diff --git a/DESIGN.md b/DESIGN.md
index 57ab2ebbf..e3e11c5a6 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -28,6 +28,16 @@ The `/apis` route is a **custom, in-house API explorer** ([`src/features/instanc
 - **Try-it-out is credentialed cross-origin `fetch`** (`credentials: 'include'`), the same model Swagger used — which is why the **CORS warning + one-click enable** flow in [`APIDocs.tsx`](src/features/instance/apis/APIDocs.tsx) matters and must be preserved. Auth offers Cookie (session, default) / Basic / Bearer; Basic/Bearer add an `Authorization` header.
 - **Persistence**: the server + auth selections persist to `localStorage` under `LocalStorageKeys.ApiExplorerSettings`, **keyed by entity id**, so a credential set for one instance never applies to another.
 
+## Operations console (the instance/cluster "Operations" tab)
+
+[`src/features/instance/operations/`](src/features/instance/operations/) sends one freeform operations-API body through the entity's own `getInstanceClient` client (direct, basic, or proxied — whatever every other page uses). The rules, each pinned by a test there:
+
+- **The typed text is the request body.** It is parsed only to validate it and read `operation`; re-serializing the parse would round integers past 2^53 (a primary key) before Harper saw them. Axios sends a string body that parses as JSON as-is, only trimmed.
+- **At most one send.** It sets `skipGatewayRetry`, because the shared client replays a 502/503/504 for any body whose `operation` reads by name, and a component's `get_…` operation is no proof that it only reads. Only a request Studio refused before sending counts as unsent. Anything that reached Harper marks data stale, an error answer included, because an arbitrary operation can change something before it fails; and a request abandoned mid-flight (the page unmounted) is reported as possibly applied.
+- **Only Harper's own reads skip the confirmation.** [`isBuiltInRead`](src/features/instance/operations/operationKinds.ts) is the restart gate's naming rule ([`isReadOperation`](src/integrations/api/isReadOperation.ts)) _and_ membership in the role editor's catalog of Harper's operations, because a component can register a mutating `get_…`. Everything else — unknown names, every `sql` — confirms, showing the exact body. It guards against a mistyped paste; Harper's `verifyPerms` is what authorizes each operation.
+- **Operations Studio has to know about are not sent blind.** A `restart` is tracked with `markRestarting` exactly like the Restart button's (released at once on a 4xx; a 5xx can be a gateway losing the answer to a restart that ran), so the page's reads are held (an instance) or their connectivity errors muted (a cluster, which restarts one member) until `waitUntilAnsweringAfterRestart` sees the target again. `logout` is refused: it would end the session the rest of Studio is still using. Any other operation with such a side effect needs the same treatment rather than a raw send.
+- **Nothing leaves the page.** Failures render inline and never pass through `console.error` or the global React Query handlers (RUM reports the former, and bodies carry passwords and secrets). The editor buffer is not persisted, and the console remounts per entity so a confirmation written for one instance can never be sent to another. After a possible write, entity queries are marked stale with `refetchType: 'none'`, never refetched into whatever the operation just did. The download is abandoned once progress passes 5 MB (XHR reports progress about every 50 ms, so this bounds, not caps, what arrives), and display truncates like the API explorer.
+
 ## Cloud authentication presentation
 
 All cloud authentication routes use `AuthLayout`; keep form submission, validation, OAuth targets, and error handling in the existing route components/hooks. `AuthInput` keeps `FormControl` directly around the input so label/error associations and React Hook Form refs reach the DOM. React 19 passes `ref` through props; browser tests verify first-invalid-field focus. Password selectors must use an exact label match because the reveal button also has “password” in its accessible name.
@@ -39,7 +49,7 @@ The wide hero artwork spans both columns beneath the form card in three independ
 [`restartTracker.ts`](src/lib/restart/restartTracker.ts) is the one record of which clusters and instances are restarting, so a planned outage doesn't read as a failure. Read it before adding anything that takes an instance down.
 
 - **Two sources.** Studio's own Harper `restart` runs mark and release their targets (`markRestarting`, released in `finally`) — central manager never hears about these. Container ops are central manager's: every `getClusterInfo` fetch mirrors its `RESTARTING`/`STARTING` statuses into the tracker — including a one-node cluster whose only member is restarting under an instance-only op, which leaves the cluster's own status `RUNNING`/`PARTIAL`. A new flow that takes an instance down must use one of the two, or its failures toast like before.
-- **Reads are held; everything else is refused.** Every `getInstanceClient` client holds a read (`get_`/`search_`/`describe_`/`list_`/`read_`…) while its entity is `down` and sends it on recovery, but refuses a write at once with `ERR_TARGET_RESTARTING` — a write queued for minutes could land after the user gave up on it, or retried it ([`restartGate.ts`](src/lib/restart/restartGate.ts)). Token minting counts as a write on purpose, so a route guard's Fabric Connect attempt falls through to sign-in instead of stalling. Requests that drive or watch a restart must pass `skipRestartGate: true`, or they wait on themselves. A held read is cancelled if the entity's connection generation changes before release: credentials are read at send time, so it would otherwise go out as whoever connected meanwhile.
+- **Reads are held; everything else is refused.** Every `getInstanceClient` client holds a read (`get_`/`search_`/`describe_`/`list_`/`read_`…) while its entity is `down` and sends it on recovery, but refuses a write at once with `ERR_TARGET_RESTARTING` — a write queued for minutes could land after the user gave up on it, or retried it ([`restartGate.ts`](src/lib/restart/restartGate.ts); the read rule is [`isReadOperation`](src/integrations/api/isReadOperation.ts), shared with the operations console). Token minting counts as a write on purpose, so a route guard's Fabric Connect attempt falls through to sign-in instead of stalling. Requests that drive or watch a restart must pass `skipRestartGate: true`, or they wait on themselves. A held read is cancelled if the entity's connection generation changes before release: credentials are read at send time, so it would otherwise go out as whoever connected meanwhile.
 - **Central manager's operations proxy refuses a transitional target outright** — `400 "Cluster is not active"` / `"Instance is not active"` for any `INACTIVE_STATES` status, which includes a _rolling_ restart's `RESTARTING` cluster — and relays the host manager's connection errors as a `500` carrying the raw error text. That is why a proxied client holds for marks with `proxyRefuses`, and why `isConnectivityFailure` counts those two shapes. The set also covers ERROR, FAILED and the terminal states, which no restart releases: a poll through the proxy must be gated on [`isOperationsProxyRefused`](src/components/ui/utils/badgeStatus.tsx), not `isStoppedOrTransitioning`, or it 400s every tick for as long as the page is open (HarperFast/studio#1569).
 - **Only query errors are muted, and only connectivity-class ones.** Mutations still toast; a 403 or a Harper 500 during a restart still toasts.
 - **Detection is per tab.** A page learns of a container op started elsewhere only from a cluster-record fetch, and the in-cluster studio pages don't poll the cluster, so they don't notice one started in another tab.
@@ -52,6 +62,29 @@ The wide hero artwork spans both columns beneath the form card in three independ
 - **On 5.2+ the first instance is still written and restarted alone.** Only once it is back up on the new config is the write fanned out with `replicated: true` from that instance — even when it was the last instance to restart, because the fan-out also reaches live members Studio does not restart (not RUNNING, or failed earlier), which the per-instance path leaves on the old config. Fanning out first would leave an unproven config pending on every node, which a Cancel could no longer contain.
 - **A later instance skips its write only when the fan-out acknowledged that exact node** — its CM `replicationFqdn` (lower-cased) appears among the successful `replicated[]` entries. Fabric names each Harper node after that FQDN (host-manager sets `NODE_HOSTNAME` and `REPLICATION_HOSTNAME` to it). A count of acknowledgements is not proof: the origin's replication peers are not CM's restart targets, so a stale peer can stand in for a missing one. A target with no `replicationFqdn`, a rejected fan-out (the instance client rejects any response with a failed peer), or a response with no usable `replicated[]` all keep the per-instance write.
 
+## Instance clients replay only reads
+
+Every `getInstanceClient` client replays a 502/503/504 up to three times (5s/10s/20s), but only for a request [`isReadRequest`](src/integrations/api/isReadOperation.ts) accepts: a GET, or a POST whose body's `operation` is a read by Harper's naming — the restart gate's rule, one predicate for both ([`retryGatewayErrors.ts`](src/integrations/api/retryGatewayErrors.ts)). A write is sent once and its first 5xx is final, because no gateway status proves the write was not applied: Harper itself answers 503 after handing an operation to a worker that exits or overruns. Do not add an exemption for a "usually safe" status or a write that looks idempotent; a caller whose write is safe to repeat retries it itself, where it can say why.
+
+## A write with no verdict never reads as failed
+
+The same rule decides what a failure says. [`isUnansweredWrite`](src/integrations/api/unansweredWrite.ts) is a request `isReadRequest` rejects, answered 502/503/504 or not at all (`ERR_NETWORK`, a timeout). [`describeError`](src/react-query/queryClient.ts) checks it before reading any body and returns "Outcome unknown … check whether it took effect before you try again", so the global mutation toast and every `describeError` caller say so with no copy of their own. Gate on status, never body (a gateway's body describes the gateway), and keep it to display: rewriting `error.message` would defeat `shouldKeepEvent`, which recognises timeouts and `Network Error` by message.
+
+- **A caller that adds its own failure toast to a mutation** asks [`shouldToastOwnFailure`](src/react-query/queryClient.ts) first, so "Failed to …" never sits beside the global warning. A caller with no mutation behind it (rename, the chat tools), or one whose mutation opts out of the global toast (the deploy mutation behind import, redeploy and staged-release activation), shows `describeError`'s text itself, under a title from [`deployFailureTitle`](src/features/instance/applications/modals/reportDeployHealth.ts) for a deploy ("Couldn't confirm … was redeployed", never "Failed to …"), and a loop that tallies one write per target (cluster restart, rolling config, licenses) counts these apart from failures.
+- **Do not re-wrap an AxiosError into a plain `Error`** for a write: the predicate needs its `config`. `secrets.ts` passes an unanswered one through as is.
+- **A restart with no verdict stays marked until its target answers again or the watch gives up**, as an accepted one does, because a gateway can lose the answer to a restart that ran. The Restart button holds the mark while it watches, and the cluster loop waits on that member before restarting the next.
+- **These toasts are never collapsed** onto a shared id: each warns about a different write, and a read timing out alongside one must not replace it through `request-timeout`.
+- **A read that is costly to repeat** stays a read here and opts out of the replay instead (`package_component`, `skipGatewayRetry`).
+
+## A restart Harper accepted never reads as failed
+
+Harper's answer to the restart request is its only verdict on the restart: `restart` answers before it tears down (harper `bin/restart.ts` schedules the teardown 50ms out so the reply can go first) and `restart_service` once its job has started (`executeJob`). So [`restartInstance`](src/integrations/api/instance/status/restartInstance.ts) rejects with the request's own error only when that request failed; after a 2xx, a target Studio never sees answer the `user_info` watch successfully rejects with [`RestartUnconfirmedError`](src/integrations/api/instance/status/restartUnconfirmed.ts), which reads "Not back yet", never "Failed", and is never a reason to send the restart again.
+
+- **The watch outlasts the usual recovery time** (one settle, then two probe schedules), and `onSlowToReturn` fires once between them so a caller can say it is still waiting. Every restart mark uses `RESTART_MARK_TTL_MS`, derived from the same constants, so no mark lapses while its watch still runs; the probes skip the gateway replay for the same reason.
+- **Only a successful probe counts as back, never a 401/403.** Through central manager's operations proxy a 403 is CM refusing the caller before it contacts the instance (`notAllowed()` in its `HDBInstance.js`), so it says nothing about the target; reading it as "back" would report a restart Studio never saw finish. That is also why the copy says Studio "couldn't confirm it came back", not that the target never answered.
+- **A one-at-a-time loop stops at a member that is not back** (cluster restart, rolling config update): restarting the next one could leave no member serving. Both loops also wait on a member whose restart got no verdict, and stop if that follow-up watch gives up too: it may have restarted and still be down, or, in a config update, restarted onto a configuration that broke it. Either report names the members it left alone, and it, like the no-verdict warning, outranks Cancel, which would otherwise hide the warning not to restart again; the report then says which members Cancel left. A Cancel clicked during a member's configuration write stops before its restart, and the report says the configuration may be pending there. On a 5.2+ cluster the config update never fans out from a canary that is not back, since it never proved it can run the configuration; a stop after the fan-out keeps the note that the members it left may already have the new configuration saved.
+- **The chat tools return `success: true`** for it: their action was carried out, and `false` invites the agent to repeat it.
+
 ## Cluster upgrade picker — which versions an existing cluster is offered
 
 [`buildUpgradeVersionOptions`](src/features/clusters/upsert/lib/buildUpgradeVersionOptions.ts) is the one place that decides, and its test file is the spec. Two rules, and they differ on purpose:
diff --git a/src/features/auth/describeAuthFailure.ts b/src/features/auth/describeAuthFailure.ts
index c866db7ba..fd957b168 100644
--- a/src/features/auth/describeAuthFailure.ts
+++ b/src/features/auth/describeAuthFailure.ts
@@ -1,3 +1,4 @@
+import { NO_RESPONSE_CODES } from '@/integrations/api/unansweredWrite';
 import { describeError } from '@/react-query/queryClient';
 import { AxiosError } from 'axios';
 
@@ -15,24 +16,15 @@ export const OUTCOME_UNKNOWN_MESSAGE =
 	"We didn't get an answer from the server, so we can't tell whether that went through.";
 
 // 503 alone: the server is declining requests, so it very likely never processed this one and a
-// plain retry is honest. (`curryRetryGatewayErrors` also classes 502/504 as retryable, but it is
-// installed on instance clients only, never on `apiClient` — nothing retries these calls
-// automatically, and the retry this copy invites is the user's own.)
+// plain retry is honest. (`curryRetryGatewayErrors` replays 502/503/504, but only for reads and
+// only on instance clients, never on `apiClient` — nothing retries these calls automatically, and
+// the retry this copy invites is the user's own.)
 const TRANSIENT_STATUSES: ReadonlySet<number> = new Set([503]);
 // Every form using this submits a non-idempotent POST, and each of these means the request had
 // already been handed upstream, so the write may have applied (RFC 9110 §9.2.2 — a retry is only
 // safe once you know it did not). Repeating blindly turns a completed sign-up into a 409 with the
 // verification mail already sent (#1668).
 const OUTCOME_UNKNOWN_STATUSES: ReadonlySet<number> = new Set([502, 504]);
-// Axios reports a request that got no response as ERR_NETWORK — including a CORS rejection, and
-// including a connection that dropped *after* the POST was applied — so it cannot be described as
-// "we couldn't reach the server". It is the same unknown outcome. ECONNABORTED/ETIMEDOUT are the
-// timeout pair; which one axios uses depends on `transitional.clarifyTimeoutError`.
-const OUTCOME_UNKNOWN_CODES: ReadonlySet<string> = new Set([
-	AxiosError.ERR_NETWORK,
-	AxiosError.ETIMEDOUT,
-	AxiosError.ECONNABORTED,
-]);
 
 /**
  * Our own copy for a failure the server's own words shouldn't answer, or `undefined` to defer.
@@ -64,7 +56,7 @@ export function describeRetryableAuthFailure(rawErr: unknown, outcomeUnknownReco
 	// ERR_CANCELED is a local abort that reached nothing, and a config fault (ERR_INVALID_URL,
 	// ERR_BAD_OPTION) never left the browser — none of those is ours to describe.
 	const code = axiosErr?.code;
-	return typeof code === 'string' && OUTCOME_UNKNOWN_CODES.has(code) ? outcomeUnknown : undefined;
+	return typeof code === 'string' && NO_RESPONSE_CODES.has(code) ? outcomeUnknown : undefined;
 }
 
 /** Display text for an auth-form rejection, preferring whatever the server said. */
diff --git a/src/features/cluster/domains/Management.test.tsx b/src/features/cluster/domains/Management.test.tsx
index b2e99421d..2e460097e 100644
--- a/src/features/cluster/domains/Management.test.tsx
+++ b/src/features/cluster/domains/Management.test.tsx
@@ -3,7 +3,7 @@
  */
 import { MutationCache, onlineManager, QueryCache, QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { act, fireEvent, render, waitFor, within } from '@testing-library/react';
-import { AxiosError } from 'axios';
+import { AxiosError, type InternalAxiosRequestConfig } from 'axios';
 import { PropsWithChildren, Suspense } from 'react';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
@@ -30,6 +30,7 @@ vi.mock('@/hooks/usePermissions', () => ({
 const { instancePost } = vi.hoisted(() => ({ instancePost: vi.fn() }));
 vi.mock('@/config/getInstanceClient', () => ({ getInstanceClient: () => ({ post: instancePost }) }));
 
+import { describeUnansweredWrites, OUTCOME_UNKNOWN_TITLE } from '@/integrations/api/unansweredWrite';
 import { mutationErrorHandler, queryErrorHandler } from '@/react-query/queryClient';
 import { toast } from 'sonner';
 
@@ -1121,3 +1122,49 @@ describe('DomainsManagement — the Remove Domain tooltip', () => {
 		expect(pendingCell.querySelectorAll('[tabindex]')).toHaveLength(0);
 	});
 });
+
+describe('validating pending domains', () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+	});
+
+	it('says a validation that got no answer may have gone through, and refreshes the list to show it', async () => {
+		get.mockImplementation((url: string) =>
+			url.startsWith('/Domain/')
+				? Promise.resolve({
+					data: [
+						{ id: 'dom-1', domain: 'a.example.com', status: 'PENDING_VALIDATION' },
+						{ id: 'dom-2', domain: 'b.example.com', status: 'PENDING_VALIDATION' },
+					],
+				})
+				: Promise.resolve({ data: { id: 'clu-1', organizationId: 'org-1', status: 'RUNNING', domainIds: [] } })
+		);
+		post.mockImplementation((url: string) => {
+			const config = { method: 'post', url } as InternalAxiosRequestConfig;
+			return Promise.reject(
+				url.includes('dom-1')
+					? new AxiosError('timeout of 60000ms exceeded', AxiosError.ECONNABORTED, config)
+					: new AxiosError('Request failed with status code 400', AxiosError.ERR_BAD_REQUEST, config, undefined, {
+						status: 400,
+						statusText: '',
+						data: 'TXT record not found',
+						headers: {},
+						config,
+					}),
+			);
+		});
+		const { container } = renderManagement();
+		const validateButton = () => container.querySelector<HTMLButtonElement>('button[accesskey="r"]');
+		await waitFor(() => expect(validateButton()?.disabled).toBe(false));
+		const fetchesBefore = domainListFetches();
+
+		fireEvent.click(validateButton()!);
+
+		await waitFor(() => expect(toast.error).toHaveBeenCalled());
+		expect(toast.error).toHaveBeenCalledWith(OUTCOME_UNKNOWN_TITLE, {
+			description: `${describeUnansweredWrites(1)} 1 other domain failed to validate.`,
+			id: 'validatingDomains',
+		});
+		expect(domainListFetches()).toBeGreaterThan(fetchesBefore);
+	});
+});
diff --git a/src/features/cluster/domains/Management.tsx b/src/features/cluster/domains/Management.tsx
index 0fc8204d6..d8a71da46 100644
--- a/src/features/cluster/domains/Management.tsx
+++ b/src/features/cluster/domains/Management.tsx
@@ -40,6 +40,7 @@ import { getOrganizationDomainsQueryOptions } from '@/features/organization/quer
 import { useOrganizationRolePermissions } from '@/hooks/usePermissions';
 import { useRefreshClick } from '@/hooks/useRefreshClick';
 import { SchemaOrganizationDomain } from '@/integrations/api/api.patch';
+import { describeUnansweredWrites, isUnansweredWrite, OUTCOME_UNKNOWN_TITLE } from '@/integrations/api/unansweredWrite';
 import { pluralize } from '@/lib/pluralize';
 import { describeError } from '@/react-query/queryClient';
 import { zodResolver } from '@hookform/resolvers/zod';
@@ -235,6 +236,7 @@ export function DomainsManagement() {
 		const id = 'validatingDomains';
 		let checked = 0;
 		let failed = 0;
+		let unanswered = 0;
 		for (const pendingDomain of pendingDomains) {
 			try {
 				toast.loading(message, {
@@ -242,11 +244,24 @@ export function DomainsManagement() {
 					id,
 				});
 				await validateDomainInOrganization(pendingDomain.id);
-			} catch {
-				failed += 1;
+			} catch (error) {
+				if (isUnansweredWrite(error)) {
+					unanswered += 1;
+				} else {
+					failed += 1;
+				}
 			}
 		}
-		if (failed > 0) {
+		if (unanswered > 0) {
+			await refetch();
+			toast.error(OUTCOME_UNKNOWN_TITLE, {
+				description: [
+					describeUnansweredWrites(unanswered),
+					failed > 0 && `${pluralize(failed, 'other domain', 'other domains')} failed to validate.`,
+				].filter(Boolean).join(' '),
+				id,
+			});
+		} else if (failed > 0) {
 			toast.error('Validation failed!', {
 				description:
 					`Please make sure the TXT record has been put in place. You may need to wait a bit for the DNS change to propagate.`,
diff --git a/src/features/clusters/components/ClusterCard.tsx b/src/features/clusters/components/ClusterCard.tsx
index 9c10485be..596ecd766 100644
--- a/src/features/clusters/components/ClusterCard.tsx
+++ b/src/features/clusters/components/ClusterCard.tsx
@@ -28,6 +28,7 @@ import { excludeFalsy } from '@/lib/arrays/excludeFalsy';
 import { LocalStorageKeys } from '@/lib/storage/localStorageKeys';
 import { buildAbsoluteLinkToPage } from '@/lib/urls/buildAbsoluteLinkToPage';
 import { getOperationsUrlForCluster } from '@/lib/urls/getOperationsUrlForCluster';
+import { shouldToastOwnFailure } from '@/react-query/queryClient';
 import { useQueryClient } from '@tanstack/react-query';
 import { Link, useRouter } from '@tanstack/react-router';
 import {
@@ -146,17 +147,19 @@ export function ClusterCard({ item: summary }: { item: ClusterListItem }) {
 				});
 				setIsTerminateClusterModalOpen(false);
 			},
-			onError: () => {
-				toast.error('Error', {
-					description: isSelfManaged
-						? `Failed to remove cluster: ${cluster.name}`
-						: `Failed to terminate cluster: ${cluster.name}.`,
-					duration: 5000,
-					action: {
-						label: 'Dismiss',
-						onClick: () => toast.dismiss(),
-					},
-				});
+			onError: (error) => {
+				if (shouldToastOwnFailure(error)) {
+					toast.error('Error', {
+						description: isSelfManaged
+							? `Failed to remove cluster: ${cluster.name}`
+							: `Failed to terminate cluster: ${cluster.name}.`,
+						duration: 5000,
+						action: {
+							label: 'Dismiss',
+							onClick: () => toast.dismiss(),
+						},
+					});
+				}
 				setIsTerminateClusterModalOpen(false);
 			},
 		});
diff --git a/src/features/instance/InstanceNavBar.test.tsx b/src/features/instance/InstanceNavBar.test.tsx
new file mode 100644
index 000000000..89cc61d68
--- /dev/null
+++ b/src/features/instance/InstanceNavBar.test.tsx
@@ -0,0 +1,42 @@
+/** @vitest-environment jsdom */
+import { InstanceNavBar } from '@/features/instance/InstanceNavBar';
+import { cleanup, render, screen } from '@testing-library/react';
+import type { ReactNode } from 'react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+const { permission } = vi.hoisted(() => ({ permission: { canManage: true } }));
+
+vi.mock('@/hooks/usePermissions', () => ({ useInstanceManagePermission: () => permission.canManage }));
+vi.mock('@/config/useInstanceClient', () => ({ useInstanceClientIdParams: () => ({}) }));
+vi.mock('@/components/Breadcrumbs', () => ({ Breadcrumbs: () => null }));
+vi.mock('@tanstack/react-query', async (importOriginal) => ({
+	...(await importOriginal<typeof import('@tanstack/react-query')>()),
+	useQuery: () => ({ data: undefined }),
+}));
+vi.mock('@tanstack/react-router', () => ({
+	Link: ({ to, children, 'aria-label': ariaLabel }: { to: string; children: ReactNode; 'aria-label'?: string }) => (
+		<a href={to} aria-label={ariaLabel}>{children}</a>
+	),
+	useLoaderData: () => ({ version: '5.3.0' }),
+	useParams: () => ({ organizationId: 'org-1', clusterId: 'clu-1', instanceId: 'ins-1' }),
+}));
+
+afterEach(cleanup);
+
+describe('InstanceNavBar', () => {
+	it('offers the operations console to a super user', () => {
+		permission.canManage = true;
+		render(<InstanceNavBar />);
+
+		expect(screen.getByRole('link', { name: 'Operations' }).getAttribute('href'))
+			.toBe('/org-1/clu-1/instance/ins-1/operations');
+	});
+
+	it('hides it from anyone else', () => {
+		permission.canManage = false;
+		render(<InstanceNavBar />);
+
+		expect(screen.queryByRole('link', { name: 'Operations' })).toBeNull();
+		expect(screen.getByRole('link', { name: 'Databases' })).toBeTruthy();
+	});
+});
diff --git a/src/features/instance/InstanceNavBar.tsx b/src/features/instance/InstanceNavBar.tsx
index 2bf185988..8581cb185 100644
--- a/src/features/instance/InstanceNavBar.tsx
+++ b/src/features/instance/InstanceNavBar.tsx
@@ -18,7 +18,16 @@ import { wasAReleasedBeforeB } from '@/lib/string/wasAReleasedBeforeB';
 import { buildAbsoluteLinkToPage } from '@/lib/urls/buildAbsoluteLinkToPage';
 import { useQuery } from '@tanstack/react-query';
 import { Link, useLoaderData, useParams } from '@tanstack/react-router';
-import { DatabaseIcon, GaugeIcon, Menu, NotepadTextIcon, PackageIcon, ServerIcon, SettingsIcon } from 'lucide-react';
+import {
+	DatabaseIcon,
+	GaugeIcon,
+	Menu,
+	NotepadTextIcon,
+	PackageIcon,
+	ServerIcon,
+	SettingsIcon,
+	SquareTerminalIcon,
+} from 'lucide-react';
 import { ReactNode, useMemo } from 'react';
 
 interface Link {
@@ -67,6 +76,11 @@ export function InstanceNavBar() {
 				name: 'APIs',
 				icon: <ServerIcon className="inline-block" />,
 			},
+			canManage && {
+				to: buildAbsoluteLinkToPage(params, 'operations'),
+				name: 'Operations',
+				icon: <SquareTerminalIcon className="inline-block" />,
+			},
 			canManage && statusAvailable && {
 				to: buildAbsoluteLinkToPage(params, 'status'),
 				icon: <GaugeIcon className="inline-block" />,
diff --git a/src/features/instance/applications/components/Chat/tools/createApp/execute.ts b/src/features/instance/applications/components/Chat/tools/createApp/execute.ts
index 1f6e53f5a..b8bdf84f0 100644
--- a/src/features/instance/applications/components/Chat/tools/createApp/execute.ts
+++ b/src/features/instance/applications/components/Chat/tools/createApp/execute.ts
@@ -1,6 +1,7 @@
 import { templates } from '@/features/instance/applications/components/NewApplication/templates';
 import { addComponent } from '@/integrations/api/instance/applications/addComponent';
 import { restartInstance } from '@/integrations/api/instance/status/restartInstance';
+import { RestartUnconfirmedError } from '@/integrations/api/instance/status/restartUnconfirmed';
 import { findBy } from '@/lib/arrays/findBy';
 import { emitToListeners } from '@/lib/events/listener';
 import { toKebabCase } from '@/lib/string/to-kebab-case';
@@ -8,6 +9,7 @@ import { inputSchema } from '@harperfast/agent-tools/tools/createApp/inputSchema
 import { toast } from 'sonner';
 import { z } from 'zod';
 import { ExecuteParams } from '../../types/executeParams';
+import { describeToolError, toastToolFailure } from '../describeToolError';
 import { Output } from './output';
 
 export async function execute(
@@ -37,9 +39,10 @@ export async function execute(
 			template: template.npm || template.githubUrl,
 		});
 	} catch (err) {
+		toastToolFailure(toastId, err);
 		return {
 			success: false,
-			message: `Error: ${err}`,
+			message: `Error: ${describeToolError(err)}`,
 		};
 	}
 
@@ -58,9 +61,20 @@ export async function execute(
 			replicated: instanceClientParams.entityType === 'cluster',
 		});
 	} catch (err) {
+		toastToolFailure(toastId, err);
+		if (err instanceof RestartUnconfirmedError) {
+			// The app exists either way; `success: false` would invite creating it again.
+			return {
+				success: true,
+				message: `App "${name}" created. Harper accepted the restart that loads it, but Studio couldn't confirm `
+					+ "the instance came back, so it may still be starting. Don't create the app or restart again until "
+					+ 'its status shows it is back.',
+				webURL: baseURL,
+			};
+		}
 		return {
 			success: false,
-			message: `Error: ${err}`,
+			message: `Error: ${describeToolError(err)}`,
 		};
 	}
 
diff --git a/src/features/instance/applications/components/Chat/tools/deleteTableRecords/execute.ts b/src/features/instance/applications/components/Chat/tools/deleteTableRecords/execute.ts
index cb41f2ff9..683337bb5 100644
--- a/src/features/instance/applications/components/Chat/tools/deleteTableRecords/execute.ts
+++ b/src/features/instance/applications/components/Chat/tools/deleteTableRecords/execute.ts
@@ -3,6 +3,7 @@ import { queryClient } from '@/react-query/queryClient';
 import { inputSchema } from '@harperfast/agent-tools/tools/deleteTableRecords/inputSchema';
 import { z } from 'zod';
 import { ExecuteParams } from '../../types/executeParams';
+import { describeToolError } from '../describeToolError';
 import { Output } from './output';
 
 export async function execute(
@@ -24,7 +25,7 @@ export async function execute(
 	} catch (err) {
 		return {
 			success: false,
-			message: `Error: ${err}`,
+			message: `Error: ${describeToolError(err)}`,
 		};
 	}
 }
diff --git a/src/features/instance/applications/components/Chat/tools/describeToolError.ts b/src/features/instance/applications/components/Chat/tools/describeToolError.ts
new file mode 100644
index 000000000..31c027455
--- /dev/null
+++ b/src/features/instance/applications/components/Chat/tools/describeToolError.ts
@@ -0,0 +1,13 @@
+import { isUnansweredWrite, UNANSWERED_WRITE_MESSAGE } from '@/integrations/api/unansweredWrite';
+import { describeError } from '@/react-query/queryClient';
+import { toast } from 'sonner';
+
+export function describeToolError(err: unknown): string {
+	return isUnansweredWrite(err) ? UNANSWERED_WRITE_MESSAGE : String(err);
+}
+
+/** A loading toast never dismisses itself, so a failed tool must replace its progress toast. */
+export function toastToolFailure(toastId: string | number, err: unknown) {
+	const { title, description } = describeError(err);
+	toast.error(title, { id: toastId, description, duration: 10_000 });
+}
diff --git a/src/features/instance/applications/components/Chat/tools/dropComponentFile/execute.ts b/src/features/instance/applications/components/Chat/tools/dropComponentFile/execute.ts
index fe9715563..0d022447e 100644
--- a/src/features/instance/applications/components/Chat/tools/dropComponentFile/execute.ts
+++ b/src/features/instance/applications/components/Chat/tools/dropComponentFile/execute.ts
@@ -2,6 +2,7 @@ import { dropComponent } from '@/integrations/api/instance/applications/dropComp
 import { inputSchema } from '@harperfast/agent-tools/tools/dropComponentFile/inputSchema';
 import { z } from 'zod';
 import { ExecuteParams } from '../../types/executeParams';
+import { describeToolError } from '../describeToolError';
 import { Output } from './output';
 
 export async function execute(
@@ -19,7 +20,7 @@ export async function execute(
 	} catch (err) {
 		return {
 			success: false,
-			message: `Error: ${err}`,
+			message: `Error: ${describeToolError(err)}`,
 		};
 	}
 }
diff --git a/src/features/instance/applications/components/Chat/tools/getUserContext/execute.ts b/src/features/instance/applications/components/Chat/tools/getUserContext/execute.ts
index 27b766e17..6ec859174 100644
--- a/src/features/instance/applications/components/Chat/tools/getUserContext/execute.ts
+++ b/src/features/instance/applications/components/Chat/tools/getUserContext/execute.ts
@@ -29,6 +29,13 @@ export async function execute(
 		};
 	}
 
