diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 74087e691..bf87a7b42 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -25,6 +25,14 @@ independent blind review using only requirements, acceptance criteria, boundarie
 repository path and comparison baseline. Fix in-scope blockers before delivery.
 Do not use `codex exec` as a substitute reviewer.
 
+The Core Web is an administrator console for execution and resource operations;
+business collaboration remains in Parsar. Environment Template management shares
+the Session creation catalog and uses the existing public client operations. Patch
+only edited fields, confirm deletion, and never automatically retry an uncertain
+write. A Core connection change must discard the previous connection's forms,
+pending results and notices. Saving a Template must not allocate a Runtime, call a
+model or imply execution readiness. Keep unsupported advanced profiles explicit.
+
 For subsequent alignment and milestone closure batches, the main thread coordinates
 design, shared interface agreements, file ownership, integration and merge. First
 reconcile main and the boards, then list remaining mandatory milestone work,
diff --git a/apps/web/e2e/environment-templates.spec.ts b/apps/web/e2e/environment-templates.spec.ts
new file mode 100644
index 000000000..d56661715
--- /dev/null
+++ b/apps/web/e2e/environment-templates.spec.ts
@@ -0,0 +1,314 @@
+import { expect, test, type APIRequestContext, type Page } from "@playwright/test";
+
+const fixtureBaseUrl = `http://127.0.0.1:${process.env.AGENTS_FIXTURE_PORT ?? 18092}`;
+const collectionPath = "/v1/agents/environments/templates";
+const beta = { "OpenAI-Beta": "agents=v1" };
+
+interface Template {
+  id: string;
+  name: string | null;
+  network: { access: "enabled" | "disabled"; allowed_domains: string[] };
+  created_at: number;
+  updated_at: number;
+}
+
+interface RecordedRequest {
+  method: string;
+  path: string;
+  query: string;
+  beta: string | null;
+  body?: Record<string, unknown>;
+}
+
+async function control(request: APIRequestContext, values: Record<string, unknown>) {
+  expect((await request.post(`${fixtureBaseUrl}/__fixture/control`, { data: values })).ok()).toBe(true);
+}
+
+async function requests(request: APIRequestContext): Promise<RecordedRequest[]> {
+  return (await request.get(`${fixtureBaseUrl}/__fixture/requests`)).json();
+}
+
+async function seed(request: APIRequestContext, name: string, access: "enabled" | "disabled" = "enabled"): Promise<Template> {
+  const response = await request.post(`${fixtureBaseUrl}${collectionPath}`, { headers: beta, data: { name, network: { access } } });
+  expect(response.status()).toBe(201);
+  return response.json();
+}
+
+async function retrieve(request: APIRequestContext, id: string): Promise<Template> {
+  const response = await request.get(`${fixtureBaseUrl}${collectionPath}/${id}`, { headers: beta });
+  expect(response.ok()).toBe(true);
+  return response.json();
+}
+
+async function openTemplates(page: Page) {
+  await page.goto("/#templates");
+  await expect(page.getByRole("heading", { name: "Environment Templates", exact: true })).toBeVisible();
+}
+
+function manager(page: Page) {
+  return page.locator(".templates-page");
+}
+
+async function openSessionSelector(page: Page) {
+  await page.getByRole("button", { name: "Agents", exact: true }).click();
+  await page.getByRole("button", { name: /^Start a Session with Second Agent/ }).click();
+  const dialog = page.getByRole("dialog", { name: "Create a Session", exact: true });
+  await dialog.getByRole("radio", { name: /Managed hosted/ }).check();
+  return dialog.getByLabel("Reusable Environment Template");
+}
+
+test.beforeEach(async ({ request }) => {
+  expect((await request.post(`${fixtureBaseUrl}/__fixture/reset`)).ok()).toBe(true);
+});
+
+test.afterEach(async ({ request }) => {
+  const entries = await requests(request);
+  expect(entries.filter((entry) => entry.method !== "GET" && (
+    entry.path.startsWith("/v1/agents/sessions") ||
+    (entry.path.startsWith("/v1/agents/environments") && !entry.path.startsWith(collectionPath)) ||
+    entry.path.startsWith("/api/v1/agent-daemon")
+  ))).toEqual([]);
+  expect(entries.filter((entry) => entry.path.startsWith(collectionPath)).every((entry) => entry.beta === "agents=v1")).toBe(true);
+  const state = await (await request.get(`${fixtureBaseUrl}/__fixture/state`)).json();
+  expect(state.sessions.map((session: { id: string }) => session.id)).toEqual(["session_snapshot"]);
+});
+
+test("opens Templates by navigation and hash, with an explicit empty catalog", async ({ page }) => {
+  await page.goto("/");
+  await page.getByRole("button", { name: "Templates", exact: true }).click();
+  await expect(page).toHaveURL(/#templates$/u);
+  await expect(manager(page).getByRole("heading", { name: "No Environment Templates yet" })).toBeVisible();
+  await expect(manager(page).getByRole("button", { name: "New Template", exact: true })).toBeEnabled();
+  await page.reload();
+  await expect(page.getByRole("button", { name: "Templates", exact: true })).toHaveAttribute("aria-current", "page");
+  await expect(manager(page).getByRole("heading", { name: "Environment Templates", exact: true })).toBeVisible();
+});
+
+test("loads every Template page and keeps pagination cursors distinct", async ({ page, request }) => {
+  const templates = await Promise.all(["First profile", "Second profile", "Third profile"].map((name) => seed(request, name)));
+  await control(request, { environmentTemplatePageSize: 2 });
+  await openTemplates(page);
+  for (const template of templates) await expect(manager(page).getByRole("heading", { name: template.name!, exact: true })).toBeVisible();
+  await expect(manager(page)).toContainText("3 of 3 Templates");
+  const reads = (await requests(request)).filter((entry) => entry.method === "GET" && entry.path === collectionPath);
+  expect(reads.some((entry) => new URLSearchParams(entry.query).has("after"))).toBe(true);
+  expect(new Set(reads.map((entry) => entry.query)).size).toBeGreaterThanOrEqual(2);
+  await manager(page).getByRole("searchbox", { name: "Filter Templates" }).fill("Third profile");
+  await expect(manager(page)).toContainText("1 of 3 Templates");
+  await expect(manager(page).getByRole("heading", { name: "First profile", exact: true })).toHaveCount(0);
+});
+
+for (const status of [400, 404, 405, 501, 503]) {
+  test(`distinguishes unavailable Template catalog (${status}) from an empty catalog`, async ({ page, request }) => {
+    await control(request, { environmentTemplateListStatus: status });
+    await openTemplates(page);
+    await expect(manager(page).getByText(
+      status === 503 ? "Environment Templates could not be loaded" : "Environment Templates are not available",
+      { exact: true },
+    )).toBeVisible();
+    await expect(manager(page).getByRole("heading", { name: "No Environment Templates yet" })).toHaveCount(0);
+    await expect(manager(page).getByRole("button", { name: "New Template", exact: true })).toBeDisabled();
+    await control(request, { environmentTemplateListStatus: 200 });
+    await manager(page).getByRole("button", { name: "Refresh", exact: true }).click();
+    await expect(manager(page).getByRole("heading", { name: "No Environment Templates yet" })).toBeVisible();
+  });
+}
+
+test("creates and edits basic Templates with minimal patches, then refreshes the Session selector", async ({ page, request }) => {
+  await openTemplates(page);
+  await manager(page).getByRole("button", { name: "New Template", exact: true }).click();
+  let dialog = page.getByRole("dialog", { name: "Create Template", exact: true });
+  await dialog.getByRole("textbox", { name: /^Name/ }).fill("Outbound disabled");
+  await dialog.getByLabel("Network access", { exact: true }).selectOption("disabled");
+  const beforeCreate = (await requests(request)).filter((entry) => entry.method === "GET" && entry.path === collectionPath).length;
+  await dialog.getByRole("button", { name: "Create Template", exact: true }).click();
+  await expect(dialog).toHaveCount(0);
+  await expect(manager(page).getByRole("heading", { name: "Outbound disabled", exact: true })).toBeVisible();
+  const writes = (await requests(request)).filter((entry) => entry.method === "POST" && entry.path === collectionPath);
+  expect(writes).toHaveLength(1);
+  expect(writes[0]!.body).toEqual({ name: "Outbound disabled", network: { access: "disabled" } });
+  const list = await (await request.get(`${fixtureBaseUrl}${collectionPath}`, { headers: beta })).json();
+  const original = list.data[0] as Template;
+  expect((await requests(request)).filter((entry) => entry.method === "GET" && entry.path === collectionPath).length).toBeGreaterThan(beforeCreate + 1);
+
+  await manager(page).getByRole("button", { name: "Edit Outbound disabled", exact: true }).click();
+  dialog = page.getByRole("dialog", { name: "Edit Template", exact: true });
+  await dialog.getByRole("textbox", { name: /^Name/ }).fill("Reusable sandbox");
+  await dialog.getByRole("button", { name: "Save changes", exact: true }).click();
+  await expect(dialog).toHaveCount(0);
+  let updates = (await requests(request)).filter((entry) => entry.method === "POST" && entry.path === `${collectionPath}/${original.id}`);
+  expect(updates.map((entry) => entry.body)).toEqual([{ name: "Reusable sandbox" }]);
+  const renamed = await retrieve(request, original.id);
+  expect({ ...renamed, name: original.name, updated_at: original.updated_at }).toEqual(original);
+
+  await manager(page).getByRole("button", { name: "Edit Reusable sandbox", exact: true }).click();
+  dialog = page.getByRole("dialog", { name: "Edit Template", exact: true });
+  await dialog.getByLabel("Network access", { exact: true }).selectOption("enabled");
+  await dialog.getByRole("button", { name: "Save changes", exact: true }).click();
+  await expect(dialog).toHaveCount(0);
+  updates = (await requests(request)).filter((entry) => entry.method === "POST" && entry.path === `${collectionPath}/${original.id}`);
+  expect(updates.at(-1)!.body).toEqual({ network: { access: "enabled" } });
+  const changed = await retrieve(request, original.id);
+  expect({ ...changed, network: renamed.network, updated_at: renamed.updated_at }).toEqual(renamed);
+
+  const selector = await openSessionSelector(page);
+  await expect(selector.locator(`option[value="${original.id}"]`)).toHaveText("Reusable sandbox · network enabled");
+  await page.keyboard.press("Escape");
+});
+
+test("confirms deletion, preserves a failed delete, and removes the selected catalog entry after success", async ({ page, request }) => {
+  const template = await seed(request, "Delete candidate");
+  await openTemplates(page);
+  await manager(page).getByRole("button", { name: "Delete Delete candidate", exact: true }).click();
+  let dialog = page.getByRole("dialog", { name: "Delete Template?", exact: true });
+  await expect(dialog).toContainText("Existing Sessions keep their configuration");
+  await dialog.getByRole("button", { name: "Cancel", exact: true }).click();
+  expect((await requests(request)).filter((entry) => entry.method === "DELETE")).toEqual([]);
+
+  await control(request, { environmentTemplateDeleteStatus: 503 });
+  await manager(page).getByRole("button", { name: "Delete Delete candidate", exact: true }).click();
+  dialog = page.getByRole("dialog", { name: "Delete Template?", exact: true });
+  await dialog.getByRole("button", { name: "Delete Template", exact: true }).click();
+  await expect(manager(page).getByRole("alert")).toContainText("not confirmed");
+  expect((await retrieve(request, template.id)).name).toBe("Delete candidate");
+  expect((await requests(request)).filter((entry) => entry.method === "DELETE")).toHaveLength(1);
+  await manager(page).getByRole("button", { name: "Refresh", exact: true }).click();
+  await expect(manager(page).getByRole("button", { name: "Delete Delete candidate", exact: true })).toBeEnabled();
+  await manager(page).getByRole("button", { name: "Delete Delete candidate", exact: true }).click();
+  await page.getByRole("dialog", { name: "Delete Template?", exact: true }).getByRole("button", { name: "Delete Template", exact: true }).click();
+  await expect(manager(page).getByRole("heading", { name: "No Environment Templates yet" })).toBeVisible();
+  const selector = await openSessionSelector(page);
+  await expect(selector.locator(`option[value="${template.id}"]`)).toHaveCount(0);
