the
+// fleet until ctx is done.
+//
+// The shape is Transport.Run's, deliberately and not by accident: the same
+// jittered backoff, the same stable-connection rule that stops two daemons
+// fighting over one leg from hammering a Worker with a 100k-request day, and
+// the same "cancellation is not an error" contract. Two legs to one relay that
+// reconnected on two different disciplines would be two things to reason about
+// during the same outage.
+func (d *Directory) Run(ctx context.Context) error {
+	attempt := 0
+	for {
+		connectedAt, err := d.runOnce(ctx)
+		if ctx.Err() != nil {
+			return nil
+		}
+		if connectedAt.IsZero() {
+			d.log.Warn("fleet directory dial failed", "url", d.wsURL, "err", err)
+			d.markUnreachable()
+		} else {
+			lasted := time.Since(connectedAt)
+			d.log.Info("fleet directory connection lost",
+				"url", d.wsURL, "lasted", lasted.Round(time.Millisecond), "err", err)
+			d.markUnreachable()
+			if lasted >= minStableConn {
+				attempt = 0
+			}
+		}
+		delay := backoffDelay(attempt)
+		if attempt < backoffMaxAttempt {
+			attempt++
+		}
+		timer := time.NewTimer(delay)
+		select {
+		case <-timer.C:
+		case <-ctx.Done():
+			timer.Stop()
+			return nil
+		}
+	}
+}
+
+// runOnce holds one directory connection: the socket, the catch-up read, the
+// publish of everything this machine holds, and then the pushes until it ends.
+func (d *Directory) runOnce(ctx context.Context) (connectedAt time.Time, err error) {
+	dialCtx, cancelDial := context.WithTimeout(ctx, dialTimeout)
+	ws, _, err := websocket.Dial(dialCtx, d.wsURL, &websocket.DialOptions{
+		HTTPHeader: http.Header{"Authorization": {"Bearer " + d.cfg.Secret}},
+		HTTPClient: noRedirects,
+	})
+	cancelDial()
+	if err != nil {
+		return time.Time{}, err
+	}
+	connectedAt = time.Now()
+	// The silence clock starts at the handshake, not at the epoch: an idle
+	// directory must not look dead the first time the keepalive checks.
+	d.markHeard()
+	d.markConnected()
+	// One push is one blob and nothing else — no envelope, no key (see
+	// relay/src/directory.ts, push) — so the blob cap is the frame cap. A
+	// relay that sends more than a certificate can be is not one this daemon
+	// keeps reading from.
+	ws.SetReadLimit(maxBlobBytes)
+	defer ws.CloseNow()
+	d.log.Info("fleet directory connected", "url", d.wsURL)
+
+	connCtx, cancel := context.WithCancel(ctx)
+
+	// Reading before the snapshot, so a write that lands between the two is
+	// caught by the socket. The reader owns the connection's lifetime: when it
+	// returns, this connection is over.
+	readErr := make(chan error, 1)
+	go func() { readErr <- d.readLoop(connCtx, ws) }()
+
+	// The HTTP half runs on its own goroutine, and that is not tidiness. A PUT
+	// or a GET to a Durable Object that has to wake up takes as long as it
+	// takes, and this loop is also the only thing sending keepalives: a
+	// publish on the same goroutine would put the socket's liveness behind an
+	// unrelated request, which is how an honest slow relay ends up being
+	// declared silent. Only this goroutine writes to the socket, so the two
+	// cannot race either.
+	pubDone := make(chan struct{})
+	go func() {
+		defer close(pubDone)
+		d.ingestSnapshot(connCtx)
+		d.publishAll(connCtx)
+		republish := time.NewTicker(republishEvery)
+		defer republish.Stop()
+		for {
+			select {
+			case blob := <-d.pub:
+				d.publish(connCtx, blob)
+			case <-republish.C:
+				d.publishAll(connCtx)
+			case <-connCtx.Done():
+				return
+			}
+		}
+	}()
+	// Cancel first, then wait: the publisher's requests are bounded by
+	// connCtx, so cancelling is what ends one in flight.
+	defer func() {
+		cancel()
+		<-pubDone
+	}()
+
+	ping := time.NewTicker(d.keepalive)
+	defer ping.Stop()
+	stale := staleFactor * d.keepalive
+
+	for {
+		select {
+		case err := <-readErr:
+			return connectedAt, err
+		case <-ping.C:
+			if silence := time.Since(d.lastHeard()); silence > stale {
+				// Half-open: this end still has a socket and the other end
+				// stopped existing. The edge answers every flue-ping from the
+				// Durable Object's auto-response without waking it, so silence
+				// across three intervals is not a busy relay — it is a socket
+				// nothing is on the other end of, which nothing else would
+				// ever notice.
+				return connectedAt, fmt.Errorf("%w for %s", errRelaySilent, silence.Round(time.Millisecond))
+			}
+			wctx, cancelWrite := context.WithTimeout(connCtx, writeTimeout)
+			err := ws.Write(wctx, websocket.MessageText, []byte(relaywire.Ping))
+			cancelWrite()
+			if err != nil {
+				return connectedAt, fmt.Errorf("relay: writing to the fleet directory: %w", err)
+			}
+		case <-ctx.Done():
+			return connectedAt, ctx.Err()
+		}
+	}
+}
+
+// readLoop ingests pushes until the socket ends.
+//
+// Every message is one blob, exactly as it was PUT, and every one of them goes
+// through the same verification the snapshot's entries do. Text frames are the
+// keepalives and nothing else: the leg is push-only in the other direction
+// too, and a relay saying anything else on it is a relay this daemon stops
+// reading and re-dials.
+func (d *Directory) readLoop(ctx context.Context, ws *websocket.Conn) error {
+	for {
+		typ, data, err := ws.Read(ctx)
+		if err != nil {
+			return err
+		}
+		// Any message at all is proof the socket is still two-ended.
+		d.markHeard()
+		if typ == websocket.MessageText {
+			if string(data) == relaywire.Pong || string(data) == relaywire.Ping {
+				continue
+			}
+			// Not logged verbatim: this is the branch a hostile relay reaches
+			// with a message of its own choosing.
+			_ = ws.Close(websocket.StatusProtocolError, "protocol error")
+			return protocolError{fmt.Errorf("the fleet directory sent a text frame that is not a keepalive (%d bytes)", len(data))}
+		}
+		d.ingest(data, "push")
+	}
+}
+
+// ingestSnapshot reads the whole directory and ingests what verifies.
+//
+// A failure here is logged and nothing else. This leg's entire job is
+// convergence, and the ways it can fail — a 5xx, a truncated body, a document
+// that is not the shape the spec fixes — are all "this daemon has not caught
+// up yet", which the next connect or the next push corrects. None of them is a
+// reason to drop a socket that may be about to deliver a revocation.
+func (d *Directory) ingestSnapshot(ctx context.Context) {
+	ctx, cancel := context.WithTimeout(ctx, directoryStepTimeout)
+	defer cancel()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, d.httpURL, nil)
+	if err != nil {
+		d.log.Warn("could not build the fleet directory read", "err", err)
+		return
+	}
+	// The secret on a credential-less route, on purpose. `GET /directory` needs
+	// no credential — the browser reads it without one — but the Worker meters
+	// exactly the callers that present none (relay/src/index.ts, allowRate),
+	// and a fleet of daemons re-reading the directory on every reconnect has no
+	// business spending the per-IP budget that exists to keep browsers working.
+	req.Header.Set("Authorization", "Bearer "+d.cfg.Secret)
+	// The conditional read. The tag is the relay's version counter, so a match
+	// means the set has not changed since this daemon last applied all of it —
+	// nothing to download, nothing to verify. Absent on the first read of a
+	// process and after any snapshot that did not fully apply.
+	if tag := d.snapshotETag(); tag != "" {
+		req.Header.Set("If-None-Match", tag)
+	}
+	resp, err := d.client.Do(req)
+	if err != nil {
+		d.log.Warn("could not read the fleet directory", "url", d.httpURL, "err", err)
+		return
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode == http.StatusNotModified {
+		// Unchanged since the tag was issued, and this process applied every
+		// entry of that version — so it is converged, and the counts it
+		// recorded then are still what the directory holds. Anything published
+		// since would have moved the tag and been answered 200; anything
+		// published from here on arrives on the push socket, which was opened
+		// before this read.
+		d.restoreCounts()
+		d.log.Debug("the fleet directory is unchanged since the last read", "etag", d.snapshotETag())
+		return
+	}
+	if resp.StatusCode != http.StatusOK {
+		d.log.Warn("the fleet directory refused a read", "url", d.httpURL, "status", resp.StatusCode)
+		return
+	}
+	var doc struct {
+		V       int `json:"v"`
+		Entries []struct {
+			Key string `json:"key"`
+			// Standard base64 with padding on the wire, which is the alphabet
+			// encoding/json reads a []byte in — so the Worker's answer decodes
+			// here with no help (relay/src/directory.ts, base64).
+			Blob []byte `json:"blob"`
+		} `json:"entries"`
+	}
+	if err := json.NewDecoder(io.LimitReader(resp.Body, maxDirectorySnapshot)).Decode(&doc); err != nil {
+		d.log.Warn("the fleet directory answered something that is not a directory", "err", err)
+		return
+	}
+
+	counts := DirectoryCounts{Connected: true, Entries: len(doc.Entries)}
+	// applied stays true only while every entry either meant something or was
+	// refused for a reason that will not change — a blob that does not verify
+	// is not coming back different next time. A revocation the sink could not
+	// take is the one retryable failure, and it is why the tag below is not
+	// always remembered.
+	applied := true
+	// Bounded before the loop and not merely reported: a relay that claims
+	// 100 000 entries gets 512 signature checks out of this daemon, which is
+	// what its own ceiling would have allowed. A *shorter* answer than the
+	// truth costs nothing but freshness, which is the availability a relay has
+	// always been able to take away.
+	for i, e := range doc.Entries {
+		if i >= MaxDirectoryEntries {
+			d.log.Warn("the fleet directory served more entries than it can hold; the rest are ignored",
+				"entries", len(doc.Entries), "ceiling", MaxDirectoryEntries)
+			// A truncated read is not a fully applied one: the entries past the
+			// ceiling were never looked at, so this answer must not be cached
+			// under a tag that would skip them for good.
+			applied = false
+			break
+		}
+		kind, ok, retry := d.ingest(e.Blob, "snapshot")
+		if retry {
+			applied = false
+		}
+		if ok {
+			counts.Verified++
+			switch kind {
+			case fleet.KindMachine:
+				counts.Machines++
+			case fleet.KindDevice:
+				counts.Devices++
+			case fleet.KindRevoke:
+				counts.Revocations++
+			}
+		}
+	}
+	d.mu.Lock()
+	d.counts = counts
+	if applied {
+		// Remembered together, and only now: the tag is a claim that this
+		// process holds everything that version carried, and lastCounts is what
+		// a 304 against it will report.
+		d.etag, d.lastCounts = resp.Header.Get("ETag"), counts
+	} else {
+		// Something is owed. Drop the tag so the next read is unconditional and
+		// the relay sends the whole set again.
+		d.etag = ""
+	}
+	d.mu.Unlock()
+	d.log.Debug("read the fleet directory",
+		"entries", counts.Entries, "verified", counts.Verified,
+		"machines", counts.Machines, "devices", counts.Devices, "revocations", counts.Revocations)
+}
+
+// snapshotETag is the tag of the last fully applied snapshot, or "" when the
+// next read must be unconditional.
+func (d *Directory) snapshotETag() string {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	return d.etag
+}
+
+// restoreCounts republishes the last snapshot's numbers as current, which is
+// what a 304 means: the set is what it was, and this daemon still holds all of
+// it. Connected is set here rather than carried, because the socket this read
+// runs under is up by definition.
+func (d *Directory) restoreCounts() {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	d.counts = d.lastCounts
+	d.counts.Connected = true
+}
+
+// ingest verifies one blob and does whatever it means, reporting its kind,
+// whether it verified, and whether it is worth trying again.
+//
+// retry is the narrow one and it exists for the conditional read: it is true
+// only when a *verified* artifact could not be applied for a reason that may
+// not hold next time — a revocation the sink refused because the registry was
+// unreadable for a moment. A blob that fails verification is not retryable, it
+// is simply not a certificate, and it will fail identically forever. The
+// caller uses it to decide whether this snapshot may be remembered under its
+// ETag, because caching a tag over an unapplied revocation would postpone the
+// retry until somebody else happens to publish.
+//
+// The verification is the boundary. Everything above this line is bytes a
+// relay chose; everything below is a statement the fleet key signed. A blob
+// that is too big, too small, not a certificate, signed by another key, or
+// signed by this key and then edited by one byte, all leave by the same door:
+// dropped, counted as nothing, logged once.
+//
+// What a verified blob does, by kind:
+//
+//   - Revocation → the sink, which records it, drops the local registry row
+//     and closes that device's live channels. This is the fleet-wide kill
+//     switch, and it is the only kind with a local consequence.
+//
+//   - Device cert → **nothing**, deliberately, and this is the load-bearing
+//     decision of this file. This daemon no longer publishes them either (see
+//     mine), so one reaching here at all means an older machine in the fleet is
+//     still doing so, or a relay is offering something nobody asked for; either
+//     way the answer is the same, and it is the answer it always was. A cert
+//     here is a public blob off a credential-less GET; the *handshake* is where
+//     a device proves it holds the key, and rule 2 of the acceptance order
+//     already admits a fleet-signed device that presents its cert in message A
+//     (channel.go, admitByFleetCert) — writing the row at that moment, when
+//     possession has just been proved. Pre-populating the registry from the
+//     directory instead would put rows in devices.json for keys nobody has
+//     demonstrated they hold, and those rows are honoured by rule 1
+//     (crypto.FindByKey), which deliberately never looks at a certificate at
+//     all. Rule 1 exists so that pairing on this machine keeps working if the
+//     fleet key ever rotates away — so a registry filled from the directory
+//     would quietly convert "the fleet vouches for this key today" into "this
+//     machine pairs with this key forever", surviving the very rotation that
+//     was meant to withdraw it. The Devices screen would also stop being this
+//     machine's record and become a fleet-wide roster it cannot vouch for.
+//     None of that buys anything: a device roaming to this machine brings its
+//     cert with it.
+//
+//   - Machine cert → nothing here either, and for a plainer reason: daemons do
+//     not dial each other. A sibling machine's cert is addressed to browsers,
+//     which read this directory themselves (part C) and pin the `noise` key it
+//     carries. Verifying it is still worth the cycles — it is what makes the
+//     machine count on `flue relay status` a count of machines rather than of
+//     blobs.
+func (d *Directory) ingest(blob []byte, via string) (kind string, ok bool, retry bool) {
+	if len(blob) == 0 || len(blob) > maxBlobBytes {
+		d.log.Warn("dropped a fleet directory entry of an impossible size", "via", via, "bytes", len(blob))
+		return "", false, false
+	}
+	digest := sha256.Sum256(blob)
+	if k, done := d.alreadySeen(digest); done {
+		return k, true, false
+	}
+	cert, err := fleet.Verify(d.cfg.FleetPub, blob)
+	if err != nil {
+		// The one line that matters when a relay is lying, and the one that
+		// would matter if a fleet key had rotated under this machine's feet.
+		// The blob is not logged: it is bytes of the relay's choosing.
+		d.log.Warn("dropped a fleet directory entry that does not verify under the fleet key",
+			"via", via, "bytes", len(blob), "err", err)
+		return "", false, false
+	}
+	switch c := cert.(type) {
+	case fleet.Revocation:
+		if err := d.sink.ApplyFleetRevocation(c.Device, blob); err != nil {
+			// Not remembered as seen, so the next snapshot tries again — the
+			// registry may simply have been unreadable for a moment, and a
+			// revocation that was dropped on the floor is a device that stays
+			// admitted.
+			d.log.Error("could not apply a fleet revocation",
+				"via", via, "device", crypto.DeviceID(c.Device), "err", err)
+			return c.Kind(), false, true
+		}
+		d.log.Info("applied a fleet revocation", "via", via, "device", crypto.DeviceID(c.Device))
+	case fleet.DeviceCert:
+		// Verified, and deliberately not written to the registry — see above.
+		d.log.Debug("read a fleet device certificate",
+			"via", via, "device", crypto.DeviceID(c.Device), "pairedOn", clip(c.PairedOn))
+	case fleet.MachineCert:
+		d.log.Debug("read a fleet machine certificate", "via", via, "machine", clip(c.ID))
+	}
+	d.remember(digest, cert.Kind())
+	return cert.Kind(), true, false
+}
+
+func (d *Directory) markHeard() { d.heard.Store(time.Now().UnixNano()) }
+
+func (d *Directory) lastHeard() time.Time { return time.Unix(0, d.heard.Load()) }
+
+// alreadySeen reports whether this exact blob has been ingested by this
+// process, and what it was.
+func (d *Directory) alreadySeen(digest [32]byte) (string, bool) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	k, ok := d.seenKind[digest]
+	return k, ok
+}
+
+func (d *Directory) remember(digest [32]byte, kind string) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	if len(d.seenKind) >= MaxDirectoryEntries {
+		// The directory cannot hold more than this, so a process that has seen
+		// this many distinct blobs is either very long-lived across a fleet's
+		// whole history or is being fed by a relay that is not obeying its own
+		// ceiling. Either way the map stops growing rather than being pruned
+		// on a policy: forgetting costs one re-verification, and every path
+		// behind this cache is idempotent.
+		return
+	}
+	d.seenKind[digest] = kind
+}
+
+// publishAll offers the directory everything this machine holds for it: its
+// own machine certificate and every revocation it knows about. Not the device
+// certificates its ceremonies minted — those go to the devices themselves; see
+// `mine`, which is where the absence is argued.
+//
+// It runs on every connect, which is what makes the whole leg self-healing —
+// a PUT that failed, a push that was dropped, an artifact minted while the
+// relay was down, a directory that was emptied by a re-deploy — and it is
+// cheap to run: the store is content-addressed, so re-offering a blob it
+// already has is a 200 with no write and no push (relay/src/directory.ts).
+func (d *Directory) publishAll(ctx context.Context) {
+	for _, blob := range d.mine() {
+		if ctx.Err() != nil {
+			return
+		}
+		d.publish(ctx, blob)
+	}
+}
+
+// mine is every blob this machine is the source of: its own machine
+// certificate, and every revocation it knows.
+//
+// **Device certificates are deliberately not here**, and their absence is the
+// load-bearing half of this function. A device gets its own certificate from
+// the machine that minted it — in the pairing answer, and again in the welcome
+// on every connection it opens anywhere in the fleet (internal/daemon) — both
+// of which are channels the device is already authenticated on. Publishing the
+// same blob to `GET /directory` bought exactly one thing, a browser being able
+// to find its own certificate, and cost two:
+//
+//   - **Privacy.** That route is credential-less by design, because what it
+//     carries is signed rather than secret. A device certificate names a device
+//     public key and the human label its owner typed — "Karn's phone" — so
+//     publishing every one of them made the directory a roster of the operator's
+//     devices, readable by anybody who knew the relay's address.
+//   - **The cap.** Nothing in the directory is ever deleted, one entry at a
+//     time, and it holds 512. Device certificates were the term that grew: one
+//     permanent entry per pairing ceremony ever performed, against machines and
+//     revocations that grow with the fleet rather than with its use. A full
+//     directory refuses new writes, and the write it refuses might be a
+//     revocation.
+//
+// Nothing needs them here. No daemon ever ingested one (see ingest, at length);
+// a machine admits a roaming device on the certificate the device *presents* in
+// its handshake, which is rule 2 and never consults this store.
+func (d *Directory) mine() [][]byte {
+	var out [][]byte
+	if cert := d.machineCert(); cert != nil {
+		out = append(out, cert)
+	}
+	if d.devices == nil {
+		return out
+	}
+	revs, err := d.devices.Revocations()
+	if err != nil {
+		d.log.Error("could not read the revocation list to publish it", "err", err)
+	}
+	for _, r := range revs {
+		if len(r.Cert) > 0 {
+			out = append(out, r.Cert)
+		}
+	}
+	return out
+}
+
+// machineCert is this machine's own certificate, if the one relay.json holds
+// still describes this machine.
+//
+// Checked rather than trusted, and against this daemon's own facts rather than
+// the relay's: the cert is minted by `flue relay setup`/`join` and stored, so
+// the ways it can go stale are local ones — a keys/static.key deleted and
+// regenerated, a relay.json copied from another machine, a machine id rotated
+// by a re-setup that did not re-mint. Publishing a stale one is worse than
+// publishing none: browsers pin the `noise` key it names, so a cert naming a
+// key this daemon no longer holds is a machine every device in the fleet
+// dials and none of them can handshake with.
+func (d *Directory) machineCert() []byte {
+	if len(d.cfg.MachineCert) == 0 {
+		return nil
+	}
+	cert, err := fleet.Verify(d.cfg.FleetPub, d.cfg.MachineCert)
+	if err != nil {
+		d.log.Error("not publishing this machine's fleet certificate: it does not verify under this relay's fleet key; re-run the join line for this relay",
+			"err", err)
+		return nil
+	}
+	mc, ok := cert.(fleet.MachineCert)
+	if !ok {
+		d.log.Error("not publishing this machine's fleet certificate: relay.json holds a " + cert.Kind() + " certificate where a machine certificate belongs")
+		return nil
+	}
+	if mc.ID != d.cfg.MachineID {
+		d.log.Error("not publishing this machine's fleet certificate: it names another machine; re-run the join line on this machine",
+			"cert", clip(mc.ID), "machine", d.cfg.MachineID)
+		return nil
+	}
+	if !bytes.Equal(mc.Noise, d.noisePub) {
+		d.log.Error("not publishing this machine's fleet certificate: it names a static key this daemon no longer holds; re-run the join line on this machine")
+		return nil
+	}
+	return d.cfg.MachineCert
+}
+
+// publish PUTs one blob. Every answer the directory can give is handled here
+// and none of them ends the connection, because none of them is about the
+// connection.
+func (d *Directory) publish(ctx context.Context, blob []byte) {
+	ctx, cancel := context.WithTimeout(ctx, directoryStepTimeout)
+	defer cancel()
+	req, err := http.NewRequestWithContext(ctx, http.MethodPut, d.httpURL, bytes.NewReader(blob))
+	if err != nil {
+		d.log.Error("could not build a fleet directory write", "err", err)
+		return
+	}
+	req.Header.Set("Authorization", "Bearer "+d.cfg.Secret)
+	// Raw bytes, and the Worker never parses them: what the far end stores is
+	// exactly what was signed here (relay/src/directory.ts, put).
+	req.Header.Set("Content-Type", "application/octet-stream")
+	req.ContentLength = int64(len(blob))
+	resp, err := d.client.Do(req)
+	if err != nil {
+		d.log.Warn("could not publish to the fleet directory", "url", d.httpURL, "err", err)
+		return
+	}
+	defer resp.Body.Close()
+	// The body is a key this daemon has no use for — it is the digest of what
+	// it just sent — so it is drained to let the connection be reused and not
+	// read.
+	_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, 1<<10))
+
+	switch resp.StatusCode {
+	case http.StatusCreated, http.StatusOK:
+		// 201 stored, 200 already there. A daemon re-offering its set on every
+		// reconnect sees 200 for everything, which is the point.
+	case http.StatusInsufficientStorage:
+		// 507: the directory is full and refuses to evict, because every
+		// eviction policy can drop a revocation and a forgotten revocation
+		// re-admits the device it revoked. Loud and dropped, not retried: it
+		// will not fit until an operator empties the whole set with `flue relay
+		// reset`, and no redeploy does that for them — the object is named by a
+		// constant and its storage outlives the script. A daemon that retried
+		// would spend the fleet's request budget saying so. Nothing else is
+		// wedged — the socket stays up, and everything already stored keeps
+		// arriving.
+		//
+		// The line is exact about what did not happen, because the difference
+		// matters when the artifact is a revocation. The refusal comes before
+		// the store *and* before the fan-out (relay/src/directory.ts, put), and
+		// the push socket carries new entries and nothing else — so this blob
+		// reached nobody at all, not "everybody who happened to be connected".
+		// A revoke that lands here has therefore taken effect on this machine
+		// and on no other, and re-offering it changes nothing: every reconnect
+		// and every republish is answered 507 until the directory is emptied.
+		d.log.Error("the fleet directory is full; this artifact was not stored and was not pushed to anyone, so no machine will learn of it from here — run `flue relay reset` to empty the directory",
+			"bytes", len(blob))
+	case http.StatusRequestEntityTooLarge:
+		// 413: this daemon minted something larger than the directory will
+		// take. That is a bug on this side, not a relay fault, and retrying it
+		// forever would hide it.
+		d.log.Error("the fleet directory refused an artifact as too large", "bytes", len(blob), "ceiling", maxBlobBytes)
+	case http.StatusUnauthorized:
+		d.log.Error("the fleet directory refused this daemon's credential; the relay secret in relay.json is not the one this Worker holds")
+	default:
+		d.log.Warn("the fleet directory refused a write", "status", resp.StatusCode, "bytes", len(blob))
+	}
+}
+
+// markConnected and markUnreachable are what a held or lost socket mean to the
+// status surfaces. The counts themselves come from the snapshot; this is the
+// flag that says whether they are a live answer or the last thing that was
+// true. Losing the socket clears both, because a stale count presented as
+// current is worse than no count: it is the difference between "this machine
+// is hearing the fleet" and "this machine heard the fleet once".
+func (d *Directory) markConnected() {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	d.counts.Connected = true
+}
+
+func (d *Directory) markUnreachable() {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	d.counts = DirectoryCounts{}
+}
diff --git a/internal/transport/relay/directory_test.go b/internal/transport/relay/directory_test.go
new file mode 100644
index 0000000..88a2b4e
--- /dev/null
+++ b/internal/transport/relay/directory_test.go
@@ -0,0 +1,866 @@
+package relay
+
+import (
+	"context"
+	"crypto/rand"
+	"log/slog"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/flynn/noise"
+	"github.com/karnstack/flue/internal/crypto"
+	"github.com/karnstack/flue/internal/fleet"
+)
+
+// The fleet directory leg, from the daemon's side.
+//
+// Every test here is really one assertion: what the relay says is bytes, and
+// only a signature under the fleet key turns bytes into a fact. So the fake
+// directory is allowed to lie in every way a real one could — wrong signer,
+// edited blob, truncated set, empty set, 507, 413 — and the daemon's answer to
+// all of them has to be the same: drop it, keep serving, converge when it can.
+
+// contextWithTimeout is the fake directory's helper, here because it is the
+// only file in the package that needs one.
+func contextWithTimeout(d time.Duration) (context.Context, context.CancelFunc) {
+	return context.WithTimeout(context.Background(), d)
+}
+
+// fakeSink records the revocations that made it past verification. It is the
+// seam the daemon sits behind (daemon.Server implements FleetSink), so a test
+// can assert on exactly what a hostile directory managed to get through.
+type fakeSink struct {
+	mu      sync.Mutex
+	applied [][]byte // device keys, in order
+	fail    error    // when set, every apply fails
+}
+
+func (s *fakeSink) ApplyFleetRevocation(deviceKey, blob []byte) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.fail != nil {
+		return s.fail
+	}
+	s.applied = append(s.applied, append([]byte(nil), deviceKey...))
+	return nil
+}
+
+func (s *fakeSink) count() int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return len(s.applied)
+}
+
+func (s *fakeSink) applies() [][]byte {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return append([][]byte(nil), s.applied...)
+}
+
+// awaitApplied waits for n revocations to have been applied.
+func (s *fakeSink) awaitApplied(t *testing.T, n int, what string) {
+	t.Helper()
+	deadline := time.Now().Add(waitFor)
+	for {
+		if s.count() >= n {
+			return
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("%s: %d revocations applied in %s, want %d", what, s.count(), waitFor, n)
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+}
+
+// stayedAt asserts that nothing further was applied over a window long enough
+// for it to have been. Used by every "this must be dropped" test: the absence
+// of an effect is only evidence if the effect had time to happen.
+func (s *fakeSink) stayedAt(t *testing.T, n int, what string) {
+	t.Helper()
+	deadline := time.Now().Add(300 * time.Millisecond)
+	for time.Now().Before(deadline) {
+		if got := s.count(); got != n {
+			t.Fatalf("%s: %d revocations applied, want %d", what, got, n)
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+}
+
+// dirFixture is one machine's directory leg: its fleet key, its device store,
+// the fake relay it talks to and the sink its revocations land in.
+type dirFixture struct {
+	dir     *Directory
+	fd      *fakeDirectory
+	sink    *fakeSink
+	fleet   fleet.Key
+	devices *crypto.DeviceStore
+	key     noise.DHKey
+	log     *syncBuffer
+}
+
+const dirSecret = "s3cr3t-daemon-secret"
+
+// newDirFixture builds a directory leg over a fresh fake directory. opts runs
+// on the Config before NewDirectory sees it, which is how a test gives this
+// machine a machine certificate or a fleet key it does not hold.
+func newDirFixture(t *testing.T, opts ...func(*Config)) *dirFixture {
+	t.Helper()
+	fd := newFakeDirectory(t, dirSecret)
+	return newDirFixtureOn(t, fd, opts...)
+}
+
+// newDirFixtureOn is newDirFixture against a directory that already exists —
+// a second machine on the same relay, which is what "published on A, applied
+// on B" needs.
+func newDirFixtureOn(t *testing.T, fd *fakeDirectory, opts ...func(*Config)) *dirFixture {
+	t.Helper()
+	dir := t.TempDir()
+	key, err := crypto.LoadOrCreateStaticKey(dir)
+	if err != nil {
+		t.Fatalf("LoadOrCreateStaticKey: %v", err)
+	}
+	fk, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		t.Fatalf("fleet.Mint: %v", err)
+	}
+	f := &dirFixture{
+		fd:      fd,
+		sink:    &fakeSink{},
+		fleet:   fk,
+		devices: crypto.NewDeviceStore(dir),
+		key:     key,
+		log:     &syncBuffer{},
+	}
+	cfg := Config{
+		URL:       fd.URL(),
+		Secret:    dirSecret,
+		Origin:    testOrigin,
+		MachineID: testMachineID,
+		FleetPub:  fk.Public(),
+	}
+	for _, o := range opts {
+		o(&cfg)
+	}
+	d, err := NewDirectory(cfg, f.sink, key, f.devices, slog.New(slog.NewTextHandler(f.log, nil)))
+	if err != nil {
+		t.Fatalf("NewDirectory: %v", err)
+	}
+	// Short enough that a keepalive test need not wait 30 s for one.
+	d.keepalive = 50 * time.Millisecond
+	f.dir = d
+	return f
+}
+
+// run starts the leg and stops it when the test ends.
+func (f *dirFixture) run(t *testing.T) {
+	t.Helper()
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan error, 1)
+	go func() { done <- f.dir.Run(ctx) }()
+	t.Cleanup(func() {
+		cancel()
+		select {
+		case err := <-done:
+			if err != nil {
+				t.Errorf("Run returned %v after cancellation, want nil", err)
+			}
+		case <-time.After(waitFor):
+			t.Error("Run did not return within the deadline after cancellation")
+		}
+	})
+}
+
+// revocation signs one under this machine's fleet key.
+func (f *dirFixture) revocation(t *testing.T, deviceKey []byte) []byte {
+	t.Helper()
+	blob, err := f.fleet.Sign(fleet.Revocation{Device: deviceKey, IAT: time.Now().Unix()})
+	if err != nil {
+		t.Fatalf("signing a revocation: %v", err)
+	}
+	return blob
+}
+
+// machineCert signs this machine's own, the way `flue relay join` does.
+func (f *dirFixture) machineCert(t *testing.T) []byte {
+	t.Helper()
+	blob, err := f.fleet.Sign(fleet.MachineCert{
+		ID: testMachineID, Name: "Karn's MacBook Pro", Noise: f.key.Public, IAT: time.Now().Unix(),
+	})
+	if err != nil {
+		t.Fatalf("signing a machine cert: %v", err)
+	}
+	return blob
+}
+
+// someKey is a 32-byte device key that is nobody's in particular.
+func someKey(t *testing.T, fill byte) []byte {
+	t.Helper()
+	k := make([]byte, 32)
+	for i := range k {
+		k[i] = fill
+	}
+	return k
+}
+
+// TestDirectoryAppliesARevocationPublishedElsewhere is the feature: machine A
+// revokes a device, and machine B — which never paired it and was not asked —
+// drops it. Here the publishing is the fake's `store`, which is machine A's
+// PUT seen from the relay's side.
+func TestDirectoryAppliesARevocationPublishedElsewhere(t *testing.T) {
+	f := newDirFixture(t)
+	dead := someKey(t, 0xAB)
+	f.fd.store(f.revocation(t, dead))
+
+	f.run(t)
+	f.sink.awaitApplied(t, 1, "a revocation waiting in the directory at connect")
+	if got := f.sink.applies()[0]; string(got) != string(dead) {
+		t.Errorf("applied revocation for %x, want %x", got, dead)
+	}
+}
+
+// TestDirectoryAppliesARevocationPushedWhileConnected: the same fact arriving
+// on the socket rather than in the snapshot — the path that makes a revoke
+// take effect on the other machines in seconds rather than on their next
+// reconnect.
+func TestDirectoryAppliesARevocationPushedWhileConnected(t *testing.T) {
+	f := newDirFixture(t)
+	f.run(t)
+	// The connection is established once the snapshot has been read.
+	f.fd.awaitRead(t, 1)
+
+	dead := someKey(t, 0xCD)
+	f.fd.store(f.revocation(t, dead))
+	f.sink.awaitApplied(t, 1, "a revocation pushed on the socket")
+}
+
+// TestDirectoryDropsABlobSignedByTheWrongKey is the trust boundary itself. The
+// relay is holding a perfectly well-formed revocation for a device this daemon
+// is carrying — signed by a key that is not this fleet's. Honouring it would
+// make the directory an unauthenticated kill switch for anyone who can write
+// to a relay: the secret-holder, a Cloudflare account takeover, a Worker
+// deployed by someone else.
+func TestDirectoryDropsABlobSignedByTheWrongKey(t *testing.T) {
+	f := newDirFixture(t)
+
+	other, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	dead := someKey(t, 0xEF)
+	forged, err := other.Sign(fleet.Revocation{Device: dead, IAT: time.Now().Unix()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	f.fd.store(forged)
+
+	f.run(t)
+	f.fd.awaitRead(t, 1)
+	f.sink.stayedAt(t, 0, "a revocation signed by another fleet key")
+	if !strings.Contains(f.log.String(), "does not verify under the fleet key") {
+		t.Errorf("the drop was not logged; log was:\n%s", f.log.String())
+	}
+}
+
+// TestDirectoryDropsAMangledBlob: a blob that verified when it was signed and
+// does not now. Truncation, a trailing byte, one flipped bit in the middle —
+// all three are the same fault to a signature, and all three have to be the
+// same answer here, because the relay is the one holding the bytes.
+func TestDirectoryDropsAMangledBlob(t *testing.T) {
+	f := newDirFixture(t)
+	dead := someKey(t, 0x11)
+	good := f.revocation(t, dead)
+
+	for _, tc := range []struct {
+		name string
+		blob []byte
+	}{
+		{"truncated", good[:len(good)-1]},
+		{"truncated to nothing but the prefix", good[:16]},
+		{"extended by a byte", append(append([]byte(nil), good...), 0x00)},
+		{"one bit flipped in the signature", flipLast(good)},
+		{"one bit flipped in the fields", flipAt(good, 20)},
+	} {
+		f.fd.store(tc.blob)
+	}
+	// And the good one last, as the fence: if the mangled blobs had been
+	// honoured this count would be six rather than one.
+	f.fd.store(good)
+
+	f.run(t)
+	f.sink.awaitApplied(t, 1, "the one intact revocation")
+	f.sink.stayedAt(t, 1, "five mangled revocations beside an intact one")
+}
+
+func flipLast(b []byte) []byte {
+	out := append([]byte(nil), b...)
+	out[len(out)-1] ^= 0x01
+	return out
+}
+
+func flipAt(b []byte, i int) []byte {
+	out := append([]byte(nil), b...)
+	out[i] ^= 0x01
+	return out
+}
+
+// TestDirectoryDropsAnOversizedBlob: the Worker caps a blob at 4 KiB, and this
+// daemon does not take the Worker's word for it. Anything past the cap is
+// dropped before a signature check is even attempted — the bound exists so a
+// relay cannot spend this process's memory or its CPU at will.
+func TestDirectoryDropsAnOversizedBlob(t *testing.T) {
+	f := newDirFixture(t)
+	f.fd.store(make([]byte, maxBlobBytes+1))
+	f.fd.store([]byte{})
+
+	f.run(t)
+	f.fd.awaitRead(t, 1)
+	f.sink.stayedAt(t, 0, "an oversized and an empty entry")
+	if !strings.Contains(f.log.String(), "impossible size") {
+		t.Errorf("the oversized entry was not reported; log was:\n%s", f.log.String())
+	}
+}
+
+// TestDirectoryIngestIsIdempotent: the same revocation arrives on the socket
+// and again in every snapshot, forever. Applying it twice must be free — the
+// sink is idempotent too, but a leg that re-ran the whole fleet's history on
+// every reconnect would be spending a signature check and a registry write per
+// entry per reconnect.
+func TestDirectoryIngestIsIdempotent(t *testing.T) {
+	f := newDirFixture(t)
+	dead := someKey(t, 0x22)
+	blob := f.revocation(t, dead)
+	f.fd.store(blob)
+
+	f.run(t)
+	f.sink.awaitApplied(t, 1, "the revocation in the snapshot")
+
+	// The same bytes again, by both paths: a push of something already stored
+	// (which the real directory would not even send) and a re-read.
+	f.fd.push(blob)
+	f.dir.ingestSnapshot(context.Background())
+	f.sink.stayedAt(t, 1, "the same revocation delivered three times")
+}
+
+// TestDirectoryPublishesWhatThisMachineHolds: the machine cert from relay.json
+// and every revocation this machine knows — on connect, so a machine that was
+// switched off while the fleet moved catches the fleet up as well as catching
+// up.
+//
+// And **not** the device certificates its own ceremonies minted. Those reach
+// the device that owns them over the pairing answer and every welcome, and no
+// daemon ever read one from here; publishing them made the credential-less
+// `GET /directory` a roster of the operator's devices and spent one of 512
+// permanent entries per ceremony ever performed.
+func TestDirectoryPublishesWhatThisMachineHolds(t *testing.T) {
+	var machineCert []byte
+	f := newDirFixture(t, func(c *Config) {})
+	machineCert = f.machineCert(t)
+	f.dir.cfg.MachineCert = machineCert
+
+	// A device this machine paired, with the cert its ceremony minted.
+	devKey := someKey(t, 0x33)
+	devCert, err := f.fleet.Sign(fleet.DeviceCert{
+		Device: devKey, Name: "phone", PairedOn: testMachineID, IAT: time.Now().Unix(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := f.devices.Add("phone", devKey, devCert); err != nil {
+		t.Fatalf("Add: %v", err)
+	}
+	// And a revocation it minted for some other device.
+	revoked := someKey(t, 0x44)
+	rev := f.revocation(t, revoked)
+	if err := f.devices.AddRevocation(revoked, rev); err != nil {
+		t.Fatalf("AddRevocation: %v", err)
+	}
+
+	f.run(t)
+	f.fd.awaitPublished(t, machineCert, "this machine's certificate")
+	f.fd.awaitPublished(t, rev, "a revocation this machine minted")
+	// The revocation is the fence: it is published after the device cert would
+	// have been (mine walks the registry before the revocation list), so by the
+	// time it lands, a device cert that was going to be sent has been.
+	if f.fd.published(devCert) {
+		t.Error("a device certificate reached the directory; it belongs to the device, not to a public store")
+	}
+}
+
+// TestDirectoryPublishesAFreshlyMintedArtifact: the live path — a pairing
+// ceremony or a revoke hands a blob to the publisher, which puts it on the
+// wire without the caller waiting for anything.
+func TestDirectoryPublishesAFreshlyMintedArtifact(t *testing.T) {
+	f := newDirFixture(t)
+	f.run(t)
+	f.fd.awaitRead(t, 1)
+
+	blob := f.revocation(t, someKey(t, 0x55))
+	f.dir.PublishFleetBlob(blob)
+	f.fd.awaitPublished(t, blob, "a revocation minted while connected")
+}
+
+// TestDirectoryRefusesToPublishADeviceCert: the guard on the live path. No
+// caller offers one today — the ceremony hands its cert to the device and
+// `mine` does not walk the registry — but a call site that forgot would spend
+// a permanent entry out of 512 and put a device key and its owner's label on
+// the credential-less GET. The refusal is here so that costs a log line
+// instead.
+func TestDirectoryRefusesToPublishADeviceCert(t *testing.T) {
+	f := newDirFixture(t)
+	f.run(t)
+	f.fd.awaitRead(t, 1)
+
+	devCert, err := f.fleet.Sign(fleet.DeviceCert{
+		Device: someKey(t, 0x66), Name: "phone", PairedOn: testMachineID, IAT: time.Now().Unix(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	f.dir.PublishFleetBlob(devCert)
+
+	// The fence: a revocation offered after it, on the same single-consumer
+	// queue, so by the time this lands the device cert has had its turn.
+	rev := f.revocation(t, someKey(t, 0x67))
+	f.dir.PublishFleetBlob(rev)
+	f.fd.awaitPublished(t, rev, "a revocation minted while connected")
+
+	if f.fd.published(devCert) {
+		t.Error("a device certificate reached the directory; it belongs to the device, not to a public store")
+	}
+	if !strings.Contains(f.log.String(), "refused to publish a device certificate") {
+		t.Errorf("nothing in the log says why the device certificate was dropped:\n%s", f.log.String())
+	}
+}
+
+// TestDirectoryRefusesToPublishAStaleMachineCert: the cert names the Noise key
+// browsers will pin, so publishing one that names a key this daemon no longer
+// holds would advertise a machine nothing in the fleet can handshake with —
+// worse than publishing nothing, which merely leaves it undiscovered.
+func TestDirectoryRefusesToPublishAStaleMachineCert(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		make func(f *dirFixture, t *testing.T) []byte
+		want string
+	}{
+		{
+			name: "a cert for another machine's id",
+			make: func(f *dirFixture, t *testing.T) []byte {
+				b, err := f.fleet.Sign(fleet.MachineCert{
+					ID: "someone-else-a1b2-0f9a12cd", Name: "n", Noise: f.key.Public, IAT: 1,
+				})
+				if err != nil {
+					t.Fatal(err)
+				}
+				return b
+			},
+			want: "names another machine",
+		},
+		{
+			name: "a cert for a static key this daemon does not hold",
+			make: func(f *dirFixture, t *testing.T) []byte {
+				b, err := f.fleet.Sign(fleet.MachineCert{
+					ID: testMachineID, Name: "n", Noise: someKey(t, 0x66), IAT: 1,
+				})
+				if err != nil {
+					t.Fatal(err)
+				}
+				return b
+			},
+			want: "names a static key this daemon no longer holds",
+		},
+		{
+			name: "a cert signed by another fleet",
+			make: func(f *dirFixture, t *testing.T) []byte {
+				other, err := fleet.Mint(rand.Reader)
+				if err != nil {
+					t.Fatal(err)
+				}
+				b, err := other.Sign(fleet.MachineCert{
+					ID: testMachineID, Name: "n", Noise: f.key.Public, IAT: 1,
+				})
+				if err != nil {
+					t.Fatal(err)
+				}
+				return b
+			},
+			want: "does not verify under this relay's fleet key",
+		},
+		{
+			name: "a device certificate where a machine certificate belongs",
+			make: func(f *dirFixture, t *testing.T) []byte {
+				b, err := f.fleet.Sign(fleet.DeviceCert{
+					Device: someKey(t, 0x77), Name: "n", PairedOn: testMachineID, IAT: 1,
+				})
+				if err != nil {
+					t.Fatal(err)
+				}
+				return b
+			},
+			want: "where a machine certificate belongs",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			f := newDirFixture(t)
+			cert := tc.make(f, t)
+			f.dir.cfg.MachineCert = cert
+
+			f.run(t)
+			f.fd.awaitRead(t, 1)
+			if f.fd.published(cert) {
+				t.Error("published a machine certificate that does not describe this machine")
+			}
+			if !strings.Contains(f.log.String(), tc.want) {
+				t.Errorf("log does not say %q; it says:\n%s", tc.want, f.log.String())
+			}
+		})
+	}
+}
+
+// TestDirectorySurvivesAFullDirectory: 507 means "your blob is fine and I will
+// not keep it", and the operator has to be told — but a daemon that treated it
+// as a connection fault, or retried it in a loop, would turn a full directory
+// into a relay leg that is also down. The socket stays up and revocations
+// already stored keep arriving.
+func TestDirectorySurvivesAFullDirectory(t *testing.T) {
+	f := newDirFixture(t)
+	f.fd.setFull(true)
+	dead := someKey(t, 0x88)
+	f.fd.store(f.revocation(t, dead))
+	f.dir.cfg.MachineCert = f.machineCert(t)
+
+	f.run(t)
+	// The read still happened and the revocation still applied, even though
+	// nothing this daemon offered could be stored.
+	f.sink.awaitApplied(t, 1, "a revocation read from a full directory")
+	if !strings.Contains(f.log.String(), "the fleet directory is full") {
+		t.Errorf("a full directory was not reported; log was:\n%s", f.log.String())
+	}
+	// And the leg is still working: a later push is still ingested.
+	f.fd.setFull(false)
+	f.fd.store(f.revocation(t, someKey(t, 0x89)))
+	f.sink.awaitApplied(t, 2, "a revocation pushed after a 507")
+}
+
+// TestDirectorySurvivesARefusedBlob: 413 is this daemon's own bug — it minted
+// something larger than a certificate can be — and it must be loud and dropped
+// rather than retried forever.
+func TestDirectorySurvivesARefusedBlob(t *testing.T) {
+	f := newDirFixture(t)
+	f.fd.setTooLarge(true)
+	f.dir.cfg.MachineCert = f.machineCert(t)
+
+	f.run(t)
+	f.fd.awaitRead(t, 1)
+	deadline := time.Now().Add(waitFor)
+	for !strings.Contains(f.log.String(), "refused an artifact as too large") {
+		if time.Now().After(deadline) {
+			t.Fatalf("a 413 was not reported; log was:\n%s", f.log.String())
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	// Still ingesting.
+	f.fd.setTooLarge(false)
+	f.fd.store(f.revocation(t, someKey(t, 0x8A)))
+	f.sink.awaitApplied(t, 1, "a revocation pushed after a 413")
+}
+
+// TestDirectoryTruncationCostsAvailabilityOnly: a hostile relay serving a
+// partial set is the one thing it can still do, and the bound on the damage is
+// that it can only *withhold*. What it withholds it can withhold forever; what
+// it cannot do is un-apply a revocation this daemon has already recorded, or
+// invent one.
+func TestDirectoryTruncationCostsAvailabilityOnly(t *testing.T) {
+	f := newDirFixture(t)
+	first := f.revocation(t, someKey(t, 0x99))
+	second := f.revocation(t, someKey(t, 0x9A))
+	f.fd.store(first)
+	f.fd.store(second)
+	// Only the first entry is ever served.
+	f.fd.setServing(1, false)
+
+	f.run(t)
+	f.sink.awaitApplied(t, 1, "the one entry a truncating directory served")
+	f.sink.stayedAt(t, 1, "a directory serving half its set")
+
+	// The relay now hides everything. The daemon keeps running, keeps its
+	// socket, and — crucially — nothing it already applied is undone: there is
+	// no message in this protocol that can un-revoke, which is why withholding
+	// is the whole of the relay's power.
+	f.fd.setServing(1, true)
+	f.dir.ingestSnapshot(context.Background())
+	f.sink.stayedAt(t, 1, "a directory serving nothing at all")
+
+	// And when it stops lying, the daemon converges.
+	f.fd.setServing(0, false)
+	f.dir.ingestSnapshot(context.Background())
+	f.sink.awaitApplied(t, 2, "the entry the relay had been withholding")
+}
+
+// TestDirectoryDropsEntriesPastTheCeiling: the Worker will not store more than
+// MAX_ENTRIES, so an answer longer than that is not a bigger fleet. The bound
+// is the daemon's own — one signature check per entry is exactly the work a
+// hostile relay would like to buy in bulk.
+func TestDirectoryDropsEntriesPastTheCeiling(t *testing.T) {
+	f := newDirFixture(t)
+	// One real revocation, then far more filler than the ceiling allows. The
+	// filler is stored first, so the real one falls past the cut.
+	for i := 0; i < MaxDirectoryEntries+8; i++ {
+		f.fd.store([]byte{byte(i), byte(i >> 8), 'f', 'i', 'l', 'l'})
+	}
+	dead := someKey(t, 0xA1)
+	f.fd.store(f.revocation(t, dead))
+
+	f.run(t)
+	f.fd.awaitRead(t, 1)
+	f.sink.stayedAt(t, 0, "an entry past the directory's own ceiling")
+	if !strings.Contains(f.log.String(), "more entries than it can hold") {
+		t.Errorf("the over-long answer was not reported; log was:\n%s", f.log.String())
+	}
+}
+
+// TestDirectoryRetriesARevocationItCouldNotApply: a registry that could not be
+// written is not a reason to forget a revocation — the device stays admitted
+// until it lands, so the next snapshot has to try again rather than skipping
+// it as "already seen".
+func TestDirectoryRetriesARevocationItCouldNotApply(t *testing.T) {
+	f := newDirFixture(t)
+	f.sink.fail = errTestSinkDown
+	blob := f.revocation(t, someKey(t, 0xB1))
+	f.fd.store(blob)
+
+	f.run(t)
+	f.fd.awaitRead(t, 1)
+	f.sink.stayedAt(t, 0, "a sink that refused")
+
+	f.sink.mu.Lock()
+	f.sink.fail = nil
+	f.sink.mu.Unlock()
+	f.dir.ingestSnapshot(context.Background())
+	f.sink.awaitApplied(t, 1, "the retried revocation")
+}
+
+// TestDirectoryReadsConditionally: the snapshot is the largest document the
+// relay serves — 512 × 4 KiB of base64, about 2.8 MiB — and a daemon re-reads
+// all of it on every reconnect, where the usual answer is "nothing new". The
+// second read presents the first read's ETag and is answered 304 without a
+// body, and the counts it recorded still stand.
+func TestDirectoryReadsConditionally(t *testing.T) {
+	f := newDirFixture(t)
+	f.fd.store(f.revocation(t, someKey(t, 0xD1)))
+
+	f.run(t)
+	f.fd.awaitRead(t, 1)
+	f.sink.awaitApplied(t, 1, "the first snapshot")
+	before := f.dir.Counts()
+	if before.Entries != 1 || before.Verified != 1 {
+		t.Fatalf("first read counted %+v, want one verified entry", before)
+	}
+
+	// A second read of an unchanged directory.
+	f.dir.ingestSnapshot(context.Background())
+	bodies, notModified := f.fd.reads()
+	if notModified != 1 {
+		t.Errorf("reads: %d with a body, %d not-modified; want the second answered 304", bodies, notModified)
+	}
+	if bodies != 1 {
+		t.Errorf("the relay served %d bodies, want 1: the second read should have cost none", bodies)
+	}
+	// A 304 is not an empty directory. The counts belong to the version the tag
+	// names, and reporting zeroes here would make the Remote screen say this
+	// machine hears nothing.
+	if got := f.dir.Counts(); got != before {
+		t.Errorf("counts after a 304 = %+v, want the ones the tag was issued with %+v", got, before)
+	}
+
+	// And a directory that has changed is served in full again.
+	f.fd.store(f.revocation(t, someKey(t, 0xD2)))
+	f.dir.ingestSnapshot(context.Background())
+	f.sink.awaitApplied(t, 2, "the entry added after the tag was issued")
+	if bodies, _ := f.fd.reads(); bodies != 2 {
+		t.Errorf("the relay served %d bodies, want 2: a changed set cannot be answered 304", bodies)
+	}
+}
+
+// TestDirectoryDoesNotCacheATagOverAnUnappliedRevocation: the conditional read
+// is an optimisation and must never become a way to forget something. A
+// snapshot whose revocation the sink refused is *not* remembered under its
+// ETag, so the next read is unconditional and tries again — otherwise the
+// retry would wait for somebody else to publish, and the artifact it dropped is
+// the fleet-wide kill switch.
+func TestDirectoryDoesNotCacheATagOverAnUnappliedRevocation(t *testing.T) {
+	f := newDirFixture(t)
+	f.sink.fail = errTestSinkDown
+	f.fd.store(f.revocation(t, someKey(t, 0xE1)))
+
+	f.run(t)
+	f.fd.awaitRead(t, 1)
+	f.sink.stayedAt(t, 0, "a sink that refused")
+
+	f.sink.mu.Lock()
+	f.sink.fail = nil
+	f.sink.mu.Unlock()
+	f.dir.ingestSnapshot(context.Background())
+	f.sink.awaitApplied(t, 1, "the retried revocation")
+	if _, notModified := f.fd.reads(); notModified != 0 {
+		t.Errorf("a read was answered 304 after a snapshot that did not fully apply (%d of them)", notModified)
+	}
+}
+
+var errTestSinkDown = &sinkError{}
+
+type sinkError struct{}
+
+func (*sinkError) Error() string { return "the registry is unreadable" }
+
+// TestDirectoryReadsCarryTheDaemonSecret: `GET /directory` needs no
+// credential, and the Worker meters exactly the callers that present none. A
+// fleet of daemons re-reading on every reconnect has no business spending the
+// per-IP budget that keeps browsers working.
+func TestDirectoryReadsCarryTheDaemonSecret(t *testing.T) {
+	f := newDirFixture(t)
+	f.run(t)
+	f.fd.awaitRead(t, 1)
+
+	f.fd.mu.Lock()
+	auths := append([]string(nil), f.fd.auths...)
+	f.fd.mu.Unlock()
+	if len(auths) == 0 {
+		t.Fatal("no request reached the directory")
+	}
+	for i, a := range auths {
+		if a != "Bearer "+dirSecret {
+			t.Errorf("request %d carried Authorization %q, want the daemon secret", i, a)
+		}
+	}
+}
+
+// TestDirectoryReconnects: the leg is held open across a relay that drops it,
+// with the transport's own backoff — and the snapshot after a reconnect is
+// what closes the window a missed push leaves.
+func TestDirectoryReconnects(t *testing.T) {
+	f := newDirFixture(t)
+	f.run(t)
+	f.fd.awaitRead(t, 1)
+
+	f.fd.closeSockets()
+	f.fd.awaitRead(t, 2)
+
+	// A revocation stored while the socket was down is picked up by the
+	// reconnect's snapshot rather than lost with the push.
+	f.fd.store(f.revocation(t, someKey(t, 0xC1)))
+	f.sink.awaitApplied(t, 1, "a revocation the reconnect's snapshot caught")
+}
+
+// TestNewDirectoryRefusesAnIncompleteConfig: this leg is *only* signed
+// artifacts, so a config without a fleet key could not honestly do anything
+// with a byte of what it reads.
+func TestNewDirectoryRefusesAnIncompleteConfig(t *testing.T) {
+	t.Parallel()
+	fk, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	full := Config{URL: "wss://relay.example", Secret: "s", Origin: testOrigin, MachineID: testMachineID, FleetPub: fk.Public()}
+	for _, tc := range []struct {
+		name string
+		cfg  Config
+		sink FleetSink
+	}{
+		{"no URL", Config{Secret: full.Secret, FleetPub: full.FleetPub}, &fakeSink{}},
+		{"no secret", Config{URL: full.URL, FleetPub: full.FleetPub}, &fakeSink{}},
+		{"no fleet key", Config{URL: full.URL, Secret: full.Secret}, &fakeSink{}},
+		{"no sink", full, nil},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if _, err := NewDirectory(tc.cfg, tc.sink, noise.DHKey{}, nil, nil); err == nil {
+				t.Fatal("NewDirectory accepted an incomplete config")
+			}
+		})
+	}
+}
+
+// TestDirectoryURLsComeFromTheDialledHost: the socket and the writes have to
+// reach the object the daemon leg dials. Deriving the HTTP URL from any other
+// field would let a half-edited relay.json publish this fleet's certificates
+// somewhere else.
+func TestDirectoryURLsComeFromTheDialledHost(t *testing.T) {
+	t.Parallel()
+	fk, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	d, err := NewDirectory(Config{
+		URL:      "wss://relay.example/",
+		Secret:   "s",
+		Origin:   "https://somewhere-else.example",
+		FleetPub: fk.Public(),
+	}, &fakeSink{}, noise.DHKey{}, nil, nil)
+	if err != nil {
+		t.Fatalf("NewDirectory: %v", err)
+	}
+	if want := "wss://relay.example/directory"; d.wsURL != want {
+		t.Errorf("socket URL = %q, want %q", d.wsURL, want)
+	}
+	if want := "https://relay.example/directory"; d.httpURL != want {
+		t.Errorf("http URL = %q, want %q", d.httpURL, want)
+	}
+}
+
+// TestDirectoryDoesNotRegisterDeviceCerts pins the decision that shapes this
+// whole leg: a verified device certificate read out of the directory is *not*
+// a local registry row.
+//
+// The directory is a credential-less store of public blobs. Possession of a
+// cert proves nothing — the IK handshake is what proves a browser holds the
+// key, which is why rule 2 of the acceptance order writes the row at *that*
+// moment (channel.go, admitByFleetCert) and not before. Writing it here would
+// put rows in devices.json for keys nobody has demonstrated they hold, and
+// those rows are honoured by rule 1 (crypto.FindByKey), which deliberately
+// never looks at a certificate: the fleet's word for today would quietly
+// become this machine's own pairing forever, surviving the fleet-key rotation
+// that was meant to withdraw it.
+//
+// Verified-and-ignored, not ignored: the cert is still checked, because the
+// machine and device counts a status line reports are counts of things this
+// fleet key signed.
+func TestDirectoryDoesNotRegisterDeviceCerts(t *testing.T) {
+	f := newDirFixture(t)
+	stranger := someKey(t, 0xD1)
+	cert, err := f.fleet.Sign(fleet.DeviceCert{
+		Device: stranger, Name: "someone else's phone", PairedOn: "sibling-mac-a1b2-0f9a12cd", IAT: time.Now().Unix(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	f.fd.store(cert)
+	// A machine cert beside it, which has no local consequence either: daemons
+	// do not dial each other, and a sibling's cert is addressed to browsers.
+	f.fd.store(f.machineCert(t))
+
+	f.run(t)
+	f.fd.awaitRead(t, 1)
+	// Give the ingest a moment to have done the wrong thing if it were going
+	// to: an assertion of absence is only worth something after the window in
+	// which the presence would have appeared.
+	time.Sleep(200 * time.Millisecond)
+
+	list, err := f.devices.List()
+	if err != nil {
+		t.Fatalf("List: %v", err)
+	}
+	if len(list) != 0 {
+		t.Fatalf("the directory wrote %d rows into this machine's registry: %+v", len(list), list)
+	}
+	if _, _, err := f.devices.FindByKey(stranger); err != nil {
+		t.Fatal(err)
+	}
+	if _, paired, _ := f.devices.FindByKey(stranger); paired {
+		t.Fatal("a device certificate read from the directory made its key pair with this machine")
+	}
+	// But both were verified, which is what the counts report.
+	if c := f.dir.Counts(); c.Verified != 2 || c.Devices != 1 || c.Machines != 1 {
+		t.Errorf("counts = %+v, want 2 verified: 1 device, 1 machine", c)
+	}
+}
diff --git a/internal/transport/relay/fake_directory_test.go b/internal/transport/relay/fake_directory_test.go
new file mode 100644
index 0000000..cbfac04
--- /dev/null
+++ b/internal/transport/relay/fake_directory_test.go
@@ -0,0 +1,356 @@
+package relay
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/coder/websocket"
+)
+
+// fakeDirectory is the Worker's fleet directory leg, in process: the three
+// shapes of `/directory` on one URL, content-addressed the way
+// relay/src/directory.ts is, with the same refusals for the same reasons.
+//
+// It models the *protocol*, not the class — bearer on the write and the
+// socket, none required on the read, blobs stored under the hex SHA-256 of
+// their own bytes, standard base64 with padding on the way out, one binary
+// message of exactly the blob on every push — so a test against it is a test
+// against the contract part A shipped. Where a test needs the relay to
+// misbehave (serve a truncated set, hand out a blob nobody signed, answer 507)
+// it sets a field rather than being handed a different fake: the daemon must
+// not be able to tell the two apart until it checks a signature.
+type fakeDirectory struct {
+	ts     *httptest.Server
+	secret string
+
+	// full makes every PUT answer 507, the way a directory at MAX_ENTRIES
+	// does. tooLarge does the same with 413.
+	full     bool
+	tooLarge bool
+	// truncate, when positive, is how many entries a GET will answer with,
+	// however many are stored — a hostile or broken relay serving a partial
+	// set.
+	truncate int
+	// hideAll makes GET answer an empty set while the store keeps everything,
+	// which is the strongest thing a relay can do to this leg.
+	hideAll bool
+
+	mu sync.Mutex
+	// blobs is the store, keyed by digest, in insertion order.
+	order []string
+	blobs map[string][]byte
+	// puts is every blob the daemon offered, in order, duplicates included:
+	// what a test asserts publishing on.
+	puts [][]byte
+	// gets counts reads that were answered with a body; notModified counts the
+	// ones answered 304 because the caller already had this set.
+	gets        int
+	notModified int
+	ifNoneMatch []string
+	auths       []string
+	socks       []*websocket.Conn
+}
+
+func newFakeDirectory(t *testing.T, secret string) *fakeDirectory {
+	t.Helper()
+	d := &fakeDirectory{secret: secret, blobs: map[string][]byte{}}
+	mux := http.NewServeMux()
+	mux.HandleFunc("/directory", d.serve)
+	d.ts = httptest.NewServer(mux)
+	t.Cleanup(func() {
+		d.closeSockets()
+		d.ts.Close()
+	})
+	return d
+}
+
+// URL is the address relay.json would hold: the bare host, ws:// because
+// httptest serves plain HTTP. NewDirectory derives both the socket URL and the
+// HTTP one from it, which is the property that keeps a fleet's certificates
+// going to the host the daemon leg dials.
+func (d *fakeDirectory) URL() string {
+	return "ws" + strings.TrimPrefix(d.ts.URL, "http")
+}
+
+func (d *fakeDirectory) serve(w http.ResponseWriter, r *http.Request) {
+	auth := r.Header.Get("Authorization")
+	d.mu.Lock()
+	d.auths = append(d.auths, auth)
+	d.mu.Unlock()
+	authorized := auth == "Bearer "+d.secret
+
+	if strings.EqualFold(r.Header.Get("Upgrade"), "websocket") {
+		if !authorized {
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		d.serveSocket(w, r)
+		return
+	}
+	switch r.Method {
+	case http.MethodPut:
+		if !authorized {
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		d.put(w, r)
+	case http.MethodGet:
+		d.get(w, r)
+	default:
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+	}
+}
+
+func (d *fakeDirectory) put(w http.ResponseWriter, r *http.Request) {
+	blob, err := io.ReadAll(io.LimitReader(r.Body, maxBlobBytes+1))
+	if err != nil {
+		http.Error(w, "unreadable", http.StatusBadRequest)
+		return
+	}
+	d.mu.Lock()
+	d.puts = append(d.puts, blob)
+	full, tooLarge := d.full, d.tooLarge
+	d.mu.Unlock()
+
+	switch {
+	case len(blob) == 0:
+		writeJSONStatus(w, http.StatusBadRequest, map[string]string{"error": "empty blob"})
+		return
+	case tooLarge || len(blob) > maxBlobBytes:
+		writeJSONStatus(w, http.StatusRequestEntityTooLarge, map[string]string{"error": "blob too large"})
+		return
+	case full:
+		writeJSONStatus(w, http.StatusInsufficientStorage, map[string]string{"error": "directory full"})
+		return
+	}
+
+	key := digestOf(blob)
+	d.mu.Lock()
+	_, had := d.blobs[key]
+	if !had {
+		d.blobs[key] = blob
+		d.order = append(d.order, key)
+	}
+	d.mu.Unlock()
+	if had {
+		// Same bytes, same key: no write, no push. A daemon that re-offers its
+		// whole set on every reconnect costs the object nothing.
+		writeJSONStatus(w, http.StatusOK, map[string]string{"key": key})
+		return
+	}
+	d.push(blob)
+	writeJSONStatus(w, http.StatusCreated, map[string]string{"key": key})
+}
+
+// get answers the snapshot, conditionally.
+//
+// The Worker's ETag is a version counter it bumps on every write (see
+// relay/src/directory.ts); this fake hashes the keys it is about to serve
+// instead, and the difference is deliberate. A counter is right there because
+// only a write changes the answer. Here the answer also changes when a test
+// flips `truncate` or `hideAll` to play a hostile relay, and a counter would go
+// on claiming the set was unchanged while the body moved underneath. Hashing
+// what is served keeps the one promise the daemon leans on — the same tag means
+// the same bytes — under a fake whose whole purpose is to misbehave.
+func (d *fakeDirectory) get(w http.ResponseWriter, r *http.Request) {
+	d.mu.Lock()
+	entries := []map[string]any{}
+	limit := len(d.order)
+	if d.hideAll {
+		limit = 0
+	} else if d.truncate > 0 && d.truncate < limit {
+		limit = d.truncate
+	}
+	served := d.order[:limit]
+	for _, k := range served {
+		entries = append(entries, map[string]any{"key": k, "blob": d.blobs[k]})
+	}
+	etag := `"` + digestOf([]byte(strings.Join(served, ","))) + `"`
+	cond := r.Header.Get("If-None-Match")
+	d.ifNoneMatch = append(d.ifNoneMatch, cond)
+	if cond != "" && cond == etag {
+		d.notModified++
+		d.mu.Unlock()
+		w.Header().Set("ETag", etag)
+		w.WriteHeader(http.StatusNotModified)
+		return
+	}
+	d.gets++
+	d.mu.Unlock()
+	w.Header().Set("ETag", etag)
+	// encoding/json writes a []byte as standard base64 with padding, which is
+	// the alphabet the Worker's own answer uses.
+	writeJSONStatus(w, http.StatusOK, map[string]any{"v": 1, "entries": entries})
+}
+
+// reads is what the fake was asked for: bodies served, and reads answered 304
+// because the caller already held that set.
+func (d *fakeDirectory) reads() (bodies, notModified int) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	return d.gets, d.notModified
+}
+
+// serveSocket accepts a push socket and holds it, answering flue-ping the way
+// the Cloudflare edge does from the Durable Object's auto-response.
+func (d *fakeDirectory) serveSocket(w http.ResponseWriter, r *http.Request) {
+	ws, err := websocket.Accept(w, r, &websocket.AcceptOptions{InsecureSkipVerify: true})
+	if err != nil {
+		return
+	}
+	defer ws.CloseNow()
+	d.mu.Lock()
+	d.socks = append(d.socks, ws)
+	d.mu.Unlock()
+	for {
+		typ, data, err := ws.Read(r.Context())
+		if err != nil {
+			return
+		}
+		if typ == websocket.MessageText && string(data) == "flue-ping" {
+			ctx, cancel := contextWithTimeout(waitFor)
+			_ = ws.Write(ctx, websocket.MessageText, []byte("flue-pong"))
+			cancel()
+		}
+	}
+}
+
+// push sends one blob, raw, to every socket — no envelope and no key, exactly
+// as the Durable Object does.
+func (d *fakeDirectory) push(blob []byte) {
+	d.mu.Lock()
+	socks := append([]*websocket.Conn(nil), d.socks...)
+	d.mu.Unlock()
+	for _, ws := range socks {
+		ctx, cancel := contextWithTimeout(waitFor)
+		_ = ws.Write(ctx, websocket.MessageBinary, blob)
+		cancel()
+	}
+}
+
+// store puts a blob into the directory without going through a daemon: what
+// some *other* machine in the fleet published, which is the whole point of the
+// thing. It pushes, so a connected daemon hears it.
+func (d *fakeDirectory) store(blob []byte) {
+	key := digestOf(blob)
+	d.mu.Lock()
+	_, had := d.blobs[key]
+	if !had {
+		d.blobs[key] = blob
+		d.order = append(d.order, key)
+	}
+	d.mu.Unlock()
+	if !had {
+		d.push(blob)
+	}
+}
+
+// published reports whether this exact blob was ever PUT by the daemon.
+func (d *fakeDirectory) published(blob []byte) bool {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	want := digestOf(blob)
+	for _, p := range d.puts {
+		if digestOf(p) == want {
+			return true
+		}
+	}
+	return false
+}
+
+// awaitPublished waits for the daemon to have offered this blob.
+func (d *fakeDirectory) awaitPublished(t *testing.T, blob []byte, what string) {
+	t.Helper()
+	deadline := time.Now().Add(waitFor)
+	for {
+		if d.published(blob) {
+			return
+		}
+		if time.Now().After(deadline) {
+			d.mu.Lock()
+			n := len(d.puts)
+			d.mu.Unlock()
+			t.Fatalf("the daemon never published %s within %s (%d writes seen)", what, waitFor, n)
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+}
+
+// readCount is how many times the daemon has *asked*, which is the question
+// every caller of awaitRead is really asking. Bodies and 304s both count: a
+// reconnect against an unchanged directory still performed its catch-up read,
+// and answering it cheaply is the point of the conditional GET rather than a
+// read that did not happen.
+func (d *fakeDirectory) readCount() int {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	return d.gets + d.notModified
+}
+
+// awaitRead waits until at least n reads have been answered, which is how a
+// test knows the snapshot it staged has been consumed.
+func (d *fakeDirectory) awaitRead(t *testing.T, n int) {
+	t.Helper()
+	deadline := time.Now().Add(waitFor)
+	for {
+		if d.readCount() >= n {
+			return
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("the daemon read the directory %d times in %s, want at least %d", d.readCount(), waitFor, n)
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+}
+
+func (d *fakeDirectory) closeSockets() {
+	d.mu.Lock()
+	socks := append([]*websocket.Conn(nil), d.socks...)
+	d.socks = nil
+	d.mu.Unlock()
+	for _, ws := range socks {
+		_ = ws.CloseNow()
+	}
+}
+
+// The knobs are set through methods rather than fields: the handler reads them
+// on the server's own goroutines, and a test that flips one mid-flight — which
+// is exactly how "the relay stops lying" is staged — would otherwise be racing
+// them.
+func (d *fakeDirectory) setFull(v bool) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	d.full = v
+}
+
+func (d *fakeDirectory) setTooLarge(v bool) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	d.tooLarge = v
+}
+
+func (d *fakeDirectory) setServing(truncate int, hideAll bool) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	d.truncate, d.hideAll = truncate, hideAll
+}
+
+func digestOf(blob []byte) string {
+	sum := sha256.Sum256(blob)
+	return hex.EncodeToString(sum[:])
+}
+
+func writeJSONStatus(w http.ResponseWriter, status int, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Cache-Control", "no-store")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(v)
+}
diff --git a/internal/transport/relay/relay.go b/internal/transport/relay/relay.go
index 80bb730..f15332d 100644
--- a/internal/transport/relay/relay.go
+++ b/internal/transport/relay/relay.go
@@ -167,6 +167,15 @@ type Config struct {
 	// acceptance order and silently drops rule 2 (channel.go). Only the
 	// public half ever reaches this package.
 	FleetPub ed25519.PublicKey
+
+	// MachineCert is this machine's own fleet certificate as relay.json
+	// stores it (config.Relay.MachineCert), minted by the command that joined
+	// this machine to the relay. The directory leg publishes it so the
+	// fleet's browsers can find this machine; nothing else here reads it, and
+	// an empty one costs discovery rather than access — see
+	// Directory.machineCert, which refuses to publish one that no longer
+	// describes this daemon.
+	MachineCert []byte
 }
 
