diff --git a/.agent/domain-map.json b/.agent/domain-map.json
index b09f64e809..7b8c9a8051 100644
--- a/.agent/domain-map.json
+++ b/.agent/domain-map.json
@@ -92,6 +92,7 @@
         "packages/ai-sandbox-e2b",
         "packages/ai-sandbox-local-process",
         "packages/ai-sandbox-railway",
+        "packages/ai-sandbox-render",
         "packages/ai-sandbox-sprites",
         "packages/ai-sandbox-upstash-box",
         "packages/ai-sandbox-vercel"
diff --git a/.changeset/add-ai-sandbox-render.md b/.changeset/add-ai-sandbox-render.md
new file mode 100644
index 0000000000..88cfe6ef6c
--- /dev/null
+++ b/.changeset/add-ai-sandbox-render.md
@@ -0,0 +1,17 @@
+---
+'@tanstack/ai-sandbox-render': minor
+---
+
+Add `@tanstack/ai-sandbox-render`, a sandbox provider backed by
+[Render](https://render.com/docs/sandboxes) sandboxes through `@renderinc/sdk`.
+It implements the `SandboxProvider` / `SandboxHandle` contract: native file
+transfer for reads and writes, shell-backed `list`, `mkdir`, `remove`,
+`rename`, `exists` and a non-following `lstat`, commands with separate stdout
+and stderr, background processes, a shared env overlay, filesystem or
+runtime snapshots, resume by id, and an enforced `deny-all` network policy.
+
+`killableProcesses` is `true` and measured against a real sandbox: every
+command records its process group, and `kill()` or an aborted `signal` sends
+the requested signal (`TERM` by default) to the group from a second command,
+then `KILL` after 2 s. `ports`,
+`writableStdin` and `fork` are `false`.
diff --git a/docs/sandbox/providers-advanced.md b/docs/sandbox/providers-advanced.md
index 68479eeb81..6e3f9802b4 100644
--- a/docs/sandbox/providers-advanced.md
+++ b/docs/sandbox/providers-advanced.md
@@ -380,10 +380,50 @@ export function provider(env: SandboxAgentEnv) {
 
 The agent coordinator, durable runs, live previews through a quick tunnel, callback hosts, and the Durable Object run log are on [Cloudflare](./cloudflare) and [Cloudflare Edge Details](./cloudflare-advanced).
 
+## Render
+
+```ts
+import { renderSandbox } from '@tanstack/ai-sandbox-render'
+
+const render = renderSandbox({
+  plan: '2c-4g',
+  idleTimeoutSeconds: 900,
+  // Optional: when the policy allows network, allow only these hosts.
+  networkPolicy: {
+    type: 'allow-list',
+    rules: [{ domain: 'registry.npmjs.org' }, { domain: 'api.anthropic.com' }],
+  },
+})
+```
+
+- **Isolation:** a managed [Render](https://render.com/docs/sandboxes) sandbox. It boots from the base image (Debian 12, `root` user), a custom image (`buildName`), or a named snapshot (`snapshotName`).
+- **Auth:** the SDK reads `RENDER_API_KEY` and `RENDER_WORKSPACE_ID`. Pass `token` and `ownerId` to set them in code. Harness credentials are [workspace secrets](./provisioning). The provider uploads them to a shared file in `/dev/tsai` that only `root` can read. `/dev` is held in memory, so the secrets never reach the sandbox disk. Reconnecting with fresh secrets replaces that file and removes older overlays. No value goes into a command string.
+- **Lifetime:** Render suspends an idle sandbox after `idleTimeoutSeconds` (default 900) and keeps its disk, so `durableFilesystem` is `true`. The next command or file call resumes it. After `timeoutSeconds` (default 86400), Render terminates it.
+- **Network:** `policy.capabilities.network: 'deny'` sends `deny-all`, and Render enforces it. Otherwise the provider sends `networkPolicy`, or allows all egress.
+- **Not available:** inbound ports, stdin for a spawned process, and fork. `ports.connect` throws. Harnesses that need a port or stdin, such as OpenCode and ACP harnesses, do not run on Render.
+
+Snapshots and resume on Render:
+
+Take snapshots while commands are stopped. A runtime snapshot also captures memory, so the provider removes the env file for the capture and writes it back after. When multiple orchestrator processes share a sandbox, use your lifecycle lock to serialize runtime snapshots and secret updates.
+
+- `snapshot(label)` captures a `filesystem` snapshot named `tsai-<label>`, and waits until it is available. Set `snapshotKind: 'runtime'` to keep memory and processes too. A runtime snapshot restores only onto the same `plan`.
+- Render restores a snapshot only inside its sandbox group, so keep the same `sandboxGroupId` between capture and restore. `restoreSnapshot()` applies env and the network policy again. Filesystem snapshots leave out `/dev`, so they never contain the env file. Runtime snapshots retain the environment of existing processes.
+- The contract has no delete hook. Delete `tsai-*` snapshots that you do not use with `sandboxes.snapshots.delete()` from `@renderinc/sdk`.
+- Resume by id reads the sandbox status. A missing, `errored`, or `terminated` sandbox resumes as `null`. Auth and server errors are thrown again.
+- Render makes its own `sbx-` ids, so `create` ignores `input.id`. Keep the returned id in your instance store.
+
+Processes on Render:
+
+- Each command runs through `bash -c` in `/workspace`. Set `workdir` to change it. stdout and stderr stay separate, and `spawn()` reports `pid: -1`.
+- Each command has its own process group, recorded in `/tmp/tsai`. `kill(signal)` sends the requested signal and abort sends `TERM`, then `KILL` after 2 s if the group is still alive. Signals other than `TERM`, `INT`, `HUP`, `QUIT` and `KILL` become `KILL`. A cancellation marker prevents delayed commands from starting.
+- A supervising shell stops remaining children before it reports exit. A kill finishes on the confirmed remote exit. An aborted `exec` resolves with the exit code of the signal.
+- If the host disconnects, the command keeps running in the sandbox. The [run journal](./journal) owns run identity, so a new host reads the output from the journal.
+- `read`, `readBytes`, and `write` use native file transfer. Each other file call is one command, about 0.6 s. Render allows 1,000 commands per minute for each user.
+
 ## `writableStdin` per provider
 
 - `true`: local process, Docker container, Daytona, Upstash Box, E2B, boxd, and Railway.
-- `false`: Docker Sandboxes (`sbx`), Vercel, Sprites, Blaxel, and Cloudflare.
+- `false`: Docker Sandboxes (`sbx`), Vercel, Sprites, Blaxel, Cloudflare, and Render.
 
 When the value is `false`, a harness that reads its prompt from stdin gets the prompt from a file. The shell redirects that file into the process.
 
@@ -412,6 +452,7 @@ If a provider cannot be measured yet, it stays `false`. A `false` value only mak
 | Cloudflare | `false` | `kill()` does nothing. The `AbortSignal` of the caller reaches neither `exec` nor `spawn`, because Workers RPC cannot serialize one. |
 | boxd | `true` | **Measured.** The spawn wrapper runs under `setsid`, so the recorded pid leads its own process group. `kill()` runs a shell inside the machine that signals that group, then sends `KILL`, then checks with `kill -0`. Closing the stream alone is not a kill: the process survived it. Verified against production: a spawned `sleep 5 && touch <marker>` was killed, and the marker never appeared. Needs `BOXD_API_KEY`. |
 | Railway | `true` | **Measured.** `kill()` and an aborted `exec` send `TERM` to the process group, then `KILL` after 2 s. An aborted `spawn` sends `KILL` at once. Each one finishes only when the remote exit is confirmed. Verified against production: the shared journal conformance kill case passes. Spawned `sleep 5 && touch <marker>` commands (one with a background child) were killed before the marker appeared, for `kill()`, an aborted `exec`, and an aborted `spawn`. Needs `RAILWAY_API_TOKEN` or `RAILWAY_TOKEN` and `RAILWAY_ENVIRONMENT_ID`. |
+| Render | `true` | **Measured.** Each command records its process group. `kill()` sends the requested signal (`TERM` by default) to the group from a second command, then `KILL` after 2 s. A closed exec stream does not stop the process (measured), so every abort sends the kill. The shared journal conformance kill case passes against a real sandbox. Needs `RENDER_API_KEY` and `RENDER_WORKSPACE_ID`. |
 
 Each remote provider registers the shared journal conformance suite, so you can test each claim:
 
diff --git a/docs/sandbox/providers.md b/docs/sandbox/providers.md
index 587b99b1a9..bc26603d34 100644
--- a/docs/sandbox/providers.md
+++ b/docs/sandbox/providers.md
@@ -2,7 +2,7 @@
 title: Providers
 id: providers
 order: 3
-description: "Pick where a TanStack AI sandbox runs (local process, Docker container, Docker Sandboxes microVM, Daytona, Vercel, Sprites, Upstash Box, Blaxel, E2B, boxd, Railway, or Cloudflare), install it, and configure it."
+description: "Pick where a TanStack AI sandbox runs (local process, Docker container, Docker Sandboxes microVM, Daytona, Vercel, Sprites, Upstash Box, Blaxel, E2B, boxd, Railway, Cloudflare, or Render), install it, and configure it."
 ---
 
 A provider is where the sandbox runs: a local process for a fast loop, or an isolated VM in production.
@@ -27,6 +27,7 @@ A provider is that place. Every provider has the same contract, so your [workspa
 | [boxd](https://boxd.sh) | `@tanstack/ai-sandbox-boxd` | microVM | `BOXD_API_KEY` and `BOXD_ORG`. |
 | [Railway](https://railway.com) | `@tanstack/ai-sandbox-railway` | microVM | `RAILWAY_API_TOKEN` or `RAILWAY_TOKEN`, and an environment. |
 | [Cloudflare](./cloudflare) | `@tanstack/ai-sandbox-cloudflare` | Container | A `Sandbox` Durable Object binding in a Worker. |
+| [Render](https://render.com/docs/sandboxes) | `@tanstack/ai-sandbox-render` | Cloud sandbox | `RENDER_API_KEY` and `RENDER_WORKSPACE_ID` |
 
 2. Install its package. This example installs the Docker provider. Use the package from your row.
 
@@ -82,6 +83,7 @@ import { blaxelSandbox } from '@tanstack/ai-sandbox-blaxel'
 import { e2bSandbox } from '@tanstack/ai-sandbox-e2b'
 import { boxdSandbox } from '@tanstack/ai-sandbox-boxd'
 import { railwaySandbox } from '@tanstack/ai-sandbox-railway'
+import { renderSandbox } from '@tanstack/ai-sandbox-render'
 
 const dev = localProcessSandbox() // runs on your host
 const isolated = dockerSandbox({ image: 'node:22' }) // container
@@ -94,6 +96,7 @@ const blaxel = blaxelSandbox() // uses the API key or the CLI login
 const e2b = e2bSandbox() // reads E2B_API_KEY
 const boxd = boxdSandbox({ org: 'acme' }) // reads BOXD_API_KEY
 const railway = railwaySandbox() // reads RAILWAY_TOKEN and RAILWAY_ENVIRONMENT_ID
+const render = renderSandbox() // reads RENDER_API_KEY and RENDER_WORKSPACE_ID
 ```
 
 `dockerSandbox()` and `sbxSandbox()` come from the same package. Every other provider has its own package.
@@ -108,7 +111,7 @@ const railway = railwaySandbox() // reads RAILWAY_TOKEN and RAILWAY_ENVIRONMENT_
 - Provider-native snapshots and resume keep or recreate the provider state. They make bootstrap faster. [Portable Snapshots](./portable-snapshots) store finished files in your own persistence.
 
 > [!NOTE]
-> Cloud providers (Daytona, Vercel, Sprites, Upstash Box, Blaxel, E2B, boxd, and Railway) run remotely. When you drive them from your laptop, [bridged tools](./tools) cannot reach your `localhost`. Use the ngrok bridge tunnel from the [tools guide](./tools). Cloudflare is different: the Worker that owns the sandbox also runs the bridge, so there is no laptop in the path. See [Cloudflare](./cloudflare).
+> Cloud providers (Daytona, Vercel, Sprites, Upstash Box, Blaxel, E2B, boxd, Railway, and Render) run remotely. When you drive them from your laptop, [bridged tools](./tools) cannot reach your `localhost`. Use the ngrok bridge tunnel from the [tools guide](./tools). Cloudflare is different: the Worker that owns the sandbox also runs the bridge, so there is no laptop in the path. See [Cloudflare](./cloudflare).
 
 ## Capabilities
 
@@ -162,6 +165,7 @@ The [run journal](./journal) reads this flag to decide how to read a run's outpu
 | Cloudflare | `false` |
 | boxd | `true` |
 | Railway | `true` |
+| Render | `true` |
 
 A bring-your-own provider must set this flag too. For the reason behind each value, see [Providers (Advanced)](./providers-advanced#killableprocesses-per-provider).
 
diff --git a/packages/ai-sandbox-render/README.md b/packages/ai-sandbox-render/README.md
new file mode 100644
index 0000000000..b29a2bf404
--- /dev/null
+++ b/packages/ai-sandbox-render/README.md
@@ -0,0 +1,121 @@
+<div align="center">
+  <picture>
+    <source
+      media="(prefers-color-scheme: dark)"
+      srcset="https://tanstack.com/api/readme/ai.png?theme=dark"
+    />
+    <source
+      media="(prefers-color-scheme: light)"
+      srcset="https://tanstack.com/api/readme/ai.png"
+    />
+    <img
+      src="https://tanstack.com/api/readme/ai.png"
+      alt="TanStack AI"
+      width="900"
+    />
+  </picture>
+</div>
+
+<br />
+
+# @tanstack/ai-sandbox-render
+
+Render sandbox provider for [TanStack AI](https://tanstack.com/ai). Runs
+harness adapters inside [Render](https://render.com/docs/sandboxes) sandboxes
+through the uniform `SandboxHandle`: real filesystem, shell, background
+processes, snapshots, and an enforced egress policy.
+
+## Install
+
+```bash
+npm install @tanstack/ai @tanstack/ai-sandbox @tanstack/ai-sandbox-render
+```
+
+Set `RENDER_API_KEY` and `RENDER_WORKSPACE_ID` (your `tea-` workspace id).
+
+## Usage
+
+```ts
+import {
+  defineSandbox,
+  defineWorkspace,
+  withSandbox,
+} from '@tanstack/ai-sandbox'
+import { renderSandbox } from '@tanstack/ai-sandbox-render'
+
+const sandbox = defineSandbox({
+  id: 'agent',
+  provider: renderSandbox({ plan: '2c-4g', idleTimeoutSeconds: 900 }),
+  workspace: defineWorkspace({/* source, setup, secrets */}),
+})
+
+// Then pass `withSandbox(sandbox)` as chat() middleware.
+```
+
+Use the provider directly through the `SandboxHandle`:
+
+```ts
+import { renderSandbox } from '@tanstack/ai-sandbox-render'
+
+const provider = renderSandbox()
+const sbx = await provider.create({})
+try {
+  await sbx.fs.write('/workspace/hello.txt', 'hello from render')
+  console.log(await sbx.fs.read('/workspace/hello.txt'))
+
+  const run = await sbx.process.exec('node --version')
+  console.log('node', run.stdout.trim(), 'exit', run.exitCode)
+
+  const ref = await sbx.snapshot!('after-setup')
+  const copy = await provider.restoreSnapshot!({ snapshotId: ref.id })
+  await copy.destroy()
+} finally {
+  await sbx.destroy()
+}
+```
+
+## Configuration
+
+| Option               | Default               | Notes                                                                                                          |
+| -------------------- | --------------------- | -------------------------------------------------------------------------------------------------------------- |
+| `token`              | `RENDER_API_KEY`      | Render API key.                                                                                                |
+| `ownerId`            | `RENDER_WORKSPACE_ID` | Workspace id (`tea-...`).                                                                                      |
+| `client`             | none                  | A pre-built `SandboxesClient` from `@renderinc/sdk`. Set `token` and `ownerId` on it; passing them too throws. |
+| `sandboxGroupId`     | workspace default     | Snapshots restore only inside the group they were captured in.                                                 |
+| `plan`               | `1c-2g`               | `1c-2g`, `2c-4g`, `4c-8g`, `8c-16g`, or a newer plan.                                                          |
+| `timeoutSeconds`     | `86400`               | Maximum continuous runtime. Render terminates the sandbox after it.                                            |
+| `idleTimeoutSeconds` | `900`                 | Render suspends an idle sandbox and keeps its disk. `0` turns off idle suspension.                             |
+| `networkPolicy`      | `allow-all`           | Egress when the policy allows network, for example an `allow-list`. A `deny` policy sends `deny-all`.          |
+| `buildName`          | none                  | Boot every new sandbox from this Render sandbox build (a custom image).                                        |
+| `snapshotName`       | none                  | Boot every new sandbox from this named snapshot.                                                               |
+| `snapshotKind`       | `filesystem`          | What `snapshot()` captures. `runtime` also keeps memory and processes, and needs the same `plan`.              |
+| `workdir`            | `/workspace`          | Where the `/workspace` virtual root maps. Created at boot.                                                     |
+
+Render makes its own `sbx-` ids, so `create` ignores the id that `ensure()`
+passes. Keep the returned id in your instance store.
+
+## Capabilities
+
+| Capability            | Supported | Why                                                                                                                                                                                                   |
+| --------------------- | --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `fs`                  | yes       | `read`, `readBytes`, and `write` use native file transfer. Other calls run one shell command each. `lstat` is a GNU `stat` probe that does not follow symlinks.                                       |
+| `exec`                | yes       | Separate `stdout` and `stderr`. An aborted `exec` resolves with the exit code of the signal.                                                                                                          |
+| `env`                 | yes       | Create-time env plus a shared root-only overlay in memory-backed `/dev`, replaced when secrets are reapplied. No value goes into a command string.                                                    |
+| `backgroundProcesses` | yes       | `spawn()` streams output. `pid` is `-1`. A command keeps running if the host disconnects.                                                                                                             |
+| `killableProcesses`   | yes       | A supervisor owns each command group and stops remaining children. `kill(signal)` sends the requested signal (`TERM` by default), then `KILL` after 2 s, and prevents delayed commands from starting. |
+| `snapshots`           | yes       | `filesystem` by default, `runtime` with `snapshotKind`. Named `tsai-<label>`.                                                                                                                         |
+| `networkPolicy`       | yes       | `deny-all`, `allow-all`, and `allow-list` are enforced by Render.                                                                                                                                     |
+| `durableFilesystem`   | yes       | An idle sandbox suspends with its disk and resumes on the next command or file call.                                                                                                                  |
+| `ports`               | no        | Render sandboxes have no inbound ports.                                                                                                                                                               |
+| `writableStdin`       | no        | Render exec has no stdin. Harnesses get their prompt from a file.                                                                                                                                     |
+| `fork`                | no        | Render has no native fork.                                                                                                                                                                            |
+
+## Known limits
+
+- **No ports and no stdin.** Harnesses that need either one, such as OpenCode
+  and ACP harnesses, do not run on Render. Claude Code and Codex run.
+- **Snapshots are not deleted for you.** Delete `tsai-*` snapshots that you do
+  not use with `sandboxes.snapshots.delete()` from `@renderinc/sdk`.
+- **Live tests need credentials.** `tests/render.test.ts` and the journal
+  conformance suite run only with `RENDER_API_KEY` and `RENDER_WORKSPACE_ID`.
+  Without them they report a named skip.
diff --git a/packages/ai-sandbox-render/package.json b/packages/ai-sandbox-render/package.json
new file mode 100644
index 0000000000..17ce4b4cac
--- /dev/null
+++ b/packages/ai-sandbox-render/package.json
@@ -0,0 +1,55 @@
+{
+  "name": "@tanstack/ai-sandbox-render",
+  "version": "0.0.0",
+  "description": "Render sandbox provider for TanStack AI — run harness adapters inside Render sandboxes through the uniform SandboxHandle.",
+  "author": "",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/TanStack/ai.git",
+    "directory": "packages/ai-sandbox-render"
+  },
+  "keywords": [
+    "ai",
+    "tanstack",
+    "sandbox",
+    "render",
+    "harness",
+    "agent",
+    "isolation"
+  ],
+  "type": "module",
+  "module": "./dist/esm/index.js",
+  "types": "./dist/esm/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/esm/index.d.ts",
+      "import": "./dist/esm/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "scripts": {
+    "build": "vite build",
+    "clean": "premove ./build ./dist",
+    "lint:fix": "oxlint src --type-aware --fix",
+    "test:build": "publint --strict",
+    "test:oxlint": "oxlint src --type-aware",
+    "test:coverage": "vitest run --coverage --coverage.include='src/**' --coverage.reporter=text-summary --coverage.reporter=json-summary",
+    "test:lib": "vitest",
+    "test:lib:dev": "pnpm test:lib --watch",
+    "test:types": "tsc"
+  },
+  "dependencies": {
+    "@renderinc/sdk": "^1.5.0"
+  },
+  "peerDependencies": {
+    "@tanstack/ai-sandbox": "workspace:^"
+  },
+  "devDependencies": {
+    "@tanstack/ai-sandbox": "workspace:*",
+    "@vitest/coverage-v8": "4.1.10"
+  }
+}
diff --git a/packages/ai-sandbox-render/src/handle.ts b/packages/ai-sandbox-render/src/handle.ts
new file mode 100644
index 0000000000..30d3a1434e
--- /dev/null
+++ b/packages/ai-sandbox-render/src/handle.ts
@@ -0,0 +1,827 @@
+/**
+ * SandboxHandle backed by a Render sandbox (via `@renderinc/sdk`). Real
+ * isolation: fs/exec/git operate inside a remote Render microVM; the
+ * `/workspace` virtual root is a real directory created at boot.