+	if (url.endsWith('/operations')) {
+		return {
+			success: true,
+			description: 'sending raw requests from the operations API console',
+		};
+	}
+
 	if (url.endsWith('/status')) {
 		return {
 			success: true,
diff --git a/src/features/instance/applications/components/Chat/tools/insertTableRecords/execute.ts b/src/features/instance/applications/components/Chat/tools/insertTableRecords/execute.ts
index fd6af4be4..dabdcf37c 100644
--- a/src/features/instance/applications/components/Chat/tools/insertTableRecords/execute.ts
+++ b/src/features/instance/applications/components/Chat/tools/insertTableRecords/execute.ts
@@ -3,6 +3,7 @@ import { queryClient } from '@/react-query/queryClient';
 import { inputSchema } from '@harperfast/agent-tools/tools/insertTableRecords/inputSchema';
 import { z } from 'zod';
 import { ExecuteParams } from '../../types/executeParams';
+import { describeToolError } from '../describeToolError';
 import { Output } from './output';
 
 export async function execute(
@@ -24,7 +25,7 @@ export async function execute(
 	} catch (err) {
 		return {
 			success: false,
-			message: `Error: ${err}`,
+			message: `Error: ${describeToolError(err)}`,
 		};
 	}
 }
diff --git a/src/features/instance/applications/components/Chat/tools/restartHTTPService/execute.ts b/src/features/instance/applications/components/Chat/tools/restartHTTPService/execute.ts
index fb054f514..d2e5abb91 100644
--- a/src/features/instance/applications/components/Chat/tools/restartHTTPService/execute.ts
+++ b/src/features/instance/applications/components/Chat/tools/restartHTTPService/execute.ts
@@ -1,8 +1,10 @@
 import { restartInstance } from '@/integrations/api/instance/status/restartInstance';
+import { RestartUnconfirmedError } from '@/integrations/api/instance/status/restartUnconfirmed';
 import { inputSchema } from '@harperfast/agent-tools/tools/restartHTTPService/inputSchema';
 import { toast } from 'sonner';
 import { z } from 'zod';
 import { ExecuteParams } from '../../types/executeParams';
+import { describeToolError, toastToolFailure } from '../describeToolError';
 import { Output } from './output';
 
 export async function execute(
@@ -20,9 +22,20 @@ export async function execute(
 			replicated: instanceClientParams.entityType === 'cluster',
 		});
 	} catch (err) {
+		toastToolFailure(toastId, err);
+		if (err instanceof RestartUnconfirmedError) {
+			// `success` is whether the tool's own action was carried out, and Harper accepted the restart.
+			return {
+				success: true,
+				message: "Harper accepted the restart, but Studio couldn't confirm the HTTP service came back, so it may "
+					+ "still be starting. Don't restart it again until its status shows it is back, or it goes down a "
+					+ 'second time.',
+				webURL: baseURL,
+			};
+		}
 		return {
 			success: false,
-			message: `Error: ${err}`,
+			message: `Error: ${describeToolError(err)}`,
 		};
 	}
 
diff --git a/src/features/instance/applications/components/Chat/tools/restartTools.test.ts b/src/features/instance/applications/components/Chat/tools/restartTools.test.ts
new file mode 100644
index 000000000..a3aae6441
--- /dev/null
+++ b/src/features/instance/applications/components/Chat/tools/restartTools.test.ts
@@ -0,0 +1,101 @@
+import {
+	RESTART_UNCONFIRMED_MESSAGE,
+	RESTART_UNCONFIRMED_TITLE,
+	RestartUnconfirmedError,
+} from '@/integrations/api/instance/status/restartUnconfirmed';
+import { AxiosError } from 'axios';
+import { toast } from 'sonner';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import type { ExecuteParams } from '../types/executeParams';
+import { execute as createApp } from './createApp/execute';
+import { execute as restartHTTPService } from './restartHTTPService/execute';
+
+vi.mock('@/integrations/api/instance/status/restartInstance', () => ({ restartInstance: vi.fn() }));
+vi.mock('@/integrations/api/instance/applications/addComponent', () => ({ addComponent: vi.fn() }));
+vi.mock('@/lib/events/listener', () => ({ emitToListeners: vi.fn() }));
+vi.mock('sonner', () => ({
+	toast: { loading: vi.fn(() => 'tool-toast'), error: vi.fn(), success: vi.fn() },
+}));
+
+import { addComponent } from '@/integrations/api/instance/applications/addComponent';
+import { restartInstance } from '@/integrations/api/instance/status/restartInstance';
+
+function params<T>(input: T): ExecuteParams<T> {
+	return {
+		input,
+		instanceClientParams: { entityType: 'instance', entityId: 'ins-1' } as ExecuteParams['instanceClientParams'],
+		baseURL: 'https://ins-1.example.com',
+		params: {},
+	};
+}
+
+const notBackYet = () => new RestartUnconfirmedError(new AxiosError('Network Error', AxiosError.ERR_NETWORK));
+
+function refused() {
+	const config = { method: 'post', data: { operation: 'restart_service' } } as never;
+	return new AxiosError('Request failed with status code 403', AxiosError.ERR_BAD_REQUEST, config, undefined, {
+		status: 403,
+		statusText: '',
+		data: { error: 'This operation is restricted to super users' },
+		headers: {},
+		config,
+	});
+}
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	vi.mocked(addComponent).mockResolvedValue({} as never);
+});
+
+describe('restartHTTPService', () => {
+	it('tells the agent a restart Harper accepted is not back yet, and not to restart it again', async () => {
+		vi.mocked(restartInstance).mockRejectedValue(notBackYet());
+
+		const output = await restartHTTPService(params({}));
+
+		expect(output.success).toBe(true);
+		expect(output.message).not.toMatch(/^Error/);
+		expect(output.message).toContain("Don't restart it again");
+		expect(restartInstance).toHaveBeenCalledOnce();
+		expect(toast.error).toHaveBeenCalledWith(
+			RESTART_UNCONFIRMED_TITLE,
+			expect.objectContaining({
+				id: 'tool-toast',
+				description: RESTART_UNCONFIRMED_MESSAGE,
+			}),
+		);
+	});
+
+	it('still reports a refused restart as an error, and clears its progress toast', async () => {
+		vi.mocked(restartInstance).mockRejectedValue(refused());
+
+		const output = await restartHTTPService(params({}));
+
+		expect(output.success).toBe(false);
+		expect(output.message).toMatch(/^Error: /);
+		expect(toast.error).toHaveBeenCalledWith('Error', expect.objectContaining({ id: 'tool-toast' }));
+	});
+});
+
+describe('createApp', () => {
+	it('keeps the fact that the app was created when its restart is not back yet', async () => {
+		vi.mocked(restartInstance).mockRejectedValue(notBackYet());
+
+		const output = await createApp(params({ name: 'My App', type: 'vanilla' as const }));
+
+		expect(output.success).toBe(true);
+		expect(output.message).toMatch(/^App "my-app" created\. Harper accepted the restart/);
+		expect(output.message).toContain("Don't create the app or restart again");
+		expect(addComponent).toHaveBeenCalledOnce();
+	});
+
+	it('clears its progress toast when the app could not be created', async () => {
+		vi.mocked(addComponent).mockRejectedValue(new Error('Component my-app already exists'));
+
+		const output = await createApp(params({ name: 'My App', type: 'vanilla' as const }));
+
+		expect(output.success).toBe(false);
+		expect(restartInstance).not.toHaveBeenCalled();
+		expect(toast.error).toHaveBeenCalledWith(expect.any(String), expect.objectContaining({ id: 'tool-toast' }));
+	});
+});
diff --git a/src/features/instance/applications/components/Chat/tools/setComponentFile/execute.ts b/src/features/instance/applications/components/Chat/tools/setComponentFile/execute.ts
index 5b5b02af1..614ee120c 100644
--- a/src/features/instance/applications/components/Chat/tools/setComponentFile/execute.ts
+++ b/src/features/instance/applications/components/Chat/tools/setComponentFile/execute.ts
@@ -4,6 +4,7 @@ import { queryClient } from '@/react-query/queryClient';
 import { inputSchema } from '@harperfast/agent-tools/tools/setComponentFile/inputSchema';
 import { z } from 'zod';
 import { ExecuteParams } from '../../types/executeParams';
+import { describeToolError } from '../describeToolError';
 import { Output } from './output';
 
 export async function execute(
@@ -27,7 +28,7 @@ export async function execute(
 	} catch (err) {
 		return {
 			success: false,
-			message: `Error: ${err}`,
+			message: `Error: ${describeToolError(err)}`,
 		};
 	}
 }
diff --git a/src/features/instance/applications/components/Chat/tools/updateTableRecords/execute.ts b/src/features/instance/applications/components/Chat/tools/updateTableRecords/execute.ts
index 730c8fbda..fe8fe2302 100644
--- a/src/features/instance/applications/components/Chat/tools/updateTableRecords/execute.ts
+++ b/src/features/instance/applications/components/Chat/tools/updateTableRecords/execute.ts
@@ -3,6 +3,7 @@ import { queryClient } from '@/react-query/queryClient';
 import { inputSchema } from '@harperfast/agent-tools/tools/updateTableRecords/inputSchema';
 import { z } from 'zod';
 import { ExecuteParams } from '../../types/executeParams';
+import { describeToolError } from '../describeToolError';
 import { Output } from './output';
 
 export async function execute(
@@ -24,7 +25,7 @@ export async function execute(
 	} catch (err) {
 		return {
 			success: false,
-			message: `Error: ${err}`,
+			message: `Error: ${describeToolError(err)}`,
 		};
 	}
 }
diff --git a/src/features/instance/applications/components/NewApplication/useImportApplication.test.ts b/src/features/instance/applications/components/NewApplication/useImportApplication.test.ts
index e7d4e149c..9ce0e9a2f 100644
--- a/src/features/instance/applications/components/NewApplication/useImportApplication.test.ts
+++ b/src/features/instance/applications/components/NewApplication/useImportApplication.test.ts
@@ -52,6 +52,7 @@ vi.mock('@/integrations/api/instance/applications/deployComponentStream', () =>
 
 import { deployComponentStream } from '@/integrations/api/instance/applications/deployComponentStream';
 import { SSEInconclusiveError } from '@/integrations/api/sse/errors';
+import { UNANSWERED_WRITE_MESSAGE } from '@/integrations/api/unansweredWrite';
 import { mutationErrorHandler } from '@/react-query/queryClient';
 import { MutationCache, QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { act, renderHook, waitFor } from '@testing-library/react';
@@ -260,6 +261,37 @@ describe('useImportApplication', () => {
 		expect(mocks.post).toHaveBeenCalledWith('/', expect.objectContaining({ activate: false }), expect.anything());
 	});
 
+	it.each([
+		[false, "Couldn't confirm my-app was imported"],
+		[true, "Couldn't confirm my-app was staged"],
+	])('never calls a deploy that got no verdict failed (stage: %s)', async (stageOnly, title) => {
+		mocks.canStage.enabled = stageOnly;
+		const config = {
+			headers: new AxiosHeaders(),
+			method: 'post',
+			data: JSON.stringify({ operation: 'deploy_component' }),
+		} as InternalAxiosRequestConfig;
+		mocks.post.mockRejectedValue(new AxiosError('timeout of 300000ms exceeded', AxiosError.ECONNABORTED, config));
+		const { result } = renderImport();
+
+		act(() => result.current.importApplication({ contents: { ...contents, stageOnly }, project: 'my-app' }));
+
+		await waitFor(() => expect(result.current.importFailure).toEqual({ title, message: UNANSWERED_WRITE_MESSAGE }));
+		expect(vi.mocked(toast.error)).not.toHaveBeenCalled();
+		// It may have imported, so the tree the message says to check is reloaded.
+		expect(mocks.editorView.reloadRootEntries).toHaveBeenCalledOnce();
+	});
+
+	it('reloads nothing after an import Harper refused', async () => {
+		mocks.post.mockRejectedValue(serverFailure({ error: 'Component my-app could not be loaded' }));
+		const { result } = renderImport();
+
+		act(() => result.current.importApplication({ contents, project: 'my-app' }));
+
+		await waitFor(() => expect(result.current.importFailure).toBeDefined());
+		expect(mocks.editorView.reloadRootEntries).not.toHaveBeenCalled();
+	});
+
 	describe('a rollout that settles after the form has gone', () => {
 		function deployThenFollow(job: () => Promise<unknown>) {
 			mocks.post.mockImplementation((_url: string, body: { operation: string }) =>
diff --git a/src/features/instance/applications/components/NewApplication/useImportApplication.ts b/src/features/instance/applications/components/NewApplication/useImportApplication.ts
index 83ab4cd48..876b7c191 100644
--- a/src/features/instance/applications/components/NewApplication/useImportApplication.ts
+++ b/src/features/instance/applications/components/NewApplication/useImportApplication.ts
@@ -6,12 +6,17 @@ import {
 	useStagedDeploymentsAvailable,
 	useSupportsDeploymentSSE,
 } from '@/features/instance/applications/hooks/useSupportsDeploymentSSE';
-import { reportDeployOutcome, reportStaged } from '@/features/instance/applications/modals/reportDeployHealth';
+import {
+	deployFailureTitle,
+	reportDeployOutcome,
+	reportStaged,
+} from '@/features/instance/applications/modals/reportDeployHealth';
 import { useDeployComponentMutation } from '@/integrations/api/instance/applications/deployComponent';
 import { DeployComponentResult } from '@/integrations/api/instance/applications/deployComponentStream';
 import { deployFailureDetails } from '@/integrations/api/instance/applications/deployOutcome';
 import { DeployRolloutError } from '@/integrations/api/instance/applications/restartJob';
 import { SSEInconclusiveError } from '@/integrations/api/sse/errors';
+import { isUnansweredWrite } from '@/integrations/api/unansweredWrite';
 import { invalidateEntityQueries } from '@/react-query/invalidateEntityQueries';
 import { describeError } from '@/react-query/queryClient';
 import { useQueryClient } from '@tanstack/react-query';
@@ -149,7 +154,12 @@ export function useImportApplication(
 				});
 				return;
 			}
-			const title = `Failed to ${stage ? 'stage' : 'import'} ${project}`;
+			const title = deployFailureTitle(error, project, stage ? 'stage' : 'import');
+			if (isUnansweredWrite(error)) {
+				// It may have imported, so what the message says to check must be current.
+				void invalidateEntityQueries(queryClient, entityId);
+				void reloadRootEntries();
+			}
 			const { message } = describeError(error);
 			if (formEntity.current === entityId) {
 				setImportFailure({ entityId, failure: { title, message, deploymentId } });
@@ -174,7 +184,17 @@ export function useImportApplication(
 				duration: 5_000,
 			});
 		}
-	}, [mutateAsync, sseDeploy, canStage, instanceParams, runHealthCheck, onImported, recordAction]);
+	}, [
+		mutateAsync,
+		sseDeploy,
+		canStage,
+		instanceParams,
+		runHealthCheck,
+		onImported,
+		recordAction,
+		queryClient,
+		reloadRootEntries,
+	]);
 
 	const importApplication = useCallback((args: ImportArgs) => void runImport(args), [runImport]);
 
diff --git a/src/features/instance/applications/hooks/useRenameFiles.test.tsx b/src/features/instance/applications/hooks/useRenameFiles.test.tsx
new file mode 100644
index 000000000..62565e7d1
--- /dev/null
+++ b/src/features/instance/applications/hooks/useRenameFiles.test.tsx
@@ -0,0 +1,63 @@
+/** @vitest-environment jsdom */
+import { dropComponent } from '@/integrations/api/instance/applications/dropComponent';
+import { OUTCOME_UNKNOWN_TITLE, UNANSWERED_WRITE_MESSAGE } from '@/integrations/api/unansweredWrite';
+import { renderHook } from '@testing-library/react';
+import { AxiosError, type InternalAxiosRequestConfig } from 'axios';
+import { toast } from 'sonner';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { useRenameFiles } from './useRenameFiles';
+
+vi.mock('@/config/useInstanceClient', () => ({
+	useInstanceClientIdParams: () => ({ entityId: 'ins-1', entityType: 'instance' }),
+}));
+vi.mock('@/features/instance/applications/hooks/useEditorView', () => ({
+	useEditorView: () => ({ reloadRootEntries: vi.fn(), setFocusedItem: vi.fn(), setSelectedItems: vi.fn() }),
+}));
+vi.mock('@/integrations/api/instance/applications/getComponentFile', () => ({
+	getComponentFile: vi.fn().mockResolvedValue({ message: 'Y29udGVudHM=' }),
+}));
+vi.mock('@/integrations/api/instance/applications/setComponentFile', () => ({
+	setComponentFile: vi.fn().mockResolvedValue({}),
+}));
+vi.mock('@/integrations/api/instance/applications/dropComponent', () => ({ dropComponent: vi.fn() }));
+vi.mock('sonner', () => ({ toast: { loading: vi.fn(() => 'rename-toast'), error: vi.fn(), success: vi.fn() } }));
+
+const dropSent = {
+	method: 'post',
+	data: JSON.stringify({ operation: 'drop_component' }),
+} as InternalAxiosRequestConfig;
+
+function rename() {
+	const { result } = renderHook(() => useRenameFiles());
+	return result.current([{ from: 'app/old.js', to: 'app/new.js' }]);
+}
+
+describe('useRenameFiles', () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+	});
+
+	it('says a rename whose last write got no answer may have gone through', async () => {
+		vi.mocked(dropComponent).mockRejectedValue(
+			new AxiosError('timeout of 60000ms exceeded', AxiosError.ECONNABORTED, dropSent),
+		);
+
+		await expect(rename()).resolves.toBe(false);
+
+		expect(toast.error).toHaveBeenCalledWith(
+			OUTCOME_UNKNOWN_TITLE,
+			expect.objectContaining({ id: 'rename-toast', description: UNANSWERED_WRITE_MESSAGE }),
+		);
+	});
+
+	it('still says a refused rename failed', async () => {
+		vi.mocked(dropComponent).mockRejectedValue(new Error('Unable to locate project'));
+
+		await expect(rename()).resolves.toBe(false);
+
+		expect(toast.error).toHaveBeenCalledWith(
+			'Rename Failed',
+			expect.objectContaining({ id: 'rename-toast', description: 'Unable to locate project' }),
+		);
+	});
+});
diff --git a/src/features/instance/applications/hooks/useRenameFiles.tsx b/src/features/instance/applications/hooks/useRenameFiles.tsx
index 67380b1a8..64a458428 100644
--- a/src/features/instance/applications/hooks/useRenameFiles.tsx
+++ b/src/features/instance/applications/hooks/useRenameFiles.tsx
@@ -4,7 +4,9 @@ import { useEditorView } from '@/features/instance/applications/hooks/useEditorV
 import { dropComponent } from '@/integrations/api/instance/applications/dropComponent';
 import { getComponentFile } from '@/integrations/api/instance/applications/getComponentFile';
 import { setComponentFile } from '@/integrations/api/instance/applications/setComponentFile';
+import { isUnansweredWrite } from '@/integrations/api/unansweredWrite';
 import { pluralize } from '@/lib/pluralize';
+import { describeError } from '@/react-query/queryClient';
 import { useCallback } from 'react';
 import { ExternalToast, toast } from 'sonner';
 
@@ -98,9 +100,13 @@ export function useRenameFiles() {
 				stepForward();
 			}
 		} catch (error) {
-			toast.error('Rename Failed', {
-				id: toastConfig.id,
+			const { title, description } = isUnansweredWrite(error) ? describeError(error) : {
+				title: 'Rename Failed',
 				description: error instanceof Error ? error.message : 'An unexpected error occurred while renaming.',
+			};
+			toast.error(title, {
+				id: toastConfig.id,
+				description,
 				duration: 10000,
 				action: { label: 'OK', onClick: () => undefined },
 			});
diff --git a/src/features/instance/applications/modals/RedeployApplicationModal.test.tsx b/src/features/instance/applications/modals/RedeployApplicationModal.test.tsx
index 4d93c6d35..f071e1cf7 100644
--- a/src/features/instance/applications/modals/RedeployApplicationModal.test.tsx
+++ b/src/features/instance/applications/modals/RedeployApplicationModal.test.tsx
@@ -51,6 +51,7 @@ import {
 	deployComponentStream,
 } from '@/integrations/api/instance/applications/deployComponentStream';
 import { SSEOperationError } from '@/integrations/api/sse/errors';
+import { UNANSWERED_WRITE_MESSAGE } from '@/integrations/api/unansweredWrite';
 import { setWatchedValue } from '@/lib/events/watcher';
 import { mutationErrorHandler } from '@/react-query/queryClient';
 import { MutationCache, QueryClient, QueryClientProvider } from '@tanstack/react-query';
@@ -190,6 +191,77 @@ describe('RedeployApplicationModal', () => {
 		});
 	});
 
+	describe('a redeploy that got no verdict', () => {
+		const unanswered = () =>
+			new AxiosError(
+				'timeout of 300000ms exceeded',
+				AxiosError.ECONNABORTED,
+				{
+					headers: new AxiosHeaders(),
+					method: 'post',
+					data: JSON.stringify({ operation: 'deploy_component' }),
+				} as InternalAxiosRequestConfig,
+			);
+		const COMPONENTS = { queryKey: ['ins-1', 'get_components'], refetchType: 'active' };
+		let invalidate: ReturnType<typeof vi.spyOn>;
+		beforeEach(() => {
+			invalidate = vi.spyOn(QueryClient.prototype, 'invalidateQueries');
+		});
+
+		it("replaces a buffered redeploy's progress toast without calling it failed, and refreshes the list", async () => {
+			mocks.sse.enabled = false;
+			mocks.post.mockRejectedValue(unanswered());
+			await renderOpenModal();
+
+			await submit();
+
+			await waitFor(() => expect(vi.mocked(toast.error)).toHaveBeenCalledOnce());
+			expect(vi.mocked(toast.error)).toHaveBeenCalledWith("Couldn't confirm my-app was redeployed", {
+				id: 'loading-toast',
+				description: UNANSWERED_WRITE_MESSAGE,
+			});
+			expect(invalidate).toHaveBeenCalledWith(COMPONENTS);
+		});
+
+		it('says so in the open progress panel, and refreshes the list', async () => {
+			vi.mocked(deployComponentStream).mockRejectedValue(unanswered());
+			await renderOpenModal();
+
+			await submit();
+
+			expect((await screen.findByRole('alert')).textContent).toContain(UNANSWERED_WRITE_MESSAGE);
+			expect(vi.mocked(toast.error)).not.toHaveBeenCalled();
+			expect(invalidate).toHaveBeenCalledWith(COMPONENTS);
+		});
+
+		it('refreshes nothing after a redeploy Harper refused', async () => {
+			vi.mocked(deployComponentStream).mockRejectedValue(new SSEOperationError(FAILURE, { phase: 'load' }));
+			await renderOpenModal();
+
+			await submit();
+
+			expect((await screen.findByRole('alert')).textContent).toContain(FAILURE);
+			expect(invalidate).not.toHaveBeenCalledWith(COMPONENTS);
+		});
+
+		it('toasts a streamed one that lands after the modal was closed without calling it failed', async () => {
+			const pending = deferred();
+			vi.mocked(deployComponentStream).mockReturnValue(pending.promise);
+			await renderOpenModal();
+			await submit();
+
+			await act(async () => {
+				fireEvent.keyDown(document.activeElement ?? document.body, { key: 'Escape' });
+			});
+			await act(async () => pending.reject(unanswered()));
+
+			await waitFor(() => expect(vi.mocked(toast.error)).toHaveBeenCalledOnce());
+			expect(vi.mocked(toast.error)).toHaveBeenCalledWith("Couldn't confirm my-app was redeployed", {
+				description: UNANSWERED_WRITE_MESSAGE,
+			});
+		});
+	});
+
 	describe('a rollout that settles after the modal was closed', () => {
 		function deployThenFollow(job: () => Promise<unknown>) {
 			vi.mocked(deployComponentStream).mockResolvedValue({ message: 'ok', deployment_id: 'd1', restartJobId: 'job-1' });
diff --git a/src/features/instance/applications/modals/RedeployApplicationModal.tsx b/src/features/instance/applications/modals/RedeployApplicationModal.tsx
index ae8cd5e6a..c82b17dd6 100644
--- a/src/features/instance/applications/modals/RedeployApplicationModal.tsx
+++ b/src/features/instance/applications/modals/RedeployApplicationModal.tsx
@@ -24,6 +24,7 @@ import { DeployComponentResult } from '@/integrations/api/instance/applications/
 import { deployFailureDetails } from '@/integrations/api/instance/applications/deployOutcome';
 import { DeployRolloutError } from '@/integrations/api/instance/applications/restartJob';
 import { SSEInconclusiveError } from '@/integrations/api/sse/errors';
+import { isUnansweredWrite } from '@/integrations/api/unansweredWrite';
 import { attemptToRestoreFocus } from '@/lib/attemptToRestoreFocus';
 import { setWatchedValue, useWatchedValue } from '@/lib/events/watcher';
 import { describeError } from '@/react-query/queryClient';
@@ -32,7 +33,13 @@ import { RefreshCwIcon } from 'lucide-react';
 import { useCallback, useEffect, useRef, useState } from 'react';
 import { useForm } from 'react-hook-form';
 import { toast } from 'sonner';
-import { deployNotes, reportDeployOutcome, reportDeployResult, reportStaged } from './reportDeployHealth';
+import {
+	deployFailureTitle,
+	deployNotes,
+	reportDeployOutcome,
+	reportDeployResult,
+	reportStaged,
+} from './reportDeployHealth';
 
 export function RedeployApplicationModal() {
 	const { value: isModalOpen, trigger } = useWatchedValue('ShowRedeployApplicationModal', false);
@@ -134,8 +141,9 @@ export function RedeployApplicationModal() {
 					return;
 				}
 				const rolloutFailed = error instanceof DeployRolloutError;
-				if (rolloutFailed) {
-					// Live on the node that received it.
+				// Live on the node that received it, or, with no verdict, it may have deployed: either way the
+				// list the message says to check must be current.
+				if (rolloutFailed || isUnansweredWrite(error)) {
 					invalidateComponents();
 				}
 				const { message } = describeError(error);
@@ -146,7 +154,7 @@ export function RedeployApplicationModal() {
 				}
 				const title = rolloutFailed
 					? `${project} did not reach every node`
-					: `Failed to ${stage ? 'stage' : 'redeploy'} ${project}`;
+					: deployFailureTitle(error, project, stage ? 'stage' : 'redeploy');
 				toast.error(title, { description: message, action: recordAction(deployFailureDetails(error).deploymentId) });
 				return;
 			}
@@ -204,7 +212,10 @@ export function RedeployApplicationModal() {
 					invalidateComponents();
 					return;
 				}
-				toast.error(`Failed to ${stage ? 'stage' : 'redeploy'} ${project}`, {
+				if (isUnansweredWrite(error)) {
+					invalidateComponents();
+				}
+				toast.error(deployFailureTitle(error, project, stage ? 'stage' : 'redeploy'), {
 					id: toastId,
 					description: describeError(error).message,
 					action,
diff --git a/src/features/instance/applications/modals/RenameFileModal.tsx b/src/features/instance/applications/modals/RenameFileModal.tsx
index 2170399df..f4b04ba9d 100644
--- a/src/features/instance/applications/modals/RenameFileModal.tsx
+++ b/src/features/instance/applications/modals/RenameFileModal.tsx
@@ -22,9 +22,11 @@ import { useEditorView } from '@/features/instance/applications/hooks/useEditorV
 import { useRenameFiles } from '@/features/instance/applications/hooks/useRenameFiles';
 import { dropComponent } from '@/integrations/api/instance/applications/dropComponent';
 import { setComponentFile } from '@/integrations/api/instance/applications/setComponentFile';
+import { isUnansweredWrite } from '@/integrations/api/unansweredWrite';
 import { attemptToRestoreFocus } from '@/lib/attemptToRestoreFocus';
 import { setWatchedValue, useWatchedValue } from '@/lib/events/watcher';
 import { renameFileInPath } from '@/lib/string/paths/renameFileInPath';
+import { describeError } from '@/react-query/queryClient';
 import { zodResolver } from '@hookform/resolvers/zod';
 import { PencilIcon } from 'lucide-react';
 import { useCallback, useEffect, useState } from 'react';
@@ -123,9 +125,11 @@ export function RenameFileModal() {
 				await dropComponent({ ...instanceParams, project: openedEntry.project, file: relative(openedEntry.path) });
 				await reloadRootEntries();
 			} catch (error) {
-				toast.error('Rename Failed', {
+				const { title, description } = isUnansweredWrite(error) ? describeError(error) : {
+					title: 'Rename Failed',
 					description: error instanceof Error ? error.message : 'Could not remove the original directory.',
-				});
+				};
+				toast.error(title, { description });
 				setIsPending(false);
 				return;
 			}
diff --git a/src/features/instance/applications/modals/reportDeployHealth.test.ts b/src/features/instance/applications/modals/reportDeployHealth.test.ts
index 66e51cb99..11bfacdd8 100644
--- a/src/features/instance/applications/modals/reportDeployHealth.test.ts
+++ b/src/features/instance/applications/modals/reportDeployHealth.test.ts
@@ -5,6 +5,8 @@ vi.mock('sonner', () => ({ toast }));
 
 import { DeployComponentResult } from '@/integrations/api/instance/applications/deployComponentStream';
 import { DeployRolloutError } from '@/integrations/api/instance/applications/restartJob';
+import { UNANSWERED_WRITE_MESSAGE } from '@/integrations/api/unansweredWrite';
+import { AxiosError, type InternalAxiosRequestConfig } from 'axios';
 import {
 	deployNotes,
 	reportDeployFailure,
@@ -120,6 +122,18 @@ describe('reportDeployFailure', () => {
 		reportDeployFailure('web', new Error('404: no such deployment'), 'activate');
 		expect(toast.error).toHaveBeenCalledWith('Failed to activate web', { description: '404: no such deployment' });
 	});
+
+	it('never calls an activation that got no verdict failed', () => {
+		const sent = { method: 'post', data: '{"operation":"deploy_component"}' } as InternalAxiosRequestConfig;
+		reportDeployFailure(
+			'web',
+			new AxiosError('timeout of 300000ms exceeded', AxiosError.ECONNABORTED, sent),
+			'activate',
+		);
+		expect(toast.error).toHaveBeenCalledWith("Couldn't confirm web was activated", {
+			description: UNANSWERED_WRITE_MESSAGE,
+		});
+	});
 });
 
 describe('deployNotes', () => {
diff --git a/src/features/instance/applications/modals/reportDeployHealth.ts b/src/features/instance/applications/modals/reportDeployHealth.ts
index 55a5c90d0..2c5de6f71 100644
--- a/src/features/instance/applications/modals/reportDeployHealth.ts
+++ b/src/features/instance/applications/modals/reportDeployHealth.ts
@@ -5,6 +5,7 @@ import {
 import { ComponentHealthResult } from '@/features/instance/applications/hooks/useComponentHealthCheck';
 import { DeployComponentResult } from '@/integrations/api/instance/applications/deployComponentStream';
 import { DeployRolloutError } from '@/integrations/api/instance/applications/restartJob';
+import { isUnansweredWrite, UNANSWERED_WRITE_MESSAGE } from '@/integrations/api/unansweredWrite';
 import { toast } from 'sonner';
 
 interface DeployNotes {
@@ -135,20 +136,38 @@ export function reportDeployResult(
 	toast.success(success.title, { ...options, description: withNotes(success.description, notes) });
 }
 
+type DeployVerb = 'import' | 'stage' | 'redeploy' | 'activate';
+
+const DONE: Record<DeployVerb, string> = {
+	import: 'imported',
+	stage: 'staged',
+	redeploy: 'redeployed',
+	activate: 'activated',
+};
+
+/** Never "Failed" for a deploy that got no verdict: it may be live, and its message says to check first. */
+export function deployFailureTitle(error: unknown, project: string, verb: DeployVerb): string {
+	return isUnansweredWrite(error) ? `Couldn't confirm ${project} was ${DONE[verb]}` : `Failed to ${verb} ${project}`;
+}
+
 /** A deploy that failed: a rollout failure says the release is live where it was received, not that nothing landed. */
 export function reportDeployFailure(
 	project: string,
 	error: unknown,
-	verb: string,
+	verb: DeployVerb,
 	options: DeployToastOptions = {},
 ): void {
 	if (error instanceof DeployRolloutError) {
 		toast.error(`${project} did not reach every node`, { ...options, description: error.message });
 		return;
 	}
-	toast.error(`Failed to ${verb} ${project}`, {
+	toast.error(deployFailureTitle(error, project, verb), {
 		...options,
-		description: error instanceof Error ? error.message : undefined,
+		description: isUnansweredWrite(error)
+			? UNANSWERED_WRITE_MESSAGE
+			: error instanceof Error
+			? error.message
+			: undefined,
 	});
 }
 
diff --git a/src/features/instance/config/deployments/components/ActivateStagedRelease.test.tsx b/src/features/instance/config/deployments/components/ActivateStagedRelease.test.tsx
index 99576d143..40fc2a564 100644
--- a/src/features/instance/config/deployments/components/ActivateStagedRelease.test.tsx
+++ b/src/features/instance/config/deployments/components/ActivateStagedRelease.test.tsx
@@ -1,8 +1,10 @@
 /** @vitest-environment jsdom */
 import { Deployment } from '@/integrations/api/instance/deployments/types';
 import { SSEInconclusiveError } from '@/integrations/api/sse/errors';
+import { UNANSWERED_WRITE_MESSAGE } from '@/integrations/api/unansweredWrite';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { act, cleanup, fireEvent, render, screen } from '@testing-library/react';
+import { AxiosError, type InternalAxiosRequestConfig } from 'axios';
 import { afterEach, describe, expect, it, vi } from 'vitest';
 
 const state = vi.hoisted(() => ({
@@ -27,7 +29,7 @@ vi.mock('@/features/instance/applications/hooks/useDeploymentRecordAction', () =
 	useDeploymentRecordAction: () => () => undefined,
 }));
 vi.mock('@/features/instance/applications/components/DeployProgress/DeployProgress', () => ({
-	DeployProgress: () => <div>progress</div>,
+	DeployProgress: ({ state }: { state: { error?: string } }) => <div>{state.error ?? 'progress'}</div>,
 }));
 vi.mock('@/features/instance/applications/modals/reportDeployHealth', () => ({
 	reportDeployOutcome: state.reportDeployOutcome,
@@ -134,6 +136,16 @@ describe('ActivateStagedRelease', () => {
 		consoleError.mockRestore();
 	});
 
