diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 00000000..bdae166c
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+*.snap -text
diff --git a/CLAUDE.md b/CLAUDE.md
index 1aab3800..e9f84f0e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -233,6 +233,7 @@ When drafting Slack messages, PR descriptions, review replies, release notes, or
 # Testing
 
 - Prefer integration tests to cover most cases. Use unit tests when integration tests are not practical.
+- Assertions use `github.com/stretchr/testify` (`require` for fatal checks). Snapshots use the in-house `internal/snap` helper: `snap.Match(t, s)` stores snapshots in one archive per test file (`__snapshots__/<test_file>.snap`): a `[TestName_N]` header line per Match call, the value verbatim, and a `---` terminator on its own line (so a value and the same value plus one final newline are indistinguishable; other newlines are preserved exactly). Missing snapshots are created locally but fail in CI; `UPDATE_SNAPS=true go test` rewrites them. The format has no escaping, so a value containing a line that is exactly `---` is rejected (round-trip guard) — sanitize such values before matching. `snap.MatchJSON(t, raw, "data.currentVersion", ...)` snapshots a JSON document in canonical pretty-printed form, masking the values at the given dotted paths with `<any>` (a path that doesn't resolve fails the test; objects only, no array indexing). A package using snapshots must wire `func TestMain(m *testing.M) { os.Exit(snap.Clean(m)) }` — obsolete snapshots then fail the run (or are deleted under `UPDATE_SNAPS=true`); cleanup is skipped on filtered (`-run`/`-skip`) or failed runs. Sanitize volatile values before matching with label-anchored regexes, not value-shaped ones (see `sanitizeSnapshot` in `internal/output`; RE2 has no lookahead, so a bare semver pattern corrupts IPv4 strings).
 - **When fixing a bug, always add an integration test** that fails before the fix and passes after. This prevents regressions and documents the exact scenario that was broken.
 - Integration tests that run the CLI binary with Bubble Tea must use a PTY since Bubble Tea requires a terminal. Use the cross-platform helpers in `test/integration/pty_helpers_test.go` — `runLstkInPTY` for run-to-completion, or `startLstkInPTY`/`startCmdInPTY` returning a `ptyProc` with `waitForOutput`/`write`/`wait`/`kill` for interactive prompts — never `creack/pty` directly. The helpers wrap `charmbracelet/x/xpty` (Unix PTY on macOS/Linux, ConPTY on Windows), so PTY tests run on Windows too; output from `wait()`/`output()` is ANSI-stripped because ConPTY injects its own repaint sequences. `creack/pty` remains only in `signal_forwarding_test.go` (build-tagged `!windows`; POSIX signal semantics don't port).
 - Never fake an external CLI (`aws`, `az`, `terraform`, `cdk`, `sam`, `aws_completer`, browser openers) with a shell script — scripts don't run on Windows. Use `writeFakeTool`/`installFakeTool` (`test/integration/faketool_test.go`), which copy a compiled Go stand-in (`test-samples/faketool`) onto PATH configured via a JSON sidecar (echo lines with `{argN}`/`{args}`/`{env:NAME}` placeholders, arg-prefix cases like `--version`, sleep, exit codes, record-to-file).
diff --git a/go.mod b/go.mod
index 349d86e5..24a92fc0 100644
--- a/go.mod
+++ b/go.mod
@@ -13,6 +13,7 @@ require (
 	github.com/containerd/errdefs v1.0.0
 	github.com/creack/pty v1.1.24
 	github.com/docker/go-units v0.5.0
+	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.0
 	github.com/hashicorp/hcl/v2 v2.24.0
 	github.com/moby/moby/api v1.55.0
@@ -67,7 +68,6 @@ require (
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/godbus/dbus/v5 v5.2.2 // indirect
-	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
diff --git a/internal/extension/resolve.go b/internal/extension/resolve.go
index 98d34dc6..f6d9b8c9 100644
--- a/internal/extension/resolve.go
+++ b/internal/extension/resolve.go
@@ -6,6 +6,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	goruntime "runtime"
+	"slices"
 	"sort"
 	"strings"
 
@@ -128,7 +129,15 @@ func scanDir(dir string) []string {
 		}
 		name := strings.TrimPrefix(fileName, NamePrefix)
 		if goruntime.GOOS == "windows" {
-			name = strings.TrimSuffix(name, filepath.Ext(name))
+			// isExecutableFile accepts any regular file on Windows, so
+			// executability must be decided here by PATHEXT — otherwise a
+			// data file like lstk-extensions.toml lists as a phantom
+			// "extensions" extension.
+			ext := strings.ToLower(filepath.Ext(name))
+			if !slices.Contains(windowsExts(), ext) {
+				continue
+			}
+			name = strings.TrimSuffix(name, ext)
 		}
 		if name == "" {
 			continue
diff --git a/internal/output/__snapshots__/envelope_sink_test.snap b/internal/output/__snapshots__/envelope_sink_test.snap
new file mode 100644
index 00000000..d8305bcf
--- /dev/null
+++ b/internal/output/__snapshots__/envelope_sink_test.snap
@@ -0,0 +1,17 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestEnvelopeSink_UpdateCheckedEnvelopeJSON_1]
+{
+  "command": "update",
+  "data": {
+    "currentVersion": "<any>",
+    "latestVersion": "<any>",
+    "updateAvailable": true
+  },
+  "error": null,
+  "schemaVersion": 1,
+  "status": "ok",
+  "warnings": []
+}
+---
diff --git a/internal/output/__snapshots__/plain_sink_test.snap b/internal/output/__snapshots__/plain_sink_test.snap
new file mode 100644
index 00000000..02748312
--- /dev/null
+++ b/internal/output/__snapshots__/plain_sink_test.snap
@@ -0,0 +1,66 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestPlainSink_EmitsErrorEvent_1]
+Error: Connection failed
+  Cannot connect to Docker
+  ==> Start Docker: open -a Docker
+---
+
+[TestPlainSink_EmitsInstanceInfoEvent_full_1]
+✔︎ LocalStack AWS Emulator is running
+• Endpoint: localhost.localstack.cloud:4566
+• Persistence: Enabled
+• Container: localstack-aws
+• Version: <version>
+• Uptime: <time>
+---
+
+[TestPlainSink_EmitsInstanceInfoEvent_minimal_1]
+✔︎ LocalStack AWS Emulator is running
+• Endpoint: 127.0.0.1:4566
+---
+
+[TestPlainSink_EmitsLogLineEvent_1]
+2024-01-01 hello from container
+---
+
+[TestPlainSink_EmitsMessageEventInfo_1]
+hello
+---
+
+[TestPlainSink_EmitsMessageEventWarning_1]
+> Warning: something went wrong
+---
+
+[TestPlainSink_EmitsSpinnerEvent_active_spinner_1]
+Loading...
+---
+
+[TestPlainSink_EmitsStatusEvent_pulling_phase_1]
+Preparing LocalStack...
+---
+
+[TestPlainSink_EmitsStatusEvent_ready_phase_with_detail_1]
+✔︎ LocalStack is running (abc123)
+---
+
+[TestPlainSink_EmitsStatusEvent_ready_phase_without_detail_1]
+✔︎ LocalStack is running
+---
+
+[TestPlainSink_EmitsStatusEvent_starting_phase_1]
+Starting LocalStack...
+---
+
+[TestPlainSink_EmitsStatusEvent_unknown_phase_with_detail_1]
+LocalStack: custom (info)
+---
+
+[TestPlainSink_EmitsStatusEvent_unknown_phase_without_detail_1]
+LocalStack: custom
+---
+
+[TestPlainSink_EmitsStatusEvent_waiting_phase_1]
+Waiting for LocalStack to be ready...
+---
diff --git a/internal/output/envelope_sink_test.go b/internal/output/envelope_sink_test.go
index c50b69dc..6f52c17b 100644
--- a/internal/output/envelope_sink_test.go
+++ b/internal/output/envelope_sink_test.go
@@ -1,8 +1,12 @@
 package output
 
 import (
+	"encoding/json"
 	"errors"
 	"testing"
+
+	"github.com/localstack/lstk/internal/snap"
+	"github.com/stretchr/testify/require"
 )
 
 func TestEnvelopeSink_SuccessWithNoEvents(t *testing.T) {
@@ -40,30 +44,13 @@ func TestEnvelopeSink_EmulatorStoppedEventAccumulates(t *testing.T) {
 
 	envelope := sink.Result("stop", nil)
 	data, ok := envelope.Data.(map[string]any)
-	if !ok {
-		t.Fatalf("expected map[string]any data, got %T", envelope.Data)
-	}
+	require.True(t, ok)
 	entries, ok := data["emulators"].([]JsonEmulatorEntry)
-	if !ok {
-		t.Fatalf("expected []JsonEmulatorEntry emulators, got %T", data["emulators"])
-	}
-	if len(entries) != 2 {
-		t.Fatalf("expected 2 emulators, got %d", len(entries))
-	}
-	emulators := make([]JsonStoppedEmulator, len(entries))
-	for i, entry := range entries {
-		stopped, ok := entry.(JsonStoppedEmulator)
-		if !ok {
-			t.Fatalf("expected entry %d to be a JsonStoppedEmulator, got %T", i, entry)
-		}
-		emulators[i] = stopped
-	}
-	if emulators[0].Type != "aws" || emulators[0].Name != "localstack-aws" || !emulators[0].WasRunning {
-		t.Fatalf("unexpected first emulator entry: %+v", emulators[0])
-	}
-	if emulators[1].Type != "snowflake" {
-		t.Fatalf("unexpected second emulator entry: %+v", emulators[1])
-	}
+	require.True(t, ok)
+	require.Equal(t, []JsonEmulatorEntry{
+		JsonStoppedEmulator{JsonEmulatorRef: JsonEmulatorRef{Type: "aws", Name: "localstack-aws"}, WasRunning: true},
+		JsonStoppedEmulator{JsonEmulatorRef: JsonEmulatorRef{Type: "snowflake", Name: "localstack-snowflake"}, WasRunning: true},
+	}, entries)
 }
 
 func TestEnvelopeSink_EmulatorResetEvent(t *testing.T) {
@@ -102,6 +89,19 @@ func TestEnvelopeSink_UpdateCheckedEvent(t *testing.T) {
 	}
 }
 
+// TestEnvelopeSink_UpdateCheckedEnvelopeJSON pins the full serialized
+// envelope shape (schemaVersion, status, data, warnings) as a snapshot,
+// masking the version fields that vary in real runs.
+func TestEnvelopeSink_UpdateCheckedEnvelopeJSON(t *testing.T) {
+	sink := NewEnvelopeSink(FormatJSON)
+	sink.Emit(UpdateCheckedEvent{CurrentVersion: "2.2.1", LatestVersion: "2.3.0", Available: true})
+
+	envelope := sink.Result("update", nil)
+	raw, err := json.Marshal(envelope)
+	require.NoError(t, err)
+	snap.MatchJSON(t, raw, "data.currentVersion", "data.latestVersion")
+}
+
 func TestEnvelopeSink_UpdateAppliedEvent(t *testing.T) {
 	t.Parallel()
 
@@ -153,30 +153,16 @@ func TestEnvelopeSink_ErrorEventSetsClassifiedError(t *testing.T) {
 	})
 
 	envelope := sink.Result("reset", errors.New("LocalStack is not running"))
-	if envelope.Status != StatusError {
-		t.Fatalf("expected status %q, got %q", StatusError, envelope.Status)
-	}
-	if envelope.Data != nil {
-		t.Fatalf("expected nil data on error, got %+v", envelope.Data)
-	}
-	if envelope.Error == nil {
-		t.Fatal("expected non-nil error")
-	}
-	if envelope.Error.Code != ErrEmulatorNotRunning {
-		t.Fatalf("expected code %q, got %q", ErrEmulatorNotRunning, envelope.Error.Code)
-	}
-	if envelope.Error.Category != CategoryEmulator {
-		t.Fatalf("expected category %q, got %q", CategoryEmulator, envelope.Error.Category)
-	}
-	if envelope.Error.Retryable != ErrEmulatorNotRunning.Retryable() {
-		t.Fatalf("expected retryable %v to match the code's static classification", ErrEmulatorNotRunning.Retryable())
-	}
-	if envelope.Error.Message != "LocalStack is not running" {
-		t.Fatalf("expected message %q, got %q", "LocalStack is not running", envelope.Error.Message)
-	}
-	if len(envelope.Error.Actions) != 1 || envelope.Error.Actions[0].ID != "start-localstack" || envelope.Error.Actions[0].Command != "lstk" {
-		t.Fatalf("unexpected actions: %+v", envelope.Error.Actions)
-	}
+	require.Equal(t, StatusError, envelope.Status)
+	require.Nil(t, envelope.Data)
+	require.NotNil(t, envelope.Error)
+	require.Equal(t, &EnvelopeError{
+		Code:      ErrEmulatorNotRunning,
+		Category:  CategoryEmulator,
+		Message:   "LocalStack is not running",
+		Retryable: ErrEmulatorNotRunning.Retryable(),
+		Actions:   []EnvelopeAction{{ID: "start-localstack", Command: "lstk"}},
+	}, envelope.Error)
 }
 
 // TestEnvelopeSink_ErrorEventIncludesSummaryInDetails covers PR #374's report
diff --git a/internal/output/main_test.go b/internal/output/main_test.go
new file mode 100644
index 00000000..ad1d1413
--- /dev/null
+++ b/internal/output/main_test.go
@@ -0,0 +1,14 @@
+package output
+
+import (
+	"os"
+	"testing"
+
+	"github.com/localstack/lstk/internal/snap"
+)
+
+// TestMain wires snapshot cleanup: snapshots no test uses anymore fail the
+// run (or are deleted with UPDATE_SNAPS=true).
+func TestMain(m *testing.M) {
+	os.Exit(snap.Clean(m))
+}
diff --git a/internal/output/plain_sink_test.go b/internal/output/plain_sink_test.go
index 379745c7..884d585c 100644
--- a/internal/output/plain_sink_test.go
+++ b/internal/output/plain_sink_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -25,7 +26,7 @@ func TestPlainSink_EmitsMessageEventInfo(t *testing.T) {
 
 	sink.Emit(MessageEvent{Severity: SeverityInfo, Text: "hello"})
 
-	assert.Equal(t, "hello\n", out.String())
+	snap.Match(t, out.String())
 }
 
 func TestPlainSink_EmitsMessageEventWarning(t *testing.T) {
@@ -34,49 +35,41 @@ func TestPlainSink_EmitsMessageEventWarning(t *testing.T) {
 
 	sink.Emit(MessageEvent{Severity: SeverityWarning, Text: "something went wrong"})
 
-	assert.Equal(t, "> Warning: something went wrong\n", out.String())
+	snap.Match(t, out.String())
 }
 
 func TestPlainSink_EmitsStatusEvent(t *testing.T) {
 	tests := []struct {
-		name     string
-		event    ContainerStatusEvent
-		expected string
+		name  string
+		event ContainerStatusEvent
 	}{
 		{
-			name:     "pulling phase",
-			event:    ContainerStatusEvent{Phase: "pulling", Container: "localstack/localstack:latest"},
-			expected: "Preparing LocalStack...\n",
+			name:  "pulling phase",
+			event: ContainerStatusEvent{Phase: "pulling", Container: "localstack/localstack:latest"},
 		},
 		{
-			name:     "starting phase",
-			event:    ContainerStatusEvent{Phase: "starting", Container: "localstack-aws"},
-			expected: "Starting LocalStack...\n",
+			name:  "starting phase",
+			event: ContainerStatusEvent{Phase: "starting", Container: "localstack-aws"},
 		},
 		{
-			name:     "waiting phase",
-			event:    ContainerStatusEvent{Phase: "waiting", Container: "localstack-aws"},
-			expected: "Waiting for LocalStack to be ready...\n",
+			name:  "waiting phase",
+			event: ContainerStatusEvent{Phase: "waiting", Container: "localstack-aws"},
 		},
 		{
-			name:     "ready phase with detail",
-			event:    ContainerStatusEvent{Phase: "ready", Container: "localstack-aws", Detail: "abc123"},
-			expected: fmt.Sprintf("%s LocalStack is running (abc123)\n", SuccessMarker()),
+			name:  "ready phase with detail",
+			event: ContainerStatusEvent{Phase: "ready", Container: "localstack-aws", Detail: "abc123"},
 		},
 		{
-			name:     "ready phase without detail",
-			event:    ContainerStatusEvent{Phase: "ready", Container: "localstack-aws"},
-			expected: fmt.Sprintf("%s LocalStack is running\n", SuccessMarker()),
+			name:  "ready phase without detail",
+			event: ContainerStatusEvent{Phase: "ready", Container: "localstack-aws"},
 		},
 		{
-			name:     "unknown phase with detail",
-			event:    ContainerStatusEvent{Phase: "custom", Container: "localstack-aws", Detail: "info"},
-			expected: "LocalStack: custom (info)\n",
+			name:  "unknown phase with detail",
+			event: ContainerStatusEvent{Phase: "custom", Container: "localstack-aws", Detail: "info"},
 		},
 		{
-			name:     "unknown phase without detail",
-			event:    ContainerStatusEvent{Phase: "custom", Container: "localstack-aws"},
-			expected: "LocalStack: custom\n",
+			name:  "unknown phase without detail",
+			event: ContainerStatusEvent{Phase: "custom", Container: "localstack-aws"},
 		},
 	}
 
@@ -87,7 +80,7 @@ func TestPlainSink_EmitsStatusEvent(t *testing.T) {
 
 			sink.Emit(tt.event)
 
-			assert.Equal(t, tt.expected, out.String())
+			snap.Match(t, out.String())
 		})
 	}
 }
@@ -122,7 +115,7 @@ func TestPlainSink_EmitsLogLineEvent(t *testing.T) {
 
 	sink.Emit(LogLineEvent{Source: "container", Line: "2024-01-01 hello from container"})
 
-	assert.Equal(t, "2024-01-01 hello from container\n", out.String())
+	snap.Match(t, out.String())
 }
 
 func TestPlainSink_EmitsSpinnerEvent(t *testing.T) {
@@ -132,7 +125,7 @@ func TestPlainSink_EmitsSpinnerEvent(t *testing.T) {
 
 		sink.Emit(SpinnerEvent{Active: true, Text: "Loading"})
 
-		assert.Equal(t, "Loading...\n", out.String())
+		snap.Match(t, out.String())
 	})
 
 	t.Run("stop spinner is silent", func(t *testing.T) {
@@ -155,8 +148,7 @@ func TestPlainSink_EmitsErrorEvent(t *testing.T) {
 		Actions: []ErrorAction{{Label: "Start Docker:", Value: "open -a Docker"}},
 	})
 
-	expected := "Error: Connection failed\n  Cannot connect to Docker\n  ==> Start Docker: open -a Docker\n"
-	assert.Equal(t, expected, out.String())
+	snap.Match(t, out.String())
 }
 
 func TestPlainSink_EmitsInstanceInfoEvent(t *testing.T) {
@@ -173,8 +165,7 @@ func TestPlainSink_EmitsInstanceInfoEvent(t *testing.T) {
 			Persistence:   true,
 		})
 
-		expected := SuccessMarker() + " LocalStack AWS Emulator is running\n• Endpoint: localhost.localstack.cloud:4566\n• Persistence: Enabled\n• Container: localstack-aws\n• Version: 4.14.1\n• Uptime: 4m 23s\n"
-		assert.Equal(t, expected, out.String())
+		snap.Match(t, sanitizeSnapshot(out.String()))
 		assert.NoError(t, sink.Err())
 	})
 
@@ -187,8 +178,7 @@ func TestPlainSink_EmitsInstanceInfoEvent(t *testing.T) {
 			Host:         "127.0.0.1:4566",
 		})
 
-		expected := SuccessMarker() + " LocalStack AWS Emulator is running\n• Endpoint: 127.0.0.1:4566\n"
-		assert.Equal(t, expected, out.String())
+		snap.Match(t, out.String())
 		assert.NoError(t, sink.Err())
 	})
 