+  await expect(selector).toBeDisabled();
+  await page.keyboard.press("Escape");
+});
+
+test("rejects advanced Template responses without offering destructive basic edits", async ({ page, request }) => {
+  await seed(request, "Advanced profile");
+  await page.route(`**${collectionPath}?*`, async (route) => {
+    const response = await route.fetch();
+    const value = await response.json();
+    value.data[0].packages.npm = ["private-package"];
+    await route.fulfill({ response, json: value });
+  });
+  await openTemplates(page);
+  await expect(manager(page).getByText("Environment Templates could not be loaded", { exact: true })).toBeVisible();
+  await expect(manager(page).getByRole("button", { name: "Edit Advanced profile", exact: true })).toHaveCount(0);
+  await expect(manager(page).getByRole("button", { name: "New Template", exact: true })).toBeDisabled();
+});
+
+for (const operation of ["create", "update"] as const) {
+  test(`does not replay a failed Template ${operation} or silently change the catalog`, async ({ page, request }) => {
+    const template = operation === "update" ? await seed(request, "Original name", "disabled") : null;
+    await control(request, { [operation === "create" ? "environmentTemplateCreateStatus" : "environmentTemplateUpdateStatus"]: 503 });
+    await openTemplates(page);
+    await manager(page).getByRole("button", { name: template ? "Edit Original name" : "New Template", exact: true }).click();
+    const dialog = page.getByRole("dialog", { name: template ? "Edit Template" : "Create Template", exact: true });
+    await dialog.getByRole("textbox", { name: /^Name/ }).fill("Rejected name");
+    await dialog.getByRole("button", { name: template ? "Save changes" : "Create Template", exact: true }).click();
+    await expect(manager(page).getByRole("alert")).toContainText("not confirmed");
+    await expect(manager(page).getByRole("button", { name: "New Template", exact: true })).toBeDisabled();
+    const path = template ? `${collectionPath}/${template.id}` : collectionPath;
+    expect((await requests(request)).filter((entry) => entry.method === "POST" && entry.path === path)).toHaveLength(1);
+    if (template) expect(await retrieve(request, template.id)).toEqual(template);
+    await manager(page).getByRole("button", { name: "Refresh", exact: true }).click();
+    await expect(manager(page).getByRole("button", { name: "New Template", exact: true })).toBeEnabled();
+    await expect(manager(page).getByRole("heading", { name: "Rejected name", exact: true })).toHaveCount(0);
+  });
+}
+
+for (const operation of ["read", "write"] as const) {
+  test(`fences a late Template ${operation} after switching Core connections`, async ({ page, request }) => {
+    const original = await seed(request, "Old connection Template");
+    await page.addInitScript(({ original, operation, collectionPath }) => {
+      const target = window as Window & {
+        holdTemplateResponse?: boolean;
+        releaseTemplateResponse?: () => void;
+        newTemplateReads?: number;
+      };
+      const originalFetch = window.fetch.bind(window);
+      target.holdTemplateResponse = false;
+      target.newTemplateReads = 0;
+      const json = (body: unknown) => new Response(JSON.stringify(body), { status: 200, headers: { "Content-Type": "application/json" } });
+      const list = (template: typeof original) => ({ object: "list", data: [template], has_more: false, first_id: template.id, last_id: template.id });
+      window.fetch = (input, init) => {
+        const url = new URL(typeof input === "string" ? input : input instanceof URL ? input.href : input.url, location.href);
+        const method = init?.method ?? "GET";
+        if (new Headers(init?.headers).get("Authorization") === "Bearer replacement-token" && url.pathname === collectionPath) {
+          target.newTemplateReads = (target.newTemplateReads ?? 0) + 1;
+          return Promise.resolve(json(list({ ...original, id: "49999999-1111-4111-8111-111111111111", name: "New connection Template" })));
+        }
+        if (target.holdTemplateResponse && (
+          operation === "read" ? url.pathname === collectionPath && method === "GET" : url.pathname === `${collectionPath}/${original.id}` && method === "POST"
+        )) {
+          target.holdTemplateResponse = false;
+          // Deliberately ignore abort: fencing must also handle a response that
+          // was already accepted by the remote service before cancellation.
+          return new Promise<Response>((resolve) => {
+            target.releaseTemplateResponse = () => resolve(json(operation === "read" ? list(original) : { ...original, name: "Late old name" }));
+          });
+        }
+        return originalFetch(input, init);
+      };
+    }, { original, operation, collectionPath });
+    await openTemplates(page);
+    await expect(manager(page).getByRole("heading", { name: original.name!, exact: true })).toBeVisible();
+    await page.evaluate(() => { (window as Window & { holdTemplateResponse?: boolean }).holdTemplateResponse = true; });
+    if (operation === "read") {
+      await manager(page).getByRole("button", { name: "Refresh", exact: true }).click();
+    } else {
+      await manager(page).getByRole("button", { name: `Edit ${original.name}`, exact: true }).click();
+      const dialog = page.getByRole("dialog", { name: "Edit Template", exact: true });
+      await dialog.getByRole("textbox", { name: /^Name/ }).fill("Late old name");
+      await dialog.getByRole("button", { name: "Save changes", exact: true }).click();
+    }
+    await expect.poll(() => page.evaluate(() => typeof (window as Window & { releaseTemplateResponse?: () => void }).releaseTemplateResponse)).toBe("function");
+    // Changing the hash is the same navigation available in the address bar;
+    // it lets an in-flight write finish after its owning page has unmounted.
+    await page.evaluate(() => { location.hash = "system"; });
+    await expect(page.getByRole("dialog", { name: "Edit Template", exact: true })).toHaveCount(0);
+    await page.getByRole("button", { name: "Configure Agent Core connection", exact: true }).click();
+    const connection = page.getByRole("dialog", { name: "Connect an Agent Core", exact: true });
+    await connection.getByRole("radio", { name: /Other compatible Core/ }).check();
+    await connection.getByLabel("Compatible Core base URL").fill(`${new URL(page.url()).origin}/v1`);
+    await connection.getByLabel("Bearer token").fill("replacement-token");
+    await connection.getByRole("button", { name: "Apply connection", exact: true }).click();
+    await page.getByRole("button", { name: "Templates", exact: true }).click();
+    await expect(manager(page).getByRole("heading", { name: "New connection Template", exact: true })).toBeVisible();
+    const before = await page.evaluate(() => (window as Window & { newTemplateReads?: number }).newTemplateReads);
+    await page.evaluate(async () => {
+      (window as Window & { releaseTemplateResponse?: () => void }).releaseTemplateResponse?.();
+      await new Promise<void>((resolve) => setTimeout(resolve, 0));
+    });
+    await expect(manager(page).getByRole("heading", { name: "New connection Template", exact: true })).toBeVisible();
+    await expect(manager(page)).not.toContainText("Late old name");
+    await expect(manager(page)).not.toContainText("Old connection Template");
+    expect(await page.evaluate(() => (window as Window & { newTemplateReads?: number }).newTemplateReads)).toBe(before);
+  });
+}
+
+test("keeps the Template modal keyboard-contained and usable at narrow widths", async ({ page }) => {
+  await page.setViewportSize({ width: 390, height: 844 });
+  await openTemplates(page);
+  const trigger = manager(page).getByRole("button", { name: "New Template", exact: true });
+  await trigger.click();
+  const dialog = page.getByRole("dialog", { name: "Create Template", exact: true });
+  await expect(dialog.getByRole("textbox", { name: /^Name/ })).toBeFocused();
+  await dialog.getByRole("button", { name: "Close dialog", exact: true }).focus();
+  await page.keyboard.press("Shift+Tab");
+  await expect(dialog.getByRole("button", { name: "Create Template", exact: true })).toBeFocused();
+  await page.keyboard.press("Tab");
+  await expect(dialog.getByRole("button", { name: "Close dialog", exact: true })).toBeFocused();
+  const sizes = await dialog.evaluate((element) => ({
+    viewport: innerWidth,
+    document: document.documentElement.scrollWidth,
+    left: element.getBoundingClientRect().left,
+    right: element.getBoundingClientRect().right,
+  }));
+  expect(sizes.document).toBeLessThanOrEqual(sizes.viewport);
+  expect(sizes.left).toBeGreaterThanOrEqual(0);
+  expect(sizes.right).toBeLessThanOrEqual(sizes.viewport);
+  await page.keyboard.press("Escape");
+  await expect(dialog).toHaveCount(0);
+  await expect(trigger).toBeFocused();
+});
diff --git a/apps/web/e2e/fixture-core.mjs b/apps/web/e2e/fixture-core.mjs
index 98c1d0a8b..127487337 100644
--- a/apps/web/e2e/fixture-core.mjs
+++ b/apps/web/e2e/fixture-core.mjs
@@ -383,6 +383,7 @@ function initialState() {
     sourceFiles: new Map(),
     hostedWorkspaceFiles: [],
     environmentTemplates: [],
+    environmentTemplateSequence: 0,
     sessionCreateReceipts: new Map(),
     controls: {
       createAgentResponseVariant: "valid",
@@ -415,7 +416,15 @@ function initialState() {
       environmentFileCreateStatus: 200,
       environmentFileCreateResponseLoss: 0,
       environmentTemplateListStatus: 200,
+      environmentTemplateListDelayMs: 0,
+      environmentTemplatePageSize: 100,
       environmentTemplateCreateStatus: 200,
+      environmentTemplateRetrieveStatus: 200,
+      environmentTemplateRetrieveDelayMs: 0,
+      environmentTemplateUpdateStatus: 200,
+      environmentTemplateUpdateDelayMs: 0,
+      environmentTemplateDeleteStatus: 200,
+      environmentTemplateDeleteDelayMs: 0,
       environmentResourceStatus: "pending",
       environmentResourceVariant: "valid",
       environmentEventStatus: 0,
@@ -1348,13 +1357,22 @@ const server = http.createServer(async (request, response) => {
           return sendError(response, 400, "Fixture Environment Template query is invalid.");
         }
         const templates = [...state.environmentTemplates]
-          .sort((left, right) => left.created_at - right.created_at);
+          .sort((left, right) => left.created_at - right.created_at || left.id.localeCompare(right.id));
         if (order === "desc") templates.reverse();
-        const page = templates.slice(0, limit);
+        const after = url.searchParams.get("after");
+        const before = url.searchParams.get("before");
+        const start = after ? templates.findIndex((template) => template.id === after) + 1 : 0;
+        const end = before ? templates.findIndex((template) => template.id === before) : templates.length;
+        if ((after && start === 0) || end < 0) return sendError(response, 404, "Fixture Template cursor not found.");
+        const page = templates.slice(start, Math.min(end, start + Math.min(limit, state.controls.environmentTemplatePageSize)));
+        const delayMs = state.controls.environmentTemplateListDelayMs;
+        state.controls.environmentTemplateListDelayMs = 0;
+        if (delayMs) await wait(delayMs);
+        if (response.destroyed) return;
         return sendJson(response, {
           object: "list",
           data: page,
-          has_more: page.length < templates.length,
+          has_more: start + page.length < end,
           first_id: page[0]?.id ?? null,
           last_id: page.at(-1)?.id ?? null,
         });
@@ -1379,7 +1397,7 @@ const server = http.createServer(async (request, response) => {
         if (body.name !== undefined && body.name !== null && typeof body.name !== "string") {
           return sendError(response, 400, "Fixture Environment Template name is invalid.");
         }
-        const index = state.environmentTemplates.length + 1;
+        const index = ++state.environmentTemplateSequence;
         const created = Math.floor(Date.now() / 1000);
         const template = {
           id: `4${String(index).padStart(7, "0")}-1111-4111-8111-111111111111`,
@@ -1400,6 +1418,38 @@ const server = http.createServer(async (request, response) => {
       return sendError(response, 405, "This API method is not supported.", "unsupported_operation");
     }
 
