diff --git a/.changeset/staging-host-secrets.md b/.changeset/staging-host-secrets.md
new file mode 100644
index 00000000..57ae3e11
--- /dev/null
+++ b/.changeset/staging-host-secrets.md
@@ -0,0 +1,17 @@
+---
+"everything-dev": minor
+---
+
+Add `bos deploy` command, host secrets, and staging environment support
+
+- **New `bos deploy` command**: Publishes config to FastKV and triggers Railway redeploy in one step. Reads service name from `ci.railway.service` in `bos.config.json`. Uses `RAILWAY_TOKEN` (environment-scoped) instead of deployment IDs.
+
+- **New `ci` config section**: `bos.config.json` now accepts `ci.railway.service` for Railway integration. Child projects inherit this via extends.
+
+- **Staging environment support**: `BOS_ENV=staging` or `--env staging` enables staging mode. `staging.domain` overrides `domain`, FastKV publishes under the staging gateway key, and runtime sets `env = "staging"`.
+
+- **Host secrets**: Added `secrets` array to `app.host` for tenant-related environment variables (`TENANT_WHITELIST`, `ALLOW_OVERRIDE`, `ALLOW_UNTRUSTED_SSR`, `CSP_STRICT`). Validated during `bos start` and surfaced in `bos infra`.
+
+- **Workflow simplification**: Replaced `publish.yml` with `deploy.yml`. `release.yml` now only handles npm package releases. `staging.yml` uses `bos deploy --env staging`. All workflows use `railway redeploy` via CLI instead of raw GraphQL API calls.
+
+- **Removed**: `RAILWAY_PRODUCTION_SERVICE_ID` and `RAILWAY_STAGING_SERVICE_ID` variables — replaced by environment-scoped `RAILWAY_TOKEN` secrets.
\ No newline at end of file
diff --git a/.changeset/tenant-ssr-integrity-gate.md b/.changeset/tenant-ssr-integrity-gate.md
new file mode 100644
index 00000000..fea5de7c
--- /dev/null
+++ b/.changeset/tenant-ssr-integrity-gate.md
@@ -0,0 +1,10 @@
+---
+"everything-dev": patch
+"host": patch
+---
+
+Require ssrIntegrity for tenant SSR — prevent no-cache-per-request MF instance creation
+
+Tenant SSR now requires both `ssrUrl` and `ssrIntegrity` to be present. Previously, a whitelisted tenant with `ssrUrl` but no `ssrIntegrity` would bypass the router module cache (`shouldCacheRouterModule` returns false without `ssrIntegrity`), causing a new Module Federation instance to be created on every SSR request — the same pattern that caused the production SSR failure.
+
+Also fixes pre-existing typecheck errors in host test files (Effect Either narrowing, FederationError type annotation).
diff --git a/.env.example b/.env.example
index 5396bdfe..98afd68b 100644
--- a/.env.example
+++ b/.env.example
@@ -3,6 +3,10 @@
 
 # app.host
 CORS_ORIGIN=http://localhost:3000
+TENANT_WHITELIST=
+ALLOW_OVERRIDE=
+ALLOW_UNTRUSTED_SSR=
+CSP_STRICT=
 
 # app.api
 API_DATABASE_URL=postgres://everythingdev:everythingdev@localhost:5432/api_db
diff --git a/.github/workflows/publish.yml b/.github/templates/workflows/deploy.yml
similarity index 59%
rename from .github/workflows/publish.yml
rename to .github/templates/workflows/deploy.yml
index 22eebf6b..aff1bc72 100644
--- a/.github/workflows/publish.yml
+++ b/.github/templates/workflows/deploy.yml
@@ -1,31 +1,34 @@
-name: Publish Config
+name: Deploy
 
 on:
-  push:
-    branches:
-      - main
-    paths:
-      - "bos.config.json"
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
   workflow_dispatch:
-    inputs:
-      deploy:
-        description: "Build/deploy all workspaces before publish"
-        required: false
-        default: false
-        type: boolean
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 permissions:
   contents: write
 
 jobs:
-  publish:
-    if: github.event_name == 'workflow_dispatch' || !contains(github.event.head_commit.message, '[skip ci]')
+  deploy:
+    name: Deploy Production
+    if: >
+      github.event_name == 'workflow_dispatch' ||
+      (
+        github.event_name == 'workflow_run' &&
+        github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.event == 'push' &&
+        github.event.workflow_run.head_branch == 'main'
+      )
     runs-on: ubuntu-latest
     env:
       BOS_INSTALL_NEAR_CLI: "true"
       NEAR_PRIVATE_KEY: ${{ secrets.NEAR_PRIVATE_KEY }}
       ZE_SECRET_TOKEN: ${{ secrets.ZEPHYR_AUTH_TOKEN }}
       ZE_USER_EMAIL: ${{ secrets.ZEPHYR_USER_EMAIL }}
+      RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
     steps:
       - name: Checkout code
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
@@ -44,16 +47,14 @@ jobs:
       - name: Run postinstall
         run: bun run postinstall
 
-      - name: Publish app
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ inputs.deploy }}" = "true" ]; then
-            bun packages/everything-dev/src/cli.ts publish --deploy
-          else
-            bun packages/everything-dev/src/cli.ts publish
-          fi
+      - name: Install Railway CLI
+        run: npm i -g @railway/cli
+
+      - name: Deploy
+        run: bos deploy
 
       - name: Commit bos.config.json updates
         uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5.2.0
         with:
           commit_message: "chore: update deployment URLs [skip ci]"
-          file_pattern: "**/bos.config.json"
+          file_pattern: "**/bos.config.json"
\ No newline at end of file
diff --git a/.github/templates/workflows/staging.yml b/.github/templates/workflows/staging.yml
new file mode 100644
index 00000000..2b9542b6
--- /dev/null
+++ b/.github/templates/workflows/staging.yml
@@ -0,0 +1,54 @@
+name: Staging
+
+on:
+  push:
+    branches:
+      - staging
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+
+jobs:
+  deploy-staging:
+    name: Deploy Staging
+    runs-on: ubuntu-latest
+    env:
+      BOS_INSTALL_NEAR_CLI: "true"
+      NEAR_PRIVATE_KEY: ${{ secrets.NEAR_PRIVATE_KEY }}
+      ZE_SECRET_TOKEN: ${{ secrets.ZEPHYR_AUTH_TOKEN }}
+      ZE_USER_EMAIL: ${{ secrets.ZEPHYR_USER_EMAIL }}
+      RAILWAY_TOKEN: ${{ secrets.RAILWAY_STAGING_TOKEN }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: "1.2.20"
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile --ignore-scripts
+
+      - name: Build every-plugin
+        run: bun run --cwd packages/every-plugin build
+
+      - name: Run postinstall
+        run: bun run postinstall
+
+      - name: Install Railway CLI
+        run: npm i -g @railway/cli
+
+      - name: Deploy
+        run: bos deploy --env staging
+
+      - name: Commit bos.config.json updates
+        uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5.2.0
+        with:
+          commit_message: "chore: update staging deployment URLs [skip ci]"
+          file_pattern: "**/bos.config.json"
\ No newline at end of file
diff --git a/.github/templates/workflows/publish.yml b/.github/workflows/deploy.yml
similarity index 54%
rename from .github/templates/workflows/publish.yml
rename to .github/workflows/deploy.yml
index 3a5eef02..71ea0346 100644
--- a/.github/templates/workflows/publish.yml
+++ b/.github/workflows/deploy.yml
@@ -1,31 +1,34 @@
-name: Publish Config
+name: Deploy
 
 on:
-  push:
-    branches:
-      - main
-    paths:
-      - "bos.config.json"
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
   workflow_dispatch:
-    inputs:
-      deploy:
-        description: "Build/deploy all workspaces before publish"
-        required: false
-        default: false
-        type: boolean
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 permissions:
   contents: write
 
 jobs:
-  publish:
-    if: github.event_name == 'workflow_dispatch' || !contains(github.event.head_commit.message, '[skip ci]')
+  deploy:
+    name: Deploy Production
+    if: >
+      github.event_name == 'workflow_dispatch' ||
+      (
+        github.event_name == 'workflow_run' &&
+        github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.event == 'push' &&
+        github.event.workflow_run.head_branch == 'main'
+      )
     runs-on: ubuntu-latest
     env:
       BOS_INSTALL_NEAR_CLI: "true"
       NEAR_PRIVATE_KEY: ${{ secrets.NEAR_PRIVATE_KEY }}
       ZE_SECRET_TOKEN: ${{ secrets.ZEPHYR_AUTH_TOKEN }}
       ZE_USER_EMAIL: ${{ secrets.ZEPHYR_USER_EMAIL }}
+      RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
     steps:
       - name: Checkout code
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
@@ -38,19 +41,20 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile --ignore-scripts
 
+      - name: Build every-plugin
+        run: bun run --cwd packages/every-plugin build
+
       - name: Run postinstall
         run: bun run postinstall
 
-      - name: Publish app
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ inputs.deploy }}" = "true" ]; then
-            bun packages/everything-dev/src/cli.ts publish --deploy
-          else
-            bun packages/everything-dev/src/cli.ts publish
-          fi
+      - name: Install Railway CLI
+        run: npm i -g @railway/cli
+
+      - name: Deploy
+        run: bun packages/everything-dev/src/cli.ts deploy
 
       - name: Commit bos.config.json updates
         uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5.2.0
         with:
           commit_message: "chore: update deployment URLs [skip ci]"
-          file_pattern: "**/bos.config.json"
+          file_pattern: "**/bos.config.json"
\ No newline at end of file
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 50965846..f7b945d3 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -24,7 +24,7 @@ jobs:
         github.event_name == 'workflow_run' &&
         github.event.workflow_run.conclusion == 'success' &&
         github.event.workflow_run.event == 'push' &&
-        github.event.workflow_run.head_branch == 'main'
+        (github.event.workflow_run.head_branch == 'main' || github.event.workflow_run.head_branch == 'staging')
       )
     steps:
       - name: Checkout code
@@ -65,6 +65,7 @@ jobs:
           images: ghcr.io/${{ env.REPO }}
           tags: |
             type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=staging,enable=${{ github.ref == 'refs/heads/staging' }}
             type=ref,event=branch
             type=sha
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bfef56b2..e63172be 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,7 +38,6 @@ jobs:
         github.event.workflow_run.head_branch == 'main'
       )
     env:
-      BOS_INSTALL_NEAR_CLI: "true"
       TARGET_REF: ${{ inputs.ref != '' && inputs.ref || (github.event_name == 'workflow_run' && github.event.workflow_run.head_sha) || github.sha }}
     outputs:
       should_publish: ${{ steps.release_mode.outputs.should_publish }}
@@ -171,18 +170,3 @@ jobs:
               --notes "$NOTES" \
               --target main
           done
-
-      - name: Publish runtime config
-        if: steps.release_mode.outputs.should_publish == 'true'
-        env:
-          NEAR_PRIVATE_KEY: ${{ secrets.NEAR_PRIVATE_KEY }}
-          ZE_SECRET_TOKEN: ${{ secrets.ZEPHYR_AUTH_TOKEN }}
-          ZE_USER_EMAIL: ${{ secrets.ZEPHYR_USER_EMAIL }}
-        run: bun packages/everything-dev/src/cli.ts publish --deploy
-
-      - name: Commit bos.config.json updates
-        if: steps.release_mode.outputs.should_publish == 'true'
-        uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5.2.0
-        with:
-          commit_message: "chore: update deployment URLs [skip ci]"
-          file_pattern: "**/bos.config.json"
diff --git a/.github/workflows/staging.yml b/.github/workflows/staging.yml
new file mode 100644
index 00000000..5aab61b4
--- /dev/null
+++ b/.github/workflows/staging.yml
@@ -0,0 +1,55 @@
+name: Staging
+
+on:
+  push:
+    branches:
+      - staging
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+  deploy-staging:
+    name: Deploy Staging
+    runs-on: ubuntu-latest
+    env:
+      BOS_INSTALL_NEAR_CLI: "true"
+      NEAR_PRIVATE_KEY: ${{ secrets.NEAR_PRIVATE_KEY }}
+      ZE_SECRET_TOKEN: ${{ secrets.ZEPHYR_AUTH_TOKEN }}
+      ZE_USER_EMAIL: ${{ secrets.ZEPHYR_USER_EMAIL }}
+      RAILWAY_TOKEN: ${{ secrets.RAILWAY_STAGING_TOKEN }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: "1.2.20"
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile --ignore-scripts
+
+      - name: Build every-plugin
+        run: bun run --cwd packages/every-plugin build
+
+      - name: Run postinstall
+        run: bun run postinstall
+
+      - name: Install Railway CLI
+        run: npm i -g @railway/cli
+
+      - name: Deploy
+        run: bun packages/everything-dev/src/cli.ts deploy --env staging
+
+      - name: Commit bos.config.json updates
+        uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5.2.0
+        with:
+          commit_message: "chore: update staging deployment URLs [skip ci]"
+          file_pattern: "**/bos.config.json"
\ No newline at end of file
diff --git a/Dockerfile b/Dockerfile
index fe61153d..021c4263 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -41,6 +41,8 @@ RUN mkdir -p .bos/generated .bos/logs && \
 ENV NODE_ENV=production
 ENV PORT=3000
 ENV HOST=0.0.0.0
+# BOS_ENV: set to "staging" to enable staging mode (uses staging domain for BOS_GATEWAY)
+# Defaults to "production" if unset.
 EXPOSE 3000
 
 HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
diff --git a/bos.config.json b/bos.config.json
index a5229464..3f19b2e6 100644
--- a/bos.config.json
+++ b/bos.config.json
@@ -1,28 +1,40 @@
 {
   "account": "dev.everything.near",
-  "domain": "dev.everything.dev",
+  "domain": "everything.dev",
   "title": "everything.dev",
   "description": "Open runtime for apps on NEAR, composed from published config and loaded through a shared host, UI, and API runtime.",
-  "testnet": "dev.allthethings.testnet",
   "staging": {
-    "domain": "staging.dev.everything.dev"
+    "domain": "dev.everything.dev"
   },
   "repository": "https://github.com/nearbuilders/everything-dev",
+  "ci": {
+    "railway": {
+      "service": "app"
+    }
+  },
   "app": {
     "host": {
       "development": "local:host",
-      "production": "https://elliot-braem-3974-host-everything-dev-nearbuilder-8513ab298-ze.zephyrcloud.app",
-      "integrity": "sha384-cJSFftKsfmRX3ezuW4BP/VFK+VSzhTSXqu0eLDgHKUmOohuDPkWt7RMvDd2egijq"
+      "production": "https://elliot-braem-3982-host-everything-dev-nearbuilder-ce31237a5-ze.zephyrcloud.app",
+      "integrity": "sha384-xpMal1DC+V2vazkrYCJspPT6XldFXbd0bcd1Qq9lc6mVcaLLy9PWQLpDbuxxoVSs",
+      "secrets": [
+        "CORS_ORIGIN",
+        "TENANT_WHITELIST",
+        "ALLOW_OVERRIDE",
+        "ALLOW_UNTRUSTED_SSR",
+        "CSP_STRICT"
+      ]
     },
     "ui": {
       "development": "local:ui",
-      "production": "https://elliot-braem-3968-ui-everything-dev-nearbuilders-6cd4c405b-ze.zephyrcloud.app",
-      "ssr": "https://elliot-braem-3969-ui-everything-dev-nearbuilders-e369c17ce-ze.zephyrcloud.app",
-      "integrity": "sha384-ni2kNqkd7aFlf9eSxChty8Tds1g5Wz31FAkW1DiMDLcSkbQJ9peFXH9mwSp92qYD"
+      "production": "https://elliot-braem-4009-ui-everything-dev-nearbuilders-08b0deb6b-ze.zephyrcloud.app",
+      "ssr": "https://elliot-braem-4010-ui-everything-dev-nearbuilders-41017c5ae-ze.zephyrcloud.app",
+      "integrity": "sha384-CPc7Ruz83GD5ZSz//iDGelzs66TWP3nRroIa6vNejj3AyP9D7rbSYCY0B9QmKkOO",
+      "ssrIntegrity": "sha384-Xl88t66al3NxqvJKtHAD+9V0X1Zf984ZqInTb+mnvwZK3HmUvJmlzNJmyu4l9g1v"
     },
     "api": {
       "development": "local:api",
-      "production": "https://elliot-braem-3970-api-everything-dev-nearbuilders-7d41ad764-ze.zephyrcloud.app",
+      "production": "https://elliot-braem-3978-api-everything-dev-nearbuilders-6f0545872-ze.zephyrcloud.app",
       "integrity": "sha384-f/HuutBh3+h3xiBvJvJu4HDAp2jhSLDR0OLjSjhLjg595qGOQLBu2oYO/u+vjdzq",
       "secrets": [
         "API_DATABASE_URL"
@@ -35,8 +47,8 @@
   "plugins": {
     "apps": {
       "development": "local:plugins/apps",
-      "production": "https://elliot-braem-3971-everything-dev-apps-plugin-ever-91dca9a92-ze.zephyrcloud.app",
-      "integrity": "sha384-zfHOSR0mbcu4l8PkZqli4BlDlnfhw5HhgtP2jGiys90/qKKAh74/l7LYI+7j6r9L",
+      "production": "https://elliot-braem-3979-everything-dev-apps-plugin-ever-c59643b12-ze.zephyrcloud.app",
+      "integrity": "sha384-fGQEg7G+Ze38bNMMrhVboO/vbz9WHISeG0nhHuSQki4Xu5ZpKwu1EwXFFRAc9QUy",
       "variables": {
         "registryNamespace": "dev.everything.near"
       },
@@ -54,7 +66,7 @@
     },
     "projects": {
       "development": "local:plugins/projects",
-      "production": "https://elliot-braem-3972-everything-dev-projects-plugin--bcdb70e9a-ze.zephyrcloud.app",
+      "production": "https://elliot-braem-3980-everything-dev-projects-plugin--330a6cdf9-ze.zephyrcloud.app",
       "integrity": "sha384-oSAXUrJT2x5NfuEcbPS9GvmzC8E0INdCarPSQxFJ4SwxKfyCQEoWGkFTl7Ja86z/",
       "secrets": [
         "PROJECTS_DATABASE_URL"
@@ -71,7 +83,7 @@
     },
     "settings": {
       "development": "local:plugins/settings",
-      "production": "https://elliot-braem-3973-every-plugin-settings-everythin-6b4774e41-ze.zephyrcloud.app",
+      "production": "https://elliot-braem-3981-every-plugin-settings-everythin-e8acf157d-ze.zephyrcloud.app",
       "integrity": "sha384-f0n7itNtGKV74WX+KSu7anEpB0MEQcFxhZw2rJbHEWIWPzvLnNf/tEGX/7Hp2haY",
       "routes": [
         "ui/src/routes/_layout/_authenticated/settings.tsx"
diff --git a/host/.env.example b/host/.env.example
index 79a57c7c..1283ab78 100644
--- a/host/.env.example
+++ b/host/.env.example
@@ -1,2 +1,9 @@
-API_DATABASE_URL=
-API_DATABASE_AUTH_TOKEN=
+# app.host
+CORS_ORIGIN=http://localhost:3000
+TENANT_WHITELIST=
+ALLOW_OVERRIDE=
+ALLOW_UNTRUSTED_SSR=
+CSP_STRICT=
+
+# app.api
+API_DATABASE_URL=postgres://everythingdev:everythingdev@localhost:5432/api_db
\ No newline at end of file
diff --git a/host/src/services/errors.ts b/host/src/services/errors.ts
index 70161513..22e8dc7e 100644
--- a/host/src/services/errors.ts
+++ b/host/src/services/errors.ts
@@ -4,10 +4,22 @@ export class FederationError extends Data.TaggedError("FederationError")<{
   readonly remoteName: string;
   readonly remoteUrl?: string;
   readonly cause?: unknown;
-}> {}
+}> {
+  get message() {
+    const raw = this.cause instanceof FederationError ? this.cause.cause : this.cause;
+    const detail = raw instanceof Error ? raw.message : String(raw ?? "");
+    return `Failed to load ${this.remoteName}${this.remoteUrl ? ` from ${this.remoteUrl}` : ""}: ${detail}`;
+  }
+}
 
 export class PluginError extends Data.TaggedError("PluginError")<{
   readonly pluginName?: string;
   readonly pluginUrl?: string;
   readonly cause?: unknown;
-}> {}
+}> {
+  get message() {
+    const raw = this.cause instanceof PluginError ? this.cause.cause : this.cause;
+    const detail = raw instanceof Error ? raw.message : String(raw ?? "");
+    return `Plugin ${this.pluginName ?? "unknown"}${this.pluginUrl ? ` at ${this.pluginUrl}` : ""} failed: ${detail}`;
+  }
+}
diff --git a/host/src/services/tenant-runtime.ts b/host/src/services/tenant-runtime.ts
index 4fe63253..983bff8e 100644
--- a/host/src/services/tenant-runtime.ts
+++ b/host/src/services/tenant-runtime.ts
@@ -506,7 +506,10 @@ export async function resolveRequestRuntime(
     }
   }
 
-  const ssrAllowed = Boolean(effectiveConfig.ui.ssrUrl) && isSsrAllowed(tenantAccountId);
+  const ssrAllowed =
+    Boolean(effectiveConfig.ui.ssrUrl) &&
+    Boolean(effectiveConfig.ui.ssrIntegrity) &&
+    isSsrAllowed(tenantAccountId);
 
