diff --git a/DESIGN.md b/DESIGN.md
index cc8eb998..f3eb70fe 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -256,9 +256,9 @@ The daemon watches linked Project config files and automatically reconciles when
 
 On startup, the daemon detects privileged system drift such as stale DNS resolver ports or stale `pf` redirects, but it does not prompt for admin privileges or mutate system configuration from the background. It records repair-required observed status instead.
 
-If a linked Project config becomes invalid, the daemon keeps serving the last valid desired state, records the config error in observed status, stops updating `.env` from the invalid config, and surfaces the error in `pv list` and `pv status`. PV does not tear down working resources because of a transient invalid edit.
+If a linked Project config becomes invalid, the daemon keeps the last valid served or resource-only desired state, records the config error in observed status, stops updating the configured env file from the invalid config, and surfaces the error in `pv list` and `pv status`. PV does not tear down working routes or resources because of a transient invalid edit.
 
-Project config changes restart or reload only affected runtime processes. PHP version or routing changes may restart/reassign FrankenPHP serving for the affected Project. Env-only changes update `.env` without restarting the Gateway.
+Project config changes restart or reload only affected runtime processes. PHP version or routing changes may restart/reassign FrankenPHP serving for the affected Project. Env-only changes update the configured env file without restarting the Gateway.
 
 When a Project's PHP track or optional extension set changes, PV reconfigures only affected Project-serving workers. It may stop an old PHP worker if no Projects remain on that runtime identity and start or reload the new runtime's worker. Unrelated PHP workers are not touched.
 
@@ -322,7 +322,7 @@ export COMPOSER_CACHE_DIR="/Users/<user>/.pv/composer/cache";
 
 `pv env` only prints shell code. It does not create directories or otherwise mutate filesystem state during shell startup.
 
-`pv project:env` prints the generated Project environment values PV would render into the PV-managed `.env` block, without editing `.env`. With no argument, it resolves the current directory's Project. With a hostname argument, it resolves that Project hostname, including additional hostnames declared in `hostnames:`. It prints actual rendered values, including secrets. Broad status commands should avoid printing secrets.
+`pv project:env` prints the generated Project environment values PV would render into the PV-managed block, without editing the configured env file. With no argument, it resolves the current directory's Project. With a selector argument, it resolves an exact Project slug or Project hostname, including additional hostnames declared in `hostnames:`. Bare slug/normalized-hostname ambiguity fails and suggests the full `.test` hostname. It prints actual rendered values, including secrets. Broad status commands should avoid printing secrets.
 
 ## Multi-version PHP
 
@@ -333,6 +333,8 @@ The Gateway is always-on core PV infrastructure after setup. It only routes/prox
 
 Each Project-serving FrankenPHP worker serves all Projects assigned to one PHP runtime identity. The runtime identity is the resolved PHP track plus the sorted available optional extension set. PV does not run one worker per Project.
 
+Resource-only Projects do not contribute Gateway routes or Project-serving worker demand. The core Gateway remains running and healthy when every linked Project is resource-only. A successful served-to-resource-only transition removes stale generated route and worker config for that Project.
+
 Project-serving FrankenPHP workers bind only to loopback high ports. They are internal to PV behind the Gateway.
 
 The Gateway terminates TLS for Project hostnames. Project-serving FrankenPHP workers receive proxied plain HTTP traffic over loopback high ports.
@@ -357,6 +359,8 @@ When routing or Gateway config changes, PV reloads the Gateway config using Cadd
 
 PV owns one local CA and passes that CA to the Gateway's FrankenPHP/Caddy configuration. FrankenPHP/Caddy generates and manages Project certificates from that CA as needed for hostnames in PV's desired routing table: primary Project hostnames plus additional `hostnames:` from valid Project config. The Gateway selects certificates by SNI.
 
+While a Project is resource-only, PV retains any existing stable Project TLS files but does not refresh them or include the Project in Gateway TLS demand. Re-enabling serving resumes normal TLS reconciliation after hostname and document-root validation succeeds.
+
 The Gateway does not automatically route `*.project.test` to a Project. Subdomain routing must be explicitly requested in Project config, which allows `acme.test` and `api.acme.test` to belong to different Projects.
 
 For unknown `.test` hostnames, the Gateway should return a simple self-contained HTML response explaining that no PV Project is linked for the hostname and suggesting `pv link` when technically feasible.
@@ -971,6 +975,12 @@ Projects may opt in to Project-specific Managed Resource requirements and enviro
 
 An empty Project config is valid and means no Project-specific overrides. PV uses defaults and does not touch `.env`.
 
+Project config accepts a root-level `serve` boolean. It defaults to `true`. With `serve: false`, the Project remains linked and PV still reconciles its declared Managed Resources, Resource allocations, and environment mappings, but PV does not create a Gateway route, TLS demand, or PHP worker for the Project. PV does not start framework or application development servers on the Project's behalf.
+
+Serving-only config remains valid but dormant while `serve: false`. This includes `document_root`, `hostnames:`, the primary Project hostname, and env entries that use `${project_url}`, `${tls_cert}`, `${tls_key}`, or `${tls_ca}`. PV preserves those values in user-owned config, ignores them for runtime planning, and omits env entries that depend on serving-only placeholders. If serving is enabled again, PV validates and applies those values normally and restores the omitted env entries.
+
+Basic YAML types, unknown keys, env key rules, and placeholder spelling are validated in both serving modes. A malformed dormant value is still a config error when it can be validated without serving context. Hostname collision and document-root existence checks are deferred until serving is enabled. As with other invalid Project config, a failed transition keeps the last valid desired state active.
+
 Empty string values for meaningful config fields, such as `php` or Managed Resource `version`, are invalid.
 
 Version/track fields may be YAML strings or numbers. PV normalizes them to strings during validation.
@@ -981,6 +991,8 @@ Project config can declare additional Project hostnames with `hostnames:`. These
 
 All hostnames in PV's desired routing table are unique across primary and additional hostnames. If an additional hostname conflicts with another Project's primary or additional hostname, the Project config is invalid. If `pv link --hostname` tries to use a hostname that is already primary or additional for another Project, it fails with a clear collision error. PV keeps serving the last valid desired state and surfaces conflicts in `pv list` and `pv status`.
 
+When a served Project changes to `serve: false`, it retains its primary and additional hostname reservations so another Project cannot take them during a temporary serving pause. A Project first linked with `serve: false` does not need or reserve a real `.test` hostname.
+
 Project config `hostnames:` cannot include the Project's own primary hostname.
 
 Project config `hostnames:` cannot contain duplicates after normalization.
@@ -995,6 +1007,8 @@ If Project config asks for a Managed Resource track that is not installed, daemo
 
 Declaring a Managed Resource in Project config means the Project needs that resource. Reconciliation installs and starts the selected track even when no env mappings or Resource allocations are declared.
 
+An explicit `php:` selection remains available to the Project-aware `php` and Composer shims for a resource-only Project and installs the selected PHP/FrankenPHP lifecycle pair when required. It does not create a PHP worker while `serve: false`. Without explicit `php:`, a resource-only Project creates no Project-specific PHP demand and Project-aware CLI commands may use the global PHP runtime fallback.
+
 If no linked Projects need a running Managed Resource track anymore, the daemon stops that process. Installed Managed Resource assets remain on disk unless explicitly uninstalled.
 
 Project config can also request that PV create Resource allocations inside shared machine-level Managed Resource instances. Examples include databases, buckets, credentials, prefixes, or similar resource-specific objects.
@@ -1015,9 +1029,9 @@ SQL root/superuser passwords are randomly generated once per Managed Resource in
 
 For SQL database names, allocation names are normalized to underscore-style identifiers: hyphens are converted to underscores. Project config allocation names may still use hyphens.
 
-SQL database names use the same readable hostname-based naming approach as RustFS buckets, but with underscores: `<hostname_slug>_<allocation_name>`. The hostname slug includes the `.test` suffix, with dots and hyphens converted to underscores. For example, primary Project hostname `acme.test` and allocation `app-db` creates database `acme_test_app_db`.
+SQL database names use the Project's immutable slug with underscores: `<project_slug>_<allocation_name>`. Hyphens in both the Project slug and allocation name are converted to underscores. For example, Project slug `acme` and allocation `app-db` creates database `acme_app_db`.
 
-SQL database names are generated when the Resource allocation is first created and then stored in `pv.db`. If the Project's primary hostname changes later, PV keeps using the existing stored database name instead of renaming the database or creating a new database.
+SQL database names are generated when the Resource allocation is first created and then stored in `pv.db`. If the Project's hostname, path, slug derivation input, or serving mode changes later, PV keeps using the existing stored database name instead of renaming the database or creating a new database.
 
 Generated local development secrets are stored plainly in the user-owned SQLite database for v1. PV relies on filesystem permissions rather than macOS Keychain encryption at rest.
 
@@ -1025,7 +1039,7 @@ Generated credentials are stable. PV creates them once for the relevant Managed
 
 PV v1 does not support credential rotation commands.
 
-Redis Resource allocations create generated key prefixes only in v1. PV does not manage Redis logical DB indexes or ACL users in v1. Redis prefix values use `<hostname-slug>-<allocation>-`, where the primary Project hostname at allocation creation time is slugged by replacing dots with hyphens and includes the `.test` suffix. For example, primary hostname `acme.test` and allocation `cache` renders `acme-test-cache-`. Redis prefixes are generated when the Resource allocation is first created and then stored in `pv.db`. If the Project's primary hostname changes later, PV keeps using the existing stored prefix instead of switching to a new key namespace.
+Redis Resource allocations create generated key prefixes only in v1. PV does not manage Redis logical DB indexes or ACL users in v1. Redis prefix values use `<project-slug>-<allocation>-`. For example, Project slug `acme` and allocation `cache` renders `acme-cache-`. Redis prefixes are generated when the Resource allocation is first created and then stored in `pv.db`. Later Project changes do not switch the stored key namespace.
 
 For Redis prefixes, allocation names are normalized the same way as RustFS bucket allocation segments: underscores are converted to hyphens.
 
@@ -1033,7 +1047,7 @@ Mailpit does not support Resource allocations in v1. It is a shared capture serv
 
 RustFS uses one randomly generated PV-managed root/access credential per Managed Resource instance/track so PV can manage and access the local RustFS instance. RustFS Resource allocations create per-Project buckets and render the shared instance access credentials plus bucket name. PV v1 does not create dedicated per-allocation RustFS access keys.
 
-RustFS Resource allocation bucket names use the Project hostname slug and allocation name: `<hostname-slug>-<allocation_name>`. The hostname slug includes the `.test` suffix, with dots replaced by hyphens. For example, primary Project hostname `acme.test` and allocation `uploads` creates bucket `acme-test-uploads`.
+RustFS Resource allocation bucket names use the Project slug and allocation name: `<project-slug>-<allocation_name>`. For example, Project slug `acme` and allocation `uploads` creates bucket `acme-uploads`.
 
 For RustFS bucket names, allocation names are normalized to bucket-safe lowercase DNS-style labels: underscores are converted to hyphens. Project config allocation names may still use underscores.
 
@@ -1059,7 +1073,7 @@ If a Resource allocation is removed from Project config, PV stops reconciling it
 
 PV v1 does not automatically garbage-collect orphaned Resource allocations.
 
-PV uses readable hostname-based generated names for user-visible Resource allocation objects. SQL database names use `<hostname_slug>_<allocation_name>`, RustFS bucket names use `<hostname-slug>-<allocation_name>`, and Redis prefixes use `<hostname-slug>-<allocation>-`. These names are generated at first allocation creation and stored in `pv.db` so later Project hostname changes do not silently switch backing data.
+PV uses readable Project-slug-based generated names for user-visible Resource allocation objects. SQL database names use `<project_slug>_<allocation_name>`, RustFS bucket names use `<project-slug>-<allocation_name>`, and Redis prefixes use `<project-slug>-<allocation>-`. These names are generated at first allocation creation and stored in `pv.db`; reconciliation always reuses the persisted `generated_name` and never renames an existing database, bucket, or prefix.
 
 PV applies a hard 63-character maximum to generated Resource allocation object names in v1. If the generated SQL database name, Redis prefix, or RustFS bucket name would exceed 63 characters, PV fails Project config/reconciliation with a clear error. PV does not truncate, hash, or silently rewrite generated Resource allocation names in v1.
 
@@ -1093,6 +1107,8 @@ Placeholder names must use lowercase snake_case, such as `${project_url}`, `${ac
 
 `${tls_key}` renders the stable PV-owned path to the TLS private key for the Project's primary hostname. `${tls_cert}` renders the stable PV-owned path to the TLS certificate chain for the Project's primary hostname. `${tls_ca}` renders the path to PV's local CA certificate. PV must never expose the local CA private key through Project env placeholders.
 
+While `serve: false`, `${project_url}`, `${tls_key}`, `${tls_cert}`, and `${tls_ca}` remain recognized placeholders, but PV omits any complete env entry containing one of them instead of rendering a partial or fake serving value. Other entries at the same mapping scope continue to render.
+
 TLS placeholders are scoped to the primary Project hostname only. They do not render files for additional `hostnames:`, do not imply wildcard certificate support, and do not imply wildcard Project routing. Additional hostnames remain explicit Gateway routes with Gateway-managed TLS certificates.
 
 PV owns stable Project TLS files under Project-specific storage in `~/.pv/certificates/` and refreshes them during reconciliation when the Project's primary hostname or local CA changes. Placeholder values must not point at Caddy/FrankenPHP's internal certificate storage; that layout is an implementation detail of the managed Gateway.
@@ -1157,13 +1173,15 @@ rustfs:
 
 Any `env:` mapping in Project config is explicit opt-in to PV-managed `.env` rendering, including root-level `env:` without Managed Resource mappings.
 
-When a Project opts in with environment mappings, the daemon reconciles the requested Managed Resources and updates only a PV-owned delimited block inside the Project's `.env` file. PV never rewrites user-owned `.env` lines outside that block. If the Project's `.env` file does not exist, PV creates it automatically with the PV-owned block.
+When a Project opts in with environment mappings, the daemon reconciles the requested Managed Resources and updates only a PV-owned delimited block inside the configured env file. PV never rewrites user-owned lines outside that block. If the configured env file does not exist, PV creates it automatically with the PV-owned block.
 
 PV renders `.env` only after required Managed Resource ports and Resource allocations are known. Env rendering is all-or-nothing for the full Project config. If a required allocation or resource reconciliation fails, PV keeps the last valid managed block and records the failure instead of rendering incomplete values.
 
-PV v1 only renders to `.env`. It does not support `.env.local` or configurable env file targets.
+Project config accepts a root-level `env_file` path and defaults it to `.env`. The path is relative to the canonical Project root. Absolute paths, lexical `..` escapes, and symlinks that resolve outside the canonical Project root are rejected. The target's parent directory must already exist; PV does not create parent directories.
 
-When creating a missing `.env`, PV creates a user-owned file containing only the PV-owned block with `0600` permissions. It does not copy `.env.example`. When updating an existing `.env`, PV preserves the existing file permissions.
+When creating a missing configured env file, PV creates a user-owned file containing only the PV-owned block with `0600` permissions. It does not copy `.env.example`. When updating an existing env file, PV preserves the existing file permissions.
+
+If `env_file` changes, PV writes or updates only the newly configured target. PV leaves the prior target and its last PV-managed block untouched and does not track historical env targets for cleanup. If config later switches back to a previous target, PV updates the existing block there normally.
 
 PV uses these exact `.env` delimiters:
 
@@ -1187,7 +1205,7 @@ Duplicate env key warnings appear as compact Project warnings in `pv list`, with
 
 PV writes `.env` values unquoted when safe and quotes/escapes values when necessary, such as values containing spaces, `#`, quotes, or newlines.
 
-If a Project has no Project config, or its Project config has no environment mappings, PV does not touch the Project's `.env` file. If a previously generated PV-managed block exists, PV leaves the last generated values in place and stops updating the block. The Project is still served through the Gateway using the default PHP version, or the `php` version requested in Project config when present.
+If a Project has no Project config, or its Project config has no environment mappings, PV does not touch the configured env file. If a previously generated PV-managed block exists, PV leaves the last generated values in place and stops updating the block. A served Project still uses the default PHP version, or the `php` version requested in Project config when present.
 
 PV does not watch `.env` files. It only writes the PV-managed block during reconciliation when Project config or Managed Resource state requires an update.
 
@@ -1199,7 +1217,7 @@ PV does not create sample Project config files during setup and does not create
 
 ## Project Linking
 
-`pv link [path]` registers a Project as desired state and immediately requests daemon reconciliation.
+`pv link [path]` registers a Project as desired state and immediately requests daemon reconciliation. PV reads and validates Project config before choosing whether the new Project is served or resource-only.
 
 If `path` is omitted, `pv link` uses the current directory.
 
@@ -1223,7 +1241,7 @@ PV v1 does not run Laravel application commands, such as `php artisan key:genera
 
 PV v1 does not diagnose Laravel application state, such as missing `APP_KEY`.
 
-The command succeeds when PV has recorded the desired Project and submitted the reconciliation request. If the daemon is running and reconciliation succeeds, the Project should be reachable at its `.test` URL by the end of the command.
+The command succeeds when PV has recorded the desired Project and submitted the reconciliation request. If the daemon is running and reconciliation succeeds, a served Project should be reachable at its `.test` URL by the end of the command. A resource-only Project should have its declared Managed Resources, allocations, and env reconciled without becoming reachable through the Gateway.
 
 `pv link` can run before `pv setup`. It records desired state and warns that setup is incomplete, so routing will not work until `pv setup` completes.
 
@@ -1233,12 +1251,18 @@ Project hostnames are normalized to lowercase and validated as DNS-safe `.test`
 
 `pv.test` is reserved for PV diagnostics or future internal UI and cannot be assigned to a Project.
 
-PV identifies a Project by its canonical absolute path. Generated names and Project hostnames are unique attributes, but they are not Project identity. Running `pv link` more than once for the same canonical path updates the existing Project record.
+PV identifies a Project by its canonical absolute path. Project slugs, generated names, and Project hostnames are unique attributes, but they are not Project identity. Running `pv link` more than once for the same canonical path updates the existing Project record.
 
 PV stores both the original linked path string and the canonical absolute path. The canonical path is used for identity, routing, and equality; the original path is display/debug metadata.
 
 PV also assigns each Project a random stable Project ID at first link and stores it in `pv.db`. The Project ID is PV's stable internal reference for the Project and does not change when the Project hostname changes. Project IDs should be short random URL-safe IDs, roughly 8-12 characters, to avoid local collisions while keeping diagnostics readable.
 
+PV also assigns every Project a globally unique, immutable Project slug at first link and stores it in `pv.db`. The base slug is derived from the canonical directory basename using the same lowercase DNS-safe normalization as a default hostname label. If that slug is already stored by another Project, PV appends the first available numeric suffix: `appointment`, `appointment-1`, `appointment-2`, and so on. Slug collision checks use PV state, not underlying Managed Resource data. Relinking the same canonical path preserves its assigned slug.
+
+The Project slug is the stable readable namespace for all newly generated Resource allocation names in both serving modes. It does not change when the Project path, hostname, or serving mode changes.
+
+Persisted Project state records serving mode and Project slug additively. Where the current database hostname invariants require a non-null unique value for a newly linked resource-only Project, PV stores a unique internal `.invalid` hostname. This compatibility value is storage-only and must never appear in user-facing text or JSON, selectors, Gateway or TLS planning, env rendering, Resource allocation names, status, or logs.
+
 If a Project directory moves and is linked again at the new path, PV v1 treats it as a new Project. Path-move semantics may be added later if needed.
 
 If a linked Project path no longer exists, PV marks the Project failed or missing in observed state but keeps desired state. PV does not auto-unlink missing Projects.
@@ -1247,6 +1271,8 @@ Missing Projects continue to own their Project hostnames until the user unlinks
 
 If the derived Project hostname is already assigned to another Project, `pv link` fails with a clear collision error. The user can pass an explicit Project hostname with `--hostname <hostname>` to resolve the collision.
 
+When a newly linked resource-only Project is later enabled for serving without an established real hostname, PV derives its initial hostname from its immutable Project slug. Normal hostname collision and document-root validation applies, and a collision fails clearly instead of silently choosing a different hostname.
+
 `--hostname` accepts either a bare label or a full `.test` hostname. A bare label always normalizes to `<label>.test`; for example, `--hostname acme` and `--hostname acme.test` both normalize to `acme.test`. Multi-label hostnames must be provided in full, such as `api.acme.test`. PV v1 rejects non-`.test` hostnames.
 
 Primary Project hostnames may contain multiple labels as long as they end in `.test`, such as `api.acme.test`.
@@ -1263,7 +1289,9 @@ If `pv link` is run for an already linked Project without `--hostname`, PV prese
 
 `pv unlink` with no argument unlinks the Project resolved from the current directory, using the nearest linked Project ancestor rule.
 
-`pv unlink <hostname>` unlinks the Project resolved by that hostname. The hostname argument accepts the same forms as `pv link --hostname`, so `acme` and `acme.test` both resolve to `acme.test`. Additional hostnames declared in `hostnames:` may also resolve the owning Project. Output should identify the owning primary Project hostname before unlinking.
+`pv unlink <selector>` unlinks the Project resolved by an exact Project slug or hostname. Hostname selectors accept the same forms as `pv link --hostname`, so `acme` and `acme.test` can normalize to `acme.test`. Additional hostnames declared in `hostnames:` may also resolve the owning Project. Output identifies the owning primary Project hostname for a served Project and the Project slug for a resource-only Project.
+
+If a bare selector could resolve both an exact Project slug and a normalized hostname belonging to different Projects, PV fails clearly and suggests using the full `.test` hostname to select the served Project.
 
 `pv unlink <additional-hostname>` does not require confirmation in v1 because unlink is non-destructive, but output must make the resolved primary Project explicit.
 
@@ -1275,7 +1303,7 @@ If PV previously generated a Project `.env` block, `pv unlink` leaves the block
 
 ## Opening Projects
 
-`pv open [hostname]` opens a Project hostname in the user's browser from desired state. It does not require observed state to confirm that the Project is currently reachable.
+`pv open [hostname]` opens a served Project hostname in the user's browser from desired state. It does not require observed state to confirm that the Project is currently reachable.
 
 With a hostname argument, `pv open <hostname>` opens that Project directly. With no argument, it opens the current Project or falls back to the picker.
 
@@ -1289,6 +1317,8 @@ If no current Project can be resolved and the terminal is non-interactive, `pv o
 
 Current-directory Project resolution walks up from the current directory to linked Project roots, stopping at the filesystem root. If linked Projects are nested, PV chooses the nearest linked Project ancestor. This applies to commands that resolve a Project from the current directory.
 
+An explicit resource-only Project target returns a clear non-zero error and never launches a browser. Resource-only Projects are excluded from the interactive picker.
+
 `pv open` is Project-focused and does not open Managed Resource dashboards.
 
 `pv mailpit:open` / `pv mail:open` opens the Mailpit dashboard only when Mailpit is already running. It does not start Mailpit or change desired state.
@@ -1303,17 +1333,19 @@ The picker sorts Projects by primary Project hostname.
 
 ## Listing Projects
 
-`pv list` lists desired Projects and enriches them with the Project config and env rendering status currently stored in `pv.db`. At minimum, each row should include Project hostname, canonical absolute path, resolved PHP version, declared Managed Resource demand, env rendering status, and a serving field that may be `unknown` until Project serving observations are added.
+`pv list` lists desired Projects and enriches them with the Project config and env rendering status currently stored in `pv.db`. At minimum, each row includes separate Project and Mode fields, canonical absolute path, resolved PHP version, declared Managed Resource demand, env rendering status, and currently known serving status. Mode is `served` or `resource-only`; serving observation may remain `unknown` until reconciliation.
 
 Status values use words such as `ok`, `pending`, `failed`, `degraded`, or `unknown` by default. TTY output may add color or icons, but words remain present.
 
 If the daemon has not reconciled a Project yet, the Project still appears with pending or unknown observed status.
 
-`pv list` shows the primary Project hostname by default and may show a compact indicator for additional hostnames, such as a count. Full additional hostname detail belongs in broader status/detail output.
+In the Project field, `pv list` normally shows the primary hostname for a served Project and the immutable slug for a resource-only Project. It may show a compact indicator for additional hostnames, such as a count. Full additional hostname detail belongs in broader status/detail output.
+
+`pv list --json` includes `mode`, `slug`, nullable `hostname`, and `env_file` for every Project. The internal `.invalid` compatibility hostname is represented as `null`, never as a string.
 
 `pv list` does not show Resource allocation details by default. It stays focused on Project-level serving status.
 
-`pv list` sorts Projects by primary Project hostname by default.
+`pv list` sorts Projects by their displayed Project value by default.
 
 ## System Status
 
@@ -1383,13 +1415,13 @@ If the daemon is intentionally disabled while DNS, ports, or CA integrations rem
 | ------------------------ | ----------------------------------------------------------------------------------------------------------------- |
 | pv link [path] [--hostname <hostname>] | Register a Project and request daemon reconciliation                                                    |
 | pv open [hostname]       | Opens a Project in the browser                                                                                    |
-| pv project:env [hostname] [--json] | Print generated Project environment values without editing `.env`                                         |
+| pv project:env [selector] [--json] | Print generated Project environment values without editing the configured env file                          |
 | pv list [--json]         | List linked Projects with PHP, declared Managed Resource demand, env status, and currently known serving status    |
 | pv logs [--follow]       | Show PV daemon/reconciliation logs                                                                                |
 | pv status [--json]       | Show whole-system PV status                                                                                       |
 | pv setup [--yes] [--non-interactive] [--no-path] | Configure macOS resolver, `pf` redirects, CA trust, daemon registration, and default Managed Resources |
 | pv uninstall [--prune] [--force] | Uninstall PV, preserving data by default                                                                  |
-| pv unlink [hostname]     | Unlink a Project by current directory or Project hostname                                                         |
+| pv unlink [selector]     | Unlink a Project by current directory, Project slug, or Project hostname                                           |
 | pv update [--check] [--json] | Update the PV application and installed Managed Resources to their latest versions, or report available updates with `--check`; `--json` requires `--check` |
 | pv restart               | Restart PV-managed runtime processes and reconcile desired state                                                   |
 | pv env [--shell <shell>] | Print shell exports for PV-managed binaries and Composer environment                                              |
diff --git a/crates/cli/src/args.rs b/crates/cli/src/args.rs
index aae92532..72d2544d 100644
--- a/crates/cli/src/args.rs
+++ b/crates/cli/src/args.rs
@@ -481,13 +481,13 @@ pub(crate) struct InitArgs {
 
 #[derive(Debug, clap::Args)]
 pub(crate) struct UnlinkArgs {
-    #[arg(value_name = "hostname", help = "Project hostname to unlink")]
+    #[arg(value_name = "project", help = "Project slug or hostname to unlink")]
     pub(crate) hostname: Option<String>,
 }
 
 #[derive(Debug, clap::Args)]
 pub(crate) struct OpenArgs {
-    #[arg(value_name = "hostname", help = "Project hostname to open")]
+    #[arg(value_name = "project", help = "Project slug or hostname to open")]
     pub(crate) hostname: Option<String>,
 }
 
@@ -496,7 +496,10 @@ pub(crate) struct ProjectEnvArgs {
     #[arg(long, help = "Print generated Project environment values as JSON")]
     pub(crate) json: bool,
 
-    #[arg(value_name = "hostname", help = "Project hostname to render env for")]
+    #[arg(
+        value_name = "project",
+        help = "Project slug or hostname to render env for"
+    )]
     pub(crate) hostname: Option<String>,
 }
 
diff --git a/crates/cli/src/commands/php.rs b/crates/cli/src/commands/php.rs
index 36c2d6a9..cbfd34b3 100644
--- a/crates/cli/src/commands/php.rs
+++ b/crates/cli/src/commands/php.rs
@@ -11,7 +11,9 @@ use resources::{
     TargetPlatform, TrackName, TrackSelector, UreqResourceHttpClient,
 };
 use serde::Serialize;
-use state::{Database, ManagedResourceDesiredState, ProjectRecord, PvPaths, StateError};
+use state::{
+    Database, ManagedResourceDesiredState, ProjectMode, ProjectRecord, PvPaths, StateError,
+};
 
 use crate::args::{ListArgs, PhpInstallArgs, PhpUninstallArgs, PhpUseArgs, ShimArgs};
 use crate::environment::{Environment, artifact_manifest_url};
@@ -64,7 +66,7 @@ pub(crate) fn use_track(
 
     output.line(&format!(
         "Set {} PHP track to {track}",
-        project.primary_hostname
+        project_display_name(&project)
     ))?;
     output.line(&format!("Updated Project config: {}", config_file.path))?;
     write_install_lines(&installed, &mut output)?;
@@ -650,7 +652,8 @@ fn request_project_reconciliation(
     match daemon::submit_job_blocking(paths.clone(), RECONCILE_KIND, &scope) {
         Ok(job) => output.line(&format!(
             "Queued reconciliation {} for {}",
-            job.id, project.primary_hostname
+            job.id,
+            project_display_name(project)
         ))?,
         Err(daemon::DaemonError::Io(error)) if daemon_is_unavailable(&error) => {
             write_daemon_unavailable_warning(output)?
@@ -661,6 +664,17 @@ fn request_project_reconciliation(
     Ok(())
 }
 
+fn project_display_name(project: &ProjectRecord) -> &str {
+    if project.mode == ProjectMode::ResourceOnly {
+        return project.slug.as_str();
+    }
+
+    project
+        .primary_hostname
+        .as_deref()
+        .unwrap_or(project.slug.as_str())
+}
+
 fn request_system_reconciliation(
     paths: &PvPaths,
     output: &mut Output<'_, impl Write>,
diff --git a/crates/cli/src/commands/project.rs b/crates/cli/src/commands/project.rs
index 6ad47117..e35dd5a0 100644
--- a/crates/cli/src/commands/project.rs
+++ b/crates/cli/src/commands/project.rs
@@ -11,7 +11,8 @@ use resources::{ArtifactManifestCache, ConcreteTrackName, ResourceName, TrackSel
 use serde::Serialize;
 use state::{
     Database, LinkProjectInput, LinkProjectStatus, ProjectEnvObservedStateRecord,
-    ProjectEnvObservedStatus, ProjectEnvStateContext, ProjectRecord, PvPaths, StateError,
+    ProjectEnvObservedStatus, ProjectEnvStateContext, ProjectMode, ProjectRecord, PvPaths,
+    StateError,
 };
 
 use crate::args::{LinkArgs, ListArgs, OpenArgs, ProjectEnvArgs, UnlinkArgs};
@@ -27,6 +28,7 @@ pub(crate) fn link(
     let paths = pv_paths(environment)?;
     let original_project_path = resolve_project_path(args.path.as_deref(), environment)?;
     let config_file = ProjectConfigFile::read_from_root(&original_project_path)?;
+    config::validate_project_env_shape(&config_file.config)?;
     let project_path = project_root_from_config_path(&config_file.path)?;
     let desired_php_track = resolved_project_php_track(
         &paths,
@@ -38,33 +40,51 @@ pub(crate) fn link(
     )?;
     let mut database = Database::open(&paths)?;
     let existing = database.project_by_path(&project_path)?;
-    let primary_hostname = match (args.hostname, existing.as_ref()) {
+    let mode = if config_file.config.serve {
+        ProjectMode::Served
+    } else {
+        ProjectMode::ResourceOnly
+    };
+    let primary_hostname = match (
+        config_file.config.serve.then_some(args.hostname).flatten(),
+        existing.as_ref(),
+    ) {
         (Some(hostname), _) => config::normalize_primary_hostname(&hostname)?,
-        (None, Some(project)) => project.primary_hostname.clone(),
+        (None, Some(project)) => project
+            .primary_hostname
+            .clone()
+            .unwrap_or_else(|| format!("{}.test", project.slug)),
         (None, None) => config::hostname_from_project_path(&project_path)?,
     };
-    let result = database.link_project(LinkProjectInput {
-        path: project_path.clone(),
-        original_path: original_project_path,
-        primary_hostname,
-        config_path: config_file.path,
-        desired_php_track,
-        additional_hostnames: config_file.config.hostnames,
-    })?;
+    let result = database.link_project_with_mode(
+        LinkProjectInput {
+            path: project_path.clone(),
+            original_path: original_project_path,
+            primary_hostname,
+            config_path: config_file.path,
+            desired_php_track,
+            additional_hostnames: config_file.config.hostnames,
+        },
+        mode,
+    )?;
 
     let mut output = Output::new(stdout, OutputMode::plain());
+    let project_name = if result.project.mode == ProjectMode::ResourceOnly {
+        format!("{} (resource-only)", result.project.slug)
+    } else {
+        project_display_name(&result.project).to_string()
+    };
     match result.status {
-        LinkProjectStatus::Created => output.line(&format!(
-            "Linked {} -> {}",
-            result.project.primary_hostname, result.project.path
-        ))?,
+        LinkProjectStatus::Created => {
+            output.line(&format!("Linked {project_name} -> {}", result.project.path,))?
+        }
         LinkProjectStatus::Updated => output.line(&format!(
-            "Updated {} -> {}",
-            result.project.primary_hostname, result.project.path
+            "Updated {project_name} -> {}",
+            result.project.path,
         ))?,
         LinkProjectStatus::Unchanged => output.line(&format!(
-            "Already linked {} -> {}",
-            result.project.primary_hostname, result.project.path
+            "Already linked {project_name} -> {}",
+            result.project.path,
         ))?,
     }
     request_project_reconciliation(&paths, &result.project, &mut output)?;
@@ -111,7 +131,8 @@ pub(crate) fn unlink(
 
     output.line(&format!(
         "Unlinked {} -> {}",
-        project.primary_hostname, project.path
+        project_display_name(&project),
+        project.path
     ))?;
     request_system_reconciliation(&paths, &mut output)?;
 
@@ -139,13 +160,13 @@ pub(crate) fn open(
     let paths = pv_paths(environment)?;
     let database = Database::open(&paths)?;
     let (project, hostname) = match args.hostname {
-        Some(hostname) => {
-            let hostname = config::normalize_primary_hostname(&hostname)?;
-            let project = database
-                .project_by_hostname(&hostname)?
-                .ok_or(CliError::ProjectNotResolved)?;
-
-            (project, hostname)
+        Some(selector) => {
+            let resolved = resolve_project_selector(&database, &selector)?;
+            let hostname = served_project_hostname(&resolved.project)?.to_string();
+            (
+                resolved.project,
+                resolved.matched_hostname.unwrap_or(hostname),
+            )
         }
         None => resolve_open_project(&database, environment, stdout)?,
     };
@@ -154,7 +175,11 @@ pub(crate) fn open(
     environment.open_url(&url)?;
 
     let mut output = Output::new(stdout, OutputMode::plain());
-    output.line(&format!("Opened {} for {}", url, project.primary_hostname))?;
+    output.line(&format!(
+        "Opened {} for {}",
+        url,
+        project_display_name(&project)
+    ))?;
 
     Ok(ExitCode::SUCCESS)
 }
@@ -169,22 +194,35 @@ pub(crate) fn env(
     let database = Database::open(&paths)?;
     let project = resolve_project(&database, args.hostname.as_deref(), environment)?;
     let config_file = ProjectConfigFile::read_from_root(&project.path)?;
-    database.validate_project_hostnames(
-        &project.id,
-        &project.primary_hostname,
-        &config_file.config.hostnames,
-    )?;
+    let serves_http = project.mode == ProjectMode::Served && config_file.config.serve;
+    if serves_http {
+        database.validate_project_hostnames(
+            &project.id,
+            served_project_hostname(&project)?,
+            &config_file.config.hostnames,
+        )?;
+    }
     config::validate_project_env_shape(&config_file.config)?;
 
-    let context = project_env_context(&paths, database.project_env_context(&project.id)?);
+    let context = project_env_context(
+        &paths,
+        database.project_env_context(&project.id)?,
+        serves_http,
+    );
     let rendered = config::render_project_env(&config_file.config, &context)?;
-    let existing_env = read_project_env_file(&project.path)?;
-    let transform = config::transform_managed_env_block(existing_env.as_deref(), &rendered)?;
+    let warnings = if config_file.config.has_env_mappings() {
+        let env_file_path =
+            config::resolve_project_env_file_path(&project.path, &config_file.config)?;
+        let existing_env = read_project_env_file(&env_file_path)?;
+        config::transform_managed_env_block(existing_env.as_deref(), &rendered)?.warnings
+    } else {
+        Vec::new()
+    };
 
     if args.json {
         serde_json::to_writer(&mut *stdout, &rendered.values)?;
         writeln!(stdout)?;
-        write_project_env_warnings(&transform.warnings, stderr)?;
+        write_project_env_warnings(&warnings, stderr)?;
 
         return Ok(ExitCode::SUCCESS);
     }
@@ -195,7 +233,7 @@ pub(crate) fn env(
     }
 
     write!(stdout, "{content}")?;
-    write_project_env_warnings(&transform.warnings, stderr)?;
+    write_project_env_warnings(&warnings, stderr)?;
 
     Ok(ExitCode::SUCCESS)
 }
@@ -207,7 +245,12 @@ pub(crate) fn list(
 ) -> Result<ExitCode, ExecuteError> {
     let paths = pv_paths(environment)?;
     let database = Database::open(&paths)?;
-    let projects = database.projects()?;
+    let mut projects = database.projects()?;
+    projects.sort_by(|left, right| {
+        project_display_name(left)
+            .cmp(project_display_name(right))
+            .then_with(|| left.id.cmp(&right.id))
+    });
 
     if args.json {
         let projects = projects
@@ -227,12 +270,13 @@ pub(crate) fn list(
         return Ok(ExitCode::SUCCESS);
     }
 
-    output.line("Hostname  PHP  Status  Resources  Env  Path")?;
+    output.line("Project  Mode  PHP  Status  Resources  Env  Path")?;
     for project in projects {
         let status = project_list_status(&database, &project)?;
         output.line(&format!(
-            "{}  {}  {}  unknown  {}  {}",
-            project.primary_hostname,
+            "{}  {}  {}  {}  unknown  {}  {}",
+            project_display_name(&project),
+            project.mode.as_str(),
             project.desired_php_track.as_deref().unwrap_or("default"),
             status.project.as_str(),
             status.env.as_str(),
@@ -258,7 +302,8 @@ fn request_project_reconciliation(
     match daemon::submit_job_blocking(paths.clone(), "reconcile", &scope) {
         Ok(job) => output.line(&format!(
             "Queued reconciliation {} for {}",
-            job.id, project.primary_hostname
+            job.id,
+            project_display_name(project)
         ))?,
         Err(daemon::DaemonError::Io(error)) if daemon_is_unavailable(&error) => output.line(
             "warning: PV daemon is not running; reconciliation will run after `pv setup` starts it",
@@ -291,7 +336,7 @@ fn resolve_open_project(
 ) -> Result<(ProjectRecord, String), ExecuteError> {
     let current_dir = current_dir(environment)?;
     if let Some(project) = database.nearest_project_for_path(&current_dir)? {
-        let hostname = project.primary_hostname.clone();
+        let hostname = served_project_hostname(&project)?.to_string();
         return Ok((project, hostname));
     }
 
@@ -299,8 +344,18 @@ fn resolve_open_project(
         return Err(CliError::ProjectNotResolved.into());
     }
 
-    let project = select_project(database.projects()?, environment, stdout)?;
-    let hostname = project.primary_hostname.clone();
+    let mut projects = database
+        .projects()?
+        .into_iter()
+        .filter(|project| project.mode == ProjectMode::Served && project.primary_hostname.is_some())
+        .collect::<Vec<_>>();
+    projects.sort_by(|left, right| {
+        left.primary_hostname
+            .cmp(&right.primary_hostname)
+            .then_with(|| left.id.cmp(&right.id))
+    });
+    let project = select_project(projects, environment, stdout)?;
+    let hostname = served_project_hostname(&project)?.to_string();
 
     Ok((project, hostname))
 }
@@ -320,7 +375,7 @@ fn select_project(
         output.line(&format!(
             "{}. {}  {}",
             index + 1,
-            project.primary_hostname,
+            project_display_name(project),
             project.path
         ))?;
     }
@@ -360,14 +415,34 @@ fn daemon_is_unavailable(error: &io::Error) -> bool {
     )
 }
 
-fn project_env_context(paths: &PvPaths, context: ProjectEnvStateContext) -> ProjectEnvContext {
+fn project_env_context(
+    paths: &PvPaths,
+    context: ProjectEnvStateContext,
+    serves_http: bool,
+) -> ProjectEnvContext {
     let project_id = context.project_id;
 
     ProjectEnvContext {
-        primary_hostname: context.primary_hostname,
-        tls_ca_path: paths.ca_certificate().to_string(),
-        tls_cert_path: paths.project_tls_certificate(&project_id).to_string(),
-        tls_key_path: paths.project_tls_private_key(&project_id).to_string(),
+        primary_hostname: if serves_http {
+            context.primary_hostname.unwrap_or_default()
+        } else {
+            String::new()
+        },
+        tls_ca_path: if serves_http {
+            paths.ca_certificate().to_string()
+        } else {
+            String::new()
+        },
+        tls_cert_path: if serves_http {
+            paths.project_tls_certificate(&project_id).to_string()
+        } else {
+            String::new()
+        },
+        tls_key_path: if serves_http {
+            paths.project_tls_private_key(&project_id).to_string()
+        } else {
+            String::new()
+        },
         resources: context
             .resources
             .into_iter()
@@ -397,9 +472,8 @@ fn project_env_context(paths: &PvPaths, context: ProjectEnvStateContext) -> Proj
     }
 }
 
