diff --git a/.github/workflows/ssh-windows-hosts.yml b/.github/workflows/ssh-windows-hosts.yml
index 4bccdf1a5f2..3fcd66f8e10 100644
--- a/.github/workflows/ssh-windows-hosts.yml
+++ b/.github/workflows/ssh-windows-hosts.yml
@@ -45,7 +45,7 @@ on:
       # The deploy runs over this SSH transport.
       - 'src/main/ssh/ssh-connection*'
       - '!src/**/*.test.ts'
-      - 'src/main/ssh/orcad-windows-host-lane.test.ts'
+      - 'src/main/managed-server/host-state/orcad-windows-host-lane.test.ts'
       - 'tests/e2e/ssh-orcad-auto-convert.spec.ts'
       - 'tests/e2e/helpers/orcad-convert-host.ts'
       - 'tests/e2e/helpers/orcad-convert-flow.ts'
diff --git a/config/ci/windows-ssh-provider/invoke-windows-host-cells.ps1 b/config/ci/windows-ssh-provider/invoke-windows-host-cells.ps1
index 13d18b02ae9..039b934e784 100644
--- a/config/ci/windows-ssh-provider/invoke-windows-host-cells.ps1
+++ b/config/ci/windows-ssh-provider/invoke-windows-host-cells.ps1
@@ -117,7 +117,7 @@ try {
       $code=Invoke-AppCell $account $descriptor (Join-Path $ReceiptRoot "$cell.log") $appCells[$cell][0] $appCells[$cell][1]
     } else {
       if(-not $cell.StartsWith('orcad-')){throw "Unknown Windows host cell $cell"}
-      $lane='src/main/ssh/orcad-windows-host-lane.test.ts'
+      $lane='src/main/managed-server/host-state/orcad-windows-host-lane.test.ts'
       & node node_modules/vitest/vitest.mjs run --config config/vitest.config.ts $lane --reporter=verbose 2>&1 | Tee-Object -FilePath (Join-Path $ReceiptRoot "$cell.log")
       # Why global: under the workflow's GetNewClosure callback, bare $LASTEXITCODE reads a stale captured copy.
       $code=$global:LASTEXITCODE
diff --git a/config/scripts/ci-shard-timings.json b/config/scripts/ci-shard-timings.json
index e9812315df6..64ecfee2c1e 100644
--- a/config/scripts/ci-shard-timings.json
+++ b/config/scripts/ci-shard-timings.json
@@ -5667,11 +5667,11 @@
       "src/main/ssh/orcad-runtime-maintenance.test.ts": 894,
       "src/main/managed-server/lifecycle/orcad-runtime-target.test.ts": 217,
       "src/main/ssh/orcad-ssh-provisioning.test.ts": 271,
-      "src/main/ssh/orcad-state-mutation-exec.test.ts": 360,
-      "src/main/ssh/orcad-state-mutation-fence-heartbeat.test.ts": 4403,
-      "src/main/ssh/orcad-state-mutation-timeout.test.ts": 434,
-      "src/main/ssh/orcad-state-snapshot-shell.test.ts": 832,
-      "src/main/ssh/orcad-state-snapshot.test.ts": 334,
+      "src/main/managed-server/host-state/orcad-state-mutation-exec.test.ts": 360,
+      "src/main/managed-server/host-state/orcad-state-mutation-fence-heartbeat.test.ts": 4403,
+      "src/main/managed-server/host-state/orcad-state-mutation-timeout.test.ts": 434,
+      "src/main/managed-server/host-state/orcad-state-snapshot-shell.test.ts": 832,
+      "src/main/managed-server/host-state/orcad-state-snapshot.test.ts": 334,
       "src/main/managed-server/lifecycle/orcad-stdio-bridge-provider.test.ts": 705,
       "src/main/ssh/orcad-stdio-bridge.test.ts": 597,
       "src/main/ssh/orcad-terminal-census-client.test.ts": 302,
@@ -5679,9 +5679,9 @@
       "src/main/ssh/orcad-unreachable-setup-release.test.ts": 1871,
       "src/main/ssh/orcad-unreachable-setup-stop.test.ts": 421,
       "src/main/ssh/orcad-update-plan.test.ts": 557,
-      "src/main/ssh/orcad-windows-host-fence-ops.test.ts": 995,
-      "src/main/ssh/orcad-windows-host-lane.test.ts": 647,
-      "src/main/ssh/orcad-windows-host-state-ops.test.ts": 2049,
+      "src/main/managed-server/host-state/orcad-windows-host-fence-ops.test.ts": 995,
+      "src/main/managed-server/host-state/orcad-windows-host-lane.test.ts": 647,
+      "src/main/managed-server/host-state/orcad-windows-host-state-ops.test.ts": 2049,
       "src/main/ssh/pinned-runtime-host-target.test.ts": 51,
       "src/main/ssh/relay-bundle-paths.test.ts": 32,
       "src/main/ssh/relay-install-artifacts.test.ts": 37,
diff --git a/src/main/managed-server/activation/orcad-activation-fence-generation.test.ts b/src/main/managed-server/activation/orcad-activation-fence-generation.test.ts
index e0c3d94aa0c..4517d8c43a5 100644
--- a/src/main/managed-server/activation/orcad-activation-fence-generation.test.ts
+++ b/src/main/managed-server/activation/orcad-activation-fence-generation.test.ts
@@ -34,8 +34,8 @@ const { withOrcadActivationLock } = await import('./orcad-activation-lock')
 const { orcadActivationFenceRefusal } = await import('./orcad-activation-fence-hold')
 const { execOrcadRemote } = await import('../install/orcad-remote-runtime-control')
 const { OrcadFenceLostError, runWithOrcadFence } = await import('./orcad-activation-fence-scope')
-const { execOrcadStateMutation } = await import('../../ssh/orcad-state-mutation-exec')
-const { clearOrcadStateSnapshotMembersCommand } = await import('../../ssh/orcad-state-snapshot')
+const { execOrcadStateMutation } = await import('../host-state/orcad-state-mutation-exec')
+const { clearOrcadStateSnapshotMembersCommand } = await import('../host-state/orcad-state-snapshot')
 const { getRemoteHostPlatform } = await import('../../ssh/ssh-remote-platform')
 
 const homes: string[] = []
diff --git a/src/main/ssh/orcad-machine-claim-command.ts b/src/main/managed-server/host-state/orcad-machine-claim-command.ts
similarity index 92%
rename from src/main/ssh/orcad-machine-claim-command.ts
rename to src/main/managed-server/host-state/orcad-machine-claim-command.ts
index a29f5140a56..ad8c6e60dc9 100644
--- a/src/main/ssh/orcad-machine-claim-command.ts
+++ b/src/main/managed-server/host-state/orcad-machine-claim-command.ts
@@ -1,11 +1,11 @@
 import { randomUUID } from 'node:crypto'
-import { shellEscape } from './ssh-connection-utils'
-import { RELAY_REMOTE_DIR } from './remote-frame-protocol'
+import { shellEscape } from '../../ssh/ssh-connection-utils'
+import { RELAY_REMOTE_DIR } from '../../ssh/remote-frame-protocol'
 import {
   ORCAD_MACHINE_CLAIM_FILENAME,
   ORCAD_MACHINE_CLAIM_SCHEMA_VERSION
 } from './orcad-machine-home'
-import { joinRemotePath, type RemoteHostPlatform } from './ssh-remote-platform'
+import { joinRemotePath, type RemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
 /** Under `~/.orca-remote`: decides the claim when hard links cannot (see the claim command). */
 export const ORCAD_MACHINE_CLAIM_ARBITER_DIRNAME = 'orcad-machine.arbiter'
diff --git a/src/main/ssh/orcad-machine-home.test.ts b/src/main/managed-server/host-state/orcad-machine-home.test.ts
similarity index 95%
rename from src/main/ssh/orcad-machine-home.test.ts
rename to src/main/managed-server/host-state/orcad-machine-home.test.ts
index ac7243fad98..e728ffb6505 100644
--- a/src/main/ssh/orcad-machine-home.test.ts
+++ b/src/main/managed-server/host-state/orcad-machine-home.test.ts
@@ -12,16 +12,16 @@ import {
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
-import type * as ExecCommandModule from './remote-exec-command'
+import type * as ExecCommandModule from '../../ssh/remote-exec-command'
 import type { OrcadMachineHomeProbe } from './orcad-machine-home'
-import type { OrcadHostTransport } from './orcad-host-transport'
-import type { RemoteHostPlatform } from './ssh-remote-platform'
+import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
+import type { RemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
 // Each "machine" is a real local shell whose `uname -n` answers that machine's hostname.
 const shell = vi.hoisted((): { env: NodeJS.ProcessEnv | undefined } => ({
   env: undefined
 }))
-vi.mock('./remote-exec-command', async (importOriginal) => {
+vi.mock('../../ssh/remote-exec-command', async (importOriginal) => {
   const { runProcess } = await import('@orca/process-host')
   return {
     ...(await importOriginal<typeof ExecCommandModule>()),
@@ -32,7 +32,7 @@ vi.mock('./remote-exec-command', async (importOriginal) => {
         env: conn.env ?? shell.env
       })
       if (result.code !== 0) {
-        const { sshCommandExitError } = await import('./remote-exec-command')
+        const { sshCommandExitError } = await import('../../ssh/remote-exec-command')
         throw sshCommandExitError(command, result.code ?? 1, result.stdout)
       }
       return result.stdout
@@ -40,7 +40,7 @@ vi.mock('./remote-exec-command', async (importOriginal) => {
   }
 })
 