+	it('says in its progress panel that an activation with no verdict may have gone through', async () => {
+		const sent = { method: 'post', data: '{"operation":"deploy_component"}' } as InternalAxiosRequestConfig;
+		const unanswered = new AxiosError('timeout of 300000ms exceeded', AxiosError.ECONNABORTED, sent);
+		state.mutateAsync.mockRejectedValue(unanswered);
+		renderButton();
+		confirm();
+		expect(await screen.findByText(UNANSWERED_WRITE_MESSAGE)).toBeTruthy();
+		expect(state.reportDeployFailure).toHaveBeenCalledWith('web', unanswered, 'activate', { action: undefined });
+	});
+
 	it('offers nothing where staging is not known to exist', () => {
 		state.canStage = false;
 		renderButton();
diff --git a/src/features/instance/config/deployments/components/ActivateStagedRelease.tsx b/src/features/instance/config/deployments/components/ActivateStagedRelease.tsx
index d68b10344..b0c90c735 100644
--- a/src/features/instance/config/deployments/components/ActivateStagedRelease.tsx
+++ b/src/features/instance/config/deployments/components/ActivateStagedRelease.tsx
@@ -25,6 +25,7 @@ import { deployFailureDetails } from '@/integrations/api/instance/applications/d
 import { DeployRolloutError } from '@/integrations/api/instance/applications/restartJob';
 import { Deployment } from '@/integrations/api/instance/deployments/types';
 import { SSEInconclusiveError } from '@/integrations/api/sse/errors';
+import { isUnansweredWrite, UNANSWERED_WRITE_MESSAGE } from '@/integrations/api/unansweredWrite';
 import { invalidateEntityQueries } from '@/react-query/invalidateEntityQueries';
 import { useIsMutating, useQueryClient } from '@tanstack/react-query';
 import { RocketIcon } from 'lucide-react';
@@ -84,7 +85,13 @@ export function ActivateStagedRelease({ deployment }: { deployment: Deployment }
 			}
 			stream.markSettled(
 				'error',
-				error instanceof DeployRolloutError ? undefined : error instanceof Error ? error.message : String(error),
+				error instanceof DeployRolloutError
+					? undefined
+					: isUnansweredWrite(error)
+					? UNANSWERED_WRITE_MESSAGE
+					: error instanceof Error
+					? error.message
+					: String(error),
 				{ failure: error },
 			);
 			reportDeployFailure(project, error, 'activate', {
diff --git a/src/features/instance/config/secrets/SecretGrantsEditor.tsx b/src/features/instance/config/secrets/SecretGrantsEditor.tsx
index 9525adb40..fd233d066 100644
--- a/src/features/instance/config/secrets/SecretGrantsEditor.tsx
+++ b/src/features/instance/config/secrets/SecretGrantsEditor.tsx
@@ -9,7 +9,7 @@ import { Badge } from '@/components/ui/badge';
 import { useInstanceClientIdParams } from '@/config/useInstanceClient';
 import { ComponentGrantCombobox } from '@/features/instance/secrets/ComponentGrantCombobox';
 import { useGrantSecret, useRevokeSecret } from '@/integrations/api/instance/secrets/secrets';
-import { describeError } from '@/react-query/queryClient';
+import { describeError, shouldToastOwnFailure } from '@/react-query/queryClient';
 import { XIcon } from 'lucide-react';
 import { useCallback, useState } from 'react';
 import { toast } from 'sonner';
@@ -41,7 +41,9 @@ export function SecretGrantsEditor({
 			setGrants(response.grants);
 			onChanged?.();
 		} catch (error) {
-			toast.error(describeError(error).message);
+			if (shouldToastOwnFailure(error)) {
+				toast.error(describeError(error).message);
+			}
 			// Rethrow so the combobox keeps the typed text for a retry instead of clearing it.
 			throw error;
 		}
@@ -53,7 +55,9 @@ export function SecretGrantsEditor({
 			setGrants(response.grants);
 			onChanged?.();
 		} catch (error) {
-			toast.error(describeError(error).message);
+			if (shouldToastOwnFailure(error)) {
+				toast.error(describeError(error).message);
+			}
 		}
 	}, [revokeSecret, instanceParams, name, onChanged]);
 
diff --git a/src/features/instance/databases/components/DatabaseTableView.tsx b/src/features/instance/databases/components/DatabaseTableView.tsx
index 3548f9b3d..6d1444560 100644
--- a/src/features/instance/databases/components/DatabaseTableView.tsx
+++ b/src/features/instance/databases/components/DatabaseTableView.tsx
@@ -70,6 +70,7 @@ import { keyBy } from '@/lib/keyBy';
 import { onClickStopPropagation } from '@/lib/onClickStopPropagation';
 import { pluralize } from '@/lib/pluralize';
 import { Row } from '@/lib/table';
+import { shouldToastOwnFailure } from '@/react-query/queryClient';
 import { zodResolver } from '@hookform/resolvers/zod';
 import { useQuery, useQueryClient } from '@tanstack/react-query';
 import { Link, useParams, useSearch } from '@tanstack/react-router';
@@ -645,7 +646,9 @@ export function DatabaseTableView({
 				refreshTable();
 			},
 			onError: (error) => {
-				toast.error(error instanceof Error ? error.message : 'Failed to cleanup orphan blobs');
+				if (shouldToastOwnFailure(error)) {
+					toast.error(error instanceof Error ? error.message : 'Failed to cleanup orphan blobs');
+				}
 			},
 		});
 	}, [cleanupOrphanBlobs, databaseName, instanceParams, refreshTable]);
diff --git a/src/features/instance/databases/modals/recordEditorJson.test.ts b/src/features/instance/databases/modals/recordEditorJson.test.ts
index ff73cc132..900cb01c7 100644
--- a/src/features/instance/databases/modals/recordEditorJson.test.ts
+++ b/src/features/instance/databases/modals/recordEditorJson.test.ts
@@ -34,6 +34,13 @@ describe('tryParseRecordJson', () => {
 		expect(parsed.ok === false && parsed.error.message).not.toMatch(/position|line \d+ column/i);
 	});
 
+	it('drops it from trailing-content errors too, which V8 words "after JSON at position"', () => {
+		const parsed = tryParseRecordJson('{"a": 1}}');
+
+		expect(parsed.ok === false && parsed.error.message).toBe('Unexpected non-whitespace character after JSON');
+		expect(parsed.ok === false && parsed.error.location).toEqual({ lineNumber: 1, column: 9 });
+	});
+
 	// These go to the ops API as `records`, so a primitive parses cleanly and then fails on the
 	// wire in the server's wording. Say it here, where the user can act on it.
 	it('rejects JSON that is well-formed but could never be a record', () => {
diff --git a/src/features/instance/databases/modals/recordEditorJson.ts b/src/features/instance/databases/modals/recordEditorJson.ts
index a44659450..657cc91bb 100644
--- a/src/features/instance/databases/modals/recordEditorJson.ts
+++ b/src/features/instance/databases/modals/recordEditorJson.ts
@@ -32,15 +32,24 @@ export function tryParseRecordJson(content: string): ParsedRecordJson {
 		// record rather than an editor the user emptied.
 		return { ok: false, error: { message: 'The editor is empty, so there is nothing to save.' } };
 	}
-	let value: unknown;
+	const parsed = tryParseJson(content);
+	if (!parsed.ok) {
+		return parsed;
+	}
+	const shapeError = recordShapeError(parsed.value);
+	return shapeError
+		? { ok: false, error: { message: shapeError } }
+		: { ok: true, value: parsed.value as RecordJsonValue };
+}
+
+/** Parse `content` as any JSON value; on failure, the parser's reason and (when the engine says) where. */
+export function tryParseJson(content: string): { ok: true; value: unknown } | { ok: false; error: RecordJsonError } {
 	try {
-		value = JSON.parse(content);
+		return { ok: true, value: JSON.parse(content) };
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
 		return { ok: false, error: { message: withoutEngineLocation(message), location: locate(message, content) } };
 	}
-	const shapeError = recordShapeError(value);
-	return shapeError ? { ok: false, error: { message: shapeError } } : { ok: true, value: value as RecordJsonValue };
 }
 
 /** One-line rendering of a {@link RecordJsonError}, for a toast description. */
@@ -99,7 +108,7 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 function withoutEngineLocation(message: string): string {
 	return message
 		.replace(/^JSON\.parse:\s*/, '')
-		.replace(/\s*in JSON at position \d+.*$/i, '')
+		.replace(/\s*(?:in JSON )?at position \d+.*$/i, '')
 		.replace(/\s*at line \d+ column \d+ of the JSON data\.?$/i, '')
 		.trim();
 }
diff --git a/src/features/instance/operations/index.test.tsx b/src/features/instance/operations/index.test.tsx
new file mode 100644
index 000000000..bf279f143
--- /dev/null
+++ b/src/features/instance/operations/index.test.tsx
@@ -0,0 +1,387 @@
+/** @vitest-environment jsdom */
+import { OperationsIndex } from '@/features/instance/operations/index';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { act, cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
+import axios, { AxiosError, CanceledError, type InternalAxiosRequestConfig } from 'axios';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const { state, invalidateEntityQueries, markRestarting, releaseRestart, restartSettles } = vi.hoisted(() => {
+	const releaseRestart = vi.fn();
+	const restartSettles = { resolve: () => {}, promise: Promise.resolve() } as {
+		resolve: () => void;
+		promise: Promise<void>;
+	};
+	return {
+		state: {
+			canManage: true,
+			user: { username: 'HDB_ADMIN' } as { username: string } | null,
+			entityId: 'ins-1',
+		},
+		invalidateEntityQueries: vi.fn(),
+		releaseRestart,
+		markRestarting: vi.fn(() => releaseRestart),
+		restartSettles,
+	};
+});
+
+vi.mock('@/lib/monaco/MonacoEditor', () => ({
+	Editor: ({ value, onChange }: { value?: string; onChange?: (value: string | undefined) => void }) => (
+		<textarea
+			aria-label="Operation request"
+			value={value ?? ''}
+			onChange={(event) => onChange?.(event.target.value)}
+		/>
+	),
+}));
+vi.mock('@/hooks/useMonacoTheme', () => ({ useMonacoTheme: () => 'light' }));
+vi.mock('@/hooks/usePermissions', () => ({ useInstanceManagePermission: () => state.canManage }));
+vi.mock('@/hooks/useAuth', () => ({ useInstanceAuth: () => ({ user: state.user, isLoading: false }) }));
+vi.mock('@/react-query/invalidateEntityQueries', () => ({ invalidateEntityQueries }));
+vi.mock('@/lib/restart/restartTracker', async (importOriginal) => ({
+	...(await importOriginal<typeof import('@/lib/restart/restartTracker')>()),
+	markRestarting,
+}));
+vi.mock('@/integrations/api/instance/status/restartInstance', () => ({
+	RESTART_MARK_TTL_MS: 600_000,
+	waitUntilAnsweringAfterRestart: () => restartSettles.promise,
+}));
+vi.mock('@tanstack/react-router', () => ({
+	Navigate: ({ to }: { to: string }) => <div data-testid="redirect">{to}</div>,
+	useParams: () => ({ organizationId: 'org-1', clusterId: 'clu-1', instanceId: 'ins-1' }),
+}));
+
+const instanceClient = axios.create({ headers: { 'Content-Type': 'application/json' } });
+vi.mock('@/config/useInstanceClient', () => ({
+	useInstanceClientIdParams: () => ({ instanceClient, entityId: state.entityId, entityType: 'instance' }),
+}));
+
+let adapter: ReturnType<typeof vi.fn<(config: InternalAxiosRequestConfig) => Promise<unknown>>>;
+
+function ok(config: InternalAxiosRequestConfig, data: string) {
+	return { status: 200, statusText: 'OK', data, headers: { 'content-type': 'application/json' }, config };
+}
+
+function renderPage() {
+	const queryClient = new QueryClient();
+	const page = () => (
+		<QueryClientProvider client={queryClient}>
+			<OperationsIndex />
+		</QueryClientProvider>
+	);
+	const result = render(page());
+	return { ...result, rerenderPage: () => result.rerender(page()) };
+}
+
+function typeRequest(text: string) {
+	fireEvent.change(screen.getByLabelText('Operation request'), { target: { value: text } });
+}
+
+function send() {
+	fireEvent.click(screen.getByRole('button', { name: 'Send' }));
+}
+
+function sentBodies() {
+	return adapter.mock.calls.map(([config]) => config.data);
+}
+
+beforeEach(() => {
+	state.canManage = true;
+	state.user = { username: 'HDB_ADMIN' };
+	state.entityId = 'ins-1';
+	markRestarting.mockClear();
+	releaseRestart.mockClear();
+	restartSettles.promise = new Promise<void>((resolve) => (restartSettles.resolve = resolve));
+	adapter = vi.fn(async (config: InternalAxiosRequestConfig) => ok(config, '{"message":"done"}'));
+	instanceClient.defaults.adapter = adapter as never;
+	invalidateEntityQueries.mockClear();
+});
+
+afterEach(() => {
+	cleanup();
+	vi.restoreAllMocks();
+});
+
+describe('OperationsIndex', () => {
+	it('sends a read straight away and shows the formatted answer', async () => {
+		adapter.mockImplementation(async (config) => ok(config, '{"dev":{"dog":{}}}'));
+		renderPage();
+
+		send();
+
+		expect(await screen.findByText('200 OK')).toBeTruthy();
+		expect(screen.getByText(/"dev": \{/)).toBeTruthy();
+		expect(sentBodies()).toEqual(['{\n\t"operation": "describe_all"\n}']);
+		expect(screen.queryByRole('alertdialog')).toBeNull();
+		expect(invalidateEntityQueries).not.toHaveBeenCalled();
+	});
+
+	it('refuses invalid JSON inline, naming where it broke, and sends nothing', () => {
+		renderPage();
+		typeRequest('{\n\t"operation": "describe_all",\n}');
+
+		send();
+
+		expect(screen.getByRole('alert').textContent).toMatch(/^Line 3, column 1: /);
+		expect(adapter).not.toHaveBeenCalled();
+	});
+
+	it('refuses a body that names no operation, and clears the complaint once it is edited', () => {
+		renderPage();
+		typeRequest('{"database": "dev"}');
+		send();
+
+		expect(screen.getByRole('alert').textContent).toMatch(/needs an "operation"/);
+		expect(adapter).not.toHaveBeenCalled();
+
+		typeRequest('{"operation": "describe_all"}');
+
+		expect(screen.queryByRole('alert')).toBeNull();
+	});
+
+	it('asks before sending anything that is not a read, and sends nothing when cancelled', () => {
+		renderPage();
+		typeRequest('{"operation": "drop_table", "database": "dev", "table": "dog"}');
+
+		send();
+
+		const dialog = screen.getByRole('alertdialog');
+		expect(dialog.textContent).toContain('Run drop_table on this instance?');
+		expect(dialog.textContent).toContain('"table": "dog"');
+
+		fireEvent.click(screen.getByRole('button', { name: 'Cancel' }));
+
+		expect(screen.queryByRole('alertdialog')).toBeNull();
+		expect(adapter).not.toHaveBeenCalled();
+	});
+
+	it('sends the confirmed body exactly once and marks cached data stale without refetching it', async () => {
+		renderPage();
+		const body = '{"operation": "drop_table", "database": "dev", "table": "dog"}';
+		typeRequest(body);
+		send();
+
+		fireEvent.click(screen.getByRole('button', { name: 'Run drop_table' }));
+
+		expect(await screen.findByText('200 OK')).toBeTruthy();
+		expect(sentBodies()).toEqual([body]);
+		expect(invalidateEntityQueries).toHaveBeenCalledWith(expect.anything(), 'ins-1', { refetchType: 'none' });
+	});
+
+	it("renders Harper's error inline and never hands it to console.error", async () => {
+		const consoleError = vi.spyOn(console, 'error');
+		adapter.mockImplementation(async (config) => {
+			const response = {
+				status: 403,
+				statusText: 'Forbidden',
+				data: '{"error":"This operation is not authorized due to role restrictions"}',
+				headers: { 'content-type': 'application/json' },
+				config,
+			};
+			throw new AxiosError(
+				'Request failed with status code 403',
+				AxiosError.ERR_BAD_REQUEST,
+				config,
+				undefined,
+				response,
+			);
+		});
+		renderPage();
+
+		send();
+
+		expect(await screen.findByText('403 Forbidden')).toBeTruthy();
+		expect(screen.getByText(/not authorized due to role restrictions/)).toBeTruthy();
+		expect(consoleError).not.toHaveBeenCalled();
+	});
+
+	it('marks data stale after a write Harper answered with an error, which may have changed something first', async () => {
+		adapter.mockImplementation(async (config) => {
+			const response = { status: 400, statusText: 'Bad Request', data: '{"error":"partial"}', headers: {}, config };
+			throw new AxiosError(
+				'Request failed with status code 400',
+				AxiosError.ERR_BAD_REQUEST,
+				config,
+				undefined,
+				response,
+			);
+		});
+		renderPage();
+		typeRequest('{"operation": "my_component_import", "rows": 10}');
+		send();
+
+		fireEvent.click(screen.getByRole('button', { name: 'Run my_component_import' }));
+
+		expect(await screen.findByText('400 Bad Request')).toBeTruthy();
+		expect(invalidateEntityQueries).toHaveBeenCalledWith(expect.anything(), 'ins-1', { refetchType: 'none' });
+	});
+
+	it('says an unanswered write may have run', async () => {
+		adapter.mockImplementation(async (config) => {
+			throw new AxiosError('Network Error', AxiosError.ERR_NETWORK, config);
+		});
+		renderPage();
+		typeRequest('{"operation": "restart"}');
+		send();
+		fireEvent.click(screen.getByRole('button', { name: 'Run restart' }));
+
+		expect(await screen.findByText('No response from Harper.')).toBeTruthy();
+		expect(screen.getByText('Network Error')).toBeTruthy();
+		expect(screen.getByText(/may or may not have run/)).toBeTruthy();
+		expect(invalidateEntityQueries).toHaveBeenCalledTimes(1);
+	});
+
+	it('sends once however fast Send is clicked', async () => {
+		let answer: (value: unknown) => void = () => {};
+		adapter.mockImplementation((config) => new Promise((resolve) => (answer = () => resolve(ok(config, '{}')))));
+		renderPage();
+
+		const button = screen.getByRole('button', { name: 'Send' });
+		// One act: both clicks land before React commits the disabled button.
+		act(() => {
+			button.click();
+			button.click();
+		});
+		await waitFor(() => expect(adapter).toHaveBeenCalledTimes(1));
+
+		await act(async () => answer(undefined));
+
+		expect(await screen.findByText('200 OK')).toBeTruthy();
+		expect(adapter).toHaveBeenCalledTimes(1);
+	});
+
+	it('asks before sending a component operation that only looks like a read', () => {
+		renderPage();
+		typeRequest('{"operation": "get_and_rotate_key"}');
+
+		send();
+
+		expect(screen.getByRole('alertdialog').textContent).toContain('Run get_and_rotate_key on this instance?');
+		expect(adapter).not.toHaveBeenCalled();
+	});
+
+	it('refuses logout, which would end the session the rest of Studio is using', () => {
+		renderPage();
+		typeRequest('{"operation": "logout"}');
+
+		send();
+
+		expect(screen.getByRole('alert').textContent).toMatch(/^Sign out from Studio instead/);
+		expect(screen.queryByRole('alertdialog')).toBeNull();
+		expect(adapter).not.toHaveBeenCalled();
+	});
+
+	it('tracks a restart the way the Restart button does, until the instance answers again', async () => {
+		adapter.mockImplementation(async (config) => ok(config, '{"message":"Restarting HarperDB."}'));
+		renderPage();
+		typeRequest('{"operation": "restart"}');
+		send();
+
+		fireEvent.click(screen.getByRole('button', { name: 'Run restart' }));
+
+		expect(await screen.findByText('200 OK')).toBeTruthy();
+		expect(markRestarting).toHaveBeenCalledWith(['ins-1'], expect.objectContaining({ reach: 'down' }));
+		expect(adapter.mock.calls[0][0].skipRestartGate).toBe(true);
+		expect(releaseRestart).not.toHaveBeenCalled();
+
+		await act(async () => restartSettles.resolve());
+
+		expect(releaseRestart).toHaveBeenCalledTimes(1);
+	});
+
+	it('stops tracking a restart Harper refused', async () => {
+		adapter.mockImplementation(async (config) => {
+			const response = { status: 403, statusText: 'Forbidden', data: '{"error":"no"}', headers: {}, config };
+			throw new AxiosError(
+				'Request failed with status code 403',
+				AxiosError.ERR_BAD_REQUEST,
+				config,
+				undefined,
+				response,
+			);
+		});
+		renderPage();
+		typeRequest('{"operation": "restart"}');
+		send();
+
+		fireEvent.click(screen.getByRole('button', { name: 'Run restart' }));
+
+		expect(await screen.findByText('403 Forbidden')).toBeTruthy();
+		expect(releaseRestart).toHaveBeenCalledTimes(1);
+	});
+
+	it('keeps tracking a restart whose answer a gateway lost, and still marks data stale', async () => {
+		adapter.mockImplementation(async (config) => {
+			const response = { status: 502, statusText: 'Bad Gateway', data: '', headers: {}, config };
+			throw new AxiosError(
+				'Request failed with status code 502',
+				AxiosError.ERR_BAD_RESPONSE,
+				config,
+				undefined,
+				response,
+			);
+		});
+		renderPage();
+		typeRequest('{"operation": "restart"}');
+		send();
+
+		fireEvent.click(screen.getByRole('button', { name: 'Run restart' }));
+
+		expect(await screen.findByText('502 Bad Gateway')).toBeTruthy();
+		expect(releaseRestart).not.toHaveBeenCalled();
+		expect(invalidateEntityQueries).toHaveBeenCalledWith(expect.anything(), 'ins-1', { refetchType: 'none' });
+
+		await act(async () => restartSettles.resolve());
+
+		expect(releaseRestart).toHaveBeenCalledTimes(1);
+	});
+
+	it('starts over when the page switches to another instance, so nothing written for one reaches the next', () => {
+		const page = renderPage();
+		typeRequest('{"operation": "drop_table", "database": "dev", "table": "dog"}');
+		send();
+		expect(screen.getByRole('alertdialog')).toBeTruthy();
+
+		state.entityId = 'ins-2';
+		page.rerenderPage();
+
+		expect(screen.queryByRole('alertdialog')).toBeNull();
+		expect((screen.getByLabelText('Operation request') as HTMLTextAreaElement).value).toContain('describe_all');
+		expect(adapter).not.toHaveBeenCalled();
+	});
+
+	it('still marks data stale for a write it stopped waiting on when the page went away', async () => {
+		adapter.mockImplementation((config) =>
+			new Promise((_resolve, reject) => {
+				(config.signal as AbortSignal).addEventListener('abort', () => reject(new CanceledError(undefined, config)));
+			})
+		);
+		const page = renderPage();
+		typeRequest('{"operation": "insert", "database": "dev", "table": "dog", "records": [{"name": "Harper"}]}');
+		send();
+		fireEvent.click(screen.getByRole('button', { name: 'Run insert' }));
+		await waitFor(() => expect(adapter).toHaveBeenCalledTimes(1));
+
+		page.unmount();
+
+		await waitFor(() =>
+			expect(invalidateEntityQueries).toHaveBeenCalledWith(expect.anything(), 'ins-1', { refetchType: 'none' })
+		);
+	});
+
+	it('sends a non-super user back to Databases', () => {
+		state.canManage = false;
+		renderPage();
+
+		expect(screen.getByTestId('redirect').textContent).toBe('/org-1/clu-1/instance/ins-1/databases');
+		expect(screen.queryByRole('button', { name: 'Send' })).toBeNull();
+	});
+
+	it('waits for the instance user before deciding to redirect', () => {
+		state.canManage = false;
+		state.user = null;
+		renderPage();
+
+		expect(screen.queryByTestId('redirect')).toBeNull();
+		expect(screen.queryByRole('button', { name: 'Send' })).toBeNull();
+	});
+});
diff --git a/src/features/instance/operations/index.tsx b/src/features/instance/operations/index.tsx
new file mode 100644
index 000000000..98e638fcf
--- /dev/null
+++ b/src/features/instance/operations/index.tsx
@@ -0,0 +1,310 @@
+import {
+	AlertDialog,
+	AlertDialogAction,
+	AlertDialogCancel,
+	AlertDialogContent,
+	AlertDialogDescription,
+	AlertDialogFooter,
+	AlertDialogHeader,
+	AlertDialogTitle,
+} from '@/components/ui/alertDialog';
+import { Button } from '@/components/ui/button';
+import { buttonVariants } from '@/components/ui/buttonVariants';
+import { useInstanceClientIdParams } from '@/config/useInstanceClient';
+import { EntityIds } from '@/features/auth/store/authStore';
+import { CodeBlock } from '@/features/instance/apis/explorer/CodeBlock';
+import { httpStatusColorClass, StatusBadge } from '@/features/instance/apis/explorer/StatusBadge';
+import { describeRecordJsonError, RecordJsonError } from '@/features/instance/databases/modals/recordEditorJson';
+import { useRecordJsonErrorMarker } from '@/features/instance/databases/modals/recordJsonErrorMarker';
+import { isBuiltInRead } from '@/features/instance/operations/operationKinds';
+import { OperationRequest, parseOperationRequest } from '@/features/instance/operations/parseOperationRequest';
+import { MAX_RESPONSE_BYTES, OperationResult, sendOperation } from '@/features/instance/operations/sendOperation';
+import { useInstanceAuth } from '@/hooks/useAuth';
+import { useMonacoTheme } from '@/hooks/useMonacoTheme';
+import { useInstanceManagePermission } from '@/hooks/usePermissions';
+import {
+	RESTART_MARK_TTL_MS,
+	waitUntilAnsweringAfterRestart,
+} from '@/integrations/api/instance/status/restartInstance';
+import { humanFileSize } from '@/lib/humanFileSize';
+import { Editor } from '@/lib/monaco/MonacoEditor';
+import { WORKER_FREE_JSON_LANGUAGE_ID } from '@/lib/monaco/workerFreeJsonLanguage';
+import { markRestarting } from '@/lib/restart/restartTracker';
+import { buildAbsoluteLinkToPage } from '@/lib/urls/buildAbsoluteLinkToPage';
+import { invalidateEntityQueries } from '@/react-query/invalidateEntityQueries';
+import { useQueryClient } from '@tanstack/react-query';
+import { Navigate, useParams } from '@tanstack/react-router';
+import type { AxiosInstance } from 'axios';
+import { Play } from 'lucide-react';
+import { useEffect, useRef, useState } from 'react';
+
+const OPERATIONS_API_DOCS = 'https://docs.harperdb.io/docs/developers/operations-api/';
+const INITIAL_REQUEST = '{\n\t"operation": "describe_all"\n}\n';
+const CONFIRM_PREVIEW_CHARS = 4_000;
+const LOGOUT_REFUSAL = 'Sign out from Studio instead: a logout sent from here would end the session the rest of '
+	+ 'Studio is still using, without Studio knowing.';
+
+export function OperationsIndex() {
+	const params = useParams({ strict: false });
+	const { instanceClient, entityId, entityType } = useInstanceClientIdParams();
+	const canManage = useInstanceManagePermission(entityId);
+	const { user } = useInstanceAuth(entityId);
+
+	if (!canManage) {
+		// No user yet means auth is still resolving; redirecting then would bounce a super user too.
+		return user ? <Navigate to={buildAbsoluteLinkToPage(params, 'databases')} /> : null;
+	}
+	return (
+		<OperationsConsole
+			// The router keeps this page mounted across a switch to another instance, and a buffer or a
+			// pending confirmation written for one must never be sent to the next.
+			key={entityId}
+			instanceClient={instanceClient}
+			entityId={entityId}
+			noun={entityType}
+			username={user?.username}
+		/>
+	);
+}
+
+function OperationsConsole({ instanceClient, entityId, noun, username }: {
+	instanceClient: AxiosInstance;
+	entityId: EntityIds;
+	noun: 'instance' | 'cluster';
+	username?: string;
+}) {
+	const monacoTheme = useMonacoTheme();
+	const queryClient = useQueryClient();
+	const { onEditorMount, showRecordJsonError, clearRecordJsonError } = useRecordJsonErrorMarker();
+	const [text, setText] = useState(INITIAL_REQUEST);
+	const [inputError, setInputError] = useState<RecordJsonError | null>(null);
+	const [awaitingConfirmation, setAwaitingConfirmation] = useState<OperationRequest | null>(null);
+	const [isSending, setIsSending] = useState(false);
+	const [sent, setSent] = useState<{ operation: string; result: OperationResult } | null>(null);
+	// A ref, not `isSending`: two clicks can land before React commits the disabled button.
+	const inFlight = useRef(false);
+	const lifetime = useRef<AbortController | null>(null);
+
+	useEffect(() => {
+		const controller = new AbortController();
+		lifetime.current = controller;
+		return () => controller.abort();
+	}, []);
+
+	async function send(request: OperationRequest) {
+		if (inFlight.current) {
+			return;
+		}
+		inFlight.current = true;
+		setIsSending(true);
+		setSent(null);
+		const signal = lifetime.current?.signal;
+		// Tracked like the Restart button's, so the page's polls ride out the outage instead of failing
+		// into the global error handlers.
+		const releaseRestart = request.operation === 'restart'
+			? markRestarting([entityId], { reach: noun === 'instance' ? 'down' : 'rolling', ttlMs: RESTART_MARK_TTL_MS })
+			: undefined;
+		try {
+			const result = await sendOperation(instanceClient, request.text, {
+				signal,
+				skipRestartGate: !!releaseRestart,
+			});
+			const reachedHarper = !(result.kind === 'failed' && !result.mayHaveRun);
+			if (releaseRestart) {
+				// A 4xx is a restart refused; a 5xx can be a gateway that lost the answer to one that ran
+				// and took the instance down mid-reply.
+				const refused = !reachedHarper || (result.kind === 'response' && result.status >= 400 && result.status < 500);
+				if (refused) {
+					releaseRestart();
+				} else {
+					void waitUntilAnsweringAfterRestart({ instanceClient }).then(releaseRestart, releaseRestart);
+				}
+			}
+			// Even an error answer: an arbitrary operation can change something before it fails.
+			if (!isBuiltInRead(request.operation) && reachedHarper) {
+				// Stale, not refetched: the refetch would race whatever the operation just did.
+				void invalidateEntityQueries(queryClient, entityId, { refetchType: 'none' });
+			}
+			if (!signal?.aborted) {
+				setSent({ operation: request.operation, result });
+			}
+		} finally {
+			inFlight.current = false;
+			if (!signal?.aborted) {
+				setIsSending(false);
+			}
+		}
+	}
+
+	function submit() {
+		if (inFlight.current) {
+			return;
+		}
+		const parsed = parseOperationRequest(text);
+		if (!parsed.ok) {
+			setInputError(parsed.error);
+			showRecordJsonError(parsed.error);
+			return;
+		}
+		if (parsed.request.operation === 'logout') {
+			setInputError({ message: LOGOUT_REFUSAL });
+			return;
+		}
+		setInputError(null);
+		if (isBuiltInRead(parsed.request.operation)) {
+			void send(parsed.request);
+		} else {
+			setAwaitingConfirmation(parsed.request);
+		}
+	}
+
+	return (
+		<div className="flex max-w-6xl flex-col gap-4 px-4 py-4 text-foreground md:px-12">
+			<div className="flex flex-col gap-1">
+				<h1 className="text-xl font-semibold">Operations API</h1>
+				<p className="text-muted-foreground text-sm">
+					Send one operations-API request to{' '}
+					{username ? `this ${noun} as ${username}` : `this ${noun}`}. Harper checks your permissions for each
+					operation. See the{' '}
+					<a href={OPERATIONS_API_DOCS} target="_blank" rel="noreferrer" className="underline underline-offset-2">
+						Operations API reference
+					</a>{' '}
+					for what you can send.
+				</p>
+				{noun === 'cluster' && (
+					<p className="text-muted-foreground text-sm">
+						Each request runs on one node of the cluster. To target a specific node, open it from the cluster&apos;s
+						Instances list.
+					</p>
+				)}
+			</div>
+
+			<div className="h-72 overflow-hidden rounded-md border">
+				<Editor
+					className="h-full w-full"
+					language={WORKER_FREE_JSON_LANGUAGE_ID}
+					theme={monacoTheme}
+					value={text}
+					onChange={(value) => {
+						setText(value ?? '');
+						setInputError(null);
+						clearRecordJsonError();
+					}}
+					onMount={onEditorMount}
+					options={{
+						minimap: { enabled: false },
+						automaticLayout: true,
+						scrollBeyondLastLine: false,
+						fontSize: 13,
+					}}
+				/>
+			</div>
+
+			{inputError && <p role="alert" className="text-red text-sm">{describeRecordJsonError(inputError)}</p>}
+
+			<div>
+				<Button variant="submit" onClick={submit} disabled={isSending}>
+					<Play />
+					{isSending ? 'Sending…' : 'Send'}
+				</Button>
+			</div>
+
+			{sent && <ResultView operation={sent.operation} result={sent.result} />}
+
+			<ConfirmOperationDialog
+				request={awaitingConfirmation}
+				noun={noun}
+				onCancel={() => setAwaitingConfirmation(null)}
+				onConfirm={(request) => {
+					setAwaitingConfirmation(null);
+					void send(request);
+				}}
+			/>
+		</div>
+	);
+}
+
+function ConfirmOperationDialog({ request, noun, onCancel, onConfirm }: {
+	request: OperationRequest | null;
+	noun: 'instance' | 'cluster';
+	onCancel: () => void;
+	onConfirm: (request: OperationRequest) => void;
+}) {
+	// The content stays mounted through the close animation, after `request` is already null.
+	const [lastRequest, setLastRequest] = useState(request);
+	if (request && request !== lastRequest) {
+		setLastRequest(request);
+	}
+	const shown = request ?? lastRequest;
+	const preview = shown && shown.text.length > CONFIRM_PREVIEW_CHARS
+		? `${shown.text.slice(0, CONFIRM_PREVIEW_CHARS)}\n…`
+		: shown?.text;
+	return (
+		<AlertDialog open={!!request} onOpenChange={(open) => !open && onCancel()}>
+			<AlertDialogContent className="text-popover-foreground sm:max-w-2xl">
+				<AlertDialogHeader>
+					<AlertDialogTitle>
+						Run <code className="font-mono">{shown?.operation}</code> on this {noun}?
+					</AlertDialogTitle>
+					<AlertDialogDescription>
+						This isn&apos;t a read, so it can change data, users, or configuration, and Harper may not be able to undo
+						it.
+					</AlertDialogDescription>
+				</AlertDialogHeader>
+				<pre className="bg-muted/40 max-h-48 overflow-auto rounded-md border p-2 font-mono text-xs whitespace-pre-wrap break-all">
+					{preview}
+				</pre>
+				<AlertDialogFooter>
+					<AlertDialogCancel>Cancel</AlertDialogCancel>
+					<AlertDialogAction
+						className={buttonVariants({ variant: 'destructive' })}
+						onClick={() => request && onConfirm(request)}
+					>
+						Run {shown?.operation}
+					</AlertDialogAction>
+				</AlertDialogFooter>
+			</AlertDialogContent>
+		</AlertDialog>
+	);
+}
+
+function ResultView({ operation, result }: { operation: string; result: OperationResult }) {
+	return (
+		<section aria-label={`Result of ${operation}`} className="flex flex-col gap-2">
+			<div className="flex items-center gap-3">
+				<span className="text-muted-foreground text-xs font-semibold uppercase tracking-wide">Response</span>
+				{result.kind === 'response'
+					? (
+						<StatusBadge colorClass={httpStatusColorClass(result.status)}>
+							{`${result.status} ${result.statusText}`.trim()}
+						</StatusBadge>
+					)
+					: (
+						<StatusBadge colorClass={httpStatusColorClass(0)}>
+							{result.kind === 'too-large' ? 'Too large' : 'Failed'}
+						</StatusBadge>
+					)}
+				<span className="text-muted-foreground text-xs">{result.durationMs} ms</span>
+			</div>
+			{result.kind === 'response' && <CodeBlock code={result.body || '(empty response body)'} label="response body" />}
+			{result.kind === 'too-large' && (
+				<div className="border-yellow/40 bg-yellow/10 rounded-md border p-3 text-sm">
+					Harper answered, but the response was over{' '}
+					{humanFileSize(MAX_RESPONSE_BYTES)}, so Studio stopped downloading it. Narrow the request (for example, with a
+					limit) to see the result here.
+				</div>
+			)}
+			{result.kind === 'failed' && (
+				<div className="border-red/40 bg-red/10 rounded-md border p-3 text-sm">
+					<p className="text-red font-medium">No response from Harper.</p>
+					<p className="text-muted-foreground mt-1 text-xs">{result.message}</p>
+					<p className="text-muted-foreground mt-2 text-xs">
+						{result.mayHaveRun
+							? `The ${operation} operation may or may not have run. Check before sending it again.`
+							: `The ${operation} operation was not sent.`}
+					</p>
+				</div>
+			)}
+		</section>
+	);
+}
diff --git a/src/features/instance/operations/operationKinds.test.ts b/src/features/instance/operations/operationKinds.test.ts
new file mode 100644
index 000000000..ca09e3f17
--- /dev/null
+++ b/src/features/instance/operations/operationKinds.test.ts
@@ -0,0 +1,22 @@
+import { isBuiltInRead } from '@/features/instance/operations/operationKinds';
+import { describe, expect, it } from 'vitest';
+
+describe('isBuiltInRead', () => {
+	it.each(['describe_all', 'search_by_value', 'search_by_id', 'get_configuration', 'list_users', 'read_log'])(
+		"lets Harper's own %s through without asking",
+		(operation) => {
+			expect(isBuiltInRead(operation)).toBe(true);
+		},
+	);
+
+	it.each(['get_and_rotate_key', 'search_and_destroy', 'read_then_delete', 'list_and_purge'])(
+		'asks about %s, a component operation that only looks like a read',
+		(operation) => {
+			expect(isBuiltInRead(operation)).toBe(false);
+		},
+	);
+
+	it.each(['insert', 'sql', 'drop_table', 'restart'])('asks about %s, a built-in that is not a read', (operation) => {
+		expect(isBuiltInRead(operation)).toBe(false);
+	});
+});
diff --git a/src/features/instance/operations/operationKinds.ts b/src/features/instance/operations/operationKinds.ts
new file mode 100644
index 000000000..b48803c36
--- /dev/null
+++ b/src/features/instance/operations/operationKinds.ts
@@ -0,0 +1,11 @@
+import { getOperationInfo } from '@/features/instance/config/roles/operations/operationsCatalog';
+import { isReadOperation } from '@/integrations/api/isReadOperation';
+
+/**
+ * A read Harper itself defines. The name alone is not enough: a component can register an
+ * operation called `get_and_rotate_key`, so anything outside Studio's catalog of Harper's own
+ * operations is treated as able to change something.
+ */
+export function isBuiltInRead(operation: string): boolean {
+	return isReadOperation(operation) && getOperationInfo(operation) !== undefined;
+}
diff --git a/src/features/instance/operations/parseOperationRequest.test.ts b/src/features/instance/operations/parseOperationRequest.test.ts
new file mode 100644
index 000000000..0a98d874f
--- /dev/null
+++ b/src/features/instance/operations/parseOperationRequest.test.ts
@@ -0,0 +1,43 @@
+import { parseOperationRequest } from '@/features/instance/operations/parseOperationRequest';
+import { describe, expect, it } from 'vitest';
+
+describe('parseOperationRequest', () => {
+	it('keeps the typed text, not a re-serialization of it', () => {
+		const text = '{ "operation": "search_by_id", "ids": [9007199254740993] }';
+		const parsed = parseOperationRequest(text);
+
+		expect(parsed).toEqual({ ok: true, request: { text, operation: 'search_by_id' } });
+	});
+
+	it('names where the JSON stopped parsing', () => {
+		const parsed = parseOperationRequest('{\n\t"operation": "describe_all",\n}');
+
+		expect(parsed.ok).toBe(false);
+		expect(!parsed.ok && parsed.error.location?.lineNumber).toBe(3);
+	});
+
+	it.each(['', '   \n\t'])('refuses an empty editor (%j)', (text) => {
+		const parsed = parseOperationRequest(text);
+
+		expect(parsed).toEqual({ ok: false, error: { message: 'The editor is empty, so there is nothing to send.' } });
+	});
+
+	it.each(['[{"operation":"describe_all"}]', '"describe_all"', 'null', '42'])(
+		'refuses %s, which is not a single object',
+		(text) => {
+			const parsed = parseOperationRequest(text);
+
+			expect(parsed).toEqual({ ok: false, error: { message: 'A request has to be a single JSON object.' } });
+		},
+	);
+
+	it.each(['{}', '{"operation": 1}', '{"operation": "  "}', '{"op": "describe_all"}'])(
+		'refuses %s, which names no operation',
+		(text) => {
+			const parsed = parseOperationRequest(text);
+
+			expect(parsed.ok).toBe(false);
+			expect(!parsed.ok && parsed.error.message).toMatch(/needs an "operation"/);
+		},
+	);
+});
diff --git a/src/features/instance/operations/parseOperationRequest.ts b/src/features/instance/operations/parseOperationRequest.ts
new file mode 100644
index 000000000..da9f42157
--- /dev/null
+++ b/src/features/instance/operations/parseOperationRequest.ts
@@ -0,0 +1,30 @@
+import { type RecordJsonError, tryParseJson } from '@/features/instance/databases/modals/recordEditorJson';
+
+export interface OperationRequest {
+	text: string;
+	operation: string;
+}
+
+type ParsedOperationRequest = { ok: true; request: OperationRequest } | { ok: false; error: RecordJsonError };
+
+export function parseOperationRequest(text: string): ParsedOperationRequest {
+	if (!text.trim()) {
+		return { ok: false, error: { message: 'The editor is empty, so there is nothing to send.' } };
+	}
+	const parsed = tryParseJson(text);
+	if (!parsed.ok) {
+		return parsed;
+	}
+	const { value } = parsed;
+	if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+		return { ok: false, error: { message: 'A request has to be a single JSON object.' } };
+	}
+	const { operation } = value as { operation?: unknown };
+	if (typeof operation !== 'string' || !operation.trim()) {
+		return {
+			ok: false,
+			error: { message: 'The request needs an "operation" naming what to run, such as "describe_all".' },
+		};
+	}
+	return { ok: true, request: { text, operation } };
+}
diff --git a/src/features/instance/operations/routes.ts b/src/features/instance/operations/routes.ts
new file mode 100644
index 000000000..f4c1a4b1f
--- /dev/null
+++ b/src/features/instance/operations/routes.ts
@@ -0,0 +1,11 @@
+import { createInstanceLayoutRoute } from '@/features/instance/instanceLayoutRoute';
+import { createRoute, lazyRouteComponent } from '@tanstack/react-router';
+
+export function createOperationsRouteTree(instanceLayoutRoute: ReturnType<typeof createInstanceLayoutRoute>) {
+	return createRoute({
+		getParentRoute: () => instanceLayoutRoute,
+		path: 'operations',
+		head: () => ({ meta: [{ title: 'Operations — Harper Fabric' }] }),
+		component: lazyRouteComponent(async () => import('@/features/instance/operations/index'), 'OperationsIndex'),
+	});
+}
diff --git a/src/features/instance/operations/sendOperation.test.ts b/src/features/instance/operations/sendOperation.test.ts
new file mode 100644
index 000000000..74c650eee
--- /dev/null
+++ b/src/features/instance/operations/sendOperation.test.ts
@@ -0,0 +1,235 @@
+/** @vitest-environment jsdom */
+import { MAX_RESPONSE_BYTES, sendOperation } from '@/features/instance/operations/sendOperation';
+import { AxiosError, type AxiosProgressEvent, CanceledError, type InternalAxiosRequestConfig } from 'axios';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('@/lib/sleep', () => ({ sleep: vi.fn().mockResolvedValue(true) }));
+
+const { getInstanceClient } = await import('@/config/getInstanceClient');
+const { markRestarting } = await import('@/lib/restart/restartTracker');
+
+const ENTITY_ID = 'ins-operations';
+
+type Adapter = (config: InternalAxiosRequestConfig) => Promise<unknown>;
+
+function respond(config: InternalAxiosRequestConfig, status: number, data: string, contentType = 'application/json') {
+	const response = {
+		status,
+		statusText: status === 200 ? 'OK' : 'Bad Gateway',
+		data,
+		headers: { 'content-type': contentType },
+		config,
+	};
+	if (status >= 200 && status < 300) {
+		return response;
+	}
+	// Status validation lives in axios's built-in adapters, so a custom one has to reject itself.
+	throw new AxiosError(
+		`Request failed with status code ${status}`,
+		AxiosError.ERR_BAD_RESPONSE,
+		config,
+		undefined,
+		response,
+	);
+}
+
+let sent: InternalAxiosRequestConfig[] = [];
+
+/** The real instance client — restart gate, replication check and gateway retry all installed. */
+function clientServing(adapter: Adapter) {
+	const client = getInstanceClient({ id: ENTITY_ID, operationsUrl: 'https://ins-operations.example.com:9925/' });
+	client.defaults.adapter = (config) => {
+		sent.push(config);
+		return adapter(config) as never;
+	};
+	return client;
+}
+
+beforeEach(() => {
+	sent = [];
+});
+
+describe('sendOperation', () => {
+	it('sends the typed text as-is, so integers past 2^53 reach Harper intact', async () => {
+		const text = '{"operation":"search_by_id","database":"dev","table":"dog","ids":[9007199254740993]}';
+		const client = clientServing(async (config) => respond(config, 200, '[]'));
+
+		await sendOperation(client, `  ${text}\n`);
+
+		expect(sent).toHaveLength(1);
+		expect(sent[0].data).toBe(text);
+		expect(String(sent[0].headers['Content-Type'])).toContain('application/json');
+	});
+
+	it('pretty-prints a JSON answer and reports its status', async () => {
+		const client = clientServing(async (config) => respond(config, 200, '{"message":"ok","count":2}'));
+		const clock = [100, 142];
+
+		const result = await sendOperation(client, '{"operation":"describe_all"}', { now: () => clock.shift()! });
+
+		expect(result).toEqual({
+			kind: 'response',
+			status: 200,
+			statusText: 'OK',
+			durationMs: 42,
+			body: '{\n\t"message": "ok",\n\t"count": 2\n}',
+		});
+	});
+
+	it('renders a non-JSON answer as the text Harper sent', async () => {
+		const client = clientServing(async (config) => respond(config, 200, 'not { json', 'text/plain'));
+
+		const result = await sendOperation(client, '{"operation":"describe_all"}');
+
+		expect(result).toMatchObject({ kind: 'response', body: 'not { json' });
+	});
+
+	it("shows Harper's error answer rather than throwing", async () => {
+		const client = clientServing(async (config) => respond(config, 400, '{"error":"Table \'dog\' does not exist"}'));
+
+		const result = await sendOperation(client, '{"operation":"drop_table","table":"dog"}');
+
+		expect(result).toMatchObject({
+			kind: 'response',
+			status: 400,
+			body: '{\n\t"error": "Table \'dog\' does not exist"\n}',
+		});
+	});
+
+	it.each([502, 503, 504])('sends exactly once when the gateway answers %i', async (status) => {
+		const client = clientServing(async (config) => respond(config, status, '{"error":"upstream"}'));
+
+		const result = await sendOperation(client, '{"operation":"insert","records":[{"name":"Harper"}]}');
+
+		expect(sent).toHaveLength(1);
+		expect(result).toMatchObject({ kind: 'response', status });
+	});
+
+	it('still retries a gateway error for every other request on the same client', async () => {
+		let attempts = 0;
+		const client = clientServing(async (config) => {
+			attempts += 1;
+			return attempts === 1 ? respond(config, 502, '') : respond(config, 200, '{}');
+		});
+
+		await client.post('/', { operation: 'describe_all' });
+
+		expect(sent).toHaveLength(2);
+	});
+
+	it('stops downloading a response past the size cap instead of buffering all of it', async () => {
+		const client = clientServing(async (config) => {
+			config.onDownloadProgress?.(
+				{ loaded: MAX_RESPONSE_BYTES + 1, bytes: MAX_RESPONSE_BYTES + 1 } as AxiosProgressEvent,
+			);
+			if (config.signal?.aborted) {
+				throw new CanceledError(undefined, config);
+			}
+			return respond(config, 200, 'x'.repeat(10));
+		});
+
+		const result = await sendOperation(client, '{"operation":"search_by_value","search_value":"*"}');
+
+		expect(result).toMatchObject({ kind: 'too-large' });
+	});
+
+	it('keeps downloading a response under the cap', async () => {
+		const client = clientServing(async (config) => {
+			config.onDownloadProgress?.({ loaded: MAX_RESPONSE_BYTES, bytes: MAX_RESPONSE_BYTES } as AxiosProgressEvent);
+			return respond(config, 200, '{}');
+		});
+
+		const result = await sendOperation(client, '{"operation":"describe_all"}');
+
+		expect(result).toMatchObject({ kind: 'response', status: 200 });
+	});
+
+	it('says an unanswered write may already have run', async () => {
+		const client = clientServing(async (config) => {
+			throw new AxiosError('timeout of 60000ms exceeded', AxiosError.ECONNABORTED, config);
+		});
+
+		const result = await sendOperation(client, '{"operation":"restart"}');
+
+		expect(result).toMatchObject({ kind: 'failed', message: 'timeout of 60000ms exceeded', mayHaveRun: true });
+	});
+
+	describe('while the instance is tracked as restarting', () => {
+		let release: () => void = () => {};
+		beforeEach(() => {
+			release = markRestarting([ENTITY_ID], { reach: 'down', ttlMs: 60_000 });
+		});
+		afterEach(() => release());
+
+		it('says a write the restart gate refused was never sent', async () => {
+			const client = clientServing(async (config) => respond(config, 200, '{}'));
+
+			const result = await sendOperation(client, '{"operation":"insert"}');
+
+			expect(sent).toHaveLength(0);
+			expect(result).toMatchObject({
+				kind: 'failed',
+				message: "This instance is restarting. Try again once it's back online.",
+				mayHaveRun: false,
+			});
+		});
+
+		it('sends past the gate when asked to, as the restart it is driving must', async () => {
+			const client = clientServing(async (config) => respond(config, 200, '{"message":"Restarting"}'));
+
+			const result = await sendOperation(client, '{"operation":"restart"}', { skipRestartGate: true });
+
+			expect(sent).toHaveLength(1);
+			expect(result).toMatchObject({ kind: 'response', status: 200 });
+		});
+	});
+
+	it('never sends when its caller is already gone', async () => {
+		const caller = new AbortController();
+		caller.abort();
+		const client = clientServing(async (config) => respond(config, 200, '{}'));
+
+		const result = await sendOperation(client, '{"operation":"insert"}', { signal: caller.signal });
+
+		expect(sent).toHaveLength(0);
+		expect(result).toMatchObject({ kind: 'failed', mayHaveRun: false });
+	});
+
+	it('says a request abandoned mid-flight may still have run', async () => {
+		const caller = new AbortController();
+		const client = clientServing(async (config) => {
+			caller.abort();
+			if (config.signal?.aborted) {
+				throw new CanceledError(undefined, config);
+			}
+			return respond(config, 200, '{}');
+		});
+
+		const result = await sendOperation(client, '{"operation":"insert"}', { signal: caller.signal });
+
+		expect(sent).toHaveLength(1);
+		expect(result).toMatchObject({
+			kind: 'failed',
+			message: 'Studio stopped waiting for the answer.',
+			mayHaveRun: true,
+		});
+	});
+
+	it("says a request Studio cancelled before sending, because its connection changed, didn't run", async () => {
+		const client = clientServing(async (config) => {
+			throw new AxiosError(
+				'Connection replaced before this request could be retried.',
+				AxiosError.ERR_CANCELED,
+				config,
+			);
+		});
+
+		const result = await sendOperation(client, '{"operation":"insert"}');
+
+		expect(result).toMatchObject({
+			kind: 'failed',
+			message: 'Connection replaced before this request could be retried.',
+			mayHaveRun: false,
+		});
+	});
+});
diff --git a/src/features/instance/operations/sendOperation.ts b/src/features/instance/operations/sendOperation.ts
new file mode 100644
index 000000000..9c873d749
--- /dev/null
+++ b/src/features/instance/operations/sendOperation.ts
@@ -0,0 +1,119 @@
+import { formatResponseBody } from '@/features/instance/apis/explorer/request';
+import { errorText } from '@/lib/errorText';
+import { RESTARTING_ERROR_CODE } from '@/lib/restart/restartGate';
+import { type AxiosInstance, isAxiosError } from 'axios';
+
+/**
+ * The download is abandoned once progress reports more than this. axios buffers a whole body before
+ * resolving, and the browser reports progress about every 50 ms, so this bounds how much an
+ * unbounded `search` can pull into the tab rather than capping it to the byte.
+ */
+export const MAX_RESPONSE_BYTES = 5_000_000;
+
+export type OperationResult =
+	| { kind: 'response'; status: number; statusText: string; durationMs: number; body: string }
+	| { kind: 'too-large'; durationMs: number }
+	| { kind: 'failed'; durationMs: number; message: string; mayHaveRun: boolean };
+
+/**
+ * Send one operations-API body and describe what came back. Never throws: every failure becomes a
+ * result the page renders inline, so nothing here reaches the global error handlers.
+ *
+ * `text` is sent as typed rather than re-serialized from a parse, which would round integers past
+ * 2^53 (a primary key among them) before Harper ever saw them.
+ */
+export async function sendOperation(
+	instanceClient: Pick<AxiosInstance, 'post'>,
+	text: string,
+	{ signal, skipRestartGate, now = () => Date.now() }: {
+		signal?: AbortSignal;
+		skipRestartGate?: boolean;
+		now?: () => number;
+	} = {},
+): Promise<OperationResult> {
+	const start = now();
+	const elapsed = () => Math.round(now() - start);
+	if (signal?.aborted) {
+		return {
+			kind: 'failed',
+			durationMs: 0,
+			message: 'The request was cancelled before it was sent.',
+			mayHaveRun: false,
+		};
+	}
+	const download = new AbortController();
+	const abandon = () => download.abort();
+	signal?.addEventListener('abort', abandon);
+	let tooLarge = false;
+	try {
+		const response = await instanceClient.post('/', text, {
+			responseType: 'text',
+			skipGatewayRetry: true,
+			skipRestartGate,
+			signal: download.signal,
+			onDownloadProgress: ({ loaded }) => {
+				if (loaded > MAX_RESPONSE_BYTES) {
+					tooLarge = true;
+					download.abort();
+				}
+			},
+		});
+		return describeResponse(response, elapsed());
+	} catch (error) {
+		if (tooLarge) {
+			return { kind: 'too-large', durationMs: elapsed() };
+		}
+		if (isAxiosError(error) && error.response) {
+			return describeResponse(error.response, elapsed());
+		}
+		if (download.signal.aborted) {
+			// Abandoned mid-flight: aborting the download does not undo a write Harper already took.
+			return {
+				kind: 'failed',
+				durationMs: elapsed(),
+				message: 'Studio stopped waiting for the answer.',
+				mayHaveRun: true,
+			};
+		}
+		return { kind: 'failed', durationMs: elapsed(), ...describeFailure(error) };
+	} finally {
+		signal?.removeEventListener('abort', abandon);
+	}
+}
+
+function describeResponse(
+	{ status, statusText, data, headers }: { status: number; statusText?: string; data?: unknown; headers?: unknown },
+	durationMs: number,
+): OperationResult {
+	const contentType = (headers as Record<string, unknown> | undefined)?.['content-type'];
+	return {
+		kind: 'response',
+		status,
+		statusText: statusText ?? '',
+		durationMs,
+		body: formatResponseBody(bodyText(data), typeof contentType === 'string' ? contentType : null),
+	};
+}
+
+function bodyText(data: unknown): string {
+	if (typeof data === 'string') {
+		return data;
+	}
+	try {
+		return JSON.stringify(data) ?? '';
+	} catch {
+		return '';
+	}
+}
+
+/**
+ * Whether an unanswered request may still have been applied is what decides if resending is safe.
+ * Only Studio's own gates refuse before sending: the restart gate, and a client cancelling a request
+ * whose connection changed under it.
+ */
+function describeFailure(error: unknown): { message: string; mayHaveRun: boolean } {
+	if (isAxiosError(error) && (error.code === RESTARTING_ERROR_CODE || error.code === 'ERR_CANCELED')) {
+		return { message: errorText(error) ?? 'The request was cancelled before it was sent.', mayHaveRun: false };
+	}
+	return { message: errorText(error) ?? 'The request failed before Harper answered.', mayHaveRun: true };
+}
diff --git a/src/features/instance/routes.ts b/src/features/instance/routes.ts
index bd451bed6..7846724f9 100644
--- a/src/features/instance/routes.ts
+++ b/src/features/instance/routes.ts
@@ -4,6 +4,7 @@ import { createConfigRouteTree } from '@/features/instance/config/routes';
 import { createBrowseRouteTree } from '@/features/instance/databases/routes';
 import { createInstanceLayoutRoute } from '@/features/instance/instanceLayoutRoute';
 import { createLogRouteTree } from '@/features/instance/log/routes';
+import { createOperationsRouteTree } from '@/features/instance/operations/routes';
 import { createStatusRouteTree } from '@/features/instance/status/routes';
 
