@@ -123,6 +123,8 @@ jobs:
         uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           global-json-file: global.json
+      - name: Trust the development HTTPS certificate
+        run: dotnet dev-certs https --trust
       - name: Build
         run: dotnet build KeyLoad.slnx -warnaserror
       - name: Install administration browser
 
@@ -259,7 +259,8 @@ still serve earlier committed data after Orleans membership settles.
 
 Both values are read at startup; there is no live resizing or data movement.
 Node data remains in `data/cluster/`; development credentials live in AppHost user secrets.
-HTTP ports start at `5101`; keep the data directory between restarts.
+Aspire allocates HTTPS, silo and membership ports; copy a node's HTTPS URL from
+the Aspire dashboard into `KEYLOAD_ENDPOINT`. Keep the data directory between restarts.
 Stop owned resources with `aspire stop --non-interactive`.
 
 For one shared volume, configure the same storage path on all silos. The execution
@@ -276,11 +277,11 @@ shared filesystem locking and flush behavior still need deployment qualification
 
 Export the `Parameters:admin-key` value from AppHost user secrets as `KEYLOAD_API_KEY` before running the CLI or the examples below.
 
-- Open the [admin console](http://localhost:5101/admin).
+- Open `/admin` on the node's discovered HTTPS URL.
 - Or check the cluster from the CLI:
 
 ```bash
-dotnet run --project src/KeyLoad.Cli --no-build -- status http://localhost:5101
+dotnet run --project src/KeyLoad.Cli --no-build -- status "$KEYLOAD_ENDPOINT"
 ```
 
 ## Use it
@@ -295,7 +296,8 @@ using KeyLoad.Client;
 
 var apiKey = Environment.GetEnvironmentVariable("KEYLOAD_API_KEY")
     ?? throw new InvalidOperationException("Set KEYLOAD_API_KEY.");
-using var http = new HttpClient { BaseAddress = new Uri("http://localhost:5101") };
+using var http = new HttpClient { BaseAddress = new Uri(Environment.GetEnvironmentVariable("KEYLOAD_ENDPOINT")
+    ?? throw new InvalidOperationException("Set KEYLOAD_ENDPOINT to the Aspire HTTPS URL.")) };
 var client = new KeyLoadClient(http, apiKey);
 
 // tenant, database, transaction domain, partition key
@@ -351,7 +353,7 @@ Every node serves [MCP](https://modelcontextprotocol.io/) at `/mcp`. Its compact
   "mcpServers": {
     "keyload": {
       "type": "http",
-      "url": "http://localhost:5101/mcp",
+      "url": "${KEYLOAD_ENDPOINT}/mcp",
       "headers": { "Authorization": "Bearer ${KEYLOAD_API_KEY}" }
     }
   }
 
@@ -1,11 +1,9 @@
 using System.Globalization;
-using System.Net;
 using System.Security.Cryptography;
 using KeyLoad.AppHost.StorageRecovery;
 using KeyLoad.AppHost.TestInfrastructure;
 using KeyLoad.Clustering;
 using Microsoft.Extensions.DependencyInjection;
-using Microsoft.Extensions.Options;
 
 namespace KeyLoad.AppHost.Hosting;
 
@@ -23,7 +21,7 @@ internal static class AppHostProgram
     private const string StorageModeEnvironment = "KeyLoad__StorageMode";
     private const string SharedDirectory = "shared";
     private const string SiloNameEnvironment = "KeyLoad__SiloName";
-    private const string HttpEndpoint = "http";
+    private const string HttpsEndpoint = "https";
     private const string SiloEndpoint = "silo";
     private const string TcpScheme = "tcp";
     private const string ReadyPath = "/health/ready";
@@ -41,7 +39,6 @@ internal static class AppHostProgram
     private const string ServerUrlsEnvironment = "ASPNETCORE_URLS";
     private const string LoopbackAddress = "127.0.0.1";
     private const int FirstNodeIndex = 0;
-    private const int LastNodeOffset = 1;
     private const int SharedVolumeCopies = 1;
 