+    const templateMatch = url.pathname.match(/^\/v1\/agents\/environments\/templates\/([^/]+)$/u);
+    if (templateMatch) {
+      if (request.headers["openai-beta"] !== "agents=v1") {
+        return sendError(response, 400, "Fixture Environment Templates require the Agents beta header.");
+      }
+      const template = state.environmentTemplates.find((entry) => entry.id === decodeURIComponent(templateMatch[1]));
+      if (!template) return sendError(response, 404, "Fixture Environment Template not found.");
+      const operation = { GET: "Retrieve", POST: "Update", DELETE: "Delete" }[request.method];
+      if (!operation) return sendError(response, 405, "This API method is not supported.", "unsupported_operation");
+      const control = consumeControl(`environmentTemplate${operation}`);
+      if (control.delayMs) await wait(control.delayMs);
+      if (response.destroyed) return;
+      if (control.status !== 200) return sendError(response, control.status, `Fixture Environment Template ${operation.toLowerCase()} failed.`);
+      if (request.method === "GET") return sendJson(response, template);
+      if (request.method === "DELETE") {
+        state.environmentTemplates = state.environmentTemplates.filter((entry) => entry.id !== template.id);
+        return sendJson(response, { id: template.id, object: "agent.environment.template.deleted", deleted: true });
+      }
+      if (!isRecord(body) || !hasOnlyKeys(body, ["name", "network"]) ||
+        (body.name !== undefined && body.name !== null && typeof body.name !== "string")) {
+        return sendError(response, 400, "Fixture Environment Template patch is invalid.");
+      }
+      if (body.network !== undefined && body.network !== null &&
+        (!isRecord(body.network) || !hasOnlyKeys(body.network, ["access"]) || !["enabled", "disabled"].includes(body.network.access))) {
+        return sendError(response, 400, "Fixture Environment Template network is unsupported.");
+      }
+      if (Object.hasOwn(body, "name")) template.name = body.name;
+      if (Object.hasOwn(body, "network")) template.network = { access: body.network?.access ?? "enabled", allowed_domains: [] };
+      template.updated_at = Math.max(template.updated_at + 1, Math.floor(Date.now() / 1000));
+      return sendJson(response, template);
+    }
+
     const environmentFilesMatch = url.pathname.match(/^\/v1\/agents\/environments\/([^/]+)\/files$/);
     if (request.method === "POST" && environmentFilesMatch) {
       const id = decodeURIComponent(environmentFilesMatch[1]);
diff --git a/apps/web/src/App.tsx b/apps/web/src/App.tsx
index cc0f0482c..4b0e787d6 100644
--- a/apps/web/src/App.tsx
+++ b/apps/web/src/App.tsx
@@ -34,6 +34,7 @@ import {
   requestAgentUpdate,
 } from "./features/agents/agent-actions";
 import { DashboardView } from "./features/dashboard/DashboardView";
+import { EnvironmentTemplatesView } from "./features/environment-templates/EnvironmentTemplatesView";
 import {
   SessionsView,
   type SessionDetailState,
@@ -131,6 +132,7 @@ type View = ProductView | "system";
 function viewFromLocation(): View {
   if (typeof window === "undefined") return "dashboard";
   const candidate = window.location.hash.slice(1);
+  if (candidate === "templates" && __AGENTS_CORE_WEB_OPENAI_HOSTED_SESSIONS__) return "templates";
   return candidate === "agents" || candidate === "sessions" || candidate === "vaults" || candidate === "system"
     ? candidate
     : "dashboard";
@@ -2115,6 +2117,7 @@ export function App() {
           active={view === "system" ? null : view}
           onSelect={(nextView) => setView(nextView)}
           showVaults={vaultSupported === true}
+          showTemplates={__AGENTS_CORE_WEB_OPENAI_HOSTED_SESSIONS__}
         />
 