diff --git a/internal/output/snapshot_sanitize_test.go b/internal/output/snapshot_sanitize_test.go
new file mode 100644
index 00000000..711071df
--- /dev/null
+++ b/internal/output/snapshot_sanitize_test.go
@@ -0,0 +1,48 @@
+package output
+
+import (
+	"regexp"
+	"testing"
+)
+
+// snap.MatchJSON masks volatile values via dotted paths, but plain-text
+// snap.Match has no masking hook. sanitizeSnapshot fills that gap: it
+// replaces volatile values in rendered CLI output with stable placeholders
+// so text snapshots stay deterministic across runs.
+//
+// The patterns are label-anchored rather than value-shaped on purpose: Go's
+// RE2 has no lookahead, so a bare semver pattern (\d+\.\d+\.\d+) would also
+// match inside IPv4 addresses ("127.0.0.1" contains "0.0.1" at a word
+// boundary). Anchoring on the rendered label sidesteps that class of
+// collision; add a new labeled pattern here when another volatile value
+// shows up in snapshot output.
+var (
+	snapshotVersionRe = regexp.MustCompile(`(Version: )\S+`)
+	snapshotUptimeRe  = regexp.MustCompile(`(?m)(Uptime: ).+$`)
+)
+
+func sanitizeSnapshot(s string) string {
+	s = snapshotVersionRe.ReplaceAllString(s, "${1}<version>")
+	s = snapshotUptimeRe.ReplaceAllString(s, "${1}<time>")
+	return s
+}
+
+func TestSanitizeSnapshot(t *testing.T) {
+	t.Parallel()
+
+	cases := map[string]string{
+		"• Version: 4.14.1":          "• Version: <version>",
+		"• Version: v2.3.0-rc1":      "• Version: <version>",
+		"• Uptime: 4m 23s":           "• Uptime: <time>",
+		"• Uptime: 1h 2m 3s":         "• Uptime: <time>",
+		"• Uptime: 42s":              "• Uptime: <time>",
+		"• Endpoint: 127.0.0.1:4566": "• Endpoint: 127.0.0.1:4566",
+		"plain text untouched":       "plain text untouched",
+		"• Version: 4.14.1\n• Uptime: 4m 23s\n• Container: localstack-aws": "• Version: <version>\n• Uptime: <time>\n• Container: localstack-aws",
+	}
+	for in, want := range cases {
+		if got := sanitizeSnapshot(in); got != want {
+			t.Errorf("sanitizeSnapshot(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
diff --git a/internal/snap/snap.go b/internal/snap/snap.go
new file mode 100644
index 00000000..f735b6fc
--- /dev/null
+++ b/internal/snap/snap.go
@@ -0,0 +1,434 @@
+// Package snap is a minimal file-snapshot testing helper: Match compares a
+// string against a snapshot stored under __snapshots__/ next to the calling
+// test file, and Clean (wired via TestMain) removes snapshots no test uses
+// anymore. In-house replacement for the subset of go-snaps that lstk uses.
+//
+// Workflow: a missing snapshot is created on the first local run (never in
+// CI, where it fails instead). On a mismatch the test fails with a diff;
+// UPDATE_SNAPS=true go test ./... rewrites snapshots and lets Clean delete
+// obsolete ones.
+//
+// Storage is one archive per test file (__snapshots__/<test_file>.snap) with
+// one section per Match call:
+//
+//	[TestName_1]
+//	value
+//	---
+//
+//	[TestName_2]
+//	...
+//
+// N is the Match call number within the test. A value's newlines are stored
+// verbatim; the "---" terminator always sits on its own line, so a value not
+// ending in a newline gets one — a snapshot therefore cannot distinguish a
+// value from the same value plus one final newline. The format has no
+// escaping: a value containing a line that is exactly "---" cannot be stored;
+// write guards against that with a parse round-trip and fails with guidance
+// to sanitize the value instead.
+package snap
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"runtime"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+// header is the comment block of every archive, kept canonical on rewrite.
+const header = "Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites\nthis file.\n\n"
+
+const terminator = "---"
+
+// Test-only helper state: the visited registry must span all tests in the
+// package so Clean can tell live snapshots from obsolete ones. The mutex also
+// serializes read-modify-write cycles on archives shared by parallel tests.
+var (
+	mu      sync.Mutex
+	visited = map[string]map[string]bool{} // archive path -> entry name -> seen
+	calls   = map[string]int{}             // archive path + test name -> Match call count
+)
+
+var (
+	unsafeChars = regexp.MustCompile(`[^A-Za-z0-9._-]+`)
+	entryStart  = regexp.MustCompile(`^\[(.+)\]$`)
+)
+
+// entry is one named snapshot inside an archive.
+type entry struct {
+	name  string
+	value string
+}
+
+// Match compares got against the stored snapshot for the calling test,
+// creating the snapshot on first local run or rewriting it when
+// UPDATE_SNAPS=true.
+func Match(t testing.TB, got string) {
+	t.Helper()
+	match(t, got, callerArchive(t))
+}
+
+// MatchJSON snapshots got (a JSON document) in canonical pretty-printed form
+// (two-space indent, object keys sorted by encoding/json), after replacing
+// the values at the given dotted paths (e.g. "data.currentVersion") with the
+// placeholder "<any>". Use the paths to mask values that legitimately change
+// between runs. A path that doesn't resolve fails the test, so a masked
+// field disappearing is caught rather than silently ignored. Paths traverse
+// JSON objects only; there is no array-index syntax.
+func MatchJSON(t testing.TB, got []byte, maskPaths ...string) {
+	t.Helper()
+	// The returns after Fatalf matter: tests exercise this path with a fake
+	// TB whose Fatalf does not stop the goroutine like *testing.T's does,
+	// and a fallthrough would store a bogus snapshot.
+	var v any
+	if err := json.Unmarshal(got, &v); err != nil {
+		t.Fatalf("snap: value is not valid JSON: %v", err)
+		return
+	}
+	for _, path := range maskPaths {
+		if !mask(v, strings.Split(path, ".")) {
+			t.Fatalf("snap: mask path %q not found in JSON", path)
+			return
+		}
+	}
+	// An Encoder rather than MarshalIndent so the "<any>" placeholder isn't
+	// HTML-escaped (u003c/u003e) in the stored snapshot. Encode appends the
+	// trailing newline.
+	var buf bytes.Buffer
+	enc := json.NewEncoder(&buf)
+	enc.SetEscapeHTML(false)
+	enc.SetIndent("", "  ")
+	if err := enc.Encode(v); err != nil {
+		t.Fatalf("snap: %v", err)
+	}
+	match(t, buf.String(), callerArchive(t))
+}
+
+// mask walks nested JSON objects along path segments and replaces the final
+// value with "<any>", reporting whether the full path resolved.
+func mask(v any, segs []string) bool {
+	m, ok := v.(map[string]any)
+	if !ok {
+		return false
+	}
+	if len(segs) == 1 {
+		if _, ok := m[segs[0]]; !ok {
+			return false
+		}
+		m[segs[0]] = "<any>"
+		return true
+	}
+	return mask(m[segs[0]], segs[1:])
+}
+
+// callerArchive resolves the archive for the test file that called the
+// exported Match/MatchJSON function (two frames up):
+// <dir>/__snapshots__/<test_file_without_.go>.snap.
+func callerArchive(t testing.TB) string {
+	t.Helper()
+	_, file, _, ok := runtime.Caller(2)
+	if !ok {
+		t.Fatal("snap: cannot resolve calling test file")
+	}
+	base := strings.TrimSuffix(filepath.Base(file), ".go")
+	return filepath.Join(filepath.Dir(file), "__snapshots__", base+".snap")
+}
+
+// parseArchive decodes the archive format. Everything before the first
+// "[name]" line is the header comment and is discarded (rewrites emit the
+// canonical header). Each entry's value is the lines between its "[name]"
+// line and the next "---" line, verbatim; blank lines between entries are
+// separators.
+func parseArchive(data []byte) ([]entry, error) {
+	var entries []entry
+	lines := strings.Split(string(data), "\n")
+	for i := 0; i < len(lines); i++ {
+		m := entryStart.FindStringSubmatch(lines[i])
+		if m == nil {
+			continue
+		}
+		var value strings.Builder
+		terminated := false
+		j := i + 1
+		for ; j < len(lines); j++ {
+			if lines[j] == terminator {
+				terminated = true
+				break
+			}
+			value.WriteString(lines[j])
+			value.WriteString("\n")
+		}
+		if !terminated {
+			return nil, fmt.Errorf("entry %q has no %q terminator", m[1], terminator)
+		}
+		entries = append(entries, entry{name: m[1], value: value.String()})
+		i = j
+	}
+	return entries, nil
+}
+
+// formatArchive encodes entries (name-sorted) with the canonical header, the
+// "---" terminator on its own line, and one blank line between entries. A
+// value not ending in a newline gets one so the terminator stays on its own
+// line.
+func formatArchive(entries []entry) []byte {
+	sort.Slice(entries, func(i, j int) bool { return entries[i].name < entries[j].name })
+	var b strings.Builder
+	b.WriteString(header)
+	for i, e := range entries {
+		if i > 0 {
+			b.WriteString("\n")
+		}
+		b.WriteString("[" + e.name + "]\n")
+		v := e.value
+		if v != "" && !strings.HasSuffix(v, "\n") {
+			v += "\n"
+		}
+		b.WriteString(v)
+		b.WriteString(terminator + "\n")
+	}
+	return []byte(b.String())
+}
+
+// readArchive parses the archive at path. A missing file is an empty archive.
+func readArchive(path string) ([]entry, error) {
+	data, err := os.ReadFile(path)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return parseArchive(data)
+}
+
+// entryValue returns the entry's value and whether it exists.
+func entryValue(entries []entry, name string) (string, bool) {
+	for _, e := range entries {
+		if e.name == name {
+			return e.value, true
+		}
+	}
+	return "", false
+}
+
+// ensureNL normalizes a value for comparison: the terminator sits on its own
+// line, so stored values always end with a newline — a value without one is
+// indistinguishable from the same value with one.
+func ensureNL(s string) string {
+	if s != "" && !strings.HasSuffix(s, "\n") {
+		return s + "\n"
+	}
+	return s
+}
+
+func match(t testing.TB, got, archive string) {
+	t.Helper()
+	if n := flagValue("test.count"); n != "" && n != "1" {
+		t.Fatalf("snap: -count > 1 is not supported (snapshot call numbering would repeat)")
+	}
+	got = ensureNL(got)
+
+	mu.Lock()
+	defer mu.Unlock()
+
+	key := archive + "|" + t.Name()
+	calls[key]++
+	name := unsafeChars.ReplaceAllString(t.Name(), "_") + "_" + strconv.Itoa(calls[key])
+	if visited[archive] == nil {
+		visited[archive] = map[string]bool{}
+	}
+	visited[archive][name] = true
+
+	entries, err := readArchive(archive)
+	if err != nil {
+		t.Fatalf("snap: reading %s: %v", archive, err)
+		return
+	}
+	want, exists := entryValue(entries, name)
+	update := os.Getenv("UPDATE_SNAPS") == "true"
+	switch {
+	case !exists:
+		if isCI() && !update {
+			t.Fatalf("snap: missing snapshot %q in %s (snapshots are never created in CI; run the test locally and commit the file)", name, archive)
+			return
+		}
+		writeEntry(t, archive, entries, name, got)
+		t.Logf("snap: created %q in %s", name, archive)
+	case want != got:
+		if update {
+			writeEntry(t, archive, entries, name, got)
+			t.Logf("snap: updated %q in %s", name, archive)
+			return
+		}
+		t.Errorf("snapshot mismatch (-want +got):\n%s\nrun UPDATE_SNAPS=true go test to update %s", cmp.Diff(want, got), archive)
+	}
+}
+
+// writeEntry upserts name=value into the archive and saves it. A parse
+// round-trip guards against values the format cannot represent (a line that
+// is exactly the "---" terminator); such values must be sanitized by the
+// caller instead. Callers hold mu.
+func writeEntry(t testing.TB, path string, entries []entry, name, value string) {
+	t.Helper()
+	replaced := false
+	for i := range entries {
+		if entries[i].name == name {
+			entries[i].value = value
+			replaced = true
+			break
+		}
+	}
+	if !replaced {
+		entries = append(entries, entry{name: name, value: value})
+	}
+
+	out := formatArchive(entries)
+	back, err := parseArchive(out)
+	if err == nil {
+		if got, ok := entryValue(back, name); !ok || got != ensureNL(value) {
+			err = fmt.Errorf("value does not survive the round-trip")
+		}
+	}
+	if err != nil {
+		t.Fatalf("snap: value for %q cannot be stored (%v — it likely contains a line that is exactly %q); sanitize the value before snapshotting", name, err, terminator)
+		return
+	}
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatalf("snap: %v", err)
+	}
+	if err := os.WriteFile(path, out, 0o644); err != nil {
+		t.Fatalf("snap: %v", err)
+	}
+}
+
+// Clean runs the package's tests and then handles obsolete snapshots: archive
+// entries no Match call used, and whole .snap archives in visited snapshot
+// directories that no test touched. They are deleted when UPDATE_SNAPS=true,
+// otherwise reported as an error (non-zero exit) so stale snapshots can't
+// linger unnoticed. Wire it in TestMain:
+//
+//	func TestMain(m *testing.M) { os.Exit(snap.Clean(m)) }
+//
+// Cleanup is skipped on failed or filtered runs (-run/-skip), where "not
+// visited" doesn't mean obsolete.
+func Clean(m *testing.M) int {
+	code := m.Run()
+	if code != 0 || flagValue("test.run") != "" || flagValue("test.skip") != "" {
+		return code
+	}
+	update := os.Getenv("UPDATE_SNAPS") == "true"
+	mu.Lock()
+	defer mu.Unlock()
+
+	for archive, seen := range visited {
+		n, err := cleanEntries(archive, seen, update)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "snap: cleaning %s: %v\n", archive, err)
+			code = 1
+		} else if n > 0 && !update {
+			code = 1
+		}
+	}
+	if n, err := cleanOrphanArchives(update); err != nil {
+		fmt.Fprintf(os.Stderr, "snap: cleaning orphan archives: %v\n", err)
+		code = 1
+	} else if n > 0 && !update {
+		code = 1
+	}
+	return code
+}
+
+// cleanEntries deletes (update mode) or reports entries of archive that no
+// Match call visited, returning how many it found. An archive left with no
+// entries is removed entirely.
+func cleanEntries(archive string, seen map[string]bool, update bool) (int, error) {
+	entries, err := readArchive(archive)
+	if err != nil {
+		return 0, err
+	}
+	var live []entry
+	obsolete := 0
+	for _, e := range entries {
+		if seen[e.name] {
+			live = append(live, e)
+			continue
+		}
+		obsolete++
+		if update {
+			fmt.Fprintf(os.Stderr, "snap: removed obsolete snapshot %q from %s\n", e.name, archive)
+		} else {
+			fmt.Fprintf(os.Stderr, "snap: obsolete snapshot %q in %s (UPDATE_SNAPS=true go test to remove)\n", e.name, archive)
+		}
+	}
+	if obsolete == 0 || !update {
+		return obsolete, nil
+	}
+	if len(live) == 0 {
+		return obsolete, os.Remove(archive)
+	}
+	return obsolete, os.WriteFile(archive, formatArchive(live), 0o644)
+}
+
+// cleanOrphanArchives deletes (update mode) or reports .snap files in visited
+// snapshot directories that no test visited — typically archives of deleted
+// or renamed test files.
+//
+// ponytail: only directories where at least one Match ran this process are
+// examined — deleting a whole test file orphans its archive until some other
+// test in the same directory runs Match. Acceptable: any later full package
+// run flags it.
+func cleanOrphanArchives(update bool) (int, error) {
+	dirs := map[string]bool{}
+	for archive := range visited {
+		dirs[filepath.Dir(archive)] = true
+	}
+	orphans := 0
+	for dir := range dirs {
+		entries, err := os.ReadDir(dir)
+		if errors.Is(err, os.ErrNotExist) {
+			continue
+		}
+		if err != nil {
+			return orphans, err
+		}
+		for _, e := range entries {
+			path := filepath.Join(dir, e.Name())
+			if e.IsDir() || !strings.HasSuffix(e.Name(), ".snap") || visited[path] != nil {
+				continue
+			}
+			orphans++
+			if update {
+				if err := os.Remove(path); err != nil {
+					return orphans, err
+				}
+				fmt.Fprintf(os.Stderr, "snap: removed orphan snapshot archive %s\n", path)
+			} else {
+				fmt.Fprintf(os.Stderr, "snap: orphan snapshot archive %s (UPDATE_SNAPS=true go test to remove)\n", path)
+			}
+		}
+	}
+	return orphans, nil
+}
+
+func isCI() bool {
+	return os.Getenv("CI") != ""
+}
+
+func flagValue(name string) string {
+	if f := flag.Lookup(name); f != nil {
+		return f.Value.String()
+	}
+	return ""
+}
diff --git a/internal/snap/snap_test.go b/internal/snap/snap_test.go
new file mode 100644
index 00000000..9084cc06
--- /dev/null
+++ b/internal/snap/snap_test.go
@@ -0,0 +1,426 @@
+package snap
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// fakeT records failures instead of failing the real test. Only the methods
+// Match uses are implemented; anything else nil-panics loudly.
+type fakeT struct {
+	testing.TB
+	name   string
+	failed bool
+	fatal  bool
+	msg    string
+	logs   []string
+}
+
+func (f *fakeT) Helper()      {}
+func (f *fakeT) Name() string { return f.name }
+
+func (f *fakeT) Fatal(args ...any) { f.failed, f.fatal = true, true }
+
+func (f *fakeT) Fatalf(format string, args ...any) {
+	f.failed, f.fatal = true, true
+	f.msg = format
+}
+
+func (f *fakeT) Errorf(format string, args ...any) {
+	f.failed = true
+	f.msg = format
+}
+
+func (f *fakeT) Logf(format string, args ...any) {
+	f.logs = append(f.logs, format)
+}
+
+// testArchive returns the archive Match uses when called from this file
+// (snap_test.go) and registers cleanup of the file and the helper registry so
+// tests stay independent. These tests are sequential (t.Setenv forbids
+// t.Parallel), so resetting the whole registry is safe.
+func testArchive(t *testing.T) string {
+	t.Helper()
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(wd, "__snapshots__", "snap_test.snap")
+	t.Cleanup(func() {
+		_ = os.Remove(path)
+		mu.Lock()
+		defer mu.Unlock()
+		visited = map[string]map[string]bool{}
+		calls = map[string]int{}
+	})
+	return path
+}
+
+// getEntry reads the named entry from the archive, reporting whether it
+// exists.
+func getEntry(t *testing.T, archive, name string) (string, bool) {
+	t.Helper()
+	entries, err := readArchive(archive)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return entryValue(entries, name)
+}
+
+// seed writes the given entries into the archive directly.
+func seed(t *testing.T, archive string, values map[string]string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(archive), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	var entries []entry
+	for name, value := range values {
+		entries = append(entries, entry{name: name, value: ensureNL(value)})
+	}
+	if err := os.WriteFile(archive, formatArchive(entries), 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestMatchCreatesThenMatches(t *testing.T) {
+	t.Setenv("CI", "")
+	t.Setenv("UPDATE_SNAPS", "")
+	archive := testArchive(t)
+
+	ft := &fakeT{name: "TestFakeCreate"}
+	Match(ft, "hello\nworld\n")
+	if ft.failed {
+		t.Fatalf("first Match should create, not fail: %q", ft.msg)
+	}
+	got, ok := getEntry(t, archive, "TestFakeCreate_1")
+	if !ok || got != "hello\nworld\n" {
+		t.Fatalf("stored entry: %q ok=%v", got, ok)
+	}
+
+	// Same test name matches again on a fresh run (reset the call counter).
+	mu.Lock()
+	delete(calls, archive+"|TestFakeCreate")
+	mu.Unlock()
+	ft = &fakeT{name: "TestFakeCreate"}
+	Match(ft, "hello\nworld\n")
+	if ft.failed {
+		t.Fatalf("re-Match against stored snapshot failed: %q", ft.msg)
+	}
+}
+
+func TestMatchFailsOnMismatch(t *testing.T) {
+	t.Setenv("CI", "")
+	t.Setenv("UPDATE_SNAPS", "")
+	archive := testArchive(t)
+	seed(t, archive, map[string]string{"TestFakeMismatch_1": "old"})
+
+	ft := &fakeT{name: "TestFakeMismatch"}
+	Match(ft, "new")
+	if !ft.failed || ft.fatal {
+		t.Fatalf("mismatch should Errorf: failed=%v fatal=%v", ft.failed, ft.fatal)
+	}
+	if !strings.Contains(ft.msg, "-want +got") {
+		t.Fatalf("mismatch message should carry a diff, got %q", ft.msg)
+	}
+}
+
+func TestMatchUpdatesOnEnv(t *testing.T) {
+	t.Setenv("CI", "")
+	t.Setenv("UPDATE_SNAPS", "true")
+	archive := testArchive(t)
+	seed(t, archive, map[string]string{
+		"TestFakeUpdate_1": "old",
+		"TestOther_1":      "untouched",
+	})
+
+	ft := &fakeT{name: "TestFakeUpdate"}
+	Match(ft, "new")
+	if ft.failed {
+		t.Fatalf("update mode should rewrite, not fail: %q", ft.msg)
+	}
+	if got, ok := getEntry(t, archive, "TestFakeUpdate_1"); !ok || got != "new\n" {
+		t.Fatalf("entry not updated: %q ok=%v", got, ok)
+	}
+	if got, ok := getEntry(t, archive, "TestOther_1"); !ok || got != "untouched\n" {
+		t.Fatalf("sibling entry must survive an update: %q ok=%v", got, ok)
+	}
+}
+
+func TestMatchMissingSnapshotFailsInCI(t *testing.T) {
+	t.Setenv("CI", "true")
+	t.Setenv("UPDATE_SNAPS", "")
+	archive := testArchive(t)
+
+	ft := &fakeT{name: "TestFakeCI"}
+	Match(ft, "content")
+	if !ft.fatal {
+		t.Fatal("missing snapshot in CI must be fatal")
+	}
+	if _, ok := getEntry(t, archive, "TestFakeCI_1"); ok {
+		t.Fatal("snapshot must not be created in CI")
+	}
+}
+
+func TestMatchCountsCallsWithinOneTest(t *testing.T) {
+	t.Setenv("CI", "")
+	t.Setenv("UPDATE_SNAPS", "")
+	archive := testArchive(t)
+
+	ft := &fakeT{name: "TestFakeMulti"}
+	Match(ft, "first")
+	Match(ft, "second")
+	if ft.failed {
+		t.Fatalf("unexpected failure: %q", ft.msg)
+	}
+	for name, want := range map[string]string{"TestFakeMulti_1": "first\n", "TestFakeMulti_2": "second\n"} {
+		if got, ok := getEntry(t, archive, name); !ok || got != want {
+			t.Fatalf("%s: got=%q ok=%v", name, got, ok)
+		}
+	}
+}
+
+func TestMatchJSONMasksAndCanonicalizes(t *testing.T) {
+	t.Setenv("CI", "")
+	t.Setenv("UPDATE_SNAPS", "")
+	archive := testArchive(t)
+
+	ft := &fakeT{name: "TestFakeJSON"}
+	MatchJSON(ft, []byte(`{"zebra":1,"data":{"version":"4.14.1","name":"aws"}}`), "data.version")
+	if ft.failed {
+		t.Fatalf("unexpected failure: %q", ft.msg)
+	}
+	got, ok := getEntry(t, archive, "TestFakeJSON_1")
+	if !ok {
+		t.Fatal("entry missing")
+	}
+	if !strings.Contains(got, `"version": "<any>"`) {
+		t.Fatalf("masked value missing: %s", got)
+	}
+	if strings.Contains(got, "4.14.1") {
+		t.Fatalf("volatile value leaked into snapshot: %s", got)
+	}
+	if strings.Index(got, `"data"`) > strings.Index(got, `"zebra"`) {
+		t.Fatalf("keys not sorted: %s", got)
+	}
+}
+
+func TestMatchJSONFailsOnMissingMaskPath(t *testing.T) {
+	t.Setenv("CI", "")
+	ft := &fakeT{name: "TestFakeJSONBadPath"}
+	MatchJSON(ft, []byte(`{"data":{}}`), "data.version")
+	if !ft.fatal {
+		t.Fatal("missing mask path must be fatal")
+	}
+}
+
+func TestMatchJSONFailsOnInvalidJSON(t *testing.T) {
+	t.Setenv("CI", "")
+	ft := &fakeT{name: "TestFakeJSONInvalid"}
+	MatchJSON(ft, []byte(`not json`))
+	if !ft.fatal {
+		t.Fatal("invalid JSON must be fatal")
+	}
+}
+
+func TestMatchJSONFatalPathsWriteNoSnapshot(t *testing.T) {
+	t.Setenv("CI", "")
+	archive := testArchive(t)
+
+	MatchJSON(&fakeT{name: "TestFakeJSONInvalid"}, []byte(`not json`))
+	MatchJSON(&fakeT{name: "TestFakeJSONBadPath"}, []byte(`{"data":{}}`), "data.version")
+
+	for _, name := range []string{"TestFakeJSONInvalid_1", "TestFakeJSONBadPath_1"} {
+		if _, ok := getEntry(t, archive, name); ok {
+			t.Fatalf("fatal MatchJSON call must not write %s", name)
+		}
+	}
+}
+
+// TestMatchRejectsTerminatorCollision pins the format limitation: a value
+// containing a line that is exactly the "---" terminator cannot be stored and
+// must fail loudly instead of corrupting the archive.
+func TestMatchRejectsTerminatorCollision(t *testing.T) {
+	t.Setenv("CI", "")
+	t.Setenv("UPDATE_SNAPS", "")
+	archive := testArchive(t)
+
+	ft := &fakeT{name: "TestFakeCollision"}
+	Match(ft, "before\n---\nafter")
+	if !ft.fatal {
+		t.Fatal("terminator collision must be fatal")
+	}
+	if !strings.Contains(ft.msg, "sanitize") {
+		t.Fatalf("collision message should point at sanitizing, got %q", ft.msg)
+	}
+	if _, err := os.Stat(archive); !os.IsNotExist(err) {
+		t.Fatal("colliding value must not be written")
+	}
+}
+
+// TestMatchTrailingNewlineInvariant pins the terminator contract: "---"
+// always sits on its own line, a value and the same value plus one final
+// newline are indistinguishable, but additional trailing blank lines are
+// preserved and distinguish values.
+func TestMatchTrailingNewlineInvariant(t *testing.T) {
+	t.Setenv("CI", "")
+	t.Setenv("UPDATE_SNAPS", "")
+	archive := testArchive(t)
+
+	ft := &fakeT{name: "TestFakeEOF"}
+	Match(ft, "line")
+	raw, err := os.ReadFile(archive)
+	if err != nil || !strings.HasSuffix(string(raw), "line\n---\n") {
+		t.Fatalf("terminator should sit on its own line: %q err=%v", raw, err)
+	}
+
+	// "line" and "line\n" are the same snapshot; "line\n\n" is not.
+	for got, wantMatch := range map[string]bool{"line": true, "line\n": true, "line\n\n": false} {
+		mu.Lock()
+		delete(calls, archive+"|TestFakeEOF")
+		mu.Unlock()
+		ft := &fakeT{name: "TestFakeEOF"}
+		Match(ft, got)
+		if ft.failed == wantMatch {
+			t.Fatalf("Match(%q): failed=%v, want match=%v (%q)", got, ft.failed, wantMatch, ft.msg)
+		}
+	}
+}
+
+// TestMatchPreservesInteriorTrailingBlankLines pins that a value ending in
+// blank lines keeps them across the store/compare round-trip.
+func TestMatchPreservesInteriorTrailingBlankLines(t *testing.T) {
+	t.Setenv("CI", "")
+	t.Setenv("UPDATE_SNAPS", "")
+	archive := testArchive(t)
+
+	value := "top\n\nmiddle\n\n\n"
+	ft := &fakeT{name: "TestFakeBlanks"}
+	Match(ft, value)
+	if got, ok := getEntry(t, archive, "TestFakeBlanks_1"); !ok || got != value {
+		t.Fatalf("blank lines not preserved: %q ok=%v", got, ok)
+	}
+
+	mu.Lock()
+	delete(calls, archive+"|TestFakeBlanks")
+	mu.Unlock()
+	ft = &fakeT{name: "TestFakeBlanks"}
+	Match(ft, value)
+	if ft.failed {
+		t.Fatalf("re-Match should succeed: %q", ft.msg)
+	}
+}
+
+func TestCleanEntries(t *testing.T) {
+	dir := t.TempDir()
+	archive := filepath.Join(dir, "some_test.snap")
+	seed(t, archive, map[string]string{
+		"TestLive_1": "keep",
+		"TestGone_1": "stale",
+	})
+	seen := map[string]bool{"TestLive_1": true}
+
+	// Report mode: counts but keeps entries.
+	n, err := cleanEntries(archive, seen, false)
+	if err != nil || n != 1 {
+		t.Fatalf("report mode: n=%d err=%v", n, err)
+	}
+	if _, ok := getEntry(t, archive, "TestGone_1"); !ok {
+		t.Fatal("report mode must not delete entries")
+	}
+
+	// Update mode: drops the stale entry, keeps the live one.
+	n, err = cleanEntries(archive, seen, true)
+	if err != nil || n != 1 {
+		t.Fatalf("update mode: n=%d err=%v", n, err)
+	}
+	if _, ok := getEntry(t, archive, "TestGone_1"); ok {
+		t.Fatal("stale entry should be deleted")
+	}
+	if got, ok := getEntry(t, archive, "TestLive_1"); !ok || got != "keep\n" {
+		t.Fatalf("live entry should survive: %q ok=%v", got, ok)
+	}
+
+	// Dropping the last live entry removes the archive entirely.
+	n, err = cleanEntries(archive, map[string]bool{}, true)
+	if err != nil || n != 1 {
+		t.Fatalf("final update: n=%d err=%v", n, err)
+	}
+	if _, err := os.Stat(archive); !os.IsNotExist(err) {
+		t.Fatal("empty archive should be removed")
+	}
+}
+
+func TestCleanOrphanArchives(t *testing.T) {
+	dir := t.TempDir()
+	live := filepath.Join(dir, "live_test.snap")
+	orphan := filepath.Join(dir, "gone_test.snap")
+	other := filepath.Join(dir, "notes.txt")
+	for _, p := range []string{live, orphan, other} {
+		if err := os.WriteFile(p, []byte("x"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	mu.Lock()
+	visited = map[string]map[string]bool{live: {"TestX_1": true}}
+	mu.Unlock()
+	t.Cleanup(func() {
+		mu.Lock()
+		defer mu.Unlock()
+		visited = map[string]map[string]bool{}
+	})
+
+	mu.Lock()
+	n, err := cleanOrphanArchives(false)
+	mu.Unlock()
+	if err != nil || n != 1 {
+		t.Fatalf("report mode: n=%d err=%v", n, err)
+	}
+	if _, err := os.Stat(orphan); err != nil {
+		t.Fatal("report mode must not delete")
+	}
+
+	mu.Lock()
+	n, err = cleanOrphanArchives(true)
+	mu.Unlock()
+	if err != nil || n != 1 {
+		t.Fatalf("update mode: n=%d err=%v", n, err)
+	}
+	if _, err := os.Stat(orphan); !os.IsNotExist(err) {
+		t.Fatal("orphan archive should be deleted")
+	}
+	for _, p := range []string{live, other} {
+		if _, err := os.Stat(p); err != nil {
+			t.Fatalf("%s should survive cleanup: %v", p, err)
+		}
+	}
+}
+
+// TestMatchStoresNearTerminatorLines pins that only a line that is exactly
+// "---" is unstorable: lines merely containing or resembling the terminator
+// (markdown-style rules, indented dashes, inline dashes) round-trip fine.
+func TestMatchStoresNearTerminatorLines(t *testing.T) {
+	t.Setenv("CI", "")
+	t.Setenv("UPDATE_SNAPS", "")
+	archive := testArchive(t)
+
+	value := "----\n--- text\n ---\na---b\n-- almost --\n"
+	ft := &fakeT{name: "TestFakeDashes"}
+	Match(ft, value)
+	if ft.failed {
+		t.Fatalf("near-terminator lines should be storable: %q", ft.msg)
+	}
+	if got, ok := getEntry(t, archive, "TestFakeDashes_1"); !ok || got != value {
+		t.Fatalf("round-trip mangled the value: %q ok=%v", got, ok)
+	}
+
+	mu.Lock()
+	delete(calls, archive+"|TestFakeDashes")
+	mu.Unlock()
+	ft = &fakeT{name: "TestFakeDashes"}
+	Match(ft, value)
+	if ft.failed {
+		t.Fatalf("re-Match against stored snapshot failed: %q", ft.msg)
+	}
+}
diff --git a/test/integration/__snapshots__/aws_cmd_test.snap b/test/integration/__snapshots__/aws_cmd_test.snap
new file mode 100644
index 00000000..abaae776
--- /dev/null
+++ b/test/integration/__snapshots__/aws_cmd_test.snap
@@ -0,0 +1,39 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestAWSCommandFailsWhenAWSCLINotInstalled_1]
+Error: aws CLI not found in PATH
+  ==> Install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
+---
+
+[TestAWSCommandHelpSkipsDockerAndEmulator_--help_1]
+ARGS:--help
+---
+
+[TestAWSCommandHelpSkipsDockerAndEmulator_-h_1]
+ARGS:-h
+---
+
+[TestAWSCommandHelpSkipsDockerAndEmulator_help_1]
+ARGS:help
+---
+
+[TestAWSCommandHelpSkipsDockerAndEmulator_s3_--help_1]
+ARGS:s3 --help
+---
+
+[TestAWSCommandHelpSkipsDockerAndEmulator_s3_help_1]
+ARGS:s3 help
+---
+
+[TestAWSCommandRejectsAccountWithoutValue_1]
+Error: --account requires a value
+---
+
+[TestAWSCommandRejectsInvalidAccount_1]
+Error: --account must be a 12-digit AWS account id, got "12345"
+---
+
+[TestAWSCommandRejectsPreSubcommandAccount_1]
+Error: --account must appear after the aws subcommand (e.g. `lstk aws --account 111111111111 ...`)