 // ErrIncompleteConfig is what New answers a Config it cannot dial with: a
@@ -216,8 +225,11 @@ type Server interface {
 
 // The daemon is the implementation, and the compiler is what keeps the two in
 // step: a signature that drifts here fails to build rather than failing to
-// serve.
-var _ Server = (*daemon.Server)(nil)
+// serve. FleetSink (directory.go) is the same contract for the other leg.
+var (
+	_ Server    = (*daemon.Server)(nil)
+	_ FleetSink = (*daemon.Server)(nil)
+)
 
 // Transport dials the relay and serves channels until ctx ends. It reconnects
 // with jittered exponential backoff and only returns when its context is done.
diff --git a/internal/wire/control.go b/internal/wire/control.go
index 77fa98e..8a3f160 100644
--- a/internal/wire/control.go
+++ b/internal/wire/control.go
@@ -188,6 +188,26 @@ type Welcome struct {
 	// Relay is how this daemon is reachable from outside the machine, or nil
 	// when it is not configured for a relay at all. See RelayInfo.
 	Relay *RelayInfo `json:"relay,omitempty"`
+
+	// FleetCert is this device's own fleet certificate — the signed blob it
+	// presents to every *other* machine in the fleet to be admitted without a
+	// second ceremony (spec/fleet-trust.md, rule 2) — or empty when there is
+	// none to give.
+	//
+	// It rides the welcome because this connection is the one place the cert
+	// can be handed over privately and to the right device at once: the socket
+	// is inside Noise, so the relay carries ciphertext, and the far end has
+	// already proved it holds the key the cert names. The alternative this
+	// replaced was publishing every device cert to the credential-less
+	// `GET /directory` and letting the browser find its own — which worked, and
+	// put every device's public key and human label in a document anybody on
+	// the internet could read, and spent one of the directory's 512 permanent
+	// entries on every pairing ceremony ever performed.
+	//
+	// Empty for a loopback connection (no device identity to hand one to), for
+	// a daemon with no fleet key, and for a device paired before the fleet key
+	// existed. A client that gets none keeps whatever it already had.
+	FleetCert []byte `json:"fleetCert,omitempty"`
 }
 