-const { resolveOrcadMachineHome } = await import('../managed-server/install/orcad-remote-context')
+const { resolveOrcadMachineHome } = await import('../install/orcad-remote-context')
 const {
   decideOrcadMachineHome,
   orcadMachineIdentity,
@@ -50,13 +50,12 @@ const {
   ORCAD_MACHINE_HOMES_DIRNAME
 } = await import('./orcad-machine-home')
 const { ORCAD_MACHINE_CLAIM_ARBITER_DIRNAME } = await import('./orcad-machine-claim-command')
-const { computeRemoteInstallDir } =
-  await import('../managed-server/install/remote-versioned-install')
-const { ORCAD_INSTALL_MODEL } = await import('../managed-server/install/remote-install-model')
-const { orcadLivenessProbeCommand } = await import('../managed-server/install/orcad-remote-launch')
-const { ORCAD_PID_FILENAME } = await import('../managed-server/install/orcad-remote-host-support')
-const { execOrcadRemote } = await import('../managed-server/install/orcad-remote-runtime-control')
-const { getRemoteHostPlatform } = await import('./ssh-remote-platform')
+const { computeRemoteInstallDir } = await import('../install/remote-versioned-install')
+const { ORCAD_INSTALL_MODEL } = await import('../install/remote-install-model')
+const { orcadLivenessProbeCommand } = await import('../install/orcad-remote-launch')
+const { ORCAD_PID_FILENAME } = await import('../install/orcad-remote-host-support')
+const { execOrcadRemote } = await import('../install/orcad-remote-runtime-control')
+const { getRemoteHostPlatform } = await import('../../ssh/ssh-remote-platform')
 type Probe = OrcadMachineHomeProbe
 type Host = RemoteHostPlatform
 
diff --git a/src/main/ssh/orcad-machine-home.ts b/src/main/managed-server/host-state/orcad-machine-home.ts
similarity index 97%
rename from src/main/ssh/orcad-machine-home.ts
rename to src/main/managed-server/host-state/orcad-machine-home.ts
index 34f6ce777c6..7ca9beb3562 100644
--- a/src/main/ssh/orcad-machine-home.ts
+++ b/src/main/managed-server/host-state/orcad-machine-home.ts
@@ -11,16 +11,16 @@
  * can see, so a store shared across machines could be collected under another machine's server.
  */
 import { createHash } from 'node:crypto'
-import { shellEscape } from './ssh-connection-utils'
-import { RELAY_REMOTE_DIR } from './remote-frame-protocol'
-import { ORCAD_ACTIVATION_FILENAME } from '../managed-server/activation/orcad-activation-record'
-import { parseDarwinPlatformUuid } from '../persistence/profile-state/profile-state-access-identity'
+import { shellEscape } from '../../ssh/ssh-connection-utils'
+import { RELAY_REMOTE_DIR } from '../../ssh/remote-frame-protocol'
+import { ORCAD_ACTIVATION_FILENAME } from '../activation/orcad-activation-record'
+import { parseDarwinPlatformUuid } from '../../persistence/profile-state/profile-state-access-identity'
 import {
   joinRemotePath,
   normalizeRemoteHome,
   validateRemoteHome,
   type RemoteHostPlatform
-} from './ssh-remote-platform'
+} from '../../ssh/ssh-remote-platform'
 
 /** Under `~/.orca-remote`: names the one machine that owns the login home's orcad state. */
 export const ORCAD_MACHINE_CLAIM_FILENAME = 'orcad-machine.json'
diff --git a/src/main/ssh/orcad-state-mutation-exec.test.ts b/src/main/managed-server/host-state/orcad-state-mutation-exec.test.ts
similarity index 91%
rename from src/main/ssh/orcad-state-mutation-exec.test.ts
rename to src/main/managed-server/host-state/orcad-state-mutation-exec.test.ts
index 4c7ac2da409..fde1f054db0 100644
--- a/src/main/ssh/orcad-state-mutation-exec.test.ts
+++ b/src/main/managed-server/host-state/orcad-state-mutation-exec.test.ts
@@ -6,10 +6,10 @@ import {
   execOrcadStateMutation,
   execOrcadStateMutationOr
 } from './orcad-state-mutation-exec'
-import { execOrcadRemoteOr } from '../managed-server/install/orcad-remote-runtime-control'
-import { isUnconfirmedSshCommandTermination } from './remote-exec-command'
-import { getRemoteHostPlatform } from './ssh-remote-platform'
-import type { OrcadHostTransport } from './orcad-host-transport'
+import { execOrcadRemoteOr } from '../install/orcad-remote-runtime-control'
+import { isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
+import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
 
 /** An ssh2 exec channel whose remote command answers only when the test says so. */
 class SlowChannel extends EventEmitter {
diff --git a/src/main/ssh/orcad-state-mutation-exec.ts b/src/main/managed-server/host-state/orcad-state-mutation-exec.ts
similarity index 92%
rename from src/main/ssh/orcad-state-mutation-exec.ts
rename to src/main/managed-server/host-state/orcad-state-mutation-exec.ts
index b32154814fe..69dc25e495d 100644
--- a/src/main/ssh/orcad-state-mutation-exec.ts
+++ b/src/main/managed-server/host-state/orcad-state-mutation-exec.ts
@@ -11,12 +11,9 @@ import {
   ORCAD_STATE_MUTATION_BUSY,
   ORCAD_STATE_MUTATION_DEADLINE
 } from './orcad-state-snapshot-members'
-import type { OrcadRemoteExecTarget } from '../managed-server/install/orcad-remote-runtime-control'
-import { execCommand, isUnconfirmedSshCommandTermination } from './remote-exec-command'
-import {
-  isOrcadFenceLost,
-  OrcadFenceLostError
-} from '../managed-server/activation/orcad-activation-fence-scope'
+import type { OrcadRemoteExecTarget } from '../install/orcad-remote-runtime-control'
+import { execCommand, isUnconfirmedSshCommandTermination } from '../../ssh/remote-exec-command'
+import { isOrcadFenceLost, OrcadFenceLostError } from '../activation/orcad-activation-fence-scope'
 