+---
diff --git a/test/integration/__snapshots__/aws_completion_test.snap b/test/integration/__snapshots__/aws_completion_test.snap
new file mode 100644
index 00000000..4063cc2f
--- /dev/null
+++ b/test/integration/__snapshots__/aws_completion_test.snap
@@ -0,0 +1,34 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestAWSCompletionAppendsTrailingSpaceForNewWord_1]
+compline=[aws s3 ]
+ls
+list-buckets
+:4
+---
+
+[TestAWSCompletionDegradesWhenCompleterMissing_1]
+:0
+---
+
+[TestAWSCompletionDelegatesToAWSCompleter_1]
+compline=[aws s3 l]
+ls
+list-buckets
+:4
+---
+
+[TestAWSCompletionNeedsNoDockerOrEmulator_1]
+compline=[aws s3 l]
+ls
+list-buckets
+:4
+---
+
+[TestAWSCompletionStripsGlobalFlags_1]
+compline=[aws s3 l]
+ls
+list-buckets
+:4
+---
diff --git a/test/integration/__snapshots__/awsconfig_test.snap b/test/integration/__snapshots__/awsconfig_test.snap
new file mode 100644
index 00000000..e764ead8
--- /dev/null
+++ b/test/integration/__snapshots__/awsconfig_test.snap
@@ -0,0 +1,16 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestSetupAWSNonInteractiveCreatesProfile_1]
+✔︎ Created LocalStack profile in ~/.aws
+---
+
+[TestSetupAWSNonInteractiveIsIdempotent_1]
+> Note: LocalStack AWS profile is already configured.
+---
+
+[TestSetupAWSNonInteractiveOverwriteRequiresForce_1]
+Error: Refusing to overwrite the existing LocalStack AWS profile
+  a 'localstack' AWS profile already exists with different values
+  ==> Overwrite it: lstk setup aws --force
+---
diff --git a/test/integration/__snapshots__/az_cmd_test.snap b/test/integration/__snapshots__/az_cmd_test.snap
new file mode 100644
index 00000000..73760e9a
--- /dev/null
+++ b/test/integration/__snapshots__/az_cmd_test.snap
@@ -0,0 +1,20 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestAzCommandConfigFlagSelectsConfigFile_1]
+AZ_ARGS:group list
+---
+
+[TestAzCommandConfigFlagSelectsConfigFile_2]
+Error: Azure CLI integration is not set up
+  ==> Set it up: lstk setup azure
+---
+
+[TestAzCommandFailsWhenAzureCLINotInstalled_1]
+Error: az CLI not found in PATH
+  ==> Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/
+---
+
+[TestAzCommandStripsGlobalFlagsFromPassthrough_1]
+AZ_ARGS:group list
+---
diff --git a/test/integration/__snapshots__/az_interception_test.snap b/test/integration/__snapshots__/az_interception_test.snap
new file mode 100644
index 00000000..88a37f40
--- /dev/null
+++ b/test/integration/__snapshots__/az_interception_test.snap
@@ -0,0 +1,16 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestAzStartInterceptionRoutesToSubcommand_1]
+Error: az CLI not found in PATH
+  ==> Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/
+---
+
+[TestAzStopInterceptionFailsWhenAzureCLINotInstalled_1]
+Error: az CLI not found in PATH
+  ==> Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/
+---
+
+[TestAzStopInterceptionNoOpWhenNotIntercepting_1]
+> Note: 'LocalStack' is not the active Azure cloud (currently 'AzureCloud'); nothing to revert.
+---
diff --git a/test/integration/__snapshots__/az_pty_test.snap b/test/integration/__snapshots__/az_pty_test.snap
new file mode 100644
index 00000000..4a5c2989
--- /dev/null
+++ b/test/integration/__snapshots__/az_pty_test.snap
@@ -0,0 +1,8 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestAzWithPipedStdoutKeepsPipe_1]
+STDOUT_TTY:no
+PYTHONUNBUFFERED:1
+piped
+---
diff --git a/test/integration/__snapshots__/cdk_cmd_test.snap b/test/integration/__snapshots__/cdk_cmd_test.snap
new file mode 100644
index 00000000..b93b1209
--- /dev/null
+++ b/test/integration/__snapshots__/cdk_cmd_test.snap
@@ -0,0 +1,203 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestCDKAccountRejected_123456789012_1]
+---
+
+[TestCDKAccountRejected_123456789012_2]
+Error: --account is not supported by lstk cdk; CDK always uses the default LocalStack account 000000000000
+---
+
+[TestCDKAccountRejected_12345_1]
+---
+
+[TestCDKAccountRejected_12345_2]
+Error: --account is not supported by lstk cdk; CDK always uses the default LocalStack account 000000000000
+---
+
+[TestCDKFlagBeforeSubcommandRejected_1]
+---
+
+[TestCDKFlagBeforeSubcommandRejected_2]
+Error: --region and --account must appear after the cdk subcommand (e.g. `lstk cdk --region us-west-2 ...`)
+---
+
+[TestCDKFlagsAfterActionAreForwarded_1]
+ARGS:synth --region us-west-2
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKForwardsArgs_1]
+ARGS:synth
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKHelpNoEmulator_--help_1]
+ARGS:--help
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKHelpNoEmulator_-h_1]
+ARGS:-h
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKHelpNoEmulator_deploy_--help_1]
+ARGS:deploy --help
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKHelpNoEmulator_deploy_help_1]
+ARGS:deploy help
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKHelpNoEmulator_help_1]
+ARGS:help
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKHonorsLstkCdkCmd_1]
+MYCDK:synth
+---
+
+[TestCDKInjectsCleanAWSEnv_1]
+ARGS:synth
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=eu-west-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKMissingBinary_1]
+---
+
+[TestCDKMissingBinary_2]
+Error: cdk not found in PATH
+  ==> Install CDK CLI: npm install -g aws-cdk
+---
+
+[TestCDKOfflineCommandsNoEmulator_doctor_1]
+ARGS:doctor
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-west-2
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKOfflineCommandsNoEmulator_init_1]
+ARGS:init
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-west-2
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKOfflineCommandsNoEmulator_ls_1]
+ARGS:ls
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-west-2
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKOfflineCommandsNoEmulator_synth_1]
+ARGS:synth
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-west-2
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKOfflineCommandsNoEmulator_version_1]
+ARGS:version
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=http://<endpoint-host>:4566
+ENV_AWS_REGION=us-west-2
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKPropagatesExitCode_1]
+cdk: simulated failure
+---
+
+[TestCDKVersionTooOld_1]
+---
+
+[TestCDKVersionTooOld_2]
+Error: AWS CDK 2.176.0 is too old; lstk requires 2.177.0 or newer (it points CDK at LocalStack via AWS_ENDPOINT_URL, which older versions ignore)
+  ==> Upgrade CDK CLI: npm install -g aws-cdk@latest
+---
diff --git a/test/integration/__snapshots__/completion_test.snap b/test/integration/__snapshots__/completion_test.snap
new file mode 100644
index 00000000..d0492db0
--- /dev/null
+++ b/test/integration/__snapshots__/completion_test.snap
@@ -0,0 +1,34 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestBashCompletionFallbackYieldsToInstalledPackage_1]
+package version
+---
+
+[TestBashCompletionReassemblesWordbreakSplits_adjacent_pieces_re-join_1]
+cur=--config=./cfg
+prev=lstk
+cword=1
+nwords=2
+---
+
+[TestBashCompletionReassemblesWordbreakSplits_empty_word_after_separator-then-space_1]
+cur=
+prev=--config=
+cword=2
+nwords=3
+---
+
+[TestBashCompletionReassemblesWordbreakSplits_whitespace-surrounded_separator_stays_separate_1]
+cur=./x
+prev==
+cword=3
+nwords=4
+---
+
+[TestBashCompletionReassemblesWordbreakSplits_word_after_separator-then-space_stays_separate_1]
+cur=st
+prev=--config=
+cword=2
+nwords=3
+---
diff --git a/test/integration/__snapshots__/config_test.snap b/test/integration/__snapshots__/config_test.snap
new file mode 100644
index 00000000..c6ef65c0
--- /dev/null
+++ b/test/integration/__snapshots__/config_test.snap
@@ -0,0 +1,22 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestConfigWithInvalidContainerNameFails_1]
+---
+
+[TestConfigWithInvalidContainerNameFails_2]
+Error: failed to get config: invalid container config: invalid container name "my emulator": must start with a letter or digit and use only letters, digits, dots, hyphens, and underscores
+---
+
+[TestConfigWithMissingRequiredPortFails_1]
+Error: failed to get config: invalid container config: port is required for aws emulator
+---
+
+[TestStartWithMultipleContainersFailsFast_1]
+Error: Unsupported configuration
+  found 2 [[containers]] blocks in your config, but only one is supported at a time
+  ==> Edit your config file so only one [[containers]] block is enabled: lstk config path
+---
+
+[TestStartWithMultipleContainersFailsFast_2]
+---
diff --git a/test/integration/__snapshots__/emulator_type_test.snap b/test/integration/__snapshots__/emulator_type_test.snap
new file mode 100644
index 00000000..55c16e55
--- /dev/null
+++ b/test/integration/__snapshots__/emulator_type_test.snap
@@ -0,0 +1,20 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestStartTypeErrorsOnMultipleBlocks_1]
+Error: Unsupported configuration
+  found 2 [[containers]] blocks in your config, but only one is supported at a time
+  ==> Edit your config file so only one [[containers]] block is enabled: lstk config path
+---
+
+[TestStartTypeErrorsWhenNoContainersBlock_1]
+Error: failed to switch emulator type: no [[containers]] block found in config
+---
+
+[TestStartTypeInvalidValue_1]
+Error: invalid emulator type "bogus" (must be one of: aws, snowflake, azure)
+---
+
+[TestStartTypePositionalRejected_1]
+Error: unexpected argument "azure"; select the emulator with --type (e.g. lstk start --type azure)
+---
diff --git a/test/integration/__snapshots__/endpoint_url_https_test.snap b/test/integration/__snapshots__/endpoint_url_https_test.snap
new file mode 100644
index 00000000..9978a6d7
--- /dev/null
+++ b/test/integration/__snapshots__/endpoint_url_https_test.snap
@@ -0,0 +1,14 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestStatusEndpointURLHTTPSRendersReducedOutput_1]
+Fetching LocalStack status...
+✔︎ LocalStack AWS Emulator is running
+• Endpoint: https://127.0.0.1:<port>
+• Version: <version>
+> Note: No resources deployed
+---
+
+[TestStatusEndpointURLHTTPSSchemeMismatchSuggestsHTTP_1]
+Error: could not reach LocalStack emulator at https://127.0.0.1:<port>: Get "https://127.0.0.1:<port>/_localstack/health": http: server gave HTTP response to HTTPS client, but http://127.0.0.1:<port> responded — retry with that URL
+---
diff --git a/test/integration/__snapshots__/endpoint_url_test.snap b/test/integration/__snapshots__/endpoint_url_test.snap
new file mode 100644
index 00000000..c1b7cdfb
--- /dev/null
+++ b/test/integration/__snapshots__/endpoint_url_test.snap
@@ -0,0 +1,88 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestAWSCommandEndpointURLAfterSubcommandPassesThrough_1]
+> Note: No AWS profile found, run 'lstk setup aws'
+ENDPOINT:http://127.0.0.1:<port>
+ARGS:--endpoint-url http://127.0.0.1:<port> s3 ls
+---
+
+[TestAWSCommandEndpointURLNoDockerRequired_1]
+> Note: No AWS profile found, run 'lstk setup aws'
+ENDPOINT:http://127.0.0.1:<port>
+ARGS:s3 ls
+---
+
+[TestCDKAWSEndpointURLBypassesDockerCheck_1]
+ARGS:deploy MyStack
+ENV_AWS_ENDPOINT_URL=http://<host>:<port>
+ENV_AWS_ENDPOINT_URL_S3=http://<host>:<port>
+ENV_AWS_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestCDKAWSEndpointURLWrongTypeFails_1]
+Error: lstk cdk requires the AWS emulator, but the endpoint at http://127.0.0.1:<port> is a LocalStack Azure Emulator emulator
+---
+
+[TestLogsRejectsAmbientEndpointURL_1]
+Error: logs does not support LSTK_ENDPOINT_URL: it operates on a local Docker container or local filesystem state with no remote equivalent (LSTK_ENDPOINT_URL is set)
+---
+
+[TestLogsRejectsExplicitEndpointURL_1]
+Error: logs does not support --endpoint-url: it operates on a local Docker container or local filesystem state with no remote equivalent (--endpoint-url was passed)
+---
+
+[TestRestartRejectsAmbientEndpointURL_1]
+Error: restart does not support AWS_ENDPOINT_URL: it operates on a local Docker container or local filesystem state with no remote equivalent (AWS_ENDPOINT_URL is set)
+---
+
+[TestStartRejectsAmbientEndpointURL_1]
+Error: start does not support LSTK_ENDPOINT_URL: it operates on a local Docker container or local filesystem state with no remote equivalent (LSTK_ENDPOINT_URL is set)
+---
+
+[TestStartRejectsExplicitEndpointURL_1]
+Error: start does not support --endpoint-url: it operates on a local Docker container or local filesystem state with no remote equivalent (--endpoint-url was passed)
+---
+
+[TestStatusEndpointURLRendersReducedOutput_1]
+Fetching LocalStack status...
+✔︎ LocalStack AWS Emulator is running
+• Endpoint: http://127.0.0.1:<port>
+• Version: <version>
+> Note: No resources deployed
+---
+
+[TestStatusEndpointURLShowsResources_1]
+Fetching LocalStack status...
+✔︎ LocalStack AWS Emulator is running
+• Endpoint: http://127.0.0.1:<port>
+• Version: <version>
+~ 1 resources · 1 services
+  SERVICE  RESOURCE        REGION     ACCOUNT
+  S3       my-test-bucket  us-east-1  000000000000
+---
+
+[TestStatusUnreachableEndpointURLFailsClosed_1]
+Error: could not reach LocalStack emulator at http://127.0.0.1:<port>: unexpected status 404 from http://127.0.0.1:<port>/_localstack/health
+---
+
+[TestStopRejectsAmbientEndpointURL_1]
+Error: stop does not support LSTK_ENDPOINT_URL: it operates on a local Docker container or local filesystem state with no remote equivalent (LSTK_ENDPOINT_URL is set)
+---
+
+[TestVolumeClearRejectsAmbientEndpointURL_1]
+Error: volume clear does not support LSTK_ENDPOINT_URL: it operates on a local Docker container or local filesystem state with no remote equivalent (LSTK_ENDPOINT_URL is set)
+---
+
+[TestVolumePathRejectsAmbientEndpointURL_1]
+Error: volume path does not support LSTK_ENDPOINT_URL: it operates on a local Docker container or local filesystem state with no remote equivalent (LSTK_ENDPOINT_URL is set)
+---
+
+[TestVolumePathRejectsExplicitEndpointURL_1]
+Error: volume path does not support --endpoint-url: it operates on a local Docker container or local filesystem state with no remote equivalent (--endpoint-url was passed)
+---
diff --git a/test/integration/__snapshots__/exit_code_test.snap b/test/integration/__snapshots__/exit_code_test.snap
new file mode 100644
index 00000000..9dc0ecd7
--- /dev/null
+++ b/test/integration/__snapshots__/exit_code_test.snap
@@ -0,0 +1,140 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestBareParentCommandExitsZero_completion_1]
+Generate the autocompletion script for lstk for the specified shell.
+See each sub-command's help for details on how to use the generated script.
+
+Usage: lstk completion [flags]
+
+Commands:
+  bash        Generate the autocompletion script for bash
+  fish        Generate the autocompletion script for fish
+  powershell  Generate the autocompletion script for powershell
+  zsh         Generate the autocompletion script for zsh
+
+Options:
+  -h, --help   help for completion
+
+Global Options:
+      --config string         Path to config file
+      --endpoint-url string   Target an existing, externally-managed emulator at this URL
+      --json                  Output in JSON format (only supported by some commands)
+      --non-interactive       Disable interactive mode
+---
+
+[TestBareParentCommandExitsZero_config_1]
+Manage configuration
+
+Usage: lstk config [flags]
+
+Commands:
+  path        Print the configuration file path
+
+Options:
+  -h, --help   help for config
+
+Global Options:
+      --config string         Path to config file
+      --endpoint-url string   Target an existing, externally-managed emulator at this URL
+      --json                  Output in JSON format (only supported by some commands)
+      --non-interactive       Disable interactive mode
+---
+
+[TestBareParentCommandExitsZero_setup_1]
+Set up emulator CLI integration for AWS or Azure.
+
+Usage: lstk setup [flags]
+
+Commands:
+  aws         Set up the LocalStack AWS profile
+  azure       Set up Azure CLI integration with LocalStack
+
+Options:
+  -h, --help   help for setup
+
+Global Options:
+      --config string         Path to config file
+      --endpoint-url string   Target an existing, externally-managed emulator at this URL
+      --json                  Output in JSON format (only supported by some commands)
+      --non-interactive       Disable interactive mode
+---
+
+[TestBareParentCommandExitsZero_snapshot_1]
+Manage emulator snapshots
+
+Usage: lstk snapshot [flags]
+
+Commands:
+  list        List Cloud Pod snapshots available on the LocalStack platform
+  load        Load a snapshot into the running emulator
+  remove      Delete a cloud snapshot from the LocalStack platform
+  save        Save a snapshot of the emulator state
+  show        Show metadata for a cloud snapshot
+  versions    List the version history of a cloud snapshot
+
+Options:
+  -h, --help   help for snapshot
+
+Global Options:
+      --config string         Path to config file
+      --endpoint-url string   Target an existing, externally-managed emulator at this URL
+      --json                  Output in JSON format (only supported by some commands)
+      --non-interactive       Disable interactive mode
+---
+
+[TestBareParentCommandExitsZero_volume_1]
+Manage emulator volume
+
+Usage: lstk volume [flags]
+
+Commands:
+  clear       Clear emulator volume data
+  path        Print the volume directory path
+
+Options:
+  -h, --help   help for volume
+
+Global Options:
+      --config string         Path to config file
+      --endpoint-url string   Target an existing, externally-managed emulator at this URL
+      --json                  Output in JSON format (only supported by some commands)
+      --non-interactive       Disable interactive mode
+---
+
+[TestInvalidUsageExitsNonZero_removed_config_profile_subcommand_1]
+Error: unknown command "profile" for "lstk config"
+---
+
+[TestInvalidUsageExitsNonZero_unknown_command_1]
+Error: unknown command "bogus-command" for lstk
+  ==> See help: lstk -h
+---
+
+[TestInvalidUsageExitsNonZero_unknown_completion_shell_1]
+Error: unknown command "bogus" for "lstk completion"
+---
+
+[TestInvalidUsageExitsNonZero_unknown_config_subcommand_1]
+Error: unknown command "bogus" for "lstk config"
+---
+
+[TestInvalidUsageExitsNonZero_unknown_flag_on_root_1]
+Error: unknown flag: --bogus-flag-xyz
+---
+
+[TestInvalidUsageExitsNonZero_unknown_flag_on_start_1]
+Error: unknown flag: --bogus-flag-xyz
+---
+
+[TestInvalidUsageExitsNonZero_unknown_setup_subcommand_1]
+Error: unknown command "bogus" for "lstk setup"
+---
+
+[TestInvalidUsageExitsNonZero_unknown_snapshot_subcommand_1]
+Error: unknown command "bogus" for "lstk snapshot"
+---
+
+[TestInvalidUsageExitsNonZero_unknown_volume_subcommand_1]
+Error: unknown command "bogus" for "lstk volume"
+---
diff --git a/test/integration/__snapshots__/extension_test.snap b/test/integration/__snapshots__/extension_test.snap
new file mode 100644
index 00000000..80efdd3b
--- /dev/null
+++ b/test/integration/__snapshots__/extension_test.snap
@@ -0,0 +1,190 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestExtensionBundledWinsOverPath_1]
+Usage: lstk [options] [command]
+
+LSTK - LocalStack command-line interface
+
+Commands:
+  completion  Generate the autocompletion script for the specified shell
+  config      Manage configuration
+  help        Help about any command
+  load        Load a snapshot into the running emulator
+  login       Manage login
+  logout      Remove stored authentication credentials
+  logs        Show emulator logs
+  reset       Reset emulator state
+  restart     Restart emulator
+  save        Save a snapshot of the emulator state
+  setup       Set up emulator CLI integration
+  snapshot    Manage emulator snapshots
+  start       Start emulator
+  status      Show emulator status and deployed resources
+  stop        Stop emulator
+  update      Update lstk to the latest version
+  volume      Manage emulator volume
+
+Tools:
+  aws         Run AWS CLI commands against LocalStack
+  az          Run Azure CLI commands against LocalStack
+  cdk         Run AWS CDK against LocalStack
+  sam         Run the AWS SAM CLI against LocalStack
+  terraform   Run Terraform against LocalStack
+
+Extensions:
+  deploy
+
+Options:
+      --config string         Path to config file
+      --endpoint-url string   Target an existing, externally-managed emulator at this URL
+  -h, --help                  Show help
+      --json                  Output in JSON format (only supported by some commands)
+      --no-snapshot           Skip auto-loading the configured snapshot for this run
+      --non-interactive       Disable interactive mode
+      --persist               Persist emulator state across restarts
+      --snapshot string       Snapshot REF to load after start (overrides config for this run)
+      --timeout duration      Maximum time to wait for the emulator to become ready (overrides LSTK_STARTUP_TIMEOUT; 0 uses the default)
+  -t, --type string           Emulator type to start (aws, snowflake, azure)
+  -v, --version               Show version
+---
+
+[TestExtensionEndpointOmittedWhenNoRuntime_1]
+ARGS=[]
+SELF=<path>
+API_VERSION=1
+CONFIG_DIR=<path>
+NON_INTERACTIVE=true
+JSON=false
+SESSION_ID=<id>
+MACHINE_ID=<id>
+EMULATOR_COUNT=0
+---
+
+[TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly_1]
+Usage: lstk [options] [command]
+
+LSTK - LocalStack command-line interface
+
+Commands:
+  completion  Generate the autocompletion script for the specified shell
+  config      Manage configuration
+  help        Help about any command
+  load        Load a snapshot into the running emulator
+  login       Manage login
+  logout      Remove stored authentication credentials
+  logs        Show emulator logs
+  reset       Reset emulator state
+  restart     Restart emulator
+  save        Save a snapshot of the emulator state
+  setup       Set up emulator CLI integration
+  snapshot    Manage emulator snapshots
+  start       Start emulator
+  status      Show emulator status and deployed resources
+  stop        Stop emulator
+  update      Update lstk to the latest version
+  volume      Manage emulator volume
+
+Tools:
+  aws         Run AWS CLI commands against LocalStack
+  az          Run Azure CLI commands against LocalStack
+  cdk         Run AWS CDK against LocalStack
+  sam         Run the AWS SAM CLI against LocalStack
+  terraform   Run Terraform against LocalStack
+
+Extensions:
+  deploy      Deploy your application to LocalStack
+  hello
+
+Options:
+      --config string         Path to config file
+      --endpoint-url string   Target an existing, externally-managed emulator at this URL
+  -h, --help                  Show help
+      --json                  Output in JSON format (only supported by some commands)
+      --no-snapshot           Skip auto-loading the configured snapshot for this run
+      --non-interactive       Disable interactive mode
+      --persist               Persist emulator state across restarts
+      --snapshot string       Snapshot REF to load after start (overrides config for this run)
+      --timeout duration      Maximum time to wait for the emulator to become ready (overrides LSTK_STARTUP_TIMEOUT; 0 uses the default)
+  -t, --type string           Emulator type to start (aws, snowflake, azure)
+  -v, --version               Show version
+---
+
+[TestExtensionHelpMissingDescriptionsFileDegrades_1]
+Usage: lstk [options] [command]
+
+LSTK - LocalStack command-line interface
+
+Commands:
+  completion  Generate the autocompletion script for the specified shell
+  config      Manage configuration
+  help        Help about any command
+  load        Load a snapshot into the running emulator
+  login       Manage login
+  logout      Remove stored authentication credentials
+  logs        Show emulator logs
+  reset       Reset emulator state
+  restart     Restart emulator
+  save        Save a snapshot of the emulator state
+  setup       Set up emulator CLI integration
+  snapshot    Manage emulator snapshots
+  start       Start emulator
+  status      Show emulator status and deployed resources
+  stop        Stop emulator
+  update      Update lstk to the latest version
+  volume      Manage emulator volume
+
+Tools:
+  aws         Run AWS CLI commands against LocalStack
+  az          Run Azure CLI commands against LocalStack
+  cdk         Run AWS CDK against LocalStack
+  sam         Run the AWS SAM CLI against LocalStack
+  terraform   Run Terraform against LocalStack
+
+Extensions:
+  deploy
+
+Options:
+      --config string         Path to config file
+      --endpoint-url string   Target an existing, externally-managed emulator at this URL
+  -h, --help                  Show help
+      --json                  Output in JSON format (only supported by some commands)
+      --no-snapshot           Skip auto-loading the configured snapshot for this run
+      --non-interactive       Disable interactive mode
+      --persist               Persist emulator state across restarts
+      --snapshot string       Snapshot REF to load after start (overrides config for this run)
+      --timeout duration      Maximum time to wait for the emulator to become ready (overrides LSTK_STARTUP_TIMEOUT; 0 uses the default)
+  -t, --type string           Emulator type to start (aws, snowflake, azure)
+  -v, --version               Show version
+---
+
+[TestExtensionSelfAuthorizationRefusesWithoutToken_1]
+lstk-ref: not authorized (no auth token conveyed)
+---
+
+[TestExtensionSessionIDOmittedWhenTelemetryDisabled_1]
+ARGS=[exit 7]
+SELF=<path>
+API_VERSION=1
+CONFIG_DIR=<path>
+NON_INTERACTIVE=true
+JSON=false
+EMULATOR_COUNT=0
+---
+
+[TestExtensionUnknownCommandDispatches_1]
+ARGS=[world]
+SELF=<path>
+API_VERSION=1
+CONFIG_DIR=<path>
+NON_INTERACTIVE=true
+JSON=false
+SESSION_ID=<id>
+MACHINE_ID=<id>
+EMULATOR_COUNT=0
+---
+
+[TestExtensionUnknownCommandNoExtensionErrors_1]
+Error: unknown command "nope" for lstk
+  ==> See help: lstk -h
+---
diff --git a/test/integration/__snapshots__/json_envelope_test.snap b/test/integration/__snapshots__/json_envelope_test.snap
new file mode 100644
index 00000000..bfb20c29
--- /dev/null
+++ b/test/integration/__snapshots__/json_envelope_test.snap
@@ -0,0 +1,70 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestConfigLoadFailureRendersJSONEnvelope_1]
+{
+  "command": "stop",
+  "data": null,
+  "error": {
+    "category": "CONFIG",
+    "code": "CONFIG_INVALID",
+    "message": "<any>",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+---
+
+[TestConfigNotFoundRendersJSONEnvelope_1]
+{
+  "command": "reset",
+  "data": null,
+  "error": {
+    "category": "CONFIG",
+    "code": "CONFIG_NOT_FOUND",
+    "message": "<any>",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+---
+
+[TestNotJSONCapableCommandRendersEnvelope_1]
+{
+  "command": "login",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"login\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+---
+
+[TestUsageErrorAfterJSONRendersEnvelope_1]
+{
+  "command": "stop",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "USAGE_ERROR",
+    "message": "unknown flag: --bogus-flag",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+---
+
+[TestUsageErrorBeforeJSONFallsBackToPlainText_1]
+Error: unknown flag: --bogus-flag
+---
diff --git a/test/integration/__snapshots__/json_flag_test.snap b/test/integration/__snapshots__/json_flag_test.snap
new file mode 100644
index 00000000..9349deb7
--- /dev/null
+++ b/test/integration/__snapshots__/json_flag_test.snap
@@ -0,0 +1,246 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestExtensionReceivesJSONFlagInContext_1]
+ARGS=[--foo]
+SELF=<path>
+API_VERSION=1
+CONFIG_DIR=<path>
+NON_INTERACTIVE=true
+JSON=true
+SESSION_ID=<id>
+MACHINE_ID=<id>
+EMULATOR_COUNT=0
+---
+
+[TestJSONFlagBeforeCommandNameBooleanValues_--json_false_before_the_command_name_is_not_rejected_1]
+Error: aws CLI not found in PATH
+  ==> Install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
+---
+
+[TestJSONFlagBeforeCommandNameBooleanValues_--json_false_before_the_command_name_is_not_rejected_2]
+---
+
+[TestJSONFlagBeforeCommandNameBooleanValues_--json_true_before_the_command_name_is_rejected_1]
+{
+  "command": "aws",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"aws\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+---
+
+[TestJSONFlagBeforeCommandNameBooleanValues_a_malformed_value_before_the_command_name_is_rejected_1]
+{
+  "command": "aws",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"aws\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+---
+
+[TestJSONFlagProxyCommandsForwardJSON_aws_json_after_the_wrapped_tool_s_own_action_1]
+Error: aws CLI not found in PATH
+  ==> Install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
+---
+
+[TestJSONFlagProxyCommandsForwardJSON_aws_json_after_the_wrapped_tool_s_own_action_2]
+---
+
+[TestJSONFlagProxyCommandsForwardJSON_aws_json_immediately_after_command_name_1]
+Error: aws CLI not found in PATH
+  ==> Install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html
+---
+
+[TestJSONFlagProxyCommandsForwardJSON_aws_json_immediately_after_command_name_2]
+---
+
+[TestJSONFlagProxyCommandsForwardJSON_az_json_after_the_wrapped_tool_s_own_action_1]
+Error: az CLI not found in PATH
+  ==> Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/
+---
+
+[TestJSONFlagProxyCommandsForwardJSON_az_json_after_the_wrapped_tool_s_own_action_2]
+---
+
+[TestJSONFlagProxyCommandsForwardJSON_az_json_immediately_after_command_name_1]
+Error: az CLI not found in PATH
+  ==> Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/
+---
+
+[TestJSONFlagProxyCommandsForwardJSON_az_json_immediately_after_command_name_2]
+---
+