 export function createInstanceRouteTree(mode: 'local' | 'cluster' | 'instance') {
@@ -13,6 +14,7 @@ export function createInstanceRouteTree(mode: 'local' | 'cluster' | 'instance')
 		createLogRouteTree(instanceLayoutRoute),
 		...createApplicationsRoutes(instanceLayoutRoute, mode),
 		createAPIsRouteTree(instanceLayoutRoute),
+		createOperationsRouteTree(instanceLayoutRoute),
 		createStatusRouteTree(instanceLayoutRoute),
 		createConfigRouteTree(instanceLayoutRoute),
 		createBrowseRouteTree(instanceLayoutRoute),
diff --git a/src/features/instance/secrets/SecretModals.tsx b/src/features/instance/secrets/SecretModals.tsx
index 8e247ec16..807875ea7 100644
--- a/src/features/instance/secrets/SecretModals.tsx
+++ b/src/features/instance/secrets/SecretModals.tsx
@@ -25,7 +25,7 @@ import { revealFieldErrorOnEnter } from '@/components/ui/form/revealFieldErrorOn
 import { Input } from '@/components/ui/input';
 import { Textarea } from '@/components/ui/textarea';
 import { ENV_KEY_REGEX, ENV_VALUE_MASK } from '@/lib/env/envFile';
-import { describeError } from '@/react-query/queryClient';
+import { describeError, shouldToastOwnFailure } from '@/react-query/queryClient';
 import { zodResolver } from '@hookform/resolvers/zod';
 import { EyeIcon, Save, Trash2 } from 'lucide-react';
 import { ReactNode, useCallback, useMemo, useState } from 'react';
@@ -118,7 +118,9 @@ export function AddSecretModal({
 				toast.success(`Secret "${formData.key}" saved.`);
 				setIsModalOpen(false);
 			} catch (error) {
-				toast.error(describeError(error).message);
+				if (shouldToastOwnFailure(error)) {
+					toast.error(describeError(error).message);
+				}
 			}
 		},
 		[onSubmit, form, setIsModalOpen, delivery, tier, grants, resetDelivery],
@@ -282,7 +284,9 @@ export function EditSecretModal({
 				toast.success(`Secret "${name}" updated.`);
 				closeModal();
 			} catch (error) {
-				toast.error(describeError(error).message);
+				if (shouldToastOwnFailure(error)) {
+					toast.error(describeError(error).message);
+				}
 			}
 		},
 		[onSave, name, closeModal, delivery, tier],
@@ -301,7 +305,9 @@ export function EditSecretModal({
 			toast.success(`Secret "${name}" deleted.`);
 			closeModal();
 		} catch (error) {
-			toast.error(describeError(error).message);
+			if (shouldToastOwnFailure(error)) {
+				toast.error(describeError(error).message);
+			}
 		} finally {
 			setIsDeleting(false);
 		}
diff --git a/src/features/organization/roles/modals/AddOrganizationRoleModal.test.tsx b/src/features/organization/roles/modals/AddOrganizationRoleModal.test.tsx
index 1c652ac50..b57320cca 100644
--- a/src/features/organization/roles/modals/AddOrganizationRoleModal.test.tsx
+++ b/src/features/organization/roles/modals/AddOrganizationRoleModal.test.tsx
@@ -13,10 +13,13 @@ vi.mock('@tanstack/react-query', async (importOriginal) => ({
 	...(await importOriginal<typeof import('@tanstack/react-query')>()),
 	useQueryClient: () => ({ invalidateQueries: vi.fn() }),
 }));
+const { mutate } = vi.hoisted(() => ({ mutate: vi.fn() }));
 vi.mock('@/features/organization/mutations/addOrganizationRole', () => ({
-	useAddOrganizationRole: () => ({ mutate: vi.fn(), isPending: false }),
+	useAddOrganizationRole: () => ({ mutate, isPending: false }),
 }));
 
+import { AxiosError, type InternalAxiosRequestConfig } from 'axios';
+import { toast } from 'sonner';
 import { AddOrganizationRoleModal } from './AddOrganizationRoleModal';
 
 beforeAll(() => {
@@ -76,4 +79,27 @@ describe('AddOrganizationRoleModal', () => {
 		expect(await screen.findByText(message)).toBeTruthy();
 		expect((screen.getByRole('button', { name: 'Save Changes' }) as HTMLButtonElement).disabled).toBe(true);
 	});
+
+	it.each([
+		['a refused one says it failed', new Error('Role already exists'), 1],
+		[
+			'one that got no answer leaves it to the global toast',
+			new AxiosError('Network Error', AxiosError.ERR_NETWORK, {
+				method: 'post',
+				data: '{"name":"readers"}',
+			} as InternalAxiosRequestConfig),
+			0,
+		],
+	])('of the failed adds, %s', async (_, error, ownToasts) => {
+		vi.mocked(toast.error).mockClear();
+		mutate.mockImplementation((_data, { onError }) => onError(error));
+		render(<AddOrganizationRoleModal isModalOpen setIsModalOpen={() => {}} />);
+		await typeRoleName('readers');
+		await act(async () => {
+			fireEvent.click(screen.getByRole('button', { name: 'Save Changes' }));
+		});
+
+		expect(mutate).toHaveBeenCalled();
+		expect(toast.error).toHaveBeenCalledTimes(ownToasts);
+	});
 });
diff --git a/src/features/organization/roles/modals/AddOrganizationRoleModal.tsx b/src/features/organization/roles/modals/AddOrganizationRoleModal.tsx
index 458c8baec..cde3e0687 100644
--- a/src/features/organization/roles/modals/AddOrganizationRoleModal.tsx
+++ b/src/features/organization/roles/modals/AddOrganizationRoleModal.tsx
@@ -19,6 +19,7 @@ import {
 import { useMonacoTheme } from '@/hooks/useMonacoTheme';
 import { Editor } from '@/lib/monaco/MonacoEditor';
 import { safeParse } from '@/lib/string/safeParse';
+import { shouldToastOwnFailure } from '@/react-query/queryClient';
 import { zodResolver } from '@hookform/resolvers/zod';
 import { useQueryClient } from '@tanstack/react-query';
 import { useParams } from '@tanstack/react-router';
@@ -97,7 +98,9 @@ export function AddOrganizationRoleModal({
 						form.reset();
 					},
 					onError: (error: Error) => {
-						toast.error(`Failed to add organization role: ${error.message}`);
+						if (shouldToastOwnFailure(error)) {
+							toast.error(`Failed to add organization role: ${error.message}`);
+						}
 					},
 				});
 			}
diff --git a/src/features/organization/roles/modals/EditOrganizationRoleModal.tsx b/src/features/organization/roles/modals/EditOrganizationRoleModal.tsx
index 2b7fbcaef..bfc9b24c6 100644
--- a/src/features/organization/roles/modals/EditOrganizationRoleModal.tsx
+++ b/src/features/organization/roles/modals/EditOrganizationRoleModal.tsx
@@ -23,6 +23,7 @@ import { useOrganizationRolePermissions } from '@/hooks/usePermissions';
 import { SchemaOrganizationRole } from '@/integrations/api/api.gen';
 import { Editor } from '@/lib/monaco/MonacoEditor';
 import { safeParse } from '@/lib/string/safeParse';
+import { shouldToastOwnFailure } from '@/react-query/queryClient';
 import { zodResolver } from '@hookform/resolvers/zod';
 import { useQueryClient, useSuspenseQuery } from '@tanstack/react-query';
 import { Suspense, useCallback, useMemo, useState } from 'react';
@@ -107,6 +108,9 @@ function EditOrganizationRoleModalContent({
 					form.reset();
 				},
 				onError: (error: Error | unknown) => {
+					if (!shouldToastOwnFailure(error)) {
+						return;
+					}
 					toast.error('Error', {
 						description: `Failed to delete role: ${error instanceof Error ? error.message : String(error)}.`,
 						action: {
@@ -173,6 +177,9 @@ function EditOrganizationRoleModalContent({
 							form.reset();
 						},
 						onError: (error: Error | unknown) => {
+							if (!shouldToastOwnFailure(error)) {
+								return;
+							}
 							toast.error('Error', {
 								description: `Failed to update role: ${error instanceof Error ? error.message : String(error)}.`,
 								action: {
diff --git a/src/features/organization/settings/index.tsx b/src/features/organization/settings/index.tsx
index 62b910dc1..3e06351ca 100644
--- a/src/features/organization/settings/index.tsx
+++ b/src/features/organization/settings/index.tsx
@@ -18,6 +18,7 @@ import { useOrganizationPermissions } from '@/hooks/usePermissions';
 import { SchemaOrganization } from '@/integrations/api/api.gen';
 import { OAuthConfig } from '@/integrations/api/api.patch';
 import { getOAuthSignInUrl } from '@/lib/urls/getOAuthSignInUrl';
+import { shouldToastOwnFailure } from '@/react-query/queryClient';
 import { zodResolver } from '@hookform/resolvers/zod';
 import { useMutation, useQueryClient, useSuspenseQuery } from '@tanstack/react-query';
 import { useParams } from '@tanstack/react-router';
@@ -80,7 +81,11 @@ export function OrgSettingsIndex() {
 	const { mutate: patch, isPending } = useMutation({
 		mutationFn: (payload: Partial<OAuthConfig> & { provider: string }) => patchOAuthConfig(organizationId, payload),
 		onSuccess: () => void queryClient.invalidateQueries({ queryKey: [organizationId] }),
-		onError: () => toast.error('Failed to update OAuth settings.'),
+		onError: (error) => {
+			if (shouldToastOwnFailure(error)) {
+				toast.error('Failed to update OAuth settings.');
+			}
+		},
 	});
 
 	// Add
diff --git a/src/features/organization/users/modals/EditUserModal.tsx b/src/features/organization/users/modals/EditUserModal.tsx
index 22e71c4ff..7ade43c5e 100644
--- a/src/features/organization/users/modals/EditUserModal.tsx
+++ b/src/features/organization/users/modals/EditUserModal.tsx
@@ -10,6 +10,7 @@ import { useCloudAuth } from '@/hooks/useAuth';
 import { useOrganizationRolePermissions } from '@/hooks/usePermissions';
 import { SchemaUser } from '@/integrations/api/api.gen';
 import { keyBy } from '@/lib/keyBy';
+import { shouldToastOwnFailure } from '@/react-query/queryClient';
 import { useSuspenseQuery } from '@tanstack/react-query';
 import { useParams } from '@tanstack/react-router';
 import { AxiosError } from 'axios';
@@ -59,16 +60,16 @@ export function EditUserModal({
 		const results = await Promise.allSettled(
 			roles.map((role) => removeUserFromRole({ userId: data.id, roleId: role.id })),
 		);
-		const failed = results.some(
-			(result) => result.status === 'rejected' && (result.reason as AxiosError)?.response?.status !== 404,
+		const failures = results.flatMap((result) =>
+			result.status === 'rejected' && (result.reason as AxiosError)?.response?.status !== 404 ? [result.reason] : []
 		);
-		if (failed) {
+		if (failures.some(shouldToastOwnFailure)) {
 			toast.error(
 				isSelf
 					? 'Something went wrong leaving the organization. Please try again.'
 					: `Couldn’t remove ${data.email} from the organization. Please try again.`,
 			);
-		} else {
+		} else if (failures.length === 0) {
 			toast.success(
 				isSelf
 					? 'You’ve left the organization.'
diff --git a/src/hooks/useApplyLicensesClick.test.tsx b/src/hooks/useApplyLicensesClick.test.tsx
index 87f4f5a62..5dd6c7411 100644
--- a/src/hooks/useApplyLicensesClick.test.tsx
+++ b/src/hooks/useApplyLicensesClick.test.tsx
@@ -2,8 +2,10 @@
  * @vitest-environment jsdom
  */
 import type { SchemaLicense } from '@/integrations/api/api.gen';
+import { OUTCOME_UNKNOWN_TITLE } from '@/integrations/api/unansweredWrite';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { act, renderHook } from '@testing-library/react';
+import { AxiosError, type InternalAxiosRequestConfig } from 'axios';
 import { PropsWithChildren } from 'react';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
@@ -28,6 +30,7 @@ import { toast } from 'sonner';
 import { useApplyLicensesClick } from './useApplyLicensesClick';
 
 const LICENSES = [{ license: 'lic-1' }, { license: 'lic-2' }] as SchemaLicense[];
+const installSent = { method: 'post', data: '{"operation":"install_usage_license"}' } as InternalAxiosRequestConfig;
 
 function wrapper() {
 	const queryClient = new QueryClient();
@@ -35,8 +38,8 @@ function wrapper() {
 	</QueryClientProvider>;
 }
 