 // Longer than the host's own deadline, so the host kills the work before the client gives up.
 export const ORCAD_STATE_MUTATION_CLIENT_TIMEOUT_MS =
diff --git a/src/main/ssh/orcad-state-mutation-fence-heartbeat.test.ts b/src/main/managed-server/host-state/orcad-state-mutation-fence-heartbeat.test.ts
similarity index 91%
rename from src/main/ssh/orcad-state-mutation-fence-heartbeat.test.ts
rename to src/main/managed-server/host-state/orcad-state-mutation-fence-heartbeat.test.ts
index 0f5afc078ec..2a0a58acc60 100644
--- a/src/main/ssh/orcad-state-mutation-fence-heartbeat.test.ts
+++ b/src/main/managed-server/host-state/orcad-state-mutation-fence-heartbeat.test.ts
@@ -15,12 +15,12 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import { runProcess, spawnProcess } from '@orca/process-host'
-import { RELAY_INSTALL_LOCK_NAME } from '../../shared/relay-install-lock-name'
-import { ORCAD_ACTIVATION_TRANSACTION_DIRNAME } from '../managed-server/activation/orcad-activation-transaction'
+import { RELAY_INSTALL_LOCK_NAME } from '../../../shared/relay-install-lock-name'
+import { ORCAD_ACTIVATION_TRANSACTION_DIRNAME } from '../activation/orcad-activation-transaction'
 import { serializedStateMutationCommand } from './orcad-state-snapshot'
-import { ORCAD_FENCE_OWNER_FILENAME } from '../managed-server/activation/orcad-activation-fence-scope'
-import { tryStealInstallLockCommand } from '../managed-server/install/remote-install-lock-commands'
-import { getRemoteHostPlatform } from './ssh-remote-platform'
+import { ORCAD_FENCE_OWNER_FILENAME } from '../activation/orcad-activation-fence-scope'
+import { tryStealInstallLockCommand } from '../install/remote-install-lock-commands'
+import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
 const posix = getRemoteHostPlatform('linux-x64')
 const STALE_SECONDS = 3
diff --git a/src/main/ssh/orcad-state-mutation-owner-record.ts b/src/main/managed-server/host-state/orcad-state-mutation-owner-record.ts
similarity index 100%
rename from src/main/ssh/orcad-state-mutation-owner-record.ts
rename to src/main/managed-server/host-state/orcad-state-mutation-owner-record.ts
diff --git a/src/main/ssh/orcad-state-mutation-timeout.test.ts b/src/main/managed-server/host-state/orcad-state-mutation-timeout.test.ts
similarity index 79%
rename from src/main/ssh/orcad-state-mutation-timeout.test.ts
rename to src/main/managed-server/host-state/orcad-state-mutation-timeout.test.ts
index 89dbabc2567..8e883245041 100644
--- a/src/main/ssh/orcad-state-mutation-timeout.test.ts
+++ b/src/main/managed-server/host-state/orcad-state-mutation-timeout.test.ts
@@ -5,33 +5,33 @@
  * command shape) runs beside it, as the two restores did on a real host.
  */
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type * as ExecCommandModule from './remote-exec-command'
-import type * as RecordFile from '../managed-server/install/orcad-remote-record-file'
-import type * as InstallLock from '../managed-server/install/remote-install-lock'
-import type * as VersionedInstall from '../managed-server/install/remote-versioned-install'
+import type * as ExecCommandModule from '../../ssh/remote-exec-command'
+import type * as RecordFile from '../install/orcad-remote-record-file'
+import type * as InstallLock from '../install/remote-install-lock'
+import type * as VersionedInstall from '../install/remote-versioned-install'
 
-vi.mock('./remote-exec-command', async (importOriginal) => ({
+vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
   ...(await importOriginal<typeof ExecCommandModule>()),
   execCommand: vi.fn()
 }))
-vi.mock('./ssh-connection-utils', () => ({ shellEscape: (s: string) => `'${s}'` }))
-vi.mock('../managed-server/install/remote-install-lock', async (importOriginal) => ({
+vi.mock('../../ssh/ssh-connection-utils', () => ({ shellEscape: (s: string) => `'${s}'` }))
+vi.mock('../install/remote-install-lock', async (importOriginal) => ({
   ...(await importOriginal<typeof InstallLock>()),
   acquireInstallLock: vi.fn()
 }))
-vi.mock('../managed-server/install/orcad-remote-record-file', async (importOriginal) => ({
+vi.mock('../install/orcad-remote-record-file', async (importOriginal) => ({
   ...(await importOriginal<typeof RecordFile>()),
   writeAtomicOrcadRemoteRecord: vi.fn()
 }))
-vi.mock('../managed-server/install/remote-versioned-install', async (importOriginal) => ({
+vi.mock('../install/remote-versioned-install', async (importOriginal) => ({
   ...(await importOriginal<typeof VersionedInstall>()),
   readLocalFullVersion: () => '0.2.0+bb01'
 }))
-vi.mock('../managed-server/install/orcad-remote-install', () => ({ installOrcadBundle: vi.fn() }))
-vi.mock('../managed-server/install/orcad-remote-preflight', () => ({
+vi.mock('../install/orcad-remote-install', () => ({ installOrcadBundle: vi.fn() }))
+vi.mock('../install/orcad-remote-preflight', () => ({
   preflightInstalledOrcad: vi.fn()
 }))
-vi.mock('./orcad-local-build-hash', () => ({
+vi.mock('../../ssh/orcad-local-build-hash', () => ({
   computeLocalOrcadBuildHash: () => 'abc123def4567890'
 }))
 
@@ -39,21 +39,21 @@ import {
   execCommand,
   SSH_EXEC_TIMEOUT_CODE,
   isUnconfirmedSshCommandTermination
-} from './remote-exec-command'
-import { acquireInstallLock } from '../managed-server/install/remote-install-lock'
-import { writeAtomicOrcadRemoteRecord } from '../managed-server/install/orcad-remote-record-file'
-import { deployOrcad } from './orcad-remote-deploy'
-import { rollbackOrcad } from '../managed-server/install/orcad-remote-rollback'
-import { recoverInterruptedOrcadActivation } from '../managed-server/activation/orcad-activation-recovery'
-import { getRemoteHostPlatform } from './ssh-remote-platform'
-import type { OrcadHostTransport } from './orcad-host-transport'
+} from '../../ssh/remote-exec-command'
+import { acquireInstallLock } from '../install/remote-install-lock'
+import { writeAtomicOrcadRemoteRecord } from '../install/orcad-remote-record-file'
+import { deployOrcad } from '../../ssh/orcad-remote-deploy'
+import { rollbackOrcad } from '../install/orcad-remote-rollback'
+import { recoverInterruptedOrcadActivation } from '../activation/orcad-activation-recovery'
+import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
+import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
 import {
   BUILD_HASH,
   FakeOrcadHost,
   NEW,
   OLD
-} from '../managed-server/activation/orcad-activation-host-test-harness'
-import { isSnapshotCaptureCommand } from './orcad-snapshot-capture-command'
+} from '../activation/orcad-activation-host-test-harness'
+import { isSnapshotCaptureCommand } from '../../ssh/orcad-snapshot-capture-command'
 
 let host = new FakeOrcadHost()
 type StateMutation = 'capture' | 'restore'
@@ -135,7 +135,7 @@ beforeEach(() => {
   vi.mocked(acquireInstallLock).mockImplementation(async (_conn, dir, _host, options) => {
     if (!host.acquireFence(options)) {
       const { RemoteInstallLockBusyError } = await vi.importActual<typeof InstallLock>(
-        '../managed-server/install/remote-install-lock'
+        '../install/remote-install-lock'
       )
       throw new RemoteInstallLockBusyError(dir, 0)
     }
diff --git a/src/main/ssh/orcad-state-snapshot-members.ts b/src/main/managed-server/host-state/orcad-state-snapshot-members.ts
similarity index 100%
rename from src/main/ssh/orcad-state-snapshot-members.ts
rename to src/main/managed-server/host-state/orcad-state-snapshot-members.ts
diff --git a/src/main/ssh/orcad-state-snapshot-shell.test.ts b/src/main/managed-server/host-state/orcad-state-snapshot-shell.test.ts
similarity index 98%
rename from src/main/ssh/orcad-state-snapshot-shell.test.ts
rename to src/main/managed-server/host-state/orcad-state-snapshot-shell.test.ts
index 84a42dbb265..d7f568aca2c 100644
--- a/src/main/ssh/orcad-state-snapshot-shell.test.ts
+++ b/src/main/managed-server/host-state/orcad-state-snapshot-shell.test.ts
@@ -20,8 +20,8 @@ import {
   serializedStateMutationCommand
 } from './orcad-state-snapshot'
 import { posixProcessGroupCommand } from './orcad-state-mutation-owner-record'
-import { getRemoteHostPlatform } from './ssh-remote-platform'
-import { shellEscape } from './ssh-connection-utils'
+import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
+import { shellEscape } from '../../ssh/ssh-connection-utils'
 
 const posix = getRemoteHostPlatform('linux-x64')
 
