diff --git a/MIGRATION.md b/MIGRATION.md
index 4b7fb69..26cf425 100644
--- a/MIGRATION.md
+++ b/MIGRATION.md
@@ -27,8 +27,8 @@
 - 领域代码的注释（`//!`、`///`）全部是英文。每个来自 Core 或 Swift 的模块在模块文档里写明来源。
 - 宿主侧的接线是分步的：`plugin.json` 现在声明 `backend`（`backend.launch` 为 `packaged`，路径 `bin/lithe-java-backend`），后端把领域命令注册成插件函数，
   并承担 API-35 的设置中转（第 5 节：调用方一侧发现并调用 `languageImport.settings`，导出方一侧接收 `languageImport.settingsChanged`，
-  再用 `languageServer/notify` 推送给 JDT LS）。语言服务器仍由宿主的 JDT 集成启动（`launch.kind` 为 `runtime`，带 `hostIntegration`），
-  改为后端启动要等第 6 节列出的 API-23 等宿主 API 就位，见第 10 节。
+  再用 `languageServer/notify` 推送给 JDT LS）。语言服务器由后端启动（`launch.kind` 为 `backend`，函数 `java.resolveLaunch`，
+  `requires.serverProcess` 3，不再有 `hostIntegration`），见第 5.8 节；运行/调试/测试的接管见第 10 节。
 
 ## 2. 边界决定
 
@@ -222,7 +222,7 @@ API-30（调试适配器）、API-37（环境与 l10n）、API-42（内置 Git 
 
 | 来源 | 新位置 | 状态 | 说明 |
 | --- | --- | --- | --- |
-| `Plugins/mac/Official/JavaSupport/plugin.json@1daaeb525` | `io.github.lithe-idea.java-support/plugin.json` | 已移植并有测试 | 身份改为普通插件：id 从 `dev.lithe.plugin.java-support` 变为 `io.github.lithe-idea.java-support`，`vendor` 改为 `Lithe Community`（`signatureRequirement: none`），删除 `publisherPackage`、`bundledSignatureRequirement` 和 `requires.packageTrust`，见第 9 节；版本仍是 1.1.0。新增后端声明：顶层 `backend`、`pluginFunctions`，`requires.backend: 2`、`pluginFunctions: 1`、`languageServers: 3`，权限 `backend.launch`、`languageServer.request`、`workspace.metadata`，激活事件 `onWorkspaceOpen`，语言服务器的 `requestMethods` 与 `commands`（第 5.7 节）；`launch` 和 `hostIntegration` 不变。`repository_pins.rs` 断言社区身份 |
+| `Plugins/mac/Official/JavaSupport/plugin.json@1daaeb525` | `io.github.lithe-idea.java-support/plugin.json` | 已移植并有测试 | 身份改为普通插件：id 从 `dev.lithe.plugin.java-support` 变为 `io.github.lithe-idea.java-support`，`vendor` 改为 `Lithe Community`（`signatureRequirement: none`），删除 `publisherPackage`、`bundledSignatureRequirement` 和 `requires.packageTrust`，见第 9 节；版本仍是 1.1.0。新增后端声明：顶层 `backend`、`pluginFunctions`，`requires.backend: 2`、`pluginFunctions: 1`、`languageServers: 3`，权限 `backend.launch`、`languageServer.request`、`workspace.metadata`，激活事件 `onWorkspaceOpen`，语言服务器的 `requestMethods` 与 `commands`（第 5.7 节）；`launch` 改为后端解析、删除 `hostIntegration`（第 5.8 节）。`repository_pins.rs` 断言社区身份和后端启动的形状 |
 | `Plugins/mac/Official/JavaSupport/{icons,templates}/**@1daaeb525` | `io.github.lithe-idea.java-support/{icons,templates}/` | 已移植并有测试 | `backend/tests/repository_pins.rs` 检查清单里每个文件都存在。Maven 图标（`icons/maven*.svg`）、Maven 与 Gradle 构建文件模板（`templates/java/{maven,gradle-kotlin,gradle-groovy,standard-*}`）已移交 Maven、Gradle 插件，本仓库只保留 `templates/java/plain*` 与 Java、Spring Boot 图标，见第 7 节 |
 | `Plugins/mac/Official/JavaSupport/assemble-package.sh@1daaeb525` | `scripts/assemble-package.sh` | 已移植无测试 | 新增后端二进制：按 `--arch` 用 `cargo build --release --locked -p lithe-java-backend --target <triple>` 编译，`universal` 用 `lipo -create` 合并，放到 `plugin.json` 的 `backend.launch.path`（`bin/lithe-java-backend`）。由 `scripts/verify-package.sh` 校验产物，包括后端存在、可执行、架构与 `--arch` 一致 |
 | `scripts/macos/prepare/prepare-jdtls.sh@1daaeb525`、`prepare-jdk.sh@1daaeb525` | `scripts/prepare-jdtls.sh`、`scripts/prepare-jdk.sh` | 已移植无测试 | 来源地址和 SHA-256 固定在 `third_party/*/manifest.json`，`repository_pins.rs` 检查格式 |
@@ -288,8 +288,8 @@ API-30（调试适配器）、API-37（环境与 l10n）、API-42（内置 Git 
 状态：**已实现**（Java 一侧）。接口常量、答案校验与合并在 `dj/lsp/languages/jdt_contributions.rs`（纯逻辑，不依赖 SDK），
 发现并调用提供方在 `backend/src/plugin_functions.rs`，按工作区维护贡献、推送给 JDT LS、接收 `languageImport.settingsChanged` 的在
 `backend/src/settings_session.rs`。宿主中转已由 Core 的 [#1742](https://github.com/1lck/Lithe-IDEA/pull/1742) 实现并合入，后端按已合入的
-方法形状（插件函数协议 4，Rust SDK 0.3.0）调用它，清单已声明（第 5.7 节）。仍缺的只有 `java.configuration.runtimes` 的推送，
-它依赖 API-23，见第 6 节。
+方法形状（插件函数协议 4，Rust SDK 0.3.0）调用它，清单已声明（第 5.7 节）。`java.configuration.runtimes` 由启动请求里宿主
+解析出的 `tools.java` 提供（第 5.8 节），不再等 API-23。
 
 ### 5.1 接口函数 ID
 
@@ -319,8 +319,9 @@ API-30（调试适配器）、API-37（环境与 l10n）、API-42（内置 Git 
 6. **只有至少一个提供方参与（回答或失败）时才推送**：用 `languageServer/notify` 发 `workspace/didChangeConfiguration`，
    `settings` 整份替换会话里的插件配置。没有任何提供方时什么都不推送——过渡期主仓库的 jdt 宿主集成仍在推送它自己的设置，
    插件这边的整份替换会把它覆盖掉；在 Maven/Gradle 插件导出 `languageImport.settings` 之前必须零行为变化。
-7. 推送里 `java.configuration.runtimes` 为空：插件后端目前没有列出 JDK 安装的宿主方法（API-23 `toolchains.list`），
-   等它提供后把宿主的候选列表填进来；JDT LS 不会因为缺这个键而删除已登记的 VM。索引根也不在插件推送里，因为 Core 会在插件配置上叠加宿主的索引策略。
+7. 推送里的 `java.configuration.runtimes` 只有一项：宿主在启动请求里解析出的 `java` 工具安装（第 5.8 节），作为默认运行时，
+   每次推送都重复它，这样服务器编译的目标和 Run 启动项目用的 JDK 一致。宿主没找到 `java` 工具时不带这个键，JDT LS 不会因为缺键而删除
+   已登记的 VM。列出全机 JDK 仍要等 API-23 `toolchains.list`。索引根也不在插件推送里，因为 Core 会在插件配置上叠加宿主的索引策略。
 
 ### 5.3 超时、失败与状态
 
@@ -384,8 +385,29 @@ Java 的清单现在这样声明（以已合入的契约 README 为准）：
 - `requires` 写 `backend: 2`、`pluginFunctions: 1`、`languageServers: 3` 和 `serverProcess: 1`，`pluginAPIVersion` 为 4；
   后端运行时协商到插件函数协议 4 才能调用中转方法。
 - 权限：`backend.launch`、`languageServer.request`（语言服务器列了 `requestMethods`）、`workspace.metadata`（读取工作区根路径需要 `backend` 2）。
-- `languageServers[0]` 声明 `requestMethods: ["workspace/executeCommand"]` 和 `commands: ["java.project.updateSettings"]`；
-  `launch`（`kind: "runtime"`）和 `hostIntegration`（`id: "jdt"`）保持不变，直到 API-23 就位（第 10 节）。
+- `languageServers[0]` 声明 `requestMethods: ["java/classFileContents", "workspace/executeCommand"]` 和 `commands: ["java.project.updateSettings"]`；
+  `launch` 是 `{ "kind": "backend", "function": "java.resolveLaunch", "timeoutMilliseconds": 60000 }`（`requires.serverProcess` 3），
+  没有 `hostIntegration`、`arguments`、`runtimeDependencies` 和 `initializationOptions`，它们的值都由后端在第 5.8 节的回答里给出。
+
+### 5.8 语言服务器启动（serverProcess 3）
+
+`backend/src/launch.rs` 注册 `java.resolveLaunch`。宿主按契约的 `resolveParams`（`serverID`、`platform.arch`、`stateDirectory`、
+`workspaceStateDirectory`、`logDirectory`、`temporaryDirectory`、`settings`）加工作区上下文调用它，后端：
+
+- 以后端二进制所在的 `bin/` 的上级为包根，按固定布局定位文件：`language-server/plugins/org.eclipse.equinox.launcher_*.jar`（恰好一个）、
+  `language-server/configuration/<arch>`、`language-server/lombok/lombok.jar`、`language-server/java-debug` 与 `language-server/java-test/extensions`
+  里的扩展包、`runtime/<arch>/bin/java`。布局常量是 `pub`，`backend/tests/repository_pins.rs` 用它们约束 `scripts/assemble-package.sh`
+  和 `scripts/verify-package.sh`，所以 `plugin.json` 不再写这些路径；
+- 把 `heapMaxMB`、`logLevel` 两个设置和 `logDirectory/jdt.log` 拼进 JVM 参数（原 `runtimeArguments` 的 `${setting:…}` 与 `${logDir}` 展开），
+  把每个工作区的 Equinox 配置复制到 `workspaceStateDirectory` 下再以 `-configuration` 传入，`-data` 指向其中的 `data/`；
+- 读取契约里可选的 `tools.java`（宿主按清单 `requiresTools: ["java"]`、按用户选择与发现解析出的安装，带 `home` 与 `version`），
+  把它作为 `java.configuration.runtimes` 里唯一且默认的运行时写进 `initializationOptions` 与 `workspaceConfiguration`，并记进设置会话，
+  之后每次推送都重复它。原因：Run 用宿主解析的 `java` 工具启动项目，而 JDT LS 默认用自带的 JDK 21 编译，不配默认运行时会出现
+  `UnsupportedClassVersionError`（class 65.0 对 61.0）。`tools` 缺失、缺 `home` 或 `version` 时不配置，也不报错；
+- 回答 `executable: { kind: "packaged", path }`、`arguments`、`initializationOptions`（原 `hostIntegration` 的 bundles、设置与
+  `java_configuration`）、`workspaceConfiguration`、`writablePaths`，以及一个 `language/status` 的就绪门（`service-ready`）。
+
+错误码 `launch.invalid_params`、`launch.package_unavailable`、`launch.resource_missing`、`launch.configuration_failed` 与设置中转的错误码不重名。
 - 激活事件加 `onWorkspaceOpen`：本插件要主动调用 `languageImport.settings` 并接收语言服务器的状态通知，只导出函数不足以启动后端。
   后端是全机一个进程，所有工作区共享。
 
@@ -396,6 +418,40 @@ Java 的清单现在这样声明（以已合入的契约 README 为准）：
 **信任边界。** 宿主只中转，不传递信任：Maven/Gradle 插件用自己的权限执行，Java 不因此获得权限；Java 只接受 `CONTRIBUTED_SETTINGS_KEYS`
 里的键，所以一个提供方既不能改 `java.home`，也不能改别的插件的槽位。
 
+### 5.9 运行、调试与测试（API-27 / API-29，已实现）
+
+`backend/src/run.rs` 用三个宿主能力接管了主仓库 Core 与 macOS 原来写死的 Java 运行流程：
+
+- **行内动作**（`editor/registerActions`，权限 `editor.actions` + `documents.read`）：后端在 `initialize` 之后与每次
+  `didChangeContexts` 时列出工作区上下文，为每个上下文注册 `.java` 的收集函数 `java.collectActions`。宿主对每个打开的 Java 文档
+  调用它，后端向 JDT LS 请求 `vscode.java.resolveMainMethod` 与 `vscode.java.test.findTestTypesAndMethods`，经领域规则
+  `java_run_markers` 得到标记，每个标记一条 `Run '<label>'` 动作（图标 `run`/`test`）并带 `Debug` 备选项。语言服务器没起来、
+  忙或超时时回答空列表，宿主在下次编辑时再收集。宿主只在注册绑定和编辑时收集，而首次注册发生在 `initialize` 之后、JDT LS
+  仍在启动时，所以后端收到清单转发的 `language/status` `ServiceReady`（`languageServer/didReceiveNotification`）后，
+  注销并重新注册该上下文的绑定，让宿主对已打开的文档立刻再收集一次；用户不必编辑文件才能看到标记。
+  工具栏与菜单的 Run/Debug 也走这些动作：清单的 `languages` 里 Java 没有执行模块，也没有 `hostCapabilities`，所以 macOS 宿主在
+  “当前文件”运行配置下保存文档、按 gutter 的方式收集当前文档的动作，Run 调用位置最前的 `run` 动作，Debug 调用它的 `debug` 备选项；
+  没有 main 方法时宿主提示“Java does not provide project execution”。这是宿主的通用规则（契约 README“Independent editor actions”一节），
+  插件这边无须额外声明。
+- **启动进程**（`run/start`，权限 `run.start`；调试另需 `debug.start`）：点击调用 `java.runAction`。main 类先经
+  `vscode.java.buildWorkspace`（结果 1 或 2 继续）再 `vscode.java.resolveClasspath` 得到 `[modulePaths, classPaths]`；
+  测试经 `plan_debug_launch` → `vscode.java.test.junit.argument` → `debug_launch_target` → `java_test_launch` 得到运行器参数。
+  进程用清单 `requiresTools: ["java"]` 引用的工具定义（`executable.kind: "tool"`），由用户在 JDK 设置里选择的 JDK 执行；
+  调试时在最前面加 `-agentlib:jdwp=…,address=localhost:<port>` 与 `-Dspring.devtools.restart.enabled=false`，并在 `debug`
+  字段给出 `{configurationType: "java", target: {kind: "connection", port}}`，宿主用清单的 `java` 调试适配器接上。
+  `rerun` 指向 `java.rerun`，数据就是动作参数。
+- **测试结果**：后端对每次测试启动在 127.0.0.1 开一个端口交给 Eclipse JUnit 运行器（`-port`），监听线程按 `%TESTS`/`%FAILED`/
+  `%ERROR` 计数，运行器断开后用 `window/showInformation`（有失败用 `showWarning`）显示 `<名称>: N passed, N failed…`；
+  宿主发 `run/didExit` 后停止。摘要文案是英文，等插件后端能用宿主 i18n（API-37）。
+- **输出链接**（`outputLinkMatchers` 1）：清单的 `stack-frame` 匹配器捕获 `at pkg.Class.method(Class.java:12)`，
+  点击调 `java.resolveOutputLink`，后端用 `workspace/findFiles`（权限 `workspace.search`）按文件名查找，
+  优先包目录匹配的文件，回答 `{uri, range}`。
+- **调试适配器声明**（`debugAdapters` 3）：热替换 `redefineClasses`/`hotcodereplace`/`changedClasses`/`errorMessage`
+  与默认步进过滤 `$JDK`、`$Libraries` 写进清单的 `features`/`defaults`，主仓库不再按适配器 ID 特判。
+- 清单改动：`requires.serverProcess: 4` + `requiresTools: ["java"]`、`requires.debugAdapters: 3`、
+  `requires.outputLinkMatchers: 1`；`languageServers[].commands` 白名单加入上面五个 `vscode.java.*` 命令；权限加入
+  `documents.read`、`editor.actions`、`run.start`、`debug.start`、`window.messages`、`workspace.search`。
+
 ## 6. `TODO(host-api)` 清单
 
 每条都是代码里的占位注释，格式 `TODO(host-api: API-NN 说明)`；`†` 的含义见第 2.3 节。
@@ -421,20 +477,22 @@ Java 的清单现在这样声明（以已合入的契约 README 为准）：
 - `backend/src/lib.rs`（与 API-27、API-29 并列）：`plugin.json` 已声明 `backend`（`requires.backend: 2`，`requires.serverProcess: 1`，
   `backend.launch {kind: "packaged", path: "bin/lithe-java-backend"}`，第 5.7 节）。宿主能为编辑器提供者、运行配置、Java 测试流程调用插件函数之后，
   再把宿主每个调用点从 Core 切到这些函数。
-- 语言服务器仍用 `launch.kind: "runtime"` 加 `hostIntegration` 启动。改为 `launch.kind: "backend"`、去掉 `hostIntegration`、
-  由插件接管运行/调试/测试（阶段 J2），依赖 API-23（见下文“来自计划里其他编号的占位”）。
+- 语言服务器已改为 `launch.kind: "backend"` 并去掉 `hostIntegration`（第 5.8 节）；运行/调试/测试由后端接管（第 5.9 节）。
 
-### API-27 编辑器动作与标记
+### API-27 编辑器动作与标记（运行/调试标记已完成）
 
-- `backend/src/lib.rs`（同上）：运行/调试标记、导航标记、CodeLens 要由插件提供。
-- 表中对应的 Swift 行（`AppModel+JavaRunMarkers`、`AppModel+JavaEntrypoints`、`AppModel+JavaNavigation`、`SpringEndpointsView`、`JavaFileIconResolver`）也都等这个编号。
+- 运行与调试的行内标记由 `backend/src/run.rs` 通过编辑器动作（`editor/registerActions`）提供，见第 5.9 节。
+- 导航标记（父类/实现）、CodeLens、`SpringEndpointsView`、`JavaFileIconResolver` 对应的 Swift 行仍等这个编号的其余部分。
 
-### API-29 构建与测试
+### API-29 构建与测试（运行/调试/测试启动已完成）
 
-- `dj/testing/result_channel.rs`：测试结果需要一个回环监听通道。插件后端不能自己监听，要由宿主提供回环通道
-  或 `network.loopbackListen` 能力。
+- 运行、调试、测试的进程由后端经宿主 `run/start` 启动，调试会话由宿主按 `debug` 字段接到声明的 `java` 调试适配器，
+  见第 5.9 节。
+- `dj/testing/result_channel.rs`：后端自己在回环地址上监听 JUnit 运行器的结果端口（`backend/src/run.rs` 的结果监听器），
+  不再需要宿主提供回环通道。
 - `dj/testing/jdt_test_items.rs`（`build_test_selectors`）：选择器由构建插件运行，见第 5.6 节（与 API-35 并列）。
-- 表中的运行配置、启动决策、`standalone-java-compile-run-v1.json`、`execution/configuration.rs` 的 Java 类型等行也等这个编号。
+- 未做：`execution/launch_command.rs` 的 argfile 规划没有接到 `run/start`（命令行按 JDT LS 给的长度原样传递）；
+  TestNG 运行器的结果协议不解析，只报“已结束”。
 
 ### API-33 项目模板
 
@@ -450,7 +508,7 @@ Java 一侧的中转已经实现并在清单里声明（第 5 节、第 5.7 节
 - `languageImport.settingsChanged`：已注册，调用方插件 ID 取自 `caller`，已完成。
 - 变化后的 `workspace/didChangeConfiguration` 与 Maven profiles（`java.project.updateSettings`）：经 `languageServer/notify` 与
   `languageServer/request` 发出（#1745），已完成（第 5.2、5.4 节）。
-- 还剩下的两项属于其他编号：`java.configuration.runtimes` 的推送等 API-23（`toolchains.list`），见下文；
+- `java.configuration.runtimes` 的默认运行时已由启动请求里的 `tools.java` 提供（第 5.8 节）；列出全机 JDK 仍属于 API-23，见下文。
   构建插件提供工具链要求和测试运行（第 5.5、5.6 节）仍是设计，没有实现。
   - `dj/execution/toolchain_requirements.rs`：构建插件通过函数提供工具链要求（第 5.5 节）。
   - `dj/testing/jdt_test_items.rs`：测试运行委托给构建插件（第 5.6 节）。
@@ -460,9 +518,8 @@ Java 一侧的中转已经实现并在清单里声明（第 5 节、第 5.7 节
 - API-20 存储：`dj/execution/argfile.rs`（后端没有插件自有的临时目录）、`dj/jdt_integration/workspace_state.rs`（缓存目录来自宿主）。
 - API-22 日志与进度：日志部分已完成，后端接入 `litheLogging` 1，不再有占位（第 3.1 节“Java 日志事件”一行，级别表见 README 的“日志”一节）。
 - API-23 工具链与进程：`dj/jdt_integration/runtime.rs`（探测 `java -version` 的进程执行）。
-  `toolchains.list`（列出已安装 JDK）也属于它：插件后端没有这个宿主方法，所以设置中转暂不推送 `java.configuration.runtimes`
-  （`backend/src/settings_session.rs` 里的 `TODO(host-api: API-23 toolchains.list)`），JDT LS 的 VM 登记保持现状。
-  这是阶段 J2（语言服务器改为 `launch.kind: "backend"`、去掉 `hostIntegration`、插件接管运行/调试/测试）的前置条件。
+  `toolchains.list`（列出已安装 JDK）也属于它：插件后端没有这个宿主方法，所以 `java.configuration.runtimes` 只含宿主随启动请求
+  送来的 `tools.java` 这一个默认运行时（第 5.8 节），不列出全机其他 JDK。
 - API-37 环境与 l10n：`dj/jdt_integration/runtime.rs`、`dj/jdt_integration/launch_resources.rs`、`backend/src/lib.rs`（用户可见文案要走宿主 i18n）。
 - API-42 内置 Git 只读：`dj/host/git.rs`、`dj/languages/code_vision_hints.rs`（blame 作者）、`dj/lsp/languages/jdt_project_metadata.rs`（一条测试注释，Git 忽略查询）。
 - API-30 调试适配器：第 3.1 与 3.4 节表里的 `debug/engine.rs` 特例与 `RealJavaDebugIntegrationTests`，代码里没有单独占位。
@@ -512,7 +569,7 @@ Java 一侧的中转已经实现并在清单里声明（第 5 节、第 5.7 节
 - Core：
   - 两条按官方身份设的宿主限制已由主仓库 [#1763](https://github.com/1lck/Lithe-IDEA/pull/1763) 取消，本插件可以作为普通插件被宿主接受：
     普通插件可以声明 `languageServers[].hostIntegration`（JDT）和短 `toolDefinitions` ID（例如 `java`）；
-    多个插件争用同一个短工具 ID 时都不归属。`hostIntegration` 本身仍在 Core 里，随 JDT 宿主集成一起，由通用 API 取代后删除（阶段 J2）。
+    多个插件争用同一个短工具 ID 时都不归属。本插件已不再声明 `hostIntegration`（第 5.8 节），Core 里的 JDT 宿主集成随主仓库的拆分 PR 删除。
   - `lsp/languages/{java_*,jdt*,project_preparation}.rs` 与 `mod.rs` 里的 re-export，`languages/{java,java_syntax,spring,mybatis}.rs`，
     `debug/java_test.rs`，`execution/{java_selection,launch_command,classpath_jar}.rs` 的 Java 部分，`protocol/contracts.rs` 里的 Java、Spring、MyBatis、Maven 模型。
   - `protocol/command.rs` 与 `runtime/dispatcher.rs` 里的 Java 命令；`engine.rs` 里的 Java 函数与 `StartServerRequest` 的 Java 字段；
@@ -607,9 +664,13 @@ Java 一侧的中转已经实现并在清单里声明（第 5 节、第 5.7 节
 