         <nav className="main-nav" aria-label="System navigation">
@@ -2162,6 +2165,15 @@ export function App() {
           />
         </header>
         <div className="page-transition" key={view}>
+          {view === "templates" ? (
+            <EnvironmentTemplatesView
+              key={`templates:${coreGeneration}`}
+              catalog={environmentTemplates}
+              operations={core}
+              onRefresh={refreshEnvironmentTemplates}
+              onConfigureConnection={() => setConnectionOpen(true)}
+            />
+          ) : null}
           {view === "dashboard" ? (
             <DashboardView
               agents={agents}
diff --git a/apps/web/src/components/ProductNavigation.test.tsx b/apps/web/src/components/ProductNavigation.test.tsx
index 75029bc9d..6ed7d167e 100644
--- a/apps/web/src/components/ProductNavigation.test.tsx
+++ b/apps/web/src/components/ProductNavigation.test.tsx
@@ -17,6 +17,7 @@ describe("Product navigation", () => {
     expect(html).toContain("Sessions");
     expect(html).not.toContain("Vaults");
     expect(html).not.toContain("Environments");
+    expect(html).not.toContain("Templates");
     expect(html).toContain('aria-current="page"');
   });
 
@@ -28,4 +29,12 @@ describe("Product navigation", () => {
     expect(html).toContain("Vaults");
     expect(html).toContain('aria-current="page"');
   });
+
+  it("exposes Templates in managed Environment builds", () => {
+    const html = renderToStaticMarkup(
+      <ProductNavigation active="templates" showTemplates onSelect={() => undefined} />,
+    );
+    expect(html).toContain("Templates");
+    expect(html).toContain('aria-current="page"');
+  });
 });
diff --git a/apps/web/src/components/ProductNavigation.tsx b/apps/web/src/components/ProductNavigation.tsx
index 75b672ee5..3e2a2c9f4 100644
--- a/apps/web/src/components/ProductNavigation.tsx
+++ b/apps/web/src/components/ProductNavigation.tsx
@@ -1,11 +1,12 @@
-import { Bot, LayoutDashboard, MessageSquare, Vault, type LucideIcon } from "lucide-react";
+import { Bot, LayoutDashboard, Layers3, MessageSquare, Vault, type LucideIcon } from "lucide-react";
 
-export type ProductView = "dashboard" | "agents" | "sessions" | "vaults";
+export type ProductView = "dashboard" | "agents" | "sessions" | "vaults" | "templates";
 
 const productViews: Array<{ id: ProductView; label: string; icon: LucideIcon }> = [
   { id: "dashboard", label: "Dashboard", icon: LayoutDashboard },
   { id: "agents", label: "Agents", icon: Bot },
   { id: "sessions", label: "Sessions", icon: MessageSquare },
+  { id: "templates", label: "Templates", icon: Layers3 },
   { id: "vaults", label: "Vaults", icon: Vault },
 ];
 