     private static async Task<int> Main(string[] args)
@@ -86,11 +83,6 @@ internal static IResourceBuilder<ProjectResource>[] AddCluster(IDistributedAppli
         var nodeNames = ClusterTopologyNodeNames.Read(benchmarkNodeCount, functionalNodeCount, ephemeral,
             options.Cluster.Value.SiloCount);
         var replicas = benchmarkNodeCount ?? options.Cluster.Value.ReplicaCount;
-        if (!ephemeral && (long)options.Cluster.Value.FirstPublicPort + nodeNames.Length - LastNodeOffset > IPEndPoint.MaxPort)
-        {
-            throw new OptionsValidationException(Options.DefaultName, typeof(ClusterDeploymentOptions),
-                [ClusterDeploymentOptions.ValidationMessage]);
-        }
         if (replicas > nodeNames.Length
             || (options.Cluster.Value.StorageMode == StorageAccessMode.SharedVolume && replicas != SharedVolumeCopies))
         {
@@ -105,11 +97,11 @@ internal static IResourceBuilder<ProjectResource>[] AddCluster(IDistributedAppli
         for (var index = FirstNodeIndex; index < nodes.Length; index++)
         {
             nodes[index] = AddNode(builder, databaseIdentity, root, ephemeral, nodeNames.Length,
-                replicas, identity, nodeNames[index], index);
+                replicas, identity, nodeNames[index]);
         }
         var contenders = ExclusiveOwnerContentionResources.Add(options.Control.Value.ExclusiveOwnerContention,
             nodes[FirstNodeIndex], resourceName => AddNode(builder, databaseIdentity, root, true,
-                nodeNames.Length, replicas, identity, ExclusiveOwnerContentionResources.OwnerName, FirstNodeIndex,
+                nodeNames.Length, replicas, identity, ExclusiveOwnerContentionResources.OwnerName,
                 resourceName));
         var membershipSecret = builder.AddParameter(MembershipParameter,
             Convert.ToBase64String(RandomNumberGenerator.GetBytes(MembershipSecretBytes)), secret: true);
@@ -130,19 +122,18 @@ private static IResourceBuilder<ProjectResource> AddNode(IDistributedApplication
         ClusterIdentity databaseIdentity, string root, bool ephemeral, int siloCount, int replicaCount,
         (IResourceBuilder<ParameterResource> Signing, IResourceBuilder<ParameterResource> Admin,
             IResourceBuilder<ParameterResource> Incarnation) identity,
-        string ownerName, int index, string? resourceName = null)
+        string ownerName, string? resourceName = null)
     {
         resourceName ??= ownerName;
         var options = AppHostOptionsRegistration.Get(builder).Cluster.Value;
         var directory = Path.Combine(root, options.StorageMode == StorageAccessMode.SharedVolume ? SharedDirectory : ownerName);
         Directory.CreateDirectory(directory);
-        var port = ephemeral ? (int?)null : options.FirstPublicPort + index;
         var resource = builder.AddProject<Projects.KeyLoad>(resourceName, launchProfileName: null)
-            .WithHttpEndpoint(port: port, name: HttpEndpoint, isProxied: false)
+            .WithHttpsEndpoint(name: HttpsEndpoint, isProxied: false)
             .WithEndpoint(name: SiloEndpoint, scheme: TcpScheme, isExternal: false, isProxied: false);
         resource.WithEnvironment(ClusterEnvironment, ClusterPrefix + databaseIdentity.Incarnation.ToString(ClusterGuidFormat))
-            .WithEnvironment(PublicEnvironment, resource.GetEndpoint(HttpEndpoint))
-            .WithEnvironment(ServerUrlsEnvironment, resource.GetEndpoint(HttpEndpoint))
+            .WithEnvironment(PublicEnvironment, resource.GetEndpoint(HttpsEndpoint))
+            .WithEnvironment(ServerUrlsEnvironment, resource.GetEndpoint(HttpsEndpoint))
             .WithEnvironment(SiloNameEnvironment, resourceName)
             .WithEnvironment(SiloCountEnvironment, siloCount.ToString(CultureInfo.InvariantCulture))
             .WithEnvironment(ReplicaCountEnvironment, replicaCount.ToString(CultureInfo.InvariantCulture))
@@ -155,8 +146,7 @@ private static IResourceBuilder<ProjectResource> AddNode(IDistributedApplication
             .WithEnvironment(IncarnationEnvironment, identity.Incarnation)
             .WithEnvironment(SigningEnvironment, identity.Signing)
             .WithEnvironment(AdminEnvironment, identity.Admin)
-            .WithHttpHealthCheck(ReadyPath, endpointName: HttpEndpoint);
-        KeyLoad.AppHost.ClientApi.ClusterConnectionEndpointResources.Apply(resource);
+            .WithHttpHealthCheck(ReadyPath, endpointName: HttpsEndpoint);
         ClusterResourceSettings.Apply(builder, resource);
         ProcessKillCommand.Apply(builder, resource, ephemeral);
         return resource;
 