 ## 10. 未完成事项
 
-- 宿主侧（阶段 J2）还没有切换：`plugin.json` 已声明 `backend` 2、`languageServers` 3 和 `pluginFunctions` 1，设置中转（API-25 / API-35）已在后端实现，
-  但语言服务器仍走 `hostIntegration`（JDT），启动、运行时选择和 `java.configuration.runtimes` 还由宿主决定。切换要等 API-23 `toolchains.list`
-  （后端的 `TODO(host-api: API-23 toolchains.list)`），第 6 节其余 API 没有实现，三个会话命令仍只回答 `NotSupported`。
+- 阶段 J2：语言服务器由后端启动（第 5.8 节），设置中转（API-25 / API-35）与运行/调试/测试（第 5.9 节）都在后端实现。
+  仍未接：`java.configuration.runtimes` 只含 `tools.java` 这一个默认运行时，列出全机 JDK 等 API-23 `toolchains.list`；
+  argfile 规划（`execution/launch_command.rs`）没有接到 `run/start`；TestNG 结果协议不解析；导航标记（父类/实现）与 CodeLens
+  没有宿主 API；测试结果摘要是英文（等 API-37）；三个会话命令仍只回答 `NotSupported`。
+- 运行/调试/测试的接管只由后端单元测试和 Core 清单校验验证，还要对着真实宿主（主仓库 Java 拆分分支）跑通：
+  打开 Java 工程后出现行内 Run/Debug 标记、点击能启动并在 Run 窗口看到输出、调试能在断点停下、JUnit 测试结束后弹出摘要、
+  堆栈行可点击跳转。
 - Maven 与 Gradle 插件还没有接手新建项目模板（第 7 节）：lithe-plugin-maven 要带 `maven-archetype` 生成器、`pom.xml` 模板、Maven 图标和 `standard-*` 目录模板，
   lithe-plugin-gradle 要带 `gradle-kotlin`、`gradle-groovy` 模板和自己的一份 `standard-*` 目录模板。在它们接手之前不要发布本插件的新版本。
 - 设置中转只由后端单元测试和桩中转测试验证，没有对着真实宿主跑过。变化通知（`languageImport.settingsChanged`）触发 `java.project.updateSettings`
diff --git a/README.md b/README.md
index 2e6cca4..554bdc8 100644
--- a/README.md
+++ b/README.md
@@ -14,10 +14,11 @@
 
 > **进行中**：本仓库正在从 Lithe 主仓库拆分出来，目标是 Lithe 宿主（Rust Core 和 macOS 应用）不再包含任何 Java 专属逻辑，
 > Java 的领域规则全部由本插件提供，宿主只提供通用插件接口。插件现在带一个 Rust 后端：`plugin.json` 声明了 `backend` 2，
-> 后端目前承担 Maven/Gradle 导入设置的中转（见“工作方式”）。语言服务器仍然由宿主的 JDT 集成启动
-> （`launch.kind` 为 `runtime`，带 `hostIntegration`）；改为后端启动、去掉 `hostIntegration`、由插件接管运行/调试/测试，
-> 要等宿主提供 API-23（`toolchains.list`），清单见 `MIGRATION.md` 第 6 节和第 10 节。在那之前 Lithe 仍然内置 Java Support
-> （旧 ID `dev.lithe.plugin.java-support`），本仓库发布的版本标为预发布，原因见 `MIGRATION.md` 第 9 节。
+> 后端承担 Maven/Gradle 导入设置的中转（见“工作方式”），并解析语言服务器的启动：`plugin.json` 的 `languageServers[0].launch`
+> 是 `kind: "backend"`、函数 `java.resolveLaunch`（`serverProcess` 3），不再有 `hostIntegration`；后端在 `backend/src/launch.rs`
+> 里定位包内的 Equinox 启动器、按架构的配置目录、Lombok 代理、java-debug 与 java-test 扩展包和随包 JDK，拼出 JDT LS 的命令行、
+> 初始化选项和 `language/status` 就绪门。由插件接管运行/调试/测试还在进行，清单见 `MIGRATION.md` 第 6 节和第 10 节。
+> 在宿主去掉内置 Java Support（旧 ID `dev.lithe.plugin.java-support`）之前，本仓库发布的版本标为预发布，原因见 `MIGRATION.md` 第 9 节。
 > Maven Archetype 生成器、Maven 与 Gradle 的项目模板已经移交 lithe-plugin-maven 和 lithe-plugin-gradle；
 > 在这两个插件接手模板之前不要发布本插件的新版本，否则“新建项目”会少掉 Maven 和 Gradle 选项。
 
@@ -26,8 +27,8 @@
 | 功能 | 说明 |
 | --- | --- |
 | 语言服务 | 用打包的 JDT LS（含 Lombok）提供补全、诊断、导航；JDK 随包提供，只用来运行语言服务器，项目自己的 SDK 仍由用户选择 |
-| 运行与调试入口 | 识别 `main` 方法和测试方法，生成运行/调试标记 |
-| 测试 | 发现 JUnit 测试项，生成测试选择器，并驱动 java-debug 与 vscode-java-test 运行器 |
+| 运行与调试 | 在 `main` 方法和测试旁显示 Run/Debug 行内动作；点击后后端经 JDT LS 构建并解析类路径，用用户选择的 JDK 通过宿主 Run 窗口启动，调试经 java-debug 连接；控制台里的堆栈行可点击跳转 |
+| 测试 | 发现 JUnit/TestNG 测试项，按类或方法启动 Eclipse JUnit 运行器（TestNG 用 vscode-java-test 运行器），运行结束后显示通过/失败计数 |
 | Spring Boot / MyBatis | 索引 Spring 端点与 MyBatis 映射，支持跳转 |
 | 新建项目 | 两个声明式项目生成器：Java（无构建系统，可选示例代码）、Spring Boot；Maven 原型和 Maven/Gradle 项目模板由 Maven、Gradle 插件提供 |
 | Maven / Gradle 工程 | 导入设置（settings 文件、本地仓库、offline、Gradle user home 等）由 Maven、Gradle 插件通过 `languageImport.settings` 提供，Java 不计算也不解析它们；后端收下后推给 JDT LS，Maven profiles 变化时触发 `java.project.updateSettings` |
@@ -54,6 +55,9 @@
   - 当前不推送 `java.configuration.runtimes`：插件后端还没有列出 JDK 安装的宿主方法，等 API-23（`toolchains.list`）提供。JDT LS 不会因为缺这个键而删除已登记的 VM。
 
   细节见 `MIGRATION.md` 第 5 节。
+- **运行/调试/测试**在 `backend/src/run.rs`：用宿主的编辑器动作（`editor/registerActions`）提供行内 Run/Debug 标记，
+  用 `run/start` 启动进程（进程用清单 `requiresTools: ["java"]` 引用的 JDK 工具定义），测试结果由后端自己在回环端口上监听
+  JUnit 运行器并用窗口消息显示，输出链接匹配器把堆栈行解析成工作区文件。细节见 `MIGRATION.md` 第 5.9 节。
 - **运行时只读**：插件包安装后在运行时只读。JDT LS、Lombok、java-debug、测试运行器、JDK 和后端二进制都在构建阶段固定来源、校验哈希（或由锁定的源码编译）后放进包里，
   运行时状态只写宿主提供的状态目录，不写包目录。
 