+ *
+ * File reads and writes use the SDK's native `download`/`upload`; every other
+ * fs call is one shell command. Render's `exec` takes no cwd, env, stdin or
+ * kill, and dropping its stream leaves the remote process running (measured),
+ * so every command runs through a wrapper that records its process group in a
+ * file, and `kill()` signals that group from a second `exec`. Env reaches the
+ * wrapper as a file uploaded to `/dev`, never in the command string, because
+ * Render stores command text on the sandbox's exec timeline.
+ */
+import { randomUUID } from 'node:crypto'
+import { Buffer } from 'node:buffer'
+import {
+  UnsupportedCapabilityError,
+  createExecBackedGit,
+} from '@tanstack/ai-sandbox'
+import { ClientError } from '@renderinc/sdk'
+import type { SandboxSnapshotKind, SandboxesClient } from '@renderinc/sdk'
+import type {
+  ExecResult,
+  ProcessOptions,
+  SandboxCapabilities,
+  SandboxFsStat,
+  SandboxHandle,
+  SnapshotRef,
+  SpawnHandle,
+} from '@tanstack/ai-sandbox'
+
+/** Default workspace root inside the sandbox; created at boot. */
+export const DEFAULT_WORKDIR = '/workspace'
+
+/** Prefix of every snapshot name this provider creates. */
+export const SNAPSHOT_PREFIX = 'tsai-'
+const SNAPSHOT_NAME_MAX = 64
+
+/** Byte cap per stream, for spawned processes and captured exec output. */
+const MAX_STREAM_BYTES = 8 * 1024 * 1024
+
+/**
+ * How long a kill waits for the remote exit after `TERM` and the in-sandbox
+ * `KILL` escalation (2 s) before giving up on confirming it.
+ */
+const KILL_SETTLE_MS = 12_000
+
+/** Where each command's process-group id is recorded while it runs. */
+const PGID_DIR = '/tmp/tsai'
+
+/**
+ * Where env files go. `/dev` is the sandbox's only memory-backed mount
+ * (devtmpfs, measured): filesystem snapshots leave it out and it survives an
+ * idle suspend, so secrets never reach the disk.
+ */
+export const ENV_DIR = '/dev/tsai'
+
+/** Overlays earlier versions kept on disk, removed whenever we can. */
+const LEGACY_ENV = `${PGID_DIR}/env ${PGID_DIR}/env-*`
+
+interface EnvState {
+  queue: Promise<void>
+  /** Exact shared bytes to restore if a snapshot's write-back failed. */
+  restore?: Uint8Array
+}
+
+// Handles for the same sandbox share one queue. Runtime snapshots from separate
+// orchestrator processes still need the caller's sandbox lifecycle lock.
+const envStates = new Map<string, EnvState>()
+
+/**
+ * Capability descriptor for a Render sandbox.
+ *
+ * - `killableProcesses`: every command records its process group and `kill()`
+ *   signals the group from a second exec (the requested signal, `TERM` by
+ *   default, then `KILL` after 2 s). MEASURED
+ *   against a real sandbox: a backgrounded child stopped writing after the
+ *   group kill. `tests/journal.conformance.test.ts` re-measures it.
+ * - `writableStdin` / `ports` / `fork`: Render has no exec stdin, no inbound
+ *   ports and no native fork.
+ * - `networkPolicy`: `deny-all` is enforced by Render (measured: DNS fails).
+ * - `durableFilesystem`: an idle sandbox suspends with its disk and resumes on
+ *   the next exec or file call.
+ */
+export const RENDER_CAPS: SandboxCapabilities = {
+  fs: true,
+  exec: true,
+  env: true,
+  ports: false,
+  backgroundProcesses: true,
+  writableStdin: false,
+  killableProcesses: true,
+  snapshots: true,
+  networkPolicy: true,
+  durableFilesystem: true,
+  fork: false,
+}
+
+/** POSIX single-quote escape for embedding values in `bash -c`. */
+export function q(value: string): string {
+  return `'${value.replace(/'/g, `'\\''`)}'`
+}
+
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/
+
+/** Bash read-only variables: exporting one fails, and the command never runs. */
+const READONLY_ENV = new Set([
+  'BASHOPTS',
+  'BASH_VERSINFO',
+  'EUID',
+  'PPID',
+  'SHELLOPTS',
+  'UID',
+])
+
+/**
+ * `env` as a file of `export` lines for the wrapper to source. Names are
+ * checked and values quoted, so a value cannot break out into shell code.
+ */
+export function envFileContent(env: Record<string, string>): string {
+  return Object.entries(env)
+    .map(([name, value]) => {
+      if (!ENV_NAME.test(name) || READONLY_ENV.has(name)) {
+        throw new Error(`render: invalid env var name ${JSON.stringify(name)}`)
+      }
+      return `export ${name}=${q(value)}\n`
+    })
+    .join('')
+}
+
+/** Stop a group without killing the supervisor that must reap it. */
+function stopGroup(group: string): string {
+  return `kill -TERM -- -${group} 2>/dev/null; for i in $(seq 20); do kill -0 -- -${group} 2>/dev/null || break; sleep 0.1; done; kill -KILL -- -${group} 2>/dev/null`
+}
+
+/**
+ * Job control gives the command its own group. The supervisor stops surviving
+ * descendants before reporting exit. Publish the group atomically before
+ * checking cancellation, so a kill either prevents startup or finds its group.
+ */
+export function wrapCommand(
+  command: string,
+  pgidFile: string,
+  cwd: string,
+  envFiles: Array<string>,
+  callEnvFile: string,
+): string {
+  const sourceStep = envFiles.map((file) => `. ${q(file)} && `).join('')
+  const inner = `echo $$ > ${pgidFile}.tmp && mv -f ${pgidFile}.tmp ${pgidFile} || exit $?; [ ! -e ${pgidFile}.killed ] || exit 143; ${sourceStep}rm -f ${callEnvFile} && cd ${q(cwd)} && exec bash -c ${q(command)}`
+  const supervisor = `mkdir -p ${PGID_DIR} || exit $?; set -m; bash -c ${q(inner)} & tsai_group=$!; set +m; wait "$tsai_group" 2>/dev/null; tsai_status=$?; ${stopGroup('"$tsai_group"')}; rm -f ${pgidFile} ${pgidFile}.tmp ${callEnvFile} ${pgidFile}.killed; exit $tsai_status`
+  return `bash -c ${q(supervisor)}`
+}
+
+type GroupSignal = 'TERM' | 'KILL' | 'INT' | 'HUP' | 'QUIT'
+
+const GROUP_SIGNALS: ReadonlyMap<string | number, GroupSignal> = new Map<
+  string | number,
+  GroupSignal
+>([
+  ['SIGTERM', 'TERM'],
+  [15, 'TERM'],
+  ['SIGKILL', 'KILL'],
+  [9, 'KILL'],
+  ['SIGINT', 'INT'],
+  [2, 'INT'],
+  ['SIGHUP', 'HUP'],
+  [1, 'HUP'],
+  ['SIGQUIT', 'QUIT'],
+  [3, 'QUIT'],
+])
+
+/**
+ * Map a `kill()` signal onto a name for the shell's `kill`. As in the Railway
+ * provider, any other signal is a request to stop, so it becomes `KILL`.
+ */
+export function groupSignal(signal?: NodeJS.Signals | number): GroupSignal {
+  if (signal === undefined) return 'TERM'
+  return GROUP_SIGNALS.get(signal) ?? 'KILL'
+}
+
+/**
+ * Signal the process group recorded in `pgidFile` with `signal`, then send
+ * `KILL` if the group is still alive after 2 s. It first leaves a `.killed`
+ * marker, so a wrapper that starts later exits without running, then waits up
+ * to 2 s for the file so a kill that races the start still lands. Cleans up
+ * the files a killed wrapper leaves behind.
+ */
+export function killCommand(
+  pgidFile: string,
+  callEnvFile: string,
+  signal: GroupSignal = 'TERM',
+): string {
+  const cleanup = `rm -f ${pgidFile} ${callEnvFile} ${pgidFile}.killed`
+  const grace =
+    signal === 'KILL'
+      ? ''
+      : `for i in $(seq 20); do sleep 0.1; kill -0 -- -$g 2>/dev/null || { ${cleanup}; exit 0; }; done; kill -KILL -- -$g 2>/dev/null; `
+  const kill = `mkdir -p ${PGID_DIR} && touch ${pgidFile}.killed; for i in $(seq 20); do [ -f ${pgidFile} ] && break; sleep 0.1; done; g=$(cat ${pgidFile} 2>/dev/null) || exit 0; kill -${signal} -- -$g 2>/dev/null || { ${cleanup}; exit 0; }; ${grace}${cleanup}; true`
+  return `bash -c ${q(kill)}`
+}
+
+const LSTAT_MISSING = '__TANSTACK_LSTAT_MISSING__'
+
+/** Verify a missing path by listing parent entries. `test -e` also fails for inaccessible parents. */
+export function lstatCommand(path: string): string {
+  return `tanstack_lstat_path=${q(path)}; tanstack_lstat_output=$(stat -c '%f:%s' -- "$tanstack_lstat_path" 2>&1); tanstack_lstat_status=$?; if [ "$tanstack_lstat_status" -eq 0 ]; then printf '%s\n' "$tanstack_lstat_output"; else tanstack_lstat_missing() { tanstack_missing_path=$1; case "$tanstack_missing_path" in /|.) return 1 ;; */*) tanstack_parent=${'$'}{tanstack_missing_path%/*}; tanstack_name=${'$'}{tanstack_missing_path##*/}; [ -n "$tanstack_parent" ] || tanstack_parent=/ ;; *) tanstack_parent=.; tanstack_name=$tanstack_missing_path ;; esac; tanstack_parent_mode=$(stat -L -c '%f' -- "$tanstack_parent" 2>/dev/null); tanstack_parent_status=$?; if [ "$tanstack_parent_status" -ne 0 ]; then tanstack_lstat_missing "$tanstack_parent"; else case "$tanstack_parent_mode" in 4[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]) case "$tanstack_parent" in /*) tanstack_find_parent=$tanstack_parent ;; *) tanstack_find_parent=./$tanstack_parent ;; esac; tanstack_match=$(find -H "$tanstack_find_parent" -mindepth 1 -maxdepth 1 -exec sh -c 'tanstack_target=$1; shift; for tanstack_candidate do [ "${'$'}{tanstack_candidate##*/}" = "$tanstack_target" ] && { printf 1; exit 0; }; done; exit 0' sh "$tanstack_name" '{}' + 2>/dev/null); tanstack_find_status=$?; [ "$tanstack_find_status" -eq 0 ] && [ -z "$tanstack_match" ] ;; *) return 1 ;; esac; fi; }; if tanstack_lstat_missing "$tanstack_lstat_path"; then printf '%s' '${LSTAT_MISSING}'; else printf '%s\n' "$tanstack_lstat_output" >&2; exit "$tanstack_lstat_status"; fi; fi`
+}
+
+function parseLstatOutput(output: string): SandboxFsStat {
+  const fields = /^(?<mode>[0-9a-fA-F]{4}):(?<size>\d+)\n?$/.exec(output)
+  const mode = fields?.groups?.mode
+  const size = fields?.groups?.size
+  if (!mode || !size) throw new Error(`invalid lstat output: ${output}`)
+  const parsedMode = Number.parseInt(mode, 16)
+  const parsedSize = Number(size)
+  if (
+    !Number.isSafeInteger(parsedMode) ||
+    !Number.isSafeInteger(parsedSize) ||
+    parsedSize < 0
+  )
+    throw new Error(`invalid lstat output: ${output}`)
+  const type = parsedMode & 0xf000
+  if (type === 0x8000)
+    return { type: 'file', mode: parsedMode, size: parsedSize }
+  if (type === 0x4000) return { type: 'dir', mode: parsedMode }
+  if (type === 0xa000) return { type: 'symlink', mode: parsedMode }
+  return { type: 'other', mode: parsedMode }
+}
+
+/**
+ * Reject paths `rm -rf` must never see. The path is single-quoted into the
+ * command, so this guards intent (wiping the root), not injection.
+ */
+export function assertRemovablePath(path: string): void {
+  if (path.includes('\0')) throw new Error('render: path contains a NUL byte')
+  const normalized = path.replace(/\/+/g, '/').replace(/(.)\/$/, '$1')
+  if (normalized === '' || normalized === '/' || !normalized.startsWith('/')) {
+    throw new Error(`render: refusing to remove ${JSON.stringify(path)}`)
+  }
+  if (normalized.split('/').some((part) => part === '..' || part === '.')) {
+    throw new Error(
+      `render: refusing to remove a path with relative segments: ${JSON.stringify(path)}`,
+    )
+  }
+}
+
+/**
+ * A push-driven async iterable with a byte cap. The streamer pushes decoded
+ * chunks and calls `end()` once; consumers `for await` over it.
+ */
+class AsyncChunkQueue implements AsyncIterable<string> {
+  private readonly chunks: Array<string> = []
+  private readonly waiters: Array<(r: IteratorResult<string>) => void> = []
+  private ended = false
+  private bytes = 0
+
+  constructor(
+    private readonly label: string,
+    private readonly onOverflow: () => void,
+  ) {}
+
+  push(chunk: string): void {
+    if (chunk === '' || this.ended) return
+    this.bytes += Buffer.byteLength(chunk)
+    if (this.bytes > MAX_STREAM_BYTES) {
+      this.emit(
+        `\n[render] ${this.label} exceeded ${MAX_STREAM_BYTES} bytes; output truncated\n`,
+      )
+      this.end()
+      this.onOverflow()
+      return
+    }
+    this.emit(chunk)
+  }
+
+  private emit(chunk: string): void {
+    const waiter = this.waiters.shift()
+    if (waiter) waiter({ value: chunk, done: false })
+    else this.chunks.push(chunk)
+  }
+
+  end(): void {
+    this.ended = true
+    let waiter = this.waiters.shift()
+    while (waiter) {
+      waiter({ value: undefined, done: true })
+      waiter = this.waiters.shift()
+    }
+  }
+
+  [Symbol.asyncIterator](): AsyncIterator<string> {
+    return {
+      next: () => {
+        const chunk = this.chunks.shift()
+        if (chunk !== undefined) {
+          return Promise.resolve({ value: chunk, done: false })
+        }
+        if (this.ended) {
+          return Promise.resolve({ value: undefined, done: true })
+        }
+        return new Promise((resolve) => this.waiters.push(resolve))
+      },
+    }
+  }
+}
+
+/** A started command: its exit code, and a kill that settles on the exit. */
+interface RunningCommand {
+  exit: Promise<number>
+  kill: (signal?: GroupSignal) => Promise<void>
+}
+
+export interface RenderHandleDeps {
+  /** The SDK's sandboxes client. */
+  client: SandboxesClient
+  /** Sandbox id (`sbx-…`). */
+  id: string
+  /** Directory the `/workspace` virtual root maps to. */
+  workdir: string
+  /** What `snapshot()` captures. */
+  snapshotKind: SandboxSnapshotKind
+  /** Where env files go; defaults to {@link ENV_DIR}. Tests point it elsewhere. */
+  envDir?: string
+}
+
+export class RenderHandle implements SandboxHandle {
+  readonly id: string
+  readonly provider = 'render'
+  readonly workspaceRoot: string
+  readonly capabilities = RENDER_CAPS
+  readonly fs: SandboxHandle['fs']
+  readonly git: SandboxHandle['git']
+  readonly process: SandboxHandle['process']
+  readonly ports: SandboxHandle['ports']
+  readonly env: SandboxHandle['env']
+
+  private readonly client: SandboxesClient
+  private readonly workdir: string
+  private readonly snapshotKind: SandboxSnapshotKind
+  private readonly envDir: string
+  /** The env overlay, one path per sandbox: a later handle (after resume) overwrites an earlier one's secrets. */
+  private readonly envFile: string
+  private readonly envVars: Record<string, string> = {}
+  /** Bumped by each `env.set`; 0 means this handle has no overlay. */
+  private envVersion = 0
+  /** Last version this handle uploaded; another handle may have rotated it. */
+  private envWritten = 0
+
+  constructor(deps: RenderHandleDeps) {
+    this.client = deps.client
+    this.id = deps.id
+    this.workdir = deps.workdir
+    this.workspaceRoot = deps.workdir
+    this.snapshotKind = deps.snapshotKind
+    this.envDir = deps.envDir ?? ENV_DIR
+    this.envFile = `${this.envDir}/env`
+
+    this.process = {
+      exec: (command, opts) => this.exec(command, opts),
+      spawn: (command, opts) => this.spawnProcess(command, opts),
+    }
+
+    this.fs = {
+      read: async (p, o) =>
+        Buffer.from(await this.download(p, o?.signal)).toString('utf8'),
+      readBytes: (p, o) => this.download(p, o?.signal),
+      // Render creates missing parents (measured).
+      write: (p, data, o) =>
+        this.client.upload(
+          this.id,
+          this.abs(p),
+          // Copy into a fresh buffer: a caller's view may sit on a SharedArrayBuffer.
+          typeof data === 'string' ? data : Buffer.from(data),
+          undefined,
+          o?.signal ? { signal: o.signal } : undefined,
+        ),
+      list: async (p, o) => {
+        // `-p` marks directories with a trailing `/`; symlinks are not followed.
+        const r = await this.check(
+          `ls -1Ap -- ${q(this.abs(p))}`,
+          `list ${p}`,
+          o?.signal,
+        )
+        const base = p.replace(/\/$/, '')
+        return r.stdout
+          .split('\n')
+          .filter((line) => line !== '')
+          .map((line) => {
+            const name = line.replace(/\/$/, '')
+            return {
+              name,
+              path: `${base}/${name}`,
+              type: line.endsWith('/') ? ('dir' as const) : ('file' as const),
+            }
+          })
+      },
+      lstat: (p, o) => this.lstat(this.abs(p), o?.signal),
+      mkdir: async (p, o) => {
+        await this.check(
+          `mkdir -p -- ${q(this.abs(p))}`,
+          `mkdir ${p}`,
+          o?.signal,
+        )
+      },
+      remove: async (p, o) => {
+        const path = this.abs(p)
+        assertRemovablePath(path)
+        await this.check(`rm -rf -- ${q(path)}`, `remove ${p}`, o?.signal)
+      },
+      rename: async (from, to, o) => {
+        await this.check(
+          `mv -f -- ${q(this.abs(from))} ${q(this.abs(to))}`,
+          `rename ${from}`,
+          o?.signal,
+        )
+      },
+      exists: async (p, o) => {
+        const path = q(this.abs(p))
+        const r = await this.sh(`test -e ${path} || test -L ${path}`, o?.signal)
+        return r.exitCode === 0
+      },
+    }
+
+    this.git = createExecBackedGit(this.process, this.workspaceRoot)
+
+    this.ports = {
+      connect: () =>
+        Promise.reject(
+          new UnsupportedCapabilityError(
+            'render',
+            'ports',
+            'Render sandboxes do not expose inbound ports.',
+          ),
+        ),
+    }
+
+    this.env = {
+      // Render has no VM-wide mutable env, so the overlay is handle-local and
+      // uploaded to `/dev` as a root-only file (uploads land 0600, measured)
+      // that every later exec/spawn sources. TanStack re-applies workspace
+      // secrets through this on resume and restore.
+      set: async (vars) => {
+        // Check names first, so a rejected call leaves the overlay unchanged.
+        envFileContent(vars)
+        Object.assign(this.envVars, vars)
+        this.envVersion++
+        await this.queueEnv(async (state) => {
+          await this.writeEnv(state)
+          // Remove overlays left by earlier versions before returning fresh credentials.