   return {
     config: ssrAllowed
diff --git a/host/tests/helpers/bundled-host.ts b/host/tests/helpers/bundled-host.ts
new file mode 100644
index 00000000..62cded36
--- /dev/null
+++ b/host/tests/helpers/bundled-host.ts
@@ -0,0 +1,133 @@
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { createInstance } from "@module-federation/enhanced/runtime";
+import { setGlobalFederationInstance } from "@module-federation/runtime-core";
+import { patchManifestFetchForSsrPublicPath } from "everything-dev/mf";
+import type { RuntimeConfig } from "../../src/services/config";
+import { getAvailablePort } from "./ports";
+import { startStaticDistServer } from "./static-dist-server";
+import { loadHostTestEnv } from "./test-env";
+
+interface ServerHandle {
+  ready: Promise<void>;
+  shutdown: () => Promise<void>;
+}
+
+interface HostRemoteModule {
+  runServer: (input: { config: RuntimeConfig }) => ServerHandle;
+}
+
+export interface BundledHostRuntime {
+  baseUrl: string;
+  hostAssetsUrl: string;
+  uiAssetsUrl: string;
+  stop: () => Promise<void>;
+}
+
+export interface BundledHostUrls {
+  baseUrl: string;
+  hostAssetsUrl: string;
+  uiAssetsUrl: string;
+}
+
+const workspaceRoot = path.resolve(import.meta.dirname, "../../..");
+const hostDir = path.join(workspaceRoot, "host");
+const uiDir = path.join(workspaceRoot, "ui");
+let buildReady = false;
+
+loadHostTestEnv(workspaceRoot);
+
+function ensureBuild(cwd: string) {
+  const result = spawnSync("bun", ["run", "build"], {
+    cwd,
+    stdio: "inherit",
+    env: { ...process.env },
+  });
+
+  if (result.status !== 0) {
+    throw new Error(`Build failed for ${cwd} (exit ${result.status ?? "unknown"})`);
+  }
+}
+
+function ensureBuilds() {
+  if (buildReady) return;
+
+  if (!existsSync(path.join(hostDir, "dist", "remoteEntry.js"))) {
+    ensureBuild(hostDir);
+  }
+  if (!existsSync(path.join(uiDir, "dist", "remoteEntry.server.js"))) {
+    ensureBuild(uiDir);
+  }
+  buildReady = true;
+}
+
+let instanceCounter = 0;
+
+async function loadBundledHostModule(hostAssetsUrl: string): Promise<HostRemoteModule> {
+  instanceCounter++;
+  const remoteName = `host_${instanceCounter}`;
+  const mf = createInstance({ name: `bundled-host-${instanceCounter}`, remotes: [] });
+  setGlobalFederationInstance(mf as any);
+  patchManifestFetchForSsrPublicPath(mf as any);
+
+  const entryUrl = `${hostAssetsUrl}/mf-manifest.json`;
+  (mf as any).registerRemotes([{ name: remoteName, entry: entryUrl, alias: "host" }]);
+
+  const hostModule = (await (mf as any).loadRemote(`${remoteName}/Server`)) as HostRemoteModule | null;
+  if (!hostModule?.runServer) {
+    throw new Error("Bundled host module did not export runServer");
+  }
+
+  return hostModule;
+}
+
+export async function startBundledHost(
+  buildConfig: (urls: BundledHostUrls) => RuntimeConfig,
+): Promise<BundledHostRuntime> {
+  ensureBuilds();
+
+  const hostAssetsServer = await startStaticDistServer(path.join(hostDir, "dist"));
+  const uiAssetsServer = await startStaticDistServer(path.join(uiDir, "dist"));
+  const port = await getAvailablePort();
+  const baseUrl = `http://127.0.0.1:${port}`;
+  const runtimeConfig = buildConfig({
+    baseUrl,
+    hostAssetsUrl: hostAssetsServer.baseUrl,
+    uiAssetsUrl: uiAssetsServer.baseUrl,
+  });
+
+  const previousNodeEnv = process.env.NODE_ENV;
+  const previousHost = process.env.HOST;
+  const previousPort = process.env.PORT;
+  process.env.NODE_ENV = "production";
+  process.env.HOST = "127.0.0.1";
+  process.env.PORT = String(port);
+
+  let serverHandle: ServerHandle | null = null;
+
+  try {
+    const hostModule = await loadBundledHostModule(hostAssetsServer.baseUrl);
+    serverHandle = hostModule.runServer({ config: runtimeConfig });
+    await serverHandle.ready;
+  } catch (error) {
+    await Promise.allSettled([hostAssetsServer.stop(), uiAssetsServer.stop()]);
+    process.env.NODE_ENV = previousNodeEnv;
+    process.env.HOST = previousHost;
+    process.env.PORT = previousPort;
+    throw error;
+  }
+
+  return {
+    baseUrl,
+    hostAssetsUrl: hostAssetsServer.baseUrl,
+    uiAssetsUrl: uiAssetsServer.baseUrl,
+    stop: async () => {
+      await serverHandle?.shutdown();
+      await Promise.allSettled([hostAssetsServer.stop(), uiAssetsServer.stop()]);
+      process.env.NODE_ENV = previousNodeEnv;
+      process.env.HOST = previousHost;
+      process.env.PORT = previousPort;
+    },
+  };
+}
diff --git a/host/tests/helpers/bundled-ssr-module.ts b/host/tests/helpers/bundled-ssr-module.ts
new file mode 100644
index 00000000..d372890d
--- /dev/null
+++ b/host/tests/helpers/bundled-ssr-module.ts
@@ -0,0 +1,96 @@
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { createInstance } from "@module-federation/enhanced/runtime";
+import { setGlobalFederationInstance } from "@module-federation/runtime-core";
+import { patchManifestFetchForSsrPublicPath } from "everything-dev/mf";
+import type { RouterModule } from "../../src/types";
+import { startStaticDistServer, type StaticDistServer } from "./static-dist-server";
+import { loadHostTestEnv } from "./test-env";
+
+const workspaceRoot = path.resolve(import.meta.dirname, "../../..");
+const uiDir = path.join(workspaceRoot, "ui");
+let buildReady = false;
+
+loadHostTestEnv(workspaceRoot);
+
+function ensureUiServerBuild() {
+  if (buildReady) return;
+
+  const serverEntry = path.join(uiDir, "dist", "remoteEntry.server.js");
+  if (existsSync(serverEntry)) {
+    buildReady = true;
+    return;
+  }
+
+  const result = spawnSync("bun", ["run", "build"], {
+    cwd: uiDir,
+    stdio: "inherit",
+    env: { ...process.env, BUILD_TARGET: "server" },
+  });
+
+  if (result.status !== 0) {
+    throw new Error(`UI server build failed (exit ${result.status ?? "unknown"})`);
+  }
+
+  buildReady = true;
+}
+
+let activeSsrLoader: {
+  uiServer: StaticDistServer;
+  mf: ReturnType<typeof createInstance>;
+} | null = null;
+
+export async function loadBundledRouterModule(): Promise<{
+  routerModule: RouterModule;
+  assetsUrl: string;
+  cleanup: () => Promise<void>;
+}> {
+  ensureUiServerBuild();
+
+  if (activeSsrLoader) {
+    const mod = await (activeSsrLoader.mf as any).loadRemote("ui/Router", { from: "build" });
+    return {
+      routerModule: mod.default as RouterModule,
+      assetsUrl: activeSsrLoader.uiServer.baseUrl,
+      cleanup: async () => {},
+    };
+  }
+
+  const uiServer = await startStaticDistServer(path.join(uiDir, "dist"));
+
+  const mf = createInstance({
+    name: "ssr-test-host",
+    remotes: [
+      {
+        name: "ui",
+        entry: `${uiServer.baseUrl}/mf-manifest.json`,
+        alias: "ui",
+      },
+    ],
+  });
+  setGlobalFederationInstance(mf as any);
+  patchManifestFetchForSsrPublicPath(mf as any);
+
+  const mod = await (mf as any).loadRemote("ui/Router", { from: "build" });
+  if (!mod?.default) {
+    await uiServer.stop();
+    throw new Error("Bundled UI remote did not export Router module");
+  }
+
+  activeSsrLoader = { uiServer, mf };
+
+  return {
+    routerModule: mod.default as RouterModule,
+    assetsUrl: uiServer.baseUrl,
+    cleanup: async () => {
+      if (activeSsrLoader) {
+        await activeSsrLoader.uiServer.stop();
+        if ((mf as any).getInstance) {
+          setGlobalFederationInstance(undefined as any);
+        }
+        activeSsrLoader = null;
+      }
+    },
+  };
+}
diff --git a/host/tests/helpers/runtime-config.ts b/host/tests/helpers/runtime-config.ts
index 8fa122a9..a1c0cd4e 100644
--- a/host/tests/helpers/runtime-config.ts
+++ b/host/tests/helpers/runtime-config.ts
@@ -61,6 +61,14 @@ export function buildTestClientRuntimeConfig(config: RuntimeConfig): Partial<Cli
     apiBase: "/api",
     rpcBase: "/api/rpc",
     repository: config.repository,
+    runtime: {
+      accountId: config.account,
+      gatewayId: config.domain ?? config.account,
+      runtimeBasePath: "/",
+      title: config.title ?? config.account,
+      description: config.description ?? null,
+      hostUrl: config.host?.url,
+    },
     ui: {
       name: config.ui.name,
       url: config.ui.url,
diff --git a/host/tests/helpers/static-dist-server.ts b/host/tests/helpers/static-dist-server.ts
new file mode 100644
index 00000000..2059bddf
--- /dev/null
+++ b/host/tests/helpers/static-dist-server.ts
@@ -0,0 +1,68 @@
+import { createServer } from "node:http";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import path from "node:path";
+import { getAvailablePort } from "./ports";
+
+export interface StaticDistServer {
+  baseUrl: string;
+  stop: () => Promise<void>;
+}
+
+const MIME_TYPES: Record<string, string> = {
+  ".css": "text/css",
+  ".html": "text/html",
+  ".ico": "image/x-icon",
+  ".js": "application/javascript",
+  ".json": "application/json",
+  ".mjs": "application/javascript",
+  ".png": "image/png",
+  ".svg": "image/svg+xml",
+  ".txt": "text/plain",
+  ".webmanifest": "application/manifest+json",
+};
+
+function getContentType(filePath: string) {
+  return MIME_TYPES[path.extname(filePath).toLowerCase()] ?? "application/octet-stream";
+}
+
+export async function startStaticDistServer(rootDir: string): Promise<StaticDistServer> {
+  const port = await getAvailablePort();
+  const normalizedRoot = path.resolve(rootDir);
+
+  const server = createServer((req, res) => {
+    const rawPath = (req.url ?? "/").split("?")[0] ?? "/";
+    const relativePath = rawPath === "/" ? "/index.html" : rawPath;
+    const filePath = path.resolve(normalizedRoot, `.${relativePath}`);
+
+    if (!filePath.startsWith(normalizedRoot)) {
+      res.statusCode = 403;
+      res.end("forbidden");
+      return;
+    }
+
+    if (!existsSync(filePath) || statSync(filePath).isDirectory()) {
+      res.statusCode = 404;
+      res.end("not found");
+      return;
+    }
+
+    res.statusCode = 200;
+    res.setHeader("access-control-allow-origin", "*");
+    res.setHeader("content-type", getContentType(filePath));
+    res.end(readFileSync(filePath));
+  });
+
+  await new Promise<void>((resolve, reject) => {
+    server.on("error", reject);
+    server.listen(port, "127.0.0.1", () => resolve());
+  });
+
+  return {
+    baseUrl: `http://127.0.0.1:${port}`,
+    stop: async () => {
+      await new Promise<void>((resolve, reject) => {
+        server.close((error) => (error ? reject(error) : resolve()));
+      });
+    },
+  };
+}
diff --git a/host/tests/integration/runtime-remote.test.ts b/host/tests/integration/runtime-remote.test.ts
index afa7347c..c5b885bc 100644
--- a/host/tests/integration/runtime-remote.test.ts
+++ b/host/tests/integration/runtime-remote.test.ts
@@ -73,6 +73,9 @@ for (const scenario of scenarios) {
       if (scenario.ssr) {
         expect(html).toContain('<div id="root">');
         expect(html).toContain("manifest.json");
+        expect(html).toContain('<iframe title="BOS viewer"');
+        expect(html).not.toContain("SSR unavailable, showing client app.");
+        expect(html).not.toContain("<p>Loading...</p>");
       }
     });
 
diff --git a/host/tests/integration/seo.test.ts b/host/tests/integration/seo.test.ts
index aa8efdae..edc77f3d 100644
--- a/host/tests/integration/seo.test.ts
+++ b/host/tests/integration/seo.test.ts
@@ -1,8 +1,7 @@
-import { Effect } from "every-plugin/effect";
-import { beforeAll, describe, expect, it } from "vitest";
-import { loadRouterModule } from "@/services/federation.server";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
 import type { HeadData, RouterModule, RuntimeConfig } from "@/types";
 import { buildTestRouteHeadContext, loadTestRuntimeConfig } from "../helpers/runtime-config";
+import { loadBundledRouterModule } from "../helpers/bundled-ssr-module";
 
 function escapeHtml(str: string): string {
   return str
@@ -61,10 +60,17 @@ function renderHeadToString(head: HeadData): string {
 describe("SEO Head Extraction", () => {
   let routerModule: RouterModule;
   let config: RuntimeConfig;
+  let cleanup: () => Promise<void>;
 
   beforeAll(async () => {
     config = await loadTestRuntimeConfig();
-    routerModule = await Effect.runPromise(loadRouterModule(config));
+    const bundled = await loadBundledRouterModule();
+    routerModule = bundled.routerModule;
+    cleanup = bundled.cleanup;
+  });
+
+  afterAll(async () => {
+    await cleanup();
   });
 