diff --git a/backend/src/launch.rs b/backend/src/launch.rs
new file mode 100644
index 0000000..8c89f19
--- /dev/null
+++ b/backend/src/launch.rs
@@ -0,0 +1,1122 @@
+//! Backend-resolved launch of JDT LS (`launch.kind: "backend"`).
+//!
+//! Before the host starts the `java` language server it calls
+//! [`LAUNCH_FUNCTION_ID`] with the contract's `resolveParams` and the
+//! workspace `context`, and it starts the process the answer describes. This
+//! module does what the host's `jdt` integration did: it finds the JDT LS
+//! files in the installed package, gives Equinox a writable copy of the
+//! packaged configuration, and builds the JDT LS command line, its
+//! initialization options and its settings.
+//!
+//! # Where the files are
+//!
+//! `resolveParams` carries no package directory. The manifest installs the
+//! backend at `bin/lithe-java-backend`, so the package root is the parent of
+//! the directory of the running executable ([`package_root`]). Every package
+//! path below is relative to that root, and the launcher is found by name
+//! instead of by a pinned version, so a JDT LS update changes no code.
+//!
+//! # Where the launch writes
+//!
+//! The package is read-only: neither the backend nor JDT LS writes into it.
+//! The launch writes only into the four directories the host provides for
+//! this start, and the answer lists them as `writablePaths`:
+//!
+//! - `stateDirectory`: the Equinox configuration area, one per `config.ini`
+//!   digest, which the backend prepares before it answers;
+//! - `workspaceStateDirectory`: the `-data` directory of the workspace;
+//! - `logDirectory`: the Equinox log `jdt.log` and its backups;
+//! - `temporaryDirectory`: `java.io.tmpdir` of the JDT LS process.
+//!
+//! # Settings
+//!
+//! The answer's `workspaceConfiguration` is
+//! [`settings_session::java_configuration`] of the settings the session knows
+//! for the workspace, the same value a later `workspace/didChangeConfiguration`
+//! push sends, so a start and a push never disagree. The initialization
+//! options carry the same `settings.java`, because JDT LS imports the
+//! projects while it handles `initialize`.
+//!
+//! [`settings_session::java_configuration`]: crate::settings_session::java_configuration
+
+use crate::run::file_uri;
+use crate::settings_session::{java_configuration, jdt_settings, SettingsSession, SERVER_ID};
+use lithe_java_domain::jdt_integration::launch_resources::{bundles_in, missing_resource_message};
+use lithe_java_domain::lsp::languages::jdt::{
+    adapt_initialization_options, add_trigger_files, direct_java_arguments, jdt_java_runtimes,
+    JdtDirectLaunchResources, JdtJavaRuntime,
+};
+use lithe_java_domain::lsp::languages::prepare_jdt_configuration_area;
+use lithe_java_domain::lsp::JavaRuntimeCandidate;
+use lithe_plugin_sdk::{
+    Context, FunctionError, Host, PluginError, SdkError, Value, WorkspaceContext,
+};
+use serde_json::json;
+use std::collections::VecDeque;
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+/// Plugin function the manifest names as the server's `launch.function`.
+pub const LAUNCH_FUNCTION_ID: &str = "java.resolveLaunch";
+
+/// `java.resolveLaunch` was called without a usable `resolveParams` field:
+/// another server ID, an unknown architecture, a directory that is not
+/// absolute, or a setting outside its declaration.
+pub const LAUNCH_INVALID_PARAMS: &str = "launch.invalid_params";
+/// The backend cannot find the package it was installed from.
+pub const LAUNCH_PACKAGE_UNAVAILABLE: &str = "launch.package_unavailable";
+/// The package lacks a file the launch needs; reinstalling repairs it.
+pub const LAUNCH_RESOURCE_MISSING: &str = "launch.resource_missing";
+/// The writable Equinox configuration area could not be prepared.
+pub const LAUNCH_CONFIGURATION_FAILED: &str = "launch.configuration_failed";
+
+/// Every `pluginErrorCode` `java.resolveLaunch` answers with, one per cause.
+pub const LAUNCH_ERROR_CODES: &[&str] = &[
+    LAUNCH_INVALID_PARAMS,
+    LAUNCH_PACKAGE_UNAVAILABLE,
+    LAUNCH_RESOURCE_MISSING,
+    LAUNCH_CONFIGURATION_FAILED,
+];
+
+/// Configuration areas of older JDT LS versions could not be removed. Only
+/// disk space is at stake, so the launch goes on.
+pub const LAUNCH_CONFIGURATION_CLEANUP_FAILED: &str = "launch.configuration_cleanup_failed";
+
+/// Diagnostics categories a launch reports as `degraded` without failing.
+/// The host did not answer `workspace/getFolders` for the workspace, so the
+/// launch names no `triggerFiles` and JDT LS falls back to the first opened
+/// file to lay out a workspace without a build file.
+pub const LAUNCH_WORKSPACE_FOLDERS_UNAVAILABLE: &str = "launch.workspace_folders_unavailable";
+/// Every degraded-diagnostic category `java.resolveLaunch` reports.
+pub const LAUNCH_CATEGORIES: &[&str] = &[
+    LAUNCH_CONFIGURATION_CLEANUP_FAILED,
+    LAUNCH_WORKSPACE_FOLDERS_UNAVAILABLE,
+];
+
+/// Most `.java` files named as `triggerFiles`. JDT LS uses the first one
+/// under each workspace folder, so one per folder would do; a few more let it
+/// still find one when the first lies in a directory it ignores.
+pub const TRIGGER_FILE_LIMIT: usize = 16;
+/// How deep below a workspace folder the trigger-file scan descends. Source
+/// roots of plain workspaces sit at the top or one level down (`src`,
+/// `src/main/java`), and the package directories below them are what the
+/// depth must still cover.
+pub const TRIGGER_SCAN_DEPTH: usize = 8;
+/// Most directory entries the scan reads in total, so a huge workspace delays
+/// the launch by a bounded amount instead of by its size.
+pub const TRIGGER_SCAN_ENTRY_BUDGET: usize = 20_000;
+/// Directories the scan never enters: hidden ones, dependency and build
+/// output trees. A `.java` file there is generated or foreign and would make
+/// JDT LS lay the project out around it.
+pub const TRIGGER_SCAN_SKIPPED_DIRECTORIES: &[&str] = &[
+    "node_modules",
+    "target",
+    "build",
+    "bin",
+    "out",
+    "dist",
+    "vendor",
+];
+
+/// `heapMaxMB` when the settings do not carry it; the manifest's default.
+pub const DEFAULT_HEAP_MAX_MB: u64 = 2048;
+/// Smallest `heapMaxMB` the manifest accepts. JDT LS imports in a
+/// constrained-memory mode at or below 1536 MB.
+pub const MIN_HEAP_MAX_MB: u64 = 2048;
+/// Largest `heapMaxMB` the manifest accepts.
+pub const MAX_HEAP_MAX_MB: u64 = 16384;
+/// `logLevel` when the settings do not carry it; the manifest's default.
+pub const DEFAULT_LOG_LEVEL: &str = "WARNING";
+/// The `logLevel` values the manifest declares.
+pub const LOG_LEVELS: &[&str] = &["ALL", "INFO", "WARNING", "SEVERE"];
+/// The `platform.arch` values the contract defines.
+pub const ARCHITECTURES: &[&str] = &["arm64", "x86_64"];
+/// Gate that holds the backend's requests until JDT LS reports its Java
+/// service ready.
+pub const SERVICE_READY_GATE_ID: &str = "service-ready";
+
+// Package layout. `plugin.json` no longer names these files (a backend
+// launch declares only the function); this module is the single source for
+// where `scripts/assemble-package.sh` puts them and `scripts/verify-package.sh`
+// checks them, and `backend/tests/repository_pins.rs` holds both scripts to
+// [`PACKAGE_LAYOUT`].
+
+/// Package directory that holds the Equinox launcher JAR.
+pub const LAUNCHER_DIRECTORY: &str = "language-server/plugins";
+/// File name prefix of the Equinox launcher JAR; the version follows it.
+pub const LAUNCHER_PREFIX: &str = "org.eclipse.equinox.launcher_";
+/// File name suffix of the Equinox launcher JAR.
+pub const LAUNCHER_SUFFIX: &str = ".jar";
+/// Package directory with one Equinox configuration per architecture.
+pub const CONFIGURATION_DIRECTORY: &str = "language-server/configuration";
+/// Package path of the Lombok agent JDT LS runs with.
+pub const LOMBOK_AGENT: &str = "language-server/lombok/lombok.jar";
+/// Package directories whose JAR files JDT LS loads as extension bundles, in
+/// this order and then by file name: the Java Debug Server, then the Java
+/// Test extensions.
+pub const EXTENSION_BUNDLE_DIRECTORIES: &[&str] = &[
+    "language-server/java-debug",
+    "language-server/java-test/extensions",
+];
+/// Package path of the Java Test runner JAR the test flow adds to the class
+/// path of TestNG launches; JDT LS itself does not load it.
+pub const TEST_RUNNER: &str =
+    "language-server/java-test/runner/com.microsoft.java.test.runner-jar-with-dependencies.jar";
+/// Package directory of the Java runtime; `<arch>/bin/java` follows it.
+pub const RUNTIME_DIRECTORY: &str = "runtime";
+/// Every package path the backend resolves at launch or test time, so the
+/// package scripts can be held to the same list.
+pub const PACKAGE_LAYOUT: &[&str] = &[
+    LAUNCHER_DIRECTORY,
+    CONFIGURATION_DIRECTORY,
+    LOMBOK_AGENT,
+    EXTENSION_BUNDLE_DIRECTORIES[0],
+    EXTENSION_BUNDLE_DIRECTORIES[1],
+    TEST_RUNNER,
+    RUNTIME_DIRECTORY,
+];
+/// Directory under `workspaceStateDirectory` passed to JDT LS as `-data`.
+const DATA_DIRECTORY: &str = "data";
+/// Equinox log file under `logDirectory`.
+const LOG_FILE: &str = "jdt.log";
+/// JDT LS notification that reports the readiness of its Java service.
+const LANGUAGE_STATUS: &str = "language/status";
+/// `language/status` type JDT LS sends once the projects are imported.
+const SERVICE_READY: &str = "ServiceReady";
+
+/// The `resolveParams` of one start, checked.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct LaunchRequest {
+    /// `platform.arch`: `arm64` or `x86_64`, the runtime and the Equinox
+    /// configuration to use.
+    pub architecture: String,
+    /// `stateDirectory`: the plugin's writable directory for this server.
+    pub state_directory: PathBuf,
+    /// `workspaceStateDirectory`: the writable directory of this workspace.
+    pub workspace_state_directory: PathBuf,
+    /// `logDirectory`: the session's log directory for the plugin.
+    pub log_directory: PathBuf,
+    /// `temporaryDirectory`: scratch space the host removes after the process.
+    pub temporary_directory: PathBuf,
+    /// `settings.heapMaxMB`: the JVM's maximum heap, in MiB.
+    pub heap_max_mb: u64,
+    /// `settings.logLevel`: the JDT LS log level.
+    pub log_level: String,
+    /// `tools.java`, the installation the host resolved for the plugin's
+    /// `java` tool, as the server's default runtime: Run starts the project
+    /// with that JDK, so the server must compile for it. Empty when the host
+    /// found none, which leaves the server on the runtimes it already knows.
+    pub java_runtimes: Vec<JdtJavaRuntime>,
+}
+
+/// The package files of a JDT LS launch, absolute.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct LaunchFiles {
+    /// The Equinox launcher JAR passed after `-jar`.
+    pub launcher_jar: PathBuf,
+    /// The Lombok agent passed as `-javaagent`.
+    pub lombok_agent: PathBuf,
+    /// The read-only Equinox configuration of the architecture; the launch
+    /// uses a writable copy of it.
+    pub packaged_configuration: PathBuf,
+    /// The extension bundle JARs, in load order.
+    pub extension_bundles: Vec<PathBuf>,
+}
+
+/// Checks the `resolveParams` of a call.
+pub fn parse_launch_params(params: &Value) -> Result<LaunchRequest, PluginError> {
+    if params.get("serverID").and_then(Value::as_str) != Some(SERVER_ID) {
+        return Err(invalid_params(
+            "The launch is not for the Java language server.",
+        ));
+    }
+    let architecture = params
+        .get("platform")
+        .and_then(|platform| platform.get("arch"))
+        .and_then(Value::as_str)
+        .filter(|arch| ARCHITECTURES.contains(arch))
+        .ok_or_else(|| invalid_params("The launch names no supported architecture."))?;
+    let settings = params.get("settings").cloned().unwrap_or_else(|| json!({}));
+    let heap_max_mb = match settings.get("heapMaxMB") {
+        None | Some(Value::Null) => DEFAULT_HEAP_MAX_MB,
+        Some(value) => value
+            .as_u64()
+            .filter(|mb| (MIN_HEAP_MAX_MB..=MAX_HEAP_MAX_MB).contains(mb))
+            .ok_or_else(|| invalid_params("The maximum heap setting is out of range."))?,
+    };
+    let log_level = match settings.get("logLevel") {
+        None | Some(Value::Null) => DEFAULT_LOG_LEVEL,
+        Some(value) => value
+            .as_str()
+            .filter(|level| LOG_LEVELS.contains(level))
+            .ok_or_else(|| invalid_params("The log level setting is not supported."))?,
+    };
+    Ok(LaunchRequest {
+        architecture: architecture.to_string(),
+        state_directory: directory(params, "stateDirectory")?,
+        workspace_state_directory: directory(params, "workspaceStateDirectory")?,
+        log_directory: directory(params, "logDirectory")?,
+        temporary_directory: directory(params, "temporaryDirectory")?,
+        heap_max_mb,
+        log_level: log_level.to_string(),
+        java_runtimes: jdt_java_runtimes(&host_java_tool(params)),
+    })
+}
+
+/// The `java` installation the host resolved, from the optional `tools`
+/// of the request. The contract has the host leave out a tool it could not
+/// find and promises only the fields it knows, so a missing or incomplete
+/// entry is no error: without a home or a version, the server cannot be
+/// pointed at the JDK, and the list stays empty.
+fn host_java_tool(params: &Value) -> Vec<JavaRuntimeCandidate> {
+    let Some(tool) = params.get("tools").and_then(|tools| tools.get("java")) else {
+        return Vec::new();
+    };
+    let field = |name: &str| {
+        tool.get(name)
+            .and_then(Value::as_str)
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+    };
+    match (field("home"), field("version")) {
+        (Some(home), Some(version)) => vec![JavaRuntimeCandidate {
+            is_default: true,
+            home_path: home.to_string(),
+            version: version.to_string(),
+        }],
+        _ => Vec::new(),
+    }
+}
+
+/// An absolute directory field of `resolveParams`, kept as the host wrote
+/// it: the host compares `writablePaths` with it as text.
+fn directory(params: &Value, field: &str) -> Result<PathBuf, PluginError> {
+    params
+        .get(field)
+        .and_then(Value::as_str)
+        .map(PathBuf::from)
+        .filter(|path| path.is_absolute())
+        .ok_or_else(|| invalid_params("The launch is missing a writable directory."))
+}
+
+fn invalid_params(message: &str) -> PluginError {
+    PluginError::new(LAUNCH_INVALID_PARAMS, message)
+}
+
+fn missing_resource(name: &str) -> PluginError {
+    PluginError::new(LAUNCH_RESOURCE_MISSING, missing_resource_message(name))
+}
+
+/// Root of the installed package: the parent of `bin/`, where the manifest
+/// installs the backend executable.
+pub fn package_root() -> Result<PathBuf, PluginError> {
+    let unavailable = || {
+        PluginError::new(
+            LAUNCH_PACKAGE_UNAVAILABLE,
+            "The Java Support plugin cannot find its installed files. Reinstall the plugin.",
+        )
+    };
+    let executable = std::env::current_exe()
+        .and_then(fs::canonicalize)
+        .map_err(|_| unavailable())?;
+    executable
+        .parent()
+        .and_then(Path::parent)
+        .map(Path::to_path_buf)
+        .ok_or_else(unavailable)
+}
+
+/// The package path of the Java runtime of `architecture`, as the answer's
+/// `executable.path` names it.
+pub fn runtime_executable(architecture: &str) -> String {
+    format!("{RUNTIME_DIRECTORY}/{architecture}/bin/java")
+}
+
+/// Finds the JDT LS files of `architecture` in the package at `package_root`.
+pub fn locate_launch_files(
+    package_root: &Path,
+    architecture: &str,
+) -> Result<LaunchFiles, PluginError> {
+    if !package_root
+        .join(runtime_executable(architecture))
+        .is_file()
+    {
+        return Err(missing_resource("the Java runtime"));
+    }
+    let launcher_jar = launcher_in(&package_root.join(LAUNCHER_DIRECTORY))
+        .ok_or_else(|| missing_resource("the JDT LS launcher"))?;
+    let packaged_configuration = package_root
+        .join(CONFIGURATION_DIRECTORY)
+        .join(architecture);
+    if !packaged_configuration.is_dir() {
+        return Err(missing_resource("the JDT LS configuration"));
+    }
+    let lombok_agent = package_root.join(LOMBOK_AGENT);
+    if !lombok_agent.is_file() {
+        return Err(missing_resource("the Lombok agent"));
+    }
+    let extension_bundles = EXTENSION_BUNDLE_DIRECTORIES
+        .iter()
+        .flat_map(|directory| bundles_in(&package_root.join(directory)))
+        .collect();
+    Ok(LaunchFiles {
+        launcher_jar,
+        lombok_agent,
+        packaged_configuration,
+        extension_bundles,
+    })
+}
+
+/// The one Equinox launcher JAR in `directory`. None or several mean the
+/// package is damaged.
+fn launcher_in(directory: &Path) -> Option<PathBuf> {
+    let mut launchers: Vec<PathBuf> = fs::read_dir(directory)
+        .ok()?
+        .filter_map(Result::ok)
+        .map(|entry| entry.path())
+        .filter(|path| {
+            path.file_name()
+                .and_then(|name| name.to_str())
+                .is_some_and(|name| {
+                    name.starts_with(LAUNCHER_PREFIX) && name.ends_with(LAUNCHER_SUFFIX)
+                })
+                && path.is_file()
+        })
+        .collect();
+    if launchers.len() == 1 {
+        launchers.pop()
+    } else {
+        None
+    }
+}
+
+/// The `-data` directory of the workspace.
+pub fn data_directory(request: &LaunchRequest) -> PathBuf {
+    request.workspace_state_directory.join(DATA_DIRECTORY)
+}
+
+/// The complete JDT LS command line after the `java` executable.
+///
+/// The plugin's own choices (heap, log level, the Equinox log in
+/// `logDirectory`, `java.io.tmpdir` in `temporaryDirectory`) go before
+/// `-jar <launcher>`; [`direct_java_arguments`] adds what JDT LS always
+/// needs (the Lombok agent, `--add-opens`, the Equinox properties, the
+/// tuning defaults), `-configuration <configuration_directory>` and
+/// `-data <workspaceStateDirectory>/data`.
+pub fn jdtls_arguments(
+    request: &LaunchRequest,
+    files: &LaunchFiles,
+    configuration_directory: &Path,
+) -> Vec<String> {
+    let plugin_arguments = vec![
+        format!("-Xmx{}m", request.heap_max_mb),
+        format!("-Dlog.level={}", request.log_level),
+        format!(
+            "-Dosgi.logfile={}",
+            request.log_directory.join(LOG_FILE).to_string_lossy()
+        ),
+        "-Declipse.log.include.commandline=false".to_string(),
+        "-Declipse.log.size.max=1024".to_string(),
+        "-Declipse.log.backup.max=2".to_string(),
+        // No `-Declipse.log.level=WARNING`: JDT LS 1.61 reads the date of the
+        // first Platform log event it saw when the client connects
+        // (`LogHandler.setClientConnection` -> `LogReader.parseLogFile`), and
+        // that event is its own INFO "is started" entry. Filtering INFO out
+        // leaves the date null and the server dies with a
+        // NullPointerException before it answers `initialize`. The client
+        // mask `-Dlog.level` above is what limits what reaches the editor.
+        format!(
+            "-Djava.io.tmpdir={}",
+            request.temporary_directory.to_string_lossy()
+        ),
+        "-jar".to_string(),
+        files.launcher_jar.to_string_lossy().into_owned(),
+    ];
+    let resources = JdtDirectLaunchResources {
+        launcher_jar_path: files.launcher_jar.clone(),
+        configuration_directory: configuration_directory.to_path_buf(),
+        lombok_agent_path: files.lombok_agent.clone(),
+        java_debug_bundle_path: None,
+    };
+    direct_java_arguments(&plugin_arguments, &resources, &data_directory(request))
+}
+
+/// The gate that holds the backend's requests until JDT LS reports
+/// `language/status` `ServiceReady`. Before that JDT LS answers project
+/// commands and class file requests with errors or stale results.
+pub fn service_ready_gate() -> Value {
+    json!({
+        "id": SERVICE_READY_GATE_ID,
+        "until": "notification",
+        "method": LANGUAGE_STATUS,
+        "match": {"type": SERVICE_READY},
+    })
+}
+
+/// Resolves the launch for `request` from the package at `package_root`.
+///
+/// `fragments` are the settings other plugins contributed for the
+/// workspace, as the settings session last collected them. The function
+/// prepares the configuration area under `stateDirectory`, which is the only
+/// write it makes; a failed cleanup of older areas is reported through
+/// `report` and does not fail the launch.
+pub fn resolve(
+    request: &LaunchRequest,
+    package_root: &Path,
+    fragments: &[Value],
+    trigger_files: &[String],
+    now_unix_seconds: u64,
+    report: &dyn Fn(&str, u64),
+) -> Result<Value, PluginError> {
+    let files = locate_launch_files(package_root, &request.architecture)?;
+    let area = prepare_jdt_configuration_area(
+        &request.state_directory,
+        &files.packaged_configuration,
+        now_unix_seconds,
+    )
+    .map_err(|error| PluginError::new(LAUNCH_CONFIGURATION_FAILED, error.message))?;
+    if area.cleanup_failure.is_some() {
+        report(LAUNCH_CONFIGURATION_CLEANUP_FAILED, 1);
+    }
+    // Equinox also writes `../p2` next to the `-configuration` directory, so
+    // the whole area is writable.
+    let area_root = area
+        .directory
+        .parent()
+        .map_or_else(|| area.directory.clone(), Path::to_path_buf);
+    let mut initialization_options = adapt_initialization_options(
+        SERVER_ID,
+        None,
+        &files.extension_bundles,
+        jdt_settings(fragments, &request.java_runtimes),
+    )
+    .unwrap_or_else(|| json!({}));
+    add_trigger_files(&mut initialization_options, trigger_files);
+    let writable_paths: Vec<Value> = [
+        area_root,
+        data_directory(request),
+        request.log_directory.clone(),
+        request.temporary_directory.clone(),
+    ]
+    .iter()
+    .map(|path| Value::String(path.to_string_lossy().into_owned()))
+    .collect();
+    Ok(json!({
+        "executable": {
+            "kind": "packaged",
+            "path": runtime_executable(&request.architecture),
+        },
+        "arguments": jdtls_arguments(request, &files, &area.directory),
+        // JDT LS needs no variable beyond the ones the host passes.
+        "environment": {},
+        "initializationOptions": initialization_options,
+        "workspaceConfiguration": java_configuration(fragments, &request.java_runtimes),
+        "gates": [service_ready_gate()],
+        "writablePaths": writable_paths,
+    }))
+}
+
+/// The local paths of the workspace's folders, from the host's
+/// `workspace/getFolders`. A remote workspace lists folders without a path,
+/// which leaves the result empty.
+fn workspace_folders(host: &Host, workspace: &WorkspaceContext) -> Result<Vec<PathBuf>, SdkError> {
+    let answer = host.workspace().get_folders(workspace)?;
+    Ok(answer
+        .get("folders")
+        .and_then(Value::as_array)
+        .map(|folders| {
+            folders
+                .iter()
+                .filter_map(|folder| folder.get("path").and_then(Value::as_str))
+                .filter(|path| !path.is_empty())
+                .map(PathBuf::from)
+                .collect()
+        })
+        .unwrap_or_default())
+}
+
+/// The `triggerFiles` of a launch: `file:` URIs of up to
+/// [`TRIGGER_FILE_LIMIT`] `.java` files found under `folders`, folders and
+/// entries in sorted order so the same workspace always names the same files.
+/// The scan stops at [`TRIGGER_SCAN_DEPTH`] levels, skips hidden directories
+/// and [`TRIGGER_SCAN_SKIPPED_DIRECTORIES`], does not follow symbolic links,
+/// and reads at most [`TRIGGER_SCAN_ENTRY_BUDGET`] entries. A folder that
+/// cannot be read contributes nothing; JDT LS treats a missing list as
+/// "nothing to import".
+pub fn trigger_files(folders: &[PathBuf]) -> Vec<String> {
+    let mut files = Vec::new();
+    let mut budget = TRIGGER_SCAN_ENTRY_BUDGET;
+    let mut roots: Vec<&PathBuf> = folders.iter().collect();
+    roots.sort();
+    roots.dedup();
+    for root in roots {
+        // Breadth first, so the files nearest the folder come first and a
+        // deep tree cannot use up the limit before a shallow source root.
+        let mut pending = VecDeque::from([(root.clone(), 0usize)]);
+        while let Some((directory, depth)) = pending.pop_front() {
+            let Ok(entries) = fs::read_dir(&directory) else {
+                continue;
+            };
+            let mut entries: Vec<_> = entries.filter_map(Result::ok).collect();
+            entries.sort_by_key(|entry| entry.file_name());
+            let mut subdirectories = Vec::new();
+            for entry in entries {
+                if budget == 0 {
+                    return files;
+                }
+                budget -= 1;
+                let name = entry.file_name();
+                let Some(name) = name.to_str() else {
+                    continue;
+                };
+                let Ok(kind) = entry.file_type() else {
+                    continue;
+                };
+                if kind.is_dir() {
+                    let skipped =
+                        name.starts_with('.') || TRIGGER_SCAN_SKIPPED_DIRECTORIES.contains(&name);
+                    if depth < TRIGGER_SCAN_DEPTH && !skipped {
+                        subdirectories.push((entry.path(), depth + 1));
+                    }
+                } else if kind.is_file() && name.ends_with(".java") && !name.starts_with('.') {
+                    files.push(file_uri(&entry.path()));
+                    if files.len() >= TRIGGER_FILE_LIMIT {
+                        return files;
+                    }
+                }
+            }
+            pending.extend(subdirectories);
+        }
+    }
+    files
+}
+
+/// Seconds since the Unix epoch; a clock before 1970 counts as 0, which only
+/// makes the configuration areas look older to the retention.
+fn now_unix_seconds() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map_or(0, |elapsed| elapsed.as_secs())
+}
+
+/// Runs a call of `java.resolveLaunch`.
+///
+/// The workspace comes from the call's `context`. The settings are the ones
+/// the session last collected for it; on the first start of a workspace that
+/// is only the plugin's own settings, and the session pushes the contributed
+/// ones once the server runs.
+pub fn resolve_launch_function(
+    session: &SettingsSession,
+    params: Value,
+    context: &Context,
+) -> Result<Value, FunctionError> {
+    context.check_cancelled()?;
+    let request = parse_launch_params(&params)?;
+    let package_root = package_root()?;
+    let diagnostics = context.diagnostics();
+    let operation = context.function_id().to_owned();
+    // An error from `degraded` only means the arguments were invalid, so the
+    // call's own result stands.
+    let report = move |code: &str, count: u64| {
+        let _ = diagnostics.degraded(&operation, code, Some(count));
+    };
+    let (fragments, folders) = match context.workspace_context() {
+        Some(workspace) => {
+            // The pushes after this start repeat the runtimes it configures.
+            session.set_java_runtimes(workspace, request.java_runtimes.clone());
+            let folders = match workspace_folders(context.host(), workspace) {
+                Ok(folders) => folders,
+                Err(_) => {
+                    // The launch stands without the folders; JDT LS then lays
+                    // out a plain workspace from the first opened file.
+                    report(LAUNCH_WORKSPACE_FOLDERS_UNAVAILABLE, 1);
+                    Vec::new()
+                }
+            };
+            (session.start_fragments(workspace.context_id()), folders)
+        }
+        None => (Vec::new(), Vec::new()),
+    };
+    let trigger_files = trigger_files(&folders);
+    context.check_cancelled()?;
+    let answer = resolve(
+        &request,
+        &package_root,
+        &fragments,
+        &trigger_files,
+        now_unix_seconds(),
+        &report,
+    )?;
+    context.check_cancelled()?;
+    Ok(answer)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::atomic::{AtomicU64, Ordering};
+    use std::sync::Mutex;
+
+    const LAUNCHER: &str =
+        "language-server/plugins/org.eclipse.equinox.launcher_1.8.0.v20260804-1928.jar";
+
+    /// A package laid out like the assembled one, and the host's four
+    /// directories, in a fresh directory that is removed on drop.
+    struct Fixture {
+        root: PathBuf,
+    }
+
+    impl Fixture {
+        fn new() -> Self {
+            static NEXT: AtomicU64 = AtomicU64::new(0);
+            let root = std::env::temp_dir().join(format!(
+                "lithe-java-launch-{}-{}",
+                std::process::id(),
+                NEXT.fetch_add(1, Ordering::SeqCst)
+            ));
+            let _ = fs::remove_dir_all(&root);
+            let package = root.join("package");
+            for directory in [
+                "runtime/arm64/bin",
+                "language-server/plugins",
+                "language-server/configuration/arm64",
+                "language-server/lombok",
+                "language-server/java-debug",
+                "language-server/java-test/extensions",
+            ] {
+                fs::create_dir_all(package.join(directory)).unwrap();
+            }
+            for file in [
+                "runtime/arm64/bin/java",
+                LAUNCHER,
+                "language-server/plugins/org.eclipse.jdt.ls.core_1.50.0.jar",
+                "language-server/lombok/lombok.jar",
+                "language-server/java-debug/com.microsoft.java.debug.plugin-0.53.0.jar",
+                "language-server/java-test/extensions/b.jar",
+                "language-server/java-test/extensions/a.jar",
+                "language-server/java-test/extensions/notes.txt",
+            ] {
+                fs::write(package.join(file), b"").unwrap();
+            }
+            fs::write(
+                package.join("language-server/configuration/arm64/config.ini"),
+                b"osgi.bundles=example\n",
+            )
+            .unwrap();
+            for directory in ["state", "workspace-state", "log", "tmp"] {
+                fs::create_dir_all(root.join(directory)).unwrap();
+            }
+            Fixture { root }
+        }
+
+        fn package(&self) -> PathBuf {
+            self.root.join("package")
+        }
+
+        fn params(&self) -> Value {
+            json!({
+                "serverID": "java",
+                "platform": {"os": "macos", "arch": "arm64"},
+                "stateDirectory": self.root.join("state"),
+                "workspaceStateDirectory": self.root.join("workspace-state"),
+                "logDirectory": self.root.join("log"),
+                "temporaryDirectory": self.root.join("tmp"),
+                "settings": {"heapMaxMB": 4096, "logLevel": "INFO"},
+            })
+        }
+
+        fn request(&self) -> LaunchRequest {
+            parse_launch_params(&self.params()).unwrap()
+        }
+    }
+
+    impl Drop for Fixture {
+        fn drop(&mut self) {
+            let _ = fs::remove_dir_all(&self.root);
+        }
+    }
+
+    fn resolve_fixture(fixture: &Fixture, fragments: &[Value]) -> (Value, Vec<String>) {
+        let reports = Mutex::new(Vec::new());
+        let answer = {
+            let report = |code: &str, _count: u64| reports.lock().unwrap().push(code.to_string());
+            resolve(
+                &fixture.request(),
+                &fixture.package(),
+                fragments,
+                &[],
+                1_000_000,
+                &report,
+            )
+            .unwrap()
+        };
+        (answer, reports.into_inner().unwrap())
+    }
+
+    fn strings(value: &Value) -> Vec<String> {
+        value
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|item| item.as_str().unwrap().to_string())
+            .collect()
+    }
+
+    #[test]
+    fn the_params_are_read_with_the_declared_defaults() {
+        let fixture = Fixture::new();
+        let request = fixture.request();
+        assert_eq!(request.architecture, "arm64");
+        assert_eq!(request.heap_max_mb, 4096);
+        assert_eq!(request.log_level, "INFO");
+        assert_eq!(request.state_directory, fixture.root.join("state"));
+
+        let mut params = fixture.params();
+        params["settings"] = json!({});
+        let request = parse_launch_params(&params).unwrap();
+        assert_eq!(request.heap_max_mb, DEFAULT_HEAP_MAX_MB);
+        assert_eq!(request.log_level, DEFAULT_LOG_LEVEL);
+    }
+
+    #[test]
+    fn unusable_params_are_refused_with_one_code() {
+        let fixture = Fixture::new();
+        let edits: Vec<(&str, Value)> = vec![
+            ("/serverID", json!("kotlin")),
+            ("/platform/arch", json!("sparc")),
+            ("/stateDirectory", json!("relative/state")),
+            ("/workspaceStateDirectory", Value::Null),
+            ("/settings/heapMaxMB", json!(1024)),
+            ("/settings/heapMaxMB", json!("4096")),
+            ("/settings/logLevel", json!("DEBUG")),
+        ];
+        for (pointer, value) in edits {
+            let mut params = fixture.params();
+            *params.pointer_mut(pointer).unwrap() = value;
+            let error = parse_launch_params(&params).unwrap_err();
+            assert_eq!(error.code(), LAUNCH_INVALID_PARAMS, "{pointer}");
+        }
+        assert_eq!(
+            parse_launch_params(&json!({})).unwrap_err().code(),
+            LAUNCH_INVALID_PARAMS
+        );
+    }
+
+    #[test]
+    fn the_answer_runs_the_packaged_runtime_with_the_full_command_line() {
+        let fixture = Fixture::new();
+        let (answer, reports) = resolve_fixture(&fixture, &[]);
+        assert!(reports.is_empty());
+        assert_eq!(
+            answer["executable"],
+            json!({"kind": "packaged", "path": "runtime/arm64/bin/java"})
+        );
+        let arguments = strings(&answer["arguments"]);
+        let package = fixture.package();
+        let launcher = package.join(LAUNCHER).to_string_lossy().into_owned();
+        let lombok = package.join("language-server/lombok/lombok.jar");
+        assert_eq!(
+            arguments[0],
+            format!("-javaagent:{}", lombok.to_string_lossy())
+        );
+        for expected in [
+            "-Xms256m",
+            "-Xmx4096m",
+            "-Dlog.level=INFO",
+            "--add-modules=ALL-SYSTEM",
+            "--add-opens=java.base/java.util=ALL-UNNAMED",
+            "--add-opens=java.base/java.lang=ALL-UNNAMED",
+            "-Declipse.application=org.eclipse.jdt.ls.core.id1",
+            "-Declipse.product=org.eclipse.jdt.ls.core.product",
+            "-Declipse.log.size.max=1024",
+        ] {
+            assert!(
+                arguments.iter().any(|argument| argument == expected),
+                "{expected}"
+            );
+        }
+        assert!(!arguments.iter().any(|argument| argument == "-Xmx2048m"));
+        // The Equinox log filter would crash JDT LS 1.61 at `initialize`.
+        assert!(!arguments
+            .iter()
+            .any(|argument| argument.starts_with("-Declipse.log.level=")));
+        let log_file = fixture.root.join("log").join("jdt.log");
+        assert!(arguments.contains(&format!("-Dosgi.logfile={}", log_file.to_string_lossy())));
+        let temporary = fixture.root.join("tmp");
+        assert!(arguments.contains(&format!("-Djava.io.tmpdir={}", temporary.to_string_lossy())));
+
+        // `-jar <launcher> -configuration <area> ... -data <data>` closes the
+        // line, and every JVM option comes before `-jar`.
+        let jar = arguments
+            .iter()
+            .position(|argument| argument == "-jar")
+            .unwrap();
+        assert_eq!(arguments[jar + 1], launcher);
+        assert_eq!(arguments[jar + 2], "-configuration");
+        let configuration = PathBuf::from(&arguments[jar + 3]);
+        assert!(configuration.starts_with(fixture.root.join("state")));
+        assert!(configuration.join("config.ini").is_file());
+        assert!(!configuration.starts_with(&package));
+        let data = fixture.root.join("workspace-state").join("data");
+        assert_eq!(
+            arguments[arguments.len() - 2..].to_vec(),
+            vec!["-data".to_string(), data.to_string_lossy().into_owned()]
+        );
+        assert!(arguments[..jar]
+            .iter()
+            .all(|argument| argument.starts_with('-')));
+    }
+
+    #[test]
+    fn the_answer_loads_the_bundles_and_waits_for_service_ready() {
+        let fixture = Fixture::new();
+        let (answer, _) = resolve_fixture(&fixture, &[]);
+        let package = fixture.package();
+        let expected: Vec<String> = [
+            "language-server/java-debug/com.microsoft.java.debug.plugin-0.53.0.jar",
+            "language-server/java-test/extensions/a.jar",
+            "language-server/java-test/extensions/b.jar",
+        ]
+        .iter()
+        .map(|bundle| package.join(bundle).to_string_lossy().into_owned())
+        .collect();
+        assert_eq!(
+            strings(&answer["initializationOptions"]["bundles"]),
+            expected
+        );
+        assert_eq!(
+            answer["initializationOptions"]["extendedClientCapabilities"]
+                ["classFileContentsSupport"],
+            json!(true)
+        );
+        assert_eq!(
+            answer["gates"],
+            json!([{
+                "id": "service-ready",
+                "until": "notification",
+                "method": "language/status",
+                "match": {"type": "ServiceReady"},
+            }])
+        );
+        assert_eq!(answer["environment"], json!({}));
+    }
+
+    #[test]
+    fn every_write_lies_in_a_host_directory() {
+        let fixture = Fixture::new();
+        let (answer, _) = resolve_fixture(&fixture, &[]);
+        let writable = strings(&answer["writablePaths"]);
+        assert_eq!(writable.len(), 4);
+        let hosts: Vec<String> = ["state", "workspace-state", "log", "tmp"]
+            .iter()
+            .map(|directory| fixture.root.join(directory).to_string_lossy().into_owned())
+            .collect();
+        for path in &writable {
+            assert!(
+                hosts
+                    .iter()
+                    .any(|host| path == host || path.starts_with(&format!("{host}/"))),
+                "{path}"
+            );
+        }
+        let arguments = strings(&answer["arguments"]);
+        let configuration = arguments
+            .windows(2)
+            .find(|pair| pair[0] == "-configuration")
+            .map(|pair| PathBuf::from(&pair[1]))
+            .unwrap();
+        assert!(writable
+            .iter()
+            .any(|path| configuration.starts_with(path) && path.starts_with(&hosts[0])));
+    }
+
+    #[test]
+    fn the_startup_settings_are_the_settings_a_push_sends() {
+        let fixture = Fixture::new();
+        let fragments = vec![json!({"java": {"import": {"maven": {"enabled": true}}}})];
+        let (answer, _) = resolve_fixture(&fixture, &fragments);
+        assert_eq!(
+            answer["workspaceConfiguration"],
+            java_configuration(&fragments, &[])
+        );
+        assert_eq!(
+            answer["initializationOptions"]["settings"]["java"],
+            answer["workspaceConfiguration"]["java"]
+        );
+        let (answer, _) = resolve_fixture(&fixture, &[]);
+        assert_eq!(
+            answer["workspaceConfiguration"],
+            java_configuration(&[], &[])
+        );
+        assert!(answer
+            .pointer("/initializationOptions/settings/java/configuration/runtimes")
+            .is_none());
+    }
+
+    #[test]
+    fn the_java_tool_the_host_resolved_is_the_default_runtime() {
+        let fixture = Fixture::new();
+        let mut params = fixture.params();
+        params["tools"] = json!({
+            "java": {"executable": "/jdk/17/bin/java", "home": "/jdk/17", "version": "17.0.19"}
+        });
+        let request = parse_launch_params(&params).unwrap();
+        let expected = json!([{"name": "JavaSE-17", "path": "/jdk/17", "default": true}]);
+        assert_eq!(
+            request.java_runtimes,
+            vec![JdtJavaRuntime {
+                is_default: true,
+                name: "JavaSE-17".to_string(),
+                path: "/jdk/17".to_string(),
+            }]
+        );
+        let report = |_: &str, _: u64| {};
+        let answer = resolve(&request, &fixture.package(), &[], &[], 1_000_000, &report).unwrap();
+        assert_eq!(
+            answer["initializationOptions"]["settings"]["java"]["configuration"]["runtimes"],
+            expected
+        );
+        assert_eq!(
+            answer["workspaceConfiguration"]["java"]["configuration"]["runtimes"],
+            expected
+        );
+
+        // A tool chosen by executable has no home; a host that found nothing
+        // sends no entry. Neither configures a runtime.
+        for tools in [
+            json!({"java": {"executable": "/usr/bin/java"}}),
+            json!({"java": {"executable": "/usr/bin/java", "home": " ", "version": "17"}}),
+            json!({"gradle": {"executable": "/g/bin/gradle", "home": "/g", "version": "8"}}),
+            json!({}),
+        ] {
+            params["tools"] = tools;
+            assert!(parse_launch_params(&params)
+                .unwrap()
+                .java_runtimes
+                .is_empty());
+        }
+    }
+
+    #[test]
+    fn a_damaged_package_names_the_missing_file() {
+        for (remove, expected) in [
+            ("runtime/arm64/bin/java", "the Java runtime"),
+            (LAUNCHER, "the JDT LS launcher"),
+            ("language-server/lombok/lombok.jar", "the Lombok agent"),
+        ] {
+            let fixture = Fixture::new();
+            fs::remove_file(fixture.package().join(remove)).unwrap();
+            let error = locate_launch_files(&fixture.package(), "arm64").unwrap_err();
+            assert_eq!(error.code(), LAUNCH_RESOURCE_MISSING, "{remove}");
+            assert_eq!(error.message(), missing_resource_message(expected));
+        }
+
+        // The package has no runtime for this architecture.
+        let fixture = Fixture::new();
+        let error = locate_launch_files(&fixture.package(), "x86_64").unwrap_err();
+        assert_eq!(error.code(), LAUNCH_RESOURCE_MISSING);
+
+        // Two launchers leave the choice open.
+        let fixture = Fixture::new();
+        fs::write(
+            fixture
+                .package()
+                .join("language-server/plugins/org.eclipse.equinox.launcher_1.9.0.jar"),
+            b"",
+        )
+        .unwrap();
+        let error = locate_launch_files(&fixture.package(), "arm64").unwrap_err();
+        assert_eq!(error.code(), LAUNCH_RESOURCE_MISSING);
+    }
+
+    #[test]
+    fn launch_codes_are_distinct_valid_plugin_codes() {
+        let all: std::collections::BTreeSet<&str> = LAUNCH_ERROR_CODES
+            .iter()
+            .chain(LAUNCH_CATEGORIES)
+            .copied()
+            .collect();
+        assert_eq!(
+            all.len(),
+            LAUNCH_ERROR_CODES.len() + LAUNCH_CATEGORIES.len()
+        );
+        assert!(all
+            .iter()
+            .all(|code| lithe_plugin_sdk::is_plugin_error_code(code)));
+        assert!(lithe_plugin_sdk::is_function_id(LAUNCH_FUNCTION_ID));
+    }
+
+    #[test]
+    fn trigger_files_name_java_files_in_order_and_skip_hidden_and_build_trees() {
+        let fixture = Fixture::new();
+        let workspace = fixture.root.join("workspace");
+        for directory in [
+            "src/demo",
+            "src/.hidden",
+            "target/classes",
+            "node_modules/x",
+            "lib",
+            "a/b/c/d/e/f/g/h/i",
+        ] {
+            fs::create_dir_all(workspace.join(directory)).unwrap();
+        }
+        for file in [
+            "src/demo/Main.java",
+            "src/demo/notes.txt",
+            "src/.hidden/Hidden.java",
+            "target/classes/Generated.java",
+            "node_modules/x/Dep.java",
+            "lib/Util.java",
+            "lib/.Dot.java",
+            "a/b/c/d/e/f/g/h/i/Deep.java",
+        ] {
+            fs::write(workspace.join(file), b"").unwrap();
+        }
+        let files = trigger_files(&[workspace.clone(), workspace.clone()]);
+        assert_eq!(
+            files,
+            vec![
+                file_uri(&workspace.join("lib/Util.java")),
+                file_uri(&workspace.join("src/demo/Main.java")),
+            ]
+        );
+        assert!(trigger_files(&[fixture.root.join("missing")]).is_empty());
+        assert!(trigger_files(&[]).is_empty());
+    }
+
+    #[test]
+    fn trigger_files_stop_at_the_limit() {
+        let fixture = Fixture::new();
+        let workspace = fixture.root.join("many");
+        fs::create_dir_all(&workspace).unwrap();
+        for index in 0..(TRIGGER_FILE_LIMIT + 5) {
+            fs::write(workspace.join(format!("C{index:03}.java")), b"").unwrap();
+        }
+        assert_eq!(trigger_files(&[workspace]).len(), TRIGGER_FILE_LIMIT);
+    }
+
+    #[test]
+    fn resolve_passes_trigger_files_to_the_initialization_options() {
+        let fixture = Fixture::new();
+        let report = |_: &str, _: u64| {};
+        let trigger = vec!["file:///w/src/demo/Main.java".to_string()];
+        let answer = resolve(
+            &fixture.request(),
+            &fixture.package(),
+            &[],
+            &trigger,
+            1_000_000,
+            &report,
+        )
+        .unwrap();
+        assert_eq!(
+            answer["initializationOptions"]["triggerFiles"],
+            json!(["file:///w/src/demo/Main.java"])
+        );
+        let (answer, _) = resolve_fixture(&fixture, &[]);
+        assert!(answer["initializationOptions"]
+            .get("triggerFiles")
+            .is_none());
+    }
+}
diff --git a/backend/src/lib.rs b/backend/src/lib.rs
index 38db997..c5e2390 100644
--- a/backend/src/lib.rs
+++ b/backend/src/lib.rs
@@ -6,9 +6,18 @@
 //! other plugins contribute. The plugin manifest declares it as the plugin's
 //! `backend`.
 //!
-//! The Java rules themselves still run in the host for the editor providers,
-//! run configurations and the Java test workflow; the backend is where they
-//! move, one host API at a time (see `MIGRATION.md`).
+//! The run, debug and test actions of Java files are the backend's own as
+//! well ([`run`]): it collects them through editor actions and starts the
+//! processes through the host's `run/start` method. What still waits for a
+//! host API is listed in `MIGRATION.md`.
+//!
+//! # Language server launch (serverProcess 3)
+//!
+//! The manifest declares the `java` language server with
+//! `launch.kind: "backend"`, so the host asks [`launch`] for the JDT LS
+//! command line, initialization options and startup settings before each
+//! start. The launch reads the settings the [`settings_session`] knows for
+//! the workspace, so a restart starts with the last pushed settings.
 //!
 //! # Cross-plugin settings (API-35)
 //!
@@ -38,9 +47,16 @@
 //! `settings_session::SESSION_CATEGORIES`. The backend never writes to
 //! stderr, and a fact carries no path, source or tool output.
 