diff --git a/src/main/ssh/orcad-state-snapshot.test.ts b/src/main/managed-server/host-state/orcad-state-snapshot.test.ts
similarity index 98%
rename from src/main/ssh/orcad-state-snapshot.test.ts
rename to src/main/managed-server/host-state/orcad-state-snapshot.test.ts
index 7cfb937ba2a..5d0649789a7 100644
--- a/src/main/ssh/orcad-state-snapshot.test.ts
+++ b/src/main/managed-server/host-state/orcad-state-snapshot.test.ts
@@ -14,7 +14,7 @@ import {
   restoreOrcadStateSnapshotCommand,
   ORCAD_STATE_MUTATION_DEADLINE_SECONDS
 } from './orcad-state-snapshot'
-import { getRemoteHostPlatform } from './ssh-remote-platform'
+import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 import { ORCAD_SNAPSHOT_EXCLUDED, ORCAD_SNAPSHOT_MEMBERS } from './orcad-state-snapshot-members'
 
 const posix = getRemoteHostPlatform('linux-x64')
diff --git a/src/main/ssh/orcad-state-snapshot.ts b/src/main/managed-server/host-state/orcad-state-snapshot.ts
similarity index 98%
rename from src/main/ssh/orcad-state-snapshot.ts
rename to src/main/managed-server/host-state/orcad-state-snapshot.ts
index a46c12e9562..92ee7a5b0ad 100644
--- a/src/main/ssh/orcad-state-snapshot.ts
+++ b/src/main/managed-server/host-state/orcad-state-snapshot.ts
@@ -22,9 +22,13 @@ import {
   posixOrcadFenceGuard,
   posixOrcadFenceOwnedTest,
   type OrcadFence
-} from '../managed-server/activation/orcad-activation-fence-scope'
-import { shellEscape } from './ssh-connection-utils'
-import { isWindowsRemoteHost, joinRemotePath, type RemoteHostPlatform } from './ssh-remote-platform'
+} from '../activation/orcad-activation-fence-scope'
+import { shellEscape } from '../../ssh/ssh-connection-utils'
+import {
+  isWindowsRemoteHost,
+  joinRemotePath,
+  type RemoteHostPlatform
+} from '../../ssh/ssh-remote-platform'
 import type { OrcadWindowsHostStateOp } from './orcad-windows-host-state-ops'
 import {
   ORCAD_SNAPSHOT_MEMBERS,
@@ -34,7 +38,7 @@ import {
   ORCAD_STATE_MUTATION_LOCK_DIRNAME,
   ORCAD_STATE_RESTORE_STAGE_DIRNAME
 } from './orcad-state-snapshot-members'
-import { orcadWindowsHostOpCommand } from '../managed-server/install/orcad-remote-windows-node'
+import { orcadWindowsHostOpCommand } from '../install/orcad-remote-windows-node'
 import {
   posixStateMutationGroupRecord,
   posixStateMutationPidRecord
diff --git a/src/main/ssh/orcad-windows-host-fence-ops.test.ts b/src/main/managed-server/host-state/orcad-windows-host-fence-ops.test.ts
similarity index 99%
rename from src/main/ssh/orcad-windows-host-fence-ops.test.ts
rename to src/main/managed-server/host-state/orcad-windows-host-fence-ops.test.ts
index 64324f0933e..19ca2e4a89c 100644
--- a/src/main/ssh/orcad-windows-host-fence-ops.test.ts
+++ b/src/main/managed-server/host-state/orcad-windows-host-fence-ops.test.ts
@@ -15,7 +15,7 @@ import { runProcess, spawnProcess } from '@orca/process-host'
 import {
   ORCAD_FENCE_LOST_EXIT,
   ORCAD_FENCE_LOST_MARKER
-} from '../managed-server/activation/orcad-activation-fence-scope'
+} from '../activation/orcad-activation-fence-scope'
 import { ORCAD_WINDOWS_HOST_SCRIPT } from './orcad-windows-host-script'
 
 const dirs: string[] = []
diff --git a/src/main/ssh/orcad-windows-host-fence-ops.ts b/src/main/managed-server/host-state/orcad-windows-host-fence-ops.ts
similarity index 98%
rename from src/main/ssh/orcad-windows-host-fence-ops.ts
rename to src/main/managed-server/host-state/orcad-windows-host-fence-ops.ts
index f9be8889271..7b371cbddeb 100644
--- a/src/main/ssh/orcad-windows-host-fence-ops.ts
+++ b/src/main/managed-server/host-state/orcad-windows-host-fence-ops.ts
@@ -7,7 +7,7 @@ import {
   ORCAD_FENCE_LOST_EXIT,
   ORCAD_FENCE_LOST_MARKER,
   ORCAD_FENCE_OWNER_FILENAME
-} from '../managed-server/activation/orcad-activation-fence-scope'
+} from '../activation/orcad-activation-fence-scope'
 import { ORCAD_EXITED_OWN_LOCK_QUIET_SECONDS } from './orcad-state-snapshot-members'
 
 export const ORCAD_WINDOWS_FENCE_ARG = '--fence'
diff --git a/src/main/ssh/orcad-windows-host-lane.test.ts b/src/main/managed-server/host-state/orcad-windows-host-lane.test.ts
similarity index 84%
rename from src/main/ssh/orcad-windows-host-lane.test.ts
rename to src/main/managed-server/host-state/orcad-windows-host-lane.test.ts
index 05997e14d39..60fcbea13a9 100644
--- a/src/main/ssh/orcad-windows-host-lane.test.ts
+++ b/src/main/managed-server/host-state/orcad-windows-host-lane.test.ts
@@ -12,30 +12,27 @@ import { afterAll, beforeAll, describe, expect, it, vi, type MockInstance } from
 
 vi.mock('electron', () => ({ app: { getAppPath: () => process.cwd() } }))
 
-import { SshConnection } from './ssh-connection'
+import { SshConnection } from '../../ssh/ssh-connection'
 import {
   connectHostileHost,
   installHostileHostAppEnvironment
-} from './hostile-host-test-support/ssh-hostile-host-test-harness'
-import { resolveOrcadRemoteContext } from '../managed-server/install/orcad-remote-context'
-import { proveWindowsStdioBridge } from './orcad-windows-stdio-bridge-test-cell'
-import { deployOrcad } from './orcad-remote-deploy'
-import {
-  orcadLivenessProbeCommand,
-  parseOrcadLiveness
-} from '../managed-server/install/orcad-remote-launch'
-import { orcadSlotDir, type OrcadSlotOptions } from './orcad-recovery-slot'
-import { decommissionRemoteOrcad } from '../managed-server/install/orcad-remote-decommission'
-import { readOrcadActivationRecord } from '../managed-server/activation/orcad-activation-record-store'
-import { gcOldOrcadVersions } from '../managed-server/install/orcad-remote-gc'
-import { execOrcadRemote } from '../managed-server/install/orcad-remote-runtime-control'
-import { orcadWindowsNodeCommandLine } from '../managed-server/install/orcad-remote-windows-node'
-import { joinRemotePath } from './ssh-remote-platform'
+} from '../../ssh/hostile-host-test-support/ssh-hostile-host-test-harness'
+import { resolveOrcadRemoteContext } from '../install/orcad-remote-context'
+import { proveWindowsStdioBridge } from '../../ssh/orcad-windows-stdio-bridge-test-cell'
+import { deployOrcad } from '../../ssh/orcad-remote-deploy'
+import { orcadLivenessProbeCommand, parseOrcadLiveness } from '../install/orcad-remote-launch'
+import { orcadSlotDir, type OrcadSlotOptions } from '../../ssh/orcad-recovery-slot'
+import { decommissionRemoteOrcad } from '../install/orcad-remote-decommission'
+import { readOrcadActivationRecord } from '../activation/orcad-activation-record-store'
+import { gcOldOrcadVersions } from '../install/orcad-remote-gc'
+import { execOrcadRemote } from '../install/orcad-remote-runtime-control'
+import { orcadWindowsNodeCommandLine } from '../install/orcad-remote-windows-node'
+import { joinRemotePath } from '../../ssh/ssh-remote-platform'
 import {
   isWindowsOrcadCellId,
   readWindowsHostCellDescriptor,
   windowsHostSshTarget
-} from './ssh-windows-host-cells'
+} from '../../ssh/ssh-windows-host-cells'
 