-fn read_project_env_file(project_path: &Utf8Path) -> Result<Option<String>, ExecuteError> {
-    let env_path = project_path.join(".env");
-    match state::fs::read_to_string(&env_path) {
+fn read_project_env_file(env_file_path: &Utf8Path) -> Result<Option<String>, ExecuteError> {
+    match state::fs::read_to_string(env_file_path) {
         Ok(content) => Ok(Some(content)),
         Err(error) => {
             if let StateError::Filesystem { source, .. } = &error
@@ -435,14 +509,11 @@ fn project_env_warning(warning: &ProjectEnvWarning) -> String {
 
 fn resolve_project(
     database: &Database,
-    hostname: Option<&str>,
+    selector: Option<&str>,
     environment: &impl Environment,
 ) -> Result<ProjectRecord, ExecuteError> {
-    if let Some(hostname) = hostname {
-        let hostname = config::normalize_primary_hostname(hostname)?;
-        return database
-            .project_by_hostname(&hostname)?
-            .ok_or_else(|| CliError::ProjectNotResolved.into());
+    if let Some(selector) = selector {
+        return Ok(resolve_project_selector(database, selector)?.project);
     }
 
     let current_dir = current_dir(environment)?;
@@ -451,6 +522,85 @@ fn resolve_project(
         .ok_or_else(|| CliError::ProjectNotResolved.into())
 }
 
+struct ResolvedProjectSelector {
+    project: ProjectRecord,
+    matched_hostname: Option<String>,
+}
+
+fn resolve_project_selector(
+    database: &Database,
+    selector: &str,
+) -> Result<ResolvedProjectSelector, ExecuteError> {
+    if selector.contains('.') {
+        let hostname = config::normalize_primary_hostname(selector)?;
+        let project = database
+            .project_by_hostname(&hostname)?
+            .ok_or(CliError::ProjectNotResolved)?;
+
+        return Ok(ResolvedProjectSelector {
+            project,
+            matched_hostname: Some(hostname),
+        });
+    }
+
+    let slug_project = database.project_by_slug(selector)?;
+    let hostname = config::normalize_primary_hostname(selector)?;
+    let hostname_project = database.project_by_hostname(&hostname)?;
+
+    if let (Some(slug_project), Some(hostname_project)) = (&slug_project, &hostname_project)
+        && slug_project.id != hostname_project.id
+    {
+        return Err(CliError::AmbiguousProjectSelector {
+            selector: selector.to_string(),
+            hostname,
+        }
+        .into());
+    }
+
+    if let Some(project) = slug_project {
+        return Ok(ResolvedProjectSelector {
+            project,
+            matched_hostname: None,
+        });
+    }
+    if let Some(project) = hostname_project {
+        return Ok(ResolvedProjectSelector {
+            project,
+            matched_hostname: Some(hostname),
+        });
+    }
+
+    Err(CliError::ProjectNotResolved.into())
+}
+
+fn served_project_hostname(project: &ProjectRecord) -> Result<&str, ExecuteError> {
+    if project.mode == ProjectMode::ResourceOnly {
+        return Err(CliError::ResourceOnlyProjectCannotOpen {
+            project: project.slug.clone(),
+        }
+        .into());
+    }
+
+    project
+        .primary_hostname
+        .as_deref()
+        .ok_or_else(|| StateError::ProjectNotServed {
+            project_id: project.id.clone(),
+        })
+        .map_err(Into::into)
+}
+
+fn project_display_name(project: &ProjectRecord) -> &str {
+    if project.mode == ProjectMode::ResourceOnly {
+        return project.slug.as_str();
+    }
+
+    project
+        .primary_hostname
+        .as_deref()
+        .unwrap_or(project.slug.as_str())
+}
+
 fn resolve_project_path(
     path: Option<&str>,
     environment: &impl Environment,
@@ -504,8 +654,11 @@ struct ProjectListOutput {
 #[derive(Serialize)]
 struct ProjectListItem {
     id: String,
-    hostname: String,
+    mode: &'static str,
+    slug: String,
+    hostname: Option<String>,
     additional_hostnames: Vec<String>,
+    env_file: Option<String>,
     php: String,
     status: &'static str,
     env: &'static str,
@@ -575,11 +728,15 @@ fn project_list_status(
             });
         }
     };
-    if let Err(error) = database.validate_project_hostnames(
-        &project.id,
-        &project.primary_hostname,
-        &config_file.config.hostnames,
-    ) {
+    if project.mode == ProjectMode::Served
+        && config_file.config.serve
+        && let Some(primary_hostname) = project.primary_hostname.as_deref()
+        && let Err(error) = database.validate_project_hostnames(
+            &project.id,
+            primary_hostname,
+            &config_file.config.hostnames,
+        )
+    {
         return Ok(ProjectListStatus {
             project: ProjectStatus::ConfigInvalid,
             env: ProjectEnvStatus::Invalid,
@@ -614,6 +771,9 @@ fn project_list_item(
     project: ProjectRecord,
 ) -> Result<ProjectListItem, ExecuteError> {
     let status = project_list_status(database, &project)?;
+    let env_file = ProjectConfigFile::read_from_root(&project.path)
+        .ok()
+        .map(|config_file| config_file.config.env_file.to_string());
     let resources = database
         .project_managed_resources(&project.id)?
         .into_iter()
@@ -625,8 +785,11 @@ fn project_list_item(
 
     Ok(ProjectListItem {
         id: project.id,
+        mode: project.mode.as_str(),
+        slug: project.slug,
         hostname: project.primary_hostname,
         additional_hostnames: project.additional_hostnames,
+        env_file,
         php: project
             .desired_php_track
             .unwrap_or_else(|| "default".to_string()),
diff --git a/crates/cli/src/commands/status.rs b/crates/cli/src/commands/status.rs
index 950c8040..40a3f22b 100644
--- a/crates/cli/src/commands/status.rs
+++ b/crates/cli/src/commands/status.rs
@@ -151,7 +151,7 @@ impl StatusSnapshot {
             for project in &self.projects {
                 output.line(&format!(
                     "  {} env={} {}",
-                    project.hostname,
+                    project.display_name(),
                     project.env_status,
                     project.message.as_deref().unwrap_or("-"),
                 ))?;
@@ -304,7 +304,9 @@ struct RuntimeStatus {
 
 #[derive(Serialize)]
 struct ProjectStatus {
-    hostname: String,
+    mode: &'static str,
+    slug: String,
+    hostname: Option<String>,
     env_status: &'static str,
     message: Option<String>,
     observed_at: Option<String>,
@@ -312,6 +314,16 @@ struct ProjectStatus {
     failure: bool,
 }
 
+impl ProjectStatus {
+    fn display_name(&self) -> &str {
+        if self.mode == "resource-only" {
+            return &self.slug;
+        }
+
+        self.hostname.as_deref().unwrap_or(&self.slug)
+    }
+}
+
 #[derive(Serialize)]
 struct JobStatusSummary {
     id: String,
@@ -424,6 +436,8 @@ fn project_status(
 ) -> ProjectStatus {
     let Some(observed) = observed else {
         return ProjectStatus {
+            mode: project.mode.as_str(),
+            slug: project.slug,
             hostname: project.primary_hostname,
             env_status: "pending",
             message: Some("Project env has not been observed yet".to_string()),
@@ -440,6 +454,8 @@ fn project_status(
     };
 
     ProjectStatus {
+        mode: project.mode.as_str(),
+        slug: project.slug,
         hostname: project.primary_hostname,
         env_status,
         message,
diff --git a/crates/cli/src/error.rs b/crates/cli/src/error.rs
index 64610804..e975eef0 100644
--- a/crates/cli/src/error.rs
+++ b/crates/cli/src/error.rs
@@ -18,9 +18,17 @@ pub enum CliError {
     #[error("path is not valid UTF-8: {path:?}")]
     NonUtf8Path { path: std::path::PathBuf },
 
-    #[error("could not resolve a linked Project; pass a hostname")]
+    #[error("could not resolve a linked Project; pass a Project slug or hostname")]
     ProjectNotResolved,
 
+    #[error(
+        "Project selector `{selector}` matches slug `{selector}` and hostname `{hostname}` on different Projects; pass the full `{hostname}` hostname"
+    )]
+    AmbiguousProjectSelector { selector: String, hostname: String },
+
+    #[error("Project `{project}` is resource-only and cannot be opened")]
+    ResourceOnlyProjectCannotOpen { project: String },
+
     #[error("invalid Project picker selection `{selection}`; enter a number from 1 to {count}")]
     InvalidProjectSelection { selection: String, count: usize },
 
diff --git a/crates/cli/tests/list_json.rs b/crates/cli/tests/list_json.rs
index c8ddefa9..8b59db13 100644
--- a/crates/cli/tests/list_json.rs
+++ b/crates/cli/tests/list_json.rs
@@ -10,7 +10,7 @@ use cli::{Environment, run_with_environment};
 use insta::{Settings, assert_debug_snapshot};
 use state::{
     Database, LinkProjectInput, ManagedResourceTrackInstallInput, PortRequest,
-    ProjectManagedResourceInput, PvPaths, RuntimeObservedStatus, RuntimeSubject,
+    ProjectManagedResourceInput, ProjectMode, PvPaths, RuntimeObservedStatus, RuntimeSubject,
 };
 
 #[derive(Debug)]
@@ -80,6 +80,99 @@ fn list_json_outputs_linked_projects() -> anyhow::Result<()> {
     Ok(())
 }
 
+#[test]
+fn list_json_exposes_resource_only_mode_slug_and_env_file_without_sentinel() -> anyhow::Result<()> {
+    let tempdir = tempdir()?;
+    let home = tempdir.path().join("home");
+    let project = tempdir.path().join("Resource Project");
+    create_dir(&project.join("config"))?;
+    write_file(
+        &project.join("pv.yml"),
+        "serve: false\nenv_file: config/development.env\n",
+    )?;
+    let paths = PvPaths::for_home(home.clone());
+    let environment = TestEnvironment::new(&home, &project);
+    let mut database = Database::open(&paths)?;
+    database.link_project_with_mode(
+        LinkProjectInput {
+            path: project.clone(),
+            original_path: project.clone(),
+            primary_hostname: "ignored.test".to_string(),
+            config_path: project.join("pv.yml"),
+            desired_php_track: None,
+            additional_hostnames: Vec::new(),
+        },
+        ProjectMode::ResourceOnly,
+    )?;
+    drop(database);
+
+    let output = run_pv(&["list", "--json"], &environment)?;
+    assert!(!output.stdout.contains(".invalid"));
+    let json = parse_json_output(output)?;
+    let project = &json["projects"][0];
+
+    assert_eq!(project["mode"], "resource-only");
+    assert_eq!(project["slug"], "resource-project");
+    assert_eq!(project["hostname"], serde_json::Value::Null);
+    assert_eq!(project["env_file"], "config/development.env");
+    assert_list_json_snapshot(
+        "list_json_exposes_resource_only_mode_slug_and_env_file_without_sentinel",
+        tempdir.path(),
+        &json,
+    );
+
+    Ok(())
+}
+
+#[test]
+fn list_json_sorts_projects_by_displayed_value() -> anyhow::Result<()> {
+    let tempdir = tempdir()?;
+    let home = tempdir.path().join("home");
+    let served = tempdir.path().join("Zulu Web");
+    let resource_only = tempdir.path().join("Beta Data");
+    create_dir(&served)?;
+    create_dir(&resource_only)?;
+    write_file(&served.join("pv.yml"), "")?;
+    write_file(&resource_only.join("pv.yml"), "serve: false\n")?;
+    let paths = PvPaths::for_home(home.clone());
+    let environment = TestEnvironment::new(&home, &served);
+    let mut database = Database::open(&paths)?;
+    database.link_project(LinkProjectInput {
+        path: served.clone(),
+        original_path: served.clone(),
+        primary_hostname: "alpha.test".to_string(),
+        config_path: served.join("pv.yml"),
+        desired_php_track: None,
+        additional_hostnames: Vec::new(),
+    })?;
+    database.link_project_with_mode(
+        LinkProjectInput {
+            path: resource_only.clone(),
+            original_path: resource_only.clone(),
+            primary_hostname: "ignored.test".to_string(),
+            config_path: resource_only.join("pv.yml"),
+            desired_php_track: None,
+            additional_hostnames: Vec::new(),
+        },
+        ProjectMode::ResourceOnly,
+    )?;
+    drop(database);
+
+    let output = run_pv(&["list", "--json"], &environment)?;
+    let json = parse_json_output(output)?;
+    let projects = json["projects"]
+        .as_array()
+        .ok_or_else(|| anyhow::anyhow!("expected Projects array"))?;
+    let [first, second] = projects.as_slice() else {
+        return Err(anyhow::anyhow!("expected exactly two Projects"));
+    };
+
+    assert_eq!(first["hostname"], "alpha.test");
+    assert_eq!(second["slug"], "beta-data");
+
+    Ok(())
+}
+
 #[test]
 fn resource_list_json_outputs_installed_tracks_and_aliases() -> anyhow::Result<()> {
     let tempdir = tempdir()?;
diff --git a/crates/cli/tests/php.rs b/crates/cli/tests/php.rs
index 9b37fa8a..20e438c3 100644
--- a/crates/cli/tests/php.rs
+++ b/crates/cli/tests/php.rs
@@ -14,7 +14,7 @@ use insta::assert_debug_snapshot;
 use resources::{ResourceHttpClient, ResourcesError, TargetPlatform};
 use state::{
     Database, LinkProjectInput, ManagedResourceDesiredState, ManagedResourceTrackRecord,
-    ProjectRecord, PvPaths, fs,
+    ProjectMode, ProjectPhpRuntimeInput, ProjectRecord, PvPaths, fs,
 };
 
 const MANIFEST_URL: &str = "https://artifacts.example.test/manifest.json";
@@ -314,6 +314,117 @@ fn php_shim_uses_persisted_runtime_when_project_config_is_invalid() -> anyhow::R
     Ok(())
 }
 
+#[test]
+fn php_shim_preserves_served_runtime_during_invalid_resource_only_transition() -> anyhow::Result<()>
+{
+    let tempdir = tempdir()?;
+    let home = tempdir.path().join("home");
+    let project = tempdir.path().join("acme");
+    create_dir(&project)?;
+    write_file(&project.join("pv.yml"), "php: 8.4\n")?;
+    let project_record = register_project(&home, &project, "acme.test")?;
+    record_installed_php(&home, "8.3", "8.3.12-pv1")?;
+    let project_release = record_installed_php(&home, "8.4", "8.4.8-pv1")?;
+    {
+        let mut database = Database::open(&pv_paths(&home))?;
+        database.record_global_php_default_track("8.3")?;
+        database.replace_project_php_runtime(
+            &project_record.id,
+            Some(&ProjectPhpRuntimeInput {
+                track: "8.4".to_string(),
+                requested_extensions: Vec::new(),
+                loaded_extensions: Vec::new(),
+                ignored_extensions: Vec::new(),
+            }),
+        )?;
+    }
+    write_file(
+        &project.join("pv.yml"),
+        r#"serve: false
+postgres:
+  version: "8.0"
+  allocations:
+    analytics:
+      env:
+        DATABASE_URL: "postgres://${database}"
+    app:
+      env:
+        DATABASE_URL: "postgres://${database}"
+"#,
+    )?;
+    let environment = TestEnvironment::new(&home, &project_record.path, ScriptedClient::new());
+
+    let output = run_pv(&["shim:php", "-v"], &environment)?;
+    let exec_calls = environment.exec_calls();
+
+    assert_eq!(output.exit_code, ExitCode::SUCCESS);
+    assert_eq!(
+        exec_calls,
+        vec![ExecCall {
+            program: project_release.join("bin/php").as_std_path().to_path_buf(),
+            args: vec!["-v".to_string()],
+            env: php_exec_env(&home, "8.4")?,
+        }]
+    );
+    Ok(())
+}
+
+#[test]
+fn php_shim_preserves_resource_only_runtime_during_invalid_served_transition() -> anyhow::Result<()>
+{
+    let tempdir = tempdir()?;
+    let home = tempdir.path().join("home");
+    let project = tempdir.path().join("resources");
+    create_dir(&project)?;
+    write_file(&project.join("pv.yml"), "serve: false\nphp: 8.4\n")?;
+    let project_record =
+        register_project_with_mode(&home, &project, "ignored.test", ProjectMode::ResourceOnly)?;
+    record_installed_php(&home, "8.3", "8.3.12-pv1")?;
+    let project_release = record_installed_php(&home, "8.4", "8.4.8-pv1")?;
+    {
+        let mut database = Database::open(&pv_paths(&home))?;
+        database.record_global_php_default_track("8.3")?;
+        database.replace_project_php_runtime(
+            &project_record.id,
+            Some(&ProjectPhpRuntimeInput {
+                track: "8.4".to_string(),
+                requested_extensions: Vec::new(),
+                loaded_extensions: Vec::new(),
+                ignored_extensions: Vec::new(),
+            }),
+        )?;
+    }
+    write_file(
+        &project.join("pv.yml"),
+        r#"postgres:
+  version: "8.0"
+  allocations:
+    analytics:
+      env:
+        DATABASE_URL: "postgres://${database}"
+    app:
+      env:
+        DATABASE_URL: "postgres://${database}"
+"#,
+    )?;
+    let environment = TestEnvironment::new(&home, &project_record.path, ScriptedClient::new());
+
+    let output = run_pv(&["shim:php", "-v"], &environment)?;
+    let exec_calls = environment.exec_calls();
+
+    assert_eq!(output.exit_code, ExitCode::SUCCESS);
+    assert_eq!(
+        exec_calls,
+        vec![ExecCall {
+            program: project_release.join("bin/php").as_std_path().to_path_buf(),
+            args: vec!["-v".to_string()],
+            env: php_exec_env(&home, "8.4")?,
+        }]
+    );
+
+    Ok(())
+}
+
 #[test]
 fn php_shim_resolves_project_config_extensions_when_persisted_runtime_is_empty()
 -> anyhow::Result<()> {
@@ -698,6 +809,66 @@ fn php_shim_execs_global_default_track_outside_project() -> anyhow::Result<()> {
     Ok(())
 }
 
+#[test]
+fn php_shim_honors_explicit_resource_only_php_track() -> anyhow::Result<()> {
+    let tempdir = tempdir()?;
+    let home = tempdir.path().join("home");
+    let project = tempdir.path().join("resources");
+    create_dir(&project)?;
+    write_file(&project.join("pv.yml"), "serve: false\nphp: 8.4\n")?;
+    let project_record =
+        register_project_with_mode(&home, &project, "ignored.test", ProjectMode::ResourceOnly)?;
+    let release = record_installed_php(&home, "8.4", "8.4.8-pv1")?;
+    let environment = TestEnvironment::new(&home, &project_record.path, ScriptedClient::new());
+
+    let output = run_pv(&["shim:php", "-v"], &environment)?;
+    let exec_calls = environment.exec_calls();
+
+    assert_eq!(output.exit_code, ExitCode::SUCCESS);
+    assert_eq!(
+        exec_calls,
+        vec![ExecCall {
+            program: release.join("bin/php").as_std_path().to_path_buf(),
+            args: vec!["-v".to_string()],
+            env: php_exec_env(&home, "8.4")?,
+        }]
+    );
+
+    Ok(())
+}
+
+#[test]
+fn php_shim_uses_global_fallback_for_resource_only_project_without_php() -> anyhow::Result<()> {
+    let tempdir = tempdir()?;
+    let home = tempdir.path().join("home");
+    let project = tempdir.path().join("resources");
+    create_dir(&project)?;
+    write_file(&project.join("pv.yml"), "serve: false\n")?;
+    let project_record =
+        register_project_with_mode(&home, &project, "ignored.test", ProjectMode::ResourceOnly)?;
+    let release = record_installed_php(&home, "8.3", "8.3.12-pv1")?;
+    {
+        let mut database = Database::open(&pv_paths(&home))?;
+        database.record_global_php_default_track("8.3")?;
+    }
+    let environment = TestEnvironment::new(&home, &project_record.path, ScriptedClient::new());
+
+    let output = run_pv(&["shim:php", "-v"], &environment)?;
+    let exec_calls = environment.exec_calls();
+
+    assert_eq!(output.exit_code, ExitCode::SUCCESS);
+    assert_eq!(
+        exec_calls,
+        vec![ExecCall {
+            program: release.join("bin/php").as_std_path().to_path_buf(),
+            args: vec!["-v".to_string()],
+            env: php_exec_env(&home, "8.3")?,
+        }]
+    );
+
+    Ok(())
+}
+
 #[test]
 fn php_shim_forwards_help_and_version_flags() -> anyhow::Result<()> {
     let tempdir = tempdir()?;
@@ -1608,18 +1779,30 @@ fn register_project(
     home: &Utf8Path,
     project: &Utf8Path,
     primary_hostname: &str,
+) -> anyhow::Result<ProjectRecord> {
+    register_project_with_mode(home, project, primary_hostname, ProjectMode::Served)
+}
+
+fn register_project_with_mode(
+    home: &Utf8Path,
+    project: &Utf8Path,
+    primary_hostname: &str,
+    mode: ProjectMode,
 ) -> anyhow::Result<ProjectRecord> {
     let config_file = ProjectConfigFile::read_from_root(project)?;
     let project_path = project_root_from_config_path(&config_file.path)?;
     let mut database = Database::open(&pv_paths(home))?;
-    let result = database.link_project(LinkProjectInput {
-        path: project_path,
-        original_path: project.to_path_buf(),
-        primary_hostname: primary_hostname.to_string(),
-        config_path: config_file.path,
-        desired_php_track: None,
-        additional_hostnames: config_file.config.hostnames,
-    })?;
+    let result = database.link_project_with_mode(
+        LinkProjectInput {
+            path: project_path,
+            original_path: project.to_path_buf(),
+            primary_hostname: primary_hostname.to_string(),
+            config_path: config_file.path,
+            desired_php_track: None,
+            additional_hostnames: config_file.config.hostnames,
+        },
+        mode,
+    )?;
 
     Ok(result.project)
 }
@@ -1659,7 +1842,10 @@ struct ProjectSnapshot {
 
 fn project_snapshot(project: &ProjectRecord, root: &Utf8Path) -> anyhow::Result<ProjectSnapshot> {
     Ok(ProjectSnapshot {
-        primary_hostname: project.primary_hostname.clone(),
+        primary_hostname: project
+            .primary_hostname
+            .clone()
+            .ok_or_else(|| anyhow::anyhow!("expected served Project hostname"))?,
         path: normalize_path(&project.path, root),
         config_path: normalize_path(&project.config_path, root),
         desired_php_track: project.desired_php_track.clone(),
diff --git a/crates/cli/tests/project_env.rs b/crates/cli/tests/project_env.rs
index e2d85549..b2ea2539 100644
--- a/crates/cli/tests/project_env.rs
+++ b/crates/cli/tests/project_env.rs
@@ -11,8 +11,8 @@ use cli::{Environment, run_with_environment};
 use config::ProjectConfigFile;
 use insta::{Settings, assert_debug_snapshot};
 use state::{
-    Database, EnvContextValues, LinkProjectInput, ProjectManagedResourceInput, ProjectRecord,
-    PvPaths, ResourceAllocationInput,
+    Database, EnvContextValues, LinkProjectInput, ProjectManagedResourceInput, ProjectMode,
+    ProjectRecord, PvPaths, ResourceAllocationInput,
 };
 
 #[derive(Debug)]
@@ -204,6 +204,76 @@ fn project_env_json_returns_empty_object_for_no_mappings() -> anyhow::Result<()>
     Ok(())
 }
 
+#[test]
+fn project_env_resolves_resource_only_slug_and_reads_configured_env_file() -> anyhow::Result<()> {
+    let tempdir = tempdir()?;
+    let home = tempdir.path().join("home");
+    let project = tempdir.path().join("Resource Project");
+    create_dir(&project.join("config"))?;
+    write_file(
+        &project.join("pv.yml"),
+        r#"serve: false
+env_file: config/development.env
+env:
+  APP_NAME: resource-project
+  APP_URL: "${project_url}"
+"#,
+    )?;
+    let env_path = project.join("config/development.env");
+    let env_before = "USER_VALUE=kept\n";
+    write_file(&env_path, env_before)?;
+    register_project_with_mode(&home, &project, "ignored.test", ProjectMode::ResourceOnly)?;
+    let environment = TestEnvironment::new(&home, &project);
+
+    let output = run_pv(&["project:env", "resource-project"], &environment)?;
+
+    assert_eq!(output.exit_code, ExitCode::SUCCESS);
+    assert_eq!(output.stdout, "APP_NAME=resource-project\n");
+    assert!(output.stderr.is_empty());
+    assert_eq!(read_file(&env_path)?, env_before);
+    assert!(!output.stdout.contains("project_url"));
+    assert_debug_snapshot!((output, env_before));
+
+    Ok(())
+}
+
+#[test]
+fn project_env_rejects_bare_slug_hostname_ambiguity() -> anyhow::Result<()> {
+    let tempdir = tempdir()?;
+    let home = tempdir.path().join("home");
+    let resource_only = tempdir.path().join("acme");
+    let served = tempdir.path().join("web");
+    let outside = tempdir.path().join("outside");
+    create_dir(&resource_only)?;
+    create_dir(&served)?;
+    create_dir(&outside)?;
+    write_file(
+        &resource_only.join("pv.yml"),
+        "serve: false\nenv:\n  PROJECT_KIND: resource\n",
+    )?;
+    write_file(&served.join("pv.yml"), "env:\n  PROJECT_KIND: served\n")?;
+    register_project_with_mode(
+        &home,
+        &resource_only,
+        "ignored.test",
+        ProjectMode::ResourceOnly,
+    )?;
+    register_project_with_mode(&home, &served, "acme.test", ProjectMode::Served)?;
+    let environment = TestEnvironment::new(&home, &outside);
+
+    let ambiguous = run_pv(&["project:env", "acme"], &environment)?;
+    let explicit_hostname = run_pv(&["project:env", "acme.test"], &environment)?;
+
+    assert_eq!(ambiguous.exit_code, ExitCode::FAILURE);
+    assert!(ambiguous.stdout.is_empty());
+    assert!(ambiguous.stderr.contains("full `acme.test` hostname"));
+    assert_eq!(explicit_hostname.exit_code, ExitCode::SUCCESS);
+    assert_eq!(explicit_hostname.stdout, "PROJECT_KIND=served\n");
+    assert_debug_snapshot!((ambiguous, explicit_hostname));
+
+    Ok(())
+}
+
 #[test]
 fn project_env_writes_duplicate_warnings_to_stderr_without_mutating_dotenv() -> anyhow::Result<()> {
     let tempdir = tempdir()?;
@@ -333,6 +403,15 @@ fn register_project(
     home: &Utf8Path,
     project: &Utf8Path,
     primary_hostname: &str,
+) -> anyhow::Result<ProjectRecord> {
+    register_project_with_mode(home, project, primary_hostname, ProjectMode::Served)
+}
+
+fn register_project_with_mode(
+    home: &Utf8Path,
+    project: &Utf8Path,
+    primary_hostname: &str,
+    mode: ProjectMode,
 ) -> anyhow::Result<ProjectRecord> {
     let config_file = ProjectConfigFile::read_from_root(project)?;
     let project_path = project_root_from_config_path(&config_file.path)?;
@@ -343,14 +422,17 @@ fn register_project(
         .and_then(|php| php.version_selector())
         .map(str::to_owned);
     let mut database = Database::open(&pv_paths(home))?;
-    let result = database.link_project(LinkProjectInput {
-        path: project_path,
-        original_path: project.to_path_buf(),
-        primary_hostname: primary_hostname.to_string(),
-        config_path: config_file.path,
-        desired_php_track,
-        additional_hostnames: config_file.config.hostnames,
-    })?;
+    let result = database.link_project_with_mode(
+        LinkProjectInput {
+            path: project_path,
+            original_path: project.to_path_buf(),
+            primary_hostname: primary_hostname.to_string(),
+            config_path: config_file.path,
+            desired_php_track,
+            additional_hostnames: config_file.config.hostnames,
+        },
+        mode,
+    )?;
 
     Ok(result.project)
 }
diff --git a/crates/cli/tests/project_open.rs b/crates/cli/tests/project_open.rs
index 45b41813..3b20cdf0 100644
--- a/crates/cli/tests/project_open.rs
+++ b/crates/cli/tests/project_open.rs
@@ -9,7 +9,7 @@ use camino::{Utf8Path, Utf8PathBuf};
 use camino_tempfile::tempdir;
 use cli::{Environment, run_with_environment};
 use insta::assert_debug_snapshot;
-use state::{Database, PvPaths};
+use state::{Database, ProjectMode, PvPaths};
 
 #[derive(Debug)]
 struct TestEnvironment {
@@ -141,6 +141,50 @@ fn link_rejects_update_lock_without_recording_project() -> anyhow::Result<()> {
     Ok(())
 }
 
+#[test]
+fn link_rejects_invalid_mode_change_without_replacing_served_state() -> anyhow::Result<()> {
+    let tempdir = tempdir()?;
+    let home = tempdir.path().join("home");
+    let project = tempdir.path().join("acme");
+    create_dir(&project)?;
+    let paths = PvPaths::for_home(home.clone());
+    let environment = TestEnvironment::new(&home, &project);
+
+    let initial_link = run_pv(&["link"], &environment)?;
+    write_file(
+        &project.join("pv.yml"),
+        r#"serve: false
+postgres:
+  allocations:
+    analytics:
+      env:
+        DATABASE_URL: "postgres://${database}"
+    app:
+      env:
+        DATABASE_URL: "postgres://${database}"
+"#,
+    )?;
+    let invalid_link = run_pv(&["link"], &environment)?;
+    let database = Database::open(&paths)?;
+    let linked = database
+        .project_by_path(&canonical_path(&project)?)?
+        .ok_or_else(|| anyhow::anyhow!("expected linked Project"))?;
+
+    assert_eq!(initial_link.exit_code, ExitCode::SUCCESS);
+    assert_eq!(invalid_link.exit_code, ExitCode::FAILURE);
+    assert_eq!(linked.mode, ProjectMode::Served);
+    let mut settings = insta::Settings::clone_current();
+    settings.add_filter(tempdir.path().as_str(), "<tempdir>");
+    settings.add_filter("/private<tempdir>", "<tempdir>");
+    settings.add_filter(r"\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z", "<timestamp>");
+    settings.add_filter(r#"id: "[a-z0-9]{10}""#, r#"id: "<project_id>""#);
+    settings.bind(|| {
+        assert_debug_snapshot!((initial_link, invalid_link, linked));
+    });
+
+    Ok(())
+}
+
 #[test]
 fn open_additional_hostname_argument_opens_exact_hostname() -> anyhow::Result<()> {
     let tempdir = tempdir()?;
@@ -233,37 +277,83 @@ fn open_uses_project_picker_when_outside_a_linked_project() -> anyhow::Result<()
     Ok(())
 }
 
+#[test]
+fn open_rejects_resource_only_target_and_excludes_it_from_picker() -> anyhow::Result<()> {
+    let tempdir = tempdir()?;
+    let home = tempdir.path().join("home");
+    let resource_only = tempdir.path().join("resources");
+    let served = tempdir.path().join("web");
+    let outside = tempdir.path().join("outside");
+    create_dir(&resource_only)?;
+    create_dir(&served)?;
+    create_dir(&outside)?;
+    write_file(&resource_only.join("pv.yml"), "serve: false\n")?;
+    let environment = TestEnvironment::new(&home, &resource_only).interactive(["1\n"]);
+
+    let link_resource_only = run_pv(&["link"], &environment)?;
+    let explicit_open = run_pv(&["open", "resources"], &environment)?;
+    let current_open = run_pv(&["open"], &environment)?;
+    environment.set_current_dir(&served);
+    let link_served = run_pv(&["link"], &environment)?;
+    environment.set_current_dir(&outside);
+    let picker_open = run_pv(&["open"], &environment)?;
+    let opened_urls = environment.opened_urls();
+
+    assert_eq!(link_resource_only.exit_code, ExitCode::SUCCESS);
+    assert_eq!(explicit_open.exit_code, ExitCode::FAILURE);
+    assert_eq!(current_open.exit_code, ExitCode::FAILURE);
+    assert_eq!(link_served.exit_code, ExitCode::SUCCESS);
+    assert_eq!(picker_open.exit_code, ExitCode::SUCCESS);
+    assert_eq!(opened_urls, ["https://web.test"]);
+    assert!(!picker_open.stdout.contains("resources"));
+    let mut settings = insta::Settings::clone_current();
+    settings.add_filter(tempdir.path().as_str(), "<tempdir>");
+    settings.add_filter("/private<tempdir>", "<tempdir>");
+    settings.bind(|| {
+        assert_debug_snapshot!((
+            link_resource_only,
+            explicit_open,
+            current_open,
+            link_served,
+            picker_open,
+            opened_urls
+        ));
+    });
+
+    Ok(())
+}
+
 #[test]
 fn open_project_picker_sorts_projects_by_primary_hostname() -> anyhow::Result<()> {
     let tempdir = tempdir()?;
     let home = tempdir.path().join("home");
-    let acme = tempdir.path().join("acme");
-    let zeta = tempdir.path().join("zeta");
+    let first_by_slug = tempdir.path().join("alpha-project");
+    let second_by_slug = tempdir.path().join("zeta-project");
     let outside = tempdir.path().join("outside");
-    create_dir(&acme)?;
-    create_dir(&zeta)?;
+    create_dir(&first_by_slug)?;
+    create_dir(&second_by_slug)?;
     create_dir(&outside)?;
-    let environment = TestEnvironment::new(&home, &zeta).interactive(["2\n"]);
+    let environment = TestEnvironment::new(&home, &first_by_slug).interactive(["2\n"]);
 
-    let link_zeta = run_pv(&["link"], &environment)?;
-    environment.set_current_dir(&acme);
-    let link_acme = run_pv(&["link"], &environment)?;
+    let link_zeta = run_pv(&["link", "--hostname", "zeta"], &environment)?;
+    environment.set_current_dir(&second_by_slug);
+    let link_alpha = run_pv(&["link", "--hostname", "alpha"], &environment)?;
     environment.set_current_dir(&outside);
     let open = run_pv(&["open"], &environment)?;
     let opened_urls = environment.opened_urls();
 
     assert_eq!(link_zeta.exit_code, ExitCode::SUCCESS);
-    assert_eq!(link_acme.exit_code, ExitCode::SUCCESS);
+    assert_eq!(link_alpha.exit_code, ExitCode::SUCCESS);
     assert_eq!(open.exit_code, ExitCode::SUCCESS);
     assert_eq!(opened_urls, vec!["https://zeta.test"]);
     assert!(link_zeta.stderr.is_empty());
-    assert!(link_acme.stderr.is_empty());
+    assert!(link_alpha.stderr.is_empty());
     assert!(open.stderr.is_empty());
     let mut settings = insta::Settings::clone_current();
     settings.add_filter(tempdir.path().as_str(), "<tempdir>");
     settings.add_filter("/private<tempdir>", "<tempdir>");
     settings.bind(|| {
-        assert_debug_snapshot!((link_zeta, link_acme, open, opened_urls));
+        assert_debug_snapshot!((link_zeta, link_alpha, open, opened_urls));
     });
 
     Ok(())
diff --git a/crates/cli/tests/project_unlink.rs b/crates/cli/tests/project_unlink.rs
index e00e946d..e6f6fc6f 100644
--- a/crates/cli/tests/project_unlink.rs
+++ b/crates/cli/tests/project_unlink.rs
@@ -88,6 +88,36 @@ fn unlink_removes_project_tls_directory() -> anyhow::Result<()> {
     Ok(())
 }
 
+#[test]
+fn unlink_resolves_resource_only_slug_and_leaves_managed_env_block() -> anyhow::Result<()> {
+    let tempdir = tempdir()?;
+    let home = tempdir.path().join("home");
+    let project_path = tempdir.path().join("acme");
+    state::fs::write_sensitive_file(&project_path.join("pv.yml"), "serve: false\n")?;
+    let env_path = project_path.join(".env");
+    let env_before = "USER_VALUE=kept\n# >>> PV MANAGED\nAPP_NAME=acme\n# <<< PV MANAGED\n";
+    state::fs::write_sensitive_file(&env_path, env_before)?;
+    let paths = PvPaths::for_home(home.clone());
+    let environment = TestEnvironment::new(&home, &project_path);
+
+    let link = run_pv(&["link"], &environment)?;
+    let unlink = run_pv(&["unlink", "acme"], &environment)?;
+    let database = Database::open(&paths)?;
+
+    assert_eq!(link.exit_code, ExitCode::SUCCESS);
+    assert_eq!(unlink.exit_code, ExitCode::SUCCESS);
+    assert!(database.projects()?.is_empty());
+    assert_eq!(state::fs::read_to_string(&env_path)?, env_before);
+    let mut settings = Settings::clone_current();
+    settings.add_filter(tempdir.path().as_str(), "<tempdir>");
+    settings.add_filter("/private<tempdir>", "<tempdir>");
+    settings.bind(|| {
+        assert_debug_snapshot!((link, unlink, env_before));
+    });
+
+    Ok(())
+}
+
 fn seed_project(paths: &PvPaths, project_path: &Utf8Path) -> anyhow::Result<ProjectRecord> {
     state::fs::write_sensitive_file(&project_path.join("pv.yml"), "php: 8.4\n")?;
 
@@ -106,6 +136,7 @@ fn seed_project(paths: &PvPaths, project_path: &Utf8Path) -> anyhow::Result<Proj
     Ok(project)
 }
 