 // RelayInfo is the state of the daemon's relay leg, as of the moment the
diff --git a/relay/src/directory.ts b/relay/src/directory.ts
new file mode 100644
index 0000000..7f865d5
--- /dev/null
+++ b/relay/src/directory.ts
@@ -0,0 +1,442 @@
+import { DurableObject } from 'cloudflare:workers'
+import { JSON_NO_STORE, readCapped } from './http'
+import type { Env } from './index'
+
+/**
+ * FleetDirectory is the relay's store of signed blobs — in practice machine
+ * certs and revocations, minted by the daemons under the fleet key
+ * (spec/fleet-trust.md, "The fleet directory"). One object per relay —
+ * `idFromName("directory")`, because one relay is one fleet — and it is the
+ * only Durable Object here that is not per machine.
+ *
+ * "In practice", because this class cannot tell one kind from another and does
+ * not try; what it holds is whatever the daemons PUT. Device certificates are
+ * deliberately not among them — a device is handed its own by the machine that
+ * minted it, in the pairing answer and again in every welcome — which is a
+ * rule the daemons keep and this object could not enforce if it wanted to.
+ * That rule is the reason `GET` below is not a public roster of the operator's
+ * device keys and the labels beside them.
+ *
+ * **The relay stores and serves; it never verifies.** The fleet key never
+ * touches the Worker, by design: not as a secret, not as a binding, not in a
+ * log. So this class cannot tell a machine cert from a revocation from 200
+ * bytes of noise, and must not try — every reader (daemon and browser both)
+ * verifies every signature under the fleet public key and drops what fails.
+ * What a hostile relay can do to this store is serve it stale, truncated or
+ * empty; what it cannot do is mint an entry, because minting needs the key it
+ * does not hold.
+ *
+ * "Availability is the relay's only power" — the spine of
+ * spec/relay-protocol.md — survives this leg with one exception, and the
+ * exception is worth naming here rather than only there. For a *certificate*,
+ * withholding subtracts: a machine cert this object hides is a machine the
+ * browser does not see. For a *revocation*, withholding adds — a machine that
+ * never receives one goes on admitting a device the operator cut off — and the
+ * answer a `GET` gives is shape-identical whether it is complete or filtered,
+ * because entries are signed one by one and the set is signed not at all. There
+ * is no epoch and no manifest for a reader to check an answer against. What
+ * bounds it is that every holder re-publishes every revocation it has on every
+ * connect and every 30 minutes, that a machine which has ingested one keeps it
+ * forever, and that the relay still cannot mint the certificate the revocation
+ * was about. A signed manifest is the real fix and is future work, not this
+ * file's (spec/relay-protocol.md, "What withholding costs").
+ *
+ * Entries are **content-addressed**: the storage key is the SHA-256 of the
+ * exact bytes PUT, and nothing else. That is the only key a Worker which
+ * cannot read a blob is entitled to compute — a caller-supplied name would
+ * make the relay arbitrate a namespace it cannot check, and one buggy or
+ * hostile secret-holder could then PUT a machine cert over a revocation and
+ * the relay would help. Content addressing makes that structurally
+ * impossible: a PUT can only ever *add*. Two consequences fall straight out of
+ * it — a duplicate PUT is idempotent (same bytes, same key, same value, no
+ * second entry), and a blob round-trips byte for byte, because bytes the
+ * relay mangled would not hash to the key it filed them under. Readers dedupe
+ * on their own terms; a revocation outranks a device cert for the same key
+ * whatever their timestamps, which is a rule about *meaning* and therefore
+ * theirs, not ours.
+ *
+ * Hibernation rules, the same ones src/hub.ts lives by: sockets are accepted
+ * with `ctx.acceptWebSocket` — never `ws.accept()`, which pins the object in
+ * memory — no timers outside a request already holding the object awake, and
+ * nothing about the store in memory, because a wake finds every field back at
+ * its initializer. The entry count is a storage counter for exactly that
+ * reason (`nextChannel` in the hub is the same idea). The daemon sockets carry
+ * no attachment at all, and that is not an oversight: a directory socket is a
+ * fan-out target and nothing more — no channel, no counters anything reads, no
+ * per-socket state a wake could lose — so `getWebSockets('daemon')` is the
+ * whole of what a handler needs to know about it.
+ */
+export class FleetDirectory extends DurableObject<Env> {
+  constructor(ctx: DurableObjectState, env: Env) {
+    super(ctx, env)
+    // The edge answers keepalives itself, without waking a hibernated object
+    // (spec/relay-protocol.md, Keepalive). The directory socket speaks the
+    // same two strings the hub's legs do.
+    this.ctx.setWebSocketAutoResponse(new WebSocketRequestResponsePair('flue-ping', 'flue-pong'))
+  }
+
+  /**
+   * The four shapes of `/directory`, told apart the way the router told them
+   * apart before forwarding: an upgrade, a PUT, a DELETE, or a GET. Auth
+   * happened there — the daemon legs of this object are secret-gated by
+   * `authorizeDaemon` in src/index.ts, exactly as `/daemon` is, and this object
+   * trusts that the way DaemonHub does.
+   */
+  async fetch(req: Request): Promise<Response> {
+    if (req.headers.get('Upgrade')?.toLowerCase() === 'websocket') return this.acceptDaemon()
+    if (req.method === 'PUT') return this.put(req)
+    if (req.method === 'DELETE') return this.reset()
+    if (req.method === 'GET') return this.snapshot(req)
+    return new Response('not found', { status: 404 })
+  }
+
+  /**
+   * A daemon's push socket. Unlike the hub's daemon leg there is no takeover
+   * here: every machine in the fleet holds one of these at once, which is the
+   * point — a device paired on machine A has to reach machine B without B
+   * polling.
+   *
+   * The socket is push-only. Nothing a daemon could say on it is part of this
+   * protocol — a write is `PUT /directory`, an HTTP request that answers with
+   * the key it filed — so any message from a daemon here is a protocol error,
+   * handled in `webSocketMessage`.
+   */
+  private acceptDaemon(): Response {
+    // The fan-out bound. The leg is secret-gated, so this is not the DoS cap
+    // MAX_CLIENTS is on the hub's credential-less leg; it bounds the cost of
+    // one PUT, which is one send per socket, against a fleet that has left
+    // half-dead sockets behind or a secret-holder opening them in a loop. A
+    // one-operator fleet reaches double digits.
+    if (this.ctx.getWebSockets('daemon').length >= MAX_DAEMON_SOCKETS) {
+      return new Response('{"error":"too many directory sockets"}', {
+        status: 503,
+        headers: JSON_NO_STORE,
+      })
+    }
+    const pair = new WebSocketPair()
+    this.ctx.acceptWebSocket(pair[1], ['daemon'])
+    return new Response(null, { status: 101, webSocket: pair[0] })
+  }
+
+  /**
+   * `PUT /directory`: one signed blob, stored under the hash of its own bytes.
+   *
+   * The body is read as bytes and never parsed. It reaches storage, the GET
+   * and every push socket unchanged — parts B and C verify Ed25519 signatures
+   * over *these* bytes, and a relay that re-encoded a blob into some canonical
+   * shape of its own would break every signature over it while believing it
+   * had been helpful.
+   */
+  private async put(req: Request): Promise<Response> {
+    const blob = await readCapped(req, MAX_BLOB_BYTES)
+    if (blob === null) return tooLarge()
+    // An empty body is not a signed anything under any encoding, and hashing
+    // it would spend an entry — permanently, since nothing here is ever
+    // deleted — on the one blob that is certainly not a certificate.
+    if (blob.byteLength === 0) {
+      return new Response('{"error":"empty blob"}', { status: 400, headers: JSON_NO_STORE })
+    }
+    const key = await digestKey(blob)
+    // Read all three, decide, then write once. Nothing awaits between the read
+    // and the write except the write itself, so the input gate holds a second
+    // PUT at the door and neither counter can drift: two blobs, two entries,
+    // always.
+    const have = await this.ctx.storage.get<Uint8Array | number>([
+      BLOB_PREFIX + key,
+      COUNT_KEY,
+      VERSION_KEY,
+    ])
+    if (have.has(BLOB_PREFIX + key)) {
+      // Already here, byte for byte — that is what sharing a key means. No
+      // write, no push, no second entry, and no new version: a daemon that
+      // re-PUTs on every reconnect (and one will) costs this object nothing,
+      // and a replayed PUT of a blob captured off the wire changes nothing
+      // either.
+      return stored(key, 200)
+    }
+    const count = (have.get(COUNT_KEY) as number | undefined) ?? 0
+    if (count >= MAX_ENTRIES) return full()
+    const version = (have.get(VERSION_KEY) as number | undefined) ?? 0
+    // One multi-key put: the blob, the count and the version land together or
+    // not at all.
+    await this.ctx.storage.put({
+      [BLOB_PREFIX + key]: blob,
+      [COUNT_KEY]: count + 1,
+      [VERSION_KEY]: version + 1,
+    })
+    this.push(blob)
+    return stored(key, 201)
+  }
+
+  /**
+   * `GET /directory`: the whole set, credential-less.
+   *
+   * No order is promised. Storage hands these back sorted by key, which is to
+   * say by digest, which is to say by nothing — the directory is a set, and a
+   * reader that inferred "newest last" from this array would be reading a
+   * property of SHA-256. `iat` is inside the blobs, where a reader that has
+   * verified a signature can trust it.
+   *
+   * **Conditional.** The answer carries an `ETag` and a matching
+   * `If-None-Match` is answered `304` with no body. The tag is the store's
+   * version counter, bumped by every write that lands and by every reset, so
+   * it changes exactly when the set does — never on a duplicate PUT, which
+   * stores nothing, and never on a wipe-then-refill back to the same contents,
+   * because it counts mutations rather than hashing them.
+   *
+   * It is worth the two storage keys because this document is the largest
+   * thing the relay serves — 512 entries of 4 KiB is about 2.8 MiB of base64 —
+   * and every daemon re-reads the whole of it on every reconnect, where the
+   * usual answer is "nothing has changed since you last asked".
+   *
+   * Two things it deliberately is not. It is not a bound on an anonymous
+   * flood: a caller who wants the bytes simply omits the header, and what
+   * bounds them is the per-IP rate rule in src/index.ts. And it is not a
+   * licence for anything to *hold* this document — `Cache-Control: no-store`
+   * stays, because a directory served from a cache is a revocation served
+   * late, and that is the one staleness this design cannot afford. The tag is
+   * for clients that revalidate on purpose, which is what the daemon's leg
+   * does (internal/transport/relay/directory.go), not for a shared cache
+   * deciding on its own.
+   */
+  private async snapshot(req: Request): Promise<Response> {
+    const version = (await this.ctx.storage.get<number>(VERSION_KEY)) ?? 0
+    const etag = `"${version}"`
+    if (req.headers.get('If-None-Match') === etag) {
+      // No body, and the tag again so a client that revalidates twice has
+      // something to send the second time.
+      return new Response(null, { status: 304, headers: { ...JSON_NO_STORE, ETag: etag } })
+    }
+    const rows = await this.ctx.storage.list<Uint8Array>({ prefix: BLOB_PREFIX })
+    const entries: { key: string; blob: string }[] = []
+    for (const [k, blob] of rows) {
+      entries.push({ key: k.slice(BLOB_PREFIX.length), blob: base64(blob) })
+    }
+    return new Response(JSON.stringify({ v: 1, entries }), {
+      headers: { ...JSON_NO_STORE, ETag: etag },
+    })
+  }
+
+  /**
+   * `DELETE /directory`: empty the whole store, and the count with it.
+   *
+   * This is the escape hatch for a full directory, and it exists because
+   * without it a full one is permanent. Nothing here ever deletes a single
+   * entry — see `full()` for why selective pruning must not be the relay's
+   * job — so at 512 entries every later PUT is refused, and a refused PUT of a
+   * *revocation* is the fleet-wide kill switch reaching only the machine it was
+   * typed on. Redeploying does not clear it either: the script name is a
+   * constant, the object is `idFromName("directory")` on another constant, and
+   * Durable Object storage outlives a redeploy. So the only way back is a
+   * deliberate wipe, and this is it.
+   *
+   * **All or nothing, on purpose.** A wipe needs no opinion about what any blob
+   * means, which is what makes it a thing this Worker may do: it deletes the
+   * set, not a member of it. Pruning "the device certificates whose key is
+   * revoked" would need the fleet key, and the whole design turns on that key
+   * never being here.
+   *
+   * **Why it is safe to do this to a store of revocations.** Every daemon
+   * re-offers everything it holds for this store — its machine certificate and
+   * every revocation it knows — on every connect and every 30 minutes
+   * (internal/transport/relay/directory.go, publishAll), so an emptied
+   * directory refills itself from the fleet. To make that happen in
+   * seconds rather than in half an hour, every daemon socket is closed here:
+   * the reconnect that follows is a snapshot read and a full re-publish.
+   *
+   * **The residual, stated rather than hidden.** A blob whose only remaining
+   * holder never reconnects is gone — and the one that matters is a revocation
+   * published by a machine that has since been decommissioned, wiped or is
+   * simply off for good. Every other machine that had *already* ingested it
+   * still holds it (a revocation is written to that machine's own
+   * revocations.json and re-published from there), so this is a narrow window
+   * rather than a general loss; it is narrow, not empty. Un-revoking is not
+   * what a wipe does — the device stays cut off on every machine that ever
+   * heard — but a machine that never heard, and now never will, is one a
+   * re-revoke from any surviving machine is the answer to.
+   */
+  private async reset(): Promise<Response> {
+    // Read before the wipe, because the wipe takes the counter too. This is
+    // what the object believed it was holding, which is the number the cap was
+    // enforced against and therefore the one an operator is owed.
+    const held = await this.ctx.storage.get<number>([COUNT_KEY, VERSION_KEY])
+    const removed = (held.get(COUNT_KEY) as number | undefined) ?? 0
+    // Everything: the blobs and the count, in one call, so no interleaving can
+    // leave a counter that outlives the entries it counted and re-fills the
+    // directory to 512 with nothing in it.
+    await this.ctx.storage.deleteAll()
+    // The version survives the wipe and moves forward, which is the one
+    // counter that must not go back to zero: a reader holding the old tag has
+    // to see this as a change, and a directory emptied and refilled to the
+    // same contents would otherwise re-issue a tag that reader already has.
+    await this.ctx.storage.put(VERSION_KEY, ((held.get(VERSION_KEY) as number | undefined) ?? 0) + 1)
+    for (const ws of this.ctx.getWebSockets('daemon')) {
+      try {
+        // 1012 (service restart) is the honest code: the store this socket was
+        // subscribed to is gone and the daemon's own reconnect is what refills
+        // it. Nothing on this leg speaks daemon-ward except raw blobs, so there
+        // is no in-band way to say "re-publish" — the close is the message, and
+        // the daemon already knows what to do with one.
+        ws.close(1012, 'the directory was reset; reconnect and republish')
+      } catch {
+        // Already closing; its own close event finishes the teardown.
+      }
+    }
+    return new Response(JSON.stringify({ reset: true, removed }), { headers: JSON_NO_STORE })
+  }
+
+  /**
+   * The write, to every daemon socket, as one binary message of exactly the
+   * blob's bytes.
+   *
+   * Raw bytes and no envelope, because an envelope is a chance to reshape
+   * something the relay cannot read: what the daemon verifies is the signature
+   * over these bytes, and the shortest path to them is no framing at all. The
+   * key is not sent — it is SHA-256 of the message, derivable by anyone who
+   * wants it, and a daemon that verifies signatures has no use for it.
+   *
+   * The fan-out includes the socket belonging to the machine whose PUT this
+   * was: an HTTP request carries no socket identity, so there is nobody to
+   * exclude, and there is no need to — the receiver already holds the blob and
+   * a push it already has is a no-op. Pushes are best-effort by nature. A
+   * daemon that was offline, or whose send failed here, converges on its next
+   * `GET /directory`; to close the window it opens this socket *first* and
+   * GETs second, so a write in between arrives on one path or the other.
+   */
+  private push(blob: Uint8Array): void {
+    for (const ws of this.ctx.getWebSockets('daemon')) {
+      try {
+        ws.send(blob)
+      } catch {
+        // Closing under us — its close event finishes the teardown, and the
+        // daemon's reconnect GET is what it converges on.
+      }
+    }
+  }
+
+  async webSocketMessage(ws: WebSocket, message: string | ArrayBuffer): Promise<void> {
+    // flue-ping never reaches here (the auto-response answers it at the edge)
+    // and a stray flue-pong is dropped silently, exactly as on the hub's legs.
+    if (message === 'flue-pong') return
+    // Everything else is a protocol error: this socket carries relay → daemon
+    // pushes and nothing in the other direction. A daemon with something to
+    // say says it with `PUT /directory`.
+    try {
+      ws.close(1002, 'the directory socket is push-only')
+    } catch {
+      // Already closing.
+    }
+  }
+}
+
+/** The storage prefix for blobs; the rest of the key is the digest. */
+const BLOB_PREFIX = 'blob:'
+
+/** How many entries are stored. A counter rather than a `list()` per PUT
+ * because listing reads every blob back to answer a question about their
+ * number, and it survives hibernation for the reason the hub's `nextChannel`
+ * does: a wake finds memory empty and storage intact. */
+const COUNT_KEY = 'count'
+
+/**
+ * How many times the set has changed: bumped by every PUT that stores and by
+ * every reset, never by a duplicate PUT, and never reset to zero.
+ *
+ * It is the `ETag` on `GET /directory` and nothing else. A counter rather than
+ * a digest of the contents because the question a conditional GET asks is "has
+ * this changed since version N", which a monotonic counter answers exactly and
+ * for the price of one integer in a write that was already happening. Storage
+ * for the same reason COUNT_KEY is: a wake finds memory back at its
+ * initializer and storage intact.
+ */
+const VERSION_KEY = 'version'
+
+/**
+ * The largest single blob. A certificate is a version, a kind, a 32-byte key,
+ * a machine id of at most 63 characters, a display name, a timestamp and a
+ * 64-byte signature — a couple of hundred bytes, encoded generously. 4 KiB is
+ * the same bound the pairing body carries (src/hub.ts, MAX_PAIR_BYTES) and two
+ * orders of magnitude of headroom over any honest cert; it is here because the
+ * Worker cannot tell a cert from four megabytes of anything, and this store is
+ * readable without a credential by whoever asks.
+ */
+const MAX_BLOB_BYTES = 4096
+
+/**
+ * How many entries the directory will hold.
+ *
+ * The arithmetic that picks it: entries are machines, devices, and one
+ * revocation per device ever revoked, and nothing is ever removed. A
+ * one-operator fleet — the model this whole design serves — is a handful of
+ * machines and a handful of devices, so 512 is years of pair-and-revoke churn
+ * with room to spare. The other end of the number is what it bounds: 512 ×
+ * 4 KiB is 2 MiB stored and about 2.8 MiB of base64 on a credential-less GET,
+ * which is the worst case a secret-holder can build and not one an honest
+ * fleet comes near (512 real certs are on the order of 100 KiB).
+ */
+const MAX_ENTRIES = 512
+
+/** Push sockets one directory will hold: one per machine, plus slack for
+ * reconnects whose close events have not landed yet. */
+const MAX_DAEMON_SOCKETS = 256
+
+/** A stored blob: 201 when this PUT created the entry, 200 when it was already
+ * there. The body is the same either way — a caller need not branch, and the
+ * key is what it came for — so the status is the whole of the difference, for
+ * logs and for a daemon that wants to know whether it was first. */
+function stored(key: string, status: 200 | 201): Response {
+  return new Response(JSON.stringify({ key }), { status, headers: JSON_NO_STORE })
+}
+
+function tooLarge(): Response {
+  return new Response('{"error":"blob too large"}', { status: 413, headers: JSON_NO_STORE })
+}
+
+/**
+ * The directory is full (`MAX_ENTRIES`). 507, and deliberately its own status:
+ * nothing else on this leg means "your blob is fine and I will not keep it",
+ * and a daemon has to be able to tell that from a 413 (this blob is wrong) or a
+ * 401 (this caller is wrong) without reading prose.
+ *
+ * Refusing rather than evicting is the security decision here, and it is not a
+ * close call. Every eviction policy — oldest first, largest first, random —
+ * can drop a revocation, and a directory that silently forgets a revocation
+ * re-admits the device it revoked to every machine that had not yet heard.
+ * That is a compromise; a refused PUT is an operator with a full directory,
+ * who is told so, loudly, at the moment it happens. Nothing in this object
+ * ever deletes *an* entry, and if pruning is ever wanted — a device cert whose
+ * key is revoked, say — it has to be a decision signed under the fleet key and
+ * carried out by something that can read what it is deleting. That is not the
+ * relay, and it must never become the relay.
+ *
+ * What the relay may do, and what `reset` above is, is delete the whole set at
+ * once: that needs no opinion about any blob's meaning, and it is the only way
+ * out of a full directory, because storage survives every redeploy. A daemon
+ * that sees this status has hit a wall an operator has to take down —
+ * `flue relay reset` — and no amount of retrying will move it, which is why
+ * the daemon logs and drops rather than retrying (directory.go, publish).
+ */
+function full(): Response {
+  return new Response('{"error":"directory full"}', { status: 507, headers: JSON_NO_STORE })
+}
+
+/** The storage key for a blob: SHA-256 of its exact bytes, lowercase hex. */
+async function digestKey(blob: Uint8Array): Promise<string> {
+  const digest = await crypto.subtle.digest('SHA-256', blob as BufferSource)
+  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('')
+}
+
+/**
+ * Standard base64, with padding — the alphabet Go's `encoding/json` reads a
+ * `[]byte` field in and writes one out in, so the daemon's own struct decodes
+ * `blob` with no help (internal/crypto keys travel the same way). Chunked
+ * because `String.fromCharCode(...bytes)` on a whole blob is an argument list,
+ * and argument lists have a length limit that a 4 KiB cert would find.
+ */
+function base64(bytes: Uint8Array): string {
+  let binary = ''
+  for (let i = 0; i < bytes.length; i += 0x8000) {
+    binary += String.fromCharCode(...bytes.subarray(i, i + 0x8000))
+  }
+  return btoa(binary)
+}
diff --git a/relay/src/http.ts b/relay/src/http.ts
new file mode 100644
index 0000000..0878871
--- /dev/null
+++ b/relay/src/http.ts
@@ -0,0 +1,47 @@
+// The two things both Durable Objects in this Worker need from HTTP: a bounded
+// body read, and the headers every JSON answer either of them writes.
+
+/** What every JSON answer this Worker writes carries. `no-store` because all of
+ * them are about live state — a refusal that got cached by anything in the path
+ * would outlive the condition that caused it, and the fleet directory is a set
+ * a revocation is expected to change under a reader's feet. */
+export const JSON_NO_STORE = { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }
+
+/**
+ * The request body, or null if it runs past `max`.
+ *
+ * Content-Length is consulted first so an honestly-labelled oversized POST is
+ * refused without being read, and the stream is then counted as it arrives:
+ * a chunked body declares no length at all, and buffering an undeclared one
+ * would hand an endpoint a memory DoS — the exposure the channel cap and the
+ * handshake deadline bound on the client leg (spec/relay-protocol.md, Auth),
+ * and the one the blob cap bounds on `PUT /directory`.
+ */
+export async function readCapped(req: Request, max: number): Promise<Uint8Array | null> {
+  const declared = Number(req.headers.get('Content-Length'))
+  if (Number.isFinite(declared) && declared > max) return null
+  if (!req.body) return new Uint8Array(0)
+  const reader = req.body.getReader()
+  const chunks: Uint8Array[] = []
+  let total = 0
+  try {
+    for (;;) {
+      const { done, value } = await reader.read()
+      if (done) break
+      total += value.byteLength
+      if (total > max) return null
+      chunks.push(value)
+    }
+  } finally {
+    // Releases the leg of an oversized body we stopped reading; a no-op once
+    // the stream has ended on its own.
+    await reader.cancel().catch(() => {})
+  }
+  const out = new Uint8Array(total)
+  let at = 0
+  for (const chunk of chunks) {
+    out.set(chunk, at)
+    at += chunk.byteLength
+  }
+  return out
+}
diff --git a/relay/src/hub.ts b/relay/src/hub.ts
index 85fdb50..0565204 100644
--- a/relay/src/hub.ts
+++ b/relay/src/hub.ts
@@ -1,5 +1,6 @@
 import { DurableObject } from 'cloudflare:workers'
 import { decodeFrame, encodeFrame } from './frame'
+import { JSON_NO_STORE, readCapped } from './http'
 import type { Env } from './index'
 
 /**
@@ -557,11 +558,6 @@ const MAX_PENDING_PAIRS = 8
 /** Statuses a `Response` may not carry a body for. */
 const NULL_BODY_STATUS = new Set([204, 205, 304])
 
-/** What every JSON answer this hub writes carries. `no-store` because all of
- * them are about the state of one live ceremony: a refusal that got cached by
- * anything in the path would outlive the condition that caused it. */
-const JSON_NO_STORE = { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }
-
 /** What a daemon socket remembers across hibernation. */
 interface DaemonAttachment {
   /** False once replaced. `getWebSockets` can still list the dying socket, so
@@ -635,45 +631,6 @@ function pairStatus(status: unknown): number {
     : 502
 }
 
-/**
- * The request body, or null if it runs past `max`.
- *
- * Content-Length is consulted first so an honestly-labelled oversized POST is
- * refused without being read, and the stream is then counted as it arrives:
- * a chunked body declares no length at all, and buffering an undeclared one
- * would hand the credential-less pairing endpoint a memory DoS — the same
- * exposure the channel cap and the handshake deadline bound on the client leg
- * (spec/relay-protocol.md, Auth).
- */
-async function readCapped(req: Request, max: number): Promise<Uint8Array | null> {
-  const declared = Number(req.headers.get('Content-Length'))
-  if (Number.isFinite(declared) && declared > max) return null
-  if (!req.body) return new Uint8Array(0)
-  const reader = req.body.getReader()
-  const chunks: Uint8Array[] = []
-  let total = 0
-  try {
-    for (;;) {
-      const { done, value } = await reader.read()
-      if (done) break
-      total += value.byteLength
-      if (total > max) return null
-      chunks.push(value)
-    }
-  } finally {
-    // Releases the leg of an oversized body we stopped reading; a no-op once
-    // the stream has ended on its own.
-    await reader.cancel().catch(() => {})
-  }
-  const out = new Uint8Array(total)
-  let at = 0
-  for (const chunk of chunks) {
-    out.set(chunk, at)
-    at += chunk.byteLength
-  }
-  return out
-}
-
 /** WebSocket endpoints answer plain HTTP with 426, upgrade required. */
 function refuseNonUpgrade(req: Request): Response | null {
   if (req.headers.get('Upgrade')?.toLowerCase() === 'websocket') return null
diff --git a/relay/src/index.ts b/relay/src/index.ts
index 28a1278..5522cb5 100644
--- a/relay/src/index.ts
+++ b/relay/src/index.ts
@@ -1,9 +1,13 @@
 export interface Env {
   HUB: DurableObjectNamespace
+  /** The fleet directory: one object per relay, because one relay is one fleet
+   * (spec/fleet-trust.md, "The fleet directory"). Not per machine, which is
+   * why it is a namespace of its own rather than a name in HUB's. */
+  DIRECTORY: DurableObjectNamespace
   ASSETS: Fetcher
   DAEMON_SECRET: string
   /** The per-IP rate limiter over the credential-less routes (`/client/*`,
-   * `POST /api/pair/*`) — a Cloudflare rate-limiting binding, declared in
+   * `POST /api/pair/*`, `GET /directory`) — a Cloudflare rate-limiting binding, declared in
    * wrangler.jsonc (`ratelimits`) and in the deploy `flue relay setup` builds
    * (internal/relaydeploy, RateLimitBinding); the two must agree. Optional
    * and fail-open: the rule bounds quota burn, it is not auth, and a Worker
@@ -132,6 +136,30 @@ const rateLimited = () =>
     headers: { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' },
   })
 
+/** A path under a prefix the Worker owns but does not serve. Not the machine
+ * 404: `/directory/anything` names no machine, and answering that it is not
+ * one would be a lie about what was asked. */
+const notFound = () =>
+  new Response('{"error":"not found"}', {
+    status: 404,
+    headers: { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' },
+  })
+
+const methodNotAllowed = (allow: string) =>
+  new Response('{"error":"method not allowed"}', {
+    status: 405,
+    headers: {
+      'Content-Type': 'application/json',
+      'Cache-Control': 'no-store',
+      Allow: allow,
+    },
+  })
+
+/** The name of the one directory object. One relay is one fleet, so this is a
+ * constant rather than anything read off the request: there is no second
+ * directory to route to, and a name in the path would only invent one. */
+const DIRECTORY_NAME = 'directory'
+
 /**
  * May this credential-less request proceed, under the per-IP rate rule?
  *
@@ -210,6 +238,52 @@ export default {
       // token and earns no HMAC: asset requests are unmetered, and the tag
       // check exists to guard Durable Object wakes, not page loads.
     }
+    if (claims(url.pathname, '/directory')) {
+      // The fleet directory: one object for the whole relay, no id in the
+      // path, three shapes on one URL (spec/fleet-trust.md, "The fleet
+      // directory"). Nothing lives under it, and the Worker keeps refusal
+      // authority over the whole prefix — `/directory/anything` is the
+      // Worker's own 404, never the SPA.
+      if (url.pathname !== '/directory') return notFound()
+      // The relay holds no fleet key and verifies none of what this leg
+      // carries; what it can check is who may *write*, and that is the same
+      // bearer secret the daemon leg presents. Checked once, up front,
+      // because it decides both the auth answer and the metering below.
+      const daemon = authorizeDaemon(req, env)
+      // The rate rule meters everything on this prefix that does not hold the
+      // secret — which is the credential-less `GET /directory` the spec puts
+      // behind it, and equally an anonymous caller waving an `Upgrade` header
+      // to reach the 401 by a cheaper road. The secret-holding legs stay
+      // unmetered for the reason `/daemon` is: they are secret-gated, and a
+      // fleet is a handful of machines.
+      if (!daemon && !(await allowRate(req, env))) return rateLimited()
+      const upgrade = req.headers.get('Upgrade')?.toLowerCase() === 'websocket'
+      // DELETE is gated exactly as PUT and the socket are, and by the same
+      // secret: it empties the whole directory (src/directory.ts, reset), which
+      // is the only way out of a full one and therefore the only way a fleet
+      // whose kill switch has stopped being distributed gets it back. It is
+      // reachable by whoever holds the daemon secret, which is every machine in
+      // the fleet — the same set that can already PUT, and the same set that
+      // could always fill the directory in the first place.
+      if ((upgrade || req.method === 'PUT' || req.method === 'DELETE') && !daemon) {
+        return unauthorized()
+      }
+      if (!upgrade && req.method !== 'GET' && req.method !== 'PUT' && req.method !== 'DELETE') {
+        return methodNotAllowed('GET, PUT, DELETE')
+      }
+      // Fail closed on a Worker deployed without the binding — an older
+      // `flue relay setup` than this script. Unlike CLIENT_RATE, which is
+      // fail-open because it bounds cost rather than access, there is no
+      // degraded directory to serve without the object: 503 says so, and the
+      // rest of the relay (which is every session on it) keeps running.
+      if (!env.DIRECTORY) {
+        return new Response('{"error":"directory unavailable"}', {
+          status: 503,
+          headers: { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' },
+        })
+      }
+      return env.DIRECTORY.get(env.DIRECTORY.idFromName(DIRECTORY_NAME)).fetch(req)
+    }
     if (url.pathname === '/api/health' && req.method === 'GET') {
       // Liveness of the Worker and nothing else — no id, no Durable Object
       // woken, nothing about any daemon. An uptime monitor pointed here costs
@@ -230,4 +304,5 @@ export default {
     return env.ASSETS.fetch(req)
   },
 }
+export { FleetDirectory } from './directory'
 export { DaemonHub } from './hub'
diff --git a/relay/test/directory.test.ts b/relay/test/directory.test.ts
new file mode 100644
index 0000000..fde227f
--- /dev/null
+++ b/relay/test/directory.test.ts
@@ -0,0 +1,617 @@
+import { env, SELF } from 'cloudflare:test'
+import { describe, expect, it } from 'vitest'
+
+import worker, { type Env } from '../src/index'
+import { BASE, Leg, machineId, sleep, TEST_SECRET, within } from './harness'
+
+/**
+ * The fleet directory: the relay's store of blobs it cannot read
+ * (spec/fleet-trust.md, "The fleet directory"). Everything below is written
+ * from the outside — through the real Worker, over the real Durable Object —
+ * because the contract parts B and C are written against is the HTTP and
+ * WebSocket surface, not the class.
+ *
+ * The invariant every one of these tests is really about: the relay stores and
+ * serves, and verifies nothing. A blob that came back changed, or an entry that
+ * quietly displaced another, would be a Worker that had formed an opinion about
+ * bytes it holds no key for.
+ */
+
+/** Mirrors MAX_BLOB_BYTES in src/directory.ts. */
+const MAX_BLOB_BYTES = 4096
+
+/** Mirrors MAX_ENTRIES in src/directory.ts. */
+const MAX_ENTRIES = 512
+
+/** Mirrors MAX_DAEMON_SOCKETS in src/directory.ts. */
+const MAX_DAEMON_SOCKETS = 256
+
+const DIRECTORY = `${BASE}/directory`
+
+const AUTH = { Authorization: `Bearer ${TEST_SECRET}` }
+
+/**
+ * Every test in this file shares the one directory object — `idFromName`
+ * ("directory") is a constant, which is the whole point of "one relay is one
+ * fleet" — so blobs are made unique per test rather than per run, and the
+ * assertions are about *this* blob rather than about the size of the set.
+ */
+function blob(tag: string, fill = 'x'): Uint8Array {
+  return new TextEncoder().encode(`${tag}:${fill}`)
+}
+
+function put(body: BodyInit, headers: Record<string, string> = AUTH): Promise<Response> {
+  return SELF.fetch(DIRECTORY, { method: 'PUT', body, headers })
+}
+
+async function get(): Promise<{ v: number; entries: { key: string; blob: string }[] }> {
+  const res = await SELF.fetch(DIRECTORY)
+  expect(res.status).toBe(200)
+  return (await res.json()) as { v: number; entries: { key: string; blob: string }[] }
+}
+
+/** The key the directory files a blob under: SHA-256 of its exact bytes. */
+async function digest(bytes: Uint8Array): Promise<string> {
+  const d = await crypto.subtle.digest('SHA-256', bytes as BufferSource)
+  return [...new Uint8Array(d)].map((b) => b.toString(16).padStart(2, '0')).join('')
+}
+
+/** The bytes of one entry of a GET, base64 undone. */
+function decode(b64: string): Uint8Array {
+  return Uint8Array.from(atob(b64), (c) => c.charCodeAt(0))
+}
+
+/** A daemon's push socket, as a harness Leg. */
+async function socket(): Promise<Leg> {
+  const res = await SELF.fetch(DIRECTORY, { headers: { Upgrade: 'websocket', ...AUTH } })
+  expect(res.status).toBe(101)
+  const ws = res.webSocket!
+  // The pool's test-side socket defaults to delivering binary as Blob; ask for
+  // ArrayBuffer so a push can be compared synchronously.
+  ;(ws as unknown as { binaryType: string }).binaryType = 'arraybuffer'
+  ws.accept()
+  return new Leg(ws)
+}
+
+/** A stub env for the router unit tests, shaped like machineid.test.ts's: the
+ * directory namespace answers with a status nothing else in the Worker uses,
+ * so "reached the object" is unmistakable. */
+function stubEnv(overrides: Partial<Env>): Env {
+  return {
+    DAEMON_SECRET: TEST_SECRET,
+    DIRECTORY: {
+      idFromName: (name: string) => name,
+      get: () => ({ fetch: async () => new Response('reached the directory', { status: 299 }) }),
+    },
+    ASSETS: { fetch: async () => new Response('spa', { status: 200 }) },
+    ...overrides,
+  } as unknown as Env
+}
+
+const denyAll = { limit: async () => ({ success: false }) }
+
+describe('PUT /directory', () => {
+  it('refuses a write without the daemon secret: 401', async () => {
+    const res = await put(blob('unauthorized'), {})
+    expect(res.status).toBe(401)
+  })
+
+  it('refuses a write with the wrong secret: 401', async () => {
+    const res = await put(blob('wrong-secret'), { Authorization: 'Bearer nope' })
+    expect(res.status).toBe(401)
+  })
+
+  it('stores a blob and answers 201 with the key it filed it under', async () => {
+    const body = blob('stored')
+    const res = await put(body)
+    expect(res.status).toBe(201)
+    expect(res.headers.get('Content-Type')).toBe('application/json')
+    expect(res.headers.get('Cache-Control')).toBe('no-store')
+    // Content-addressed: the key is SHA-256 of the exact bytes and nothing
+    // else, which is what makes a PUT unable to displace another entry.
+    expect(await res.json()).toEqual({ key: await digest(body) })
+  })
+
+  it('is idempotent: the same bytes again answer 200 and add no second entry', async () => {
+    const body = blob('idempotent')
+    expect((await put(body)).status).toBe(201)
+    const before = (await get()).entries.length
+    const again = await put(body)
+    // 200 rather than 201 — same body, so a caller need not branch; the status
+    // is the whole of "you were not the first".
+    expect(again.status).toBe(200)
+    expect(await again.json()).toEqual({ key: await digest(body) })
+    expect((await get()).entries.length).toBe(before)
+  })
+
+  it('refuses an empty body: 400, and spends no entry on it', async () => {
+    const res = await put(new Uint8Array(0))
+    expect(res.status).toBe(400)
+    expect(await res.json()).toEqual({ error: 'empty blob' })
+  })
+
+  it('takes a blob of exactly the cap and refuses one byte more: 413', async () => {
+    const at = new Uint8Array(MAX_BLOB_BYTES).fill(0x41)
+    expect((await put(at)).status).toBe(201)
+    const over = new Uint8Array(MAX_BLOB_BYTES + 1).fill(0x42)
+    const res = await put(over)
+    expect(res.status).toBe(413)
+    expect(await res.json()).toEqual({ error: 'blob too large' })
+    // And nothing of the oversized blob was kept.
+    const keys = (await get()).entries.map((e) => e.key)
+    expect(keys).not.toContain(await digest(over))
+  })
+
+  it('refuses an oversized chunked body too, where Content-Length says nothing', async () => {
+    // A body streamed without a declared length is the case a Content-Length
+    // check alone misses, and buffering it is the memory DoS readCapped
+    // exists to stop.
+    const stream = new ReadableStream<Uint8Array>({
+      start(controller) {
+        controller.enqueue(new Uint8Array(MAX_BLOB_BYTES).fill(0x43))
+        controller.enqueue(new Uint8Array(64).fill(0x44))
+        controller.close()
+      },
+    })
+    const res = await SELF.fetch(DIRECTORY, {
+      method: 'PUT',
+      body: stream,
+      headers: AUTH,
+      // Required by the fetch spec for a streaming body.
+      duplex: 'half',
+    } as RequestInit)
+    expect(res.status).toBe(413)
+  })
+})
+
+describe('GET /directory', () => {
+  it('is credential-less: no secret, still the full set', async () => {
+    const body = blob('credential-less')
+    await put(body)
+    const res = await SELF.fetch(DIRECTORY)
+    expect(res.status).toBe(200)
+    expect(res.headers.get('Content-Type')).toBe('application/json')
+    expect(res.headers.get('Cache-Control')).toBe('no-store')
+    const doc = (await res.json()) as { v: number; entries: { key: string; blob: string }[] }
+    expect(doc.v).toBe(1)
+    expect(doc.entries.map((e) => e.key)).toContain(await digest(body))
+  })
+
+  it('round-trips a blob byte for byte, whatever is in it', async () => {
+    // The load-bearing test of the whole leg. Parts B and C verify Ed25519
+    // signatures over *these* bytes: a relay that re-encoded, trimmed, or
+    // ran a blob through UTF-8 anywhere would break every signature over it
+    // while believing it had been helpful. So the payload is deliberately not
+    // text — a NUL, a lone 0xFF that is not valid UTF-8, and a byte pattern
+    // that base64 has to pad.
+    const body = Uint8Array.of(0x00, 0xff, 0xfe, 0x0a, 0x7b, 0x22, 0x80, 0x01, 0x02)
+    const res = await put(body)
+    expect(res.status).toBe(201)
+    const key = await digest(body)
+    const entry = (await get()).entries.find((e) => e.key === key)
+    expect(entry).toBeDefined()
+    expect([...decode(entry!.blob)]).toEqual([...body])
+    // And the key is still the digest of what came back: bytes the relay had
+    // altered could not hash to the name it filed them under.
+    expect(await digest(decode(entry!.blob))).toBe(key)
+  })
+
+  it('keys every entry by the digest of its own blob', async () => {
+    await put(blob('keyed-by-digest'))
+    const entries = (await get()).entries
+    expect(entries.length).toBeGreaterThan(0)
+    for (const e of entries) expect(await digest(decode(e.blob))).toBe(e.key)
+  })
+
+  it('carries an ETag and answers a matching If-None-Match with 304', async () => {
+    // The largest document this relay serves — 512 × 4 KiB of base64 is about
+    // 2.8 MiB — re-read by every daemon on every reconnect, where the usual
+    // answer is "nothing has changed".
+    const dir = env.DIRECTORY.get(env.DIRECTORY.idFromName(`etag-${crypto.randomUUID()}`))
+    const write = (body: Uint8Array): Promise<Response> =>
+      dir.fetch(DIRECTORY, { method: 'PUT', body, headers: AUTH })
+    expect((await write(blob('etag', 'a'))).status).toBe(201)
+
+    const first = await dir.fetch(DIRECTORY)
+    const tag = first.headers.get('ETag')
+    expect(tag).toBeTruthy()
+    // no-store stays: a directory served from a cache is a revocation served
+    // late. The tag is for a client that revalidates on purpose.
+    expect(first.headers.get('Cache-Control')).toBe('no-store')
+
+    const again = await dir.fetch(DIRECTORY, { headers: { 'If-None-Match': tag! } })
+    expect(again.status).toBe(304)
+    expect(again.headers.get('ETag')).toBe(tag)
+    expect(await again.text()).toBe('')
+
+    // A duplicate PUT stores nothing, so the set did not change and neither
+    // does the tag.
+    expect((await write(blob('etag', 'a'))).status).toBe(200)
+    expect((await dir.fetch(DIRECTORY, { headers: { 'If-None-Match': tag! } })).status).toBe(304)
+
+    // A PUT that lands does change it.
+    expect((await write(blob('etag', 'b'))).status).toBe(201)
+    const third = await dir.fetch(DIRECTORY, { headers: { 'If-None-Match': tag! } })
+    expect(third.status).toBe(200)
+    expect(third.headers.get('ETag')).not.toBe(tag)
+  })
+
+  it('never reissues a tag a reader already holds, even across a reset', async () => {
+    // The one case a content digest would get wrong and a counter gets right:
+    // empty the directory, put the same blob back, and the contents are
+    // identical while the reader's picture of the world was empty in between.
+    const dir = env.DIRECTORY.get(env.DIRECTORY.idFromName(`etag-reset-${crypto.randomUUID()}`))
+    const body = blob('etag-reset', 'a')
+    await dir.fetch(DIRECTORY, { method: 'PUT', body, headers: AUTH })
+    const tag = (await dir.fetch(DIRECTORY)).headers.get('ETag')
+
+    await dir.fetch(DIRECTORY, { method: 'DELETE', headers: AUTH })
+    await dir.fetch(DIRECTORY, { method: 'PUT', body, headers: AUTH })
+
+    const after = await dir.fetch(DIRECTORY, { headers: { 'If-None-Match': tag! } })
+    expect(after.status).toBe(200)
+    expect(after.headers.get('ETag')).not.toBe(tag)
+  })
+
+  it('sits behind the rate rule, like /client and POST /api/pair', async () => {
+    const res = await worker.fetch(
+      new Request(DIRECTORY),
+      stubEnv({ CLIENT_RATE: denyAll }),
+    )
+    expect(res.status).toBe(429)
+    expect(await res.json()).toEqual({ error: 'rate limited' })
+  })
+
+  it('does not meter the secret-holding legs: they are gated, not throttled', async () => {
+    const upgrade = await worker.fetch(
+      new Request(DIRECTORY, { headers: { Upgrade: 'websocket', ...AUTH } }),
+      stubEnv({ CLIENT_RATE: denyAll }),
+    )
+    expect(upgrade.status).toBe(299)
+    const write = await worker.fetch(
+      new Request(DIRECTORY, { method: 'PUT', body: 'blob', headers: AUTH }),
+      stubEnv({ CLIENT_RATE: denyAll }),
+    )
+    expect(write.status).toBe(299)
+  })
+
+  it('meters an anonymous upgrade too: the 401 is not a cheaper road past the rule', async () => {
+    // Without this, `Upgrade: websocket` would be a way to spend the Worker's
+    // billed requests on /directory without ever presenting a credential.
+    const res = await worker.fetch(
+      new Request(DIRECTORY, { headers: { Upgrade: 'websocket' } }),
+      stubEnv({ CLIENT_RATE: denyAll }),
+    )
+    expect(res.status).toBe(429)
+  })
+
+  it('fails open when the rate binding is absent, as the other routes do', async () => {
+    const res = await worker.fetch(new Request(DIRECTORY), stubEnv({ CLIENT_RATE: undefined }))
+    expect(res.status).toBe(299)
+  })
+})
+
+describe('the directory socket', () => {
+  it('refuses an upgrade without the daemon secret: 401', async () => {
+    const res = await SELF.fetch(DIRECTORY, { headers: { Upgrade: 'websocket' } })
+    expect(res.status).toBe(401)
+  })
+
+  it('pushes a stored blob to every connected daemon, byte for byte', async () => {
+    const a = await socket()
+    const b = await socket()
+    const body = Uint8Array.of(0x00, 0xff, 0x10, 0x20, 0x30)
+    expect((await put(body)).status).toBe(201)
+    // One binary message of exactly the blob's bytes: no envelope, because an
+    // envelope is a chance to reshape something the relay cannot read.
+    expect([...new Uint8Array((await a.next('a push')) as ArrayBuffer)]).toEqual([...body])
+    expect([...new Uint8Array((await b.next('a push')) as ArrayBuffer)]).toEqual([...body])
+    a.ws.close()
+    b.ws.close()
+  })
+
+  it('pushes nothing for a duplicate PUT: the set did not change', async () => {
+    const body = blob('pushed-once')
+    await put(body)
+    const daemon = await socket()
+    // The socket is opened after the first PUT, so the only push it could see
+    // is one the duplicate produced.
+    await put(body)
+    // A blob that *does* change the set, sent second, is the fence: if the
+    // duplicate had pushed, this assertion would read its bytes instead.
+    const fresh = blob('pushed-once-fence')
+    await put(fresh)
+    expect([...new Uint8Array((await daemon.next('the fence push')) as ArrayBuffer)]).toEqual([
+      ...fresh,
+    ])
+    daemon.ws.close()
+  })
+
+  it('holds MAX_DAEMON_SOCKETS of them and refuses the next with 503', async () => {
+    // Not the DoS cap MAX_CLIENTS is on the hub's credential-less leg — this
+    // one is secret-gated. It bounds what a single PUT costs, which is one
+    // send per socket, against a fleet that has left half-dead sockets behind
+    // or a secret-holder opening them in a loop. Untested until now, and an
+    // untested bound is a number rather than a limit.
+    const dir = env.DIRECTORY.get(env.DIRECTORY.idFromName(`sockets-${crypto.randomUUID()}`))
+    const open = (): Promise<Response> =>
+      dir.fetch(DIRECTORY, { headers: { Upgrade: 'websocket', ...AUTH } })
+
+    const held: WebSocket[] = []
+    for (let i = 0; i < MAX_DAEMON_SOCKETS; i++) {
+      const res = await open()
+      expect(res.status).toBe(101)
+      // Accepted on this side too: an unaccepted pair is not what a real
+      // daemon leaves behind, and the object counts what it accepted.
+      res.webSocket!.accept()
+      held.push(res.webSocket!)
+    }
+
+    const over = await open()
+    expect(over.status).toBe(503)
+    expect(await over.json()).toEqual({ error: 'too many directory sockets' })
+
+    // And there is no reaper: the cap is a ceiling on concurrency, not a
+    // queue, so room appears when a socket closes and not before.
+    held[0]!.close()
+    // The close has to reach the object before the next upgrade is judged; a
+    // fresh request is the fence the pool gives us.
+    for (let attempt = 0; attempt < 20; attempt++) {
+      const retry = await open()
+      if (retry.status === 101) {
+        retry.webSocket!.accept()
+        held.push(retry.webSocket!)
+        break
+      }
+      expect(retry.status).toBe(503)
+      await sleep(25)
+    }
+    for (const ws of held) {
+      try {
+        ws.close()
+      } catch {
+        // Already closed by the assertions above.
+      }
+    }
+  })
+
+  it('closes a daemon that speaks on it: the socket is push-only', async () => {
+    const daemon = await socket()
+    daemon.ws.send('hello')
+    expect(await within(daemon.closed, 'the socket to close')).toEqual({
+      code: 1002,
+      reason: 'the directory socket is push-only',
+    })
+  })
+
+  it('survives a flue-pong without closing', async () => {
+    const daemon = await socket()
+    daemon.ws.send('flue-pong')
+    const body = blob('after-a-pong')
+    await put(body)
+    expect([...new Uint8Array((await daemon.next('a push')) as ArrayBuffer)]).toEqual([...body])
+    daemon.ws.close()
+  })
+
+  it('answers flue-ping from the edge auto-response, without waking the object', async () => {
+    const daemon = await socket()
+    daemon.ws.send('flue-ping')
+    expect(await daemon.next('the pong')).toBe('flue-pong')
+    daemon.ws.close()
+  })
+})
+
+describe('the directory routes', () => {
+  it('404s a path under the prefix: the Worker owns it, the SPA does not answer', async () => {
+    const res = await SELF.fetch(`${BASE}/directory/anything`)
+    expect(res.status).toBe(404)
+    // Not the machine 404: nothing here names a machine, and saying so would
+    // be a lie about what was asked.
+    expect(await res.json()).toEqual({ error: 'not found' })
+  })
+
+  it('405s a method the leg does not have', async () => {
+    const res = await SELF.fetch(DIRECTORY, { method: 'PATCH', headers: AUTH })
+    expect(res.status).toBe(405)
+    expect(res.headers.get('Allow')).toBe('GET, PUT, DELETE')
+    expect(await res.json()).toEqual({ error: 'method not allowed' })
+  })
+
+  it('never confuses the directory with a machine: /directory is not an id', async () => {
+    // The two prefixes cannot collide — "directory" carries no MAC tag and
+    // could not be a machine id — but the check is cheap and the failure mode
+    // (a fleet's certs served out of a machine hub) would be silent.
+    const res = await SELF.fetch(`${BASE}/client/${await machineId('notdir-0a0a')}`, {
+      headers: { Upgrade: 'websocket' },
+    })
+    expect(res.status).toBe(503)
+    expect(await res.json()).toEqual({ error: 'daemon offline' })
+  })
+
+  it('503s when the directory binding is absent: an older deploy than this script', async () => {
+    const res = await worker.fetch(new Request(DIRECTORY), stubEnv({ DIRECTORY: undefined }))
+    expect(res.status).toBe(503)
+    expect(await res.json()).toEqual({ error: 'directory unavailable' })
+  })
+
+  it('binds one directory for the whole relay', async () => {
+    // One relay is one fleet: the name is a constant in the router, so two
+    // reads of it are two reads of the same object. The binding has to exist
+    // in the pool for that to mean anything.
+    expect(env.DIRECTORY).toBeDefined()
+    expect(typeof env.DIRECTORY.idFromName).toBe('function')
+  })
+})
+
+/**
+ * The reset, which is the only way out of a full directory.
+ *
+ * Like the cap below, these run against objects of their own: a wipe of the
+ * shared directory would pull the ground out from under every other test in
+ * this file. The one test here that *is* about the router — who may ask for a
+ * wipe — goes through SELF, and is refused before it reaches any object.
+ */
+describe('DELETE /directory', () => {
+  /** A directory nothing else in this file touches. */
+  function own(): DurableObjectStub {
+    return env.DIRECTORY.get(env.DIRECTORY.idFromName(`reset-${crypto.randomUUID()}`))
+  }
+  const write = (dir: DurableObjectStub, body: Uint8Array): Promise<Response> =>
+    dir.fetch(DIRECTORY, { method: 'PUT', body, headers: AUTH })
+  const wipe = (dir: DurableObjectStub): Promise<Response> =>
+    dir.fetch(DIRECTORY, { method: 'DELETE', headers: AUTH })
+  const read = async (dir: DurableObjectStub): Promise<{ key: string; blob: string }[]> =>
+    ((await (await dir.fetch(DIRECTORY)).json()) as { entries: { key: string; blob: string }[] })
+      .entries
+
+  it('refuses a wipe without the daemon secret: 401', async () => {
+    // The gate is the router's, and it is the same secret PUT and the socket
+    // present. A credential-less caller can read this store; emptying it is a
+    // write, and the largest one there is.
+    expect((await SELF.fetch(DIRECTORY, { method: 'DELETE' })).status).toBe(401)
+    expect(
+      (await SELF.fetch(DIRECTORY, { method: 'DELETE', headers: { Authorization: 'Bearer nope' } }))
+        .status,
+    ).toBe(401)
+  })
+
+  it('empties the store and reports what it removed', async () => {
+    const dir = own()
+    expect((await write(dir, blob('wipe', 'a'))).status).toBe(201)
+    expect((await write(dir, blob('wipe', 'b'))).status).toBe(201)
+    expect((await read(dir)).length).toBe(2)
+
+    const res = await wipe(dir)
+    expect(res.status).toBe(200)
+    expect(res.headers.get('Cache-Control')).toBe('no-store')
+    expect(await res.json()).toEqual({ reset: true, removed: 2 })
+    expect(await read(dir)).toEqual([])
+  })
+
+  it('takes the count with the blobs: a re-publish repopulates from zero', async () => {
+    const dir = own()
+    const first = blob('repopulate', 'a')
+    expect((await write(dir, first)).status).toBe(201)
+    await wipe(dir)
+    // 201 rather than 200: the entry is genuinely gone, not merely hidden from
+    // the snapshot, so the daemon that re-offers it is filing it afresh.
+    expect((await write(dir, first)).status).toBe(201)
+    expect((await read(dir)).map((e) => e.key)).toEqual([await digest(first)])
+    // And the counter went with it — a count that survived the wipe would
+    // refuse the 513th write into an empty store.
+    expect((await wipe(dir)).status).toBe(200)
+    expect(await (await wipe(dir)).json()).toEqual({ reset: true, removed: 0 })
+  })
+
+  it('lets a revocation that was refused at the cap be published after a reset', async () => {
+    // The whole point, end to end. A full directory refuses the fleet-wide kill
+    // switch with 507 — and refuses it permanently, because nothing evicts and
+    // Durable Object storage outlives every redeploy. This is the way back.
+    const dir = own()
+    for (let i = 0; i < MAX_ENTRIES; i++) {
+      expect((await write(dir, blob('fullcap', String(i)))).status).toBe(201)
+    }
+    const revocation = blob('fullcap', 'revocation')
+    expect((await write(dir, revocation)).status).toBe(507)
+
+    expect((await wipe(dir)).status).toBe(200)
+
+    const after = await write(dir, revocation)
+    expect(after.status).toBe(201)
+    expect(await after.json()).toEqual({ key: await digest(revocation) })
+    expect((await read(dir)).map((e) => e.key)).toEqual([await digest(revocation)])
+  })
+
+  it('closes every daemon socket, so the fleet re-publishes in seconds not in half an hour', async () => {
+    const dir = own()
+    const res = await dir.fetch(DIRECTORY, { headers: { Upgrade: 'websocket', ...AUTH } })
+    expect(res.status).toBe(101)
+    const ws = res.webSocket!
+    ws.accept()
+    const leg = new Leg(ws)
+
+    expect((await wipe(dir)).status).toBe(200)
+
+    // The close is the message: this leg carries nothing but raw blobs daemon-
+    // ward, so there is no in-band way to say "re-publish" — and a daemon's
+    // reconnect is a snapshot read followed by a full re-offer of everything it
+    // holds, which is exactly what an emptied directory needs.
+    const closed = await within(leg.closed, 'the reset to close the daemon socket')
+    expect(closed.code).toBe(1012)
+    expect(closed.reason).toBe('the directory was reset; reconnect and republish')
+  })
+})
+
+/**
+ * The cap, tested against its own object rather than the shared one: filling
+ * the fleet directory would leave every other test in this file reading 512
+ * entries. This dials the Durable Object directly, which is the one place in
+ * this suite the router is not the thing under test.
+ */
+describe('the entry cap', () => {
+  it('refuses a PUT past MAX_ENTRIES with 507, and keeps taking duplicates', async () => {
+    const full = env.DIRECTORY.get(env.DIRECTORY.idFromName(`full-${crypto.randomUUID()}`))
+    const write = (body: Uint8Array): Promise<Response> =>
+      full.fetch(DIRECTORY, { method: 'PUT', body, headers: AUTH })
+    // Fill it. Small blobs — the cap under test is the count, not the bytes.
+    const first = blob('cap', '0')
+    expect((await write(first)).status).toBe(201)
+    for (let i = 1; i < MAX_ENTRIES; i++) expect((await write(blob('cap', String(i)))).status).toBe(201)
+    // One more distinct blob is refused, with a status nothing else on this
+    // leg wears: a daemon has to tell "your blob is fine and I will not keep
+    // it" from 413 (this blob is wrong) and 401 (this caller is wrong).
+    const over = blob('cap', 'over')
+    const res = await write(over)
+    expect(res.status).toBe(507)
+    expect(await res.json()).toEqual({ error: 'directory full' })
+    // Refused, not evicted — a directory that dropped an old entry to take a
+    // new one could drop a revocation, and a forgotten revocation re-admits
+    // the device it revoked.
+    const doc = (await (await full.fetch(DIRECTORY)).json()) as {
+      entries: { key: string; blob: string }[]
+    }
+    expect(doc.entries.length).toBe(MAX_ENTRIES)
+    expect(doc.entries.map((e) => e.key)).toContain(await digest(first))
+    expect(doc.entries.map((e) => e.key)).not.toContain(await digest(over))
+    // And a re-PUT of something already stored still succeeds at the cap: it
+    // asks for no room, so refusing it would strand a daemon that re-announces
+    // on every reconnect.
+    expect((await write(first)).status).toBe(200)
+  })
+
+  it('pushes nothing at all for a refused blob: the 507 comes before the fan-out', async () => {
+    // The exact failure mode, pinned, because it is the one an operator has to
+    // be told the truth about. A refused blob is not stored, and the push
+    // socket carries *new entries* — so a revocation refused here reaches
+    // nobody, not "everybody who happened to be connected". It has taken effect
+    // on the machine it was typed on and on no other.
+    const full = env.DIRECTORY.get(env.DIRECTORY.idFromName(`nopush-${crypto.randomUUID()}`))
+    const write = (body: Uint8Array): Promise<Response> =>
+      full.fetch(DIRECTORY, { method: 'PUT', body, headers: AUTH })
+    for (let i = 0; i < MAX_ENTRIES; i++) {
+      expect((await write(blob('nopush', String(i)))).status).toBe(201)
+    }
+
+    const res = await full.fetch(DIRECTORY, { headers: { Upgrade: 'websocket', ...AUTH } })
+    expect(res.status).toBe(101)
+    const ws = res.webSocket!
+    ;(ws as unknown as { binaryType: string }).binaryType = 'arraybuffer'
+    ws.accept()
+    const daemon = new Leg(ws)
+
+    let pushed: unknown = null
+    // The caught tail is only to keep the harness's own 2 s deadline from
+    // rejecting into nobody after this test has passed.
+    void daemon
+      .next('a push that must not come')
+      .then((m) => {
+        pushed = m
+      })
+      .catch(() => {})
+
+    expect((await write(blob('nopush', 'revocation'))).status).toBe(507)
+    await sleep(50)
+    expect(pushed).toBeNull()
+    ws.close()
+  })
+})
diff --git a/relay/wrangler.jsonc b/relay/wrangler.jsonc
index 1a449b8..8139393 100644
--- a/relay/wrangler.jsonc
+++ b/relay/wrangler.jsonc
@@ -22,19 +22,62 @@
     "not_found_handling": "single-page-application",
     // The bare entries matter: "/daemon/*" alone would let the asset router
     // answer a bare /daemon with the SPA before the Worker's 404 could — the
-    // Worker keeps refusal authority over its whole prefix, ids or not.
+    // Worker keeps refusal authority over its whole prefix, ids or not. The
+    // same goes for /directory, where the bare path *is* the route and the
+    // starred form is the Worker's own 404.
     // internal/relaydeploy (RunWorkerFirst) ships the same list in the
     // deploy request `flue relay setup` builds; edit both or neither.
-    "run_worker_first": ["/daemon", "/daemon/*", "/client", "/client/*", "/api/*"]
+    "run_worker_first": [
+      "/daemon",
+      "/daemon/*",
+      "/client",
+      "/client/*",
+      "/api/*",
+      "/directory",
+      "/directory/*"
+    ]
   },
-  "durable_objects": { "bindings": [{ "name": "HUB", "class_name": "DaemonHub" }] },
-  "migrations": [{ "tag": "v1", "new_sqlite_classes": ["DaemonHub"] }],
-  // The per-IP bound on the credential-less routes (/client/*, POST
-  // /api/pair/*): generous enough that a fleet of tabs never sees it, tight
-  // enough that burning the daily request allowance needs a botnet
-  // (spec/fleet-trust.md, "Rate rule"). internal/relaydeploy ships the same
-  // binding — name, namespace, numbers — in the deploy request `flue relay
-  // setup` builds; edit both or neither.
+  // Two classes: DaemonHub is one object per machine, FleetDirectory is one
+  // object for the relay (spec/fleet-trust.md, "The fleet directory").
+  //
+  // internal/relaydeploy is level with this file on all three counts the
+  // directory needs — this binding (DirectoryBinding/DirectoryClass), the v2
+  // migration below (Migrations), and the two "/directory" entries above
+  // (RunWorkerFirst) — so `flue relay setup` and `pnpm dev` deploy the same
+  // object and the 503 the Worker answers without the binding is once again
+  // only what an older flue's relay serves. Edit both or neither, and note
+  // that the *tags* are part of the contract: Cloudflare records the tag
+  // against the deployed script, so a wrangler deploy and a flue deploy of one
+  // Worker have to name the same migration history.
+  //
+  // That is no longer prose alone: internal/relaydeploy/deploy_test.go parses
+  // this file and fails when the two disagree. It is worth the test because a
+  // `v3` added here and not there would leave every `flue relay update`
+  // sending nothing — the account reports v2, the client's history ends at v2
+  // — and the class would never be created, silently, on a deploy that
+  // succeeds.
+  "durable_objects": {
+    "bindings": [
+      { "name": "HUB", "class_name": "DaemonHub" },
+      { "name": "DIRECTORY", "class_name": "FleetDirectory" }
+    ]
+  },
+  "migrations": [
+    { "tag": "v1", "new_sqlite_classes": ["DaemonHub"] },
+    { "tag": "v2", "new_sqlite_classes": ["FleetDirectory"] }
+  ],
+  // The per-IP bound on the credential-less routes — /client/*, POST
+  // /api/pair/*, and every request to /directory that does not present the
+  // daemon secret, which is the public `GET /directory` and any anonymous
+  // caller waving an Upgrade header at it. Generous enough that a fleet of
+  // tabs never sees it, tight enough that burning the daily request allowance
+  // needs a botnet (spec/fleet-trust.md, "Rate rule"). This is also the only
+  // bound on the size of what an anonymous GET can pull — the snapshot's ETag
+  // makes a *revalidating* client cheap and does nothing about one that simply
+  // asks again. internal/relaydeploy ships the same binding — name, namespace,
+  // numbers — in the deploy request `flue relay setup` builds; edit both or
+  // neither, and internal/relaydeploy/deploy_test.go now fails when they
+  // differ.
   "ratelimits": [
     { "name": "CLIENT_RATE", "namespace_id": "1001", "simple": { "limit": 300, "period": 60 } }
   ],
diff --git a/spec/fleet-trust.md b/spec/fleet-trust.md
index 260736f..b809db0 100644
--- a/spec/fleet-trust.md
+++ b/spec/fleet-trust.md
@@ -127,12 +127,78 @@ One additional Durable Object per fleet (`idFromName("directory")`, one relay
 is one fleet) with three routes:
 
 ```
-PUT  /directory            daemon leg auth (Bearer secret); body: one cert or revocation
-GET  /directory            credential-less; the full set: machine certs, device certs, revocations
-WS   /directory (daemons)  daemon leg auth; push on write, so daemons learn of new
-                           devices/revocations without polling
+PUT    /directory          daemon leg auth (Bearer secret); body: one cert or revocation
+GET    /directory          credential-less; the full set: machine certs and revocations
+DELETE /directory          daemon leg auth; empties the whole set (`flue relay reset`)
+WS     /directory (daemons)  daemon leg auth; push on write, so daemons learn of new
+                           revocations without polling
 ```
 