   describe("Module Federation", () => {
diff --git a/host/tests/integration/ssr-bundled-runtime.test.ts b/host/tests/integration/ssr-bundled-runtime.test.ts
new file mode 100644
index 00000000..be9835aa
--- /dev/null
+++ b/host/tests/integration/ssr-bundled-runtime.test.ts
@@ -0,0 +1,54 @@
+import { describe, expect, it } from "vitest";
+import { startBundledHost, type BundledHostRuntime } from "../helpers/bundled-host";
+
+function createRuntimeConfig(urls: {
+  baseUrl: string;
+  uiAssetsUrl: string;
+}) {
+  return {
+    env: "production",
+    account: "dev.everything.near",
+    domain: "everything.dev",
+    networkId: "mainnet",
+    title: "everything.dev",
+    description: "Bundled SSR regression runtime",
+    repository: "https://github.com/nearbuilders/everything-dev",
+    host: {
+      name: "host",
+      url: urls.baseUrl,
+      entry: `${urls.baseUrl}/mf-manifest.json`,
+      source: "remote",
+    },
+    ui: {
+      name: "ui",
+      url: urls.uiAssetsUrl,
+      entry: `${urls.uiAssetsUrl}/mf-manifest.json`,
+      source: "remote",
+      ssrUrl: urls.uiAssetsUrl,
+    },
+    api: {
+      name: "api",
+      url: urls.baseUrl,
+      entry: `${urls.baseUrl}/mf-manifest.json`,
+      source: "remote",
+    },
+  } as const;
+}
+
+describe("bundled host SSR runtime", () => {
+  let runtime: BundledHostRuntime | null = null;
+
+  it("renders real SSR markup from the bundled UI remote through the host", async () => {
+    runtime = await startBundledHost((urls) => createRuntimeConfig(urls));
+
+    const response = await fetch(`${runtime.baseUrl}/`);
+    const html = await response.text();
+
+    expect(response.status).toBe(200);
+    expect(html).toContain('<iframe title="BOS viewer"');
+    expect(html).not.toContain("SSR unavailable, showing client app.");
+    expect(html).not.toContain("<p>Loading...</p>");
+
+    await runtime.stop();
+  }, 120000);
+});
diff --git a/host/tests/integration/ssr-fallback.test.ts b/host/tests/integration/ssr-fallback.test.ts
new file mode 100644
index 00000000..83b733e0
--- /dev/null
+++ b/host/tests/integration/ssr-fallback.test.ts
@@ -0,0 +1,333 @@
+import { createServer } from "node:http";
+import { Effect } from "every-plugin/effect";
+import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
+import { getAvailablePort } from "../helpers/ports";
+
+const loadRouterModuleMock = vi.fn();
+const resolveRequestRuntimeMock = vi.fn();
+
+vi.mock("../../src/services/federation.server", async () => {
+  const actual = await vi.importActual<typeof import("../../src/services/federation.server")>(
+    "../../src/services/federation.server",
+  );
+  return {
+    ...actual,
+    loadRouterModule: loadRouterModuleMock,
+  };
+});
+
+vi.mock("../../src/services/tenant-runtime", async () => {
+  const actual = await vi.importActual<typeof import("../../src/services/tenant-runtime")>(
+    "../../src/services/tenant-runtime",
+  );
+  return {
+    ...actual,
+    resolveRequestRuntime: resolveRequestRuntimeMock,
+  };
+});
+
+const { FederationError } = await import("../../src/services/errors");
+const { runServer } = await import("../../src/program");
+
+function createBaseConfig(ssrUrl?: string) {
+  return {
+    env: "production",
+    account: "linktree.near",
+    domain: "linktree.com",
+    networkId: "mainnet",
+    title: "Linktree",
+    description: "Base runtime",
+    repository: "https://github.com/example/linktree",
+    host: {
+      name: "host",
+      url: "http://127.0.0.1:0",
+      entry: "http://127.0.0.1:0/mf-manifest.json",
+      source: "remote",
+    },
+    ui: {
+      name: "ui",
+      url: "http://127.0.0.1:0/ui",
+      entry: "http://127.0.0.1:0/ui/mf-manifest.json",
+      source: "remote",
+      integrity: "sha384-base",
+      ssrUrl,
+    },
+    api: {
+      name: "api",
+      url: "http://127.0.0.1:0/api",
+      entry: "http://127.0.0.1:0/api/mf-manifest.json",
+      source: "remote",
+      proxy: "http://127.0.0.1:9",
+    },
+    plugins: {},
+  } as const;
+}
+
+async function startStaticServer(routes: Record<string, { body: string; contentType?: string }>) {
+  const port = await getAvailablePort();
+  const server = createServer((req, res) => {
+    const route = routes[req.url ?? ""];
+    if (!route) {
+      res.statusCode = 404;
+      res.end("not found");
+      return;
+    }
+    res.statusCode = 200;
+    res.setHeader("content-type", route.contentType ?? "text/plain");
+    res.end(route.body);
+  });
+
+  await new Promise<void>((resolve, reject) => {
+    server.on("error", reject);
+    server.listen(port, "127.0.0.1", () => resolve());
+  });
+
+  return {
+    baseUrl: `http://127.0.0.1:${port}`,
+    stop: async () => {
+      await new Promise<void>((resolve, reject) => {
+        server.close((error) => (error ? reject(error) : resolve()));
+      });
+    },
+  };
+}
+
+describe("SSR fallback paths", () => {
+  let assetServer: Awaited<ReturnType<typeof startStaticServer>>;
+  let handle: ReturnType<typeof runServer>;
+  let baseUrl: string;
+  const envSnapshot = { ...process.env };
+
+  beforeAll(async () => {
+    assetServer = await startStaticServer({});
+
+    const port = await getAvailablePort();
+    baseUrl = `http://127.0.0.1:${port}`;
+    process.env.NODE_ENV = "production";
+    process.env.HOST = "127.0.0.1";
+    process.env.PORT = String(port);
+    process.env.CSP_STRICT = "false";
+
+    const config = createBaseConfig(`${assetServer.baseUrl}/ui-ssr`);
+    handle = runServer({
+      config: {
+        ...config,
+        host: { ...config.host, url: baseUrl, entry: `${baseUrl}/mf-manifest.json` },
+        ui: {
+          ...config.ui,
+          url: `${assetServer.baseUrl}/ui`,
+          entry: `${assetServer.baseUrl}/ui/mf-manifest.json`,
+          ssrUrl: `${assetServer.baseUrl}/ui-ssr`,
+        },
+        api: { ...config.api, proxy: assetServer.baseUrl },
+      } as any,
+    });
+
+    await handle.ready;
+  });
+
+  afterAll(async () => {
+    await handle?.shutdown();
+    await assetServer?.stop();
+    process.env = { ...envSnapshot };
+  });
+
+  beforeEach(() => {
+    loadRouterModuleMock.mockReset();
+    resolveRequestRuntimeMock.mockReset();
+
+    resolveRequestRuntimeMock.mockResolvedValue({
+      tenantAccountId: null,
+      gatewayId: "linktree.com",
+      ssrAllowed: true,
+      config: createBaseConfig(`${assetServer.baseUrl}/ui-ssr`),
+    });
+  });
+
+  describe("loadRouterModule fails with FederationError", () => {
+    it("falls back to client shell with SSR unavailable message", async () => {
+      const federationError = new FederationError({
+        remoteName: "ui",
+        remoteUrl: `${assetServer.baseUrl}/ui-ssr`,
+        cause: new Error("An error has occurred"),
+      });
+
+      loadRouterModuleMock.mockReturnValue(
+        Effect.gen(function* () {
+          return yield* Effect.fail(federationError);
+        }),
+      );
+
+      const response = await fetch(`${baseUrl}/`);
+      const html = await response.text();
+
+      expect(response.status).toBe(200);
+      expect(html).toContain("SSR unavailable");
+      expect(html).toContain("remoteEntry.js");
+      expect(html).toContain("window.__RUNTIME_CONFIG__");
+    });
+
+    it("includes the FederationError cause message in the client shell fallback", async () => {
+      const federationError = new FederationError({
+        remoteName: "ui",
+        remoteUrl: `${assetServer.baseUrl}/ui-ssr`,
+        cause: new Error("Module not found: ui/Router"),
+      });
+
+      loadRouterModuleMock.mockReturnValue(
+        Effect.gen(function* () {
+          return yield* Effect.fail(federationError);
+        }),
+      );
+
+      const response = await fetch(`${baseUrl}/`);
+      const html = await response.text();
+
+      expect(response.status).toBe(200);
+      expect(html).toContain("SSR unavailable");
+
+      const errorParagraphMatch = html.match(
+        /<p class="error">SSR unavailable, showing client app\.<\/p><p>(.*?)<\/p>/,
+      );
+      expect(errorParagraphMatch).not.toBeNull();
+      expect(errorParagraphMatch![1].length).toBeGreaterThan(0);
+    });
+
+    it("preserves FederationError context for logging", async () => {
+      const cause = new Error("An error has occurred");
+      const federationError = new FederationError({
+        remoteName: "ui",
+        remoteUrl: `${assetServer.baseUrl}/ui-ssr`,
+        cause,
+      });
+
+      loadRouterModuleMock.mockReturnValue(
+        Effect.gen(function* () {
+          return yield* Effect.fail(federationError);
+        }),
+      );
+
+      await fetch(`${baseUrl}/`);
+
+      expect(loadRouterModuleMock).toHaveBeenCalled();
+    });
+  });
+
+  describe("SSR URL not configured", () => {
+    it("renders client shell without attempting SSR", async () => {
+      resolveRequestRuntimeMock.mockResolvedValue({
+        tenantAccountId: null,
+        gatewayId: "linktree.com",
+        ssrAllowed: false,
+        config: createBaseConfig(undefined),
+      });
+
+      const response = await fetch(`${baseUrl}/`);
+      const html = await response.text();
+
+      expect(response.status).toBe(200);
+      expect(html).toContain("Loading...");
+      expect(html).toContain("remoteEntry.js");
+      expect(loadRouterModuleMock).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("renderToStream throws", () => {
+    it("returns 500 error page", async () => {
+      const failingModule = {
+        renderToStream: vi.fn().mockRejectedValue(new Error("React render error")),
+        getRouteHead: vi.fn(),
+        createRouter: vi.fn(),
+      };
+
+      loadRouterModuleMock.mockReturnValue(
+        Effect.gen(function* () {
+          return failingModule;
+        }),
+      );
+
+      const response = await fetch(`${baseUrl}/`);
+      const html = await response.text();
+
+      expect(response.status).toBe(500);
+      expect(html).toContain("Server Error");
+      expect(html).toContain("React render error");
+    });
+  });
+
+  describe("SSR succeeds after previous failure", () => {
+    it("recovers from a transient FederationError on the next request", async () => {
+      const federationError = new FederationError({
+        remoteName: "ui",
+        remoteUrl: `${assetServer.baseUrl}/ui-ssr`,
+        cause: new Error("Transient network error"),
+      });
+
+      loadRouterModuleMock.mockReturnValueOnce(
+        Effect.gen(function* () {
+          return yield* Effect.fail(federationError);
+        }),
+      );
+
+      const firstResponse = await fetch(`${baseUrl}/`);
+      const firstHtml = await firstResponse.text();
+      expect(firstResponse.status).toBe(200);
+      expect(firstHtml).toContain("SSR unavailable");
+
+      const stream = new ReadableStream({
+        start(controller) {
+          controller.enqueue(
+            new TextEncoder().encode(
+              '<!DOCTYPE html><html><head><title>SSR Page</title></head><body><div id="root">SSR Content</div></body></html>',
+            ),
+          );
+          controller.close();
+        },
+      });
+
+      const successModule = {
+        renderToStream: vi.fn().mockResolvedValue({
+          stream,
+          statusCode: 200,
+          headers: new Headers(),
+        }),
+        getRouteHead: vi.fn(),
+        createRouter: vi.fn(),
+      };
+
+      loadRouterModuleMock.mockReturnValueOnce(
+        Effect.gen(function* () {
+          return successModule;
+        }),
+      );
+
+      const secondResponse = await fetch(`${baseUrl}/`);
+      expect(secondResponse.status).toBe(200);
+    });
+  });
+
+  describe("FederationError message propagation bug", () => {
+    it("FederationError.message is empty when passed through Effect.either", async () => {
+      const federationError = new FederationError({
+        remoteName: "ui",
+        remoteUrl: `${assetServer.baseUrl}/ui-ssr`,
+        cause: new Error("An error has occurred"),
+      });
+
+      expect(federationError._tag).toBe("FederationError");
+      expect(federationError.remoteName).toBe("ui");
+      expect(federationError.cause).toBeDefined();
+
+      const result = await Effect.runPromise(
+        Effect.fail(federationError).pipe(Effect.either),
+      );
+
+      expect(result._tag).toBe("Left");
+      if (result._tag !== "Left") throw new Error("Expected Left");
+      const leftError = result.left as InstanceType<typeof FederationError>;
+      expect(leftError._tag).toBe("FederationError");
+
+      expect(leftError.message.length).toBeGreaterThan(0);
+    });
+  });
+});
diff --git a/host/tests/integration/ssr-federation-error.test.ts b/host/tests/integration/ssr-federation-error.test.ts
new file mode 100644
index 00000000..00cdedb0
--- /dev/null
+++ b/host/tests/integration/ssr-federation-error.test.ts
@@ -0,0 +1,240 @@
+import { Effect } from "every-plugin/effect";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import type { RuntimeConfig } from "../../src/services/config";
+
+const loadRemoteMock = vi.fn();
+const createInstanceMock = vi.fn(() => ({
+  loadRemote: loadRemoteMock,
+}));
+const verifySriForUrlMock = vi.fn();
+
+vi.mock("@module-federation/enhanced/runtime", () => ({
+  createInstance: createInstanceMock,
+}));
+
+vi.mock("everything-dev/integrity", () => ({
+  verifySriForUrl: verifySriForUrlMock,
+}));
+
+const { loadRouterModule, resetFederationInstance } = await import(
+  "../../src/services/federation.server"
+);
+
+const { FederationError } = await import("../../src/services/errors");
+
+function createRemoteConfig(options?: {
+  ssrUrl?: string;
+  ssrIntegrity?: string;
+}): RuntimeConfig {
+  return {
+    env: "production",
+    account: "linktree.near",
+    networkId: "mainnet",
+    host: {
+      name: "host",
+      url: "https://linktree.com",
+      entry: "https://linktree.com/mf-manifest.json",
+      source: "remote",
+    },
+    ui: {
+      name: "ui",
+      url: "https://cdn.example.com/ui",
+      entry: "https://cdn.example.com/ui/mf-manifest.json",
+      source: "remote",
+      integrity: "sha384-ui",
+      ssrUrl: options?.ssrUrl ?? "https://cdn.example.com/ui-ssr",
+      ssrIntegrity: options?.ssrIntegrity ?? "sha384-ssr-a",
+    },
+    api: {
+      name: "api",
+      url: "https://api.example.com",
+      entry: "https://api.example.com/mf-manifest.json",
+      source: "remote",
+    },
+  } as RuntimeConfig;
+}
+
+describe("loadRouterModule failure paths", () => {
+  beforeEach(() => {
+    resetFederationInstance();
+    vi.clearAllMocks();
+    verifySriForUrlMock.mockResolvedValue(undefined);
+  });
+
+  describe("loadRemote returns null", () => {
+    it("raises FederationError with Module not found message", async () => {
+      loadRemoteMock.mockResolvedValue(null);
+
+      const result = await Effect.runPromise(
+        loadRouterModule(createRemoteConfig()).pipe(Effect.either),
+      );
+
+      expect(result._tag).toBe("Left");
+      if (result._tag !== "Left") throw new Error("Expected Left");
+      const error = result.left as InstanceType<typeof FederationError>;
+      expect(error._tag).toBe("FederationError");
+      expect(error.remoteName).toBe("ui");
+      expect(String(error.cause)).toContain("Module not found: ui/Router");
+    });
+  });
+
+  describe("loadRemote throws a Module Federation runtime error", () => {
+    it("wraps the MF error in FederationError", async () => {
+      const mfError = new Error("An error has occurred");
+      mfError.name = "FederationError";
+      loadRemoteMock.mockRejectedValue(mfError);
+
+      const result = await Effect.runPromise(
+        loadRouterModule(createRemoteConfig()).pipe(Effect.either),
+      );
+
+      expect(result._tag).toBe("Left");
+      if (result._tag !== "Left") throw new Error("Expected Left");
+      const error = result.left as InstanceType<typeof FederationError>;
+      expect(error._tag).toBe("FederationError");
+      expect(error.remoteName).toBe("ui");
+      expect(error.cause).toBeDefined();
+      expect(String(error.cause)).toContain("An error has occurred");
+    });
+  });
+
+  describe("SRI verification fails", () => {
+    it("raises FederationError wrapping the integrity error", async () => {
+      const integrityError = new Error("SRI hash mismatch: expected sha384-abc, got sha384-xyz");
+      verifySriForUrlMock.mockRejectedValue(integrityError);
+
+      const result = await Effect.runPromise(
+        loadRouterModule(createRemoteConfig()).pipe(Effect.either),
+      );
+
+      expect(result._tag).toBe("Left");
+      if (result._tag !== "Left") throw new Error("Expected Left");
+      const error = result.left as InstanceType<typeof FederationError>;
+      expect(error._tag).toBe("FederationError");
+      expect(error.remoteUrl).toBe("https://cdn.example.com/ui-ssr");
+    });
+  });
+
+  describe("SSR URL missing in production", () => {
+    it("raises error when ssrUrl is not configured", async () => {
+      const config = createRemoteConfig({ ssrUrl: undefined });
+
+      const result = await Effect.runPromise(
+        loadRouterModule(config).pipe(Effect.either),
+      );
+
+      expect(result._tag).toBe("Left");
+    });
+  });
+
+  describe("retry succeeds after initial failures", () => {
+    it("retries up to 5 times and succeeds on the third attempt", async () => {
+      const routerModule = {
+        default: { renderToStream: vi.fn(), getRouteHead: vi.fn(), createRouter: vi.fn() },
+      };
+
+      loadRemoteMock
+        .mockRejectedValueOnce(new Error("Network error"))
+        .mockRejectedValueOnce(new Error("Timeout"))
+        .mockResolvedValue(routerModule);
+
+      const result = await Effect.runPromise(loadRouterModule(createRemoteConfig()));
+
+      expect(result).toBe(routerModule.default);
+      expect(createInstanceMock).toHaveBeenCalledTimes(3);
+    });
+  });
+
+  describe("retry exhausts all 5 attempts", () => {
+    it("raises FederationError after all retries fail", async () => {
+      loadRemoteMock.mockRejectedValue(new Error("Persistent failure"));
+
+      const result = await Effect.runPromise(
+        loadRouterModule(createRemoteConfig()).pipe(Effect.either),
+      );
+
+      expect(result._tag).toBe("Left");
+      if (result._tag !== "Left") throw new Error("Expected Left");
+      const error = result.left as InstanceType<typeof FederationError>;
+      expect(error._tag).toBe("FederationError");
+      expect(createInstanceMock).toHaveBeenCalledTimes(6);
+    });
+  });
+
+  describe("cache evicts on failure", () => {
+    it("removes the cache entry when the load promise rejects", { timeout: 30000 }, async () => {
+      const config = createRemoteConfig();
+
+      loadRemoteMock.mockRejectedValue(new Error("Load failed"));
+
+      const result = await Effect.runPromise(
+        loadRouterModule(config).pipe(Effect.either),
+      );
+      expect(result._tag).toBe("Left");
+
+      loadRemoteMock.mockRejectedValue(new Error("Still failing"));
+      const secondResult = await Effect.runPromise(
+        loadRouterModule(config).pipe(Effect.either),
+      );
+      expect(secondResult._tag).toBe("Left");
+
+      expect(createInstanceMock.mock.calls.length).toBeGreaterThanOrEqual(2);
+    });
+
+    it("recovers after cache eviction on a subsequent request", { timeout: 30000 }, async () => {
+      const config = createRemoteConfig();
+
+      loadRemoteMock.mockRejectedValue(new Error("Load failed"));
+
+      const firstResult = await Effect.runPromise(
+        loadRouterModule(config).pipe(Effect.either),
+      );
+      expect(firstResult._tag).toBe("Left");
+
+      const routerModule = {
+        default: { renderToStream: vi.fn(), getRouteHead: vi.fn(), createRouter: vi.fn() },
+      };
+      loadRemoteMock.mockResolvedValue(routerModule);
+
+      const secondResult = await Effect.runPromise(loadRouterModule(config));
+      expect(secondResult).toBe(routerModule.default);
+    });
+  });
+
+  describe("FederationError structure matches production error", () => {
+    it("includes remoteName and remoteUrl in the error", async () => {
+      loadRemoteMock.mockResolvedValue(null);
+
+      const result = await Effect.runPromise(
+        loadRouterModule(createRemoteConfig()).pipe(Effect.either),
+      );
+
+      expect(result._tag).toBe("Left");
+      if (result._tag !== "Left") throw new Error("Expected Left");
+      const error = result.left as InstanceType<typeof FederationError>;
+      expect(error).toHaveProperty("remoteName", "ui");
+      expect(error).toHaveProperty("remoteUrl", "https://cdn.example.com/ui-ssr");
+    });
+
+    it("cause contains the original MF error that matches the stack trace pattern", async () => {
+      const mfError = new Error("An error has occurred");
+      mfError.stack = [
+        "Error: An error has occurred",
+        "    at catch (file:///remoteEntry.js:286:77)",
+        "    at effect_internal_function (/app/node_modules/effect/dist/esm/Utils.js:339:14)",
+      ].join("\n");
+      loadRemoteMock.mockRejectedValue(mfError);
+
+      const result = await Effect.runPromise(
+        loadRouterModule(createRemoteConfig()).pipe(Effect.either),
+      );
+
+      expect(result._tag).toBe("Left");
+      if (result._tag !== "Left") throw new Error("Expected Left");
+      const error = result.left as InstanceType<typeof FederationError>;
+      expect(error.cause).toBeDefined();
+      const causeStr = String(error.cause);
+      expect(causeStr).toContain("remoteEntry.js");
+    });
+  });
+});
diff --git a/host/tests/integration/ssr.test.ts b/host/tests/integration/ssr.test.ts
index 7503a1c3..4a57f4fe 100644
--- a/host/tests/integration/ssr.test.ts
+++ b/host/tests/integration/ssr.test.ts
@@ -1,6 +1,4 @@
-import { Effect } from "every-plugin/effect";
-import { beforeAll, describe, expect, it } from "vitest";
-import { loadRouterModule } from "@/services/federation.server";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
 import type { RouterModule, RuntimeConfig } from "@/types";
 import { createTestApiClient } from "../helpers/api-client";
 import {
@@ -9,6 +7,7 @@ import {
   createMockAuthClient,
   loadTestRuntimeConfig,
 } from "../helpers/runtime-config";
+import { loadBundledRouterModule } from "../helpers/bundled-ssr-module";
 