+#[derive(Debug)]
 struct RunOutput {
     exit_code: ExitCode,
     stdout: String,
diff --git a/crates/cli/tests/snapshots/doctor__doctor_fails_when_active_pf_redirects_are_missing.snap b/crates/cli/tests/snapshots/doctor__doctor_fails_when_active_pf_redirects_are_missing.snap
index a387824b..6a5843a9 100644
--- a/crates/cli/tests/snapshots/doctor__doctor_fails_when_active_pf_redirects_are_missing.snap
+++ b/crates/cli/tests/snapshots/doctor__doctor_fails_when_active_pf_redirects_are_missing.snap
@@ -8,6 +8,6 @@ RunOutput {
             1,
         ),
     ),
-    stdout: "PV doctor\n[pass] State layout: 9 PV-owned directories have user-only permissions\n[pass] Database: read-only open succeeded; 8 migrations applied\n[pass] Daemon LaunchAgent: PV-owned LaunchAgent is installed\n  path: <tempdir>/home/Library/LaunchAgents/com.prvious.pv.daemon.plist\n[pass] Daemon socket: daemon answered health check\n  path: <tempdir>/home/.pv/run/pv.sock\n[pass] DNS config: system resolver uses port 35353\n[fail] Port redirect config: active pf redirects are not loaded\n  repair: `pv ports:install`\n[pass] Local CA trust: system trust matches fingerprint <fingerprint>\n[pass] Recent jobs: no failed jobs in recent history\n[pass] Runtime states: no degraded or failed runtime observations\n[pass] Artifact manifest cache: cached manifest is present\n  path: <tempdir>/home/.pv/downloads/manifest.json\nSummary: 9 passed, 0 warning(s), 1 failed\n",
+    stdout: "PV doctor\n[pass] State layout: 9 PV-owned directories have user-only permissions\n[pass] Database: read-only open succeeded; 9 migrations applied\n[pass] Daemon LaunchAgent: PV-owned LaunchAgent is installed\n  path: <tempdir>/home/Library/LaunchAgents/com.prvious.pv.daemon.plist\n[pass] Daemon socket: daemon answered health check\n  path: <tempdir>/home/.pv/run/pv.sock\n[pass] DNS config: system resolver uses port 35353\n[fail] Port redirect config: active pf redirects are not loaded\n  repair: `pv ports:install`\n[pass] Local CA trust: system trust matches fingerprint <fingerprint>\n[pass] Recent jobs: no failed jobs in recent history\n[pass] Runtime states: no degraded or failed runtime observations\n[pass] Artifact manifest cache: cached manifest is present\n  path: <tempdir>/home/.pv/downloads/manifest.json\nSummary: 9 passed, 0 warning(s), 1 failed\n",
     stderr: "",
 }
diff --git a/crates/cli/tests/snapshots/doctor__doctor_fails_when_daemon_socket_is_stale.snap b/crates/cli/tests/snapshots/doctor__doctor_fails_when_daemon_socket_is_stale.snap
index b52c34a4..499fc9df 100644
--- a/crates/cli/tests/snapshots/doctor__doctor_fails_when_daemon_socket_is_stale.snap
+++ b/crates/cli/tests/snapshots/doctor__doctor_fails_when_daemon_socket_is_stale.snap
@@ -8,6 +8,6 @@ RunOutput {
             1,
         ),
     ),
-    stdout: "PV doctor\n[pass] State layout: 9 PV-owned directories have user-only permissions\n[pass] Database: read-only open succeeded; 8 migrations applied\n[pass] Daemon LaunchAgent: PV-owned LaunchAgent is installed\n  path: <tempdir>/home/Library/LaunchAgents/com.prvious.pv.daemon.plist\n[fail] Daemon socket: daemon socket is present but daemon did not answer health check\n  path: <tempdir>/home/.pv/run/pv.sock; error: I/O error: Socket operation on non-socket (os error 38)\n  repair: `pv daemon:restart`\n[pass] DNS config: system resolver uses port 35353\n[pass] Port redirect config: system pf config and active redirects are current\n[pass] Local CA trust: system trust matches fingerprint <fingerprint>\n[pass] Recent jobs: no failed jobs in recent history\n[pass] Runtime states: no degraded or failed runtime observations\n[pass] Artifact manifest cache: cached manifest is present\n  path: <tempdir>/home/.pv/downloads/manifest.json\nSummary: 9 passed, 0 warning(s), 1 failed\n",
+    stdout: "PV doctor\n[pass] State layout: 9 PV-owned directories have user-only permissions\n[pass] Database: read-only open succeeded; 9 migrations applied\n[pass] Daemon LaunchAgent: PV-owned LaunchAgent is installed\n  path: <tempdir>/home/Library/LaunchAgents/com.prvious.pv.daemon.plist\n[fail] Daemon socket: daemon socket is present but daemon did not answer health check\n  path: <tempdir>/home/.pv/run/pv.sock; error: I/O error: Socket operation on non-socket (os error 38)\n  repair: `pv daemon:restart`\n[pass] DNS config: system resolver uses port 35353\n[pass] Port redirect config: system pf config and active redirects are current\n[pass] Local CA trust: system trust matches fingerprint <fingerprint>\n[pass] Recent jobs: no failed jobs in recent history\n[pass] Runtime states: no degraded or failed runtime observations\n[pass] Artifact manifest cache: cached manifest is present\n  path: <tempdir>/home/.pv/downloads/manifest.json\nSummary: 9 passed, 0 warning(s), 1 failed\n",
     stderr: "",
 }
diff --git a/crates/cli/tests/snapshots/doctor__doctor_fails_when_system_ca_trust_is_missing.snap b/crates/cli/tests/snapshots/doctor__doctor_fails_when_system_ca_trust_is_missing.snap
index 7f5909ce..61aaf3ff 100644
--- a/crates/cli/tests/snapshots/doctor__doctor_fails_when_system_ca_trust_is_missing.snap
+++ b/crates/cli/tests/snapshots/doctor__doctor_fails_when_system_ca_trust_is_missing.snap
@@ -8,6 +8,6 @@ RunOutput {
             1,
         ),
     ),
-    stdout: "PV doctor\n[pass] State layout: 9 PV-owned directories have user-only permissions\n[pass] Database: read-only open succeeded; 8 migrations applied\n[pass] Daemon LaunchAgent: PV-owned LaunchAgent is installed\n  path: <tempdir>/home/Library/LaunchAgents/com.prvious.pv.daemon.plist\n[pass] Daemon socket: daemon answered health check\n  path: <tempdir>/home/.pv/run/pv.sock\n[pass] DNS config: system resolver uses port 35353\n[pass] Port redirect config: system pf config and active redirects are current\n[fail] Local CA trust: local CA is not trusted in the System keychain\n  fingerprint: <fingerprint>\n  repair: `pv ca:trust`\n[pass] Recent jobs: no failed jobs in recent history\n[pass] Runtime states: no degraded or failed runtime observations\n[pass] Artifact manifest cache: cached manifest is present\n  path: <tempdir>/home/.pv/downloads/manifest.json\nSummary: 9 passed, 0 warning(s), 1 failed\n",
+    stdout: "PV doctor\n[pass] State layout: 9 PV-owned directories have user-only permissions\n[pass] Database: read-only open succeeded; 9 migrations applied\n[pass] Daemon LaunchAgent: PV-owned LaunchAgent is installed\n  path: <tempdir>/home/Library/LaunchAgents/com.prvious.pv.daemon.plist\n[pass] Daemon socket: daemon answered health check\n  path: <tempdir>/home/.pv/run/pv.sock\n[pass] DNS config: system resolver uses port 35353\n[pass] Port redirect config: system pf config and active redirects are current\n[fail] Local CA trust: local CA is not trusted in the System keychain\n  fingerprint: <fingerprint>\n  repair: `pv ca:trust`\n[pass] Recent jobs: no failed jobs in recent history\n[pass] Runtime states: no degraded or failed runtime observations\n[pass] Artifact manifest cache: cached manifest is present\n  path: <tempdir>/home/.pv/downloads/manifest.json\nSummary: 9 passed, 0 warning(s), 1 failed\n",
     stderr: "",
 }
diff --git a/crates/cli/tests/snapshots/doctor__doctor_fails_when_system_resolver_is_missing.snap b/crates/cli/tests/snapshots/doctor__doctor_fails_when_system_resolver_is_missing.snap
index a894dd19..10b61f69 100644
--- a/crates/cli/tests/snapshots/doctor__doctor_fails_when_system_resolver_is_missing.snap
+++ b/crates/cli/tests/snapshots/doctor__doctor_fails_when_system_resolver_is_missing.snap
@@ -8,6 +8,6 @@ RunOutput {
             1,
         ),
     ),
-    stdout: "PV doctor\n[pass] State layout: 9 PV-owned directories have user-only permissions\n[pass] Database: read-only open succeeded; 8 migrations applied\n[pass] Daemon LaunchAgent: PV-owned LaunchAgent is installed\n  path: <tempdir>/home/Library/LaunchAgents/com.prvious.pv.daemon.plist\n[pass] Daemon socket: daemon answered health check\n  path: <tempdir>/home/.pv/run/pv.sock\n[fail] DNS config: system resolver config is missing\n  path: <tempdir>/home/etc/resolver/test\n  repair: `pv dns:install`\n[pass] Port redirect config: system pf config and active redirects are current\n[pass] Local CA trust: system trust matches fingerprint <fingerprint>\n[pass] Recent jobs: no failed jobs in recent history\n[pass] Runtime states: no degraded or failed runtime observations\n[pass] Artifact manifest cache: cached manifest is present\n  path: <tempdir>/home/.pv/downloads/manifest.json\nSummary: 9 passed, 0 warning(s), 1 failed\n",
+    stdout: "PV doctor\n[pass] State layout: 9 PV-owned directories have user-only permissions\n[pass] Database: read-only open succeeded; 9 migrations applied\n[pass] Daemon LaunchAgent: PV-owned LaunchAgent is installed\n  path: <tempdir>/home/Library/LaunchAgents/com.prvious.pv.daemon.plist\n[pass] Daemon socket: daemon answered health check\n  path: <tempdir>/home/.pv/run/pv.sock\n[fail] DNS config: system resolver config is missing\n  path: <tempdir>/home/etc/resolver/test\n  repair: `pv dns:install`\n[pass] Port redirect config: system pf config and active redirects are current\n[pass] Local CA trust: system trust matches fingerprint <fingerprint>\n[pass] Recent jobs: no failed jobs in recent history\n[pass] Runtime states: no degraded or failed runtime observations\n[pass] Artifact manifest cache: cached manifest is present\n  path: <tempdir>/home/.pv/downloads/manifest.json\nSummary: 9 passed, 0 warning(s), 1 failed\n",
     stderr: "",
 }
diff --git a/crates/cli/tests/snapshots/doctor__doctor_fails_with_repair_commands.snap b/crates/cli/tests/snapshots/doctor__doctor_fails_with_repair_commands.snap
index 70670a44..76411adf 100644
--- a/crates/cli/tests/snapshots/doctor__doctor_fails_with_repair_commands.snap
+++ b/crates/cli/tests/snapshots/doctor__doctor_fails_with_repair_commands.snap
@@ -8,6 +8,6 @@ RunOutput {
             1,
         ),
     ),
-    stdout: "PV doctor\n[pass] State layout: 9 PV-owned directories have user-only permissions\n[pass] Database: read-only open succeeded; 8 migrations applied\n[pass] Daemon LaunchAgent: PV-owned LaunchAgent is installed\n  path: <tempdir>/home/Library/LaunchAgents/com.prvious.pv.daemon.plist\n[fail] Daemon socket: daemon socket is missing\n  path: <tempdir>/home/.pv/run/pv.sock\n  repair: `pv daemon:restart`\n[pass] DNS config: system resolver uses port 35353\n[pass] Port redirect config: system pf config and active redirects are current\n[pass] Local CA trust: system trust matches fingerprint <fingerprint>\n[fail] Recent jobs: 1 failed job(s) in recent history\n  <job-id> reconcile system: Gateway failed to start\n  repair: `pv setup`\n[fail] Runtime states: 1 degraded or failed runtime observation(s)\n  gateway Gateway failed to start\n  repair: `pv daemon:restart`\n[pass] Artifact manifest cache: cached manifest is present\n  path: <tempdir>/home/.pv/downloads/manifest.json\nSummary: 7 passed, 0 warning(s), 3 failed\n",
+    stdout: "PV doctor\n[pass] State layout: 9 PV-owned directories have user-only permissions\n[pass] Database: read-only open succeeded; 9 migrations applied\n[pass] Daemon LaunchAgent: PV-owned LaunchAgent is installed\n  path: <tempdir>/home/Library/LaunchAgents/com.prvious.pv.daemon.plist\n[fail] Daemon socket: daemon socket is missing\n  path: <tempdir>/home/.pv/run/pv.sock\n  repair: `pv daemon:restart`\n[pass] DNS config: system resolver uses port 35353\n[pass] Port redirect config: system pf config and active redirects are current\n[pass] Local CA trust: system trust matches fingerprint <fingerprint>\n[fail] Recent jobs: 1 failed job(s) in recent history\n  <job-id> reconcile system: Gateway failed to start\n  repair: `pv setup`\n[fail] Runtime states: 1 degraded or failed runtime observation(s)\n  gateway Gateway failed to start\n  repair: `pv daemon:restart`\n[pass] Artifact manifest cache: cached manifest is present\n  path: <tempdir>/home/.pv/downloads/manifest.json\nSummary: 7 passed, 0 warning(s), 3 failed\n",
     stderr: "",
 }
diff --git a/crates/cli/tests/snapshots/doctor__doctor_passes_when_required_checks_pass.snap b/crates/cli/tests/snapshots/doctor__doctor_passes_when_required_checks_pass.snap
index 8e408eac..49413b32 100644
--- a/crates/cli/tests/snapshots/doctor__doctor_passes_when_required_checks_pass.snap
+++ b/crates/cli/tests/snapshots/doctor__doctor_passes_when_required_checks_pass.snap
@@ -8,6 +8,6 @@ RunOutput {
             0,
         ),
     ),
-    stdout: "PV doctor\n[pass] State layout: 9 PV-owned directories have user-only permissions\n[pass] Database: read-only open succeeded; 8 migrations applied\n[pass] Daemon LaunchAgent: PV-owned LaunchAgent is installed\n  path: <tempdir>/home/Library/LaunchAgents/com.prvious.pv.daemon.plist\n[pass] Daemon socket: daemon answered health check\n  path: <tempdir>/home/.pv/run/pv.sock\n[pass] DNS config: system resolver uses port 35353\n[pass] Port redirect config: system pf config and active redirects are current\n[pass] Local CA trust: system trust matches fingerprint <fingerprint>\n[pass] Recent jobs: no failed jobs in recent history\n[pass] Runtime states: no degraded or failed runtime observations\n[pass] Artifact manifest cache: cached manifest is present\n  path: <tempdir>/home/.pv/downloads/manifest.json\nSummary: 10 passed, 0 warning(s), 0 failed\n",
+    stdout: "PV doctor\n[pass] State layout: 9 PV-owned directories have user-only permissions\n[pass] Database: read-only open succeeded; 9 migrations applied\n[pass] Daemon LaunchAgent: PV-owned LaunchAgent is installed\n  path: <tempdir>/home/Library/LaunchAgents/com.prvious.pv.daemon.plist\n[pass] Daemon socket: daemon answered health check\n  path: <tempdir>/home/.pv/run/pv.sock\n[pass] DNS config: system resolver uses port 35353\n[pass] Port redirect config: system pf config and active redirects are current\n[pass] Local CA trust: system trust matches fingerprint <fingerprint>\n[pass] Recent jobs: no failed jobs in recent history\n[pass] Runtime states: no degraded or failed runtime observations\n[pass] Artifact manifest cache: cached manifest is present\n  path: <tempdir>/home/.pv/downloads/manifest.json\nSummary: 10 passed, 0 warning(s), 0 failed\n",
     stderr: "",
 }
diff --git a/crates/cli/tests/snapshots/doctor__doctor_warnings_do_not_fail.snap b/crates/cli/tests/snapshots/doctor__doctor_warnings_do_not_fail.snap
index 3c2ae918..87fb0215 100644
--- a/crates/cli/tests/snapshots/doctor__doctor_warnings_do_not_fail.snap
+++ b/crates/cli/tests/snapshots/doctor__doctor_warnings_do_not_fail.snap
@@ -8,6 +8,6 @@ RunOutput {
             0,
         ),
     ),
-    stdout: "PV doctor\n[pass] State layout: 9 PV-owned directories have user-only permissions\n[pass] Database: read-only open succeeded; 8 migrations applied\n[pass] Daemon LaunchAgent: PV-owned LaunchAgent is installed\n  path: <tempdir>/home/Library/LaunchAgents/com.prvious.pv.daemon.plist\n[pass] Daemon socket: daemon answered health check\n  path: <tempdir>/home/.pv/run/pv.sock\n[pass] DNS config: system resolver uses port 35353\n[pass] Port redirect config: system pf config and active redirects are current\n[pass] Local CA trust: system trust matches fingerprint <fingerprint>\n[pass] Recent jobs: no failed jobs in recent history\n[pass] Runtime states: no degraded or failed runtime observations\n[warn] Artifact manifest cache: cached artifact manifest is missing\n  path: <tempdir>/home/.pv/downloads/manifest.json\n  repair: `pv setup`\nSummary: 9 passed, 1 warning(s), 0 failed\n",
+    stdout: "PV doctor\n[pass] State layout: 9 PV-owned directories have user-only permissions\n[pass] Database: read-only open succeeded; 9 migrations applied\n[pass] Daemon LaunchAgent: PV-owned LaunchAgent is installed\n  path: <tempdir>/home/Library/LaunchAgents/com.prvious.pv.daemon.plist\n[pass] Daemon socket: daemon answered health check\n  path: <tempdir>/home/.pv/run/pv.sock\n[pass] DNS config: system resolver uses port 35353\n[pass] Port redirect config: system pf config and active redirects are current\n[pass] Local CA trust: system trust matches fingerprint <fingerprint>\n[pass] Recent jobs: no failed jobs in recent history\n[pass] Runtime states: no degraded or failed runtime observations\n[warn] Artifact manifest cache: cached artifact manifest is missing\n  path: <tempdir>/home/.pv/downloads/manifest.json\n  repair: `pv setup`\nSummary: 9 passed, 1 warning(s), 0 failed\n",
     stderr: "",
 }
diff --git a/crates/cli/tests/snapshots/list_json__list_json_exposes_resource_only_mode_slug_and_env_file_without_sentinel.snap b/crates/cli/tests/snapshots/list_json__list_json_exposes_resource_only_mode_slug_and_env_file_without_sentinel.snap
new file mode 100644
index 00000000..8370421d
--- /dev/null
+++ b/crates/cli/tests/snapshots/list_json__list_json_exposes_resource_only_mode_slug_and_env_file_without_sentinel.snap
@@ -0,0 +1,22 @@
+---
+source: crates/cli/tests/list_json.rs
+expression: snapshot
+---
+Object {
+    "projects": Array [
+        Object {
+            "additional_hostnames": Array [],
+            "config_path": String("<tempdir>/Resource Project/pv.yml"),
+            "env": String("none"),
+            "env_file": String("config/development.env"),
+            "hostname": Null,
+            "id": String("<project-id>"),
+            "mode": String("resource-only"),
+            "path": String("<tempdir>/Resource Project"),
+            "php": String("default"),
+            "resources": Array [],
+            "slug": String("resource-project"),
+            "status": String("unknown"),
+        },
+    ],
+}
diff --git a/crates/cli/tests/snapshots/list_json__list_json_outputs_linked_projects.snap b/crates/cli/tests/snapshots/list_json__list_json_outputs_linked_projects.snap
index 15b5dc24..733a5b8f 100644
--- a/crates/cli/tests/snapshots/list_json__list_json_outputs_linked_projects.snap
+++ b/crates/cli/tests/snapshots/list_json__list_json_outputs_linked_projects.snap
@@ -10,8 +10,10 @@ Object {
             ],
             "config_path": String("<tempdir>/acme/pv.yml"),
             "env": String("none"),
+            "env_file": String(".env"),
             "hostname": String("acme.test"),
             "id": String("<project-id>"),
+            "mode": String("served"),
             "path": String("<tempdir>/acme"),
             "php": String("8.4"),
             "resources": Array [
@@ -20,6 +22,7 @@ Object {
                     "track": String("8.0"),
                 },
             ],
+            "slug": String("acme"),
             "status": String("unknown"),
         },
     ],
diff --git a/crates/cli/tests/snapshots/php__php_use_latest_preserves_alias_in_config_and_records_resolved_track.snap b/crates/cli/tests/snapshots/php__php_use_latest_preserves_alias_in_config_and_records_resolved_track.snap
index f8c491a7..df1547d0 100644
--- a/crates/cli/tests/snapshots/php__php_use_latest_preserves_alias_in_config_and_records_resolved_track.snap
+++ b/crates/cli/tests/snapshots/php__php_use_latest_preserves_alias_in_config_and_records_resolved_track.snap
@@ -14,6 +14,8 @@ expression: "(output, config_after, config_file.config,\nproject_snapshot(&proje
     },
     "php: latest\nhostnames:\n- api.acme.test\n",
     ProjectConfig {
+        serve: true,
+        env_file: ".env",
         php: Some(
             PhpConfig {
                 version: Some(
diff --git a/crates/cli/tests/snapshots/php__php_use_updates_project_config_state_and_reports_missing_daemon.snap b/crates/cli/tests/snapshots/php__php_use_updates_project_config_state_and_reports_missing_daemon.snap
index fd90e686..56160ddb 100644
--- a/crates/cli/tests/snapshots/php__php_use_updates_project_config_state_and_reports_missing_daemon.snap
+++ b/crates/cli/tests/snapshots/php__php_use_updates_project_config_state_and_reports_missing_daemon.snap
@@ -13,6 +13,8 @@ expression: "(output, config_file.config,\nproject_snapshot(&project_after, temp
         stderr: "",
     },
     ProjectConfig {
+        serve: true,
+        env_file: ".env",
         php: Some(
             PhpConfig {
                 version: Some(
diff --git a/crates/cli/tests/snapshots/project_env__project_env_rejects_bare_slug_hostname_ambiguity.snap b/crates/cli/tests/snapshots/project_env__project_env_rejects_bare_slug_hostname_ambiguity.snap
new file mode 100644
index 00000000..2a445648
--- /dev/null
+++ b/crates/cli/tests/snapshots/project_env__project_env_rejects_bare_slug_hostname_ambiguity.snap
@@ -0,0 +1,24 @@
+---
+source: crates/cli/tests/project_env.rs
+expression: "(ambiguous, explicit_hostname)"
+---
+(
+    RunOutput {
+        exit_code: ExitCode(
+            unix_exit_status(
+                1,
+            ),
+        ),
+        stdout: "",
+        stderr: "error: Project selector `acme` matches slug `acme` and hostname `acme.test` on different Projects; pass the full `acme.test` hostname\n",
+    },
+    RunOutput {
+        exit_code: ExitCode(
+            unix_exit_status(
+                0,
+            ),
+        ),
+        stdout: "PROJECT_KIND=served\n",
+        stderr: "",
+    },
+)
diff --git a/crates/cli/tests/snapshots/project_env__project_env_resolves_resource_only_slug_and_reads_configured_env_file.snap b/crates/cli/tests/snapshots/project_env__project_env_resolves_resource_only_slug_and_reads_configured_env_file.snap
new file mode 100644
index 00000000..6c8e9713
--- /dev/null
+++ b/crates/cli/tests/snapshots/project_env__project_env_resolves_resource_only_slug_and_reads_configured_env_file.snap
@@ -0,0 +1,16 @@
+---
+source: crates/cli/tests/project_env.rs
+expression: "(output, env_before)"
+---
+(
+    RunOutput {
+        exit_code: ExitCode(
+            unix_exit_status(
+                0,
+            ),
+        ),
+        stdout: "APP_NAME=resource-project\n",
+        stderr: "",
+    },
+    "USER_VALUE=kept\n",
+)
diff --git a/crates/cli/tests/snapshots/project_open__link_rejects_invalid_mode_change_without_replacing_served_state.snap b/crates/cli/tests/snapshots/project_open__link_rejects_invalid_mode_change_without_replacing_served_state.snap
new file mode 100644
index 00000000..e788b796
--- /dev/null
+++ b/crates/cli/tests/snapshots/project_open__link_rejects_invalid_mode_change_without_replacing_served_state.snap
@@ -0,0 +1,45 @@
+---
+source: crates/cli/tests/project_open.rs
+expression: "(initial_link, invalid_link, linked)"
+---
+(
+    RunOutput {
+        exit_code: ExitCode(
+            unix_exit_status(
+                0,
+            ),
+        ),
+        stdout: "Linked acme.test -> <tempdir>/acme\nwarning: PV daemon is not running; reconciliation will run after `pv setup` starts it\n",
+        stderr: "",
+    },
+    RunOutput {
+        exit_code: ExitCode(
+            unix_exit_status(
+                1,
+            ),
+        ),
+        stdout: "",
+        stderr: "error: duplicate rendered Project env key `DATABASE_URL` from same-depth mappings `postgres.allocations.analytics.env.DATABASE_URL` and `postgres.allocations.app.env.DATABASE_URL`\n",
+    },
+    ProjectRecord {
+        id: "<project_id>",
+        slug: "acme",
+        mode: Served,
+        path: "<tempdir>/acme",
+        original_path: "<tempdir>/acme",
+        primary_hostname: Some(
+            "acme.test",
+        ),
+        config_path: "<tempdir>/acme/pv.yml",
+        desired_php_track: None,
+        php_runtime: ProjectPhpRuntimeRecord {
+            track: None,
+            requested_extensions: [],
+            loaded_extensions: [],
+            ignored_extensions: [],
+        },
+        additional_hostnames: [],
+        created_at: "<timestamp>",
+        updated_at: "<timestamp>",
+    },
+)
diff --git a/crates/cli/tests/snapshots/project_open__open_project_picker_sorts_projects_by_primary_hostname.snap b/crates/cli/tests/snapshots/project_open__open_project_picker_sorts_projects_by_primary_hostname.snap
index 9a5d8ba7..a342f601 100644
--- a/crates/cli/tests/snapshots/project_open__open_project_picker_sorts_projects_by_primary_hostname.snap
+++ b/crates/cli/tests/snapshots/project_open__open_project_picker_sorts_projects_by_primary_hostname.snap
@@ -1,6 +1,6 @@
 ---
 source: crates/cli/tests/project_open.rs
-expression: "(link_zeta, link_acme, open, opened_urls)"
+expression: "(link_zeta, link_alpha, open, opened_urls)"
 ---
 (
     RunOutput {
@@ -9,7 +9,7 @@ expression: "(link_zeta, link_acme, open, opened_urls)"
                 0,
             ),
         ),
-        stdout: "Linked zeta.test -> <tempdir>/zeta\nwarning: PV daemon is not running; reconciliation will run after `pv setup` starts it\n",
+        stdout: "Linked zeta.test -> <tempdir>/alpha-project\nwarning: PV daemon is not running; reconciliation will run after `pv setup` starts it\n",
         stderr: "",
     },
     RunOutput {
@@ -18,7 +18,7 @@ expression: "(link_zeta, link_acme, open, opened_urls)"
                 0,
             ),
         ),
-        stdout: "Linked acme.test -> <tempdir>/acme\nwarning: PV daemon is not running; reconciliation will run after `pv setup` starts it\n",
+        stdout: "Linked alpha.test -> <tempdir>/zeta-project\nwarning: PV daemon is not running; reconciliation will run after `pv setup` starts it\n",
         stderr: "",
     },
     RunOutput {
@@ -27,7 +27,7 @@ expression: "(link_zeta, link_acme, open, opened_urls)"
                 0,
             ),
         ),
-        stdout: "Select a Project:\n1. acme.test  <tempdir>/acme\n2. zeta.test  <tempdir>/zeta\nEnter selection:\nOpened https://zeta.test for zeta.test\n",
+        stdout: "Select a Project:\n1. alpha.test  <tempdir>/zeta-project\n2. zeta.test  <tempdir>/alpha-project\nEnter selection:\nOpened https://zeta.test for zeta.test\n",
         stderr: "",
     },
     [
diff --git a/crates/cli/tests/snapshots/project_open__open_rejects_resource_only_target_and_excludes_it_from_picker.snap b/crates/cli/tests/snapshots/project_open__open_rejects_resource_only_target_and_excludes_it_from_picker.snap
new file mode 100644
index 00000000..dd253aa5
--- /dev/null
+++ b/crates/cli/tests/snapshots/project_open__open_rejects_resource_only_target_and_excludes_it_from_picker.snap
@@ -0,0 +1,54 @@
+---
+source: crates/cli/tests/project_open.rs
+expression: "(link_resource_only, explicit_open, current_open, link_served, picker_open,\nopened_urls)"
+---
+(
+    RunOutput {
+        exit_code: ExitCode(
+            unix_exit_status(
+                0,
+            ),
+        ),
+        stdout: "Linked resources (resource-only) -> <tempdir>/resources\nwarning: PV daemon is not running; reconciliation will run after `pv setup` starts it\n",
+        stderr: "",
+    },
+    RunOutput {
+        exit_code: ExitCode(
+            unix_exit_status(
+                1,
+            ),
+        ),
+        stdout: "",
+        stderr: "error: Project `resources` is resource-only and cannot be opened\n",
+    },
+    RunOutput {
+        exit_code: ExitCode(
+            unix_exit_status(
+                1,
+            ),
+        ),
+        stdout: "",
+        stderr: "error: could not resolve a linked Project; pass a Project slug or hostname\n",
+    },
+    RunOutput {
+        exit_code: ExitCode(
+            unix_exit_status(
+                0,
+            ),
+        ),
+        stdout: "Linked web.test -> <tempdir>/web\nwarning: PV daemon is not running; reconciliation will run after `pv setup` starts it\n",
+        stderr: "",
+    },
+    RunOutput {
+        exit_code: ExitCode(
+            unix_exit_status(
+                0,
+            ),
+        ),
+        stdout: "Select a Project:\n1. web.test  <tempdir>/web\nEnter selection:\nOpened https://web.test for web.test\n",
+        stderr: "",
+    },
+    [
+        "https://web.test",
+    ],
+)
diff --git a/crates/cli/tests/snapshots/project_open__open_without_current_project_fails_when_non_interactive.snap b/crates/cli/tests/snapshots/project_open__open_without_current_project_fails_when_non_interactive.snap
index d1bb9dfa..d17cda65 100644
--- a/crates/cli/tests/snapshots/project_open__open_without_current_project_fails_when_non_interactive.snap
+++ b/crates/cli/tests/snapshots/project_open__open_without_current_project_fails_when_non_interactive.snap
@@ -19,7 +19,7 @@ expression: "(link, open, opened_urls)"
             ),
         ),
         stdout: "",
-        stderr: "error: could not resolve a linked Project; pass a hostname\n",
+        stderr: "error: could not resolve a linked Project; pass a Project slug or hostname\n",
     },
     [],
 )
diff --git a/crates/cli/tests/snapshots/project_unlink__unlink_resolves_resource_only_slug_and_leaves_managed_env_block.snap b/crates/cli/tests/snapshots/project_unlink__unlink_resolves_resource_only_slug_and_leaves_managed_env_block.snap
new file mode 100644
index 00000000..bdff0b57
--- /dev/null
+++ b/crates/cli/tests/snapshots/project_unlink__unlink_resolves_resource_only_slug_and_leaves_managed_env_block.snap
@@ -0,0 +1,25 @@
+---
+source: crates/cli/tests/project_unlink.rs
+expression: "(link, unlink, env_before)"
+---
+(
+    RunOutput {
+        exit_code: ExitCode(
+            unix_exit_status(
+                0,
+            ),
+        ),
+        stdout: "Linked acme (resource-only) -> <tempdir>/acme\nwarning: PV daemon is not running; reconciliation will run after `pv setup` starts it\n",
+        stderr: "",
+    },
+    RunOutput {
+        exit_code: ExitCode(
+            unix_exit_status(
+                0,
+            ),
+        ),
+        stdout: "Unlinked acme -> <tempdir>/acme\nwarning: PV daemon is not running; reconciliation will run after `pv setup` starts it\n",
+        stderr: "",
+    },
+    "USER_VALUE=kept\n# >>> PV MANAGED\nAPP_NAME=acme\n# <<< PV MANAGED\n",
+)
diff --git a/crates/cli/tests/snapshots/status__status_prefers_ignored_php_extension_over_other_project_env_warnings.snap b/crates/cli/tests/snapshots/status__status_prefers_ignored_php_extension_over_other_project_env_warnings.snap
index 1283f716..fa96295e 100644
--- a/crates/cli/tests/snapshots/status__status_prefers_ignored_php_extension_over_other_project_env_warnings.snap
+++ b/crates/cli/tests/snapshots/status__status_prefers_ignored_php_extension_over_other_project_env_warnings.snap
@@ -1,6 +1,5 @@
 ---
 source: crates/cli/tests/status.rs
-assertion_line: 603
 expression: snapshot
 ---
 (
@@ -19,7 +18,7 @@ expression: snapshot
                 0,
             ),
         ),
-        stdout: "{\"overall\":\"ok\",\"daemon\":{\"state\":\"disabled\",\"launch_agent\":\"missing\",\"socket\":\"missing\",\"failure\":false},\"integrations\":{\"dns\":\"missing\",\"ports\":\"missing\",\"ca\":\"missing\"},\"managed_resources\":[],\"runtimes\":[],\"projects\":[{\"hostname\":\"app.test\",\"env_status\":\"warning\",\"message\":\"ignored unsupported PHP extension `missing`; ignored unsupported PHP extension `typo`\",\"observed_at\":\"<timestamp>\"}],\"recent_errors\":[],\"log_directory\":\"<tempdir>/home/.pv/logs\"}\n",
+        stdout: "{\"overall\":\"ok\",\"daemon\":{\"state\":\"disabled\",\"launch_agent\":\"missing\",\"socket\":\"missing\",\"failure\":false},\"integrations\":{\"dns\":\"missing\",\"ports\":\"missing\",\"ca\":\"missing\"},\"managed_resources\":[],\"runtimes\":[],\"projects\":[{\"mode\":\"served\",\"slug\":\"project\",\"hostname\":\"app.test\",\"env_status\":\"warning\",\"message\":\"ignored unsupported PHP extension `missing`; ignored unsupported PHP extension `typo`\",\"observed_at\":\"<timestamp>\"}],\"recent_errors\":[],\"log_directory\":\"<tempdir>/home/.pv/logs\"}\n",
         stderr: "",
     },
 )
diff --git a/crates/cli/tests/snapshots/status__status_reports_warning_project_env_as_success.snap b/crates/cli/tests/snapshots/status__status_reports_warning_project_env_as_success.snap
index f2d3e039..a203b2f5 100644
--- a/crates/cli/tests/snapshots/status__status_reports_warning_project_env_as_success.snap
+++ b/crates/cli/tests/snapshots/status__status_reports_warning_project_env_as_success.snap
@@ -18,7 +18,7 @@ expression: snapshot
                 0,
             ),
         ),
-        stdout: "{\"overall\":\"ok\",\"daemon\":{\"state\":\"disabled\",\"launch_agent\":\"missing\",\"socket\":\"missing\",\"failure\":false},\"integrations\":{\"dns\":\"missing\",\"ports\":\"missing\",\"ca\":\"missing\"},\"managed_resources\":[],\"runtimes\":[],\"projects\":[{\"hostname\":\"app.test\",\"env_status\":\"warning\",\"message\":\"ignored unsupported PHP extension `missing`\",\"observed_at\":\"<timestamp>\"}],\"recent_errors\":[],\"log_directory\":\"<tempdir>/home/.pv/logs\"}\n",
+        stdout: "{\"overall\":\"ok\",\"daemon\":{\"state\":\"disabled\",\"launch_agent\":\"missing\",\"socket\":\"missing\",\"failure\":false},\"integrations\":{\"dns\":\"missing\",\"ports\":\"missing\",\"ca\":\"missing\"},\"managed_resources\":[],\"runtimes\":[],\"projects\":[{\"mode\":\"served\",\"slug\":\"project\",\"hostname\":\"app.test\",\"env_status\":\"warning\",\"message\":\"ignored unsupported PHP extension `missing`\",\"observed_at\":\"<timestamp>\"}],\"recent_errors\":[],\"log_directory\":\"<tempdir>/home/.pv/logs\"}\n",
         stderr: "",
     },
 )
diff --git a/crates/config/src/discovery.rs b/crates/config/src/discovery.rs
index 96741cc6..e7a7900e 100644
--- a/crates/config/src/discovery.rs
+++ b/crates/config/src/discovery.rs
@@ -1,6 +1,6 @@
 use std::io;
 
-use camino::Utf8Path;
+use camino::{Utf8Path, Utf8PathBuf};
 
 use crate::filesystem::{canonicalize_utf8, is_directory, path_present, read_to_string};
 use crate::{ConfigError, ProjectConfig, ProjectConfigFile};
@@ -66,16 +66,19 @@ fn validate_project_paths(
     project_root: &Utf8Path,
     config: ProjectConfig,
 ) -> Result<ProjectConfig, ConfigError> {
+    resolve_project_env_file_path(project_root, &config)?;
+
+    if let Some(document_root) = &config.document_root {
+        validate_document_root_shape(document_root)?;
+    }
+    if !config.serve {
+        return Ok(config);
+    }
+
     let Some(document_root) = &config.document_root else {
         return Ok(config);
     };
 
-    if document_root.is_absolute() {
-        return Err(ConfigError::AbsoluteDocumentRoot {
-            document_root: document_root.clone(),
-        });
-    }
-
     let absolute_document_root = project_root.join(document_root);
     let canonical_document_root = match canonicalize_utf8(&absolute_document_root) {
         Ok(path) => path,
@@ -102,6 +105,98 @@ fn validate_project_paths(
     Ok(config)
 }
 
+pub(crate) fn validate_document_root_shape(document_root: &Utf8Path) -> Result<(), ConfigError> {
+    if document_root.is_absolute() {
+        return Err(ConfigError::AbsoluteDocumentRoot {
+            document_root: document_root.to_path_buf(),
+        });
+    }
+
+    let mut depth = 0_u32;
+    for component in document_root.components() {
+        match component {
+            camino::Utf8Component::Normal(_) => depth += 1,
+            camino::Utf8Component::ParentDir if depth == 0 => {
+                return Err(ConfigError::DocumentRootEscapesProject {
+                    document_root: document_root.to_path_buf(),
+                });
+            }
+            camino::Utf8Component::ParentDir => depth -= 1,
+            camino::Utf8Component::CurDir => {}
+            camino::Utf8Component::RootDir | camino::Utf8Component::Prefix(_) => {
+                return Err(ConfigError::AbsoluteDocumentRoot {
+                    document_root: document_root.to_path_buf(),
+                });
+            }
+        }
+    }
+
+    Ok(())
+}
+
+pub fn resolve_project_env_file_path(
+    project_root: &Utf8Path,
+    config: &ProjectConfig,
+) -> Result<Utf8PathBuf, ConfigError> {
+    let canonical_root = canonicalize_utf8(project_root)?;
+    let env_file = &config.env_file;
+    let target = canonical_root.join(env_file);
+
+    if path_present(&target)? {
+        let canonical_target = canonicalize_utf8(&target)?;
+        if !canonical_target.starts_with(&canonical_root) {
+            return Err(ConfigError::EnvFileEscapesProject {
+                env_file: env_file.clone(),
+            });
+        }
+        if is_directory(&canonical_target)? {
+            return Err(ConfigError::EnvFileNotFile {
+                env_file: env_file.clone(),
+            });
+        }
+
+        return Ok(canonical_target);
+    }
+
+    let Some(parent) = target.parent() else {
+        return Err(ConfigError::EnvFileParentNotDirectory {
+            env_file: env_file.clone(),
+        });
+    };
+    let canonical_parent = match canonicalize_utf8(parent) {
+        Ok(path) => path,
+        Err(ConfigError::Filesystem { source, .. })
+            if matches!(
+                source.kind(),
+                io::ErrorKind::NotFound | io::ErrorKind::NotADirectory
+            ) =>
+        {
+            return Err(ConfigError::EnvFileParentNotDirectory {
+                env_file: env_file.clone(),
+            });
+        }
+        Err(error) => return Err(error),
+    };
+    if !canonical_parent.starts_with(&canonical_root) {
+        return Err(ConfigError::EnvFileEscapesProject {
+            env_file: env_file.clone(),
+        });
+    }
+    if !is_directory(&canonical_parent)? {
+        return Err(ConfigError::EnvFileParentNotDirectory {
+            env_file: env_file.clone(),
+        });
+    }
+
+    let Some(file_name) = target.file_name() else {
+        return Err(ConfigError::EnvFileNotFile {
+            env_file: env_file.clone(),
+        });
+    };
+
+    Ok(canonical_parent.join(file_name))
+}
+
 fn validate_config_path(
     project_root: &Utf8Path,
     config_path: &Utf8Path,
diff --git a/crates/config/src/env.rs b/crates/config/src/env.rs
index aa98124d..e86c6fe4 100644
--- a/crates/config/src/env.rs
+++ b/crates/config/src/env.rs
@@ -2,6 +2,7 @@ use std::collections::{BTreeMap, BTreeSet};
 
 use camino::Utf8Path;
 
+use crate::model::value_uses_serving_placeholder;
 use crate::{ConfigError, ProjectConfig, filesystem};
 
 pub const MANAGED_ENV_START_MARKER: &str = "# >>> PV MANAGED";
@@ -57,8 +58,8 @@ pub fn render_project_env(
     config: &ProjectConfig,
     context: &ProjectEnvContext,
 ) -> Result<RenderedProjectEnv, ConfigError> {
-    let project_values = project_context_values(context)?;
-    let mut values = render_mapping("env", &config.env, &project_values)?
+    let project_values = project_context_values(context, config.serve)?;
+    let mut values = render_mapping("env", &config.env, &project_values, config.serve)?
         .into_iter()
         .map(|(key, entry)| (key, entry.value))
         .collect::<BTreeMap<_, _>>();
@@ -79,6 +80,7 @@ pub fn render_project_env(
             &format!("{resource}.env"),
             &resource_config.env,
             &context_values,
+            config.serve,
         )?;
         insert_same_depth_entries(&mut resource_values, rendered)?;
     }
@@ -114,6 +116,7 @@ pub fn render_project_env(
                 &format!("{resource}.allocations.{allocation}.env"),
                 &allocation_config.env,
                 &context_values,
+                config.serve,
             )?;
             insert_same_depth_entries(&mut allocation_values, rendered)?;
         }
@@ -130,7 +133,10 @@ pub fn render_project_env(
 pub fn validate_project_env_shape(config: &ProjectConfig) -> Result<(), ConfigError> {
     let mut resource_values = BTreeMap::new();
     for (resource, resource_config) in &config.resources {
-        for key in resource_config.env.keys() {
+        for (key, value) in &resource_config.env {
+            if !config.serve && value_uses_serving_placeholder(value) {
+                continue;
+            }
             insert_same_depth_key(&mut resource_values, key, format!("{resource}.env.{key}"))?;
         }
     }
@@ -138,7 +144,10 @@ pub fn validate_project_env_shape(config: &ProjectConfig) -> Result<(), ConfigEr
     let mut allocation_values = BTreeMap::new();
     for (resource, resource_config) in &config.resources {
         for (allocation, allocation_config) in &resource_config.allocations {
-            for key in allocation_config.env.keys() {
+            for (key, value) in &allocation_config.env {
+                if !config.serve && value_uses_serving_placeholder(value) {
+                    continue;
+                }
                 insert_same_depth_key(
                     &mut allocation_values,
                     key,
@@ -192,16 +201,15 @@ pub fn transform_managed_env_block(
     rendered: &RenderedProjectEnv,
 ) -> Result<ManagedEnvBlockTransform, ConfigError> {
     let existing_content = existing_content.unwrap_or_default();
-    if rendered.values.is_empty() {
+    let lines = split_env_lines(existing_content);
+    let blocks = managed_blocks(&lines)?;
+    if rendered.values.is_empty() && blocks.is_empty() {
         return Ok(ManagedEnvBlockTransform {
             content: existing_content.to_string(),
             warnings: Vec::new(),
             changed: false,
         });
     }
-
-    let lines = split_env_lines(existing_content);
-    let blocks = managed_blocks(&lines)?;
     let warnings = duplicate_existing_key_warnings(&lines, &blocks, rendered);
     let block_lines = managed_block_lines(rendered);
 
@@ -251,8 +259,9 @@ pub fn write_project_env_file(
 
 fn project_context_values(
     context: &ProjectEnvContext,
+    serve: bool,
 ) -> Result<BTreeMap<String, String>, ConfigError> {
-    if context.primary_hostname.is_empty() {
+    if serve && context.primary_hostname.is_empty() {
         return Err(ConfigError::MissingEnvContext {
             field: "project.primary_hostname".to_string(),
             placeholder: "project_url".to_string(),
@@ -260,10 +269,12 @@ fn project_context_values(
     }
 
     let mut values = BTreeMap::new();
-    values.insert(
-        "project_url".to_string(),
-        format!("https://{}", context.primary_hostname),
-    );
+    if !context.primary_hostname.is_empty() {
+        values.insert(
+            "project_url".to_string(),
+            format!("https://{}", context.primary_hostname),
+        );
+    }
     if !context.tls_ca_path.is_empty() {
         values.insert("tls_ca".to_string(), context.tls_ca_path.clone());
     }
@@ -307,10 +318,14 @@ fn render_mapping(
     field: &str,
     mapping: &BTreeMap<String, String>,
     context_values: &BTreeMap<String, String>,
+    serve: bool,
 ) -> Result<BTreeMap<String, RenderedEnvEntry>, ConfigError> {
     let mut rendered = BTreeMap::new();
 
     for (key, value) in mapping {
+        if !serve && value_uses_serving_placeholder(value) {
+            continue;
+        }
         let field = format!("{field}.{key}");
         let value = render_env_value(&field, value, context_values)?;
         rendered.insert(
diff --git a/crates/config/src/error.rs b/crates/config/src/error.rs
index 5bbef006..cfcd5a1d 100644
--- a/crates/config/src/error.rs
+++ b/crates/config/src/error.rs
@@ -118,6 +118,18 @@ pub enum ConfigError {
     #[error("Project config document_root must be an existing directory: {document_root}")]
     DocumentRootNotDirectory { document_root: Utf8PathBuf },
 
+    #[error("Project config env_file must be relative to the Project root: {env_file}")]
+    AbsoluteEnvFile { env_file: Utf8PathBuf },
+
+    #[error("Project config env_file escapes the Project root: {env_file}")]
+    EnvFileEscapesProject { env_file: Utf8PathBuf },
+
+    #[error("Project config env_file parent must be an existing directory: {env_file}")]
+    EnvFileParentNotDirectory { env_file: Utf8PathBuf },
+
+    #[error("Project config env_file must point to a file: {env_file}")]
+    EnvFileNotFile { env_file: Utf8PathBuf },
+
     #[error("invalid Project config env key `{key}`")]
     InvalidEnvKey { key: String },
 
diff --git a/crates/config/src/lib.rs b/crates/config/src/lib.rs
index ef669b62..977015ca 100644
--- a/crates/config/src/lib.rs
+++ b/crates/config/src/lib.rs
@@ -8,6 +8,7 @@ mod model;
 mod parser;
 mod writer;
 