 const RUN = process.env.ORCA_RUN_SSH_WINDOWS_HOST === '1'
 const CELL_TIMEOUT_MS = 20 * 60_000
diff --git a/src/main/ssh/orcad-windows-host-preparation.ts b/src/main/managed-server/host-state/orcad-windows-host-preparation.ts
similarity index 71%
rename from src/main/ssh/orcad-windows-host-preparation.ts
rename to src/main/managed-server/host-state/orcad-windows-host-preparation.ts
index 39d0562ff88..6d572922841 100644
--- a/src/main/ssh/orcad-windows-host-preparation.ts
+++ b/src/main/managed-server/host-state/orcad-windows-host-preparation.ts
@@ -6,16 +6,16 @@
  * script is content-addressed, so rewriting it changes nothing a running orcad depends on.
  */
 import { join } from 'node:path'
-import { getAppEnvironment } from '../../shared/app-environment'
-import type { NodeRuntimeTarget } from '../../shared/node-runtime-pin'
-import { ensureRemoteOrcadNodeRuntime } from '../managed-server/install/orcad-remote-node-runtime'
+import { getAppEnvironment } from '../../../shared/app-environment'
+import type { NodeRuntimeTarget } from '../../../shared/node-runtime-pin'
+import { ensureRemoteOrcadNodeRuntime } from '../install/orcad-remote-node-runtime'
 import {
   installOrcadWindowsHostScript,
   orcadRemoteBaseDir
-} from '../managed-server/install/orcad-remote-windows-node'
-import { materializeNodeRuntimeArchive } from '../node-runtime/pinned-runtime-materializer'
-import type { OrcadHostTransport } from './orcad-host-transport'
-import { joinRemotePath, type RemoteHostPlatform } from './ssh-remote-platform'
+} from '../install/orcad-remote-windows-node'
+import { materializeNodeRuntimeArchive } from '../../node-runtime/pinned-runtime-materializer'
+import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
+import { joinRemotePath, type RemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
 export async function prepareWindowsOrcadHost(options: {
   conn: OrcadHostTransport
diff --git a/src/main/ssh/orcad-windows-host-script.ts b/src/main/managed-server/host-state/orcad-windows-host-script.ts
similarity index 98%
rename from src/main/ssh/orcad-windows-host-script.ts
rename to src/main/managed-server/host-state/orcad-windows-host-script.ts
index 4a00582bc9a..339c2a06827 100644
--- a/src/main/ssh/orcad-windows-host-script.ts
+++ b/src/main/managed-server/host-state/orcad-windows-host-script.ts
@@ -20,12 +20,12 @@ import {
   ORCAD_NODE_RUNTIME_WINDOWS_EXECUTABLE,
   ORCAD_RUNTIMES_DIRNAME,
   ORCAD_WINDOWS_PROCESS_TREE_FILENAME
-} from '../../shared/orcad-artifacts'
+} from '../../../shared/orcad-artifacts'
 import {
   ORCAD_STOP_REQUEST_FILENAME,
   ORCAD_STOP_REQUESTS_CAPABILITY
-} from '../../shared/orcad-stop-request'
-import { ORCAD_STDIO_BRIDGE_FUNCTION } from '../managed-server/lifecycle/orcad-stdio-bridge-script'
+} from '../../../shared/orcad-stop-request'
+import { ORCAD_STDIO_BRIDGE_FUNCTION } from '../lifecycle/orcad-stdio-bridge-script'
 import {
   ORCAD_WINDOWS_FENCE_PRELUDE,
   ORCAD_WINDOWS_HOST_FENCE_OPS
@@ -38,7 +38,7 @@ import {
   ORCAD_READINESS_FILENAME,
   ORCAD_READINESS_MAX_BYTES,
   ORCAD_WINDOWS_PROCESS_FILENAME
-} from '../managed-server/install/orcad-remote-host-support'
+} from '../install/orcad-remote-host-support'
 
 export const ORCAD_RECORD_ABSENT_MARKER = '__ORCAD_RECORD_ABSENT__'
 export const ORCAD_RECORD_PRESENT_MARKER = '__ORCAD_RECORD_PRESENT__'
diff --git a/src/main/ssh/orcad-windows-host-state-ops.test.ts b/src/main/managed-server/host-state/orcad-windows-host-state-ops.test.ts
similarity index 100%
rename from src/main/ssh/orcad-windows-host-state-ops.test.ts
rename to src/main/managed-server/host-state/orcad-windows-host-state-ops.test.ts
diff --git a/src/main/ssh/orcad-windows-host-state-ops.ts b/src/main/managed-server/host-state/orcad-windows-host-state-ops.ts
similarity index 96%
rename from src/main/ssh/orcad-windows-host-state-ops.ts
rename to src/main/managed-server/host-state/orcad-windows-host-state-ops.ts
index 38f735b1cf2..3bf75749819 100644
--- a/src/main/ssh/orcad-windows-host-state-ops.ts
+++ b/src/main/managed-server/host-state/orcad-windows-host-state-ops.ts
@@ -8,14 +8,14 @@
  * built under a partial name and renamed into place, so a half-written snapshot is never
  * `PRESENT`. Symlinks and junctions anywhere in captured state fail closed, as on POSIX.
  */
-import { PRIMARY_RUNTIME_METADATA_FILE } from '../../shared/runtime-bootstrap'
-import { ORCAD_LOCK_FILE_NAME } from '../orcad/orcad-instance-lock'
-import { ORCAD_WINDOWS_PROCESS_TREE_FILENAME } from '../../shared/orcad-artifacts'
-import { ORCAD_INSTALL_MODEL } from '../managed-server/install/remote-install-model'
+import { PRIMARY_RUNTIME_METADATA_FILE } from '../../../shared/runtime-bootstrap'
+import { ORCAD_LOCK_FILE_NAME } from '../../orcad/orcad-instance-lock'
+import { ORCAD_WINDOWS_PROCESS_TREE_FILENAME } from '../../../shared/orcad-artifacts'
+import { ORCAD_INSTALL_MODEL } from '../install/remote-install-model'
 import {
   ORCAD_FENCE_LOST_EXIT,
   ORCAD_FENCE_LOST_MARKER
-} from '../managed-server/activation/orcad-activation-fence-scope'
+} from '../activation/orcad-activation-fence-scope'
 import {
   ORCAD_SNAPSHOT_MEMBERS,
   ORCAD_STATE_MUTATION_BUSY,
diff --git a/src/main/managed-server/install/orcad-remote-build-hash.ts b/src/main/managed-server/install/orcad-remote-build-hash.ts
index 12542718b55..312ee003fcb 100644
--- a/src/main/managed-server/install/orcad-remote-build-hash.ts
+++ b/src/main/managed-server/install/orcad-remote-build-hash.ts
@@ -3,7 +3,7 @@ import { ORCAD_LAUNCHER_FILENAME } from '../../../shared/orcad-artifacts'
 import { shellEscape } from '../../ssh/ssh-connection-utils'
 import { execOrcadRemote, type OrcadRemoteExecTarget } from './orcad-remote-runtime-control'
 import { orcadWindowsSlotOpCommand } from './orcad-remote-windows-node'
-import { ORCAD_BUILD_HASH_MARKER as BUILD_HASH_MARKER } from '../../ssh/orcad-windows-host-script'
+import { ORCAD_BUILD_HASH_MARKER as BUILD_HASH_MARKER } from '../host-state/orcad-windows-host-script'
 import {
   isWindowsRemoteHost,
   joinRemotePath,
diff --git a/src/main/managed-server/install/orcad-remote-context.ts b/src/main/managed-server/install/orcad-remote-context.ts
index fee4e071447..07401dba139 100644
--- a/src/main/managed-server/install/orcad-remote-context.ts
+++ b/src/main/managed-server/install/orcad-remote-context.ts
@@ -4,7 +4,7 @@ import type { SshTarget } from '../../../shared/ssh-types'
 import type { OrcadActivationRecord } from '../activation/orcad-activation-record'
 import { readOrcadActivationRecord } from '../activation/orcad-activation-record-store'
 import { resolveOrcadRuntimeTarget } from '../lifecycle/orcad-runtime-target'
-import { prepareWindowsOrcadHost } from '../../ssh/orcad-windows-host-preparation'
+import { prepareWindowsOrcadHost } from '../host-state/orcad-windows-host-preparation'
 import {
   isWslOrcadHostTarget,
   type OrcadHostTarget,
@@ -18,8 +18,8 @@ import {
   orcadMachineOwnershipUnresolvedMessage,
   parseOrcadMachineClaim,
   parseOrcadMachineHomeProbe
-} from '../../ssh/orcad-machine-home'
-import { orcadMachineClaimCommand } from '../../ssh/orcad-machine-claim-command'
+} from '../host-state/orcad-machine-home'
+import { orcadMachineClaimCommand } from '../host-state/orcad-machine-claim-command'
 import { execOrcadRemote, type OrcadRemoteExecTarget } from './orcad-remote-runtime-control'
 import { readRemoteHomeCommand } from '../../ssh/ssh-remote-commands'
 import { shellEscape } from '../../ssh/ssh-connection-utils'
diff --git a/src/main/managed-server/install/orcad-remote-gc.ts b/src/main/managed-server/install/orcad-remote-gc.ts
index cae0adea6dd..e9a66f8f404 100644
--- a/src/main/managed-server/install/orcad-remote-gc.ts
+++ b/src/main/managed-server/install/orcad-remote-gc.ts
@@ -35,7 +35,7 @@ import {
 } from '../../ssh/ssh-remote-platform'
 import { RELAY_REMOTE_DIR } from '../../ssh/remote-frame-protocol'
 import { orcadWindowsHomeOpCommand } from './orcad-remote-windows-node'
-import { ORCAD_WINDOWS_LIVENESS_MANY_MARKER } from '../../ssh/orcad-windows-host-script'
+import { ORCAD_WINDOWS_LIVENESS_MANY_MARKER } from '../host-state/orcad-windows-host-script'
 