-async function applyLicenses() {
-	const { result } = renderHook(() => useApplyLicensesClick({ licenses: LICENSES }), { wrapper: wrapper() });
+async function applyLicenses(licenses = LICENSES) {
+	const { result } = renderHook(() => useApplyLicensesClick({ licenses }), { wrapper: wrapper() });
 	await act(async () => {
 		await (result.current.onApplyLicensesClick() as unknown as Promise<void>);
 	});
@@ -70,6 +73,49 @@ describe('useApplyLicensesClick', () => {
 		expect(installUsageLicense).not.toHaveBeenCalled();
 		expect(toast.error).toHaveBeenCalledWith('Cancelled', expect.anything());
 	});
+
+	it('counts a license that got no answer apart from one that failed', async () => {
+		vi.mocked(installUsageLicense)
+			.mockResolvedValueOnce({} as never)
+			.mockRejectedValueOnce(new AxiosError('timeout of 60000ms exceeded', AxiosError.ECONNABORTED, installSent));
+
+		await applyLicenses();
+
+		const [title, options] = vi.mocked(toast.error).mock.calls.at(-1)!;
+		expect(title).toBe(OUTCOME_UNKNOWN_TITLE);
+		expect(options?.description).toBe(
+			"1 of 2 licenses confirmed applied. 1 request couldn't be confirmed, so it may have gone through. "
+				+ 'Check before you try again, or it may run twice.',
+		);
+	});
+
+	it('still counts a refused license when another got no answer', async () => {
+		vi.mocked(installUsageLicense)
+			.mockResolvedValueOnce({} as never)
+			.mockRejectedValueOnce(new AxiosError('timeout of 60000ms exceeded', AxiosError.ECONNABORTED, installSent))
+			.mockRejectedValueOnce(new Error('License is expired'));
+
+		await applyLicenses([...LICENSES, { license: 'lic-3' }] as SchemaLicense[]);
+
+		const [title, options] = vi.mocked(toast.error).mock.calls.at(-1)!;
+		expect(title).toBe(OUTCOME_UNKNOWN_TITLE);
+		expect(options?.description).toBe(
+			"1 of 3 licenses confirmed applied. 1 request couldn't be confirmed, so it may have gone through. "
+				+ 'Check before you try again, or it may run twice. 1 other license failed to apply.',
+		);
+	});
+
+	it('still says a refused license was not applied', async () => {
+		vi.mocked(installUsageLicense)
+			.mockResolvedValueOnce({} as never)
+			.mockRejectedValueOnce(new Error('License is expired'));
+
+		await applyLicenses();
+
+		const [title, options] = vi.mocked(toast.error).mock.calls.at(-1)!;
+		expect(title).toBe('Error');
+		expect(options?.description).toBe('Licenses not applied.\n1 of 2 licenses applied.');
+	});
 });
 
 function cancel() {
diff --git a/src/hooks/useApplyLicensesClick.tsx b/src/hooks/useApplyLicensesClick.tsx
index 493838764..8ea696df4 100644
--- a/src/hooks/useApplyLicensesClick.tsx
+++ b/src/hooks/useApplyLicensesClick.tsx
@@ -3,7 +3,9 @@ import { useInstanceClient, useInstanceClientIdParams } from '@/config/useInstan
 import { SchemaLicense } from '@/integrations/api/api.gen';
 import { installUsageLicense } from '@/integrations/api/instance/auth/installUsageLicense';
 import { getInstanceUserInfo } from '@/integrations/api/instance/status/getInstanceUserInfo';
+import { describeUnansweredWrites, isUnansweredWrite, OUTCOME_UNKNOWN_TITLE } from '@/integrations/api/unansweredWrite';
 import { excludeFalsy } from '@/lib/arrays/excludeFalsy';
+import { pluralize } from '@/lib/pluralize';
 import { sleep } from '@/lib/sleep';
 import { useQueryClient } from '@tanstack/react-query';
 import { useCallback, useState } from 'react';
@@ -50,6 +52,8 @@ export function useApplyLicensesClick({ licenses }: ApplyLicensesClickParams): A
 		});
 
 		let licensesApplied = 0;
+		let licensesUnanswered = 0;
+		let licensesFailed = 0;
 
 		for (let i = 0; i < licenses.length; i++) {
 			const license = licenses[i];
@@ -83,10 +87,14 @@ export function useApplyLicensesClick({ licenses }: ApplyLicensesClickParams): A
 						instanceClient,
 					});
 					licensesApplied += 1;
-				} catch {
+				} catch (error) {
+					const unanswered = isUnansweredWrite(error);
+					licensesUnanswered += unanswered ? 1 : 0;
+					licensesFailed += unanswered ? 0 : 1;
 					if (i + 1 !== licenses.length) {
 						// If it fails to applyLicenses, or wasn't available, warn for a bit then move on.
-						toast.loading(`Failed Applying License ${i + 1} of ${licenses.length}`, {
+						const verdict = unanswered ? 'Could Not Confirm' : 'Failed Applying';
+						toast.loading(`${verdict} License ${i + 1} of ${licenses.length}`, {
 							...toastConfig,
 							id: toastId,
 							description: 'We will carry on momentarily.',
@@ -127,13 +135,19 @@ export function useApplyLicensesClick({ licenses }: ApplyLicensesClickParams): A
 				},
 			});
 		} else {
-			toast.error('Error', {
+			toast.error(licensesUnanswered ? OUTCOME_UNKNOWN_TITLE : 'Error', {
 				id: toastId,
-				description: `${licenseWord} not applied.\n`
-					+ ([
-						licensesApplied > 0 && licenses.length !== licensesApplied
-						&& `${licensesApplied} of ${licenses.length} ${licenseWord.toLowerCase()} applied.`,
-					].filter(excludeFalsy).shift() || ''),
+				description: licensesUnanswered
+					? [
+						`${licensesApplied} of ${licenses.length} ${licenseWord.toLowerCase()} confirmed applied.`,
+						describeUnansweredWrites(licensesUnanswered),
+						licensesFailed > 0 && `${pluralize(licensesFailed, 'other license', 'other licenses')} failed to apply.`,
+					].filter(excludeFalsy).join(' ')
+					: `${licenseWord} not applied.\n`
+						+ ([
+							licensesApplied > 0 && licenses.length !== licensesApplied
+							&& `${licensesApplied} of ${licenses.length} ${licenseWord.toLowerCase()} applied.`,
+						].filter(excludeFalsy).shift() || ''),
 				duration: 10_000,
 				action: {
 					label: 'Dismiss',
diff --git a/src/hooks/useRestartClusterClick.test.tsx b/src/hooks/useRestartClusterClick.test.tsx
index 5d89b76a3..a4e90b93e 100644
--- a/src/hooks/useRestartClusterClick.test.tsx
+++ b/src/hooks/useRestartClusterClick.test.tsx
@@ -2,9 +2,11 @@
  * @vitest-environment jsdom
  */
 import type { Cluster, Instance } from '@/integrations/api/api.patch';
-import { getRestartState } from '@/lib/restart/restartTracker';
+import { RestartUnconfirmedError } from '@/integrations/api/instance/status/restartUnconfirmed';
+import { describeUnansweredWrites, OUTCOME_UNKNOWN_TITLE } from '@/integrations/api/unansweredWrite';
+import { getRestartState, resetRestartTracker } from '@/lib/restart/restartTracker';
 import { act, renderHook } from '@testing-library/react';
-import type { AxiosInstance } from 'axios';
+import { AxiosError, type AxiosInstance, type InternalAxiosRequestConfig } from 'axios';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
 vi.mock('@tanstack/react-router', () => ({
@@ -18,7 +20,11 @@ vi.mock('@/features/auth/store/authStore', () => ({
 }));
 vi.mock('@/features/cluster/queries/getClusterInfoQuery', () => ({ getClusterInfo: vi.fn() }));
 vi.mock('@/integrations/api/instance/status/getInstanceUserInfo', () => ({ getInstanceUserInfo: vi.fn() }));
-vi.mock('@/integrations/api/instance/status/restartInstance', () => ({ restartInstance: vi.fn() }));
+vi.mock('@/integrations/api/instance/status/restartInstance', () => ({
+	RESTART_MARK_TTL_MS: 600_000,
+	restartInstance: vi.fn(),
+	waitUntilAnsweringAfterRestart: vi.fn(),
+}));
 vi.mock('@/lib/sleep', () => ({ sleep: vi.fn(() => Promise.resolve()) }));
 vi.mock('sonner', () => ({
 	toast: { loading: vi.fn(() => 'toast-1'), error: vi.fn(), success: vi.fn(), dismiss: vi.fn() },
@@ -27,7 +33,7 @@ vi.mock('sonner', () => ({
 import { getInstanceClient } from '@/config/getInstanceClient';
 import { getClusterInfo } from '@/features/cluster/queries/getClusterInfoQuery';
 import { getInstanceUserInfo } from '@/integrations/api/instance/status/getInstanceUserInfo';
-import { restartInstance } from '@/integrations/api/instance/status/restartInstance';
+import { restartInstance, waitUntilAnsweringAfterRestart } from '@/integrations/api/instance/status/restartInstance';
 import { toast } from 'sonner';
 import { useRestartClusterClick } from './useRestartClusterClick';
 
@@ -58,7 +64,9 @@ async function clickRestart() {
 
 beforeEach(() => {
 	restarted = [];
+	resetRestartTracker();
 	vi.mocked(getInstanceUserInfo).mockResolvedValue({} as never);
+	vi.mocked(waitUntilAnsweringAfterRestart).mockResolvedValue(undefined);
 	vi.mocked(restartInstance).mockImplementation(async ({ instanceClient }) => {
 		restarted.push(targetOf(instanceClient));
 		return { message: 'ok' };
@@ -124,6 +132,33 @@ describe('useRestartClusterClick', () => {
 		expect(options?.description).not.toContain('No instances were in a "RUNNING" state');
 	});
 
+	it('counts a member whose restart got no verdict apart from one that failed', async () => {
+		vi.mocked(getClusterInfo).mockResolvedValue(
+			{ id: 'clu-1', instances: [instance('ins-a'), instance('ins-b')] } as Cluster,
+		);
+		vi.mocked(restartInstance).mockImplementation(async ({ instanceClient }) => {
+			if (targetOf(instanceClient) === 'ins-b') {
+				throw new AxiosError('timeout of 60000ms exceeded', AxiosError.ECONNABORTED, {
+					method: 'post',
+					data: '{"operation":"restart"}',
+				} as InternalAxiosRequestConfig);
+			}
+			restarted.push(targetOf(instanceClient));
+			return { message: 'ok' };
+		});
+
+		await clickRestart();
+
+		expect(restarted).toEqual(['ins-a']);
+		expect(toast.loading).toHaveBeenCalledWith('Could Not Confirm Instance 1 of 2', expect.anything());
+		const [title, options] = vi.mocked(toast.error).mock.calls.at(-1)!;
+		expect(title).toBe(OUTCOME_UNKNOWN_TITLE);
+		expect(options?.description).toBe(
+			'Only 1 "RUNNING" instance was confirmed restarted of 2 instances. '
+				+ describeUnansweredWrites(1),
+		);
+	});
+
 	it('reports a cluster with no instances as a failure, not a success', async () => {
 		vi.mocked(getClusterInfo).mockResolvedValue({ id: 'clu-1', instances: [] } as unknown as Cluster);
 
@@ -169,3 +204,293 @@ function cancel() {
 	const [, options] = vi.mocked(toast.loading).mock.calls.at(-1)!;
 	(options as unknown as { action: { onClick: () => void } }).action.onClick();
 }
+
+function answeredWith(status: number) {
+	const config = { method: 'post', data: { operation: 'restart' } } as never;
+	const code = status >= 500 ? AxiosError.ERR_BAD_RESPONSE : AxiosError.ERR_BAD_REQUEST;
+	return new AxiosError(`Request failed with status code ${status}`, code, config, undefined, {
+		status,
+		statusText: '',
+		data: status === 504 ? 'Proxied operation timed out after 30s on instance ins-b' : { error: 'Not allowed' },
+		headers: {},
+		config,
+	});
+}
+
+function refused() {
+	return answeredWith(403);
+}
+
+function notBackYet() {
+	return new RestartUnconfirmedError(new AxiosError('timeout of 3000ms exceeded', AxiosError.ECONNABORTED));
+}
+
+function restartsEndingIn(outcomes: Record<string, Error | Promise<void>>) {
+	vi.mocked(restartInstance).mockImplementation(async ({ instanceClient, onSlowToReturn }) => {
+		const target = targetOf(instanceClient);
+		restarted.push(target);
+		const outcome = outcomes[target];
+		if (outcome instanceof RestartUnconfirmedError) {
+			onSlowToReturn?.();
+		}
+		if (outcome instanceof Error) {
+			throw outcome;
+		}
+		if (outcome) {
+			onSlowToReturn?.();
+			await outcome;
+		}
+		return { message: 'Restarting Harper. This may take up to 60 seconds.' };
+	});
+}
+
+function finalError() {
+	const [title, options] = vi.mocked(toast.error).mock.calls.at(-1) ?? [];
+	return { title, description: (options as { description?: string } | undefined)?.description };
+}
+
+describe('useRestartClusterClick, for a member whose restart got no answer', () => {
+	beforeEach(() => {
+		vi.mocked(getClusterInfo).mockResolvedValue(
+			{ id: 'clu-1', instances: [instance('ins-a'), instance('ins-b'), instance('ins-c')] } as Cluster,
+		);
+	});
+
+	it('holds it down, and waits for it to answer, before restarting the next member', async () => {
+		let answer: (() => void) | undefined;
+		vi.mocked(waitUntilAnsweringAfterRestart).mockReturnValueOnce(new Promise<void>((resolve) => (answer = resolve)));
+		restartsEndingIn({ 'ins-b': answeredWith(504) });
+		const { result } = renderHook(() => useRestartClusterClick());
+
+		let click: Promise<void> | undefined;
+		act(() => {
+			click = result.current.onRestartClick() as unknown as Promise<void>;
+		});
+		await vi.waitFor(() => expect(waitUntilAnsweringAfterRestart).toHaveBeenCalledTimes(1));
+
+		expect(targetOf(vi.mocked(waitUntilAnsweringAfterRestart).mock.calls[0][0].instanceClient)).toBe('ins-b');
+		expect(restarted).toEqual(['ins-c', 'ins-b']);
+		expect(getRestartState('ins-b')?.reach).toBe('down');
+
+		await act(async () => {
+			answer!();
+			await click;
+		});
+
+		expect(restarted).toEqual(['ins-c', 'ins-b', 'ins-a']);
+		expect(getRestartState('ins-b')).toBeUndefined();
+		expect(vi.mocked(toast.error).mock.calls.at(-1)?.[0]).toBe(OUTCOME_UNKNOWN_TITLE);
+	});
+
+	it('does not wait on a member that refused the restart', async () => {
+		restartsEndingIn({ 'ins-b': answeredWith(403) });
+
+		await clickRestart();
+
+		expect(restarted).toEqual(['ins-c', 'ins-b', 'ins-a']);
+		expect(waitUntilAnsweringAfterRestart).not.toHaveBeenCalled();
+		expect(vi.mocked(toast.error).mock.calls.at(-1)?.[0]).toBe('Error');
+	});
+
+	it('stops there when Studio cannot confirm it came back either, rather than restart the next member', async () => {
+		vi.mocked(waitUntilAnsweringAfterRestart).mockRejectedValueOnce(new Error('timeout of 3000ms exceeded'));
+		restartsEndingIn({ 'ins-b': answeredWith(504) });
+
+		await clickRestart();
+
+		expect(restarted).toEqual(['ins-c', 'ins-b']);
+		expect(getRestartState('ins-b')).toBeUndefined();
+		expect(finalError()).toEqual({
+			title: OUTCOME_UNKNOWN_TITLE,
+			description: 'Only 1 "RUNNING" instance was confirmed restarted of 3 instances. '
+				+ `${describeUnansweredWrites(1)} `
+				+ "Studio couldn't confirm it came back either, so it may still be starting. "
+				+ '1 other instance was not restarted, to keep the cluster available. '
+				+ 'Check its status before you restart it again.',
+		});
+	});
+
+	it('names the members a Cancel left alone, beside the warning, when Cancel lands while waiting on it', async () => {
+		vi.mocked(waitUntilAnsweringAfterRestart).mockImplementationOnce(async () => cancel());
+		restartsEndingIn({ 'ins-b': answeredWith(504) });
+
+		await clickRestart();
+
+		expect(restarted).toEqual(['ins-c', 'ins-b']);
+		expect(finalError()).toEqual({
+			title: OUTCOME_UNKNOWN_TITLE,
+			description: 'Only 1 "RUNNING" instance was confirmed restarted of 3 instances. '
+				+ `${describeUnansweredWrites(1)} `
+				+ '1 other instance was not restarted: Cancel stopped it there.',
+		});
+	});
+});
+
+describe('useRestartClusterClick, for a member that accepted the restart but was never confirmed back', () => {
+	beforeEach(() => {
+		vi.mocked(getClusterInfo).mockResolvedValue(
+			{ id: 'clu-1', instances: [instance('ins-a'), instance('ins-b'), instance('ins-c')] } as Cluster,
+		);
+	});
+
+	it('stops there rather than restart another member, and never says the cluster failed', async () => {
+		restartsEndingIn({ 'ins-b': notBackYet() });
+
+		await clickRestart();
+
+		expect(restarted).toEqual(['ins-c', 'ins-b']);
+		expect(toast.loading).toHaveBeenCalledWith(
+			'Waiting On Instance 2 of 3',
+			expect.objectContaining({ description: "It accepted the restart but isn't back yet." }),
+		);
+		expect(finalError()).toEqual({
+			title: 'Not back yet',
+			description: 'Only 1 "RUNNING" instance was confirmed restarted of 3 instances. '
+				+ "1 instance accepted the restart but couldn't be confirmed back, so it may still be starting. "
+				+ '1 other instance was not restarted, to keep the cluster available. '
+				+ 'Check its status before you restart it again.',
+		});
+		expect(toast.success).not.toHaveBeenCalled();
+		expect(getRestartState('ins-b')).toBeUndefined();
+		expect(getRestartState('clu-1')).toBeUndefined();
+	});
+
+	it('names no members left alone when the last one is the one not back', async () => {
+		restartsEndingIn({ 'ins-a': notBackYet() });
+
+		await clickRestart();
+
+		expect(restarted).toEqual(['ins-c', 'ins-b', 'ins-a']);
+		expect(finalError().description).toBe(
+			'Only 2 "RUNNING" instances were confirmed restarted of 3 instances. '
+				+ "1 instance accepted the restart but couldn't be confirmed back, so it may still be starting. "
+				+ 'Check its status before you restart it again.',
+		);
+	});
+
+	it('goes on to the next member once a slow one answers, holding it down until then', async () => {
+		let answer: (() => void) | undefined;
+		restartsEndingIn({ 'ins-b': new Promise<void>((resolve) => (answer = resolve)) });
+		const { result } = renderHook(() => useRestartClusterClick());
+
+		let click: Promise<void> | undefined;
+		act(() => {
+			click = result.current.onRestartClick() as unknown as Promise<void>;
+		});
+		await vi.waitFor(() => expect(restarted).toEqual(['ins-c', 'ins-b']));
+
+		expect(getRestartState('ins-b')?.reach).toBe('down');
+		const clock = vi.spyOn(Date, 'now').mockReturnValue(Date.now() + 6 * 60_000);
+		expect(getRestartState('ins-b')?.reach).toBe('down');
+		expect(getRestartState('clu-1')).toBeDefined();
+		clock.mockRestore();
+
+		await act(async () => {
+			answer!();
+			await click;
+		});
+
+		expect(restarted).toEqual(['ins-c', 'ins-b', 'ins-a']);
+		expect(toast.success).toHaveBeenCalledWith('Success', expect.objectContaining({ id: 'toast-1' }));
+		expect(getRestartState('ins-b')).toBeUndefined();
+	});
+
+	it('still carries on past a member that refused, and says it failed', async () => {
+		restartsEndingIn({ 'ins-b': refused() });
+
+		await clickRestart();
+
+		expect(restarted).toEqual(['ins-c', 'ins-b', 'ins-a']);
+		expect(toast.loading).toHaveBeenCalledWith('Failed Restarting Instance 2 of 3', expect.anything());
+		expect(finalError().title).toBe('Error');
+		expect(finalError().description).toContain('Only 2 "RUNNING" instances were restarted');
+	});
+
+	it('names a member that refused alongside the one not back', async () => {
+		restartsEndingIn({ 'ins-c': refused(), 'ins-b': notBackYet() });
+
+		await clickRestart();
+
+		expect(restarted).toEqual(['ins-c', 'ins-b']);
+		expect(finalError()).toEqual({
+			title: 'Not back yet',
+			description: 'Only 0 "RUNNING" instances were confirmed restarted of 3 instances. '
+				+ '1 instance failed to restart. '
+				+ "1 instance accepted the restart but couldn't be confirmed back, so it may still be starting. "
+				+ '1 other instance was not restarted, to keep the cluster available. '
+				+ 'Check its status before you restart it again.',
+		});
+	});
+
+	it('still says it is not back yet when Cancel is clicked while waiting on it', async () => {
+		vi.mocked(restartInstance).mockImplementation(async ({ instanceClient, onSlowToReturn }) => {
+			restarted.push(targetOf(instanceClient));
+			if (targetOf(instanceClient) === 'ins-b') {
+				onSlowToReturn?.();
+				cancel();
+				throw notBackYet();
+			}
+			return { message: 'Restarting Harper. This may take up to 60 seconds.' };
+		});
+
+		await clickRestart();
+
+		expect(restarted).toEqual(['ins-c', 'ins-b']);
+		expect(finalError().title).toBe('Not back yet');
+		expect(vi.mocked(toast.error).mock.calls.map(([title]) => title)).not.toContain('Cancelled');
+	});
+
+	it('brings its waiting toast back without a second Cancel once Cancel was clicked', async () => {
+		vi.mocked(restartInstance).mockImplementation(async ({ instanceClient, onSlowToReturn }) => {
+			restarted.push(targetOf(instanceClient));
+			if (targetOf(instanceClient) === 'ins-b') {
+				cancel();
+				onSlowToReturn?.();
+			}
+			return { message: 'Restarting Harper. This may take up to 60 seconds.' };
+		});
+
+		await clickRestart();
+
+		const [, options] = vi.mocked(toast.loading).mock.calls.find(([title]) => title === 'Waiting On Instance 2 of 3')!;
+		expect(options).not.toHaveProperty('action');
+		expect(options?.description).toContain('Cancelled: no other instance will be restarted.');
+		expect(restarted).toEqual(['ins-c', 'ins-b']);
+	});
+
+	it('brings back none of its later toasts with a second Cancel once Cancel was clicked', async () => {
+		vi.mocked(restartInstance).mockImplementation(async ({ instanceClient }) => {
+			restarted.push(targetOf(instanceClient));
+			if (targetOf(instanceClient) === 'ins-b') {
+				cancel();
+				throw answeredWith(504);
+			}
+			return { message: 'Restarting Harper. This may take up to 60 seconds.' };
+		});
+
+		await clickRestart();
+
+		const afterCancel = vi.mocked(toast.loading).mock.calls.filter(([title]) =>
+			title === 'Could Not Confirm Instance 2 of 3'
+		);
+		expect(afterCancel).toHaveLength(2);
+		for (const [, options] of afterCancel) {
+			expect(options).not.toHaveProperty('action');
+			expect(options?.description).toContain('Cancelled: no other instance will be restarted.');
+		}
+		expect(restarted).toEqual(['ins-c', 'ins-b']);
+	});
+
+	it('still says Cancelled when nothing was left uncertain', async () => {
+		vi.mocked(restartInstance).mockImplementation(async ({ instanceClient }) => {
+			restarted.push(targetOf(instanceClient));
+			cancel();
+			return { message: 'Restarting Harper. This may take up to 60 seconds.' };
+		});
+
+		await clickRestart();
+
+		expect(restarted).toEqual(['ins-c']);
+		expect(finalError().title).toBe('Cancelled');
+	});
+});
diff --git a/src/hooks/useRestartClusterClick.tsx b/src/hooks/useRestartClusterClick.tsx
index ca5eefc76..4c7c7a070 100644
--- a/src/hooks/useRestartClusterClick.tsx
+++ b/src/hooks/useRestartClusterClick.tsx
@@ -1,7 +1,16 @@
 import { ProgressBar } from '@/components/ProgressBar';
 import { ClusterRestartTargets, getClusterRestartTargets } from '@/hooks/getClusterRestartTargets';
 import { getInstanceUserInfo } from '@/integrations/api/instance/status/getInstanceUserInfo';
-import { restartInstance } from '@/integrations/api/instance/status/restartInstance';
+import {
+	RESTART_MARK_TTL_MS,
+	restartInstance,
+	waitUntilAnsweringAfterRestart,
+} from '@/integrations/api/instance/status/restartInstance';
+import {
+	describeUncertainRollingOutcome,
+	RestartUnconfirmedError,
+} from '@/integrations/api/instance/status/restartUnconfirmed';
+import { isUnansweredWrite } from '@/integrations/api/unansweredWrite';
 import { excludeFalsy } from '@/lib/arrays/excludeFalsy';
 import { pluralize } from '@/lib/pluralize';
 import { markRestarting } from '@/lib/restart/restartTracker';
@@ -10,9 +19,6 @@ import { useParams } from '@tanstack/react-router';
 import { useCallback, useState } from 'react';
 import { toast } from 'sonner';
 
-/** Longest a single `restartInstance` can take: 10s settle + 12 probes of up to 3s + 15s apart. */
-const INSTANCE_RESTART_TTL_MS = 5 * 60_000;
-
 interface RestartClusterClickParams {
 	onRestartedSuccessfully?: () => void;
 }
@@ -44,6 +50,16 @@ export function useRestartClusterClick(
 			},
 		};
 
+		// Once Cancel is clicked its toast is gone, and a progress toast offering Cancel again would read as if
+		// it had not landed: say so instead.
+		const progress = (description: string, onceCanceled = description) =>
+			canceled
+				? {
+					duration: toastConfig.duration,
+					description: `${onceCanceled} Cancelled: no other instance will be restarted.`.trim(),
+				}
+				: { ...toastConfig, description };
+
 		const toastId = toast.loading('Restarting', {
 			...toastConfig,
 			description: (
@@ -72,12 +88,16 @@ export function useRestartClusterClick(
 			}
 			const { allInstances, targets } = plan;
 			let instancesRestarted = 0;
+			let instancesUnanswered = 0;
+			let instancesFailed = 0;
+			let instancesUntouched: number | undefined;
+			let instancesStoppedOnNoVerdict = false;
 
 			// One instance at a time, so the cluster stays reachable through the others unless it has only
 			// one. The TTLs only matter if this loop dies without reaching `finally`.
 			const releaseCluster = markRestarting([clusterId], {
 				reach: targets.length === 1 ? 'down' : 'rolling',
-				ttlMs: (targets.length + 1) * INSTANCE_RESTART_TTL_MS,
+				ttlMs: (targets.length + 1) * RESTART_MARK_TTL_MS,
 			});
 
 			try {
@@ -107,22 +127,50 @@ export function useRestartClusterClick(
 							}
 							releaseInstance = markRestarting([instance.id], {
 								reach: 'down',
-								ttlMs: INSTANCE_RESTART_TTL_MS,
+								ttlMs: RESTART_MARK_TTL_MS,
 							});
 							// Then restart it.
 							await restartInstance({
 								operation: 'restart',
 								replicated: false,
 								instanceClient,
+								onSlowToReturn: () =>
+									toast.loading(`Waiting On Instance ${i + 1} of ${targets.length}`, {
+										id: toastId,
+										...progress("It accepted the restart but isn't back yet."),
+									}),
 							});
 							instancesRestarted += 1;
-						} catch {
+						} catch (error) {
+							if (error instanceof RestartUnconfirmedError) {
+								// It may still be down: restarting the next one could leave no member serving.
+								instancesUntouched = targets.length - i - 1;
+								break;
+							}
+							const unanswered = isUnansweredWrite(error);
+							instancesUnanswered += unanswered ? 1 : 0;
+							instancesFailed += unanswered ? 0 : 1;
+							if (unanswered) {
+								// A gateway can lose the answer to a restart that ran and took this member down, so it
+								// stays marked, and the next one waits, until it answers again or the watch gives up.
+								toast.loading(`Could Not Confirm Instance ${i + 1} of ${targets.length}`, {
+									id: toastId,
+									...progress('Waiting for it to answer before carrying on.', 'Waiting for it to answer.'),
+								});
+								const back = await waitUntilAnsweringAfterRestart({ instanceClient }).then(() => true, () => false);
+								if (!back) {
+									// As down as a member that accepted the restart and is not back: stop here too.
+									instancesUntouched = targets.length - i - 1;
+									instancesStoppedOnNoVerdict = true;
+									break;
+								}
+							}
 							if (i + 1 !== targets.length) {
 								// If it fails to restart, or wasn't available, warn for a bit then move on.
-								toast.loading(`Failed Restarting Instance ${i + 1} of ${targets.length}`, {
-									...toastConfig,
+								const verdict = unanswered ? 'Could Not Confirm' : 'Failed Restarting';
+								toast.loading(`${verdict} Instance ${i + 1} of ${targets.length}`, {
 									id: toastId,
-									description: 'We will carry on momentarily.',
+									...progress('We will carry on momentarily.', ''),
 								});
 								await sleep(3000);
 							}
@@ -136,7 +184,19 @@ export function useRestartClusterClick(
 				releaseCluster();
 			}
 