+          await this.raw(`rm -f -- ${LEGACY_ENV}`)
+        })
+      },
+    }
+  }
+
+  /**
+   * Map the `/workspace` virtual root onto the workdir and resolve relative
+   * paths against it (Render resolves them against `/root`).
+   */
+  private abs(p: string): string {
+    if (!p.startsWith('/')) return `${this.workdir}/${p}`
+    if (this.workdir === '/workspace') return p
+    if (p === '/workspace') return this.workdir
+    if (p.startsWith('/workspace/'))
+      return `${this.workdir}/${p.slice('/workspace/'.length)}`
+    return p
+  }
+
+  private async download(
+    p: string,
+    signal: AbortSignal | undefined,
+  ): Promise<Uint8Array> {
+    const file = await this.client.download(
+      this.id,
+      this.abs(p),
+      undefined,
+      signal,
+    )
+    // A directory downloads as a tar archive; reading one is an error.
+    if (file.contentType === 'application/x-tar') {
+      throw new Error(`render: ${p} is a directory`)
+    }
+    return new Uint8Array(file.data)
+  }
+
+  /**
+   * Run an fs helper from `/`. Helpers take absolute paths, and the workdir
+   * may not exist yet (creating it is the first helper `create` runs).
+   */
+  private async sh(
+    command: string,
+    signal: AbortSignal | undefined,
+  ): Promise<ExecResult> {
+    const r = await this.exec(command, {
+      cwd: '/',
+      ...(signal ? { signal } : {}),
+    })
+    // An aborted exec resolves with the killed exit code; fs calls must reject,
+    // or `exists` reads a cancel as "missing".
+    signal?.throwIfAborted()
+    return r
+  }
+
+  /** Run an fs helper and throw on a non-zero exit. */
+  private async check(
+    command: string,
+    what: string,
+    signal: AbortSignal | undefined,
+  ): Promise<ExecResult> {
+    const r = await this.sh(command, signal)
+    if (r.exitCode !== 0) {
+      throw new Error(
+        `render: ${what} failed (exit ${r.exitCode}): ${r.stderr.trim()}`,
+      )
+    }
+    return r
+  }
+
+  private async lstat(
+    path: string,
+    signal: AbortSignal | undefined,
+  ): Promise<SandboxFsStat | undefined> {
+    const r = await this.sh(lstatCommand(path), signal)
+    if (r.exitCode === 0 && r.stdout.trim() === LSTAT_MISSING) return undefined
+    if (r.exitCode !== 0) {
+      const output = `${r.stdout}\n${r.stderr}`
+      throw new Error(`lstat failed: ${output.trim()}`)
+    }
+    return parseLstatOutput(r.stdout)
+  }
+
+  /** Serialize overlay writes, capture and starts across handles of this sandbox. */
+  private queueEnv<T>(op: (state: EnvState) => Promise<T>): Promise<T> {
+    const state = envStates.get(this.id) ?? { queue: Promise.resolve() }
+    envStates.set(this.id, state)
+    const next = state.queue.then(() => op(state))
+    const settled = next.then(noop, noop)
+    state.queue = settled
+    void settled.then(() => {
+      if (
+        state.queue === settled &&
+        state.restore === undefined &&
+        envStates.get(this.id) === state
+      ) {
+        envStates.delete(this.id)
+      }
+    })
+    return next
+  }
+
+  /** Write new values or retry the exact shared overlay hidden by a snapshot. */
+  private async writeEnv(state: EnvState): Promise<void> {
+    const version = this.envVersion
+    if (version > 0 && this.envWritten !== version) {
+      await this.client.upload(
+        this.id,
+        this.envFile,
+        envFileContent(this.envVars),
+      )
+      this.envWritten = version
+      state.restore = undefined
+    } else if (state.restore !== undefined) {
+      await this.client.upload(
+        this.id,
+        this.envFile,
+        Buffer.from(state.restore),
+      )
+      state.restore = undefined
+    }
+  }
+
+  /** Control commands bypass the overlay queue; a failed cleanup must surface. */
+  private async raw(command: string): Promise<void> {
+    const events = await this.client.exec(this.id, command)
+    for await (const event of events) {
+      if (event.type === 'exit') {
+        if (event.exit_code !== 0)
+          throw new Error(
+            `render: control command failed (exit ${event.exit_code})`,
+          )
+        return
+      }
+    }
+    throw new Error('render: control command ended without an exit event')
+  }
+
+  /**
+   * Start `command` under the process-group wrapper. Abort is handled by the
+   * callers through `kill`, not the SDK signal: dropping the stream would only
+   * detach this host and leave the command running.
+   */
+  private run(
+    command: string,
+    opts: ProcessOptions | undefined,
+    onOutput: (stream: 'stdout' | 'stderr', data: string) => void,
+  ): RunningCommand {
+    const commandId = randomUUID()
+    const pgidFile = `${PGID_DIR}/${commandId}`
+    // Per-call env goes in its own file, sourced after the overlay so it wins.
+    const callEnvFile = `${this.envDir}/${commandId}.env`
+    const callEnv =
+      opts?.env && Object.keys(opts.env).length > 0
+        ? envFileContent(opts.env)
+        : undefined
+    const stream = new AbortController()
+    let settled = false
+    let killed = false
+
+    const kill = async (signal?: GroupSignal): Promise<void> => {
+      if (settled) return
+      killed = true
+      await this.raw(killCommand(pgidFile, callEnvFile, signal)).catch(
+        () => undefined,
+      )
+      await settleWithin(exit, KILL_SETTLE_MS)
+      if (!settled) {
+        stream.abort()
+        throw new Error(
+          `render: no exit confirmed ${KILL_SETTLE_MS}ms after killing \`${command}\``,
+        )
+      }
+    }
+
+    const exit = (async (): Promise<number> => {
+      // Starting is queued: it waits out overlay writes and snapshots, and
+      // rewrites the overlay if a snapshot left it missing.
+      const events = await this.queueEnv(async (state) => {
+        await this.writeEnv(state)
+        const envFiles = this.envVersion > 0 ? [this.envFile] : []
+        if (callEnv !== undefined) {
+          await this.client.upload(this.id, callEnvFile, callEnv)
+          envFiles.push(callEnvFile)
+        }
+        // Killed before the start: never start it, and remove what the kill
+        // could not see yet.
+        if (killed) {
+          await this.raw(`rm -f ${callEnvFile} ${pgidFile}.killed`).catch(noop)
+          return undefined
+        }
+        const wrapped = wrapCommand(
+          command,
+          pgidFile,
+          opts?.cwd ? this.abs(opts.cwd) : this.workdir,
+          envFiles,
+          callEnvFile,
+        )
+        return this.client.exec(this.id, wrapped, undefined, stream.signal)
+      })
+      if (events === undefined) return 128 + 15
+      for await (const event of events) {
+        if (event.type === 'output') onOutput(event.stream, event.data)
+        else return event.exit_code
+      }
+      throw new Error('render: exec stream ended without an exit event')
+    })()
+      .catch(async (error: unknown) => {
+        // The stream failed, so the process state is unknown: kill the group
+        // rather than leave it running until the sandbox times out.
+        if (!stream.signal.aborted) {
+          await this.raw(killCommand(pgidFile, callEnvFile)).catch(
+            () => undefined,
+          )
+        }
+        throw error
+      })
+      .finally(() => {
+        settled = true
+      })
+    exit.catch(() => undefined)
+
+    return { exit, kill }
+  }
+
+  private async exec(
+    command: string,
+    opts?: ProcessOptions,
+  ): Promise<ExecResult> {
+    const signal = opts?.signal
+    signal?.throwIfAborted()
+    const out = { stdout: '', stderr: '' }
+    // The cap is in UTF-8 bytes, so multi-byte output cannot exceed it.
+    const bytes = { stdout: 0, stderr: 0 }
+    // Once a stream hits the cap, drop the rest of it, not just one chunk.
+    const cut = { stdout: false, stderr: false }
+    const running = this.run(command, opts, (stream, data) => {
+      const size = Buffer.byteLength(data)
+      if (cut[stream] || bytes[stream] + size > MAX_STREAM_BYTES) {
+        cut[stream] = true
+        return
+      }
+      bytes[stream] += size
+      out[stream] += data
+    })
+    // An aborted exec kills the group and resolves with its real (signalled)
+    // exit code, as Railway does.
+    const onAbort = (): void => {
+      void running.kill().catch(() => undefined)
+    }
+    signal?.addEventListener('abort', onAbort, { once: true })
+    try {
+      const exitCode = await running.exit
+      return {
+        stdout: out.stdout,
+        stderr:
+          cut.stdout || cut.stderr
+            ? `${out.stderr}\n[render] output truncated\n`
+            : out.stderr,
+        exitCode,
+      }
+    } catch (error) {
+      if (signal?.aborted) throw signal.reason
+      throw error
+    } finally {
+      signal?.removeEventListener('abort', onAbort)
+    }
+  }
+
+  private async spawnProcess(
+    command: string,
+    opts?: ProcessOptions,
+  ): Promise<SpawnHandle> {
+    opts?.signal?.throwIfAborted()
+    const kill = (): void => {
+      void running.kill().catch(() => undefined)
+    }
+    const stdoutQ = new AsyncChunkQueue('stdout', kill)
+    const stderrQ = new AsyncChunkQueue('stderr', kill)
+    const running = this.run(command, opts, (stream, data) =>
+      (stream === 'stdout' ? stdoutQ : stderrQ).push(data),
+    )
+    opts?.signal?.addEventListener('abort', kill, { once: true })
+    const exit = running.exit.finally(() => {
+      opts?.signal?.removeEventListener('abort', kill)
+      stdoutQ.end()
+      stderrQ.end()
+    })
+    exit.catch(() => undefined)
+
+    const noStdin = (): Promise<never> =>
+      Promise.reject(
+        new UnsupportedCapabilityError(
+          'render',
+          'writableStdin',
+          'Render exec has no stdin; deliver input through a file.',
+        ),
+      )
+
+    return {
+      // The process group id lives in the sandbox; a fabricated pid would be wrong.
+      pid: -1,
+      stdout: stdoutQ,
+      stderr: stderrQ,
+      stdin: { write: noStdin, end: noStdin },
+      wait: () => exit,
+      // The requested signal goes to the whole group, then KILL after 2 s.
+      kill: (signal) => running.kill(groupSignal(signal)),
+    }
+  }
+
+  snapshot = (label?: string): Promise<SnapshotRef> =>
+    this.queueEnv(async (state) => {
+      await this.writeEnv(state)
+      if (this.snapshotKind === 'filesystem') {
+        // The overlay is in `/dev`, which a filesystem snapshot leaves out, so
+        // it stays in place. This also wakes a suspended sandbox before capture.
+        await this.raw(`rm -f -- ${LEGACY_ENV}`)
+        return this.capture(label)
+      }
+      // A runtime snapshot keeps memory, `/dev` included, so the overlay comes
+      // out for the capture. Read the shared file, even for a fresh handle:
+      // restoring this handle's cached vars could resurrect a secret another
+      // handle already rotated.
+      try {
+        state.restore = await this.download(this.envFile, undefined)
+      } catch (error) {
+        if (!(error instanceof ClientError && error.statusCode === 404))
+          throw error
+      }
+      try {
+        await this.raw(`rm -f -- ${this.envFile} ${LEGACY_ENV}`)
+        return await this.capture(label)
+      } finally {
+        // Keep a successful snapshot ref if write-back fails. The next queued
+        // operation retries these exact bytes, including from a fresh handle.
+        await this.writeEnv(state).catch(noop)
+      }
+    })
+
+  private async capture(label: string | undefined): Promise<SnapshotRef> {
+    const snap = await this.client.snapshots.create({
+      sandboxId: this.id,
+      kind: this.snapshotKind,
+      name: `${SNAPSHOT_PREFIX}${label ?? 'snap'}`.slice(0, SNAPSHOT_NAME_MAX),
+      wait: true,
+    })
+    return { id: snap.id, ...(label !== undefined ? { label } : {}) }
+  }
+
+  async destroy(): Promise<void> {
+    try {
+      await this.client.terminate(this.id)
+      envStates.delete(this.id)
+    } catch (error) {
+      if (error instanceof ClientError && error.statusCode === 404) return
+      throw error
+    }
+  }
+}
+
+/** Wait for `settled` up to `ms`, ignoring its outcome. */
+async function settleWithin(
+  settled: Promise<unknown>,
+  ms: number,
+): Promise<void> {
+  let timer: ReturnType<typeof setTimeout> | undefined
+  const timeout = new Promise<void>((resolve) => {
+    timer = setTimeout(resolve, ms)
+    timer.unref?.()
+  })
+  try {
+    await Promise.race([settled.then(noop, noop), timeout])
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+function noop(): void {}
diff --git a/packages/ai-sandbox-render/src/index.ts b/packages/ai-sandbox-render/src/index.ts
new file mode 100644
index 0000000000..878f1bdb19
--- /dev/null
+++ b/packages/ai-sandbox-render/src/index.ts
@@ -0,0 +1,9 @@
+export { renderSandbox } from './provider'
+export type { RenderSandboxConfig } from './provider'
+export {
+  DEFAULT_WORKDIR,
+  RENDER_CAPS,
+  RenderHandle,
+  SNAPSHOT_PREFIX,
+} from './handle'
+export type { RenderHandleDeps } from './handle'
diff --git a/packages/ai-sandbox-render/src/provider.ts b/packages/ai-sandbox-render/src/provider.ts
new file mode 100644
index 0000000000..b84577e26a
--- /dev/null
+++ b/packages/ai-sandbox-render/src/provider.ts
@@ -0,0 +1,258 @@
+import {
+  ClientError,
+  Render,
+  SandboxCreateWaitError,
+  SandboxNotRunningError,
+} from '@renderinc/sdk'
+import { DEFAULT_WORKDIR, RENDER_CAPS, RenderHandle } from './handle'
+import type {
+  SandboxCreateInput as RenderCreateInput,
+  SandboxNetworkPolicy,
+  SandboxPlan,
+  SandboxSnapshotKind,
+  SandboxesClient,
+} from '@renderinc/sdk'
+import type {
+  SandboxCapabilities,
+  SandboxCreateInput,
+  SandboxDestroyInput,
+  SandboxHandle,
+  SandboxPolicy,
+  SandboxProvider,
+  SandboxRestoreInput,
+  SandboxResumeInput,
+} from '@tanstack/ai-sandbox'
+
+export interface RenderSandboxConfig {
+  /** Render API key. Omit to let the SDK read `RENDER_API_KEY`. */
+  token?: string
+  /** Workspace id (`tea-…`). Omit to let the SDK read `RENDER_WORKSPACE_ID`. */
+  ownerId?: `tea-${string}`
+  /** Pre-built SDK sandboxes client (tests, custom base URL). Set `token` and `ownerId` on it; passing them here too throws. */
+  client?: SandboxesClient
+  /**
+   * Sandbox group to create in. Defaults to the workspace's default group.
+   * Snapshots restore only inside the group they were captured in.
+   */
+  sandboxGroupId?: string
+  /** Compute plan, e.g. `'2c-4g'`. Render defaults to `'1c-2g'`. */
+  plan?: SandboxPlan | (string & {})
+  /** Maximum continuous runtime in seconds. Render defaults to 86400 (24 h). */
+  timeoutSeconds?: number
+  /** Idle seconds before the sandbox suspends; `0` disables. Render defaults to 900. */
+  idleTimeoutSeconds?: number
+  /**
+   * Egress when the TanStack policy allows network, e.g. an `allow-list`.
+   * Defaults to `allow-all`. `policy.capabilities.network: 'deny'` always
+   * sends `deny-all`.
+   */
+  networkPolicy?: SandboxNetworkPolicy
+  /** Boot every new sandbox from this Render sandbox build (a custom image). */
+  buildName?: string
+  /** Boot every new sandbox from this named snapshot. */
+  snapshotName?: string
+  /**
+   * What `handle.snapshot()` captures. `filesystem` (default) restores onto
+   * any plan; `runtime` also keeps memory and processes but needs the same plan.
+   */
+  snapshotKind?: SandboxSnapshotKind
+  /** Directory the `/workspace` virtual root maps to. Defaults to `/workspace`. */
+  workdir?: string
+}
+
+/** How long `create` waits for the sandbox to reach `running` (measured: under 2 s). */
+const CREATE_WAIT_MS = 120_000
+
+/** Statuses a sandbox never comes back from. */
+const ENDED = new Set(['errored', 'terminated'])
+
+function networkPolicy(
+  config: RenderSandboxConfig,
+  policy: SandboxPolicy | undefined,
+): SandboxNetworkPolicy | undefined {
+  if (policy?.capabilities?.network === 'deny') return { type: 'deny-all' }
+  return config.networkPolicy
+}
+
+/** 404 for an unknown sandbox, 400 for a malformed id (measured): both are gone. */
+function isMissing(error: unknown): boolean {
+  return (
+    error instanceof ClientError &&
+    (error.statusCode === 404 || error.statusCode === 400)
+  )
+}
+
+class RenderProvider implements SandboxProvider {
+  readonly name = 'render'
+  private readonly client: SandboxesClient
+
+  constructor(private readonly config: RenderSandboxConfig) {
+    if (config.buildName !== undefined && config.snapshotName !== undefined) {
+      throw new Error('render: pass either buildName or snapshotName, not both')
+    }
+    // A pre-built client carries its own auth; these would be silently ignored.
+    if (
+      config.client !== undefined &&
+      (config.token !== undefined || config.ownerId !== undefined)
+    ) {
+      throw new Error(
+        'render: set token and ownerId on your client, not alongside it',
+      )
+    }
+    this.client =
+      config.client ??
+      new Render({
+        ...(config.token !== undefined ? { token: config.token } : {}),
+        ...(config.ownerId !== undefined ? { ownerId: config.ownerId } : {}),
+      }).sandboxes
+  }
+
+  capabilities(): SandboxCapabilities {
+    return RENDER_CAPS
+  }
+
+  private get workdir(): string {
+    return this.config.workdir ?? DEFAULT_WORKDIR
+  }
+
+  private handle(id: string): RenderHandle {
+    return new RenderHandle({
+      client: this.client,
+      id,
+      workdir: this.workdir,
+      snapshotKind: this.config.snapshotKind ?? 'filesystem',
+    })
+  }
+
+  /**
+   * Create, wait for `running`, then create the workdir. Any failure after
+   * Render minted the sandbox, or an abort that landed meanwhile, terminates
+   * it so it does not bill until its timeout.
+   */
+  private async boot(
+    input: RenderCreateInput,
+    signal: AbortSignal | undefined,
+  ): Promise<SandboxHandle> {
+    signal?.throwIfAborted()
+    const c = this.config
+    let id: string | undefined
+    try {
+      const sandbox = await this.client.create({
+        ...input,
+        ...(c.sandboxGroupId !== undefined
+          ? { sandboxGroupId: c.sandboxGroupId }
+          : {}),
+        ...(c.plan !== undefined ? { plan: c.plan } : {}),
+        ...(c.timeoutSeconds !== undefined
+          ? { timeoutSeconds: c.timeoutSeconds }
+          : {}),
+        ...(c.idleTimeoutSeconds !== undefined
+          ? { idleTimeoutSeconds: c.idleTimeoutSeconds }
+          : {}),
+        wait: { timeoutMs: CREATE_WAIT_MS, ...(signal ? { signal } : {}) },
+      })
+      id = sandbox.id
+      const handle = this.handle(id)
+      await handle.fs.mkdir(this.workdir)
+      signal?.throwIfAborted()
+      return handle
+    } catch (error) {
+      id ??=
+        error instanceof SandboxCreateWaitError ? error.sandboxId : undefined
+      if (id !== undefined) {
+        await this.client.terminate(id).catch(() => undefined)
+      }
+      if (signal?.aborted) throw signal.reason
+      throw error
+    }
+  }
+
+  create(input: SandboxCreateInput): Promise<SandboxHandle> {
+    // Render mints opaque `sbx-…` ids and has no labels to carry `input.id`,
+    // so it is ignored (the contract allows it); persist the returned id.
+    const c = this.config
+    const policy = networkPolicy(c, input.policy)
+    const source =
+      c.snapshotName !== undefined
+        ? { snapshotName: c.snapshotName }
+        : c.buildName !== undefined
+          ? { buildName: c.buildName }
+          : {}
+    return this.boot(
+      {
+        ...source,
+        ...(policy ? { networkPolicy: policy } : {}),
+        ...(input.env !== undefined ? { env: input.env } : {}),
+      },
+      input.signal,
+    )
+  }
+
+  restoreSnapshot(input: SandboxRestoreInput): Promise<SandboxHandle> {
+    // Env and network policy are not part of a snapshot (measured: create-time
+    // env is gone after restore), so both are reapplied here.