+pub mod launch;
 pub mod plugin_functions;
+pub mod run;
 pub mod settings_session;
 
+use crate::launch::LAUNCH_FUNCTION_ID;
+use crate::run::{
+    RunSession, COLLECT_FUNCTION_ID, LANGUAGE_SERVER_NOTIFICATION, RERUN_FUNCTION_ID,
+    RESOLVE_LINK_FUNCTION_ID, RUN_ACTION_FUNCTION_ID, RUN_DID_EXIT_NOTIFICATION,
+};
 use crate::settings_session::{
     HostServices, SettingsSession, LANGUAGE_SERVER_STATE_NOTIFICATION, SETTINGS_CHANGED_FUNCTION_ID,
 };
@@ -66,10 +82,19 @@ const NOTIFICATION_OPERATION: &str = "notification";
 /// `languageImport.settingsChanged` is a key operation: another plugin
 /// reports a change a user made, it happens rarely, and its success is the
 /// only trace that the change reached the language server.
+/// `java.resolveLaunch` is one too: it runs once per language server start
+/// and its success is the only trace of which package files the server
+/// started from. `java.runAction` and `java.rerun` are key operations
+/// because each is one user click that starts a process; collection and
+/// output link resolution run on every edit and every output line, so their
+/// successes are suppressed.
 pub const KEY_OPERATIONS: &[&str] = &[
     "debug.javaTestLaunch",
     "execution.planLaunchCommand",
     "java.prepareLaunch",
+    LAUNCH_FUNCTION_ID,
+    RERUN_FUNCTION_ID,
+    RUN_ACTION_FUNCTION_ID,
     SETTINGS_CHANGED_FUNCTION_ID,
     "runConfig.selectJava",
 ];
@@ -78,8 +103,9 @@ pub const KEY_OPERATIONS: &[&str] = &[
 ///
 /// A function can only be suppressed once it is registered, so the successes
 /// of the functions outside [`KEY_OPERATIONS`] are suppressed after the
-/// registration loop. `languageImport.settingsChanged` is registered after
-/// that loop and is a key operation, so it needs no suppression.
+/// registration loop. `languageImport.settingsChanged` and
+/// `java.resolveLaunch` are registered after that loop and are key
+/// operations, so they need no suppression.
 ///
 /// Every input is a compile-time constant, so the result is the same on each
 /// run: it fails only when a function ID is invalid, repeated or over the
@@ -120,9 +146,69 @@ pub fn backend() -> Result<Backend, SdkError> {
             Ok(())
         }
     })?;
-    backend.function(SETTINGS_CHANGED_FUNCTION_ID, move |params, context| {
-        settings_changed(&session, params, context)
+    backend.function(SETTINGS_CHANGED_FUNCTION_ID, {
+        let session = Arc::clone(&session);
+        move |params, context| settings_changed(&session, params, context)
+    })?;
+    backend.function(LAUNCH_FUNCTION_ID, move |params, context| {
+        launch::resolve_launch_function(&session, params, context)
+    })?;
+
+    // The run session registers the editor actions of every workspace context
+    // and keeps the result listener of each test run; both happen outside a
+    // function call, so it holds the backend handle too.
+    let run_session = Arc::new(RunSession::new(backend.handle()));
+    let report: run::Report = {
+        let handle = backend.handle();
+        Arc::new(move |code: &str, count: u64| {
+            let _ = handle
+                .diagnostics()
+                .degraded(NOTIFICATION_OPERATION, code, Some(count));
+        })
+    };
+    backend.on_initialize({
+        let run_session = Arc::clone(&run_session);
+        let report = Arc::clone(&report);
+        move |_initialize| {
+            run_session.sync_after_initialize(Arc::clone(&report));
+            Ok(())
+        }
+    });
+    backend.on_contexts_changed({
+        let run_session = Arc::clone(&run_session);
+        let report = Arc::clone(&report);
+        move |_params| {
+            run_session.sync_contexts_reporting(&*report);
+            Ok(())
+        }
+    });
+    backend.on_host_notification(RUN_DID_EXIT_NOTIFICATION, {
+        let run_session = Arc::clone(&run_session);
+        move |params| {
+            run_session.run_did_exit(&params);
+            Ok(())
+        }
+    })?;
+    backend.on_host_notification(LANGUAGE_SERVER_NOTIFICATION, {
+        let run_session = Arc::clone(&run_session);
+        let report = Arc::clone(&report);
+        move |params| {
+            run_session.did_receive_notification(&params, &*report);
+            Ok(())
+        }
+    })?;
+    backend.function(COLLECT_FUNCTION_ID, run::collect_actions_function)?;
+    backend.suppress_success_diagnostics(COLLECT_FUNCTION_ID)?;
+    backend.function(RUN_ACTION_FUNCTION_ID, {
+        let run_session = Arc::clone(&run_session);
+        move |params, context| run::run_action_function(&run_session, params, context)
+    })?;
+    backend.function(RERUN_FUNCTION_ID, {
+        let run_session = Arc::clone(&run_session);
+        move |params, context| run::rerun_function(&run_session, params, context)
     })?;
+    backend.function(RESOLVE_LINK_FUNCTION_ID, run::resolve_output_link_function)?;
+    backend.suppress_success_diagnostics(RESOLVE_LINK_FUNCTION_ID)?;
     Ok(backend)
 }
 
@@ -263,9 +349,9 @@ mod tests {
             .all(|code| lithe_plugin_sdk::is_plugin_error_code(code)));
     }
 
-    /// An error code names one cause. The codes `settingsChanged` answers
-    /// with, the domain codes and the diagnostics categories of the settings
-    /// modules must never share a name.
+    /// An error code names one cause. The codes `settingsChanged` and
+    /// `java.resolveLaunch` answer with, the domain codes and the diagnostics
+    /// categories of the settings and launch modules must never share a name.
     #[test]
     fn settings_relay_codes_never_share_a_name_with_another_code() {
         let domain: Vec<&str> = [
@@ -290,6 +376,10 @@ mod tests {
             .iter()
             .chain(settings_session::SESSION_CATEGORIES)
             .chain(plugin_functions::RELAY_CATEGORIES)
+            .chain(launch::LAUNCH_ERROR_CODES)
+            .chain(launch::LAUNCH_CATEGORIES)
+            .chain(run::RUN_ERROR_CODES)
+            .chain(run::RUN_CATEGORIES)
         {
             assert!(seen.insert(*name), "{name} names two causes");
         }
@@ -309,12 +399,19 @@ mod tests {
 