@@ -13,15 +14,17 @@ export function ProductNavigation({
   active,
   onSelect,
   showVaults = false,
+  showTemplates = false,
 }: {
   active: ProductView | null;
   onSelect: (view: ProductView) => void;
   showVaults?: boolean;
+  showTemplates?: boolean;
 }) {
   return (
     <nav className="main-nav product-navigation" aria-label="Agents product">
       <p className="nav-label">Workspace</p>
-      {productViews.filter((item) => item.id !== "vaults" || showVaults).map((item) => {
+      {productViews.filter((item) => (item.id !== "vaults" || showVaults) && (item.id !== "templates" || showTemplates)).map((item) => {
         const Icon = item.icon;
         return (
           <button
diff --git a/apps/web/src/features/environment-templates/EnvironmentTemplatesView.css b/apps/web/src/features/environment-templates/EnvironmentTemplatesView.css
new file mode 100644
index 000000000..6b2e32339
--- /dev/null
+++ b/apps/web/src/features/environment-templates/EnvironmentTemplatesView.css
@@ -0,0 +1,40 @@
+.templates-page .page-header { align-items: center; flex-wrap: wrap; gap: 12px; }
+.templates-page .page-header p, .templates-boundary { color: var(--fg-muted); font-size: 12px; line-height: 1.6; }
+.templates-content { padding: 0 24px 24px; }
+.templates-toolbar { display: flex; align-items: center; justify-content: space-between; flex-wrap: wrap; gap: 12px; margin: 24px 0 14px; }
+.templates-toolbar > span { color: var(--fg-muted); font-size: 12px; }
+.templates-search { display: flex; align-items: center; gap: 8px; width: 360px; max-width: 100%; color: var(--fg-muted); }
+.templates-search input, .template-form input, .template-form select { min-width: 0; width: 100%; border: 1px solid var(--line-strong); background: var(--surface); color: var(--fg); border-radius: 5px; padding: 9px 10px; font: inherit; }
+.templates-list { border: 1px solid var(--line); border-radius: 8px; overflow: hidden; }
+.template-row { display: flex; align-items: center; gap: 24px; padding: 18px; background: var(--surface); }
+.template-row + .template-row { border-top: 1px solid var(--line); }
+.template-identity { display: flex; flex-direction: column; gap: 6px; flex: 1; min-width: 0; }
+.template-identity h2 { margin: 0; font-size: 14px; font-weight: 550; overflow-wrap: anywhere; }
+.template-identity code, .template-delete code { overflow-wrap: anywhere; font-size: 11px; }
+.template-identity small { color: var(--fg-muted); font-size: 11px; }
+.template-summary { display: flex; gap: 24px; margin: 0; font-size: 12px; }
+.template-summary dt { color: var(--fg-muted); font-size: 11px; margin-bottom: 6px; }
+.template-summary dd { margin: 0; }
+.template-row-actions, .template-form-actions { display: flex; flex-wrap: wrap; gap: 8px; }
+.template-form-actions { justify-content: flex-end; margin-top: 12px; }
+.templates-empty { padding: 36px 16px; border: 1px dashed var(--line-strong); border-radius: 8px; text-align: center; }
+.templates-empty h2 { font-size: 15px; font-weight: 550; }
+.templates-empty p, .template-form p, .template-delete p { color: var(--fg-muted); font-size: 12px; line-height: 1.6; }
+.template-form { display: flex; flex-direction: column; gap: 10px; }
+.template-form label { font-size: 12px; font-weight: 550; }
+.template-form label span { color: var(--fg-muted); font-weight: 400; margin-left: 6px; }
+.template-form p { margin: 0; }
+.template-delete .button.danger { color: var(--danger); border-color: color-mix(in srgb, var(--danger) 35%, var(--line)); background: color-mix(in srgb, var(--danger) 7%, var(--surface)); }
+.template-delete .button.danger:hover:not(:disabled) { background: color-mix(in srgb, var(--danger) 13%, var(--surface)); }
+.template-form :is(input, select):focus-visible, .templates-search input:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
+@media (max-width: 1000px) {
+  .templates-content { padding: 0 16px 20px; }
+  .template-row { flex-wrap: wrap; gap: 16px; }
+  .template-identity { flex-basis: 100%; }
+  .template-summary { flex: 1; }
+  .templates-page .page-actions { flex-wrap: wrap; }
+  .templates-page .button, .template-form-actions .button { min-height: 40px; }
+}
+.templates-page { overflow-y: auto; }
+
+.templates-search > .sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip-path: inset(50%); white-space: nowrap; border: 0; }
diff --git a/apps/web/src/features/environment-templates/EnvironmentTemplatesView.test.tsx b/apps/web/src/features/environment-templates/EnvironmentTemplatesView.test.tsx
new file mode 100644
index 000000000..ea7b654b3
--- /dev/null
+++ b/apps/web/src/features/environment-templates/EnvironmentTemplatesView.test.tsx
@@ -0,0 +1,58 @@
+import { renderToStaticMarkup } from "react-dom/server";
+import { describe, expect, it, vi } from "vitest";
+import type { EnvironmentTemplate } from "@agents-core-web/agents-client";
+import { EnvironmentTemplatesView, type EnvironmentTemplatesViewProps } from "./EnvironmentTemplatesView";
+import { TemplateForm } from "./TemplateForm";
+
+const template: EnvironmentTemplate = {
+  id: "eb4fa61b-6c45-4b4c-a33b-6d9d1f05fd21", object: "agent.environment.template", name: "Restricted",
+  network: { access: "disabled", allowed_domains: [] }, capability_directories: [],
+  packages: { npm: [], python: [], system: [] }, files: [], plugins: [], skills: [], created_at: 1, updated_at: 2,
+};
+function render(catalog: EnvironmentTemplatesViewProps["catalog"]) {
+  const operations = {
+    createEnvironmentTemplate: vi.fn(), updateEnvironmentTemplate: vi.fn(), deleteEnvironmentTemplate: vi.fn(),
+  };
+  const html = renderToStaticMarkup(<EnvironmentTemplatesView catalog={catalog} operations={operations} onRefresh={async () => undefined} onConfigureConnection={() => undefined} />);
+  expect(operations.createEnvironmentTemplate).not.toHaveBeenCalled();
+  expect(operations.updateEnvironmentTemplate).not.toHaveBeenCalled();
+  expect(operations.deleteEnvironmentTemplate).not.toHaveBeenCalled();
+  return html;
+}
+
+describe("Environment Templates view", () => {
+  it("distinguishes unread, unsupported, failed and empty catalogs", () => {
+    expect(render(null)).toContain("Loading Environment Templates");
+    expect(render({ state: "unsupported" })).toContain("does not expose the Template resource");
+    const failed = render({ state: "failed", message: "secret-token" });
+    expect(failed).toContain("could not be loaded");
+    expect(failed).not.toContain("No Environment Templates yet");
+    expect(failed).not.toContain("secret-token");
+    expect(render({ state: "ready", templates: [] })).toContain("No Environment Templates yet");
+  });
+
+  it("shows safe configuration and actions without execution readiness claims", () => {
+    const html = render({ state: "ready", templates: [template] });
+    expect(html).toContain("Environment Templates</h1>");
+    expect(html).toContain("Filter Templates");
+    expect(html).toContain("Edit Restricted");
+    expect(html).toContain("Delete Restricted");
+    expect(html).toContain(template.id);
+    expect(html).toContain("does not start a Runtime");
+    expect(html).not.toContain("connected");
+  });
+
+  it("does not render unknown fields or private configuration", () => {
+    const value = { ...template, env: { KEY: "secret-canary" }, setup_commands: ["private-command"] };
+    const html = render({ state: "ready", templates: [value] });
+    expect(html).not.toContain("secret-canary");
+    expect(html).not.toContain("private-command");
+  });
+
+  it("provides explicit labels and blocks an unchanged edit", () => {
+    const html = renderToStaticMarkup(<TemplateForm template={template} busy={false} onSave={() => undefined} onCancel={() => undefined} />);
+    expect(html).toContain("Network access</label>");
+    expect(html).toContain("Existing Sessions keep their configuration");
+    expect(html).toContain('type="submit" disabled=""');
+  });
+});
diff --git a/apps/web/src/features/environment-templates/EnvironmentTemplatesView.tsx b/apps/web/src/features/environment-templates/EnvironmentTemplatesView.tsx
new file mode 100644
index 000000000..28601fbc3
--- /dev/null
+++ b/apps/web/src/features/environment-templates/EnvironmentTemplatesView.tsx
@@ -0,0 +1,140 @@
+import { Plus, RefreshCw, Search } from "lucide-react";
+import { useEffect, useRef, useState } from "react";
+import type { AgentCore, EnvironmentTemplate } from "@agents-core-web/agents-client";
+import { Modal } from "../../components/Modal";
+import { ErrorState } from "../../components/ErrorState";
+import { formatDashboardTimestamp } from "../dashboard/dashboard-model";
+import type { EnvironmentTemplateCatalog } from "../sessions/environment/environment-templates";
+import { TemplateForm } from "./TemplateForm";
+import { createTemplateWriteScope, templateName, templatePatch, type TemplateDraft } from "./template-editor";
+import "./EnvironmentTemplatesView.css";
+
+export interface EnvironmentTemplatesViewProps {
+  catalog: EnvironmentTemplateCatalog | null;
+  operations: Pick<AgentCore, "createEnvironmentTemplate" | "updateEnvironmentTemplate" | "deleteEnvironmentTemplate">;
+  onRefresh: () => Promise<void>;
+  onConfigureConnection: () => void;
+}
+
+type Dialog = { kind: "create" } | { kind: "edit" | "delete"; template: EnvironmentTemplate } | null;
+
+export function EnvironmentTemplatesView({ catalog, operations, onRefresh, onConfigureConnection }: EnvironmentTemplatesViewProps) {
+  const [query, setQuery] = useState("");
+  const [dialog, setDialog] = useState<Dialog>(null);
+  const [busy, setBusy] = useState(false);
+  const [refreshing, setRefreshing] = useState(false);