+    const policy = networkPolicy(this.config, input.policy)
+    return this.boot(
+      {
+        snapshotId: input.snapshotId,
+        ...(policy ? { networkPolicy: policy } : {}),
+        ...(input.env !== undefined ? { env: input.env } : {}),
+      },
+      input.signal,
+    )
+  }
+
+  async resume(input: SandboxResumeInput): Promise<SandboxHandle | null> {
+    input.signal?.throwIfAborted()
+    let status: string
+    try {
+      status = (await this.client.get(input.id, undefined, input.signal)).status
+    } catch (error) {
+      // Missing is gone. Auth and transport errors must surface so `ensure()`
+      // does not silently create a duplicate of a live sandbox.
+      if (isMissing(error)) return null
+      throw error
+    }
+    if (ENDED.has(status)) return null
+    if (status === 'creating' || status === 'resuming') {
+      try {
+        await this.client.waitUntilRunning(input.id, {
+          ...(input.signal ? { signal: input.signal } : {}),
+        })
+      } catch (error) {
+        // It can end while we wait; the SDK throws instead of returning it.
+        if (
+          error instanceof SandboxNotRunningError &&
+          ENDED.has(error.sandboxStatus)
+        ) {
+          return null
+        }
+        throw error
+      }
+    }
+    // A suspended sandbox resumes on the next exec or file call.
+    return this.handle(input.id)
+  }
+
+  async destroy(input: SandboxDestroyInput): Promise<void> {
+    input.signal?.throwIfAborted()
+    try {
+      // Terminating an already-terminated sandbox succeeds (measured).
+      await this.client.terminate(input.id)
+    } catch (error) {
+      if (isMissing(error)) return
+      throw error
+    }
+  }
+}
+
+/**
+ * Render sandbox provider — runs harness adapters inside Render sandboxes
+ * through the uniform `SandboxHandle`. Reads `RENDER_API_KEY` and
+ * `RENDER_WORKSPACE_ID` through the SDK when `token` / `ownerId` are omitted.
+ */
+export function renderSandbox(
+  config: RenderSandboxConfig = {},
+): SandboxProvider {
+  return new RenderProvider(config)
+}
diff --git a/packages/ai-sandbox-render/tests/fakes.ts b/packages/ai-sandbox-render/tests/fakes.ts
new file mode 100644
index 0000000000..7c0f727e24
--- /dev/null
+++ b/packages/ai-sandbox-render/tests/fakes.ts
@@ -0,0 +1,99 @@
+/**
+ * A fake slice of the Render SDK's `SandboxesClient`. `exec` runs the command
+ * in a local `bash` as its own process-group leader, as Render's exec shell is
+ * (measured), so the handle's real wrapper and group kill are exercised. An
+ * aborted stream only detaches, as on Render: the process keeps running.
+ */
+import { spawn } from 'node:child_process'
+import { mkdir, readFile, writeFile } from 'node:fs/promises'
+import { constants } from 'node:os'
+import { dirname } from 'node:path'
+import { vi } from 'vitest'
+import { ClientError } from '@renderinc/sdk'
+import type { SandboxExecEvent, SandboxesClient } from '@renderinc/sdk'
+
+async function* localExec(
+  command: string,
+  signal?: AbortSignal,
+  shell = 'bash',
+): AsyncGenerator<SandboxExecEvent> {
+  const child = spawn(shell, ['-c', command], {
+    detached: true,
+    stdio: ['ignore', 'pipe', 'pipe'],
+  })
+  const queue: Array<SandboxExecEvent> = []
+  let wake = (): void => {}
+  const push = (event: SandboxExecEvent): void => {
+    queue.push(event)
+    wake()
+  }
+  child.stdout.on('data', (d) =>
+    push({ type: 'output', stream: 'stdout', data: String(d) }),
+  )
+  child.stderr.on('data', (d) =>
+    push({ type: 'output', stream: 'stderr', data: String(d) }),
+  )
+  child.on('close', (code, sig) =>
+    push({
+      type: 'exit',
+      exit_code: code ?? 128 + (sig ? constants.signals[sig] : 0),
+    }),
+  )
+  for (;;) {
+    if (signal?.aborted) throw new Error('AbortError')
+    const event = queue.shift()
+    if (event === undefined) {
+      await new Promise<void>((resolve) => {
+        wake = resolve
+        signal?.addEventListener('abort', () => resolve(), { once: true })
+      })
+      continue
+    }
+    yield event
+    if (event.type === 'exit') return
+  }
+}
+
+export function fakeClient(
+  files = new Map<string, Uint8Array>(),
+  shell = 'bash',
+): {
+  /** The fake's `vi.fn` mocks, for driving and asserting. */
+  client: Record<string, any>
+  sdk: SandboxesClient
+  files: Map<string, Uint8Array>
+} {
+  const client = {
+    exec: vi.fn(
+      (_id: string, command: string, _owner?: string, signal?: AbortSignal) =>
+        Promise.resolve(localExec(command, signal, shell)),
+    ),
+    // Uploads land on the local disk too, so the local bash can source env files.
+    upload: vi.fn(
+      async (_id: string, path: string, data: string | Uint8Array) => {
+        await mkdir(dirname(path), { recursive: true })
+        await writeFile(path, data, { mode: 0o600 })
+      },
+    ),
+    download: vi.fn(async (_id: string, path: string) => {
+      const data =
+        files.get(path) ?? (await readFile(path).catch(() => undefined))
+      if (data === undefined) throw new ClientError('not found', 404)
+      return Promise.resolve({
+        data: Buffer.from(data),
+        size: data.byteLength,
+        contentType: path.endsWith('/')
+          ? 'application/x-tar'
+          : 'application/octet-stream',
+      })
+    }),
+    terminate: vi.fn(() => Promise.resolve()),
+    get: vi.fn(),
+    create: vi.fn(),
+    waitUntilRunning: vi.fn(() => Promise.resolve()),
+    snapshots: {
+      create: vi.fn(() => Promise.resolve({ id: 'snp-1' })),
+    },
+  }
+  return { client, sdk: client as unknown as SandboxesClient, files }
+}
diff --git a/packages/ai-sandbox-render/tests/handle.test.ts b/packages/ai-sandbox-render/tests/handle.test.ts
new file mode 100644
index 0000000000..20546ffd6d
--- /dev/null
+++ b/packages/ai-sandbox-render/tests/handle.test.ts
@@ -0,0 +1,588 @@
+/**
+ * Handle tests against a local `bash` standing in for Render's exec (see
+ * `fakes.ts`). The case that matters most: `kill()` stops a backgrounded
+ * child, not just this host's view of the stream.
+ */
+import { mkdtemp, readFile, realpath, rm, stat } from 'node:fs/promises'
+import { randomUUID } from 'node:crypto'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { UnsupportedCapabilityError } from '@tanstack/ai-sandbox'
+import { RenderHandle, envFileContent, groupSignal } from '../src/handle'
+import { fakeClient } from './fakes'
+
+let dir: string
+/** Stands in for `/dev/tsai`, which is not writable here. */
+let envDir: string
+let envFile: string
+let fake: ReturnType<typeof fakeClient>
+let handle: RenderHandle
+
+/** Another handle on the same sandbox, as after a resume. */
+function newHandle(
+  snapshotKind: 'filesystem' | 'runtime' = 'filesystem',
+  client = fake.sdk,
+  id = 'sbx-test',
+): RenderHandle {
+  return new RenderHandle({ client, id, workdir: dir, snapshotKind, envDir })
+}
+
+beforeEach(async () => {
+  // Resolved, because macOS tmpdir is a symlink and `pwd` prints the real path.
+  dir = await realpath(await mkdtemp(join(tmpdir(), 'tsai-render-')))
+  envDir = await realpath(await mkdtemp(join(tmpdir(), 'tsai-env-')))
+  envFile = join(envDir, 'env')
+  fake = fakeClient()
+  handle = newHandle()
+})
+
+afterEach(async () => {
+  await rm(dir, { recursive: true, force: true })
+  await rm(envDir, { recursive: true, force: true })
+})
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms))
+const lines = async (path: string) =>
+  (await readFile(path, 'utf8').catch(() => '')).split('\n').length
+
+describe('process', () => {
+  it('runs in the workdir with the env overlay and returns the exit code', async () => {
+    await handle.env.set({ A: "it's" })
+    const r = await handle.process.exec(
+      'pwd; echo "$A $B"; echo err >&2; exit 3',
+      {
+        env: { B: 'b' },
+      },
+    )
+    expect(r).toEqual({
+      stdout: `${dir}\nit's b\n`,
+      stderr: 'err\n',
+      exitCode: 3,
+    })
+  })
+
+  it('maps /workspace and relative cwd onto the workdir', async () => {
+    await handle.fs.mkdir('sub')
+    const r = await handle.process.exec('pwd', { cwd: '/workspace/sub' })
+    expect(r.stdout.trim()).toBe(join(dir, 'sub'))
+  })
+
+  it('never puts env values in the command string (Render stores it)', async () => {
+    await handle.env.set({ SECRET: 'sk-overlay' })
+    const r = await handle.process.exec('echo "$SECRET $TOKEN"', {
+      env: { TOKEN: 'tok-per-call', SECRET: 'sk-override' },
+    })
+    expect(r.stdout).toBe('sk-override tok-per-call\n')
+    const sent = fake.client.exec.mock.calls.map(
+      (call: Array<unknown>) => call[1],
+    )
+    expect(sent.join('\n')).not.toMatch(/sk-overlay|sk-override|tok-per-call/)
+  })
+
+  it('rejects env names that are not shell identifiers', () => {
+    expect(() => envFileContent({ 'A;rm': 'x' })).toThrow(
+      /invalid env var name/,
+    )
+  })
+
+  it('rejects bash read-only names, which would stop the command', () => {
+    expect(() => envFileContent({ UID: '1' })).toThrow(/invalid env var name/)
+  })
+
+  it('a rejected env.set leaves the overlay usable', async () => {
+    await expect(handle.env.set({ 'BAD-NAME': 'x' })).rejects.toThrow()
+    await handle.env.set({ B: '2' })
+    expect((await handle.process.exec('echo $B')).stdout).toBe('2\n')
+  })
+
+  it('concurrent env.set calls write one file with every var', async () => {
+    await Promise.all([handle.env.set({ A: '1' }), handle.env.set({ B: '2' })])
+    const paths = new Set(
+      fake.client.upload.mock.calls.map((call: Array<unknown>) => call[1]),
+    )
+    expect([...paths]).toEqual([envFile])
+    expect((await handle.process.exec('echo $A$B')).stdout).toBe('12\n')
+  })
+
+  it('a kill before a slow start stops the command (no env)', async () => {
+    const marker = join(dir, 'started')
+    const exec = fake.client.exec.getMockImplementation()!
+    fake.client.exec.mockImplementationOnce(async (...args: Array<any>) => {
+      // The command reaches the sandbox after killCommand's 2 s wait.
+      await sleep(2500)
+      return exec(...args)
+    })
+    const proc = await handle.process.spawn(`touch ${marker}`)
+    await sleep(50)
+    await proc.kill()
+    expect(await proc.wait()).toBe(143)
+    await expect(stat(marker)).rejects.toThrow()
+  }, 10_000)
+
+  it('deletes the per-call env file once the command has read it', async () => {
+    const proc = await handle.process.spawn('sleep 0.5; echo $T', {
+      env: { T: 'tok' },
+    })
+    await sleep(250)
+    const callFile = fake.client.upload.mock.calls
+      .map((call: Array<unknown>) => String(call[1]))
+      .find((path: string) => path.endsWith('.env'))!
+    expect(callFile.startsWith(`${envDir}/`)).toBe(true)
+    await expect(stat(callFile)).rejects.toThrow()
+    const out: Array<string> = []
+    for await (const chunk of proc.stdout) out.push(chunk)
+    expect(out.join('')).toBe('tok\n')
+  })
+
+  it('drops the rest of a stream once it passes the cap', async () => {
+    // A 3-byte first chunk keeps the 64 KiB pipe chunks off the cap, so room
+    // is left after the overflow; the pause makes TAIL its own chunk.
+    const r = await handle.process.exec(
+      'printf xyz; sleep 0.1; head -c 9000000 /dev/zero | tr "\\0" a; sleep 0.2; echo TAIL',
+    )
+    expect(r.stdout).not.toContain('TAIL')
+    expect(r.stderr).toContain('output truncated')
+  })
+
+  it('caps captured output in bytes, not string units', async () => {
+    // "é\n" is 3 bytes but 2 string units: 9 MB of it is 6M units, under the
+    // 8 MiB cap when counted as units.
+    const r = await handle.process.exec(
+      'printf xyz; sleep 0.1; yes é | head -c 9000000; sleep 0.2; echo TAIL',
+    )
+    expect(r.stdout).not.toContain('TAIL')
+    expect(r.stderr).toContain('output truncated')
+    expect(Buffer.byteLength(r.stdout)).toBeLessThanOrEqual(8 * 1024 * 1024)
+  })
+
+  it('spawn with an aborted signal rejects instead of throwing', async () => {
+    let result: Promise<unknown> | undefined
+    expect(() => {
+      result = handle.process.spawn('true', { signal: AbortSignal.abort() })
+    }).not.toThrow()
+    await expect(result).rejects.toThrow()
+  })
+
+  it('kill() stops a backgrounded child', async () => {
+    const ticks = join(dir, 'ticks')
+    const proc = await handle.process.spawn(
+      `(while true; do echo t >> ${ticks}; sleep 0.05; done) & wait`,
+    )
+    await sleep(300)
+    await proc.kill()
+    expect(await proc.wait()).not.toBe(0)
+    const after = await lines(ticks)
+    await sleep(300)
+    expect(await lines(ticks)).toBe(after)
+  })
+
+  it('kill(signal) delivers the requested signal to the group', async () => {
+    const proc = await handle.process.spawn(
+      "trap 'echo got-int; exit 7' INT; echo ready; while true; do sleep 0.05; done",
+    )
+    const out: Array<string> = []
+    const reading = (async () => {
+      for await (const chunk of proc.stdout) out.push(chunk)
+    })()
+    while (!out.join('').includes('ready')) await sleep(20)
+    await proc.kill('SIGINT')
+    expect(await proc.wait()).toBe(7)
+    await reading
+    expect(out.join('')).toContain('got-int')
+  })
+
+  it('kill("SIGKILL") skips the TERM grace period', async () => {
+    // The command ignores TERM, so a TERM-first kill would take the full 2 s.
+    const proc = await handle.process.spawn(
+      "trap '' TERM; echo ready; while true; do sleep 0.05; done",
+    )
+    const out: Array<string> = []
+    void (async () => {
+      for await (const chunk of proc.stdout) out.push(chunk)
+    })()
+    while (!out.join('').includes('ready')) await sleep(20)
+    const start = Date.now()
+    await proc.kill('SIGKILL')
+    expect(await proc.wait()).toBe(128 + 9)
+    expect(Date.now() - start).toBeLessThan(1500)
+  })
+
+  it('maps kill signals onto group signals', () => {
+    expect(groupSignal()).toBe('TERM')
+    expect(groupSignal('SIGINT')).toBe('INT')
+    expect(groupSignal(2)).toBe('INT')
+    expect(groupSignal('SIGKILL')).toBe('KILL')
+    expect(groupSignal('SIGHUP')).toBe('HUP')
+    // Anything the wrapper does not forward is a request to stop.
+    expect(groupSignal('SIGUSR1')).toBe('KILL')
+  })
+
+  it('an aborted exec kills the group and resolves with its exit code', async () => {
+    const ticks = join(dir, 'ticks')
+    const controller = new AbortController()
+    const run = handle.process.exec(
+      `(while true; do echo t >> ${ticks}; sleep 0.05; done) & wait`,
+      { signal: controller.signal },
+    )
+    await sleep(300)
+    controller.abort()
+    expect((await run).exitCode).not.toBe(0)
+    const after = await lines(ticks)
+    await sleep(300)
+    expect(await lines(ticks)).toBe(after)
+  })
+
+  it('a kill during the env upload never starts the command', async () => {
+    const marker = join(dir, 'started')
+    const upload = fake.client.upload.getMockImplementation()!
+    fake.client.upload.mockImplementationOnce(async (...args: Array<any>) => {
+      // Longer than killCommand's 2 s wait for the process-group file.
+      await sleep(2500)
+      return upload(...args)
+    })
+    const proc = await handle.process.spawn(`touch ${marker}`, {
+      env: { TOKEN: 't' },
+    })
+    await proc.kill()
+    expect(await proc.wait()).toBe(143)
+    await expect(stat(marker)).rejects.toThrow()
+    const sent: Array<string> = fake.client.exec.mock.calls.map(
+      (call: Array<unknown>) => String(call[1]),
+    )
+    expect(sent.some((c) => c.includes(marker))).toBe(false)
+  }, 10_000)
+
+  it.each(['kill', 'abort'] as const)(
+    '%s prevents a delayed exec request from starting',
+    async (cancel) => {
+      const exec = fake.client.exec.getMockImplementation()!
+      fake.client.exec.mockImplementationOnce(async (...args: Array<any>) => {
+        await sleep(2500)
+        return exec(...args)
+      })
+      const controller = new AbortController()
+      const proc = await handle.process.spawn('touch delayed-marker', {
+        signal: controller.signal,
+      })
+      if (cancel === 'kill') await proc.kill()
+      else controller.abort()
+      expect(await proc.wait()).not.toBe(0)
+      await expect(stat(join(dir, 'delayed-marker'))).rejects.toThrow()
+    },
+    10_000,
+  )
+
+  it('stops a surviving child when its foreground shell exits', async () => {
+    // A bounded writer and explicit cleanup also keep the failing regression safe.
+    const proc = await handle.process.spawn(
+      '(trap "" TERM; for i in $(seq 600); do echo t >> orphan-ticks; sleep 0.05; done) & echo $! > orphan-pid; exit 0',
+    )
+    try {
+      for (let i = 0; i < 100; i++) {
+        if (await stat(join(dir, 'orphan-pid')).catch(() => undefined)) break
+        await sleep(20)
+      }
+      await stat(join(dir, 'orphan-pid'))
+      await sleep(200)
+      await proc.kill()
+      await proc.wait()
+      const after = await lines(join(dir, 'orphan-ticks'))
+      await sleep(300)
+      expect(await lines(join(dir, 'orphan-ticks'))).toBe(after)
+    } finally {
+      const pid = Number(await readFile(join(dir, 'orphan-pid'), 'utf8'))
+      try {
+        process.kill(pid, 'SIGKILL')
+      } catch {
+        /* Already stopped. */
+      }
+    }
+  }, 20_000)
+
+  it('kills a group when the provider exec shell is sh', async () => {
+    const shellHandle = newHandle(
+      'filesystem',
+      fakeClient(undefined, 'sh').sdk,
+      'sbx-sh',
+    )
+    const ticks = join(dir, 'sh-ticks')
+    const proc = await shellHandle.process.spawn(
+      `(for i in $(seq 100); do echo t >> ${ticks}; sleep 0.05; done) & wait`,
+    )
+    await sleep(200)
+    await proc.kill()
+    expect(await proc.wait()).not.toBe(0)
+    const after = await lines(ticks)
+    await sleep(300)
+    expect(await lines(ticks)).toBe(after)
+  })
+
+  it('streams spawn output and has no stdin', async () => {
+    const proc = await handle.process.spawn('echo out; echo err >&2')
+    const out: Array<string> = []
+    for await (const chunk of proc.stdout) out.push(chunk)
+    expect(out.join('')).toBe('out\n')
+    expect(await proc.wait()).toBe(0)
+    await expect(proc.stdin.write('x')).rejects.toBeInstanceOf(
+      UnsupportedCapabilityError,
+    )
+  })
+})
+
+describe('fs', () => {
+  it('lists, renames, checks and removes through the shell', async () => {
+    await handle.fs.mkdir('/workspace/a/b')
+    await handle.process.exec('touch a/f')
+    expect(await handle.fs.list('a')).toEqual(
+      expect.arrayContaining([
+        { name: 'b', path: 'a/b', type: 'dir' },
+        { name: 'f', path: 'a/f', type: 'file' },
+      ]),
+    )
+    await handle.fs.rename('a/f', 'a/g')
+    expect(await handle.fs.exists('a/g')).toBe(true)
+    expect(await handle.fs.exists('a/f')).toBe(false)
+    // ponytail: lstat's GNU `stat` probe is covered by the live suite, not here (BSD stat differs).