+[TestJSONFlagProxyCommandsForwardJSON_cdk_json_after_the_wrapped_tool_s_own_action_1]
+Error: cdk not found in PATH
+  ==> Install CDK CLI: npm install -g aws-cdk
+---
+
+[TestJSONFlagProxyCommandsForwardJSON_cdk_json_after_the_wrapped_tool_s_own_action_2]
+---
+
+[TestJSONFlagProxyCommandsForwardJSON_cdk_json_immediately_after_command_name_1]
+Error: cdk not found in PATH
+  ==> Install CDK CLI: npm install -g aws-cdk
+---
+
+[TestJSONFlagProxyCommandsForwardJSON_cdk_json_immediately_after_command_name_2]
+---
+
+[TestJSONFlagProxyCommandsForwardJSON_sam_json_after_the_wrapped_tool_s_own_action_1]
+Error: sam not found in PATH
+  ==> Install AWS SAM CLI: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html
+---
+
+[TestJSONFlagProxyCommandsForwardJSON_sam_json_after_the_wrapped_tool_s_own_action_2]
+---
+
+[TestJSONFlagProxyCommandsForwardJSON_sam_json_immediately_after_command_name_1]
+Error: sam not found in PATH
+  ==> Install AWS SAM CLI: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html
+---
+
+[TestJSONFlagProxyCommandsForwardJSON_sam_json_immediately_after_command_name_2]
+---
+
+[TestJSONFlagProxyCommandsForwardJSON_terraform_json_after_the_wrapped_tool_s_own_action_1]
+Error: terraform not found in PATH
+  ==> Install Terraform CLI: https://developer.hashicorp.com/terraform/cli
+---
+
+[TestJSONFlagProxyCommandsForwardJSON_terraform_json_after_the_wrapped_tool_s_own_action_2]
+---
+
+[TestJSONFlagProxyCommandsForwardJSON_terraform_json_immediately_after_command_name_1]
+Error: terraform not found in PATH
+  ==> Install Terraform CLI: https://developer.hashicorp.com/terraform/cli
+---
+
+[TestJSONFlagProxyCommandsForwardJSON_terraform_json_immediately_after_command_name_2]
+---
+
+[TestJSONFlagProxyCommandsRejectBeforeCommandName_aws_1]
+{
+  "command": "aws",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"aws\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+---
+
+[TestJSONFlagProxyCommandsRejectBeforeCommandName_az_1]
+{
+  "command": "az",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"az\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+---
+
+[TestJSONFlagProxyCommandsRejectBeforeCommandName_cdk_1]
+{
+  "command": "cdk",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"cdk\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+---
+
+[TestJSONFlagProxyCommandsRejectBeforeCommandName_sam_1]
+{
+  "command": "sam",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"sam\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+---
+
+[TestJSONFlagProxyCommandsRejectBeforeCommandName_terraform_1]
+{
+  "command": "terraform",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"terraform\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+---
+
+[TestJSONFlagRejectsDefaultStartBehavior_1]
+{
+  "command": "start",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"start\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+---
+
+[TestJSONFlagRejectsUnannotatedBuiltinCommand_1]
+{
+  "command": "status",
+  "data": null,
+  "error": {
+    "category": "USAGE",
+    "code": "NOT_JSON_CAPABLE",
+    "message": "\"status\" is not able to provide output in JSON format",
+    "retryable": false
+  },
+  "schemaVersion": 1,
+  "status": "error",
+  "warnings": []
+}
+---
diff --git a/test/integration/__snapshots__/logout_test.snap b/test/integration/__snapshots__/logout_test.snap
new file mode 100644
index 00000000..7fbd965c
--- /dev/null
+++ b/test/integration/__snapshots__/logout_test.snap
@@ -0,0 +1,7 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestLogoutCommandSucceedsWhenNoToken_1]
+Logging out......
+> Note: Not currently logged in
+---
diff --git a/test/integration/__snapshots__/logs_test.snap b/test/integration/__snapshots__/logs_test.snap
new file mode 100644
index 00000000..c4d244c2
--- /dev/null
+++ b/test/integration/__snapshots__/logs_test.snap
@@ -0,0 +1,6 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestLogsTailRejectsInvalidValue_1]
+Error: invalid --tail value "bogus": expected a non-negative integer or "all"
+---
diff --git a/test/integration/__snapshots__/sam_cmd_test.snap b/test/integration/__snapshots__/sam_cmd_test.snap
new file mode 100644
index 00000000..e3d0cc39
--- /dev/null
+++ b/test/integration/__snapshots__/sam_cmd_test.snap
@@ -0,0 +1,261 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestSAMAccountSupported_1]
+ARGS:build
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-east-1
+ENV_AWS_DEFAULT_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=123456789012
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMDoesNotInjectAmbientRegion_1]
+ARGS:deploy
+ENV_AWS_ENDPOINT_URL=http://<host>:<port>
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=eu-west-1
+ENV_AWS_DEFAULT_REGION=eu-west-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMDoesNotInjectRegionForOfflineSubcommand_1]
+ARGS:build
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=ap-northeast-1
+ENV_AWS_DEFAULT_REGION=ap-northeast-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMDoesNotInjectRegionWhenNotSelected_1]
+ARGS:deploy
+ENV_AWS_ENDPOINT_URL=http://<host>:<port>
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-east-1
+ENV_AWS_DEFAULT_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMFlagBeforeSubcommandRejected_1]
+---
+
+[TestSAMFlagBeforeSubcommandRejected_2]
+Error: --region and --account must appear after the sam subcommand (e.g. `lstk sam --region us-west-2 ...`)
+---
+
+[TestSAMFlagsAfterActionAreForwarded_1]
+ARGS:build --region us-west-2
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-east-1
+ENV_AWS_DEFAULT_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMForwardsArgs_1]
+ARGS:build
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-east-1
+ENV_AWS_DEFAULT_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMHelpNoEmulator_--help_1]
+ARGS:--help
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-east-1
+ENV_AWS_DEFAULT_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMHelpNoEmulator_-h_1]
+ARGS:-h
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-east-1
+ENV_AWS_DEFAULT_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMHelpNoEmulator_deploy_--help_1]
+ARGS:deploy --help
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-east-1
+ENV_AWS_DEFAULT_REGION=us-east-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMHonorsLstkSamCmd_1]
+MYSAM:build
+---
+
+[TestSAMInjectsCleanAWSEnv_1]
+ARGS:build
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=eu-west-1
+ENV_AWS_DEFAULT_REGION=eu-west-1
+ENV_AWS_ACCESS_KEY_ID=111111111111
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMInvalidAccountRejected_1]
+---
+
+[TestSAMInvalidAccountRejected_2]
+Error: --account must be a 12-digit AWS account id, got "12345"
+---
+
+[TestSAMLeavesUserSuppliedRegionFlagAlone_1]
+ARGS:deploy --region us-west-1
+ENV_AWS_ENDPOINT_URL=http://<host>:<port>
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=ap-northeast-1
+ENV_AWS_DEFAULT_REGION=ap-northeast-1
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMMissingBinary_1]
+---
+
+[TestSAMMissingBinary_2]
+Error: sam not found in PATH
+  ==> Install AWS SAM CLI: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html
+---
+
+[TestSAMOfflineCommandsNoEmulator_build_1]
+ARGS:build
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-west-2
+ENV_AWS_DEFAULT_REGION=us-west-2
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMOfflineCommandsNoEmulator_docs_1]
+ARGS:docs
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-west-2
+ENV_AWS_DEFAULT_REGION=us-west-2
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMOfflineCommandsNoEmulator_init_1]
+ARGS:init
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-west-2
+ENV_AWS_DEFAULT_REGION=us-west-2
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMOfflineCommandsNoEmulator_pipeline_1]
+ARGS:pipeline
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-west-2
+ENV_AWS_DEFAULT_REGION=us-west-2
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMOfflineCommandsNoEmulator_validate_1]
+ARGS:validate
+ENV_AWS_ENDPOINT_URL=http://<endpoint-host>:4566
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=us-west-2
+ENV_AWS_DEFAULT_REGION=us-west-2
+ENV_AWS_ACCESS_KEY_ID=test
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMPropagatesExitCode_1]
+sam: simulated failure
+---
+
+[TestSAMPutsSelectedRegionOnTheCommandLine_1]
+ARGS:deploy --region ap-northeast-1
+ENV_AWS_ENDPOINT_URL=http://<host>:<port>
+ENV_AWS_ENDPOINT_URL_S3=<unset>
+ENV_AWS_REGION=ap-northeast-1
+ENV_AWS_DEFAULT_REGION=ap-northeast-1
+ENV_AWS_ACCESS_KEY_ID=121212122323
+ENV_AWS_SECRET_ACCESS_KEY=test
+ENV_AWS_PROFILE=<unset>
+ENV_AWS_DEFAULT_PROFILE=<unset>
+ENV_AWS_SESSION_TOKEN=<unset>
+---
+
+[TestSAMVersionTooOld_1]
+---
+
+[TestSAMVersionTooOld_2]
+Error: AWS SAM CLI 1.94.0 is too old; lstk requires 1.95.0 or newer (it points SAM at LocalStack via AWS_ENDPOINT_URL, which older versions ignore)
+  ==> Upgrade AWS SAM CLI: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/install-sam-cli.html
+---
diff --git a/test/integration/__snapshots__/setup_azure_test.snap b/test/integration/__snapshots__/setup_azure_test.snap
new file mode 100644
index 00000000..52482b23
--- /dev/null
+++ b/test/integration/__snapshots__/setup_azure_test.snap
@@ -0,0 +1,22 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestAzCommandErrorsWhenNotSetUp_1]
+Error: Azure CLI integration is not set up
+  ==> Set it up: lstk setup azure
+---
+
+[TestSetupAzureAliasAz_1]
+Error: no azure emulator configured — run 'lstk start' and select the Azure emulator first
+---
+
+[TestSetupAzureNonInteractiveRunsWithoutTerminal_1]
+Error: no azure emulator configured — run 'lstk start' and select the Azure emulator first
+---
+
+[TestSetupAzureReportsMissingAzCLIOnce_1]
+Error: az CLI not found in PATH — install it from https://learn.microsoft.com/en-us/cli/azure/
+---
+
+[TestSetupAzureReportsMissingAzCLIOnce_2]
+---
diff --git a/test/integration/__snapshots__/snapshot_list_test.snap b/test/integration/__snapshots__/snapshot_list_test.snap
new file mode 100644
index 00000000..08337920
--- /dev/null
+++ b/test/integration/__snapshots__/snapshot_list_test.snap
@@ -0,0 +1,34 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestSnapshotListAllFlag_1]
+Fetching snapshots...
+~ 1 snapshot
+
+  NAME     VERSION  LAST CHANGED
+  org-pod  1        -
+---
+
+[TestSnapshotListEmpty_1]
+Fetching snapshots...
+> Note: No snapshots found
+---
+
+[TestSnapshotListRequiresAuthToken_1]
+Error: Authentication required to list snapshots
+  ==> Log in: lstk login
+  ==> Or set a token: export LOCALSTACK_AUTH_TOKEN=<token>
+---
+
+[TestSnapshotListServerError_1]
+Error: list snapshots: failed to list cloud pods: status 500: internal error
+---
+
+[TestSnapshotListSuccessWithoutDocker_1]
+Fetching snapshots...
+~ 2 snapshots
+
+  NAME           VERSION  LAST CHANGED
+  baseline-q2    3        <date>              
+  infra-2026-04  1        -
+---
diff --git a/test/integration/__snapshots__/snapshot_load_test.snap b/test/integration/__snapshots__/snapshot_load_test.snap
new file mode 100644
index 00000000..f61e426f
--- /dev/null
+++ b/test/integration/__snapshots__/snapshot_load_test.snap
@@ -0,0 +1,34 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestSnapshotLoadDryRunOnLocalRef_1]
+Error: --dry-run is only supported for pod refs — use the "pod:" prefix (e.g. pod:my-baseline --dry-run)
+---
+
+[TestSnapshotLoadDryRunPodNoAuthToken_1]
+Error: pod snapshots require authentication — set LOCALSTACK_AUTH_TOKEN or run "lstk login"
+---
+
+[TestSnapshotLoadPodInvalidName_pod__1]
+Error: invalid pod name "": must not be empty
+---
+
+[TestSnapshotLoadPodInvalidName_pod_bad.name_1]
+Error: invalid pod name "bad.name": use letters, digits, hyphens, and underscores only
+---
+
+[TestSnapshotLoadPodInvalidName_pod_my_pod_1]
+Error: invalid pod name "my pod": use letters, digits, hyphens, and underscores only
+---
+
+[TestSnapshotLoadPodNoAuthToken_1]
+Error: pod snapshots require authentication — set LOCALSTACK_AUTH_TOKEN or run "lstk login"
+---
+
+[TestSnapshotLoadRemoteRejected_oras_registry_image_1]
+Error: remote destinations are not yet supported — coming soon
+---
+
+[TestSnapshotLoadS3RequiresPodName_1]
+Error: a pod name is required to load from S3: lstk snapshot load <pod-name> s3://bucket/key
+---
diff --git a/test/integration/__snapshots__/snapshot_load_version_test.snap b/test/integration/__snapshots__/snapshot_load_version_test.snap
new file mode 100644
index 00000000..bf1f6cbc
--- /dev/null
+++ b/test/integration/__snapshots__/snapshot_load_version_test.snap
@@ -0,0 +1,62 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestSnapshotLoadPodVersionDryRun_1]
+Checking diff for pod "my-baseline" (version 3)......
+Dry-run results for pod:my-baseline:3
+
+  s3  + 1 addition
+
+✔︎ No state was modified.
+---
+
+[TestSnapshotLoadPodVersionNotFound_1]
+Loading snapshot from pod "my-baseline" (version 99)......
+Error: Could not load snapshot
+  Unable to load pod my-baseline with version 99. The maximum version available in the remote storage is 3
+  ==> List available versions: lstk snapshot versions pod:my-baseline
+---
+
+[TestSnapshotLoadPodVersionReachesWire_1]
+Loading snapshot from pod "my-baseline" (version 3)......
+✔︎ Snapshot loaded from pod:my-baseline:3
+• Services: s3
+---
+
+[TestSnapshotLoadPodWithoutVersionOmitsParam_1]
+Loading snapshot from pod "my-baseline"......
+✔︎ Snapshot loaded from pod:my-baseline
+• Services: s3
+---
+
+[TestSnapshotLoadRejectsMalformedVersion_pod_my-baseline_0_1]
+Error: invalid version "0" in "pod:my-baseline:0": use a positive integer
+---
+
+[TestSnapshotLoadRejectsMalformedVersion_pod_my-baseline__1]
+Error: invalid version "" in "pod:my-baseline:": use a positive integer
+---
+
+[TestSnapshotLoadRejectsMalformedVersion_pod_my-baseline_abc_1]
+Error: invalid version "abc" in "pod:my-baseline:abc": use a positive integer
+---
+
+[TestSnapshotLoadS3RejectsPodVersion_1]
+Error: a specific snapshot version is not supported here: "my-pod:3" — S3 remotes do not support snapshot versions
+---
+
+[TestSnapshotRemoveRejectsPodVersion_1]
+Error: a specific snapshot version is not supported here: drop the ':3' from "pod:my-baseline:3"
+---
+
+[TestSnapshotSaveRejectsPodVersion_pod_destination_1]
+Error: a specific snapshot version is not supported here: 'pod:my-baseline:3' — the platform assigns the version on each save; use 'pod:my-baseline'
+---
+
+[TestSnapshotSaveRejectsPodVersion_s3_remote_1]
+Error: a specific snapshot version is not supported here: "my-pod:3" — S3 remotes do not support snapshot versions
+---
+
+[TestStartSnapshotFlagAcceptsPodVersion_1]
+Error: invalid version "abc" in "pod:my-baseline:abc": use a positive integer
+---
diff --git a/test/integration/__snapshots__/snapshot_remove_test.snap b/test/integration/__snapshots__/snapshot_remove_test.snap
new file mode 100644
index 00000000..db28d949
--- /dev/null
+++ b/test/integration/__snapshots__/snapshot_remove_test.snap
@@ -0,0 +1,38 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestSnapshotRemoteSchemeRejected_oras_registry_snap_1]
+Error: remote destinations are not yet supported — coming soon
+---
+
+[TestSnapshotRemoteSchemeRejected_s3_bucket_snap_1]
+Error: remote destinations are not yet supported — coming soon
+---
+
+[TestSnapshotRemoveLocalBareNameRejected_1]
+Error: 'my-baseline' resolves to a local file (./my-baseline.snapshot); CLI cannot delete local files
+---
+
+[TestSnapshotRemoveLocalRefRejected_1]
+Error: './my-baseline.zip' resolves to a local file (./my-baseline.snapshot); CLI cannot delete local files
+---
+
+[TestSnapshotRemoveNonInteractiveRequiresForce_1]
+Error: snapshot remove requires confirmation; use --force to skip in non-interactive mode
+---
+
+[TestSnapshotRemovePodInvalidName_pod__1]
+Error: invalid pod name "": must not be empty
+---
+
+[TestSnapshotRemovePodInvalidName_pod_bad.name_1]
+Error: invalid pod name "bad.name": use letters, digits, hyphens, and underscores only
+---
+
+[TestSnapshotRemovePodInvalidName_pod_my_pod_1]
+Error: invalid pod name "my pod": use letters, digits, hyphens, and underscores only
+---
+
+[TestSnapshotRemovePodNoAuthToken_1]
+Error: pod snapshots require authentication — set LOCALSTACK_AUTH_TOKEN or run "lstk login"
+---
diff --git a/test/integration/__snapshots__/snapshot_save_test.snap b/test/integration/__snapshots__/snapshot_save_test.snap
new file mode 100644
index 00000000..195c301e
--- /dev/null
+++ b/test/integration/__snapshots__/snapshot_save_test.snap
@@ -0,0 +1,42 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestSnapshotSavePodInvalidName_pod__1]
+Error: invalid pod name "": must not be empty
+---
+
+[TestSnapshotSavePodInvalidName_pod_bad.name_1]
+Error: invalid pod name "bad.name": use letters, digits, hyphens, and underscores only
+---
+
+[TestSnapshotSavePodInvalidName_pod_my_pod_1]
+Error: invalid pod name "my pod": use letters, digits, hyphens, and underscores only
+---
+
+[TestSnapshotSavePodNoAuthToken_1]
+Error: pod snapshots require authentication — set LOCALSTACK_AUTH_TOKEN or run "lstk login"
+---
+
+[TestSnapshotSavePodServicesInvalidFormat_____1]
+Error: must be a comma-separated list of service names (letters, digits, hyphens, underscores)
+---
+
+[TestSnapshotSavePodServicesInvalidFormat_s3__1]
+Error: must be a comma-separated list of service names (letters, digits, hyphens, underscores)
+---
+
+[TestSnapshotSavePodServicesInvalidFormat_s3_lambda_1]
+Error: must be a comma-separated list of service names (letters, digits, hyphens, underscores)
+---
+
+[TestSnapshotSaveRemoteRejected_oras_registry_my-snap_1]
+Error: remote destinations are not yet supported — coming soon
+---
+
+[TestSnapshotSaveS3CredentialsInURLRejected_1]
+Error: do not put credentials in the s3:// URL; use AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or --profile
+---
+
+[TestSnapshotSaveS3MissingCredentials_1]
+Error: AWS credentials required for S3 snapshots: set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, set AWS_PROFILE, or pass --profile <name>
+---
diff --git a/test/integration/__snapshots__/snapshot_show_test.snap b/test/integration/__snapshots__/snapshot_show_test.snap
new file mode 100644
index 00000000..5bf1ed24
--- /dev/null
+++ b/test/integration/__snapshots__/snapshot_show_test.snap
@@ -0,0 +1,48 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestSnapshotShowNotFound_1]
+Fetching snapshot...
+Error: Snapshot 'pod:missing' not found
+  ==> List your snapshots: lstk snapshot list
+---
+
+[TestSnapshotShowRejectsLocalPath_1]
+Error: './my-snapshot' resolves to a local file (./my-snapshot.snapshot); CLI cannot show local snapshots
+---
+
+[TestSnapshotShowRejectsPodNameWithPeriod_1]
+Error: invalid pod name "release.v1": use letters, digits, hyphens, and underscores only
+---
+
+[TestSnapshotShowRequiresAuthToken_1]
+Error: Authentication required to show snapshots
+  ==> Log in: lstk login
+  ==> Or set a token: export LOCALSTACK_AUTH_TOKEN=<token>
+---
+
+[TestSnapshotShowSuccessWithoutDocker_1]
+Fetching snapshot...
+Name            my-baseline
+Version         1
+Created         <date>              
+Size            <size> 
+LocalStack      <calv> 
+Message         Pre-refactor baseline
+
+Services        s3, lambda, dynamodb, sqs
+
+Resources
+  lambda        1 function
+  s3            3 buckets
+---
+
+[TestSnapshotShowWithoutResources_1]
+Fetching snapshot...
+Name            bare
+Version         1
+Size            <size>
+LocalStack      <calv> 
+
+Services        s3, sqs
+---
diff --git a/test/integration/__snapshots__/snapshot_versions_test.snap b/test/integration/__snapshots__/snapshot_versions_test.snap
new file mode 100644
index 00000000..e0d6fac7
--- /dev/null
+++ b/test/integration/__snapshots__/snapshot_versions_test.snap
@@ -0,0 +1,95 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestSnapshotShowPinnedVersion_1]
+Fetching snapshot version 1...
+Name            my-baseline
+Version         1
+Created         <date>              
+Size            <size>
+LocalStack      <calv> 
+Message         the first one
+
+Services        s3
+---
+
+[TestSnapshotShowVersionNotFound_1]
+Fetching snapshot version 99...
+Error: Version 99 of 'pod:my-baseline' not found
+  The highest available version is 3.
+  ==> List available versions: lstk snapshot versions pod:my-baseline
+---
+
+[TestSnapshotVersionsEmptyHistory_1]
+Fetching versions...
+> Note: No versions found for 'pod:blank'
+---
+
+[TestSnapshotVersionsFiltersDeletedVersions_1]
+Fetching versions...
+~ 2 versions
+
+  VERSION  CREATED  LOCALSTACK  SERVICES
+  3        -        keep-three  -
+  1        -        keep-one    -
+---
+
+[TestSnapshotVersionsNoDockerRequired_1]
+Fetching versions...
+~ 3 versions
+
+  VERSION  CREATED               LOCALSTACK  SERVICES
+  3        <date>                <calv>      s3, lambda
+  2        <date>                <calv>      s3
+  1        <date>                <calv>      -
+---
+
+[TestSnapshotVersionsNotFound_1]
+Fetching versions...
+Error: Snapshot 'pod:missing' not found
+  ==> List your snapshots: lstk snapshot list
+---
+
+[TestSnapshotVersionsOrasKeepsComingSoon_1]
+Error: remote destinations are not yet supported — coming soon
+---
+
+[TestSnapshotVersionsRejectsInvalidPodName_1]
+Error: invalid pod name "release.v1": use letters, digits, hyphens, and underscores only
+---
+
+[TestSnapshotVersionsRejectsLocalPath_1]
+Error: './my-snapshot' resolves to a local file (./my-snapshot.snapshot); CLI cannot list versions of local snapshots
+---
+
+[TestSnapshotVersionsRejectsS3Ref_1]
+Error: snapshot versions is only supported for Cloud Pods (pod: refs), not S3 remotes
+---
+
+[TestSnapshotVersionsRejectsVersionSuffix_1]
+Error: a specific snapshot version is not supported here: drop the ':3' from "pod:my-baseline:3"
+---
+
+[TestSnapshotVersionsRequiresAuthToken_1]
+Error: Authentication required to list snapshot versions
+  ==> Log in: lstk login
+  ==> Or set a token: export LOCALSTACK_AUTH_TOKEN=<token>
+---
+
+[TestSnapshotVersionsSingleVersionUsesSingularNoun_1]
+Fetching versions...
+~ 1 version
+
+  VERSION  CREATED  LOCALSTACK  SERVICES
+  1        -        -           -
+---
+
+[TestSnapshotVersionsSuccessWithoutDocker_1]
+Fetching versions...
+~ 3 versions
+
+  VERSION  CREATED               LOCALSTACK  SERVICES
+  3        <date>                <calv>      s3, lambda
+  2        <date>                <calv>      s3
+  1        <date>                <calv>      -
+---
diff --git a/test/integration/__snapshots__/start_snapshot_test.snap b/test/integration/__snapshots__/start_snapshot_test.snap
new file mode 100644
index 00000000..9343227a
--- /dev/null
+++ b/test/integration/__snapshots__/start_snapshot_test.snap
@@ -0,0 +1,10 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestStartSnapshotConflictingFlags_1]
+Error: --snapshot and --no-snapshot cannot be used together
+---
+
+[TestStartSnapshotInvalidPodName_1]
+Error: invalid pod name "bad.name": use letters, digits, hyphens, and underscores only
+---
diff --git a/test/integration/__snapshots__/start_test.snap b/test/integration/__snapshots__/start_test.snap
new file mode 100644
index 00000000..1d9b5434
--- /dev/null
+++ b/test/integration/__snapshots__/start_test.snap
@@ -0,0 +1,6 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestStartCommandRejectsInvalidExposePorts_1]
+Error: failed to get config: invalid container config: invalid expose_ports entry "53/sctp": protocol must be "tcp" or "udp"
+---
diff --git a/test/integration/__snapshots__/status_test.snap b/test/integration/__snapshots__/status_test.snap
new file mode 100644
index 00000000..e0369198
--- /dev/null
+++ b/test/integration/__snapshots__/status_test.snap
@@ -0,0 +1,8 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestStatusCommandFailsWhenNotRunning_1]
+Error: LocalStack AWS Emulator is not running
+  ==> Start LocalStack: lstk
+  ==> See help: lstk -h
+---
diff --git a/test/integration/__snapshots__/terraform_cmd_test.snap b/test/integration/__snapshots__/terraform_cmd_test.snap
new file mode 100644
index 00000000..ef7e3f06
--- /dev/null
+++ b/test/integration/__snapshots__/terraform_cmd_test.snap
@@ -0,0 +1,102 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestTerraformAliasTF_1]
+ARGS:version
+---
+
+[TestTerraformDryRunGeneratesOverride_1]
+# Generated by lstk - do not edit. This file is removed automatically.
+
+provider "aws" {
+  access_key = "111111111111"
+  secret_key = "test"
+  region = "us-west-2"
+  skip_credentials_validation = true
+  skip_metadata_api_check = true
+  s3_use_path_style = false
+
+  endpoints {
+    s3 = "http://<endpoint-host>:4566"
+    sqs = "http://<endpoint-host>:4566"
+  }
+}
+
+---
+
+[TestTerraformFlagBeforeSubcommandRejected_1]
+---
+
+[TestTerraformFlagBeforeSubcommandRejected_2]
+Error: --region and --account must appear after the terraform subcommand (e.g. `lstk terraform --region us-west-2 ...`)
+---
+
+[TestTerraformFlagsAfterActionAreForwarded_1]
+ARGS:version --region us-west-2
+---
+
+[TestTerraformForwardsArgs_1]
+ARGS:version
+---
+
+[TestTerraformHelpSkipsOverride_--help_1]
+ARGS:--help
+---
+
+[TestTerraformHelpSkipsOverride_-h_1]
+ARGS:-h
+---
+
+[TestTerraformHelpSkipsOverride_-help_1]
+ARGS:-help
+---
+
+[TestTerraformHelpSkipsOverride_plan_--help_1]
+ARGS:plan --help
+---
+
+[TestTerraformHonorsLstkTfCmd_1]
+TOFU:version
+---
+
+[TestTerraformInvalidAccountRejected_1]
+---
+
+[TestTerraformInvalidAccountRejected_2]
+Error: --account must be a 12-digit AWS account id, got "12345"
+---
+
+[TestTerraformMissingBinary_1]
+---
+
+[TestTerraformMissingBinary_2]
+Error: terraform not found in PATH
+  ==> Install Terraform CLI: https://developer.hashicorp.com/terraform/cli
+---
+
+[TestTerraformMissingFlagValue_1]
+---
+
+[TestTerraformMissingFlagValue_2]
+Error: --region requires a value
+---
+
+[TestTerraformPropagatesExitCode_1]
+terraform: simulated failure
+---
+
+[TestTerraformUnproxiedSkipsOverride_fmt_1]
+ARGS:fmt
+---
+
+[TestTerraformUnproxiedSkipsOverride_init_1]
+ARGS:init
+---
+
+[TestTerraformUnproxiedSkipsOverride_validate_1]
+ARGS:validate
+---
+
+[TestTerraformUnproxiedSkipsOverride_version_1]
+ARGS:version
+---
diff --git a/test/integration/__snapshots__/update_test.snap b/test/integration/__snapshots__/update_test.snap
new file mode 100644
index 00000000..53712e37
--- /dev/null
+++ b/test/integration/__snapshots__/update_test.snap
@@ -0,0 +1,21 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestUpdateBinaryMockGitHubChecksumMismatch_1]
+lstk 0.0.1
+---
+
+[TestUpdateBinaryMockGitHubHappyPath_1]
+Checking for updates...
+Update available: 0.0.1 → v0.0.2
+Downloading and verifying update...
+✔︎ Updated to v0.0.2
+---
+
+[TestUpdateBinaryMockGitHubHappyPath_2]
+lstk 0.0.2
+---
+
+[TestUpdateBinaryMockGitHubMissingChecksums_1]
+lstk 0.0.1
+---
diff --git a/test/integration/__snapshots__/volume_test.snap b/test/integration/__snapshots__/volume_test.snap
new file mode 100644
index 00000000..58b43129
--- /dev/null
+++ b/test/integration/__snapshots__/volume_test.snap
@@ -0,0 +1,10 @@
+Snapshots created by internal/snap. UPDATE_SNAPS=true go test rewrites
+this file.
+
+[TestVolumeClearCommand_fails_without_force_in_non-interactive_mode_1]
+Error: volume clear requires confirmation; use --force to skip in non-interactive mode
+---
+
+[TestVolumeClearCommand_filters_by_emulator_type_1]
+Error: emulator type "snowflake" not found in config; available: [aws]
+---
diff --git a/test/integration/aws_cmd_test.go b/test/integration/aws_cmd_test.go
index e7cd0208..08d58fdb 100644
--- a/test/integration/aws_cmd_test.go
+++ b/test/integration/aws_cmd_test.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
 	"github.com/stretchr/testify/assert"
@@ -375,9 +376,8 @@ func TestAWSCommandRejectsInvalidAccount(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "--account", "12345", "s3", "ls")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "12-digit AWS account id")
-	// The AWS CLI must not have run.
-	assert.NotContains(t, stdout, "ARGS:")
+	// The AWS CLI must not have run, so the snapshot carries no ARGS: line.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.5 (missing value)
@@ -389,8 +389,7 @@ func TestAWSCommandRejectsAccountWithoutValue(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "--account")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "--account requires a value")
-	assert.NotContains(t, stdout, "ARGS:")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.6 — a flag before the `aws` token would be eaten during Cobra's command
@@ -403,8 +402,7 @@ func TestAWSCommandRejectsPreSubcommandAccount(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "--account", "111111111111", "aws", "s3", "ls")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "must appear after the aws subcommand")
-	assert.NotContains(t, stdout, "ARGS:")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // The leading flag is consumed before the help short-circuit, so help still
@@ -427,9 +425,7 @@ func TestAWSCommandFailsWhenAWSCLINotInstalled(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "aws", "s3", "ls")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "aws CLI not found in PATH")
-	assert.Contains(t, stdout, "Install AWS CLI:")
-	assert.Contains(t, stdout, "https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestAWSCommandUsesDefaultPortWithoutConfig(t *testing.T) {
@@ -525,8 +521,7 @@ func TestAWSCommandHelpSkipsDockerAndEmulator(t *testing.T) {
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, cmdArgs...)
 			require.NoError(t, err, "stderr: %s", stderr)
 