@@ -1,4 +1,3 @@
-using System.Net;
 using KeyLoad.Clustering;
 using Microsoft.Extensions.Configuration;
 
@@ -9,11 +8,9 @@ namespace KeyLoad.AppHost.TestInfrastructure;
 internal sealed record ClusterDeploymentOptions
 {
     private const int DefaultSiloCount = 3;
-    private const int DefaultFirstPublicPort = 5101;
     private const string SiloCountKey = "KeyLoad:SiloCount";
     private const string ReplicaCountKey = "KeyLoad:ReplicaCount";
     private const string StorageModeKey = "KeyLoad:StorageMode";
-    internal const string FirstPublicPortKey = "KeyLoad:FirstPublicPort";
     private const string LoggingKey = "Logging:LogLevel:Default";
     private const string DefaultLoggingLevel = "Warning";
     internal const string ValidationMessage = "Cluster deployment settings are invalid.";
@@ -26,15 +23,11 @@ internal sealed record ClusterDeploymentOptions
     /// <summary>Whether nodes receive isolated directories or the same shared directory.</summary>
     [ConfigurationKeyName(StorageModeKey)]
     public StorageAccessMode StorageMode { get; init; } = StorageAccessMode.IsolatedVolumes;
-    [ConfigurationKeyName(FirstPublicPortKey)]
-    public int FirstPublicPort { get; init; } = DefaultFirstPublicPort;
     [ConfigurationKeyName(LoggingKey)]
     public string LoggingLevel { get; init; } = DefaultLoggingLevel;
     internal bool IsValid() => SiloCount >= 1
         && ReplicaCount >= 1 && ReplicaCount <= SiloCount
         && Enum.IsDefined(StorageMode)
         && (StorageMode != StorageAccessMode.SharedVolume || ReplicaCount == 1)
-        && !string.IsNullOrWhiteSpace(LoggingLevel)
-        && FirstPublicPort >= 1
-        && FirstPublicPort <= IPEndPoint.MaxPort;
+        && !string.IsNullOrWhiteSpace(LoggingLevel);
 }
@@ -113,15 +113,12 @@ ceilings and rejects different policies within a comparable cohort.
 This metadata schema change does not change persisted database formats or qualify
 new performance measurements.
 
-cluster published host ports consume `ClusterDeploymentOptions.FirstPublicPort`,
-centrally bound from `KeyLoad:FirstPublicPort` with the preserved default5101.
-Validate the complete range for the configured node count against execution `IPEndPoint` bounds
-before profile-directory or Aspire-resource creation. Ordinary composition uses
-the captured value plus node index; ephemeral composition still delegates port
-assignment to Aspire. Internal container HTTP/silo ports remain frozen image
-identities. `ClusterPublishedPortPolicyTests` verifies binding, every
-actual endpoint annotation, snapshot lifetime, the inclusive upper range and
-rejection before resource/file ownership (AC-CQ-034/035).
+Cluster HTTPS, silo and membership endpoints receive ports allocated by Aspire.
+KeyLoad does not select a first public port or maintain a port range.
+`ClusterPublishedPortPolicyTests` checks both ordinary and ephemeral project
+composition: the sole HTTPS endpoint and every Orleans endpoint leave host and
+target ports unset before Aspire allocation (AC-CQ-034/035). Container target
+ports belong to their separate published-image contract.
 
 Verification order is a real full Release build, scoped formatting and a
 final full build, then Aspire-owned analyzers/unit/scalar/recovery/cluster plus the
 
@@ -24,7 +24,7 @@ flowchart LR
 - Lifetime. Disconnect uses Kestrel `ConnectionClosed`; `RequestAborted` belongs to one operation. Host shutdown closes connection admission and joins connections before the silo and storage stop. Reconnect obtains a new grain. Silo loss discards the disposable grain; command-receipt retry and uncertain writes keep their existing semantics.
 - Background work (timers, durable jobs, provider work) uses one bounded execution owner per silo service, never a grain per operation.
 - Errors. `KeyLoadException` is serialized ly (`[GenerateSerializer]`, alias `keyload.error`, Code id 0, StatusCode id 1) so domain codes survive Orleans RPC.
-- Transport. HTTP/1.1 runs sequential requests per connection. Overlapping calls on one connection use the dedicated HTTP/2 listener (`ServerExecutionOptions.EnableHttp2`, `Http2Port` default 8081); the AppHost exposes it on every node and clients use the Aspire-discovered endpoint. The SDK copies the supplied `HttpClient` request version and version policy into every request.
+- Transport. The AppHost exposes one HTTPS endpoint per node and Aspire allocates every public and Orleans port. TLS negotiates HTTP/1.1 or HTTP/2 on that endpoint; overlapping calls on one connection use HTTP/2. Clients use the Aspire-discovered HTTPS address. There is no separate cleartext HTTP/2 listener or application-selected port range. The SDK copies the supplied `HttpClient` request version and version policy into every request.
 - Current MCP transport is stateless; this decision does not deliver SQL session interoperability.
 