+    await handle.fs.remove('a')
+    await expect(stat(join(dir, 'a'))).rejects.toThrow()
+  })
+
+  it('reads and writes through upload and download at absolute paths', async () => {
+    await handle.fs.write('x.txt', 'hello')
+    expect(fake.client.upload.mock.calls[0]?.[1]).toBe(join(dir, 'x.txt'))
+    expect(await handle.fs.read('x.txt')).toBe('hello')
+    await handle.fs.write(join(dir, 'b.bin'), new Uint8Array([0, 255]))
+    expect([...(await handle.fs.readBytes(join(dir, 'b.bin')))]).toEqual([
+      0, 255,
+    ])
+  })
+
+  it('refuses to read a directory (Render returns a tar archive)', async () => {
+    fake.files.set('/tmp/dir/', new Uint8Array([1]))
+    await expect(handle.fs.read('/tmp/dir/')).rejects.toThrow(/is a directory/)
+  })
+
+  it('an aborted exists rejects instead of returning false', async () => {
+    const exec = fake.client.exec.getMockImplementation()!
+    fake.client.exec.mockImplementationOnce(
+      (id: string, command: string, ...rest: Array<any>) =>
+        exec(id, `sleep 1; ${command}`, ...rest),
+    )
+    const controller = new AbortController()
+    const check = handle.fs.exists('nope', { signal: controller.signal })
+    await sleep(200)
+    controller.abort(new Error('cancelled'))
+    await expect(check).rejects.toThrow('cancelled')
+  })
+
+  it('refuses to remove the root', async () => {
+    await expect(handle.fs.remove('/')).rejects.toThrow(/refusing/)
+  })
+})
+
+describe('capabilities', () => {
+  it('rejects ports', async () => {
+    await expect(handle.ports.connect(3000)).rejects.toBeInstanceOf(
+      UnsupportedCapabilityError,
+    )
+  })
+
+  it('snapshots with the configured kind and a tsai- name', async () => {
+    expect(await handle.snapshot('after-setup')).toEqual({
+      id: 'snp-1',
+      label: 'after-setup',
+    })
+    expect(fake.client.snapshots.create).toHaveBeenCalledWith({
+      sandboxId: 'sbx-test',
+      kind: 'filesystem',
+      name: 'tsai-after-setup',
+      wait: true,
+    })
+  })
+
+  it('leaves the overlay in place for a filesystem capture, after waking the sandbox', async () => {
+    await handle.env.set({ SECRET: 'sk-1' })
+    let presentAtCapture = false
+    fake.client.snapshots.create.mockImplementationOnce(async () => {
+      presentAtCapture = await stat(envFile).then(
+        () => true,
+        () => false,
+      )
+      return { id: 'snp-1' }
+    })
+    const execsBefore = fake.client.exec.mock.calls.length
+    await handle.snapshot()
+    expect(presentAtCapture).toBe(true)
+    expect(fake.client.exec.mock.calls.length).toBeGreaterThan(execsBefore)
+    expect(fake.client.download).not.toHaveBeenCalled()
+  })
+
+  it('refuses a filesystem capture when the wake command fails', async () => {
+    fake.client.exec.mockImplementationOnce(async function* () {
+      yield { type: 'exit', exit_code: 1 }
+    })
+    await expect(handle.snapshot()).rejects.toThrow('control command failed')
+    expect(fake.client.snapshots.create).not.toHaveBeenCalled()
+  })
+
+  it('rotation replaces the overlay across handles and removes on-disk overlays', async () => {
+    await handle.env.set({ SECRET: 'old-canary' })
+    // An overlay from an earlier provider version can exist on a resumed VM.
+    const legacyFile = `/tmp/tsai/env-${randomUUID()}`
+    await fake.sdk.upload(
+      'sbx-test',
+      legacyFile,
+      'export SECRET=legacy-canary\n',
+    )
+    const resumed = newHandle()
+    try {
+      await resumed.env.set({ SECRET: 'new-canary' })
+      expect(await readFile(envFile, 'utf8')).not.toContain('old-canary')
+      await expect(stat(legacyFile)).rejects.toThrow()
+      await fake.sdk.upload(
+        'sbx-test',
+        legacyFile,
+        'export SECRET=legacy-canary\n',
+      )
+      fake.client.snapshots.create.mockImplementationOnce(async () => {
+        await expect(stat(legacyFile)).rejects.toThrow()
+        return { id: 'snp-rotated' }
+      })
+      // An older handle must keep the rotated file, not its cached old values.
+      await handle.snapshot()
+      expect((await resumed.process.exec('echo "$SECRET"')).stdout).toBe(
+        'new-canary\n',
+      )
+    } finally {
+      await rm(legacyFile, { force: true })
+    }
+  })
+
+  describe('runtime snapshots, which keep /dev', () => {
+    beforeEach(() => {
+      handle = newHandle('runtime')
+    })
+
+    it('removes the env file during the capture and restores it after', async () => {
+      await handle.env.set({ SECRET: 'sk-1' })
+      let presentAtCapture = true
+      fake.client.snapshots.create.mockImplementationOnce(async () => {
+        presentAtCapture = await stat(envFile).then(
+          () => true,
+          () => false,
+        )
+        return { id: 'snp-1' }
+      })
+      await handle.snapshot('after-setup')
+      expect(presentAtCapture).toBe(false)
+      expect(await readFile(envFile, 'utf8')).toContain('sk-1')
+    })
+
+    it("removes an earlier handle's env file too, and wakes the sandbox first", async () => {
+      await handle.env.set({ SECRET: 'sk-old' })
+      const resumed = newHandle('runtime')
+      let presentAtCapture = true
+      fake.client.snapshots.create.mockImplementationOnce(async () => {
+        presentAtCapture = await stat(envFile).then(
+          () => true,
+          () => false,
+        )
+        return { id: 'snp-1' }
+      })
+      const execsBefore = fake.client.exec.mock.calls.length
+      await resumed.snapshot()
+      expect(presentAtCapture).toBe(false)
+      expect(fake.client.exec.mock.calls.length).toBeGreaterThan(execsBefore)
+    })
+
+    it('keeps the ref when the env write-back fails, and rewrites it before the next command', async () => {
+      await handle.env.set({ SECRET: 'sk-1' })
+      fake.client.upload.mockRejectedValueOnce(new Error('transient 502'))
+      expect(await handle.snapshot('s')).toEqual({ id: 'snp-1', label: 's' })
+      expect((await handle.process.exec('echo $SECRET')).stdout).toBe('sk-1\n')
+    })
+
+    it.each([false, true])(
+      'a command started during capture waits (resumed handle: %s)',
+      async (useResumed) => {
+        await handle.env.set({ SECRET: 'sk-1' })
+        const executing = useResumed ? newHandle('runtime') : handle
+        if (useResumed) await executing.env.set({ SECRET: 'sk-1' })
+        let capturing!: () => void
+        const started = new Promise<void>((resolve) => (capturing = resolve))
+        fake.client.snapshots.create.mockImplementationOnce(async () => {
+          capturing()
+          await sleep(300)
+          return { id: 'snp-1' }
+        })
+        const snap = handle.snapshot()
+        await started
+        const r = await executing.process.exec('echo $SECRET')
+        await snap
+        expect(r).toMatchObject({ stdout: 'sk-1\n', exitCode: 0 })
+      },
+    )
+
+    it('a fresh handle preserves the shared overlay when taking a snapshot', async () => {
+      await handle.env.set({ SECRET: 'current-canary' })
+      await newHandle('runtime').snapshot()
+      expect((await handle.process.exec('echo "$SECRET"')).stdout).toBe(
+        'current-canary\n',
+      )
+    })
+
+    it('serializes secret rotation with capture across handles', async () => {
+      await handle.env.set({ SECRET: 'old-canary' })
+      const resumed = newHandle('runtime')
+      let rotation: Promise<void> | undefined
+      let presentDuringCapture = true
+      fake.client.snapshots.create.mockImplementationOnce(async () => {
+        rotation = resumed.env.set({ SECRET: 'new-canary' })
+        // Allow an uncoordinated upload to complete while capture is pending.
+        await sleep(100)
+        presentDuringCapture = await stat(envFile).then(
+          () => true,
+          () => false,
+        )
+        return { id: 'snp-concurrent' }
+      })
+      await handle.snapshot()
+      await rotation
+      expect(presentDuringCapture).toBe(false)
+      expect((await handle.process.exec('echo "$SECRET"')).stdout).toBe(
+        'new-canary\n',
+      )
+    })
+
+    it('retries the rotated shared overlay after snapshot write-back fails', async () => {
+      await handle.env.set({ SECRET: 'old-canary' })
+      const resumed = newHandle('runtime')
+      await resumed.env.set({ SECRET: 'new-canary' })
+      fake.client.upload.mockRejectedValueOnce(new Error('transient 502'))
+      expect(await handle.snapshot('s')).toEqual({ id: 'snp-1', label: 's' })
+      expect((await handle.process.exec('echo "$SECRET"')).stdout).toBe(
+        'new-canary\n',
+      )
+    })
+
+    it('refuses to capture when removing the secret overlay fails', async () => {
+      await handle.env.set({ SECRET: 'canary' })
+      fake.client.exec.mockImplementationOnce(async function* () {
+        yield { type: 'exit', exit_code: 1 }
+      })
+      await expect(handle.snapshot()).rejects.toThrow('control command failed')
+      expect(fake.client.snapshots.create).not.toHaveBeenCalled()
+      expect((await handle.process.exec('echo "$SECRET"')).stdout).toBe(
+        'canary\n',
+      )
+    })
+  })
+
+  it('keeps the snapshot name within 64 characters and the full label in the ref', async () => {
+    const label = 'x'.repeat(100)
+    expect((await handle.snapshot(label)).label).toBe(label)
+    const { name } = fake.client.snapshots.create.mock.calls[0][0]
+    expect(name).toBe(`tsai-${'x'.repeat(59)}`)
+  })
+})
diff --git a/packages/ai-sandbox-render/tests/journal.conformance.test.ts b/packages/ai-sandbox-render/tests/journal.conformance.test.ts
new file mode 100644
index 0000000000..bca5ae985f
--- /dev/null
+++ b/packages/ai-sandbox-render/tests/journal.conformance.test.ts
@@ -0,0 +1,32 @@
+/**
+ * Journal conformance for the Render provider.
+ *
+ * Registering the shared suite makes the process-lifecycle claims falsifiable:
+ * with Render credentials it runs against a real sandbox, and without them it
+ * renders as a NAMED skip carrying the reason instead of a silent pass.
+ *
+ * `killableProcesses` is `true`, so the follow and kill cases run in full: the
+ * kill case starts a backgrounded grandchild and proves it stops writing after
+ * `kill()`, which is the measurement behind the capability.
+ */
+import { runJournalConformance } from '@tanstack/ai-sandbox/testkit'
+import { renderSandbox } from '../src/index'
+
+// Auto-gate: these cases create real, billed Render sandboxes.
+const hasCreds =
+  !!process.env.RENDER_API_KEY && !!process.env.RENDER_WORKSPACE_ID
+
+runJournalConformance({
+  name: 'render',
+  createHandle: async () => {
+    const handle = await renderSandbox({ timeoutSeconds: 1800 }).create({})
+    return { handle, dispose: () => handle.destroy() }
+  },
+  ...(hasCreds
+    ? {}
+    : {
+        unsupported: {
+          reason: 'no RENDER_API_KEY + RENDER_WORKSPACE_ID in the environment',
+        },
+      }),
+})
diff --git a/packages/ai-sandbox-render/tests/provider.test.ts b/packages/ai-sandbox-render/tests/provider.test.ts
new file mode 100644
index 0000000000..f989359d20
--- /dev/null
+++ b/packages/ai-sandbox-render/tests/provider.test.ts
@@ -0,0 +1,175 @@
+/**
+ * Provider tests against a fake SDK client. The cases that matter most: a
+ * missing or ended sandbox resumes as `null` (so `ensure()` re-creates),
+ * anything else surfaces (so `ensure()` does not duplicate a live sandbox), a
+ * failed or aborted create terminates what Render minted, and a `deny`
+ * network policy always reaches Render, on restore too.
+ */
+import { describe, expect, it } from 'vitest'
+import {
+  ClientError,
+  SandboxCreateWaitError,
+  SandboxNotRunningError,
+  ServerError,
+} from '@renderinc/sdk'
+import { renderSandbox } from '../src/index'
+import { fakeClient } from './fakes'
+
+function setup(config = {}) {
+  const fake = fakeClient()
+  fake.client.create.mockResolvedValue({ id: 'sbx-1', status: 'running' })
+  const provider = renderSandbox({
+    client: fake.sdk,
+    workdir: '/tmp',
+    ...config,
+  })
+  return { ...fake, provider }
+}
+
+describe('create', () => {
+  it('passes the config, waits for running, and returns the handle', async () => {
+    const { client, provider } = setup({
+      plan: '2c-4g',
+      idleTimeoutSeconds: 600,
+      buildName: 'node-22',
+    })
+    const handle = await provider.create({ env: { K: 'v' } })
+    expect(handle.id).toBe('sbx-1')
+    expect(client.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        plan: '2c-4g',
+        idleTimeoutSeconds: 600,
+        buildName: 'node-22',
+        env: { K: 'v' },
+        wait: expect.objectContaining({ timeoutMs: 120_000 }),
+      }),
+    )
+  })
+
+  it("sends deny-all for policy network 'deny', over the configured policy", async () => {
+    const { client, provider } = setup({
+      networkPolicy: { type: 'allow-list', rules: [{ domain: 'x.com' }] },
+    })
+    await provider.create({ policy: { capabilities: { network: 'deny' } } })
+    expect(client.create.mock.calls[0]?.[0].networkPolicy).toEqual({
+      type: 'deny-all',
+    })
+  })
+
+  it('terminates the sandbox when the wait fails', async () => {
+    const { client, provider } = setup()
+    client.create.mockRejectedValue(
+      new SandboxCreateWaitError('wait failed', 'sbx-2', new Error('timeout')),
+    )
+    await expect(provider.create({})).rejects.toThrow('wait failed')
+    expect(client.terminate).toHaveBeenCalledWith('sbx-2')
+  })
+
+  it('terminates the sandbox and rejects with the reason on abort', async () => {
+    const { client, provider } = setup()
+    const controller = new AbortController()
+    const reason = new Error('cancelled')
+    client.create.mockImplementation(async () => {
+      controller.abort(reason)
+      return { id: 'sbx-3' }
+    })
+    await expect(provider.create({ signal: controller.signal })).rejects.toBe(
+      reason,
+    )
+    expect(client.terminate).toHaveBeenCalledWith('sbx-3')
+  })
+
+  it('rejects buildName with snapshotName', () => {
+    expect(() =>
+      renderSandbox({
+        client: fakeClient().sdk,
+        buildName: 'a',
+        snapshotName: 'b',
+      }),
+    ).toThrow(/either/)
+  })
+
+  it.each([{ token: 'rnd_x' }, { ownerId: 'tea-x' as const }])(
+    'rejects %o alongside a pre-built client',
+    (auth) => {
+      expect(() =>
+        renderSandbox({ client: fakeClient().sdk, ...auth }),
+      ).toThrow(/on your client/)
+    },
+  )
+})
+
+describe('restoreSnapshot', () => {
+  it('restores by id and reapplies env and the deny policy', async () => {
+    const { client, provider } = setup()
+    await provider.restoreSnapshot!({
+      snapshotId: 'snp-1',
+      env: { K: 'v' },
+      policy: { capabilities: { network: 'deny' } },
+    })
+    expect(client.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        snapshotId: 'snp-1',
+        env: { K: 'v' },
+        networkPolicy: { type: 'deny-all' },
+      }),
+    )
+  })
+})
+
+describe('resume', () => {
+  it.each(['running', 'suspended'])(
+    'returns a handle for %s',
+    async (status) => {
+      const { client, provider } = setup()
+      client.get.mockResolvedValue({ status })
+      expect((await provider.resume({ id: 'sbx-1' }))?.id).toBe('sbx-1')
+      expect(client.waitUntilRunning).not.toHaveBeenCalled()
+    },
+  )
+
+  it('waits for a sandbox that is still resuming', async () => {
+    const { client, provider } = setup()
+    client.get.mockResolvedValue({ status: 'resuming' })
+    await provider.resume({ id: 'sbx-1' })
+    expect(client.waitUntilRunning).toHaveBeenCalled()
+  })
+
+  it.each(['terminated', 'errored'])(
+    'returns null when it becomes %s during the wait',
+    async (status) => {
+      const { client, provider } = setup()
+      client.get.mockResolvedValue({ status: 'resuming' })
+      client.waitUntilRunning.mockRejectedValue(
+        new SandboxNotRunningError('ended', 'sbx-1', status),
+      )
+      expect(await provider.resume({ id: 'sbx-1' })).toBeNull()
+    },
+  )
+
+  it.each(['terminated', 'errored'])('returns null for %s', async (status) => {
+    const { client, provider } = setup()
+    client.get.mockResolvedValue({ status })
+    expect(await provider.resume({ id: 'sbx-1' })).toBeNull()
+  })
+
+  it.each([404, 400])('returns null on a %s', async (code) => {
+    const { client, provider } = setup()
+    client.get.mockRejectedValue(new ClientError('gone', code))
+    expect(await provider.resume({ id: 'sbx-1' })).toBeNull()
+  })
+
+  it('surfaces other errors', async () => {
+    const { client, provider } = setup()
+    client.get.mockRejectedValue(new ServerError('boom', 500))
+    await expect(provider.resume({ id: 'sbx-1' })).rejects.toThrow('boom')
+  })
+})
+
+describe('destroy', () => {
+  it('treats a missing sandbox as destroyed', async () => {
+    const { client, provider } = setup()
+    client.terminate.mockRejectedValue(new ClientError('gone', 404))
+    await expect(provider.destroy({ id: 'sbx-1' })).resolves.toBeUndefined()
+  })
+})
diff --git a/packages/ai-sandbox-render/tests/render.test.ts b/packages/ai-sandbox-render/tests/render.test.ts
new file mode 100644
index 0000000000..410ce72f7c
--- /dev/null
+++ b/packages/ai-sandbox-render/tests/render.test.ts
@@ -0,0 +1,148 @@
+import { randomUUID } from 'node:crypto'
+import { beforeAll, describe, expect, it } from 'vitest'
+import { Render } from '@renderinc/sdk'
+import { renderSandbox } from '../src/index'
+import type { SandboxHandle } from '@tanstack/ai-sandbox'
+
+// Auto-gate: only run with Render credentials (these tests create real,
+// billed sandboxes). The SDK reads both from the environment itself.
+const hasCreds =
+  !!process.env.RENDER_API_KEY && !!process.env.RENDER_WORKSPACE_ID
+
+// Both build an SDK client, which throws without RENDER_API_KEY, so they are
+// created in beforeAll: the file must still load when the suite is skipped.
+let provider: ReturnType<typeof renderSandbox>
+/** For cleanup the contract has no hook for: deleting snapshots. */
+let sandboxes: Render['sandboxes']
+
+/** Run `body` against a fresh sandbox and always terminate it. */
+async function withSandbox(
+  input: Parameters<typeof provider.create>[0],
+  body: (sbx: SandboxHandle) => Promise<void>,
+): Promise<void> {
+  const sbx = await provider.create(input)
+  try {
+    await body(sbx)
+  } finally {
+    await sbx.destroy()
+  }
+}
+
+describe.skipIf(!hasCreds)(
+  'render provider (gated on RENDER_API_KEY + RENDER_WORKSPACE_ID)',
+  () => {
+    beforeAll(() => {
+      provider = renderSandbox({ timeoutSeconds: 1800 })
+      sandboxes = new Render().sandboxes
+    })
+
+    it('runs exec, env and a full fs round trip', async () => {
+      await withSandbox({ env: { CREATE_VAR: 'created' } }, async (sbx) => {
+        const echo = await sbx.process.exec('pwd')
+        expect(echo).toMatchObject({ stdout: '/workspace\n', exitCode: 0 })
+
+        const failed = await sbx.process.exec('echo nope >&2; exit 7')
+        expect(failed).toMatchObject({ stderr: 'nope\n', exitCode: 7 })
+
+        await sbx.env.set({ BASE_VAR: 'base' })
+        const env = await sbx.process.exec(
+          'echo "$CREATE_VAR:$BASE_VAR:$EXTRA_VAR"',
+          { env: { EXTRA_VAR: "it's" } },
+        )
+        expect(env.stdout).toBe("created:base:it's\n")
+
+        await sbx.fs.write('/workspace/nested/note.txt', 'inside render')
+        expect(await sbx.fs.read('nested/note.txt')).toBe('inside render')
+        expect(await sbx.fs.lstat!('nested/note.txt')).toMatchObject({
+          type: 'file',
+          size: 13,
+        })
+        await sbx.process.exec('ln -s nested/note.txt link')
+        expect(await sbx.fs.lstat!('link')).toMatchObject({ type: 'symlink' })
+        expect(await sbx.fs.lstat!('absent')).toBeUndefined()
+
+        await sbx.fs.write('bin', new Uint8Array([0, 1, 2, 250]))
+        expect([...(await sbx.fs.readBytes('bin'))]).toEqual([0, 1, 2, 250])
+        expect(await sbx.fs.list('/workspace')).toEqual(
+          expect.arrayContaining([
+            { name: 'nested', path: '/workspace/nested', type: 'dir' },
+            { name: 'bin', path: '/workspace/bin', type: 'file' },
+          ]),
+        )
+        await expect(sbx.fs.read('nested')).rejects.toThrow(/directory/)
+        await sbx.fs.rename('bin', 'bin2')
+        expect(await sbx.fs.exists('bin')).toBe(false)
+        await sbx.fs.remove('/workspace/nested')
+        expect(await sbx.fs.exists('/workspace/nested')).toBe(false)
+
+        const git = await sbx.process.exec('git --version')
+        expect(git.exitCode).toBe(0)
+      })
+    }, 120_000)
+
+    it('snapshots without the env overlay, then restores with env reapplied and egress denied', async () => {
+      await withSandbox({}, async (sbx) => {
+        await sbx.fs.write('/workspace/kept.txt', 'kept')
+        // Unique, so finding it on disk can only mean the overlay leaked.