 async function consumeStream(stream: ReadableStream): Promise<string> {
   const reader = stream.getReader();
@@ -29,10 +28,17 @@ const mockAuthClient = createMockAuthClient();
 describe("SSR Stream Lifecycle", () => {
   let routerModule: RouterModule;
   let config: RuntimeConfig;
+  let cleanup: () => Promise<void>;
 
   beforeAll(async () => {
     config = await loadTestRuntimeConfig();
-    routerModule = await Effect.runPromise(loadRouterModule(config));
+    const bundled = await loadBundledRouterModule();
+    routerModule = bundled.routerModule;
+    cleanup = bundled.cleanup;
+  });
+
+  afterAll(async () => {
+    await cleanup();
   });
 
   describe("Stream Completion", () => {
@@ -47,8 +53,6 @@ describe("SSR Stream Lifecycle", () => {
       expect(head.meta).toBeDefined();
       expect(elapsed).toBeLessThan(5000);
     });
-
-    // NOTE: Authenticated routes are configured with `ssr: false` in the demo UI.
   });
 
   describe("SSR Configuration", () => {
@@ -58,8 +62,6 @@ describe("SSR Stream Lifecycle", () => {
       const titleMeta = head.meta.find((m) => m && typeof m === "object" && "title" in m);
       expect(titleMeta).toBeDefined();
     });
-
-    // NOTE: Auth routes behavior depends on auth strategy.
   });
 
   describe("SSR Routes", () => {
@@ -105,7 +107,5 @@ describe("SSR Stream Lifecycle", () => {
       expect(html).toContain("<!DOCTYPE html>");
       expect(html).toContain("</html>");
     });
-
-    // NOTE: Product routes are not part of the current demo UI.
   });
 });
diff --git a/host/tests/integration/tenant-runtime.test.ts b/host/tests/integration/tenant-runtime.test.ts
index 95cb534f..34e41d51 100644
--- a/host/tests/integration/tenant-runtime.test.ts
+++ b/host/tests/integration/tenant-runtime.test.ts
@@ -331,6 +331,132 @@ describe("resolveRequestRuntime", () => {
     expect(result.config.ui.ssrIntegrity).toBeUndefined();
   });
 