+pub use discovery::resolve_project_env_file_path;
 pub use env::{
     AllocationEnvContext, MANAGED_ENV_END_MARKER, MANAGED_ENV_START_MARKER,
     ManagedEnvBlockTransform, ProjectEnvContext, ProjectEnvWarning, RenderedProjectEnv,
diff --git a/crates/config/src/model.rs b/crates/config/src/model.rs
index 57bf35ed..2c445481 100644
--- a/crates/config/src/model.rs
+++ b/crates/config/src/model.rs
@@ -1,11 +1,20 @@
 use std::collections::BTreeMap;
 
-use camino::Utf8PathBuf;
+use camino::{Utf8Path, Utf8PathBuf};
 use serde::ser::SerializeMap;
 use serde::{Serialize, Serializer};
 
-#[derive(Clone, Debug, Default, Eq, PartialEq, Serialize)]
+const DEFAULT_ENV_FILE: &str = ".env";
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
 pub struct ProjectConfig {
+    #[serde(skip_serializing_if = "is_true")]
+    pub serve: bool,
+    #[serde(
+        skip_serializing_if = "is_default_env_file",
+        serialize_with = "serialize_path"
+    )]
+    pub env_file: Utf8PathBuf,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub php: Option<PhpConfig>,
     #[serde(
@@ -21,6 +30,20 @@ pub struct ProjectConfig {
     pub resources: BTreeMap<String, ResourceConfig>,
 }
 
+impl Default for ProjectConfig {
+    fn default() -> Self {
+        Self {
+            serve: true,
+            env_file: default_env_file(),
+            php: None,
+            document_root: None,
+            hostnames: Vec::new(),
+            env: BTreeMap::new(),
+            resources: BTreeMap::new(),
+        }
+    }
+}
+
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct ProjectConfigFile {
     pub path: Utf8PathBuf,
@@ -104,25 +127,35 @@ impl ProjectConfig {
     }
 
     pub fn uses_tls_placeholders(&self) -> bool {
-        self.env
-            .values()
-            .any(|value| value_uses_tls_placeholder(value))
-            || self.resources.values().any(|resource| {
-                resource
-                    .env
-                    .values()
-                    .any(|value| value_uses_tls_placeholder(value))
-                    || resource.allocations.values().any(|allocation| {
-                        allocation
-                            .env
-                            .values()
-                            .any(|value| value_uses_tls_placeholder(value))
-                    })
-            })
+        self.serve
+            && (self
+                .env
+                .values()
+                .any(|value| value_uses_tls_placeholder(value))
+                || self.resources.values().any(|resource| {
+                    resource
+                        .env
+                        .values()
+                        .any(|value| value_uses_tls_placeholder(value))
+                        || resource.allocations.values().any(|allocation| {
+                            allocation
+                                .env
+                                .values()
+                                .any(|value| value_uses_tls_placeholder(value))
+                        })
+                }))
     }
 }
 
 fn value_uses_tls_placeholder(value: &str) -> bool {
+    value_uses_any_placeholder(value, &["tls_ca", "tls_cert", "tls_key"])
+}
+
+pub(crate) fn value_uses_serving_placeholder(value: &str) -> bool {
+    value_uses_any_placeholder(value, &["project_url", "tls_ca", "tls_cert", "tls_key"])
+}
+
+fn value_uses_any_placeholder(value: &str, placeholders: &[&str]) -> bool {
     let characters = value.chars().collect::<Vec<_>>();
     let mut index = 0;
 
@@ -151,7 +184,7 @@ fn value_uses_tls_placeholder(value: &str) -> bool {
             continue;
         };
         let placeholder = characters[index + 2..end_index].iter().collect::<String>();
-        if matches!(placeholder.as_str(), "tls_ca" | "tls_cert" | "tls_key") {
+        if placeholders.contains(&placeholder.as_str()) {
             return true;
         }
 
@@ -169,3 +202,22 @@ where
         .map(|path| path.as_str())
         .serialize(serializer)
 }
+
+fn serialize_path<S>(path: &Utf8PathBuf, serializer: S) -> Result<S::Ok, S::Error>
+where
+    S: Serializer,
+{
+    path.as_str().serialize(serializer)
+}
+
+fn default_env_file() -> Utf8PathBuf {
+    Utf8PathBuf::from(DEFAULT_ENV_FILE)
+}
+
+const fn is_true(value: &bool) -> bool {
+    *value
+}
+
+fn is_default_env_file(path: &Utf8PathBuf) -> bool {
+    path == Utf8Path::new(DEFAULT_ENV_FILE)
+}
diff --git a/crates/config/src/parser.rs b/crates/config/src/parser.rs
index f9994032..1d8f0d60 100644
--- a/crates/config/src/parser.rs
+++ b/crates/config/src/parser.rs
@@ -7,6 +7,7 @@ use resources::{
 };
 use yaml_serde::{Mapping, Number, Value};
 
+use crate::discovery::validate_document_root_shape;
 use crate::hostname::normalize_additional_hostname;
 use crate::{AllocationConfig, ConfigError, PhpConfig, ProjectConfig, ResourceConfig};
 
@@ -47,19 +48,29 @@ impl ProjectConfig {
 
 fn parse_project_mapping(mapping: Mapping) -> Result<ProjectConfig, ConfigError> {
     let mut config = ProjectConfig::default();
+    let mut hostnames = None;
 
     for (key, value) in mapping {
         let key = string_key(key)?;
         match key.as_str() {
+            "serve" => {
+                config.serve = bool_scalar("serve", &value)?;
+            }
+            "env_file" => {
+                let env_file = non_empty_string("env_file", &value)?;
+                config.env_file = validate_env_file(Utf8PathBuf::from(env_file))?;
+            }
             "php" => {
                 config.php = Some(php_config(&value)?);
             }
             "document_root" => {
                 let document_root = non_empty_string("document_root", &value)?;
-                config.document_root = Some(Utf8PathBuf::from(document_root));
+                let document_root = Utf8PathBuf::from(document_root);
+                validate_document_root_shape(&document_root)?;
+                config.document_root = Some(document_root);
             }
             "hostnames" => {
-                config.hostnames = parse_hostnames(&value)?;
+                hostnames = Some(value);
             }
             "env" => {
                 config.env = parse_env_mapping("env", EnvPlaceholderScope::Project, &value)?;
@@ -82,6 +93,10 @@ fn parse_project_mapping(mapping: Mapping) -> Result<ProjectConfig, ConfigError>
         }
     }
 
+    if let Some(hostnames) = hostnames {
+        config.hostnames = parse_hostnames(&hostnames)?;
+    }
+
     Ok(config)
 }
 
@@ -243,6 +258,29 @@ fn parse_hostnames(value: &Value) -> Result<Vec<String>, ConfigError> {
     Ok(hostnames)
 }
 
+fn validate_env_file(env_file: Utf8PathBuf) -> Result<Utf8PathBuf, ConfigError> {
+    if env_file.is_absolute() {
+        return Err(ConfigError::AbsoluteEnvFile { env_file });
+    }
+
+    let mut depth = 0_u32;
+    for component in env_file.components() {
+        match component {
+            camino::Utf8Component::Normal(_) => depth += 1,
+            camino::Utf8Component::ParentDir if depth == 0 => {
+                return Err(ConfigError::EnvFileEscapesProject { env_file });
+            }
+            camino::Utf8Component::ParentDir => depth -= 1,
+            camino::Utf8Component::CurDir => {}
+            camino::Utf8Component::RootDir | camino::Utf8Component::Prefix(_) => {
+                return Err(ConfigError::AbsoluteEnvFile { env_file });
+            }
+        }
+    }
+
+    Ok(env_file)
+}
+
 fn parse_env_mapping(
     field: &str,
     scope: EnvPlaceholderScope<'_>,
@@ -378,6 +416,17 @@ fn string_scalar(field: &str, value: &Value) -> Result<String, ConfigError> {
     }
 }
 
+fn bool_scalar(field: &str, value: &Value) -> Result<bool, ConfigError> {
+    match value {
+        Value::Bool(value) => Ok(*value),
+        value => Err(ConfigError::InvalidFieldType {
+            field: field.to_string(),
+            expected: "a boolean",
+            found: value_type(value),
+        }),
+    }
+}
+
 fn string_or_number_to_string(field: &str, value: &Value) -> Result<String, ConfigError> {
     match value {
         Value::String(value) => Ok(value.clone()),
diff --git a/crates/config/tests/project_config.rs b/crates/config/tests/project_config.rs
index 556b7645..f11f299b 100644
--- a/crates/config/tests/project_config.rs
+++ b/crates/config/tests/project_config.rs
@@ -35,6 +35,68 @@ postgresql:
     Ok(())
 }
 
+#[test]
+fn project_config_parses_resource_only_controls_and_defaults() -> Result<()> {
+    let defaults = ProjectConfig::parse("")?;
+    let resource_only = ProjectConfig::parse(
+        r#"
+serve: false
+env_file: .env.local
+document_root: missing
+hostnames:
+  - Api.Example.test.
+env:
+  APP_URL: "${project_url}"
+  APP_ENV: local
+"#,
+    )?;
+
+    assert_debug_snapshot!((defaults, resource_only));
+
+    Ok(())
+}
+
+#[test]
+fn project_config_rejects_invalid_resource_only_control_shapes() {
+    assert!(matches!(
+        ProjectConfig::parse("serve: disabled\n"),
+        Err(ConfigError::InvalidFieldType { field, .. }) if field == "serve"
+    ));
+    assert!(matches!(
+        ProjectConfig::parse("env_file: false\n"),
+        Err(ConfigError::InvalidFieldType { field, .. }) if field == "env_file"
+    ));
+    assert!(matches!(
+        ProjectConfig::parse("env_file: /tmp/acme.env\n"),
+        Err(ConfigError::AbsoluteEnvFile { env_file }) if env_file == "/tmp/acme.env"
+    ));
+    assert!(matches!(
+        ProjectConfig::parse("env_file: config/../../acme.env\n"),
+        Err(ConfigError::EnvFileEscapesProject { env_file })
+            if env_file == "config/../../acme.env"
+    ));
+    assert!(matches!(
+        ProjectConfig::parse("serve: false\ndocument_root: /tmp/public\n"),
+        Err(ConfigError::AbsoluteDocumentRoot { document_root })
+            if document_root == "/tmp/public"
+    ));
+    assert!(matches!(
+        ProjectConfig::parse("serve: false\ndocument_root: public/../../outside\n"),
+        Err(ConfigError::DocumentRootEscapesProject { document_root })
+            if document_root == "public/../../outside"
+    ));
+    assert!(matches!(
+        ProjectConfig::parse("serve: false\nhostnames:\n  - '*.acme.test'\n"),
+        Err(ConfigError::InvalidHostname { hostname, .. }) if hostname == "*.acme.test"
+    ));
+    assert!(matches!(
+        ProjectConfig::parse(
+            "serve: false\nhostnames:\n  - api.acme.test\n  - API.ACME.TEST.\n"
+        ),
+        Err(ConfigError::DuplicateHostname { hostname }) if hostname == "api.acme.test"
+    ));
+}
+
 #[test]
 fn project_config_accepts_registered_resource_aliases() -> Result<()> {
     let config = ProjectConfig::parse(
@@ -649,6 +711,24 @@ mysql:
     Ok(())
 }
 
+#[test]
+fn project_config_writer_preserves_resource_only_controls() -> Result<()> {
+    let tempdir = tempdir()?;
+    let project = tempdir.path().join("acme");
+    create_dir(&project)?;
+    let config = ProjectConfig::parse(
+        "serve: false\nenv_file: .env.local\ndocument_root: missing\nhostnames:\n  - api.example.test\n",
+    )?;
+
+    config::write_project_config(&project, &config)?;
+    let reloaded = ProjectConfigFile::read_from_root(&project)?;
+
+    assert_eq!(reloaded.config, config);
+    assert_snapshot!(read_file(&project.join("pv.yml"))?);
+
+    Ok(())
+}
+
 #[test]
 fn project_config_writer_rejects_invalid_document_root_without_writing() -> Result<()> {
     let tempdir = tempdir()?;
@@ -850,6 +930,56 @@ fn project_config_rejects_document_roots_that_escape_project() -> Result<()> {
     Ok(())
 }
 
+#[test]
+fn resource_only_config_defers_document_root_existence_validation() -> Result<()> {
+    let tempdir = tempdir()?;
+    let project = tempdir.path().join("acme");
+    create_dir(&project)?;
+    write_file(
+        &project.join("pv.yml"),
+        "serve: false\ndocument_root: missing\nhostnames:\n  - Api.Acme.test.\n",
+    )?;
+
+    let config_file = ProjectConfigFile::read_from_root(&project)?;
+
+    assert!(!config_file.config.serve);
+    assert_eq!(
+        config_file.config.document_root.as_deref(),
+        Some(Utf8Path::new("missing"))
+    );
+    assert_eq!(config_file.config.hostnames, ["api.acme.test"]);
+
+    Ok(())
+}
+
+#[test]
+fn project_config_validates_env_file_parent_and_symlink_boundaries() -> Result<()> {
+    let tempdir = tempdir()?;
+    let project = tempdir.path().join("acme");
+    let outside = tempdir.path().join("outside");
+    create_dir(&project)?;
+    create_dir(&outside)?;
+
+    write_file(&project.join("pv.yml"), "env_file: missing/.env\n")?;
+    assert!(matches!(
+        ProjectConfigFile::read_from_root(&project),
+        Err(ConfigError::EnvFileParentNotDirectory { env_file })
+            if env_file == "missing/.env"
+    ));
+
+    let outside_env = outside.join(".env");
+    write_file(&outside_env, "")?;
+    create_symlink(&outside_env, &project.join(".env.link"))?;
+    write_file(&project.join("pv.yml"), "env_file: .env.link\n")?;
+    assert!(matches!(
+        ProjectConfigFile::read_from_root(&project),
+        Err(ConfigError::EnvFileEscapesProject { env_file })
+            if env_file == ".env.link"
+    ));
+
+    Ok(())
+}
+
 #[test]
 fn project_config_distinguishes_missing_document_roots_from_filesystem_errors() -> Result<()> {
     let tempdir = tempdir()?;
diff --git a/crates/config/tests/project_env.rs b/crates/config/tests/project_env.rs
index 0cd1a9bb..335d331c 100644
--- a/crates/config/tests/project_env.rs
+++ b/crates/config/tests/project_env.rs
@@ -28,26 +28,45 @@ mysql:
     };
 
     let rendered = render_project_env(&config, &context)?;
-    let transformed = transform_managed_env_block(
-        Some(
-            r#"USER_VALUE=1
-# >>> PV MANAGED
-OLD_VALUE=stays
-# <<< PV MANAGED
-"#,
-        ),
-        &rendered,
-    )?;
-
     assert_debug_snapshot!((
         &rendered,
-        format_project_env(&RenderedProjectEnv::default()),
-        transformed
+        format_project_env(&RenderedProjectEnv::default())
     ));
 
     Ok(())
 }
 
+#[test]
+fn managed_env_block_transformer_clears_existing_block_when_all_mappings_are_dormant() -> Result<()>
+{
+    let config = ProjectConfig::parse(
+        r#"serve: false
+env:
+  APP_URL: "${project_url}"
+"#,
+    )?;
+    let rendered = render_project_env(&config, &ProjectEnvContext::default())?;
+    let existing = r#"USER_VALUE=kept
+# >>> PV MANAGED
+APP_URL=https://acme.test
+# <<< PV MANAGED
+"#;
+
+    let cleared = transform_managed_env_block(Some(existing), &rendered)?;
+    let missing = transform_managed_env_block(None, &rendered)?;
+
+    assert!(rendered.values.is_empty());
+    assert_eq!(
+        cleared.content,
+        "USER_VALUE=kept\n# >>> PV MANAGED\n# <<< PV MANAGED\n"
+    );
+    assert!(cleared.changed);
+    assert_eq!(missing.content, "");
+    assert!(!missing.changed);
+
+    Ok(())
+}
+
 #[test]
 fn project_env_renderer_resolves_project_resource_and_allocation_contexts() -> Result<()> {
     let config = ProjectConfig::parse(
@@ -257,6 +276,53 @@ mysql:
     Ok(())
 }
 
+#[test]
+fn resource_only_env_omits_serving_placeholders_across_scopes() -> Result<()> {
+    let config = ProjectConfig::parse(
+        r#"
+serve: false
+env:
+  APP_ENV: local
+  APP_URL: "${project_url}"
+mysql:
+  env:
+    DB_HOST: "${host}"
+    TLS_CA: "${tls_ca}"
+  allocations:
+    app:
+      env:
+        DB_DATABASE: "${database}"
+        TLS_CERT: "${tls_cert}"
+"#,
+    )?;
+    let context = ProjectEnvContext {
+        primary_hostname: String::new(),
+        tls_ca_path: String::new(),
+        tls_cert_path: String::new(),
+        tls_key_path: String::new(),
+        resources: BTreeMap::from([(
+            "mysql".to_string(),
+            ResourceEnvContext {
+                track: "8.4".to_string(),
+                values: values(&[("host", "127.0.0.1")]),
+                allocations: allocations(&[(
+                    "app",
+                    AllocationEnvContext {
+                        generated_name: "acme_app".to_string(),
+                        values: values(&[("database", "acme_app")]),
+                    },
+                )]),
+            },
+        )]),
+    };
+
+    let rendered = render_project_env(&config, &context)?;
+
+    assert_debug_snapshot!((&rendered, format_project_env(&rendered)));
+
+    Ok(())
+}
+
 #[test]
 fn project_env_renderer_reports_missing_contexts() -> Result<()> {
     let resource_config = ProjectConfig::parse(
diff --git a/crates/config/tests/snapshots/project_config__project_config_discovery_validates_paths_and_conflicts.snap b/crates/config/tests/snapshots/project_config__project_config_discovery_validates_paths_and_conflicts.snap
index caf05c1b..aa791094 100644
--- a/crates/config/tests/snapshots/project_config__project_config_discovery_validates_paths_and_conflicts.snap
+++ b/crates/config/tests/snapshots/project_config__project_config_discovery_validates_paths_and_conflicts.snap
@@ -1,6 +1,5 @@
 ---
 source: crates/config/tests/project_config.rs
-assertion_line: 67
 expression: "(config_file.path.file_name(), config_file.exists, config_file.config,)"
 ---
 (
@@ -9,6 +8,8 @@ expression: "(config_file.path.file_name(), config_file.exists, config_file.conf
     ),
     true,
     ProjectConfig {
+        serve: true,
+        env_file: ".env",
         php: None,
         document_root: Some(
             "public",
diff --git a/crates/config/tests/snapshots/project_config__project_config_expands_yaml_aliases_and_merge_keys.snap b/crates/config/tests/snapshots/project_config__project_config_expands_yaml_aliases_and_merge_keys.snap
index 7b9b26c1..5b7588c2 100644
--- a/crates/config/tests/snapshots/project_config__project_config_expands_yaml_aliases_and_merge_keys.snap
+++ b/crates/config/tests/snapshots/project_config__project_config_expands_yaml_aliases_and_merge_keys.snap
@@ -3,6 +3,8 @@ source: crates/config/tests/project_config.rs
 expression: config
 ---
 ProjectConfig {
+    serve: true,
+    env_file: ".env",
     php: None,
     document_root: None,
     hostnames: [],
diff --git a/crates/config/tests/snapshots/project_config__project_config_parses_resource_only_controls_and_defaults.snap b/crates/config/tests/snapshots/project_config__project_config_parses_resource_only_controls_and_defaults.snap
new file mode 100644
index 00000000..5135e36c
--- /dev/null
+++ b/crates/config/tests/snapshots/project_config__project_config_parses_resource_only_controls_and_defaults.snap
@@ -0,0 +1,31 @@
+---
+source: crates/config/tests/project_config.rs
+expression: "(defaults, resource_only)"
+---
+(
+    ProjectConfig {
+        serve: true,
+        env_file: ".env",
+        php: None,
+        document_root: None,
+        hostnames: [],
+        env: {},
+        resources: {},
+    },
+    ProjectConfig {
+        serve: false,
+        env_file: ".env.local",
+        php: None,
+        document_root: Some(
+            "missing",
+        ),
+        hostnames: [
+            "api.example.test",
+        ],
+        env: {
+            "APP_ENV": "local",
+            "APP_URL": "${project_url}",
+        },
+        resources: {},
+    },
+)
diff --git a/crates/config/tests/snapshots/project_config__project_config_parses_strict_resource_env_shape.snap b/crates/config/tests/snapshots/project_config__project_config_parses_strict_resource_env_shape.snap
index 6a214c12..d05747a7 100644
--- a/crates/config/tests/snapshots/project_config__project_config_parses_strict_resource_env_shape.snap
+++ b/crates/config/tests/snapshots/project_config__project_config_parses_strict_resource_env_shape.snap
@@ -3,6 +3,8 @@ source: crates/config/tests/project_config.rs
 expression: config
 ---
 ProjectConfig {
+    serve: true,
+    env_file: ".env",
     php: Some(
         PhpConfig {
             version: Some(
diff --git a/crates/config/tests/snapshots/project_config__project_config_validates_url_placeholder_scopes.snap b/crates/config/tests/snapshots/project_config__project_config_validates_url_placeholder_scopes.snap
index 8ffd88f2..862332ed 100644
--- a/crates/config/tests/snapshots/project_config__project_config_validates_url_placeholder_scopes.snap
+++ b/crates/config/tests/snapshots/project_config__project_config_validates_url_placeholder_scopes.snap
@@ -7,6 +7,8 @@ expression: cases
         "project-url-project-env",
         Ok(
             ProjectConfig {
+                serve: true,
+                env_file: ".env",
                 php: None,
                 document_root: None,
                 hostnames: [],
@@ -21,6 +23,8 @@ expression: cases
         "tls-placeholders-project-env",
         Ok(
             ProjectConfig {
+                serve: true,
+                env_file: ".env",
                 php: None,
                 document_root: None,
                 hostnames: [],
@@ -55,6 +59,8 @@ expression: cases
         "resource-project-url",
         Ok(
             ProjectConfig {
+                serve: true,
+                env_file: ".env",
                 php: None,
                 document_root: None,
                 hostnames: [],
@@ -75,6 +81,8 @@ expression: cases
         "resource-project-tls",
         Ok(
             ProjectConfig {
+                serve: true,
+                env_file: ".env",
                 php: None,
                 document_root: None,
                 hostnames: [],
@@ -97,6 +105,8 @@ expression: cases
         "resource-scoped-url",
         Ok(
             ProjectConfig {
+                serve: true,
+                env_file: ".env",
                 php: None,
                 document_root: None,
                 hostnames: [],
@@ -126,6 +136,8 @@ expression: cases
         "allocation-project-url",
         Ok(
             ProjectConfig {
+                serve: true,
+                env_file: ".env",
                 php: None,
                 document_root: None,
                 hostnames: [],
@@ -150,6 +162,8 @@ expression: cases
         "allocation-project-tls",
         Ok(
             ProjectConfig {
+                serve: true,
+                env_file: ".env",
                 php: None,
                 document_root: None,
                 hostnames: [],
@@ -176,6 +190,8 @@ expression: cases
         "allocation-scoped-url",
         Ok(
             ProjectConfig {
+                serve: true,
+                env_file: ".env",
                 php: None,
                 document_root: None,
                 hostnames: [],
diff --git a/crates/config/tests/snapshots/project_config__project_config_writer_creates_preferred_file_when_missing.snap b/crates/config/tests/snapshots/project_config__project_config_writer_creates_preferred_file_when_missing.snap
index 1ab675c3..a4c1dd16 100644
--- a/crates/config/tests/snapshots/project_config__project_config_writer_creates_preferred_file_when_missing.snap
+++ b/crates/config/tests/snapshots/project_config__project_config_writer_creates_preferred_file_when_missing.snap
@@ -8,6 +8,8 @@ expression: "(updated.path.file_name(), updated.exists, updated.config)"
     ),
     true,
     ProjectConfig {
+        serve: true,
+        env_file: ".env",
         php: Some(
             PhpConfig {
                 version: Some(
diff --git a/crates/config/tests/snapshots/project_config__project_config_writer_preserves_existing_config_file_mode.snap b/crates/config/tests/snapshots/project_config__project_config_writer_preserves_existing_config_file_mode.snap
index 738bb3b9..2544c9f9 100644
--- a/crates/config/tests/snapshots/project_config__project_config_writer_preserves_existing_config_file_mode.snap
+++ b/crates/config/tests/snapshots/project_config__project_config_writer_preserves_existing_config_file_mode.snap
@@ -8,6 +8,8 @@ expression: "(updated.path.file_name(), updated.exists, updated.config)"
     ),
     true,
     ProjectConfig {
+        serve: true,
+        env_file: ".env",
         php: Some(
             PhpConfig {
                 version: Some(
diff --git a/crates/config/tests/snapshots/project_config__project_config_writer_preserves_resource_only_controls.snap b/crates/config/tests/snapshots/project_config__project_config_writer_preserves_resource_only_controls.snap
new file mode 100644
index 00000000..5e1a0d34
--- /dev/null
+++ b/crates/config/tests/snapshots/project_config__project_config_writer_preserves_resource_only_controls.snap
@@ -0,0 +1,9 @@
+---
+source: crates/config/tests/project_config.rs
+expression: "read_file(&project.join(\"pv.yml\"))?"
+---
+serve: false
+env_file: .env.local
+document_root: missing
+hostnames:
+- api.example.test
diff --git a/crates/config/tests/snapshots/project_config__project_config_writer_updates_php_in_alternate_file.snap b/crates/config/tests/snapshots/project_config__project_config_writer_updates_php_in_alternate_file.snap
index 8808a8eb..ef38b044 100644
--- a/crates/config/tests/snapshots/project_config__project_config_writer_updates_php_in_alternate_file.snap
+++ b/crates/config/tests/snapshots/project_config__project_config_writer_updates_php_in_alternate_file.snap
@@ -8,6 +8,8 @@ expression: "(updated.path.file_name(), updated.exists, updated.config)"
     ),
     true,
     ProjectConfig {
+        serve: true,
+        env_file: ".env",
         php: Some(
             PhpConfig {
                 version: Some(
diff --git a/crates/config/tests/snapshots/project_config__project_config_writer_updates_php_in_discovered_file.snap b/crates/config/tests/snapshots/project_config__project_config_writer_updates_php_in_discovered_file.snap
index 4cb7663b..3321f168 100644
--- a/crates/config/tests/snapshots/project_config__project_config_writer_updates_php_in_discovered_file.snap
+++ b/crates/config/tests/snapshots/project_config__project_config_writer_updates_php_in_discovered_file.snap
@@ -8,6 +8,8 @@ expression: "(updated.path.file_name(), updated.exists, updated.config, reloaded
     ),
     true,
     ProjectConfig {
+        serve: true,
+        env_file: ".env",
         php: Some(
             PhpConfig {
                 version: Some(
@@ -51,6 +53,8 @@ expression: "(updated.path.file_name(), updated.exists, updated.config, reloaded
         },
     },
     ProjectConfig {
+        serve: true,
+        env_file: ".env",
         php: Some(
             PhpConfig {
                 version: Some(
diff --git a/crates/config/tests/snapshots/project_config__project_config_writer_updates_symlinked_config_target.snap b/crates/config/tests/snapshots/project_config__project_config_writer_updates_symlinked_config_target.snap
index 4647f9ca..5cd6add5 100644
--- a/crates/config/tests/snapshots/project_config__project_config_writer_updates_symlinked_config_target.snap
+++ b/crates/config/tests/snapshots/project_config__project_config_writer_updates_symlinked_config_target.snap
@@ -8,6 +8,8 @@ expression: "(updated.path.file_name(), updated.exists, updated.config)"
     ),
     true,
     ProjectConfig {
+        serve: true,
+        env_file: ".env",
         php: Some(
             PhpConfig {
                 version: Some(
diff --git a/crates/config/tests/snapshots/project_config__project_config_writer_writes_full_config_to_preferred_file.snap b/crates/config/tests/snapshots/project_config__project_config_writer_writes_full_config_to_preferred_file.snap
index 5b6dc563..15046c8e 100644
--- a/crates/config/tests/snapshots/project_config__project_config_writer_writes_full_config_to_preferred_file.snap
+++ b/crates/config/tests/snapshots/project_config__project_config_writer_writes_full_config_to_preferred_file.snap
@@ -8,6 +8,8 @@ expression: "(written.path.file_name(), written.exists, reloaded.config)"
     ),
     true,
     ProjectConfig {
+        serve: true,
+        env_file: ".env",
         php: Some(
             PhpConfig {
                 version: Some(
diff --git a/crates/config/tests/snapshots/project_env__project_env_renderer_returns_empty_output_for_no_mappings.snap b/crates/config/tests/snapshots/project_env__project_env_renderer_returns_empty_output_for_no_mappings.snap
index 593346fe..38add34d 100644
--- a/crates/config/tests/snapshots/project_env__project_env_renderer_returns_empty_output_for_no_mappings.snap
+++ b/crates/config/tests/snapshots/project_env__project_env_renderer_returns_empty_output_for_no_mappings.snap
@@ -1,15 +1,10 @@
 ---
 source: crates/config/tests/project_env.rs
-expression: "(&rendered, format_project_env(&RenderedProjectEnv::default()), transformed)"
+expression: "(&rendered, format_project_env(&RenderedProjectEnv::default()))"
 ---
 (
     RenderedProjectEnv {
         values: {},
     },
     "",
-    ManagedEnvBlockTransform {
-        content: "USER_VALUE=1\n# >>> PV MANAGED\nOLD_VALUE=stays\n# <<< PV MANAGED\n",
-        warnings: [],
-        changed: false,
-    },
 )
diff --git a/crates/config/tests/snapshots/project_env__resource_only_env_omits_serving_placeholders_across_scopes.snap b/crates/config/tests/snapshots/project_env__resource_only_env_omits_serving_placeholders_across_scopes.snap
new file mode 100644
index 00000000..15a28fe8
--- /dev/null
+++ b/crates/config/tests/snapshots/project_env__resource_only_env_omits_serving_placeholders_across_scopes.snap
@@ -0,0 +1,14 @@
+---
+source: crates/config/tests/project_env.rs
+expression: "(&rendered, format_project_env(&rendered))"
+---
+(
+    RenderedProjectEnv {
+        values: {
+            "APP_ENV": "local",
+            "DB_DATABASE": "acme_app",
+            "DB_HOST": "127.0.0.1",
+        },
+    },
+    "APP_ENV=local\nDB_DATABASE=acme_app\nDB_HOST=127.0.0.1\n",
+)
diff --git a/crates/daemon/src/gateway.rs b/crates/daemon/src/gateway.rs
index f056130a..1bc258f7 100644
--- a/crates/daemon/src/gateway.rs
+++ b/crates/daemon/src/gateway.rs
@@ -13,8 +13,8 @@ use rustix::process::{Pid, Signal, kill_process_group};
 use sha2::{Digest, Sha256};
 use state::{
     Database, ManagedResourceDesiredState, ManagedResourceTrackRecord, PortOwner, PortRequest,
-    ProjectEnvObservedStatus, PvPaths, RUNTIME_PORT_FALLBACK_END, RUNTIME_PORT_FALLBACK_START,
-    RuntimeObservedStatus, RuntimeSubject, StateError, fs,
+    ProjectEnvObservedStatus, ProjectMode, PvPaths, RUNTIME_PORT_FALLBACK_END,
+    RUNTIME_PORT_FALLBACK_START, RuntimeObservedStatus, RuntimeSubject, StateError, fs,
 };
 use tokio::io::{AsyncRead, AsyncReadExt};
 use tokio::time::timeout;
@@ -459,6 +459,10 @@ pub fn build_runtime_plan(paths: &PvPaths) -> Result<RuntimePlan, DaemonError> {
     let mut projects_by_runtime_key: BTreeMap<String, PhpWorkerRuntimePlan> = BTreeMap::new();
 