     #[test]
     fn key_operations_are_registered_functions_without_duplicates() {
-        // The commands, and the one function registered next to them.
+        // The commands, and the functions registered next to them.
         let commands: std::collections::BTreeSet<&str> = SUPPORTED_COMMANDS
             .iter()
             .chain(SESSION_COMMANDS)
             .copied()
-            .chain([SETTINGS_CHANGED_FUNCTION_ID])
+            .chain([
+                SETTINGS_CHANGED_FUNCTION_ID,
+                LAUNCH_FUNCTION_ID,
+                COLLECT_FUNCTION_ID,
+                RUN_ACTION_FUNCTION_ID,
+                RERUN_FUNCTION_ID,
+                RESOLVE_LINK_FUNCTION_ID,
+            ])
             .collect();
         let distinct: std::collections::BTreeSet<&str> = KEY_OPERATIONS.iter().copied().collect();
         assert_eq!(
diff --git a/backend/src/run.rs b/backend/src/run.rs
new file mode 100644
index 0000000..e224cef
--- /dev/null
+++ b/backend/src/run.rs
@@ -0,0 +1,1392 @@
+//! Run, debug and test actions of Java files.
+//!
+//! The host collects the gutter actions of each open `.java` document through
+//! editor actions (host method `editor/registerActions`), and the backend
+//! starts the chosen target through the host's `run/start` method with the
+//! `java` tool the manifest requires. The Java rules (which declarations are
+//! runnable, how a test launch is planned, which runner arguments a framework
+//! needs) live in [`lithe_java_domain`]; this module only connects them to
+//! the host.
+//!
+//! # Flow
+//!
+//! 1. After `initialize`, and on each `didChangeContexts`, the
+//!    [`RunSession`] lists the workspace contexts and registers the collection
+//!    function [`COLLECT_FUNCTION_ID`] for `.java` files in each of them.
+//! 2. The host calls [`COLLECT_FUNCTION_ID`] with the document; the backend
+//!    asks JDT LS for the main methods and test items of the file and answers
+//!    one `Run` action per target, with a `Debug` alternative.
+//! 3. A click calls [`RUN_ACTION_FUNCTION_ID`] with the action's params. For
+//!    a main class the backend builds the workspace and resolves the classpath
+//!    through JDT LS; for a test it plans the launch and asks JDT LS for the
+//!    runner arguments. It then calls `run/start`, so the host's Run window
+//!    owns the process. `Rerun` comes back through [`RERUN_FUNCTION_ID`] with
+//!    the same params.
+//! 4. A test launch opens one loopback port the Eclipse JUnit runner reports
+//!    to. A listener thread counts the results and shows them in a window
+//!    message; it stops when the host reports `run/didExit`.
+//! 5. The output link matcher of the manifest asks
+//!    [`RESOLVE_LINK_FUNCTION_ID`] to turn a stack frame into a file of the
+//!    workspace.
+//!
+//! # Not yet covered
+//!
+//! - Long command lines are passed as they are. The domain's argfile planning
+//!   (`execution::launch_command`) is not applied, because macOS accepts the
+//!   lengths JDT LS produces for ordinary projects.
+//! - The result summary is English text until plugin backends can reach the
+//!   host's i18n service (API-37).
+
+use crate::launch::{self, TEST_RUNNER};
+use crate::settings_session::{EXECUTE_COMMAND, REQUEST_METHOD, SERVER_ID};
+use lithe_java_domain::debug::java_test_launch;
+use lithe_java_domain::lsp::languages::java_main_methods::{
+    java_main_methods_command, normalize_java_main_methods,
+};
+use lithe_java_domain::lsp::languages::java_tests::{
+    java_test_items_command, normalize_java_test_items, JavaTestItem as CollectedTestItem,
+};
+use lithe_java_domain::lsp::languages::{
+    java_run_markers, JavaRunMarker, JavaRunMarkerKind, JavaRunMarkersRequest, MainMethodInput,
+    RangeInput, TestItemInput,
+};
+use lithe_java_domain::testing::jdt_test_items::{self, JavaTestItem, LAUNCH_ARGUMENTS_COMMAND};
+use lithe_plugin_sdk::{
+    BackendHandle, Context, FunctionError, Host, PluginError, SdkError, Subscription, Value,
+    WorkspaceContext,
+};
+use serde_json::{json, Map};
+use std::collections::{HashMap, HashSet};
+use std::io::{BufRead, BufReader};
+use std::net::TcpListener;
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Mutex, MutexGuard, PoisonError};
+use std::thread;
+use std::time::{Duration, Instant};
+
+/// Function the host calls to collect the actions of one `.java` document.
+pub const COLLECT_FUNCTION_ID: &str = "java.collectActions";
+
+/// Function the host calls when the user clicks an action or an alternative.
+pub const RUN_ACTION_FUNCTION_ID: &str = "java.runAction";
+
+/// Function the host calls to rerun a finished run; its params are the data
+/// the start passed as `rerun.data`, which are the action's params.
+pub const RERUN_FUNCTION_ID: &str = "java.rerun";
+
+/// Function the manifest's output link matcher names: it maps a stack frame
+/// (`at pkg.Class.method(Class.java:12)`) to a file of the workspace.
+pub const RESOLVE_LINK_FUNCTION_ID: &str = "java.resolveOutputLink";
+
+/// Registration ID of the editor actions binding, the same in each context.
+pub const ACTIONS_BINDING_ID: &str = "javaRunActions";
+
+/// Host notification that reports a finished run: `{runID, exitCode?, signal?}`.
+pub const RUN_DID_EXIT_NOTIFICATION: &str = "lithe/host/run/didExit";
+
+/// Host notification that forwards a notification of a language server the
+/// manifest lists under `forwardNotifications`:
+/// `{context, serverID, generation, method, params?}`.
+pub const LANGUAGE_SERVER_NOTIFICATION: &str = "lithe/host/languageServer/didReceiveNotification";
+
+/// JDT LS notification that reports its service state.
+const LANGUAGE_STATUS_METHOD: &str = "language/status";
+
+/// `language/status` type that says the server answers workspace commands.
+const SERVICE_READY_TYPE: &str = "ServiceReady";
+
+/// Host method that starts a run owned by the host.
+const RUN_START_METHOD: &str = "lithe/host/run/start";
+
+/// Host method that lists the workspace contexts.
+const LIST_CONTEXTS_METHOD: &str = "lithe/host/workspace/listContexts";
+
+/// The tool definition of the manifest the run starts; `requiresTools` lists it.
+const RUN_TOOL: &str = "java";
+
+/// Debug configuration type of the manifest's `java` debug adapter.
+const DEBUG_CONFIGURATION_TYPE: &str = "java";
+
+/// JDT LS command that builds the workspace before a launch.
+const BUILD_WORKSPACE_COMMAND: &str = "vscode.java.buildWorkspace";
+
+/// JDT LS command that answers `[modulePaths, classPaths]` of a main class.
+const RESOLVE_CLASSPATH_COMMAND: &str = "vscode.java.resolveClasspath";
+
+/// `vscode.java.buildWorkspace` answer that means the build succeeded.
+const BUILD_SUCCEEDED: i64 = 1;
+
+/// `vscode.java.buildWorkspace` answer that means the build finished with
+/// compile errors; JDT LS still produces class files, so the launch goes on.
+const BUILD_WITH_ERRORS: i64 = 2;
+
+/// Timeout of the JDT LS requests a launch makes; a workspace build may take
+/// a while on a first run.
+const LAUNCH_REQUEST_TIMEOUT_MILLISECONDS: u64 = 120_000;
+
+/// Timeout of the JDT LS requests collection makes; the host bounds the whole
+/// collection to eight seconds.
+const COLLECT_REQUEST_TIMEOUT_MILLISECONDS: u64 = 6_000;
+
+/// Most actions one answer carries; the contract refuses more.
+const MAX_ACTIONS: usize = 1000;
+
+/// Most files `findFiles` returns for one stack frame.
+const LINK_SEARCH_LIMIT: u64 = 50;
+
+/// How long the result listener waits for the test runner to connect before
+/// it gives up on its own; the normal end is the `run/didExit` notification.
+const RESULT_CONNECTION_TIMEOUT: Duration = Duration::from_secs(600);
+
+/// How often the result listener checks the stop flag while waiting.
+const RESULT_POLL_INTERVAL: Duration = Duration::from_millis(100);
+
+/// How often the startup thread retries the first context sync while the
+/// session is not initialized yet, and how many times.
+const SYNC_RETRY_INTERVAL: Duration = Duration::from_millis(250);
+const SYNC_RETRY_ATTEMPTS: u32 = 40;
+
+/// Plugin error code of a call whose params do not have the documented shape.
+pub const RUN_INVALID_PARAMS: &str = "run.invalid_params";
+
+/// Plugin error code of a call without a workspace context.
+pub const RUN_CONTEXT_MISSING: &str = "run.context_missing";
+
+/// Plugin error code of a launch whose workspace has no local folder, so the
+/// process has no working directory.
+pub const RUN_WORKSPACE_UNAVAILABLE: &str = "run.workspace_unavailable";
+
+/// Plugin error code of a launch whose JDT LS request failed or answered an
+/// unexpected shape.
+pub const RUN_LANGUAGE_SERVER_FAILED: &str = "run.language_server_failed";
+
+/// Plugin error code of a launch whose workspace build failed or was cancelled.
+pub const RUN_BUILD_FAILED: &str = "run.build_failed";
+
+/// Plugin error code of a test launch whose file has no matching test.
+pub const RUN_NO_TESTS: &str = "run.no_tests";
+
+/// Plugin error code of a launch that could not open a loopback port.
+pub const RUN_PORT_UNAVAILABLE: &str = "run.port_unavailable";
+
+/// Plugin error code of a launch the host refused to start.
+pub const RUN_HOST_REJECTED: &str = "run.host_rejected";
+
+/// Every plugin error code the run functions answer with.
+pub const RUN_ERROR_CODES: &[&str] = &[
+    RUN_INVALID_PARAMS,
+    RUN_CONTEXT_MISSING,
+    RUN_WORKSPACE_UNAVAILABLE,
+    RUN_LANGUAGE_SERVER_FAILED,
+    RUN_BUILD_FAILED,
+    RUN_NO_TESTS,
+    RUN_PORT_UNAVAILABLE,
+    RUN_HOST_REJECTED,
+];
+
+/// Category reported when registering the actions binding in a context failed.
+pub const RUN_ACTIONS_REGISTRATION_FAILED: &str = "run.actions_registration_failed";
+
+/// Category reported when the contexts could not be listed, so no binding was
+/// registered or refreshed.
+pub const RUN_CONTEXTS_UNAVAILABLE: &str = "run.contexts_unavailable";
+
+/// Category reported when the test result summary could not be shown.
+pub const RUN_RESULT_SUMMARY_FAILED: &str = "run.result_summary_failed";
+
+/// Reports one degraded category with a count; the backend builds it around
+/// its diagnostics channel.
+pub type Report = Arc<dyn Fn(&str, u64) + Send + Sync>;
+
+/// Every category this module reports.
+pub const RUN_CATEGORIES: &[&str] = &[
+    RUN_ACTIONS_REGISTRATION_FAILED,
+    RUN_CONTEXTS_UNAVAILABLE,
+    RUN_RESULT_SUMMARY_FAILED,
+];
+
+/// The run state of the backend: the actions binding per context and the
+/// result listener per running test launch. Shared between the functions,
+/// the notification handlers and the listener threads.
+pub struct RunSession {
+    handle: BackendHandle,
+    registrations: Mutex<HashMap<String, Registration>>,
+    listeners: Mutex<HashMap<String, Arc<ResultListener>>>,
+}
+
+/// The actions binding registered in one context generation.
+struct Registration {
+    generation: u64,
+    subscription: Subscription,
+}
+
+/// What the host sends for an action click or a rerun, as the action's
+/// `invoke.params` put it there.
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct Target {
+    debug: bool,
+    kind: TargetKind,
+    /// Workspace-relative path of the document.
+    path: String,
+    main_class: Option<String>,
+    project_name: Option<String>,
+    test_identifier: Option<String>,
+    label: String,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum TargetKind {
+    Main,
+    Test,
+}
+
+impl Target {
+    fn to_value(&self) -> Value {
+        json!({
+            "mode": if self.debug { "debug" } else { "run" },
+            "kind": match self.kind { TargetKind::Main => "main", TargetKind::Test => "test" },
+            "path": self.path,
+            "mainClass": self.main_class,
+            "projectName": self.project_name,
+            "testIdentifier": self.test_identifier,
+            "label": self.label,
+        })
+    }
+
+    fn from_value(value: &Value) -> Result<Self, FunctionError> {
+        let text = |key: &str| value.get(key).and_then(Value::as_str).map(str::to_owned);
+        let debug = match text("mode").as_deref() {
+            Some("run") => false,
+            Some("debug") => true,
+            _ => return Err(failure(RUN_INVALID_PARAMS, "The action names no mode.")),
+        };
+        let kind = match text("kind").as_deref() {
+            Some("main") => TargetKind::Main,
+            Some("test") => TargetKind::Test,
+            _ => return Err(failure(RUN_INVALID_PARAMS, "The action names no kind.")),
+        };
+        let path = text("path")
+            .filter(|path| !path.is_empty())
+            .ok_or_else(|| failure(RUN_INVALID_PARAMS, "The action names no document path."))?;
+        let label = text("label")
+            .filter(|label| !label.is_empty())
+            .ok_or_else(|| failure(RUN_INVALID_PARAMS, "The action names no label."))?;
+        Ok(Self {
+            debug,
+            kind,
+            path,
+            main_class: text("mainClass"),
+            project_name: text("projectName"),
+            test_identifier: text("testIdentifier"),
+            label,
+        })
+    }
+}
+
+impl RunSession {
+    pub fn new(handle: BackendHandle) -> Self {
+        Self {
+            handle,
+            registrations: Mutex::new(HashMap::new()),
+            listeners: Mutex::new(HashMap::new()),
+        }
+    }
+
+    /// Lists the contexts and brings the actions bindings in line with them:
+    /// a new context or generation gets a binding, a vanished one loses it.
+    ///
+    /// Answers the number of contexts whose registration failed. An error is
+    /// the failed listing itself, before any binding was touched.
+    pub fn sync_contexts(&self) -> Result<u64, SdkError> {
+        let host = self.handle.host();
+        let listed = host.request(LIST_CONTEXTS_METHOD, json!({}))?;
+        let contexts = listed
+            .get("contexts")
+            .and_then(Value::as_array)
+            .cloned()
+            .unwrap_or_default();
+        let mut registrations = lock(&self.registrations);
+        let mut seen = HashSet::new();
+        let mut failures = 0;
+        for context in &contexts {
+            let Ok(reference) = WorkspaceContext::from_value(context) else {
+                continue;
+            };
+            seen.insert(reference.context_id().to_owned());
+            if let Some(existing) = registrations.get(reference.context_id()) {
+                if existing.generation == reference.generation() {
+                    continue;
+                }
+                if let Some(stale) = registrations.remove(reference.context_id()) {
+                    // The old generation is gone with its binding; a refused
+                    // dispose changes nothing.
+                    let _ = stale.subscription.dispose();
+                }
+            }
+            let params = json!({
+                "id": ACTIONS_BINDING_ID,
+                "function": COLLECT_FUNCTION_ID,
+                "selector": {"fileExtensions": ["java"], "fileNames": []},
+            });
+            match host.editor().register_actions(&reference, params) {
+                Ok(subscription) => {
+                    registrations.insert(
+                        reference.context_id().to_owned(),
+                        Registration {
+                            generation: reference.generation(),
+                            subscription,
+                        },
+                    );
+                }
+                Err(_) => failures += 1,
+            }
+        }
+        let gone: Vec<String> = registrations
+            .keys()
+            .filter(|id| !seen.contains(*id))
+            .cloned()
+            .collect();
+        for id in gone {
+            if let Some(stale) = registrations.remove(&id) {
+                let _ = stale.subscription.dispose();
+            }
+        }
+        Ok(failures)
+    }
+
+    /// Runs [`Self::sync_contexts`] and reports its failures as `degraded`
+    /// facts of the notification operation.
+    pub fn sync_contexts_reporting(&self, report: &dyn Fn(&str, u64)) -> bool {
+        match self.sync_contexts() {
+            Ok(0) => true,
+            Ok(failures) => {
+                report(RUN_ACTIONS_REGISTRATION_FAILED, failures);
+                true
+            }
+            Err(_) => {
+                report(RUN_CONTEXTS_UNAVAILABLE, 1);
+                false
+            }
+        }
+    }
+
+    /// Syncs the contexts once the session is initialized.
+    ///
+    /// The `initialize` hook runs before the answer, and the host refuses
+    /// requests until the answer is out, so the first sync runs on its own
+    /// thread and retries while the session is not ready. The host also
+    /// notifies `didChangeContexts` later; both paths end in the same sync.
+    pub fn sync_after_initialize(self: &Arc<Self>, report: Report) {
+        let session = Arc::clone(self);
+        thread::Builder::new()
+            .name("java-run-sync".into())
+            .spawn(move || {
+                for attempt in 0..SYNC_RETRY_ATTEMPTS {
+                    thread::sleep(SYNC_RETRY_INTERVAL);
+                    match session.sync_contexts() {
+                        Ok(0) => return,
+                        Ok(failures) => {
+                            report(RUN_ACTIONS_REGISTRATION_FAILED, failures);
+                            return;
+                        }
+                        Err(_) if attempt + 1 < SYNC_RETRY_ATTEMPTS => continue,
+                        Err(_) => report(RUN_CONTEXTS_UNAVAILABLE, 1),
+                    }
+                }
+            })
+            // A thread that cannot start leaves the bindings to the next
+            // `didChangeContexts`; there is nothing else to do about it.
+            .ok();
+    }
+
+    /// Re-registers the actions binding of a context whose language server
+    /// just became ready, so the host collects the actions of the open
+    /// documents again.
+    ///
+    /// The host collects once when a binding is registered and then only on
+    /// edits. The first registration runs right after `initialize`, while JDT
+    /// LS is still starting, so that collection answers no actions; without
+    /// this the gutter stays empty until the user edits the file.
+    pub fn did_receive_notification(&self, params: &Value, report: &dyn Fn(&str, u64)) {
+        let Some(context_id) = service_ready_context(params) else {
+            return;
+        };
+        if let Some(stale) = lock(&self.registrations).remove(&context_id) {
+            let _ = stale.subscription.dispose();
+        }
+        self.sync_contexts_reporting(report);
+    }
+
+    /// Stops the result listener of a finished run.
+    pub fn run_did_exit(&self, params: &Value) {
+        let Some(run_id) = params.get("runID").and_then(Value::as_str) else {
+            return;
+        };
+        if let Some(listener) = lock(&self.listeners).remove(run_id) {
+            listener.stop();
+        }
+    }
+}
+
+/// Builds the actions of one `.java` document for the host.
+///
+/// Answers no actions when the language server is not running or busy: the
+/// gutter is empty until it is, and the host collects again on the next edit.
+pub fn collect_actions_function(params: Value, context: &Context) -> Result<Value, FunctionError> {
+    context.check_cancelled()?;
+    let reference = workspace_context(context)?;
+    let path = params
+        .pointer("/document/path")
+        .and_then(Value::as_str)
+        .filter(|path| !path.is_empty())
+        .ok_or_else(|| failure(RUN_INVALID_PARAMS, "The document has no path."))?;
+    let root = workspace_root(context.host(), reference)?;
+    let uri = file_uri(&root.join(path));
+    let host = context.host();
+    let main_methods = match execute_command(
+        host,
+        reference,
+        java_main_methods_command(&uri),
+        COLLECT_REQUEST_TIMEOUT_MILLISECONDS,
+    ) {
+        Ok(value) => value,
+        Err(error) if is_transient(&error) => return Ok(json!({"actions": []})),
+        Err(error) => return Err(language_server_failed(error)),
+    };
+    context.check_cancelled()?;
+    let test_items = match execute_command(
+        host,
+        reference,
+        java_test_items_command(&uri),
+        COLLECT_REQUEST_TIMEOUT_MILLISECONDS,
+    ) {
+        Ok(value) => value,
+        Err(error) if is_transient(&error) => return Ok(json!({"actions": []})),
+        Err(error) => return Err(language_server_failed(error)),
+    };
+    let methods = normalize_java_main_methods(&main_methods)
+        .map(|methods| methods.methods)
+        .unwrap_or_default();
+    let items = normalize_java_test_items(&test_items)
+        .map(|items| items.items)
+        .unwrap_or_default();
+    let request = JavaRunMarkersRequest {
+        main_methods: methods
+            .iter()
+            .map(|method| MainMethodInput {
+                main_class: method.main_class.clone(),
+                project_name: method.project_name.clone(),
+                range: RangeInput {
+                    start_line: method.range.start_line,
+                    end_line: Some(method.range.end_line),
+                },
+            })
+            .collect(),
+        test_items: items.iter().map(test_item_input).collect(),
+        test_cases: Vec::new(),
+    };
+    let markers = java_run_markers(request)
+        .map_err(|error| failure(RUN_INVALID_PARAMS, error.message))?
+        .markers;
+    let actions: Vec<Value> = markers
+        .iter()
+        .take(MAX_ACTIONS)
+        .enumerate()
+        .map(|(index, marker)| action(index, marker, path))
+        .collect();
+    Ok(json!({"actions": actions}))
+}
+
+fn test_item_input(item: &CollectedTestItem) -> TestItemInput {
+    TestItemInput {
+        id: item.id.clone(),
+        label: item.label.clone(),
+        full_name: item.full_name.clone(),
+        test_level: item.test_level,
+        range: item.range.as_ref().map(|range| RangeInput {
+            start_line: range.start_line,
+            end_line: Some(range.end_line),
+        }),
+        children: item.children.iter().map(test_item_input).collect(),
+    }
+}
+
+/// One gutter action: `Run` with a `Debug` alternative, on the first column
+/// of the declaration line (one-based, half-open).
+fn action(index: usize, marker: &JavaRunMarker, path: &str) -> Value {
+    let line = marker.line + 1;
+    let (kind, icon) = match marker.kind {
+        JavaRunMarkerKind::Main => (TargetKind::Main, "run"),
+        JavaRunMarkerKind::TestClass | JavaRunMarkerKind::TestMethod => (TargetKind::Test, "test"),
+    };
+    let target = |debug: bool| Target {
+        debug,
+        kind,
+        path: path.to_owned(),
+        main_class: marker.main_class.clone(),
+        project_name: marker.project_name.clone(),
+        test_identifier: marker.test_identifier(true),
+        label: marker.label.clone(),
+    };
+    json!({
+        "id": format!("a{index}"),
+        "range": {
+            "start": {"line": line, "column": 1},
+            "end": {"line": line, "column": 2},
+        },
+        "title": format!("Run '{}'", marker.label),
+        "icon": icon,
+        "invoke": {"functionID": RUN_ACTION_FUNCTION_ID, "params": target(false).to_value()},
+        "alternatives": [{
+            "id": "debug",
+            "title": format!("Debug '{}'", marker.label),
+            "icon": "debug",
+            "invoke": {"functionID": RUN_ACTION_FUNCTION_ID, "params": target(true).to_value()},
+        }],
+    })
+}
+
+/// Runs a click on an action: the host passes the action's params as `data`.
+pub fn run_action_function(
+    session: &RunSession,
+    params: Value,
+    context: &Context,
+) -> Result<Value, FunctionError> {
+    let data = params
+        .get("data")
+        .filter(|data| data.is_object())
+        .ok_or_else(|| failure(RUN_INVALID_PARAMS, "The click carries no action data."))?;
+    start(session, &Target::from_value(data)?, context)
+}
+
+/// Runs a rerun: the host passes the start's `rerun.data` as the params.
+pub fn rerun_function(
+    session: &RunSession,
+    params: Value,
+    context: &Context,
+) -> Result<Value, FunctionError> {
+    start(session, &Target::from_value(&params)?, context)
+}
+
+/// Prepares the process of a target and asks the host to start it.
+fn start(session: &RunSession, target: &Target, context: &Context) -> Result<Value, FunctionError> {
+    context.check_cancelled()?;
+    let reference = workspace_context(context)?;
+    let host = context.host();
+    let root = workspace_root(host, reference)?;
+    let debug_port = if target.debug {
+        Some(free_port()?)
+    } else {
+        None
+    };
+    let (mut process, listener) = match target.kind {
+        TargetKind::Main => (main_process(host, reference, &root, target)?, None),
+        TargetKind::Test => {
+            let (process, listener) = test_process(session, host, reference, &root, target)?;
+            (process, Some(listener))
+        }
+    };
+    context.check_cancelled()?;
+    if let Some(port) = debug_port {
+        // The agent goes first so it applies before any other VM argument;
+        // Spring DevTools restarts would detach the debugger, so they are off.
+        let mut arguments = vec![
+            format!(
+                "-agentlib:jdwp=transport=dt_socket,server=y,suspend=y,address=localhost:{port}"
+            ),
+            "-Dspring.devtools.restart.enabled=false".to_owned(),
+        ];
+        arguments.append(&mut process.arguments);
+        process.arguments = arguments;
+    }
+    let mut params = json!({
+        "context": reference.to_value(),
+        "label": target.label,
+        "process": {
+            "executable": {"kind": "tool", "tool": RUN_TOOL},
+            "arguments": process.arguments,
+            "workingDirectory": process.working_directory,
+            "environment": {},
+        },
+        "rerun": {"function": RERUN_FUNCTION_ID, "data": target.to_value()},
+    });
+    if let Some(port) = debug_port {
+        params["debug"] = json!({
+            "configurationType": DEBUG_CONFIGURATION_TYPE,
+            "target": {"kind": "connection", "port": port},
+        });
+    }
+    let started = match host.request(RUN_START_METHOD, params) {
+        Ok(started) => started,
+        Err(error) => {
+            if let Some(listener) = listener {
+                listener.stop();
+            }
+            return Err(failure(RUN_HOST_REJECTED, error.message().to_owned()));
+        }
+    };
+    // Without a run ID no `didExit` can reach the listener; it then ends by
+    // its own timeout after one connection or none.
+    if let (Some(listener), Some(run_id)) = (listener, started.get("runID").and_then(Value::as_str))
+    {
+        lock(&session.listeners).insert(run_id.to_owned(), listener);
+    }
+    Ok(Value::Null)
+}
+
+/// The `java` arguments and working directory of one launch.
+struct Process {
+    arguments: Vec<String>,
+    /// Workspace-relative; `.` is the first folder itself.
+    working_directory: String,
+}
+
+/// Builds the workspace and resolves the classpath of a main class.
+fn main_process(
+    host: &Host,
+    reference: &WorkspaceContext,
+    root: &Path,
+    target: &Target,
+) -> Result<Process, FunctionError> {
+    let main_class = target
+        .main_class
+        .as_deref()
+        .filter(|class| !class.is_empty())
+        .ok_or_else(|| failure(RUN_INVALID_PARAMS, "The action names no main class."))?;
+    let mut build_request = json!({
+        "mainClass": main_class,
+        "filePath": root.join(&target.path).to_string_lossy(),
+        "isFullBuild": false,
+    });
+    if let Some(project) = &target.project_name {
+        build_request["projectName"] = json!(project);
+    }
+    let build = execute_command(
+        host,
+        reference,
+        json!({"command": BUILD_WORKSPACE_COMMAND, "arguments": [build_request.to_string()]}),
