The composition-root record: the handles plus the shared HTTP manager and the metadata cache, from which the whole effectful shell is reached. See the module header for the no-SDK and sole-composition-root invariants it upholds.

Assemble an Env from its constructed handles, an explicit process-wide serve admission handle, and the two data-plane HTTP Managers (one per origin: the untrusted public/artifact fetches and the trusted private upstream, both the validating TLS manager). The executable passes the admission handle sized from its configured bound.

The Managers, MetadataCache, LogEnv, and Telemetry handle are taken as arguments rather than built here: a Manager owns a connection pool whose lifetime should be bracketed by the caller that also owns teardown (see withEnvWithAdmission), and injecting them keeps Env assembly pure of network, logging, and telemetry setup, so it can be exercised in tests against in-memory handle doubles with no sockets opened, no scribe attached to stdout, and no exporter initialised. Backend selection happens in the handle smart constructors that produce the arguments; this only gathers them.

Assemble an Env carrying an explicit serve admission handle and run an action within its scope: the scope the server and worker run in. The composition root borrows every resource it holds (the Managers, the Telemetry providers); each is owned and torn down by the caller that supplied it, so this root has nothing of its own to release and needs no teardown bracket.

Project the request runtime (Ecluse.Core.Server.Context.ServeRuntime) the serve path is closed over from the composition root: the two data-plane managers, the metadata cache and mirror queue, and the OpenTelemetry-backed metric and tracing ports (metricsPortOf, tracingPortOf). Built at dispatch per request -- it gathers existing handles and wraps the instrument and telemetry handles in their ports -- so the core pipeline reads its backends through the core interface without depending on this application Env.

Project the worker runtime (Ecluse.Core.Worker.WorkerRuntime) the mirror worker is closed over from the composition root: the mirror queue, the untrusted data-plane manager, the consume-loop heartbeat, and the OpenTelemetry-backed worker metric and tracing ports (workerMetricsPortOf, workerTracingPortOf). Built at the worker entry point -- it gathers existing handles and wraps the instrument and telemetry handles in their worker ports -- so the core loop reads its backends through the core interface without depending on this application Env (the analogue of serveRuntimeOf for the serve path).

The per-ecosystem bundles are passed in rather than read from the Env: they are derived from the served mounts and the resolved publish targets (the same prepared rules, artifact request formation, and public origin the serve path gates with, plus each mount's married mirror-write capability), which the composition root resolves alongside the handles (workerPoliciesFor), so the worker re-runs current policy against a job before mirroring it through one codepath with the serve gate, and publishes through the job ecosystem's own bundle.