-			assert.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
-			assert.NotContains(t, stdout, "--endpoint-url")
+			snap.Match(t, sanitizeOutput(stdout))
 		})
 	}
 }
diff --git a/test/integration/aws_completion_test.go b/test/integration/aws_completion_test.go
index c9e580f7..26f3ee4f 100644
--- a/test/integration/aws_completion_test.go
+++ b/test/integration/aws_completion_test.go
@@ -7,6 +7,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 )
 
@@ -37,12 +38,7 @@ func TestAWSCompletionDelegatesToAWSCompleter(t *testing.T) {
 
 	// The completer strips the first word of COMP_LINE and resolves the rest
 	// against the aws command tree, so lstk's own name must not be in it.
-	assert.Contains(t, stdout, "compline=[aws s3 l]")
-	assert.NotContains(t, stdout, "compline=[lstk")
-
-	completions := strings.Fields(stdout)
-	assert.Contains(t, completions, "ls")
-	assert.Contains(t, completions, "list-buckets")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestAWSCompletionAppendsTrailingSpaceForNewWord verifies the cursor position
@@ -57,7 +53,7 @@ func TestAWSCompletionAppendsTrailingSpaceForNewWord(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "__complete", "aws", "s3", "")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	assert.Contains(t, stdout, "compline=[aws s3 ]")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestAWSCompletionStripsGlobalFlags keeps lstk's own persistent flags out of
@@ -73,7 +69,7 @@ func TestAWSCompletionStripsGlobalFlags(t *testing.T) {
 		"__complete", "aws", "--non-interactive", "s3", "l")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	assert.Contains(t, stdout, "compline=[aws s3 l]")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestAWSCompletionNeedsNoDockerOrEmulator guards the property that makes this
@@ -91,8 +87,7 @@ func TestAWSCompletionNeedsNoDockerOrEmulator(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "__complete", "aws", "s3", "l")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	assert.Contains(t, stdout, "ls")
-	assert.NotContains(t, stdout, "Docker is not available")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestAWSCompletionDegradesWhenCompleterMissing verifies a machine without
@@ -108,7 +103,7 @@ func TestAWSCompletionDegradesWhenCompleterMissing(t *testing.T) {
 
 	// ShellCompDirectiveDefault (0) — hand the word back to the shell's own
 	// file completion rather than offering nothing at all.
-	assert.Equal(t, ":0", strings.TrimSpace(stdout))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestBashCompletionForAWSSubcommand drives the real generated bash script the
diff --git a/test/integration/awsconfig_test.go b/test/integration/awsconfig_test.go
index bcf50ae4..ee0d1a46 100644
--- a/test/integration/awsconfig_test.go
+++ b/test/integration/awsconfig_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -252,8 +253,7 @@ func TestSetupAWSNonInteractiveCreatesProfile(t *testing.T) {
 		"setup", "aws",
 	)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "Created LocalStack profile in ~/.aws")
-	assert.NotContains(t, stdout, "requires an interactive terminal")
+	snap.Match(t, sanitizeOutput(stdout))
 
 	configContent, err := os.ReadFile(filepath.Join(tmpHome, ".aws", "config"))
 	require.NoError(t, err, "~/.aws/config should have been created")
@@ -280,7 +280,7 @@ func TestSetupAWSNonInteractiveIsIdempotent(t *testing.T) {
 	// not be treated as an overwrite (no --force required).
 	stdout, _, err := runLstk(t, testContext(t), "", baseEnv, "setup", "aws")
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "already configured")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSetupAWSNonInteractiveOverwriteRequiresForce(t *testing.T) {
@@ -297,7 +297,7 @@ func TestSetupAWSNonInteractiveOverwriteRequiresForce(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), "", baseEnv, "setup", "aws")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "--force")
+	snap.Match(t, sanitizeOutput(stdout))
 
 	// The existing profile must be left untouched.
 	configContent, err := os.ReadFile(filepath.Join(awsDir, "config"))
diff --git a/test/integration/az_cmd_test.go b/test/integration/az_cmd_test.go
index 177bc6c3..b769016c 100644
--- a/test/integration/az_cmd_test.go
+++ b/test/integration/az_cmd_test.go
@@ -8,6 +8,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -22,9 +23,7 @@ func TestAzCommandFailsWhenAzureCLINotInstalled(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), workDir, e, "az", "group", "list")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "az CLI not found in PATH")
-	assert.Contains(t, stdout, "Install Azure CLI:")
-	assert.Contains(t, stdout, "https://learn.microsoft.com/en-us/cli/azure/")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // azureHealthServer answers like an Azure-flavored emulator: /_localstack/health
@@ -119,9 +118,7 @@ func TestAzCommandStripsGlobalFlagsFromPassthrough(t *testing.T) {
 		"--endpoint-url", srv.URL, "--config", configPath, "--non-interactive", "az", "group", "list")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	assert.Contains(t, stdout, "AZ_ARGS:group list")
-	assert.NotContains(t, stdout, "--non-interactive")
-	assert.NotContains(t, stdout, "--config")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // --config must select the given config file for `lstk az` too: the Azure setup
@@ -137,12 +134,12 @@ func TestAzCommandConfigFlagSelectsConfigFile(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "--config", configPath, "az", "group", "list")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "AZ_ARGS:group list")
+	snap.Match(t, sanitizeOutput(stdout))
 
 	stdout, _, err = runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "az", "group", "list")
 	require.Error(t, err, "without --config the azure setup marker must not be found")
-	assert.Contains(t, stdout, "Azure CLI integration is not set up")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestAzCommandShowsSpinnerForSlowOperation(t *testing.T) {
diff --git a/test/integration/az_interception_test.go b/test/integration/az_interception_test.go
index f9224ded..b70a446e 100644
--- a/test/integration/az_interception_test.go
+++ b/test/integration/az_interception_test.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -43,8 +44,7 @@ func TestAzStartInterceptionRoutesToSubcommand(t *testing.T) {
 		"az", "start-interception",
 	)
 	require.Error(t, err)
-	assert.Contains(t, stdout, "az CLI not found in PATH")
-	assert.NotContains(t, stdout, "not set up")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // stop-interception is a safe no-op when LocalStack is not the active cloud — e.g.
@@ -62,7 +62,7 @@ func TestAzStopInterceptionNoOpWhenNotIntercepting(t *testing.T) {
 		"az", "stop-interception",
 	)
 	require.NoError(t, err, "stop-interception must not fail when LocalStack is not active")
-	assert.Contains(t, stdout, "not the active Azure cloud")
+	snap.Match(t, sanitizeOutput(stdout))
 
 	// It must not have switched the active cloud to anything.
 	active, azErr := runAzRaw(t, testContext(t), env.WithHome(home), "cloud", "show", "--query", "name", "-o", "tsv")
@@ -79,8 +79,7 @@ func TestAzStopInterceptionFailsWhenAzureCLINotInstalled(t *testing.T) {
 		"az", "stop-interception",
 	)
 	require.Error(t, err)
-	assert.Contains(t, stdout, "az CLI not found in PATH")
-	assert.Contains(t, stdout, "Install Azure CLI:")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestAzInterception exercises the full start/stop-interception lifecycle against a real
diff --git a/test/integration/az_pty_test.go b/test/integration/az_pty_test.go
index 2a000933..6329a5b3 100644
--- a/test/integration/az_pty_test.go
+++ b/test/integration/az_pty_test.go
@@ -13,6 +13,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -153,6 +154,5 @@ func TestAzWithPipedStdoutKeepsPipe(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), workDir, e, "--endpoint-url", srv.URL, "az", "group", "list")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "STDOUT_TTY:no")
-	assert.Contains(t, stdout, "piped")
+	snap.Match(t, sanitizeOutput(stdout))
 }
diff --git a/test/integration/cdk_cmd_test.go b/test/integration/cdk_cmd_test.go
index 9eabed46..836cc4f2 100644
--- a/test/integration/cdk_cmd_test.go
+++ b/test/integration/cdk_cmd_test.go
@@ -4,6 +4,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -49,7 +50,7 @@ func TestCDKForwardsArgs(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ARGS:synth")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.1 — propagates the cdk exit code.
@@ -60,7 +61,7 @@ func TestCDKPropagatesExitCode(t *testing.T) {
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
 	require.Error(t, err)
-	assert.Contains(t, stderr, "simulated failure")
+	snap.Match(t, sanitizeOutput(stderr))
 	requireExitCode(t, 7, err)
 }
 
@@ -82,16 +83,11 @@ func TestCDKInjectsCleanAWSEnv(t *testing.T) {
 		"cdk", "--region", "eu-west-1", "synth")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	assert.Contains(t, stdout, "ENV_AWS_ENDPOINT_URL=http")
-	assert.Contains(t, stdout, ":4566")
-	assert.Contains(t, stdout, "ENV_AWS_ENDPOINT_URL_S3=http")
-	assert.Contains(t, stdout, "ENV_AWS_REGION=eu-west-1")
-	assert.Contains(t, stdout, "ENV_AWS_ACCESS_KEY_ID=test")
-	assert.Contains(t, stdout, "ENV_AWS_SECRET_ACCESS_KEY=test")
-	// Ambient AWS config is stripped.
-	assert.Contains(t, stdout, "ENV_AWS_PROFILE=<unset>")
-	assert.Contains(t, stdout, "ENV_AWS_DEFAULT_PROFILE=<unset>")
-	assert.Contains(t, stdout, "ENV_AWS_SESSION_TOKEN=<unset>")
+	// The snapshot pins the full env contract: both endpoints' scheme+port
+	// (host is DNS-dependent, masked), the region, the forced "test" access
+	// key (a real-looking ambient key must not select a custom account), and
+	// ambient AWS config stripped to <unset>.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.4 — offline subcommands run without a running emulator, even with a leading
@@ -109,8 +105,9 @@ func TestCDKOfflineCommandsNoEmulator(t *testing.T) {
 				"cdk", "--region", "us-west-2", sub)
 			require.NoError(t, err, "stderr: %s", stderr)
 