+        LAUNCH_REQUEST_TIMEOUT_MILLISECONDS,
+    )
+    .map_err(language_server_failed)?;
+    match build.as_i64() {
+        Some(BUILD_SUCCEEDED | BUILD_WITH_ERRORS) => {}
+        Some(_) => {
+            return Err(failure(
+                RUN_BUILD_FAILED,
+                "The workspace build failed or was cancelled.",
+            ))
+        }
+        None => {
+            return Err(failure(
+                RUN_LANGUAGE_SERVER_FAILED,
+                "The build answered without a result code.",
+            ))
+        }
+    }
+    let classpath = execute_command(
+        host,
+        reference,
+        json!({
+            "command": RESOLVE_CLASSPATH_COMMAND,
+            "arguments": [main_class, target.project_name.clone().unwrap_or_default()],
+        }),
+        LAUNCH_REQUEST_TIMEOUT_MILLISECONDS,
+    )
+    .map_err(language_server_failed)?;
+    let paths = |index: usize| -> Vec<String> {
+        classpath
+            .get(index)
+            .and_then(Value::as_array)
+            .map(|entries| {
+                entries
+                    .iter()
+                    .filter_map(Value::as_str)
+                    .filter(|entry| !entry.is_empty())
+                    .map(str::to_owned)
+                    .collect()
+            })
+            .unwrap_or_default()
+    };
+    let module_paths = paths(0);
+    let class_paths = paths(1);
+    if module_paths.is_empty() && class_paths.is_empty() {
+        return Err(failure(
+            RUN_LANGUAGE_SERVER_FAILED,
+            "The classpath of the main class could not be resolved.",
+        ));
+    }
+    let mut arguments = Vec::new();
+    if !module_paths.is_empty() {
+        arguments.push("--module-path".to_owned());
+        arguments.push(module_paths.join(PATH_SEPARATOR));
+    }
+    if !class_paths.is_empty() {
+        arguments.push("-cp".to_owned());
+        arguments.push(class_paths.join(PATH_SEPARATOR));
+    }
+    arguments.push(main_class.to_owned());
+    Ok(Process {
+        arguments,
+        working_directory: ".".to_owned(),
+    })
+}
+
+/// Plans a test launch with JDT LS and opens the result port the runner
+/// reports to. The listener runs until the host reports the run's exit.
+fn test_process(
+    session: &RunSession,
+    host: &Host,
+    reference: &WorkspaceContext,
+    root: &Path,
+    target: &Target,
+) -> Result<(Process, Arc<ResultListener>), FunctionError> {
+    let file_path = root.join(&target.path);
+    let file_name = file_path
+        .file_name()
+        .map(|name| name.to_string_lossy().into_owned())
+        .unwrap_or_default();
+    let found = execute_command(
+        host,
+        reference,
+        java_test_items_command(&file_uri(&file_path)),
+        LAUNCH_REQUEST_TIMEOUT_MILLISECONDS,
+    )
+    .map_err(language_server_failed)?;
+    let items: Vec<JavaTestItem> = match found {
+        Value::Null => Vec::new(),
+        value => serde_json::from_value(value).map_err(|_| {
+            failure(
+                RUN_LANGUAGE_SERVER_FAILED,
+                "The test items answered an unexpected shape.",
+            )
+        })?,
+    };
+    let plan =
+        jdt_test_items::plan_debug_launch(&items, &file_name, target.test_identifier.as_deref())
+            .map_err(|error| failure(RUN_NO_TESTS, error.message))?;
+    let launch = execute_command(
+        host,
+        reference,
+        json!({"command": LAUNCH_ARGUMENTS_COMMAND, "arguments": [plan.launch_arguments_request()]}),
+        LAUNCH_REQUEST_TIMEOUT_MILLISECONDS,
+    )
+    .map_err(language_server_failed)?;
+    let launch = jdt_test_items::parse_launch_arguments(&launch)
+        .map_err(|error| failure(RUN_LANGUAGE_SERVER_FAILED, error.message))?;
+    let testng_runner = testng_runner_path();
+    let debug_target = jdt_test_items::debug_launch_target(
+        &file_path.to_string_lossy(),
+        &file_name,
+        plan,
+        launch,
+        testng_runner.as_deref(),
+    )
+    .map_err(|error| failure(RUN_LANGUAGE_SERVER_FAILED, error.message))?;
+    let working_directory = relative_working_directory(root, &debug_target.working_directory);
+    let listener = ResultListener::start(
+        session.handle.host(),
+        reference.clone(),
+        target.label.clone(),
+    )?;
+    let configuration = java_test_launch(debug_target.launch_request(listener.port))
+        .map_err(|error| failure(RUN_INVALID_PARAMS, error.message))?;
+    let arguments = launch_arguments(&configuration.arguments);
+    Ok((
+        Process {
+            arguments,
+            working_directory,
+        },
+        listener,
+    ))
+}
+
+/// Turns the DAP-style launch arguments the domain produces into `java`
+/// arguments: VM arguments, module path, classpath, main class, program
+/// arguments.
+fn launch_arguments(configuration: &Map<String, Value>) -> Vec<String> {
+    let strings = |key: &str| -> Vec<String> {
+        configuration
+            .get(key)
+            .and_then(Value::as_array)
+            .map(|values| {
+                values
+                    .iter()
+                    .filter_map(Value::as_str)
+                    .filter(|value| !value.is_empty())
+                    .map(str::to_owned)
+                    .collect()
+            })
+            .unwrap_or_default()
+    };
+    let mut arguments = strings("vmArgs");
+    let module_paths = strings("modulePaths");
+    if !module_paths.is_empty() {
+        arguments.push("--module-path".to_owned());
+        arguments.push(module_paths.join(PATH_SEPARATOR));
+    }
+    let class_paths = strings("classPaths");
+    if !class_paths.is_empty() {
+        arguments.push("-cp".to_owned());
+        arguments.push(class_paths.join(PATH_SEPARATOR));
+    }
+    if let Some(main_class) = configuration.get("mainClass").and_then(Value::as_str) {
+        arguments.push(main_class.to_owned());
+    }
+    arguments.extend(strings("args"));
+    arguments
+}
+
+/// The TestNG runner shipped in the package, when it is there.
+fn testng_runner_path() -> Option<String> {
+    let path = launch::package_root().ok()?.join(TEST_RUNNER);
+    path.is_file().then(|| path.to_string_lossy().into_owned())
+}
+
+/// Maps the absolute working directory JDT LS answers to the
+/// workspace-relative form `run/start` accepts; a directory outside the
+/// first folder falls back to the folder itself.
+fn relative_working_directory(root: &Path, working_directory: &str) -> String {
+    let directory = Path::new(working_directory);
+    match directory.strip_prefix(root) {
+        Ok(relative) if relative.as_os_str().is_empty() => ".".to_owned(),
+        Ok(relative) => relative.to_string_lossy().into_owned(),
+        Err(_) => ".".to_owned(),
+    }
+}
+
+/// Resolves a stack frame of the run output to a file of the workspace:
+/// `{groups: {qualified, file, line}}` to `{uri, range}` or `null`.
+pub fn resolve_output_link_function(
+    params: Value,
+    context: &Context,
+) -> Result<Value, FunctionError> {
+    context.check_cancelled()?;
+    let reference = workspace_context(context)?;
+    let group = |name: &str| {
+        params
+            .pointer(&format!("/groups/{name}"))
+            .and_then(Value::as_str)
+    };
+    let Some(file) = group("file").filter(|file| !file.is_empty()) else {
+        return Ok(Value::Null);
+    };
+    let line = group("line")
+        .and_then(|line| line.parse::<u64>().ok())
+        .filter(|line| *line >= 1)
+        .map_or(0, |line| line - 1);
+    let package_directory = group("qualified")
+        .and_then(|qualified| qualified.rsplit_once('.'))
+        .map(|(package, _)| package.replace('.', "/"))
+        .unwrap_or_default();
+    let host = context.host();
+    let workspace = host.workspace().get_context(reference)?;
+    let Some(folders) = workspace.get("folders").and_then(Value::as_array) else {
+        return Ok(Value::Null);
+    };
+    let mut best: Option<(PathBuf, usize)> = None;
+    for folder in folders {
+        let (Some(root_id), Some(root)) = (
+            folder.get("rootID").and_then(Value::as_str),
+            folder.get("path").and_then(Value::as_str),
+        ) else {
+            continue;
+        };
+        let found = host.workspace().find_files(
+            reference,
+            json!({
+                "resource": {"rootID": root_id, "path": ""},
+                "query": file,
+                "limit": LINK_SEARCH_LIMIT,
+            }),
+        )?;
+        for found in found
+            .get("matches")
+            .and_then(Value::as_array)
+            .into_iter()
+            .flatten()
+        {
+            let Some(path) = found.get("path").and_then(Value::as_str) else {
+                continue;
+            };
+            if Path::new(path)
+                .file_name()
+                .map(|name| name.to_string_lossy())
+                != Some(file.into())
+            {
+                continue;
+            }
+            let expected = format!("{package_directory}/{file}");
+            // A file in the right package directory beats any other file of
+            // the same name; among several, the first keeps the place.
+            let score = if package_directory.is_empty() || path.ends_with(&expected) {
+                2
+            } else {
+                1
+            };
+            if best.as_ref().is_none_or(|(_, current)| score > *current) {
+                best = Some((Path::new(root).join(path), score));
+            }
+        }
+    }
+    Ok(match best {
+        Some((path, _)) => json!({
+            "uri": file_uri(&path),
+            "range": {
+                "start": {"line": line, "character": 0},
+                "end": {"line": line, "character": 0},
+            },
+        }),
+        None => Value::Null,
+    })
+}
+
+/// Counts the results the Eclipse JUnit runner streams to the result port
+/// and shows them when the runner disconnects.
+struct ResultListener {
+    port: u16,
+    stop: Arc<AtomicBool>,
+}
+
+/// Counts of one test run as the Eclipse runner reports them.
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
+struct ResultCounts {
+    started: u64,
+    failed: u64,
+    errors: u64,
+    ignored: u64,
+}
+
+impl ResultCounts {
+    /// Applies one line of the runner's protocol: `%TESTS` starts a test,
+    /// `%FAILED` and `%ERROR` record its outcome. An ignored test starts with
+    /// `@Ignore:` in its name.
+    fn apply(&mut self, line: &str) {
+        if let Some(rest) = line.strip_prefix("%TESTS") {
+            self.started += 1;
+            if rest.contains("@Ignore:") || rest.contains("@AssumptionFailure:") {
+                self.ignored += 1;
+            }
+        } else if line.starts_with("%FAILED") {
+            self.failed += 1;
+        } else if line.starts_with("%ERROR") {
+            self.errors += 1;
+        }
+    }
+
+    fn passed(&self) -> u64 {
+        self.started
+            .saturating_sub(self.failed)
+            .saturating_sub(self.errors)
+            .saturating_sub(self.ignored)
+    }
+
+    fn summary(&self, name: &str) -> String {
+        let mut parts = vec![format!("{} passed", self.passed())];
+        if self.failed > 0 {
+            parts.push(format!("{} failed", self.failed));
+        }
+        if self.errors > 0 {
+            parts.push(format!("{} errors", self.errors));
+        }
+        if self.ignored > 0 {
+            parts.push(format!("{} skipped", self.ignored));
+        }
+        format!("{name}: {}", parts.join(", "))
+    }
+
+    fn is_success(&self) -> bool {
+        self.failed == 0 && self.errors == 0
+    }
+}
+
+impl ResultListener {
+    fn start(
+        host: Host,
+        reference: WorkspaceContext,
+        name: String,
+    ) -> Result<Arc<Self>, FunctionError> {
+        let listener = TcpListener::bind(("127.0.0.1", 0))
+            .and_then(|listener| listener.set_nonblocking(true).map(|()| listener))
+            .map_err(|error| failure(RUN_PORT_UNAVAILABLE, error.to_string()))?;
+        let port = listener
+            .local_addr()
+            .map_err(|error| failure(RUN_PORT_UNAVAILABLE, error.to_string()))?
+            .port();
+        let stop = Arc::new(AtomicBool::new(false));
+        let result = Arc::new(Self {
+            port,
+            stop: Arc::clone(&stop),
+        });
+        thread::Builder::new()
+            .name(format!("java-test-results-{port}"))
+            .spawn(move || serve(listener, stop, host, reference, name))
+            .map_err(|error| failure(RUN_PORT_UNAVAILABLE, error.to_string()))?;
+        Ok(result)
+    }
+
+    fn stop(&self) {
+        self.stop.store(true, Ordering::SeqCst);
+    }
+}
+
+/// Waits for the runner, reads its protocol until it disconnects or the run
+/// stops, then shows the summary.
+fn serve(
+    listener: TcpListener,
+    stop: Arc<AtomicBool>,
+    host: Host,
+    reference: WorkspaceContext,
+    name: String,
+) {
+    let started = Instant::now();
+    let stream = loop {
+        if stop.load(Ordering::SeqCst) || started.elapsed() > RESULT_CONNECTION_TIMEOUT {
+            return;
+        }
+        match listener.accept() {
+            Ok((stream, _)) => break stream,
+            Err(error) if error.kind() == std::io::ErrorKind::WouldBlock => {
+                thread::sleep(RESULT_POLL_INTERVAL);
+            }
+            Err(_) => return,
+        }
+    };
+    if stream.set_nonblocking(false).is_err()
+        || stream.set_read_timeout(Some(RESULT_POLL_INTERVAL)).is_err()
+    {
+        return;
+    }
+    let mut counts = ResultCounts::default();
+    let mut saw_protocol = false;
+    let mut reader = BufReader::new(stream);
+    let mut line = String::new();
+    loop {
+        if stop.load(Ordering::SeqCst) {
+            break;
+        }
+        line.clear();
+        match reader.read_line(&mut line) {
+            Ok(0) => break,
+            Ok(_) => {
+                if line.starts_with('%') {
+                    saw_protocol = true;
+                    counts.apply(line.trim_end());
+                }
+            }
+            Err(error)
+                if matches!(
+                    error.kind(),
+                    std::io::ErrorKind::WouldBlock | std::io::ErrorKind::TimedOut
+                ) => {}
+            Err(_) => break,
+        }
+    }
+    // The TestNG runner speaks another protocol; its results are in the
+    // run's output, so only the end is reported.
+    let text = if saw_protocol {
+        counts.summary(&name)
+    } else {
+        format!("{name}: finished")
+    };
+    let params = json!({"text": text});
+    let shown = if saw_protocol && !counts.is_success() {
+        host.window().show_warning(&reference, params)
+    } else {
+        host.window().show_information(&reference, params)
+    };
+    if shown.is_err() {
+        // The message is the only thing that failed; the counts were seen.
+        let _ = host_diagnostics_degraded(&host, RUN_RESULT_SUMMARY_FAILED);
+    }
+}
+
+/// Reports a category of the notification operation through the host
+/// connection the listener holds. The listener has no backend handle; the
+/// report goes through the SDK's own degraded channel when it is reachable.
+fn host_diagnostics_degraded(_host: &Host, _code: &str) -> Result<(), SdkError> {
+    // TODO(sdk): `Host` exposes no diagnostics; the summary failure is lost
+    // until the SDK offers them off the backend handle on a thread.
+    Ok(())
+}
+
+/// Runs one JDT LS command through the host and answers its `result`.
+fn execute_command(
+    host: &Host,
+    reference: &WorkspaceContext,
+    command: Value,
+    timeout_milliseconds: u64,
+) -> Result<Value, SdkError> {
+    let answer = host.request(
+        REQUEST_METHOD,
+        json!({
+            "context": reference.to_value(),
+            "serverID": SERVER_ID,
+            "method": EXECUTE_COMMAND,
+            "params": command,
+            "timeoutMilliseconds": timeout_milliseconds,
+        }),
+    )?;
+    Ok(answer.get("value").cloned().unwrap_or(Value::Null))
+}
+
+/// A host failure collection should answer with no actions rather than fail:
+/// the server is not running yet, is busy, or the request timed out.
+fn is_transient(error: &SdkError) -> bool {
+    matches!(
+        error.code(),
+        "plugin.host.languageServerUnavailable"
+            | "plugin.host.busy"
+            | "plugin.host.timeout"
+            | "plugin.host.cancelled"
+            | "plugin.host.languageServerError"
+    )
+}
+
+fn language_server_failed(error: SdkError) -> FunctionError {
+    failure(RUN_LANGUAGE_SERVER_FAILED, error.message().to_owned())
+}
+
+fn workspace_context(context: &Context) -> Result<&WorkspaceContext, FunctionError> {
+    context
+        .workspace_context()
+        .ok_or_else(|| failure(RUN_CONTEXT_MISSING, "The call names no workspace."))
+}
+
+/// The local path of the workspace's first folder.
+fn workspace_root(host: &Host, reference: &WorkspaceContext) -> Result<PathBuf, FunctionError> {
+    let context = host.workspace().get_context(reference)?;
+    context
+        .pointer("/folders/0/path")
+        .and_then(Value::as_str)
+        .filter(|path| !path.is_empty())
+        .map(PathBuf::from)
+        .ok_or_else(|| {
+            failure(
+                RUN_WORKSPACE_UNAVAILABLE,
+                "The workspace has no local folder.",
+            )
+        })
+}
+
+/// A free loopback port for the debug agent; the port is released before
+/// the JVM binds it, which is the usual race every debugger accepts.
+fn free_port() -> Result<u16, FunctionError> {
+    TcpListener::bind(("127.0.0.1", 0))
+        .and_then(|listener| listener.local_addr())
+        .map(|address| address.port())
+        .map_err(|error| failure(RUN_PORT_UNAVAILABLE, error.to_string()))
+}
+
+/// `file:` URI of an absolute path, percent-encoding what RFC 3986 reserves.
+pub(crate) fn file_uri(path: &Path) -> String {
+    let text = path.to_string_lossy();
+    let mut uri = String::from("file://");
+    for byte in text.bytes() {
+        let keep = byte.is_ascii_alphanumeric() || b"-._~/".contains(&byte);
+        if keep {
+            uri.push(byte as char);
+        } else {
+            uri.push_str(&format!("%{byte:02X}"));
+        }
+    }
+    uri
+}
+
+/// Path separator of the `-cp` and `--module-path` values.
+const PATH_SEPARATOR: &str = if cfg!(windows) { ";" } else { ":" };
+
+fn failure(code: &'static str, message: impl Into<String>) -> FunctionError {
+    PluginError::new(code, message).into()
+}
+
+/// The context ID of a forwarded `language/status` `ServiceReady` of the
+/// `java` server, `None` for every other notification.
+fn service_ready_context(params: &Value) -> Option<String> {
+    if params.get("serverID").and_then(Value::as_str) != Some(SERVER_ID)
+        || params.get("method").and_then(Value::as_str) != Some(LANGUAGE_STATUS_METHOD)
+        || params
+            .get("params")
+            .and_then(|status| status.get("type"))
+            .and_then(Value::as_str)
+            != Some(SERVICE_READY_TYPE)
+    {
+        return None;
+    }
+    WorkspaceContext::from_value(&params["context"])
+        .ok()
+        .map(|reference| reference.context_id().to_owned())
+}
+
+fn lock<T>(mutex: &Mutex<T>) -> MutexGuard<'_, T> {
+    mutex.lock().unwrap_or_else(PoisonError::into_inner)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use lithe_java_domain::lsp::languages::JavaRunMarkerStatus;
+
+    #[test]
+    fn only_a_service_ready_status_of_the_java_server_names_its_context() {
+        let ready = json!({
+            "context": {"contextID": "ctx-1", "generation": 3},
+            "serverID": SERVER_ID,
+            "generation": 2,
+            "method": LANGUAGE_STATUS_METHOD,
+            "params": {"type": SERVICE_READY_TYPE, "message": "ServiceReady"},
+        });
+        assert_eq!(service_ready_context(&ready).as_deref(), Some("ctx-1"));
+        let mut other_server = ready.clone();
+        other_server["serverID"] = json!("kotlin");
+        let mut other_method = ready.clone();
+        other_method["method"] = json!("language/progressReport");
+        let mut starting = ready.clone();
+        starting["params"]["type"] = json!("Starting");
+        let mut no_params = ready.clone();
+        no_params.as_object_mut().unwrap().remove("params");
+        let mut no_context = ready.clone();
+        no_context.as_object_mut().unwrap().remove("context");
+        for value in [other_server, other_method, starting, no_params, no_context] {
+            assert_eq!(service_ready_context(&value), None, "{value}");
+        }
+    }
+
+    #[test]
+    fn a_target_round_trips_through_its_params() {
+        let target = Target {
+            debug: true,
+            kind: TargetKind::Test,
+            path: "src/test/java/OrderTest.java".into(),
+            main_class: None,
+            project_name: Some("shop".into()),
+            test_identifier: Some("item-1".into()),
+            label: "OrderTest".into(),
+        };
+        assert_eq!(Target::from_value(&target.to_value()).unwrap(), target);
+    }
+
+    #[test]
+    fn a_target_without_mode_or_path_is_invalid() {
+        for value in [
+            json!({"kind": "main", "path": "A.java", "label": "A"}),
+            json!({"mode": "run", "kind": "main", "label": "A"}),
+            json!({"mode": "step", "kind": "main", "path": "A.java", "label": "A"}),
+        ] {
+            match Target::from_value(&value) {
+                Err(FunctionError::Plugin(error)) => assert_eq!(error.code(), RUN_INVALID_PARAMS),
+                other => panic!("{value} was accepted: {other:?}"),
+            }
+        }
+    }
+
+    #[test]
+    fn every_marker_becomes_a_run_action_with_a_debug_alternative() {
+        let marker = JavaRunMarker {
+            line: 4,
+            end_line: 9,
+            kind: JavaRunMarkerKind::Main,
+            label: "App.main()".into(),
+            main_class: Some("com.example.App".into()),
+            project_name: Some("app".into()),
+            test_class: None,
+            test_method: None,
+            test_item_id: None,
+            status: JavaRunMarkerStatus::None,
+        };
+        let action = action(0, &marker, "src/main/java/com/example/App.java");
+        assert_eq!(action["id"], "a0");
+        assert_eq!(action["range"]["start"]["line"], 5);
+        assert_eq!(action["icon"], "run");
+        assert_eq!(action["invoke"]["functionID"], RUN_ACTION_FUNCTION_ID);
+        assert_eq!(action["invoke"]["params"]["mode"], "run");
+        assert_eq!(action["invoke"]["params"]["mainClass"], "com.example.App");
+        assert_eq!(action["alternatives"][0]["icon"], "debug");
+        assert_eq!(
+            action["alternatives"][0]["invoke"]["params"]["mode"],
+            "debug"
+        );
+        assert_eq!(
+            action["alternatives"][0]["invoke"]["params"]["kind"],
+            "main"
+        );
+    }
+
+    #[test]
+    fn launch_arguments_follow_the_java_command_line_order() {
+        let configuration = json!({
+            "vmArgs": ["-ea"],
+            "modulePaths": [],
+            "classPaths": ["/a.jar", "/classes"],
+            "mainClass": "org.eclipse.jdt.internal.junit.runner.RemoteTestRunner",
+            "args": ["-port", "5000"],
+        });
+        let arguments = launch_arguments(configuration.as_object().unwrap());
+        let expected_classpath = format!("/a.jar{PATH_SEPARATOR}/classes");
+        assert_eq!(
+            arguments,
+            vec![
+                "-ea",
+                "-cp",
+                expected_classpath.as_str(),
+                "org.eclipse.jdt.internal.junit.runner.RemoteTestRunner",
+                "-port",
+                "5000",
+            ]
+        );
+    }
+
+    #[test]
+    fn result_counts_follow_the_eclipse_runner_protocol() {
+        let mut counts = ResultCounts::default();
+        for line in [
+            "%TESTC  3 v2",
+            "%TESTS  1,creates(OrderTest)",
+            "%TESTE  1,creates(OrderTest)",
+            "%TESTS  2,fails(OrderTest)",
+            "%FAILED 2,fails(OrderTest)",
+            "%TESTE  2,fails(OrderTest)",
+            "%TESTS  3,@Ignore: skipped(OrderTest)",
+            "%TESTE  3,@Ignore: skipped(OrderTest)",
+            "%RUNTIME120",
+        ] {
+            counts.apply(line);
+        }
+        assert_eq!(counts.passed(), 1);
+        assert_eq!(counts.failed, 1);
+        assert_eq!(counts.ignored, 1);
+        assert!(!counts.is_success());
+        assert_eq!(
+            counts.summary("OrderTest"),
+            "OrderTest: 1 passed, 1 failed, 1 skipped"
+        );
+    }
+
+    #[test]
+    fn working_directories_are_relative_to_the_first_folder() {
+        let root = Path::new("/work/shop");
+        assert_eq!(relative_working_directory(root, "/work/shop"), ".");
+        assert_eq!(
+            relative_working_directory(root, "/work/shop/orders"),
+            "orders"
+        );
+        assert_eq!(relative_working_directory(root, "/elsewhere"), ".");
+    }
+
+    #[test]
+    fn file_uris_percent_encode_reserved_characters() {
+        assert_eq!(
+            file_uri(Path::new("/Users/me/My Project/src/Main.java")),
+            "file:///Users/me/My%20Project/src/Main.java"
+        );
+    }
+
+    #[test]
+    fn run_codes_are_valid_and_distinct() {
+        let mut seen = std::collections::BTreeSet::new();
+        for code in RUN_ERROR_CODES.iter().chain(RUN_CATEGORIES) {
+            assert!(lithe_plugin_sdk::is_plugin_error_code(code), "{code}");
+            assert!(seen.insert(*code), "{code} is listed twice");
+        }
+    }
+}
diff --git a/backend/src/settings_session.rs b/backend/src/settings_session.rs
index 01a5408..f4e6ba6 100644
--- a/backend/src/settings_session.rs
+++ b/backend/src/settings_session.rs
@@ -18,15 +18,18 @@
 //! plugin configuration of the session, so the backend always sends the
 //! complete merged settings and never a delta.
 //!
-//! # No provider, no push
+//! # Every running server gets a push
 //!
-//! The backend pushes only when at least one provider took part, whether its
-//! answer was usable or not. While the main application still runs its own
-//! Java integration, that integration pushes JDT LS settings itself, and the
-//! plugin's whole-configuration notification would overwrite them. A
-//! workspace without Maven or Gradle plugins must therefore see no change in
-//! behavior, and the push becomes unconditional only when the integration
-//! moves into this plugin.
+//! The backend resolves the JDT LS launch itself ([`crate::launch`]), so no
+//! host integration pushes JDT LS settings any more, and this module is their
+//! only source. Once the collection of a running server finished, the backend
+//! pushes even when no Maven or Gradle plugin took part: the push then
+//! carries the plugin's own settings and the defaults.
+//!
+//! The launch answer's `workspaceConfiguration` and every push are built by
+//! the same function, [`java_configuration`], from the contributions known
+//! at that moment, so the settings JDT LS starts with and the settings a
+//! later `workspace/didChangeConfiguration` carries never disagree in shape.
 //!
 //! # Ordering and locks
 //!
@@ -46,7 +49,7 @@ use crate::plugin_functions::{
     collect_contributions, FunctionRelay, HostRelay, RelayFailure, PROVIDER_TIMEOUT,
     RELAY_KEYS_REJECTED,
 };
-use lithe_java_domain::lsp::languages::jdt::{settings_notification, JdtSettings};
+use lithe_java_domain::lsp::languages::jdt::{settings_notification, JdtJavaRuntime, JdtSettings};
 use lithe_java_domain::lsp::languages::jdt_contributions::{
     accept_answer, AcceptedSettings, Contributions, SETTINGS_CHANGED_FUNCTION,
 };
@@ -118,13 +121,13 @@ pub const SESSION_CATEGORIES: &[&str] = &[
 const NOTIFY_METHOD: &str = "lithe/host/languageServer/notify";
 