+**Device certificates are deliberately not in the directory.** A device gets
+its own certificate from the machine that minted it — in the pairing answer,
+and again in the welcome of every connection it opens anywhere in the fleet —
+both channels on which it is already authenticated, and the second of which is
+inside Noise. Publishing them as well bought one thing, a browser being able to
+find its own, and cost two: `GET /directory` needs no credential, so it became
+a public roster of the operator's device keys and the human labels beside them;
+and nothing in the directory is ever deleted one entry at a time, so each
+ceremony ever performed spent one of 512 permanent entries. No daemon ever read
+one from there — a machine admits a roaming device on the certificate the
+device *presents* in its handshake, which is rule 2 — so nothing needed them.
+
+What the directory still owes a stored certificate is the other half of the
+rule: a browser reads the revocations and stops presenting a certificate whose
+key the fleet has cut off.
+
+**Pruning superseded entries: considered, and not built.** The reason is that
+there is almost nothing left to prune, not that a delete would be dangerous.
+
+Count what can ever be *superseded* now. A revocation never is: it is the
+final word about a key and outranks everything, forever. A device certificate
+is not in here at all. That leaves a machine certificate a machine re-minted,
+which happens when `flue relay setup`/`join` runs on that machine again — a
+handful of times in the life of a fleet, and one entry each. Against a cap of
+512, the growth term this would reclaim is single digits. A mechanism, its
+failure modes and its tests, to win back a fraction of a percent of a store
+that no longer grows with use, is not a trade worth making.
+
+The failure it would guard against is already covered, and covered by
+something with no opinion about any blob: `DELETE /directory`
+(`flue relay reset`) empties the store, and every daemon re-publishes
+everything it holds on its next connect and every 30 minutes thereafter, so
+the fleet refills itself. The status surfaces warn from 90% of the cap, so
+arriving at the wall is a decision rather than a discovery. What a wipe
+genuinely costs — a blob whose only remaining holder never reconnects — is
+stated with the route itself in `docs/RELAY.md` rather than hidden here.
+
+Two arguments that would be tempting here are **not** the reason, and are
+written down so nobody re-derives them as one:
+
+- *"A targeted delete on the daemon secret would let one compromised machine
+  delete any entry."* True, and this design already ships `DELETE /directory`
+  on that same secret, which lets that machine delete **every** entry
+  including every revocation. A targeted delete would be strictly weaker than
+  what the secret already buys, and self-healing for the same reason the wipe
+  is. The secret is a fleet-wide credential; a compromised machine holding one
+  is the case `spec/relay-protocol.md` treats under re-setup, not a case
+  pruning would change.
+- *"A signed delete would need the relay to verify."* Also true, and it is a
+  real cost — but it is the cost of the *signed* variant only, so it is an
+  argument about which mechanism, not about whether to have one.
+
+**Future work, deliberately not built: a verify-only deletion gate.** The
+fleet *public* key could be bound to the Worker so that a `DELETE` naming
+digests is honoured only when a fleet-signed statement authorises it. The
+private key still never goes near the relay, so this does not weaken minting.
+It is not built because it makes the Worker a policy engine — today it stores
+bytes and serves them, and every rule about what those bytes mean lives in the
+readers — and because it creates a rotation problem the rest of this design
+does not have: rotating the fleet key would leave a Worker bound to the old
+public half, unable to honour a delete signed by the new one and still willing
+to honour one signed by the old. Either shape of that fix (a rotation
+ceremony, or a Worker that accepts two keys during an overlap) is a bigger
+change than the entries it would reclaim.
+
 The Worker stores blobs it cannot check; every reader verifies every
 signature under the fleet public key and drops what fails. A hostile relay
 can serve a stale or truncated directory — it always could refuse to route —
@@ -140,21 +206,36 @@ but cannot mint a machine or a device, because it does not hold the fleet
 key. Availability remains the relay's only power; that invariant is the spine
 of `spec/relay-protocol.md` and survives intact.
 
-Privacy note for `docs/RELAY.md`: the directory makes machine names/ids and
-device public keys/names visible to the relay (they are signed, not secret).
-The relay already routes by machine id; the delta is names and device pubs.
-One operator, their own Worker: acceptable, but stated.
+Privacy note for `docs/RELAY.md`: the directory makes machine names and ids
+visible to the relay, and to anyone who reads the credential-less route (they
+are signed, not secret). The relay already routes by machine id, so the delta
+is machine *names* and the revocation history — who was cut off and when.
+One operator, their own Worker: acceptable, and stated.
+
+State the device-certificate delta precisely, because it is easy to overclaim.
+The relay *operator* still sees every device certificate: a relayed pairing
+posts through the Worker in cleartext and the certificate comes back in the
+answer (`spec/relay-protocol.md`, "What the relay sees"), and no directory
+arrangement changes that, since the request is the ceremony. What keeping them
+out of the directory removes is the **anonymous reader**: `GET /directory`
+takes no credential, so a published certificate was a device public key and its
+owner's label readable by anyone who knew the relay's address, permanently.
+"Not published to strangers", not "not seen by the operator".
 
 Flows, end to end:
 
 - **New machine.** `flue relay join` (one line) → daemon mints its machine
   cert, PUTs it, opens the directory socket. Every paired browser's next
-  directory read shows the machine; every existing device cert already in the
-  directory lets those devices straight in. No ceremony.
+  directory read shows the machine, and presents the certificate it already
+  holds to be let in. No ceremony.
 - **New device.** Pair once, on any machine (that machine's `/pair` page,
-  reached through the relay as today). The ceremony's machine mints the
-  device cert, PUTs it; every other daemon hears the push. The phone's next
-  directory read gives it the whole fleet.
+  reached through the relay as today). The ceremony's machine mints the device
+  cert and hands it to the device in the pairing answer, which the browser
+  verifies under the fleet key it pinned from the QR seconds earlier and keeps.
+  The phone's next directory read gives it the whole fleet's machines, and its
+  stored certificate is what those machines admit it on. Any machine it can
+  reach re-offers the same certificate in its welcome, so losing it is not
+  losing the fleet.
 - **Revoke.** The Devices screen on any machine revokes any fleet device: PUT
   the revocation, push to every daemon, each drops the key from its local
   registry and closes its channels — the existing `revoked{reason}` flow, now
diff --git a/spec/relay-protocol.md b/spec/relay-protocol.md
index dd04d8d..335ef75 100644
--- a/spec/relay-protocol.md
+++ b/spec/relay-protocol.md
@@ -1,7 +1,8 @@
 # flue relay protocol
 
-The relay is a Cloudflare Worker (one Durable Object per machine) that bridges
-each daemon's single outbound socket to any number of browser tabs. It
+The relay is a Cloudflare Worker (one Durable Object per machine, plus one for
+the fleet directory) that bridges each daemon's single outbound socket to any
+number of browser tabs. It
 forwards bytes and nothing else: it holds no Noise keys, reads no terminal traffic, and cannot
 tell one keystroke from another. What it *does* see — the control channel is
 cleartext — is set out under "What the relay sees" below.
@@ -10,6 +11,14 @@ This document defines the two sockets that meet at the relay and the framing on
 each. It does **not** redefine the wire protocol — `spec/protocol.md` is
 unchanged and travels inside, encrypted. The relay is a transport for it.
 
+It also defines one thing the relay *stores* rather than forwards: the fleet
+directory, a set of signed blobs it cannot verify (below). That leg holds no
+key either, and the rule it lives under is the same one this whole document
+turns on — the relay's only power is availability. **With one exception, which
+the directory introduced and which is stated wherever that phrase appears:
+withholding a revocation is not the same kind of loss as withholding a
+certificate.** See "What withholding costs" below.
+
 ```
 daemon  ---- wss /daemon/<id> ---->  Worker + one DO per machine  <---- wss /client/<id> ----  browser
         [4B channel][payload]                                     [payload]
@@ -26,6 +35,26 @@ Three layers stack, outermost first:
 | Noise IK | handshake messages, then transport ciphertexts | daemon and browser |
 | Kind framing | `[1 byte kind][wire protocol bytes]` | daemon and browser |
 
+The directory leg stacks none of them. It is HTTP plus one push socket, and
+what travels on it is a signed blob in whatever encoding the fleet key signs
+(`spec/fleet-trust.md`, Certificates) — bytes the relay stores, serves and
+forwards without a frame of its own around them, because it cannot read them
+and any framing it added would be a chance to reshape what a reader is about
+to check a signature over.
+
+The routes, in one place:
+
+| Route | Auth | Metered | Object |
+|---|---|---|---|
+| `WS /daemon/<id>` | Bearer daemon secret | no | that machine's hub |
+| `WS /client/<id>` | none | yes | that machine's hub |
+| `POST /api/pair/<id>` | none | yes | that machine's hub |
+| `PUT /directory` | Bearer daemon secret | no | the directory |
+| `GET /directory` | none | yes | the directory |
+| `DELETE /directory` | Bearer daemon secret | no | the directory |
+| `WS /directory` | Bearer daemon secret | no | the directory |
+| `GET /api/health` | none | no | none — the Worker alone |
+
 ## The daemon leg
 
 The daemon dials `wss://<relay>/daemon/<machine-id>` **outbound** — nothing
@@ -148,15 +177,201 @@ distinction would be lost. This byte carries it, and the layer above the relay
 reads the same `(text, data)` pair it reads locally. An empty payload, or any
 kind byte other than `0x00` or `0x01`, is a protocol error.
 
+## The fleet directory
+
+One more Durable Object, and the only one that is not per machine: the fleet
+directory, `idFromName("directory")`, because one relay is one fleet
+(`spec/fleet-trust.md`, "The fleet directory"). It holds the signed artifacts
+that have to reach every machine and every device — machine certs and
+revocations — and it holds them as **blobs it cannot verify**, because the
+fleet key never touches the Worker.
+
+*Device* certificates are deliberately not among them. A device is handed its
+own by the machine that minted it, over the pairing answer and over every
+welcome, so publishing them here would only have made a credential-less route
+into a roster of the operator's device keys and spent one permanent entry per
+ceremony against a cap of 512. The Worker cannot tell one blob from another and
+does not try; this is a rule the daemons keep, not one this leg enforces.
+
+That is the invariant this leg exists to preserve, and it must survive every
+future change to it: **the relay stores and serves, and never verifies.** Every
+reader — daemon and browser both — checks every signature under the fleet
+public key and drops what fails. A hostile relay can therefore serve a stale,
+truncated or empty directory, exactly as it could always refuse to route; what
+it cannot do is mint a machine or a device, because minting needs a key it does
+not hold.
+
+### What withholding costs
+
+"The cost of a hostile relay stays availability, and nothing else" is exactly
+true of the routing legs and of the *certificates* in this store. It is not
+exactly true of the revocations, and the difference is worth stating rather
+than rounding off.
+
+For a certificate, omission subtracts: a machine cert the relay hides is a
+machine the browser does not see, and one it has no way to reach until it pairs
+with that machine by hand. The reader ends up with less authority than the
+fleet granted, which is the shape "availability" describes. (Device certs are
+not in this store to be withheld — they travel to the device that owns them —
+so the only certificate this paragraph is about is a machine's.)
+
+For a revocation, omission *adds*. A revocation only ever removes authority, so
+a machine that never receives one goes on admitting a device the operator cut
+off — and there is nothing in the answer to say so. A `GET /directory` that
+omits a revocation is shape-identical to one from a fleet that never issued it:
+the set is signed entry by entry and not as a whole, so there is no count, no
+epoch and no signature over the collection for a reader to check the answer
+against. A relay that filters is indistinguishable from a relay that is simply
+younger.
+
+What bounds this in practice, and why it is a stated weakness rather than an
+open door:
+
+- Revocations are re-published by every machine that holds one, on every
+  connect and every 30 minutes, so a relay must withhold *continuously* and
+  from *every* reader to keep one buried.
+- A machine that has already ingested a revocation has written it to its own
+  store; nothing the relay does later takes it back.
+- The relay cannot mint the device cert the withheld revocation was about. It
+  can only preserve authority the fleet had already granted, never invent it.
+
+**Future work, deliberately not built here: a signed manifest.** The fix is for
+the fleet to sign a statement *about the set* — an epoch counter, or a digest
+over the entry keys, minted under the fleet key and published like any other
+blob — so that a reader can tell "this is the whole directory as of epoch N"
+from "this is what the relay felt like handing me". That turns omission back
+into an availability failure a reader can detect. It needs a rule for who mints
+the manifest and when, and a rule for readers meeting two manifests at different
+epochs, and neither belongs in the same change as the directory itself.
+
+```
+PUT    /directory  Bearer daemon secret; body is one signed blob, raw bytes
+GET    /directory  credential-less, rate limited; the whole set
+DELETE /directory  Bearer daemon secret; empties the whole set
+WS     /directory  Bearer daemon secret; relay → daemon pushes, on write
+```
+
+Nothing lives under the prefix: `/directory/<anything>` is the Worker's own
+`404 {"error":"not found"}` — not the machine 404, because nothing here names a
+machine — and a method other than `GET`, `PUT` or `DELETE` is `405` with
+`Allow: GET, PUT, DELETE`.
+
+**Entries are content-addressed.** An entry's key is the lowercase hex SHA-256
+of the blob's exact bytes, and there is no other name for it. That is the only
+key a Worker that cannot read a blob is entitled to compute: a caller-supplied
+name would put the relay in charge of a namespace it cannot check, and one
+buggy or hostile secret-holder could then PUT a machine cert over a revocation
+with the relay's help. Content addressing makes that structurally impossible —
+a PUT can only ever *add* — and two properties fall out of it:
+
+- **Idempotence.** The same bytes PUT again are the same key and the same
+  value: no second entry, no push. A daemon may re-announce everything it holds
+  on every reconnect, and a PUT replayed from the wire changes nothing.
+- **Byte-exactness.** A blob comes back exactly as it went in. Bytes the relay
+  had altered would not hash to the name it filed them under, and every reader
+  verifies a signature over these bytes.
+
+`PUT` answers `201 {"key":"<hex>"}` when it created the entry and
+`200 {"key":"<hex>"}` when the blob was already there; the body is the same
+either way, so the status is the whole of the difference. An empty body is
+`400 {"error":"empty blob"}` — not a signed anything under any encoding.
+
+`GET` answers, as `application/json`, no-store:
+
+```json
+{ "v": 1, "entries": [ { "key": "<hex sha-256>", "blob": "<base64>" } ] }
+```
+
+`blob` is standard base64 with padding — the alphabet Go's `encoding/json`
+reads a `[]byte` field in, so a daemon's struct decodes it with no help. **No
+order is promised.** Storage hands entries back sorted by key, which is to say
+by digest, which is to say by nothing; a reader that inferred "newest last"
+would be reading a property of SHA-256. Ordering that means anything lives
+inside the blobs, in `iat`, where a reader that has checked a signature can
+trust it. Neither is any *ranking* the relay's: a revocation outranks a device
+cert for the same key whatever their timestamps, and that is a rule about
+meaning, which readers hold and the relay does not.
+
+**The push socket** carries one binary message per new entry, and that message
+is exactly the blob's bytes — no envelope, no key, no framing, for the reason
+the whole leg is unframed. The fan-out reaches every connected daemon including
+the one whose machine made the PUT (an HTTP request carries no socket identity,
+and a push a receiver already holds is a no-op). Duplicates push nothing: the
+set did not change.
+
+Unlike `/daemon`, there is no takeover here: every machine in the fleet holds
+one of these at once, which is the point. At most 256 are held, answered
+`503 {"error":"too many directory sockets"}` over that — not a DoS bound, since
+the leg is secret-gated, but a bound on what one PUT costs, which is one send
+per socket.
+
+Pushes are best effort, and the socket is **push-only** — a write is `PUT
+/directory`, an HTTP request that answers with the key it filed, so any message
+from a daemon on this socket other than the keepalive below is a protocol error
+and closes it with `1002`. A daemon converges the rest of the way by reading
+`GET /directory`, and the order that closes the gap is: **open the socket
+first, then GET.** A write that lands in between arrives by one path or the
+other — or by both, which content addressing makes harmless.
+
+**Bounds.** The directory is written by secret-holders and readable without a
+credential, so it is bounded at both ends: a blob is at most **4 KiB**
+(`413 {"error":"blob too large"}`), and the directory holds at most **512**
+entries. At the cap a PUT of a new blob is refused with
+`507 {"error":"directory full"}` — its own status, so a daemon can tell "your
+blob is fine and I will not keep it" from a 413 or a 401 without reading prose
+— while a PUT of a blob already stored still answers 200, because it asks for
+no room. The refusal precedes the store and therefore the fan-out: a refused
+blob is not kept and is **not pushed to any connected daemon**, because the
+push socket carries new entries and a refusal creates none. A revocation
+refused here has reached nobody.
+
+Refusing rather than evicting is deliberate and is a security decision, not a
+capacity one. Every eviction policy can drop a revocation, and a directory that
+silently forgets a revocation re-admits the device it revoked to every machine
+that had not yet heard. Nothing in this leg ever deletes *an* entry.
+
+Nor does it need to. The only entry that can ever be superseded is a machine
+certificate a machine re-minted, which is single digits out of 512 in the life
+of a fleet — a revocation is never superseded, and a device certificate is not
+in the store at all. `spec/fleet-trust.md` works the count through and declines
+to build pruning on the strength of it. If it is ever wanted anyway, it has to
+be a decision signed under the fleet key and carried out by something that can
+read what it is deleting. That is not the relay, and it must not become the
+relay.
+
+**The reset**, and why the cap needs one. Refusal is permanent: nothing evicts,
+the object is named by a constant, and Durable Object storage survives every
+redeploy of the script — so a directory that has reached 512 stays there
+forever, and a fleet whose directory is full is a fleet whose *revocations* have
+stopped crossing machines. `DELETE /directory` is the way out. It empties the
+whole set and the entry count, answers `200 {"reset":true,"removed":<n>}`, and
+closes every push socket with `1012` so that each daemon reconnects and
+re-publishes at once rather than at its next half-hourly republish.
+
+All-or-nothing is what makes it a thing a relay may do: a wipe needs no opinion
+about what any blob means, where a prune would need the fleet key. It is gated
+by the daemon secret — the same credential a PUT presents, held by exactly the
+machines that could fill the directory in the first place — and it is
+`flue relay reset` on the operator's side.
+
+Convergence after a reset is the daemons' own: each re-offers everything it
+holds on every connect and every 30 minutes, so the fleet refills the set. The
+residual, which readers of this spec are owed: **a blob whose only remaining
+holder never reconnects is lost by a wipe** — in practice a revocation
+published by a machine that has since been decommissioned. Every machine that
+already ingested it still holds it and re-publishes it, so the window is narrow;
+it is not zero, and re-revoking from any surviving machine closes it.
+
 ## Keepalive
 
-Either leg may send the **text** frame `flue-ping`; the Cloudflare edge answers
+Any socket the relay holds — either leg of a machine hub, and the directory
+socket — may send the **text** frame `flue-ping`; the Cloudflare edge answers
 `flue-pong` from the Durable Object's auto-response, without waking it. No leg
 ever has to answer a ping itself — the edge does, so neither the daemon nor a
 browser sees one — and a received `flue-pong` is dropped silently. Neither
 string ever carries a channel header: they are text frames, and everything
-channel-framed is binary. Any other text frame on either socket is a protocol
-error.
+channel-framed is binary. Any other text frame is a protocol error, on all
+three.
 
 This is the one place the relay adds something `spec/protocol.md` says does not
 exist ("WebSocket ping/pong frames only. There is no application-level ping").
@@ -181,10 +396,18 @@ Object bounds it directly: a cap on concurrent channels, a deadline on
 completing the handshake, after which the channel is closed, and a cap on the
 size of one client message.
 
+The directory's legs are gated by the same one secret: `PUT /directory` and the
+`/directory` upgrade present the bearer, and `GET /directory` presents nothing,
+for the same reason `/client` presents nothing — what the directory holds is
+signed, public by design, and worthless to forge without the fleet key. The
+secret is what says who may *write*, and it is all the Worker has to say it
+with, since it cannot verify a single blob it stores.
+
 Both legs, and `POST /api/pair`, carry a **machine id** in the path —
 `/daemon/<id>`, `/client/<id>`, `/api/pair/<id>` — and the Worker routes on it:
 `idFromName(id)` selects that machine's Durable Object, and the hub receives
-the bare prefix, never the id. The id is **self-certifying**:
+the bare prefix, never the id. (`/directory` carries none: one relay is one
+fleet, so its object's name is a constant.) The id is **self-certifying**:
 
 ```
 machine-id  =  <slug> "-" <tag>
@@ -221,11 +444,15 @@ The tag changes none of that — it authenticates the *mint*, not the caller.
 The real id is semi-public (it rides pairing links), and the Worker bills
 every request before any of this runs, so the credential-less routes also sit
 behind a **rate rule**: one Cloudflare rate-limiting binding, keyed by
-connecting IP, over `/client/*` and `POST /api/pair/*` — 300 requests per
+connecting IP, over `/client/*`, `POST /api/pair/*` and every request to
+`/directory` that does not present the secret — 300 requests per
 60 s per IP per Cloudflare location, answered `429 {"error":"rate limited"}`
 over it. Generous enough that a fleet of tabs never sees it; tight enough
-that burning quota, or walking the tag space, needs a botnet. The daemon leg
-is not rate limited: it is secret-gated and one socket per machine. The rule
+that burning quota, or walking the tag space, needs a botnet. The daemon legs
+are not rate limited: they are secret-gated, one socket per machine. The
+metering on `/directory` is decided by the credential rather than the method
+on purpose — otherwise an anonymous caller waving an `Upgrade` header would
+have a cheaper road to the 401 than the metered `GET` beside it. The rule
 is fail-open by design — a Worker deployed without the binding routes rather
 than refuses — because it bounds cost, not access.
 
@@ -255,8 +482,27 @@ observe is:
 - who is connected, when, and for how long;
 - channel ids, message counts and message sizes — enough for traffic analysis
   of a session, not its content;
-- the whole pairing exchange: the single-use pairing token, the device's public
-  key, and the daemon's.
+- the whole pairing exchange, when it goes through the relay: the single-use
+  pairing token, the device's public key and the label its owner typed, the
+  daemon's key, and — in the answer — the device certificate the ceremony
+  minted. `POST /api/pair` is parked and forwarded in cleartext by the hub;
+  taking device certificates out of the directory did **not** change this, and
+  nothing else could, since the request is the ceremony;
+- everything in the fleet directory: machine ids and display names, and who
+  revoked what and when. The blobs are opaque to the *code* and not to the
+  operator of the machine running it. The relay already routed by machine id,
+  so the delta is machine names and the revocation history.
+
+**The distinction between those last two is the one the directory's design
+turns on, and it is easy to blur.** A device certificate is seen by the relay
+*operator* either way, because a relayed pairing transits their Worker. What
+keeping it out of the directory removes is a different exposure: `GET
+/directory` needs no credential, so a published certificate was readable by
+anybody who learned the relay's address — a roster of the operator's device
+keys and the human labels beside them, on the open internet, permanently. The
+change is "not published to strangers", not "not seen by the operator". One
+operator on their own Worker is why the operator's own view is acceptable, and
+`docs/RELAY.md` states both halves rather than leaving either to be discovered.
 