     for project in database.projects()? {
+        if project.mode == ProjectMode::ResourceOnly {
+            continue;
+        }
+
         let config_file = match ProjectConfigFile::read_from_root(&project.path) {
             Ok(config_file) => Some(config_file),
             Err(error) => {
@@ -478,6 +482,14 @@ pub fn build_runtime_plan(paths: &PvPaths) -> Result<RuntimePlan, DaemonError> {
         };
         let config = match config_file {
             Some(config_file) => {
+                if config_file.config.serve != (project.mode == ProjectMode::Served) {
+                    append_persisted_runtime_project(
+                        &mut database,
+                        &mut projects_by_runtime_key,
+                        project,
+                    )?;
+                    continue;
+                }
                 match validate_project_config_for_gateway(paths, &database, &project, &config_file)
                 {
                     Ok(()) => Some(config_file.config),
@@ -499,6 +511,13 @@ pub fn build_runtime_plan(paths: &PvPaths) -> Result<RuntimePlan, DaemonError> {
             }
             None => None,
         };
+        let primary_hostname =
+            project
+                .primary_hostname
+                .clone()
+                .ok_or_else(|| StateError::ProjectNotServed {
+                    project_id: project.id.clone(),
+                })?;
         let runtime = resolve_project_php_runtime(
             paths,
             &database,
@@ -509,9 +528,9 @@ pub fn build_runtime_plan(paths: &PvPaths) -> Result<RuntimePlan, DaemonError> {
         let runtime_project = RuntimeProject {
             id: project.id,
             render_config: true,
-            primary_hostname: project.primary_hostname.clone(),
+            primary_hostname: primary_hostname.clone(),
             hostnames: additional_hostnames(
-                &project.primary_hostname,
+                &primary_hostname,
                 project.additional_hostnames,
                 config
                     .as_ref()
@@ -588,6 +607,16 @@ fn append_persisted_runtime_project(
     projects_by_runtime_key: &mut BTreeMap<String, PhpWorkerRuntimePlan>,
     project: state::ProjectRecord,
 ) -> Result<(), DaemonError> {
+    if project.mode == ProjectMode::ResourceOnly {
+        return Ok(());
+    }
+    let primary_hostname =
+        project
+            .primary_hostname
+            .clone()
+            .ok_or_else(|| StateError::ProjectNotServed {
+                project_id: project.id.clone(),
+            })?;
     let runtime = match persisted_project_php_runtime(database, &project) {
         Ok(Some(runtime)) => runtime,
         Ok(None) => return Ok(()),
@@ -611,9 +640,9 @@ fn append_persisted_runtime_project(
     let runtime_project = RuntimeProject {
         id: project.id,
         render_config: false,
-        primary_hostname: project.primary_hostname.clone(),
+        primary_hostname: primary_hostname.clone(),
         hostnames: additional_hostnames(
-            &project.primary_hostname,
+            &primary_hostname,
             project.additional_hostnames,
             Vec::new(),
         ),
diff --git a/crates/daemon/src/jobs.rs b/crates/daemon/src/jobs.rs
index b3a4bdb2..86b61d91 100644
--- a/crates/daemon/src/jobs.rs
+++ b/crates/daemon/src/jobs.rs
@@ -1022,9 +1022,8 @@ async fn reconcile_system_projects_with_progress(
                 report.summaries.push(summary.as_str().to_owned());
             }
             Err(error) => {
-                report
-                    .failures
-                    .push(format!("{}: {error}", project.primary_hostname));
+                let project_label = project.primary_hostname.as_deref().unwrap_or(&project.slug);
+                report.failures.push(format!("{project_label}: {error}"));
             }
         }
     }
diff --git a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__mysql_tests__mysql_project_demand_installs_missing_fixture_track_before_start.snap b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__mysql_tests__mysql_project_demand_installs_missing_fixture_track_before_start.snap
index 609469f0..a6ca2439 100644
--- a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__mysql_tests__mysql_project_demand_installs_missing_fixture_track_before_start.snap
+++ b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__mysql_tests__mysql_project_demand_installs_missing_fixture_track_before_start.snap
@@ -6,11 +6,11 @@ expression: snapshot
     [
         RecordedSqlAdminOperation {
             engine: Mysql,
-            database: "acme_test_app_db",
-            statement: "CREATE DATABASE IF NOT EXISTS `acme_test_app_db`",
+            database: "project_app_db",
+            statement: "CREATE DATABASE IF NOT EXISTS `project_app_db`",
         },
     ],
-    "# >>> PV MANAGED\nAPP_URL=https://acme.test\nDATABASE_URL=mysql://pv_root:<generated_mysql_password>@127.0.0.1:<mysql_port>/acme_test_app_db\nDB_DATABASE=acme_test_app_db\nDB_HOST=127.0.0.1\nDB_PASSWORD=<generated_mysql_password>\nDB_PORT=<mysql_port>\nDB_USERNAME=pv_root\n# <<< PV MANAGED\n",
+    "# >>> PV MANAGED\nAPP_URL=https://acme.test\nDATABASE_URL=mysql://pv_root:<generated_mysql_password>@127.0.0.1:<mysql_port>/project_app_db\nDB_DATABASE=project_app_db\nDB_HOST=127.0.0.1\nDB_PASSWORD=<generated_mysql_password>\nDB_PORT=<mysql_port>\nDB_USERNAME=pv_root\n# <<< PV MANAGED\n",
     ManagedResourceTrackRecord {
         resource_name: "mysql",
         track: "8.0",
@@ -51,13 +51,13 @@ expression: snapshot
             resource_name: "mysql",
             track: "8.0",
             allocation_name: "app-db",
-            generated_name: "acme_test_app_db",
+            generated_name: "project_app_db",
             env: {
-                "database": "acme_test_app_db",
+                "database": "project_app_db",
                 "host": "127.0.0.1",
                 "password": "<generated_mysql_password>",
                 "port": "<mysql_port>",
-                "url": "mysql://pv_root:<generated_mysql_password>@127.0.0.1:<mysql_port>/acme_test_app_db",
+                "url": "mysql://pv_root:<generated_mysql_password>@127.0.0.1:<mysql_port>/project_app_db",
                 "username": "pv_root",
             },
             status: Ready,
diff --git a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__mysql_tests__mysql_reconciliation_creates_database_allocation_and_renders_env.snap b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__mysql_tests__mysql_reconciliation_creates_database_allocation_and_renders_env.snap
index 609469f0..a6ca2439 100644
--- a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__mysql_tests__mysql_reconciliation_creates_database_allocation_and_renders_env.snap
+++ b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__mysql_tests__mysql_reconciliation_creates_database_allocation_and_renders_env.snap
@@ -6,11 +6,11 @@ expression: snapshot
     [
         RecordedSqlAdminOperation {
             engine: Mysql,
-            database: "acme_test_app_db",
-            statement: "CREATE DATABASE IF NOT EXISTS `acme_test_app_db`",
+            database: "project_app_db",
+            statement: "CREATE DATABASE IF NOT EXISTS `project_app_db`",
         },
     ],
-    "# >>> PV MANAGED\nAPP_URL=https://acme.test\nDATABASE_URL=mysql://pv_root:<generated_mysql_password>@127.0.0.1:<mysql_port>/acme_test_app_db\nDB_DATABASE=acme_test_app_db\nDB_HOST=127.0.0.1\nDB_PASSWORD=<generated_mysql_password>\nDB_PORT=<mysql_port>\nDB_USERNAME=pv_root\n# <<< PV MANAGED\n",
+    "# >>> PV MANAGED\nAPP_URL=https://acme.test\nDATABASE_URL=mysql://pv_root:<generated_mysql_password>@127.0.0.1:<mysql_port>/project_app_db\nDB_DATABASE=project_app_db\nDB_HOST=127.0.0.1\nDB_PASSWORD=<generated_mysql_password>\nDB_PORT=<mysql_port>\nDB_USERNAME=pv_root\n# <<< PV MANAGED\n",
     ManagedResourceTrackRecord {
         resource_name: "mysql",
         track: "8.0",
@@ -51,13 +51,13 @@ expression: snapshot
             resource_name: "mysql",
             track: "8.0",
             allocation_name: "app-db",
-            generated_name: "acme_test_app_db",
+            generated_name: "project_app_db",
             env: {
-                "database": "acme_test_app_db",
+                "database": "project_app_db",
                 "host": "127.0.0.1",
                 "password": "<generated_mysql_password>",
                 "port": "<mysql_port>",
-                "url": "mysql://pv_root:<generated_mysql_password>@127.0.0.1:<mysql_port>/acme_test_app_db",
+                "url": "mysql://pv_root:<generated_mysql_password>@127.0.0.1:<mysql_port>/project_app_db",
                 "username": "pv_root",
             },
             status: Ready,
diff --git a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__async_readiness_reassigns_unowned_persisted_port_before_resource_readiness.snap b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__async_readiness_reassigns_unowned_persisted_port_before_resource_readiness.snap
index 88a3b26f..de18441e 100644
--- a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__async_readiness_reassigns_unowned_persisted_port_before_resource_readiness.snap
+++ b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__async_readiness_reassigns_unowned_persisted_port_before_resource_readiness.snap
@@ -11,7 +11,7 @@ expression: snapshot
         "env_uses_occupied_port",
         false,
     ),
-    "# >>> PV MANAGED\nDATABASE_URL=mysql://root:secret@127.0.0.1:<mysql_port>/acme_test_app_db\n# <<< PV MANAGED\n",
+    "# >>> PV MANAGED\nDATABASE_URL=mysql://root:secret@127.0.0.1:<port>/project_app_db\n# <<< PV MANAGED\n",
     [
         PortAssignment {
             owner: Resource {
@@ -30,13 +30,13 @@ expression: snapshot
             resource_name: "mysql",
             track: "8.0",
             allocation_name: "app-db",
-            generated_name: "acme_test_app_db",
+            generated_name: "project_app_db",
             env: {
-                "database": "acme_test_app_db",
+                "database": "project_app_db",
                 "host": "127.0.0.1",
                 "password": "secret",
                 "port": "<port>",
-                "url": "mysql://root:secret@127.0.0.1:<mysql_port>/acme_test_app_db",
+                "url": "mysql://root:secret@127.0.0.1:<port>/project_app_db",
                 "username": "root",
             },
             status: Ready,
diff --git a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__demanded_resource_uses_async_readiness_and_allocation_hooks.snap b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__demanded_resource_uses_async_readiness_and_allocation_hooks.snap
index a64bd0a1..dcf1f6e2 100644
--- a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__demanded_resource_uses_async_readiness_and_allocation_hooks.snap
+++ b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__demanded_resource_uses_async_readiness_and_allocation_hooks.snap
@@ -3,7 +3,7 @@ source: crates/daemon/src/managed_resources/tests.rs
 expression: snapshot
 ---
 (
-    "# >>> PV MANAGED\nDATABASE_URL=mysql://root:secret@127.0.0.1:<mysql_port>/acme_test_app_db\n# <<< PV MANAGED\n",
+    "# >>> PV MANAGED\nDATABASE_URL=mysql://root:secret@127.0.0.1:<port>/project_app_db\n# <<< PV MANAGED\n",
     [
         ResourceAllocationRecord {
             id: "allocation_000001",
@@ -11,13 +11,13 @@ expression: snapshot
             resource_name: "mysql",
             track: "8.0",
             allocation_name: "app-db",
-            generated_name: "acme_test_app_db",
+            generated_name: "project_app_db",
             env: {
-                "database": "acme_test_app_db",
+                "database": "project_app_db",
                 "host": "127.0.0.1",
                 "password": "secret",
                 "port": "<port>",
-                "url": "mysql://root:secret@127.0.0.1:<mysql_port>/acme_test_app_db",
+                "url": "mysql://root:secret@127.0.0.1:<port>/project_app_db",
                 "username": "root",
             },
             status: Ready,
diff --git a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__postgres_project_demand_installs_missing_fixture_track_before_start.snap b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__postgres_project_demand_installs_missing_fixture_track_before_start.snap
index 9b80f26f..d788dfb0 100644
--- a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__postgres_project_demand_installs_missing_fixture_track_before_start.snap
+++ b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__postgres_project_demand_installs_missing_fixture_track_before_start.snap
@@ -3,7 +3,7 @@ source: crates/daemon/src/managed_resources/tests.rs
 expression: snapshot
 ---
 (
-    "# >>> PV MANAGED\nDATABASE_URL=postgres://pv_root:<postgres_password>@127.0.0.1:<postgres_port>/acme_test_app_db\nDB_DATABASE=acme_test_app_db\nDB_HOST=127.0.0.1\nDB_PASSWORD=<postgres_password>\nDB_PORT=<postgres_port>\nDB_USERNAME=pv_root\nPGHOST=127.0.0.1\nPGPASSWORD=<postgres_password>\nPGPORT=<postgres_port>\nPGUSER=pv_root\n# <<< PV MANAGED\n",
+    "# >>> PV MANAGED\nDATABASE_URL=postgres://pv_root:<postgres_password>@127.0.0.1:<postgres_port>/project_app_db\nDB_DATABASE=project_app_db\nDB_HOST=127.0.0.1\nDB_PASSWORD=<postgres_password>\nDB_PORT=<postgres_port>\nDB_USERNAME=pv_root\nPGHOST=127.0.0.1\nPGPASSWORD=<postgres_password>\nPGPORT=<postgres_port>\nPGUSER=pv_root\n# <<< PV MANAGED\n",
     ManagedResourceTrackRecord {
         resource_name: "postgres",
         track: "16",
@@ -44,13 +44,13 @@ expression: snapshot
             resource_name: "postgres",
             track: "16",
             allocation_name: "app-db",
-            generated_name: "acme_test_app_db",
+            generated_name: "project_app_db",
             env: {
-                "database": "acme_test_app_db",
+                "database": "project_app_db",
                 "host": "127.0.0.1",
                 "password": "<postgres_password>",
                 "port": "<postgres_port>",
-                "url": "postgres://pv_root:<postgres_password>@127.0.0.1:<postgres_port>/acme_test_app_db",
+                "url": "postgres://pv_root:<postgres_password>@127.0.0.1:<postgres_port>/project_app_db",
                 "username": "pv_root",
             },
             status: Ready,
diff --git a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__postgres_reconciliation_creates_database_allocation_and_renders_env.snap b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__postgres_reconciliation_creates_database_allocation_and_renders_env.snap
index 9b80f26f..d788dfb0 100644
--- a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__postgres_reconciliation_creates_database_allocation_and_renders_env.snap
+++ b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__postgres_reconciliation_creates_database_allocation_and_renders_env.snap
@@ -3,7 +3,7 @@ source: crates/daemon/src/managed_resources/tests.rs
 expression: snapshot
 ---
 (
-    "# >>> PV MANAGED\nDATABASE_URL=postgres://pv_root:<postgres_password>@127.0.0.1:<postgres_port>/acme_test_app_db\nDB_DATABASE=acme_test_app_db\nDB_HOST=127.0.0.1\nDB_PASSWORD=<postgres_password>\nDB_PORT=<postgres_port>\nDB_USERNAME=pv_root\nPGHOST=127.0.0.1\nPGPASSWORD=<postgres_password>\nPGPORT=<postgres_port>\nPGUSER=pv_root\n# <<< PV MANAGED\n",
+    "# >>> PV MANAGED\nDATABASE_URL=postgres://pv_root:<postgres_password>@127.0.0.1:<postgres_port>/project_app_db\nDB_DATABASE=project_app_db\nDB_HOST=127.0.0.1\nDB_PASSWORD=<postgres_password>\nDB_PORT=<postgres_port>\nDB_USERNAME=pv_root\nPGHOST=127.0.0.1\nPGPASSWORD=<postgres_password>\nPGPORT=<postgres_port>\nPGUSER=pv_root\n# <<< PV MANAGED\n",
     ManagedResourceTrackRecord {
         resource_name: "postgres",
         track: "16",
@@ -44,13 +44,13 @@ expression: snapshot
             resource_name: "postgres",
             track: "16",
             allocation_name: "app-db",
-            generated_name: "acme_test_app_db",
+            generated_name: "project_app_db",
             env: {
-                "database": "acme_test_app_db",
+                "database": "project_app_db",
                 "host": "127.0.0.1",
                 "password": "<postgres_password>",
                 "port": "<postgres_port>",
-                "url": "postgres://pv_root:<postgres_password>@127.0.0.1:<postgres_port>/acme_test_app_db",
+                "url": "postgres://pv_root:<postgres_password>@127.0.0.1:<postgres_port>/project_app_db",
                 "username": "pv_root",
             },
             status: Ready,
diff --git a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__postgres_reconciliation_replaces_stale_admin_username_from_track_env.snap b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__postgres_reconciliation_replaces_stale_admin_username_from_track_env.snap
index caf147ec..9a2679a9 100644
--- a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__postgres_reconciliation_replaces_stale_admin_username_from_track_env.snap
+++ b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__postgres_reconciliation_replaces_stale_admin_username_from_track_env.snap
@@ -3,7 +3,7 @@ source: crates/daemon/src/managed_resources/tests.rs
 expression: snapshot
 ---
 (
-    "# >>> PV MANAGED\nDATABASE_URL=postgres://pv_root:<postgres_password>@127.0.0.1:<postgres_port>/acme_test_app_db\nDB_DATABASE=acme_test_app_db\nDB_HOST=127.0.0.1\nDB_PASSWORD=<postgres_password>\nDB_PORT=<postgres_port>\nDB_USERNAME=pv_root\nPGHOST=127.0.0.1\nPGPASSWORD=<postgres_password>\nPGPORT=<postgres_port>\nPGUSER=pv_root\n# <<< PV MANAGED\n",
+    "# >>> PV MANAGED\nDATABASE_URL=postgres://pv_root:<postgres_password>@127.0.0.1:<postgres_port>/project_app_db\nDB_DATABASE=project_app_db\nDB_HOST=127.0.0.1\nDB_PASSWORD=<postgres_password>\nDB_PORT=<postgres_port>\nDB_USERNAME=pv_root\nPGHOST=127.0.0.1\nPGPASSWORD=<postgres_password>\nPGPORT=<postgres_port>\nPGUSER=pv_root\n# <<< PV MANAGED\n",
     ManagedResourceTrackRecord {
         resource_name: "postgres",
         track: "16",
@@ -33,13 +33,13 @@ expression: snapshot
             resource_name: "postgres",
             track: "16",
             allocation_name: "app-db",
-            generated_name: "acme_test_app_db",
+            generated_name: "project_app_db",
             env: {
-                "database": "acme_test_app_db",
+                "database": "project_app_db",
                 "host": "127.0.0.1",
                 "password": "<postgres_password>",
                 "port": "<postgres_port>",
-                "url": "postgres://pv_root:<postgres_password>@127.0.0.1:<postgres_port>/acme_test_app_db",
+                "url": "postgres://pv_root:<postgres_password>@127.0.0.1:<postgres_port>/project_app_db",
                 "username": "pv_root",
             },
             status: Ready,
diff --git a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__redis_port_reassignment_refreshes_ready_allocation_env.snap b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__redis_port_reassignment_refreshes_ready_allocation_env.snap
index 0e87ee86..41788729 100644
--- a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__redis_port_reassignment_refreshes_ready_allocation_env.snap
+++ b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__redis_port_reassignment_refreshes_ready_allocation_env.snap
@@ -3,7 +3,7 @@ source: crates/daemon/src/managed_resources/tests.rs
 expression: snapshot
 ---
 (
-    "# >>> PV MANAGED\nCACHE_REDIS_HOST=127.0.0.1\nCACHE_REDIS_PORT=<redis_port>\nCACHE_REDIS_PREFIX=acme-test-cache-\nCACHE_REDIS_URL=redis://127.0.0.1:<redis_port>/0\nREDIS_HOST=127.0.0.1\nREDIS_PORT=<redis_port>\nREDIS_URL=redis://127.0.0.1:<redis_port>/0\n# <<< PV MANAGED\n",
+    "# >>> PV MANAGED\nCACHE_REDIS_HOST=127.0.0.1\nCACHE_REDIS_PORT=<redis_port>\nCACHE_REDIS_PREFIX=project-cache-\nCACHE_REDIS_URL=redis://127.0.0.1:<redis_port>/0\nREDIS_HOST=127.0.0.1\nREDIS_PORT=<redis_port>\nREDIS_URL=redis://127.0.0.1:<redis_port>/0\n# <<< PV MANAGED\n",
     ManagedResourceTrackRecord {
         resource_name: "redis",
         track: "7.2",
@@ -31,11 +31,11 @@ expression: snapshot
             resource_name: "redis",
             track: "7.2",
             allocation_name: "cache",
-            generated_name: "acme-test-cache-",
+            generated_name: "project-cache-",
             env: {
                 "host": "127.0.0.1",
                 "port": "<redis_port>",
-                "prefix": "acme-test-cache-",
+                "prefix": "project-cache-",
                 "url": "redis://127.0.0.1:<redis_port>/0",
             },
             status: Ready,
diff --git a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__redis_project_demand_installs_missing_fixture_track_before_start.snap b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__redis_project_demand_installs_missing_fixture_track_before_start.snap
index 0e87ee86..41788729 100644
--- a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__redis_project_demand_installs_missing_fixture_track_before_start.snap
+++ b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__redis_project_demand_installs_missing_fixture_track_before_start.snap
@@ -3,7 +3,7 @@ source: crates/daemon/src/managed_resources/tests.rs
 expression: snapshot
 ---
 (
-    "# >>> PV MANAGED\nCACHE_REDIS_HOST=127.0.0.1\nCACHE_REDIS_PORT=<redis_port>\nCACHE_REDIS_PREFIX=acme-test-cache-\nCACHE_REDIS_URL=redis://127.0.0.1:<redis_port>/0\nREDIS_HOST=127.0.0.1\nREDIS_PORT=<redis_port>\nREDIS_URL=redis://127.0.0.1:<redis_port>/0\n# <<< PV MANAGED\n",
+    "# >>> PV MANAGED\nCACHE_REDIS_HOST=127.0.0.1\nCACHE_REDIS_PORT=<redis_port>\nCACHE_REDIS_PREFIX=project-cache-\nCACHE_REDIS_URL=redis://127.0.0.1:<redis_port>/0\nREDIS_HOST=127.0.0.1\nREDIS_PORT=<redis_port>\nREDIS_URL=redis://127.0.0.1:<redis_port>/0\n# <<< PV MANAGED\n",
     ManagedResourceTrackRecord {
         resource_name: "redis",
         track: "7.2",
@@ -31,11 +31,11 @@ expression: snapshot
             resource_name: "redis",
             track: "7.2",
             allocation_name: "cache",
-            generated_name: "acme-test-cache-",
+            generated_name: "project-cache-",
             env: {
                 "host": "127.0.0.1",
                 "port": "<redis_port>",
-                "prefix": "acme-test-cache-",
+                "prefix": "project-cache-",
                 "url": "redis://127.0.0.1:<redis_port>/0",
             },
             status: Ready,
diff --git a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__redis_reconciliation_marks_prefix_allocation_ready_and_renders_env.snap b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__redis_reconciliation_marks_prefix_allocation_ready_and_renders_env.snap
index 0e87ee86..41788729 100644
--- a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__redis_reconciliation_marks_prefix_allocation_ready_and_renders_env.snap
+++ b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__redis_reconciliation_marks_prefix_allocation_ready_and_renders_env.snap
@@ -3,7 +3,7 @@ source: crates/daemon/src/managed_resources/tests.rs
 expression: snapshot
 ---
 (
-    "# >>> PV MANAGED\nCACHE_REDIS_HOST=127.0.0.1\nCACHE_REDIS_PORT=<redis_port>\nCACHE_REDIS_PREFIX=acme-test-cache-\nCACHE_REDIS_URL=redis://127.0.0.1:<redis_port>/0\nREDIS_HOST=127.0.0.1\nREDIS_PORT=<redis_port>\nREDIS_URL=redis://127.0.0.1:<redis_port>/0\n# <<< PV MANAGED\n",
+    "# >>> PV MANAGED\nCACHE_REDIS_HOST=127.0.0.1\nCACHE_REDIS_PORT=<redis_port>\nCACHE_REDIS_PREFIX=project-cache-\nCACHE_REDIS_URL=redis://127.0.0.1:<redis_port>/0\nREDIS_HOST=127.0.0.1\nREDIS_PORT=<redis_port>\nREDIS_URL=redis://127.0.0.1:<redis_port>/0\n# <<< PV MANAGED\n",
     ManagedResourceTrackRecord {
         resource_name: "redis",
         track: "7.2",
@@ -31,11 +31,11 @@ expression: snapshot
             resource_name: "redis",
             track: "7.2",
             allocation_name: "cache",
-            generated_name: "acme-test-cache-",
+            generated_name: "project-cache-",
             env: {
                 "host": "127.0.0.1",
                 "port": "<redis_port>",
-                "prefix": "acme-test-cache-",
+                "prefix": "project-cache-",
                 "url": "redis://127.0.0.1:<redis_port>/0",
             },
             status: Ready,
diff --git a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__redis_reconciliation_reuses_ready_prefix_allocation.snap b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__redis_reconciliation_reuses_ready_prefix_allocation.snap
index 4d8a4d76..1c967044 100644
--- a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__redis_reconciliation_reuses_ready_prefix_allocation.snap
+++ b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__redis_reconciliation_reuses_ready_prefix_allocation.snap
@@ -25,7 +25,9 @@ expression: snapshot
         ],
         ProjectEnvStateContext {
             project_id: "<project_id>",
-            primary_hostname: "acme.test",
+            primary_hostname: Some(
+                "acme.test",
+            ),
             resources: {
                 "redis": ProjectEnvResourceContext {
                     track: "7.2",
@@ -71,7 +73,9 @@ expression: snapshot
         ],
         ProjectEnvStateContext {
             project_id: "<project_id>",
-            primary_hostname: "acme.test",
+            primary_hostname: Some(
+                "acme.test",
+            ),
             resources: {
                 "redis": ProjectEnvResourceContext {
                     track: "7.2",
diff --git a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__rustfs_allocation_failure_preserves_project_env_and_records_failed_runtime.snap b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__rustfs_allocation_failure_preserves_project_env_and_records_failed_runtime.snap
index 3f5df94c..2acc4a22 100644
--- a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__rustfs_allocation_failure_preserves_project_env_and_records_failed_runtime.snap
+++ b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__rustfs_allocation_failure_preserves_project_env_and_records_failed_runtime.snap
@@ -3,7 +3,7 @@ source: crates/daemon/src/managed_resources/tests.rs
 expression: snapshot
 ---
 (
-    "Err(\n    UnexpectedProtocolResponse {\n        reason: \"RustFS admin error: failed to create bucket `acme-test-uploads`; service error\",\n    },\n)",
+    "Err(\n    UnexpectedProtocolResponse {\n        reason: \"RustFS admin error: failed to create bucket `project-uploads`; service error\",\n    },\n)",
     "EXISTING=value\n",
     [
         ResourceAllocationRecord {
@@ -12,7 +12,7 @@ expression: snapshot
             resource_name: "rustfs",
             track: "1.0",
             allocation_name: "uploads",
-            generated_name: "acme-test-uploads",
+            generated_name: "project-uploads",
             env: {},
             status: Desired,
             created_at: "<timestamp>",
@@ -27,7 +27,7 @@ expression: snapshot
             },
             status: Failed,
             message: Some(
-                "daemon protocol error: RustFS admin error: failed to create bucket `acme-test-uploads`; service error",
+                "daemon protocol error: RustFS admin error: failed to create bucket `project-uploads`; service error",
             ),
             observed_at: "<timestamp>",
         },
@@ -37,7 +37,7 @@ expression: snapshot
             project_id: "<project_id>",
             status: Failed,
             message: Some(
-                "daemon protocol error: RustFS admin error: failed to create bucket `acme-test-uploads`; service error",
+                "daemon protocol error: RustFS admin error: failed to create bucket `project-uploads`; service error",
             ),
             observed_at: "<timestamp>",
             warnings: [],
diff --git a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__rustfs_port_reassignment_renders_current_endpoint_for_ready_allocation.snap b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__rustfs_port_reassignment_renders_current_endpoint_for_ready_allocation.snap
index fce43de1..75842baa 100644
--- a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__rustfs_port_reassignment_renders_current_endpoint_for_ready_allocation.snap
+++ b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__rustfs_port_reassignment_renders_current_endpoint_for_ready_allocation.snap
@@ -3,7 +3,7 @@ source: crates/daemon/src/managed_resources/tests.rs
 expression: snapshot
 ---
 (
-    "# >>> PV MANAGED\nAWS_ACCESS_KEY_ID=pv-rustfs\nAWS_BUCKET=acme-test-uploads\nAWS_ENDPOINT=http://127.0.0.1:<api_port>\nAWS_SECRET_ACCESS_KEY=<secret_key>\nAWS_URL=http://127.0.0.1:<api_port>\nS3_ACCESS_KEY=pv-rustfs\nS3_ENDPOINT=http://127.0.0.1:<api_port>\nS3_SECRET_KEY=<secret_key>\n# <<< PV MANAGED\n",
+    "# >>> PV MANAGED\nAWS_ACCESS_KEY_ID=pv-rustfs\nAWS_BUCKET=project-uploads\nAWS_ENDPOINT=http://127.0.0.1:<api_port>\nAWS_SECRET_ACCESS_KEY=<secret_key>\nAWS_URL=http://127.0.0.1:<api_port>\nS3_ACCESS_KEY=pv-rustfs\nS3_ENDPOINT=http://127.0.0.1:<api_port>\nS3_SECRET_KEY=<secret_key>\n# <<< PV MANAGED\n",
     ManagedResourceTrackRecord {
         resource_name: "rustfs",
         track: "1.0",
@@ -34,9 +34,9 @@ expression: snapshot
             resource_name: "rustfs",
             track: "1.0",
             allocation_name: "uploads",
-            generated_name: "acme-test-uploads",
+            generated_name: "project-uploads",
             env: {
-                "bucket": "acme-test-uploads",
+                "bucket": "project-uploads",
             },
             status: Ready,
             created_at: "<timestamp>",
diff --git a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__rustfs_project_demand_installs_missing_fixture_track_before_start.snap b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__rustfs_project_demand_installs_missing_fixture_track_before_start.snap
index fce43de1..75842baa 100644
--- a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__rustfs_project_demand_installs_missing_fixture_track_before_start.snap
+++ b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__rustfs_project_demand_installs_missing_fixture_track_before_start.snap
@@ -3,7 +3,7 @@ source: crates/daemon/src/managed_resources/tests.rs
 expression: snapshot
 ---
 (
-    "# >>> PV MANAGED\nAWS_ACCESS_KEY_ID=pv-rustfs\nAWS_BUCKET=acme-test-uploads\nAWS_ENDPOINT=http://127.0.0.1:<api_port>\nAWS_SECRET_ACCESS_KEY=<secret_key>\nAWS_URL=http://127.0.0.1:<api_port>\nS3_ACCESS_KEY=pv-rustfs\nS3_ENDPOINT=http://127.0.0.1:<api_port>\nS3_SECRET_KEY=<secret_key>\n# <<< PV MANAGED\n",
+    "# >>> PV MANAGED\nAWS_ACCESS_KEY_ID=pv-rustfs\nAWS_BUCKET=project-uploads\nAWS_ENDPOINT=http://127.0.0.1:<api_port>\nAWS_SECRET_ACCESS_KEY=<secret_key>\nAWS_URL=http://127.0.0.1:<api_port>\nS3_ACCESS_KEY=pv-rustfs\nS3_ENDPOINT=http://127.0.0.1:<api_port>\nS3_SECRET_KEY=<secret_key>\n# <<< PV MANAGED\n",
     ManagedResourceTrackRecord {
         resource_name: "rustfs",
         track: "1.0",
@@ -34,9 +34,9 @@ expression: snapshot
             resource_name: "rustfs",
             track: "1.0",
             allocation_name: "uploads",
-            generated_name: "acme-test-uploads",
+            generated_name: "project-uploads",
             env: {
-                "bucket": "acme-test-uploads",
+                "bucket": "project-uploads",
             },
             status: Ready,
             created_at: "<timestamp>",
diff --git a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__rustfs_ready_allocation_reconciliation_repairs_missing_bucket_and_preserves_env.snap b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__rustfs_ready_allocation_reconciliation_repairs_missing_bucket_and_preserves_env.snap
index 80f61ac7..ef6a4040 100644
--- a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__rustfs_ready_allocation_reconciliation_repairs_missing_bucket_and_preserves_env.snap
+++ b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__rustfs_ready_allocation_reconciliation_repairs_missing_bucket_and_preserves_env.snap
@@ -3,7 +3,7 @@ source: crates/daemon/src/managed_resources/tests.rs
 expression: snapshot
 ---
 (
-    "# >>> PV MANAGED\nAWS_ACCESS_KEY_ID=pv-rustfs\nAWS_BUCKET=acme-test-uploads\nAWS_ENDPOINT=http://127.0.0.1:<api_port>\nAWS_SECRET_ACCESS_KEY=<secret_key>\nAWS_URL=http://127.0.0.1:<api_port>\nS3_ACCESS_KEY=pv-rustfs\nS3_ENDPOINT=http://127.0.0.1:<api_port>\nS3_SECRET_KEY=<secret_key>\n# <<< PV MANAGED\n",
+    "# >>> PV MANAGED\nAWS_ACCESS_KEY_ID=pv-rustfs\nAWS_BUCKET=project-uploads\nAWS_ENDPOINT=http://127.0.0.1:<api_port>\nAWS_SECRET_ACCESS_KEY=<secret_key>\nAWS_URL=http://127.0.0.1:<api_port>\nS3_ACCESS_KEY=pv-rustfs\nS3_ENDPOINT=http://127.0.0.1:<api_port>\nS3_SECRET_KEY=<secret_key>\n# <<< PV MANAGED\n",
     [
         ResourceAllocationRecord {
             id: "allocation_000001",
@@ -11,9 +11,9 @@ expression: snapshot
             resource_name: "rustfs",
             track: "1.0",
             allocation_name: "uploads",
-            generated_name: "acme-test-uploads",
+            generated_name: "project-uploads",
             env: {
-                "bucket": "acme-test-uploads",
+                "bucket": "project-uploads",
             },
             status: Ready,
             created_at: "<timestamp>",
diff --git a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__rustfs_reconciliation_creates_bucket_and_renders_env.snap b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__rustfs_reconciliation_creates_bucket_and_renders_env.snap
index 7a852844..2516372b 100644
--- a/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__rustfs_reconciliation_creates_bucket_and_renders_env.snap
+++ b/crates/daemon/src/managed_resources/snapshots/daemon__managed_resources__tests__rustfs_reconciliation_creates_bucket_and_renders_env.snap
@@ -3,7 +3,7 @@ source: crates/daemon/src/managed_resources/tests.rs
 expression: snapshot
 ---
 (
-    "# >>> PV MANAGED\nAWS_ACCESS_KEY_ID=pv-rustfs\nAWS_BUCKET=acme-test-uploads\nAWS_ENDPOINT=http://127.0.0.1:<api_port>\nAWS_SECRET_ACCESS_KEY=<secret_key>\nAWS_URL=http://127.0.0.1:<api_port>\nS3_ACCESS_KEY=pv-rustfs\nS3_ENDPOINT=http://127.0.0.1:<api_port>\nS3_SECRET_KEY=<secret_key>\n# <<< PV MANAGED\n",
+    "# >>> PV MANAGED\nAWS_ACCESS_KEY_ID=pv-rustfs\nAWS_BUCKET=project-uploads\nAWS_ENDPOINT=http://127.0.0.1:<api_port>\nAWS_SECRET_ACCESS_KEY=<secret_key>\nAWS_URL=http://127.0.0.1:<api_port>\nS3_ACCESS_KEY=pv-rustfs\nS3_ENDPOINT=http://127.0.0.1:<api_port>\nS3_SECRET_KEY=<secret_key>\n# <<< PV MANAGED\n",
     ManagedResourceTrackRecord {
         resource_name: "rustfs",
         track: "1.0",
@@ -37,9 +37,9 @@ expression: snapshot
             resource_name: "rustfs",
             track: "1.0",
             allocation_name: "uploads",
-            generated_name: "acme-test-uploads",
+            generated_name: "project-uploads",
             env: {
-                "bucket": "acme-test-uploads",
+                "bucket": "project-uploads",
             },
             status: Ready,
             created_at: "<timestamp>",
diff --git a/crates/daemon/src/managed_resources/tests.rs b/crates/daemon/src/managed_resources/tests.rs
index 8c08597c..a94beb91 100644
--- a/crates/daemon/src/managed_resources/tests.rs
+++ b/crates/daemon/src/managed_resources/tests.rs
@@ -3082,13 +3082,17 @@ fn write_expiring_project_certificate(
 ) -> Result<()> {
     let ca_key_pair = KeyPair::from_pem(&local_ca.private_key_pem)?;
     let issuer = Issuer::from_ca_cert_pem(&local_ca.certificate_pem, ca_key_pair)?;
-    let mut params = CertificateParams::new(vec![project.primary_hostname.clone()])?;
+    let primary_hostname = project
+        .primary_hostname
+        .as_deref()
+        .ok_or_else(|| anyhow!("expected Project `{}` to have a hostname", project.slug))?;
+    let mut params = CertificateParams::new(vec![primary_hostname.to_string()])?;
     let now = OffsetDateTime::now_utc();
     params.not_before = now - CertificateDuration::days(1);
     params.not_after = now + CertificateDuration::days(7);
     params
         .distinguished_name
-        .push(DnType::CommonName, &project.primary_hostname);
+        .push(DnType::CommonName, primary_hostname);
     params.use_authority_key_identifier_extension = true;
     params.key_usages = vec![KeyUsagePurpose::DigitalSignature];
     params.extended_key_usages = vec![ExtendedKeyUsagePurpose::ServerAuth];
diff --git a/crates/daemon/src/project_env.rs b/crates/daemon/src/project_env.rs
index 47f8f9f0..50c7e529 100644
--- a/crates/daemon/src/project_env.rs
+++ b/crates/daemon/src/project_env.rs
@@ -11,10 +11,10 @@ use resources::{
     generated_allocation_name,
 };
 use state::{
-    Database, ManagedResourceDesiredState, ProjectEnvObservedStatus,
-    ProjectEnvObservedWarningInput, ProjectManagedResourceInput, ProjectPhpRuntimeInput,
-    ProjectRecord, PvPaths, ResourceAllocationInput, ResourceAllocationRecord,
-    ResourceAllocationStatus, StateError,
+    Database, LinkProjectInput, ManagedResourceDesiredState, ProjectEnvObservedStatus,
+    ProjectEnvObservedWarningInput, ProjectManagedResourceInput, ProjectMode,
+    ProjectPhpRuntimeInput, ProjectReconciliationStateInput, ProjectRecord, PvPaths,
+    ResourceAllocationInput, ResourceAllocationRecord, ResourceAllocationStatus, StateError,
 };
 
 use crate::DaemonError;
@@ -152,67 +152,70 @@ async fn reconcile_loaded_project(
     let config_file = match ProjectConfigFile::read_from_root(&project.path) {
         Ok(config_file) => config_file,
         Err(error) => {
-            if let Ok(true) = project_tls_artifact_exists(paths, project)
-                && let Err(maintenance_error) = ensure_project_tls_files(paths, project)
-            {
-                structured_log::project_tls_maintenance_failed(
-                    paths,
-                    &project.id,
-                    &maintenance_error.to_string(),
-                );
-            }
+            maintain_existing_project_tls_after_config_error(paths, project, false);
             return Err(error.into());
         }
     };
-    let tls_maintenance_result = if config_file.config.uses_tls_placeholders() {
-        Some(ensure_project_tls_files(paths, project))
-    } else {
-        None
-    };
-    let has_env_mappings = config_file.config.has_env_mappings();
-    let pre_render_result = async {
-        let plan = validate_project_config_and_plan(paths, database, project, &config_file)?;
+    let candidate_project = project_with_config_mode(project, &config_file.config);
+    let serves_http = candidate_project.mode == ProjectMode::Served;
+    let preflight_result = (|| {
+        let plan =
+            validate_project_config_and_plan(paths, database, &candidate_project, &config_file)?;
         let resolved_php_runtime = maybe_resolve_project_php_runtime(
             paths,
             database,
-            project,
+            &candidate_project,
             config_file.config.php.as_ref(),
+            serves_http,
         )?;
 
+        Ok::<_, DaemonError>((plan, resolved_php_runtime))
+    })();
+    let (plan, resolved_php_runtime) = match preflight_result {
+        Ok(result) => result,
+        Err(error) => {
+            maintain_existing_project_tls_after_config_error(
+                paths,
+                project,
+                config_file.config.uses_tls_placeholders(),
+            );
+            return Err(error);
+        }
+    };
+    let tls_maintenance_result = if serves_http && config_file.config.uses_tls_placeholders() {
+        Some(ensure_project_tls_files(paths, &candidate_project))
+    } else {
+        None
+    };
+    let has_env_mappings = config_file.config.has_env_mappings();
+    let pre_render_result = async {
         if let Some(runtime) = &resolved_php_runtime {
             record_project_php_runtime_resource_requirements(database, runtime)?;
         }
-        apply_project_resource_plan(database, &project.id, &plan)?;
+        apply_project_resource_plan(database, &candidate_project.id, &plan)?;
 
         let resource_result = if let Some(catalog) = catalog {
             crate::managed_resources::reconcile_project_resources_with_catalog_and_progress(
-                paths, database, project, &plan, catalog, progress,
+                paths,
+                database,
+                &candidate_project,
+                &plan,
+                catalog,
+                progress,
             )
             .await
         } else {
             crate::managed_resources::reconcile_project_resources_with_progress(
-                paths, database, project, &plan, progress,
+                paths,
+                database,
+                &candidate_project,
+                &plan,
+                progress,
             )
             .await
         };
         resource_result?;
 
-        if let Some(runtime) = &resolved_php_runtime {
-            database.replace_project_php_runtime(
-                &project.id,
-                Some(&ProjectPhpRuntimeInput {
-                    track: runtime.track.clone(),
-                    requested_extensions: runtime.requested_extensions.clone(),
-                    loaded_extensions: runtime.loaded_extensions.clone(),
-                    ignored_extensions: runtime.ignored_extensions.clone(),
-                }),
-            )?;
-        } else if project.desired_php_track.is_some() {
-            database.replace_project_php_runtime(&project.id, None)?;
-        }
-        database
-            .replace_project_additional_hostnames(&project.id, &config_file.config.hostnames)?;
-
         let runtime_warnings = resolved_php_runtime
             .as_ref()
             .map(ignored_php_extension_warnings)
@@ -232,7 +235,7 @@ async fn reconcile_loaded_project(
             if let Some(Err(tls_error)) = tls_maintenance_result.as_ref() {
                 structured_log::project_tls_maintenance_failed(
                     paths,
-                    &project.id,
+                    &candidate_project.id,
                     &tls_error.to_string(),
                 );
             }
@@ -255,10 +258,13 @@ async fn reconcile_loaded_project(
         } else {
             "Project runtime has warnings"
         };
-        database.record_project_env_observed_snapshot(
-            &project.id,
+        finalize_project_reconciliation_state(
+            database,
+            project,
+            &config_file,
+            resolved_php_runtime.as_ref(),
             status,
-            Some(message),
+            message,
             &runtime_warnings,
         )?;
 
@@ -277,9 +283,17 @@ async fn reconcile_loaded_project(
         return Ok(summary);
     }
 
-    let context = project_env_context_for_plan(paths, database, project, &plan)?;
+    let context = project_env_context_for_plan(
+        paths,
+        database,
+        &candidate_project,
+        &config_file.config,
+        &plan,
+    )?;
     let rendered = config::render_project_env(&config_file.config, &context)?;
-    let transform = config::write_project_env_file(&project.path.join(".env"), &rendered)?;
+    let env_file_path =
+        config::resolve_project_env_file_path(&candidate_project.path, &config_file.config)?;
+    let transform = config::write_project_env_file(&env_file_path, &rendered)?;
     let mut warnings = observed_warnings(&transform.warnings);
     warnings.extend(runtime_warnings);
     let status = if warnings.is_empty() {
@@ -293,7 +307,15 @@ async fn reconcile_loaded_project(
         "rendered Project env with warnings"
     };
 
-    database.record_project_env_observed_snapshot(&project.id, status, Some(message), &warnings)?;
+    finalize_project_reconciliation_state(
+        database,
+        project,
+        &config_file,
+        resolved_php_runtime.as_ref(),
+        status,
+        message,
+        &warnings,
+    )?;
 
     let summary = if warnings.is_empty() {
         ProjectEnvReconciliationSummary {
@@ -310,7 +332,21 @@ async fn reconcile_loaded_project(
     Ok(summary)
 }
 
+fn maintain_existing_project_tls_after_config_error(
+    paths: &PvPaths,
+    project: &ProjectRecord,
+    required_by_config: bool,
+) {
+    if project.mode == ProjectMode::Served
+        && (required_by_config || matches!(project_tls_artifact_exists(paths, project), Ok(true)))
+        && let Err(error) = ensure_project_tls_files(paths, project)
+    {
+        structured_log::project_tls_maintenance_failed(paths, &project.id, &error.to_string());
+    }
+}
+
 fn ensure_project_tls_files(paths: &PvPaths, project: &ProjectRecord) -> Result<(), DaemonError> {
+    let primary_hostname = served_project_hostname(project)?;
     let ca_certificate_pem = state::fs::read_to_string(&paths.ca_certificate())?;
     let ca_private_key_pem = state::fs::read_to_string(&paths.ca_private_key())?;
 
@@ -322,7 +358,7 @@ fn ensure_project_tls_files(paths: &PvPaths, project: &ProjectRecord) -> Result<
     let private_key_path = paths.project_tls_private_key(&project.id);
 
     let generated = platform::generate_project_certificate(
-        &project.primary_hostname,
+        primary_hostname,
         &ca_certificate_pem,
         &ca_private_key_pem,
     )?;
@@ -339,6 +375,7 @@ pub(crate) fn project_tls_files_are_current(
     project: &ProjectRecord,
     ca_certificate_pem: &str,
 ) -> Result<bool, DaemonError> {
+    let primary_hostname = served_project_hostname(project)?;
     let certificate_pem = read_optional_file(&paths.project_tls_certificate(&project.id))?;
     let private_key_pem = read_optional_file(&paths.project_tls_private_key(&project.id))?;
 
@@ -346,7 +383,7 @@ pub(crate) fn project_tls_files_are_current(
         (Some(certificate_pem), Some(private_key_pem)) => platform::project_certificate_matches(
             &certificate_pem,
             &private_key_pem,
-            &project.primary_hostname,
+            primary_hostname,
             ca_certificate_pem,
         ),
         _ => false,
@@ -378,7 +415,12 @@ fn maybe_resolve_project_php_runtime(
     database: &Database,
     project: &ProjectRecord,
     php: Option<&config::PhpConfig>,
+    serves_http: bool,
 ) -> Result<Option<ResolvedPhpRuntime>, DaemonError> {
+    if !serves_http && php.is_none() {
+        return Ok(None);
+    }
+
     if php.is_none()
         && project.desired_php_track.is_none()
         && !paths.downloads().join("manifest.json").exists()
@@ -482,22 +524,88 @@ fn validate_project_config_and_plan(
     project: &ProjectRecord,
     config_file: &ProjectConfigFile,
 ) -> Result<ProjectResourcePlan, DaemonError> {
-    database.validate_project_hostnames(
-        &project.id,
-        &project.primary_hostname,
-        &config_file.config.hostnames,
-    )?;
+    if project.mode == ProjectMode::Served && config_file.config.serve {
+        database.validate_project_hostnames(
+            &project.id,
+            served_project_hostname(project)?,
+            &config_file.config.hostnames,
+        )?;
+    }
     config::validate_project_env_shape(&config_file.config)?;
 
     let plan = project_resource_plan(paths, database, project, &config_file.config)?;
     if config_file.config.has_env_mappings() {
-        let existing_content = read_optional_dotenv(project)?;
+        let existing_content = read_optional_project_env_file(project, &config_file.config)?;
         config::validate_managed_env_block(existing_content.as_deref())?;
     }
 
     Ok(plan)
 }
 
+fn finalize_project_reconciliation_state(
+    database: &mut Database,
+    project: &ProjectRecord,
+    config_file: &ProjectConfigFile,
+    resolved_php_runtime: Option<&ResolvedPhpRuntime>,
+    env_status: ProjectEnvObservedStatus,
+    env_message: &str,
+    env_warnings: &[ProjectEnvObservedWarningInput],
+) -> Result<ProjectRecord, DaemonError> {
+    let project =
+        database
+            .project_by_id(&project.id)?
+            .ok_or_else(|| StateError::ProjectNotFound {
+                target: project.id.clone(),
+            })?;
+    let mode = project_mode_for_config(&config_file.config);
+    let primary_hostname = project
+        .primary_hostname
+        .clone()
+        .unwrap_or_else(|| format!("{}.test", project.slug));
+    let php_runtime = resolved_php_runtime.map(|runtime| ProjectPhpRuntimeInput {
+        track: runtime.track.clone(),
+        requested_extensions: runtime.requested_extensions.clone(),
+        loaded_extensions: runtime.loaded_extensions.clone(),
+        ignored_extensions: runtime.ignored_extensions.clone(),
+    });
+    let project = database.finalize_project_reconciliation(ProjectReconciliationStateInput {
+        project_id: project.id.clone(),
+        link: LinkProjectInput {
+            path: project.path.clone(),
+            original_path: project.original_path.clone(),
+            primary_hostname,
+            config_path: config_file.path.clone(),
+            desired_php_track: None,
+            additional_hostnames: config_file.config.hostnames.clone(),
+        },
+        mode,
+        php_runtime,
+        env_status,
+        env_message: Some(env_message.to_string()),
+        env_warnings: env_warnings.to_vec(),
+    })?;
+
+    Ok(project)
+}
+
+fn project_with_config_mode(project: &ProjectRecord, config: &ProjectConfig) -> ProjectRecord {
+    let mut candidate = project.clone();
+    candidate.mode = project_mode_for_config(config);
+    if candidate.mode == ProjectMode::Served && candidate.primary_hostname.is_none() {
+        candidate.primary_hostname = Some(format!("{}.test", candidate.slug));
+    }
+
+    candidate
+}
+
+fn project_mode_for_config(config: &ProjectConfig) -> ProjectMode {
+    if config.serve {
+        ProjectMode::Served
+    } else {
+        ProjectMode::ResourceOnly
+    }
+}
+
 fn project_resource_plan(
     paths: &PvPaths,
     database: &Database,
@@ -565,7 +673,7 @@ fn allocation_generated_name(
         return Ok(existing.generated_name.clone());
     }
 
-    let generated = generated_allocation_name(resource, &project.primary_hostname, allocation)?;
+    let generated = generated_allocation_name(resource, &project.slug, allocation)?;
 
     Ok(generated.generated_name().to_string())
 }
@@ -675,6 +783,7 @@ fn project_env_context_for_plan(
     paths: &PvPaths,
     database: &Database,
     project: &ProjectRecord,
+    config: &ProjectConfig,
     plan: &ProjectResourcePlan,
 ) -> Result<ProjectEnvContext, DaemonError> {
     let mut resources = BTreeMap::new();
@@ -705,11 +814,28 @@ fn project_env_context_for_plan(
         );
     }
 
+    let serves_http = project.mode == ProjectMode::Served && config.serve;
     Ok(ProjectEnvContext {
-        primary_hostname: project.primary_hostname.clone(),
-        tls_ca_path: paths.ca_certificate().to_string(),
-        tls_cert_path: paths.project_tls_certificate(&project.id).to_string(),
-        tls_key_path: paths.project_tls_private_key(&project.id).to_string(),
+        primary_hostname: if serves_http {
+            served_project_hostname(project)?.to_string()
+        } else {
+            String::new()
+        },
+        tls_ca_path: if serves_http {
+            paths.ca_certificate().to_string()
+        } else {
+            String::new()
+        },
+        tls_cert_path: if serves_http {
+            paths.project_tls_certificate(&project.id).to_string()
+        } else {
+            String::new()
+        },
+        tls_key_path: if serves_http {
+            paths.project_tls_private_key(&project.id).to_string()
+        } else {
+            String::new()
+        },
         resources,
     })
 }
@@ -758,8 +884,12 @@ fn planned_allocation_contexts(
     Ok(allocations)
 }
 