+  const [notice, setNotice] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [needsRefresh, setNeedsRefresh] = useState(false);
+  const scope = useRef(createTemplateWriteScope());
+  const mounted = useRef(true);
+  const refreshPending = useRef(false);
+  const writePending = useRef(false);
+  const failedCatalog = useRef<EnvironmentTemplateCatalog | null>(null);
+
+  useEffect(() => {
+    mounted.current = true;
+    scope.current = createTemplateWriteScope();
+    return () => { mounted.current = false; scope.current.dispose(); };
+  }, []);
+
+  useEffect(() => {
+    if (needsRefresh && catalog?.state === "ready" && catalog !== failedCatalog.current) setNeedsRefresh(false);
+  }, [catalog, needsRefresh]);
+
+  const ready = catalog?.state === "ready";
+  const blocked = busy || refreshing || needsRefresh || !ready;
+  const templates = ready ? catalog.templates : [];
+  const needle = query.trim().toLocaleLowerCase();
+  const visible = templates.filter((template) => [templateName(template), template.id, template.network.access].some((value) => value.toLocaleLowerCase().includes(needle)));
+
+  const refresh = async () => {
+    if (refreshPending.current || writePending.current) return;
+    refreshPending.current = true;
+    setRefreshing(true);
+    try { await onRefresh(); }
+    catch { if (mounted.current) setError("The catalog could not be refreshed. Check the connection and try again."); }
+    finally { refreshPending.current = false; if (mounted.current) setRefreshing(false); }
+  };
+
+  const write = async (request: (signal: AbortSignal) => Promise<unknown>, success: string) => {
+    if (blocked || writePending.current) return;
+    writePending.current = true;
+    setBusy(true); setError(null); setNotice(null);
+    const result = await scope.current.run(request, onRefresh);
+    writePending.current = false;
+    if (!mounted.current || result.kind === "ignored") return;
+    setBusy(false);
+    setDialog(null);
+    if (result.kind === "failed") {
+      failedCatalog.current = catalog;
+      setNeedsRefresh(true);
+      setError(result.message);
+    } else {
+      setNotice(success);
+      if (result.kind === "saved-refresh-failed") {
+        failedCatalog.current = catalog;
+        setNeedsRefresh(true);
+        setError("The change was saved, but the catalog refresh failed. Refresh before making another change.");
+      }
+    }
+  };
+
+  const save = (draft: TemplateDraft) => {
+    if (dialog?.kind === "create") {
+      void write((signal) => operations.createEnvironmentTemplate({ name: draft.name.trim() || null, network: { access: draft.access } }, { signal }), "Template created. No Runtime was allocated.");
+    } else if (dialog?.kind === "edit") {
+      const template = dialog.template;
+      const patch = templatePatch(template, draft);
+      if (Object.keys(patch).length) void write((signal) => operations.updateEnvironmentTemplate(template.id, patch, { signal }), "Template updated. Existing Sessions keep their configuration.");
+    }
+  };
+  const close = () => { if (!busy) setDialog(null); };
+
+  return (
+    <section className="page-section templates-page" aria-labelledby="templates-heading">
+      <header className="page-header">
+        <div><h1 id="templates-heading">Environment Templates</h1><p>Reusable configuration for managed Sessions.</p></div>
+        <div className="page-actions">
+          <button className="button outline" type="button" disabled={busy || refreshing} onClick={() => void refresh()}><RefreshCw size={14} aria-hidden="true" />{refreshing ? "Refreshing…" : "Refresh"}</button>
+          <button className="button primary" type="button" disabled={blocked} onClick={() => setDialog({ kind: "create" })}><Plus size={14} aria-hidden="true" />New Template</button>
+        </div>
+      </header>
+      <div className="templates-content">
+        <p className="templates-boundary">Manage names and network access for basic Templates. Select a saved Template when starting a Session. Saving configuration does not start a Runtime.</p>
+        {notice ? <p className="notice success" role="status">{notice}</p> : null}
+        {error ? <p className="notice warning" role="alert">{error}</p> : null}
+        {catalog === null ? <p role="status" aria-busy="true">Loading Environment Templates…</p> : catalog.state === "unsupported" ? (
+          <ErrorState title="Environment Templates are not available" description="This Core does not expose the Template resource. No catalog is inferred." action={<button className="button outline" onClick={onConfigureConnection}>Configure connection</button>} />
+        ) : catalog.state === "failed" ? (
+          <ErrorState title="Environment Templates could not be loaded" description="Check the Core connection, access permissions, and supported Template profile. The catalog is unavailable." action={<button className="button outline" onClick={onConfigureConnection}>Configure connection</button>} />
+        ) : (
+          <>
+            <div className="templates-toolbar">
+              <label className="templates-search"><Search size={15} aria-hidden="true" /><span className="sr-only">Filter Templates</span><input type="search" value={query} onChange={(event) => setQuery(event.target.value)} placeholder="Filter by name, ID, or network" /></label>
+              <span>{visible.length} of {templates.length} Templates</span>
+            </div>
+            {templates.length === 0 ? <div className="templates-empty"><h2>No Environment Templates yet</h2><p>Create a reusable configuration, then select it when starting a Session.</p></div> : visible.length === 0 ? <div className="templates-empty"><h2>No matching Templates</h2><button className="button outline" onClick={() => setQuery("")}>Clear filter</button></div> : (
+              <div className="templates-list" aria-label="Environment Templates">
+                {visible.map((template) => (
+                  <article className="template-row" key={template.id}>
+                    <div className="template-identity"><h2>{templateName(template)}</h2><code>{template.id}</code><small>Updated {formatDashboardTimestamp(template.updated_at)}</small></div>
+                    <dl className="template-summary"><div><dt>Network</dt><dd>{template.network.access === "enabled" ? "Enabled" : "Disabled"}</dd></div><div><dt>Allowed domains</dt><dd>{template.network.allowed_domains.length}</dd></div></dl>
+                    <div className="template-row-actions"><button className="button outline" type="button" disabled={blocked} aria-label={`Edit ${templateName(template)}`} onClick={() => setDialog({ kind: "edit", template })}>Edit</button><button className="button outline" type="button" disabled={blocked} aria-label={`Delete ${templateName(template)}`} onClick={() => setDialog({ kind: "delete", template })}>Delete</button></div>
+                  </article>
+                ))}
+              </div>
+            )}
+          </>
+        )}
+      </div>
+      <Modal open={dialog !== null} title={dialog?.kind === "delete" ? "Delete Template?" : dialog?.kind === "edit" ? "Edit Template" : "Create Template"} onClose={close}>
+        {dialog?.kind === "delete" ? <div className="template-delete">
+          <p>Delete <strong>{templateName(dialog.template)}</strong>?</p><code>{dialog.template.id}</code>
+          <p>New Sessions will no longer be able to select this Template. Existing Sessions keep their configuration. This action cannot be undone.</p>
+          <div className="template-form-actions"><button className="button outline" disabled={busy} onClick={close}>Cancel</button><button className="button danger" disabled={blocked} onClick={() => { const template = dialog.template; void write((signal) => operations.deleteEnvironmentTemplate(template.id, { signal }), "Template deleted."); }}>{busy ? "Deleting…" : "Delete Template"}</button></div>
+        </div> : dialog ? <TemplateForm key={dialog.kind === "edit" ? dialog.template.id : "new"} template={dialog.kind === "edit" ? dialog.template : undefined} busy={blocked} onSave={save} onCancel={close} /> : null}
+      </Modal>
+    </section>
+  );
+}
diff --git a/apps/web/src/features/environment-templates/TemplateForm.tsx b/apps/web/src/features/environment-templates/TemplateForm.tsx
new file mode 100644
index 000000000..9421e65b2
--- /dev/null
+++ b/apps/web/src/features/environment-templates/TemplateForm.tsx
@@ -0,0 +1,39 @@
+import { useId, useState, type FormEvent } from "react";
+import type { EnvironmentTemplate } from "@agents-core-web/agents-client";
+import { templatePatch, type TemplateDraft } from "./template-editor";
+
+export function TemplateForm({ template, busy, onSave, onCancel }: {
+  template?: EnvironmentTemplate;
+  busy: boolean;
+  onSave: (draft: TemplateDraft) => void;
+  onCancel: () => void;
+}) {
+  const id = useId();
+  const [draft, setDraft] = useState<TemplateDraft>({ name: template?.name ?? "", access: template?.network.access ?? "enabled" });
+  const tooLong = [...draft.name.trim()].length > 256;
+  const networkEditable = !template || template.network.allowed_domains.length === 0;
+  const unchanged = template && !tooLong && Object.keys(templatePatch(template, draft)).length === 0;
+  const submit = (event: FormEvent) => {
+    event.preventDefault();
+    if (!busy && !tooLong && !unchanged) onSave(draft);
+  };
+  return (
+    <form className="template-form" onSubmit={submit}>
+      <label htmlFor={`${id}-name`}>Name <span aria-hidden="true">Optional</span></label>