 export type OrcadGcOptions = {
   conn: OrcadHostTransport
diff --git a/src/main/managed-server/install/orcad-remote-launch-windows.ts b/src/main/managed-server/install/orcad-remote-launch-windows.ts
index ae347dece83..da7d65139e8 100644
--- a/src/main/managed-server/install/orcad-remote-launch-windows.ts
+++ b/src/main/managed-server/install/orcad-remote-launch-windows.ts
@@ -30,7 +30,7 @@ import {
 import {
   ORCAD_WINDOWS_ENTRY_MARKER,
   ORCAD_WINDOWS_RUNTIME_MARKER
-} from '../../ssh/orcad-windows-host-script'
+} from '../host-state/orcad-windows-host-script'
 import {
   ORCAD_LOG_FILENAME,
   ORCAD_READINESS_FILENAME,
diff --git a/src/main/managed-server/install/orcad-remote-log-tail.test.ts b/src/main/managed-server/install/orcad-remote-log-tail.test.ts
index f1bfe39d75a..04aaa640691 100644
--- a/src/main/managed-server/install/orcad-remote-log-tail.test.ts
+++ b/src/main/managed-server/install/orcad-remote-log-tail.test.ts
@@ -11,7 +11,7 @@ import {
   parseOrcadLogTail,
   withOrcadLogTail
 } from './orcad-remote-log-tail'
-import { ORCAD_WINDOWS_HOST_SCRIPT } from '../../ssh/orcad-windows-host-script'
+import { ORCAD_WINDOWS_HOST_SCRIPT } from '../host-state/orcad-windows-host-script'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
 const execCommand = vi.hoisted(() => vi.fn())
diff --git a/src/main/managed-server/install/orcad-remote-log-tail.ts b/src/main/managed-server/install/orcad-remote-log-tail.ts
index d1fa7407df5..b06882659ad 100644
--- a/src/main/managed-server/install/orcad-remote-log-tail.ts
+++ b/src/main/managed-server/install/orcad-remote-log-tail.ts
@@ -16,7 +16,7 @@ import {
   orcadWindowsSlotOpCommand,
   readOrcadWindowsEncodedAnswer
 } from './orcad-remote-windows-node'
-import { ORCAD_WINDOWS_LOG_TAIL_MARKER } from '../../ssh/orcad-windows-host-script'
+import { ORCAD_WINDOWS_LOG_TAIL_MARKER } from '../host-state/orcad-windows-host-script'
 import type { OrcadRemoteExecTarget } from './orcad-remote-runtime-control'
 
 export const ORCAD_LOG_TAIL_LINES = 40
diff --git a/src/main/managed-server/install/orcad-remote-preflight.ts b/src/main/managed-server/install/orcad-remote-preflight.ts
index 274d88fa01f..9be9ffa4d48 100644
--- a/src/main/managed-server/install/orcad-remote-preflight.ts
+++ b/src/main/managed-server/install/orcad-remote-preflight.ts
@@ -13,7 +13,7 @@ import {
   readOrcadWindowsEncodedAnswer
 } from './orcad-remote-windows-node'
 import { readWindowsOrcadSlotEntry } from './orcad-remote-launch-windows'
-import { ORCAD_WINDOWS_RUNTIME_MARKER } from '../../ssh/orcad-windows-host-script'
+import { ORCAD_WINDOWS_RUNTIME_MARKER } from '../host-state/orcad-windows-host-script'
 import { orcadNodeSlotRuntimeCommand, selectOrcadSlotEntryCommand } from './orcad-remote-runtime'
 import { execCommand } from '../../ssh/remote-exec-command'
 import { shellEscape } from '../../ssh/ssh-connection-utils'
diff --git a/src/main/managed-server/install/orcad-remote-primitives.test.ts b/src/main/managed-server/install/orcad-remote-primitives.test.ts
index 57d17c732cf..4ff84ffd914 100644
--- a/src/main/managed-server/install/orcad-remote-primitives.test.ts
+++ b/src/main/managed-server/install/orcad-remote-primitives.test.ts
@@ -9,11 +9,13 @@ vi.mock('../../ssh/remote-exec-command', async (importOriginal) => ({
 }))
 
 vi.mock('../../ssh/ssh-remote-platform-detection', () => ({ detectRemoteHostPlatform: vi.fn() }))
-vi.mock('../../ssh/orcad-windows-host-preparation', () => ({ prepareWindowsOrcadHost: vi.fn() }))
+vi.mock('../host-state/orcad-windows-host-preparation', () => ({
+  prepareWindowsOrcadHost: vi.fn()
+}))
 
 import { execCommand } from '../../ssh/remote-exec-command'
 import { detectRemoteHostPlatform } from '../../ssh/ssh-remote-platform-detection'
-import { prepareWindowsOrcadHost } from '../../ssh/orcad-windows-host-preparation'
+import { prepareWindowsOrcadHost } from '../host-state/orcad-windows-host-preparation'
 import { resolveOrcadRemoteContext } from './orcad-remote-context'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 import type { OrcadHostTransport } from '../../ssh/orcad-host-transport'
diff --git a/src/main/managed-server/install/orcad-remote-readiness-wait.ts b/src/main/managed-server/install/orcad-remote-readiness-wait.ts
index 3e1a37b1a66..2c5a2dfe8c0 100644
--- a/src/main/managed-server/install/orcad-remote-readiness-wait.ts
+++ b/src/main/managed-server/install/orcad-remote-readiness-wait.ts
@@ -22,7 +22,7 @@ import {
   orcadWindowsSlotOpCommand,
   readOrcadWindowsEncodedAnswer
 } from './orcad-remote-windows-node'
-import { ORCAD_WINDOWS_READINESS_MARKER } from '../../ssh/orcad-windows-host-script'
+import { ORCAD_WINDOWS_READINESS_MARKER } from '../host-state/orcad-windows-host-script'
 
 /** Under the 30 s exec timeout, so one wait never reads as an unanswered host. */
 export const ORCAD_READINESS_WAIT_MAX_SECONDS = 20
diff --git a/src/main/managed-server/install/orcad-remote-record-file.ts b/src/main/managed-server/install/orcad-remote-record-file.ts
index 5bb28dc7e63..fca3bdd6626 100644
--- a/src/main/managed-server/install/orcad-remote-record-file.ts
+++ b/src/main/managed-server/install/orcad-remote-record-file.ts
@@ -18,7 +18,7 @@ import {
 import {
   ORCAD_RECORD_ABSENT_MARKER as ABSENT_MARKER,
   ORCAD_RECORD_PRESENT_MARKER as PRESENT_MARKER
-} from '../../ssh/orcad-windows-host-script'
+} from '../host-state/orcad-windows-host-script'
 