-fn read_optional_dotenv(project: &ProjectRecord) -> Result<Option<String>, DaemonError> {
-    match state::fs::read_to_string(&project.path.join(".env")) {
+fn read_optional_project_env_file(
+    project: &ProjectRecord,
+    config: &ProjectConfig,
+) -> Result<Option<String>, DaemonError> {
+    let path = config::resolve_project_env_file_path(&project.path, config)?;
+    match state::fs::read_to_string(&path) {
         Ok(content) => Ok(Some(content)),
         Err(StateError::Filesystem { source, .. }) if source.kind() == io::ErrorKind::NotFound => {
             Ok(None)
@@ -768,6 +898,16 @@ fn read_optional_dotenv(project: &ProjectRecord) -> Result<Option<String>, Daemo
     }
 }
 
+fn served_project_hostname(project: &ProjectRecord) -> Result<&str, DaemonError> {
+    project
+        .primary_hostname
+        .as_deref()
+        .ok_or_else(|| StateError::ProjectNotServed {
+            project_id: project.id.clone(),
+        })
+        .map_err(Into::into)
+}
+
 fn observed_warnings(warnings: &[ProjectEnvWarning]) -> Vec<ProjectEnvObservedWarningInput> {
     warnings
         .iter()
diff --git a/crates/daemon/src/server.rs b/crates/daemon/src/server.rs
index 56f507f5..356b7f43 100644
--- a/crates/daemon/src/server.rs
+++ b/crates/daemon/src/server.rs
@@ -3,7 +3,7 @@ use std::time::Duration;
 
 use config::ProjectConfigFile;
 use futures_util::StreamExt;
-use state::{Database, PvPaths};
+use state::{Database, ProjectMode, PvPaths};
 use tokio::io::AsyncRead;
 use tokio::sync::oneshot;
 use tokio::task::{JoinHandle, JoinSet};
@@ -167,6 +167,9 @@ fn collect_project_tls_health_scopes(
     let mut scopes = Vec::new();
 
     for project in projects {
+        if project.mode == ProjectMode::ResourceOnly {
+            continue;
+        }
         let should_assess = match ProjectConfigFile::read_from_root(&project.path) {
             Ok(config_file) => config_file.config.uses_tls_placeholders(),
             Err(_error) => project_tls_artifact_exists(paths, &project).unwrap_or(false),
@@ -271,7 +274,7 @@ where
 mod tests {
     use std::time::Duration;
 
-    use anyhow::Result;
+    use anyhow::{Result, anyhow};
     use camino::Utf8Path;
     use camino_tempfile::tempdir;
     use rcgen::{
@@ -423,13 +426,17 @@ mod tests {
     ) -> Result<()> {
         let ca_key_pair = KeyPair::from_pem(&local_ca.private_key_pem)?;
         let issuer = Issuer::from_ca_cert_pem(&local_ca.certificate_pem, ca_key_pair)?;
-        let mut params = CertificateParams::new(vec![project.primary_hostname.clone()])?;
+        let primary_hostname = project
+            .primary_hostname
+            .as_deref()
+            .ok_or_else(|| anyhow!("expected Project `{}` to have a hostname", project.slug))?;
+        let mut params = CertificateParams::new(vec![primary_hostname.to_string()])?;
         let now = OffsetDateTime::now_utc();
         params.not_before = now - CertificateDuration::days(1);
         params.not_after = now + CertificateDuration::days(remaining_days);
         params
             .distinguished_name
-            .push(DnType::CommonName, &project.primary_hostname);
+            .push(DnType::CommonName, primary_hostname);
         params.use_authority_key_identifier_extension = true;
         params.key_usages = vec![KeyUsagePurpose::DigitalSignature];
         params.extended_key_usages = vec![ExtendedKeyUsagePurpose::ServerAuth];
diff --git a/crates/daemon/src/watcher.rs b/crates/daemon/src/watcher.rs
index a215446f..8e9b8c31 100644
--- a/crates/daemon/src/watcher.rs
+++ b/crates/daemon/src/watcher.rs
@@ -117,8 +117,8 @@ mod tests {
         let mut database = Database::open(&paths)?;
         state::testing::transaction(&mut database, |transaction| {
             transaction.execute(
-                "INSERT INTO projects (id, path, primary_hostname, config_path, created_at, updated_at)
-                VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
+                "INSERT INTO projects (id, project_slug, path, primary_hostname, config_path, created_at, updated_at)
+                VALUES (?1, ?1, ?2, ?3, ?4, ?5, ?6)",
                 params![
                     "bad_project",
                     "bad\0path",
@@ -129,8 +129,8 @@ mod tests {
                 ],
             )?;
             transaction.execute(
-                "INSERT INTO projects (id, path, primary_hostname, config_path, created_at, updated_at)
-                VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
+                "INSERT INTO projects (id, project_slug, path, primary_hostname, config_path, created_at, updated_at)
+                VALUES (?1, ?1, ?2, ?3, ?4, ?5, ?6)",
                 params![
                     "good_project",
                     project_path.as_str(),
@@ -232,8 +232,8 @@ mod tests {
         let mut database = Database::open(paths)?;
         state::testing::transaction(&mut database, |transaction| {
             transaction.execute(
-                "INSERT INTO projects (id, path, primary_hostname, config_path, created_at, updated_at)
-                VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
+                "INSERT INTO projects (id, project_slug, path, primary_hostname, config_path, created_at, updated_at)
+                VALUES (?1, ?1, ?2, ?3, ?4, ?5, ?6)",
                 params![
                     "project_1",
                     project_path.as_str(),
diff --git a/crates/daemon/tests/daemon_foundation.rs b/crates/daemon/tests/daemon_foundation.rs
index 3fbd6d78..48fbb1cf 100644
--- a/crates/daemon/tests/daemon_foundation.rs
+++ b/crates/daemon/tests/daemon_foundation.rs
@@ -826,8 +826,8 @@ async fn project_config_watcher_enqueues_project_reconciliation() -> Result<()>
     let mut database = Database::open(&paths)?;
     state::testing::transaction(&mut database, |transaction| {
         transaction.execute(
-            "INSERT INTO projects (id, path, primary_hostname, config_path, created_at, updated_at)
-            VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
+            "INSERT INTO projects (id, project_slug, path, primary_hostname, config_path, created_at, updated_at)
+            VALUES (?1, ?1, ?2, ?3, ?4, ?5, ?6)",
             params![
                 "project_1",
                 project_path.as_str(),
diff --git a/crates/daemon/tests/gateway_reconciliation.rs b/crates/daemon/tests/gateway_reconciliation.rs
index 26e99f33..86d4d68f 100644
--- a/crates/daemon/tests/gateway_reconciliation.rs
+++ b/crates/daemon/tests/gateway_reconciliation.rs
@@ -12,7 +12,7 @@ use rcgen::generate_simple_self_signed;
 use rustix::process::{Pid, Signal, kill_process_group, test_kill_process};
 use serde_json::json;
 use state::{
-    Database, GatewayPort, LinkProjectInput, PortOwner, PortRequest, PvPaths,
+    Database, GatewayPort, LinkProjectInput, PortOwner, PortRequest, ProjectMode, PvPaths,
     RUNTIME_PORT_FALLBACK_END, RUNTIME_PORT_FALLBACK_START, fs,
 };
 use std::collections::BTreeMap;
@@ -1210,6 +1210,92 @@ document_root: public
     Ok(())
 }
 
+#[test]
+fn runtime_plan_excludes_resource_only_project_with_explicit_php() -> Result<()> {
+    let tempdir = tempdir()?;
+    let paths = PvPaths::for_home(tempdir.path().join("home"));
+    let served = tempdir.path().join("served");
+    let resource_only = tempdir.path().join("resource-only");
+    create_project(&served, "php: \"8.4\"\n")?;
+    create_project(&resource_only, "serve: false\nphp: \"8.4\"\n")?;
+
+    let mut database = Database::open(&paths)?;
+    let served = database
+        .link_project(LinkProjectInput {
+            path: served.clone(),
+            original_path: served.clone(),
+            primary_hostname: "served.test".to_owned(),
+            config_path: served.join("pv.yml"),
+            desired_php_track: Some("8.4".to_owned()),
+            additional_hostnames: Vec::new(),
+        })?
+        .project;
+    let resource_only = database
+        .link_project_with_mode(
+            LinkProjectInput {
+                path: resource_only.clone(),
+                original_path: resource_only.clone(),
+                primary_hostname: "ignored.test".to_owned(),
+                config_path: resource_only.join("pv.yml"),
+                desired_php_track: Some("8.4".to_owned()),
+                additional_hostnames: Vec::new(),
+            },
+            ProjectMode::ResourceOnly,
+        )?
+        .project;
+    seed_stable_runtime_plan_ports(&mut database, &["8.4"])?;
+    drop(database);
+
+    let plan = build_runtime_plan(&paths)?;
+    let project_ids = plan
+        .workers
+        .iter()
+        .flat_map(|worker| worker.projects.iter())
+        .map(|project| project.id.as_str())
+        .collect::<Vec<_>>();
+
+    assert_eq!(project_ids, [served.id.as_str()]);
+    assert!(!project_ids.contains(&resource_only.id.as_str()));
+
+    Ok(())
+}
+
+#[test]
+fn runtime_plan_preserves_served_project_while_resource_only_transition_is_pending() -> Result<()> {
+    let tempdir = tempdir()?;
+    let paths = PvPaths::for_home(tempdir.path().join("home"));
+    let project_root = tempdir.path().join("served");
+    create_project(&project_root, "php: \"8.4\"\n")?;
+
+    let mut database = Database::open(&paths)?;
+    let project = database
+        .link_project(LinkProjectInput {
+            path: project_root.clone(),
+            original_path: project_root.clone(),
+            primary_hostname: "served.test".to_owned(),
+            config_path: project_root.join("pv.yml"),
+            desired_php_track: Some("8.4".to_owned()),
+            additional_hostnames: Vec::new(),
+        })?
+        .project;
+    seed_stable_runtime_plan_ports(&mut database, &["8.4"])?;
+    drop(database);
+    fs::write_sensitive_file(&project_root.join("pv.yml"), "serve: false\nphp: \"8.4\"\n")?;
+
+    let plan = build_runtime_plan(&paths)?;
+    let planned_project = plan
+        .workers
+        .iter()
+        .flat_map(|worker| worker.projects.iter())
+        .find(|candidate| candidate.id == project.id)
+        .ok_or_else(|| anyhow::anyhow!("expected persisted served Project in runtime plan"))?;
+
+    assert!(!planned_project.render_config);
+    assert_eq!(planned_project.primary_hostname, "served.test");
+
+    Ok(())
+}
+
 #[test]
 fn gateway_runtime_plan_groups_projects_by_php_track_and_extensions() -> Result<()> {
     let tempdir = tempdir()?;
diff --git a/crates/daemon/tests/project_env_reconciliation.rs b/crates/daemon/tests/project_env_reconciliation.rs
index b3a007f9..eefe547a 100644
--- a/crates/daemon/tests/project_env_reconciliation.rs
+++ b/crates/daemon/tests/project_env_reconciliation.rs
@@ -16,13 +16,216 @@ use serde_json::{Value, json};
 use state::fs::write_sensitive_file;
 use state::{
     Database, EnvContextValues, JobRecord, LinkProjectInput, PortOwner, PortRequest,
-    ProjectEnvObservedStatus, ProjectManagedResourceInput, ProjectRecord, PvPaths,
+    ProjectEnvObservedStatus, ProjectManagedResourceInput, ProjectMode, ProjectRecord, PvPaths,
     ResourceAllocationInput, StateError,
 };
 use time::{Duration, OffsetDateTime};
 use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
 use tokio::net::UnixStream;
 
+#[tokio::test]
+async fn resource_only_project_uses_custom_env_file_and_no_php_worker() -> Result<()> {
+    let tempdir = tempdir()?;
+    let paths = PvPaths::for_home(tempdir.path().join("home"));
+    let project_path = tempdir.path().join("Resource Project");
+    state::fs::ensure_user_dir(&project_path.join("config"))?;
+    let project = link_resource_only_project(
+        &paths,
+        &project_path,
+        r#"serve: false
+env_file: config/development.env
+php: "8.4"
+env:
+  APP_NAME: resource-project
+  APP_URL: "${project_url}"
+"#,
+    )?;
+
+    let lines = run_project_reconciliation(&paths, &project).await?;
+    let database = Database::open(&paths)?;
+    let reconciled = database
+        .project_by_id(&project.id)?
+        .ok_or_else(|| anyhow!("expected reconciled resource-only Project"))?;
+    let runtime_plan = daemon::gateway::build_runtime_plan(&paths)?;
+    let custom_env = state::fs::read_to_string(&project.path.join("config/development.env"))?;
+
+    assert!(runtime_plan.workers.is_empty());
+    assert!(!state::fs::path_entry_exists(&project.path.join(".env"))?);
+    assert!(!state::fs::path_entry_exists(
+        &paths.project_tls_certificate(&project.id)
+    )?);
+    assert_eq!(reconciled.mode, ProjectMode::ResourceOnly);
+    assert_eq!(reconciled.primary_hostname, None);
+    assert_eq!(reconciled.php_runtime.track.as_deref(), Some("8.4"));
+    assert_eq!(
+        custom_env,
+        "# >>> PV MANAGED\nAPP_NAME=resource-project\n# <<< PV MANAGED\n"
+    );
+
+    assert_with_normalized_timestamps_and_tempdir(
+        "resource_only_project_uses_custom_env_file_and_no_php_worker",
+        (
+            lines,
+            reconciled,
+            database.project_env_observed_state(&project.id)?,
+        ),
+        tempdir.path(),
+    )?;
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn invalid_resource_only_transition_preserves_served_mode() -> Result<()> {
+    let tempdir = tempdir()?;
+    let paths = PvPaths::for_home(tempdir.path().join("home"));
+    let project = link_project(
+        &paths,
+        &tempdir.path().join("project"),
+        "acme.test",
+        "env:\n  APP_NAME: acme\n",
+    )?;
+    write_project_config(
+        &project,
+        r#"serve: false
+postgres:
+  version: "8.0"
+  allocations:
+    analytics:
+      env:
+        DATABASE_URL: "postgres://${database}"
+    app:
+      env:
+        DATABASE_URL: "postgres://${database}"
+"#,
+    )?;
+
+    let lines = run_project_reconciliation(&paths, &project).await?;
+    let database = Database::open(&paths)?;
+    let reconciled = database
+        .project_by_id(&project.id)?
+        .ok_or_else(|| anyhow!("expected failed transition to preserve Project state"))?;
+
+    assert_eq!(reconciled.mode, ProjectMode::Served);
+    assert_eq!(reconciled.primary_hostname.as_deref(), Some("acme.test"));
+    assert_with_normalized_timestamps_and_tempdir(
+        "invalid_resource_only_transition_preserves_served_mode",
+        (
+            lines,
+            reconciled,
+            database.project_env_observed_state(&project.id)?,
+            latest_job(&database, &format!("project:{}", project.id))?,
+        ),
+        tempdir.path(),
+    )?;
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn failed_resource_only_transition_after_preflight_preserves_served_mode() -> Result<()> {
+    let tempdir = tempdir()?;
+    let paths = PvPaths::for_home(tempdir.path().join("home"));
+    let project = link_project(&paths, &tempdir.path().join("project"), "acme.test", "")?;
+    write_project_config(
+        &project,
+        r#"serve: false
+postgres:
+  version: "8.0"
+  allocations:
+    app-db:
+      env:
+        DB_DATABASE: "${database}"
+"#,
+    )?;
+
+    let lines = run_project_reconciliation(&paths, &project).await?;
+    let database = Database::open(&paths)?;
+    let reconciled = database
+        .project_by_id(&project.id)?
+        .ok_or_else(|| anyhow!("expected failed transition to preserve Project state"))?;
+    let job = latest_job(&database, &format!("project:{}", project.id))?;
+
+    assert!(!lines.is_empty());
+    assert_eq!(job.status, state::JobStatus::Failed);
+    assert_eq!(reconciled.mode, ProjectMode::Served);
+    assert_eq!(reconciled.primary_hostname.as_deref(), Some("acme.test"));
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn failed_served_transition_after_preflight_preserves_resource_only_mode() -> Result<()> {
+    let tempdir = tempdir()?;
+    let paths = PvPaths::for_home(tempdir.path().join("home"));
+    let project =
+        link_resource_only_project(&paths, &tempdir.path().join("project"), "serve: false\n")?;
+    write_project_config(
+        &project,
+        r#"postgres:
+  version: "8.0"
+  allocations:
+    app-db:
+      env:
+        DB_DATABASE: "${database}"
+"#,
+    )?;
+
+    let lines = run_project_reconciliation(&paths, &project).await?;
+    let database = Database::open(&paths)?;
+    let reconciled = database
+        .project_by_id(&project.id)?
+        .ok_or_else(|| anyhow!("expected failed transition to preserve Project state"))?;
+    let job = latest_job(&database, &format!("project:{}", project.id))?;
+
+    assert!(!lines.is_empty());
+    assert_eq!(job.status, state::JobStatus::Failed);
+    assert_eq!(reconciled.mode, ProjectMode::ResourceOnly);
+    assert_eq!(reconciled.primary_hostname, None);
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn failed_transition_after_php_resolution_preserves_served_runtime() -> Result<()> {
+    let tempdir = tempdir()?;
+    let paths = PvPaths::for_home(tempdir.path().join("home"));
+    let project = link_project(
+        &paths,
+        &tempdir.path().join("project"),
+        "acme.test",
+        "php: \"8.4\"\n",
+    )?;
+    run_project_reconciliation(&paths, &project).await?;
+    let locked_directory = project.path.join("locked");
+    state::fs::ensure_user_dir(&locked_directory)?;
+    set_file_mode(&locked_directory, 0o500)?;
+    write_project_config(
+        &project,
+        r#"serve: false
+php: "8.3"
+env_file: locked/.env
+env:
+  APP_NAME: acme
+"#,
+    )?;
+
+    let lines = run_project_reconciliation(&paths, &project).await?;
+    set_file_mode(&locked_directory, 0o700)?;
+    let database = Database::open(&paths)?;
+    let reconciled = database
+        .project_by_id(&project.id)?
+        .ok_or_else(|| anyhow!("expected failed transition to preserve Project state"))?;
+    let job = latest_job(&database, &format!("project:{}", project.id))?;
+
+    assert!(!lines.is_empty());
+    assert_eq!(job.status, state::JobStatus::Failed);
+    assert_eq!(reconciled.mode, ProjectMode::Served);
+    assert_eq!(reconciled.php_runtime.track.as_deref(), Some("8.4"));
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn root_only_env_rendering_writes_dotenv_and_records_rendered_state() -> Result<()> {
     let tempdir = tempdir()?;
@@ -62,6 +265,42 @@ async fn root_only_env_rendering_writes_dotenv_and_records_rendered_state() -> R
     Ok(())
 }
 
+#[tokio::test]
+async fn changing_env_file_and_unlinking_leave_previous_managed_blocks_untouched() -> Result<()> {
+    let tempdir = tempdir()?;
+    let paths = PvPaths::for_home(tempdir.path().join("home"));
+    let project = link_project(
+        &paths,
+        &tempdir.path().join("project"),
+        "acme.test",
+        "env:\n  APP_NAME: first\n",
+    )?;
+
+    run_project_reconciliation(&paths, &project).await?;
+    let original_env = read_dotenv(&project)?;
+    write_project_config(&project, "env_file: .env.local\nenv:\n  APP_NAME: second\n")?;
+    run_project_reconciliation(&paths, &project).await?;
+    let alternate_env = state::fs::read_to_string(&project.path.join(".env.local"))?;
+    let mut database = Database::open(&paths)?;
+    database.unlink_project(&project.id)?;
+
+    assert_eq!(read_dotenv(&project)?, original_env);
+    assert_eq!(
+        state::fs::read_to_string(&project.path.join(".env.local"))?,
+        alternate_env
+    );
+    assert_eq!(
+        original_env,
+        "# >>> PV MANAGED\nAPP_NAME=first\n# <<< PV MANAGED\n"
+    );
+    assert_eq!(
+        alternate_env,
+        "# >>> PV MANAGED\nAPP_NAME=second\n# <<< PV MANAGED\n"
+    );
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn tls_placeholders_generate_and_refresh_primary_hostname_certificate() -> Result<()> {
     let tempdir = tempdir()?;
@@ -128,6 +367,96 @@ async fn tls_placeholders_generate_and_refresh_primary_hostname_certificate() ->
     Ok(())
 }
 
+#[tokio::test]
+async fn disabling_serving_retains_tls_files_without_refreshing_them() -> Result<()> {
+    let tempdir = tempdir()?;
+    let paths = PvPaths::for_home(tempdir.path().join("home"));
+    let project = link_project(
+        &paths,
+        &tempdir.path().join("project"),
+        "acme.test",
+        "env:\n  VITE_DEV_SERVER_CERT: \"${tls_cert}\"\n",
+    )?;
+    let local_ca = seed_local_ca(&paths)?;
+    write_project_certificate_with_remaining_days(&paths, &project, &local_ca, 7)?;
+    let certificate_before =
+        state::fs::read_to_string(&paths.project_tls_certificate(&project.id))?;
+    let private_key_before =
+        state::fs::read_to_string(&paths.project_tls_private_key(&project.id))?;
+    write_project_config(
+        &project,
+        "serve: false\nenv:\n  VITE_DEV_SERVER_CERT: \"${tls_cert}\"\n",
+    )?;
+
+    run_project_reconciliation(&paths, &project).await?;
+    let database = Database::open(&paths)?;
+    let reconciled = database
+        .project_by_id(&project.id)?
+        .ok_or_else(|| anyhow!("expected resource-only Project after disabling serving"))?;
+
+    assert_eq!(reconciled.mode, ProjectMode::ResourceOnly);
+    assert_eq!(
+        state::fs::read_to_string(&paths.project_tls_certificate(&project.id))?,
+        certificate_before
+    );
+    assert_eq!(
+        state::fs::read_to_string(&paths.project_tls_private_key(&project.id))?,
+        private_key_before
+    );
+    assert_eq!(read_optional_dotenv(&project)?, None);
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn serving_transition_clears_and_restores_all_dormant_env_entries() -> Result<()> {
+    let tempdir = tempdir()?;
+    let paths = PvPaths::for_home(tempdir.path().join("home"));
+    let project = link_project(
+        &paths,
+        &tempdir.path().join("project"),
+        "acme.test",
+        "env:\n  APP_URL: \"${project_url}\"\n",
+    )?;
+    write_sensitive_file(&project.path.join(".env"), "USER_VALUE=kept\n")?;
+
+    run_project_reconciliation(&paths, &project).await?;
+    assert_eq!(
+        read_dotenv(&project)?,
+        "USER_VALUE=kept\n# >>> PV MANAGED\nAPP_URL=https://acme.test\n# <<< PV MANAGED\n"
+    );
+
+    write_project_config(
+        &project,
+        "serve: false\nenv:\n  APP_URL: \"${project_url}\"\n",
+    )?;
+    run_project_reconciliation(&paths, &project).await?;
+    let database = Database::open(&paths)?;
+    let resource_only = database
+        .project_by_id(&project.id)?
+        .ok_or_else(|| anyhow!("expected resource-only Project"))?;
+    assert_eq!(resource_only.mode, ProjectMode::ResourceOnly);
+    assert_eq!(
+        read_dotenv(&project)?,
+        "USER_VALUE=kept\n# >>> PV MANAGED\n# <<< PV MANAGED\n"
+    );
+    drop(database);
+
+    write_project_config(&project, "env:\n  APP_URL: \"${project_url}\"\n")?;
+    run_project_reconciliation(&paths, &project).await?;
+    let database = Database::open(&paths)?;
+    let served = database
+        .project_by_id(&project.id)?
+        .ok_or_else(|| anyhow!("expected served Project"))?;
+    assert_eq!(served.mode, ProjectMode::Served);
+    assert_eq!(
+        read_dotenv(&project)?,
+        "USER_VALUE=kept\n# >>> PV MANAGED\nAPP_URL=https://acme.test\n# <<< PV MANAGED\n"
+    );
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn project_tls_reconciliation_replaces_overlong_leaf_once() -> Result<()> {
     let tempdir = tempdir()?;
@@ -155,7 +484,7 @@ async fn project_tls_reconciliation_replaces_overlong_leaf_once() -> Result<()>
     assert!(!platform::project_certificate_matches(
         &stale_certificate_chain,
         &stale_private_key,
-        &project.primary_hostname,
+        served_project_hostname(&project)?,
         &local_ca.certificate_pem
     ));
     run_project_reconciliation(&paths, &project).await?;
@@ -178,7 +507,7 @@ async fn project_tls_reconciliation_replaces_overlong_leaf_once() -> Result<()>
     assert_project_certificate_matches(
         &certificate_after_reconciliation,
         &private_key_after_reconciliation,
-        &project.primary_hostname,
+        served_project_hostname(&project)?,
         &local_ca,
     );
     assert_eq!(
@@ -266,7 +595,7 @@ async fn daemon_health_tick_replaces_expiring_tls_certificate_without_explicit_r
     assert_project_certificate_matches(
         &certificate_pem,
         &private_key_pem,
-        &project.primary_hostname,
+        served_project_hostname(&project)?,
         &local_ca,
     );
     assert_eq!(
@@ -985,7 +1314,7 @@ async fn malformed_config_with_existing_tls_is_renewed_by_daemon_health() -> Res
     assert!(!platform::project_certificate_matches(
         &certificate_before,
         &private_key_before,
-        &project.primary_hostname,
+        served_project_hostname(&project)?,
         &local_ca.certificate_pem,
     ));
     state::fs::remove_file(&paths.project_tls_private_key(&project.id))?;
@@ -1012,7 +1341,7 @@ async fn malformed_config_with_existing_tls_is_renewed_by_daemon_health() -> Res
             let renewed = platform::project_certificate_matches(
                 &certificate,
                 &private_key,
-                &project.primary_hostname,
+                served_project_hostname(&project)?,
                 &local_ca.certificate_pem,
             );
             let database = Database::open(&paths)?;
@@ -1310,7 +1639,7 @@ postgres:
     assert!(platform::project_certificate_matches(
         &certificate,
         &private_key,
-        &project.primary_hostname,
+        served_project_hostname(&project)?,
         &local_ca.certificate_pem,
     ));
     assert_eq!(
@@ -1726,6 +2055,30 @@ fn link_project(
     Ok(result.project)
 }
 
+fn link_resource_only_project(
+    paths: &PvPaths,
+    project_path: &Utf8Path,
+    config_source: &str,
+) -> Result<ProjectRecord> {
+    let config_path = project_path.join("pv.yml");
+    write_sensitive_file(&config_path, config_source)?;
+
+    let mut database = Database::open(paths)?;
+    let result = database.link_project_with_mode(
+        LinkProjectInput {
+            path: project_path.to_path_buf(),
+            original_path: project_path.to_path_buf(),
+            primary_hostname: "ignored.test".to_string(),
+            config_path,
+            desired_php_track: None,
+            additional_hostnames: Vec::new(),
+        },
+        ProjectMode::ResourceOnly,
+    )?;
+
+    Ok(result.project)
+}
+
 fn write_project_config(project: &ProjectRecord, config_source: &str) -> Result<()> {
     write_sensitive_file(&project.config_path, config_source)?;
 
@@ -1843,13 +2196,14 @@ fn write_project_certificate_with_remaining_days(
 ) -> Result<()> {
     let ca_key_pair = KeyPair::from_pem(&local_ca.private_key_pem)?;
     let issuer = Issuer::from_ca_cert_pem(&local_ca.certificate_pem, ca_key_pair)?;
-    let mut params = CertificateParams::new(vec![project.primary_hostname.clone()])?;
+    let primary_hostname = served_project_hostname(project)?;
+    let mut params = CertificateParams::new(vec![primary_hostname.to_string()])?;
     let now = OffsetDateTime::now_utc();
     params.not_before = now - Duration::days(1);
     params.not_after = now + Duration::days(remaining_days);
     params
         .distinguished_name
-        .push(DnType::CommonName, &project.primary_hostname);
+        .push(DnType::CommonName, primary_hostname);
     params.use_authority_key_identifier_extension = true;
     params.key_usages = vec![KeyUsagePurpose::DigitalSignature];
     params.extended_key_usages = vec![ExtendedKeyUsagePurpose::ServerAuth];
@@ -1868,6 +2222,13 @@ fn write_project_certificate_with_remaining_days(
     Ok(())
 }
 
+fn served_project_hostname(project: &ProjectRecord) -> Result<&str> {
+    project
+        .primary_hostname
+        .as_deref()
+        .ok_or_else(|| anyhow!("expected Project `{}` to have a hostname", project.slug))
+}
+
 fn test_manifest(default_track: &str) -> String {
     json!({
         "schema_version": 1,
@@ -2043,6 +2404,10 @@ fn assert_with_normalized_timestamps(
         r#"project_id: "[a-z0-9]{10}""#,
         r#"project_id: "<project_id>""#,
     );
+    settings.add_filter(
+        "id: \"[a-z0-9]{10}\",\n        slug:",
+        "id: \"<project_id>\",\n        slug:",
+    );
     settings.add_filter(r"Project `[a-z0-9]{10}`", "Project `<project_id>`");
     settings.bind(|| {
         assert_debug_snapshot!(name, snapshot);
@@ -2065,6 +2430,10 @@ fn assert_with_normalized_timestamps_and_tempdir(
         r#"project_id: "[a-z0-9]{10}""#,
         r#"project_id: "<project_id>""#,
     );
+    settings.add_filter(
+        "id: \"[a-z0-9]{10}\",\n        slug:",
+        "id: \"<project_id>\",\n        slug:",
+    );
     settings.add_filter(r"Project `[a-z0-9]{10}`", "Project `<project_id>`");
     settings.bind(|| {
         assert_debug_snapshot!(name, snapshot);
diff --git a/crates/daemon/tests/snapshots/project_env_reconciliation__config_declared_hostnames_are_persisted_during_reconciliation.snap b/crates/daemon/tests/snapshots/project_env_reconciliation__config_declared_hostnames_are_persisted_during_reconciliation.snap
index 5dff4787..dba5c888 100644
--- a/crates/daemon/tests/snapshots/project_env_reconciliation__config_declared_hostnames_are_persisted_during_reconciliation.snap
+++ b/crates/daemon/tests/snapshots/project_env_reconciliation__config_declared_hostnames_are_persisted_during_reconciliation.snap
@@ -39,7 +39,9 @@ expression: snapshot
         ],
     ),
     Some(
-        "acme.test",
+        Some(
+            "acme.test",
+        ),
     ),
     JobRecord {
         id: "job_000001",
diff --git a/crates/daemon/tests/snapshots/project_env_reconciliation__first_allocation_reconciliation_records_desired_state_before_context_failure.snap b/crates/daemon/tests/snapshots/project_env_reconciliation__first_allocation_reconciliation_records_desired_state_before_context_failure.snap
index 4eb095e3..6fc8254c 100644
--- a/crates/daemon/tests/snapshots/project_env_reconciliation__first_allocation_reconciliation_records_desired_state_before_context_failure.snap
+++ b/crates/daemon/tests/snapshots/project_env_reconciliation__first_allocation_reconciliation_records_desired_state_before_context_failure.snap
@@ -45,7 +45,7 @@ expression: snapshot
             resource_name: "postgres",
             track: "8.0",
             allocation_name: "app-db",
-            generated_name: "acme_test_app_db",
+            generated_name: "project_app_db",
             env: {},
             status: Desired,
             created_at: "<timestamp>",
diff --git a/crates/daemon/tests/snapshots/project_env_reconciliation__generated_allocation_name_too_long_leaves_resource_state_unchanged.snap b/crates/daemon/tests/snapshots/project_env_reconciliation__generated_allocation_name_too_long_leaves_resource_state_unchanged.snap
index 4917bf78..916f6217 100644
--- a/crates/daemon/tests/snapshots/project_env_reconciliation__generated_allocation_name_too_long_leaves_resource_state_unchanged.snap
+++ b/crates/daemon/tests/snapshots/project_env_reconciliation__generated_allocation_name_too_long_leaves_resource_state_unchanged.snap
@@ -23,7 +23,7 @@ expression: snapshot
             "type": String("log"),
         },
         Object {
-            "error": String("Managed Resource error: generated Resource allocation name `a_test_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa` for `postgres` allocation `aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa` exceeds 63 characters"),
+            "error": String("Managed Resource error: generated Resource allocation name `project_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa` for `postgres` allocation `aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa` exceeds 63 characters"),
             "job_id": String("job_000001"),
             "type": String("job_failed"),
         },
@@ -36,7 +36,7 @@ expression: snapshot
             project_id: "<project_id>",
             status: Failed,
             message: Some(
-                "Managed Resource error: generated Resource allocation name `a_test_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa` for `postgres` allocation `aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa` exceeds 63 characters",
+                "Managed Resource error: generated Resource allocation name `project_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa` for `postgres` allocation `aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa` exceeds 63 characters",
             ),
             observed_at: "<timestamp>",
             warnings: [],
@@ -53,7 +53,7 @@ expression: snapshot
         ),
         summary: None,
         error: Some(
-            "Managed Resource error: generated Resource allocation name `a_test_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa` for `postgres` allocation `aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa` exceeds 63 characters",
+            "Managed Resource error: generated Resource allocation name `project_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa` for `postgres` allocation `aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa` exceeds 63 characters",
         ),
     },
 )
diff --git a/crates/daemon/tests/snapshots/project_env_reconciliation__invalid_resource_only_transition_preserves_served_mode.snap b/crates/daemon/tests/snapshots/project_env_reconciliation__invalid_resource_only_transition_preserves_served_mode.snap
new file mode 100644
index 00000000..db9b91f2
--- /dev/null
+++ b/crates/daemon/tests/snapshots/project_env_reconciliation__invalid_resource_only_transition_preserves_served_mode.snap
@@ -0,0 +1,77 @@
+---
+source: crates/daemon/tests/project_env_reconciliation.rs
+expression: snapshot
+---
+(
+    [
+        Object {
+            "job_id": String("job_000001"),
+            "message": String("job accepted"),
+            "protocol_version": Number(3),
+            "status": String("accepted"),
+            "type": String("response"),
+        },
+        Object {
+            "job_id": String("job_000001"),
+            "kind": String("reconcile"),
+            "scope": String("project:<project_id>"),
+            "type": String("job_started"),
+        },
+        Object {
+            "job_id": String("job_000001"),
+            "message": String("Project env reconciliation started"),
+            "type": String("log"),
+        },
+        Object {
+            "error": String("Project config error: duplicate rendered Project env key `DATABASE_URL` from same-depth mappings `postgres.allocations.analytics.env.DATABASE_URL` and `postgres.allocations.app.env.DATABASE_URL`"),
+            "job_id": String("job_000001"),
+            "type": String("job_failed"),
+        },
+    ],
+    ProjectRecord {
+        id: "<project_id>",
+        slug: "project",
+        mode: Served,
+        path: "<tempdir>/project",
+        original_path: "<tempdir>/project",
+        primary_hostname: Some(
+            "acme.test",
+        ),
+        config_path: "<tempdir>/project/pv.yml",
+        desired_php_track: None,
+        php_runtime: ProjectPhpRuntimeRecord {
+            track: None,
+            requested_extensions: [],
+            loaded_extensions: [],
+            ignored_extensions: [],
+        },
+        additional_hostnames: [],
+        created_at: "<timestamp>",
+        updated_at: "<timestamp>",
+    },
+    Some(
+        ProjectEnvObservedStateRecord {
+            project_id: "<project_id>",
+            status: Failed,
+            message: Some(
+                "Project config error: duplicate rendered Project env key `DATABASE_URL` from same-depth mappings `postgres.allocations.analytics.env.DATABASE_URL` and `postgres.allocations.app.env.DATABASE_URL`",
+            ),
+            observed_at: "<timestamp>",
+            warnings: [],
+        },
+    ),
+    JobRecord {
+        id: "job_000001",
+        kind: "reconcile",
+        scope: "project:<project_id>",
+        status: Failed,
+        started_at: "<timestamp>",
+        finished_at: Some(
+            "<timestamp>",
+        ),
+        summary: None,
+        error: Some(
+            "Project config error: duplicate rendered Project env key `DATABASE_URL` from same-depth mappings `postgres.allocations.analytics.env.DATABASE_URL` and `postgres.allocations.app.env.DATABASE_URL`",
+        ),
+    },
+)
diff --git a/crates/daemon/tests/snapshots/project_env_reconciliation__resource_only_project_uses_custom_env_file_and_no_php_worker.snap b/crates/daemon/tests/snapshots/project_env_reconciliation__resource_only_project_uses_custom_env_file_and_no_php_worker.snap
new file mode 100644
index 00000000..392d10af
--- /dev/null
+++ b/crates/daemon/tests/snapshots/project_env_reconciliation__resource_only_project_uses_custom_env_file_and_no_php_worker.snap
@@ -0,0 +1,70 @@
+---
+source: crates/daemon/tests/project_env_reconciliation.rs
+expression: snapshot
+---
+(
+    [
+        Object {
+            "job_id": String("job_000001"),
+            "message": String("job accepted"),
+            "protocol_version": Number(3),
+            "status": String("accepted"),
+            "type": String("response"),
+        },
+        Object {
+            "job_id": String("job_000001"),
+            "kind": String("reconcile"),
+            "scope": String("project:<project_id>"),
+            "type": String("job_started"),
+        },
+        Object {
+            "job_id": String("job_000001"),
+            "message": String("Project env reconciliation started"),
+            "type": String("log"),
+        },
+        Object {
+            "job_id": String("job_000001"),
+            "message": String("Project env rendered"),
+            "type": String("progress"),
+        },
+        Object {
+            "job_id": String("job_000001"),
+            "summary": String("Project env rendered"),
+            "type": String("job_completed"),
+        },
+    ],
+    ProjectRecord {
+        id: "<project_id>",
+        slug: "resource-project",
+        mode: ResourceOnly,
+        path: "<tempdir>/Resource Project",
+        original_path: "<tempdir>/Resource Project",
+        primary_hostname: None,
+        config_path: "<tempdir>/Resource Project/pv.yml",
+        desired_php_track: Some(
+            "8.4",
+        ),
+        php_runtime: ProjectPhpRuntimeRecord {
+            track: Some(
+                "8.4",
+            ),
+            requested_extensions: [],
+            loaded_extensions: [],
+            ignored_extensions: [],
+        },
+        additional_hostnames: [],
+        created_at: "<timestamp>",
+        updated_at: "<timestamp>",
+    },
+    Some(
+        ProjectEnvObservedStateRecord {
+            project_id: "<project_id>",
+            status: Rendered,
+            message: Some(
+                "rendered Project env",
+            ),
+            observed_at: "<timestamp>",
+            warnings: [],
+        },
+    ),
+)
diff --git a/crates/daemon/tests/snapshots/project_env_reconciliation__resources_and_empty_allocations_without_env_mappings_update_state_without_dotenv.snap b/crates/daemon/tests/snapshots/project_env_reconciliation__resources_and_empty_allocations_without_env_mappings_update_state_without_dotenv.snap
index 4eb095e3..6fc8254c 100644
--- a/crates/daemon/tests/snapshots/project_env_reconciliation__resources_and_empty_allocations_without_env_mappings_update_state_without_dotenv.snap
+++ b/crates/daemon/tests/snapshots/project_env_reconciliation__resources_and_empty_allocations_without_env_mappings_update_state_without_dotenv.snap
@@ -45,7 +45,7 @@ expression: snapshot
             resource_name: "postgres",
             track: "8.0",
             allocation_name: "app-db",
-            generated_name: "acme_test_app_db",
+            generated_name: "project_app_db",
             env: {},
             status: Desired,
             created_at: "<timestamp>",
diff --git a/crates/resources/src/allocation.rs b/crates/resources/src/allocation.rs
index 755f70b1..974ffd41 100644
--- a/crates/resources/src/allocation.rs
+++ b/crates/resources/src/allocation.rs
@@ -67,7 +67,7 @@ impl ResourceAllocationName {
 /// Generates the stable backing object name for a Resource allocation.
 pub fn generated_allocation_name(
     resource_name_or_alias: &str,
-    primary_hostname: &str,
+    project_slug: &str,
     allocation_name: &str,
 ) -> Result<ResourceAllocationName> {
     let descriptor = registry::resolve(resource_name_or_alias)?;
@@ -80,23 +80,15 @@ pub fn generated_allocation_name(
         ResourceAllocationKind::SqlDatabase => {
             format!(
                 "{}_{}",
-                sql_hostname_slug(primary_hostname),
+                project_slug.replace('-', "_"),
                 allocation_name.replace('-', "_")
             )
         }
         ResourceAllocationKind::RedisPrefix => {
-            format!(
-                "{}-{}-",
-                dash_hostname_slug(primary_hostname),
-                allocation_name.replace('_', "-")
-            )
+            format!("{}-{}-", project_slug, allocation_name.replace('_', "-"))
         }
         ResourceAllocationKind::RustfsBucket => {
-            format!(
-                "{}-{}",
-                dash_hostname_slug(primary_hostname),
-                allocation_name.replace('_', "-")
-            )
+            format!("{}-{}", project_slug, allocation_name.replace('_', "-"))
         }
     };
 