+  it("disables SSR for whitelisted tenants when ssrIntegrity is missing", async () => {
+    const baseConfig = createBaseRuntimeConfig();
+
+    loadRemoteConfigMock.mockResolvedValue({
+      source: "bos://alice.linktree.near/linktree.com",
+      rawConfig: {
+        extends: "bos://linktree.near/linktree.com",
+      },
+      config: {
+        account: "alice.linktree.near",
+        app: {
+          host: { development: "local:host", production: "https://host.example.com" },
+          ui: { name: "ui", production: "https://cdn.example.com/alice-ui", ssr: "https://cdn.example.com/alice-ui-ssr" },
+          api: { name: "api", production: "https://api.example.com" },
+        },
+      },
+      extendsChain: ["bos://alice.linktree.near/linktree.com", "bos://linktree.near/linktree.com"],
+    });
+
+    buildRuntimeConfigMock.mockReturnValue({
+      ...baseConfig,
+      account: "alice.linktree.near",
+      ui: {
+        name: "ui",
+        url: "https://cdn.example.com/alice-ui",
+        entry: "https://cdn.example.com/alice-ui/mf-manifest.json",
+        source: "remote",
+        integrity: "sha384-alice",
+        ssrUrl: "https://cdn.example.com/alice-ui-ssr",
+      },
+    });
+
+    const result = await resolveRequestRuntime(
+      baseConfig,
+      new Request("https://alice.linktree.com/"),
+    );
+
+    expect(result.ssrAllowed).toBe(false);
+    expect(result.config.ui.ssrUrl).toBeUndefined();
+    expect(result.config.ui.ssrIntegrity).toBeUndefined();
+  });
+
+  it("disables SSR for whitelisted tenants when ssrUrl is missing", async () => {
+    const baseConfig = createBaseRuntimeConfig();
+
+    loadRemoteConfigMock.mockResolvedValue({
+      source: "bos://alice.linktree.near/linktree.com",
+      rawConfig: {
+        extends: "bos://linktree.near/linktree.com",
+      },
+      config: {
+        account: "alice.linktree.near",
+        app: {
+          host: { development: "local:host", production: "https://host.example.com" },
+          ui: { name: "ui", production: "https://cdn.example.com/alice-ui" },
+          api: { name: "api", production: "https://api.example.com" },
+        },
+      },
+      extendsChain: ["bos://alice.linktree.near/linktree.com", "bos://linktree.near/linktree.com"],
+    });
+
+    buildRuntimeConfigMock.mockReturnValue({
+      ...baseConfig,
+      account: "alice.linktree.near",
+      ui: {
+        name: "ui",
+        url: "https://cdn.example.com/alice-ui",
+        entry: "https://cdn.example.com/alice-ui/mf-manifest.json",
+        source: "remote",
+        integrity: "sha384-alice",
+      },
+    });
+
+    const result = await resolveRequestRuntime(
+      baseConfig,
+      new Request("https://alice.linktree.com/"),
+    );
+
+    expect(result.ssrAllowed).toBe(false);
+    expect(result.config.ui.ssrUrl).toBeUndefined();
+    expect(result.config.ui.ssrIntegrity).toBeUndefined();
+  });
+
+  it("allows SSR for whitelisted tenants when both ssrUrl and ssrIntegrity are present", async () => {
+    const baseConfig = createBaseRuntimeConfig();
+
+    loadRemoteConfigMock.mockResolvedValue({
+      source: "bos://alice.linktree.near/linktree.com",
+      rawConfig: {
+        extends: "bos://linktree.near/linktree.com",
+      },
+      config: {
+        account: "alice.linktree.near",
+        app: {
+          host: { development: "local:host", production: "https://host.example.com" },
+          ui: { name: "ui", production: "https://cdn.example.com/alice-ui", ssr: "https://cdn.example.com/alice-ui-ssr", ssrIntegrity: "sha384-alice-ssr" },
+          api: { name: "api", production: "https://api.example.com" },
+        },
+      },
+      extendsChain: ["bos://alice.linktree.near/linktree.com", "bos://linktree.near/linktree.com"],
+    });
+
+    buildRuntimeConfigMock.mockReturnValue({
+      ...baseConfig,
+      account: "alice.linktree.near",
+      ui: {
+        name: "ui",
+        url: "https://cdn.example.com/alice-ui",
+        entry: "https://cdn.example.com/alice-ui/mf-manifest.json",
+        source: "remote",
+        integrity: "sha384-alice",
+        ssrUrl: "https://cdn.example.com/alice-ui-ssr",
+        ssrIntegrity: "sha384-alice-ssr",
+      },
+    });
+
+    const result = await resolveRequestRuntime(
+      baseConfig,
+      new Request("https://alice.linktree.com/"),
+    );
+
+    expect(result.ssrAllowed).toBe(true);
+    expect(result.config.ui.ssrUrl).toBe("https://cdn.example.com/alice-ui-ssr");
+    expect(result.config.ui.ssrIntegrity).toBe("sha384-alice-ssr");
+  });
+
   it("applies existing plugin UI and sidebar overrides when plugins are allowed", async () => {
     const baseConfig = createBaseRuntimeConfig();
     process.env.ALLOW_OVERRIDE = "ui,plugins.*";
diff --git a/host/tests/integration/ui-public-assets.test.ts b/host/tests/integration/ui-public-assets.test.ts
new file mode 100644
index 00000000..a19f2b6c
--- /dev/null
+++ b/host/tests/integration/ui-public-assets.test.ts
@@ -0,0 +1,184 @@
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { runServer } from "../../src/program";
+import type { RuntimeConfig } from "../../src/services/config";
+import { startJsonProxyTarget } from "../helpers/json-proxy-target";
+import { getAvailablePort } from "../helpers/ports";
+import { startStaticDistServer } from "../helpers/static-dist-server";
+import { loadHostTestEnv } from "../helpers/test-env";
+
+const workspaceRoot = path.resolve(import.meta.dirname, "../../..");
+const uiPublicDir = path.join(workspaceRoot, "ui", "public");
+const uiDistDir = path.join(workspaceRoot, "ui", "dist");
+
+loadHostTestEnv(workspaceRoot);
+
+function buildUiProxyConfig(
+  uiAssetsUrl: string,
+  apiProxyUrl: string,
+  hostUrl: string,
+): RuntimeConfig {
+  return {
+    env: "development",
+    account: "dev.everything.near",
+    title: "everything.dev",
+    repository: "https://github.com/nearbuilders/everything-dev",
+    host: {
+      name: "host",
+      url: hostUrl,
+      entry: `${hostUrl}/mf-manifest.json`,
+      source: "remote",
+    },
+    ui: {
+      name: "ui",
+      url: uiAssetsUrl,
+      entry: `${uiAssetsUrl}/mf-manifest.json`,
+      source: "remote",
+    },
+    api: {
+      name: "api",
+      url: apiProxyUrl,
+      entry: `${apiProxyUrl}/mf-manifest.json`,
+      source: "remote",
+      proxy: apiProxyUrl,
+    },
+  } as RuntimeConfig;
+}
+
+describe("UI public asset proxying through host", () => {
+  let uiServer: Awaited<ReturnType<typeof startStaticDistServer>>;
+  let apiProxy: Awaited<ReturnType<typeof startJsonProxyTarget>>;
+  let hostHandle: ReturnType<typeof runServer>;
+  let baseUrl: string;
+  const envSnapshot = { ...process.env };
+
+  beforeAll(async () => {
+    if (!existsSync(uiPublicDir)) {
+      throw new Error(`ui/public/ not found at ${uiPublicDir} — run UI build first`);
+    }
+
+    uiServer = await startStaticDistServer(uiDistDir);
+    apiProxy = await startJsonProxyTarget();
+
+    const hostPort = await getAvailablePort();
+    baseUrl = `http://127.0.0.1:${hostPort}`;
+    process.env.NODE_ENV = "development";
+    process.env.HOST = "127.0.0.1";
+    process.env.PORT = String(hostPort);
+    process.env.CSP_STRICT = "false";
+
+    const config = buildUiProxyConfig(uiServer.baseUrl, apiProxy.baseUrl, baseUrl);
+    hostHandle = runServer({ config });
+    await hostHandle.ready;
+  }, 30000);
+
+  afterAll(async () => {
+    await hostHandle?.shutdown();
+    await uiServer?.stop();
+    await apiProxy?.stop();
+    process.env = { ...envSnapshot };
+  });
+
+  describe("text assets from ui/public", () => {
+    it("proxies /skill.md from UI dist", async () => {
+      const response = await fetch(`${baseUrl}/skill.md`);
+
+      expect(response.status).toBe(200);
+      const text = await response.text();
+      expect(text.length).toBeGreaterThan(0);
+    });
+
+    it("proxies /llms.txt from UI dist", async () => {
+      const response = await fetch(`${baseUrl}/llms.txt`);
+
+      expect(response.status).toBe(200);
+      const text = await response.text();
+      expect(text.length).toBeGreaterThan(0);
+    });
+
+    it("proxies /robots.txt from UI dist", async () => {
+      const response = await fetch(`${baseUrl}/robots.txt`);
+
+      expect(response.status).toBe(200);
+      const text = await response.text();
+      expect(text.length).toBeGreaterThan(0);
+    });
+
+    it("proxies /README.md from UI dist", async () => {
+      const response = await fetch(`${baseUrl}/README.md`);
+
+      expect(response.status).toBe(200);
+      const text = await response.text();
+      expect(text.length).toBeGreaterThan(0);
+    });
+  });
+
+  describe("binary assets from ui/public", () => {
+    it("proxies /favicon.ico from UI dist", async () => {
+      const response = await fetch(`${baseUrl}/favicon.ico`);
+
+      expect(response.status).toBe(200);
+      const buf = await response.arrayBuffer();
+      expect(buf.byteLength).toBeGreaterThan(0);
+    });
+
+    it("proxies /icon.svg from UI dist", async () => {
+      const response = await fetch(`${baseUrl}/icon.svg`);
+
+      expect(response.status).toBe(200);
+      const text = await response.text();
+      expect(text).toContain("<svg");
+    });
+
+    it("proxies /manifest.json from UI dist", async () => {
+      const response = await fetch(`${baseUrl}/manifest.json`);
+
+      expect(response.status).toBe(200);
+      const json = await response.json();
+      expect(json).toHaveProperty("name");
+    });
+  });
+
+  describe("non-asset paths are not proxied", () => {
+    it("/ (root) renders client shell, not proxied", async () => {
+      const response = await fetch(`${baseUrl}/`);
+
+      expect(response.status).toBe(200);
+      const html = await response.text();
+      expect(html).toContain("window.__RUNTIME_CONFIG__");
+      expect(html).toContain("remoteEntry.js");
+    });
+
+    it("/health is handled by host directly", async () => {
+      const response = await fetch(`${baseUrl}/health`);
+
+      expect(response.status).toBe(200);
+      expect(await response.text()).toBe("OK");
+    });
+
+    it("/api/ping is routed to API proxy, not UI proxy", async () => {
+      const response = await fetch(`${baseUrl}/api/ping`);
+      const json = (await response.json()) as Record<string, unknown>;
+
+      expect(response.status).toBe(200);
+      expect(json).toMatchObject({ status: "ok" });
+    });
+
+    it("paths without file extensions are not proxied to UI", async () => {
+      const response = await fetch(`${baseUrl}/nonexistent-page`);
+
+      expect(response.status).toBe(200);
+      const html = await response.text();
+      expect(html).toContain("window.__RUNTIME_CONFIG__");
+    });
+  });
+
+  describe("missing UI assets return 404", () => {
+    it("returns 404 for a file extension path that does not exist in UI dist", async () => {
+      const response = await fetch(`${baseUrl}/nonexistent-file.css`);
+
+      expect(response.status).toBe(404);
+    });
+  });
+});
diff --git a/packages/everything-dev/src/cli.ts b/packages/everything-dev/src/cli.ts
index cda98574..d6eefd0e 100644
--- a/packages/everything-dev/src/cli.ts
+++ b/packages/everything-dev/src/cli.ts
@@ -761,6 +761,53 @@ async function main() {
         return;
       }
     }
+
+    if (descriptor.key === "deploy") {
+      const deployResult = result as any;
+      if (deployResult.status === "dry-run") {
+        console.log();
+        console.log(colors.cyan(`${icons.ok} Dry run complete`));
+        console.log(`  ${colors.dim("Registry URL:")} ${deployResult.registryUrl}`);
+        console.log();
+        return;
+      }
+
+      if (deployResult.status === "deployed") {
+        console.log();
+        console.log(colors.green(`${icons.ok} Deployed successfully`));
+        console.log(`  ${colors.dim("Registry URL:")} ${deployResult.registryUrl}`);
+        if (deployResult.txHash) {
+          console.log(`  ${colors.dim("Transaction:")} ${deployResult.txHash}`);
+        }
+        if (deployResult.built && deployResult.built.length > 0) {
+          console.log(`  ${colors.dim("Built:")} ${deployResult.built.join(", ")}`);
+        }
+        if (deployResult.skipped && deployResult.skipped.length > 0) {
+          console.log(`  ${colors.dim("Skipped:")} ${deployResult.skipped.join(", ")}`);
+        }
+        if (deployResult.redeployed) {
+          console.log(`  ${colors.dim("Railway:")} redeployed ${deployResult.service ?? "service"}`);
+        } else if (!process.env.RAILWAY_TOKEN) {
+          console.log(`  ${colors.yellow("Railway:")} skipped (RAILWAY_TOKEN not set)`);
+        }
+        console.log();
+        return;
+      }
+
+      if (deployResult.status === "published") {
+        console.log();
+        console.log(colors.yellow(`${icons.err} Config published, but Railway redeploy failed`));
+        console.log(`  ${colors.dim("Registry URL:")} ${deployResult.registryUrl}`);
+        if (deployResult.txHash) {
+          console.log(`  ${colors.dim("Transaction:")} ${deployResult.txHash}`);
+        }
+        if (deployResult.error) {
+          console.log(`  ${colors.dim("Railway:")} ${deployResult.error}`);
+        }
+        console.log();
+        process.exit(1);
+      }
+    }
   } catch (error) {
     console.error(`[CLI] ${error instanceof Error ? error.message : String(error)}`);
     process.exit(1);
diff --git a/packages/everything-dev/src/cli/init.ts b/packages/everything-dev/src/cli/init.ts
index c368f50e..1e174271 100644
--- a/packages/everything-dev/src/cli/init.ts
+++ b/packages/everything-dev/src/cli/init.ts
@@ -37,6 +37,7 @@ export const INIT_ROOT_PATTERNS = [
   "bunfig.toml",
   "Dockerfile",
   "railway.json",
+  "railway.toml",
   "AGENTS.md",
   ".changeset/config.json",
   ".changeset/README.md",
diff --git a/packages/everything-dev/src/cli/sync.ts b/packages/everything-dev/src/cli/sync.ts
index d97c5386..d12c5fa9 100644
--- a/packages/everything-dev/src/cli/sync.ts
+++ b/packages/everything-dev/src/cli/sync.ts
@@ -25,7 +25,9 @@ const FRAMEWORK_OWNED_SYNC_FILES = new Set([
   ".changeset/config.json",
   ".changeset/README.md",
   ".github/workflows/ci.yml",
-  ".github/workflows/publish.yml",
+  ".github/workflows/deploy.yml",
+  ".github/workflows/staging.yml",
+  "railway.toml",
   "ui/package.json",
   "ui/postcss.config.mjs",
   "ui/rsbuild.config.ts",
diff --git a/packages/everything-dev/src/cli/upgrade.ts b/packages/everything-dev/src/cli/upgrade.ts
index 966d523b..a80c0c5c 100644
--- a/packages/everything-dev/src/cli/upgrade.ts
+++ b/packages/everything-dev/src/cli/upgrade.ts
@@ -49,9 +49,9 @@ const OBSOLETE_FILES = [
   ".github/templates/dependabot.yml",
   ".github/renovate.json",
   ".github/workflows/packages-release.yml",
+  ".github/workflows/publish.yml",
   ".github/workflows/release.yml",
   ".github/workflows/release-sync.yml",
-  ".github/workflows/staging.yml",
   "packages/everything-dev/cli.js",
   ".templatekeep",
   ".templatesync-exclude",
diff --git a/packages/everything-dev/src/contract.meta.ts b/packages/everything-dev/src/contract.meta.ts
index 826b4a84..104d4742 100644
--- a/packages/everything-dev/src/contract.meta.ts
+++ b/packages/everything-dev/src/contract.meta.ts
@@ -74,6 +74,23 @@ export const cliCommandMeta = {
     commandPath: ["publish"],
     summary: "Publish the current workspace configuration",
     interactive: false,
+    fields: {
+      deploy: { description: "Build and deploy all workspaces before publish" },
+      dryRun: { description: "Preview what would be published without writing" },
+      env: { description: "Environment: production or staging" },
+      network: { description: "NEAR network: mainnet or testnet" },
+    },
+  },
+  deploy: {
+    commandPath: ["deploy"],
+    summary: "Publish config and trigger Railway redeploy",
+    interactive: false,
+    fields: {
+      env: { description: "Environment: production or staging" },
+      build: { description: "Build and deploy workspaces before publish (default: true)" },
+      dryRun: { description: "Preview what would be deployed without writing" },
+      service: { description: "Override Railway service name from config" },
+    },
   },
   keyPublish: {
     commandPath: ["key", "publish"],
diff --git a/packages/everything-dev/src/contract.ts b/packages/everything-dev/src/contract.ts
index b72f04ef..f548b4f6 100644
--- a/packages/everything-dev/src/contract.ts
+++ b/packages/everything-dev/src/contract.ts
@@ -121,6 +121,7 @@ export const PublishOptionsSchema = z.object({
   packages: z.string().default("all"),
   network: z.enum(["mainnet", "testnet"]).optional(),
   privateKey: z.string().optional(),
+  env: z.enum(["production", "staging"]).default("production"),
 });
 
 export const PublishResultSchema = z.object({
@@ -132,6 +133,27 @@ export const PublishResultSchema = z.object({
   skipped: z.array(z.string()).optional(),
 });
 