 /// Host method that sends a request to a plugin-declared server.
-const REQUEST_METHOD: &str = "lithe/host/languageServer/request";
+pub(crate) const REQUEST_METHOD: &str = "lithe/host/languageServer/request";
 
 /// LSP notification that replaces the plugin configuration of the session.
 const DID_CHANGE_CONFIGURATION: &str = "workspace/didChangeConfiguration";
 
 /// LSP request that runs a server command.
-const EXECUTE_COMMAND: &str = "workspace/executeCommand";
+pub(crate) const EXECUTE_COMMAND: &str = "workspace/executeCommand";
 
 /// What the session needs from the host, behind a trait so tests can script
 /// it. Every failure is the host's answer to one request.
@@ -271,6 +274,10 @@ struct WorkspaceState {
     /// The last applied server event, which orders the next one.
     seen: Option<(u64, ServerPhase)>,
     contributions: Contributions,
+    /// The JDKs the last launch configured for the server, from the tools
+    /// the host resolved; every push repeats them so the server keeps the
+    /// same default runtime the host runs.
+    java_runtimes: Vec<JdtJavaRuntime>,
     /// Project updates waiting for a running server.
     pending_projects: Vec<ProjectProfiles>,
     /// Set from the moment the server is running until its collection is
@@ -286,6 +293,7 @@ impl WorkspaceState {
             context,
             seen: None,
             contributions: Contributions::default(),
+            java_runtimes: Vec::new(),
             pending_projects: Vec::new(),
             collecting: None,
         }
@@ -458,9 +466,12 @@ fn parse_project(entry: &Value) -> Result<ProjectProfiles, String> {
     })
 }
 
-/// The params of the `workspace/didChangeConfiguration` for `fragments`.
-fn configuration_params(fragments: &[Value]) -> Value {
-    settings_notification(JdtSettings {
+/// The JDT LS settings this plugin owns, built from the contributed
+/// `fragments` and the `runtimes` the launch configured. The launch passes
+/// them to `initializationOptions`, and every push sends them, so both start
+/// from this one function.
+pub fn jdt_settings<'a>(fragments: &'a [Value], runtimes: &'a [JdtJavaRuntime]) -> JdtSettings<'a> {
+    JdtSettings {
         // The host overlays its own indexing policy on the plugin
         // configuration it forwards, so the plugin must not compute one.
         indexing_root_uri: None,
@@ -470,15 +481,30 @@ fn configuration_params(fragments: &[Value]) -> Value {
         completion: None,
         import_exclusions: None,
         contributed: fragments,
-        // TODO(host-api: API-23 toolchains.list): the backend has no host
-        // method that lists the JDKs installed on this machine. When API-23
-        // provides one, build the candidates from its answer, pass them
-        // through `jdt_java_runtimes`, and fill this list. JDT LS does not
-        // unregister the VMs it already knows because the key is absent, so
-        // the runtimes stay as the host configured them until then.
-        java_runtimes: &[],
-    })
-    .params
+        // The host sends the installation it resolved for the `java` tool
+        // with the launch (`tools.java`); the launch turns it into the
+        // default runtime so the server compiles for the JDK that runs the
+        // project. Without it the key is absent and JDT LS keeps the VMs it
+        // already knows, so the runtimes stay as the previous launch set them.
+        java_runtimes: runtimes,
+    }
+}
+
+/// The params of the `workspace/didChangeConfiguration` for `fragments`:
+/// `{settings: {java: ...}}`.
+fn configuration_params(fragments: &[Value], runtimes: &[JdtJavaRuntime]) -> Value {
+    settings_notification(jdt_settings(fragments, runtimes)).params
+}
+
+/// The `settings` member of the push params, `{java: ...}`. The launch
+/// answers it as `workspaceConfiguration`; Core serves the server's
+/// `workspace/configuration` requests from it and sends it after
+/// `initialized`, which is exactly what a later push replaces it with.
+pub fn java_configuration(fragments: &[Value], runtimes: &[JdtJavaRuntime]) -> Value {
+    match configuration_params(fragments, runtimes) {
+        Value::Object(mut params) => params.remove("settings").unwrap_or_else(|| json!({})),
+        _ => json!({}),
+    }
 }
 
 /// Locks `mutex` even when a panic poisoned it: the guarded data stays
@@ -514,7 +540,8 @@ impl SettingsSession {
     /// Handles `lithe/host/languageServer/didChangeState`.
     ///
     /// When the `java` server is running, this collects the providers'
-    /// settings and, if any provider took part, pushes the merged result.
+    /// settings and pushes the merged result, which is the plugin's own
+    /// settings when no provider took part.
     /// The call blocks on the host, which is allowed on a notification
     /// thread. `report` receives the categories in [`SESSION_CATEGORIES`] and
     /// [`crate::plugin_functions::RELAY_CATEGORIES`].
@@ -554,7 +581,8 @@ impl SettingsSession {
 
     /// Asks the providers for their settings. `None` when there is nothing to
     /// collect: a remote workspace, or a workspace whose location the host
-    /// would not tell.
+    /// would not tell. The push still follows, with the contributions known
+    /// before.
     fn collect(
         &self,
         workspace: &WorkspaceContext,
@@ -663,10 +691,11 @@ impl SettingsSession {
     /// Sends the merged settings and the pending project updates, if the
     /// workspace is ready for them.
     ///
-    /// Nothing is sent while the server is not running, while the collection
-    /// is still in flight (a push then would carry a partial result), or while
-    /// no provider has taken part. Whatever is not sent stays recorded for a
-    /// later flush.
+    /// Nothing is sent while the server is not running or while the
+    /// collection is still in flight (a push then would carry a partial
+    /// result). Whatever is not sent stays recorded for a later flush. A
+    /// workspace without providers is pushed as well; see the module
+    /// documentation.
     fn flush(&self, key: &str, report: &dyn Fn(&str, u64)) {
         let _delivery = lock(&self.gate);
         let (workspace, params, projects) = {
@@ -674,15 +703,12 @@ impl SettingsSession {
             let Some(state) = states.get_mut(key) else {
                 return;
             };
-            if !state.is_running()
-                || state.collecting.is_some()
-                || !state.contributions.has_providers()
-            {
+            if !state.is_running() || state.collecting.is_some() {
                 return;
             }
             (
                 state.context.clone(),
-                configuration_params(&state.contributions.fragments()),
+                configuration_params(&state.contributions.fragments(), &state.java_runtimes),
                 std::mem::take(&mut state.pending_projects),
             )
         };
@@ -704,6 +730,38 @@ impl SettingsSession {
         }
     }
 
+    /// The contributed settings fragments known for the workspace
+    /// `context_id`, in the order a push applies them; empty for a workspace
+    /// the session has not seen. The launch builds its startup settings from
+    /// them, so a server that restarts starts with the last pushed settings.
+    pub fn start_fragments(&self, context_id: &str) -> Vec<Value> {
+        self.lock_states()
+            .get(context_id)
+            .map(|state| state.contributions.fragments())
+            .unwrap_or_default()
+    }
+
+    /// Remembers the JDKs a launch of the workspace `workspace` configured,
+    /// so a later push repeats them instead of leaving the server with the
+    /// runtimes of an older launch. A workspace the session has not seen is
+    /// created here, as a later state event would create it.
+    pub fn set_java_runtimes(&self, workspace: &WorkspaceContext, runtimes: Vec<JdtJavaRuntime>) {
+        let mut states = self.lock_states();
+        let state = states
+            .entry(workspace.context_id().to_string())
+            .or_insert_with(|| WorkspaceState::new(workspace.clone()));
+        state.java_runtimes = runtimes;
+    }
+
+    /// The JDKs the last launch of the workspace `context_id` configured;
+    /// empty for a workspace the session has not seen.
+    pub fn java_runtimes(&self, context_id: &str) -> Vec<JdtJavaRuntime> {
+        self.lock_states()
+            .get(context_id)
+            .map(|state| state.java_runtimes.clone())
+            .unwrap_or_default()
+    }
+
     /// Puts project updates back in front of the ones that arrived while they
     /// were being sent; a newer update of the same project wins.
     fn requeue_projects(&self, key: &str, mut projects: Vec<ProjectProfiles>) {
@@ -952,12 +1010,51 @@ mod tests {
     }
 
     #[test]
-    fn no_provider_means_nothing_is_pushed() {
+    fn no_provider_still_pushes_the_plugins_own_settings() {
         let (script, session) = fixture();
         session.did_change_state(&java("running", 1), &quiet);
         // The providers were asked, and none exists.
         assert_eq!(script.provider_calls.load(Ordering::SeqCst), 1);
-        assert!(script.sent().is_empty());
+        // The push is unconditional: it carries the plugin's own settings and
+        // the defaults, and no contributed value.
+        let configurations = script.configurations();
+        assert_eq!(configurations.len(), 1, "{configurations:?}");
+        assert_eq!(
+            configurations[0].pointer("/settings/java/maven/downloadSources"),
+            Some(&json!(false))
+        );
+        assert!(configurations[0]
+            .pointer("/settings/java/import/maven/enabled")
+            .is_none());
+        assert_eq!(configurations[0], configuration_params(&[], &[]));
+    }
+
+    #[test]
+    fn the_startup_configuration_is_what_a_push_sends() {
+        let (script, session) = fixture();
+        // Before the first `running`, the launch sees no contribution.
+        assert!(session.start_fragments(workspace().context_id()).is_empty());
+
+        script.provide(
+            MAVEN,
+            json!({
+                "java.import.maven.enabled": true,
+                "java.configuration.maven.userSettings": "/m/settings.xml",
+            }),
+        );
+        session.did_change_state(&java("running", 1), &quiet);
+        let pushed = script.configurations();
+        assert_eq!(pushed.len(), 1);
+
+        // A restart's launch answers the same settings the last push sent.
+        let fragments = session.start_fragments(workspace().context_id());
+        assert_eq!(fragments.len(), 1);
+        assert_eq!(java_configuration(&fragments, &[]), pushed[0]["settings"]);
+        assert_eq!(
+            java_configuration(&[], &[]),
+            configuration_params(&[], &[])["settings"]
+        );
+        assert!(session.start_fragments("ctx-unknown").is_empty());
     }
 
     #[test]
@@ -1014,8 +1111,8 @@ mod tests {
             params.pointer("/settings/java/import/gradle/offline/enabled"),
             Some(&json!(true))
         );
-        // The defaults stay, and the runtimes key is absent so JDT LS keeps
-        // the VMs it already knows.
+        // The defaults stay, and without a launch that configured runtimes
+        // the key is absent so JDT LS keeps the VMs it already knows.
         assert_eq!(
             params.pointer("/settings/java/maven/downloadSources"),
             Some(&json!(false))
@@ -1025,6 +1122,29 @@ mod tests {
             .is_none());
     }
 
+    #[test]
+    fn a_push_repeats_the_runtimes_the_launch_configured() {
+        let (script, session) = fixture();
+        let runtimes = vec![JdtJavaRuntime {
+            is_default: true,
+            name: "JavaSE-17".to_string(),
+            path: "/jdk/17".to_string(),
+        }];
+        // The launch runs before the first `running`.
+        session.set_java_runtimes(&workspace(), runtimes.clone());
+        assert_eq!(session.java_runtimes(workspace().context_id()), runtimes);
+        assert!(session.java_runtimes("ctx-unknown").is_empty());
+
+        session.did_change_state(&java("running", 1), &quiet);
+        let pushed = script.configurations();
+        assert_eq!(pushed.len(), 1);
+        assert_eq!(
+            pushed[0].pointer("/settings/java/configuration/runtimes"),
+            Some(&json!([{"name": "JavaSE-17", "path": "/jdk/17", "default": true}]))
+        );
+        assert_eq!(pushed[0], configuration_params(&[], &runtimes));
+    }
+
     #[test]
     fn a_remote_workspace_is_not_collected() {
         let (script, session) = fixture();
@@ -1033,7 +1153,12 @@ mod tests {
         session.did_change_state(&java("running", 1), &quiet);
         assert_eq!(script.root_calls.load(Ordering::SeqCst), 1);
         assert_eq!(script.provider_calls.load(Ordering::SeqCst), 0);
-        assert!(script.sent().is_empty());
+        // The plugin's own settings are still pushed, without a provider's.
+        let configurations = script.configurations();
+        assert_eq!(configurations.len(), 1, "{configurations:?}");
+        assert!(configurations[0]
+            .pointer("/settings/java/import/maven/enabled")
+            .is_none());
     }
 
     #[test]
@@ -1410,7 +1535,13 @@ mod tests {
             [(SESSION_ROOT_UNAVAILABLE.to_string(), 1)]
         );
         assert_eq!(script.provider_calls.load(Ordering::SeqCst), 0);
-        assert!(script.sent().is_empty());
+        // No provider was asked, so the push carries only the plugin's own
+        // settings.
+        let configurations = script.configurations();
+        assert_eq!(configurations.len(), 1, "{configurations:?}");
+        assert!(configurations[0]
+            .pointer("/settings/java/import/maven/enabled")
+            .is_none());
     }
 
     #[test]
diff --git a/backend/tests/repository_pins.rs b/backend/tests/repository_pins.rs
index e433ecd..008fae6 100644
--- a/backend/tests/repository_pins.rs
+++ b/backend/tests/repository_pins.rs
@@ -6,6 +6,7 @@
 //! platform in `cargo test`; the assembled package is checked separately by
 //! `scripts/verify-package.sh`.
 
+use lithe_java_backend::launch::{LAUNCHER_PREFIX, LAUNCH_FUNCTION_ID, PACKAGE_LAYOUT};
 use serde_json::Value;
 use std::fs;
 use std::path::{Path, PathBuf};
@@ -133,29 +134,64 @@ fn every_file_the_manifest_ships_from_the_repository_exists() {
 }
 
 #[test]
-fn language_server_resources_point_inside_the_assembled_package() {
+fn language_server_launch_is_resolved_by_the_backend() {
     let manifest = read_json(&format!("{PLUGIN_ID}/plugin.json"));
     let server = &manifest["languageServers"][0];
     let launch = &server["launch"];
-    assert_eq!(text(launch, "packagedRuntime"), "runtime/${arch}/bin/java");
-    assert!(text(launch, "entry").starts_with("language-server/plugins/"));
-    let resources = &server["hostIntegration"]["resources"];
-    let mut paths = vec![
-        text(resources, "configuration"),
-        text(resources, "lombokAgent"),
-        text(resources, "testRunner"),
-    ];
-    paths.extend(
-        resources["extensionBundleDirectories"]
-            .as_array()
-            .unwrap()
-            .iter()
-            .map(|value| value.as_str().unwrap()),
+    assert_eq!(text(launch, "kind"), "backend");
+    assert_eq!(text(launch, "function"), LAUNCH_FUNCTION_ID);
+    assert!(
+        launch["timeoutMilliseconds"]
+            .as_u64()
+            .is_some_and(|value| value > 0),
+        "a backend launch must bound how long the host waits for the function"
+    );
+    // The contract reserves these for declarative launches; the backend's
+    // answer carries their values instead.
+    for forbidden in [
+        "arguments",
+        "validationArguments",
+        "runtimeDependencies",
+        "initializationOptions",
+        "hostIntegration",
+    ] {
+        assert!(
+            server.get(forbidden).is_none(),
+            "languageServers[0].{forbidden} must not accompany a backend launch"
+        );
+    }
+    let requires = &manifest["requires"];
+    assert!(
+        requires["serverProcess"].as_u64().unwrap() >= 3,
+        "backend launch needs serverProcess 3"
     );
-    for path in paths {
+    assert!(
+        requires["backend"].as_u64().unwrap() >= 2,
+        "resolveParams need backend 2"
+    );
+    assert!(manifest["pluginAPIVersion"].as_u64().unwrap() >= 4);
+}
+
+#[test]
+fn package_scripts_name_every_path_the_backend_resolves() {
+    // plugin.json no longer lists the language server files, so the scripts
+    // that assemble and verify the package are held to the backend's layout.
+    for script in ["scripts/assemble-package.sh", "scripts/verify-package.sh"] {
+        let source = read(script);
+        for path in PACKAGE_LAYOUT {
+            assert!(
+                path.starts_with("language-server/") || *path == "runtime",
+                "{path} must stay inside language-server/ or runtime/"
+            );
+            assert!(
+                !path.split('/').any(|part| part == ".."),
+                "{path} must not leave the package"
+            );
+            assert!(source.contains(path), "{script} does not check {path}");
+        }
         assert!(
-            path.starts_with("language-server/") && !path.split('/').any(|part| part == ".."),
-            "{path} must stay inside language-server/"
+            source.contains(LAUNCHER_PREFIX),
+            "{script} does not check for the Equinox launcher JAR"
         );
     }
 }
diff --git a/crates/java-domain/src/jdt_integration/launch_resources.rs b/crates/java-domain/src/jdt_integration/launch_resources.rs
index cb14f84..23c040e 100644
--- a/crates/java-domain/src/jdt_integration/launch_resources.rs
+++ b/crates/java-domain/src/jdt_integration/launch_resources.rs
@@ -1,99 +1,15 @@
-//! Files the JDT LS launch takes from the plugin declaration.
+//! Helpers for the files the JDT LS launch takes from the plugin package.
 //!
-//! Ported from the Swift `MacJdtLaunchResources`. Exactly the declared files
-//! are handed over; nothing searches the host application or the machine for
-//! JDT LS, so removing the plugin removes Java language support with it.
+//! Ported from the Swift `MacJdtLaunchResources`. The package layout itself is
+//! fixed by `backend/src/launch.rs`, which resolves the launch for the host
+//! (`launch.kind: "backend"`); exactly the packaged files are handed over,
+//! nothing searches the host application or the machine for JDT LS, so
+//! removing the plugin removes Java language support with it.
 
-use std::collections::BTreeMap;
 use std::fs;
 use std::path::{Path, PathBuf};
 
-use crate::protocol::{CoreError, ErrorCode};
-
-/// Declaration key of the writable-copy source for the Equinox configuration.
-pub const CONFIGURATION_RESOURCE: &str = "configuration";
-/// Declaration key of the Lombok Java agent.
-pub const LOMBOK_AGENT_RESOURCE: &str = "lombokAgent";
-/// Declaration key of the directories whose JARs extend JDT LS.
-pub const EXTENSION_BUNDLE_DIRECTORIES_RESOURCE: &str = "extensionBundleDirectories";
-/// Declaration key of the Java Test runner JAR.
-pub const TEST_RUNNER_RESOURCE: &str = "testRunner";
-
-/// A resolved `hostIntegration` declaration: package-relative paths already
-/// joined to the installed package directory.
-#[derive(Debug, Clone, Default, PartialEq, Eq)]
-pub struct DeclaredHostIntegration {
-    /// The language server's `launch.entry`, the Equinox launcher JAR.
-    pub entry: Option<PathBuf>,
-    /// `hostIntegration.resources`; single values are one-element lists.
-    pub resources: BTreeMap<String, Vec<PathBuf>>,
-}
-
-impl DeclaredHostIntegration {
-    /// First path declared under `name`.
-    pub fn resource(&self, name: &str) -> Option<&Path> {
-        self.resources
-            .get(name)
-            .and_then(|paths| paths.first())
-            .map(PathBuf::as_path)
-    }
-}
-
-/// Files of one JDT LS launch.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct JdtLaunchResources {
-    /// Equinox launcher JAR.
-    pub launcher_jar: PathBuf,
-    /// Packaged configuration directory. It is passed as is: the launch gives
-    /// Equinox a writable copy in the host cache and never writes into the
-    /// package.
-    pub configuration_directory: PathBuf,
-    /// Lombok Java agent.
-    pub lombok_agent: PathBuf,
-    /// JDT LS extension bundles in load order.
-    pub extension_bundles: Vec<PathBuf>,
-    /// Java Test runner JAR, when the package ships one.
-    pub test_runner: Option<PathBuf>,
-}
-
-/// Maps a declaration to launch files, naming the first missing one.
-pub fn launch_resources(
-    integration: &DeclaredHostIntegration,
-) -> Result<JdtLaunchResources, CoreError> {
-    let launcher_jar = integration
-        .entry
-        .clone()
-        .ok_or_else(|| missing_resource("the JDT LS launcher"))?;
-    let configuration_directory = integration
-        .resource(CONFIGURATION_RESOURCE)
-        .ok_or_else(|| missing_resource("the JDT LS configuration"))?
-        .to_path_buf();
-    let lombok_agent = integration
-        .resource(LOMBOK_AGENT_RESOURCE)
-        .ok_or_else(|| missing_resource("the Lombok agent"))?
-        .to_path_buf();
-    let extension_bundles = integration
-        .resources
-        .get(EXTENSION_BUNDLE_DIRECTORIES_RESOURCE)
-        .map(|directories| {
-            directories
-                .iter()
-                .flat_map(|directory| bundles_in(directory))
-                .collect()
-        })
-        .unwrap_or_default();
-    Ok(JdtLaunchResources {
-        launcher_jar,
-        configuration_directory,
-        lombok_agent,
-        extension_bundles,
-        test_runner: integration
-            .resource(TEST_RUNNER_RESOURCE)
-            .map(Path::to_path_buf),
-    })
-}
-
-/// Message shown when the package lacks a declared file.
+/// Message shown when the package lacks a file the launch needs.
 ///
 /// TODO(host-api: API-37 i18n): user-facing text must go through the host's
 /// i18n table.
@@ -101,10 +17,6 @@ pub fn missing_resource_message(name: &str) -> String {
     format!("The Java Support plugin does not provide {name}. Reinstall the plugin.")
 }
 