@@ -131,17 +123,3 @@ pub fn allocation_env_placeholders(
         .env_placeholder_contract()
         .allocation_placeholders())
 }
-
-fn sql_hostname_slug(value: &str) -> String {
-    value
-        .chars()
-        .map(|character| match character {
-            '.' | '-' => '_',
-            character => character,
-        })
-        .collect()
-}
-
-fn dash_hostname_slug(value: &str) -> String {
-    value.replace('.', "-")
-}
diff --git a/crates/resources/tests/resource_allocations.rs b/crates/resources/tests/resource_allocations.rs
index eea1bfb7..4fb7a18f 100644
--- a/crates/resources/tests/resource_allocations.rs
+++ b/crates/resources/tests/resource_allocations.rs
@@ -33,20 +33,22 @@ struct PlaceholderContractSnapshot {
 #[test]
 fn resource_allocations_generate_resource_specific_names() -> Result<()> {
     let allocations = [
-        ("mysql", "acme.test", "app-db"),
-        ("postgres", "api.acme.test", "analytics"),
-        ("redis", "acme.test", "cache"),
-        ("rustfs", "acme.test", "uploads_bucket"),
-        ("mysql", "acme-store.test", "app-db"),
-        ("redis", "acme-store.test", "cache_bucket"),
-        ("rustfs", "acme-store.test", "cache_bucket"),
-        ("pg", "acme.test", "app-db"),
-        ("s3", "acme.test", "uploads_bucket"),
+        ("mysql", "acme", "app-db"),
+        ("postgres", "api", "analytics"),
+        ("redis", "acme", "cache"),
+        ("rustfs", "acme", "uploads_bucket"),
+        ("mysql", "acme-store", "app-db"),
+        ("redis", "acme-store", "cache_bucket"),
+        ("rustfs", "acme-store", "cache_bucket"),
+        ("pg", "acme", "app-db"),
+        ("s3", "acme", "uploads_bucket"),
     ]
     .into_iter()
-    .map(|(resource, hostname, allocation)| {
+    .map(|(resource, project_slug, allocation)| {
         Ok(allocation_name_summary(generated_allocation_name(
-            resource, hostname, allocation,
+            resource,
+            project_slug,
+            allocation,
         )?))
     })
     .collect::<Result<Vec<_>>>()?;
@@ -58,36 +60,36 @@ fn resource_allocations_generate_resource_specific_names() -> Result<()> {
 
 #[test]
 fn generated_allocation_names_enforce_sixty_three_character_limit() -> Result<()> {
-    let sql_exact_allocation = "a".repeat(56);
-    let redis_exact_allocation = "a".repeat(55);
-    let rustfs_exact_allocation = "a".repeat(56);
+    let sql_exact_allocation = "a".repeat(61);
+    let redis_exact_allocation = "a".repeat(60);
+    let rustfs_exact_allocation = "a".repeat(61);
 
     assert_eq!(
-        generated_allocation_name("mysql", "a.test", &sql_exact_allocation)?
+        generated_allocation_name("mysql", "a", &sql_exact_allocation)?
             .generated_name()
             .len(),
         63
     );
     assert_eq!(
-        generated_allocation_name("redis", "a.test", &redis_exact_allocation)?
+        generated_allocation_name("redis", "a", &redis_exact_allocation)?
             .generated_name()
             .len(),
         63
     );
     assert_eq!(
-        generated_allocation_name("rustfs", "a.test", &rustfs_exact_allocation)?
+        generated_allocation_name("rustfs", "a", &rustfs_exact_allocation)?
             .generated_name()
             .len(),
         63
     );
 
-    let sql_too_long_allocation = "a".repeat(57);
-    let redis_too_long_allocation = "a".repeat(56);
-    let rustfs_too_long_allocation = "a".repeat(57);
+    let sql_too_long_allocation = "a".repeat(62);
+    let redis_too_long_allocation = "a".repeat(61);
+    let rustfs_too_long_allocation = "a".repeat(62);
     let errors = vec![
-        allocation_error("mysql", "a.test", &sql_too_long_allocation)?,
-        allocation_error("redis", "a.test", &redis_too_long_allocation)?,
-        allocation_error("rustfs", "a.test", &rustfs_too_long_allocation)?,
+        allocation_error("mysql", "a", &sql_too_long_allocation)?,
+        allocation_error("redis", "a", &redis_too_long_allocation)?,
+        allocation_error("rustfs", "a", &rustfs_too_long_allocation)?,
     ];
 
     assert_debug_snapshot!(errors);
@@ -99,7 +101,7 @@ fn generated_allocation_names_enforce_sixty_three_character_limit() -> Result<()
 fn unsupported_resource_allocations_report_canonical_resource_names() -> Result<()> {
     let errors = ["mailpit", "mail", "php", "frankenphp", "composer"]
         .into_iter()
-        .map(|resource| allocation_error(resource, "acme.test", "app"))
+        .map(|resource| allocation_error(resource, "acme", "app"))
         .collect::<Result<Vec<_>>>()?;
 
     assert_debug_snapshot!(errors);
@@ -184,10 +186,10 @@ fn allocation_name_summary(name: ResourceAllocationName) -> AllocationNameSnapsh
 
 fn allocation_error(
     resource: &str,
-    primary_hostname: &str,
+    project_slug: &str,
     allocation: &str,
 ) -> Result<ResourcesError> {
-    match generated_allocation_name(resource, primary_hostname, allocation) {
+    match generated_allocation_name(resource, project_slug, allocation) {
         Ok(name) => Err(anyhow!("expected allocation error, got {name:?}")),
         Err(error) => Ok(error),
     }
diff --git a/crates/resources/tests/snapshots/resource_allocations__generated_allocation_names_enforce_sixty_three_character_limit.snap b/crates/resources/tests/snapshots/resource_allocations__generated_allocation_names_enforce_sixty_three_character_limit.snap
index 97f4651c..a6e6ae73 100644
--- a/crates/resources/tests/snapshots/resource_allocations__generated_allocation_names_enforce_sixty_three_character_limit.snap
+++ b/crates/resources/tests/snapshots/resource_allocations__generated_allocation_names_enforce_sixty_three_character_limit.snap
@@ -5,20 +5,20 @@ expression: errors
 [
     GeneratedAllocationNameTooLong {
         resource: "mysql",
-        allocation: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        generated: "a_test_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        allocation: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        generated: "a_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
         max: 63,
     },
     GeneratedAllocationNameTooLong {
         resource: "redis",
-        allocation: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        generated: "a-test-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-",
+        allocation: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        generated: "a-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-",
         max: 63,
     },
     GeneratedAllocationNameTooLong {
         resource: "rustfs",
-        allocation: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        generated: "a-test-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        allocation: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        generated: "a-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
         max: 63,
     },
 ]
diff --git a/crates/resources/tests/snapshots/resource_allocations__resource_allocations_generate_resource_specific_names.snap b/crates/resources/tests/snapshots/resource_allocations__resource_allocations_generate_resource_specific_names.snap
index 81781a0f..ba5bca4c 100644
--- a/crates/resources/tests/snapshots/resource_allocations__resource_allocations_generate_resource_specific_names.snap
+++ b/crates/resources/tests/snapshots/resource_allocations__resource_allocations_generate_resource_specific_names.snap
@@ -6,46 +6,46 @@ expression: allocations
     AllocationNameSnapshot {
         resource_name: "mysql",
         allocation_name: "app-db",
-        generated_name: "acme_test_app_db",
+        generated_name: "acme_app_db",
     },
     AllocationNameSnapshot {
         resource_name: "postgres",
         allocation_name: "analytics",
-        generated_name: "api_acme_test_analytics",
+        generated_name: "api_analytics",
     },
     AllocationNameSnapshot {
         resource_name: "redis",
         allocation_name: "cache",
-        generated_name: "acme-test-cache-",
+        generated_name: "acme-cache-",
     },
     AllocationNameSnapshot {
         resource_name: "rustfs",
         allocation_name: "uploads_bucket",
-        generated_name: "acme-test-uploads-bucket",
+        generated_name: "acme-uploads-bucket",
     },
     AllocationNameSnapshot {
         resource_name: "mysql",
         allocation_name: "app-db",
-        generated_name: "acme_store_test_app_db",
+        generated_name: "acme_store_app_db",
     },
     AllocationNameSnapshot {
         resource_name: "redis",
         allocation_name: "cache_bucket",
-        generated_name: "acme-store-test-cache-bucket-",
+        generated_name: "acme-store-cache-bucket-",
     },
     AllocationNameSnapshot {
         resource_name: "rustfs",
         allocation_name: "cache_bucket",
-        generated_name: "acme-store-test-cache-bucket",
+        generated_name: "acme-store-cache-bucket",
     },
     AllocationNameSnapshot {
         resource_name: "postgres",
         allocation_name: "app-db",
-        generated_name: "acme_test_app_db",
+        generated_name: "acme_app_db",
     },
     AllocationNameSnapshot {
         resource_name: "rustfs",
         allocation_name: "uploads_bucket",
-        generated_name: "acme-test-uploads-bucket",
+        generated_name: "acme-uploads-bucket",
     },
 ]
diff --git a/crates/state/src/database.rs b/crates/state/src/database.rs
index 9dce8505..647cdbc4 100644
--- a/crates/state/src/database.rs
+++ b/crates/state/src/database.rs
@@ -18,6 +18,7 @@ pub const RUNTIME_PORT_FALLBACK_END: u16 = 48999;
 const PROJECT_ID_LENGTH: usize = 10;
 const PROJECT_ID_ATTEMPTS: usize = 16;
 const PROJECT_ID_ALPHABET: &[u8] = b"abcdefghijklmnopqrstuvwxyz0123456789";
+const PROJECT_SLUG_ATTEMPTS: usize = 10_000;
 const MAX_DNS_LABEL_LENGTH: usize = 63;
 const MAX_HOSTNAME_LENGTH: usize = 253;
 const RESERVED_HOSTNAME: &str = "pv.test";
@@ -179,6 +180,36 @@ pub struct LinkProjectResult {
     pub project: ProjectRecord,
 }
 
+#[derive(Copy, Clone, Debug, Eq, PartialEq)]
+pub enum ProjectMode {
+    Served,
+    ResourceOnly,
+}
+
+impl ProjectMode {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Served => "served",
+            Self::ResourceOnly => "resource-only",
+        }
+    }
+
+    const fn as_database(self) -> i64 {
+        match self {
+            Self::Served => 1,
+            Self::ResourceOnly => 0,
+        }
+    }
+
+    fn from_database(serves_http: i64) -> Result<Self, StateError> {
+        match serves_http {
+            1 => Ok(Self::Served),
+            0 => Ok(Self::ResourceOnly),
+            value => Err(StateError::UnknownProjectMode { value }),
+        }
+    }
+}
+
 #[derive(Copy, Clone, Debug, Eq, PartialEq)]
 pub enum LinkProjectStatus {
     Created,
@@ -189,9 +220,11 @@ pub enum LinkProjectStatus {
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct ProjectRecord {
     pub id: String,
+    pub slug: String,
+    pub mode: ProjectMode,
     pub path: Utf8PathBuf,
     pub original_path: Utf8PathBuf,
-    pub primary_hostname: String,
+    pub primary_hostname: Option<String>,
     pub config_path: Utf8PathBuf,
     pub desired_php_track: Option<String>,
     pub php_runtime: ProjectPhpRuntimeRecord,
@@ -216,6 +249,17 @@ pub struct ProjectPhpRuntimeInput {
     pub ignored_extensions: Vec<String>,
 }
 
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct ProjectReconciliationStateInput {
+    pub project_id: String,
+    pub link: LinkProjectInput,
+    pub mode: ProjectMode,
+    pub php_runtime: Option<ProjectPhpRuntimeInput>,
+    pub env_status: ProjectEnvObservedStatus,
+    pub env_message: Option<String>,
+    pub env_warnings: Vec<ProjectEnvObservedWarningInput>,
+}
+
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct ProjectManagedResourceInput {
     pub resource_name: String,
@@ -262,7 +306,7 @@ pub struct ResourceAllocationRecord {
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct ProjectEnvStateContext {
     pub project_id: String,
-    pub primary_hostname: String,
+    pub primary_hostname: Option<String>,
     pub resources: BTreeMap<String, ProjectEnvResourceContext>,
 }
 
@@ -429,6 +473,8 @@ struct RuntimeObservedStateRow {
 
 struct ProjectRow {
     id: String,
+    project_slug: Option<String>,
+    serves_http: i64,
     path: String,
     original_path: Option<String>,
     primary_hostname: String,
@@ -614,7 +660,15 @@ impl Database {
         &mut self,
         input: LinkProjectInput,
     ) -> Result<LinkProjectResult, StateError> {
-        validate_link_project_input(&input)?;
+        self.link_project_with_mode(input, ProjectMode::Served)
+    }
+
+    pub fn link_project_with_mode(
+        &mut self,
+        mut input: LinkProjectInput,
+        mode: ProjectMode,
+    ) -> Result<LinkProjectResult, StateError> {
+        validate_link_project_input(&input, mode)?;
         let transaction = self
             .connection
             .transaction_with_behavior(TransactionBehavior::Immediate)?;
@@ -623,9 +677,31 @@ impl Database {
             Some(project) => project.id.clone(),
             None => generate_project_id(&transaction)?,
         };
-        validate_project_hostnames_in_transaction(&transaction, &project_id, &input)?;
+        let project_slug = match &existing {
+            Some(project) => project.slug.clone(),
+            None => generate_project_slug(&transaction, &input.path)?,
+        };
+        if mode == ProjectMode::ResourceOnly {
+            match &existing {
+                Some(project) => {
+                    input.primary_hostname = project
+                        .primary_hostname
+                        .clone()
+                        .unwrap_or_else(|| internal_project_hostname(&project_id));
+                    input.additional_hostnames = project.additional_hostnames.clone();
+                }
+                None => {
+                    input.primary_hostname = internal_project_hostname(&project_id);
+                    input.additional_hostnames.clear();
+                }
+            }
+        } else {
+            validate_project_hostnames_in_transaction(&transaction, &project_id, &input)?;
+        }
         let status = match &existing {
-            Some(project) if project_matches_input(project, &input) => LinkProjectStatus::Unchanged,
+            Some(project) if project_matches_input(project, &input, mode) => {
+                LinkProjectStatus::Unchanged
+            }
             Some(_) => LinkProjectStatus::Updated,
             None => LinkProjectStatus::Created,
         };
@@ -637,11 +713,23 @@ impl Database {
                     &project.id,
                     &input.primary_hostname,
                 )?;
-                update_project_in_transaction(&transaction, &project.id, &input)?;
+                update_project_in_transaction(&transaction, &project.id, &input, mode)?;
             }
-            None => insert_project_in_transaction(&transaction, &project_id, &input)?,
+            None => insert_project_in_transaction(
+                &transaction,
+                &project_id,
+                &project_slug,
+                &input,
+                mode,
+            )?,
+        }
+        if mode == ProjectMode::Served
+            || existing
+                .as_ref()
+                .is_some_and(|project| project.primary_hostname.is_some())
+        {
+            replace_project_hostnames_in_transaction(&transaction, &project_id, &input)?;
         }
-        replace_project_hostnames_in_transaction(&transaction, &project_id, &input)?;
         let project =
             project_by_id_in_transaction(&transaction, &project_id)?.ok_or_else(|| {
                 StateError::ProjectNotFound {
@@ -706,10 +794,17 @@ impl Database {
                 target: project_id.to_string(),
             }
         })?;
+        let primary_hostname =
+            project
+                .primary_hostname
+                .clone()
+                .ok_or_else(|| StateError::ProjectNotServed {
+                    project_id: project_id.to_string(),
+                })?;
         validate_project_hostname_set(
             &transaction,
             project_id,
-            &project.primary_hostname,
+            &primary_hostname,
             additional_hostnames,
         )?;
 
@@ -718,12 +813,12 @@ impl Database {
             let input = LinkProjectInput {
                 path: project.path.clone(),
                 original_path: project.original_path.clone(),
-                primary_hostname: project.primary_hostname.clone(),
+                primary_hostname,
                 config_path: project.config_path.clone(),
                 desired_php_track: project.desired_php_track.clone(),
                 additional_hostnames: additional_hostnames.to_vec(),
             };
-            update_project_in_transaction(&transaction, project_id, &input)?;
+            update_project_in_transaction(&transaction, project_id, &input, ProjectMode::Served)?;
             replace_project_hostnames_in_transaction(&transaction, project_id, &input)?;
         }
 
@@ -757,30 +852,8 @@ impl Database {
         project_id: &str,
         runtime: Option<&ProjectPhpRuntimeInput>,
     ) -> Result<ProjectRecord, StateError> {
-        let (track, requested, loaded, ignored) = match runtime {
-            Some(runtime) => {
-                validate_project_php_track(&runtime.track)?;
-                (
-                    Some(runtime.track.as_str()),
-                    user_extension_json(&runtime.requested_extensions)?,
-                    runtime_extension_json(&runtime.loaded_extensions)?,
-                    user_extension_json(&runtime.ignored_extensions)?,
-                )
-            }
-            None => (None, "[]".to_string(), "[]".to_string(), "[]".to_string()),
-        };
-        let updated_at = timestamp()?;
-
-        self.connection.execute(
-            "UPDATE projects
-            SET desired_php_track = ?2,
-                desired_php_requested_extensions_json = ?3,
-                desired_php_loaded_extensions_json = ?4,
-                desired_php_ignored_extensions_json = ?5,
-                updated_at = ?6
-            WHERE id = ?1",
-            params![project_id, track, requested, loaded, ignored, updated_at],
-        )?;
+        let runtime = project_php_runtime_database_values(runtime)?;
+        replace_project_php_runtime_in_connection(&self.connection, project_id, &runtime)?;
 
         self.project_by_id(project_id)?
             .ok_or_else(|| StateError::ProjectNotFound {
@@ -788,9 +861,67 @@ impl Database {
             })
     }
 
+    pub fn finalize_project_reconciliation(
+        &mut self,
+        mut input: ProjectReconciliationStateInput,
+    ) -> Result<ProjectRecord, StateError> {
+        input.link.desired_php_track = input
+            .php_runtime
+            .as_ref()
+            .map(|runtime| runtime.track.clone());
+        validate_link_project_input(&input.link, input.mode)?;
+        validate_project_env_observed_warnings(&input.env_warnings)?;
+        let runtime = project_php_runtime_database_values(input.php_runtime.as_ref())?;
+        let transaction = self
+            .connection
+            .transaction_with_behavior(TransactionBehavior::Immediate)?;
+        let project =
+            project_by_id_in_transaction(&transaction, &input.project_id)?.ok_or_else(|| {
+                StateError::ProjectNotFound {
+                    target: input.project_id.clone(),
+                }
+            })?;
+
+        if input.mode == ProjectMode::ResourceOnly {
+            input.link.primary_hostname = project
+                .primary_hostname
+                .clone()
+                .unwrap_or_else(|| internal_project_hostname(&project.id));
+            input.link.additional_hostnames = project.additional_hostnames.clone();
+        } else {
+            validate_project_hostnames_in_transaction(&transaction, &project.id, &input.link)?;
+        }
+        delete_same_project_additional_hostname_in_transaction(
+            &transaction,
+            &project.id,
+            &input.link.primary_hostname,
+        )?;
+        update_project_in_transaction(&transaction, &project.id, &input.link, input.mode)?;
+        if input.mode == ProjectMode::Served || project.primary_hostname.is_some() {
+            replace_project_hostnames_in_transaction(&transaction, &project.id, &input.link)?;
+        }
+        replace_project_php_runtime_in_connection(&transaction, &project.id, &runtime)?;
+        record_project_env_observed_snapshot_in_transaction(
+            &transaction,
+            &project.id,
+            input.env_status,
+            input.env_message.as_deref(),
+            &input.env_warnings,
+        )?;
+        let project =
+            project_by_id_in_transaction(&transaction, &project.id)?.ok_or_else(|| {
+                StateError::ProjectNotFound {
+                    target: input.project_id,
+                }
+            })?;
+        transaction.commit()?;
+
+        Ok(project)
+    }
+
     pub fn project_by_id(&self, project_id: &str) -> Result<Option<ProjectRecord>, StateError> {
         let mut statement = self.connection.prepare(
-            "SELECT id, path, original_path, primary_hostname, config_path, desired_php_track, created_at, updated_at
+            "SELECT id, path, original_path, primary_hostname, config_path, desired_php_track, created_at, updated_at, project_slug, serves_http
             FROM projects
             WHERE id = ?1",
         )?;
@@ -804,7 +935,7 @@ impl Database {
 
     pub fn project_by_path(&self, path: &Utf8Path) -> Result<Option<ProjectRecord>, StateError> {
         let mut statement = self.connection.prepare(
-            "SELECT id, path, original_path, primary_hostname, config_path, desired_php_track, created_at, updated_at
+            "SELECT id, path, original_path, primary_hostname, config_path, desired_php_track, created_at, updated_at, project_slug, serves_http
             FROM projects
             WHERE path = ?1",
         )?;
@@ -818,7 +949,7 @@ impl Database {
 
     pub fn project_by_hostname(&self, hostname: &str) -> Result<Option<ProjectRecord>, StateError> {
         let mut statement = self.connection.prepare(
-            "SELECT projects.id, projects.path, projects.original_path, projects.primary_hostname, projects.config_path, projects.desired_php_track, projects.created_at, projects.updated_at
+            "SELECT projects.id, projects.path, projects.original_path, projects.primary_hostname, projects.config_path, projects.desired_php_track, projects.created_at, projects.updated_at, projects.project_slug, projects.serves_http
             FROM projects
             INNER JOIN project_hostnames ON project_hostnames.project_id = projects.id
             WHERE project_hostnames.hostname = ?1",
@@ -831,6 +962,20 @@ impl Database {
         }
     }
 
+    pub fn project_by_slug(&self, slug: &str) -> Result<Option<ProjectRecord>, StateError> {
+        let mut statement = self.connection.prepare(
+            "SELECT id, path, original_path, primary_hostname, config_path, desired_php_track, created_at, updated_at, project_slug, serves_http
+            FROM projects
+            WHERE project_slug = ?1",
+        )?;
+        let mut rows = statement.query_map(params![slug], project_from_row)?;
+
+        match rows.next() {
+            Some(row) => row?.into_record(&self.connection).map(Some),
+            None => Ok(None),
+        }
+    }
+
     pub fn nearest_project_for_path(
         &self,
         path: &Utf8Path,
@@ -844,9 +989,9 @@ impl Database {
 
     pub fn projects(&self) -> Result<Vec<ProjectRecord>, StateError> {
         let mut statement = self.connection.prepare(
-            "SELECT id, path, original_path, primary_hostname, config_path, desired_php_track, created_at, updated_at
+            "SELECT id, path, original_path, primary_hostname, config_path, desired_php_track, created_at, updated_at, project_slug, serves_http
             FROM projects
-            ORDER BY primary_hostname",
+            ORDER BY project_slug",
         )?;
         let rows = statement.query_map([], project_from_row)?;
         let mut projects = Vec::new();
@@ -1472,51 +1617,13 @@ impl Database {
             .connection
             .transaction_with_behavior(TransactionBehavior::Immediate)?;
         ensure_project_exists_in_transaction(&transaction, project_id)?;
-        let observed_at = timestamp()?;
-        transaction.execute(
-            "INSERT INTO observed_states (
-                subject_kind,
-                subject_id,
-                status,
-                message,
-                observed_at
-            )
-            VALUES (?1, ?2, ?3, ?4, ?5)
-            ON CONFLICT(subject_kind, subject_id) DO UPDATE SET
-                status = excluded.status,
-                message = excluded.message,
-                observed_at = excluded.observed_at",
-            params![
-                PROJECT_ENV_OBSERVED_SUBJECT_KIND,
-                project_id,
-                status.as_str(),
-                message,
-                observed_at,
-            ],
-        )?;
-        transaction.execute(
-            "DELETE FROM project_env_observed_warnings WHERE project_id = ?1",
-            params![project_id],
+        record_project_env_observed_snapshot_in_transaction(
+            &transaction,
+            project_id,
+            status,
+            message,
+            warnings,
         )?;
-
-        for warning in warnings {
-            transaction.execute(
-                "INSERT INTO project_env_observed_warnings (
-                    project_id,
-                    warning_kind,
-                    message,
-                    observed_at
-                )
-                VALUES (?1, ?2, ?3, ?4)",
-                params![
-                    project_id,
-                    warning.kind.as_str(),
-                    warning.message.as_str(),
-                    observed_at.as_str(),
-                ],
-            )?;
-        }
-
         transaction.commit()?;
 
         self.project_env_observed_state(project_id)?
@@ -1846,6 +1953,123 @@ impl Database {
     }
 }
 
+struct ProjectPhpRuntimeDatabaseValues {
+    track: Option<String>,
+    requested_extensions_json: String,
+    loaded_extensions_json: String,
+    ignored_extensions_json: String,
+}
+
+fn project_php_runtime_database_values(
+    runtime: Option<&ProjectPhpRuntimeInput>,
+) -> Result<ProjectPhpRuntimeDatabaseValues, StateError> {
+    match runtime {
+        Some(runtime) => {
+            validate_project_php_track(&runtime.track)?;
+
+            Ok(ProjectPhpRuntimeDatabaseValues {
+                track: Some(runtime.track.clone()),
+                requested_extensions_json: user_extension_json(&runtime.requested_extensions)?,
+                loaded_extensions_json: runtime_extension_json(&runtime.loaded_extensions)?,
+                ignored_extensions_json: user_extension_json(&runtime.ignored_extensions)?,
+            })
+        }
+        None => Ok(ProjectPhpRuntimeDatabaseValues {
+            track: None,
+            requested_extensions_json: "[]".to_string(),
+            loaded_extensions_json: "[]".to_string(),
+            ignored_extensions_json: "[]".to_string(),
+        }),
+    }
+}
+
+fn replace_project_php_runtime_in_connection(
+    connection: &Connection,
+    project_id: &str,
+    runtime: &ProjectPhpRuntimeDatabaseValues,
+) -> Result<(), StateError> {
+    let updated_at = timestamp()?;
+    let updated = connection.execute(
+        "UPDATE projects
+        SET desired_php_track = ?2,
+            desired_php_requested_extensions_json = ?3,
+            desired_php_loaded_extensions_json = ?4,
+            desired_php_ignored_extensions_json = ?5,
+            updated_at = ?6
+        WHERE id = ?1",
+        params![
+            project_id,
+            runtime.track.as_deref(),
+            runtime.requested_extensions_json.as_str(),
+            runtime.loaded_extensions_json.as_str(),
+            runtime.ignored_extensions_json.as_str(),
+            updated_at,
+        ],
+    )?;
+    if updated == 0 {
+        return Err(StateError::ProjectNotFound {
+            target: project_id.to_string(),
+        });
+    }
+
+    Ok(())
+}
+
+fn record_project_env_observed_snapshot_in_transaction(
+    transaction: &Transaction<'_>,
+    project_id: &str,
+    status: ProjectEnvObservedStatus,
+    message: Option<&str>,
+    warnings: &[ProjectEnvObservedWarningInput],
+) -> Result<(), StateError> {
+    let observed_at = timestamp()?;
+    transaction.execute(
+        "INSERT INTO observed_states (
+            subject_kind,
+            subject_id,
+            status,
+            message,
+            observed_at
+        )
+        VALUES (?1, ?2, ?3, ?4, ?5)
+        ON CONFLICT(subject_kind, subject_id) DO UPDATE SET
+            status = excluded.status,
+            message = excluded.message,
+            observed_at = excluded.observed_at",
+        params![
+            PROJECT_ENV_OBSERVED_SUBJECT_KIND,
+            project_id,
+            status.as_str(),
+            message,
+            observed_at,
+        ],
+    )?;
+    transaction.execute(
+        "DELETE FROM project_env_observed_warnings WHERE project_id = ?1",
+        params![project_id],
+    )?;
+
+    for warning in warnings {
+        transaction.execute(
+            "INSERT INTO project_env_observed_warnings (
+                project_id,
+                warning_kind,
+                message,
+                observed_at
+            )
+            VALUES (?1, ?2, ?3, ?4)",
+            params![
+                project_id,
+                warning.kind.as_str(),
+                warning.message.as_str(),
+                observed_at.as_str(),
+            ],
+        )?;
+    }
+
+    Ok(())
+}
+
 impl ManagedResourceDesiredState {
     const fn as_str(self) -> &'static str {
         match self {
@@ -2408,12 +2632,22 @@ impl ProjectRow {
             .config_path
             .map(Utf8PathBuf::from)
             .unwrap_or_else(|| path.join("pv.yml"));
+        let slug = self
+            .project_slug
+            .ok_or_else(|| StateError::ProjectSlugMissing {
+                project_id: self.id.clone(),
+            })?;
+        let mode = ProjectMode::from_database(self.serves_http)?;
+        let primary_hostname = (!is_internal_project_hostname(&self.primary_hostname))
+            .then_some(self.primary_hostname);
 
         Ok(ProjectRecord {
             id: self.id,
+            slug,
+            mode,
             path,
             original_path,
-            primary_hostname: self.primary_hostname,
+            primary_hostname,
             config_path,
             desired_php_track: self.desired_php_track,
             php_runtime,
@@ -2445,7 +2679,7 @@ fn project_by_path_in_transaction(
 ) -> Result<Option<ProjectRecord>, StateError> {
     let row = transaction
         .query_row(
-            "SELECT id, path, original_path, primary_hostname, config_path, desired_php_track, created_at, updated_at
+            "SELECT id, path, original_path, primary_hostname, config_path, desired_php_track, created_at, updated_at, project_slug, serves_http
             FROM projects
             WHERE path = ?1",
             params![path.as_str()],
@@ -2465,7 +2699,7 @@ fn project_by_id_in_transaction(
 ) -> Result<Option<ProjectRecord>, StateError> {
     let row = transaction
         .query_row(
-            "SELECT id, path, original_path, primary_hostname, config_path, desired_php_track, created_at, updated_at
+            "SELECT id, path, original_path, primary_hostname, config_path, desired_php_track, created_at, updated_at, project_slug, serves_http
             FROM projects
             WHERE id = ?1",
             params![project_id],
@@ -2906,13 +3140,18 @@ fn validate_project_env_observed_warnings(
     Ok(())
 }
 
-fn validate_link_project_input(input: &LinkProjectInput) -> Result<(), StateError> {
+fn validate_link_project_input(
+    input: &LinkProjectInput,
+    mode: ProjectMode,
+) -> Result<(), StateError> {
     validate_project_path("path", &input.path)?;
     validate_original_project_path(&input.original_path)?;
     validate_project_path("config path", &input.config_path)?;
-    validate_project_hostname(&input.primary_hostname)?;
-    for hostname in &input.additional_hostnames {
-        validate_project_hostname(hostname)?;
+    if mode == ProjectMode::Served {
+        validate_project_hostname(&input.primary_hostname)?;
+        for hostname in &input.additional_hostnames {
+            validate_project_hostname(hostname)?;
+        }
     }
     if let Some(track) = &input.desired_php_track {
         validate_project_php_track(track)?;
@@ -3100,10 +3339,17 @@ fn validate_project_hostname_label(hostname: &str, label: &str) -> Result<(), St
     }
 }
 
-fn project_matches_input(project: &ProjectRecord, input: &LinkProjectInput) -> bool {
+fn project_matches_input(
+    project: &ProjectRecord,
+    input: &LinkProjectInput,
+    mode: ProjectMode,
+) -> bool {
     project.path == input.path
         && project.original_path == input.original_path
-        && project.primary_hostname == input.primary_hostname
+        && project.primary_hostname.as_deref()
+            == (!is_internal_project_hostname(&input.primary_hostname))
+                .then_some(input.primary_hostname.as_str())
+        && project.mode == mode
         && project.config_path == input.config_path
         && project.desired_php_track == input.desired_php_track
         && sorted_hostnames(&project.additional_hostnames)
@@ -3120,14 +3366,18 @@ fn sorted_hostnames(hostnames: &[String]) -> Vec<String> {
 fn insert_project_in_transaction(
     transaction: &Transaction<'_>,
     project_id: &str,
+    project_slug: &str,
     input: &LinkProjectInput,
+    mode: ProjectMode,
 ) -> Result<(), StateError> {
     let created_at = timestamp()?;
     transaction.execute(
-        "INSERT INTO projects (id, path, original_path, primary_hostname, config_path, desired_php_track, created_at, updated_at)
-        VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?7)",
+        "INSERT INTO projects (id, project_slug, serves_http, path, original_path, primary_hostname, config_path, desired_php_track, created_at, updated_at)
+        VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?9)",
         params![
             project_id,
+            project_slug,
+            mode.as_database(),
             input.path.as_str(),
             input.original_path.as_str(),
             input.primary_hostname.as_str(),
@@ -3144,6 +3394,7 @@ fn update_project_in_transaction(
     transaction: &Transaction<'_>,
     project_id: &str,
     input: &LinkProjectInput,
+    mode: ProjectMode,
 ) -> Result<(), StateError> {
     let previous_desired_php_track = transaction.query_row(
         "SELECT desired_php_track FROM projects WHERE id = ?1",
@@ -3155,13 +3406,15 @@ fn update_project_in_transaction(
     transaction.execute(
         "UPDATE projects
         SET primary_hostname = ?1,
-            original_path = ?2,
-            config_path = ?3,
-            desired_php_track = ?4,
-            updated_at = ?5
-        WHERE id = ?6",
+            serves_http = ?2,
+            original_path = ?3,
+            config_path = ?4,
+            desired_php_track = ?5,
+            updated_at = ?6
+        WHERE id = ?7",
         params![
             input.primary_hostname.as_str(),
+            mode.as_database(),
             input.original_path.as_str(),
             input.config_path.as_str(),
             input.desired_php_track.as_deref(),
@@ -3301,6 +3554,78 @@ fn generate_project_id(transaction: &Transaction<'_>) -> Result<String, StateErr
     })
 }
 
+fn generate_project_slug(
+    transaction: &Transaction<'_>,
+    project_path: &Utf8Path,
+) -> Result<String, StateError> {
+    let base = project_slug_base(project_path)?;
+
+    for attempt in 0..PROJECT_SLUG_ATTEMPTS {
+        let slug = if attempt == 0 {
+            base.clone()
+        } else {
+            let suffix = format!("-{attempt}");
+            let maximum_base_length = MAX_DNS_LABEL_LENGTH - suffix.len();
+            let base_length = base.len().min(maximum_base_length);
+            let shortened_base = base[..base_length].trim_end_matches('-');
+
+            format!("{shortened_base}{suffix}")
+        };
+        let count = transaction.query_row(
+            "SELECT COUNT(*) FROM projects WHERE project_slug = ?1",
+            params![slug.as_str()],
+            |row| row.get::<_, i64>(0),
+        )?;
+        if count == 0 {
+            return Ok(slug);
+        }
+    }
+
+    Err(StateError::ProjectSlugExhausted {
+        attempts: PROJECT_SLUG_ATTEMPTS,
+    })
+}
+
+fn project_slug_base(project_path: &Utf8Path) -> Result<String, StateError> {
+    let Some(file_name) = project_path.file_name() else {
+        return Err(StateError::InvalidProjectSlug {
+            name: project_path.to_string(),
+        });
+    };
+    let mut slug = String::new();
+    let mut previous_was_hyphen = false;
+
+    for character in file_name.chars().flat_map(char::to_lowercase) {
+        if character.is_ascii_alphanumeric() {
+            slug.push(character);
+            previous_was_hyphen = false;
+        } else if !previous_was_hyphen && !slug.is_empty() {
+            slug.push('-');
+            previous_was_hyphen = true;
+        }
+    }
+
+    while slug.ends_with('-') {
+        slug.pop();
+    }
+
+    if slug.is_empty() || slug.len() > MAX_DNS_LABEL_LENGTH {
+        return Err(StateError::InvalidProjectSlug {
+            name: file_name.to_string(),
+        });
+    }
+
+    Ok(slug)
+}
+
+fn internal_project_hostname(project_id: &str) -> String {
+    format!("{project_id}.invalid")
+}
+
+fn is_internal_project_hostname(hostname: &str) -> bool {
+    hostname.ends_with(".invalid")
+}
+
 fn random_project_id(rng: &mut fastrand::Rng) -> String {
     let mut id = String::with_capacity(PROJECT_ID_LENGTH);
 
@@ -3663,6 +3988,8 @@ fn project_from_row(row: &rusqlite::Row<'_>) -> rusqlite::Result<ProjectRow> {
         desired_php_track: row.get(5)?,
         created_at: row.get(6)?,
         updated_at: row.get(7)?,
+        project_slug: row.get(8)?,
+        serves_http: row.get(9)?,
     })
 }
 
diff --git a/crates/state/src/error.rs b/crates/state/src/error.rs
index b35af689..75ab8729 100644
--- a/crates/state/src/error.rs
+++ b/crates/state/src/error.rs
@@ -103,6 +103,9 @@ pub enum StateError {
     #[error("unknown Project env observed status `{status}`")]
     UnknownProjectEnvObservedStatus { status: String },
 
+    #[error("unknown Project serving mode value `{value}`")]
+    UnknownProjectMode { value: i64 },
+
     #[error("unknown runtime observed status `{status}`")]
     UnknownRuntimeObservedStatus { status: String },
 
@@ -140,6 +143,18 @@ pub enum StateError {
     #[error("could not allocate a unique Project ID after {attempts} attempts")]
     ProjectIdExhausted { attempts: usize },
 
+    #[error("Project directory name `{name}` cannot produce a valid Project slug")]
+    InvalidProjectSlug { name: String },
+
+    #[error("Project `{project_id}` has no stored Project slug")]
+    ProjectSlugMissing { project_id: String },
+
+    #[error("could not allocate a unique Project slug after {attempts} attempts")]
+    ProjectSlugExhausted { attempts: usize },
+
+    #[error("Project `{project_id}` is resource-only and has no served hostname")]
+    ProjectNotServed { project_id: String },
+
     #[error("invalid managed resource {kind} `{value}`")]
     InvalidManagedResourceIdentity { kind: &'static str, value: String },
 
diff --git a/crates/state/src/lib.rs b/crates/state/src/lib.rs
index e544f4f2..5365c2b0 100644
--- a/crates/state/src/lib.rs
+++ b/crates/state/src/lib.rs
@@ -16,11 +16,11 @@ pub use database::{
     ManagedResourceTrackRemovalInput, PortAssignment, PortOwner, PortRequest, ProjectConfigWatch,
     ProjectEnvAllocationContext, ProjectEnvObservedStateRecord, ProjectEnvObservedStatus,
     ProjectEnvObservedWarningInput, ProjectEnvObservedWarningRecord, ProjectEnvResourceContext,
-    ProjectEnvStateContext, ProjectManagedResourceInput, ProjectManagedResourceRecord,
-    ProjectPhpRuntimeInput, ProjectPhpRuntimeRecord, ProjectRecord, RUNTIME_PORT_FALLBACK_END,
-    RUNTIME_PORT_FALLBACK_START, ResourceAllocationInput, ResourceAllocationRecord,
-    ResourceAllocationStatus, RuntimeObservedStateRecord, RuntimeObservedStatus, RuntimeSubject,
-    php_runtime_key,
+    ProjectEnvStateContext, ProjectManagedResourceInput, ProjectManagedResourceRecord, ProjectMode,
+    ProjectPhpRuntimeInput, ProjectPhpRuntimeRecord, ProjectReconciliationStateInput,
+    ProjectRecord, RUNTIME_PORT_FALLBACK_END, RUNTIME_PORT_FALLBACK_START, ResourceAllocationInput,
+    ResourceAllocationRecord, ResourceAllocationStatus, RuntimeObservedStateRecord,
+    RuntimeObservedStatus, RuntimeSubject, php_runtime_key,
 };
 pub use error::{StateCapability, StateError};
 pub use paths::{PathSummaryEntry, PvPaths};
diff --git a/crates/state/src/migrations.rs b/crates/state/src/migrations.rs
index 224d55be..350a411c 100644
--- a/crates/state/src/migrations.rs
+++ b/crates/state/src/migrations.rs
@@ -16,6 +16,7 @@ const GLOBAL_PHP_DEFAULT_SQL: &str = include_str!("sql/006_global_php_default.sq
 const RESOURCE_PORT_ROLES_SQL: &str = include_str!("sql/007_resource_port_roles.sql");
 const PROJECT_PHP_RUNTIME_EXTENSIONS_SQL: &str =
     include_str!("sql/008_project_php_runtime_extensions.sql");
+const PROJECT_MODE_AND_SLUG_SQL: &str = include_str!("sql/009_project_mode_and_slug.sql");
 
 pub(crate) const DEFAULT_MIGRATIONS: &[Migration] = &[
     Migration::new(1, "core_state_schema", CORE_SCHEMA_SQL),
@@ -42,6 +43,7 @@ pub(crate) const DEFAULT_MIGRATIONS: &[Migration] = &[
         "project_php_runtime_extensions",
         PROJECT_PHP_RUNTIME_EXTENSIONS_SQL,
     ),
+    Migration::new(9, "project_mode_and_slug", PROJECT_MODE_AND_SLUG_SQL),
 ];
 