+        const canary = `canary-${randomUUID()}`
+        await sbx.env.set({ OVERLAY: canary })
+        // Look this up first: a failure after the capture would leave the
+        // snapshot behind.
+        const { sandboxGroupId } = await sandboxes.get(sbx.id)
+        const ref = await sbx.snapshot!('live-test')
+        let restored: SandboxHandle | undefined
+        try {
+          // The overlay stays in memory-backed /dev through the capture.
+          expect(
+            (
+              await sbx.process.exec(
+                'echo $OVERLAY; ls /dev/tsai; ls /tmp/tsai | grep env; true',
+              )
+            ).stdout,
+          ).toBe(`${canary}\nenv\n`)
+          restored = await provider.restoreSnapshot!({
+            snapshotId: ref.id,
+            env: { AFTER: 'restore' },
+            policy: { capabilities: { network: 'deny' } },
+          })
+          expect(await restored.fs.read('/workspace/kept.txt')).toBe('kept')
+          const r = await restored.process.exec(
+            'echo $AFTER; curl -sS -m 5 https://example.com >/dev/null; echo curl=$?',
+          )
+          expect(r.stdout).toContain('restore')
+          expect(r.stdout).not.toContain('curl=0')
+          // A filesystem snapshot leaves /dev out, so the secret stays behind.
+          const secret = await restored.process.exec(
+            `echo "[$OVERLAY]"; test -e /dev/tsai/env && echo overlay; grep -rlsF ${canary} /tmp /workspace /root; true`,
+          )
+          expect(secret.stdout).toBe('[]\n')
+        } finally {
+          try {
+            await restored?.destroy()
+          } finally {
+            // Otherwise every run leaves a `tsai-live-test` snapshot behind.
+            if (sandboxGroupId) {
+              await sandboxes.snapshots.delete({
+                sandboxGroupId,
+                snapshotId: ref.id,
+              })
+            }
+          }
+        }
+      })
+    }, 180_000)
+
+    it('resumes a live sandbox and returns null once it is gone', async () => {
+      const sbx = await provider.create({})
+      try {
+        const resumed = await provider.resume({ id: sbx.id })
+        expect((await resumed!.process.exec('echo back')).stdout).toBe('back\n')
+        await provider.destroy({ id: sbx.id })
+        expect(await provider.resume({ id: sbx.id })).toBeNull()
+      } finally {
+        // Idempotent, and stops a billed sandbox if an assertion failed.
+        await provider.destroy({ id: sbx.id })
+      }
+    }, 120_000)
+  },
+)
diff --git a/packages/ai-sandbox-render/tsconfig.json b/packages/ai-sandbox-render/tsconfig.json
new file mode 100644
index 0000000000..c38689f4ea
--- /dev/null
+++ b/packages/ai-sandbox-render/tsconfig.json
@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "dist"
+  },
+  "include": ["src", "tests"],
+  "exclude": ["node_modules", "dist"]
+}
diff --git a/packages/ai-sandbox-render/vite.config.ts b/packages/ai-sandbox-render/vite.config.ts
new file mode 100644
index 0000000000..11f5b20b70
--- /dev/null
+++ b/packages/ai-sandbox-render/vite.config.ts
@@ -0,0 +1,37 @@
+import { defineConfig, mergeConfig } from 'vitest/config'
+import { tanstackViteConfig } from '@tanstack/vite-config'
+import packageJson from './package.json'
+
+const config = defineConfig({
+  test: {
+    name: packageJson.name,
+    dir: './',
+    watch: false,
+
+    globals: true,
+    environment: 'node',
+    include: ['tests/**/*.test.ts'],
+    coverage: {
+      provider: 'v8',
+      reporter: ['text', 'json', 'html', 'lcov'],
+      exclude: [
+        'node_modules/',
+        'dist/',
+        'tests/',
+        '**/*.test.ts',
+        '**/*.config.ts',
+        '**/types.ts',
+      ],
+      include: ['src/**/*.ts'],
+    },
+  },
+})
+
+export default mergeConfig(
+  config,
+  tanstackViteConfig({
+    entry: ['./src/index.ts'],
+    srcDir: './src',
+    cjs: false,
+  }),
+)
diff --git a/packages/ai-sandbox/README.md b/packages/ai-sandbox/README.md
index 4abe2ca7c7..5a1f164fb0 100644
--- a/packages/ai-sandbox/README.md
+++ b/packages/ai-sandbox/README.md
@@ -78,6 +78,7 @@ Pick a **provider** package for where the sandbox runs:
 | `@tanstack/ai-sandbox-boxd`          | boxd microVMs, live fork, snapshots    |
 | `@tanstack/ai-sandbox-e2b`           | E2B microVMs, snapshots and fork       |
 | `@tanstack/ai-sandbox-railway`       | Railway sandboxes, private networking  |
+| `@tanstack/ai-sandbox-render`        | Render sandboxes, snapshots, egress    |
 
 Install the provider you select separately. For Blaxel:
 
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 5ef6b0003b..aa5e9f080b 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -846,7 +846,7 @@ importers:
         version: 1.170.41(react-dom@19.2.3(react@19.2.3))(react@19.2.3)
       '@tanstack/react-start':
         specifier: ^1.168.60
-        version: 1.168.60(crossws@0.4.6(srvx@0.11.22))(esbuild@0.28.1)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(rolldown@1.2.9)(rollup@4.60.1)(vite-plugin-solid@2.11.14(solid-js@1.9.10)(vite@8.2.1(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0)))(vite@8.2.1(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))
+        version: 1.168.60(crossws@0.4.6(srvx@0.11.17))(esbuild@0.28.1)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(rolldown@1.2.9)(rollup@4.60.1)(vite-plugin-solid@2.11.14(solid-js@1.9.10)(vite@8.2.1(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0)))(vite@8.2.1(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))
       lucide-react:
         specifier: ^0.561.0
         version: 0.561.0(react@19.2.3)
@@ -1146,7 +1146,7 @@ importers:
         version: 1.159.5(@tanstack/react-router@1.170.41(react-dom@19.2.3(react@19.2.3))(react@19.2.3))(@tanstack/router-core@1.171.34)(csstype@3.2.3)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)
       '@tanstack/react-start':
         specifier: ^1.168.60
-        version: 1.168.60(crossws@0.4.6(srvx@0.11.17))(esbuild@0.28.1)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(rolldown@1.2.9)(rollup@4.60.1)(vite-plugin-solid@2.11.14(solid-js@1.9.10)(vite@8.2.1(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0)))(vite@8.2.1(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))
+        version: 1.168.60(crossws@0.4.6(srvx@0.11.22))(esbuild@0.28.1)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(rolldown@1.2.9)(rollup@4.60.1)(vite-plugin-solid@2.11.14(solid-js@1.9.10)(vite@8.2.1(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0)))(vite@8.2.1(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))
       '@tanstack/router-plugin':
         specifier: ^1.168.42
         version: 1.168.42(@tanstack/react-router@1.170.41(react-dom@19.2.3(react@19.2.3))(react@19.2.3))(esbuild@0.28.1)(rolldown@1.2.9)(rollup@4.60.1)(vite-plugin-solid@2.11.14(solid-js@1.9.10)(vite@8.2.1(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0)))(vite@8.2.1(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))
@@ -1222,7 +1222,7 @@ importers:
         version: 7.1.1(@cfworker/json-schema@4.1.1)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)
       '@modelcontextprotocol/sdk':
         specifier: ^1.29.0
-        version: 1.29.0(@cfworker/json-schema@4.1.1)(zod@4.2.1)
+        version: 1.29.0(@cfworker/json-schema@4.1.1)(supports-color@7.2.0)(zod@4.2.1)
       '@ngrok/ngrok':
         specifier: ^1.7.0
         version: 1.7.0
@@ -1873,7 +1873,7 @@ importers:
         version: link:../../packages/ai-remix
       remix:
         specifier: ^3.0.0-rc.1
-        version: 3.0.0-rc.1(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(mysql2@3.15.3)(pg@8.23.1)
+        version: 3.0.0-rc.1(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(mysql2@3.15.3)(pg@8.23.1)(redis@5.12.1(@opentelemetry/api@1.9.1))
       zod:
         specifier: ^4.2.0
         version: 4.3.6
@@ -1916,7 +1916,7 @@ importers:
         version: link:../../packages/ai-solid
       '@tanstack/nitro-v2-vite-plugin':
         specifier: ^1.155.0
-        version: 1.155.0(@electric-sql/pglite@0.5.11)(aws4fetch@1.0.20)(better-sqlite3@12.11.1)(drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)))(mysql2@3.15.3)(rolldown@1.2.4)(vite@8.2.1(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))
+        version: 1.155.0(@electric-sql/pglite@0.5.11)(aws4fetch@1.0.20)(better-sqlite3@12.11.1)(drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)))(mysql2@3.15.3)(rolldown@1.2.4)(vite@8.2.1(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))
       '@tanstack/router-plugin':
         specifier: ^1.168.42
         version: 1.168.42(@tanstack/react-router@1.170.41(react-dom@19.2.3(react@19.2.3))(react@19.2.3))(esbuild@0.28.1)(rolldown@1.2.9)(rollup@4.60.1)(vite-plugin-solid@2.11.14(solid-js@1.9.10)(vite@8.2.1(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0)))(vite@8.2.1(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))
@@ -2226,7 +2226,7 @@ importers:
     devDependencies:
       '@analogjs/vite-plugin-angular':
         specifier: ^2.6.2
-        version: 2.6.3(@angular/build@21.2.21(@angular/compiler-cli@21.2.17(@angular/compiler@21.2.20)(typescript@5.9.3))(@angular/compiler@21.2.20)(@angular/core@21.2.20(@angular/compiler@21.2.20)(rxjs@7.8.2)(zone.js@0.15.1))(@angular/platform-browser@21.2.20(@angular/common@21.2.20(@angular/core@21.2.20(@angular/compiler@21.2.20)(rxjs@7.8.2)(zone.js@0.15.1))(rxjs@7.8.2))(@angular/core@21.2.20(@angular/compiler@21.2.20)(rxjs@7.8.2)(zone.js@0.15.1)))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@24.10.3)(chokidar@5.0.0)(jiti@2.7.0)(less@4.6.6)(lightningcss@1.33.0)(ng-packagr@21.2.5(@angular/compiler-cli@21.2.17(@angular/compiler@21.2.20)(typescript@5.9.3))(tailwindcss@4.1.18)(tslib@2.8.1)(typescript@5.9.3))(postcss@8.5.26)(tailwindcss@4.1.18)(terser@5.44.1)(tslib@2.8.1)(tsx@4.23.12)(typescript@5.9.3)(vitest@4.1.10)(yaml@2.9.0))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(vite@8.3.0(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.97.3)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))
+        version: 2.6.3(@angular/build@21.2.21(@angular/compiler-cli@21.2.17(@angular/compiler@21.2.20)(typescript@5.9.3))(@angular/compiler@21.2.20)(@angular/core@21.2.20(@angular/compiler@21.2.20)(rxjs@7.8.2)(zone.js@0.15.1))(@angular/platform-browser@21.2.20(@angular/common@21.2.20(@angular/core@21.2.20(@angular/compiler@21.2.20)(rxjs@7.8.2)(zone.js@0.15.1))(rxjs@7.8.2))(@angular/core@21.2.20(@angular/compiler@21.2.20)(rxjs@7.8.2)(zone.js@0.15.1)))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@24.10.3)(chokidar@5.0.0)(jiti@2.7.0)(less@4.6.6)(lightningcss@1.33.0)(ng-packagr@21.2.5(@angular/compiler-cli@21.2.17(@angular/compiler@21.2.20)(typescript@5.9.3))(tailwindcss@4.1.18)(tslib@2.8.1)(typescript@5.9.3))(postcss@8.5.26)(tailwindcss@4.1.18)(terser@5.44.1)(tslib@2.8.1)(tsx@4.23.12)(typescript@5.9.3)(vitest@4.1.10)(yaml@2.9.0))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(vite@8.3.0(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))
       '@angular/build':
         specifier: ^21.2.21
         version: 21.2.21(@angular/compiler-cli@21.2.17(@angular/compiler@21.2.20)(typescript@5.9.3))(@angular/compiler@21.2.20)(@angular/core@21.2.20(@angular/compiler@21.2.20)(rxjs@7.8.2)(zone.js@0.15.1))(@angular/platform-browser@21.2.20(@angular/common@21.2.20(@angular/core@21.2.20(@angular/compiler@21.2.20)(rxjs@7.8.2)(zone.js@0.15.1))(rxjs@7.8.2))(@angular/core@21.2.20(@angular/compiler@21.2.20)(rxjs@7.8.2)(zone.js@0.15.1)))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@24.10.3)(chokidar@5.0.0)(jiti@2.7.0)(less@4.6.6)(lightningcss@1.33.0)(ng-packagr@21.2.5(@angular/compiler-cli@21.2.17(@angular/compiler@21.2.20)(typescript@5.9.3))(tailwindcss@4.1.18)(tslib@2.8.1)(typescript@5.9.3))(postcss@8.5.26)(tailwindcss@4.1.18)(terser@5.44.1)(tslib@2.8.1)(tsx@4.23.12)(typescript@5.9.3)(vitest@4.1.10)(yaml@2.9.0)
@@ -2262,7 +2262,7 @@ importers:
         version: 5.9.3
       vitest:
         specifier: ^4.1.10
-        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.10.3)(@vitest/coverage-v8@4.1.10)(happy-dom@20.11.2)(jsdom@27.4.0(@noble/hashes@2.3.0))(vite@8.3.0(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.97.3)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))
+        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.10.3)(@vitest/coverage-v8@4.1.10)(happy-dom@20.11.2)(jsdom@27.4.0(@noble/hashes@2.3.0))(vite@8.3.0(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))
       zod:
         specifier: ^4.2.0
         version: 4.3.6
@@ -3046,7 +3046,7 @@ importers:
         version: link:../ai-event-client
       ioredis:
         specifier: '>=5.0.0'
-        version: 5.9.2(supports-color@7.2.0)
+        version: 5.9.2
     devDependencies:
       '@honcho-ai/sdk':
         specifier: ^2.1.1
@@ -3062,7 +3062,7 @@ importers:
         version: 4.1.10(vitest@4.1.10)
       ioredis-mock:
         specifier: ^8.9.0
-        version: 8.13.1(@types/ioredis-mock@8.2.7(ioredis@5.9.2(supports-color@7.2.0)))(ioredis@5.9.2(supports-color@7.2.0))
+        version: 8.13.1(@types/ioredis-mock@8.2.7(ioredis@5.9.2))(ioredis@5.9.2)
       redis:
         specifier: ^4.7.0
         version: 4.7.1
@@ -3395,7 +3395,7 @@ importers:
         version: 20.11.2
       remix:
         specifier: ^3.0.0-rc.1
-        version: 3.0.0-rc.1(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(mysql2@3.15.3)(pg@8.23.1)
+        version: 3.0.0-rc.1(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(mysql2@3.15.3)(pg@8.23.1)(redis@5.12.1(@opentelemetry/api@1.9.1))
       vite:
         specifier: ^8.2.1
         version: 8.2.1(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0)
@@ -3559,6 +3559,19 @@ importers:
         specifier: 4.1.10
         version: 4.1.10(vitest@4.1.11)
 
+  packages/ai-sandbox-render:
+    dependencies:
+      '@renderinc/sdk':
+        specifier: ^1.5.0
+        version: 1.5.0(@opentelemetry/api@1.9.1)
+    devDependencies:
+      '@tanstack/ai-sandbox':
+        specifier: workspace:*
+        version: link:../ai-sandbox
+      '@vitest/coverage-v8':
+        specifier: 4.1.10
+        version: 4.1.10(vitest@4.1.11)
+
   packages/ai-sandbox-sprites:
     devDependencies:
       '@tanstack/ai-sandbox':
@@ -9754,10 +9767,28 @@ packages:
     peerDependencies:
       '@redis/client': ^1.0.0
 
+  '@redis/bloom@5.12.1':
+    resolution: {integrity: sha512-PUUfv+ms7jgPSBVoo/DN4AkPHj4D5TZSd6SbJX7egzBplkYUcKmHRE8RKia7UtZ8bSQbLguLvxVO+asKtQfZWA==}
+    engines: {node: '>= 18.19.0'}
+    peerDependencies:
+      '@redis/client': ^5.12.1
+
   '@redis/client@1.6.1':
     resolution: {integrity: sha512-/KCsg3xSlR+nCK8/8ZYSknYxvXHwubJrU82F3Lm1Fp6789VQ0/3RJKfsmRXjqfaTA++23CvC3hqmqe/2GEt6Kw==}
     engines: {node: '>=14'}
 
+  '@redis/client@5.12.1':
+    resolution: {integrity: sha512-7aPGWeqA3uFm43o19umzdl16CEjK/JQGtSXVPevplTaOU3VJA/rseBC1QvYUz9lLDIMBimc4SW/zrW4S89BaCA==}
+    engines: {node: '>= 18.19.0'}
+    peerDependencies:
+      '@node-rs/xxhash': ^1.1.0
+      '@opentelemetry/api': '>=1 <2'
+    peerDependenciesMeta:
+      '@node-rs/xxhash':
+        optional: true
+      '@opentelemetry/api':
+        optional: true
+
   '@redis/graph@1.1.1':
     resolution: {integrity: sha512-FEMTcTHZozZciLRl6GiiIB4zGm5z5F3F6a6FZCyrfxdKOhFlGkiAqlexWMBzCi4DcRoyiOsuLfW+cjlGWyExOw==}
     peerDependencies:
@@ -9768,16 +9799,34 @@ packages:
     peerDependencies:
       '@redis/client': ^1.0.0
 
+  '@redis/json@5.12.1':
+    resolution: {integrity: sha512-eOze75esLve4vfqDel7aMX08CNaiLLQS2fV8mpRN9NxPe1rVR4vQyYiW/OgtGUysF6QOr9ANhfxABKNOJfXdKg==}
+    engines: {node: '>= 18.19.0'}
+    peerDependencies:
+      '@redis/client': ^5.12.1
+
   '@redis/search@1.2.0':
     resolution: {integrity: sha512-tYoDBbtqOVigEDMAcTGsRlMycIIjwMCgD8eR2t0NANeQmgK/lvxNAvYyb6bZDD4frHRhIHkJu2TBRvB0ERkOmw==}
     peerDependencies:
       '@redis/client': ^1.0.0
 
+  '@redis/search@5.12.1':
+    resolution: {integrity: sha512-ItlxbxC9cKI6IU1TLWoczwJCRb6TdmkEpWv05UrPawqaAnWGRu3rcIqsc5vN483T2fSociuyV1UkWIL5I4//2w==}
+    engines: {node: '>= 18.19.0'}
+    peerDependencies:
+      '@redis/client': ^5.12.1
+
   '@redis/time-series@1.1.0':
     resolution: {integrity: sha512-c1Q99M5ljsIuc4YdaCwfUEXsofakb9c8+Zse2qxTadu8TalLXuAESzLvFAvNVbkmSlvlzIQOLpBCmWI9wTOt+g==}
     peerDependencies:
       '@redis/client': ^1.0.0
 
+  '@redis/time-series@5.12.1':
+    resolution: {integrity: sha512-c6JL6E3EcZJuNqKFz+KM+l9l5mpcQiKvTwgA3blt5glWJ8hjDk0yeHN3beE/MpqYIQ8UEX44ItQzgkE/gCBELQ==}
+    engines: {node: '>= 18.19.0'}
+    peerDependencies:
+      '@redis/client': ^5.12.1
+
   '@remix-run/assert@0.3.0':
     resolution: {integrity: sha512-GBA9klvJdG5YSTwRNur54LQcfqDOtir+x1TDbv3dzB9FS2Li9CEiRLp1EpBcaYrj4ByO03WJCWFBiY8bTMy4vQ==}
 
@@ -9942,6 +9991,10 @@ packages:
   '@remix-run/ui@0.8.0':
     resolution: {integrity: sha512-4OdZ3oj0zbyVVaCFT/x2vjK5YxpD63KpLONkLZ2QVKIEBcLjJUGSenp2f08BOzC8oythLHCJgzHLKKulYJpIQA==}
 
+  '@renderinc/sdk@1.5.0':
+    resolution: {integrity: sha512-xSJkPp8cx52SEXyO2uFwEaZHi0LAUlPI8hTQj1wEli+hEx4Dnb4ELg+dJeFnNiqSke0pbCgi6S3Ydmi7G0h+DQ==}