-			assert.Contains(t, stdout, "ARGS:"+sub)
-			assert.NotContains(t, stdout, "--region")
+			// The snapshot pins the forwarded args: the leading --region must
+			// be stripped, not forwarded to cdk.
+			snap.Match(t, sanitizeOutput(stdout))
 		})
 	}
 }
@@ -130,7 +127,7 @@ func TestCDKHelpNoEmulator(t *testing.T) {
 			cmdArgs := append([]string{"cdk"}, args...)
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, cmdArgs...)
 			require.NoError(t, err, "stderr: %s", stderr)
-			assert.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
+			snap.Match(t, sanitizeOutput(stdout))
 		})
 	}
 }
@@ -143,9 +140,10 @@ func TestCDKVersionTooOld(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
 	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "2.177.0")
-	// cdk was never run for real.
-	assert.NotContains(t, stdout, "ARGS:synth")
+	// The snapshots pin the full version error; cdk was never run for real
+	// (no ARGS line in either stream).
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.5 — a missing cdk binary yields the install error.
@@ -155,7 +153,8 @@ func TestCDKMissingBinary(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
 	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "not found in PATH")
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.6 — --account is not supported for cdk and is rejected at the command
@@ -172,8 +171,9 @@ func TestCDKAccountRejected(t *testing.T) {
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 				"cdk", "--account", value, "synth")
 			require.Error(t, err)
-			assert.Contains(t, stderr+stdout, "not supported")
-			assert.NotContains(t, stdout, "ARGS:synth")
+			// The snapshots pin the rejection; cdk was never run (no ARGS line).
+			snap.Match(t, sanitizeOutput(stderr))
+			snap.Match(t, sanitizeOutput(stdout))
 		})
 	}
 }
@@ -187,7 +187,7 @@ func TestCDKFlagsAfterActionAreForwarded(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"cdk", "synth", "--region", "us-west-2")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ARGS:synth --region us-west-2")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.6 — a flag before the subcommand is rejected with a clear message.
@@ -199,7 +199,8 @@ func TestCDKFlagBeforeSubcommandRejected(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--account", "111111111111", "cdk", "synth")
 	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "must appear after the cdk subcommand")
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.7 — LSTK_CDK_CMD selects the binary to invoke.
@@ -214,7 +215,7 @@ func TestCDKHonorsLstkCdkCmd(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "synth")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "MYCDK:synth")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.3 — an AWS-contacting command with no running emulator fails with "not
diff --git a/test/integration/completion_test.go b/test/integration/completion_test.go
index 948eb114..295e610f 100644
--- a/test/integration/completion_test.go
+++ b/test/integration/completion_test.go
@@ -12,6 +12,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 )
 
@@ -141,35 +142,30 @@ func TestBashCompletionReassemblesWordbreakSplits(t *testing.T) {
 		compWords string
 		cword     int
 		line      string
-		expect    []string
 	}{
 		{
 			name:      "adjacent pieces re-join",
 			compWords: `lstk --config = ./cfg`,
 			cword:     3,
 			line:      "lstk --config=./cfg",
-			expect:    []string{"cur=--config=./cfg", "prev=lstk", "cword=1", "nwords=2"},
 		},
 		{
 			name:      "word after separator-then-space stays separate",
 			compWords: `lstk --config = st`,
 			cword:     3,
 			line:      "lstk --config= st",
-			expect:    []string{"cur=st", "prev=--config=", "cword=2", "nwords=3"},
 		},
 		{
 			name:      "whitespace-surrounded separator stays separate",
 			compWords: `lstk --config = ./x`,
 			cword:     3,
 			line:      "lstk --config = ./x",
-			expect:    []string{"cur=./x", "prev==", "cword=3", "nwords=4"},
 		},
 		{
 			name:      "empty word after separator-then-space",
 			compWords: `lstk --config = ""`,
 			cword:     3,
 			line:      "lstk --config= ",
-			expect:    []string{"cur=", "prev=--config=", "cword=2", "nwords=3"},
 		},
 	}
 
@@ -197,8 +193,7 @@ run_reassembly
 			require.NoError(t, err, "driver failed\nstdout: %s\nstderr: %s", stdout, stderr)
 			assert.NotContains(t, stderr, "command not found")
 
-			lines := strings.Split(strings.TrimRight(stdout, "\n"), "\n")
-			assert.Equal(t, tc.expect, lines)
+			snap.Match(t, sanitizeOutput(stdout))
 		})
 	}
 }
@@ -215,5 +210,5 @@ _get_comp_words_by_ref
 `
 	stdout, stderr, err := runBashCompletionDriver(t, driver)
 	require.NoError(t, err, "driver failed\nstdout: %s\nstderr: %s", stdout, stderr)
-	assert.Contains(t, stdout, "package version")
+	snap.Match(t, sanitizeOutput(stdout))
 }
diff --git a/test/integration/config_test.go b/test/integration/config_test.go
index f1fbbb41..3201335c 100644
--- a/test/integration/config_test.go
+++ b/test/integration/config_test.go
@@ -7,6 +7,7 @@ import (
 	"runtime"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
 	"github.com/stretchr/testify/assert"
@@ -163,7 +164,7 @@ tag = "latest"
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "stop")
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "port is required")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestConfigWithInvalidContainerNameFails(t *testing.T) {
@@ -182,7 +183,8 @@ container_name = "my emulator"
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "stop")
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout+stderr, `invalid container name "my emulator"`)
+	snap.Match(t, sanitizeOutput(stdout))
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestStartWithMultipleContainersFailsFast(t *testing.T) {
@@ -204,7 +206,8 @@ port = "4567"
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "start")
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout+stderr, "only one is supported at a time")
+	snap.Match(t, sanitizeOutput(stdout))
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestLegacyYAMLConfigGivesHelpfulError(t *testing.T) {
diff --git a/test/integration/emulator_type_test.go b/test/integration/emulator_type_test.go
index e11109ea..57ca1351 100644
--- a/test/integration/emulator_type_test.go
+++ b/test/integration/emulator_type_test.go
@@ -6,6 +6,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
 	"github.com/stretchr/testify/assert"
@@ -148,7 +149,7 @@ func TestStartTypeErrorsOnMultipleBlocks(t *testing.T) {
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "azure", "--non-interactive")
 
 	require.Error(t, err)
-	assert.Contains(t, stdout, "Unsupported configuration")
+	snap.Match(t, sanitizeOutput(stdout))
 	// Config must be left untouched — neither block's type is rewritten.
 	data, readErr := os.ReadFile(configPath)
 	require.NoError(t, readErr)
@@ -168,7 +169,7 @@ func TestStartTypePositionalRejected(t *testing.T) {
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "azure", "--non-interactive")
 
 	require.Error(t, err)
-	assert.Contains(t, stderr, "select the emulator with --type")
+	snap.Match(t, sanitizeOutput(stderr))
 	require.NoFileExists(t, configPath)
 }
 
@@ -187,7 +188,7 @@ func TestStartTypeErrorsWhenNoContainersBlock(t *testing.T) {
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "azure", "--non-interactive")
 
 	require.Error(t, err)
-	assert.Contains(t, stderr, "[[containers]] block")
+	snap.Match(t, sanitizeOutput(stderr))
 	// The env table's type key must be left untouched, not corrupted to "azure".
 	data, readErr := os.ReadFile(configPath)
 	require.NoError(t, readErr)
@@ -201,7 +202,7 @@ func TestStartTypeInvalidValue(t *testing.T) {
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--type", "bogus", "--non-interactive")
 
 	require.Error(t, err)
-	assert.Contains(t, stderr, `invalid emulator type "bogus"`)
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // TestStartTypeFlagRefusesSwitchWhenDifferentEmulatorRunning is the end-to-end
diff --git a/test/integration/endpoint_url_https_test.go b/test/integration/endpoint_url_https_test.go
index 226f3365..344853b5 100644
--- a/test/integration/endpoint_url_https_test.go
+++ b/test/integration/endpoint_url_https_test.go
@@ -13,6 +13,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -187,9 +188,7 @@ func TestStatusEndpointURLHTTPSSchemeMismatchSuggestsHTTP(t *testing.T) {
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", httpsURL, "status")
 	require.Error(t, err)
-	assert.Contains(t, stderr, "could not reach LocalStack emulator at "+httpsURL)
-	assert.Contains(t, stderr, srv.URL+" responded")
-	assert.Contains(t, stderr, "retry with that URL")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // TestStatusEndpointURLHTTPSRendersReducedOutput is the https counterpart of
@@ -206,9 +205,7 @@ func TestStatusEndpointURLHTTPSRendersReducedOutput(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "status")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "running")
-	assert.Contains(t, stdout, srv.URL)
-	assert.Contains(t, stdout, "3.0.2")
-	assert.NotContains(t, stdout, "Container:")
-	assert.NotContains(t, stdout, "Uptime:")
+	// The snapshot pins the reduced remote-status card: running headline and
+	// endpoint only — no Container/Uptime lines, which need local Docker.
+	snap.Match(t, sanitizeOutput(stdout))
 }
diff --git a/test/integration/endpoint_url_test.go b/test/integration/endpoint_url_test.go
index ec71f149..57e36987 100644
--- a/test/integration/endpoint_url_test.go
+++ b/test/integration/endpoint_url_test.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -75,8 +76,7 @@ func TestAWSCommandEndpointURLNoDockerRequired(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "aws", "s3", "ls")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ENDPOINT:"+srv.URL)
-	assert.Contains(t, stdout, "ARGS:s3 ls")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestAWSCommandEndpointURLAfterSubcommandPassesThrough proves the aws-CLI
@@ -99,12 +99,11 @@ func TestAWSCommandEndpointURLAfterSubcommandPassesThrough(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--endpoint-url", srv.URL, "aws", "--endpoint-url", "http://127.0.0.1:9", "s3", "ls")
 	require.NoError(t, err, "stderr: %s", stderr)
-	// lstk's own resolution used the pre-command mock — proven by succeeding
-	// at all with DOCKER_HOST broken.
-	assert.Contains(t, stdout, "ENDPOINT:"+srv.URL)
-	// The user's own post-command --endpoint-url reached the wrapped aws
-	// binary untouched, appearing in its forwarded args.
-	assert.Contains(t, stdout, "ARGS:--endpoint-url http://127.0.0.1:9 s3 ls")
+	// The snapshot pins both facts: lstk's own resolution used the pre-command
+	// mock (ENDPOINT line — proven by succeeding at all with DOCKER_HOST
+	// broken), and the user's own post-command --endpoint-url reached the
+	// wrapped aws binary untouched, appearing in its forwarded args.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestLogsRejectsExplicitEndpointURL proves logs (a Docker-lifecycle command
@@ -120,8 +119,7 @@ func TestLogsRejectsExplicitEndpointURL(t *testing.T) {
 	// print a second copy to stderr.
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "logs", "--endpoint-url", "http://localhost:4566")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "logs")
-	assert.Contains(t, stdout, "does not support --endpoint-url")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestVolumePathRejectsExplicitEndpointURL mirrors the logs case for the
@@ -132,7 +130,7 @@ func TestVolumePathRejectsExplicitEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "volume", "path", "--endpoint-url", "http://localhost:4566")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "does not support --endpoint-url")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestStartRejectsExplicitEndpointURL proves `start` (previously missing from
@@ -145,8 +143,7 @@ func TestStartRejectsExplicitEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "start", "--endpoint-url", "http://localhost:4566")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "start")
-	assert.Contains(t, stdout, "does not support --endpoint-url")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // The following tests prove the corrected behavior from design.md's Decision
@@ -163,9 +160,7 @@ func TestLogsRejectsAmbientEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "logs")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "logs")
-	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
-	assert.Contains(t, stdout, "LSTK_ENDPOINT_URL is set")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestStopRejectsAmbientEndpointURL(t *testing.T) {
@@ -175,7 +170,7 @@ func TestStopRejectsAmbientEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "stop")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestRestartRejectsAmbientEndpointURL(t *testing.T) {
@@ -185,8 +180,7 @@ func TestRestartRejectsAmbientEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "restart")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "does not support AWS_ENDPOINT_URL")
-	assert.Contains(t, stdout, "AWS_ENDPOINT_URL is set")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestVolumePathRejectsAmbientEndpointURL(t *testing.T) {
@@ -195,7 +189,7 @@ func TestVolumePathRejectsAmbientEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "volume", "path")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestVolumeClearRejectsAmbientEndpointURL(t *testing.T) {
@@ -204,7 +198,7 @@ func TestVolumeClearRejectsAmbientEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "volume", "clear")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestStartRejectsAmbientEndpointURL(t *testing.T) {
@@ -214,8 +208,7 @@ func TestStartRejectsAmbientEndpointURL(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "start")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "start")
-	assert.Contains(t, stdout, "does not support LSTK_ENDPOINT_URL")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestSnapshotShowIgnoresEndpointURL proves `snapshot show` silently ignores
@@ -258,11 +251,9 @@ func TestStatusEndpointURLRendersReducedOutput(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "status")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "running")
-	assert.Contains(t, stdout, srv.URL[len("http://"):])
-	assert.Contains(t, stdout, "3.0.2")
-	assert.NotContains(t, stdout, "Container:")
-	assert.NotContains(t, stdout, "Uptime:")
+	// The snapshot pins the reduced remote-status card: running headline and
+	// endpoint only — no Container/Uptime lines, which need local Docker.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestStatusEndpointURLShowsResources proves the resources bug fix: `status`
@@ -295,10 +286,7 @@ func TestStatusEndpointURLShowsResources(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", srv.URL, "status")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "SERVICE")
-	assert.Contains(t, stdout, "RESOURCE")
-	assert.Contains(t, stdout, "S3")
-	assert.Contains(t, stdout, "my-test-bucket")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestStatusEndpointURLInteractiveRendersTUI proves `status` against an
@@ -365,8 +353,9 @@ func TestStatusUnreachableEndpointURLFailsClosed(t *testing.T) {
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", notLocalStack.URL, "status")
 	require.Error(t, err)
-	assert.Contains(t, stderr, "could not reach")
-	assert.NotContains(t, stderr, "lstk start")
+	// The snapshot pins the full error, including that it never suggests
+	// `lstk start` — the target is an emulator lstk did not start.
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // TestCDKAWSEndpointURLBypassesDockerCheck proves the BREAKING change:
@@ -385,7 +374,7 @@ func TestCDKAWSEndpointURLBypassesDockerCheck(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "cdk", "deploy", "MyStack")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, fmt.Sprintf("ENV_AWS_ENDPOINT_URL=%s", srv.URL))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestCDKAWSEndpointURLWrongTypeFails proves the type-detection gate: an
@@ -411,6 +400,5 @@ func TestCDKAWSEndpointURLWrongTypeFails(t *testing.T) {
 
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, "--endpoint-url", azureLike.URL, "cdk", "deploy", "MyStack")
 	require.Error(t, err)
-	assert.Contains(t, stdout, "requires the AWS emulator")
-	assert.Contains(t, stdout, "Azure")
+	snap.Match(t, sanitizeOutput(stdout))
 }
diff --git a/test/integration/env/env.go b/test/integration/env/env.go
index 1d8f8a7e..b5766988 100644
--- a/test/integration/env/env.go
+++ b/test/integration/env/env.go
@@ -71,20 +71,34 @@ func Require(t testing.TB, key Key) string {
 
 type Environ []string
 
-func Without(keys ...Key) Environ {
+// ambientAWSKeys are the AWS credential/config variables lstk and the wrapped
+// tools resolve from the environment. They are stripped from every test
+// environment so the developer's real shell (profile, region, keys, endpoint
+// overrides) can't leak into wrapped-tool env dumps, credential resolution, or
+// snapshotted output; tests exercising ambient behavior set them explicitly
+// via With, which wins because exec dedups duplicate keys to the last value.
+var ambientAWSKeys = []Key{
+	"AWS_PROFILE", "AWS_DEFAULT_PROFILE",
+	"AWS_REGION", "AWS_DEFAULT_REGION",
+	"AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN",
+	"AWS_ENDPOINT_URL", "AWS_ENDPOINT_URL_S3",
+	"LSTK_ENDPOINT_URL",
+}
+
+func base() Environ {
 	return Environ(os.Environ()).
+		Without(ambientAWSKeys...).
 		With(AnalyticsEndpoint, UnreachableAnalyticsEndpoint).
 		With(AzureCollectTelemetry, "false").
-		With(SamCliTelemetry, "0").
-		Without(keys...)
+		With(SamCliTelemetry, "0")
+}
+
+func Without(keys ...Key) Environ {
+	return base().Without(keys...)
 }
 
 func With(key Key, value string) Environ {
-	return Environ(os.Environ()).
-		With(AnalyticsEndpoint, UnreachableAnalyticsEndpoint).
-		With(AzureCollectTelemetry, "false").
-		With(SamCliTelemetry, "0").
-		With(key, value)
+	return base().With(key, value)
 }
 
 func (e Environ) Without(keys ...Key) Environ {
diff --git a/test/integration/exit_code_test.go b/test/integration/exit_code_test.go
index afbd0ba4..8e17e018 100644
--- a/test/integration/exit_code_test.go
+++ b/test/integration/exit_code_test.go
@@ -3,7 +3,7 @@ package integration_test
 import (
 	"testing"
 
-	"github.com/stretchr/testify/assert"
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/stretchr/testify/require"
 )
 
@@ -18,19 +18,18 @@ func TestInvalidUsageExitsNonZero(t *testing.T) {
 	t.Parallel()
 
 	cases := []struct {
-		name     string
-		args     []string
-		wantText string
+		name string
+		args []string
 	}{
-		{"unknown flag on start", []string{"start", "--bogus-flag-xyz"}, "unknown flag"},
-		{"unknown flag on root", []string{"--bogus-flag-xyz"}, "unknown flag"},
-		{"unknown command", []string{"bogus-command"}, "unknown command"},
-		{"unknown config subcommand", []string{"config", "bogus"}, `unknown command "bogus"`},
-		{"removed config profile subcommand", []string{"config", "profile"}, `unknown command "profile"`},
-		{"unknown setup subcommand", []string{"setup", "bogus"}, `unknown command "bogus"`},
-		{"unknown volume subcommand", []string{"volume", "bogus"}, `unknown command "bogus"`},
-		{"unknown snapshot subcommand", []string{"snapshot", "bogus"}, `unknown command "bogus"`},
-		{"unknown completion shell", []string{"completion", "bogus"}, `unknown command "bogus"`},
+		{"unknown flag on start", []string{"start", "--bogus-flag-xyz"}},
+		{"unknown flag on root", []string{"--bogus-flag-xyz"}},
+		{"unknown command", []string{"bogus-command"}},
+		{"unknown config subcommand", []string{"config", "bogus"}},
+		{"removed config profile subcommand", []string{"config", "profile"}},
+		{"unknown setup subcommand", []string{"setup", "bogus"}},
+		{"unknown volume subcommand", []string{"volume", "bogus"}},
+		{"unknown snapshot subcommand", []string{"snapshot", "bogus"}},
+		{"unknown completion shell", []string{"completion", "bogus"}},
 	}
 
 	for _, tc := range cases {
@@ -41,7 +40,7 @@ func TestInvalidUsageExitsNonZero(t *testing.T) {
 			_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, tc.args...)
 			require.Error(t, err, "expected %v to fail", tc.args)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, tc.wantText)
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 	}
 }
@@ -60,7 +59,7 @@ func TestBareParentCommandExitsZero(t *testing.T) {
 			stdout, _, err := runLstk(t, testContext(t), t.TempDir(), e, parent)
 			require.NoError(t, err)
 			requireExitCode(t, 0, err)
-			assert.Contains(t, stdout, "Usage:")
+			snap.Match(t, sanitizeOutput(stdout))
 		})
 	}
 }
diff --git a/test/integration/extension_test.go b/test/integration/extension_test.go
index a70679e9..91d8b689 100644
--- a/test/integration/extension_test.go
+++ b/test/integration/extension_test.go
@@ -7,11 +7,13 @@ import (
 	"os/exec"
 	"path/filepath"
 	"runtime"
+	"slices"
 	"strings"
 	"sync"
 	"testing"
 
 	"github.com/google/uuid"
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/require"
 )
@@ -103,6 +105,11 @@ func installLstkBundle(t *testing.T, dir string) string {
 // is touched. Extra DOCKER_HOST etc. can be appended by the caller.
 func envWithPath(tmpHome, extDir string) []string {
 	e := testEnvWithHome(tmpHome, "")
+	// Strip any ambient auth token (set in CI) so extension-context output is
+	// deterministic; a test that wants one appends it explicitly, which wins.
+	e = slices.DeleteFunc(e, func(kv string) bool {
+		return strings.HasPrefix(kv, string(env.AuthToken)+"=")
+	})
 	e = append(e, "PATH="+extDir+string(os.PathListSeparator)+os.Getenv("PATH"))
 	return e
 }
@@ -141,11 +148,12 @@ func TestExtensionUnknownCommandDispatches(t *testing.T) {
 	installExtension(t, extDir, "hello")
 
 	tmpHome := t.TempDir()
-	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), envWithPath(tmpHome, extDir), "hello", "world")
+	// DOCKER_HOST points at a closed port so the emulator context (and with it
+	// the EMULATOR_COUNT/EMULATOR lines) can't vary with the host's Docker state.
+	environ := append(envWithPath(tmpHome, extDir), "DOCKER_HOST=tcp://127.0.0.1:1")
+	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "hello", "world")
 	require.NoError(t, err, stderr)
-	require.Contains(t, stdout, "ARGS=[world]")
-	require.Contains(t, stdout, "API_VERSION=1")
-	require.Contains(t, stdout, "CONFIG_DIR=")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestExtensionUnknownCommandNoExtensionErrors(t *testing.T) {
@@ -155,7 +163,7 @@ func TestExtensionUnknownCommandNoExtensionErrors(t *testing.T) {
 	// goes to stderr, matching Cobra's own unknown-command output.
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), envWithPath(tmpHome, t.TempDir()), "nope")
 	requireExitCode(t, 1, err)
-	require.Contains(t, stderr, "unknown command")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestExtensionExitCodePropagates(t *testing.T) {
@@ -206,10 +214,9 @@ func TestExtensionEndpointOmittedWhenNoRuntime(t *testing.T) {
 	environ = append(environ, "DOCKER_HOST=tcp://127.0.0.1:1")
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "ref")
 	require.NoError(t, err, stderr)
-	require.Contains(t, stdout, "EMULATOR_COUNT=0")
-	require.NotContains(t, stdout, "EMULATOR=")
-	// The extension still runs and still receives the always-present variables.
-	require.Contains(t, stdout, "API_VERSION=1")
+	// The snapshot pins EMULATOR_COUNT=0 with no EMULATOR= lines, while the
+	// always-present variables are still conveyed.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestExtensionSelfAuthorizationRefusesWithoutToken(t *testing.T) {
@@ -224,7 +231,7 @@ func TestExtensionSelfAuthorizationRefusesWithoutToken(t *testing.T) {
 	environ = append(environ, "DOCKER_HOST=tcp://127.0.0.1:1")
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "deploy", "auth")
 	requireExitCode(t, 13, err)
-	require.Contains(t, stderr, "not authorized")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestExtensionInvocationRecordedInTelemetry(t *testing.T) {
@@ -292,12 +299,10 @@ func TestExtensionSessionIDOmittedWhenTelemetryDisabled(t *testing.T) {
 	stdout, _, err := runLstk(t, testContext(t), t.TempDir(), environ, "ref", "exit", "7")
 	requireExitCode(t, 7, err)
 
-	// No session exists, so the field is omitted rather than conveyed empty (the
-	// JSON-level omission is asserted in internal/extension).
-	require.NotContains(t, stdout, "SESSION_ID=",
-		"no sessionId may be conveyed when telemetry is disabled")
-	require.Contains(t, stdout, "API_VERSION=1")
-	require.Contains(t, stdout, "ARGS=[exit 7]")
+	// No session exists, so the snapshot carries no SESSION_ID line at all —
+	// omitted rather than conveyed empty (the JSON-level omission is asserted
+	// in internal/extension).
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // The conveyed machineId exists so an extension's own telemetry reports the same
@@ -503,12 +508,10 @@ func TestExtensionHelpListsBundledWithDescriptionAndPathNameOnly(t *testing.T) {
 	stdout, stderr, err := runBinary(t, t.TempDir(), envWithPath(tmpHome, extDir), lstkBin, "--help")
 	require.NoError(t, err, stderr)
 
-	require.Contains(t, stdout, "Extensions:")
-	require.Contains(t, stdout, "deploy")
-	require.Contains(t, stdout, "Deploy your application to LocalStack")
-	require.Contains(t, stdout, "hello")
-	// Help must not execute any extension.
-	require.NotContains(t, stdout, "ARGS=")
+	// The snapshot pins the Extensions section (bundled `deploy` with its
+	// description, PATH-only `hello` without) and that no extension was
+	// executed (no ARGS= line).
+	snap.Match(t, stdout)
 }
 