 Public-key material is public by design. The **token is not**: a hostile relay
 could spend a live one with a key of its own and register itself as a paired
diff --git a/web/src/client/protocol.ts b/web/src/client/protocol.ts
index 2811bb7..932534f 100644
--- a/web/src/client/protocol.ts
+++ b/web/src/client/protocol.ts
@@ -323,6 +323,19 @@ export interface Welcome {
   caps?: string[]
   /** Absent when this daemon is not configured for a relay. See RelayInfo. */
   relay?: RelayInfo
+  /**
+   * This device's own fleet certificate, base64 — the blob it presents to
+   * machines it has never paired with (spec/fleet-trust.md, rule 2).
+   *
+   * It rides every welcome rather than being fetched, and that is the whole of
+   * how a browser gets one after the ceremony that minted it: the socket is
+   * inside Noise and the far end has already proved it holds the key the
+   * certificate names, so this is the private, authenticated channel the public
+   * `GET /directory` used to stand in for. Absent on a loopback connection
+   * (no device identity), on a daemon with no fleet key, and for a device
+   * paired before that key existed.
+   */
+  fleetCert?: string
 }
 
 export interface Sessions {
diff --git a/web/src/components/cloudflare-connect.tsx b/web/src/components/cloudflare-connect.tsx
index 9deb378..1cf9eaf 100644
--- a/web/src/components/cloudflare-connect.tsx
+++ b/web/src/components/cloudflare-connect.tsx
@@ -59,6 +59,32 @@ export interface RelayUIInfo {
   deployed_version?: string
   has_token?: boolean
   account_name?: string
+  /**
+   * The fleet directory as this daemon last read it (daemon.DirectoryCounts).
+   * Absent on a daemon that is not reading one at all — no relay, or a relay
+   * config the transport refused — which is a different thing from a
+   * directory it is reading and cannot reach.
+   */
+  directory?: DirectoryCounts
+}
+
+/**
+ * What one read of the fleet directory found.
+ *
+ * `connected` is whether this daemon is holding the directory socket right
+ * now; the counts are the last snapshot read on it, so they mean nothing
+ * without it. `entries` is what the relay claimed to be holding and `verified`
+ * is how much of that this fleet's key actually signed — the gap is the only
+ * interesting number here, and it is a rotated fleet key or a relay belonging
+ * to another fleet.
+ */
+export interface DirectoryCounts {
+  connected: boolean
+  entries: number
+  verified: number
+  machines: number
+  devices: number
+  revocations: number
 }
 
 interface DeployResult {
diff --git a/web/src/crypto/cert.test.ts b/web/src/crypto/cert.test.ts
new file mode 100644
index 0000000..e8d86d3
--- /dev/null
+++ b/web/src/crypto/cert.test.ts
@@ -0,0 +1,244 @@
+import { ed25519 } from '@noble/curves/ed25519.js'
+import { describe, expect, it } from 'vitest'
+
+import fixture from '../../../testdata/fleet/certs.json'
+import { FLEET_SEED } from '@/testing/fleet'
+import { encodeCert, keyHex, verifyCert, type Cert } from './cert'
+
+const unhex = (s: string) => new Uint8Array((s.match(/.{2}/g) ?? []).map((b) => parseInt(b, 16)))
+
+const FLEET_PUB = unhex(fixture.publicKeyHex)
+
+/** The fixture's `cert` object in this module's shape. */
+function certOf(c: (typeof fixture.cases)[number]['cert']): Cert {
+  switch (c.kind) {
+    case 'machine':
+      return {
+        kind: 'machine',
+        id: c.id!,
+        name: c.name!,
+        noise: unhex(c.noiseHex!),
+        iat: c.iat,
+      }
+    case 'device':
+      return {
+        kind: 'device',
+        device: unhex(c.deviceHex!),
+        name: c.name!,
+        pairedOn: c.pairedOn!,
+        iat: c.iat,
+      }
+    default:
+      return { kind: 'revoke', device: unhex(c.deviceHex!), iat: c.iat }
+  }
+}
+
+/**
+ * The cross-language contract. testdata/fleet/certs.json is generated from
+ * internal/fleet (`go test ./internal/fleet/ -update`) and this suite is the
+ * other party to it: the same fields must encode to the same canonical bytes,
+ * and the same signed blob must verify under the same key. A failure here is
+ * not a broken test — it is a browser that would refuse the certificates its
+ * own daemons mint, or admit ones they would not.
+ */
+describe('the fleet certificate encoding against the shared fixture', () => {
+  for (const c of fixture.cases) {
+    it(`encodes ${c.name} to the canonical bytes Go signs`, () => {
+      expect(keyHex(encodeCert(certOf(c.cert)))).toBe(c.canonicalHex)
+    })
+
+    it(`verifies ${c.name} under the fleet public key`, () => {
+      const cert = verifyCert(FLEET_PUB, unhex(c.signedHex))
+      expect(cert).not.toBeNull()
+      expect(cert!.kind).toBe(c.cert.kind)
+      expect(cert!.iat).toBe(c.cert.iat)
+    })
+
+    it(`refuses ${c.name} under another key`, () => {
+      // One flipped bit in the verifying key, which is the whole of what
+      // "signed by the fleet" means. Everything else about the blob is intact.
+      const other = new Uint8Array(FLEET_PUB)
+      other[0] = other[0]! ^ 1
+      expect(verifyCert(other, unhex(c.signedHex))).toBeNull()
+    })
+
+    it(`refuses ${c.name} with a byte cut off the end`, () => {
+      const blob = unhex(c.signedHex)
+      expect(verifyCert(FLEET_PUB, blob.subarray(0, blob.length - 1))).toBeNull()
+    })
+
+    it(`refuses ${c.name} with a byte appended`, () => {
+      // The canonical part is self-delimiting, so anything after the 64-byte
+      // signature is a signed statement somebody has added to — and the
+      // signature covers none of the addition.
+      const blob = unhex(c.signedHex)
+      const longer = new Uint8Array(blob.length + 1)
+      longer.set(blob)
+      expect(verifyCert(FLEET_PUB, longer)).toBeNull()
+    })
+
+    it(`refuses ${c.name} with one field byte flipped`, () => {
+      const blob = unhex(c.signedHex)
+      // Byte 20 is inside the fields for every kind: past the 16-byte prefix,
+      // the version and the kind byte.
+      blob[20] = blob[20]! ^ 1
+      expect(verifyCert(FLEET_PUB, blob)).toBeNull()
+    })
+  }
+
+  it('reads every field of the machine certificate', () => {
+    const c = fixture.cases.find((x) => x.name === 'machine')!
+    const cert = verifyCert(FLEET_PUB, unhex(c.signedHex))
+    expect(cert).toMatchObject({
+      kind: 'machine',
+      id: c.cert.id,
+      name: c.cert.name,
+      iat: c.cert.iat,
+    })
+    expect(keyHex((cert as { noise: Uint8Array }).noise)).toBe(c.cert.noiseHex)
+  })
+
+  it('reads every field of the device certificate', () => {
+    const c = fixture.cases.find((x) => x.name === 'device')!
+    const cert = verifyCert(FLEET_PUB, unhex(c.signedHex))
+    expect(cert).toMatchObject({
+      kind: 'device',
+      name: c.cert.name,
+      pairedOn: c.cert.pairedOn,
+      iat: c.cert.iat,
+    })
+    expect(keyHex((cert as { device: Uint8Array }).device)).toBe(c.cert.deviceHex)
+  })
+
+  it('round-trips a name with astral characters in it', () => {
+    // The unicode case is in the fixture because a length prefix counting
+    // UTF-16 units instead of UTF-8 bytes passes every ASCII case there is.
+    const c = fixture.cases.find((x) => x.name === 'device-unicode-name')!
+    const cert = verifyCert(FLEET_PUB, unhex(c.signedHex))
+    expect((cert as { name: string }).name).toBe(c.cert.name)
+    expect(keyHex(encodeCert(certOf(c.cert)))).toBe(c.canonicalHex)
+  })
+})
+
+describe('what the fleet certificate reader refuses', () => {
+  const signed = unhex(fixture.cases[0]!.signedHex)
+
+  it('an empty blob', () => {
+    expect(verifyCert(FLEET_PUB, new Uint8Array(0))).toBeNull()
+  })
+
+  it('a blob that does not open with the domain separator', () => {
+    const blob = new Uint8Array(signed)
+    blob[0] = blob[0]! ^ 1
+    expect(verifyCert(FLEET_PUB, blob)).toBeNull()
+  })
+
+  it('a version this reader does not speak', () => {
+    const blob = new Uint8Array(signed)
+    blob[16] = 2
+    expect(verifyCert(FLEET_PUB, blob)).toBeNull()
+  })
+
+  it('a kind byte with no meaning', () => {
+    const blob = new Uint8Array(signed)
+    blob[17] = 9
+    expect(verifyCert(FLEET_PUB, blob)).toBeNull()
+  })
+
+  it('a fleet key that is not 32 bytes', () => {
+    expect(verifyCert(FLEET_PUB.subarray(0, 31), signed)).toBeNull()
+  })
+
+  it('a string field whose length reaches past the blob', () => {
+    // The machine cert opens with str(id). A length of 0xFFFF is inside the
+    // encoder's own ceiling only if the ceiling is not applied; either way it
+    // reaches past the bytes that carried it.
+    const blob = new Uint8Array(signed)
+    blob[18] = 0xff
+    blob[19] = 0xff
+    expect(verifyCert(FLEET_PUB, blob)).toBeNull()
+  })
+})
+
+describe('the encoder refuses what it cannot faithfully sign', () => {
+  const key = new Uint8Array(32).fill(7)
+
+  it('a key that is not 32 bytes', () => {
+    expect(() => encodeCert({ kind: 'revoke', device: key.subarray(0, 31), iat: 1 })).toThrow()
+  })
+
+  it('a negative timestamp', () => {
+    expect(() => encodeCert({ kind: 'revoke', device: key, iat: -1 })).toThrow()
+  })
+
+  it('a string over the shared ceiling', () => {
+    expect(() =>
+      encodeCert({ kind: 'machine', id: 'a'.repeat(513), name: '', noise: key, iat: 1 }),
+    ).toThrow()
+  })
+
+  it('a name carrying an unpaired surrogate', () => {
+    // TextEncoder would write U+FFFD for it — different bytes than the caller
+    // named, under a signature that would then cover them.
+    expect(() =>
+      encodeCert({ kind: 'machine', id: 'm', name: '\uD800', noise: key, iat: 1 }),
+    ).toThrow()
+  })
+
+  it('a timestamp past 2^53, which Go would sign and a number cannot carry', () => {
+    // The one place the two encoders deliberately disagree. Go's appendIAT
+    // takes anything up to 2^62; a JavaScript number stops being exact at
+    // 2^53, so a value above it has already been rounded by the time it
+    // arrives here and signing it would cover bytes nobody named. Refusing is
+    // the safe direction, and it costs nothing: the browser signs nothing, and
+    // 2^53 seconds is nine million years out.
+    expect(() =>
+      encodeCert({ kind: 'revoke', device: key, iat: Number.MAX_SAFE_INTEGER + 2 }),
+    ).toThrow(/2\^53/)
+    // The boundary itself still encodes.
+    expect(() =>
+      encodeCert({ kind: 'revoke', device: key, iat: Number.MAX_SAFE_INTEGER }),
+    ).not.toThrow()
+  })
+})
+
+describe('the reader and Go agree about iat exactly', () => {
+  // The asymmetry above is in the *encoders* only. The decoders share one
+  // ceiling — 2^62, Go's maxIAT — and they have to: a reader that refused what
+  // a daemon accepts would drop real certificates off the directory, and one
+  // that accepted more would hand a caller a value Go's own Verify rejects.
+  //
+  // Signed properly, because this is about what a reader *accepts*, and a blob
+  // that fails the signature would answer null for the wrong reason. The
+  // canonical bytes are built with a placeholder iat and the field overwritten
+  // before signing, which is the only way to reach values this module's own
+  // encoder refuses to write.
+  const key = new Uint8Array(32).fill(7)
+
+  function signedWithIAT(raw: bigint): Uint8Array {
+    const canonical = encodeCert({ kind: 'revoke', device: key, iat: 1 })
+    new DataView(canonical.buffer, canonical.byteOffset, canonical.length).setBigUint64(
+      canonical.length - 8,
+      raw,
+    )
+    const sig = ed25519.sign(canonical, FLEET_SEED)
+    const blob = new Uint8Array(canonical.length + sig.length)
+    blob.set(canonical)
+    blob.set(sig, canonical.length)
+    return blob
+  }
+
+  it('accepts an iat far above 2^53, which the encoder here would not write', () => {
+    const cert = verifyCert(FLEET_PUB, signedWithIAT(1n << 60n))
+    expect(cert?.kind).toBe('revoke')
+    // Read back as a Number, which is lossy above 2^53 and documented to be:
+    // iat is display, never precedence — a revocation outranks a device
+    // certificate whatever either one says.
+    expect(cert?.iat).toBe(Number(1n << 60n))
+  })
+
+  it('accepts exactly 2^62 and refuses one more, as Go does', () => {
+    expect(verifyCert(FLEET_PUB, signedWithIAT(1n << 62n))?.kind).toBe('revoke')
+    expect(verifyCert(FLEET_PUB, signedWithIAT((1n << 62n) + 1n))).toBeNull()
+  })
+})
diff --git a/web/src/crypto/cert.ts b/web/src/crypto/cert.ts
new file mode 100644
index 0000000..c683bcb
--- /dev/null
+++ b/web/src/crypto/cert.ts
@@ -0,0 +1,404 @@
+/*
+ * The fleet's certificates, as a browser reads them.
+ *
+ * One Ed25519 keypair per relay signs three kinds of statement — a machine
+ * naming itself and its Noise static key, a pairing ceremony naming the device
+ * key it admitted, and a revocation naming a device key that is dead
+ * (spec/fleet-trust.md, Certificates). This module is the reader's half of
+ * that: `internal/fleet` in Go is the other, and testdata/fleet/certs.json is
+ * what keeps the two from drifting.
+ *
+ * The browser verifies and never signs. It holds the fleet *public* key —
+ * pinned from the pairing link, see crypto/keys.ts — and the private half
+ * never leaves the machines. So everything here is a decision about bytes
+ * somebody else produced: a blob off a credential-less `GET /directory`, or
+ * one this browser stored earlier. Every fault ends the same way, with null,
+ * because the reasons are not the reader's business — a blob a hostile relay
+ * chose is not owed a diagnosis.
+ *
+ * The canonical encoding, byte for byte (the layout is fixed by
+ * internal/fleet's package comment; this is the same document):
+ *
+ *   "flue-fleet-cert/"     16 ASCII bytes of domain separation
+ *   u8  v                  1
+ *   u8  kind               1 machine, 2 device, 3 revoke
+ *   then, per kind, in this order:
+ *     machine:  str(id)  str(name)  key32(noise)   u64(iat)
+ *     device:   key32(device)  str(name)  str(pairedOn)  u64(iat)
+ *     revoke:   key32(device)  u64(iat)
+ *
+ *   str    = u16 big-endian byte length, then that many bytes of UTF-8
+ *   key32  = exactly 32 raw bytes, no length prefix
+ *   u64    = 8 bytes big-endian
+ *
+ * The signature covers exactly the canonical bytes, and the signed blob is
+ * canonical || signature. The canonical part is self-delimiting, so whatever
+ * follows the fields must be exactly 64 bytes of signature: a blob with one
+ * byte more or fewer is refused, which is what stops anything being appended
+ * to a signed statement.
+ */
+import { ed25519 } from '@noble/curves/ed25519.js'
+
+/** The 16 ASCII bytes every canonical encoding opens with. */
+const PREFIX = 'flue-fleet-cert/'
+
+/** The one version this module writes and accepts. */
+const VERSION = 1
+
+/** Kind bytes, in the order the spec lists the kinds. */
+const KIND_MACHINE = 1
+const KIND_DEVICE = 2
+const KIND_REVOKE = 3
+
+/**
+ * The ceiling on every string field, on the way in and on the way out.
+ *
+ * The same 512 as Go's `maxStringBytes`, and it has to be the same: a reader
+ * whose ceiling was lower would refuse a certificate the daemons honour, and
+ * one whose ceiling was higher would read a length off an unauthenticated blob
+ * and believe it.
+ */
+const MAX_STRING_BYTES = 512
+
+/**
+ * The ceiling on `iat` when *reading*, matching Go's `maxIAT` exactly so the
+ * two decoders accept the same set of blobs. Unix seconds do not reach 2^62;
+ * anything at or above it is not a time.
+ */
+const MAX_IAT = 1n << 62n
+
+/**
+ * The ceiling on `iat` when *writing*, which is lower than the one above — and
+ * deliberately, rather than by omission.
+ *
+ * The two decoders agree exactly at 2^62. The two encoders do not: Go's
+ * `appendIAT` will sign anything up to 2^62, and this one refuses above 2^53.
+ * The asymmetry is real and it is the safe direction, because it is a fact
+ * about the language rather than about the format. A `number` cannot hold an
+ * integer above 2^53 exactly, so an `iat` of 2^60 + 1 arriving here is already
+ * a different value from the one the caller meant, and encoding it would put
+ * bytes under a signature that nobody asked for. Throwing is the only honest
+ * answer; silently writing the rounded value is the bug this refusal exists to
+ * make impossible.
+ *
+ * Nothing is lost by it. This encoder exists only so the decoder is tested
+ * against something other than itself (see `encodeCert`), the browser holds no
+ * fleet private key and signs nothing, and no honest `iat` will come within
+ * nine million years of 2^53 seconds. The reading path is where agreement
+ * matters — a reader that refused what a daemon accepts would drop real
+ * certificates — and there the ceilings are identical.
+ */
+const MAX_ENCODABLE_IAT = Number.MAX_SAFE_INTEGER
+
+/** An X25519 public key — the only kind of key a certificate names. */
+const KEY_BYTES = 32
+
+/** An Ed25519 signature, and an Ed25519 public key. */
+const SIGNATURE_BYTES = 64
+const FLEET_KEY_BYTES = 32
+
+/** A machine naming itself: minted by the machine, for itself, at join time. */
+export interface MachineCert {
+  kind: 'machine'
+  /** The machine id, which is also its slot on the relay: `/client/<id>`. */
+  id: string
+  /** The machine's display name. */
+  name: string
+  /** The daemon's static X25519 public key — what a browser pins to reach it. */
+  noise: Uint8Array
+  /** Unix seconds, for display. Certificates deliberately never expire. */
+  iat: number
+}
+
+/** A pairing ceremony's outcome, naming the device key it admitted. */
+export interface DeviceCert {
+  kind: 'device'
+  device: Uint8Array
+  name: string
+  /** The machine id the ceremony ran on. */
+  pairedOn: string
+  iat: number
+}
+
+/**
+ * The operator killing a device key.
+ *
+ * It permanently outranks any device certificate for the same key, whatever
+ * either one's `iat` says — `iat` is display, not precedence. Readers have to
+ * implement it that way: check the revocations before honouring a device
+ * certificate, and never compare the two by time. `relay/directory.ts` is
+ * where this browser does it.
+ */
+export interface Revocation {
+  kind: 'revoke'
+  device: Uint8Array
+  iat: number
+}
+
+export type Cert = MachineCert | DeviceCert | Revocation
+
+const encoder = new TextEncoder()
+/** `fatal` is the point: Go's decoder refuses a string field that is not
+ *  UTF-8, and a reader that quietly substituted U+FFFD would accept blobs the
+ *  daemons reject. */
+const decoder = new TextDecoder('utf-8', { fatal: true })
+
+/**
+ * The canonical bytes of one certificate — exactly what a signature covers.
+ *
+ * Nothing in the product calls this: the browser holds no fleet private key
+ * and signs nothing. It exists because a decoder tested only against its own
+ * output agrees with itself about a bug, and because testdata/fleet/certs.json
+ * pins `canonicalHex` for every case. Given the fixture's fields this must
+ * produce the fixture's bytes, or this implementation has drifted from Go's.
+ *
+ * It throws rather than returning null, which is the other way round from
+ * `verifyCert` and deliberate: the input here is this module's caller's own
+ * value, not a stranger's bytes, so a field that will not encode is a mistake
+ * worth surfacing.
+ */
+export function encodeCert(cert: Cert): Uint8Array {
+  const parts: Uint8Array[] = [encoder.encode(PREFIX)]
+  switch (cert.kind) {
+    case 'machine':
+      parts.push(
+        new Uint8Array([VERSION, KIND_MACHINE]),
+        str('id', cert.id),
+        str('name', cert.name),
+        key32('noise', cert.noise),
+        u64('iat', cert.iat),
+      )
+      break
+    case 'device':
+      parts.push(
+        new Uint8Array([VERSION, KIND_DEVICE]),
+        key32('device', cert.device),
+        str('name', cert.name),
+        str('pairedOn', cert.pairedOn),
+        u64('iat', cert.iat),
+      )
+      break
+    case 'revoke':
+      parts.push(
+        new Uint8Array([VERSION, KIND_REVOKE]),
+        key32('device', cert.device),
+        u64('iat', cert.iat),
+      )
+      break
+  }
+  return concat(parts)
+}
+
+/**
+ * Read a signed blob and check it under the fleet public key.
+ *
+ * Null for every fault there is: not a certificate, a version this module does
+ * not speak, a kind byte with no meaning, a field cut short, a string that is
+ * not UTF-8, bytes left over after the fields, a signature that does not
+ * verify. One answer for all of them, because a caller walking a directory has
+ * one thing to do with each — drop it — and because the blobs arrive from a
+ * store the relay can serve any way it likes.
+ *
+ * A verified certificate is a statement the fleet key signed and nothing more.
+ * It is not permission: the caller still has to check that a revocation does
+ * not outrank it, and that the key it names is the key it is being used for.
+ */
+export function verifyCert(fleetPub: Uint8Array, blob: Uint8Array): Cert | null {
+  if (fleetPub.length !== FLEET_KEY_BYTES) return null
+  const read = decode(blob)
+  if (read === null) return null
+  const { cert, canonicalLength } = read
+  // Exactly a signature after the fields, never merely at least one. A blob
+  // with trailing bytes is a signed statement somebody has added to, and the
+  // signature covers none of the addition.
+  if (blob.length - canonicalLength !== SIGNATURE_BYTES) return null
+  try {
+    // `zip215: false` asks noble for RFC 8032 verification, which is the rule
+    // Go's crypto/ed25519 implements. The default is ZIP215, whose accept set
+    // is strictly larger — and a browser that admitted a machine the daemons
+    // reject, or the other way round, would be two implementations of one
+    // trust decision.
+    if (!ed25519.verify(blob.subarray(canonicalLength), blob.subarray(0, canonicalLength), fleetPub, { zip215: false })) {
+      return null
+    }
+  } catch {
+    // noble throws on a malformed point or scalar rather than answering false.
+    // Same outcome: this blob is not signed by that key.
+    return null
+  }
+  return cert
+}
+
+// --- encoding primitives ---
+
+function str(field: string, s: string): Uint8Array {
+  if (!wellFormed(s)) {
+    // A JavaScript string may hold an unpaired surrogate, which TextEncoder
+    // would silently write as U+FFFD — different bytes than the caller named,
+    // under a signature that would then cover them.
+    throw new Error(`fleet: ${field} is not well-formed UTF-16`)
+  }
+  const bytes = encoder.encode(s)
+  if (bytes.length > MAX_STRING_BYTES) {
+    throw new Error(`fleet: ${field} is ${bytes.length} bytes, the ceiling is ${MAX_STRING_BYTES}`)
+  }
+  const out = new Uint8Array(2 + bytes.length)
+  new DataView(out.buffer).setUint16(0, bytes.length)
+  out.set(bytes, 2)
+  return out
+}
+
+function key32(field: string, key: Uint8Array): Uint8Array {
+  if (key.length !== KEY_BYTES) {
+    throw new Error(`fleet: ${field} must be ${KEY_BYTES} bytes, got ${key.length}`)
+  }
+  return key
+}
+
+function u64(field: string, value: number): Uint8Array {
+  if (!Number.isInteger(value) || value < 0) {
+    throw new Error(`fleet: ${field} is not a unix time`)
+  }
+  if (value > MAX_ENCODABLE_IAT) {
+    // Go's encoder takes this and this one will not — see MAX_ENCODABLE_IAT.
+    // The value is already inexact by the time it arrives here, so encoding it
+    // would sign bytes the caller did not name.
+    throw new Error(
+      `fleet: ${field} is ${value}, past 2^53 — a JavaScript number cannot carry it exactly, and this encoder will not sign a rounded one`,
+    )
+  }
+  const out = new Uint8Array(8)
+  new DataView(out.buffer).setBigUint64(0, BigInt(value))
+  return out
+}
+
+/** Whether every surrogate in the string is half of a pair. */
+function wellFormed(s: string): boolean {
+  return !/[\uD800-\uDFFF]/.test(s.replace(/[\uD800-\uDBFF][\uDC00-\uDFFF]/g, ''))
+}
+
+function concat(parts: Uint8Array[]): Uint8Array {
+  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0))
+  let at = 0
+  for (const p of parts) {
+    out.set(p, at)
+    at += p.length
+  }
+  return out
+}
+
+// --- decoding ---
+
+/**
+ * A blob walked field by field. Every read is bounds-checked and a short one
+ * ends the parse, so a length taken off the wire can never reach past the
+ * bytes that carried it.
+ */
+class Reader {
+  at = 0
+  constructor(private readonly b: Uint8Array) {}
+
+  take(n: number): Uint8Array | null {
+    if (n < 0 || this.b.length - this.at < n) return null
+    const out = this.b.subarray(this.at, this.at + n)
+    this.at += n
+    return out
+  }
+
+  str(): string | null {
+    const header = this.take(2)
+    if (header === null) return null
+    const n = new DataView(header.buffer, header.byteOffset, 2).getUint16(0)
+    if (n > MAX_STRING_BYTES) return null
+    const raw = this.take(n)
+    if (raw === null) return null
+    try {
+      return decoder.decode(raw)
+    } catch {
+      return null
+    }
+  }
+
+  /** A key, copied out: the certificate outlives the blob it was read from. */
+  key(): Uint8Array | null {
+    const raw = this.take(KEY_BYTES)
+    return raw === null ? null : new Uint8Array(raw)
+  }
+
+  iat(): number | null {
+    const raw = this.take(8)
+    if (raw === null) return null
+    const v = new DataView(raw.buffer, raw.byteOffset, 8).getBigUint64(0)
+    if (v > MAX_IAT) return null
+    // Above 2^53 this loses precision, and that is acceptable where nothing
+    // else would be: `iat` is display, never precedence — a revocation
+    // outranks a device certificate whatever either says — and the ceiling
+    // above is Go's, so this reader refuses nothing a daemon accepts.
+    return Number(v)
+  }
+}
+
+function decode(blob: Uint8Array): { cert: Cert; canonicalLength: number } | null {
+  const r = new Reader(blob)
+  const prefix = r.take(PREFIX.length)
+  if (prefix === null) return null
+  for (let i = 0; i < PREFIX.length; i++) {
+    if (prefix[i] !== PREFIX.charCodeAt(i)) return null
+  }
+  const header = r.take(2)
+  if (header === null || header[0] !== VERSION) return null
+
+  let cert: Cert
+  switch (header[1]) {
+    case KIND_MACHINE: {
+      const id = r.str()
+      const name = r.str()
+      const noise = r.key()
+      const iat = r.iat()
+      if (id === null || name === null || noise === null || iat === null) return null
+      cert = { kind: 'machine', id, name, noise, iat }
+      break
+    }
+    case KIND_DEVICE: {
+      const device = r.key()
+      const name = r.str()
+      const pairedOn = r.str()
+      const iat = r.iat()
+      if (device === null || name === null || pairedOn === null || iat === null) return null
+      cert = { kind: 'device', device, name, pairedOn, iat }
+      break
+    }
+    case KIND_REVOKE: {
+      const device = r.key()
+      const iat = r.iat()
+      if (device === null || iat === null) return null
+      cert = { kind: 'revoke', device, iat }
+      break
+    }
+    default:
+      return null
+  }
+  return { cert, canonicalLength: r.at }
+}
+
+/**
+ * Whether two keys are the same key, without an early exit.
+ *
+ * Everything compared here is a public key — one out of a certificate, one out
+ * of this browser's own store — so there is no secret for a timing channel to
+ * leak. The loop runs to the end anyway, for the reason routes/pair.tsx gives
+ * for its own copy: the cheap spelling of a key comparison teaches the next
+ * reader the wrong habit.
+ */
+export function sameKey(a: Uint8Array, b: Uint8Array): boolean {
+  if (a.length !== b.length) return false
+  let diff = 0
+  for (let i = 0; i < a.length; i++) diff |= a[i]! ^ b[i]!
+  return diff === 0
+}
+
+/** A key as a map key: hex with no capitals, the spelling the directory's own
+ *  entry keys use. */
+export function keyHex(key: Uint8Array): string {
+  return Array.from(key, (b) => b.toString(16).padStart(2, '0')).join('')
+}
diff --git a/web/src/crypto/keys.test.ts b/web/src/crypto/keys.test.ts
index bd1a002..59e1469 100644
--- a/web/src/crypto/keys.test.ts
+++ b/web/src/crypto/keys.test.ts
@@ -4,8 +4,10 @@ import {
   loadOrCreateDeviceKey,
   loadPinnedDaemonKey,
   loadPinnedDaemonKeyFor,
+  loadPinnedFleetKey,
   savePinnedDaemonKey,
   savePinnedDaemonKeyFor,
+  savePinnedFleetKey,
 } from './keys'
 
 describe('the browser device key', () => {
@@ -164,3 +166,54 @@ describe('a daemon key pinned per device', () => {
     expect(await loadPinnedDaemonKeyFor('aaaaaaaaaaaa', db)).toEqual(KEY_B)
   })
 })
+
+describe('the pinned fleet key', () => {
+  const FLEET = new Uint8Array(32).fill(0xf1)
+
+  it('is absent in a browser that has never paired with a fleet', async () => {
+    // An ordinary answer, not a fault: a browser paired before the fleet key
+    // existed reaches the machines it paired with directly and learns of no
+    // others. What it must never do is read the directory without one.
+    expect(await loadPinnedFleetKey(new IDBFactory())).toBeNull()
+  })
+
+  it('round-trips the bytes the pairing link carried', async () => {
+    const db = new IDBFactory()
+    await savePinnedFleetKey(FLEET, db)
+    expect(await loadPinnedFleetKey(db)).toEqual(FLEET)
+  })
+
+  it('refuses a record that is not 32 bytes', async () => {
+    // An Ed25519 public key is 32 bytes. A verifier handed anything else
+    // refuses every certificate, which is a browser that lists no machines —
+    // and this is the honest reading of a record this module never wrote.
+    const db = new IDBFactory()
+    await savePinnedFleetKey(new Uint8Array(31), db)
+    expect(await loadPinnedFleetKey(db)).toBeNull()
+  })
+
+  it('is one record per origin, beside every machine pin', async () => {
+    // A daemon's static key is a fact about one machine; the fleet key is a
+    // fact about the relay in front of all of them. Neither slot is the
+    // other's, under any id.
+    const db = new IDBFactory()
+    const machineKey = new Uint8Array(32).fill(0xaa)
+    await savePinnedDaemonKeyFor('aaaaaaaaaaaa', machineKey, db)
+    await savePinnedFleetKey(FLEET, db)
+
+    expect(await loadPinnedFleetKey(db)).toEqual(FLEET)
+    expect(await loadPinnedDaemonKeyFor('aaaaaaaaaaaa', db)).toEqual(machineKey)
+    expect(await loadPinnedDaemonKey(db)).toBeNull()
+  })
+
+  it('is replaced by a later ceremony, because re-setup mints a new fleet', async () => {
+    // `flue relay setup` mints a fresh fleet key and every device pairs
+    // again. A browser that refused the overwrite would be stranded on a key
+    // nothing signs under any more.
+    const db = new IDBFactory()
+    await savePinnedFleetKey(FLEET, db)
+    const next = new Uint8Array(32).fill(0xf2)
+    await savePinnedFleetKey(next, db)
+    expect(await loadPinnedFleetKey(db)).toEqual(next)
+  })
+})
diff --git a/web/src/crypto/keys.ts b/web/src/crypto/keys.ts
index a729bcd..e84cf2b 100644
--- a/web/src/crypto/keys.ts
+++ b/web/src/crypto/keys.ts
@@ -64,6 +64,39 @@ const DAEMON_RECORD = 'daemon-static'
  */
 const DEVICE_RECORD_PREFIX = 'daemon-static:'
 
+/**
+ * Where the fleet public key is pinned: one record, because one relay origin
+ * is one fleet (spec/fleet-trust.md, "The fleet directory").
+ *
+ * This is the anchor the whole of auto-pairing hangs from. A machine
+ * certificate that verifies under this key is a machine this browser will
+ * dial, pinning the `noise` key that certificate names — so a record that
+ * could be replaced silently would be every machine's static key, decided
+ * once and never asked about again. It is written from the pairing ceremony
+ * and from nowhere else, with a value that arrived in the QR: the one leg no
+ * intermediary can sit in.
+ *
+ * The Ed25519 *public* half only. The seed rides the join line between
+ * machines and never reaches a browser — a browser holding it could mint
+ * certificates for the fleet, which is the one thing the layering in
+ * spec/fleet-trust.md exists to keep out of Cloudflare's reach and out of a
+ * tab's.
+ *
+ * Per origin rather than per machine, unlike `DEVICE_RECORD_PREFIX`, and the
+ * difference is not an inconsistency: a daemon's static key is a fact about
+ * one machine, and the fleet key is a fact about the relay in front of all of
+ * them. IndexedDB is already scoped to the origin, so one record here is one
+ * fleet key per relay.
+ */
+const FLEET_RECORD = 'fleet-public'
+
+/**
+ * This device's own fleet certificate, per origin like the fleet key that
+ * verifies it. See `savePinnedDeviceCert` for why it is kept rather than read
+ * off the relay.
+ */
+const DEVICE_CERT_RECORD = 'fleet-device-cert'
+
 const openDb = (factory: IDBFactory) =>
   new Promise<IDBDatabase>((resolve, reject) => {
     const req = factory.open(DB_NAME, 1)
@@ -177,6 +210,120 @@ export async function loadPinnedDaemonKeyFor(
   return read(`${DEVICE_RECORD_PREFIX}${deviceId}`, factory)
 }
 
+/**
+ * Pin the fleet this browser has just joined, from the `f=` in the pairing
+ * link.
+ *
+ * Called from the same moment, and on the same evidence, as
+ * `savePinnedDaemonKeyFor`: the user carried a code across from a screen they
+ * physically control, and both keys were read out of it. What this one buys is
+ * every *other* machine — the directory names them, this key is what makes
+ * their certificates mean anything, and neither the relay nor anything sitting
+ * in front of it can produce one.
+ *
+ * Overwrites, for the reason the daemon pin does: re-pairing is how a browser
+ * moves to another fleet, and re-setup (`flue relay setup`) mints a fresh
+ * fleet key that every device then pairs against. A browser that refused the
+ * overwrite would be stranded on a key nothing signs under any more, with
+ * clearing site data as the only way back.
+ *
+ * Which puts the same weight on the caller: only a key that arrived in the
+ * link may be written here. A fleet key taken from an answer over the wire
+ * would be the trust-on-first-use the pinning exists to end, one level up —
+ * whoever supplied it could then mint a machine certificate for every machine
+ * this browser will ever dial.
+ */
+export async function savePinnedFleetKey(
+  publicKey: Uint8Array,
+  factory: IDBFactory = indexedDB,
+): Promise<void> {
+  const db = await openDb(factory)
+  try {
+    await tx(db, 'readwrite', (s) => s.put({ publicKey }, FLEET_RECORD))
+  } finally {
+    db.close()
+  }
+}
+
+/**
+ * The pinned fleet public key, or null in a browser that has never paired
+ * with a fleet.
+ *
+ * Null is an ordinary answer, not a fault: a browser paired before the fleet
+ * key existed, or with a daemon that holds none, reaches every machine it
+ * paired with directly and learns of no others. What it must never do is read
+ * the directory without one — an unverifiable machine list is a relay naming
+ * whatever machines it likes.
+ */
+export async function loadPinnedFleetKey(
+  factory: IDBFactory = indexedDB,
+): Promise<Uint8Array | null> {
+  return read(FLEET_RECORD, factory)
+}
+
+/**
+ * Keep this device's own fleet certificate — the signed blob it presents to
+ * every machine it has not paired with by hand.
+ *
+ * Stored rather than fetched, and that is the change this record represents.
+ * The certificate used to be read out of the relay's credential-less
+ * `GET /directory`, which meant every device's public key and human label sat
+ * in a document anybody could read, and every pairing ceremony ever performed
+ * spent one of the directory's 512 permanent entries. It now arrives over
+ * channels that are already private and already authenticated — in the pairing
+ * answer, and again in the welcome of every *relayed* connection — so the
+ * public copy buys nothing.
+ *
+ * The second delivery is a relay-tab property and not a universal one, which
+ * is worth knowing before relying on it: a loopback connection authenticates a
+ * machine-local session token rather than a device key, so the daemon does not
+ * know whose certificate to send and sends none (internal/daemon/server.go,
+ * fleetCertFor). A browser paired only over loopback holds what the ceremony
+ * wrote here and has no second source for it.
+ *
+ * It is public data either way: a certificate is a signed statement about a
+ * public key, and holding one grants nothing without the private half of the
+ * device key beside it in this same store. What this record protects is not
+ * secrecy but *supply* — a browser that cannot produce its certificate cannot
+ * reach a machine it never paired with.
+ *
+ * Per origin, like the fleet key it verifies under: a certificate signed by one
+ * fleet means nothing to another, and the two records are only ever read
+ * together.
+ *
+ * Callers must verify it under the pinned fleet key before writing it. This
+ * function does not, deliberately — it is storage, and crypto/cert.ts is where
+ * signatures are checked — but a caller that skipped the check would be keeping
+ * whatever the far end said, and presenting it later to a machine that will
+ * check it properly and refuse.
+ */
+export async function savePinnedDeviceCert(
+  cert: Uint8Array,
+  factory: IDBFactory = indexedDB,
+): Promise<void> {
+  const db = await openDb(factory)
+  try {
+    await tx(db, 'readwrite', (s) => s.put({ publicKey: cert }, DEVICE_CERT_RECORD))
+  } finally {
+    db.close()
+  }
+}
+
+/**
+ * This device's fleet certificate, or null when it has none.
+ *
+ * Null is an ordinary answer and not a fault: a browser paired with a daemon
+ * that held no fleet key, or before this machine had a place on the relay, has
+ * none — and reaches every machine it paired with directly, exactly as it
+ * always did. What it cannot do without one is walk into a machine it has never
+ * met, which is the thing a certificate is for.
+ */
+export async function loadPinnedDeviceCert(
+  factory: IDBFactory = indexedDB,
+): Promise<Uint8Array | null> {
+  return readBlob(DEVICE_CERT_RECORD, factory)
+}
+
 /**
  * Drop the key pinned for one machine.
  *
@@ -215,8 +362,36 @@ async function read(record: string, factory: IDBFactory): Promise<Uint8Array | n
     // Absent is the honest reading of a record this module could never have
     // written: the boot fails closed into the picker, where pairing again is
     // on offer, instead of open into a loop nothing on screen explains.
+    //
+    // The fleet key is the same 32 bytes and fails the same way closed: a
+    // verifier handed a key of the wrong width refuses every certificate,
+    // which is a browser that lists no machines rather than one that trusts
+    // the wrong ones.
     return key.length === KEY_BYTES ? key : null
   } finally {
     db.close()
   }
 }
+
+/**
+ * One record read as an opaque blob: no width check, because a certificate is
+ * not a key and has no fixed length.
+ *
+ * It shares `read`'s copy-out rule for the same reason, and stops there. What
+ * makes a stored certificate trustworthy is its signature under the pinned
+ * fleet key, which crypto/cert.ts checks every time it is used — so there is
+ * nothing this function could usefully refuse that the verifier would not.
+ */
+async function readBlob(record: string, factory: IDBFactory): Promise<Uint8Array | null> {
+  const db = await openDb(factory)
+  try {
+    const existing = await tx<{ publicKey: Uint8Array } | undefined>(db, 'readonly', (s) =>
+      s.get(record),
+    )
+    if (!existing) return null
+    const blob = new Uint8Array(existing.publicKey)
+    return blob.length === 0 ? null : blob
+  } finally {
+    db.close()
+  }
+}
diff --git a/web/src/crypto/noise.test.ts b/web/src/crypto/noise.test.ts
index a84e645..85427f2 100644
--- a/web/src/crypto/noise.test.ts
+++ b/web/src/crypto/noise.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import vectors from '../../../testdata/noise/ik.json'
+import payloadVectors from '../../../testdata/noise/ik-payload.json'
 import { initiatorHandshake } from './noise'
 
 const unhex = (s: string) =>
@@ -12,7 +13,7 @@ describe('Noise IK initiator against the shared vectors', () => {
     const hs = initiatorHandshake(
       unhex(vectors.initiatorStaticPriv),
       unhex(vectors.responderStaticPub),
-      unhex(vectors.initiatorEphemeralPriv),
+      { ephemeralPriv: unhex(vectors.initiatorEphemeralPriv) },
     )
     expect(hex(hs.messageA())).toBe(vectors.msg1)
     const ch = hs.readMessageB(unhex(vectors.msg2))
@@ -30,7 +31,7 @@ describe('Noise IK initiator against the shared vectors', () => {
     const hs = initiatorHandshake(
       unhex(vectors.initiatorStaticPriv),
       unhex(vectors.responderStaticPub),
-      unhex(vectors.initiatorEphemeralPriv),
+      { ephemeralPriv: unhex(vectors.initiatorEphemeralPriv) },
     )
     hs.messageA()
     const bad = unhex(vectors.msg2)
@@ -47,7 +48,7 @@ describe('Noise IK initiator against the shared vectors', () => {
     const hs = initiatorHandshake(
       unhex(vectors.initiatorStaticPriv),
       unhex(vectors.initiatorStaticPub),
-      unhex(vectors.initiatorEphemeralPriv),
+      { ephemeralPriv: unhex(vectors.initiatorEphemeralPriv) },
     )
     hs.messageA()
     expect(() => hs.readMessageB(unhex(vectors.msg2))).toThrow()
@@ -57,7 +58,7 @@ describe('Noise IK initiator against the shared vectors', () => {
     const hs = initiatorHandshake(
       unhex(vectors.initiatorStaticPriv),
       unhex(vectors.responderStaticPub),
-      unhex(vectors.initiatorEphemeralPriv),
+      { ephemeralPriv: unhex(vectors.initiatorEphemeralPriv) },
     )
     hs.messageA()
     const ch = hs.readMessageB(unhex(vectors.msg2))
@@ -66,3 +67,48 @@ describe('Noise IK initiator against the shared vectors', () => {
     expect(() => ch.open(unhex(r2i.ciphertext))).toThrow()
   })
 })
+
+/**
+ * The same handshake with the payload slot filled, against
+ * testdata/noise/ik-payload.json — the vector that pins what a fleet device
+ * actually sends.
+ *
+ * `msg1Payload` there is the signed device certificate from
+ * testdata/fleet/certs.json, byte for byte, and `msg1` is what the Go
+ * responder reads it out of. So this is the one test that ties the two
+ * fixtures together: a certificate encoder that drifted, or an initiator that
+ * sealed the wrong bytes, cannot reproduce `msg1`.
+ */
+describe('Noise IK initiator carrying a fleet device certificate', () => {
+  it('reproduces msg1 with the certificate in the payload', () => {
+    const hs = initiatorHandshake(
+      unhex(payloadVectors.initiatorStaticPriv),
+      unhex(payloadVectors.responderStaticPub),
+      {
+        payload: unhex(payloadVectors.msg1Payload),
+        ephemeralPriv: unhex(payloadVectors.initiatorEphemeralPriv),
+      },
+    )
+    expect(hex(hs.messageA())).toBe(payloadVectors.msg1)
+    const ch = hs.readMessageB(unhex(payloadVectors.msg2))
+    for (const m of payloadVectors.transport) {
+      if (m.dir === 'i2r') {
+        expect(hex(ch.seal(unhex(m.plaintext)))).toBe(m.ciphertext)
+      } else {
+        expect(hex(ch.open(unhex(m.ciphertext)))).toBe(m.plaintext)
+      }
+    }
+  })
+
+  it('is a different message A from the empty-payload one', () => {
+    // The payload is sealed into message A rather than sent beside it, so a
+    // certificate changes the bytes on the wire and the hash the rest of the
+    // handshake is keyed from. A relay reads neither.
+    const empty = initiatorHandshake(
+      unhex(payloadVectors.initiatorStaticPriv),
+      unhex(payloadVectors.responderStaticPub),
+      { ephemeralPriv: unhex(payloadVectors.initiatorEphemeralPriv) },
+    )
+    expect(hex(empty.messageA())).not.toBe(payloadVectors.msg1)
+  })
+})
diff --git a/web/src/crypto/noise.ts b/web/src/crypto/noise.ts
index 18f2f55..158e120 100644
--- a/web/src/crypto/noise.ts
+++ b/web/src/crypto/noise.ts
@@ -118,15 +118,41 @@ export interface InitiatorHandshake {
   readMessageB(msg: Uint8Array): NoiseChannel // <- e, ee, se; throws on any failure
 }
 
+export interface InitiatorOptions {
+  /**
+   * What message A's encrypted payload carries: this device's fleet
+   * certificate, or nothing.
+   *
+   * IK's first message has always had a payload slot and it was always empty.
+   * The fleet fills it (spec/fleet-trust.md, "What changes in the
+   * handshake"): a daemon that has never seen this device's key admits it on
+   * a certificate that verifies under the fleet public key and names exactly
+   * the static key the handshake proves possession of. Nothing else in the
+   * pattern changes, and the payload is sealed like any other — it rides
+   * inside `encryptAndHash`, so a relay reads none of it.
+   *
+   * Absent is the ordinary case for a browser paired to this machine
+   * directly: the daemon finds its key in the local registry and never looks
+   * at the payload (internal/transport/relay/channel.go, rule 1). Sending the
+   * certificate anyway costs nothing and is what carries a device to a
+   * machine it has never met.
+   */
+  payload?: Uint8Array
+  /** Fixed only where a vector is being reproduced; production draws from
+   *  crypto.getRandomValues. */
+  ephemeralPriv?: Uint8Array
+}
+
 export function initiatorHandshake(
   staticPriv: Uint8Array,
   peerStaticPub: Uint8Array,
-  ephemeralPriv?: Uint8Array, // tests only; defaults to crypto.getRandomValues
+  opts: InitiatorOptions = {},
 ): InitiatorHandshake {
   const ss = new SymmetricState()
   const s = { priv: staticPriv, pub: x25519.getPublicKey(staticPriv) }
-  const ePriv = ephemeralPriv ?? crypto.getRandomValues(new Uint8Array(32))
+  const ePriv = opts.ephemeralPriv ?? crypto.getRandomValues(new Uint8Array(32))
   const e = { priv: ePriv, pub: x25519.getPublicKey(ePriv) }
+  const certPayload = opts.payload ?? new Uint8Array(0)
 