+    engines: {node: '>=18.0.0'}
+
   '@rolldown/binding-android-arm-eabi@1.2.9':
     resolution: {integrity: sha512-tNISae1QEf/vkb3xkRcjV5SEdzPE97We5IVaa2Z8jSszQPZ8U60B/YCYpw4QI7VidYsBtKavczXf+DyDs9WGxw==}
     engines: {node: ^20.19.0 || >=22.12.0}
@@ -13992,6 +14045,10 @@ packages:
     resolution: {integrity: sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA==}
     engines: {node: '>=18.0.0'}
 
+  eventsource@4.1.1:
+    resolution: {integrity: sha512-D6bTRWh6KahHTK/m4WnjPQyEinNPf9eFLEZSEoj7d6fTibspnAVYfzHvirL7u/aoX5d9YYfIkBVAhmigUELk9w==}
+    engines: {node: '>=20.0.0'}
+
   execa@8.0.1:
     resolution: {integrity: sha512-VyhnebXciFV2DESc+p6B+y0LjSm0krU4OgJN44qFAhBY0TJ+1V61tYD2+wHusZ6F9n5K+vl8k0sTy7PEfV4qpg==}
     engines: {node: '>=16.17'}
@@ -16462,6 +16519,9 @@ packages:
   openapi-fetch@0.14.1:
     resolution: {integrity: sha512-l7RarRHxlEZYjMLd/PR0slfMVse2/vvIAGm75/F7J6MlQ8/b9uUQmUF2kCPrQhJqMXSxmYWObVgeYXbFYzZR+A==}
 
+  openapi-fetch@0.15.2:
+    resolution: {integrity: sha512-rdYTzUmSsJevmNqg7fwUVGuKc2Gfb9h6ph74EVPkPfIGJaZTfqdIbJahtbJ3qg1LKinln30hqZniLnKpH0RJBg==}
+
   openapi-typescript-helpers@0.0.15:
     resolution: {integrity: sha512-opyTPaunsklCBpTK8JGef6mfPhLSnyy5a0IN9vKtx3+4aExf+KxEqYwIy3hqkedXIB97u357uLMJsOnm3GVjsw==}
 
@@ -17299,6 +17359,10 @@ packages:
   redis@4.7.1:
     resolution: {integrity: sha512-S1bJDnqLftzHXHP8JsT5II/CtHWQrASX5K96REjWjlmWKrviSOLWmM7QnRLstAWsu1VBBV1ffV6DzCvxNP0UJQ==}
 
+  redis@5.12.1:
+    resolution: {integrity: sha512-LDsoVvb/CpoV9EN3FXvgvSHNJWuCIzl9MiO3ppOevuGLpSGJhwfQjpEwfFJcQvNSddHADDdZaWx0HnmMxRXG7g==}
+    engines: {node: '>= 18.19.0'}
+
   reflect-metadata@0.2.2:
     resolution: {integrity: sha512-urBwgfrvVP/eAyXx4hluJivBKzuEbSQs9rKWCrCkbSxNv8mxPcUZKeuoF3Uy4mJl3Lwprp6yy5/39VWigZ4K6Q==}
 
@@ -19598,7 +19662,7 @@ snapshots:
       - '@emnapi/core'
       - '@emnapi/runtime'
 
-  ? '@analogjs/vite-plugin-angular@2.6.3(@angular/build@21.2.21(@angular/compiler-cli@21.2.17(@angular/compiler@21.2.20)(typescript@5.9.3))(@angular/compiler@21.2.20)(@angular/core@21.2.20(@angular/compiler@21.2.20)(rxjs@7.8.2)(zone.js@0.15.1))(@angular/platform-browser@21.2.20(@angular/common@21.2.20(@angular/core@21.2.20(@angular/compiler@21.2.20)(rxjs@7.8.2)(zone.js@0.15.1))(rxjs@7.8.2))(@angular/core@21.2.20(@angular/compiler@21.2.20)(rxjs@7.8.2)(zone.js@0.15.1)))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@24.10.3)(chokidar@5.0.0)(jiti@2.7.0)(less@4.6.6)(lightningcss@1.33.0)(ng-packagr@21.2.5(@angular/compiler-cli@21.2.17(@angular/compiler@21.2.20)(typescript@5.9.3))(tailwindcss@4.1.18)(tslib@2.8.1)(typescript@5.9.3))(postcss@8.5.26)(tailwindcss@4.1.18)(terser@5.44.1)(tslib@2.8.1)(tsx@4.23.12)(typescript@5.9.3)(vitest@4.1.10)(yaml@2.9.0))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(vite@8.3.0(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.97.3)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))'
+  ? '@analogjs/vite-plugin-angular@2.6.3(@angular/build@21.2.21(@angular/compiler-cli@21.2.17(@angular/compiler@21.2.20)(typescript@5.9.3))(@angular/compiler@21.2.20)(@angular/core@21.2.20(@angular/compiler@21.2.20)(rxjs@7.8.2)(zone.js@0.15.1))(@angular/platform-browser@21.2.20(@angular/common@21.2.20(@angular/core@21.2.20(@angular/compiler@21.2.20)(rxjs@7.8.2)(zone.js@0.15.1))(rxjs@7.8.2))(@angular/core@21.2.20(@angular/compiler@21.2.20)(rxjs@7.8.2)(zone.js@0.15.1)))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@24.10.3)(chokidar@5.0.0)(jiti@2.7.0)(less@4.6.6)(lightningcss@1.33.0)(ng-packagr@21.2.5(@angular/compiler-cli@21.2.17(@angular/compiler@21.2.20)(typescript@5.9.3))(tailwindcss@4.1.18)(tslib@2.8.1)(typescript@5.9.3))(postcss@8.5.26)(tailwindcss@4.1.18)(terser@5.44.1)(tslib@2.8.1)(tsx@4.23.12)(typescript@5.9.3)(vitest@4.1.10)(yaml@2.9.0))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(vite@8.3.0(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))'
   : dependencies:
       magic-string: 0.30.21
       obug: 2.1.1
@@ -19608,7 +19672,7 @@ snapshots:
       typescript: 5.9.3
     optionalDependencies:
       '@angular/build': 21.2.21(@angular/compiler-cli@21.2.17(@angular/compiler@21.2.20)(typescript@5.9.3))(@angular/compiler@21.2.20)(@angular/core@21.2.20(@angular/compiler@21.2.20)(rxjs@7.8.2)(zone.js@0.15.1))(@angular/platform-browser@21.2.20(@angular/common@21.2.20(@angular/core@21.2.20(@angular/compiler@21.2.20)(rxjs@7.8.2)(zone.js@0.15.1))(rxjs@7.8.2))(@angular/core@21.2.20(@angular/compiler@21.2.20)(rxjs@7.8.2)(zone.js@0.15.1)))(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(@types/node@24.10.3)(chokidar@5.0.0)(jiti@2.7.0)(less@4.6.6)(lightningcss@1.33.0)(ng-packagr@21.2.5(@angular/compiler-cli@21.2.17(@angular/compiler@21.2.20)(typescript@5.9.3))(tailwindcss@4.1.18)(tslib@2.8.1)(typescript@5.9.3))(postcss@8.5.26)(tailwindcss@4.1.18)(terser@5.44.1)(tslib@2.8.1)(tsx@4.23.12)(typescript@5.9.3)(vitest@4.1.10)(yaml@2.9.0)
-      vite: 8.3.0(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.97.3)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0)
+      vite: 8.3.0(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0)
     transitivePeerDependencies:
       - '@emnapi/core'
       - '@emnapi/runtime'
@@ -19729,7 +19793,7 @@ snapshots:
       ng-packagr: 21.2.5(@angular/compiler-cli@21.2.17(@angular/compiler@21.2.20)(typescript@5.9.3))(tailwindcss@4.1.18)(tslib@2.8.1)(typescript@5.9.3)
       postcss: 8.5.26
       tailwindcss: 4.1.18
-      vitest: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.10.3)(@vitest/coverage-v8@4.1.10)(happy-dom@20.11.2)(jsdom@27.4.0(@noble/hashes@2.3.0))(vite@8.3.0(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.97.3)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))
+      vitest: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.10.3)(@vitest/coverage-v8@4.1.10)(happy-dom@20.11.2)(jsdom@27.4.0(@noble/hashes@2.3.0))(vite@8.3.0(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))
     transitivePeerDependencies:
       - '@emnapi/core'
       - '@emnapi/runtime'
@@ -23209,7 +23273,7 @@ snapshots:
 
   '@mcp-ui/client@7.1.1(@cfworker/json-schema@4.1.1)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)':
     dependencies:
-      '@modelcontextprotocol/ext-apps': 1.7.4(@modelcontextprotocol/sdk@1.29.0(@cfworker/json-schema@4.1.1)(zod@3.25.76))(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(zod@3.25.76)
+      '@modelcontextprotocol/ext-apps': 1.7.4(@modelcontextprotocol/sdk@1.29.0(@cfworker/json-schema@4.1.1)(supports-color@7.2.0)(zod@4.2.1))(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(zod@3.25.76)
       '@modelcontextprotocol/sdk': 1.29.0(@cfworker/json-schema@4.1.1)(zod@3.25.76)
       react: 19.2.3
       react-dom: 19.2.3(react@19.2.3)
@@ -23310,16 +23374,16 @@ snapshots:
     dependencies:
       zod: 4.3.6
 
-  '@modelcontextprotocol/ext-apps@1.7.4(@modelcontextprotocol/sdk@1.29.0(@cfworker/json-schema@4.1.1)(zod@3.25.76))(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(zod@3.25.76)':
+  '@modelcontextprotocol/ext-apps@1.7.4(@modelcontextprotocol/sdk@1.29.0(@cfworker/json-schema@4.1.1)(supports-color@7.2.0)(zod@4.2.1))(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(zod@3.25.76)':
     dependencies:
-      '@modelcontextprotocol/sdk': 1.29.0(@cfworker/json-schema@4.1.1)(zod@3.25.76)
+      '@modelcontextprotocol/sdk': 1.29.0(@cfworker/json-schema@4.1.1)(supports-color@7.2.0)(zod@4.2.1)
       '@standard-schema/spec': 1.1.0
       zod: 3.25.76
     optionalDependencies:
       react: 19.2.3
       react-dom: 19.2.3(react@19.2.3)
 
-  '@modelcontextprotocol/sdk@1.29.0(@cfworker/json-schema@4.1.1)(zod@3.25.76)':
+  '@modelcontextprotocol/sdk@1.29.0(@cfworker/json-schema@4.1.1)(supports-color@7.2.0)(zod@4.2.1)':
     dependencies:
       '@hono/node-server': 1.19.17(hono@4.13.8)
       ajv: 8.20.0
@@ -23330,20 +23394,20 @@ snapshots:
       eventsource: 3.0.7
       eventsource-parser: 3.1.1
       express: 5.2.1
-      express-rate-limit: 8.7.0(express@5.2.1)
+      express-rate-limit: 8.7.0(express@5.2.1)(supports-color@7.2.0)
       hono: 4.13.8
       jose: 6.2.12
       json-schema-typed: 8.0.2
       pkce-challenge: 5.0.1
       raw-body: 3.0.2
-      zod: 3.25.76
-      zod-to-json-schema: 3.25.2(zod@3.25.76)
+      zod: 4.2.1
+      zod-to-json-schema: 3.25.2(zod@4.2.1)
     optionalDependencies:
       '@cfworker/json-schema': 4.1.1
     transitivePeerDependencies:
       - supports-color
 
-  '@modelcontextprotocol/sdk@1.29.0(@cfworker/json-schema@4.1.1)(zod@4.2.1)':
+  '@modelcontextprotocol/sdk@1.29.0(@cfworker/json-schema@4.1.1)(zod@3.25.76)':
     dependencies:
       '@hono/node-server': 1.19.17(hono@4.13.8)
       ajv: 8.20.0
@@ -23354,14 +23418,14 @@ snapshots:
       eventsource: 3.0.7
       eventsource-parser: 3.1.1
       express: 5.2.1
-      express-rate-limit: 8.7.0(express@5.2.1)
+      express-rate-limit: 8.7.0(express@5.2.1)(supports-color@7.2.0)
       hono: 4.13.8
       jose: 6.2.12
       json-schema-typed: 8.0.2
       pkce-challenge: 5.0.1
       raw-body: 3.0.2
-      zod: 4.2.1
-      zod-to-json-schema: 3.25.2(zod@4.2.1)
+      zod: 3.25.76
+      zod-to-json-schema: 3.25.2(zod@3.25.76)
     optionalDependencies:
       '@cfworker/json-schema': 4.1.1
     transitivePeerDependencies:
@@ -23378,7 +23442,7 @@ snapshots:
       eventsource: 3.0.7
       eventsource-parser: 3.1.1
       express: 5.2.1
-      express-rate-limit: 8.7.0(express@5.2.1)
+      express-rate-limit: 8.7.0(express@5.2.1)(supports-color@7.2.0)
       hono: 4.13.8
       jose: 6.2.12
       json-schema-typed: 8.0.2
@@ -23402,7 +23466,7 @@ snapshots:
       eventsource: 3.0.7
       eventsource-parser: 3.1.1
       express: 5.2.1
-      express-rate-limit: 8.7.0(express@5.2.1)
+      express-rate-limit: 8.7.0(express@5.2.1)(supports-color@7.2.0)
       hono: 4.13.8
       jose: 6.2.12
       json-schema-typed: 8.0.2
@@ -24710,20 +24774,20 @@ snapshots:
       typescript: 5.9.3
     optional: true
 
-  '@prisma/client@7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3)':
+  '@prisma/client@7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@7.0.2))(typescript@7.0.2)':
     dependencies:
       '@prisma/client-runtime-utils': 7.9.0
     optionalDependencies:
-      prisma: 7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)
-      typescript: 5.9.3
+      prisma: 7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@7.0.2)
+      typescript: 7.0.2
     optional: true
 
-  '@prisma/client@7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@7.0.2))(typescript@7.0.2)':
+  '@prisma/client@7.9.0(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3)':
     dependencies:
       '@prisma/client-runtime-utils': 7.9.0
     optionalDependencies:
-      prisma: 7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@7.0.2)
-      typescript: 7.0.2
+      prisma: 7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)
+      typescript: 5.9.3
     optional: true
 
   '@prisma/config@7.9.0(magicast@0.5.2)':
@@ -26589,12 +26653,22 @@ snapshots:
     dependencies:
       '@redis/client': 1.6.1
 
+  '@redis/bloom@5.12.1(@redis/client@5.12.1(@opentelemetry/api@1.9.1))':
+    dependencies:
+      '@redis/client': 5.12.1(@opentelemetry/api@1.9.1)
+
   '@redis/client@1.6.1':
     dependencies:
       cluster-key-slot: 1.1.2
       generic-pool: 3.9.0
       yallist: 4.0.0
 
+  '@redis/client@5.12.1(@opentelemetry/api@1.9.1)':
+    dependencies:
+      cluster-key-slot: 1.1.2
+    optionalDependencies:
+      '@opentelemetry/api': 1.9.1
+
   '@redis/graph@1.1.1(@redis/client@1.6.1)':
     dependencies:
       '@redis/client': 1.6.1
@@ -26603,14 +26677,26 @@ snapshots:
     dependencies:
       '@redis/client': 1.6.1
 
+  '@redis/json@5.12.1(@redis/client@5.12.1(@opentelemetry/api@1.9.1))':
+    dependencies:
+      '@redis/client': 5.12.1(@opentelemetry/api@1.9.1)
+
   '@redis/search@1.2.0(@redis/client@1.6.1)':
     dependencies:
       '@redis/client': 1.6.1
 
+  '@redis/search@5.12.1(@redis/client@5.12.1(@opentelemetry/api@1.9.1))':
+    dependencies:
+      '@redis/client': 5.12.1(@opentelemetry/api@1.9.1)
+
   '@redis/time-series@1.1.0(@redis/client@1.6.1)':
     dependencies:
       '@redis/client': 1.6.1
 
+  '@redis/time-series@5.12.1(@redis/client@5.12.1(@opentelemetry/api@1.9.1))':
+    dependencies:
+      '@redis/client': 5.12.1(@opentelemetry/api@1.9.1)
+
   '@remix-run/assert@0.3.0': {}
 
   '@remix-run/assets@0.6.0(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)':
@@ -26815,9 +26901,11 @@ snapshots:
     dependencies:
       '@remix-run/session': 0.4.2
 
-  '@remix-run/session-storage-redis@0.1.1':
+  '@remix-run/session-storage-redis@0.1.1(redis@5.12.1(@opentelemetry/api@1.9.1))':
     dependencies:
       '@remix-run/session': 0.4.2
+    optionalDependencies:
+      redis: 5.12.1(@opentelemetry/api@1.9.1)
 
   '@remix-run/session@0.4.2': {}
 
@@ -26873,6 +26961,15 @@ snapshots:
     dependencies:
       '@types/dom-navigation': 1.0.7
 
+  '@renderinc/sdk@1.5.0(@opentelemetry/api@1.9.1)':
+    dependencies:
+      eventsource: 4.1.1
+      openapi-fetch: 0.15.2
+      redis: 5.12.1(@opentelemetry/api@1.9.1)
+    transitivePeerDependencies:
+      - '@node-rs/xxhash'
+      - '@opentelemetry/api'
+
   '@rolldown/binding-android-arm-eabi@1.2.9':
     optional: true
 
@@ -27845,9 +27942,9 @@ snapshots:
       - uploadthing
       - xml2js
 
-  '@tanstack/nitro-v2-vite-plugin@1.155.0(@electric-sql/pglite@0.5.11)(aws4fetch@1.0.20)(better-sqlite3@12.11.1)(drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)))(mysql2@3.15.3)(rolldown@1.2.4)(vite@8.2.1(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))':
+  '@tanstack/nitro-v2-vite-plugin@1.155.0(@electric-sql/pglite@0.5.11)(aws4fetch@1.0.20)(better-sqlite3@12.11.1)(drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)))(mysql2@3.15.3)(rolldown@1.2.4)(vite@8.2.1(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))':
     dependencies:
-      nitropack: 2.13.1(@electric-sql/pglite@0.5.11)(aws4fetch@1.0.20)(better-sqlite3@12.11.1)(drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)))(mysql2@3.15.3)(rolldown@1.2.4)
+      nitropack: 2.13.1(@electric-sql/pglite@0.5.11)(aws4fetch@1.0.20)(better-sqlite3@12.11.1)(drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)))(mysql2@3.15.3)(rolldown@1.2.4)
       pathe: 2.0.3
       vite: 8.2.1(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0)
     transitivePeerDependencies:
@@ -28823,9 +28920,9 @@ snapshots:
     dependencies:
       '@types/unist': 3.0.3
 
-  '@types/ioredis-mock@8.2.7(ioredis@5.9.2(supports-color@7.2.0))':
+  '@types/ioredis-mock@8.2.7(ioredis@5.9.2)':
     dependencies:
-      ioredis: 5.9.2(supports-color@7.2.0)
+      ioredis: 5.9.2
 
   '@types/istanbul-lib-coverage@2.0.6': {}
 
@@ -29339,7 +29436,7 @@ snapshots:
       obug: 2.2.1
       std-env: 4.2.0
       tinyrainbow: 3.1.1
-      vitest: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.10.3)(@vitest/coverage-v8@4.1.10)(happy-dom@20.11.2)(jsdom@27.4.0(@noble/hashes@2.3.0))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))
+      vitest: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.10.3)(@vitest/coverage-v8@4.1.10)(happy-dom@20.11.2)(jsdom@27.4.0(@noble/hashes@2.3.0))(vite@8.2.1(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))
 
   '@vitest/coverage-v8@4.1.10(vitest@4.1.11)':
     dependencies:
@@ -29389,14 +29486,6 @@ snapshots:
     optionalDependencies:
       vite: 8.3.0(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0)
 
-  '@vitest/mocker@4.1.10(vite@8.3.0(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.97.3)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))':
-    dependencies:
-      '@vitest/spy': 4.1.10
-      estree-walker: 3.0.3
-      magic-string: 0.30.21
-    optionalDependencies:
-      vite: 8.3.0(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.97.3)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0)
-
   '@vitest/mocker@4.1.10(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))':
     dependencies:
       '@vitest/spy': 4.1.10
@@ -30895,11 +30984,11 @@ snapshots:
 
   dayjs@1.11.19: {}
 
-  db0@0.3.4(@electric-sql/pglite@0.5.11)(better-sqlite3@12.11.1)(drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)))(mysql2@3.15.3):
+  db0@0.3.4(@electric-sql/pglite@0.5.11)(better-sqlite3@12.11.1)(drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)))(mysql2@3.15.3):
     optionalDependencies:
       '@electric-sql/pglite': 0.5.11
       better-sqlite3: 12.11.1
-      drizzle-orm: 0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))
+      drizzle-orm: 0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))
       mysql2: 3.15.3
 
   db0@0.3.4(@electric-sql/pglite@0.5.11)(better-sqlite3@12.11.1)(drizzle-orm@0.45.4(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.2.18))(@types/react@19.2.18)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.2.18))(@types/react@19.2.18)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)))(mysql2@3.15.3):