 // TestExtensionHelpDescriptionColumnAlignsWithCommands guards the bug where the
@@ -560,8 +563,9 @@ func TestExtensionHelpMissingDescriptionsFileDegrades(t *testing.T) {
 	tmpHome := t.TempDir()
 	stdout, stderr, err := runBinary(t, t.TempDir(), envWithPath(tmpHome, t.TempDir()), lstkBin, "--help")
 	require.NoError(t, err, stderr)
-	require.Contains(t, stdout, "Extensions:")
-	require.Contains(t, stdout, "deploy")
+	// The snapshot pins the Extensions section listing `deploy` with no
+	// description column when the descriptions file is absent.
+	snap.Match(t, stdout)
 }
 
 func TestExtensionResolvableViaSymlinkedLstk(t *testing.T) {
@@ -632,8 +636,8 @@ func TestExtensionBundledWinsOverPath(t *testing.T) {
 	require.NoError(t, err)
 	require.Contains(t, stdout, "SELF="+resolvedBundle, "expected the bundled extension to run, not the PATH one")
 
-	// Help lists the de-duplicated name exactly once.
+	// Help lists the de-duplicated name exactly once — pinned by the snapshot.
 	helpOut, _, err := runBinary(t, t.TempDir(), envWithPath(tmpHome, extDir), lstkBin, "--help")
 	require.NoError(t, err)
-	require.Equal(t, 1, strings.Count(helpOut, "\n  deploy"))
+	snap.Match(t, helpOut)
 }
diff --git a/test/integration/go.mod b/test/integration/go.mod
index 72312a54..e5a083af 100644
--- a/test/integration/go.mod
+++ b/test/integration/go.mod
@@ -13,10 +13,17 @@ require (
 	github.com/charmbracelet/x/xpty v0.1.4
 	github.com/creack/pty v1.1.24
 	github.com/google/uuid v1.6.0
-	github.com/moby/moby/api v1.54.2
-	github.com/moby/moby/client v0.4.1
+	github.com/moby/moby/api v1.55.0
+	github.com/moby/moby/client v0.5.1
 	github.com/stretchr/testify v1.11.1
-	github.com/zalando/go-keyring v0.2.7
+	github.com/zalando/go-keyring v0.2.8
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 
 require (
@@ -43,25 +50,23 @@ require (
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/danieljoos/wincred v1.2.3 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-connections v0.7.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/felixge/httpsnoop v1.1.0 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/godbus/dbus/v5 v5.2.2 // indirect
+	github.com/localstack/lstk v0.0.0
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
-	go.opentelemetry.io/otel/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 // indirect
+	go.opentelemetry.io/otel v1.45.0 // indirect
+	go.opentelemetry.io/otel/metric v1.45.0 // indirect
+	go.opentelemetry.io/otel/trace v1.45.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
+
+replace github.com/localstack/lstk => ../..
diff --git a/test/integration/go.sum b/test/integration/go.sum
index 334bb717..33ebe64e 100644
--- a/test/integration/go.sum
+++ b/test/integration/go.sum
@@ -66,11 +66,11 @@ github.com/docker/go-connections v0.7.0 h1:6SsRfJddP22WMrCkj19x9WKjEDTB+ahsdiGYf
 github.com/docker/go-connections v0.7.0/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
-github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
+github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
@@ -85,10 +85,10 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/moby/api v1.54.2 h1:wiat9QAhnDQjA7wk1kh/TqHz2I1uUA7M7t9SAl/JNXg=
-github.com/moby/moby/api v1.54.2/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
-github.com/moby/moby/client v0.4.1 h1:DMQgisVoMkmMs7fp3ROSdiBnoAu8+vo3GggFl06M/wY=
-github.com/moby/moby/client v0.4.1/go.mod h1:z52C9O2POPOsnxZAy//WtKcQ32P+jT/NGeXu/7nfjGQ=
+github.com/moby/moby/api v1.55.0 h1:2/sexvQyqIWS8pRSCFddBfpW2qE7vR7FCL+vN8pxwMc=
+github.com/moby/moby/api v1.55.0/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
+github.com/moby/moby/client v0.5.1 h1:tYNaJno4c0HXz12y5BiqEDy0rVTYkWzI26lGvnTMiJw=
+github.com/moby/moby/client v0.5.1/go.mod h1:odLstlZ6uSnfvAgVxMpvgmb8SUdd+siH2T0GBuxVAlM=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
@@ -101,22 +101,22 @@ github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/zalando/go-keyring v0.2.7 h1:YbqBw40+g4g69UNk4WsRM/fV9YErfVWwozE2+7Bn+7g=
-github.com/zalando/go-keyring v0.2.7/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0=
+github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPccHs=
+github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 h1:7iP2uCb7sGddAr30RRS6xjKy7AZ2JtTOPA3oolgVSw8=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0/go.mod h1:c7hN3ddxs/z6q9xwvfLPk+UHlWRQyaeR1LdgfL/66l0=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04=
+go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
+go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
+go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
+go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
+go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=
+go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA=
+go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=
+go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA=
+go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
+go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
diff --git a/test/integration/json_envelope_test.go b/test/integration/json_envelope_test.go
index c7820243..c031f628 100644
--- a/test/integration/json_envelope_test.go
+++ b/test/integration/json_envelope_test.go
@@ -6,6 +6,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -55,12 +56,8 @@ func TestNotJSONCapableCommandRendersEnvelope(t *testing.T) {
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), testEnvWithHome(t.TempDir(), ""), "login", "--json")
 	requireExitCode(t, 1, err)
 
-	envelope := decodeEnvelope(t, stdout)
-	assert.Equal(t, "error", envelope.Status)
-	assert.Equal(t, "login", envelope.Command)
-	require.NotNil(t, envelope.Error)
-	assert.Equal(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
-	assert.Equal(t, "USAGE", envelope.Error.Category)
+	decodeEnvelope(t, stdout)
+	snap.MatchJSON(t, []byte(stdout))
 }
 
 func TestUsageErrorAfterJSONRendersEnvelope(t *testing.T) {
@@ -73,11 +70,8 @@ func TestUsageErrorAfterJSONRendersEnvelope(t *testing.T) {
 	stdout, _, err := runLstk(t, ctx, t.TempDir(), testEnvWithHome(t.TempDir(), ""), "stop", "--json", "--bogus-flag")
 	requireExitCode(t, 1, err)
 
-	envelope := decodeEnvelope(t, stdout)
-	assert.Equal(t, "error", envelope.Status)
-	require.NotNil(t, envelope.Error)
-	assert.Equal(t, "USAGE_ERROR", envelope.Error.Code)
-	assert.Equal(t, "USAGE", envelope.Error.Category)
+	decodeEnvelope(t, stdout)
+	snap.MatchJSON(t, []byte(stdout))
 }
 
 func TestUsageErrorBeforeJSONFallsBackToPlainText(t *testing.T) {
@@ -91,7 +85,7 @@ func TestUsageErrorBeforeJSONFallsBackToPlainText(t *testing.T) {
 	requireExitCode(t, 1, err)
 
 	assert.Empty(t, stdout, "no JSON should be attempted when --json wasn't parsed yet")
-	assert.Contains(t, stderr, "bogus-flag")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // TestConfigLoadFailureRendersJSONEnvelope covers PR #374's review comment:
@@ -113,13 +107,9 @@ func TestConfigLoadFailureRendersJSONEnvelope(t *testing.T) {
 	requireExitCode(t, 1, err)
 	assert.Empty(t, stderr, "the plain-text fallback in Execute() must not also fire alongside the envelope")
 
-	envelope := decodeEnvelope(t, stdout)
-	assert.Equal(t, "error", envelope.Status)
-	assert.Equal(t, "stop", envelope.Command)
-	require.NotNil(t, envelope.Error)
-	assert.Equal(t, "CONFIG_INVALID", envelope.Error.Code)
-	assert.Equal(t, "CONFIG", envelope.Error.Category)
-	assert.False(t, envelope.Error.Retryable)
+	decodeEnvelope(t, stdout)
+	// error.message embeds the temp-dir config path, so it is masked.
+	snap.MatchJSON(t, []byte(stdout), "error.message")
 }
 
 // TestConfigNotFoundRendersJSONEnvelope covers the CONFIG_NOT_FOUND half of
@@ -135,10 +125,8 @@ func TestConfigNotFoundRendersJSONEnvelope(t *testing.T) {
 	requireExitCode(t, 1, err)
 	assert.Empty(t, stderr, "the plain-text fallback in Execute() must not also fire alongside the envelope")
 
-	envelope := decodeEnvelope(t, stdout)
-	assert.Equal(t, "error", envelope.Status)
-	assert.Equal(t, "reset", envelope.Command)
-	require.NotNil(t, envelope.Error)
-	assert.Equal(t, "CONFIG_NOT_FOUND", envelope.Error.Code)
-	assert.Equal(t, "CONFIG", envelope.Error.Category)
+	decodeEnvelope(t, stdout)
+	// error.message embeds the temp-dir config path (and an OS-specific
+	// not-found detail), so it is masked.
+	snap.MatchJSON(t, []byte(stdout), "error.message")
 }
diff --git a/test/integration/json_flag_test.go b/test/integration/json_flag_test.go
index 36572ec8..c805f4f0 100644
--- a/test/integration/json_flag_test.go
+++ b/test/integration/json_flag_test.go
@@ -3,6 +3,7 @@ package integration_test
 import (
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -18,12 +19,8 @@ func TestJSONFlagRejectsUnannotatedBuiltinCommand(t *testing.T) {
 	t.Parallel()
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "status", "--json")
 	requireExitCode(t, 1, err)
-	envelope := decodeEnvelope(t, stdout)
-	assert.Equal(t, "status", envelope.Command)
-	assert.Equal(t, "error", envelope.Status)
-	require.NotNil(t, envelope.Error)
-	assert.Equal(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
-	assert.Contains(t, envelope.Error.Message, "status")
+	decodeEnvelope(t, stdout)
+	snap.MatchJSON(t, []byte(stdout))
 	assert.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
 }
 
@@ -31,11 +28,8 @@ func TestJSONFlagRejectsDefaultStartBehavior(t *testing.T) {
 	t.Parallel()
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--json")
 	requireExitCode(t, 1, err)
-	envelope := decodeEnvelope(t, stdout)
-	assert.Equal(t, "start", envelope.Command)
-	assert.Equal(t, "error", envelope.Status)
-	require.NotNil(t, envelope.Error)
-	assert.Equal(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
+	decodeEnvelope(t, stdout)
+	snap.MatchJSON(t, []byte(stdout))
 	assert.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
 }
 
@@ -102,9 +96,10 @@ func TestJSONFlagProxyCommandsForwardJSON(t *testing.T) {
 			args := append([]string{tc.name, "--json"}, tc.args...)
 			stdout, stderr, err := runLstk(t, testContext(t), workDir, environ, args...)
 			require.Error(t, err)
-			combined := stdout + stderr
-			require.Contains(t, combined, "not found in PATH", "--json should have been forwarded to the wrapped tool, not rejected by lstk")
-			require.NotContains(t, combined, "is not able to provide output in JSON format")
+			// The snapshots pin the wrapped tool's missing-binary error —
+			// proof --json was forwarded, not rejected by lstk.
+			snap.Match(t, sanitizeOutput(stdout))
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 
 		t.Run(tc.name+"/json after the wrapped tool's own action", func(t *testing.T) {
@@ -113,9 +108,8 @@ func TestJSONFlagProxyCommandsForwardJSON(t *testing.T) {
 			args := append(append([]string{tc.name}, tc.args...), "--json")
 			stdout, stderr, err := runLstk(t, testContext(t), workDir, environ, args...)
 			require.Error(t, err)
-			combined := stdout + stderr
-			require.Contains(t, combined, "not found in PATH", "--json should have been forwarded to the wrapped tool, not rejected by lstk")
-			require.NotContains(t, combined, "is not able to provide output in JSON format")
+			snap.Match(t, sanitizeOutput(stdout))
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 	}
 }
@@ -137,10 +131,8 @@ func TestJSONFlagProxyCommandsRejectBeforeCommandName(t *testing.T) {
 			args := append([]string{"--json", tc.name}, tc.args...)
 			stdout, stderr, err := runLstk(t, testContext(t), workDir, environ, args...)
 			requireExitCode(t, 1, err)
-			envelope := decodeEnvelope(t, stdout)
-			assert.Equal(t, tc.name, envelope.Command)
-			require.NotNil(t, envelope.Error)
-			assert.Equal(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
+			decodeEnvelope(t, stdout)
+			snap.MatchJSON(t, []byte(stdout))
 			assert.Empty(t, stderr, "the rejection is rendered as JSON on stdout, not plain text on stderr")
 		})
 	}
@@ -158,29 +150,27 @@ func TestJSONFlagBeforeCommandNameBooleanValues(t *testing.T) {
 		t.Parallel()
 		stdout, _, err := runLstk(t, testContext(t), t.TempDir(), env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).WithHome(t.TempDir()), "--json=true", "aws", "s3", "ls")
 		requireExitCode(t, 1, err)
-		envelope := decodeEnvelope(t, stdout)
-		assert.Equal(t, "aws", envelope.Command)
-		require.NotNil(t, envelope.Error)
-		assert.Equal(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
+		decodeEnvelope(t, stdout)
+		snap.MatchJSON(t, []byte(stdout))
 	})
 
 	t.Run("--json=false before the command name is not rejected", func(t *testing.T) {
 		t.Parallel()
 		stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).WithHome(t.TempDir()), "--json=false", "aws", "s3", "ls")
 		require.Error(t, err)
-		combined := stdout + stderr
-		require.Contains(t, combined, "not found in PATH", "the wrapped tool should have run (and failed for its own, unrelated reason)")
-		require.NotContains(t, combined, "is not able to provide output in JSON format")
+		// The snapshots pin the wrapped tool's missing-binary error (proof the
+		// tool was invoked, i.e. --json=false was not rejected) with no
+		// NOT_JSON_CAPABLE envelope anywhere.
+		snap.Match(t, sanitizeOutput(stdout))
+		snap.Match(t, sanitizeOutput(stderr))
 	})
 
 	t.Run("a malformed value before the command name is rejected", func(t *testing.T) {
 		t.Parallel()
 		stdout, _, err := runLstk(t, testContext(t), t.TempDir(), env.With(env.DisableEvents, "1").With("PATH", t.TempDir()).WithHome(t.TempDir()), "--json=notabool", "aws", "s3", "ls")
 		requireExitCode(t, 1, err)
-		envelope := decodeEnvelope(t, stdout)
-		assert.Equal(t, "aws", envelope.Command)
-		require.NotNil(t, envelope.Error)
-		assert.Equal(t, "NOT_JSON_CAPABLE", envelope.Error.Code)
+		decodeEnvelope(t, stdout)
+		snap.MatchJSON(t, []byte(stdout))
 	})
 }
 
@@ -193,10 +183,9 @@ func TestExtensionReceivesJSONFlagInContext(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), environ, "--json", "hello", "--foo")
 	require.NoError(t, err, stderr)
-	require.Contains(t, stdout, "ARGS=[--foo]", "--json is consumed by lstk and conveyed via env, not forwarded")
-	require.Contains(t, stdout, "JSON=true")
-	// --json forces non-interactive rendering, so the extension sees that too.
-	require.Contains(t, stdout, "NON_INTERACTIVE=true")
+	// --json is consumed by lstk and conveyed via env, not forwarded; it also
+	// forces non-interactive rendering, so the extension sees that too.
+	snap.Match(t, sanitizeOutput(stdout))
 
 	stdoutDefault, stderrDefault, errDefault := runLstk(t, testContext(t), t.TempDir(), environ, "hello", "--foo")
 	require.NoError(t, errDefault, stderrDefault)
diff --git a/test/integration/license_test.go b/test/integration/license_test.go
index b47cb6a3..dffacfd3 100644
--- a/test/integration/license_test.go
+++ b/test/integration/license_test.go
@@ -93,6 +93,8 @@ func TestLicenseValidationFailure(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.APIEndpoint, mockServer.URL).With(env.AuthToken, "test-token-for-license-validation"), "start")
 	require.Error(t, err, "expected lstk start to fail with forbidden license")
 	requireExitCode(t, 1, err)
+	// Not a snapshot: the output embeds pull-progress lines that depend on
+	// the runner's image cache and the live emulator image version.
 	assert.Contains(t, stdout, "License validation failed")
 	assert.Contains(t, stdout, "invalid, inactive, or expired")
 	assert.Contains(t, stdout, "lstk logout", "the error should point at re-authentication")
diff --git a/test/integration/logout_test.go b/test/integration/logout_test.go
index 2fde824f..c6218487 100644
--- a/test/integration/logout_test.go
+++ b/test/integration/logout_test.go
@@ -6,6 +6,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
 	"github.com/stretchr/testify/assert"
@@ -39,7 +40,7 @@ func TestLogoutCommandSucceedsWhenNoToken(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), "", env.Without(env.AuthToken).With(env.AnalyticsEndpoint, analyticsSrv.URL), "logout")
 	require.NoError(t, err, "lstk logout should succeed even with no token: %s", stderr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, stdout, "Not currently logged in")
+	snap.Match(t, sanitizeOutput(stdout))
 	assertCommandTelemetry(t, events, "logout", 0)
 }
 
diff --git a/test/integration/logs_test.go b/test/integration/logs_test.go
index 6f40d04e..c2f296c4 100644
--- a/test/integration/logs_test.go
+++ b/test/integration/logs_test.go
@@ -12,6 +12,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
 	"github.com/stretchr/testify/assert"
@@ -212,8 +213,7 @@ func TestLogsTailRejectsInvalidValue(t *testing.T) {
 	_, stderr, err := runLstk(t, testContext(t), "", env.Without(), "--config", configFile, "logs", "--tail", "bogus")
 	require.Error(t, err, "expected lstk logs --tail bogus to fail")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "bogus", "error should name the invalid value")
-	assert.Contains(t, stderr, "--tail", "error should name the flag")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestLogsTailWithFollowStartsFromTail(t *testing.T) {
diff --git a/test/integration/main_test.go b/test/integration/main_test.go
index 9a054733..f8b41d36 100644
--- a/test/integration/main_test.go
+++ b/test/integration/main_test.go
@@ -106,6 +106,12 @@ func TestMain(m *testing.M) {
 		}
 	}
 
+	// snap.Clean is deliberately NOT wired here (unlike unit-test packages):
+	// it treats unvisited snapshots as obsolete, but this package skips whole
+	// test groups per platform (Docker on Windows CI, PTY/sh fakes on Windows,
+	// TLS trust on non-Linux), so a full run on any one OS never visits the
+	// other platforms' snapshots — Clean would flag them (or delete them under
+	// UPDATE_SNAPS=true). Stale snapshots here are caught by review instead.
 	m.Run()
 }
 
diff --git a/test/integration/sam_cmd_test.go b/test/integration/sam_cmd_test.go
index d184f5d0..6cd65b46 100644
--- a/test/integration/sam_cmd_test.go
+++ b/test/integration/sam_cmd_test.go
@@ -4,6 +4,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -50,7 +51,7 @@ func TestSAMForwardsArgs(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ARGS:build")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // propagates the sam exit code.
@@ -61,7 +62,7 @@ func TestSAMPropagatesExitCode(t *testing.T) {
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
 	require.Error(t, err)
-	assert.Contains(t, stderr, "simulated failure")
+	snap.Match(t, sanitizeOutput(stderr))
 	requireExitCode(t, 7, err)
 }
 
@@ -80,20 +81,11 @@ func TestSAMInjectsCleanAWSEnv(t *testing.T) {
 		"sam", "--region", "eu-west-1", "--account", "111111111111", "build")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	assert.Contains(t, stdout, "ENV_AWS_ENDPOINT_URL=http")
-	assert.Contains(t, stdout, ":4566")
-	// SAM reads AWS_DEFAULT_REGION; lstk sets both region vars.
-	assert.Contains(t, stdout, "ENV_AWS_REGION=eu-west-1")
-	assert.Contains(t, stdout, "ENV_AWS_DEFAULT_REGION=eu-west-1")
-	// A custom --account flows through to AWS_ACCESS_KEY_ID (Terraform model).
-	assert.Contains(t, stdout, "ENV_AWS_ACCESS_KEY_ID=111111111111")
-	assert.Contains(t, stdout, "ENV_AWS_SECRET_ACCESS_KEY=test")
-	// lstk never sets an S3-specific endpoint for SAM.
-	assert.Contains(t, stdout, "ENV_AWS_ENDPOINT_URL_S3=<unset>")
-	// Ambient AWS config is stripped.
-	assert.Contains(t, stdout, "ENV_AWS_PROFILE=<unset>")
-	assert.Contains(t, stdout, "ENV_AWS_DEFAULT_PROFILE=<unset>")
-	assert.Contains(t, stdout, "ENV_AWS_SESSION_TOKEN=<unset>")
+	// The snapshot pins the full env contract: endpoint scheme+port (host is
+	// DNS-dependent, masked), both region vars, --account in the access key
+	// (Terraform model), no S3-specific endpoint, and ambient AWS config
+	// (profile/session token) stripped to <unset>.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // offline subcommands run without a running emulator, even with a leading
@@ -111,8 +103,9 @@ func TestSAMOfflineCommandsNoEmulator(t *testing.T) {
 				"sam", "--region", "us-west-2", sub)
 			require.NoError(t, err, "stderr: %s", stderr)
 
-			assert.Contains(t, stdout, "ARGS:"+sub)
-			assert.NotContains(t, stdout, "--region")
+			// The snapshot pins the forwarded args: the leading --region must
+			// be stripped, not forwarded to sam.
+			snap.Match(t, sanitizeOutput(stdout))
 		})
 	}
 }
@@ -131,7 +124,7 @@ func TestSAMHelpNoEmulator(t *testing.T) {
 			cmdArgs := append([]string{"sam"}, args...)
 			stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, cmdArgs...)
 			require.NoError(t, err, "stderr: %s", stderr)
-			assert.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
+			snap.Match(t, sanitizeOutput(stdout))
 		})
 	}
 }
@@ -144,9 +137,10 @@ func TestSAMVersionTooOld(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
 	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "1.95.0")
-	// sam was never run for real.
-	assert.NotContains(t, stdout, "ARGS:build")
+	// The snapshots pin the full version error; sam was never run for real
+	// (no ARGS line in either stream).
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // a missing sam binary yields the install error.
@@ -156,7 +150,8 @@ func TestSAMMissingBinary(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
 	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "not found in PATH")
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // --account is supported for sam (unlike cdk): a valid 12-digit value is
@@ -169,7 +164,7 @@ func TestSAMAccountSupported(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"sam", "--account", "123456789012", "build")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ENV_AWS_ACCESS_KEY_ID=123456789012")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // an invalid --account value is rejected at the command boundary before sam runs.
@@ -181,8 +176,9 @@ func TestSAMInvalidAccountRejected(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"sam", "--account", "12345", "build")
 	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "12-digit")
-	assert.NotContains(t, stdout, "ARGS:build")
+	// The snapshots pin the rejection; sam was never run (no ARGS line).
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // flags after the subcommand are forwarded to sam unchanged.
@@ -194,7 +190,7 @@ func TestSAMFlagsAfterActionAreForwarded(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"sam", "build", "--region", "us-west-2")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ARGS:build --region us-west-2")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // a flag before the subcommand is rejected with a clear message.
@@ -206,7 +202,8 @@ func TestSAMFlagBeforeSubcommandRejected(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--account", "111111111111", "sam", "build")
 	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "must appear after the sam subcommand")
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // LSTK_SAM_CMD selects the binary to invoke.
@@ -221,7 +218,7 @@ func TestSAMHonorsLstkSamCmd(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "sam", "build")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "MYSAM:build")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // an AWS-contacting command with no running emulator fails with "not running"
@@ -278,9 +275,9 @@ func TestSAMPutsSelectedRegionOnTheCommandLine(t *testing.T) {
 		"--endpoint-url", srv.URL, "sam", "--region", "ap-northeast-1", "--account", "121212122323", "deploy")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	assert.Contains(t, stdout, "--region ap-northeast-1", "the region must be on sam's command line")
-	assert.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
-	assert.Contains(t, stdout, "ENV_AWS_ACCESS_KEY_ID=121212122323")
+	// The snapshot pins the ARGS line (region on sam's command line) and the
+	// env (region and account).
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // Without lstk's --region there is nothing to assert over samconfig.toml, so
@@ -296,9 +293,9 @@ func TestSAMDoesNotInjectRegionWhenNotSelected(t *testing.T) {
 		"--endpoint-url", srv.URL, "sam", "deploy")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	assert.NotContains(t, stdout, "--region")
-	// The environment still carries the default, as before.
-	assert.Contains(t, stdout, "ENV_AWS_REGION=us-east-1")
+	// The snapshot pins the bare ARGS line (no --region injected) while the
+	// environment still carries the default, as before.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // An ambient AWS_REGION is used but is not a selection: it is commonly exported
@@ -314,8 +311,9 @@ func TestSAMDoesNotInjectAmbientRegion(t *testing.T) {
 		"--endpoint-url", srv.URL, "sam", "deploy")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	assert.NotContains(t, stdout, "--region")
-	assert.Contains(t, stdout, "ENV_AWS_REGION=eu-west-1")
+	// The snapshot pins the bare ARGS line (no --region injected) with the
+	// ambient region still in the environment.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // Offline subcommands never get the flag: `init` and `docs` reject --region
@@ -329,9 +327,9 @@ func TestSAMDoesNotInjectRegionForOfflineSubcommand(t *testing.T) {
 		"sam", "--region", "ap-northeast-1", "build")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	assert.Contains(t, stdout, "ARGS:build")
-	assert.NotContains(t, stdout, "--region")
-	assert.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
+	// The snapshot pins the bare ARGS line (no --region forwarded or injected)
+	// with the selected region still in the environment.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // A --region the user addressed to sam directly wins: appending lstk's after it
@@ -346,9 +344,8 @@ func TestSAMLeavesUserSuppliedRegionFlagAlone(t *testing.T) {
 		"--endpoint-url", srv.URL, "sam", "--region", "ap-northeast-1", "deploy", "--region", "us-west-1")
 	require.NoError(t, err, "stderr: %s", stderr)
 