-			if (canceled) {
+			const uncertain = describeUncertainRollingOutcome({
+				total: allInstances.length,
+				confirmed: instancesRestarted,
+				failed: instancesFailed,
+				unanswered: instancesUnanswered,
+				untouched: instancesUntouched,
+				stoppedOnNoVerdict: instancesStoppedOnNoVerdict,
+				// Every member Cancel reached first lands in none of the counts.
+				canceled: canceled && instancesUntouched === undefined
+					? targets.length - instancesRestarted - instancesFailed - instancesUnanswered
+					: 0,
+			}, 'restarted');
+			if (canceled && !uncertain) {
 				toast.error('Cancelled', {
 					id: toastId,
 					description: `The restart was partially cancelled.`,
@@ -164,15 +224,16 @@ export function useRestartClusterClick(
 					'"RUNNING" instance was',
 					'"RUNNING" instances were',
 				);
-				toast.error('Error', {
+				toast.error(uncertain?.title ?? 'Error', {
 					id: toastId,
-					description: `Failed to fully restart cluster.\n`
-						+ ([
-							allInstances.length === 0 && 'No instances were found within the cluster to restart.',
-							targets.length === 0 && `No instances were in a "RUNNING" state of ${allTheInstances}.`,
-							allInstances.length !== instancesRestarted
-							&& `Only ${someRunningInstancesWere} restarted of ${allTheInstances}.`,
-						].filter(excludeFalsy).shift() || ''),
+					description: uncertain?.description
+						?? `Failed to fully restart cluster.\n`
+							+ ([
+								allInstances.length === 0 && 'No instances were found within the cluster to restart.',
+								targets.length === 0 && `No instances were in a "RUNNING" state of ${allTheInstances}.`,
+								allInstances.length !== instancesRestarted
+								&& `Only ${someRunningInstancesWere} restarted of ${allTheInstances}.`,
+							].filter(excludeFalsy).shift() || ''),
 					duration: 10_000,
 					action: {
 						label: 'Dismiss',
diff --git a/src/hooks/useRestartInstanceClick.test.tsx b/src/hooks/useRestartInstanceClick.test.tsx
new file mode 100644
index 000000000..d9f067a8b
--- /dev/null
+++ b/src/hooks/useRestartInstanceClick.test.tsx
@@ -0,0 +1,214 @@
+/** @vitest-environment jsdom */
+import { useRestartInstanceClick } from '@/hooks/useRestartInstanceClick';
+import { waitUntilAnsweringAfterRestart } from '@/integrations/api/instance/status/restartInstance';
+import {
+	RESTART_UNCONFIRMED_MESSAGE,
+	RESTART_UNCONFIRMED_TITLE,
+} from '@/integrations/api/instance/status/restartUnconfirmed';
+import { OUTCOME_UNKNOWN_TITLE } from '@/integrations/api/unansweredWrite';
+import { isRestarting, resetRestartTracker } from '@/lib/restart/restartTracker';
+import { mutationErrorHandler } from '@/react-query/queryClient';
+import { MutationCache, QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { act, renderHook } from '@testing-library/react';
+import { AxiosError, type AxiosInstance, type InternalAxiosRequestConfig } from 'axios';
+import { PropsWithChildren } from 'react';
+import { toast } from 'sonner';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('@tanstack/react-router', () => ({
+	useParams: () => ({ clusterId: 'clu-1', instanceId: 'ins-1' }),
+}));
+
+vi.mock(import('@/integrations/api/instance/status/restartInstance'), async (importOriginal) => ({
+	...await importOriginal(),
+	waitUntilAnsweringAfterRestart: vi.fn(),
+}));
+
+vi.mock('sonner', () => ({
+	toast: { loading: vi.fn(() => 'restart-toast'), error: vi.fn(), success: vi.fn(), dismiss: vi.fn() },
+}));
+
+vi.mock('@/lib/sleep', () => ({
+	sleep: vi.fn().mockResolvedValue(true),
+}));
+
+function restartAnswering(failure: (config: InternalAxiosRequestConfig) => AxiosError) {
+	const post = vi.fn((_url: string, data: unknown) => Promise.reject(failure({ method: 'post', data } as never)));
+	return { post } as unknown as AxiosInstance;
+}
+
+function probeTimeout(config: InternalAxiosRequestConfig) {
+	return new AxiosError('timeout of 3000ms exceeded', AxiosError.ECONNABORTED, config);
+}
+
+/**
+ * Harper accepts the restart (bin/restart.ts answers before it tears down), then each `user_info`
+ * probe gets what `userInfo` returns for its 1-based attempt number.
+ */
+function restartAccepted(userInfo: (attempt: number, config: InternalAxiosRequestConfig) => Promise<unknown>) {
+	let attempts = 0;
+	const post = vi.fn((_url: string, data: { operation: string }) => {
+		if (data.operation === 'restart') {
+			return Promise.resolve({ data: { message: 'Restarting Harper. This may take up to 60 seconds.' } });
+		}
+		attempts += 1;
+		return userInfo(attempts, { method: 'post', data } as InternalAxiosRequestConfig).then((answer) => ({
+			data: answer,
+		}));
+	});
+	const count = (operation: string) => post.mock.calls.filter(([, data]) => data.operation === operation).length;
+	return { post, restarts: () => count('restart'), probes: () => count('user_info') };
+}
+
+const neverAnswers = (_attempt: number, config: InternalAxiosRequestConfig) => Promise.reject(probeTimeout(config));
+
+function render(instanceClient: AxiosInstance) {
+	const queryClient = new QueryClient({ mutationCache: new MutationCache({ onError: mutationErrorHandler }) });
+	const wrapper = ({ children }: PropsWithChildren) => (
+		<QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+	);
+	return renderHook(() => useRestartInstanceClick({ operation: 'restart', instanceClient }), { wrapper }).result;
+}
+
+function errorTitles() {
+	return vi.mocked(toast.error).mock.calls.map(([title, options]) => [title, options?.description]);
+}
+
+describe('useRestartInstanceClick', () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+		resetRestartTracker();
+		vi.mocked(waitUntilAnsweringAfterRestart).mockResolvedValue(undefined);
+		vi.spyOn(console, 'error').mockImplementation(() => undefined);
+	});
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	it('does not call a restart that got no answer a failure', async () => {
+		const result = render(
+			restartAnswering((config) => new AxiosError('timeout of 60000ms exceeded', AxiosError.ECONNABORTED, config)),
+		);
+
+		await act(() => result.current.onRestartClick());
+
+		expect(errorTitles()).toEqual([[OUTCOME_UNKNOWN_TITLE, expect.stringContaining("couldn't confirm whether")]]);
+		expect(toast.dismiss).toHaveBeenCalledWith('restart-toast');
+	});
+
+	it('keeps a restart that got no answer marked until its target answers again', async () => {
+		let answered = () => {};
+		vi.mocked(waitUntilAnsweringAfterRestart).mockReturnValueOnce(new Promise<void>((resolve) => (answered = resolve)));
+		const result = render(
+			restartAnswering((config) =>
+				new AxiosError('Request failed with status code 504', AxiosError.ERR_BAD_RESPONSE, config, undefined, {
+					status: 504,
+					statusText: '',
+					data: 'Proxied operation timed out after 30s on instance ins-1',
+					headers: {},
+					config,
+				})
+			),
+		);
+
+		await act(() => result.current.onRestartClick());
+
+		expect(isRestarting('ins-1')).toBe(true);
+		await act(async () => answered());
+		expect(isRestarting('ins-1')).toBe(false);
+	});
+
+	it('still says a refused restart failed', async () => {
+		const result = render(
+			restartAnswering((config) =>
+				new AxiosError('Request failed with status code 403', AxiosError.ERR_BAD_REQUEST, config, undefined, {
+					status: 403,
+					statusText: '',
+					data: { error: 'This operation is restricted to super users' },
+					headers: {},
+					config,
+				})
+			),
+		);
+
+		await act(() => result.current.onRestartClick());
+
+		expect(errorTitles()).toContainEqual(['Error', 'Failed to restart instance.']);
+		expect(errorTitles().map(([title]) => title)).not.toContain(OUTCOME_UNKNOWN_TITLE);
+		expect(isRestarting('ins-1')).toBe(false);
+		expect(waitUntilAnsweringAfterRestart).not.toHaveBeenCalled();
+	});
+
+	describe('a restart Harper accepted', () => {
+		it('says it is not back yet, never that it failed, when the target does not answer again', async () => {
+			const client = restartAccepted(neverAnswers);
+			const result = render(client as unknown as AxiosInstance);
+
+			await act(() => result.current.onRestartClick());
+
+			expect(errorTitles()).toEqual([[RESTART_UNCONFIRMED_TITLE, RESTART_UNCONFIRMED_MESSAGE]]);
+			expect(toast.dismiss).toHaveBeenCalledWith('restart-toast');
+			expect(toast.success).not.toHaveBeenCalled();
+			expect(client.restarts()).toBe(1);
+			expect(client.probes()).toBe(24);
+			expect(isRestarting('ins-1')).toBe(false);
+		});
+
+		it('keeps the target marked and the button pending while it is slow to come back', async () => {
+			let answer: (() => void) | undefined;
+			const client = restartAccepted((attempt, config) =>
+				attempt <= 12
+					? neverAnswers(attempt, config)
+					: new Promise((resolve) => {
+						answer = () => resolve({ username: 'admin' });
+					})
+			);
+			const result = render(client as unknown as AxiosInstance);
+
+			let click: Promise<void> | undefined;
+			act(() => {
+				click = result.current.onRestartClick() as unknown as Promise<void>;
+			});
+			await vi.waitFor(() => expect(answer).toBeDefined());
+
+			expect(isRestarting('ins-1')).toBe(true);
+			const clock = vi.spyOn(Date, 'now').mockReturnValue(Date.now() + 6 * 60_000);
+			expect(isRestarting('ins-1')).toBe(true);
+			clock.mockRestore();
+			expect(result.current.isRestartPending).toBe(true);
+			expect(toast.loading).toHaveBeenLastCalledWith('Still restarting', {
+				id: 'restart-toast',
+				description: "Harper accepted the restart, but the instance isn't back yet. Still waiting for it.",
+			});
+			expect(toast.error).not.toHaveBeenCalled();
+
+			await act(async () => {
+				answer!();
+				await click;
+			});
+
+			expect(isRestarting('ins-1')).toBe(false);
+			expect(toast.error).not.toHaveBeenCalled();
+			expect(toast.success).toHaveBeenCalledWith(
+				'Success',
+				expect.objectContaining({ description: 'Instance restarted!' }),
+			);
+			expect(client.restarts()).toBe(1);
+		});
+
+		it('says it restarted, with no slow-return notice, when the target answers right away', async () => {
+			const client = restartAccepted(() => Promise.resolve({ username: 'admin' }));
+			const result = render(client as unknown as AxiosInstance);
+
+			await act(() => result.current.onRestartClick());
+
+			expect(toast.error).not.toHaveBeenCalled();
+			expect(toast.loading).not.toHaveBeenCalledWith('Still restarting', expect.anything());
+			expect(toast.success).toHaveBeenCalledWith(
+				'Success',
+				expect.objectContaining({ description: 'Instance restarted!' }),
+			);
+			expect(isRestarting('ins-1')).toBe(false);
+		});
+	});
+});
diff --git a/src/hooks/useRestartInstanceClick.ts b/src/hooks/useRestartInstanceClick.ts
index a8094d17c..578bb240a 100644
--- a/src/hooks/useRestartInstanceClick.ts
+++ b/src/hooks/useRestartInstanceClick.ts
@@ -1,9 +1,15 @@
 import { isLocalStudio } from '@/config/constants';
 import { InstanceClientConfig } from '@/config/instanceClientConfig';
 import { OverallAppSignIn } from '@/features/auth/store/authStore';
-import { useRestartInstance } from '@/integrations/api/instance/status/restartInstance';
+import {
+	RESTART_MARK_TTL_MS,
+	useRestartInstance,
+	waitUntilAnsweringAfterRestart,
+} from '@/integrations/api/instance/status/restartInstance';
+import { isUnansweredWrite } from '@/integrations/api/unansweredWrite';
 import { markRestarting } from '@/lib/restart/restartTracker';
 import { invalidateEntityQueries } from '@/react-query/invalidateEntityQueries';
+import { shouldToastOwnFailure } from '@/react-query/queryClient';
 import { useQueryClient } from '@tanstack/react-query';
 import { useParams } from '@tanstack/react-router';
 import { useCallback } from 'react';
@@ -41,17 +47,27 @@ export function useRestartInstanceClick({
 		// target restarts whichever member the load balancer picked, so the cluster stays reachable.
 		const entityId = isLocalStudio ? OverallAppSignIn : instanceId ?? clusterId;
 		const releaseTarget = operation === 'restart' && entityId
-			? markRestarting([entityId], { reach: targetNoun === 'Instance' ? 'down' : 'rolling', ttlMs: 5 * 60_000 })
+			? markRestarting([entityId], {
+				reach: targetNoun === 'Instance' ? 'down' : 'rolling',
+				ttlMs: RESTART_MARK_TTL_MS,
+			})
 			: undefined;
 		// Await the mutation directly rather than using the mutate() callbacks. Those callbacks are
 		// dropped if the component unmounts before the restart finishes (e.g. the user navigates to
 		// another tab while the instance comes back up), which would orphan the loading toast forever
 		// since sonner never auto-dismisses a loading toast. The awaited continuation runs regardless.
+		let holdUntilAnswering = false;
 		try {
 			await restartInstance({
 				operation,
 				replicated: operation === 'restart_service' && targetNoun === 'Cluster',
 				instanceClient,
+				onSlowToReturn: () =>
+					toast.loading('Still restarting', {
+						id: toastId,
+						description: `Harper accepted the restart, but the ${targetNoun.toLowerCase()} isn't back yet. `
+							+ 'Still waiting for it.',
+					}),
 			});
 			// Releasing a tracked target refetches its queries (`onRestartSettled`); invalidating it here
 			// too would cancel those refetches and resend them.
@@ -69,18 +85,28 @@ export function useRestartInstanceClick({
 				},
 			});
 			onRestartedSuccessfully?.();
-		} catch {
+		} catch (error) {
 			toast.dismiss(toastId);
-			toast.error('Error', {
-				description: `Failed to restart ${targetNoun.toLowerCase()}.`,
-				action: {
-					label: 'Dismiss',
-					onClick: () => toast.dismiss(),
-				},
-			});
+			// A gateway can lose the answer to a restart that ran and took the target down mid-reply, so the
+			// mark holds until the target answers again, as it would after an accepted restart.
+			holdUntilAnswering = isUnansweredWrite(error);
+			if (shouldToastOwnFailure(error)) {
+				toast.error('Error', {
+					description: `Failed to restart ${targetNoun.toLowerCase()}.`,
+					action: {
+						label: 'Dismiss',
+						onClick: () => toast.dismiss(),
+					},
+				});
+			}
 		} finally {
-			// Released on failure too: once the restart has failed, the errors that follow are real.
-			releaseTarget?.();
+			if (releaseTarget && holdUntilAnswering) {
+				void waitUntilAnsweringAfterRestart({ instanceClient }).then(releaseTarget, releaseTarget);
+			} else {
+				// Released on failure too: once the restart has failed, or the watch for its target has given up,
+				// the errors that follow are real.
+				releaseTarget?.();
+			}
 		}
 	}, [
 		clusterId,
diff --git a/src/hooks/useRollingConfigUpdate.test.tsx b/src/hooks/useRollingConfigUpdate.test.tsx
index f2560055b..b45cd590a 100644
--- a/src/hooks/useRollingConfigUpdate.test.tsx
+++ b/src/hooks/useRollingConfigUpdate.test.tsx
@@ -2,9 +2,11 @@
  * @vitest-environment jsdom
  */
 import type { Cluster, Instance } from '@/integrations/api/api.patch';
+import { RestartUnconfirmedError } from '@/integrations/api/instance/status/restartUnconfirmed';
+import { describeUnansweredWrites, OUTCOME_UNKNOWN_TITLE } from '@/integrations/api/unansweredWrite';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { act, renderHook } from '@testing-library/react';
-import type { AxiosInstance } from 'axios';
+import { AxiosError, type AxiosInstance, type InternalAxiosRequestConfig } from 'axios';
 import { PropsWithChildren } from 'react';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
@@ -32,7 +34,10 @@ vi.mock('@/features/auth/store/authStore', () => ({
 }));
 vi.mock('@/features/cluster/queries/getClusterInfoQuery', () => ({ getClusterInfo: vi.fn() }));
 vi.mock('@/integrations/api/instance/status/getInstanceUserInfo', () => ({ getInstanceUserInfo: vi.fn() }));
-vi.mock('@/integrations/api/instance/status/restartInstance', () => ({ restartInstance: vi.fn() }));
+vi.mock('@/integrations/api/instance/status/restartInstance', () => ({
+	restartInstance: vi.fn(),
+	waitUntilAnsweringAfterRestart: vi.fn(),
+}));
 vi.mock('@/integrations/api/instance/status/setConfiguration', async (importOriginal) => ({
 	...await importOriginal<typeof import('@/integrations/api/instance/status/setConfiguration')>(),
 	setConfiguration: vi.fn(),
@@ -44,7 +49,7 @@ vi.mock('sonner', () => ({
 
 import { getClusterInfo } from '@/features/cluster/queries/getClusterInfoQuery';
 import { getInstanceUserInfo } from '@/integrations/api/instance/status/getInstanceUserInfo';
-import { restartInstance } from '@/integrations/api/instance/status/restartInstance';
+import { restartInstance, waitUntilAnsweringAfterRestart } from '@/integrations/api/instance/status/restartInstance';
 import { setConfiguration } from '@/integrations/api/instance/status/setConfiguration';
 import { toast } from 'sonner';
 import { useRollingConfigUpdate } from './useRollingConfigUpdate';
@@ -117,6 +122,7 @@ beforeEach(() => {
 		events.push(`restart ${targetOf(instanceClient)}`);
 		return { message: 'ok' };
 	});
+	vi.mocked(waitUntilAnsweringAfterRestart).mockResolvedValue(undefined);
 });
 
 afterEach(() => vi.clearAllMocks());
@@ -445,6 +451,29 @@ describe('useRollingConfigUpdate outcome reporting', () => {
 		expect(options?.description).toContain('Only 0 "RUNNING" instances were restarted of 2 instances.');
 		expect(options?.description).not.toContain('No instances were in a "RUNNING" state');
 	});
+
+	it('counts a member whose restart got no verdict apart from one that failed', async () => {
+		useCluster([instance('ins-a', '5.1.29'), instance('ins-b', '5.1.29')]);
+		vi.mocked(restartInstance).mockImplementation(async ({ instanceClient }) => {
+			if (targetOf(instanceClient) === 'ins-b') {
+				throw new AxiosError('timeout of 60000ms exceeded', AxiosError.ECONNABORTED, {
+					method: 'post',
+					data: '{"operation":"restart_service"}',
+				} as InternalAxiosRequestConfig);
+			}
+			return { message: 'ok' };
+		});
+
+		await save();
+
+		expect(toast.loading).toHaveBeenCalledWith('Could Not Confirm Instance 1 of 2', expect.anything());
+		const [title, options] = vi.mocked(toast.error).mock.calls.at(-1)!;
+		expect(title).toBe(OUTCOME_UNKNOWN_TITLE);
+		expect(options?.description).toBe(
+			'Only 1 "RUNNING" instance was confirmed updated of 2 instances. '
+				+ describeUnansweredWrites(1),
+		);
+	});
 });
 
 describe('useRollingConfigUpdate cancellation', () => {
@@ -485,3 +514,292 @@ function cancel() {
 	const [, options] = vi.mocked(toast.loading).mock.calls.at(-1)!;
 	(options as unknown as { action: { onClick: () => void } }).action.onClick();
 }
+
+function notBackAfterRestart(...targets: string[]) {
+	vi.mocked(restartInstance).mockImplementation(async ({ instanceClient, onSlowToReturn }) => {
+		events.push(`restart ${targetOf(instanceClient)}`);
+		if (targets.includes(targetOf(instanceClient))) {
+			onSlowToReturn?.();
+			throw new RestartUnconfirmedError(new AxiosError('Network Error', AxiosError.ERR_NETWORK));
+		}
+		return { message: 'Restarting http' };
+	});
+}
+
+function finalError() {
+	const [title, options] = vi.mocked(toast.error).mock.calls.at(-1) ?? [];
+	return { title, description: (options as { description?: string } | undefined)?.description };
+}
+
+describe('useRollingConfigUpdate, for a member that accepted the restart but was never confirmed back', () => {
+	it('stops there rather than update another member, and never says the update failed', async () => {
+		useCluster([instance('ins-a', '5.1.29'), instance('ins-b', '5.1.29')]);
+		notBackAfterRestart('ins-b');
+
+		await save();
+
+		expect(events).toEqual(['check ins-b', 'write ins-b', 'restart ins-b']);
+		expect(toast.loading).toHaveBeenCalledWith(
+			'Waiting On Instance 1 of 2',
+			expect.objectContaining({ description: "It accepted the restart but isn't back yet." }),
+		);
+		expect(finalError()).toEqual({
+			title: 'Not back yet',
+			description: 'Only 0 "RUNNING" instances were confirmed updated of 2 instances. '
+				+ "1 instance accepted the restart but couldn't be confirmed back, so it may still be starting. "
+				+ '1 other instance was not updated, to keep the cluster available. '
+				+ 'Check its status before you restart it again.',
+		});
+		expect(toast.success).not.toHaveBeenCalled();
+	});
+
+	it('still carries on past a member that refused the update, and says it failed', async () => {
+		useCluster([instance('ins-a', '5.1.29'), instance('ins-b', '5.1.29')]);
+		vi.mocked(setConfiguration).mockImplementation(async ({ instanceClient }) => {
+			events.push(`write ${targetOf(instanceClient)}`);
+			if (targetOf(instanceClient) === 'ins-b') {
+				throw new Error('Invalid configuration');
+			}
+			return { message: 'ok' };
+		});
+
+		await save();
+
+		expect(events).toEqual(['check ins-b', 'write ins-b', 'check ins-a', 'write ins-a', 'restart ins-a']);
+		expect(finalError().title).toBe('Error');
+		expect(finalError().description).toContain('Failed to fully update cluster.');
+	});
+
+	it('names a member that refused the update alongside the one not back', async () => {
+		useCluster([instance('ins-a', '5.1.29'), instance('ins-b', '5.1.29'), instance('ins-c', '5.1.29')]);
+		vi.mocked(setConfiguration).mockImplementation(async ({ instanceClient }) => {
+			events.push(`write ${targetOf(instanceClient)}`);
+			if (targetOf(instanceClient) === 'ins-c') {
+				throw new Error('Invalid configuration');
+			}
+			return { message: 'ok' };
+		});
+		notBackAfterRestart('ins-b');
+
+		await save();
+
+		expect(events).toEqual(['check ins-c', 'write ins-c', 'check ins-b', 'write ins-b', 'restart ins-b']);
+		expect(finalError()).toEqual({
+			title: 'Not back yet',
+			description: 'Only 0 "RUNNING" instances were confirmed updated of 3 instances. '
+				+ '1 instance failed to update. '
+				+ "1 instance accepted the restart but couldn't be confirmed back, so it may still be starting. "
+				+ '1 other instance was not updated, to keep the cluster available. '
+				+ 'Check its status before you restart it again.',
+		});
+	});
+
+	it('never fans the configuration out from a canary that is not back', async () => {
+		useCluster([instance('ins-a', '5.2.0'), instance('ins-b', '5.2.0'), instance('ins-c', '5.2.0')]);
+		notBackAfterRestart('ins-c');
+
+		await save();
+
+		expect(events).toEqual(['check ins-c', 'write ins-c', 'restart ins-c']);
+		expect(finalError().title).toBe('Not back yet');
+		expect(finalError().description).not.toContain('may already have the new configuration saved');
+	});
+
+	it('stops at a later member that is not back, and says the members it left may have the new configuration', async () => {
+		useCluster([instance('ins-a', '5.2.0'), instance('ins-b', '5.2.0'), instance('ins-c', '5.2.0')]);
+		vi.mocked(setConfiguration).mockImplementation(async ({ instanceClient, ...changes }) => {
+			events.push(`${changes.replicated ? 'replicate' : 'write'} ${targetOf(instanceClient)}`);
+			return changes.replicated ? acknowledging('ins-a-repl.example.com', 'ins-b-repl.example.com') : { message: 'ok' };
+		});
+		notBackAfterRestart('ins-b');
+
+		await save();
+
+		expect(events).toEqual([
+			'check ins-c',
+			'write ins-c',
+			'restart ins-c',
+			'replicate ins-c',
+			'check ins-b',
+			'restart ins-b',
+		]);
+		expect(finalError()).toEqual({
+			title: 'Not back yet',
+			description: 'Only 1 "RUNNING" instance was confirmed updated of 3 instances. '
+				+ "1 instance accepted the restart but couldn't be confirmed back, so it may still be starting. "
+				+ '1 other instance was not updated, to keep the cluster available. '
+				+ 'Check its status before you restart it again.\n'
+				+ 'Instances that were not restarted may already have the new configuration saved, and will apply it '
+				+ 'the next time they restart.',
+		});
+	});
+
+	it('still says it is not back yet when Cancel is clicked while waiting on it', async () => {
+		useCluster([instance('ins-a', '5.1.29'), instance('ins-b', '5.1.29')]);
+		vi.mocked(restartInstance).mockImplementation(async ({ instanceClient, onSlowToReturn }) => {
+			events.push(`restart ${targetOf(instanceClient)}`);
+			onSlowToReturn?.();
+			cancel();
+			throw new RestartUnconfirmedError(new AxiosError('Network Error', AxiosError.ERR_NETWORK));
+		});
+
+		await save();
+
+		expect(events).toEqual(['check ins-b', 'write ins-b', 'restart ins-b']);
+		expect(finalError().title).toBe('Not back yet');
+		expect(vi.mocked(toast.error).mock.calls.map(([title]) => title)).not.toContain('Cancelled');
+	});
+
+	it('names the members a Cancel left alone, beside the warning, after a restart that got no verdict', async () => {
+		useCluster([instance('ins-a', '5.1.29'), instance('ins-b', '5.1.29')]);
+		vi.mocked(restartInstance).mockImplementation(async ({ instanceClient }) => {
+			events.push(`restart ${targetOf(instanceClient)}`);
+			cancel();
+			throw new AxiosError('timeout of 60000ms exceeded', AxiosError.ECONNABORTED, {
+				method: 'post',
+				data: '{"operation":"restart_service"}',
+			} as InternalAxiosRequestConfig);
+		});
+
+		await save();
+
+		expect(events).toEqual(['check ins-b', 'write ins-b', 'restart ins-b']);
+		expect(finalError()).toEqual({
+			title: OUTCOME_UNKNOWN_TITLE,
+			description: 'Only 0 "RUNNING" instances were confirmed updated of 2 instances. '
+				+ `${describeUnansweredWrites(1)} `
+				+ '1 other instance was not updated: Cancel stopped it there.',
+		});
+	});
+
+	it('stops at a member whose restart got no verdict when Studio cannot confirm it came back either', async () => {
+		useCluster([instance('ins-a', '5.1.29'), instance('ins-b', '5.1.29')]);
+		vi.mocked(restartInstance).mockImplementation(async ({ instanceClient }) => {
+			events.push(`restart ${targetOf(instanceClient)}`);
+			throw new AxiosError('timeout of 60000ms exceeded', AxiosError.ECONNABORTED, {
+				method: 'post',
+				data: '{"operation":"restart_service"}',
+			} as InternalAxiosRequestConfig);
+		});
+		vi.mocked(waitUntilAnsweringAfterRestart).mockRejectedValueOnce(new Error('timeout of 3000ms exceeded'));
+
+		await save();
+
+		expect(events).toEqual(['check ins-b', 'write ins-b', 'restart ins-b']);
+		expect(finalError()).toEqual({
+			title: OUTCOME_UNKNOWN_TITLE,
+			description: 'Only 0 "RUNNING" instances were confirmed updated of 2 instances. '
+				+ `${describeUnansweredWrites(1)} `
+				+ "Studio couldn't confirm it came back either, so it may still be starting. "
+				+ '1 other instance was not updated, to keep the cluster available. '
+				+ 'Check its status before you restart it again.',
+		});
+	});
+
+	it('does not wait on a member whose configuration write got no verdict, since nothing restarted it', async () => {
+		useCluster([instance('ins-a', '5.1.29'), instance('ins-b', '5.1.29')]);
+		vi.mocked(setConfiguration).mockImplementation(async ({ instanceClient }) => {
+			events.push(`write ${targetOf(instanceClient)}`);
+			if (targetOf(instanceClient) === 'ins-b') {
+				throw new AxiosError('timeout of 60000ms exceeded', AxiosError.ECONNABORTED, {
+					method: 'post',
+					data: '{"operation":"set_configuration"}',
+				} as InternalAxiosRequestConfig);
+			}
+			return { message: 'ok' };
+		});
+
+		await save();
+
+		expect(waitUntilAnsweringAfterRestart).not.toHaveBeenCalled();
+		expect(events).toEqual(['check ins-b', 'write ins-b', 'check ins-a', 'write ins-a', 'restart ins-a']);
+	});
+
+	it('honors a Cancel clicked during the configuration write before restarting, and says it may be pending', async () => {
+		useCluster([instance('ins-a', '5.1.29'), instance('ins-b', '5.1.29')]);
+		vi.mocked(setConfiguration).mockImplementation(async ({ instanceClient }) => {
+			events.push(`write ${targetOf(instanceClient)}`);
+			cancel();
+			return { message: 'ok' };
+		});
+
+		await save();
+
+		expect(events).toEqual(['check ins-b', 'write ins-b']);
+		expect(finalError()).toEqual({
+			title: 'Cancelled',
+			description: 'The config update was partially cancelled. Instances that were not restarted may already '
+				+ 'have the new configuration saved, and will apply it the next time they restart.',
+		});
+	});
+
+	it('brings its waiting toast back without a second Cancel once Cancel was clicked', async () => {
+		useCluster([instance('ins-a', '5.1.29'), instance('ins-b', '5.1.29')]);
+		vi.mocked(restartInstance).mockImplementation(async ({ instanceClient, onSlowToReturn }) => {
+			events.push(`restart ${targetOf(instanceClient)}`);
+			cancel();
+			onSlowToReturn?.();
+			return { message: 'Restarting http' };
+		});
+
+		await save();
+
+		const [, options] = vi.mocked(toast.loading).mock.calls.find(([title]) => title === 'Waiting On Instance 1 of 2')!;
+		expect(options).not.toHaveProperty('action');
+		expect(options?.description).toContain('Cancelled: no other instance will be updated.');
+	});
+
+	it('brings back none of its later toasts with a second Cancel once Cancel was clicked', async () => {
+		useCluster([instance('ins-a', '5.1.29'), instance('ins-b', '5.1.29')]);
+		vi.mocked(restartInstance).mockImplementation(async ({ instanceClient }) => {
+			events.push(`restart ${targetOf(instanceClient)}`);
+			cancel();
+			throw new AxiosError('timeout of 60000ms exceeded', AxiosError.ECONNABORTED, {
+				method: 'post',
+				data: '{"operation":"restart_service"}',
+			} as InternalAxiosRequestConfig);
+		});
+
+		await save();
+
+		const afterCancel = vi.mocked(toast.loading).mock.calls.filter(([title]) =>
+			title === 'Could Not Confirm Instance 1 of 2'
+		);
+		expect(afterCancel).toHaveLength(2);
+		for (const [, options] of afterCancel) {
+			expect(options).not.toHaveProperty('action');
+			expect(options?.description).toContain('Cancelled: no other instance will be updated.');
+		}
+		expect(events).toEqual(['check ins-b', 'write ins-b', 'restart ins-b']);
+	});
+
+	it('keeps the pending-configuration note when Cancel lands while waiting on a member after the fan-out', async () => {
+		useCluster([instance('ins-a', '5.2.0'), instance('ins-b', '5.2.0')]);
+		vi.mocked(setConfiguration).mockImplementation(async ({ instanceClient, ...changes }) => {
+			events.push(`${changes.replicated ? 'replicate' : 'write'} ${targetOf(instanceClient)}`);
+			return changes.replicated ? acknowledging('ins-a-repl.example.com') : { message: 'ok' };
+		});
+		vi.mocked(restartInstance).mockImplementation(async ({ instanceClient, onSlowToReturn }) => {
+			events.push(`restart ${targetOf(instanceClient)}`);
+			if (targetOf(instanceClient) === 'ins-a') {
+				onSlowToReturn?.();
+				cancel();
+				throw new RestartUnconfirmedError(new AxiosError('Network Error', AxiosError.ERR_NETWORK));
+			}
+			return { message: 'Restarting http' };
+		});
+
+		await save();
+
+		expect(events).toEqual([
+			'check ins-b',
+			'write ins-b',
+			'restart ins-b',
+			'replicate ins-b',
+			'check ins-a',
+			'restart ins-a',
+		]);
+		expect(finalError().title).toBe('Not back yet');
+		expect(finalError().description).toContain('may already have the new configuration saved');
+	});
+});
diff --git a/src/hooks/useRollingConfigUpdate.tsx b/src/hooks/useRollingConfigUpdate.tsx
index 12e8fe22a..5379d8e49 100644
--- a/src/hooks/useRollingConfigUpdate.tsx
+++ b/src/hooks/useRollingConfigUpdate.tsx
@@ -4,9 +4,14 @@ import { useInstanceClientIdParams } from '@/config/useInstanceClient';
 import { getClusterRestartTargets } from '@/hooks/getClusterRestartTargets';
 import { Instance } from '@/integrations/api/api.patch';
 import { getInstanceUserInfo } from '@/integrations/api/instance/status/getInstanceUserInfo';
-import { restartInstance } from '@/integrations/api/instance/status/restartInstance';
+import { restartInstance, waitUntilAnsweringAfterRestart } from '@/integrations/api/instance/status/restartInstance';
+import {
+	describeUncertainRollingOutcome,
+	RestartUnconfirmedError,
+} from '@/integrations/api/instance/status/restartUnconfirmed';
 import { setConfiguration, shouldFanOutSetConfiguration } from '@/integrations/api/instance/status/setConfiguration';
 import { acknowledgedReplicationNodes } from '@/integrations/api/replication';
+import { isUnansweredWrite } from '@/integrations/api/unansweredWrite';
 import { excludeFalsy } from '@/lib/arrays/excludeFalsy';
 import { pluralize } from '@/lib/pluralize';
 import { sleep } from '@/lib/sleep';
@@ -79,6 +84,16 @@ export function useRollingConfigUpdate(
 			},
 		};
 
+		// Once Cancel is clicked its toast is gone, and a progress toast offering Cancel again would read as if
+		// it had not landed: say so instead.
+		const progress = (description: string, onceCanceled = description) =>
+			canceled
+				? {
+					duration: toastConfig.duration,
+					description: `${onceCanceled} Cancelled: no other instance will be updated.`.trim(),
+				}
+				: { ...toastConfig, description };
+
 		const toastId = toast.loading('Restarting', {
 			...toastConfig,
 			description: (
@@ -109,6 +124,11 @@ export function useRollingConfigUpdate(
 			let fanOutAttempted = false;
 			let acknowledged = new Set<string>();
 			let instancesRestarted = 0;
+			let instancesUnanswered = 0;
+			let instancesFailed = 0;
+			let instancesUntouched: number | undefined;
+			let instancesStoppedOnNoVerdict = false;
+			let writtenBeforeCancel = false;
 
 			for (let i = 0; i < targets.length; i++) {
 				const { instanceClient, replicationFqdn } = targets[i];
@@ -126,6 +146,7 @@ export function useRollingConfigUpdate(
 					),
 				});
 				let restarted = false;
+				let restartSent = false;
 				try {
 					// Make sure the instance is responding.
 					await getInstanceUserInfo({
@@ -140,22 +161,54 @@ export function useRollingConfigUpdate(
 							...params,
 							instanceClient,
 						});
+						if (canceled) {
+							writtenBeforeCancel = true;
+							break;
+						}
 					}
 					// Then restart it.
+					restartSent = true;
 					await restartInstance({
 						operation: 'restart_service',
 						replicated: false,
 						instanceClient,
+						onSlowToReturn: () =>
+							toast.loading(`Waiting On Instance ${i + 1} of ${targets.length}`, {
+								id: toastId,
+								...progress("It accepted the restart but isn't back yet."),
+							}),
 					});
 					instancesRestarted += 1;
 					restarted = true;
-				} catch {
+				} catch (error) {
+					if (error instanceof RestartUnconfirmedError) {
+						// It may still be down: updating the next one could leave no member serving. A canary that is
+						// not back never proved it can run the configuration, so it is not fanned out either.
+						instancesUntouched = targets.length - i - 1;
+						break;
+					}
+					const unanswered = isUnansweredWrite(error);
+					instancesUnanswered += unanswered ? 1 : 0;
+					instancesFailed += unanswered ? 0 : 1;
+					if (unanswered && restartSent) {
+						// The restart may have run onto a configuration that broke it: wait, and stop if it never answers.
+						toast.loading(`Could Not Confirm Instance ${i + 1} of ${targets.length}`, {
+							id: toastId,
+							...progress('Waiting for it to answer before carrying on.', 'Waiting for it to answer.'),
+						});
+						const back = await waitUntilAnsweringAfterRestart({ instanceClient }).then(() => true, () => false);
+						if (!back) {
+							instancesUntouched = targets.length - i - 1;
+							instancesStoppedOnNoVerdict = true;
+							break;
+						}
+					}
 					if (i + 1 !== targets.length) {
 						// If it fails to restart, or wasn't available, warn for a bit then move on.
-						toast.loading(`Failed Restarting Instance ${i + 1} of ${targets.length}`, {
-							...toastConfig,
+						const verdict = unanswered ? 'Could Not Confirm' : 'Failed Restarting';
+						toast.loading(`${verdict} Instance ${i + 1} of ${targets.length}`, {
 							id: toastId,
-							description: 'We will carry on momentarily.',
+							...progress('We will carry on momentarily.', ''),
 						});
 						await sleep(3000);
 					}
@@ -183,10 +236,24 @@ export function useRollingConfigUpdate(
 				}
 			}
 