 ## Verification
 
@@ -15,7 +15,7 @@ For EACH SDK and official MCP changed-OFFSET refusal, assert the exact CursorExp
 Replay the complete original eight-mutation seed command through EACH public client; compare every field of its original receipt and immediately verify full current state and fresh signed pages before another replay. No raw store/journal invariance or physical-cut/logical-commit inequality is claimed.
 
 ## AC-CURSOR-IDENTITY-004
-Join all original/new caller owners before EACH of two genuine all-three Aspire cluster cold cycles. Reopen fresh callers, reject old owner/read-generation cursors, verify fresh full literal pages and all original receipt replays. The unchanged original flow already owns two cold cycles: the strengthened complete Case therefore adds two, totaling four. Its original McpCallerDeadline and Test/Args identity are preserved.
+Join all original/new caller owners before EACH of two genuine all-three Aspire cluster cold cycles. Reopen fresh callers, repeat the changed-OFFSET refusal for the original signed cursors, verify fresh full literal pages and all original receipt replays. A same-volume restart preserves the physical owner identity and read generation unless storage replacement changes it; restart alone does not imply cursor expiry. The unchanged original flow already owns two cold cycles: the strengthened complete Case therefore adds two, totaling four. Its original McpCallerDeadline and Test/Args identity are preserved.
 
 ```mermaid
 flowchart LR
@@ -25,7 +25,7 @@ flowchart LR
  X --> V[Original OFFSET1 continues c then d]
  V --> R[Full seed receipt replay and current state]
  R --> K1[Join callers and all-three cold1]
- K1 --> F1[Old cursor refusal and fresh pages]
+ K1 --> F1[Changed-OFFSET refusal and fresh pages]
  F1 --> K2[Join callers and all-three cold2]
  K2 --> F2[Fresh pages and original receipts]
 ```
 
@@ -322,9 +322,12 @@ REQ/AC-TEST-001: the full Unit model/disposal flow asserts every Aspire-owned en
 
 REQ-TEST-001/011/015 and their existing ACs preserve the genuine configured-node model construction, complete endpoint assertions and joined model disposal. In ExactSelectionBuildsTheOwnedClusterModelAndSettlesDisposal the pre-DCP http2.Port is 8081, not null. No deployment port configuration changes are authorized by this test correction.
 
-Pinned Aspire.Hosting 13.6.1's EndpointAnnotation retains an omitted backing port and exposes targetPort as Port for an unproxied endpoint unless the port was explicitly set to null. Existing ClusterConnectionEndpointResources.Apply supplies targetPort8081, name http2, isProxiedfalse and no port argument through WithHttpEndpoint. Therefore the constructed model's public Port property is8081; this is not proof of an explicitly fixed container host binding.
-
-The pinned DcpExecutor allocation checks container SpecifiedPort for a fixed public port. The omitted backing port requires allocation for a proxyless container; EnsureProxylessEndpointPort assigns the real allocated public port while retaining container target8081. The cluster resources omit this http2 backing port. Model verification thus compares http2.Port to its independent Http2TargetPort constant before DCP, preserving exact names/order/scheme/target/internal/unproxied assertions, all other endpoint values, actual Aspire Build and original application/root cleanup. It does not claim actual distinct allocated endpoints, readiness, successful connection or cluster execution; those remain authentic Aspire runtime gates.
+The primary project AppHost uses one HTTPS endpoint per node. Aspire allocates
+its port and the silo/membership ports in ordinary and ephemeral composition.
+HTTP/1.1 and HTTP/2 share TLS negotiation on that endpoint. Integration clients,
+readiness checks and the CLI use the discovered HTTPS address. CI establishes
+trust in the .NET development certificate before starting the real topology;
+certificate verification stays enabled.
 
 ### Cold restart of every stopped node before readiness