   // IK pre-message: the responder's static key is mixed before message A.
   ss.mixHash(new Uint8Array(0)) // prologue (empty)
@@ -145,7 +171,7 @@ export function initiatorHandshake(
       const encS = ss.encryptAndHash(s.pub)
       // -> ss
       ss.mixKey(x25519.getSharedSecret(s.priv, peerStaticPub))
-      const payload = ss.encryptAndHash(new Uint8Array(0))
+      const payload = ss.encryptAndHash(certPayload)
       return concat(e.pub, encS, payload)
     },
     readMessageB(msg) {
diff --git a/web/src/fleet/fleet.test.ts b/web/src/fleet/fleet.test.ts
index 5bc6350..7518376 100644
--- a/web/src/fleet/fleet.test.ts
+++ b/web/src/fleet/fleet.test.ts
@@ -5,11 +5,26 @@ import { x25519 } from '@noble/curves/ed25519.js'
 import vectors from '../../../testdata/noise/ik.json'
 import type { ConnStatus, FlueClient } from '@/client/client'
 import type { ErrorMsg, SessionInfo, Welcome } from '@/client/protocol'
-import { savePinnedDaemonKeyFor } from '@/crypto/keys'
+import {
+  loadOrCreateDeviceKey,
+  loadPinnedDeviceCert,
+  savePinnedDaemonKeyFor,
+  savePinnedDeviceCert,
+  savePinnedFleetKey,
+} from '@/crypto/keys'
 import { saveMachine } from '@/relay/machines'
 import type { RawSocket } from '@/relay/socket'
+import {
+  base64,
+  deviceCert,
+  directoryFetch,
+  FLEET_PUB,
+  machineCert,
+  OTHER_SEED,
+  revocation,
+} from '@/testing/fleet'
 import { responderHandshake } from '@/testing/noise-daemon'
-import { FleetClient, fleetSources, type FleetSource } from './fleet'
+import { adoptFleetCert, FleetClient, fleetSources, type FleetSource } from './fleet'
 import { LOCAL_MACHINE_ID, type FleetSession, type MachineState } from './types'
 
 const unhex = (s: string) => new Uint8Array((s.match(/.{2}/g) ?? []).map((b) => parseInt(b, 16)))
@@ -406,6 +421,113 @@ describe('FleetClient', () => {
     expect(remote.closes).toBe(1)
   })
 
+  /*
+   * The re-supply path, end to end and in one session.
+   *
+   * A browser that boots without its certificate builds sources for the
+   * machines it pinned by hand and skips every machine it can only reach on
+   * the fleet's word. The welcome then hands it one. Before this, that
+   * certificate sat unused until something reloaded the tab — which is
+   * precisely the case re-supply exists for, since a browser missing its
+   * certificate is a browser missing machines.
+   *
+   * `expand` here models the one thing about the real builder that matters:
+   * a machine this browser never paired with is only reachable once there is
+   * a certificate to present to it (fleetSources skips it otherwise).
+   */
+  function certExpand(loft: FakeClient) {
+    return vi.fn(async (origin: string) => {
+      void origin
+      return (await loadPinnedDeviceCert()) === null ? [] : [src('loft-9f9f', 'Loft', loft)]
+    })
+  }
+
+  it('takes the machines a re-supplied certificate unlocks, without a reload', async () => {
+    vi.stubGlobal('indexedDB', new IDBFactory())
+    await savePinnedFleetKey(FLEET_PUB)
+    const key = await loadOrCreateDeviceKey()
+    const cert = deviceCert(key.publicKey, 'phone', 'attic-pi')
+
+    const loft = new FakeClient()
+    const expand = certExpand(loft)
+    const h = harness([[LOCAL_MACHINE_ID, '']], expand)
+    h.fleet.connect()
+    h.fake(LOCAL_MACHINE_ID).open()
+
+    const relay = { status: 'connected' as const, origin: 'https://relay.example' }
+    h.fake(LOCAL_MACHINE_ID).emitWelcome(welcome(relay))
+    await vi.waitFor(() => expect(expand).toHaveBeenCalledTimes(1))
+    // Nothing unlocked: this browser holds no certificate yet.
+    expect(h.last().machines.map((m) => m.id)).toEqual([LOCAL_MACHINE_ID])
+
+    // A later welcome — a reconnect, or another machine saying hello — carries
+    // the blob this device is owed.
+    h.fake(LOCAL_MACHINE_ID).emitWelcome({ ...welcome(relay), fleetCert: base64(cert) })
+    await vi.waitFor(() => expect(expand).toHaveBeenCalledTimes(2))
+    expect(await loadPinnedDeviceCert()).toEqual(cert)
+    expect(loft.connects).toBe(1)
+    expect(h.last().machines.map((m) => m.id)).toEqual([LOCAL_MACHINE_ID, 'loft-9f9f'])
+
+    // And the welcome after that is the same blob again: no third read of the
+    // directory, no second Loft.
+    h.fake(LOCAL_MACHINE_ID).emitWelcome({ ...welcome(relay), fleetCert: base64(cert) })
+    await flush()
+    expect(expand).toHaveBeenCalledTimes(2)
+    expect(loft.connects).toBe(1)
+    h.fleet.close()
+  })
+
+  it('unlocks them even when the certificate rides the welcome that names the relay', async () => {
+    // The ordinary case, and the one that used to pass by luck: both facts
+    // arrive on one welcome, and the expansion is kicked off synchronously
+    // while the certificate is still going through IndexedDB. Whichever wins
+    // that race, the second expansion is what makes the outcome the same.
+    vi.stubGlobal('indexedDB', new IDBFactory())
+    await savePinnedFleetKey(FLEET_PUB)
+    const key = await loadOrCreateDeviceKey()
+    const cert = deviceCert(key.publicKey, 'phone', 'attic-pi')
+
+    const loft = new FakeClient()
+    const expand = certExpand(loft)
+    const h = harness([[LOCAL_MACHINE_ID, '']], expand)
+    h.fleet.connect()
+    h.fake(LOCAL_MACHINE_ID).open()
+    h.fake(LOCAL_MACHINE_ID).emitWelcome({
+      ...welcome({ status: 'connected', origin: 'https://relay.example' }),
+      fleetCert: base64(cert),
+    })
+
+    await vi.waitFor(() => expect(loft.connects).toBe(1))
+    expect(h.last().machines.map((m) => m.id)).toEqual([LOCAL_MACHINE_ID, 'loft-9f9f'])
+    h.fleet.close()
+  })
+
+  it('does not rebuild for a certificate this browser already held', async () => {
+    // A browser that boots *with* one already had every machine it unlocks, so
+    // the welcome that re-offers it is a read and nothing more. This is what
+    // keeps a reconnect from costing a directory fetch.
+    vi.stubGlobal('indexedDB', new IDBFactory())
+    await savePinnedFleetKey(FLEET_PUB)
+    const key = await loadOrCreateDeviceKey()
+    const cert = deviceCert(key.publicKey, 'phone', 'attic-pi')
+    await savePinnedDeviceCert(cert)
+
+    const loft = new FakeClient()
+    const expand = certExpand(loft)
+    const h = harness([[LOCAL_MACHINE_ID, '']], expand)
+    h.fleet.connect()
+    h.fake(LOCAL_MACHINE_ID).open()
+    h.fake(LOCAL_MACHINE_ID).emitWelcome({
+      ...welcome({ status: 'connected', origin: 'https://relay.example' }),
+      fleetCert: base64(cert),
+    })
+
+    await vi.waitFor(() => expect(loft.connects).toBe(1))
+    await flush()
+    expect(expand).toHaveBeenCalledTimes(1)
+    h.fleet.close()
+  })
+
   it('routes update to the named machine and forwards the patch untouched', () => {
     const h = harness([
       ['attic-pi', 'Attic Pi'],
@@ -676,3 +798,334 @@ describe('fleetSources', () => {
     expect(sources.map((s) => s.id)).toEqual([LOCAL_MACHINE_ID, 'attic-pi'])
   })
 })
+
+// ---------------------------------------------------------------------------
+// fleetSources against the fleet directory: a machine that joined the relay
+// long after this browser paired, appearing without a ceremony.
+// ---------------------------------------------------------------------------
+
+/** The machine nobody here ever paired with, and the key its certificate
+ *  names — the whole of what a browser needs to reach it. */
+const LOFT_PRIV = new Uint8Array(32).fill(0x5c)
+const LOFT_PUB = x25519.getPublicKey(LOFT_PRIV)
+
+describe('fleetSources with a fleet directory', () => {
+  beforeEach(() => {
+    localStorage.clear()
+    sessionStorage.clear()
+    vi.stubGlobal('indexedDB', new IDBFactory())
+  })
+
+  /** This browser's own device key, as the pairing ceremony would have made
+   *  it — the key the fleet's device certificate has to name. */
+  const devicePub = async () => (await loadOrCreateDeviceKey()).publicKey
+
+  /**
+   * The certificate this browser holds, put where it now comes from: its own
+   * key store, written by the pairing answer or by a welcome
+   * (fleet.ts, adoptFleetCert). It used to be fished out of `GET /directory`,
+   * and taking it off that credential-less route is what stopped the directory
+   * being a public roster of the operator's devices and growing by one
+   * permanent entry per ceremony.
+   */
+  const holdCert = async (...args: Parameters<typeof deviceCert>) => {
+    const cert = deviceCert(...args)
+    await savePinnedDeviceCert(cert)
+    return cert
+  }
+
+  it('builds a source for a machine it never paired with', async () => {
+    await savePinnedFleetKey(FLEET_PUB)
+    await holdCert(await devicePub())
+    const fetch = directoryFetch([machineCert('loft-9f9f', 'Loft', LOFT_PUB)])
+
+    const { urls, raws, factory } = recordingFactory()
+    const sources = await fleetSources({
+      loopback: false,
+      relayOrigin: 'https://relay.example',
+      wsFactory: factory,
+      directoryFetch: fetch,
+    })
+
+    expect(sources.map(({ id, name }) => ({ id, name }))).toEqual([
+      { id: 'loft-9f9f', name: 'Loft' },
+    ])
+
+    // It dials the machine's own slot and seals message A to the key the
+    // certificate named — and carries the device certificate in the payload,
+    // which is the only thing that will admit it there (channel.go, rule 2).
+    const client = sources[0]!.client
+    client.connect()
+    expect(urls).toEqual(['wss://relay.example/client/loft-9f9f'])
+    const raw = raws[0]!
+    raw.open()
+    const msgA = raw.sent.find((d): d is Uint8Array => typeof d !== 'string')
+    const daemon = responderHandshake(LOFT_PRIV)
+    expect(daemon.readMessageA(new Uint8Array(msgA!))).toEqual(await devicePub())
+    expect(daemon.payload()).toEqual(deviceCert(await devicePub()))
+    client.close()
+  })
+
+  it('never builds a source from a machine certificate signed by another key', async () => {
+    // The negative this whole leg turns on. The relay holds blobs it cannot
+    // read, so a hostile one can serve anything; what makes a machine is a
+    // signature under the key pinned at pairing.
+    await savePinnedFleetKey(FLEET_PUB)
+    const sources = await fleetSources({
+      loopback: false,
+      relayOrigin: 'https://relay.example',
+      directoryFetch: directoryFetch([
+        machineCert('loft-9f9f', 'Loft', LOFT_PUB, 1_754_700_000, OTHER_SEED),
+      ]),
+    })
+    expect(sources).toEqual([])
+  })
+
+  it('builds nothing from the fleet for a device the fleet revoked', async () => {
+    // A revocation outranks the device certificate beside it however much
+    // fresher that is, so the browser has nothing to present — and every
+    // daemon would refuse it anyway. What it keeps is the machine it paired
+    // with directly, whose registry row the revoke on another machine has not
+    // reached.
+    await savePinnedFleetKey(FLEET_PUB)
+    saveMachine(ATTIC)
+    await savePinnedDaemonKeyFor(ATTIC.id, DAEMON_PUB)
+    const pub = await devicePub()
+    await holdCert(pub, 'phone', 'attic-pi', 1_759_999_999)
+
+    const sources = await fleetSources({
+      loopback: false,
+      relayOrigin: 'https://relay.example',
+      directoryFetch: directoryFetch([
+        machineCert('loft-9f9f', 'Loft', LOFT_PUB),
+        machineCert(ATTIC.id, 'Attic Pi', DAEMON_PUB),
+        revocation(pub, 1_754_700_000),
+      ]),
+    })
+
+    expect(sources.map((s) => s.id)).toEqual(['attic-pi'])
+  })
+
+  it('does not send a revoked certificate to a machine it did pair with', async () => {
+    await savePinnedFleetKey(FLEET_PUB)
+    saveMachine(ATTIC)
+    await savePinnedDaemonKeyFor(ATTIC.id, DAEMON_PUB)
+    const pub = await devicePub()
+    await holdCert(pub, 'phone', 'attic-pi', 1_759_999_999)
+
+    const { raws, factory } = recordingFactory()
+    const sources = await fleetSources({
+      loopback: false,
+      relayOrigin: 'https://relay.example',
+      wsFactory: factory,
+      directoryFetch: directoryFetch([revocation(pub, 1_754_700_000)]),
+    })
+    sources[0]!.client.connect()
+    raws[0]!.open()
+    const msgA = raws[0]!.sent.find((d): d is Uint8Array => typeof d !== 'string')
+    const daemon = responderHandshake(DAEMON_PRIV)
+    daemon.readMessageA(new Uint8Array(msgA!))
+    expect(daemon.payload()).toHaveLength(0)
+    sources[0]!.client.close()
+  })
+
+  it('keeps the key the ceremony pinned when the fleet names another', async () => {
+    // The pin is the stronger fact — a user carried it across on a screen
+    // they physically control — and it outlives a fleet key that rotates
+    // away, which is the same reason the daemon's rule 1 never looks at a
+    // certificate. A stale certificate must not repoint a paired machine.
+    await savePinnedFleetKey(FLEET_PUB)
+    saveMachine(ATTIC)
+    await savePinnedDaemonKeyFor(ATTIC.id, DAEMON_PUB)
+
+    const { raws, factory } = recordingFactory()
+    const sources = await fleetSources({
+      loopback: false,
+      relayOrigin: 'https://relay.example',
+      wsFactory: factory,
+      directoryFetch: directoryFetch([machineCert(ATTIC.id, 'Attic Pi', LOFT_PUB)]),
+    })
+
+    sources[0]!.client.connect()
+    raws[0]!.open()
+    const msgA = raws[0]!.sent.find((d): d is Uint8Array => typeof d !== 'string')
+    // Sealed to the pinned key: the responder holding LOFT_PRIV cannot read it.
+    expect(() => responderHandshake(LOFT_PRIV).readMessageA(new Uint8Array(msgA!))).toThrow()
+    expect(responderHandshake(DAEMON_PRIV).readMessageA(new Uint8Array(msgA!))).toHaveLength(32)
+    sources[0]!.client.close()
+  })
+
+  it('takes the fleet’s name for a machine it paired with under another', async () => {
+    await savePinnedFleetKey(FLEET_PUB)
+    saveMachine(ATTIC)
+    await savePinnedDaemonKeyFor(ATTIC.id, DAEMON_PUB)
+    const sources = await fleetSources({
+      loopback: false,
+      relayOrigin: 'https://relay.example',
+      directoryFetch: directoryFetch([machineCert(ATTIC.id, 'Attic Pi II', DAEMON_PUB)]),
+    })
+    expect(sources.map(({ id, name }) => ({ id, name }))).toEqual([
+      { id: 'attic-pi', name: 'Attic Pi II' },
+    ])
+  })
+
+  it('reaches a paired machine whose pin has gone missing, on the fleet’s word', async () => {
+    // A record without its key was a row the picker could only offer to pair
+    // again. With a fleet key and a certificate it is a machine that works.
+    await savePinnedFleetKey(FLEET_PUB)
+    saveMachine(ATTIC) // written down, never pinned
+    await holdCert(await devicePub())
+    const sources = await fleetSources({
+      loopback: false,
+      relayOrigin: 'https://relay.example',
+      directoryFetch: directoryFetch([machineCert(ATTIC.id, 'Attic Pi', DAEMON_PUB)]),
+    })
+    expect(sources.map((s) => s.id)).toEqual(['attic-pi'])
+  })
+
+  it('reads no directory at all without a pinned fleet key', async () => {
+    // An unverifiable machine list is a relay naming whatever machines it
+    // likes, so a browser with no fleet key does not ask for one.
+    saveMachine(ATTIC)
+    await savePinnedDaemonKeyFor(ATTIC.id, DAEMON_PUB)
+    const fetch = directoryFetch([machineCert('loft-9f9f', 'Loft', LOFT_PUB)])
+
+    const sources = await fleetSources({
+      loopback: false,
+      relayOrigin: 'https://relay.example',
+      directoryFetch: fetch,
+    })
+
+    expect(fetch.calls).toEqual([])
+    expect(sources.map((s) => s.id)).toEqual(['attic-pi'])
+  })
+
+  it('leaves the paired machines standing when the relay serves nothing', async () => {
+    // A relay that has not run `flue relay update` answers 503 on this route.
+    // The cost is machines this browser does not learn of, never machines it
+    // already had.
+    await savePinnedFleetKey(FLEET_PUB)
+    saveMachine(ATTIC)
+    await savePinnedDaemonKeyFor(ATTIC.id, DAEMON_PUB)
+    const sources = await fleetSources({
+      loopback: false,
+      relayOrigin: 'https://relay.example',
+      directoryFetch: directoryFetch([], { ok: false, status: 503 }),
+    })
+    expect(sources.map((s) => s.id)).toEqual(['attic-pi'])
+  })
+
+  it('skips a fleet machine when this device holds no certificate for it', async () => {
+    // Nothing would admit it: rule 2 is the only door for a machine this
+    // browser never paired with, and the certificate is the key to it. A row
+    // here would sit at unreachable forever with nothing on screen to say why.
+    await savePinnedFleetKey(FLEET_PUB)
+    const sources = await fleetSources({
+      loopback: false,
+      relayOrigin: 'https://relay.example',
+      directoryFetch: directoryFetch([machineCert('loft-9f9f', 'Loft', LOFT_PUB)]),
+    })
+    expect(sources).toEqual([])
+  })
+})
+
+// ---------------------------------------------------------------------------
+// adoptFleetCert: how a browser gets its certificate after the ceremony that
+// minted it, now that the relay's public directory does not carry one.
+// ---------------------------------------------------------------------------
+
+describe('adoptFleetCert', () => {
+  beforeEach(() => {
+    localStorage.clear()
+    sessionStorage.clear()
+    vi.stubGlobal('indexedDB', new IDBFactory())
+  })
+
+  /** A welcome carrying `cert`, base64, as the daemon sends one. */
+  function welcomeWith(cert: Uint8Array | undefined): Welcome {
+    return {
+      type: 'welcome',
+      daemonId: 'local',
+      host: 'mbp',
+      ver: 'test',
+      ...(cert !== undefined && { fleetCert: base64(cert) }),
+    }
+  }
+
+  it('keeps a certificate that verifies under the pinned fleet key and names this device', async () => {
+    await savePinnedFleetKey(FLEET_PUB)
+    const key = await loadOrCreateDeviceKey()
+    const cert = deviceCert(key.publicKey, 'phone', 'attic-pi')
+
+    await adoptFleetCert(welcomeWith(cert))
+    expect(await loadPinnedDeviceCert()).toEqual(cert)
+  })
+
+  it('refuses a certificate signed by another fleet', async () => {
+    // The pin is the whole check: a relay that served the page could offer a
+    // certificate signed by a key it holds, and this browser would present it
+    // to a machine that will refuse it.
+    await savePinnedFleetKey(FLEET_PUB)
+    const key = await loadOrCreateDeviceKey()
+    await adoptFleetCert(welcomeWith(deviceCert(key.publicKey, 'phone', 'attic-pi', 1_754_700_000, OTHER_SEED)))
+    expect(await loadPinnedDeviceCert()).toBeNull()
+  })
+
+  it('refuses a certificate for another device, however well it verifies', async () => {
+    await savePinnedFleetKey(FLEET_PUB)
+    const someoneElse = x25519.getPublicKey(new Uint8Array(32).fill(0x77))
+    await adoptFleetCert(welcomeWith(deviceCert(someoneElse, 'someone else', 'attic-pi')))
+    expect(await loadPinnedDeviceCert()).toBeNull()
+  })
+
+  it('refuses a machine certificate offered where a device one belongs', async () => {
+    await savePinnedFleetKey(FLEET_PUB)
+    await adoptFleetCert(welcomeWith(machineCert('loft-9f9f', 'Loft', LOFT_PUB)))
+    expect(await loadPinnedDeviceCert()).toBeNull()
+  })
+
+  it('keeps nothing when this browser pinned no fleet key', async () => {
+    // Nothing to check it against, so nothing that could be checked. A browser
+    // in this state reaches the machines it paired with and no others, which
+    // is what it did before the fleet key existed.
+    const key = await loadOrCreateDeviceKey()
+    await adoptFleetCert(welcomeWith(deviceCert(key.publicKey, 'phone', 'attic-pi')))
+    expect(await loadPinnedDeviceCert()).toBeNull()
+  })
+
+  it('leaves what it holds alone when a welcome offers nothing', async () => {
+    await savePinnedFleetKey(FLEET_PUB)
+    const key = await loadOrCreateDeviceKey()
+    const cert = deviceCert(key.publicKey, 'phone', 'attic-pi')
+    await adoptFleetCert(welcomeWith(cert))
+
+    await adoptFleetCert(welcomeWith(undefined))
+    expect(await loadPinnedDeviceCert()).toEqual(cert)
+  })
+
+  it('reports only the certificate that arrived where there was none', async () => {
+    // What the fleet acts on. Gaining a first certificate can grow the set of
+    // machines this browser can reach; replacing one cannot — every machine
+    // that ever paired this device minted a certificate of its own, all of
+    // them equally admitted everywhere, differing only in name and pairedOn.
+    await savePinnedFleetKey(FLEET_PUB)
+    const key = await loadOrCreateDeviceKey()
+
+    expect(await adoptFleetCert(welcomeWith(deviceCert(key.publicKey, 'phone', 'attic-pi')))).toBe(
+      true,
+    )
+    const second = deviceCert(key.publicKey, 'phone', 'blue-mesa')
+    expect(await adoptFleetCert(welcomeWith(second))).toBe(false)
+    // Reported or not, the newer blob is the one kept.
+    expect(await loadPinnedDeviceCert()).toEqual(second)
+  })
+
+  it('reports nothing for a certificate it refused', async () => {
+    await savePinnedFleetKey(FLEET_PUB)
+    const someoneElse = x25519.getPublicKey(new Uint8Array(32).fill(0x77))
+    expect(await adoptFleetCert(welcomeWith(deviceCert(someoneElse, 'someone else', 'attic-pi')))).toBe(
+      false,
+    )
+    expect(await adoptFleetCert(welcomeWith(undefined))).toBe(false)
+  })
+})
diff --git a/web/src/fleet/fleet.ts b/web/src/fleet/fleet.ts
index 18865f3..0f96942 100644
--- a/web/src/fleet/fleet.ts
+++ b/web/src/fleet/fleet.ts
@@ -25,8 +25,17 @@
  */
 import { daemonSocketUrl, FlueClient, type ConnStatus } from '@/client/client'
 import type { ErrorMsg, Preview, SessionInfo, Welcome } from '@/client/protocol'
-import { loadOrCreateDeviceKey, loadPinnedDaemonKeyFor, type DeviceKey } from '@/crypto/keys'
-import { listMachines } from '@/relay/machines'
+import { sameKey, verifyCert } from '@/crypto/cert'
+import {
+  loadOrCreateDeviceKey,
+  loadPinnedDaemonKeyFor,
+  loadPinnedDeviceCert,
+  loadPinnedFleetKey,
+  savePinnedDeviceCert,
+  type DeviceKey,
+} from '@/crypto/keys'
+import { readDirectory, type DirectoryFetch, type FleetView } from '@/relay/directory'
+import { listMachines, mergeMachines } from '@/relay/machines'
 import { relaySocket, type RawSocket } from '@/relay/socket'
 import {
   LOCAL_MACHINE_ID,
@@ -138,6 +147,19 @@ export class FleetClient {
   private staggers = new Set<ReturnType<typeof setTimeout>>()
   /** Whether this epoch has already built remotes from a learned origin. */
   private expanded = false
+  /**
+   * The relay origin the expansion ran against, kept so a certificate that
+   * arrives after it can ask for a second one. Null on a tab whose welcome
+   * has not named a relay, which is a tab with nothing to expand into.
+   */
+  private relayOrigin: string | null = null
+  /**
+   * Whether a re-supplied certificate has already forced that second
+   * expansion. Once per epoch: a browser gains machines the first time it
+   * holds a certificate at all, and re-running on every later welcome would
+   * be a directory read per reconnect for a set that cannot have changed.
+   */
+  private certExpanded = false
   /** The slot id the loopback daemon holds on the relay, once known. */
   private twinId: string | null = null
   /** Bumped by close, so an in-flight expansion can tell it was orphaned. */
@@ -181,6 +203,8 @@ export class FleetClient {
     this.running = false
     this.epoch++
     this.expanded = false
+    this.certExpanded = false
+    this.relayOrigin = null
     if (this.poll !== null) {
       clearInterval(this.poll)
       this.poll = null
@@ -327,9 +351,17 @@ export class FleetClient {
       slot.client.onError((err) => this.emitError(slot.id, err)),
       slot.client.onRevoked((reason) => this.slotRevoked(slot, reason)),
     ]
-    // Only the loopback daemon's welcome carries facts the fleet acts on —
-    // its host name, its relay slot, the relay origin. A remote source's
-    // welcome names the machine the record already names.
+    // Every welcome may carry this device's own fleet certificate, whichever
+    // machine sent it: the daemon hands one to the device it has just
+    // authenticated, so any machine this browser can still reach re-supplies
+    // the blob it needs for the machines it cannot. Deliberately not gated on
+    // which slot: the local daemon is as good a source as a remote one, and a
+    // browser that has lost its certificate is usually a browser that can only
+    // reach one machine.
+    slot.unsubs.push(slot.client.onWelcome((w) => void this.adoptCert(w)))
+    // The rest of the welcome is the loopback daemon's alone — its host name,
+    // its relay slot, the relay origin. A remote source's welcome names the
+    // machine the record already names.
     if (slot.id === LOCAL_MACHINE_ID) {
       slot.unsubs.push(slot.client.onWelcome((w) => this.localWelcome(w)))
     }
@@ -423,14 +455,50 @@ export class FleetClient {
     }
 
     const origin = w.relay?.origin
-    if (origin !== undefined && !this.expanded) {
-      this.expanded = true
-      void this.adoptRemotes(origin)
+    if (origin !== undefined) {
+      // Remembered whether or not it triggers a build, because the *other*
+      // trigger — a certificate arriving after the expansion already ran —
+      // has no welcome of its own to read an origin from.
+      this.relayOrigin = origin
+      if (!this.expanded) {
+        this.expanded = true
+        void this.adoptRemotes(origin)
+      }
     }
 
     if (changed) this.emit()
   }
 
+  /**
+   * A welcome's certificate, kept — and the machines it unlocks, taken now
+   * rather than on the next page load.
+   *
+   * The order this repairs: a browser that boots holding no certificate builds
+   * sources for the machines it pinned by hand and skips every machine it can
+   * only reach on the fleet's word (`fleetSources` reads the stored
+   * certificate once). The first welcome then hands it one. Without this, that
+   * certificate sits in IndexedDB unused until something reloads the tab —
+   * which is exactly the case the re-supply path exists for, since a browser
+   * that lost its certificate is a browser that is missing machines.
+   *
+   * Only a certificate this browser did not already hold re-expands, so the
+   * usual welcome — the same blob it has had all along — costs one IndexedDB
+   * read and nothing else. `certExpanded` bounds it to one rebuild per epoch
+   * even if several slots say hello at once.
+   *
+   * The rebuild is `adoptRemotes` unchanged, which is why this is safe to run
+   * a second time: it is idempotent by id, skips the twin, and discards
+   * everything if the fleet closed while it was reading the directory.
+   */
+  private async adoptCert(w: Welcome) {
+    if (!(await adoptFleetCert(w))) return
+    if (this.certExpanded || !this.running) return
+    const origin = this.relayOrigin
+    if (origin === null) return
+    this.certExpanded = true
+    await this.adoptRemotes(origin)
+  }
+
   /**
    * Build and adopt the remote sources a learned relay origin unlocks.
    *
@@ -547,10 +615,79 @@ export class FleetClient {
   }
 }
 
+/**
+ * Keep this device's fleet certificate when a welcome offers one.
+ *
+ * This is the re-supply path, and the reason a certificate no longer has to
+ * live in the relay's public directory. The ceremony hands one over in its
+ * answer; every relayed connection after that offers the same blob again,
+ * inside Noise, to a device that has already proved it holds the key the
+ * certificate names. So a browser that never stored one, or lost it, or was
+ * paired before its machine had a fleet key, picks one up from any machine it
+ * can still reach that way. A loopback welcome carries none — a session-token
+ * connection has named no device key — so this listener earns its keep on the
+ * relay sources, and a tab that only ever paired over loopback re-pairs.
+ *
+ * Verified before it is kept, under the fleet key pinned at pairing and against
+ * this browser's own device key — the same three checks the pairing page makes,
+ * for the same reason: a certificate arriving over a channel is a claim until
+ * a signature says otherwise, and one naming another device's key is not this
+ * browser's to present. Everything else is dropped in silence, because a
+ * certificate is what reaches *other* machines and its absence costs nothing on
+ * the machine that just said hello.
+ *
+ * The new blob is written even when one is already stored, and the two are
+ * usually different bytes rather than the same ones. Every machine that has
+ * ever paired this device holds a certificate of its own, all of them equally
+ * valid and differing only in `name` and `pairedOn`, so a browser paired on
+ * two machines keeps whichever welcome landed last. That is not a problem to
+ * solve: any of them admits it everywhere, and the machine that just
+ * authenticated this device is as good a source as any.
+ *
+ * **Returns whether this browser gained a certificate it did not have**, which
+ * is the one case the caller can act on: the set of machines a browser can
+ * reach is computed from the certificate it holds, so a browser that had none
+ * has machines to gain. A replacement changes nothing about reachability, so
+ * it reports false — see FleetClient.adoptCert.
+ */
+export async function adoptFleetCert(w: Welcome): Promise<boolean> {
+  if (w.fleetCert === undefined || w.fleetCert === '') return false
+  try {
+    const fleetPub = await loadPinnedFleetKey()
+    if (fleetPub === null) return false
+    const blob = decodeBase64(w.fleetCert)
+    if (blob === null) return false
+    const cert = verifyCert(fleetPub, blob)
+    if (cert === null || cert.kind !== 'device') return false
+    const key = await loadOrCreateDeviceKey()
+    if (!sameKey(cert.device, key.publicKey)) return false
+    // Read before the write, because "was there one before this" is the answer
+    // the caller wants and the write destroys it.
+    const held = await loadPinnedDeviceCert()
+    await savePinnedDeviceCert(blob)
+    return held === null
+  } catch {
+    // A key store that will not open, a welcome that carried nonsense. Both
+    // mean this browser keeps whatever it already had, which is the same
+    // answer it has for a daemon that offered nothing.
+    return false
+  }
+}
+
+/** Standard base64 with padding, which is how Go's encoding/json writes the
+ *  `[]byte` this field is. Null for anything that is not. */
+function decodeBase64(text: string): Uint8Array | null {
+  try {
+    return Uint8Array.from(atob(text), (c) => c.charCodeAt(0))
+  } catch {
+    return null
+  }
+}
+
 /**
  * Build the sources a tab starts from — the production builder behind
- * FleetClient, and the only place fleet code touches storage or constructs a
- * transport.
+ * FleetClient, and the only place fleet code touches storage, reads the
+ * directory or constructs a transport.
  *
  * `loopback` says whether this origin serves /ws at all: true on a page the
  * daemon itself served, where the local source is built nameless and the
@@ -558,17 +695,35 @@ export class FleetClient {
  * own origin on a relay tab, null on a loopback tab that has not heard from
  * its daemon yet (FleetClient learns it there; see `localWelcome`).
  *
- * Each listMachines record with a pinned key becomes a source built exactly
- * as relayBoot builds its client — same identity, same relaySocket, same
- * factory seam — so the wrong-key bug class has one spelling to be tested
- * against. A record without a key is skipped silently rather than surfaced:
- * the fleet lists machines that can be reached, and re-pairing the missing
- * one is the picker's business, not a status row's.
+ * **Two ways a machine gets here, and one way it is reached.** A pairing
+ * record with a pinned key is the original: a ceremony this browser performed,
+ * whose key the user witnessed. A machine certificate out of the fleet
+ * directory is the other, and it is what makes a machine joined last week
+ * appear in this list without anybody scanning anything — verified under the
+ * fleet key pinned at pairing, then trusted for exactly one thing, the `noise`
+ * key to hand the handshake. Either way the source is built as relayBoot
+ * builds its client — same identity shape, same relaySocket, same factory seam
+ * — so the wrong-key bug class has one spelling to be tested against.
+ *
+ * The pinned key wins where a machine has both. It is the stronger fact — a
+ * user carried it across on a screen they physically control — and it outlives
+ * a fleet key that rotates away, which is the same reason the daemon's rule 1
+ * never looks at a certificate. The directory still gets the last word on the
+ * machine's *name*, which is its own to state.
+ *
+ * A row nothing can reach is skipped in silence rather than surfaced: a
+ * pairing record whose key is gone and which the fleet does not name, or a
+ * fleet machine this device has no certificate to present to. The fleet lists
+ * machines that can be reached, and re-pairing is the picker's business, not a
+ * status row's.
  */
 export async function fleetSources(opts: {
   loopback: boolean
   relayOrigin: string | null
   wsFactory?: (url: string) => RawSocket
+  /** How the directory is read. Production passes nothing; a test hands over
+   *  an answer the way it hands over a socket factory. */
+  directoryFetch?: DirectoryFetch
 }): Promise<FleetSource[]> {
   const sources: FleetSource[] = []
   if (opts.loopback) {
@@ -578,32 +733,117 @@ export async function fleetSources(opts: {
   if (origin === null) return sources
 
   // One device key serves every machine — it is this browser's identity, not
-  // a machine's — loaded once and only once a pinned record proves the tab
-  // has any handshake to spend it on.
+  // a machine's — loaded at most once.
   let deviceKey: DeviceKey | null = null
-  for (const record of listMachines()) {
-    let daemonPub: Uint8Array | null
-    try {
-      daemonPub = await loadPinnedDaemonKeyFor(record.id)
-    } catch {
-      // A key store that will not open answers as a missing pin does: this
-      // record cannot be handshaken for, and the fleet lists what it can reach.
-      continue
-    }
-    if (daemonPub === null) continue
+  const device = async (): Promise<DeviceKey | null> => {
     if (deviceKey === null) {
       try {
         deviceKey = await loadOrCreateDeviceKey()
       } catch {
-        break
+        // A key store that will not open is a tab with no identity to spend
+        // on any handshake. Nothing here can be built; the picker's empty
+        // state is the way back.
+        return null
       }
     }
-    const identity = { deviceKey, daemonPub }
+    return deviceKey
+  }
+
+  const view = await fleetView(origin, device, opts.directoryFetch)
+  // This device's own certificate, from this browser's store rather than from
+  // the relay: the machine that minted it handed it over at pairing and hands
+  // it over again on every welcome (fleet.ts, adoptFleetCert), so the public
+  // directory never has to carry one.
+  //
+  // Dropped when the directory says this key is revoked. That is the reader's
+  // rule and it is enforced here rather than in storage: a revocation outranks
+  // a certificate whatever either one's `iat` says, so a browser that went on
+  // presenting a stored certificate after the fleet cut it off would be
+  // deciding it knows better than the fleet — and would be refused by any
+  // daemon that had heard, which is a channel that opens and closes.
+  const deviceCert = view.revoked ? null : await storedDeviceCert()
+
+  for (const machine of mergeMachines(listMachines(), view.machines)) {
+    let pinned: Uint8Array | null = null
+    try {
+      pinned = await loadPinnedDaemonKeyFor(machine.id)
+    } catch {
+      // A key store that will not open answers as a missing pin does, and the
+      // fleet's own key may still name this machine.
+    }
+    const certified = view.machines.find((m) => m.id === machine.id) ?? null
+    const daemonPub = pinned ?? certified?.noise ?? null
+    if (daemonPub === null) continue
+    // A machine this browser never paired with admits it on the device
+    // certificate and on nothing else (channel.go, rule 2). Without one there
+    // is no handshake to attempt, only a row that would sit at unreachable.
+    if (pinned === null && deviceCert === null) continue
+    const key = await device()
+    if (key === null) break
+    const identity = {
+      deviceKey: key,
+      daemonPub,
+      ...(deviceCert !== null && { deviceCert }),
+    }
     sources.push({
-      id: record.id,
-      name: record.name,
-      client: new FlueClient(origin, (o) => relaySocket(o, identity, record.id, opts.wsFactory)),
+      id: machine.id,
+      name: machine.name,
+      client: new FlueClient(origin, (o) => relaySocket(o, identity, machine.id, opts.wsFactory)),
     })
   }
   return sources
 }
+
+/**
+ * What the fleet directory says, or nothing at all.
+ *
+ * Nothing is the answer for a browser with no pinned fleet key — one that
+ * paired before the key existed, or with a daemon that holds none — and it is
+ * an ordinary answer: that browser reaches the machines it paired with
+ * directly, exactly as it always did. Reading the directory *without* the key
+ * would be worse than not reading it, because an unverifiable machine list is
+ * a relay naming whatever machines it likes.
+ *
+ * Everything else it can go wrong with is inside readDirectory, which never
+ * rejects: a relay that has not been updated answers 503 on this route, an
+ * unreachable one answers nothing, and both mean "no machines learned" rather
+ * than "no fleet".
+ */
+async function fleetView(
+  origin: string,
+  device: () => Promise<DeviceKey | null>,
+  fetch: DirectoryFetch | undefined,
+): Promise<FleetView> {
+  let fleetPub: Uint8Array | null
+  try {
+    fleetPub = await loadPinnedFleetKey()
+  } catch {
+    return EMPTY_FLEET
+  }
+  if (fleetPub === null) return EMPTY_FLEET
+  const key = await device()
+  if (key === null) return EMPTY_FLEET
+  return readDirectory({
+    origin,
+    fleetPub,
+    devicePub: key.publicKey,
+    ...(fetch !== undefined && { fetch }),
+  })
+}
+
+const EMPTY_FLEET: FleetView = {
+  machines: [],
+  revoked: false,
+  entries: 0,
+  verified: 0,
+}
+
+/** This device's stored fleet certificate, or null — including when the key
+ *  store will not open, which is a browser with no identity to spend anyway. */
+async function storedDeviceCert(): Promise<Uint8Array | null> {
+  try {
+    return await loadPinnedDeviceCert()
+  } catch {
+    return null
+  }
+}
diff --git a/web/src/lib/url.test.ts b/web/src/lib/url.test.ts
index 114992c..3013b73 100644
--- a/web/src/lib/url.test.ts
+++ b/web/src/lib/url.test.ts
@@ -74,7 +74,23 @@ describe('scrubPairingParams', () => {
   it('removes every repetition of the parameters', () => {
     // URLSearchParams.delete removes all entries with the name, but a helper
     // that reached for get()/set() would leave the second copy behind.
-    history.replaceState(null, '', '/pair?t=one&t=two&k=a&k=b')
+    history.replaceState(null, '', '/pair?t=one&t=two&k=a&k=b&f=c&f=d')
+    scrubPairingParams()
+    expect(location.search).toBe('')
+  })
+
+  it('removes the fleet key with them', () => {
+    // `f` is the pin for every machine this browser will ever dial. It is
+    // read on the first render and never from the address bar again, so what
+    // a link still carrying it is, afterwards, is a live-looking pairing link
+    // in a history entry.
+    history.replaceState(null, '', '/pair?t=secret&k=daemonkey&f=fleetkey&d=blue-mesa')
+    scrubPairingParams()
+    expect(location.search).toBe('?d=blue-mesa')
+  })
+
+  it('scrubs a fleet key travelling alone', () => {
+    history.replaceState(null, '', '/pair?f=fleetkey')
     scrubPairingParams()
     expect(location.search).toBe('')
   })
diff --git a/web/src/lib/url.ts b/web/src/lib/url.ts
index a96dc06..3bf5b26 100644
--- a/web/src/lib/url.ts
+++ b/web/src/lib/url.ts
@@ -28,40 +28,54 @@ export function stripHandoff(url: string): string {
   return `${u.origin}${u.pathname}${query ? `?${query}` : ''}${u.hash}`
 }
 
-/** The query parameters a pairing link carries its secrets in: the single-use
- *  token and the daemon's static public key. `internal/daemon/conn.go` writes
- *  both, and routes/pair.tsx is the one reader. */
+/** The query parameters a pairing link carries its credentials in: the
+ *  single-use token, the daemon's static public key, and the fleet public key.
+ *  `internal/daemon/conn.go` writes all three, and routes/pair.tsx is the one
+ *  reader. */
 export const PAIRING_TOKEN_PARAM = 't'
 export const PAIRING_KEY_PARAM = 'k'
+export const PAIRING_FLEET_PARAM = 'f'
+
+/** The three the scrub takes, in one place so a fourth cannot be added to the
+ *  link and forgotten here. */
+const PAIRING_PARAMS = [PAIRING_TOKEN_PARAM, PAIRING_KEY_PARAM, PAIRING_FLEET_PARAM]
 