+      <input id={`${id}-name`} value={draft.name} disabled={busy} aria-invalid={tooLong || undefined} aria-describedby={tooLong ? `${id}-error` : undefined}
+        onChange={(event) => setDraft({ ...draft, name: event.target.value })} autoComplete="off" placeholder="e.g. Restricted network" />
+      {tooLong ? <p id={`${id}-error`} role="alert">A name accepts at most 256 characters.</p> : null}
+      <label htmlFor={`${id}-network`}>Network access</label>
+      <select id={`${id}-network`} value={draft.access} disabled={busy || !networkEditable}
+        onChange={(event) => setDraft({ ...draft, access: event.target.value as TemplateDraft["access"] })}>
+        <option value="enabled">Enabled</option><option value="disabled">Disabled</option>
+      </select>
+      {!networkEditable ? <p>This Web cannot edit this network policy without replacing its allowed domains.</p> : null}
+      <p>Applies when creating a new Session with this Template. Existing Sessions keep their configuration.</p>
+      <div className="template-form-actions">
+        <button className="button outline" type="button" disabled={busy} onClick={onCancel}>Cancel</button>
+        <button className="button primary" type="submit" disabled={busy || tooLong || Boolean(unchanged)}>{busy ? "Saving…" : template ? "Save changes" : "Create Template"}</button>
+      </div>
+    </form>
+  );
+}
diff --git a/apps/web/src/features/environment-templates/template-editor.test.ts b/apps/web/src/features/environment-templates/template-editor.test.ts
new file mode 100644
index 000000000..fb3c372a0
--- /dev/null
+++ b/apps/web/src/features/environment-templates/template-editor.test.ts
@@ -0,0 +1,91 @@
+import { describe, expect, it, vi } from "vitest";
+import type { EnvironmentTemplate } from "@agents-core-web/agents-client";
+import { createTemplateWriteScope, templatePatch } from "./template-editor";
+
+const template = {
+  id: "template-id", name: "Original", network: { access: "enabled", allowed_domains: [] },
+} as unknown as EnvironmentTemplate;
+
+describe("Template updates", () => {
+  it("omits unchanged fields and preserves network configuration on a rename", () => {
+    expect(templatePatch(template, { name: " Renamed ", access: "enabled" })).toEqual({ name: "Renamed" });
+    expect(templatePatch(template, { name: "Original", access: "enabled" })).toEqual({});
+    expect(templatePatch(template, { name: " ", access: "enabled" })).toEqual({ name: null });
+  });
+
+  it("only updates network access for an empty allowed-domain policy", () => {
+    expect(templatePatch(template, { name: "Original", access: "disabled" })).toEqual({ network: { access: "disabled" } });
+    const restricted = { ...template, network: { access: "enabled", allowed_domains: ["private.example"] } } as unknown as EnvironmentTemplate;
+    expect(templatePatch(restricted, { name: "Renamed", access: "enabled" })).toEqual({ name: "Renamed" });
+    expect(() => templatePatch(restricted, { name: "Original", access: "disabled" })).toThrow("allowed domains must be preserved");
+  });
+
+  it.each(["  Existing name  ", "   "])("preserves the untouched name %j", (name) => {
+    const original = { ...template, name };
+    expect(templatePatch(original, { name, access: "enabled" })).toEqual({});
+    expect(templatePatch(original, { name, access: "disabled" })).toEqual({ network: { access: "disabled" } });
+  });
+
+  it("counts Unicode characters rather than UTF-16 code units", () => {
+    expect(templatePatch(template, { name: "😀".repeat(256), access: "enabled" }).name).toHaveLength(512);
+    expect(() => templatePatch(template, { name: "😀".repeat(257), access: "enabled" })).toThrow("256");
+  });
+});
+
+describe("Template write lifecycle", () => {
+  it("prevents duplicate writes and refreshes only after the receipt", async () => {
+    let resolve!: () => void;
+    const write = vi.fn(() => new Promise<void>((done) => { resolve = done; }));
+    const refresh = vi.fn(async () => undefined);
+    const scope = createTemplateWriteScope();
+    const result = scope.run(write, refresh);
+    await expect(scope.run(write, refresh)).resolves.toEqual({ kind: "ignored" });
+    expect(write).toHaveBeenCalledOnce();
+    expect(refresh).not.toHaveBeenCalled();
+    resolve();
+    await expect(result).resolves.toEqual({ kind: "saved" });
+    expect(refresh).toHaveBeenCalledOnce();
+  });
+
+  it("aborts on disposal and never refreshes after a late mutation receipt", async () => {
+    let resolve!: () => void;
+    let signal!: AbortSignal;
+    const refresh = vi.fn(async () => undefined);
+    const scope = createTemplateWriteScope();
+    const result = scope.run((value) => { signal = value; return new Promise<void>((done) => { resolve = done; }); }, refresh);
+    scope.dispose();
+    expect(signal.aborted).toBe(true);
+    resolve();
+    await expect(result).resolves.toEqual({ kind: "ignored" });
+    expect(refresh).not.toHaveBeenCalled();
+  });
+
+  it("discards a refresh result after unmount", async () => {
+    let resolve!: () => void;
+    const scope = createTemplateWriteScope();
+    const refresh = vi.fn(() => new Promise<void>((done) => { resolve = done; }));
+    const result = scope.run(async () => undefined, refresh);
+    await Promise.resolve();
+    expect(refresh).toHaveBeenCalledOnce();
+    scope.dispose();
+    resolve();
+    await expect(result).resolves.toEqual({ kind: "ignored" });
+  });
+
+  it("separates a saved write from a failed refresh without replaying it", async () => {
+    const write = vi.fn(async () => undefined);
+    const scope = createTemplateWriteScope();
+    await expect(scope.run(write, async () => { throw new Error("private"); })).resolves.toEqual({ kind: "saved-refresh-failed" });
+    expect(write).toHaveBeenCalledOnce();
+  });
+
+  it("does not replay uncertain writes or expose raw failures", async () => {
+    const write = vi.fn(async () => { throw new Error("secret-token-and-hostname"); });
+    const refresh = vi.fn(async () => undefined);
+    const result = await createTemplateWriteScope().run(write, refresh);
+    expect(result.kind).toBe("failed");
+    expect(JSON.stringify(result)).not.toContain("secret-token");
+    expect(write).toHaveBeenCalledOnce();
+    expect(refresh).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/web/src/features/environment-templates/template-editor.ts b/apps/web/src/features/environment-templates/template-editor.ts
new file mode 100644
index 000000000..1d25dd5ff
--- /dev/null
+++ b/apps/web/src/features/environment-templates/template-editor.ts
@@ -0,0 +1,62 @@
+import { AgentCoreError, type EnvironmentTemplate, type OpenAIHostedNetworkAccess, type UpdateEnvironmentTemplateInput } from "@agents-core-web/agents-client";
+
+export interface TemplateDraft { name: string; access: OpenAIHostedNetworkAccess }
+
+export function templatePatch(template: EnvironmentTemplate, draft: TemplateDraft): UpdateEnvironmentTemplateInput {
+  const name = draft.name.trim() || null;
+  if ([...(name ?? "")].length > 256) throw new Error("A name accepts at most 256 characters.");
+  const patch: UpdateEnvironmentTemplateInput = {};
+  if (draft.name !== (template.name ?? "")) patch.name = name;
+  if (draft.access !== template.network.access) {
+    if (template.network.allowed_domains.length !== 0) {
+      throw new Error("This network policy cannot be edited by this Web. Its allowed domains must be preserved.");
+    }
+    patch.network = { access: draft.access };
+  }
+  return patch;
+}
+
+export function templateName(template: EnvironmentTemplate): string {
+  return template.name?.trim() || "Unnamed Template";
+}
+
+export function templateFailure(error: unknown): string {
+  if (error instanceof AgentCoreError) {
+    if (error.status === 401 || error.status === 403) return "Core rejected this request. Check the connection and access permissions.";
+    if (error.status === 404) return "This Template is no longer available. Refresh the catalog before trying again.";
+    if (error.status === 400 || error.status === 422) return "Core rejected the Template configuration. Refresh the catalog and review the fields.";
+  }
+  return "The write outcome was not confirmed. Refresh and review Core's catalog before making another change. The request was not replayed.";
+}
+
+export type TemplateWriteResult =
+  | { kind: "ignored" }
+  | { kind: "saved" | "saved-refresh-failed" }
+  | { kind: "failed"; message: string };
+
+/** One write at a time; disposal fences both late UI updates and catalog refreshes. */
+export function createTemplateWriteScope() {
+  let active = true;
+  let pending = false;
+  let controller: AbortController | null = null;
+  return {
+    dispose() { active = false; controller?.abort(); },
+    async run(write: (signal: AbortSignal) => Promise<unknown>, refresh: () => Promise<void>): Promise<TemplateWriteResult> {
+      if (!active || pending) return { kind: "ignored" };
+      pending = true;
+      controller = new AbortController();
+      try {
+        await write(controller.signal);
+        if (!active) return { kind: "ignored" };
+        try {
+          await refresh();
+          return active ? { kind: "saved" } : { kind: "ignored" };
+        } catch {
+          return active ? { kind: "saved-refresh-failed" } : { kind: "ignored" };
+        }
+      } catch (error) {
+        return active ? { kind: "failed", message: templateFailure(error) } : { kind: "ignored" };
+      } finally { pending = false; controller = null; }
+    },
+  };
+}
diff --git a/docs/web/README.md b/docs/web/README.md
index b327378ca..3a4af4d5b 100644
--- a/docs/web/README.md
+++ b/docs/web/README.md
@@ -2,10 +2,10 @@
 