-			if (canceled) {
+			const uncertain = describeUncertainRollingOutcome({
+				total: allInstances.length,
+				confirmed: instancesRestarted,
+				failed: instancesFailed,
+				unanswered: instancesUnanswered,
+				untouched: instancesUntouched,
+				stoppedOnNoVerdict: instancesStoppedOnNoVerdict,
+				// Every member Cancel reached first lands in none of the counts.
+				canceled: canceled && instancesUntouched === undefined
+					? targets.length - instancesRestarted - instancesFailed - instancesUnanswered
+					: 0,
+			}, 'updated');
+			if (canceled && !uncertain) {
 				toast.error('Cancelled', {
 					id: toastId,
-					description: `The config update was partially cancelled.${fanOutAttempted ? ` ${MAY_BE_PENDING}` : ''}`,
+					description: `The config update was partially cancelled.${
+						fanOutAttempted || writtenBeforeCancel ? ` ${MAY_BE_PENDING}` : ''
+					}`,
 					duration: 10_000,
 					action: {
 						label: 'Dismiss',
@@ -211,16 +278,17 @@ export function useRollingConfigUpdate(
 					'"RUNNING" instance was',
 					'"RUNNING" instances were',
 				);
-				toast.error('Error', {
+				toast.error(uncertain?.title ?? 'Error', {
 					id: toastId,
-					description: `Failed to fully update cluster.\n`
-						+ ([
-							allInstances.length === 0 && 'No instances were found within the cluster to restart.',
-							targets.length === 0 && `No instances were in a "RUNNING" state of ${allTheInstances}.`,
-							allInstances.length !== instancesRestarted
-							&& `Only ${someRunningInstancesWere} restarted of ${allTheInstances}.`,
-						].filter(excludeFalsy).shift() || '')
-						+ (fanOutAttempted ? '\n' + MAY_BE_PENDING : ''),
+					description: (uncertain?.description
+						?? `Failed to fully update cluster.\n`
+							+ ([
+								allInstances.length === 0 && 'No instances were found within the cluster to restart.',
+								targets.length === 0 && `No instances were in a "RUNNING" state of ${allTheInstances}.`,
+								allInstances.length !== instancesRestarted
+								&& `Only ${someRunningInstancesWere} restarted of ${allTheInstances}.`,
+							].filter(excludeFalsy).shift() || ''))
+						+ (fanOutAttempted || writtenBeforeCancel ? '\n' + MAY_BE_PENDING : ''),
 					duration: 10_000,
 					action: {
 						label: 'Dismiss',
diff --git a/src/integrations/api/instance/applications/packageComponent.ts b/src/integrations/api/instance/applications/packageComponent.ts
index 4b1d2c421..f1b0928c1 100644
--- a/src/integrations/api/instance/applications/packageComponent.ts
+++ b/src/integrations/api/instance/applications/packageComponent.ts
@@ -28,7 +28,8 @@ async function packageComponent({
 			skip_node_modules: skipNodeModules,
 			skip_symlinks: skipSymlinks,
 		},
-		{ timeout: 300_000 },
+		// A read, but every attempt builds the whole archive again.
+		{ timeout: 300_000, skipGatewayRetry: true },
 	);
 	return data;
 }
diff --git a/src/integrations/api/instance/secrets/secrets.test.tsx b/src/integrations/api/instance/secrets/secrets.test.tsx
index cb5e310f4..7143746b1 100644
--- a/src/integrations/api/instance/secrets/secrets.test.tsx
+++ b/src/integrations/api/instance/secrets/secrets.test.tsx
@@ -2,9 +2,10 @@
  * @vitest-environment jsdom
  */
 import { EntityIds } from '@/features/auth/store/authStore';
+import { isUnansweredWrite } from '@/integrations/api/unansweredWrite';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { renderHook, waitFor } from '@testing-library/react';
-import type { AxiosInstance } from 'axios';
+import { AxiosError, type AxiosInstance, type InternalAxiosRequestConfig } from 'axios';
 import { webcrypto } from 'node:crypto';
 import { PropsWithChildren } from 'react';
 import { afterEach, beforeAll, describe, expect, it, vi } from 'vitest';
@@ -278,3 +279,55 @@ describe.each(
 		await expect(result.current.mutateAsync({ ...params, name: 'API_KEY', component: 'app' })).rejects.toBe(failure);
 	});
 });
+
+describe('a secrets write that got no verdict', () => {
+	function unanswered(body: { operation: string }) {
+		const config = { method: 'post', data: JSON.stringify(body) } as InternalAxiosRequestConfig;
+		return new AxiosError('timeout of 60000ms exceeded', AxiosError.ECONNABORTED, config);
+	}
+
+	it('rejects with the AxiosError itself, so its failure can say the outcome is unknown', async () => {
+		const { post, wrapper, params } = harness();
+		const key = await generateKey();
+		post.mockImplementation((_url: string, body: { operation: string }) => {
+			if (body.operation === 'get_secrets_public_key') {
+				return Promise.resolve({ data: { public_key: key.pem, fingerprint: key.fingerprint } });
+			}
+			return Promise.reject(unanswered(body));
+		});
+
+		const set = renderHook(() => useSetSecret(), { wrapper }).result;
+		const remove = renderHook(() => useDeleteSecret(), { wrapper }).result;
+		const grant = renderHook(() => useGrantSecret(), { wrapper }).result;
+		const failures = await Promise.all([
+			set.current.mutateAsync({ ...params, name: 'API_KEY', value: 'x' }).catch((e: unknown) => e),
+			remove.current.mutateAsync({ ...params, name: 'API_KEY' }).catch((e: unknown) => e),
+			grant.current.mutateAsync({ ...params, name: 'API_KEY', component: 'app' }).catch((e: unknown) => e),
+		]);
+
+		for (const failure of failures) {
+			expect(isUnansweredWrite(failure)).toBe(true);
+		}
+	});
+
+	// Central manager's proxy answers a 504 with a JSON `error` after forwarding the operation, so the
+	// body has the shape a Harper refusal has; the status, not the body, decides.
+	it('keeps a gateway 504 that carries a JSON message as the AxiosError, not a SecretsOperationError', async () => {
+		const { post, wrapper, params } = harness();
+		const config = {
+			method: 'post',
+			data: JSON.stringify({ operation: 'delete_secret' }),
+		} as InternalAxiosRequestConfig;
+		const gateway = new AxiosError('Request failed with status code 504', AxiosError.ERR_BAD_RESPONSE, config, null, {
+			status: 504,
+			statusText: 'Gateway Timeout',
+			headers: {},
+			config,
+			data: { error: 'Proxied operation timed out after 30s on instance ins-1' },
+		});
+		post.mockRejectedValueOnce(gateway);
+
+		const { result } = renderHook(() => useDeleteSecret(), { wrapper });
+		await expect(result.current.mutateAsync({ ...params, name: 'API_KEY' })).rejects.toBe(gateway);
+	});
+});
diff --git a/src/integrations/api/instance/secrets/secrets.ts b/src/integrations/api/instance/secrets/secrets.ts
index 5957c6f72..e4b71a30c 100644
--- a/src/integrations/api/instance/secrets/secrets.ts
+++ b/src/integrations/api/instance/secrets/secrets.ts
@@ -19,6 +19,7 @@
  */
 import { apiClient } from '@/config/apiClient';
 import { InstanceClientIdConfig } from '@/config/instanceClientConfig';
+import { isUnansweredWrite } from '@/integrations/api/unansweredWrite';
 import { encryptEnvelope } from '@/lib/crypto/envSecret';
 import { QueryClient, queryOptions, useMutation, useQueryClient } from '@tanstack/react-query';
 import type { AxiosInstance } from 'axios';
@@ -65,9 +66,14 @@ export class SecretsOperationError extends Error {
 /**
  * Operations API errors carry Harper's message in the response body; surface that, not the Axios
  * noise. A failure with no such message (the network, a bug) is not Harper's text, so it stays as
- * thrown and Error Tracking keeps its type and message.
+ * thrown and Error Tracking keeps its type and message. A write that got no verdict is rethrown as
+ * is too, even when a gateway body carries a message: re-wrapped, nothing downstream could say its
+ * outcome is unknown.
  */
 function operationError(error: unknown): unknown {
+	if (isUnansweredWrite(error)) {
+		return error;
+	}
 	const body = (error as { response?: { data?: { error?: unknown; message?: unknown } } })?.response?.data;
 	const message = typeof body?.error === 'string' ? body.error : body?.message;
 	return typeof message === 'string' ? new SecretsOperationError(message) : error;
diff --git a/src/integrations/api/instance/status/restartInstance.test.ts b/src/integrations/api/instance/status/restartInstance.test.ts
new file mode 100644
index 000000000..6579de8d1
--- /dev/null
+++ b/src/integrations/api/instance/status/restartInstance.test.ts
@@ -0,0 +1,212 @@
+/** @vitest-environment jsdom */
+import { getInstanceClient } from '@/config/getInstanceClient';
+import { RESTART_MARK_TTL_MS, restartInstance } from '@/integrations/api/instance/status/restartInstance';
+import { RestartUnconfirmedError } from '@/integrations/api/instance/status/restartUnconfirmed';
+import { isUnansweredWrite } from '@/integrations/api/unansweredWrite';
+import { shouldKeepEvent } from '@/integrations/datadog/shouldKeepEvent';
+import { sleep } from '@/lib/sleep';
+import { AxiosError, type AxiosResponse, type InternalAxiosRequestConfig } from 'axios';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('@/lib/sleep', () => ({
+	sleep: vi.fn().mockResolvedValue(true),
+}));
+
+type Answer = (config: InternalAxiosRequestConfig, attempt: number) => AxiosResponse | never;
+
+// Harper's own answer to an accepted `restart` (bin/restart.ts RESTART_RESPONSE, wrapped as { message }).
+const ACCEPTED = { message: 'Restarting Harper. This may take up to 60 seconds.' };
+
+function ok(data: unknown): Answer {
+	return (config) => ({ status: 200, statusText: 'OK', data, headers: {}, config });
+}
+
+function failing(status: number, data: unknown): Answer {
+	return (config) => {
+		throw new AxiosError(
+			`Request failed with status code ${status}`,
+			status >= 500 ? AxiosError.ERR_BAD_RESPONSE : AxiosError.ERR_BAD_REQUEST,
+			config,
+			undefined,
+			{ status, statusText: '', data, headers: {}, config },
+		);
+	};
+}
+
+function timingOut(config: InternalAxiosRequestConfig): never {
+	throw new AxiosError(`timeout of ${config.timeout}ms exceeded`, AxiosError.ECONNABORTED, config);
+}
+
+function answersFrom(attempt: number): Answer {
+	return (config, probe) => probe < attempt ? timingOut(config) : ok({ username: 'admin' })(config, probe);
+}
+
+const sent: string[] = [];
+
+function instanceClient({ restart, userInfo }: { restart: Answer; userInfo: Answer }) {
+	let probes = 0;
+	const client = getInstanceClient({ id: 'ins-restart', operationsUrl: 'https://ins-restart.example.com:9925/' });
+	client.defaults.adapter = async (config: InternalAxiosRequestConfig) => {
+		const { operation } = JSON.parse(String(config.data)) as { operation: string };
+		sent.push(operation);
+		return operation === 'user_info' ? userInfo(config, ++probes) : restart(config, 0);
+	};
+	return client;
+}
+
+const probesSent = () => sent.filter((operation) => operation === 'user_info').length;
+
+async function failureOf(promise: Promise<unknown>): Promise<unknown> {
+	return promise.then(() => expect.unreachable('the restart should have been rejected'), (error: unknown) => error);
+}
+
+describe('restartInstance', () => {
+	beforeEach(() => {
+		sent.length = 0;
+		vi.mocked(sleep).mockClear();
+	});
+
+	it('resolves with Harper’s answer once the target answers again', async () => {
+		const client = instanceClient({ restart: ok(ACCEPTED), userInfo: ok({ username: 'admin' }) });
+
+		await expect(restartInstance({ operation: 'restart', replicated: false, instanceClient: client }))
+			.resolves.toEqual(ACCEPTED);
+		expect(sent).toEqual(['restart', 'user_info']);
+	});
+
+	it('keeps watching a target that is slow to come back, and says so once', async () => {
+		const client = instanceClient({ restart: ok(ACCEPTED), userInfo: answersFrom(20) });
+		const onSlowToReturn = vi.fn();
+
+		await expect(restartInstance({ operation: 'restart', replicated: false, instanceClient: client, onSlowToReturn }))
+			.resolves.toEqual(ACCEPTED);
+		expect(probesSent()).toBe(20);
+		expect(onSlowToReturn).toHaveBeenCalledOnce();
+	});
+
+	it('keeps watching when the slow-return callback throws', async () => {
+		const client = instanceClient({ restart: ok(ACCEPTED), userInfo: answersFrom(20) });
+		const broken = new Error('toast unavailable');
+		const consoleError = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+
+		await expect(restartInstance({
+			operation: 'restart',
+			replicated: false,
+			instanceClient: client,
+			onSlowToReturn: () => {
+				throw broken;
+			},
+		})).resolves.toEqual(ACCEPTED);
+		expect(probesSent()).toBe(20);
+		expect(consoleError).toHaveBeenCalledWith(broken);
+		consoleError.mockRestore();
+	});
+
+	it('does not call a target slow that answers within the usual time', async () => {
+		const client = instanceClient({ restart: ok(ACCEPTED), userInfo: answersFrom(12) });
+		const onSlowToReturn = vi.fn();
+
+		await restartInstance({ operation: 'restart', replicated: false, instanceClient: client, onSlowToReturn });
+
+		expect(onSlowToReturn).not.toHaveBeenCalled();
+	});
+
+	it('says an accepted restart is unconfirmed, not failed, when the target never answers again', async () => {
+		const client = instanceClient({ restart: ok(ACCEPTED), userInfo: timingOut });
+
+		const error = await failureOf(restartInstance({ operation: 'restart', replicated: false, instanceClient: client }));
+
+		expect(error).toBeInstanceOf(RestartUnconfirmedError);
+		expect((error as RestartUnconfirmedError).cause).toBeInstanceOf(AxiosError);
+		expect((error as RestartUnconfirmedError).cause).toMatchObject({ code: AxiosError.ECONNABORTED });
+		expect(sent.filter((operation) => operation === 'restart')).toHaveLength(1);
+		expect(probesSent()).toBe(24);
+		expect(vi.mocked(sleep).mock.calls.map(([ms]) => ms)).toEqual([10_000, ...Array(23).fill(15_000)]);
+	});
+
+	it('fits its request, every probe and every wait inside RESTART_MARK_TTL_MS', async () => {
+		const client = instanceClient({ restart: ok(ACCEPTED), userInfo: timingOut });
+		client.defaults.timeout = 0;
+		const timeouts: number[] = [];
+		const adapter = client.defaults.adapter as (config: InternalAxiosRequestConfig) => Promise<AxiosResponse>;
+		client.defaults.adapter = (config: InternalAxiosRequestConfig) => {
+			timeouts.push(config.timeout ?? Number.POSITIVE_INFINITY);
+			return adapter(config);
+		};
+
+		await failureOf(restartInstance({ operation: 'restart', replicated: false, instanceClient: client }));
+
+		expect(timeouts[0]).toBe(60_000);
+		expect(timeouts).toHaveLength(25);
+		const waited = vi.mocked(sleep).mock.calls.reduce((total, [ms = 1000]) => total + ms, 0);
+		expect(timeouts.reduce((total, ms) => total + ms, 0) + waited).toBeLessThan(RESTART_MARK_TTL_MS);
+	});
+
+	it('sends each probe once, even when a gateway answers it', async () => {
+		const client = instanceClient({ restart: ok(ACCEPTED), userInfo: failing(503, 'Service Unavailable') });
+
+		const error = await failureOf(restartInstance({ operation: 'restart', replicated: false, instanceClient: client }));
+
+		expect(error).toBeInstanceOf(RestartUnconfirmedError);
+		expect(probesSent()).toBe(24);
+	});
+
+	it('treats restart_service the same way: its job started, so the restart was accepted', async () => {
+		const client = instanceClient({
+			restart: ok({ message: 'Restarting http', job_id: 'job-1' }),
+			userInfo: timingOut,
+		});
+
+		const error = await failureOf(
+			restartInstance({ operation: 'restart_service', replicated: false, instanceClient: client }),
+		);
+
+		expect(error).toBeInstanceOf(RestartUnconfirmedError);
+	});
+
+	it.each([
+		['refused', failing(403, { error: 'This operation is restricted to super users' })],
+		['answered by a gateway', failing(504, '<html>504 Gateway Time-out</html>')],
+		['never answered', timingOut],
+	])('rejects with the restart request’s own error when it was %s', async (_label, restart) => {
+		const client = instanceClient({ restart, userInfo: ok({ username: 'admin' }) });
+
+		const error = await failureOf(restartInstance({ operation: 'restart', replicated: false, instanceClient: client }));
+
+		expect(error).toBeInstanceOf(AxiosError);
+		expect(error).not.toBeInstanceOf(RestartUnconfirmedError);
+		expect(sent).not.toContain('user_info');
+	});
+
+	it('leaves a restart that got no verdict to the unanswered-write warning', async () => {
+		const client = instanceClient({ restart: failing(504, 'gateway'), userInfo: ok({}) });
+
+		const error = await failureOf(restartInstance({ operation: 'restart', replicated: false, instanceClient: client }));
+
+		expect(isUnansweredWrite(error)).toBe(true);
+	});
+});
+
+describe('RestartUnconfirmedError', () => {
+	function consoleEvent(error: Error) {
+		return { type: 'error', error: { message: error.message, type: error.name, source: 'console' } };
+	}
+
+	it('reaches RUM, or not, exactly as the probe failure it wraps would', () => {
+		const timeout = new AxiosError('timeout of 3000ms exceeded', AxiosError.ECONNABORTED);
+		const network = new AxiosError('Network Error', AxiosError.ERR_NETWORK);
+
+		for (const probeFailure of [timeout, network]) {
+			expect(shouldKeepEvent(consoleEvent(new RestartUnconfirmedError(probeFailure))))
+				.toBe(shouldKeepEvent(consoleEvent(probeFailure)));
+		}
+		expect(shouldKeepEvent(consoleEvent(new RestartUnconfirmedError(timeout)))).toBe(false);
+	});
+
+	it.each([null, undefined, 'socket hang up', { code: 'E_SOMETHING' }])('accepts any cause (%o)', (cause) => {
+		const error = new RestartUnconfirmedError(cause);
+
+		expect(error.cause).toBe(cause);
+		expect(error.message).toMatch(/^The restart was accepted, but the target was not confirmed back: /);
+	});
+});
diff --git a/src/integrations/api/instance/status/restartInstance.ts b/src/integrations/api/instance/status/restartInstance.ts
index d9640753b..6f46302f7 100644
--- a/src/integrations/api/instance/status/restartInstance.ts
+++ b/src/integrations/api/instance/status/restartInstance.ts
@@ -1,17 +1,40 @@
 import { InstanceClientConfig } from '@/config/instanceClientConfig';
 import { getInstanceUserInfo } from '@/integrations/api/instance/status/getInstanceUserInfo';
+import { RestartUnconfirmedError } from '@/integrations/api/instance/status/restartUnconfirmed';
 import { ReplicatedResponse } from '@/integrations/api/replication';
 import { axiosRetry } from '@/lib/axiosRetry';
 import { sleep } from '@/lib/sleep';
 import { useMutation } from '@tanstack/react-query';
 
+const SETTLE_MS = 10_000;
+const PROBE_TIMEOUT_MS = 3_000;
+const PROBE_INTERVAL_MS = 15_000;
+const PROBES = 24;
+const SLOW_AFTER_PROBES = 12;
+const RESTART_REQUEST_TIMEOUT_MS = 60_000;
+
+const LONGEST_RESTART_MS = RESTART_REQUEST_TIMEOUT_MS + SETTLE_MS + PROBES * PROBE_TIMEOUT_MS
+	+ (PROBES - 1) * PROBE_INTERVAL_MS;
+
+/**
+ * For marking a restart's target: longer than the longest restart, so the mark lapses only if its
+ * owner never releases it, never while the watch below still expects the target back.
+ */
+export const RESTART_MARK_TTL_MS = LONGEST_RESTART_MS + 60_000;
+
 interface RestartInstanceParams {
 	operation: 'restart_service' | 'restart';
 	replicated: boolean;
+	/** Called once the target is still not back past the usual recovery time; the watch goes on. */
+	onSlowToReturn?: () => void;
 }
 
+/**
+ * Rejects with the restart request's own error when Harper refused it or never answered it, and with
+ * {@link RestartUnconfirmedError} when Harper accepted it but the watch never saw the target back.
+ */
 export async function restartInstance(
-	{ operation, replicated, instanceClient }: RestartInstanceParams & InstanceClientConfig,
+	{ operation, replicated, instanceClient, onSlowToReturn }: RestartInstanceParams & InstanceClientConfig,
 ): Promise<ReplicatedResponse> {
 	// Both calls skip the restart gate: the caller may already have marked this instance as
 	// restarting, and these are the requests driving and watching that restart.
@@ -19,16 +42,40 @@ export async function restartInstance(
 		operation,
 		service: operation === 'restart_service' ? 'http' : undefined,
 		replicated,
-	}, { skipRestartGate: true });
-	await sleep(10_000);
-	await axiosRetry(
-		() => getInstanceUserInfo({ instanceClient, timeout: 3_000, skipRestartGate: true }),
-		12,
-		15_000,
-	);
+	}, { skipRestartGate: true, timeout: RESTART_REQUEST_TIMEOUT_MS });
+	try {
+		await waitUntilAnsweringAfterRestart({ instanceClient, onSlowToReturn });
+	} catch (cause) {
+		throw new RestartUnconfirmedError(cause);
+	}
 	return data;
 }
 
+/**
+ * Resolves once a just-restarted target answers `user_info`; rejects with the last probe's error if it never
+ * does. Only a success counts: through central manager's proxy even a 401/403 is CM's answer, not the target's.
+ */
+export async function waitUntilAnsweringAfterRestart(
+	{ instanceClient, onSlowToReturn }: InstanceClientConfig & Pick<RestartInstanceParams, 'onSlowToReturn'>,
+): Promise<void> {
+	// Not replayed on a gateway error: these probes are the retry, and a replay would outlast the mark.
+	const probe = () =>
+		getInstanceUserInfo({ instanceClient, timeout: PROBE_TIMEOUT_MS, skipRestartGate: true, skipGatewayRetry: true });
+	await sleep(SETTLE_MS);
+	try {
+		await axiosRetry(probe, SLOW_AFTER_PROBES, PROBE_INTERVAL_MS);
+	} catch {
+		try {
+			onSlowToReturn?.();
+		} catch (error) {
+			// A broken progress callback must not cut the watch short.
+			console.error(error);
+		}
+		await sleep(PROBE_INTERVAL_MS);
+		await axiosRetry(probe, PROBES - SLOW_AFTER_PROBES, PROBE_INTERVAL_MS);
+	}
+}
+
 export function useRestartInstance() {
 	return useMutation({
 		mutationFn: restartInstance,
diff --git a/src/integrations/api/instance/status/restartUnconfirmed.ts b/src/integrations/api/instance/status/restartUnconfirmed.ts
new file mode 100644
index 000000000..87efe6ba3
--- /dev/null
+++ b/src/integrations/api/instance/status/restartUnconfirmed.ts
@@ -0,0 +1,76 @@
+import { describeUnansweredWrites, OUTCOME_UNKNOWN_TITLE } from '@/integrations/api/unansweredWrite';
+import { excludeFalsy } from '@/lib/arrays/excludeFalsy';
+import { errorText } from '@/lib/errorText';
+import { pluralize } from '@/lib/pluralize';
+
+export const RESTART_UNCONFIRMED_TITLE = 'Not back yet';
+
+export const RESTART_UNCONFIRMED_MESSAGE = "Harper accepted the restart, but Studio couldn't confirm it came back. "
+	+ 'It may still be starting, so check its status before you restart it again.';
+
+/**
+ * Harper answered the restart request with success, so the restart ran, but Studio never saw the
+ * target answer again while it watched. Not a failed restart: sending it again would take the target
+ * down a second time.
+ */
+export class RestartUnconfirmedError extends Error {
+	constructor(cause: unknown) {
+		// The probe's text stays in the message because Datadog's `shouldKeepEvent` filters on it.
+		super(`The restart was accepted, but the target was not confirmed back: ${errorText(cause) ?? 'no answer'}`, {
+			cause,
+		});
+		this.name = 'RestartUnconfirmedError';
+	}
+}
+
+interface RollingOutcome {
+	total: number;
+	confirmed: number;
+	failed: number;
+	unanswered: number;
+	/** Set when a member never came back and the loop stopped there: the members after it, left alone. */
+	untouched?: number;
+	/** The member the loop stopped at got no verdict on its restart, rather than accepting it. */
+	stoppedOnNoVerdict?: boolean;
+	/** Members a Cancel left alone. */
+	canceled?: number;
+}
+
+/**
+ * The final toast of a loop that restarts one member at a time, when some member's outcome is not
+ * known; undefined when every outcome is.
+ */
+export function describeUncertainRollingOutcome(
+	{ total, confirmed, failed, unanswered, untouched, stoppedOnNoVerdict, canceled = 0 }: RollingOutcome,
+	verb: 'restarted' | 'updated',
+): { title: string; description: string } | undefined {
+	if (!unanswered && untouched === undefined) {
+		return undefined;
+	}
+	const confirmedOf = `${pluralize(confirmed, '"RUNNING" instance was', '"RUNNING" instances were')} confirmed ${verb} `
+		+ `of ${pluralize(total, 'instance', 'instances')}.`;
+	return {
+		title: unanswered ? OUTCOME_UNKNOWN_TITLE : RESTART_UNCONFIRMED_TITLE,
+		description: [
+			`Only ${confirmedOf}`,
+			failed > 0
+			&& `${pluralize(failed, 'instance', 'instances')} failed to ${verb === 'restarted' ? 'restart' : 'update'}.`,
+			unanswered > 0 && describeUnansweredWrites(unanswered),
+			untouched !== undefined && describeNoReturn(untouched, verb, stoppedOnNoVerdict ? unanswered : 0),
+			canceled > 0
+			&& `${pluralize(canceled, 'other instance was', 'other instances were')} not ${verb}: Cancel stopped it there.`,
+		].filter(excludeFalsy).join(' '),
+	};
+}
+
+/** `unanswered` is non-zero when the member it stopped at got no verdict, and counts those requests. */
+function describeNoReturn(untouched: number, verb: 'restarted' | 'updated', unanswered: number): string {
+	const leftAlone = pluralize(untouched, 'other instance was', 'other instances were');
+	const notBack = !unanswered
+		? "1 instance accepted the restart but couldn't be confirmed back, so it may still be starting. "
+		: `Studio couldn't confirm ${unanswered === 1 ? 'it' : 'the last of them'} came back either, so it may still be `
+			+ 'starting. ';
+	return notBack
+		+ (untouched > 0 ? `${leftAlone} not ${verb}, to keep the cluster available. ` : '')
+		+ 'Check its status before you restart it again.';
+}
diff --git a/src/integrations/api/isReadOperation.test.ts b/src/integrations/api/isReadOperation.test.ts
new file mode 100644
index 000000000..908069bbd
--- /dev/null
+++ b/src/integrations/api/isReadOperation.test.ts
@@ -0,0 +1,76 @@
+import { isReadOperation, isReadRequest } from '@/integrations/api/isReadOperation';
+import { describe, expect, it } from 'vitest';
+
+describe('isReadOperation', () => {
+	it.each([
+		'describe_all',
+		'describe_table',
+		'search_by_value',
+		'search_by_conditions',
+		'get_configuration',
+		'list_users',
+		'read_log',
+		'user_info',
+		'system_information',
+		'cluster_status',
+		'registration_info',
+		'package_component',
+	])('reads %s as a read', (operation) => {
+		expect(isReadOperation(operation)).toBe(true);
+	});
+
+	it.each([
+		'insert',
+		'update',
+		'delete',
+		'sql',
+		'drop_table',
+		'set_configuration',
+		'restart',
+		'add_user',
+		'create_authentication_tokens',
+		'approve_agent_action',
+		'my_component_operation',
+		'user_info_reset',
+		'registration_information',
+		'package_component_project',
+	])('treats %s as able to change something', (operation) => {
+		expect(isReadOperation(operation)).toBe(false);
+	});
+
+	it.each([undefined, null, 42, {}, ['describe_all']])(
+		'treats a non-string operation (%j) as not a read',
+		(operation) => {
+			expect(isReadOperation(operation)).toBe(false);
+		},
+	);
+});
+
+describe('isReadRequest', () => {
+	it.each([
+		['a GET', { method: 'get' }],
+		['an upper-case GET', { method: 'GET' }],
+		['a read body', { method: 'post', data: { operation: 'describe_all' } }],
+		['a read body under an upper-case POST', { method: 'POST', data: { operation: 'describe_all' } }],
+		['a read body axios already serialized', { method: 'post', data: JSON.stringify({ operation: 'get_job' }) }],
+	])('reads %s as a read', (_, config) => {
+		expect(isReadRequest(config)).toBe(true);
+	});
+
+	it.each([
+		['a write body', { method: 'post', data: { operation: 'insert' } }],
+		['a serialized write body', { method: 'post', data: JSON.stringify({ operation: 'drop_table' }) }],
+		['a body that is not JSON', { method: 'post', data: 'describe_all' }],
+		['a JSON null body', { method: 'post', data: 'null' }],
+		['no body', { method: 'post' }],
+		['a DELETE', { method: 'delete' }],
+		['a DELETE with a read body', { method: 'delete', data: { operation: 'describe_all' } }],
+		['a PUT with a serialized read body', { method: 'put', data: JSON.stringify({ operation: 'get_job' }) }],
+		['a PATCH with a read body', { method: 'patch', data: { operation: 'search_by_value' } }],
+		['a read body with no method', { data: { operation: 'describe_all' } }],
+		['a method that is not a string', { method: 42 }],
+		['a read body under a method that is not a string', { method: 42, data: { operation: 'describe_all' } }],
+	])('treats %s as able to change something', (_, config) => {
+		expect(isReadRequest(config)).toBe(false);
+	});
+});
diff --git a/src/integrations/api/isReadOperation.ts b/src/integrations/api/isReadOperation.ts
new file mode 100644
index 000000000..17f0de160
--- /dev/null
+++ b/src/integrations/api/isReadOperation.ts
@@ -0,0 +1,37 @@
+/**
+ * Reads, by Harper's operation naming: the restart gate holds only these (anything else is refused
+ * while the entity restarts), the gateway retry replays only these, and the operations console asks
+ * before sending anything else. Token minting is deliberately not one — held, it would stall a route
+ * guard's Fabric Connect attempt behind a notice that cannot mount yet; refused, the guard falls
+ * through to sign-in at once. `package_component` reads despite its name: it packs a project's files
+ * into an archive and changes nothing.
+ */
+const READ_OPERATION =
+	/^(?:get_|search_|describe_|list_|read_|user_info$|system_information$|cluster_status$|registration_info$|package_component$)/;
+
+export function isReadOperation(operation: unknown): boolean {
+	return typeof operation === 'string' && READ_OPERATION.test(operation);
+}
+
+function operationOf(data: unknown): unknown {
+	if (typeof data !== 'string') {
+		return (data as { operation?: unknown } | undefined)?.operation;
+	}
+	// By the time a request has been sent, axios has serialized `config.data` in place; the operations
+	// console also sends raw text.
+	try {
+		return (JSON.parse(data) as { operation?: unknown } | null)?.operation;
+	} catch {
+		return undefined;
+	}
+}
+
+/**
+ * Whether a request is safe to send late (the restart gate) or twice (the gateway retry); anything
+ * unrecognized counts as a write. Harper and central manager's proxy take an operation only from a
+ * POST body, so on any other method an `operation` field is just data.
+ */
+export function isReadRequest({ method, data }: { method?: unknown; data?: unknown }): boolean {
+	const verb = typeof method === 'string' ? method.toLowerCase() : undefined;
+	return verb === 'get' || (verb === 'post' && isReadOperation(operationOf(data)));
+}
diff --git a/src/integrations/api/retryGatewayErrors.integration.test.ts b/src/integrations/api/retryGatewayErrors.integration.test.ts
new file mode 100644
index 000000000..c7c14b9eb
--- /dev/null
+++ b/src/integrations/api/retryGatewayErrors.integration.test.ts
@@ -0,0 +1,101 @@
+/** @vitest-environment jsdom */
+import { getInstanceClient } from '@/config/getInstanceClient';
+import * as sleepModule from '@/lib/sleep';
+import { AxiosError, type InternalAxiosRequestConfig } from 'axios';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('@/lib/sleep', () => ({
+	sleep: vi.fn().mockResolvedValue(true),
+}));
+
+const OPERATIONS_URL = 'https://ins-123.example.com:9925/';
+
+/**
+ * A target behind a gateway that answers `statuses` in turn, then 200. Axios applies
+ * `validateStatus` inside its own adapters, so this one rejects a non-2xx itself.
+ */
+function gateway(...statuses: number[]) {
+	const sent: Array<{ method?: string; body: unknown }> = [];
+	const client = getInstanceClient({ id: 'ins-123', operationsUrl: OPERATIONS_URL });
+	client.defaults.adapter = async (config: InternalAxiosRequestConfig) => {
+		sent.push({ method: config.method, body: typeof config.data === 'string' ? JSON.parse(config.data) : config.data });
+		const status = statuses.shift() ?? 200;
+		const response = { status, statusText: '', data: { status }, headers: {}, config };
+		if (status >= 400) {
+			throw new AxiosError(
+				`Request failed with status code ${status}`,
+				AxiosError.ERR_BAD_RESPONSE,
+				config,
+				undefined,
+				response,
+			);
+		}
+		return response;
+	};
+	return { client, sent };
+}
+
+function statusOf(error: unknown): number | undefined {
+	return (error as AxiosError).response?.status;
+}
+
+describe('the gateway retry on a real instance client', () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+	});
+
+	it.each([502, 503, 504])('sends a write once and surfaces its %i', async (status) => {
+		const { client, sent } = gateway(status, status, status, status);
+
+		const error = await client.post('/', { operation: 'insert', records: [{ name: 'a' }] }).catch((e: unknown) => e);
+
+		expect(statusOf(error)).toBe(status);
+		expect(sent).toEqual([{ method: 'post', body: { operation: 'insert', records: [{ name: 'a' }] } }]);
+		expect(sleepModule.sleep).not.toHaveBeenCalled();
+	});
+
+	it.each(['drop_table', 'deploy_component', 'set_configuration', 'restart', 'create_authentication_tokens'])(
+		'never replays %s',
+		async (operation) => {
+			const { client, sent } = gateway(504);
+
+			await expect(client.post('/', { operation })).rejects.toBeInstanceOf(AxiosError);
+			expect(sent).toHaveLength(1);
+		},
+	);
+
+	it.each([502, 503, 504])('replays a read three times on a %i, 5s/10s/20s apart, as before', async (status) => {
+		const { client, sent } = gateway(status, status, status, status);
+
+		const error = await client.post('/', { operation: 'describe_all' }).catch((e: unknown) => e);
+
+		expect(statusOf(error)).toBe(status);
+		expect(sent).toHaveLength(4);
+		expect(sent.every(({ body }) => (body as { operation: string }).operation === 'describe_all')).toBe(true);
+		expect(vi.mocked(sleepModule.sleep).mock.calls).toEqual([[5_000], [10_000], [20_000]]);
+	});
+
+	it('returns the answer to a read that recovers on its replay', async () => {
+		const { client, sent } = gateway(503);
+
+		const { data } = await client.post('/', { operation: 'get_job', id: 'job-1' });
+
+		expect(data).toEqual({ status: 200 });
+		expect(sent).toHaveLength(2);
+	});
+
+	it('replays a GET', async () => {
+		const { client, sent } = gateway(502, 502);
+
+		await expect(client.get('/health')).resolves.toMatchObject({ status: 200 });
+		expect(sent).toHaveLength(3);
+	});
+
+	it('sends a read that opted out once', async () => {
+		const { client, sent } = gateway(503);
+
+		await expect(client.post('/', { operation: 'describe_all' }, { skipGatewayRetry: true })).rejects
+			.toBeInstanceOf(AxiosError);
+		expect(sent).toHaveLength(1);
+	});
+});
diff --git a/src/integrations/api/retryGatewayErrors.test.ts b/src/integrations/api/retryGatewayErrors.test.ts
index 70f92090b..f2f7b8fc5 100644
--- a/src/integrations/api/retryGatewayErrors.test.ts
+++ b/src/integrations/api/retryGatewayErrors.test.ts
@@ -7,6 +7,9 @@ vi.mock('@/lib/sleep', () => ({
 	sleep: vi.fn().mockResolvedValue(true),
 }));
 