+export const DeployOptionsSchema = z.object({
+  env: z.enum(["production", "staging"]).default("production"),
+  build: z.boolean().default(true),
+  dryRun: z.boolean().default(false),
+  packages: z.string().default("all"),
+  network: z.enum(["mainnet", "testnet"]).optional(),
+  privateKey: z.string().optional(),
+  service: z.string().optional(),
+});
+
+export const DeployResultSchema = z.object({
+  status: z.enum(["deployed", "published", "error", "dry-run"]),
+  registryUrl: z.string(),
+  txHash: z.string().optional(),
+  built: z.array(z.string()).optional(),
+  skipped: z.array(z.string()).optional(),
+  redeployed: z.boolean(),
+  service: z.string().optional(),
+  error: z.string().optional(),
+});
+
 export const KeyPublishOptionsSchema = z.object({
   allowance: z.string().default("0.25NEAR"),
 });
@@ -290,6 +312,10 @@ export const bosContract = oc.router({
     .route({ method: "POST", path: "/publish" })
     .input(PublishOptionsSchema)
     .output(PublishResultSchema),
+  deploy: oc
+    .route({ method: "POST", path: "/deploy" })
+    .input(DeployOptionsSchema)
+    .output(DeployResultSchema),
   keyPublish: oc
     .route({ method: "POST", path: "/key/publish" })
     .input(KeyPublishOptionsSchema)
@@ -327,6 +353,8 @@ export type PluginListResult = z.infer<typeof PluginListResultSchema>;
 export type PluginPublishOptions = z.infer<typeof PluginPublishOptionsSchema>;
 export type PluginPublishResult = z.infer<typeof PluginPublishResultSchema>;
 export type PublishOptions = z.infer<typeof PublishOptionsSchema>;
+export type DeployOptions = z.infer<typeof DeployOptionsSchema>;
+export type DeployResult = z.infer<typeof DeployResultSchema>;
 export type KeyPublishOptions = z.infer<typeof KeyPublishOptionsSchema>;
 export type KeyPublishResult = z.infer<typeof KeyPublishResultSchema>;
 export type InitOptions = z.infer<typeof InitOptionsSchema>;
diff --git a/packages/everything-dev/src/merge.ts b/packages/everything-dev/src/merge.ts
index 5131f763..b8cb671d 100644
--- a/packages/everything-dev/src/merge.ts
+++ b/packages/everything-dev/src/merge.ts
@@ -10,6 +10,7 @@ export const BOS_CONFIG_ORDER = [
   "testnet",
   "staging",
   "repository",
+  "ci",
   "app",
   "plugins",
   "shared",
diff --git a/packages/everything-dev/src/mf.ts b/packages/everything-dev/src/mf.ts
index 69dea182..8a56b85c 100644
--- a/packages/everything-dev/src/mf.ts
+++ b/packages/everything-dev/src/mf.ts
@@ -21,6 +21,9 @@ export function patchManifestFetchForSsrPublicPath(mf: FederationInstance): void
         json.metaData = json.metaData ?? {};
         json.metaData.ssrPublicPath =
           json.metaData.ssrPublicPath ?? url.replace(/\/mf-manifest\.json$/, "/");
+        if (json.metaData.publicPath === "auto" || json.metaData.publicPath === "") {
+          json.metaData.publicPath = "/";
+        }
         return new Response(JSON.stringify(json), {
           headers: { "content-type": "application/json" },
         });
diff --git a/packages/everything-dev/src/plugin.ts b/packages/everything-dev/src/plugin.ts
index de109b47..5e06b1b8 100644
--- a/packages/everything-dev/src/plugin.ts
+++ b/packages/everything-dev/src/plugin.ts
@@ -435,8 +435,11 @@ async function fetchPublishedConfig(
 ): Promise<BosConfig | null> {
   try {
     return await fetchBosConfigFromFastKv<BosConfig>(`bos://${accountId}/${gatewayId}`);
-  } catch {
-    return null;
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("No config found")) {
+      return null;
+    }
+    throw error;
   }
 }
 
@@ -929,6 +932,7 @@ export default createPlugin({
 
       pluginEvents.emit("progress", { phase: "config", status: "running" } satisfies ProgressEvent);
 
+      const bosEnv = input.env ?? (process.env.BOS_ENV === "staging" ? "staging" : "production");
       const account = input.account ?? process.env.BOS_ACCOUNT;
       const domain = input.domain ?? process.env.BOS_GATEWAY;
 
@@ -936,17 +940,25 @@ export default createPlugin({
       let remoteConfig: BosConfig | null = null;
 
       if (account && domain) {
-        remoteConfig = await fetchPublishedConfig(account, domain);
-        if (remoteConfig) {
-          config = remoteConfig;
-        } else {
-          console.warn(
-            `[Start] Failed to fetch remote config for ${account}/${domain}, falling back to local bos.config.json`,
-          );
+        try {
+          remoteConfig = await fetchPublishedConfig(account, domain);
+          if (remoteConfig) {
+            config = remoteConfig;
+          } else {
+            return {
+              status: "error" as const,
+              url: "",
+              error: `No config found at bos://${account}/${domain}. Verify the account and gateway are correct and the config has been published.\nExpected URL: ${buildRegistryConfigUrl(account, domain)}`,
+            };
+          }
+        } catch (error) {
+          return {
+            status: "error" as const,
+            url: "",
+            error: `Failed to fetch config for bos://${account}/${domain}: ${error instanceof Error ? error.message : "Unknown error"}\nExpected URL: ${buildRegistryConfigUrl(account, domain)}`,
+          };
         }
-      }
-
-      if (!config) {
+      } else {
         config = deps.bosConfig;
       }
 
@@ -954,8 +966,7 @@ export default createPlugin({
         return {
           status: "error" as const,
           url: "",
-          error:
-            "No configuration found. Set BOS_ACCOUNT and BOS_GATEWAY environment variables, or provide a local bos.config.json.",
+          error: "No configuration found. Provide --account and --gateway flags, or create a local bos.config.json.",
         };
       }
 
@@ -968,7 +979,7 @@ export default createPlugin({
       }
 
       const port = input.port ?? getHostDevelopmentPort(config.app.host.development);
-      const isStaging = input.env === "staging";
+      const isStaging = bosEnv === "staging";
       const runtimePlugins = await buildRuntimePluginsForConfig(
         config,
         deps.configDir,
@@ -986,6 +997,14 @@ export default createPlugin({
       drainConfigWarnings();
       resumeWarnings();
 
+      if (isStaging && config.staging?.domain) {
+        runtimeConfig.domain = config.staging.domain;
+      }
+
+      if (isStaging) {
+        runtimeConfig.env = "staging";
+      }
+
       syncGeneratedInfra(deps.configDir, runtimeConfig);
       if (!existsSync(join(deps.configDir, ".env"))) {
         ensureEnvFile(deps.configDir);
@@ -1011,7 +1030,8 @@ export default createPlugin({
 
       // Default CORS_ORIGIN to the configured domain if not set
       if (!process.env.CORS_ORIGIN && config.domain) {
-        const defaultOrigin = `https://${config.domain}`;
+        const effectiveDomain = isStaging ? (config.staging?.domain ?? config.domain) : config.domain;
+        const defaultOrigin = `https://${effectiveDomain}`;
         productionEnv.CORS_ORIGIN = defaultOrigin;
         warnings.push(`CORS_ORIGIN defaulting to ${defaultOrigin}`);
       }
@@ -1020,6 +1040,9 @@ export default createPlugin({
       const requiredSecrets = new Set<string>();
       const missingSecrets: string[] = [];
 
+      if (runtimeConfig.host.secrets) {
+        for (const s of runtimeConfig.host.secrets) requiredSecrets.add(s);
+      }
       if (runtimeConfig.auth?.secrets) {
         for (const s of runtimeConfig.auth.secrets) requiredSecrets.add(s);
       }
@@ -1155,7 +1178,7 @@ export default createPlugin({
       };
     }),
 
-    publish: builder.publish.handler(async ({ input }) => {
+publish: builder.publish.handler(async ({ input }) => {
       if (!deps.bosConfig) {
         return {
           status: "error" as const,
@@ -1164,119 +1187,137 @@ export default createPlugin({
         };
       }
 
-      const account = deps.bosConfig.account;
-      const gateway = deps.bosConfig.domain;
-      if (!gateway) {
+      const result = await publishToFastKv({
+        bosConfig: deps.bosConfig,
+        runtimeConfig: deps.runtimeConfig,
+        configDir: deps.configDir,
+        env: input.env,
+        build: input.deploy,
+        dryRun: input.dryRun,
+        packages: input.packages,
+        network: input.network,
+        privateKey: input.privateKey,
+      });
+
+      if (result.publishConfig) {
+        const refreshed = await loadResolvedConfig({ cwd: deps.configDir });
+        if (refreshed?.config) {
+          deps.bosConfig = refreshed.config;
+          deps.runtimeConfig = refreshed.runtime;
+        }
+      }
+
+      return {
+        status: result.status,
+        registryUrl: result.registryUrl,
+        txHash: result.txHash,
+        error: result.error,
+        built: result.built,
+        skipped: result.skipped,
+      };
+    }),
+
+    deploy: builder.deploy.handler(async ({ input }) => {
+      if (!deps.bosConfig) {
         return {
           status: "error" as const,
           registryUrl: "",
-          error: "bos.config.json must define domain to publish",
+          redeployed: false,
+          error: "No bos.config.json found",
         };
       }
 
-      const network = input.network ?? getNetworkIdForAccount(account);
-      const bosUrl = `bos://${account}/${gateway}`;
-      const registryUrl = buildRegistryConfigUrlForNetwork(network, account, gateway);
-      const targets = selectWorkspaceTargets(input.packages, deps.bosConfig);
+      const result = await publishToFastKv({
+        bosConfig: deps.bosConfig,
+        runtimeConfig: deps.runtimeConfig,
+        configDir: deps.configDir,
+        env: input.env,
+        build: input.build,
+        dryRun: input.dryRun,
+        packages: input.packages,
+        network: input.network,
+        privateKey: input.privateKey,
+      });
 
-      let publishConfig = deps.bosConfig;
-      let built: string[] | undefined;
-      let skipped: string[] | undefined;
+      if (result.status === "error") {
+        return {
+          status: "error" as const,
+          registryUrl: result.registryUrl,
+          txHash: result.txHash,
+          built: result.built,
+          skipped: result.skipped,
+          redeployed: false,
+          error: result.error,
+        };
+      }
 
-      if (input.dryRun) {
+      if (result.status === "dry-run") {
         return {
           status: "dry-run" as const,
-          registryUrl,
-          built,
-          skipped,
+          registryUrl: result.registryUrl,
+          built: result.built,
+          skipped: result.skipped,
+          redeployed: false,
         };
       }
 
-      if (input.deploy) {
-        await generateCodeArtifacts(deps.configDir, deps.bosConfig, {
-          env: "production",
-          runtimeConfig: deps.runtimeConfig ?? undefined,
-        });
-
-        const result = await buildWorkspaceTargets({
-          configDir: deps.configDir,
-          bosConfig: deps.bosConfig,
-          runtimeConfig: deps.runtimeConfig,
-          targets,
-          deploy: true,
-        });
-        built = result.built;
-        skipped = result.skipped;
-
+      if (result.publishConfig) {
         const refreshed = await loadResolvedConfig({ cwd: deps.configDir });
         if (refreshed?.config) {
           deps.bosConfig = refreshed.config;
           deps.runtimeConfig = refreshed.runtime;
-          publishConfig = refreshed.config;
         }
       }
 
-      const registryEntries: Record<string, string> = {
-        [`apps/${account}/${gateway}/bos.config.json`]: JSON.stringify(publishConfig),
-      };
-
-      const payload = JSON.stringify(registryEntries);
-      const argsBase64 = Buffer.from(payload).toString("base64");
-      const privateKey =
-        input.privateKey || process.env.NEAR_PRIVATE_KEY || process.env.BOS_NEAR_PRIVATE_KEY;
+      let redeployed = false;
+      let service: string | undefined;
 
-      try {
-        await Effect.runPromise(ensureNearCli);
-        let txHash: string | undefined;
+      if (process.env.RAILWAY_TOKEN) {
+        const railwayService = input.service ?? deps.bosConfig.ci?.railway?.service;
+        if (!railwayService) {
+          return {
+            status: "published" as const,
+            registryUrl: result.registryUrl,
+            txHash: result.txHash,
+            built: result.built,
+            skipped: result.skipped,
+            redeployed: false,
+            error: "Config published but Railway redeploy failed: ci.railway.service is not configured in bos.config.json",
+          };
+        }
 