 /** `present` carries raw bytes; schema checks belong to the caller that owns the format. */
 export type OrcadRemoteRecordRead = { state: 'absent' } | { state: 'present'; raw: string }
diff --git a/src/main/managed-server/install/orcad-remote-runtime-control.ts b/src/main/managed-server/install/orcad-remote-runtime-control.ts
index 2f37a957816..14a0ad1250d 100644
--- a/src/main/managed-server/install/orcad-remote-runtime-control.ts
+++ b/src/main/managed-server/install/orcad-remote-runtime-control.ts
@@ -28,7 +28,7 @@ import {
   posixOrcadFenceGuard
 } from '../activation/orcad-activation-fence-scope'
 import { orcadWindowsHomeOpCommand } from './orcad-remote-windows-node'
-import { ORCAD_WINDOWS_FENCE_ARG } from '../../ssh/orcad-windows-host-fence-ops'
+import { ORCAD_WINDOWS_FENCE_ARG } from '../host-state/orcad-windows-host-fence-ops'
 import { isWindowsRemoteHost, type RemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
 // Only between host-side waits, so a host that answers early cannot turn this into a tight loop.
diff --git a/src/main/managed-server/install/orcad-remote-shell-commands.integration.test.ts b/src/main/managed-server/install/orcad-remote-shell-commands.integration.test.ts
index 530442f926b..38fc026c1e6 100644
--- a/src/main/managed-server/install/orcad-remote-shell-commands.integration.test.ts
+++ b/src/main/managed-server/install/orcad-remote-shell-commands.integration.test.ts
@@ -52,7 +52,7 @@ import {
   parseOrcadSnapshotRestore,
   probeOrcadStateSnapshotCommand,
   restoreOrcadStateSnapshotCommand
-} from '../../ssh/orcad-state-snapshot'
+} from '../host-state/orcad-state-snapshot'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 import { ORCAD_STOP_REQUEST_FILENAME } from '../../../shared/orcad-stop-request'
 
diff --git a/src/main/managed-server/install/orcad-remote-windows-commands.test.ts b/src/main/managed-server/install/orcad-remote-windows-commands.test.ts
index cb13e1e8444..6b2508303ce 100644
--- a/src/main/managed-server/install/orcad-remote-windows-commands.test.ts
+++ b/src/main/managed-server/install/orcad-remote-windows-commands.test.ts
@@ -36,7 +36,7 @@ import {
 import {
   ORCAD_WINDOWS_HOST_SCRIPT,
   ORCAD_WINDOWS_HOST_SCRIPT_FILENAME
-} from '../../ssh/orcad-windows-host-script'
+} from '../host-state/orcad-windows-host-script'
 import type { OrcadSlotOptions } from '../../ssh/orcad-recovery-slot'
 import { NODE_RUNTIME_ASSETS } from '../../../shared/node-runtime-pin'
 
diff --git a/src/main/managed-server/install/orcad-remote-windows-node.ts b/src/main/managed-server/install/orcad-remote-windows-node.ts
index c98fde161b8..5451b82be6f 100644
--- a/src/main/managed-server/install/orcad-remote-windows-node.ts
+++ b/src/main/managed-server/install/orcad-remote-windows-node.ts
@@ -10,7 +10,7 @@
  * rather than encoded (docs/reference/windows-edr-posture.md).
  */
 import { currentOrcadFence } from '../activation/orcad-activation-fence-scope'
-import { ORCAD_WINDOWS_FENCE_ARG } from '../../ssh/orcad-windows-host-fence-ops'
+import { ORCAD_WINDOWS_FENCE_ARG } from '../host-state/orcad-windows-host-fence-ops'
 import {
   ORCAD_NODE_RUNTIME_DIR_PREFIX,
   ORCAD_NODE_RUNTIME_WINDOWS_EXECUTABLE,
@@ -33,7 +33,7 @@ import {
   ORCAD_WINDOWS_HOST_SCRIPT_FILENAME,
   ORCAD_WINDOWS_HOST_SCRIPT_PRESENT,
   type OrcadWindowsHostOp
-} from '../../ssh/orcad-windows-host-script'
+} from '../host-state/orcad-windows-host-script'
 
 const BARE_EXECUTABLE = /^[A-Za-z]:\\[A-Za-z0-9._+~\\-]*$/u
 // Leading digits are quoted: PowerShell would read `1e5` as a number and pass `100000`.
diff --git a/src/main/managed-server/install/orcad-remote-windows-scripts.test.ts b/src/main/managed-server/install/orcad-remote-windows-scripts.test.ts
index 62f61518530..994ce098916 100644
--- a/src/main/managed-server/install/orcad-remote-windows-scripts.test.ts
+++ b/src/main/managed-server/install/orcad-remote-windows-scripts.test.ts
@@ -27,7 +27,7 @@ import {
   ORCAD_WINDOWS_RUNTIME_MARKER,
   ORCAD_WINDOWS_ENTRY_MARKER,
   type OrcadWindowsHostOp
-} from '../../ssh/orcad-windows-host-script'
+} from '../host-state/orcad-windows-host-script'
 import { getRemoteHostPlatform } from '../../ssh/ssh-remote-platform'
 
 const FAKE_ADDON_PRELOAD = [
diff --git a/src/main/managed-server/install/remote-install-lock-exited-owner.ts b/src/main/managed-server/install/remote-install-lock-exited-owner.ts
index 8170cfc9ec5..5c372eba674 100644
--- a/src/main/managed-server/install/remote-install-lock-exited-owner.ts
+++ b/src/main/managed-server/install/remote-install-lock-exited-owner.ts
@@ -8,7 +8,7 @@ import { quotePowerShellLiteral as powerShellLiteral } from '../../../shared/pow
 import {
   posixStateMutationGroupRecord,
   posixStateMutationPidRecord
-} from '../../ssh/orcad-state-mutation-owner-record'
+} from '../host-state/orcad-state-mutation-owner-record'
 
 /**
  * A lock whose owner file still names `token` once it has been quiet past `quietSeconds`: the
diff --git a/src/main/managed-server/lifecycle/orcad-managed-remote-stop.ts b/src/main/managed-server/lifecycle/orcad-managed-remote-stop.ts
index e01236bb4f3..f85f406f746 100644
--- a/src/main/managed-server/lifecycle/orcad-managed-remote-stop.ts
+++ b/src/main/managed-server/lifecycle/orcad-managed-remote-stop.ts
@@ -22,7 +22,7 @@ import {
   orcadWindowsSlotOpCommand,
   readOrcadWindowsEncodedAnswer
 } from '../install/orcad-remote-windows-node'
-import { ORCAD_WINDOWS_RUNTIME_MARKER } from '../../ssh/orcad-windows-host-script'
+import { ORCAD_WINDOWS_RUNTIME_MARKER } from '../host-state/orcad-windows-host-script'
 import { ORCAD_LOCK_FILE_NAME, parseOrcadInstanceLockRecord } from '../../orcad/orcad-instance-lock'
 import {
   ORCAD_CANCEL_MANAGED_STOP_FLAG,
diff --git a/src/main/managed-server/lifecycle/orcad-rollback-transition.ts b/src/main/managed-server/lifecycle/orcad-rollback-transition.ts
index 1fc64390bb9..e0961fd9cce 100644
--- a/src/main/managed-server/lifecycle/orcad-rollback-transition.ts
+++ b/src/main/managed-server/lifecycle/orcad-rollback-transition.ts
@@ -18,7 +18,7 @@ import {
   parseOrcadSnapshotRestore,
   probeOrcadStateSnapshotCommand,
   restoreOrcadStateSnapshotCommand
-} from '../../ssh/orcad-state-snapshot'
+} from '../host-state/orcad-state-snapshot'
 import { joinRemotePath } from '../../ssh/ssh-remote-platform'
 import type { OrcadActivationLockControl } from '../activation/orcad-activation-lock'
 import {
@@ -32,7 +32,7 @@ import {
 } from '../activation/orcad-activation-transaction-transitions'
 import { writeOrcadActivationTransaction } from '../activation/orcad-activation-transaction-store'
 import { execOrcadRemoteOr, withoutAbortSignal } from '../install/orcad-remote-runtime-control'
-import { execOrcadStateMutationOr } from '../../ssh/orcad-state-mutation-exec'
+import { execOrcadStateMutationOr } from '../host-state/orcad-state-mutation-exec'
 import {
   orcadSlotDir,
   resolveOrcadSlotIdentity,
diff --git a/src/main/managed-server/lifecycle/orcad-stdio-bridge-provider.test.ts b/src/main/managed-server/lifecycle/orcad-stdio-bridge-provider.test.ts
index bc3e1bd2b9b..d59f5ae483a 100644
--- a/src/main/managed-server/lifecycle/orcad-stdio-bridge-provider.test.ts
+++ b/src/main/managed-server/lifecycle/orcad-stdio-bridge-provider.test.ts
@@ -9,7 +9,7 @@ import type { OrcadStdioBridge } from '../../ssh/orcad-stdio-bridge'
 import { ORCAD_STDIO_BRIDGE_MAX_CHANNELS } from './orcad-stdio-bridge-listener'
 import { OrcadStdioBridgePortForwardProvider } from './orcad-stdio-bridge-provider'
 import { spawnLocalBridgeChannel, startEchoServer } from './orcad-stdio-bridge-test-channel'
-import { ORCAD_WINDOWS_HOST_SCRIPT } from '../../ssh/orcad-windows-host-script'
+import { ORCAD_WINDOWS_HOST_SCRIPT } from '../host-state/orcad-windows-host-script'
 import type { SshConnection } from '../../ssh/ssh-connection'
 import type { StartedPortForward } from '../../ssh/port-forwarding/ssh-port-forward-provider'
 import type { RemoteCommandChannel } from '../install/remote-install-transport'
diff --git a/src/main/managed-server/lifecycle/orcad-stdio-bridge-script.ts b/src/main/managed-server/lifecycle/orcad-stdio-bridge-script.ts
index 3e56de8339c..9c8ceb28a80 100644
--- a/src/main/managed-server/lifecycle/orcad-stdio-bridge-script.ts
+++ b/src/main/managed-server/lifecycle/orcad-stdio-bridge-script.ts
@@ -15,7 +15,7 @@ import {
 } from '../../../shared/orcad-artifacts'
 import { shellEscape } from '../../ssh/ssh-connection-utils'
 import { RELAY_REMOTE_DIR } from '../../ssh/remote-frame-protocol'
-import { ORCAD_MACHINE_HOMES_DIRNAME } from '../../ssh/orcad-machine-home'
+import { ORCAD_MACHINE_HOMES_DIRNAME } from '../host-state/orcad-machine-home'
 