+/** A read as the interceptor sees it: axios has serialized `config.data` by the time it fails. */
+const READ = { method: 'post', data: JSON.stringify({ operation: 'describe_all' }) };
+
 describe('curryRetryGatewayErrors', () => {
 	let client: Pick<AxiosInstance, 'request'>;
 
@@ -32,9 +35,9 @@ describe('curryRetryGatewayErrors', () => {
 		expect(client.request).not.toHaveBeenCalled();
 	});
 
-	it('rejects and does not retry for non-gateway status codes', async () => {
+	it('rejects and does not retry a read for non-gateway status codes', async () => {
 		const handler = curryRetryGatewayErrors(client);
-		const config: AxiosRequestConfig & { __retryCount?: number } = {};
+		const config: AxiosRequestConfig & { __retryCount?: number } = { ...READ };
 		const err = { response: { status: 500 }, config };
 
 		await expect(handler(err)).rejects.toBe(err);
@@ -44,9 +47,9 @@ describe('curryRetryGatewayErrors', () => {
 		expect(config.__retryCount).toBeUndefined();
 	});
 
-	it('retries on 502 and increments __retryCount with initial delay on first retry', async () => {
+	it('retries a read on 502 and increments __retryCount with initial delay on first retry', async () => {
 		const handler = curryRetryGatewayErrors(client);
-		const config: AxiosRequestConfig & { __retryCount?: number } = {};
+		const config: AxiosRequestConfig & { __retryCount?: number } = { ...READ };
 		const err = { response: { status: 502 }, config };
 
 		const result = await handler(err);
@@ -59,9 +62,9 @@ describe('curryRetryGatewayErrors', () => {
 		expect(result).toEqual({ ok: true });
 	});
 
-	it('retries on 503 with exponential backoff: more backoff on second retry', async () => {
+	it('retries a read on 503 with exponential backoff: more backoff on second retry', async () => {
 		const handler = curryRetryGatewayErrors(client);
-		const config: AxiosRequestConfig & { __retryCount?: number } = { __retryCount: 1 };
+		const config: AxiosRequestConfig & { __retryCount?: number } = { ...READ, __retryCount: 1 };
 		const err = { response: { status: 503 }, config };
 
 		await handler(err);
@@ -72,9 +75,9 @@ describe('curryRetryGatewayErrors', () => {
 		expect(client.request).toHaveBeenCalledTimes(1);
 	});
 
-	it('retries on 504 with the largest backoff on third retry', async () => {
+	it('retries a read on 504 with the largest backoff on third retry', async () => {
 		const handler = curryRetryGatewayErrors(client);
-		const config: AxiosRequestConfig & { __retryCount?: number } = { __retryCount: 2 };
+		const config: AxiosRequestConfig & { __retryCount?: number } = { ...READ, __retryCount: 2 };
 		const err = { response: { status: 504 }, config };
 
 		await handler(err);
@@ -85,9 +88,48 @@ describe('curryRetryGatewayErrors', () => {
 		expect(client.request).toHaveBeenCalledTimes(1);
 	});
 
+	it.each([
+		['an object body', { operation: 'insert', records: [] }],
+		['a serialized body', JSON.stringify({ operation: 'drop_table', table: 'dog' })],
+		['token minting', JSON.stringify({ operation: 'create_authentication_tokens' })],
+		['a body that is not JSON', 'operation=describe_all'],
+		['no body', undefined],
+	])('never replays a write on any gateway status: %s', async (_, data) => {
+		const handler = curryRetryGatewayErrors(client);
+		for (const status of [502, 503, 504]) {
+			const config: AxiosRequestConfig & { __retryCount?: number } = { method: 'post', data };
+			const err = { response: { status }, config };
+
+			await expect(handler(err)).rejects.toBe(err);
+			expect(config.__retryCount).toBeUndefined();
+		}
+		expect(sleepModule.sleep).not.toHaveBeenCalled();
+		expect(client.request).not.toHaveBeenCalled();
+	});
+
+	it('replays a GET, which carries no operation', async () => {
+		const handler = curryRetryGatewayErrors(client);
+		const config: AxiosRequestConfig & { __retryCount?: number } = { method: 'get' };
+
+		await handler({ response: { status: 503 }, config });
+
+		expect(client.request).toHaveBeenCalledWith(config);
+	});
+
+	it.each([502, 503, 504])('never replays a %i for a read that opted out', async (status) => {
+		const handler = curryRetryGatewayErrors(client);
+		const config: AxiosRequestConfig & { __retryCount?: number } = { ...READ, skipGatewayRetry: true };
+		const err = { response: { status }, config };
+
+		await expect(handler(err)).rejects.toBe(err);
+		expect(sleepModule.sleep).not.toHaveBeenCalled();
+		expect(client.request).not.toHaveBeenCalled();
+		expect(config.__retryCount).toBeUndefined();
+	});
+
 	it('stops retrying when max retries reached (>= 3)', async () => {
 		const handler = curryRetryGatewayErrors(client);
-		const config: AxiosRequestConfig & { __retryCount?: number } = { __retryCount: 3 };
+		const config: AxiosRequestConfig & { __retryCount?: number } = { ...READ, __retryCount: 3 };
 		const err = { response: { status: 502 }, config };
 
 		await expect(handler(err)).rejects.toBe(err);
diff --git a/src/integrations/api/retryGatewayErrors.ts b/src/integrations/api/retryGatewayErrors.ts
index 74fdbbaeb..766c2838d 100644
--- a/src/integrations/api/retryGatewayErrors.ts
+++ b/src/integrations/api/retryGatewayErrors.ts
@@ -1,16 +1,33 @@
+import { isReadRequest } from '@/integrations/api/isReadOperation';
 import { sleep } from '@/lib/sleep';
 import { AxiosInstance } from 'axios';
 
+declare module 'axios' {
+	interface AxiosRequestConfig {
+		/**
+		 * Send at most once, even a read. The operations console sets it: its freeform body can name a
+		 * component's operation, and a `get_` name from a component is no proof that it only reads.
+		 */
+		skipGatewayRetry?: boolean;
+	}
+}
+
+/**
+ * Replays a 502/503/504 up to three times, for reads only. None of the three means the request went
+ * unapplied — a proxy answers for an upstream that may already have it, and Harper itself answers 503
+ * when the worker running an operation exits or overruns — so a write is sent once and its first
+ * answer is final.
+ */
 export function curryRetryGatewayErrors(client: Pick<AxiosInstance, 'request'>) {
 	// eslint-disable-next-line @typescript-eslint/no-explicit-any
 	return async (error: any) => {
 		const status = error?.response?.status as number | undefined;
 		const config = error?.config;
-		if (!config) {
+		if (!config || config.skipGatewayRetry) {
 			return Promise.reject(error);
 		}
 
-		const shouldRetry = status === 502 || status === 503 || status === 504;
+		const shouldRetry = (status === 502 || status === 503 || status === 504) && isReadRequest(config);
 		if (!shouldRetry) {
 			return Promise.reject(error);
 		}
diff --git a/src/integrations/api/sse/resolveInstanceConnection.ts b/src/integrations/api/sse/resolveInstanceConnection.ts
index 44bce0e9b..6ccadbd76 100644
--- a/src/integrations/api/sse/resolveInstanceConnection.ts
+++ b/src/integrations/api/sse/resolveInstanceConnection.ts
@@ -32,8 +32,9 @@ export interface ResolvedInstanceConnection {
  * connection/auth resolution in `src/config/getInstanceClient.ts` one-way: `getInstanceClient`
  * is deliberately left untouched so its battle-tested axios path — including the
  * `rejectReplicationFailures` / gateway-retry interceptors that this fetch path intentionally
- * does NOT carry — keeps working for every non-streaming caller. Callers recover gateway/
- * cold-start resilience by falling back to the axios path when the stream can't be established.
+ * does NOT carry — keeps working for every non-streaming caller. Callers fall back to the axios
+ * path when the stream can't be established; a read regains its gateway retry there, a deploy does
+ * not, because that retry replays reads only.
  *
  * Fabric Connect now resolves to a direct Bearer (operation token) connection when it can
  * (see authStore.establishFabricConnectAuth); we prefer that so SSE streams straight from
diff --git a/src/integrations/api/unansweredWrite.integration.test.tsx b/src/integrations/api/unansweredWrite.integration.test.tsx
new file mode 100644
index 000000000..27042f04e
--- /dev/null
+++ b/src/integrations/api/unansweredWrite.integration.test.tsx
@@ -0,0 +1,117 @@
+/** @vitest-environment jsdom */
+import { getInstanceClient } from '@/config/getInstanceClient';
+import { usePackageComponentMutation } from '@/integrations/api/instance/applications/packageComponent';
+import { OUTCOME_UNKNOWN_TITLE, UNANSWERED_WRITE_MESSAGE } from '@/integrations/api/unansweredWrite';
+import { describeError, mutationErrorHandler } from '@/react-query/queryClient';
+import { MutationCache, MutationObserver, QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { renderHook } from '@testing-library/react';
+import { AxiosError, type InternalAxiosRequestConfig } from 'axios';
+import { PropsWithChildren } from 'react';
+import { toast } from 'sonner';
+import { afterEach, beforeEach, describe, expect, it, MockInstance, vi } from 'vitest';
+
+vi.mock('@/lib/sleep', () => ({
+	sleep: vi.fn().mockResolvedValue(true),
+}));
+
+vi.mock('sonner', () => ({
+	toast: { error: vi.fn(), dismiss: vi.fn() },
+}));
+
+const GATEWAY_BODY = '<html><head><title>504 Gateway Time-out</title></head></html>';
+
+function instanceClient(fail: (config: InternalAxiosRequestConfig) => never) {
+	const client = getInstanceClient({ id: 'ins-123', operationsUrl: 'https://ins-123.example.com:9925/' });
+	client.defaults.adapter = async (config: InternalAxiosRequestConfig) => fail(config);
+	return client;
+}
+
+function answering(status: number, data: unknown = GATEWAY_BODY) {
+	return (config: InternalAxiosRequestConfig): never => {
+		throw new AxiosError(
+			`Request failed with status code ${status}`,
+			status >= 500 ? AxiosError.ERR_BAD_RESPONSE : AxiosError.ERR_BAD_REQUEST,
+			config,
+			undefined,
+			{ status, statusText: '', data, headers: {}, config },
+		);
+	};
+}
+
+function timingOut(config: InternalAxiosRequestConfig): never {
+	throw new AxiosError('timeout of 60000ms exceeded', AxiosError.ECONNABORTED, config);
+}
+
+async function failureOf(promise: Promise<unknown>): Promise<unknown> {
+	return promise.then(() => expect.unreachable('the request should have failed'), (error: unknown) => error);
+}
+
+describe('a write that got no verdict, through a real instance client', () => {
+	let consoleMock: MockInstance<Console['error']>;
+
+	beforeEach(() => {
+		vi.clearAllMocks();
+		consoleMock = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+	});
+
+	afterEach(() => {
+		consoleMock?.mockRestore();
+	});
+
+	it.each([
+		['a 504 on insert', answering(504), 'insert'],
+		['a 502 on deploy_component', answering(502), 'deploy_component'],
+		['a 503 on restart', answering(503, 'The worker thread executing this operation exited'), 'restart'],
+		['a timeout on drop_table', timingOut, 'drop_table'],
+	])('toasts %s as an unknown outcome, never the gateway body', async (_label, fail, operation) => {
+		const client = instanceClient(fail);
+		const mutationClient = new QueryClient({ mutationCache: new MutationCache({ onError: mutationErrorHandler }) });
+		const observer = new MutationObserver(mutationClient, {
+			mutationFn: () => client.post('/', { operation }),
+		});
+
+		await expect(observer.mutate()).rejects.toBeInstanceOf(AxiosError);
+
+		expect(toast.error).toHaveBeenCalledOnce();
+		expect(toast.error).toHaveBeenCalledWith(OUTCOME_UNKNOWN_TITLE, {
+			id: undefined,
+			description: UNANSWERED_WRITE_MESSAGE,
+			action: { label: 'Dismiss', onClick: expect.any(Function) },
+		});
+	});
+
+	it('keeps the server’s words for a write it refused', async () => {
+		const client = instanceClient(answering(400, { error: 'Table "dog" already exists' }));
+
+		const error = await failureOf(client.post('/', { operation: 'create_table', table: 'dog' }));
+
+		expect(describeError(error).message).toBe('Table "dog" already exists');
+	});
+
+	it('keeps a read’s own failure text once the gateway retry gives up on it', async () => {
+		const client = instanceClient(answering(504));
+
+		const error = await failureOf(client.post('/', { operation: 'describe_all' }));
+
+		expect(describeError(error).message).toBe(GATEWAY_BODY);
+	});
+
+	it('sends a package download once, and never says it may have gone through', async () => {
+		const sent: string[] = [];
+		const client = instanceClient((config) => {
+			sent.push(String(config.data));
+			return answering(504)(config);
+		});
+		const queryClient = new QueryClient();
+		const { result } = renderHook(() => usePackageComponentMutation(), {
+			wrapper: ({ children }: PropsWithChildren) => (
+				<QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+			),
+		});
+
+		const error = await failureOf(result.current.mutateAsync({ project: 'app', instanceClient: client }));
+
+		expect(sent).toHaveLength(1);
+		expect(describeError(error).message).toBe(GATEWAY_BODY);
+	});
+});
diff --git a/src/integrations/api/unansweredWrite.test.ts b/src/integrations/api/unansweredWrite.test.ts
new file mode 100644
index 000000000..a26bafe0b
--- /dev/null
+++ b/src/integrations/api/unansweredWrite.test.ts
@@ -0,0 +1,71 @@
+import { isUnansweredWrite } from '@/integrations/api/unansweredWrite';
+import { AxiosError, type InternalAxiosRequestConfig } from 'axios';
+import { describe, expect, it } from 'vitest';
+
+function config(data: unknown, method = 'post'): InternalAxiosRequestConfig {
+	return { method, data } as InternalAxiosRequestConfig;
+}
+
+function answered(status: number, requestConfig = config({ operation: 'insert' })) {
+	return new AxiosError(
+		`Request failed with status code ${status}`,
+		status >= 500 ? AxiosError.ERR_BAD_RESPONSE : AxiosError.ERR_BAD_REQUEST,
+		requestConfig,
+		undefined,
+		{ status, statusText: '', data: '<html>Bad Gateway</html>', headers: {}, config: requestConfig },
+	);
+}
+
+function unanswered(code: string, requestConfig = config({ operation: 'insert' })) {
+	return new AxiosError('Network Error', code, requestConfig);
+}
+
+describe('isUnansweredWrite', () => {
+	it.each([502, 503, 504])('counts a write answered %i', (status) => {
+		expect(isUnansweredWrite(answered(status))).toBe(true);
+	});
+
+	it.each([AxiosError.ERR_NETWORK, AxiosError.ETIMEDOUT, AxiosError.ECONNABORTED])(
+		'counts a write that got no response (%s)',
+		(code) => {
+			expect(isUnansweredWrite(unanswered(code))).toBe(true);
+		},
+	);
+
+	it('reads the operation from a body axios already serialized', () => {
+		expect(isUnansweredWrite(answered(504, config(JSON.stringify({ operation: 'deploy_component' }))))).toBe(true);
+		expect(isUnansweredWrite(answered(504, config(JSON.stringify({ operation: 'describe_all' }))))).toBe(false);
+	});
+
+	it('counts a central-manager write, whose body names no operation', () => {
+		expect(isUnansweredWrite(answered(504, config({ name: 'my-cluster' })))).toBe(true);
+		expect(isUnansweredWrite(unanswered(AxiosError.ERR_NETWORK, config(undefined, 'delete')))).toBe(true);
+	});
+
+	it.each([400, 401, 403, 404, 409, 422, 429, 500])('leaves a write answered %i to its own words', (status) => {
+		expect(isUnansweredWrite(answered(status))).toBe(false);
+	});
+
+	it.each([AxiosError.ERR_CANCELED, AxiosError.ERR_INVALID_URL, AxiosError.ERR_BAD_OPTION, 'ERR_TARGET_RESTARTING'])(
+		'leaves a request that never left the browser (%s) alone',
+		(code) => {
+			expect(isUnansweredWrite(unanswered(code))).toBe(false);
+		},
+	);
+
+	it('leaves reads alone, whatever happened to them', () => {
+		expect(isUnansweredWrite(answered(504, config({ operation: 'get_job' })))).toBe(false);
+		expect(isUnansweredWrite(answered(503, config(undefined, 'get')))).toBe(false);
+		expect(isUnansweredWrite(unanswered(AxiosError.ECONNABORTED, config({ operation: 'package_component' })))).toBe(
+			false,
+		);
+	});
+
+	it('needs a real AxiosError with the request it describes', () => {
+		expect(isUnansweredWrite(new AxiosError('Network Error', AxiosError.ERR_NETWORK))).toBe(false);
+		expect(isUnansweredWrite({ isAxiosError: false, code: AxiosError.ERR_NETWORK, config: config({}) })).toBe(false);
+		expect(isUnansweredWrite(new Error('Request failed with status code 504'))).toBe(false);
+		expect(isUnansweredWrite(undefined)).toBe(false);
+		expect(isUnansweredWrite('504')).toBe(false);
+	});
+});
diff --git a/src/integrations/api/unansweredWrite.ts b/src/integrations/api/unansweredWrite.ts
new file mode 100644
index 000000000..d117b5eae
--- /dev/null
+++ b/src/integrations/api/unansweredWrite.ts
@@ -0,0 +1,42 @@
+import { isReadRequest } from '@/integrations/api/isReadOperation';
+import { pluralize } from '@/lib/pluralize';
+import { AxiosError, isAxiosError } from 'axios';
+
+export const OUTCOME_UNKNOWN_TITLE = 'Outcome unknown';
+
+export const UNANSWERED_WRITE_MESSAGE = "The server couldn't confirm whether that went through. "
+	+ 'Check whether it took effect before you try again, or it may happen twice.';
+
+export function describeUnansweredWrites(count: number): string {
+	const they = count === 1 ? 'it' : 'they';
+	return `${pluralize(count, 'request', 'requests')} couldn't be confirmed, so ${they} may have gone through. `
+		+ `Check before you try again, or ${they} may run twice.`;
+}
+
+// Axios reports a request that got no response as ERR_NETWORK, a CORS rejection and a connection
+// dropped after the request went out alike, so none of them says the server was never reached.
+// ECONNABORTED/ETIMEDOUT are the timeout pair; which one axios uses depends on
+// `transitional.clarifyTimeoutError`.
+export const NO_RESPONSE_CODES: ReadonlySet<string> = new Set([
+	AxiosError.ERR_NETWORK,
+	AxiosError.ETIMEDOUT,
+	AxiosError.ECONNABORTED,
+]);
+
+// A proxy answers these for an upstream that may already have the request (central manager's
+// operations proxy sends 504 after forwarding it), and Harper answers 503 when the worker it handed an
+// operation to exits or overruns. The same reasoning stops the gateway retry from replaying a write.
+const NO_VERDICT_STATUSES: ReadonlySet<number> = new Set([502, 503, 504]);
+
+/** Its failure must not read as a plain failure: it may have been applied, so a retry can apply it twice. */
+export function isUnansweredWrite(rawErr: unknown): rawErr is AxiosError {
+	if (!isAxiosError(rawErr) || !rawErr.config) {
+		return false;
+	}
+	const status = rawErr.response?.status;
+	const noVerdict = typeof status === 'number'
+		? NO_VERDICT_STATUSES.has(status)
+		: typeof rawErr.code === 'string' && NO_RESPONSE_CODES.has(rawErr.code);
+	// Last: it may parse a serialized body, and only these failures need it.
+	return noVerdict && !isReadRequest(rawErr.config);
+}
diff --git a/src/lib/restart/restartGate.ts b/src/lib/restart/restartGate.ts
index a53b286d6..b9a2537cb 100644
--- a/src/lib/restart/restartGate.ts
+++ b/src/lib/restart/restartGate.ts
@@ -1,3 +1,4 @@
+import { isReadRequest } from '@/integrations/api/isReadOperation';
 import { getRestartState, holdsRequests, isRestarting, waitUntilReachable } from '@/lib/restart/restartTracker';
 import { AxiosError, type AxiosInstance, CanceledError, type InternalAxiosRequestConfig } from 'axios';
 
@@ -14,32 +15,6 @@ declare module 'axios' {
 
 export const RESTARTING_ERROR_CODE = 'ERR_TARGET_RESTARTING';
 
-/**
- * Operations safe to send minutes late: reads, by Harper's naming. Token minting is deliberately not
- * one — held, it would stall a route guard's Fabric Connect attempt behind a notice that cannot mount
- * yet; refused, the guard falls through to sign-in at once.
- */
-const SAFE_TO_DELAY =
-	/^(?:get_|search_|describe_|list_|read_|user_info$|system_information$|cluster_status$|registration_info$)/;
-
-function operationOf(data: unknown): unknown {
-	if (typeof data !== 'string') {
-		return (data as { operation?: unknown } | undefined)?.operation;
-	}
-	// A gateway retry re-sends the config axios already serialized.
-	try {
-		return (JSON.parse(data) as { operation?: unknown } | null)?.operation;
-	} catch {
-		return undefined;
-	}
-}
-
-function isSafeToDelay(config: InternalAxiosRequestConfig): boolean {
-	if (config.method?.toLowerCase() === 'get') { return true; }
-	const operation = operationOf(config.data);
-	return typeof operation === 'string' && SAFE_TO_DELAY.test(operation);
-}
-
 /**
  * While the tracker says this kind of client cannot reach `entityId`, hold its reads and send them
  * once it can — a held read is a query still fetching, where a failed one is an error state, a retry
@@ -63,7 +38,7 @@ export function installRestartGate(
 ) {
 	client.interceptors.request.use(
 		(config: InternalAxiosRequestConfig) => {
-			if (!isSafeToDelay(config)) {
+			if (!isReadRequest(config)) {
 				const target = entityId.startsWith('clu-') ? 'This cluster' : 'This instance';
 				throw new AxiosError(
 					`${target} is restarting. Try again once it's back online.`,
diff --git a/src/react-query/queryClient.test.ts b/src/react-query/queryClient.test.ts
index 26c9af0ce..63503afc5 100644
--- a/src/react-query/queryClient.test.ts
+++ b/src/react-query/queryClient.test.ts
@@ -1,9 +1,15 @@
+import {
+	RESTART_UNCONFIRMED_MESSAGE,
+	RESTART_UNCONFIRMED_TITLE,
+	RestartUnconfirmedError,
+} from '@/integrations/api/instance/status/restartUnconfirmed';
+import { OUTCOME_UNKNOWN_TITLE, UNANSWERED_WRITE_MESSAGE } from '@/integrations/api/unansweredWrite';
 import { markRestarting, resetRestartTracker } from '@/lib/restart/restartTracker';
 import { MutationObserver, QueryObserver } from '@tanstack/react-query';
-import { AxiosError } from 'axios';
+import { AxiosError, type InternalAxiosRequestConfig } from 'axios';
 import { toast } from 'sonner';
 import { afterEach, beforeEach, describe, expect, it, MockInstance, vi } from 'vitest';
-import { errorHandler, queryClient, queryErrorHandler } from './queryClient';
+import { describeError, errorHandler, queryClient, queryErrorHandler, shouldToastOwnFailure } from './queryClient';
 import { claimForRoute } from './routeQueryClaims';
 
 // Mock the toast module
@@ -368,3 +374,82 @@ describe('queryErrorHandler', () => {
 		expect(toast.error).toHaveBeenCalled();
 	});
 });
+
+describe('a write that got no verdict', () => {
+	const sent = (data: unknown, method = 'post') => ({ method, data }) as InternalAxiosRequestConfig;
+	const gatewayTimeout = (config: InternalAxiosRequestConfig) =>
+		new AxiosError('Request failed with status code 504', AxiosError.ERR_BAD_RESPONSE, config, undefined, {
+			status: 504,
+			statusText: '',
+			data: { type: 'about:blank', code: 'GATEWAY_TIMEOUT', title: 'Proxied operation timed out after 30s' },
+			headers: {},
+			config,
+		});
+	const timedOut = (config: InternalAxiosRequestConfig) =>
+		new AxiosError('timeout of 60000ms exceeded', AxiosError.ECONNABORTED, config);
+
+	beforeEach(() => {
+		vi.clearAllMocks();
+		vi.spyOn(console, 'error').mockImplementation(() => undefined);
+	});
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	it('is described by its status, not by whatever the gateway sent', () => {
+		expect(describeError(gatewayTimeout(sent({ operation: 'insert' })))).toEqual({
+			title: OUTCOME_UNKNOWN_TITLE,
+			description: UNANSWERED_WRITE_MESSAGE,
+			message: UNANSWERED_WRITE_MESSAGE,
+		});
+	});
+
+	it('leaves a read with the same failure to the usual extraction', () => {
+		expect(describeError(gatewayTimeout(sent({ operation: 'get_job' })))).toEqual({
+			title: 'GATEWAY_TIMEOUT',
+			description: 'Proxied operation timed out after 30s',
+			message: 'Proxied operation timed out after 30s',
+		});
+	});
+
+	it('gets a toast of its own, never collapsed with another write or with read timeouts', () => {
+		errorHandler(timedOut(sent({ operation: 'delete', hash_values: [1] })));
+		errorHandler(timedOut(sent({ operation: 'insert', records: [{ id: 2 }] })));
+		errorHandler(timedOut(sent({ operation: 'describe_all' })));
+
+		const toasts = vi.mocked(toast.error).mock.calls.map(([title, options]) => [title, options?.id]);
+		expect(toasts).toEqual([
+			[OUTCOME_UNKNOWN_TITLE, undefined],
+			[OUTCOME_UNKNOWN_TITLE, undefined],
+			['Error', 'request-timeout'],
+		]);
+	});
+
+	it('tells a mutation’s caller not to add a "failed" toast of its own', () => {
+		expect(shouldToastOwnFailure(timedOut(sent({ operation: 'restart' })))).toBe(false);
+		expect(shouldToastOwnFailure(timedOut(sent({ operation: 'get_status' })))).toBe(true);
+		expect(shouldToastOwnFailure(new Error('Secret "x" not found'))).toBe(true);
+	});
+});
+
+describe('a restart Harper accepted whose target was never confirmed back', () => {
+	const unconfirmed = () =>
+		new RestartUnconfirmedError(
+			new AxiosError('timeout of 3000ms exceeded', AxiosError.ECONNABORTED, {
+				method: 'post',
+				data: { operation: 'user_info' },
+			} as InternalAxiosRequestConfig),
+		);
+
+	it('is described as not back yet, never by the probe’s own failure', () => {
+		expect(describeError(unconfirmed())).toEqual({
+			title: RESTART_UNCONFIRMED_TITLE,
+			description: RESTART_UNCONFIRMED_MESSAGE,
+			message: RESTART_UNCONFIRMED_MESSAGE,
+		});
+	});
+
+	it('tells a mutation’s caller not to add a "failed" toast of its own', () => {
+		expect(shouldToastOwnFailure(unconfirmed())).toBe(false);
+	});
+});
diff --git a/src/react-query/queryClient.ts b/src/react-query/queryClient.ts
index 581fa4a4e..8185d0157 100644
--- a/src/react-query/queryClient.ts
+++ b/src/react-query/queryClient.ts
@@ -1,3 +1,9 @@
+import {
+	RESTART_UNCONFIRMED_MESSAGE,
+	RESTART_UNCONFIRMED_TITLE,
+	RestartUnconfirmedError,
+} from '@/integrations/api/instance/status/restartUnconfirmed';
+import { isUnansweredWrite, OUTCOME_UNKNOWN_TITLE, UNANSWERED_WRITE_MESSAGE } from '@/integrations/api/unansweredWrite';
 import { errorText } from '@/lib/errorText';
 import { isRestartNoise } from '@/lib/restart/restartGate';
 import { onRestartSettled } from '@/lib/restart/restartTracker';
@@ -15,8 +21,22 @@ import { toast } from 'sonner';
  * inputs. They differ only for a legacy `"Conflict: user already exists"` body, where the split
  * below moves the first clause into `title`: a single line built from `description` alone would
  * lose it. Everything comes from this one extractor so the inline text and the toast can't drift.
+ *
+ * A write that got no verdict ({@link isUnansweredWrite}) gets our own copy instead, chosen by status
+ * and never by body: a gateway's body describes the gateway, and "failed" is exactly what it can't claim.
+ * So does a restart Harper accepted whose target was never confirmed back ({@link RestartUnconfirmedError}).
  */
 export function describeError(rawErr: unknown): { title: string; description: string; message: string } {
+	if (isUnansweredWrite(rawErr)) {
+		return { title: OUTCOME_UNKNOWN_TITLE, description: UNANSWERED_WRITE_MESSAGE, message: UNANSWERED_WRITE_MESSAGE };
+	}
+	if (rawErr instanceof RestartUnconfirmedError) {
+		return {
+			title: RESTART_UNCONFIRMED_TITLE,
+			description: RESTART_UNCONFIRMED_MESSAGE,
+			message: RESTART_UNCONFIRMED_MESSAGE,
+		};
+	}
 	let errorTitle = 'Error';
 	let errorMsg = 'We had some trouble!';
 	let splitTitleFromMsg = true;
@@ -62,6 +82,15 @@ export function describeError(rawErr: unknown): { title: string; description: st
 	return { title: errorTitle, description: errorMsg, message };
 }
 
+/**
+ * For a mutation's caller that toasts its own failure on top of the global toast: whether it should.
+ * Not for an unanswered write or an unconfirmed restart, whose global toast already says what is known —
+ * a second one saying "failed" would contradict it and invite the retry it warns against.
+ */
+export function shouldToastOwnFailure(rawErr: unknown): boolean {
+	return !isUnansweredWrite(rawErr) && !(rawErr instanceof RestartUnconfirmedError);
+}
+
 export function errorHandler(rawErr: unknown) {
 	console.error(rawErr);
 	const { title: errorTitle, description: errorMsg } = describeError(rawErr);
@@ -75,8 +104,17 @@ export function errorHandler(rawErr: unknown) {
 	// signed out, #1546), and a permission failure repeated N times is still one
 	// thing for the user to know.
 	const isForbidden = axiosWrappedErr?.response?.status === 403;
+	// Never collapsed: each warns about a different write, and a read timing out alongside one must
+	// not replace it through `request-timeout`.
+	const collapseId = isUnansweredWrite(rawErr)
+		? undefined
+		: isTimeout
+		? 'request-timeout'
+		: isForbidden
+		? 'request-forbidden'
+		: undefined;
 	toast.error(errorTitle, {
-		id: isTimeout ? 'request-timeout' : isForbidden ? 'request-forbidden' : undefined,
+		id: collapseId,
 		description: errorMsg,
 		action: {
 			label: 'Dismiss',
diff --git a/src/router/__tests__/orgUndefinedRepro.test.ts b/src/router/__tests__/orgUndefinedRepro.test.ts
index 70246dc64..b00cd4251 100644
--- a/src/router/__tests__/orgUndefinedRepro.test.ts
+++ b/src/router/__tests__/orgUndefinedRepro.test.ts
@@ -48,6 +48,22 @@ describe('deep-link route matching for cluster instance pages', () => {
 		});
 	});
 
+	it.each([
+		['cluster', '/org-qpz5akmyrp1d0opj/clu-tc9pqw20vrks2zik/operations', {}],
+		['instance', '/org-qpz5akmyrp1d0opj/clu-tc9pqw20vrks2zik/instance/ins-abc123/operations', {
+			instanceId: 'ins-abc123',
+		}],
+	])('matches the operations console in %s mode', (_mode, path, extraParams) => {
+		const leaf = matchDeepLink(path).at(-1)!;
+
+		expect(leaf.routeId).toMatch(/\/operations$/);
+		expect(leaf.params).toMatchObject({
+			organizationId: 'org-qpz5akmyrp1d0opj',
+			clusterId: 'clu-tc9pqw20vrks2zik',
+			...extraParams,
+		});
+	});
+
 	it('still matches explicit instance routes', () => {
 		const matches = matchDeepLink(
 			'/org-qpz5akmyrp1d0opj/clu-tc9pqw20vrks2zik/instance/ins-abc123/logs',