 /**
- * Remove the pairing secrets from the address bar.
+ * Remove the pairing credentials from the address bar.
+ *
+ * The pairing link carries `?t=<single-use token>&k=<daemon static key>` and,
+ * from a daemon that holds a fleet key, `&f=<fleet public key>`. Unlike `h`
+ * they cannot be stripped at the entry point: main.tsx runs before the router
+ * reads the location, so a scrub there would be a ceremony that never starts.
+ * The pairing page calls this instead, after it has captured all three into
+ * memory — the token is a live bearer credential until the daemon's two-minute
+ * window closes, and the address bar is where it would otherwise outlive the
+ * ceremony: in the history entry, in anything that syncs history, and in
+ * whatever the user copies out of it.
  *
- * The pairing link carries `?t=<single-use token>&k=<daemon static key>`, and
- * unlike `h` they cannot be stripped at the entry point: main.tsx runs before
- * the router reads the location, so a scrub there would be a ceremony that
- * never starts. The pairing page calls this instead, after it has captured
- * both into memory — the token is a live bearer credential until the daemon's
- * two-minute window closes, and the address bar is where it would otherwise
- * outlive the ceremony: in the history entry, in anything that syncs history,
- * and in whatever the user copies out of it.
+ * The two keys are public, and they go with the token anyway. They are read
+ * once, on the first render, and never from the address bar again — so what a
+ * link still carrying them is, after that, is a live-looking pairing link with
+ * a spent token in it, sitting in a history entry to be reopened or forwarded.
+ * The keys are also the whole of what the ceremony pins, and `f` is the pin
+ * for every machine this browser will ever dial; the fewer places it can be
+ * copied out of and pasted into a link somebody else opens, the better.
  *
  * `d` and `n` are left where they are. A machine id and its display name are
- * not secrets, and stripping them would be a second job hiding inside a
- * function named for one.
+ * not credentials of any kind, and stripping them would be a second job hiding
+ * inside a function named for one.
  *
- * replaceState rather than pushState, because the entry holding the secrets
- * is the thing being rewritten, not something to keep behind the back button.
+ * replaceState rather than pushState, because the entry holding the token is
+ * the thing being rewritten, not something to keep behind the back button.
  * The href handed to it is relative: a same-document rewrite needs no origin,
  * and not restating one is one fewer thing to have wrong.
  */
 export function scrubPairingParams(): void {
   const u = new URL(location.href)
-  if (!u.searchParams.has(PAIRING_TOKEN_PARAM) && !u.searchParams.has(PAIRING_KEY_PARAM)) return
+  if (!PAIRING_PARAMS.some((p) => u.searchParams.has(p))) return
   // delete() removes every entry with the name; get()/set() would leave a
   // second copy of a repeated parameter behind.
-  u.searchParams.delete(PAIRING_TOKEN_PARAM)
-  u.searchParams.delete(PAIRING_KEY_PARAM)
+  for (const p of PAIRING_PARAMS) u.searchParams.delete(p)
   const query = u.searchParams.toString()
   history.replaceState(null, '', `${u.pathname}${query ? `?${query}` : ''}${u.hash}`)
 }
diff --git a/web/src/relay/directory.test.ts b/web/src/relay/directory.test.ts
new file mode 100644
index 0000000..ba5d645
--- /dev/null
+++ b/web/src/relay/directory.test.ts
@@ -0,0 +1,284 @@
+import { describe, expect, it } from 'vitest'
+
+import { keyHex } from '@/crypto/cert'
+import {
+  base64,
+  deviceCert,
+  directoryFetch,
+  FLEET_PUB,
+  machineCert,
+  OTHER_SEED,
+  revocation,
+} from '@/testing/fleet'
+import { readDirectory } from './directory'
+
+const ORIGIN = 'https://relay.example'
+const DEVICE = new Uint8Array(32).fill(0x2a)
+const OTHER_DEVICE = new Uint8Array(32).fill(0x3b)
+const ATTIC_NOISE = new Uint8Array(32).fill(0xa1)
+const MESA_NOISE = new Uint8Array(32).fill(0xb2)
+
+const read = (blobs: Uint8Array[], devicePub = DEVICE) =>
+  readDirectory({ origin: ORIGIN, fleetPub: FLEET_PUB, devicePub, fetch: directoryFetch(blobs) })
+
+describe('reading the fleet directory', () => {
+  it('builds a machine from a certificate that verifies', async () => {
+    const view = await read([machineCert('attic-pi', 'Attic Pi', ATTIC_NOISE)])
+    expect(view.machines).toHaveLength(1)
+    expect(view.machines[0]).toMatchObject({ id: 'attic-pi', name: 'Attic Pi' })
+    // The `noise` key is the whole point: it is what the browser pins for the
+    // IK handshake with a machine it has never met.
+    expect(keyHex(view.machines[0]!.noise)).toBe(keyHex(ATTIC_NOISE))
+    expect(view).toMatchObject({ entries: 1, verified: 1, revoked: false })
+  })
+
+  it('asks the relay origin for /directory, with no id in the path', async () => {
+    // One relay is one fleet, so the object's name is a constant and the
+    // route names no machine.
+    const fetch = directoryFetch([])
+    await readDirectory({ origin: ORIGIN, fleetPub: FLEET_PUB, devicePub: DEVICE, fetch })
+    expect(fetch.calls).toEqual(['https://relay.example/directory'])
+  })
+
+  it('never makes a machine out of a certificate signed by another key', async () => {
+    // The negative the whole leg exists for. The relay stores blobs it cannot
+    // read, so anything can be in there; what makes a machine is a signature
+    // under the key this browser pinned at pairing, and nothing else.
+    const view = await read([
+      machineCert('attic-pi', 'Attic Pi', ATTIC_NOISE, 1_754_700_000, OTHER_SEED),
+    ])
+    expect(view.machines).toEqual([])
+    expect(view).toMatchObject({ entries: 1, verified: 0 })
+  })
+
+  it('never makes a machine out of a certificate with a byte flipped', async () => {
+    const blob = machineCert('attic-pi', 'Attic Pi', ATTIC_NOISE)
+    // Inside the fields, past the prefix, the version and the kind byte.
+    blob[20] = blob[20]! ^ 1
+    expect((await read([blob])).machines).toEqual([])
+  })
+
+  it('refuses a blob cut short, and one with a byte appended', async () => {
+    const blob = machineCert('attic-pi', 'Attic Pi', ATTIC_NOISE)
+    const longer = new Uint8Array(blob.length + 1)
+    longer.set(blob)
+    const view = await read([blob.subarray(0, blob.length - 1), longer])
+    expect(view.machines).toEqual([])
+    expect(view.verified).toBe(0)
+  })
+
+  it('keeps the later certificate when a machine has re-minted', async () => {
+    // A daemon reinstalled, its static key regenerated. Both were signed by
+    // the fleet, so this is freshness, not trust — and a browser left on the
+    // older key would dial a machine it can never handshake with.
+    const view = await read([
+      machineCert('attic-pi', 'Attic Pi', ATTIC_NOISE, 1_754_700_000),
+      machineCert('attic-pi', 'Attic Pi II', MESA_NOISE, 1_754_700_900),
+    ])
+    expect(view.machines).toHaveLength(1)
+    expect(view.machines[0]!.name).toBe('Attic Pi II')
+    expect(keyHex(view.machines[0]!.noise)).toBe(keyHex(MESA_NOISE))
+  })
+
+  it('sorts machines by id, so two reads build the same list', async () => {
+    // The answer promises no order — storage sorts by digest, which is to say
+    // by nothing — so the reader imposes one of its own.
+    const view = await read([
+      machineCert('mesa-1a2b', 'Mesa', MESA_NOISE),
+      machineCert('attic-pi', 'Attic Pi', ATTIC_NOISE),
+    ])
+    expect(view.machines.map((m) => m.id)).toEqual(['attic-pi', 'mesa-1a2b'])
+  })
+})
+
+describe('the device certificates a browser no longer reads out of the directory', () => {
+  it('counts one as verified and takes nothing from it', async () => {
+    // A device certificate here is an anomaly: nothing in a fleet publishes
+    // one, and no released flue has a directory to have published it from. It
+    // verifies, so it is counted — the number is "how much of this did our
+    // fleet key sign" — and it is otherwise ignored: this browser holds its
+    // own certificate (crypto/keys.ts, from the pairing answer and every
+    // relayed welcome) and was never owed anybody else's.
+    const view = await read([deviceCert(DEVICE, 'my phone'), deviceCert(OTHER_DEVICE, 'somebody')])
+    expect(view.verified).toBe(2)
+    expect(view.machines).toEqual([])
+    expect(view.revoked).toBe(false)
+  })
+})
+
+describe('a revocation is what the reader still owes a stored certificate', () => {
+  it('reports this device as revoked however much fresher any certificate is', async () => {
+    // The rule with its own sentence in the spec: `iat` is display, never
+    // precedence. A reader that took the newer of the two would let a
+    // certificate minted after the revoke undo it — and un-revoking is
+    // pairing again under a fresh key, not re-issuing under the dead one.
+    const view = await read([
+      revocation(DEVICE, 1_754_700_000),
+      deviceCert(DEVICE, 'phone', 'attic-pi', 1_759_999_999),
+    ])
+    expect(view.revoked).toBe(true)
+  })
+
+  it('whichever order the answer happens to list them in', async () => {
+    // Storage hands entries back sorted by digest, so the revocation may come
+    // first or last and nothing may depend on which.
+    const rev = revocation(DEVICE, 1_754_700_000)
+    const cert = deviceCert(DEVICE, 'phone', 'attic-pi', 1_759_999_999)
+    expect((await read([cert, rev])).revoked).toBe(true)
+    expect((await read([rev, cert])).revoked).toBe(true)
+  })
+
+  it('and does not touch another device', async () => {
+    const view = await read([revocation(OTHER_DEVICE), deviceCert(DEVICE)])
+    expect(view.revoked).toBe(false)
+  })
+
+  it('unless the revocation was signed by another key', async () => {
+    // A revocation only subtracts authority, which is why daemons honour one
+    // from an untrusted channel — but it still has to be *the fleet's*. A
+    // stranger able to revoke devices would be a denial of service anybody
+    // with write access to the directory could mount.
+    const view = await read([revocation(DEVICE, 1_754_700_000, OTHER_SEED), deviceCert(DEVICE)])
+    expect(view.revoked).toBe(false)
+  })
+})
+
+describe('what the reader will not take from the relay on faith', () => {
+  it('reads at most 512 entries, whatever the relay claims to hold', async () => {
+    // The Worker refuses to store a 513th (507, rather than evicting), so a
+    // longer answer is not a bigger fleet — it is a relay that has stopped
+    // speaking this protocol. The rest go unread rather than unverified.
+    const blobs = [machineCert('attic-pi', 'Attic Pi', ATTIC_NOISE)]
+    for (let i = 0; i < 600; i++) blobs.push(deviceCert(OTHER_DEVICE, `d${i}`))
+    blobs.push(machineCert('mesa-1a2b', 'Mesa', MESA_NOISE))
+
+    const view = await read(blobs)
+    expect(view.entries).toBe(602)
+    expect(view.verified).toBe(512)
+    expect(view.machines.map((m) => m.id)).toEqual(['attic-pi'])
+  })
+
+  it('refuses a blob over the 4 KiB ceiling before verifying it', async () => {
+    const huge = new Uint8Array(4097).fill(1)
+    const view = await read([huge, machineCert('attic-pi', 'Attic Pi', ATTIC_NOISE)])
+    expect(view.verified).toBe(1)
+    expect(view.machines).toHaveLength(1)
+  })
+
+  it('refuses an empty blob and one that is not base64', async () => {
+    const body = JSON.stringify({
+      v: 1,
+      entries: [{ key: '', blob: '' }, { key: '', blob: '!!!!' }, { key: '', blob: 42 }],
+    })
+    const view = await readDirectory({
+      origin: ORIGIN,
+      fleetPub: FLEET_PUB,
+      devicePub: DEVICE,
+      fetch: directoryFetch([], { body }),
+    })
+    expect(view.verified).toBe(0)
+    expect(view.machines).toEqual([])
+  })
+})
+
+describe('a directory that cannot be read costs visibility and nothing else', () => {
+  const empty = { machines: [], revoked: false, entries: 0, verified: 0 }
+
+  it('answers empty for a relay that has not been updated (503)', async () => {
+    // `/directory` on a relay deployed before the FleetDirectory object
+    // exists. The fix is `flue relay update`; until then this browser sees
+    // the machines it paired with and no others.
+    const view = await readDirectory({
+      origin: ORIGIN,
+      fleetPub: FLEET_PUB,
+      devicePub: DEVICE,
+      fetch: directoryFetch([], { ok: false, status: 503 }),
+    })
+    expect(view).toEqual(empty)
+  })
+
+  it('answers empty for a body that is not a directory', async () => {
+    for (const body of ['<!doctype html>', '{}', '{"entries":"nope"}', 'null']) {
+      const view = await readDirectory({
+        origin: ORIGIN,
+        fleetPub: FLEET_PUB,
+        devicePub: DEVICE,
+        fetch: directoryFetch([], { body }),
+      })
+      expect(view).toEqual(empty)
+    }
+  })
+
+  it('answers empty when the fetch itself throws', async () => {
+    const view = await readDirectory({
+      origin: ORIGIN,
+      fleetPub: FLEET_PUB,
+      devicePub: DEVICE,
+      fetch: () => Promise.reject(new Error('offline')),
+    })
+    expect(view).toEqual(empty)
+  })
+
+  it('refuses a document past the size ceiling without parsing it', async () => {
+    const view = await readDirectory({
+      origin: ORIGIN,
+      fleetPub: FLEET_PUB,
+      devicePub: DEVICE,
+      fetch: directoryFetch([], { body: `{"v":1,"entries":[${' '.repeat(5 << 20)}]}` }),
+    })
+    expect(view).toEqual(empty)
+  })
+
+  it('shows what a relay serving half the set left out, and nothing worse', async () => {
+    // A hostile or lagging relay can serve this stale, cut short or empty —
+    // it could always refuse to route. The cost is machines this browser does
+    // not see; what it cannot do is add one.
+    const whole = [
+      machineCert('attic-pi', 'Attic Pi', ATTIC_NOISE),
+      machineCert('mesa-1a2b', 'Mesa', MESA_NOISE),
+      revocation(OTHER_DEVICE),
+    ]
+    const full = await read(whole)
+    expect(full.machines.map((m) => m.id)).toEqual(['attic-pi', 'mesa-1a2b'])
+    expect(full.verified).toBe(3)
+
+    const half = await read(whole.slice(0, 1))
+    expect(half.machines.map((m) => m.id)).toEqual(['attic-pi'])
+    // Fewer machines this browser can open, never a machine it should not —
+    // and the withheld revocation is the exception the spec now names, since
+    // omitting one is the one direction that *adds* rather than subtracts
+    // (spec/relay-protocol.md, "What withholding costs").
+    expect(half.verified).toBe(1)
+  })
+
+  it('answers empty for a fleet key that is not 32 bytes', async () => {
+    const view = await readDirectory({
+      origin: ORIGIN,
+      fleetPub: FLEET_PUB.subarray(0, 31),
+      devicePub: DEVICE,
+      fetch: directoryFetch([machineCert('attic-pi', 'Attic Pi', ATTIC_NOISE)]),
+    })
+    expect(view.machines).toEqual([])
+    expect(view.verified).toBe(0)
+  })
+})
+
+describe('the entry key the relay files a blob under', () => {
+  it('is not what decides anything', async () => {
+    // Content addressing is the relay's filing system. What decides whether
+    // an entry means something is the signature over its bytes, so a key that
+    // is wrong, absent or a lie changes nothing.
+    const blob = machineCert('attic-pi', 'Attic Pi', ATTIC_NOISE)
+    const body = JSON.stringify({
+      v: 1,
+      entries: [{ key: 'not-a-digest', blob: base64(blob) }],
+    })
+    const view = await readDirectory({
+      origin: ORIGIN,
+      fleetPub: FLEET_PUB,
+      devicePub: DEVICE,
+      fetch: directoryFetch([], { body }),
+    })
+    expect(view.machines).toHaveLength(1)
+  })
+})
diff --git a/web/src/relay/directory.ts b/web/src/relay/directory.ts
new file mode 100644
index 0000000..922dede
--- /dev/null
+++ b/web/src/relay/directory.ts
@@ -0,0 +1,289 @@
+/*
+ * The fleet directory, as a browser reads it.
+ *
+ * `GET /directory` is credential-less and answers the whole set of signed
+ * blobs the relay is holding — machine certificates and revocations
+ * (spec/relay-protocol.md, "The fleet directory"). It is how a device paired on
+ * one machine learns of every other machine in the fleet without a second
+ * ceremony, and how it hears that a device has been cut off.
+ *
+ * **It is not where this browser's own certificate comes from.** That arrives
+ * from the machine that minted it — in the pairing answer, and again in every
+ * welcome — and is kept in this origin's key store (crypto/keys.ts). Device
+ * certificates are not published here at all: the route needs no credential, so
+ * publishing them made this document a roster of the operator's devices, and
+ * nothing was ever deleted from it, so each one spent a permanent entry against
+ * a cap of 512. What this reader still owes that certificate is the *other*
+ * half of the rule below: whether it has been revoked.
+ *
+ * **Nothing the relay says is trusted here.** The Worker stores and serves and
+ * can verify nothing — the fleet key never touches it — so every blob is
+ * checked under the pinned fleet public key and dropped if it fails. A hostile
+ * relay can serve this stale, cut short, reordered or empty, and all of that
+ * costs the same thing: machines this browser does not see. What it cannot do
+ * is add one, because adding needs the key Cloudflare never holds.
+ *
+ * Nor are the relay's own bounds taken on faith. It refuses a blob over 4 KiB
+ * and a 513th entry, and this reader enforces both again on the way in: the
+ * ceilings that matter are the ones on the side doing the work.
+ *
+ * Two rules are the reader's and are applied here rather than anywhere else:
+ *
+ *   - **A revocation outranks a device certificate for the same key, whatever
+ *     either one's `iat` says.** Not "the newer wins" — that would let a
+ *     device certificate re-issued after a revoke undo it, and `iat` is a
+ *     display field a signer chooses. Un-revoking is pairing again under a
+ *     fresh key. The certificate it outranks is now the one this browser holds
+ *     locally, which is why `revoked` is reported rather than acted on here.
+ *   - **Order in the answer means nothing.** Storage hands entries back
+ *     sorted by digest, so a reader that took the last one for the newest
+ *     would be reading a property of SHA-256. Everything is collected first
+ *     and ranked afterwards, which is also why a revocation filed before the
+ *     certificate it kills still kills it.
+ */
+import { keyHex, verifyCert, type Cert } from '@/crypto/cert'
+
+/**
+ * The largest blob this reader will look at, mirroring `MAX_BLOB_BYTES` in
+ * relay/src/directory.ts and `maxBlobBytes` in the daemon's leg. A certificate
+ * is a couple of hundred bytes; what the bound buys is that a relay cannot
+ * make this tab spend an Ed25519 verification per megabyte it feels like
+ * sending.
+ */
+const MAX_BLOB_BYTES = 4096
+
+/**
+ * How many entries one answer may carry, mirroring `MAX_ENTRIES` in
+ * relay/src/directory.ts and `MaxDirectoryEntries` in the daemon's leg. The
+ * Worker refuses to store a 513th — it answers 507 rather than evicting,
+ * because evicting could drop a revocation — so a longer answer is not a bigger
+ * fleet, it is a relay that has stopped speaking this protocol. The rest go
+ * unread.
+ *
+ * Exported because it is also the number the Remote screen measures a fleet
+ * against (routes/remote.tsx, FleetLine): the cap has no gentle failure, so the
+ * screen warns before it, and a second copy of 512 over there could drift from
+ * the one this reader enforces.
+ */
+export const MAX_ENTRIES = 512
+
+/**
+ * Where a status surface starts saying the directory is filling up: 90% of the
+ * cap, the same threshold `flue relay status` uses (internal/transport/relay,
+ * DirectoryWarnAt).
+ *
+ * At the cap the relay refuses every new blob, and refuses it before storing
+ * and therefore before pushing — so a revocation made past that point reaches
+ * nobody — and nothing frees an entry short of `flue relay reset`. Warning late
+ * is the same as not warning.
+ */
+export const DIRECTORY_WARN_AT = Math.floor((MAX_ENTRIES * 9) / 10)
+
+/**
+ * The ceiling on the document itself, in characters.
+ *
+ * The worst honest case is 512 entries of 4 KiB in base64, four characters per
+ * three bytes, plus the JSON around it — about 2.8 MiB — and this is that with
+ * room to spare, the same arithmetic `maxDirectorySnapshot` uses in Go.
+ *
+ * It bounds the *work*, not the bytes received: by the time this is checked
+ * the answer has been read, because the seam below is one `text()` call rather
+ * than a stream. That is the honest limit of it, and it is the right trade
+ * here — the relay serving this page also serves the script reading it, so a
+ * tab is not where a hostile relay is held at arm's length. What the check
+ * does buy is that a JSON parse and 100 000 base64 decodes are never attempted
+ * on an answer nothing honest produces.
+ */
+const MAX_DOCUMENT_CHARS = 4 << 20
+
+/** The route, on the relay origin. One relay is one fleet, so it names no
+ *  machine. */
+const DIRECTORY_PATH = '/directory'
+
+/** One machine the fleet has vouched for, from a certificate that verified. */
+export interface DirectoryMachine {
+  /** The machine id: its slot on the relay, the `<id>` in `/client/<id>`. */
+  id: string
+  /** The machine's own display name, as it signed it. */
+  name: string
+  /** The daemon's static X25519 public key, to pin for the IK handshake. */
+  noise: Uint8Array
+  /** When the machine minted this certificate. Display, never precedence. */
+  iat: number
+}
+
+/** What one read of the directory came back with. */
+export interface FleetView {
+  /** Every machine whose certificate verified, by id, newest certificate per
+   *  id. Sorted by id so two reads of one directory build the same list. */
+  machines: DirectoryMachine[]
+  /**
+   * Whether this device's key is revoked. Distinct from "no certificate":
+   * one is a device that was never enrolled, the other is one the operator
+   * cut off, and only the second means every machine in the fleet has been
+   * told to close its channels.
+   */
+  revoked: boolean
+  /** What the relay claimed to be holding, and how much of it this fleet key
+   *  signed. The gap is a relay serving another fleet's blobs, or a fleet key
+   *  that has rotated; it is reported rather than acted on. */
+  entries: number
+  verified: number
+}
+
+/** The narrow slice of `fetch` this module uses, so a test can hand it an
+ *  answer without a Response implementation jsdom does not have. */
+export interface DirectoryAnswer {
+  ok: boolean
+  status: number
+  text(): Promise<string>
+}
+
+export type DirectoryFetch = (url: string) => Promise<DirectoryAnswer>
+
+/** The empty view: what a relay that answered nothing usable amounts to. */
+const NOTHING: FleetView = {
+  machines: [],
+  revoked: false,
+  entries: 0,
+  verified: 0,
+}
+
+/**
+ * Read the directory at `origin` and keep what verifies under `fleetPub`.
+ *
+ * `devicePub` is this browser's own static key: the certificate hunted for is
+ * the one naming it, and the revocation looked for is the one killing it.
+ *
+ * It never rejects. Every way this can fail — the relay unreachable, a 503
+ * from a relay that has not been updated, a document that is not the shape the
+ * spec fixes, a set with nothing in it that verifies — is the same fact to a
+ * caller: this browser has not learned of any machines it did not already
+ * know. The sources built from pairing records stand either way, which is the
+ * whole point of `GET /directory` being availability and nothing else.
+ */
+export async function readDirectory(opts: {
+  origin: string
+  fleetPub: Uint8Array
+  devicePub: Uint8Array
+  fetch?: DirectoryFetch
+}): Promise<FleetView> {
+  const get = opts.fetch ?? browserFetch
+  let body: string
+  let entries: unknown
+  try {
+    const res = await get(new URL(DIRECTORY_PATH, opts.origin).toString())
+    if (!res.ok) return NOTHING
+    body = await res.text()
+    if (body.length > MAX_DOCUMENT_CHARS) return NOTHING
+    const doc: unknown = JSON.parse(body)
+    entries = (doc as { entries?: unknown } | null)?.entries
+  } catch {
+    // A network error, a body that is not JSON, a relay answering HTML. All
+    // of them are "not caught up", never "refuse to work".
+    return NOTHING
+  }
+  if (!Array.isArray(entries)) return NOTHING
+
+  // Collected first, ranked second. No order is promised in the answer, so a
+  // revocation may arrive before the certificate it kills — and must still
+  // kill it.
+  const machines = new Map<string, DirectoryMachine>()
+  const revoked = new Set<string>()
+  let verified = 0
+
+  for (const entry of entries.slice(0, MAX_ENTRIES)) {
+    const blob = decodeBlob((entry as { blob?: unknown } | null)?.blob)
+    if (blob === null) continue
+    const cert = verifyCert(opts.fleetPub, blob)
+    if (cert === null) continue
+    verified++
+    ingest(cert, machines, revoked)
+  }
+
+  return {
+    machines: [...machines.values()].sort((a, b) => a.id.localeCompare(b.id)),
+    // The reader's rule, in one line: a revocation outranks every device
+    // certificate for the same key, whatever their timestamps. The caller
+    // holds its own certificate now (crypto/keys.ts) and this is what tells it
+    // to stop presenting it — presenting a revoked certificate would be
+    // refused by any daemon that has heard of the revocation (AddFromFleetCert
+    // checks the list inside its own write), so carrying one buys nothing but
+    // a channel that closes.
+    revoked: revoked.has(keyHex(opts.devicePub)),
+    entries: entries.length,
+    verified,
+  }
+}
+
+/** File one verified certificate under whichever of the three rules it is. */
+function ingest(
+  cert: Cert,
+  machines: Map<string, DirectoryMachine>,
+  revoked: Set<string>,
+): void {
+  switch (cert.kind) {
+    case 'machine': {
+      // Two certificates for one machine is a machine that re-minted — a
+      // daemon reinstalled, a static key regenerated — and both were signed
+      // by the fleet, so this is a freshness question rather than a trust
+      // one. The later `iat` wins; a tie keeps the first seen, which is
+      // arbitrary and says so.
+      const held = machines.get(cert.id)
+      if (held === undefined || cert.iat > held.iat) {
+        machines.set(cert.id, { id: cert.id, name: cert.name, noise: cert.noise, iat: cert.iat })
+      }
+      break
+    }
+    case 'device':
+      // Nothing. A device certificate reaches the device it belongs to over
+      // the pairing answer and every relayed welcome (internal/daemon), so
+      // this browser already holds its own and no browser was ever owed
+      // anybody else's. Nothing in a fleet publishes them here — no released
+      // flue even has a directory — so one arriving is an anomaly rather than
+      // an older machine. It is counted as verified, because it is, and
+      // otherwise ignored; the status surfaces are where the count is named.
+      break
+    case 'revoke':
+      revoked.add(keyHex(cert.device))
+      break
+  }
+}
+
+/**
+ * One entry's `blob`: standard base64 with padding — the alphabet Go's
+ * `encoding/json` reads a `[]byte` in, which is why the Worker writes it.
+ *
+ * The entry's `key` is deliberately not checked. It is the digest of these
+ * bytes and the relay's own filing name; recomputing it would prove the relay
+ * can hash, which is not a question anything here turns on. What decides
+ * whether these bytes mean anything is the signature over them.
+ */
+function decodeBlob(value: unknown): Uint8Array | null {
+  if (typeof value !== 'string' || value === '') return null
+  // Four base64 characters per three bytes, so the ceiling on the encoding is
+  // the ceiling on the bytes — checked before `atob` allocates anything.
+  if (value.length > Math.ceil(MAX_BLOB_BYTES / 3) * 4) return null
+  let raw: string
+  try {
+    raw = atob(value)
+  } catch {
+    return null
+  }
+  if (raw.length === 0 || raw.length > MAX_BLOB_BYTES) return null
+  return Uint8Array.from(raw, (c) => c.charCodeAt(0))
+}
+
+/**
+ * The real read: credential-less, uncached, and with no cookies on it.
+ *
+ * `credentials: 'omit'` because there is nothing to present and nothing this
+ * route would do with it — the directory holds signed, public artifacts, and
+ * the secret is what says who may *write*. `cache: 'no-store'` because a
+ * revocation the browser learns of an hour late is an hour of a device that
+ * should have been cut off; the Worker sends no-store too, and this is the
+ * half that does not depend on the relay being honest about it.
+ */
+function browserFetch(url: string): Promise<DirectoryAnswer> {
+  return fetch(url, { cache: 'no-store', credentials: 'omit' })
+}
diff --git a/web/src/relay/machines.test.ts b/web/src/relay/machines.test.ts
index 40c8f6f..a33aa6e 100644
--- a/web/src/relay/machines.test.ts
+++ b/web/src/relay/machines.test.ts
@@ -7,6 +7,7 @@ import {
   forgetMachine,
   listMachines,
   MACHINE_ID,
+  mergeMachines,
   saveMachine,
   SELECTED_KEY,
   type MachineRecord,
@@ -153,3 +154,69 @@ describe('bootMachine', () => {
     expect(bootMachine()).toBeNull()
   })
 })
+
+describe('mergeMachines', () => {
+  it('lists the stored records when the fleet named none', () => {
+    expect(mergeMachines([MESA, ATTIC], [])).toEqual([
+      { id: 'blue-mesa', name: 'Blue Mesa', via: 'pairing' },
+      { id: 'attic-pi', name: 'Attic Pi', via: 'pairing' },
+    ])
+  })
+
+  it('adds a machine the fleet named and this browser never paired with', () => {
+    // The whole point of the directory: a machine that ran `flue relay join`
+    // last week appears without anybody scanning anything.
+    expect(mergeMachines([MESA], [{ id: 'loft-9f9f', name: 'Loft' }])).toEqual([
+      { id: 'blue-mesa', name: 'Blue Mesa', via: 'pairing' },
+      { id: 'loft-9f9f', name: 'Loft', via: 'directory' },
+    ])
+  })
+
+  it('does not list a machine twice when both know it', () => {
+    const merged = mergeMachines([MESA], [{ id: 'blue-mesa', name: 'Blue Mesa' }])
+    expect(merged).toHaveLength(1)
+    expect(merged[0]!.via).toBe('pairing')
+  })
+
+  it('takes the fleet’s name for a machine that was renamed', () => {
+    // The stored name was copied out of a pairing link at some past moment;
+    // the fleet's is the machine's own word, signed and re-minted when it is
+    // renamed. The machine knows what it is called.
+    const merged = mergeMachines([MESA], [{ id: 'blue-mesa', name: 'Mesa Verde' }])
+    expect(merged[0]).toEqual({ id: 'blue-mesa', name: 'Mesa Verde', via: 'pairing' })
+  })
+
+  it('keeps the stored name when the fleet’s is empty', () => {
+    const merged = mergeMachines([MESA], [{ id: 'blue-mesa', name: '' }])
+    expect(merged[0]!.name).toBe('Blue Mesa')
+  })
+
+  it('falls back to the id for a fleet machine with no name at all', () => {
+    expect(mergeMachines([], [{ id: 'loft-9f9f', name: '' }])[0]).toEqual({
+      id: 'loft-9f9f',
+      name: 'loft-9f9f',
+      via: 'directory',
+    })
+  })
+
+  it('refuses a fleet id outside the grammar the relay routes', () => {
+    // A certificate is signed, not sanitised. An id the Worker answers 404
+    // for is a row that could only ever fail to connect, wherever it came
+    // from — and one carrying a slash would be a path, not an id.
+    expect(
+      mergeMachines([], [
+        { id: 'Loft', name: 'capitals' },
+        { id: 'a/b', name: 'a path' },
+        { id: '', name: 'nothing' },
+        { id: 'loft-9f9f', name: 'Loft' },
+      ]).map((m) => m.id),
+    ).toEqual(['loft-9f9f'])
+  })
+
+  it('holds no key of any kind', () => {
+    // The line this module lives on: what the UI lists, never what the
+    // handshake spends. The `noise` key stays with whoever verified it.
+    const merged = mergeMachines([MESA], [{ id: 'loft-9f9f', name: 'Loft' }])
+    for (const row of merged) expect(Object.keys(row).sort()).toEqual(['id', 'name', 'via'])
+  })
+})
diff --git a/web/src/relay/machines.ts b/web/src/relay/machines.ts
index 222970b..0a303ce 100644
--- a/web/src/relay/machines.ts
+++ b/web/src/relay/machines.ts
@@ -10,6 +10,13 @@
  * store, and this module never holds a key — the two stores part ways at
  * exactly the line between "what the UI lists" and "what the handshake spends".
  *
+ * A ceremony is no longer the only way a machine gets onto the list. The fleet
+ * directory names every machine the fleet has vouched for, including ones that
+ * joined long after this browser paired, and `mergeMachines` below is where
+ * the two lists become one. What arrives from there is signed rather than
+ * stored, so it is measured the same way: an id outside the grammar is a row
+ * this module will not list, wherever it came from.
+ *
  * Everything read out of storage is measured rather than believed. localStorage
  * is writable by anything on the origin and survives every deploy, so a corrupt
  * document, a foreign shape or an id the relay would refuse all parse to the
@@ -94,6 +101,70 @@ export function listMachines(): MachineRecord[] {
     .map(({ id, name, pairedAt }) => ({ id, name, pairedAt }))
 }
 
+/**
+ * One machine the fleet can offer, whether or not a ceremony ever wrote it
+ * down here.
+ *
+ * `via` is how this browser came to know of it, and it is the difference
+ * between two kinds of row: a `pairing` row is one this browser performed a
+ * ceremony for and holds a pinned key for, and a `directory` row is one the
+ * fleet vouched for — a machine that ran `flue relay join` last week and has
+ * never met this device. Callers need the distinction because the two are
+ * reached differently: the first by the key pinned at its ceremony, the second
+ * by the key inside its machine certificate.
+ *
+ * No `pairedAt`: a directory row has no such moment, and inventing one would
+ * put a date on a screen that nothing on this browser witnessed.
+ */
+export interface FleetMachine {
+  id: string
+  name: string
+  via: 'pairing' | 'directory'
+}
+
+/**
+ * Fold the machines the fleet named into the machines this browser wrote
+ * down.
+ *
+ * Records first, in stored order, so a browser that paired three machines
+ * still lists them in the order it met them; then whatever the directory named
+ * and the records did not, in the order it was given (`readDirectory` sorts by
+ * id, so that is stable across reads).
+ *
+ * **A name from the fleet beats the stored one.** The stored name was copied
+ * out of a pairing link at a moment in the past; the directory's is the
+ * machine's own word, signed under the fleet key and re-minted when the
+ * machine is renamed. It is the same judgement `FleetClient.localWelcome`
+ * makes when the daemon's welcome names the machine it is: the machine knows
+ * what it is called. An empty one is not a rename, and does not win.
+ *
+ * Deliberately key-free. This module lists what a picker can show and never
+ * holds a key — the machine certificate's `noise` key stays with the caller
+ * that verified it, on the far side of exactly the line between "what the UI
+ * lists" and "what the handshake spends".
+ *
+ * Ids from the directory are held to the same grammar the stored ones are:
+ * a certificate is signed, not sanitised, and an id outside the shape the
+ * relay routes would be a row that can only ever 404.
+ */
+export function mergeMachines(
+  records: readonly MachineRecord[],
+  learned: readonly { id: string; name: string }[],
+): FleetMachine[] {
+  const named = new Map(learned.filter((m) => MACHINE_ID.test(m.id)).map((m) => [m.id, m.name]))
+  const out: FleetMachine[] = records.map((r) => ({
+    id: r.id,
+    name: named.get(r.id) || r.name,
+    via: 'pairing',
+  }))
+  const held = new Set(records.map((r) => r.id))
+  for (const [id, name] of named) {
+    if (held.has(id)) continue
+    out.push({ id, name: name || id, via: 'directory' })
+  }
+  return out
+}
+
 /**
  * Write one machine down, replacing any record under the same id.
  *
diff --git a/web/src/relay/socket.test.ts b/web/src/relay/socket.test.ts
index 93a57a9..38518bd 100644
--- a/web/src/relay/socket.test.ts
+++ b/web/src/relay/socket.test.ts
@@ -1,5 +1,6 @@
 import { afterEach, describe, expect, it, vi } from 'vitest'
 import { x25519 } from '@noble/curves/ed25519.js'
+import certs from '../../../testdata/fleet/certs.json'
 import vectors from '../../../testdata/noise/ik.json'
 import { FlueClient } from '@/client/client'
 import type { NoiseChannel } from '@/crypto/noise'
@@ -95,6 +96,12 @@ class FakeDaemon {
     return peer
   }
 
+  /** What message A carried in its payload slot — the fleet device
+   *  certificate a real daemon reads there, or empty. */
+  payload(): Uint8Array | null {
+    return this.hs.payload()
+  }
+
   /** The next wire-protocol frame the client sent, decrypted and unframed. */
   read(raw: FakeRaw): { text: boolean; data: Uint8Array } {
     return decodePlain(this.channel!.open(this.take(raw)))
@@ -134,12 +141,14 @@ function harness(
     daemonPriv?: Uint8Array
     pin?: Uint8Array
     machineId?: string
+    deviceCert?: Uint8Array
   } = {},
 ) {
   const daemonPriv = opts.daemonPriv ?? DAEMON_PRIV
   const identity: RelayIdentity = {
     deviceKey: { privateKey: DEVICE_PRIV, publicKey: x25519.getPublicKey(DEVICE_PRIV) },
     daemonPub: opts.pin ?? x25519.getPublicKey(daemonPriv),
+    ...(opts.deviceCert !== undefined && { deviceCert: opts.deviceCert }),
   }
   const urls: string[] = []
   const raws: FakeRaw[] = []
@@ -245,6 +254,32 @@ describe('opening the relay socket', () => {
     expect(hex(h.daemon.handshake(h.raw))).toBe(hex(h.identity.deviceKey.publicKey))
   })
 
+  it('seals the fleet device certificate into message A', () => {
+    // Rule 2 of the daemon's acceptance order reads exactly this slot
+    // (internal/transport/relay/channel.go, admitByFleetCert): a machine this
+    // browser never paired with admits it on the certificate, or not at all.
+    // Sealed, not sent beside — the relay forwarding these bytes reads none
+    // of them.
+    const cert = unhex(certs.cases.find((c) => c.name === 'device')!.signedHex)
+    const h = harness({ deviceCert: cert })
+    h.raw.open()
+
+    h.daemon.handshake(h.raw)
+    expect(hex(h.daemon.payload()!)).toBe(hex(cert))
+    // The certificate is inside the sealed payload, so message A grew by
+    // exactly its length: nothing was sent alongside.
+    expect(h.raw.binary()[0]!.byteLength).toBe(96 + cert.length)
+  })
+
+  it('sends an empty payload when this browser holds no certificate', () => {
+    // The ordinary case for a browser paired to this machine directly: rule 1
+    // finds its key in the daemon's own registry and never looks here.
+    const h = harness()
+    h.raw.open()
+    h.daemon.handshake(h.raw)
+    expect(h.daemon.payload()).toHaveLength(0)
+  })
+
   it('fires onopen only once the handshake has completed', () => {
     const h = harness()
     h.raw.open()
diff --git a/web/src/relay/socket.ts b/web/src/relay/socket.ts
index 04f56af..3cd2a04 100644
--- a/web/src/relay/socket.ts
+++ b/web/src/relay/socket.ts
@@ -60,11 +60,24 @@ export interface RelayIdentity {
   /** This browser's static Noise key, from `@/crypto/keys`. */
   deviceKey: DeviceKey
   /**
-   * The daemon's static public key, pinned at pairing time. The relay
-   * authorizes no browser — Noise against this key is what proves the far
-   * end, and the handshake fails closed against anything else.
+   * The daemon's static public key. Pinned at pairing time for a machine this
+   * browser paired with, or taken from a machine certificate that verified
+   * under the pinned fleet key (relay/directory.ts) for one it never met. The
+   * relay authorizes no browser — Noise against this key is what proves the
+   * far end, and the handshake fails closed against anything else.
    */
   daemonPub: Uint8Array
+  /**
+   * This device's fleet certificate, sealed into message A's payload.
+   *
+   * It is how a daemon that has never seen this device admits it: the
+   * certificate verifies under the fleet public key and names exactly the
+   * static key the handshake proves possession of
+   * (internal/transport/relay/channel.go, rule 2). Absent for a browser that
+   * has none — pairing on this machine still works without one, because rule
+   * 1 finds the key in the daemon's own registry and never reads the payload.
+   */
+  deviceCert?: Uint8Array
 }
 
 /** The subset of WebSocket this socket drives, so tests can substitute one. */
@@ -94,7 +107,9 @@ export function relaySocket(
   machineId: string,
   wsFactory: (url: string) => RawSocket = browserSocket,
 ): SocketLike {
-  const hs = initiatorHandshake(identity.deviceKey.privateKey, identity.daemonPub)
+  const hs = initiatorHandshake(identity.deviceKey.privateKey, identity.daemonPub, {
+    payload: identity.deviceCert,
+  })
 