-fn missing_resource(name: &str) -> CoreError {
-    CoreError::new(ErrorCode::RuntimeMissing, missing_resource_message(name))
-}
-
 /// JAR files directly inside `directory`, sorted by name so JDT LS loads the
 /// same extensions in the same order on every launch. Hidden entries,
 /// directories and unreadable directories contribute nothing.
@@ -153,93 +65,37 @@ mod tests {
         }
     }
 
-    fn declaration(root: &Path) -> DeclaredHostIntegration {
-        let mut resources = BTreeMap::new();
-        resources.insert(
-            CONFIGURATION_RESOURCE.into(),
-            vec![root.join("language-server/configuration/arm64")],
-        );
-        resources.insert(
-            LOMBOK_AGENT_RESOURCE.into(),
-            vec![root.join("language-server/lombok/lombok.jar")],
-        );
-        resources.insert(
-            EXTENSION_BUNDLE_DIRECTORIES_RESOURCE.into(),
-            vec![
-                root.join("language-server/java-debug"),
-                root.join("language-server/java-test/extensions"),
-            ],
-        );
-        DeclaredHostIntegration {
-            entry: Some(root.join("language-server/plugins/launcher.jar")),
-            resources,
-        }
-    }
-
     #[test]
-    fn declared_files_map_to_the_launch_with_sorted_extension_bundles() {
+    fn bundles_are_sorted_and_skip_hidden_entries_and_directories() {
         let temp = TempDir::new("map");
         let debug = temp.0.join("language-server/java-debug");
-        let test = temp.0.join("language-server/java-test/extensions");
         fs::create_dir_all(&debug).unwrap();
-        fs::create_dir_all(test.join("nested.jar")).unwrap();
+        fs::create_dir_all(debug.join("nested.jar")).unwrap();
         for file in [
             debug.join("z-debug.jar"),
             debug.join("a-debug.jar"),
             debug.join(".hidden.jar"),
             debug.join("notes.txt"),
-            test.join("test.jar"),
         ] {
             fs::write(file, "").unwrap();
         }
-        let resources = launch_resources(&declaration(&temp.0)).unwrap();
         assert_eq!(
-            resources.launcher_jar,
-            temp.0.join("language-server/plugins/launcher.jar")
+            bundles_in(&debug),
+            vec![debug.join("a-debug.jar"), debug.join("z-debug.jar")]
         );
-        assert_eq!(
-            resources.extension_bundles,
-            vec![
-                debug.join("a-debug.jar"),
-                debug.join("z-debug.jar"),
-                test.join("test.jar")
-            ]
-        );
-        assert_eq!(resources.test_runner, None);
     }
 
     #[test]
-    fn missing_declarations_name_the_missing_file() {
-        let temp = TempDir::new("missing");
-        let mut declared = declaration(&temp.0);
-        declared.entry = None;
-        assert_eq!(
-            launch_resources(&declared).unwrap_err().message,
-            "The Java Support plugin does not provide the JDT LS launcher. Reinstall the plugin."
-        );
-        let mut declared = declaration(&temp.0);
-        declared.resources.remove(LOMBOK_AGENT_RESOURCE);
-        assert_eq!(
-            launch_resources(&declared).unwrap_err().message,
-            "The Java Support plugin does not provide the Lombok agent. Reinstall the plugin."
-        );
-        let mut declared = declaration(&temp.0);
-        declared.resources.remove(CONFIGURATION_RESOURCE);
-        assert_eq!(
-            launch_resources(&declared).unwrap_err().message,
-            "The Java Support plugin does not provide the JDT LS configuration. Reinstall the plugin."
-        );
+    fn a_missing_bundle_directory_contributes_nothing() {
+        let temp = TempDir::new("absent");
+        assert!(bundles_in(&temp.0.join("language-server/java-debug")).is_empty());
     }
 
     #[test]
-    fn a_missing_bundle_directory_contributes_nothing() {
-        let temp = TempDir::new("absent");
-        let mut declared = declaration(&temp.0);
-        declared
-            .resources
-            .insert(TEST_RUNNER_RESOURCE.into(), vec![temp.0.join("runner.jar")]);
-        let resources = launch_resources(&declared).unwrap();
-        assert!(resources.extension_bundles.is_empty());
-        assert_eq!(resources.test_runner, Some(temp.0.join("runner.jar")));
+    fn missing_file_message_names_the_file() {
+        assert_eq!(
+            missing_resource_message("the Lombok agent"),
+            "The Java Support plugin does not provide the Lombok agent. Reinstall the plugin."
+        );
     }
 }
diff --git a/crates/java-domain/src/jdt_integration/mod.rs b/crates/java-domain/src/jdt_integration/mod.rs
index e78c4b1..a50b989 100644
--- a/crates/java-domain/src/jdt_integration/mod.rs
+++ b/crates/java-domain/src/jdt_integration/mod.rs
@@ -5,8 +5,9 @@
 //! plugin went away. These modules are the decision rules of that code,
 //! rewritten without any host type:
 //!
-//! - [`launch_resources`] maps the declared `hostIntegration.resources` to
-//!   the files the JDT LS launch needs;
+//! - [`launch_resources`] lists the extension bundles and names missing
+//!   files for the JDT LS launch the backend resolves (`backend/src/launch.rs`
+//!   fixes the package layout);
 //! - [`runtime`] validates the packaged JDK and decides when cached state may
 //!   be discarded;
 //! - [`workspace_state`] fingerprints a workspace, resets its index and
diff --git a/crates/java-domain/src/lsp/languages/jdt.rs b/crates/java-domain/src/lsp/languages/jdt.rs
index 1b7b4eb..1b50ec2 100644
--- a/crates/java-domain/src/lsp/languages/jdt.rs
+++ b/crates/java-domain/src/lsp/languages/jdt.rs
@@ -500,6 +500,46 @@ pub fn adapt_initialization_options(
     Some(Value::Object(options))
 }
 
+/// Names the Java files whose folders JDT LS imports as projects when the
+/// workspace has no build file (`initializationOptions.triggerFiles`).
+///
+/// JDT LS creates its default project only for a workspace without folders.
+/// With a folder, `InvisibleProjectImporter` returns before it creates the
+/// project unless `triggerFiles` names a `.java` file under the folder; then
+/// it reads the file's package declaration and strips it from the path, so
+/// `src/demo/Main.java` with `package demo;` makes `src` the source root.
+/// Without the list, the first `textDocument/didOpen` creates the project
+/// instead, and at that point the package cannot be read, so the file's own
+/// directory becomes the source root and every class fails with "declared
+/// package does not match expected package". File URIs are kept in order and
+/// without duplicates; an empty list changes nothing, and the key is left
+/// alone when no file is given.
+pub fn add_trigger_files(options: &mut Value, trigger_files: &[String]) {
+    if trigger_files.is_empty() {
+        return;
+    }
+    if !options.is_object() {
+        *options = json!({});
+    }
+    let files = options
+        .as_object_mut()
+        .expect("the initialization options were normalized to an object")
+        .entry("triggerFiles")
+        .or_insert_with(|| Value::Array(Vec::new()));
+    if !files.is_array() {
+        *files = Value::Array(Vec::new());
+    }
+    let files = files
+        .as_array_mut()
+        .expect("the trigger files were normalized to an array");
+    for file in trigger_files {
+        let file = Value::String(file.clone());
+        if !files.contains(&file) {
+            files.push(file);
+        }
+    }
+}
+
 /// Overlays the provider-owned `settings.java` values onto catalog-provided
 /// initialization options.
 ///
@@ -1015,7 +1055,17 @@ fn wrapper_arguments(
     arguments
 }
 
-fn direct_java_arguments(
+/// The complete `java` command line that starts JDT LS directly, without a
+/// shell wrapper.
+///
+/// `arguments` are the plugin's own choices followed by `-jar <launcher>`:
+/// `-Xmx` and `-Dlog.level=` replace the defaults when they are valid, other
+/// JVM options before the launcher are kept, and the options JDT LS needs
+/// (`-javaagent`, `-Xms`, `--add-opens`, the Equinox properties, tuning) are
+/// always rebuilt from `resources`. `-configuration` and `-data` come from
+/// `resources` and `data_directory`, never from `arguments`, so both point at
+/// writable directories. The plugin backend resolves its launch with this.
+pub fn direct_java_arguments(
     arguments: &[String],
     resources: &JdtDirectLaunchResources,
     data_directory: &Path,
@@ -2529,4 +2579,40 @@ mod tests {
         assert!(virtual_source_content("go", &json!("class String {}")).is_none());
         assert!(virtual_source_content("java", &Value::Null).is_none());
     }
+
+    #[test]
+    fn trigger_files_are_added_once_and_only_when_given() {
+        let mut options = json!({ "bundles": [] });
+        add_trigger_files(&mut options, &[]);
+        assert_eq!(options, json!({ "bundles": [] }));
+
+        let files = vec![
+            "file:///w/src/demo/Main.java".to_string(),
+            "file:///w/src/demo/Main.java".to_string(),
+            "file:///w/lib/Util.java".to_string(),
+        ];
+        add_trigger_files(&mut options, &files);
+        assert_eq!(
+            options["triggerFiles"],
+            json!(["file:///w/src/demo/Main.java", "file:///w/lib/Util.java"])
+        );
+
+        // A non-object value and a non-array key are replaced, an existing
+        // list is extended.
+        let mut scalar = Value::Null;
+        add_trigger_files(&mut scalar, &files[..1]);
+        assert_eq!(
+            scalar,
+            json!({ "triggerFiles": ["file:///w/src/demo/Main.java"] })
+        );
+        let mut wrong = json!({ "triggerFiles": "x" });
+        add_trigger_files(&mut wrong, &files[2..]);
+        assert_eq!(wrong["triggerFiles"], json!(["file:///w/lib/Util.java"]));
+        let mut existing = json!({ "triggerFiles": ["file:///w/lib/Util.java"] });
+        add_trigger_files(&mut existing, &files[..1]);
+        assert_eq!(
+            existing["triggerFiles"],
+            json!(["file:///w/lib/Util.java", "file:///w/src/demo/Main.java"])
+        );
+    }
 }
diff --git a/crates/java-domain/src/lsp/languages/mod.rs b/crates/java-domain/src/lsp/languages/mod.rs
index 8a20302..308bcc9 100644
--- a/crates/java-domain/src/lsp/languages/mod.rs
+++ b/crates/java-domain/src/lsp/languages/mod.rs
@@ -19,7 +19,7 @@ pub mod project_preparation;
 
 pub use java_run_markers::{
     java_run_markers, JavaRunMarker, JavaRunMarkerKind, JavaRunMarkerStatus, JavaRunMarkersRequest,
-    JavaRunMarkersResponse,
+    JavaRunMarkersResponse, MainMethodInput, RangeInput, TestItemInput,
 };
 pub use java_workspace::{
     java_workspace_policy, jdt_cache_retention, jdt_workspace_fingerprint,
diff --git a/crates/java-domain/src/testing/jdt_test_items.rs b/crates/java-domain/src/testing/jdt_test_items.rs
index 6435696..959c459 100644
--- a/crates/java-domain/src/testing/jdt_test_items.rs
+++ b/crates/java-domain/src/testing/jdt_test_items.rs
@@ -506,8 +506,8 @@ impl JavaTestDebugLaunchTarget {
 
 /// Combines a plan with JDT LS's runner arguments.
 ///
-/// TestNG runs through the packaged runner, which the plugin package declares
-/// as the `testRunner` resource; JUnit uses the main class JDT LS resolved.
+/// TestNG runs through the packaged runner JAR (`TEST_RUNNER` in
+/// `backend/src/launch.rs`); JUnit uses the main class JDT LS resolved.
 pub fn debug_launch_target(
     file_path: &str,
     file_name: &str,
diff --git a/io.github.lithe-idea.java-support/plugin.json b/io.github.lithe-idea.java-support/plugin.json
index 9d736f0..6f6e2a7 100644
--- a/io.github.lithe-idea.java-support/plugin.json
+++ b/io.github.lithe-idea.java-support/plugin.json
@@ -4,13 +4,14 @@
   "displayName": "Java Support",
   "version": "1.1.0",
   "pluginAPIVersion": 4,
-  "requires": {"backend": 2, "debugAdapters": 1, "languages": 1, "languageServers": 3, "pluginFunctions": 1, "serverProcess": 1, "settings": 2, "projectGenerators": 1, "toolDefinitions": 1, "executableResolution": 2},
+  "requires": {"backend": 2, "debugAdapters": 3, "languages": 1, "languageServers": 3, "outputLinkMatchers": 1, "pluginFunctions": 1, "serverProcess": 4, "settings": 2, "projectGenerators": 1, "toolDefinitions": 1, "executableResolution": 2},
+  "requiresTools": ["java"],
   "vendor": {
     "id": "io.github.lithe-idea",
     "displayName": "Lithe Community",
     "signatureRequirement": "none"
   },
-  "permissions": ["backend.launch", "languageServer.launch", "languageServer.request", "project.generate", "debug.launch", "debug.attach", "workspace.metadata"],
+  "permissions": ["backend.launch", "documents.contentProvider", "documents.read", "editor.actions", "languageServer.launch", "languageServer.request", "project.generate", "debug.launch", "debug.attach", "debug.start", "run.start", "window.messages", "workspace.metadata", "workspace.search"],
   "activationEvents": ["onLanguage:java", "onDebug:java", "onWorkspaceOpen"],
   "toolDefinitions": [
     {
@@ -148,8 +149,6 @@
       "launch": [
         "${executable}",
         "${runtimeArguments}",
-        "-jar",
-        "${entry}",
         "${arguments}"
       ]
     }
@@ -176,9 +175,28 @@
       },
       "configurations": {
         "attach": {"targetBindings": {"connection": {"host": "hostName", "port": "port"}}}
+      },
+      "features": {
+        "hotCodeReplace": {
+          "request": "redefineClasses",
+          "event": "hotcodereplace",
+          "changedField": "changedClasses",
+          "errorField": "errorMessage"
+        },
+        "stepFilters": {"argument": "stepFilters"}
+      },
+      "defaults": {
+        "stepFilters": {"classNameFilters": ["$JDK", "$Libraries"]}
       }
     }
   ],
+  "outputLinkMatchers": [
+    {
+      "id": "stack-frame",
+      "pattern": "at (?P<qualified>[\\w$.]+)\\.[\\w$<>]+\\((?P<file>\\w+\\.java):(?P<line>\\d+)\\)",
+      "resolve": {"function": "java.resolveOutputLink"}
+    }
+  ],
   "settings": [
     {
       "id": "heapMaxMB",
@@ -213,35 +231,21 @@
       "languageID": "java",
       "languageIdentifier": "java",
       "launch": {
-        "kind": "runtime",
-        "tool": "java",
-        "packagedRuntime": "runtime/${arch}/bin/java",
-        "runtimeArguments": [
-          "-Xmx${setting:heapMaxMB}m",
-          "-Dlog.level=${setting:logLevel}",
-          "-Dosgi.logfile=${logDir}/jdt.log",
-          "-Declipse.log.include.commandline=false",
-          "-Declipse.log.size.max=1024",
-          "-Declipse.log.backup.max=2",
-          "-Declipse.log.level=WARNING"
-        ],
-        "entry": "language-server/plugins/org.eclipse.equinox.launcher_1.8.0.v20260804-1928.jar"
+        "kind": "backend",
+        "function": "java.resolveLaunch",
+        "timeoutMilliseconds": 60000
       },
-      "requestMethods": ["workspace/executeCommand"],
-      "commands": ["java.project.updateSettings"],
-      "hostIntegration": {
-        "id": "jdt",
-        "capabilities": ["debug", "run", "testing"],
-        "resources": {
-          "configuration": "language-server/configuration/${arch}",
-          "lombokAgent": "language-server/lombok/lombok.jar",
-          "extensionBundleDirectories": [
-            "language-server/java-debug",
-            "language-server/java-test/extensions"
-          ],
-          "testRunner": "language-server/java-test/runner/com.microsoft.java.test.runner-jar-with-dependencies.jar"
+      "requestMethods": ["java/classFileContents", "workspace/executeCommand"],
+      "commands": ["java.project.updateSettings", "vscode.java.buildWorkspace", "vscode.java.resolveClasspath", "vscode.java.resolveMainMethod", "vscode.java.test.findTestTypesAndMethods", "vscode.java.test.junit.argument"],
+      "forwardNotifications": ["language/eventNotification", "language/progressReport", "language/status"],
+      "state": {
+        "scope": "workspace",
+        "retention": {
+          "maxEntries": 8,
+          "maxAgeDays": 30
         }
-      }
+      },
+      "remote": "unsupported"
     }
   ],
   "pluginFunctions": {
diff --git a/scripts/assemble-package.sh b/scripts/assemble-package.sh
index 32b6579..6a2d2e5 100755
--- a/scripts/assemble-package.sh
+++ b/scripts/assemble-package.sh
@@ -8,7 +8,7 @@ set -euo pipefail
 # here for the requested architecture and placed where plugin.json's
 # backend.launch.path names it). The third-party inputs are fetched and
 # checksum-verified by the shared prepare scripts; this script only arranges
-# the result in the layout plugin.json declares, plus the icons and template
+# the result in the layout the backend expects (backend/src/launch.rs), plus the icons and template
 # directories of the New Project entries (Java, Spring Boot). The assembled
 # package is read-only at runtime; projects are generated in the user's chosen
 # folder.
@@ -118,13 +118,38 @@ else
 fi
 chmod 755 "$OUTPUT_DIR/$backend_path"
 
-# plugin.json names these files exactly, so a JDT LS upgrade that renames one
-# fails here instead of at the user's first Java file.
-launcher=$(/usr/bin/plutil -extract languageServers.0.launch.entry raw "$PLUGIN_DIR/plugin.json")
-test_runner=$(/usr/bin/plutil -extract languageServers.0.hostIntegration.resources.testRunner raw "$PLUGIN_DIR/plugin.json")
-for declared in "$launcher" "$test_runner" language-server/lombok/lombok.jar "$backend_path"; do
+# The backend resolves the language server launch (plugin.json declares only
+# the function), so the layout it expects is fixed in backend/src/launch.rs
+# and checked here, where a JDT LS upgrade that renames or moves a file fails
+# instead of at the user's first Java file. backend/tests/repository_pins.rs
+# holds this list to the backend's.
+launchers=("$OUTPUT_DIR"/language-server/plugins/org.eclipse.equinox.launcher_*.jar(N))
+(( ${#launchers} == 1 )) || {
+    print -u2 -- "language-server/plugins must hold exactly one org.eclipse.equinox.launcher_*.jar, found ${#launchers}"
+    exit 1
+}
+for declared in \
+    language-server/lombok/lombok.jar \
+    language-server/java-test/runner/com.microsoft.java.test.runner-jar-with-dependencies.jar \
+    "$backend_path"; do
     [[ -f "$OUTPUT_DIR/$declared" ]] || {
-        print -u2 -- "Java Support declares $declared, which the assembled package does not contain. Update io.github.lithe-idea.java-support/plugin.json for the pinned JDT LS version."
+        print -u2 -- "The backend expects $declared, which the assembled package does not contain. Update scripts/prepare-jdtls.sh or backend/src/launch.rs for the pinned JDT LS version."
+        exit 1
+    }
+done
+for directory in language-server/java-debug language-server/java-test/extensions; do
+    [[ -n "$(find "$OUTPUT_DIR/$directory" -maxdepth 1 -name '*.jar' -print -quit 2>/dev/null)" ]] || {
+        print -u2 -- "extension bundle directory $directory holds no bundles"
+        exit 1
+    }
+done
+for runtime_arch in "${runtime_architectures[@]}"; do
+    [[ -f "$OUTPUT_DIR/language-server/configuration/$runtime_arch/config.ini" ]] || {
+        print -u2 -- "missing language-server/configuration/$runtime_arch/config.ini"
+        exit 1
+    }
+    [[ -x "$OUTPUT_DIR/runtime/$runtime_arch/bin/java" ]] || {
+        print -u2 -- "missing runtime/$runtime_arch/bin/java"
         exit 1
     }
 done
diff --git a/scripts/verify-package.sh b/scripts/verify-package.sh
index 4dc18af..d78b76d 100755
--- a/scripts/verify-package.sh
+++ b/scripts/verify-package.sh
@@ -7,7 +7,8 @@ set -euo pipefail
 #     plugin without a publisher signature (vendor.signatureRequirement "none");
 #   - the package holds only the declared top-level entries and no symbolic
 #     links, and nothing outside runtime/ and bin/ is executable;
-#   - every file plugin.json names for the language server exists;
+#   - every language server file the backend resolves (backend/src/launch.rs)
+#     exists in the layout it expects;
 #   - the plugin backend (backend.launch.path in plugin.json) is the only file
 #     in bin/, is executable, and contains exactly the requested architectures;
 #   - the packaged JDK is the requested architecture and keeps its upstream
@@ -73,15 +74,21 @@ backend_archs=(${=backend_archs_text})
 [[ "${(j: :)${(o)backend_archs}}" == "${(j: :)${(o)runtime_architectures}}" ]] ||
     fail "$backend_path contains ${backend_archs[*]:-no architectures}, expected ${runtime_architectures[*]}"
 
-launcher=$(/usr/bin/plutil -extract languageServers.0.launch.entry raw -o - "$manifest")
-lombok=$(/usr/bin/plutil -extract languageServers.0.hostIntegration.resources.lombokAgent raw -o - "$manifest")
-test_runner=$(/usr/bin/plutil -extract languageServers.0.hostIntegration.resources.testRunner raw -o - "$manifest")
-for declared in "$launcher" "$lombok" "$test_runner"; do
-    [[ -f "$PACKAGE/$declared" ]] || fail "plugin.json declares $declared, which the package does not contain"
+# The language server launch is resolved by the backend (plugin.json declares
+# launch.kind "backend" and the function only), so the files are checked
+# against the layout fixed in backend/src/launch.rs; repository_pins.rs holds
+# this script to that list.
+[[ "$(/usr/bin/plutil -extract languageServers.0.launch.kind raw -o - "$manifest")" == "backend" ]] ||
+    fail "plugin.json must declare a backend-resolved language server launch"
+launchers=("$PACKAGE"/language-server/plugins/org.eclipse.equinox.launcher_*.jar(N))
+(( ${#launchers} == 1 )) ||
+    fail "language-server/plugins must hold exactly one org.eclipse.equinox.launcher_*.jar, found ${#launchers}"
+for declared in \
+    language-server/lombok/lombok.jar \
+    language-server/java-test/runner/com.microsoft.java.test.runner-jar-with-dependencies.jar; do
+    [[ -f "$PACKAGE/$declared" ]] || fail "the backend expects $declared, which the package does not contain"
 done
-bundle_count=$(/usr/bin/plutil -extract languageServers.0.hostIntegration.resources.extensionBundleDirectories raw -o - "$manifest")
-for (( index = 0; index < bundle_count; index++ )); do
-    directory=$(/usr/bin/plutil -extract "languageServers.0.hostIntegration.resources.extensionBundleDirectories.$index" raw -o - "$manifest")
+for directory in language-server/java-debug language-server/java-test/extensions; do
     [[ -n "$(find "$PACKAGE/$directory" -maxdepth 1 -name '*.jar' -print -quit 2>/dev/null)" ]] ||
         fail "extension bundle directory $directory holds no bundles"
 done