 #[derive(Copy, Clone, Debug, Eq, PartialEq)]
diff --git a/crates/state/src/sql/009_project_mode_and_slug.sql b/crates/state/src/sql/009_project_mode_and_slug.sql
new file mode 100644
index 00000000..7e7d4637
--- /dev/null
+++ b/crates/state/src/sql/009_project_mode_and_slug.sql
@@ -0,0 +1,25 @@
+ALTER TABLE projects ADD COLUMN project_slug TEXT;
+ALTER TABLE projects
+ADD COLUMN serves_http INTEGER NOT NULL DEFAULT 1 CHECK (serves_http IN (0, 1));
+
+UPDATE projects SET project_slug = id WHERE project_slug IS NULL;
+
+CREATE UNIQUE INDEX projects_project_slug_unique
+ON projects(project_slug)
+WHERE project_slug IS NOT NULL;
+
+CREATE TRIGGER projects_project_slug_required_insert
+BEFORE INSERT ON projects
+WHEN NEW.project_slug IS NULL OR NEW.project_slug = ''
+BEGIN
+    SELECT RAISE(ABORT, 'project slug is required');
+END;
+
+CREATE TRIGGER projects_project_slug_immutable
+BEFORE UPDATE OF project_slug ON projects
+WHEN NEW.project_slug IS NULL
+    OR NEW.project_slug = ''
+    OR NEW.project_slug != OLD.project_slug
+BEGIN
+    SELECT RAISE(ABORT, 'project slug is immutable');
+END;
diff --git a/crates/state/tests/snapshots/state_foundation__database_runs_migrations_and_exposes_core_schema.snap b/crates/state/tests/snapshots/state_foundation__database_runs_migrations_and_exposes_core_schema.snap
index 45688382..253a0740 100644
--- a/crates/state/tests/snapshots/state_foundation__database_runs_migrations_and_exposes_core_schema.snap
+++ b/crates/state/tests/snapshots/state_foundation__database_runs_migrations_and_exposes_core_schema.snap
@@ -15,6 +15,7 @@ DatabaseInspection {
         "006:global_php_default",
         "007:resource_port_roles",
         "008:project_php_runtime_extensions",
+        "009:project_mode_and_slug",
     ],
     tables: [
         "global_php_default_track",
diff --git a/crates/state/tests/snapshots/state_foundation__generated_env_context_escapes_round_trip_through_state.snap b/crates/state/tests/snapshots/state_foundation__generated_env_context_escapes_round_trip_through_state.snap
index 38a5117a..5ab84064 100644
--- a/crates/state/tests/snapshots/state_foundation__generated_env_context_escapes_round_trip_through_state.snap
+++ b/crates/state/tests/snapshots/state_foundation__generated_env_context_escapes_round_trip_through_state.snap
@@ -46,7 +46,9 @@ expression: "(tracks, allocations, context)"
     ],
     ProjectEnvStateContext {
         project_id: "<project_id>",
-        primary_hostname: "acme.test",
+        primary_hostname: Some(
+            "acme.test",
+        ),
         resources: {
             "mysql": ProjectEnvResourceContext {
                 track: "8.0",
diff --git a/crates/state/tests/snapshots/state_foundation__linked_projects_preserve_ids_and_refresh_hostnames.snap b/crates/state/tests/snapshots/state_foundation__linked_projects_preserve_ids_and_refresh_hostnames.snap
index 30c2c33a..e83547b4 100644
--- a/crates/state/tests/snapshots/state_foundation__linked_projects_preserve_ids_and_refresh_hostnames.snap
+++ b/crates/state/tests/snapshots/state_foundation__linked_projects_preserve_ids_and_refresh_hostnames.snap
@@ -8,9 +8,13 @@ expression: "(created.status, updated.status, database.projects()?)"
     [
         ProjectRecord {
             id: "<project_id>",
+            slug: "acme",
+            mode: Served,
             path: "<tempdir>/acme",
             original_path: "<tempdir>/acme",
-            primary_hostname: "store.test",
+            primary_hostname: Some(
+                "store.test",
+            ),
             config_path: "<tempdir>/acme/pv.yml",
             desired_php_track: Some(
                 "8.3",
diff --git a/crates/state/tests/snapshots/state_foundation__migrated_project_resource_state_round_trips_through_public_apis.snap b/crates/state/tests/snapshots/state_foundation__migrated_project_resource_state_round_trips_through_public_apis.snap
index ab47e355..de0d999d 100644
--- a/crates/state/tests/snapshots/state_foundation__migrated_project_resource_state_round_trips_through_public_apis.snap
+++ b/crates/state/tests/snapshots/state_foundation__migrated_project_resource_state_round_trips_through_public_apis.snap
@@ -14,6 +14,7 @@ expression: "(before, after)"
                 "003:project_primary_hostname_updates",
                 "004:project_original_path",
                 "005:project_resource_requirements",
+                "009:project_mode_and_slug",
             ],
             tables: [
                 "jobs",
@@ -30,10 +31,14 @@ expression: "(before, after)"
         },
         [
             ProjectRecord {
-                id: "<project_id>",
+                id: "project_1",
+                slug: "project_1",
+                mode: Served,
                 path: "<tempdir>/acme",
                 original_path: "<tempdir>/acme",
-                primary_hostname: "acme.test",
+                primary_hostname: Some(
+                    "acme.test",
+                ),
                 config_path: "<tempdir>/acme/pv.yml",
                 desired_php_track: Some(
                     "8.4",
@@ -75,10 +80,14 @@ expression: "(before, after)"
     (
         [
             ProjectRecord {
-                id: "<project_id>",
+                id: "project_1",
+                slug: "project_1",
+                mode: Served,
                 path: "<tempdir>/acme",
                 original_path: "<tempdir>/acme",
-                primary_hostname: "acme.test",
+                primary_hostname: Some(
+                    "acme.test",
+                ),
                 config_path: "<tempdir>/acme/pv.yml",
                 desired_php_track: Some(
                     "8.4",
@@ -100,10 +109,14 @@ expression: "(before, after)"
         ],
         Some(
             ProjectRecord {
-                id: "<project_id>",
+                id: "project_1",
+                slug: "project_1",
+                mode: Served,
                 path: "<tempdir>/acme",
                 original_path: "<tempdir>/acme",
-                primary_hostname: "acme.test",
+                primary_hostname: Some(
+                    "acme.test",
+                ),
                 config_path: "<tempdir>/acme/pv.yml",
                 desired_php_track: Some(
                     "8.4",
@@ -125,14 +138,14 @@ expression: "(before, after)"
         ),
         [
             ProjectManagedResourceRecord {
-                project_id: "<project_id>",
+                project_id: "project_1",
                 resource_name: "mysql",
                 track: "8.0",
                 created_at: "<timestamp>",
                 updated_at: "<timestamp>",
             },
             ProjectManagedResourceRecord {
-                project_id: "<project_id>",
+                project_id: "project_1",
                 resource_name: "redis",
                 track: "7.2",
                 created_at: "<timestamp>",
@@ -180,7 +193,7 @@ expression: "(before, after)"
         [
             ResourceAllocationRecord {
                 id: "allocation_000001",
-                project_id: "<project_id>",
+                project_id: "project_1",
                 resource_name: "mysql",
                 track: "8.0",
                 allocation_name: "app-db",
@@ -193,7 +206,7 @@ expression: "(before, after)"
         ],
         ResourceAllocationRecord {
             id: "allocation_000001",
-            project_id: "<project_id>",
+            project_id: "project_1",
             resource_name: "mysql",
             track: "8.0",
             allocation_name: "app-db",
@@ -208,7 +221,7 @@ expression: "(before, after)"
         [
             ResourceAllocationRecord {
                 id: "allocation_000001",
-                project_id: "<project_id>",
+                project_id: "project_1",
                 resource_name: "mysql",
                 track: "8.0",
                 allocation_name: "app-db",
@@ -222,8 +235,10 @@ expression: "(before, after)"
             },
         ],
         ProjectEnvStateContext {
-            project_id: "<project_id>",
-            primary_hostname: "acme.test",
+            project_id: "project_1",
+            primary_hostname: Some(
+                "acme.test",
+            ),
             resources: {
                 "mysql": ProjectEnvResourceContext {
                     track: "8.0",
@@ -253,7 +268,7 @@ expression: "(before, after)"
             },
         },
         ProjectEnvObservedStateRecord {
-            project_id: "<project_id>",
+            project_id: "project_1",
             status: Warning,
             message: Some(
                 "rendered with warnings after migration",
@@ -261,7 +276,7 @@ expression: "(before, after)"
             observed_at: "<timestamp>",
             warnings: [
                 ProjectEnvObservedWarningRecord {
-                    project_id: "<project_id>",
+                    project_id: "project_1",
                     kind: "duplicate_key",
                     message: "APP_URL already exists outside the PV block",
                     observed_at: "<timestamp>",
@@ -270,7 +285,7 @@ expression: "(before, after)"
         },
         [
             ProjectEnvObservedWarningRecord {
-                project_id: "<project_id>",
+                project_id: "project_1",
                 kind: "duplicate_key",
                 message: "APP_URL already exists outside the PV block",
                 observed_at: "<timestamp>",
diff --git a/crates/state/tests/snapshots/state_foundation__project_env_context_uses_ready_allocations_from_required_track_only.snap b/crates/state/tests/snapshots/state_foundation__project_env_context_uses_ready_allocations_from_required_track_only.snap
index 37a908da..1a571130 100644
--- a/crates/state/tests/snapshots/state_foundation__project_env_context_uses_ready_allocations_from_required_track_only.snap
+++ b/crates/state/tests/snapshots/state_foundation__project_env_context_uses_ready_allocations_from_required_track_only.snap
@@ -5,7 +5,9 @@ expression: "(old_track_context, switched_track_context)"
 (
     ProjectEnvStateContext {
         project_id: "<project_id>",
-        primary_hostname: "acme.test",
+        primary_hostname: Some(
+            "acme.test",
+        ),
         resources: {
             "mysql": ProjectEnvResourceContext {
                 track: "8.0",
@@ -26,7 +28,9 @@ expression: "(old_track_context, switched_track_context)"
     },
     ProjectEnvStateContext {
         project_id: "<project_id>",
-        primary_hostname: "acme.test",
+        primary_hostname: Some(
+            "acme.test",
+        ),
         resources: {
             "mysql": ProjectEnvResourceContext {
                 track: "8.4",
diff --git a/crates/state/tests/snapshots/state_foundation__resource_allocations_preserve_generated_names_and_env_context.snap b/crates/state/tests/snapshots/state_foundation__resource_allocations_preserve_generated_names_and_env_context.snap
index 49a1268b..9fff615c 100644
--- a/crates/state/tests/snapshots/state_foundation__resource_allocations_preserve_generated_names_and_env_context.snap
+++ b/crates/state/tests/snapshots/state_foundation__resource_allocations_preserve_generated_names_and_env_context.snap
@@ -33,7 +33,9 @@ expression: "(created, ready, context, removed, after_removal, readded)"
     },
     ProjectEnvStateContext {
         project_id: "<project_id>",
-        primary_hostname: "acme.test",
+        primary_hostname: Some(
+            "acme.test",
+        ),
         resources: {
             "mysql": ProjectEnvResourceContext {
                 track: "8.0",
diff --git a/crates/state/tests/state_foundation.rs b/crates/state/tests/state_foundation.rs
index de3f9236..7c921e37 100644
--- a/crates/state/tests/state_foundation.rs
+++ b/crates/state/tests/state_foundation.rs
@@ -12,7 +12,7 @@ use state::{
     GATEWAY_HTTPS_PREFERRED_PORT, GatewayPort, JobStatus, ManagedResourceDesiredState,
     ManagedResourceTrackInstallInput, ManagedResourceTrackRemovalInput, PortOwner, PortRequest,
     ProjectEnvObservedStatus, ProjectEnvObservedWarningInput, ProjectManagedResourceInput,
-    ProjectRecord, PvPaths, RUNTIME_PORT_FALLBACK_END, RUNTIME_PORT_FALLBACK_START,
+    ProjectMode, ProjectRecord, PvPaths, RUNTIME_PORT_FALLBACK_END, RUNTIME_PORT_FALLBACK_START,
     ResourceAllocationInput, RuntimeObservedStatus, RuntimeSubject, StateError, UpdateLock,
 };
 
@@ -564,9 +564,10 @@ fn resource_allocations_reject_duplicate_generated_names_per_resource_track() ->
 
     state::testing::transaction(&mut database, |transaction| {
         transaction.execute(
-            "INSERT INTO projects (id, path, original_path, primary_hostname, created_at, updated_at) VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
+            "INSERT INTO projects (id, project_slug, path, original_path, primary_hostname, created_at, updated_at) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)",
             params![
                 "project_1",
+                "acme",
                 "/tmp/acme",
                 "/tmp/acme",
                 "acme.test",
@@ -953,15 +954,39 @@ fn migrated_project_resource_state_round_trips_through_public_apis() -> Result<(
         ),
     ];
     let mut old_database = state::testing::open_with_migrations(&paths, &old_migrations)?;
-    let linked = old_database.link_project(state::LinkProjectInput {
-        path: tempdir.path().join("acme"),
-        original_path: tempdir.path().join("acme"),
-        primary_hostname: "acme.test".to_string(),
-        config_path: tempdir.path().join("acme/pv.yml"),
-        desired_php_track: Some("8.4".to_string()),
-        additional_hostnames: vec!["api.acme.test".to_string()],
-    })?;
+    let project_id = "project_1".to_string();
     state::testing::transaction(&mut old_database, |transaction| {
+        transaction.execute(
+            "INSERT INTO projects (
+                id,
+                path,
+                original_path,
+                primary_hostname,
+                config_path,
+                desired_php_track,
+                created_at,
+                updated_at
+            )
+            VALUES (?1, ?2, ?2, ?3, ?4, ?5, ?6, ?6)",
+            params![
+                project_id,
+                tempdir.path().join("acme").as_str(),
+                "acme.test",
+                tempdir.path().join("acme/pv.yml").as_str(),
+                "8.4",
+                "2026-05-23T00:00:00Z",
+            ],
+        )?;
+        transaction.execute(
+            "INSERT INTO project_hostnames (hostname, project_id, is_primary, created_at)
+            VALUES (?1, ?2, 1, ?3), (?4, ?2, 0, ?3)",
+            params![
+                "acme.test",
+                project_id,
+                "2026-05-23T00:00:00Z",
+                "api.acme.test",
+            ],
+        )?;
         transaction.execute(
             "INSERT INTO managed_resource_tracks (
                 resource_name,
@@ -998,9 +1023,13 @@ fn migrated_project_resource_state_round_trips_through_public_apis() -> Result<(
             "project_resource_requirements",
             include_str!("../src/sql/005_project_resource_requirements.sql"),
         ),
+        Migration::new(
+            9,
+            "project_mode_and_slug",
+            include_str!("../src/sql/009_project_mode_and_slug.sql"),
+        ),
     ];
     let mut database = state::testing::open_with_migrations(&paths, &upgraded_migrations)?;
-    let project_id = linked.project.id;
     let before = (
         database.inspect()?,
         database.projects()?,
@@ -1889,6 +1918,11 @@ fn project_original_path_migration_backfills_existing_paths() -> Result<()> {
             "project_original_path",
             include_str!("../src/sql/004_project_original_path.sql"),
         ),
+        Migration::new(
+            9,
+            "project_mode_and_slug",
+            include_str!("../src/sql/009_project_mode_and_slug.sql"),
+        ),
     ];
     let database = state::testing::open_with_migrations(&paths, &upgraded_migrations)?;
     let project = database
@@ -2005,9 +2039,10 @@ fn primary_project_hostname_rows_must_match_the_project() -> Result<()> {
 
     state::testing::transaction(&mut database, |transaction| {
         transaction.execute(
-            "INSERT INTO projects (id, path, original_path, primary_hostname, created_at, updated_at) VALUES (?1, ?2, ?3, ?4, ?5, ?6)",
+            "INSERT INTO projects (id, project_slug, path, original_path, primary_hostname, created_at, updated_at) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)",
             params![
                 "project_1",
+                "acme",
                 "/tmp/acme",
                 "/tmp/acme",
                 "acme.test",
@@ -2138,6 +2173,222 @@ fn linked_projects_preserve_ids_and_refresh_hostnames() -> Result<()> {
     Ok(())
 }
 
+#[test]
+fn linked_projects_assign_immutable_slugs_and_persist_serving_mode() -> Result<()> {
+    let tempdir = tempdir()?;
+    let paths = PvPaths::for_home(tempdir.path().join("home"));
+    let mut database = Database::open(&paths)?;
+    let first_path = tempdir.path().join("first/Appointment");
+    let second_path = tempdir.path().join("second/Appointment");
+
+    let first = database.link_project(state::LinkProjectInput {
+        path: first_path.clone(),
+        original_path: first_path.clone(),
+        primary_hostname: "appointment.test".to_string(),
+        config_path: first_path.join("pv.yml"),
+        desired_php_track: None,
+        additional_hostnames: vec!["api.appointment.test".to_string()],
+    })?;
+    let second = database.link_project_with_mode(
+        state::LinkProjectInput {
+            path: second_path.clone(),
+            original_path: second_path.clone(),
+            primary_hostname: "ignored.test".to_string(),
+            config_path: second_path.join("pv.yml"),
+            desired_php_track: None,
+            additional_hostnames: vec!["ignored-alias.test".to_string()],
+        },
+        ProjectMode::ResourceOnly,
+    )?;
+    let second_relinked = database.link_project_with_mode(
+        state::LinkProjectInput {
+            path: second_path.clone(),
+            original_path: second_path,
+            primary_hostname: "another-ignored.test".to_string(),
+            config_path: second.project.config_path.clone(),
+            desired_php_track: None,
+            additional_hostnames: Vec::new(),
+        },
+        ProjectMode::ResourceOnly,
+    )?;
+
+    assert_eq!(first.project.slug, "appointment");
+    assert_eq!(first.project.mode, ProjectMode::Served);
+    assert_eq!(
+        first.project.primary_hostname.as_deref(),
+        Some("appointment.test")
+    );
+    assert_eq!(second.project.slug, "appointment-1");
+    assert_eq!(second.project.mode, ProjectMode::ResourceOnly);
+    assert_eq!(second.project.primary_hostname, None);
+    assert!(second.project.additional_hostnames.is_empty());
+    assert_eq!(second_relinked.status, state::LinkProjectStatus::Unchanged);
+    assert_eq!(second_relinked.project.slug, second.project.slug);
+    assert_eq!(
+        database.project_by_slug("appointment-1")?,
+        Some(second.project.clone())
+    );
+    assert!(
+        database
+            .project_by_hostname(&format!("{}.invalid", second.project.id))?
+            .is_none()
+    );
+
+    let first_disabled = database.link_project_with_mode(
+        state::LinkProjectInput {
+            path: first.project.path.clone(),
+            original_path: first.project.original_path.clone(),
+            primary_hostname: "ignored.test".to_string(),
+            config_path: first.project.config_path.clone(),
+            desired_php_track: None,
+            additional_hostnames: Vec::new(),
+        },
+        ProjectMode::ResourceOnly,
+    )?;
+    assert_eq!(first_disabled.project.slug, first.project.slug);
+    assert_eq!(first_disabled.project.mode, ProjectMode::ResourceOnly);
+    assert_eq!(
+        first_disabled.project.primary_hostname.as_deref(),
+        Some("appointment.test")
+    );
+    assert_eq!(
+        first_disabled.project.additional_hostnames,
+        ["api.appointment.test"]
+    );
+    assert!(database.project_by_hostname("appointment.test")?.is_some());
+
+    let second_enabled = database.link_project_with_mode(
+        state::LinkProjectInput {
+            path: second.project.path.clone(),
+            original_path: second.project.original_path.clone(),
+            primary_hostname: "appointment-1.test".to_string(),
+            config_path: second.project.config_path.clone(),
+            desired_php_track: None,
+            additional_hostnames: Vec::new(),
+        },
+        ProjectMode::Served,
+    )?;
+    assert_eq!(second_enabled.project.slug, second.project.slug);
+    assert_eq!(second_enabled.project.mode, ProjectMode::Served);
+    assert_eq!(
+        second_enabled.project.primary_hostname.as_deref(),
+        Some("appointment-1.test")
+    );
+
+    let maximum_length_name = "a".repeat(63);
+    let long_first_path = tempdir.path().join("long-first").join(&maximum_length_name);
+    let long_second_path = tempdir
+        .path()
+        .join("long-second")
+        .join(&maximum_length_name);
+    let long_first = database.link_project(state::LinkProjectInput {
+        path: long_first_path.clone(),
+        original_path: long_first_path.clone(),
+        primary_hostname: "long-first.test".to_string(),
+        config_path: long_first_path.join("pv.yml"),
+        desired_php_track: None,
+        additional_hostnames: Vec::new(),
+    })?;
+    let long_second = database.link_project(state::LinkProjectInput {
+        path: long_second_path.clone(),
+        original_path: long_second_path.clone(),
+        primary_hostname: "long-second.test".to_string(),
+        config_path: long_second_path.join("pv.yml"),
+        desired_php_track: None,
+        additional_hostnames: Vec::new(),
+    })?;
+    assert_eq!(long_first.project.slug, maximum_length_name);
+    assert_eq!(long_second.project.slug, format!("{}-1", "a".repeat(61)));
+
+    let changed_slug = state::testing::transaction(&mut database, |transaction| {
+        transaction.execute(
+            "UPDATE projects SET project_slug = ?1 WHERE id = ?2",
+            params!["changed", first.project.id],
+        )?;
+
+        Ok(())
+    });
+    let missing_slug = state::testing::transaction(&mut database, |transaction| {
+        transaction.execute(
+            "UPDATE projects SET project_slug = NULL WHERE id = ?1",
+            params![first.project.id],
+        )?;
+
+        Ok(())
+    });
+    assert!(changed_slug.is_err());
+    assert!(missing_slug.is_err());
+    assert_eq!(
+        database
+            .project_by_id(&first.project.id)?
+            .map(|project| project.slug),
+        Some("appointment".to_string())
+    );
+
+    Ok(())
+}
+
+#[test]
+fn project_reconciliation_finalization_rolls_back_gateway_state_on_failure() -> Result<()> {
+    let tempdir = tempdir()?;
+    let paths = PvPaths::for_home(tempdir.path().join("home"));
+    let mut database = Database::open(&paths)?;
+    let project = link_test_project(&mut database, tempdir.path(), "acme", "acme.test")?;
+    database.replace_project_php_runtime(
+        &project.id,
+        Some(&state::ProjectPhpRuntimeInput {
+            track: "8.4".to_string(),
+            requested_extensions: Vec::new(),
+            loaded_extensions: Vec::new(),
+            ignored_extensions: Vec::new(),
+        }),
+    )?;
+    state::testing::transaction(&mut database, |transaction| {
+        transaction.execute_batch(
+            "CREATE TRIGGER fail_project_observed_state
+            BEFORE INSERT ON observed_states
+            BEGIN
+                SELECT RAISE(ABORT, 'forced observed-state failure');
+            END;",
+        )?;
+
+        Ok(())
+    })?;
+
+    let result = database.finalize_project_reconciliation(state::ProjectReconciliationStateInput {
+        project_id: project.id.clone(),
+        link: state::LinkProjectInput {
+            path: project.path.clone(),
+            original_path: project.original_path.clone(),
+            primary_hostname: "ignored.test".to_string(),
+            config_path: project.config_path.clone(),
+            desired_php_track: None,
+            additional_hostnames: Vec::new(),
+        },
+        mode: ProjectMode::ResourceOnly,
+        php_runtime: Some(state::ProjectPhpRuntimeInput {
+            track: "8.3".to_string(),
+            requested_extensions: Vec::new(),
+            loaded_extensions: Vec::new(),
+            ignored_extensions: Vec::new(),
+        }),
+        env_status: ProjectEnvObservedStatus::Rendered,
+        env_message: Some("rendered Project env".to_string()),
+        env_warnings: Vec::new(),
+    });
+    let after_failure = database
+        .project_by_id(&project.id)?
+        .ok_or_else(|| anyhow!("expected linked Project"))?;
+
+    assert!(result.is_err());
+    assert_eq!(after_failure.mode, ProjectMode::Served);
+    assert_eq!(after_failure.primary_hostname.as_deref(), Some("acme.test"));
+    assert_eq!(after_failure.php_runtime.track.as_deref(), Some("8.4"));
+    assert!(database.project_env_observed_state(&project.id)?.is_none());
+
+    Ok(())
+}
+
 #[test]
 fn linked_projects_refresh_desired_php_track_independently() -> Result<()> {
     let tempdir = tempdir()?;
@@ -2447,7 +2698,10 @@ fn linked_projects_can_promote_additional_hostname_to_primary() -> Result<()> {
     })?;
 
     assert_eq!(created.project.id, updated.project.id);
-    assert_eq!(updated.project.primary_hostname, "api.acme.test");
+    assert_eq!(
+        updated.project.primary_hostname.as_deref(),
+        Some("api.acme.test")
+    );
     assert_eq!(updated.project.additional_hostnames, vec!["acme.test"]);
 
     Ok(())
@@ -2580,8 +2834,8 @@ fn linked_project_hostname_validation_checks_pending_config_hostnames() -> Resul
 
     let duplicate_primary = database.validate_project_hostnames(
         &first.project.id,
-        &first.project.primary_hostname,
-        std::slice::from_ref(&first.project.primary_hostname),
+        "acme.test",
+        &["acme.test".to_string()],
     );
     assert!(matches!(
         duplicate_primary,
@@ -2590,8 +2844,8 @@ fn linked_project_hostname_validation_checks_pending_config_hostnames() -> Resul
 
     let collision = database.validate_project_hostnames(
         &second.project.id,
-        &second.project.primary_hostname,
-        std::slice::from_ref(&first.project.primary_hostname),
+        "other.test",
+        &["acme.test".to_string()],
     );
     assert!(matches!(
         collision,
diff --git a/it/cli.rs b/it/cli.rs
index b0e3fdb1..1f85d8a4 100644
--- a/it/cli.rs
+++ b/it/cli.rs
@@ -703,6 +703,30 @@ fn project_init_rejects_yes_with_print() -> Result<()> {
     Ok(())
 }
 
+#[test]
+fn project_list_shows_project_and_mode_for_served_and_resource_only_projects() -> Result<()> {
+    let tempdir = tempdir()?;
+    let home = tempdir.path().join("home");
+    let served = tempdir.path().join("Zulu Web");
+    let resource_only = tempdir.path().join("Beta Data");
+    create_dir(&served)?;
+    create_dir(&resource_only)?;
+    write_file(&resource_only.join("pv.yml"), "serve: false\n")?;
+
+    let link_served = run_pv_in_dir_with_home(&["link", "--hostname", "alpha"], &served, &home)?;
+    let link_resource_only = run_pv_in_dir_with_home(&["link"], &resource_only, &home)?;
+    let list = run_pv_in_dir_with_home(&["list"], &resource_only, &home)?;
+
+    let mut settings = insta::Settings::clone_current();
+    settings.add_filter(tempdir.path().as_str(), "<tempdir>");
+    settings.add_filter("/private<tempdir>", "<tempdir>");
+    settings.bind(|| {
+        assert_debug_snapshot!((link_served, link_resource_only, list));
+    });
+
+    Ok(())
+}
+
 #[test]
 fn project_list_reports_invalid_linked_config() -> Result<()> {
     let tempdir = tempdir()?;
diff --git a/it/snapshots/cli__completions_generate_bash_script.snap b/it/snapshots/cli__completions_generate_bash_script.snap
index 4a0e2277..ec04b937 100644
--- a/it/snapshots/cli__completions_generate_bash_script.snap
+++ b/it/snapshots/cli__completions_generate_bash_script.snap
@@ -798,7 +798,7 @@ _pv() {
             return 0
             ;;
         pv__subcmd__open)
-            opts="-h --no-color --help [hostname]"
+            opts="-h --no-color --help [project]"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
@@ -1036,7 +1036,7 @@ _pv() {
             return 0
             ;;
         pv__subcmd__project:env)
-            opts="-h --json --no-color --help [hostname]"
+            opts="-h --json --no-color --help [project]"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
@@ -1316,7 +1316,7 @@ _pv() {
             return 0
             ;;
         pv__subcmd__unlink)
-            opts="-h --no-color --help [hostname]"
+            opts="-h --no-color --help [project]"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
diff --git a/it/snapshots/cli__completions_generate_zsh_script.snap b/it/snapshots/cli__completions_generate_zsh_script.snap
index 820e97de..422f6f38 100644
--- a/it/snapshots/cli__completions_generate_zsh_script.snap
+++ b/it/snapshots/cli__completions_generate_zsh_script.snap
@@ -195,7 +195,7 @@ _arguments "${_arguments_options[@]}" : \
 '--no-color[Disable colored output]' \
 '-h[Print help]' \
 '--help[Print help]' \
-'::hostname -- Project hostname to unlink:_default' \
+'::hostname -- Project slug or hostname to unlink:_default' \
 && ret=0
 ;;
 (open)
@@ -203,7 +203,7 @@ _arguments "${_arguments_options[@]}" : \
 '--no-color[Disable colored output]' \
 '-h[Print help]' \
 '--help[Print help]' \
-'::hostname -- Project hostname to open:_default' \
+'::hostname -- Project slug or hostname to open:_default' \
 && ret=0
 ;;
 (project:env)
@@ -212,7 +212,7 @@ _arguments "${_arguments_options[@]}" : \
 '--no-color[Disable colored output]' \
 '-h[Print help]' \
 '--help[Print help]' \
-'::hostname -- Project hostname to render env for:_default' \
+'::hostname -- Project slug or hostname to render env for:_default' \
 && ret=0
 ;;
 (status)
diff --git a/it/snapshots/cli__core_workflow_command_help_is_documented.snap b/it/snapshots/cli__core_workflow_command_help_is_documented.snap
index c80f51b2..833d6055 100644
--- a/it/snapshots/cli__core_workflow_command_help_is_documented.snap
+++ b/it/snapshots/cli__core_workflow_command_help_is_documented.snap
@@ -35,21 +35,21 @@ expression: output
         code: Some(
             0,
         ),
-        stdout: "Unlink a Project\n\nUsage: pv unlink [OPTIONS] [hostname]\n\nArguments:\n  [hostname]  Project hostname to unlink\n\nOptions:\n      --no-color  Disable colored output\n  -h, --help      Print help\n",
+        stdout: "Unlink a Project\n\nUsage: pv unlink [OPTIONS] [project]\n\nArguments:\n  [project]  Project slug or hostname to unlink\n\nOptions:\n      --no-color  Disable colored output\n  -h, --help      Print help\n",
         stderr: "",
     },
     CommandOutput {
         code: Some(
             0,
         ),
-        stdout: "Open a linked Project\n\nUsage: pv open [OPTIONS] [hostname]\n\nArguments:\n  [hostname]  Project hostname to open\n\nOptions:\n      --no-color  Disable colored output\n  -h, --help      Print help\n",
+        stdout: "Open a linked Project\n\nUsage: pv open [OPTIONS] [project]\n\nArguments:\n  [project]  Project slug or hostname to open\n\nOptions:\n      --no-color  Disable colored output\n  -h, --help      Print help\n",
         stderr: "",
     },
     CommandOutput {
         code: Some(
             0,
         ),
-        stdout: "Print generated Project environment values\n\nUsage: pv project:env [OPTIONS] [hostname]\n\nArguments:\n  [hostname]  Project hostname to render env for\n\nOptions:\n      --json      Print generated Project environment values as JSON\n      --no-color  Disable colored output\n  -h, --help      Print help\n",
+        stdout: "Print generated Project environment values\n\nUsage: pv project:env [OPTIONS] [project]\n\nArguments:\n  [project]  Project slug or hostname to render env for\n\nOptions:\n      --json      Print generated Project environment values as JSON\n      --no-color  Disable colored output\n  -h, --help      Print help\n",
         stderr: "",
     },
 ]
diff --git a/it/snapshots/cli__project_link_accepts_relative_path_arguments.snap b/it/snapshots/cli__project_link_accepts_relative_path_arguments.snap
index 6e839a36..900c9d15 100644
--- a/it/snapshots/cli__project_link_accepts_relative_path_arguments.snap
+++ b/it/snapshots/cli__project_link_accepts_relative_path_arguments.snap
@@ -14,7 +14,7 @@ expression: "(link, list)"
         code: Some(
             0,
         ),
-        stdout: "Hostname  PHP  Status  Resources  Env  Path\nacme-store.test  8.4  unknown  unknown  none  <tempdir>/parent/Acme Store\n",
+        stdout: "Project  Mode  PHP  Status  Resources  Env  Path\nacme-store.test  served  8.4  unknown  unknown  none  <tempdir>/parent/Acme Store\n",
         stderr: "",
     },
 )
diff --git a/it/snapshots/cli__project_link_list_and_unlink_use_injected_home.snap b/it/snapshots/cli__project_link_list_and_unlink_use_injected_home.snap
index e848c72d..e449541d 100644
--- a/it/snapshots/cli__project_link_list_and_unlink_use_injected_home.snap
+++ b/it/snapshots/cli__project_link_list_and_unlink_use_injected_home.snap
@@ -14,7 +14,7 @@ expression: "(link, list_after_link, unlink, list_after_unlink)"
         code: Some(
             0,
         ),
-        stdout: "Hostname  PHP  Status  Resources  Env  Path\nacme-store.test  8.4  unknown  unknown  pending  <tempdir>/Acme Store\n",
+        stdout: "Project  Mode  PHP  Status  Resources  Env  Path\nacme-store.test  served  8.4  unknown  unknown  pending  <tempdir>/Acme Store\n",
         stderr: "",
     },
     CommandOutput {
diff --git a/it/snapshots/cli__project_list_clears_stale_env_status_without_mappings.snap b/it/snapshots/cli__project_list_clears_stale_env_status_without_mappings.snap
index 9bfb4edc..e3410204 100644
--- a/it/snapshots/cli__project_list_clears_stale_env_status_without_mappings.snap
+++ b/it/snapshots/cli__project_list_clears_stale_env_status_without_mappings.snap
@@ -14,28 +14,28 @@ expression: "(link, list_initial, list_stale_pending, list_stale_warning,\nlist_
         code: Some(
             0,
         ),
-        stdout: "Hostname  PHP  Status  Resources  Env  Path\nacme-store.test  default  unknown  unknown  none  <tempdir>/Acme Store\n",
+        stdout: "Project  Mode  PHP  Status  Resources  Env  Path\nacme-store.test  served  default  unknown  unknown  none  <tempdir>/Acme Store\n",
         stderr: "",
     },
     CommandOutput {
         code: Some(
             0,
         ),
-        stdout: "Hostname  PHP  Status  Resources  Env  Path\nacme-store.test  default  unknown  unknown  none  <tempdir>/Acme Store\n",
+        stdout: "Project  Mode  PHP  Status  Resources  Env  Path\nacme-store.test  served  default  unknown  unknown  none  <tempdir>/Acme Store\n",
         stderr: "",
     },
     CommandOutput {
         code: Some(
             0,
         ),
-        stdout: "Hostname  PHP  Status  Resources  Env  Path\nacme-store.test  default  unknown  unknown  none  <tempdir>/Acme Store\n",
+        stdout: "Project  Mode  PHP  Status  Resources  Env  Path\nacme-store.test  served  default  unknown  unknown  none  <tempdir>/Acme Store\n",
         stderr: "",
     },
     CommandOutput {
         code: Some(
             0,
         ),
-        stdout: "Hostname  PHP  Status  Resources  Env  Path\nacme-store.test  default  unknown  unknown  none  <tempdir>/Acme Store\n",
+        stdout: "Project  Mode  PHP  Status  Resources  Env  Path\nacme-store.test  served  default  unknown  unknown  none  <tempdir>/Acme Store\n",
         stderr: "",
     },
 )
diff --git a/it/snapshots/cli__project_list_reports_config_hostname_validation_errors.snap b/it/snapshots/cli__project_list_reports_config_hostname_validation_errors.snap
index 3f40ea98..a9b84262 100644
--- a/it/snapshots/cli__project_list_reports_config_hostname_validation_errors.snap
+++ b/it/snapshots/cli__project_list_reports_config_hostname_validation_errors.snap
@@ -14,7 +14,7 @@ expression: "(link, list)"
         code: Some(
             0,
         ),
-        stdout: "Hostname  PHP  Status  Resources  Env  Path\nacme-store.test  8.4  config-invalid  unknown  invalid  <tempdir>/Acme Store\n  config: Project hostname `acme-store.test` appears more than once for the same Project\n",
+        stdout: "Project  Mode  PHP  Status  Resources  Env  Path\nacme-store.test  served  8.4  config-invalid  unknown  invalid  <tempdir>/Acme Store\n  config: Project hostname `acme-store.test` appears more than once for the same Project\n",
         stderr: "",
     },
 )
diff --git a/it/snapshots/cli__project_list_reports_env_observed_status.snap b/it/snapshots/cli__project_list_reports_env_observed_status.snap
index 252fe0b5..c098e585 100644
--- a/it/snapshots/cli__project_list_reports_env_observed_status.snap
+++ b/it/snapshots/cli__project_list_reports_env_observed_status.snap
@@ -14,28 +14,28 @@ expression: "(link, list_pending, list_rendered, list_warning, list_failed)"
         code: Some(
             0,
         ),
-        stdout: "Hostname  PHP  Status  Resources  Env  Path\nacme-store.test  default  unknown  unknown  pending  <tempdir>/Acme Store\n",
+        stdout: "Project  Mode  PHP  Status  Resources  Env  Path\nacme-store.test  served  default  unknown  unknown  pending  <tempdir>/Acme Store\n",
         stderr: "",
     },
     CommandOutput {
         code: Some(
             0,
         ),
-        stdout: "Hostname  PHP  Status  Resources  Env  Path\nacme-store.test  default  unknown  unknown  rendered  <tempdir>/Acme Store\n",
+        stdout: "Project  Mode  PHP  Status  Resources  Env  Path\nacme-store.test  served  default  unknown  unknown  rendered  <tempdir>/Acme Store\n",
         stderr: "",
     },
     CommandOutput {
         code: Some(
             0,
         ),
-        stdout: "Hostname  PHP  Status  Resources  Env  Path\nacme-store.test  default  unknown  unknown  warning  <tempdir>/Acme Store\n  env: warning: APP_URL already exists outside the PV block\n",
+        stdout: "Project  Mode  PHP  Status  Resources  Env  Path\nacme-store.test  served  default  unknown  unknown  warning  <tempdir>/Acme Store\n  env: warning: APP_URL already exists outside the PV block\n",
         stderr: "",
     },
     CommandOutput {
         code: Some(
             0,
         ),
-        stdout: "Hostname  PHP  Status  Resources  Env  Path\nacme-store.test  default  unknown  unknown  failed  <tempdir>/Acme Store\n  env: failed: Project config error: duplicate rendered Project env key `DATABASE_URL`\n",
+        stdout: "Project  Mode  PHP  Status  Resources  Env  Path\nacme-store.test  served  default  unknown  unknown  failed  <tempdir>/Acme Store\n  env: failed: Project config error: duplicate rendered Project env key `DATABASE_URL`\n",
         stderr: "",
     },
 )
diff --git a/it/snapshots/cli__project_list_reports_env_shape_validation_errors.snap b/it/snapshots/cli__project_list_reports_env_shape_validation_errors.snap
index ff9de7c6..48f7ce7a 100644
--- a/it/snapshots/cli__project_list_reports_env_shape_validation_errors.snap
+++ b/it/snapshots/cli__project_list_reports_env_shape_validation_errors.snap
@@ -14,7 +14,7 @@ expression: "(link, list)"
         code: Some(
             0,
         ),
-        stdout: "Hostname  PHP  Status  Resources  Env  Path\nacme-store.test  default  config-invalid  unknown  invalid  <tempdir>/Acme Store\n  config: duplicate rendered Project env key `DB_HOST` from same-depth mappings `mysql.env.DB_HOST` and `redis.env.DB_HOST`\n",
+        stdout: "Project  Mode  PHP  Status  Resources  Env  Path\nacme-store.test  served  default  config-invalid  unknown  invalid  <tempdir>/Acme Store\n  config: duplicate rendered Project env key `DB_HOST` from same-depth mappings `mysql.env.DB_HOST` and `redis.env.DB_HOST`\n",
         stderr: "",
     },
 )
diff --git a/it/snapshots/cli__project_list_reports_ignored_php_extensions.snap b/it/snapshots/cli__project_list_reports_ignored_php_extensions.snap
index c6f3e00a..ecbeea3e 100644
--- a/it/snapshots/cli__project_list_reports_ignored_php_extensions.snap
+++ b/it/snapshots/cli__project_list_reports_ignored_php_extensions.snap
@@ -1,6 +1,5 @@
 ---
 source: it/cli.rs
-assertion_line: 628
 expression: "(link, list)"
 ---
 (
@@ -15,7 +14,7 @@ expression: "(link, list)"
         code: Some(
             0,
         ),
-        stdout: "Hostname  PHP  Status  Resources  Env  Path\nacme-store.test  default  unknown  unknown  warning  <tempdir>/Acme Store\n  env: warning: ignored unsupported PHP extension `missing`; ignored unsupported PHP extension `typo`\n",
+        stdout: "Project  Mode  PHP  Status  Resources  Env  Path\nacme-store.test  served  default  unknown  unknown  warning  <tempdir>/Acme Store\n  env: warning: ignored unsupported PHP extension `missing`; ignored unsupported PHP extension `typo`\n",
         stderr: "",
     },
 )
diff --git a/it/snapshots/cli__project_list_reports_invalid_linked_config.snap b/it/snapshots/cli__project_list_reports_invalid_linked_config.snap
index f014af09..84d267ad 100644
--- a/it/snapshots/cli__project_list_reports_invalid_linked_config.snap
+++ b/it/snapshots/cli__project_list_reports_invalid_linked_config.snap
@@ -14,7 +14,7 @@ expression: "(link, list)"
         code: Some(
             0,
         ),
-        stdout: "Hostname  PHP  Status  Resources  Env  Path\nacme-store.test  8.4  config-invalid  unknown  invalid  <tempdir>/Acme Store\n  config: unknown Project config key `unexpected`\n",
+        stdout: "Project  Mode  PHP  Status  Resources  Env  Path\nacme-store.test  served  8.4  config-invalid  unknown  invalid  <tempdir>/Acme Store\n  config: unknown Project config key `unexpected`\n",
         stderr: "",
     },
 )
diff --git a/it/snapshots/cli__project_list_shows_project_and_mode_for_served_and_resource_only_projects.snap b/it/snapshots/cli__project_list_shows_project_and_mode_for_served_and_resource_only_projects.snap
new file mode 100644
index 00000000..8d725e3e
--- /dev/null
+++ b/it/snapshots/cli__project_list_shows_project_and_mode_for_served_and_resource_only_projects.snap
@@ -0,0 +1,27 @@
+---
+source: it/cli.rs
+expression: "(link_served, link_resource_only, list)"
+---
+(
+    CommandOutput {
+        code: Some(
+            0,
+        ),
+        stdout: "Linked alpha.test -> <tempdir>/Zulu Web\nwarning: PV daemon is not running; reconciliation will run after `pv setup` starts it\n",
+        stderr: "",
+    },
+    CommandOutput {
+        code: Some(
+            0,
+        ),
+        stdout: "Linked beta-data (resource-only) -> <tempdir>/Beta Data\nwarning: PV daemon is not running; reconciliation will run after `pv setup` starts it\n",
+        stderr: "",
+    },
+    CommandOutput {
+        code: Some(
+            0,
+        ),
+        stdout: "Project  Mode  PHP  Status  Resources  Env  Path\nalpha.test  served  default  unknown  unknown  none  <tempdir>/Zulu Web\nbeta-data  resource-only  default  unknown  unknown  none  <tempdir>/Beta Data\n",
+        stderr: "",
+    },
+)