   /**
    * Null until `dial` runs at the bottom of this function. Nothing else in
diff --git a/web/src/router.tsx b/web/src/router.tsx
index 2ef000b..abd6e48 100644
--- a/web/src/router.tsx
+++ b/web/src/router.tsx
@@ -213,10 +213,11 @@ const pairRoute = createRoute({
    */
   validateSearch: (
     search: Record<string, unknown>,
-  ): { t?: string; k?: string; d?: string; n?: string } => {
-    const out: { t?: string; k?: string; d?: string; n?: string } = {}
+  ): { t?: string; k?: string; f?: string; d?: string; n?: string } => {
+    const out: { t?: string; k?: string; f?: string; d?: string; n?: string } = {}
     if (typeof search.t === 'string' && search.t !== '') out.t = search.t
     if (typeof search.k === 'string' && search.k !== '') out.k = search.k
+    if (typeof search.f === 'string' && search.f !== '') out.f = search.f
     if (typeof search.d === 'string' && search.d !== '') out.d = search.d
     if (typeof search.n === 'string' && search.n !== '') out.n = search.n
     return out
diff --git a/web/src/routes/pair.test.tsx b/web/src/routes/pair.test.tsx
index ec2d4cb..f01c7d4 100644
--- a/web/src/routes/pair.test.tsx
+++ b/web/src/routes/pair.test.tsx
@@ -4,9 +4,17 @@ import { RouterProvider } from '@tanstack/react-router'
 import { IDBFactory } from 'fake-indexeddb'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-import { loadOrCreateDeviceKey, loadPinnedDaemonKey, loadPinnedDaemonKeyFor } from '@/crypto/keys'
+import {
+  loadOrCreateDeviceKey,
+  loadPinnedDaemonKey,
+  loadPinnedDaemonKeyFor,
+  loadPinnedDeviceCert,
+  loadPinnedFleetKey,
+  savePinnedFleetKey,
+} from '@/crypto/keys'
 import { listMachines } from '@/relay/machines'
 import { createFlueRouter } from '@/router'
+import { base64, deviceCert, FLEET_PUB, machineCert, OTHER_SEED } from '@/testing/fleet'
 
 /** The token a QR code carries: unpadded URL-safe base64 of 32 bytes. */
 const TOKEN = 'Zm91cnRlZW4tY2hhcnMtb2YtdG9rZW4tc2hhcGVkLXQ'
@@ -23,6 +31,10 @@ const DAEMON_PUB_PARAM = urlSafe(DAEMON_PUB)
 const OTHER_PUB_BYTES = Uint8Array.from({ length: 32 }, (_, i) => 200 - i)
 const OTHER_PUB = btoa(String.fromCharCode(...OTHER_PUB_BYTES))
 
+/** The fleet public key, as `?f=` carries it: 32 bytes, unpadded URL-safe. */
+const FLEET_PUB_BYTES = Uint8Array.from({ length: 32 }, (_, i) => 100 + i)
+const FLEET_PUB_PARAM = urlSafe(btoa(String.fromCharCode(...FLEET_PUB_BYTES)))
+
 /** A whole pairing link, as the QR encodes it: the token and the key. */
 const LINK = `?t=${TOKEN}&k=${DAEMON_PUB_PARAM}`
 
@@ -509,6 +521,61 @@ describe('PairRoute on a relay origin', () => {
     expect(machines[0]!.pairedAt).toBeGreaterThan(0)
   })
 
+  it('pins the fleet key the link carried, and only from the link', async () => {
+    // The anchor for every machine this browser has not paired with: a
+    // certificate that verifies under this key is a machine it will dial.
+    // So it comes out of the QR — the one leg no intermediary can sit in —
+    // and never out of the answer to the POST.
+    fetchMock.mockResolvedValue(paired())
+    await renderRelayPair(`${LINK}&f=${FLEET_PUB_PARAM}&d=blue-mesa&n=Blue%20Mesa`)
+
+    await userEvent.click(await armedPairButton())
+    await screen.findByRole('heading', { name: 'Paired' })
+
+    expect(await loadPinnedFleetKey()).toEqual(FLEET_PUB_BYTES)
+    // The machine's own pin is unaffected: two facts, two records.
+    expect(await loadPinnedDaemonKeyFor('blue-mesa')).toEqual(DAEMON_PUB_BYTES)
+  })
+
+  it('pairs the machine alone when the link carries no fleet key', async () => {
+    // A relay from before the fleet key, or a daemon that holds none. The
+    // ceremony is the one it always was, and nothing fleet-wide is pinned.
+    fetchMock.mockResolvedValue(paired())
+    await renderRelayPair(`${LINK}&d=blue-mesa`)
+
+    await userEvent.click(await armedPairButton())
+    await screen.findByRole('heading', { name: 'Paired' })
+
+    expect(await loadPinnedFleetKey()).toBeNull()
+    expect(await loadPinnedDaemonKeyFor('blue-mesa')).toEqual(DAEMON_PUB_BYTES)
+  })
+
+  it('pins no fleet key from an `f` that is not 32 bytes', async () => {
+    // Nothing writes a short `f` but something that rewrote the link. It is
+    // refused as no fleet key rather than rounded off into one, and this
+    // machine still pairs — a browser that trusted it would be verifying
+    // every machine certificate under bytes a stranger chose.
+    fetchMock.mockResolvedValue(paired())
+    await renderRelayPair(`${LINK}&f=c2hvcnQ&d=blue-mesa`)
+
+    await userEvent.click(await armedPairButton())
+    await screen.findByRole('heading', { name: 'Paired' })
+
+    expect(await loadPinnedFleetKey()).toBeNull()
+    expect(await loadPinnedDaemonKeyFor('blue-mesa')).toEqual(DAEMON_PUB_BYTES)
+  })
+
+  it('scrubs the fleet key out of the address bar with the rest', async () => {
+    fetchMock.mockResolvedValue(paired())
+    await renderRelayPair(`${LINK}&f=${FLEET_PUB_PARAM}&d=blue-mesa`)
+    await waitFor(() => expect(document.location.search).toBe('?d=blue-mesa'))
+
+    // And the ceremony still runs on what the first render captured.
+    await userEvent.click(await armedPairButton())
+    await screen.findByRole('heading', { name: 'Paired' })
+    expect(await loadPinnedFleetKey()).toEqual(FLEET_PUB_BYTES)
+  })
+
   it('scrubs the secrets but keeps the machine the link names', async () => {
     // `location` is this suite's stub and stays frozen; `document.location`
     // is the real bar the scrub rewrites, so it is where the rewrite shows.
@@ -581,3 +648,128 @@ describe('PairRoute on a relay origin', () => {
     expect(fetchMock).not.toHaveBeenCalled()
   })
 })
+
+/*
+ * The certificate the answer carries.
+ *
+ * This is the primary delivery — the welcome's copy is the second chance, and
+ * for a loopback tab there is no second chance at all — so it is worth its own
+ * suite. The signer is the real one from testdata/fleet/certs.json, because
+ * the whole assertion is a signature: `f` in the link is the public half, and
+ * a certificate is kept only if that key signed it.
+ *
+ * The device key is created before the render so the certificates below can
+ * name it. The page loads the same one out of this test's own IndexedDB.
+ */
+describe('PairRoute and the certificate in the answer', () => {
+  /** The real fleet key as `?f=` carries it: unpadded URL-safe base64. */
+  const REAL_FLEET_PARAM = urlSafe(base64(FLEET_PUB))
+  const relayLink = (over = '') => `${LINK}&f=${REAL_FLEET_PARAM}&d=blue-mesa${over}`
+
+  it('keeps a certificate the link’s fleet key signed for this browser', async () => {
+    const key = await loadOrCreateDeviceKey()
+    const cert = deviceCert(key.publicKey, 'Pixel by the sink', 'blue-mesa')
+    fetchMock.mockResolvedValue(paired({ deviceCert: base64(cert) }))
+    await renderRelayPair(relayLink())
+
+    await userEvent.click(await armedPairButton())
+    await screen.findByRole('heading', { name: 'Paired' })
+
+    // The bytes, unchanged: this is what the browser presents to every machine
+    // it has not paired with by hand, and a machine will check the signature.
+    expect(await loadPinnedDeviceCert()).toEqual(cert)
+    // And the pins the ceremony is really about are untouched by it.
+    expect(await loadPinnedFleetKey()).toEqual(FLEET_PUB)
+    expect(await loadPinnedDaemonKeyFor('blue-mesa')).toEqual(DAEMON_PUB_BYTES)
+  })
+
+  it('drops a certificate signed by another fleet key', async () => {
+    // The attack this check exists for. The certificate rides the same channel
+    // as the answer, so whatever is on the far end can put anything there; the
+    // key that decides is the one the camera read, and a certificate signed by
+    // some other key is a machine list this browser would dial and a handshake
+    // every one of them would refuse.
+    const key = await loadOrCreateDeviceKey()
+    const forged = deviceCert(key.publicKey, 'Pixel', 'blue-mesa', 1_754_700_000, OTHER_SEED)
+    fetchMock.mockResolvedValue(paired({ deviceCert: base64(forged) }))
+    await renderRelayPair(relayLink())
+
+    await userEvent.click(await armedPairButton())
+    // The pairing itself stands: the daemon answered as the key in the QR, and
+    // this device reaches the machine it just paired with by that key alone.
+    await screen.findByRole('heading', { name: 'Paired' })
+
+    expect(await loadPinnedDeviceCert()).toBeNull()
+    expect(await loadPinnedDaemonKeyFor('blue-mesa')).toEqual(DAEMON_PUB_BYTES)
+  })
+
+  it('drops a certificate that names a different device', async () => {
+    // Well signed, and not this browser's to hold: a certificate is a
+    // statement about one device key, and presenting somebody else's proves
+    // nothing this browser can back with the private half it holds.
+    const someoneElse = Uint8Array.from({ length: 32 }, (_, i) => 0x40 + i)
+    fetchMock.mockResolvedValue(paired({ deviceCert: base64(deviceCert(someoneElse)) }))
+    await renderRelayPair(relayLink())
+
+    await userEvent.click(await armedPairButton())
+    await screen.findByRole('heading', { name: 'Paired' })
+
+    expect(await loadPinnedDeviceCert()).toBeNull()
+  })
+
+  it('drops a machine certificate offered where a device one belongs', async () => {
+    // It verifies perfectly well and says nothing about any device.
+    const noise = Uint8Array.from({ length: 32 }, (_, i) => 0x10 + i)
+    fetchMock.mockResolvedValue(paired({ deviceCert: base64(machineCert('blue-mesa', 'Blue Mesa', noise)) }))
+    await renderRelayPair(relayLink())
+
+    await userEvent.click(await armedPairButton())
+    await screen.findByRole('heading', { name: 'Paired' })
+
+    expect(await loadPinnedDeviceCert()).toBeNull()
+  })
+
+  it('pairs without complaint when the answer carries no certificate', async () => {
+    // The ordinary answer from a daemon holding no fleet key, or one with no
+    // place on a relay yet. Nothing is stored and nothing is wrong: this
+    // device reaches the machine it paired with, which is what it always did.
+    fetchMock.mockResolvedValue(paired())
+    await renderRelayPair(relayLink())
+
+    await userEvent.click(await armedPairButton())
+    await screen.findByRole('heading', { name: 'Paired' })
+
+    expect(await loadPinnedDeviceCert()).toBeNull()
+    expect(status()).not.toMatch(/certificate/i)
+  })
+
+  it('ignores a garbled certificate rather than failing the pairing', async () => {
+    fetchMock.mockResolvedValue(paired({ deviceCert: 'not base64 at all !!' }))
+    await renderRelayPair(relayLink())
+
+    await userEvent.click(await armedPairButton())
+    await screen.findByRole('heading', { name: 'Paired' })
+
+    expect(await loadPinnedDeviceCert()).toBeNull()
+    expect(await loadPinnedDaemonKeyFor('blue-mesa')).toEqual(DAEMON_PUB_BYTES)
+  })
+
+  it('keeps nothing from a link with no fleet key, however well it verifies', async () => {
+    // The ordering that makes the check mean anything: the key the certificate
+    // is verified under comes from the link and is never re-read from storage.
+    // Here the browser already holds a pinned fleet key and the answer carries
+    // a certificate that key signed — and the link names no fleet at all, so
+    // the certificate is not considered. A page that reached for the stored
+    // key instead would keep it, and would be trusting a pin some earlier
+    // ceremony wrote to decide what this one may hand it.
+    await savePinnedFleetKey(FLEET_PUB)
+    const key = await loadOrCreateDeviceKey()
+    fetchMock.mockResolvedValue(paired({ deviceCert: base64(deviceCert(key.publicKey)) }))
+    await renderRelayPair(`${LINK}&d=blue-mesa`)
+
+    await userEvent.click(await armedPairButton())
+    await screen.findByRole('heading', { name: 'Paired' })
+
+    expect(await loadPinnedDeviceCert()).toBeNull()
+  })
+})
diff --git a/web/src/routes/pair.tsx b/web/src/routes/pair.tsx
index 1f50366..128c473 100644
--- a/web/src/routes/pair.tsx
+++ b/web/src/routes/pair.tsx
@@ -3,10 +3,13 @@ import { useSearch } from '@tanstack/react-router'
 
 import { Button } from '@/components/ui/button'
 import { Input } from '@/components/ui/input'
+import { sameKey as sameCertKey, verifyCert } from '@/crypto/cert'
 import {
   loadOrCreateDeviceKey,
   savePinnedDaemonKey,
   savePinnedDaemonKeyFor,
+  savePinnedDeviceCert,
+  savePinnedFleetKey,
   type DeviceKey,
 } from '@/crypto/keys'
 import { scrubPairingParams } from '@/lib/url'
@@ -125,6 +128,9 @@ const FIELD_LABEL = 'text-base/6 font-medium text-zinc-950 sm:text-sm/6 dark:tex
 interface PairAnswer {
   deviceId?: unknown
   daemonPub?: unknown
+  /** This device's fleet certificate, base64, when the ceremony minted one.
+   *  Absent from a daemon with no fleet key or no place on a relay. */
+  deviceCert?: unknown
 }
 
 /**
@@ -165,13 +171,13 @@ function fromBase64(text: string): Uint8Array | null {
 }
 
 /**
- * The daemon's static key as the QR carries it: unpadded URL-safe base64.
+ * A key as the QR carries it: 32 bytes in unpadded URL-safe base64.
  *
- * `?k=` is spliced into the pairing URL raw by the daemon — see conn.go, which
- * does the same with the token — so the alphabet is RFC 4648 §5 and there is no
- * padding to strip. Anything that is not exactly 32 bytes of that is not a
- * Noise static key and is refused as one, rather than being rounded off into a
- * shorter string that happens to decode.
+ * `?k=` and `?f=` are spliced into the pairing URL raw by the daemon — see
+ * conn.go, which does the same with the token — so the alphabet is RFC 4648 §5
+ * and there is no padding to strip. Anything that is not exactly 32 bytes of
+ * that is not a key of either kind and is refused as one, rather than being
+ * rounded off into a shorter string that happens to decode.
  */
 function keyFromLink(text: string): Uint8Array | null {
   if (text === '' || /[^A-Za-z0-9_-]/.test(text)) return null
@@ -180,6 +186,59 @@ function keyFromLink(text: string): Uint8Array | null {
   return key !== null && key.length === KEY_BYTES ? key : null
 }
 
+/**
+ * Keep the fleet certificate the ceremony handed over, if it is this device's.
+ *
+ * Three checks and no arguing with the result. It has to decode; it has to
+ * verify under the fleet key **from the link**, which is the one thing on this
+ * page no intermediary could have chosen; and it has to be a device
+ * certificate naming *this* browser's key. Anything else is dropped in silence.
+ *
+ * Silence is right because a missing certificate is not a broken pairing. The
+ * device is registered on the machine it just paired with and reaches it by
+ * key alone; what a certificate adds is the machines it has *not* paired with,
+ * and a daemon with no fleet key or no place on a relay legitimately mints
+ * none.
+ *
+ * **How much of a second chance there is depends on which page this is.** A
+ * tab paired *through the relay* has one: every welcome carries the same blob
+ * again (internal/daemon/conn.go, fleetCertFor), so any machine it can still
+ * reach re-supplies it. A tab paired over **loopback** has none — the daemon
+ * cannot know which device a cookie-authenticated tab is, so it sends no
+ * certificate in that welcome, and a loopback ceremony pins the daemon key
+ * without a machine id (`savePinnedDaemonKey` below), so such a tab holds no
+ * per-machine pin to reach a sibling with and has nobody else to ask. For that
+ * tab this answer is the only delivery there is; losing what it wrote means
+ * pairing again.
+ *
+ * The store failure is swallowed for the same reason and not the same shape as
+ * the daemon key's, which fails the ceremony: without the daemon's key this
+ * device can reach nothing, and without this it reaches everything it paired
+ * with.
+ */
+async function keepDeviceCert(
+  value: unknown,
+  fleetPub: Uint8Array,
+  devicePub: Uint8Array,
+): Promise<void> {
+  if (typeof value !== 'string' || value === '') return
+  const blob = fromBase64(value)
+  if (blob === null) return
+  const cert = verifyCert(fleetPub, blob)
+  // Not merely "it verified": a machine certificate, or a certificate for
+  // somebody else's device, verifies perfectly well and is not this browser's
+  // to hold or to present.
+  if (cert === null || cert.kind !== 'device' || !sameCertKey(cert.device, devicePub)) return
+  try {
+    await savePinnedDeviceCert(blob)
+  } catch {
+    // A store that would not keep it costs the fleet, not the pairing: this
+    // device still reaches the machine it just paired with. A relay tab is
+    // offered it again on its next welcome; a loopback one is not, and pairs
+    // again. See the note above.
+  }
+}
+
 /** Longer than any refusal written for a person; the daemon's own is two
  *  words. */
 const MAX_QUOTED = 200
@@ -315,7 +374,7 @@ export function PairRoute() {
    * landing on the no-token explanation is the ceremony over, not broken.
    */
   const link = useRef(search)
-  const { t, k, d, n } = link.current
+  const { t, k, f, d, n } = link.current
 
   /*
    * The one look the address bar gets. The moment the render above has the
@@ -341,6 +400,7 @@ export function PairRoute() {
    */
   const token = typeof t === 'string' ? t : ''
   const carried = typeof k === 'string' ? k : ''
+  const carriedFleet = typeof f === 'string' ? f : ''
 
   /**
    * Whether this page was served by a relay, which is the fork in the whole
@@ -377,6 +437,23 @@ export function PairRoute() {
    */
   const pinned = useMemo(() => keyFromLink(carried), [carried])
 
+  /**
+   * The fleet public key, from the same QR and by the same argument one level
+   * up: `pinned` is which machine this device may talk to, and this is which
+   * *fleet* — every machine whose certificate verifies under it, including
+   * ones that join months from now (spec/fleet-trust.md). A device that
+   * learned it from the answer to its own POST, or from the directory it is
+   * about to read, would be trusting whoever sat in the middle to name the
+   * fleet.
+   *
+   * Absent is an ordinary link, not a broken one: a daemon with no fleet key
+   * omits the parameter, and pairing then means this machine alone. Present
+   * but not 32 bytes is neither — nothing writes that but something that
+   * rewrote the link — so it is refused as no fleet key rather than rounded
+   * off into one, and the ceremony carries on for this machine.
+   */
+  const pinnedFleet = useMemo(() => keyFromLink(carriedFleet), [carriedFleet])
+
   const [key, setKey] = useState<DeviceKey | null>(null)
   const [label, setLabel] = useState(defaultLabel)
   const [sending, setSending] = useState(false)
@@ -430,10 +507,15 @@ export function PairRoute() {
    * no better account of why than it does, and a paraphrase would be this page
    * inventing a reason.
    *
-   * `expected` is the key from the QR, taken as an argument rather than read
-   * from the closure so that this function cannot be reached without one.
+   * `expected` is the daemon key from the QR and `fleet` the fleet key beside
+   * it, both taken as arguments rather than read from the closure so that this
+   * function cannot be reached without the first.
    */
-  async function attempt(device: DeviceKey, expected: Uint8Array): Promise<Failure | null> {
+  async function attempt(
+    device: DeviceKey,
+    expected: Uint8Array,
+    fleet: Uint8Array | null,
+  ): Promise<Failure | null> {
     // On a relay the machine id picks the hub; submit() cannot run without one
     // there, so the bare endpoint is always the loopback daemon's own.
     const endpoint =
@@ -514,6 +596,26 @@ export function PairRoute() {
       } else {
         await savePinnedDaemonKey(expected)
       }
+      // Last, and from the link rather than from anything the daemon said.
+      // The pins above are this machine; this one is the fleet — with it the
+      // browser accepts any machine whose certificate verifies under it, so
+      // it is written only after the ceremony this device physically
+      // performed has otherwise succeeded. A link with no `f` writes nothing
+      // and pairs this machine alone, which is what a relay from before the
+      // fleet key gives.
+      if (fleet !== null) await savePinnedFleetKey(fleet)
+      // And this device's own certificate, if the ceremony minted one: the
+      // blob it will present to every machine it has *not* paired with.
+      //
+      // Checked here rather than taken on trust, under the fleet key from the
+      // link and against this browser's own device key. The certificate came
+      // down the same channel the answer did, so the daemon could be anything
+      // until the QR's key says otherwise — and a certificate naming somebody
+      // else's device key is not this browser's to keep or to present. A
+      // failed check writes nothing and costs nothing: the pairing stands and
+      // this device reaches the machine it just paired with, which is what a
+      // ceremony against a daemon holding no fleet key gives anyway.
+      if (fleet !== null) await keepDeviceCert(answer?.deviceCert, fleet, device.publicKey)
     } catch {
       return {
         text: `This browser would not keep the daemon’s key, so this device cannot reach it. ${ORPHAN_NOTE}`,
@@ -529,7 +631,7 @@ export function PairRoute() {
     const named = label.trim() || FALLBACK_LABEL
     setFailure(null)
     setSending(true)
-    void attempt(key, pinned).then((outcome) => {
+    void attempt(key, pinned, pinnedFleet).then((outcome) => {
       setSending(false)
       if (outcome === null) setPaired(named)
       else setFailure(outcome)
diff --git a/web/src/routes/remote.test.tsx b/web/src/routes/remote.test.tsx
index dbddaa1..025512e 100644
--- a/web/src/routes/remote.test.tsx
+++ b/web/src/routes/remote.test.tsx
@@ -4,6 +4,7 @@ import { afterEach, describe, expect, it, vi } from 'vitest'
 
 import { FlueClientProvider } from '@/client/provider'
 import type { RelayInfo } from '@/client/protocol'
+import { DIRECTORY_WARN_AT, MAX_ENTRIES } from '@/relay/directory'
 import { renderWithRouter } from '@/testing/render'
 import { fakeClient, type FakeSocket } from '@/testing/socket'
 import { RemoteRoute } from './remote'
@@ -51,6 +52,31 @@ async function mountRemote({ relay }: { relay?: RelayInfo } = {}) {
 const SETUP = 'flue relay setup'
 const STATUS = 'flue relay status'
 
+/**
+ * Run a case with /api/relay/info answering `info`.
+ *
+ * The screen asks the daemon for everything the welcome does not carry — what
+ * can be deployed, and what the fleet directory holds — so a case about either
+ * has to stub the endpoint, and put the global back afterwards.
+ */
+async function withRelayInfo(info: unknown, run: () => Promise<void>): Promise<void> {
+  vi.stubGlobal(
+    'fetch',
+    vi.fn(
+      async () =>
+        new Response(JSON.stringify(info), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        }),
+    ),
+  )
+  try {
+    await run()
+  } finally {
+    vi.unstubAllGlobals()
+  }
+}
+
 /** What a browser that refuses the clipboard is told. */
 const BY_HAND =
   'This browser would not hand flue the clipboard — select the command and copy it yourself.'
@@ -152,6 +178,154 @@ describe('RemoteRoute', () => {
     }
   })
 
+  it('reports what this machine hears of its fleet', async () => {
+    // Two legs to one relay, and they fail apart: the badge above says this
+    // machine can be reached, and this says it can hear what the other
+    // machines have signed — which is what a revocation travels on.
+    await withRelayInfo(
+      {
+        configured: true,
+        can_deploy: true,
+        version: 'v',
+        directory: {
+          connected: true,
+          entries: 7,
+          verified: 7,
+          machines: 2,
+          devices: 3,
+          revocations: 2,
+        },
+      },
+      async () => {
+        await mountRemote({ relay: RELAY_UP })
+        expect(await screen.findByText(/2 machines, 2 revocations/)).toBeTruthy()
+        // Device certificates are not published to the directory any more, so
+        // three of them there is an anomaly, named rather than counted
+        // silently beside the machines — and named without guessing at a
+        // cause, since no released flue has a directory to have published one
+        // from.
+        expect(
+          screen.getByText(
+            /3 device certificates in the directory: nothing in this fleet should be publishing one/,
+          ),
+        ).toBeTruthy()
+      },
+    )
+  })
+
+  it('says so when this machine is reachable and hearing nothing', async () => {
+    // The flag day: a relay deployed before the FleetDirectory object answers
+    // nothing on /directory. Sessions are fine, so nothing else on this
+    // screen would say a word about it.
+    await withRelayInfo(
+      {
+        configured: true,
+        can_deploy: true,
+        version: 'v',
+        directory: {
+          connected: false,
+          entries: 0,
+          verified: 0,
+          machines: 0,
+          devices: 0,
+          revocations: 0,
+        },
+      },
+      async () => {
+        await mountRemote({ relay: RELAY_UP })
+        expect(await screen.findByText(/not reading the fleet directory/)).toBeTruthy()
+        expect(screen.getByText(/flue relay update/)).toBeTruthy()
+      },
+    )
+  })
+
+  it('names the entries this fleet key did not sign', async () => {
+    await withRelayInfo(
+      {
+        configured: true,
+        can_deploy: true,
+        version: 'v',
+        directory: {
+          connected: true,
+          entries: 9,
+          verified: 7,
+          machines: 2,
+          devices: 3,
+          revocations: 2,
+        },
+      },
+      async () => {
+        await mountRemote({ relay: RELAY_UP })
+        expect(await screen.findByText(/2 entries in the directory were signed by something else/))
+          .toBeTruthy()
+      },
+    )
+  })
+
+  it('warns before the directory fills, and names the way out', async () => {
+    // The cap has no gentle failure: at 512 the relay refuses every new blob
+    // before storing it and therefore before pushing it, so a revoke made
+    // past that point reaches nobody, and nothing frees an entry short of a
+    // reset. A screen that only reported the counts would leave a 507 in a
+    // daemon log as the operator's first signal.
+    await withRelayInfo(
+      {
+        configured: true,
+        can_deploy: true,
+        version: 'v',
+        directory: {
+          connected: true,
+          entries: DIRECTORY_WARN_AT,
+          verified: DIRECTORY_WARN_AT,
+          machines: 2,
+          devices: 400,
+          revocations: 58,
+        },
+      },
+      async () => {
+        await mountRemote({ relay: RELAY_UP })
+        expect(
+          await screen.findByText(
+            new RegExp(`${DIRECTORY_WARN_AT} of ${MAX_ENTRIES} entries full`),
+          ),
+        ).toBeTruthy()
+        expect(screen.getByText(/flue relay reset/)).toBeTruthy()
+      },
+    )
+  })
+
+  it('says nothing about capacity while there is room to spare', async () => {
+    await withRelayInfo(
+      {
+        configured: true,
+        can_deploy: true,
+        version: 'v',
+        directory: {
+          connected: true,
+          entries: DIRECTORY_WARN_AT - 1,
+          verified: DIRECTORY_WARN_AT - 1,
+          machines: 2,
+          devices: 400,
+          revocations: 57,
+        },
+      },
+      async () => {
+        await mountRemote({ relay: RELAY_UP })
+        expect(await screen.findByText(/2 machines, 57 revocations/)).toBeTruthy()
+        expect(screen.queryByText(/flue relay reset/)).toBeNull()
+      },
+    )
+  })
+
+  it('says nothing about a fleet on a daemon that is reading no directory', async () => {
+    await withRelayInfo({ configured: true, can_deploy: true, version: 'v' }, async () => {
+      await mountRemote({ relay: RELAY_UP })
+      expect(await screen.findByText('Connected')).toBeTruthy()
+      expect(screen.queryByText(/fleet directory/)).toBeNull()
+      expect(screen.queryByText(/machines,/)).toBeNull()
+    })
+  })
+
   it('copies the address the relay carries this machine at', async () => {
     // Copyable for the same reason the commands are: this is a string somebody
     // sends to themselves, and it is longer than a phone is wide.
diff --git a/web/src/routes/remote.tsx b/web/src/routes/remote.tsx
index 222489d..cc14f52 100644
--- a/web/src/routes/remote.tsx
+++ b/web/src/routes/remote.tsx
@@ -9,6 +9,7 @@ import {
   CloudflareConfiguredCard,
   CloudflareConnectCard,
   useRelayUIInfo,
+  type DirectoryCounts,
   type RelayUIInfo,
 } from '@/components/cloudflare-connect'
 import { Command, Copyable } from '@/components/copyable'
@@ -18,6 +19,7 @@ import { Button } from '@/components/ui/button'
 import { Skeleton } from '@/components/ui/skeleton'
 import { useRelayTransport } from '@/hooks/use-relay-transport'
 import { cn } from '@/lib/utils'
+import { DIRECTORY_WARN_AT, MAX_ENTRIES } from '@/relay/directory'
 
 /**
  * The commands this screen hands over, spelled exactly as the CLI spells them
@@ -39,6 +41,10 @@ const STATUS_COMMAND = 'flue relay status'
  */
 const PROSE = 'text-base/7 text-pretty text-zinc-600 sm:text-sm/6 dark:text-zinc-400'
 
+/** The quieter voice, for a fact under a paragraph rather than a paragraph of
+ *  its own — the same size the Cloudflare card's own notes are set in. */
+const NOTE = 'text-sm/6 text-pretty text-zinc-600 sm:text-xs/5 dark:text-zinc-400'
+
 /**
  * What to say about a connection that is not currently carrying anything.
  *
@@ -283,13 +289,14 @@ function Dialling() {
  * `reachable` in routes/devices.tsx — so this is where the reader is told the
  * gate has opened, with the way through it beside the sentence.
  */
-function Reachable({ origin }: { origin: string }) {
+function Reachable({ origin, directory }: { origin: string; directory?: DirectoryCounts }) {
   return (
     <StatePanel icon={GlobeAltIcon} title="Reachable from anywhere">
       <p className={cn(PROSE, 'max-w-[65ch]')}>
         The relay carries this machine at the address below, and you can pair a device against this
         address now — the code Devices offers names it rather than 127.0.0.1.
       </p>
+      <FleetLine directory={directory} />
       {/*
         Copyable, and breakable, as the pairing URL on Devices is: this is a
         string somebody may want to send to themselves, and a relay origin on
@@ -325,6 +332,99 @@ function Reachable({ origin }: { origin: string }) {
   )
 }
 
+/**
+ * What this machine can hear of its fleet, under the address it answers on.
+ *
+ * Two legs go to one relay and they fail apart: the hub leg above is whether
+ * this machine can be *reached*, and this is whether it hears what the other
+ * machines have signed — which is what a device certificate and, far more
+ * urgently, a revocation travel on. A machine reachable but deaf still serves
+ * every device paired to it and will not learn that one of them was cut off
+ * elsewhere, and nothing on this screen said so before.
+ *
+ * Nothing is rendered when the daemon is not reading a directory at all: the
+ * counts would be a claim about a leg that does not exist. `flue relay status`
+ * is named rather than paraphrased for the "why" — it asks the relay itself,
+ * from a terminal, and its answer is longer than a line of this panel.
+ */
+function FleetLine({ directory }: { directory?: DirectoryCounts }) {
+  if (directory === undefined) return null
+  if (!directory.connected) {
+    return (
+      <p className={cn(NOTE, 'max-w-[65ch]')}>
+        This machine is not reading the fleet directory, so a device paired on another machine will
+        not reach it, and a device revoked on another machine may still be admitted here. A relay
+        deployed before the directory existed answers nothing on it until{' '}
+        <code className="font-mono">flue relay update</code> is run once.
+      </p>
+    )
+  }
+  const unsigned = directory.entries - directory.verified
+  return (
+    <>
+      {/*
+        Machines and revocations, which is what the directory carries. Device
+        certificates go to the device that owns them and are not published
+        here, so a count of them would read as "this fleet has no devices"
+        when it means "the directory does not list them" — two different
+        claims, and only the second is true.
+
+        A non-zero one is still worth naming, and the wording does not guess
+        at how it got there. No released flue has a fleet directory at all,
+        so "an older flue published it" cannot be the explanation; what is
+        left is a build from between the two, or somebody with the daemon
+        secret and a PUT. Both are worth a second look and neither is worth
+        a diagnosis this screen cannot make.
+      */}
+      <p className={cn(NOTE, 'max-w-[65ch]')}>
+        Fleet: {count(directory.machines, 'machine')},{' '}
+        {count(directory.revocations, 'revocation')} — everything this machine's fleet key could
+        check.
+        {directory.devices > 0 &&
+          ` ${count(directory.devices, 'device certificate')} in the directory: nothing in this fleet should be publishing one.`}
+        {unsigned > 0 &&
+          ` ${count(unsigned, 'entry', 'entries')} in the directory ${
+            unsigned === 1 ? 'was' : 'were'
+          } signed by something else; this relay may belong to another fleet.`}
+      </p>
+      <FleetCapacity entries={directory.entries} />
+    </>
+  )
+}
+
+/**
+ * How close the directory is to the one limit it has no gentle failure for.
+ *
+ * Nothing above 10% of headroom, because a screen that reports health three
+ * ways is one nobody reads. Past that it is worth the room: at the cap the
+ * relay refuses every new blob *before* storing it and therefore before
+ * pushing it, so a device paired after that point reaches only the machine
+ * that paired it, and a revocation made after it reaches nobody at all. No
+ * deploy or update frees an entry — `flue relay reset` is the only thing that
+ * does, and the fleet republishes into the empty directory by itself.
+ */
+function FleetCapacity({ entries }: { entries: number }) {
+  if (entries < DIRECTORY_WARN_AT) return null
+  const full = entries >= MAX_ENTRIES
+  return (
+    <p className={cn(NOTE, 'max-w-[65ch]')}>
+      {full
+        ? `The fleet directory is full (${entries} of ${MAX_ENTRIES} entries). `
+        : `The fleet directory is ${entries} of ${MAX_ENTRIES} entries full. `}
+      {full ? 'Nothing new is being distributed' : `At ${MAX_ENTRIES} nothing new is distributed`} —
+      a device paired from here reaches only this machine, and a revoke reaches nobody. Run{' '}
+      <code className="font-mono">flue relay reset</code> to empty it; every machine republishes
+      what it holds.
+    </p>
+  )
+}
+
+/** One or many, spelled out: "1 machines" makes a screen look like it is
+ *  guessing. */
+function count(n: number, one: string, many = `${one}s`): string {
+  return `${n} ${n === 1 ? one : many}`
+}
+
 /**
  * Remote access: whether anything outside this computer can reach these
  * sessions, and what to do about it either way.
@@ -461,7 +561,7 @@ export function RemoteRoute() {
       {greeted && status === 'connecting' && <Dialling />}
       {greeted && status === 'connected' && (
         <>
-          <Reachable origin={origin} />
+          <Reachable origin={origin} {...(relayUI?.directory && { directory: relayUI.directory })} />
           {relayUI?.configured && (
             <Integrations>
               <CloudflareConfiguredCard info={relayUI} />
diff --git a/web/src/testing/fleet.ts b/web/src/testing/fleet.ts
new file mode 100644
index 0000000..137cfc5
--- /dev/null
+++ b/web/src/testing/fleet.ts
@@ -0,0 +1,122 @@
+/*
+ * A fleet key that signs, for tests only.
+ *
+ * The browser verifies and never signs, so `crypto/cert.ts` has no signing
+ * half — but a test that wants to watch a directory being read needs
+ * certificates that verify, and a fixture cannot supply every shape a case
+ * needs (two machines, a certificate re-minted a second later, one signed by
+ * a stranger). So this holds the private half and mints them.
+ *
+ * The seed is testdata/fleet/certs.json's, which is what keeps this honest:
+ * `FLEET_PUB` is asserted against the fixture's own `publicKeyHex` below, so
+ * a signer that drifted from Go's would fail before any case ran.
+ */
+import { ed25519 } from '@noble/curves/ed25519.js'
+
+import fixture from '../../../testdata/fleet/certs.json'
+import { encodeCert, type Cert } from '@/crypto/cert'
+import type { DirectoryAnswer, DirectoryFetch } from '@/relay/directory'
+
+const unhex = (s: string) => new Uint8Array((s.match(/.{2}/g) ?? []).map((b) => parseInt(b, 16)))
+
+/** The fixture's seed, decoded from the unpadded base64url the join line
+ *  carries it in. */
+export const FLEET_SEED = Uint8Array.from(
+  atob(fixture.seed.replace(/-/g, '+').replace(/_/g, '/').padEnd(44, '=')),
+  (c) => c.charCodeAt(0),
+)
+
+/** The public half every reader verifies under. */
+export const FLEET_PUB = ed25519.getPublicKey(FLEET_SEED)
+
+/** Some other fleet entirely: a key that signs perfectly well and is not
+ *  the one any browser in these tests pinned. */
+export const OTHER_SEED = new Uint8Array(32).fill(9)
+export const OTHER_PUB = ed25519.getPublicKey(OTHER_SEED)
+
+if (
+  Array.from(FLEET_PUB, (b) => b.toString(16).padStart(2, '0')).join('') !== fixture.publicKeyHex
+) {
+  throw new Error('testing/fleet: this signer does not agree with testdata/fleet/certs.json')
+}
+
+/** One signed blob: the canonical bytes, then the signature over them. */
+export function signCert(cert: Cert, seed: Uint8Array = FLEET_SEED): Uint8Array {
+  const canonical = encodeCert(cert)
+  const sig = ed25519.sign(canonical, seed)
+  const out = new Uint8Array(canonical.length + sig.length)
+  out.set(canonical)
+  out.set(sig, canonical.length)
+  return out
+}
+
+/** A machine certificate, with the fields a test rarely cares about filled. */
+export function machineCert(
+  id: string,
+  name: string,
+  noise: Uint8Array,
+  iat = 1_754_700_000,
+  seed = FLEET_SEED,
+): Uint8Array {
+  return signCert({ kind: 'machine', id, name, noise, iat }, seed)
+}
+
+/** A device certificate for one device key. */
+export function deviceCert(
+  device: Uint8Array,
+  name = 'phone',
+  pairedOn = 'attic-pi',
+  iat = 1_754_700_000,
+  seed = FLEET_SEED,
+): Uint8Array {
+  return signCert({ kind: 'device', device, name, pairedOn, iat }, seed)
+}
+
+/** A revocation for one device key. */
+export function revocation(
+  device: Uint8Array,
+  iat = 1_754_700_000,
+  seed = FLEET_SEED,
+): Uint8Array {
+  return signCert({ kind: 'revoke', device, iat }, seed)
+}
+
+/** Standard base64 with padding, the alphabet the Worker writes `blob` in. */
+export function base64(bytes: Uint8Array): string {
+  let binary = ''
+  for (const b of bytes) binary += String.fromCharCode(b)
+  return btoa(binary)
+}
+
+/**
+ * A stand-in for `GET /directory`: the document the Worker answers with,
+ * around whatever blobs a case wants in it.
+ *
+ * The entry keys are left empty rather than computed. Nothing in the reader
+ * looks at them — the signature over the bytes is what decides whether an
+ * entry means anything — and a helper that filled them in would suggest
+ * otherwise.
+ */
+export function directoryFetch(
+  blobs: Uint8Array[],
+  init: { ok?: boolean; status?: number; body?: string } = {},
+): DirectoryFetch & { calls: string[] } {
+  const calls: string[] = []
+  const body =
+    init.body ?? JSON.stringify({ v: 1, entries: blobs.map((b) => ({ key: '', blob: base64(b) })) })
+  const fetch = (url: string): Promise<DirectoryAnswer> => {
+    calls.push(url)
+    return Promise.resolve({
+      ok: init.ok ?? true,
+      status: init.status ?? 200,
+      text: () => Promise.resolve(body),
+    })
+  }
+  return Object.assign(fetch, { calls })
+}
+
+/** The fixture's own device key, for cases that want the committed vectors
+ *  rather than a minted one. */
+export const FIXTURE_DEVICE = unhex(
+  fixture.cases.find((c) => c.name === 'device')!.cert.deviceHex!,
+)
diff --git a/web/src/testing/noise-daemon.ts b/web/src/testing/noise-daemon.ts
index a7ddf29..51a5ac4 100644
--- a/web/src/testing/noise-daemon.ts
+++ b/web/src/testing/noise-daemon.ts
@@ -121,6 +121,17 @@ export interface ResponderHandshake {
    * how a browser pinning the wrong daemon fails.
    */
   readMessageA(msg: Uint8Array): Uint8Array
+  /**
+   * The payload message A carried, once it has been read: a fleet device
+   * certificate, or empty for a browser that holds none. Null before
+   * `readMessageA`.
+   *
+   * The real daemon does the same thing with it — `admitByFleetCert` reads
+   * exactly these bytes out of exactly this slot — which is what lets a test
+   * assert that the browser presented the certificate it was given rather
+   * than merely that it connected.
+   */
+  payload(): Uint8Array | null
   /** Writes `<- e, ee, se` and splits, returning both the bytes to send and
    *  the transport channel that follows them. */
   messageB(): { msg: Uint8Array; channel: NoiseChannel }
@@ -141,6 +152,7 @@ export function responderHandshake(
 
   let re: Uint8Array | null = null
   let rs: Uint8Array | null = null
+  let handshakePayload: Uint8Array | null = null
 
   return {
     readMessageA(msg) {
@@ -157,9 +169,13 @@ export function responderHandshake(
       rs = ss.decryptAndHash(msg.slice(KEY_LEN, KEY_LEN + KEY_LEN + TAG_LEN))
       // <- ss
       ss.mixKey(x25519.getSharedSecret(s.priv, rs))
-      ss.decryptAndHash(msg.slice(KEY_LEN + KEY_LEN + TAG_LEN)) // empty payload
+      // The payload slot: a fleet device certificate, or empty.
+      handshakePayload = ss.decryptAndHash(msg.slice(KEY_LEN + KEY_LEN + TAG_LEN))
       return rs
     },
+    payload() {
+      return handshakePayload
+    },
     messageB() {
       if (!re || !rs) throw new Error('noise: messageB before messageA')
       // -> e