 **English** | [简体中文](README.zh-CN.md)
 
-Agents Core Web is an open-source workspace for creating AI Agents, starting durable
-Sessions, following live work, and managing the resources used by a compatible Agent
-Core. It gives teams a product UI for their own Core deployment without moving
-credentials or execution into the browser.
+Agents Core Web is the administrator console for a self-deployed Agent Core. It
+shows execution records and manages Agents, Sessions and reusable resources through
+Core APIs. Business collaboration belongs in Parsar; credentials and execution stay
+outside the browser.
 
 ![Agents Core Web Dashboard](images/dashboard.png)
 
@@ -50,6 +50,14 @@ and follow-up input without losing the durable record.
 
 ![Durable Session conversation](images/sessions.png)
 
+### Environment Templates
+
+In managed-Environment builds, open **Templates** to view reusable configuration,
+create a basic name/network template, edit those fields, or confirm deletion. The
+Session creation picker uses the same refreshed catalog. Saving a template does
+not start a Runtime or a model request, and edits do not change existing Sessions.
+Advanced template profiles remain outside the current Web client coverage.
+
 ### System and connection status
 
 System shows what the connected Core build supports and what this process configured at
@@ -71,6 +79,7 @@ configuration is never presented as model execution readiness.
 | Vaults | Create project Vaults and manage write-only MCP bearer credentials without reading tokens back |
 | Environments | Default execution, optional self-hosted executor connection, and optional managed Runtime views |
 | Workspace and Files | Inspect supported Environment files and manage project Source Files when enabled by Core |
+| Templates | Basic name/network configuration, full catalog reads, partial updates and confirmed deletion |
 | System | Connection status plus safe build support and process startup configuration, clearly separated from Session/Environment runtime state |
 
 Capabilities appear only when the connected Core and the Web operator configuration expose
diff --git a/docs/web/architecture.md b/docs/web/architecture.md
index 2ad6bd0f3..fd29a3374 100644
--- a/docs/web/architecture.md
+++ b/docs/web/architecture.md
@@ -267,7 +267,14 @@ not executor, native-runtime, model, provider, or Turn readiness. The operator-i
 key stays outside Web, and the Linux launcher—not the browser, Web server, or daemon
 container—owns access to the Workspace. This profile is not a top-level Environment
 catalog or standalone CRUD API, and it is distinct from the managed hosted profile.
-Environment templates and automatic E2B/AWS Bedrock AgentCore provisioning stay hidden.
+Automatic provider provisioning controls stay outside the browser. The separate
+Templates navigation entry manages reusable basic Environment configuration through
+the public Template API; it is not an inventory of running Environments. It shares
+the complete catalog with Session creation, patches only edited name/network fields,
+and refreshes Core after each successful mutation. Deletion requires confirmation.
+Unknown write outcomes are never automatically replayed. Switching Core remounts
+the view and discards pending reads, forms and notices from the old connection.
+Advanced configurations outside the client projection remain explicitly unsupported.
 
 Workspace file controls require the independent default-off
 `AGENTS_CORE_WEB_ENVIRONMENT_FILES=1` flag because Core has no runtime capability
diff --git a/docs/web/protocol-coverage.md b/docs/web/protocol-coverage.md
index fe7badf7a..e1e9012a5 100644
--- a/docs/web/protocol-coverage.md
+++ b/docs/web/protocol-coverage.md
@@ -82,8 +82,8 @@ the Core key binding. Agents Core Web's local proxy owns the bearer server-side.
 | Environment lifecycle events | Yes | Read-only | UI projects pinned pending, ready, connected, disconnected, and failed live snapshots; unknown/malformed status events clear prior live claims and render as unavailable |
 | Environment retrieve | Yes | Yes, read-only | Strictly recognizes `self_hosted` and `openai_hosted` resource types. Session UI automatically reads the valid current Environment ID for either supported type; hosted write eligibility additionally requires the exact basic hosted projection and same-ID durable resource; there is no standalone Environment create/list/update/delete resource |
 | Environment overview | No public list API | No top-level UI | Web does not turn loaded Session projections into a catalog; a selected Session may still show its exact Environment data |
-| Environment Templates create/list | Yes | Managed-hosted-gated | Client covers the five pinned operations with strict safe-metadata projection; Session creation exposes list and create only, inside the managed Environment choice. Selection is disabled with an explicit reason when the connected Core rejects the collection path, and a Template that Core no longer lists cannot be referenced |
-| Environment Templates retrieve/update/delete | Yes | No | Reusable client methods only; no Web management surface, so a Template is never edited or deleted from the browser |
+| Environment Templates create/list | Yes | Managed-hosted-gated | The Templates navigation entry lists all pages and creates basic name/network configurations. It shares the catalog with Session creation. An unsupported or failed read is explicit, never an empty catalog |
+| Environment Templates retrieve/update/delete | Yes | Basic management | Templates supports partial name/network updates and confirmed deletion, followed by a Core catalog refresh. It neither creates Runtime instances nor edits existing Session snapshots. Advanced profiles outside the current strict client projection remain unsupported; no hidden fields are erased |
 | Environment keys | No public browser API | Hidden | Operator-issued executor credentials stay on executor compute and never enter browser state, request previews, navigation, or Create actions |
 | Vaults and static-bearer Credentials | Yes | Yes, when discovered | Web traverses the Vault and per-Vault Credential page chains to their Core end markers before publishing one loaded metadata result, provides safe lifecycle controls and write-only token create/replace, and deterministically attaches each selected Credential's owning Vault to Session creation. The reads are non-atomic and not a current Core total. Tokens are never returned; catalog success is not runtime proof |
 | Protocol Subagents / enabled multi-agent | Later | No | Distinct from storing multiple Agent configurations |