 export type OrcadStdioBridgeMode = 'raw' | 'base64'
 
diff --git a/src/main/ssh/orcad-exited-own-fence-mutation-race.test.ts b/src/main/ssh/orcad-exited-own-fence-mutation-race.test.ts
index 073b094f269..a726bea6e02 100644
--- a/src/main/ssh/orcad-exited-own-fence-mutation-race.test.ts
+++ b/src/main/ssh/orcad-exited-own-fence-mutation-race.test.ts
@@ -28,7 +28,8 @@ const { initOrcadHeldFenceTokenFile, ORCAD_HELD_FENCE_TOKENS_FILE_NAME } =
   await import('./orcad-held-fence-tokens')
 const { tryStealInstallLockCommand } =
   await import('../managed-server/install/remote-install-lock-commands')
-const { serializedStateMutationCommand } = await import('./orcad-state-snapshot')
+const { serializedStateMutationCommand } =
+  await import('../managed-server/host-state/orcad-state-snapshot')
 const { ORCAD_FENCE_LOST_EXIT, ORCAD_FENCE_LOST_MARKER } =
   await import('../managed-server/activation/orcad-activation-fence-scope')
 const { getRemoteHostPlatform } = await import('./ssh-remote-platform')
diff --git a/src/main/ssh/orcad-exited-own-lock.ts b/src/main/ssh/orcad-exited-own-lock.ts
index a2d6a42a44c..d28d8ae55b5 100644
--- a/src/main/ssh/orcad-exited-own-lock.ts
+++ b/src/main/ssh/orcad-exited-own-lock.ts
@@ -27,7 +27,7 @@ import {
 import {
   ORCAD_EXITED_OWN_LOCK_QUIET_SECONDS,
   ORCAD_STATE_MUTATION_LOCK_DIRNAME
-} from './orcad-state-snapshot-members'
+} from '../managed-server/host-state/orcad-state-snapshot-members'
 import { CMD_EXE_COMMAND_LINE_MAX_CHARS } from '../providers/windows-shell-args'
 import { shellEscape } from './ssh-connection-utils'
 import type { InstallLockExitedOwnerProof } from '../managed-server/install/remote-install-lock'
diff --git a/src/main/ssh/orcad-fence-lost-classification.test.ts b/src/main/ssh/orcad-fence-lost-classification.test.ts
index 61480e6f9ba..9566e9c2ed1 100644
--- a/src/main/ssh/orcad-fence-lost-classification.test.ts
+++ b/src/main/ssh/orcad-fence-lost-classification.test.ts
@@ -1,7 +1,7 @@
 import { EventEmitter } from 'node:events'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import type { ClientChannel } from 'ssh2'
-import { execOrcadStateMutation } from './orcad-state-mutation-exec'
+import { execOrcadStateMutation } from '../managed-server/host-state/orcad-state-mutation-exec'
 import {
   execOrcadRemote,
   execOrcadRemoteOr
diff --git a/src/main/ssh/orcad-incumbent-recovery.ts b/src/main/ssh/orcad-incumbent-recovery.ts
index c7bc7d9f32b..fee46eb917c 100644
--- a/src/main/ssh/orcad-incumbent-recovery.ts
+++ b/src/main/ssh/orcad-incumbent-recovery.ts
@@ -6,7 +6,7 @@
  * when an operator accepts it — the slot exposed RPC, and with it stopped nothing on the host
  * can count the terminals it started, so the snapshot may no longer describe them.
  */
-import { execOrcadStateMutation } from './orcad-state-mutation-exec'
+import { execOrcadStateMutation } from '../managed-server/host-state/orcad-state-mutation-exec'
 import { orcadRemoteBaseDir } from '../managed-server/install/orcad-remote-windows-node'
 import type { ServeReadiness } from '../server/serve-readiness'
 import { RELAY_REMOTE_DIR } from './remote-frame-protocol'
@@ -18,7 +18,7 @@ import {
   orcadSnapshotIsUnchanged,
   parseOrcadSnapshotRestore,
   restoreOrcadStateSnapshotCommand
-} from './orcad-state-snapshot'
+} from '../managed-server/host-state/orcad-state-snapshot'
 import { execOrcadRemote } from '../managed-server/install/orcad-remote-runtime-control'
 import {
   ensureOrcadSlotServing,
diff --git a/src/main/ssh/orcad-installed-activation.ts b/src/main/ssh/orcad-installed-activation.ts
index 4c9ea90beab..50030c363b7 100644
--- a/src/main/ssh/orcad-installed-activation.ts
+++ b/src/main/ssh/orcad-installed-activation.ts
@@ -27,7 +27,7 @@ import {
   captureOrcadStateSnapshotCommand,
   orcadSnapshotDirName,
   parseOrcadSnapshotCapture
-} from './orcad-state-snapshot'
+} from '../managed-server/host-state/orcad-state-snapshot'
 import { joinRemotePath } from './ssh-remote-platform'
 import { computeLocalOrcadBuildHash } from './orcad-local-build-hash'
 import { preflightInstalledOrcad } from '../managed-server/install/orcad-remote-preflight'
@@ -44,7 +44,7 @@ import {
   execOrcadRemoteOr,
   withoutAbortSignal
 } from '../managed-server/install/orcad-remote-runtime-control'
-import { execOrcadStateMutationOr } from './orcad-state-mutation-exec'
+import { execOrcadStateMutationOr } from '../managed-server/host-state/orcad-state-mutation-exec'
 import {
   initialOrcadActivationAdmissionCommand,
   parseInitialOrcadActivationAdmission
diff --git a/src/main/ssh/orcad-stdio-bridge.test.ts b/src/main/ssh/orcad-stdio-bridge.test.ts
index 15f36022d5d..e9d3f8f9511 100644
--- a/src/main/ssh/orcad-stdio-bridge.test.ts
+++ b/src/main/ssh/orcad-stdio-bridge.test.ts
@@ -19,7 +19,7 @@ import {
   spawnLocalBridgeChannel,
   startEchoServer
 } from '../managed-server/lifecycle/orcad-stdio-bridge-test-channel'
-import { ORCAD_WINDOWS_HOST_SCRIPT } from './orcad-windows-host-script'
+import { ORCAD_WINDOWS_HOST_SCRIPT } from '../managed-server/host-state/orcad-windows-host-script'
 import type { OrcadHostTransport } from './orcad-host-transport'
 import type { RemoteCommandChannel } from '../managed-server/install/remote-install-transport'