+        service = railwayService;
         try {
-          const tx = await Effect.runPromise(
-            executeTransaction({
-              account,
-              contract: getRegistryNamespaceForNetwork(network),
-              method: "__fastdata_kv",
-              argsBase64,
-              network,
-              privateKey,
-              gas: "300Tgas",
-              deposit: "0NEAR",
-            }),
-          );
-          txHash = tx.txHash;
+          await run("railway", ["redeploy", "--service", railwayService, "--yes"]);
+          redeployed = true;
         } catch (error) {
-          txHash = extractTransactionHash(error);
-
-          if (!txHash) {
-            throw error;
-          }
-
-          try {
-            const verifiedConfig = await fetchBosConfigFromFastKv<BosConfig>(bosUrl);
-            if (JSON.stringify(verifiedConfig) !== JSON.stringify(publishConfig)) {
-              throw error;
-            }
-          } catch {
-            // Config may not exist yet on first publish or propagation delay;
-            // a valid txHash is sufficient proof the transaction was submitted.
-          }
+          const message = error instanceof Error ? error.message : String(error);
+          const railError =
+            message.includes("not found") || message.includes("ENOENT")
+              ? "Railway CLI not found. Install it: npm i -g @railway/cli"
+              : `Railway redeploy failed: ${message}`;
+          return {
+            status: "published" as const,
+            registryUrl: result.registryUrl,
+            txHash: result.txHash,
+            built: result.built,
+            skipped: result.skipped,
+            redeployed: false,
+            service,
+            error: `Config published but ${railError}`,
+          };
         }
-
-        return {
-          status: "published" as const,
-          registryUrl,
-          txHash,
-          built,
-          skipped,
-        };
-      } catch (error) {
-        return {
-          status: "error" as const,
-          registryUrl,
-          error: error instanceof Error ? error.message : "Unknown error",
-          built,
-          skipped,
-        };
       }
+
+      return {
+        status: "deployed" as const,
+        registryUrl: result.registryUrl,
+        txHash: result.txHash,
+        built: result.built,
+        skipped: result.skipped,
+        redeployed,
+        service,
+      };
     }),
 
     keyPublish: builder.keyPublish.handler(async ({ input }) => {
@@ -1771,6 +1812,150 @@ export default createPlugin({
   }),
 });
 
+interface PublishToFastKvInput {
+  bosConfig: BosConfig;
+  runtimeConfig: RuntimeConfig | null;
+  configDir: string;
+  env: "production" | "staging";
+  build: boolean;
+  dryRun: boolean;
+  packages: string;
+  network?: "mainnet" | "testnet";
+  privateKey?: string;
+}
+
+interface PublishToFastKvResult {
+  status: "published" | "error" | "dry-run";
+  registryUrl: string;
+  txHash?: string;
+  built?: string[];
+  skipped?: string[];
+  error?: string;
+  publishConfig?: BosConfig;
+}
+
+async function publishToFastKv(input: PublishToFastKvInput): Promise<PublishToFastKvResult> {
+  const { env, dryRun, configDir } = input;
+  let bosConfig = input.bosConfig;
+  const runtimeConfig = input.runtimeConfig;
+
+  const isStaging = env === "staging";
+  const account = bosConfig.account;
+  const gateway = isStaging
+    ? (bosConfig.staging?.domain ?? bosConfig.domain)
+    : bosConfig.domain;
+  if (!gateway) {
+    return {
+      status: "error",
+      registryUrl: "",
+      error: "bos.config.json must define domain to publish",
+    };
+  }
+
+  const network = input.network ?? getNetworkIdForAccount(account);
+  const registryUrl = buildRegistryConfigUrlForNetwork(network, account, gateway);
+  const targets = selectWorkspaceTargets(input.packages, bosConfig);
+
+  let publishConfig: BosConfig = isStaging
+    ? { ...bosConfig, domain: gateway }
+    : bosConfig;
+  let built: string[] | undefined;
+  let skipped: string[] | undefined;
+
+  if (dryRun) {
+    return { status: "dry-run", registryUrl, built, skipped };
+  }
+
+  if (input.build) {
+    await generateCodeArtifacts(configDir, bosConfig, {
+      env: "production",
+      runtimeConfig: runtimeConfig ?? undefined,
+    });
+
+    const result = await buildWorkspaceTargets({
+      configDir,
+      bosConfig,
+      runtimeConfig,
+      targets,
+      deploy: true,
+    });
+    built = result.built;
+    skipped = result.skipped;
+
+    const refreshed = await loadResolvedConfig({ cwd: configDir });
+    if (refreshed?.config) {
+      bosConfig = refreshed.config;
+      publishConfig = isStaging
+        ? { ...refreshed.config, domain: gateway }
+        : refreshed.config;
+    }
+  }
+
+  const registryEntries: Record<string, string> = {
+    [`apps/${account}/${gateway}/bos.config.json`]: JSON.stringify(publishConfig),
+  };
+
+  const payload = JSON.stringify(registryEntries);
+  const argsBase64 = Buffer.from(payload).toString("base64");
+  const privateKey =
+    input.privateKey || process.env.NEAR_PRIVATE_KEY || process.env.BOS_NEAR_PRIVATE_KEY;
+
+  try {
+    await Effect.runPromise(ensureNearCli);
+    let txHash: string | undefined;
+
+    try {
+      const tx = await Effect.runPromise(
+        executeTransaction({
+          account,
+          contract: getRegistryNamespaceForNetwork(network),
+          method: "__fastdata_kv",
+          argsBase64,
+          network,
+          privateKey,
+          gas: "300Tgas",
+          deposit: "0NEAR",
+        }),
+      );
+      txHash = tx.txHash;
+    } catch (error) {
+      txHash = extractTransactionHash(error);
+
+      if (!txHash) {
+        throw error;
+      }
+
+      try {
+        const bosUrl = `bos://${account}/${gateway}`;
+        const verifiedConfig = await fetchBosConfigFromFastKv<BosConfig>(bosUrl);
+        if (JSON.stringify(verifiedConfig) !== JSON.stringify(publishConfig)) {
+          throw error;
+        }
+      } catch {
+        // Config may not exist yet on first publish or propagation delay;
+        // a valid txHash is sufficient proof the transaction was submitted.
+      }
+    }
+
+    return {
+      status: "published",
+      registryUrl,
+      txHash,
+      built,
+      skipped,
+      publishConfig,
+    };
+  } catch (error) {
+    return {
+      status: "error",
+      registryUrl,
+      error: error instanceof Error ? error.message : "Unknown error",
+      built,
+      skipped,
+    };
+  }
+}
+
 function extractTransactionHash(error: unknown) {
   const message = error instanceof Error ? error.message : String(error);
   const match = message.match(/Transaction ID:\s*([A-Za-z0-9]+)/i);
diff --git a/packages/everything-dev/src/types.ts b/packages/everything-dev/src/types.ts
index 6647ff6d..e0fe022d 100644
--- a/packages/everything-dev/src/types.ts
+++ b/packages/everything-dev/src/types.ts
@@ -180,6 +180,7 @@ export const BosConfigInputSchema: z.ZodType<BosConfigInput> = z.lazy(() =>
     app: z.record(z.string(), BosConfigInputAppEntrySchema).optional(),
     shared: z.record(z.string(), z.record(z.string(), SharedConfigSchema)).optional(),
     plugins: z.record(z.string(), z.union([z.string(), BosConfigInputSchema])).optional(),
+    ci: CiConfigSchema.optional(),
   }),
 );
 
@@ -209,8 +210,19 @@ export interface BosConfigInput {
   app?: Record<string, BosConfigInputAppEntry>;
   shared?: Record<string, Record<string, SharedDepConfig>>;
   plugins?: Record<string, string | BosConfigInput>;
+  ci?: CiConfig;
 }
 
+export const RailwayCiSchema = z.object({
+  service: z.string(),
+});
+export type RailwayCi = z.infer<typeof RailwayCiSchema>;
+
+export const CiConfigSchema = z.object({
+  railway: RailwayCiSchema.optional(),
+});
+export type CiConfig = z.infer<typeof CiConfigSchema>;
+
 export const BosConfigSchema = z.object({
   account: z.string(),
   extends: ExtendsSchema.optional(),
@@ -220,6 +232,7 @@ export const BosConfigSchema = z.object({
   testnet: z.string().optional(),
   staging: BosStagingSchema.optional(),
   repository: z.string().optional(),
+  ci: CiConfigSchema.optional(),
   shared: z.record(z.string(), z.record(z.string(), SharedConfigSchema)).optional(),
   plugins: z.record(z.string(), z.union([z.string(), BosPluginRefSchema])).optional(),
   app: z.object({
diff --git a/plugins/apps/types/contract.d.ts b/plugins/apps/types/contract.d.ts
index cf8e76e7..47c77167 100644
--- a/plugins/apps/types/contract.d.ts
+++ b/plugins/apps/types/contract.d.ts
@@ -2,6 +2,9 @@ import { z } from "every-plugin/zod";
 export declare const contract: {
     listRegistryApps: import("@orpc/contract").ContractProcedure<z.ZodObject<{
         q: z.ZodOptional<z.ZodString>;
+        parent: z.ZodOptional<z.ZodString>;
+        root: z.ZodOptional<z.ZodString>;
+        ancestor: z.ZodOptional<z.ZodString>;
         limit: z.ZodOptional<z.ZodNumber>;
         cursor: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>, z.ZodObject<{
@@ -18,6 +21,9 @@ export declare const contract: {
             uiSsrUrl: z.ZodNullable<z.ZodString>;
             apiUrl: z.ZodNullable<z.ZodString>;
             extends: z.ZodNullable<z.ZodString>;
+            parent: z.ZodNullable<z.ZodString>;
+            root: z.ZodNullable<z.ZodString>;
+            depth: z.ZodNumber;
             status: z.ZodEnum<{
                 ready: "ready";
                 invalid: "invalid";
@@ -66,6 +72,9 @@ export declare const contract: {
             uiSsrUrl: z.ZodNullable<z.ZodString>;
             apiUrl: z.ZodNullable<z.ZodString>;
             extends: z.ZodNullable<z.ZodString>;
+            parent: z.ZodNullable<z.ZodString>;
+            root: z.ZodNullable<z.ZodString>;
+            depth: z.ZodNumber;
             status: z.ZodEnum<{
                 ready: "ready";
                 invalid: "invalid";
@@ -111,6 +120,9 @@ export declare const contract: {
             uiSsrUrl: z.ZodNullable<z.ZodString>;
             apiUrl: z.ZodNullable<z.ZodString>;
             extends: z.ZodNullable<z.ZodString>;
+            parent: z.ZodNullable<z.ZodString>;
+            root: z.ZodNullable<z.ZodString>;
+            depth: z.ZodNumber;
             status: z.ZodEnum<{
                 ready: "ready";
                 invalid: "invalid";
@@ -127,6 +139,7 @@ export declare const contract: {
             metadataKey: z.ZodString;
             metadataContractId: z.ZodString;
             metadataFastKvUrl: z.ZodString;
+            extendsChain: z.ZodArray<z.ZodString>;
             resolvedConfig: z.ZodRecord<z.ZodString, z.ZodUnknown>;
         }, z.core.$strip>;
     }, z.core.$strip>, import("@orpc/contract").MergedErrorMap<Record<never, never>, import("@orpc/contract").MergedErrorMap<Record<never, never>, {
@@ -154,6 +167,9 @@ export declare const contract: {
             uiSsrUrl: z.ZodNullable<z.ZodString>;
             apiUrl: z.ZodNullable<z.ZodString>;
             extends: z.ZodNullable<z.ZodString>;
+            parent: z.ZodNullable<z.ZodString>;
+            root: z.ZodNullable<z.ZodString>;
+            depth: z.ZodNumber;
             status: z.ZodEnum<{
                 ready: "ready";
                 invalid: "invalid";
@@ -170,6 +186,7 @@ export declare const contract: {
             metadataKey: z.ZodString;
             metadataContractId: z.ZodString;
             metadataFastKvUrl: z.ZodString;
+            extendsChain: z.ZodArray<z.ZodString>;
             resolvedConfig: z.ZodRecord<z.ZodString, z.ZodUnknown>;
         }, z.core.$strip>;
     }, z.core.$strip>, import("@orpc/contract").MergedErrorMap<Record<never, never>, import("@orpc/contract").MergedErrorMap<Record<never, never>, {
diff --git a/ui/rsbuild.config.ts b/ui/rsbuild.config.ts
index d12b74b0..aff08598 100644
--- a/ui/rsbuild.config.ts
+++ b/ui/rsbuild.config.ts
@@ -152,13 +152,29 @@ function createClientConfig() {
 function createServerConfig() {
   const plugins = [pluginReact()];
 
+  plugins.push({
+    name: "restore-manifest-public-path",
+    setup(api) {
+      api.onAfterBuild(() => {
+        const manifestPath = path.resolve(__dirname, "dist/mf-manifest.json");
+        if (!fs.existsSync(manifestPath)) return;
+        const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+        if (manifest.metaData?.publicPath && manifest.metaData.publicPath !== "auto") {
+          manifest.metaData.publicPath = "auto";
+          fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
+        }
+      });
+    },
+  });
+
   if (shouldDeploy) {
     plugins.push(
       withZephyr({
         hooks: {
           onDeployComplete: async (info) => {
             console.log("🚀 UI SSR Deployed:", info.url);
-            const integrity = await computeSriHashForUrl(info.url);
+            const ssrEntryUrl = `${info.url.replace(/\/$/, "")}/remoteEntry.server.js`;
+            const integrity = await computeSriHashForUrl(ssrEntryUrl, { resolveEntryUrl: false });
             updateBosConfig("ssr", info.url, integrity ?? undefined);
           },
         },
@@ -194,7 +210,6 @@ function createServerConfig() {
         target: "async-node",
         output: {
           uniqueName: `${normalizedName}_server`,
-          publicPath: "auto",
           library: { type: "commonjs-module" },
         },
         resolve: {
@@ -220,7 +235,7 @@ function createServerConfig() {
     },
     output: {
       distPath: { root: "dist" },
-      assetPrefix: "auto",
+      assetPrefix: "/",
       cleanDistPath: false,
     },
   });