@@ -31151,34 +31240,34 @@ snapshots:
       prisma: 7.9.0(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)
     optional: true
 
-  drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)):
+  drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@7.0.2))(typescript@7.0.2))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@7.0.2)):
     optionalDependencies:
       '@cloudflare/workers-types': 4.20260317.1
       '@electric-sql/pglite': 0.5.11
       '@opentelemetry/api': 1.9.1
-      '@prisma/client': 7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3)
+      '@prisma/client': 7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@7.0.2))(typescript@7.0.2)
       '@types/pg': 8.23.1
       better-sqlite3: 12.11.1
       bun-types: 1.3.14
       mysql2: 3.15.3
       pg: 8.23.1
       postgres: 3.4.7
-      prisma: 7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)
-    optional: true
+      prisma: 7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@7.0.2)
 
-  drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@7.0.2))(typescript@7.0.2))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@7.0.2)):
+  drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)):
     optionalDependencies:
       '@cloudflare/workers-types': 4.20260317.1
       '@electric-sql/pglite': 0.5.11
       '@opentelemetry/api': 1.9.1
-      '@prisma/client': 7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@7.0.2))(typescript@7.0.2)
+      '@prisma/client': 7.9.0(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3)
       '@types/pg': 8.23.1
       better-sqlite3: 12.11.1
       bun-types: 1.3.14
       mysql2: 3.15.3
       pg: 8.23.1
       postgres: 3.4.7
-      prisma: 7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@7.0.2)
+      prisma: 7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)
+    optional: true
 
   drizzle-orm@0.45.4(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.2.18))(@types/react@19.2.18)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.2.18))(@types/react@19.2.18)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)):
     optionalDependencies:
@@ -31609,6 +31698,10 @@ snapshots:
     dependencies:
       eventsource-parser: 3.1.1
 
+  eventsource@4.1.1:
+    dependencies:
+      eventsource-parser: 3.1.1
+
   execa@8.0.1:
     dependencies:
       cross-spawn: 7.0.6
@@ -31817,7 +31910,7 @@ snapshots:
 
   exponential-backoff@3.1.3: {}
 
-  express-rate-limit@8.7.0(express@5.2.1):
+  express-rate-limit@8.7.0(express@5.2.1)(supports-color@7.2.0):
     dependencies:
       debug: 4.4.3(supports-color@7.2.0)
       express: 5.2.1
@@ -32704,17 +32797,17 @@ snapshots:
     dependencies:
       loose-envify: 1.4.0
 
-  ioredis-mock@8.13.1(@types/ioredis-mock@8.2.7(ioredis@5.9.2(supports-color@7.2.0)))(ioredis@5.9.2(supports-color@7.2.0)):
+  ioredis-mock@8.13.1(@types/ioredis-mock@8.2.7(ioredis@5.9.2))(ioredis@5.9.2):
     dependencies:
       '@ioredis/as-callback': 3.0.0
       '@ioredis/commands': 1.5.0
-      '@types/ioredis-mock': 8.2.7(ioredis@5.9.2(supports-color@7.2.0))
+      '@types/ioredis-mock': 8.2.7(ioredis@5.9.2)
       fengari: 0.1.5
       fengari-interop: 0.1.4(fengari@0.1.5)
-      ioredis: 5.9.2(supports-color@7.2.0)
+      ioredis: 5.9.2
       semver: 7.8.4
 
-  ioredis@5.9.2(supports-color@7.2.0):
+  ioredis@5.9.2:
     dependencies:
       '@ioredis/commands': 1.5.0
       cluster-key-slot: 1.1.2
@@ -34557,7 +34650,7 @@ snapshots:
       h3: 1.15.5
       hookable: 5.5.3
       httpxy: 0.1.7
-      ioredis: 5.9.2(supports-color@7.2.0)
+      ioredis: 5.9.2
       jiti: 2.7.0
       klona: 2.0.6
       knitwork: 1.3.0
@@ -34625,7 +34718,7 @@ snapshots:
       - supports-color
       - uploadthing
 
-  nitropack@2.13.1(@electric-sql/pglite@0.5.11)(aws4fetch@1.0.20)(better-sqlite3@12.11.1)(drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)))(mysql2@3.15.3)(rolldown@1.2.4):
+  nitropack@2.13.1(@electric-sql/pglite@0.5.11)(aws4fetch@1.0.20)(better-sqlite3@12.11.1)(drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)))(mysql2@3.15.3)(rolldown@1.2.4):
     dependencies:
       '@cloudflare/kv-asset-handler': 0.4.2
       '@rollup/plugin-alias': 6.0.0(rollup@4.60.1)
@@ -34646,7 +34739,7 @@ snapshots:
       cookie-es: 2.0.1
       croner: 9.1.0
       crossws: 0.3.5
-      db0: 0.3.4(@electric-sql/pglite@0.5.11)(better-sqlite3@12.11.1)(drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)))(mysql2@3.15.3)
+      db0: 0.3.4(@electric-sql/pglite@0.5.11)(better-sqlite3@12.11.1)(drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)))(mysql2@3.15.3)
       defu: 6.1.4
       destr: 2.0.5
       dot-prop: 10.1.0
@@ -34659,7 +34752,7 @@ snapshots:
       h3: 1.15.5
       hookable: 5.5.3
       httpxy: 0.1.7
-      ioredis: 5.9.2(supports-color@7.2.0)
+      ioredis: 5.9.2
       jiti: 2.7.0
       klona: 2.0.6
       knitwork: 1.3.0
@@ -34692,7 +34785,7 @@ snapshots:
       unenv: 2.0.0-rc.24
       unimport: 5.6.0
       unplugin-utils: 0.3.1
-      unstorage: 1.17.4(aws4fetch@1.0.20)(db0@0.3.4(@electric-sql/pglite@0.5.11)(better-sqlite3@12.11.1)(drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)))(mysql2@3.15.3))(ioredis@5.9.2)
+      unstorage: 1.17.4(aws4fetch@1.0.20)(db0@0.3.4(@electric-sql/pglite@0.5.11)(better-sqlite3@12.11.1)(drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)))(mysql2@3.15.3))(ioredis@5.9.2)
       untyped: 2.0.0
       unwasm: 0.5.3
       youch: 4.1.0-beta.13
@@ -35101,6 +35194,10 @@ snapshots:
     dependencies:
       openapi-typescript-helpers: 0.0.15
 
+  openapi-fetch@0.15.2:
+    dependencies:
+      openapi-typescript-helpers: 0.0.15
+
   openapi-typescript-helpers@0.0.15: {}
 
   optionator@0.9.4:
@@ -35798,17 +35895,17 @@ snapshots:
       - react-dom
     optional: true
 
-  prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3):
+  prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@7.0.2):
     dependencies:
       '@prisma/config': 7.9.0(magicast@0.5.2)
-      '@prisma/dev': 0.24.14(typescript@5.9.3)
+      '@prisma/dev': 0.24.14(typescript@7.0.2)
       '@prisma/engines': 7.9.0
       '@prisma/studio-core': 0.33.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)
       mysql2: 3.15.3
       postgres: 3.4.7
     optionalDependencies:
       better-sqlite3: 12.11.1
-      typescript: 5.9.3
+      typescript: 7.0.2
     transitivePeerDependencies:
       - '@types/react'
       - '@types/react-dom'
@@ -35817,17 +35914,17 @@ snapshots:
       - react-dom
     optional: true
 
-  prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@7.0.2):
+  prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3):
     dependencies:
       '@prisma/config': 7.9.0(magicast@0.5.2)
-      '@prisma/dev': 0.24.14(typescript@7.0.2)
+      '@prisma/dev': 0.24.14(typescript@5.9.3)
       '@prisma/engines': 7.9.0
       '@prisma/studio-core': 0.33.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)
       mysql2: 3.15.3
       postgres: 3.4.7
     optionalDependencies:
       better-sqlite3: 12.11.1
-      typescript: 7.0.2
+      typescript: 5.9.3
     transitivePeerDependencies:
       - '@types/react'
       - '@types/react-dom'
@@ -36488,6 +36585,17 @@ snapshots:
       '@redis/search': 1.2.0(@redis/client@1.6.1)
       '@redis/time-series': 1.1.0(@redis/client@1.6.1)
 
+  redis@5.12.1(@opentelemetry/api@1.9.1):
+    dependencies:
+      '@redis/bloom': 5.12.1(@redis/client@5.12.1(@opentelemetry/api@1.9.1))
+      '@redis/client': 5.12.1(@opentelemetry/api@1.9.1)
+      '@redis/json': 5.12.1(@redis/client@5.12.1(@opentelemetry/api@1.9.1))
+      '@redis/search': 5.12.1(@redis/client@5.12.1(@opentelemetry/api@1.9.1))
+      '@redis/time-series': 5.12.1(@redis/client@5.12.1(@opentelemetry/api@1.9.1))
+    transitivePeerDependencies:
+      - '@node-rs/xxhash'
+      - '@opentelemetry/api'
+
   reflect-metadata@0.2.2: {}
 
   regenerate-unicode-properties@10.2.2:
@@ -36578,7 +36686,7 @@ snapshots:
   remeda@2.33.4:
     optional: true
 
-  remix@3.0.0-rc.1(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(mysql2@3.15.3)(pg@8.23.1):
+  remix@3.0.0-rc.1(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)(mysql2@3.15.3)(pg@8.23.1)(redis@5.12.1(@opentelemetry/api@1.9.1)):
     dependencies:
       '@remix-run/assert': 0.3.0
       '@remix-run/assets': 0.6.0(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)
@@ -36619,7 +36727,7 @@ snapshots:
       '@remix-run/session': 0.4.2
       '@remix-run/session-middleware': 0.4.0
       '@remix-run/session-storage-memcache': 0.1.2
-      '@remix-run/session-storage-redis': 0.1.1
+      '@remix-run/session-storage-redis': 0.1.1(redis@5.12.1(@opentelemetry/api@1.9.1))
       '@remix-run/spa': 0.1.0(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.3)
       '@remix-run/static-middleware': 0.4.14
       '@remix-run/tar-parser': 0.7.1
@@ -36630,6 +36738,7 @@ snapshots:
     optionalDependencies:
       mysql2: 3.15.3
       pg: 8.23.1
+      redis: 5.12.1(@opentelemetry/api@1.9.1)
     transitivePeerDependencies:
       - '@emnapi/core'
       - '@emnapi/runtime'
@@ -38252,9 +38361,9 @@ snapshots:
     optionalDependencies:
       aws4fetch: 1.0.20
       db0: 0.3.4(@electric-sql/pglite@0.5.11)(better-sqlite3@12.11.1)(drizzle-orm@0.45.4(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.2.7))(@types/react@19.2.7)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)))(mysql2@3.15.3)
-      ioredis: 5.9.2(supports-color@7.2.0)
+      ioredis: 5.9.2
 
-  unstorage@1.17.4(aws4fetch@1.0.20)(db0@0.3.4(@electric-sql/pglite@0.5.11)(better-sqlite3@12.11.1)(drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)))(mysql2@3.15.3))(ioredis@5.9.2):
+  unstorage@1.17.4(aws4fetch@1.0.20)(db0@0.3.4(@electric-sql/pglite@0.5.11)(better-sqlite3@12.11.1)(drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)))(mysql2@3.15.3))(ioredis@5.9.2):
     dependencies:
       anymatch: 3.1.3
       chokidar: 5.0.0
@@ -38266,8 +38375,8 @@ snapshots:
       ufo: 1.6.3
     optionalDependencies:
       aws4fetch: 1.0.20
-      db0: 0.3.4(@electric-sql/pglite@0.5.11)(better-sqlite3@12.11.1)(drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.3.0))(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)))(mysql2@3.15.3)
-      ioredis: 5.9.2(supports-color@7.2.0)
+      db0: 0.3.4(@electric-sql/pglite@0.5.11)(better-sqlite3@12.11.1)(drizzle-orm@0.45.4(@cloudflare/workers-types@4.20260317.1)(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react@19.3.0)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)))(mysql2@3.15.3)
+      ioredis: 5.9.2
 
   unstorage@2.0.0-alpha.7(aws4fetch@1.0.20)(chokidar@5.0.0)(db0@0.3.4(@electric-sql/pglite@0.5.11)(better-sqlite3@12.11.1)(drizzle-orm@0.45.4(@electric-sql/pglite@0.5.11)(@opentelemetry/api@1.9.1)(@prisma/client@7.9.0(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.2.18))(@types/react@19.2.18)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3))(typescript@5.9.3))(@types/pg@8.23.1)(better-sqlite3@12.11.1)(bun-types@1.3.14)(mysql2@3.15.3)(pg@8.23.1)(postgres@3.4.7)(prisma@7.9.0(@types/react-dom@19.2.3(@types/react@19.2.18))(@types/react@19.2.18)(better-sqlite3@12.11.1)(magicast@0.5.2)(react-dom@19.2.3(react@19.2.3))(react@19.2.3)(typescript@5.9.3)))(mysql2@3.15.3))(lru-cache@11.5.3)(ofetch@2.0.0-alpha.3):
     optionalDependencies:
@@ -38574,24 +38683,6 @@ snapshots:
       tsx: 4.23.12
       yaml: 2.9.0
 
-  vite@8.3.0(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.97.3)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0):
-    dependencies:
-      lightningcss: 1.33.0
-      picomatch: 4.0.7
-      postcss: 8.5.28
-      rolldown: 1.2.9
-      tinyglobby: 0.2.17
-    optionalDependencies:
-      '@types/node': 24.10.3
-      esbuild: 0.28.1
-      fsevents: 2.3.3
-      jiti: 2.7.0
-      less: 4.6.6
-      sass: 1.97.3
-      terser: 5.44.1
-      tsx: 4.23.12
-      yaml: 2.9.0
-
   vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0):
     dependencies:
       lightningcss: 1.33.0
@@ -38680,37 +38771,6 @@ snapshots:
     transitivePeerDependencies:
       - msw
 
-  vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.10.3)(@vitest/coverage-v8@4.1.10)(happy-dom@20.11.2)(jsdom@27.4.0(@noble/hashes@2.3.0))(vite@8.3.0(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.97.3)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0)):
-    dependencies:
-      '@vitest/expect': 4.1.10
-      '@vitest/mocker': 4.1.10(vite@8.3.0(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.97.3)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0))
-      '@vitest/pretty-format': 4.1.10
-      '@vitest/runner': 4.1.10
-      '@vitest/snapshot': 4.1.10
-      '@vitest/spy': 4.1.10
-      '@vitest/utils': 4.1.10
-      es-module-lexer: 2.0.0
-      expect-type: 1.3.0
-      magic-string: 0.30.21
-      obug: 2.1.1
-      pathe: 2.0.3
-      picomatch: 4.0.5
-      std-env: 4.0.0
-      tinybench: 2.9.0
-      tinyexec: 1.1.1
-      tinyglobby: 0.2.17
-      tinyrainbow: 3.1.0
-      vite: 8.3.0(@types/node@24.10.3)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.97.3)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0)
-      why-is-node-running: 2.3.0
-    optionalDependencies:
-      '@opentelemetry/api': 1.9.1
-      '@types/node': 24.10.3
-      '@vitest/coverage-v8': 4.1.10(vitest@4.1.10)
-      happy-dom: 20.11.2
-      jsdom: 27.4.0(@noble/hashes@2.3.0)
-    transitivePeerDependencies:
-      - msw
-
   vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.10.3)(@vitest/coverage-v8@4.1.10)(happy-dom@20.11.2)(jsdom@27.4.0(@noble/hashes@2.3.0))(vite@8.3.0(@types/node@24.13.6)(esbuild@0.28.1)(jiti@2.7.0)(less@4.6.6)(sass@1.101.0)(terser@5.44.1)(tsx@4.23.12)(yaml@2.9.0)):
     dependencies:
       '@vitest/expect': 4.1.10
diff --git a/testing/e2e/tests/sandbox-render-startup-cancellation.spec.ts b/testing/e2e/tests/sandbox-render-startup-cancellation.spec.ts
new file mode 100644
index 0000000000..09317cd883
--- /dev/null
+++ b/testing/e2e/tests/sandbox-render-startup-cancellation.spec.ts
@@ -0,0 +1,86 @@
+import { spawnSync } from 'node:child_process'
+import { expect, test } from '@playwright/test'
+
+test('render create cleans up an aborted startup in the built package', () => {
+  const result = spawnSync(
+    process.execPath,
+    [
+      '--input-type=module',
+      '--eval',
+      `
+        import assert from 'node:assert/strict'
+        import { renderSandbox } from './packages/ai-sandbox-render/dist/esm/index.js'
+
+        const controller = new AbortController()
+        const reason = new Error('startup cancelled')
+        const terminated = []
+        const client = {
+          create: async () => {
+            controller.abort(reason)
+            return { id: 'sbx-1' }
+          },
+          terminate: async (id) => {
+            terminated.push(id)
+          },
+        }
+        const result = renderSandbox({ client }).create({ signal: controller.signal })
+        await assert.rejects(result, (error) => error === reason)
+        assert.deepEqual(terminated, ['sbx-1'])
+        console.log('create cancelled; sandbox terminated')
+      `,
+    ],
+    {
+      cwd: new URL('../../../', import.meta.url),
+      encoding: 'utf8',
+      timeout: 20_000,
+    },
+  )
+
+  expect(result.error).toBeUndefined()
+  expect(result.status, result.stderr).toBe(0)
+  expect(result.stdout).toContain('create cancelled; sandbox terminated')
+})
+
+test('render reconnect replaces old secrets in the built package', () => {
+  const result = spawnSync(
+    process.execPath,
+    [
+      '--input-type=module',
+      '--eval',
+      `
+        import assert from 'node:assert/strict'
+        import { renderSandbox } from './packages/ai-sandbox-render/dist/esm/index.js'
+
+        const files = new Map()
+        const commands = []
+        const client = {
+          get: async () => ({ status: 'running' }),
+          upload: async (_id, path, data) => files.set(path, String(data)),
+          exec: async function* (_id, command) {
+            commands.push(command)
+            yield { type: 'exit', exit_code: 0 }
+          },
+        }
+        const provider = renderSandbox({ client })
+        const first = await provider.resume({ id: 'sbx-1' })
+        await first.env.set({ SECRET: 'old-canary' })
+        const second = await provider.resume({ id: 'sbx-1' })
+        await second.env.set({ SECRET: 'new-canary' })
+        assert.equal(files.size, 1)
+        assert(![...files.values()].join('').includes('old-canary'))
+        assert([...files.values()].join('').includes('new-canary'))
+        assert(!commands.join('').includes('canary'))
+        console.log('reconnect replaced the old secret without logging either value')
+      `,
+    ],
+    {
+      cwd: new URL('../../../', import.meta.url),
+      encoding: 'utf8',
+      timeout: 20_000,
+    },
+  )
+
+  expect(result.error).toBeUndefined()
+  expect(result.status, result.stderr).toBe(0)
+  expect(result.stdout).toContain('reconnect replaced the old secret')
+})