-	// Pinned to the whole ARGS line: lstk must not append a second --region.
-	assert.Contains(t, stdout, "ARGS:deploy --region us-west-1\n")
-	// The environment still carries lstk's resolved region, as it always has;
-	// sam's own command-line flag is what outranks it.
-	assert.Contains(t, stdout, "ENV_AWS_REGION=ap-northeast-1")
+	// The snapshot pins the whole ARGS line (lstk must not append a second
+	// --region) and the environment, which still carries lstk's resolved
+	// region as it always has; sam's own command-line flag is what outranks it.
+	snap.Match(t, sanitizeOutput(stdout))
 }
diff --git a/test/integration/sam_e2e_test.go b/test/integration/sam_e2e_test.go
index 8ecefe46..befab4b4 100644
--- a/test/integration/sam_e2e_test.go
+++ b/test/integration/sam_e2e_test.go
@@ -6,6 +6,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"testing"
+	"time"
 
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
@@ -59,7 +60,11 @@ func samE2EEnv(t *testing.T) env.Environ {
 func TestSAME2EValidateOffline(t *testing.T) {
 	requireSAM(t)
 
-	ctx := testContext(t)
+	// Not testContext: the frozen-Python sam CLI plus --lint's cfn-lint init
+	// can exceed 2 minutes on a cold Windows runner, and the context expiring
+	// kills a sam that already printed a successful validation.
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	t.Cleanup(cancel)
 	work := copySAMSample(t, "hello")
 	e := samE2EEnv(t)
 
diff --git a/test/integration/setup_azure_test.go b/test/integration/setup_azure_test.go
index cbc73ed1..bf588414 100644
--- a/test/integration/setup_azure_test.go
+++ b/test/integration/setup_azure_test.go
@@ -4,9 +4,9 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -69,8 +69,7 @@ func TestAzCommandErrorsWhenNotSetUp(t *testing.T) {
 	)
 	require.Error(t, err)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Azure CLI integration is not set up")
-	assert.Contains(t, stdout, "lstk setup azure")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // Non-interactive mode must not be rejected upfront (CI use case): with no
@@ -84,8 +83,7 @@ func TestSetupAzureNonInteractiveRunsWithoutTerminal(t *testing.T) {
 		"setup", "azure",
 	)
 	require.Error(t, err)
-	assert.Contains(t, stderr, "no azure emulator configured")
-	assert.NotContains(t, stderr, "interactive terminal")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // `lstk setup az` must resolve to `setup azure`: the Azure tool-proxy command
@@ -100,8 +98,7 @@ func TestSetupAzureAliasAz(t *testing.T) {
 		"setup", "az",
 	)
 	require.Error(t, err)
-	assert.NotContains(t, stderr, "unknown command")
-	assert.Contains(t, stderr, "no azure emulator configured")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // When the az CLI is missing, the error must be reported exactly once —
@@ -115,10 +112,8 @@ func TestSetupAzureReportsMissingAzCLIOnce(t *testing.T) {
 		"setup", "azure",
 	)
 	require.Error(t, err)
-	assert.Contains(t, stderr, "az CLI not found in PATH")
-	combined := stdout + stderr
-	assert.Equal(t, 1, strings.Count(combined, "az CLI not found in PATH"),
-		"missing az CLI must be reported exactly once, got:\n%s", combined)
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestAzCommandErrorsWhenEmulatorNotRunning(t *testing.T) {
diff --git a/test/integration/snap_sanitize_test.go b/test/integration/snap_sanitize_test.go
new file mode 100644
index 00000000..02114020
--- /dev/null
+++ b/test/integration/snap_sanitize_test.go
@@ -0,0 +1,84 @@
+package integration_test
+
+import (
+	"regexp"
+	"strings"
+)
+
+// snap.Match has no masking hook (snap.MatchJSON's dotted paths are JSON
+// only), so CLI output is passed through sanitizeOutput before snapshotting.
+// Patterns are anchored on stable context (label, host, filename prefix)
+// rather than value-shaped: Go's RE2 has no lookahead, and a bare
+// number/semver pattern would corrupt neighbouring text such as IPv4
+// addresses. Add a rule here when a new volatile value shows up in
+// snapshot output.
+var (
+	// httptest servers listen on a random localhost port.
+	sanitizePortRe = regexp.MustCompile(`(https?://127\.0\.0\.1):\d+`)
+	// Release asset names embed the host platform (lstk_0.0.2_darwin_arm64.tar.gz).
+	sanitizeAssetRe = regexp.MustCompile(`\blstk_([^_\s]+)_[a-z0-9]+_[a-z0-9]+(\.tar\.gz|\.zip)`)
+	// Rendered instance info lines with per-run values.
+	sanitizeVersionRe = regexp.MustCompile(`(Version: )\S+`)
+	sanitizeUptimeRe  = regexp.MustCompile(`(?m)(Uptime: ).+$`)
+	// The emulator endpoint host depends on whether localhost.localstack.cloud
+	// resolves in the environment; scheme and port stay pinned.
+	sanitizeEndpointHostRe = regexp.MustCompile(`(ENV_AWS_ENDPOINT_URL(?:_S3)?=https?://)[^:\s]+`)
+	// Any URL pointing at the default gateway port (terraform override
+	// endpoints, rendered endpoint lines) — anchored on :4566 so it can't
+	// touch unrelated URLs. Like sanitizeSizeRe below, this mask is
+	// shape-anchored across the whole stream: a test that needs to assert a
+	// specific host on :4566 (or a specific size) can't — narrow the anchor
+	// if that case ever appears.
+	sanitizeGatewayHostRe = regexp.MustCompile(`(https?://)[^:"\s]+(:4566)`)
+	// Rendered snapshot metadata: timestamps ("2026-04-15 14:32 UTC"),
+	// human-readable sizes ("47.3 MB"), and LocalStack calendar versions
+	// ("2026.03"). Fixture-driven today, but masked so fixture tweaks don't
+	// churn snapshots.
+	sanitizeDateRe   = regexp.MustCompile(`\d{4}-\d{2}-\d{2} \d{2}:\d{2} UTC`)
+	sanitizeSizeRe   = regexp.MustCompile(`\b\d+(?:\.\d+)? (?:B|KB|MB|GB)\b`)
+	sanitizeCalverRe = regexp.MustCompile(`\b20\d{2}\.\d{2}\b`)
+	// Reference-extension echo lines carrying temp paths or random ids.
+	sanitizeExtPathRe = regexp.MustCompile(`(?m)^(SELF=|CONFIG_DIR=).*$`)
+	// MACHINE_ID's value is environment-dependent twice over: its origin
+	// prefix (dkr_/sys_/gen_) depends on whether Docker or /etc/machine-id is
+	// available on the host, and the rest is a host-derived hash or random id.
+	sanitizeExtIDRe = regexp.MustCompile(`(?m)^((?:SESSION|MACHINE)_ID=).*$`)
+	// Defense in depth: a real auth token must never land in a committed
+	// snapshot or a failure diff, even if a test forgets to strip it.
+	sanitizeExtTokenRe = regexp.MustCompile(`(?m)^(AUTH_TOKEN=).*$`)
+)
+
+// maskKeepWidth replaces every match with placeholder, right-padded with
+// spaces to the match's width so table column alignment survives. The
+// placeholder must not be wider than the shortest possible match.
+func maskKeepWidth(re *regexp.Regexp, s, placeholder string) string {
+	return re.ReplaceAllStringFunc(s, func(m string) string {
+		if pad := len(m) - len(placeholder); pad > 0 {
+			return placeholder + strings.Repeat(" ", pad)
+		}
+		return placeholder
+	})
+}
+
+func sanitizeOutput(s string) string {
+	s = strings.ReplaceAll(s, "\r\n", "\n")
+	s = sanitizePortRe.ReplaceAllString(s, "${1}:<port>")
+	s = sanitizeAssetRe.ReplaceAllString(s, "lstk_${1}_<platform>${2}")
+	s = sanitizeVersionRe.ReplaceAllString(s, "${1}<version>")
+	s = sanitizeUptimeRe.ReplaceAllString(s, "${1}<time>")
+	s = sanitizeEndpointHostRe.ReplaceAllString(s, "${1}<host>")
+	s = sanitizeGatewayHostRe.ReplaceAllString(s, "${1}<endpoint-host>${2}")
+	s = sanitizeExtPathRe.ReplaceAllString(s, "${1}<path>")
+	s = sanitizeExtIDRe.ReplaceAllString(s, "${1}<id>")
+	s = sanitizeExtTokenRe.ReplaceAllString(s, "${1}<redacted>")
+	// Width-preserving masks: these values appear in aligned tables, so the
+	// placeholder is padded to the original value's width to keep the
+	// snapshot's columns readable.
+	s = maskKeepWidth(sanitizeDateRe, s, "<date>")
+	s = maskKeepWidth(sanitizeSizeRe, s, "<size>")
+	s = maskKeepWidth(sanitizeCalverRe, s, "<calv>")
+	// Wrapped-tool env dumps echo GOOS-dependent endpoint hosts.
+	s = strings.ReplaceAll(s, "host.docker.internal", "<endpoint-host>")
+	s = strings.ReplaceAll(s, "localhost.localstack.cloud", "<endpoint-host>")
+	return s
+}
diff --git a/test/integration/snapshot_list_test.go b/test/integration/snapshot_list_test.go
index b618248e..aeb18d85 100644
--- a/test/integration/snapshot_list_test.go
+++ b/test/integration/snapshot_list_test.go
@@ -5,10 +5,10 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
-	"strings"
 	"sync"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -82,14 +82,7 @@ func TestSnapshotListSuccessWithoutDocker(t *testing.T) {
 	called, creator, _ := cap.get()
 	require.True(t, called, "the platform list endpoint should have been called")
 	assert.Equal(t, "me", creator, "default list should send ?creator=me")
-	assert.Contains(t, stdout, "~ 2 snapshots")
-	assert.Contains(t, stdout, "~ 2 snapshots\n\n  NAME")
-	assert.Contains(t, stdout, "NAME")
-	assert.Contains(t, stdout, "VERSION")
-	assert.Contains(t, stdout, "LAST CHANGED")
-	assert.Contains(t, stdout, "baseline-q2")
-	assert.Contains(t, stdout, "infra-2026-04")
-	assert.Contains(t, stdout, "3")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotListAllFlag(t *testing.T) {
@@ -108,8 +101,7 @@ func TestSnapshotListAllFlag(t *testing.T) {
 	called, creator, _ := cap.get()
 	require.True(t, called, "the platform list endpoint should have been called")
 	assert.Equal(t, "", creator, "--all should omit the ?creator param")
-	assert.Contains(t, stdout, "~ 1 snapshot")
-	assert.Contains(t, stdout, "org-pod")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotListEmpty(t *testing.T) {
@@ -122,7 +114,7 @@ func TestSnapshotListEmpty(t *testing.T) {
 		"--non-interactive", "snapshot", "list",
 	)
 	require.NoError(t, err, "lstk snapshot list failed: %s", stderr)
-	assert.Contains(t, stdout, "No snapshots found")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotListSendsBasicAuthHeader(t *testing.T) {
@@ -159,8 +151,7 @@ func TestSnapshotListRequiresAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "list",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Authentication required")
-	assert.Contains(t, stdout, "lstk login")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotListServerError(t *testing.T) {
@@ -179,7 +170,7 @@ func TestSnapshotListServerError(t *testing.T) {
 		"--non-interactive", "snapshot", "list",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, strings.ToLower(stderr), "error")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotListInteractive(t *testing.T) {
diff --git a/test/integration/snapshot_load_test.go b/test/integration/snapshot_load_test.go
index c954fb28..54c4650d 100644
--- a/test/integration/snapshot_load_test.go
+++ b/test/integration/snapshot_load_test.go
@@ -9,6 +9,7 @@ import (
 	"sync/atomic"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -157,7 +158,7 @@ func TestSnapshotLoadRemoteRejected(t *testing.T) {
 				"--non-interactive", "snapshot", "load", ref,
 			)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "not yet supported")
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 	}
 }
@@ -172,7 +173,7 @@ func TestSnapshotLoadS3RequiresPodName(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "s3://bucket/key",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "pod name is required")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotLoadPodNoAuthToken(t *testing.T) {
@@ -184,7 +185,7 @@ func TestSnapshotLoadPodNoAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "authentication")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotLoadPodInvalidName(t *testing.T) {
@@ -198,7 +199,7 @@ func TestSnapshotLoadPodInvalidName(t *testing.T) {
 				"--non-interactive", "snapshot", "load", ref,
 			)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "invalid pod name")
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 	}
 }
@@ -493,7 +494,7 @@ func TestSnapshotLoadDryRunOnLocalRef(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "--dry-run", snapPath,
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "pod refs")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotLoadDryRunPodNoAuthToken(t *testing.T) {
@@ -505,7 +506,7 @@ func TestSnapshotLoadDryRunPodNoAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "--dry-run", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "authentication")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotLoadDryRunPodSuccess(t *testing.T) {
diff --git a/test/integration/snapshot_load_version_test.go b/test/integration/snapshot_load_version_test.go
index a6d77b58..352e5323 100644
--- a/test/integration/snapshot_load_version_test.go
+++ b/test/integration/snapshot_load_version_test.go
@@ -7,6 +7,7 @@ import (
 	"sync"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -100,7 +101,8 @@ func TestSnapshotLoadPodVersionReachesWire(t *testing.T) {
 	assert.Equal(t, "3", query.Get("version"))
 	assert.Equal(t, "account-region-merge", query.Get("merge"), "the default merge strategy still applies")
 
-	assert.Contains(t, stdout, "pod:my-baseline:3", "the loaded source should name the pinned version")
+	// The snapshot pins that the loaded source names the pinned version.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestSnapshotLoadPodWithoutVersionOmitsParam: an unpinned ref must not send
@@ -120,8 +122,8 @@ func TestSnapshotLoadPodWithoutVersionOmitsParam(t *testing.T) {
 	require.True(t, called, "the pod load endpoint should have been called")
 	assert.False(t, query.Has("version"), "an unpinned load must not send a version parameter")
 
-	assert.Contains(t, stdout, "pod:my-baseline")
-	assert.NotContains(t, stdout, "pod:my-baseline:")
+	// The snapshot pins that no version suffix is rendered for an unpinned ref.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestLoadAliasAcceptsPodVersion: the root `lstk load` alias shares the REF
@@ -160,8 +162,7 @@ func TestSnapshotLoadPodVersionDryRun(t *testing.T) {
 	assert.Equal(t, "/_localstack/pods/my-baseline/diff", path)
 	assert.Equal(t, "3", query.Get("version"))
 
-	assert.Contains(t, stdout, "Dry-run results for pod:my-baseline:3")
-	assert.Contains(t, stdout, "No state was modified")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestSnapshotLoadPodVersionNotFound: the emulator's own message already names
@@ -182,8 +183,7 @@ func TestSnapshotLoadPodVersionNotFound(t *testing.T) {
 	_, _, query := cap.get()
 	assert.Equal(t, "99", query.Get("version"))
 
-	assert.Contains(t, stdout, "maximum version available in the remote storage is 3")
-	assert.Contains(t, stdout, "lstk snapshot versions pod:my-baseline")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestSnapshotLoadRejectsMalformedVersion: a colon in a ref is unambiguously a
@@ -205,8 +205,7 @@ func TestSnapshotLoadRejectsMalformedVersion(t *testing.T) {
 				"--non-interactive", "--endpoint-url", srv.URL, "snapshot", "load", ref,
 			)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "invalid version")
-			assert.NotContains(t, stderr, "invalid pod name")
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 	}
 }
@@ -221,7 +220,7 @@ func TestSnapshotLoadS3RejectsPodVersion(t *testing.T) {
 		"--non-interactive", "snapshot", "load", "my-pod:3", "s3://bucket/prefix",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "S3 remotes do not support snapshot versions")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // TestSnapshotSaveRejectsPodVersion: the platform assigns a version on every
@@ -235,8 +234,7 @@ func TestSnapshotSaveRejectsPodVersion(t *testing.T) {
 			"--non-interactive", "snapshot", "save", "pod:my-baseline:3",
 		)
 		requireExitCode(t, 1, err)
-		assert.Contains(t, stderr, "the platform assigns the version on each save")
-		assert.NotContains(t, stderr, "invalid pod name")
+		snap.Match(t, sanitizeOutput(stderr))
 	})
 
 	t.Run("s3 remote", func(t *testing.T) {
@@ -245,7 +243,7 @@ func TestSnapshotSaveRejectsPodVersion(t *testing.T) {
 			"--non-interactive", "snapshot", "save", "my-pod:3", "s3://bucket/prefix",
 		)
 		requireExitCode(t, 1, err)
-		assert.Contains(t, stderr, "S3 remotes do not support snapshot versions")
+		snap.Match(t, sanitizeOutput(stderr))
 	})
 }
 
@@ -259,7 +257,7 @@ func TestSnapshotRemoveRejectsPodVersion(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-baseline:3", "--force",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "drop the ':3'")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // TestStartSnapshotFlagAcceptsPodVersion: --snapshot goes through the same REF
@@ -272,5 +270,5 @@ func TestStartSnapshotFlagAcceptsPodVersion(t *testing.T) {
 		"--non-interactive", "start", "--snapshot", "pod:my-baseline:abc",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "invalid version")
+	snap.Match(t, sanitizeOutput(stderr))
 }
diff --git a/test/integration/snapshot_remove_test.go b/test/integration/snapshot_remove_test.go
index e6469f36..5f050912 100644
--- a/test/integration/snapshot_remove_test.go
+++ b/test/integration/snapshot_remove_test.go
@@ -7,6 +7,7 @@ import (
 	"sync/atomic"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -41,8 +42,7 @@ func TestSnapshotRemoveLocalRefRejected(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "./my-baseline.zip",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "resolves to a local file")
-	assert.Contains(t, stderr, "CLI cannot delete local files")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotRemoveLocalBareNameRejected(t *testing.T) {
@@ -54,8 +54,7 @@ func TestSnapshotRemoveLocalBareNameRejected(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "resolves to a local file")
-	assert.Contains(t, stderr, "CLI cannot delete local files")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotRemovePodNoAuthToken(t *testing.T) {
@@ -67,7 +66,7 @@ func TestSnapshotRemovePodNoAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-baseline", "--force",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "authentication")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotRemovePodInvalidName(t *testing.T) {
@@ -82,7 +81,7 @@ func TestSnapshotRemovePodInvalidName(t *testing.T) {
 				"--non-interactive", "snapshot", "remove", ref,
 			)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "invalid pod name")
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 	}
 }
@@ -96,7 +95,7 @@ func TestSnapshotRemoveNonInteractiveRequiresForce(t *testing.T) {
 		"--non-interactive", "snapshot", "remove", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "--force")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotRemoteSchemeRejected(t *testing.T) {
@@ -111,7 +110,7 @@ func TestSnapshotRemoteSchemeRejected(t *testing.T) {
 				"--non-interactive", "snapshot", "remove", ref,
 			)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "not yet supported")
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 	}
 }
diff --git a/test/integration/snapshot_save_test.go b/test/integration/snapshot_save_test.go
index 77975785..2b539c3c 100644
--- a/test/integration/snapshot_save_test.go
+++ b/test/integration/snapshot_save_test.go
@@ -14,6 +14,7 @@ import (
 	"sync"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -232,7 +233,7 @@ func TestSnapshotSaveRemoteRejected(t *testing.T) {
 
 			_, stderr, err := runLstk(t, ctx, t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--non-interactive", "snapshot", "save", dest)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "not yet supported")
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 	}
 }
@@ -248,7 +249,7 @@ func TestSnapshotSaveS3MissingCredentials(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "my-pod", "s3://my-bucket/prefix",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "AWS credentials required")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotSaveS3CredentialsInURLRejected(t *testing.T) {
@@ -262,7 +263,7 @@ func TestSnapshotSaveS3CredentialsInURLRejected(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "my-pod", "s3://my-bucket/prefix?access_key_id=AKIA&secret_access_key=secret",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "do not put credentials")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // mockPodS3Server handles the remote registration plus pod save against an S3
@@ -413,7 +414,7 @@ func TestSnapshotSavePodNoAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "save", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "authentication")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotSavePodInvalidName(t *testing.T) {
@@ -429,7 +430,7 @@ func TestSnapshotSavePodInvalidName(t *testing.T) {
 
 			_, stderr, err := runLstk(t, ctx, t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--non-interactive", "snapshot", "save", dest)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "invalid pod name")
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 	}
 }
@@ -559,7 +560,7 @@ func TestSnapshotSavePodServicesInvalidFormat(t *testing.T) {
 				"--non-interactive", "snapshot", "save", "pod:my-baseline", "--services", value,
 			)
 			requireExitCode(t, 1, err)
-			assert.Contains(t, stderr, "comma-separated list of service names")
+			snap.Match(t, sanitizeOutput(stderr))
 		})
 	}
 }
diff --git a/test/integration/snapshot_show_test.go b/test/integration/snapshot_show_test.go
index d51e04e5..3aff106b 100644
--- a/test/integration/snapshot_show_test.go
+++ b/test/integration/snapshot_show_test.go
@@ -4,10 +4,10 @@ import (
 	"encoding/base64"
 	"net/http"
 	"net/http/httptest"
-	"strings"
 	"sync"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -83,15 +83,7 @@ func TestSnapshotShowSuccessWithoutDocker(t *testing.T) {
 	require.True(t, called, "the single-pod endpoint should have been called")
 	assert.Equal(t, "/v1/cloudpods/my-baseline", path)
 
-	assert.Contains(t, stdout, "my-baseline")
-	assert.Contains(t, stdout, "2026-04-15 14:32 UTC")
-	assert.Contains(t, stdout, "47.3 MB")
-	assert.Contains(t, stdout, "2026.03")
-	assert.Contains(t, stdout, "Pre-refactor baseline")
-	assert.Contains(t, stdout, "s3, lambda, dynamodb, sqs")
-	assert.Contains(t, stdout, "Resources")
-	assert.Contains(t, stdout, "3 buckets")
-	assert.Contains(t, stdout, "1 function\n", "count of one should use the singular noun")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotShowWithoutResources(t *testing.T) {
@@ -106,8 +98,9 @@ func TestSnapshotShowWithoutResources(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "pod:bare",
 	)
 	require.NoError(t, err, "lstk snapshot show failed: %s", stderr)
-	assert.Contains(t, stdout, "s3, sqs")
-	assert.NotContains(t, stdout, "Resources", "Resources section must be omitted when no counts are available")
+	// The snapshot pins that the Resources section is omitted when no counts
+	// are available.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestSnapshotShowPodNameLeadingUnderscore covers a name the platform's
@@ -146,7 +139,7 @@ func TestSnapshotShowRejectsPodNameWithPeriod(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "pod:release.v1",
 	)
 	require.Error(t, err, "a dotted pod name must be rejected client-side")
-	assert.Contains(t, stderr, "invalid pod name")
+	snap.Match(t, sanitizeOutput(stderr))
 
 	called, _, _ := cap.get()
 	assert.False(t, called, "the platform endpoint must not be called for an invalid name")
@@ -183,7 +176,7 @@ func TestSnapshotShowRejectsLocalPath(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "./my-snapshot",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, strings.ToLower(stderr), "local")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotShowNotFound(t *testing.T) {
@@ -199,8 +192,7 @@ func TestSnapshotShowNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "pod:missing",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "not found")
-	assert.Contains(t, stdout, "lstk snapshot list")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotShowRequiresAuthToken(t *testing.T) {
@@ -221,6 +213,5 @@ func TestSnapshotShowRequiresAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Authentication required")
-	assert.Contains(t, stdout, "lstk login")
+	snap.Match(t, sanitizeOutput(stdout))
 }
diff --git a/test/integration/snapshot_versions_test.go b/test/integration/snapshot_versions_test.go
index b3f8a9f9..c32834a9 100644
--- a/test/integration/snapshot_versions_test.go
+++ b/test/integration/snapshot_versions_test.go
@@ -3,9 +3,9 @@ package integration_test
 import (
 	"net/http"
 	"net/http/httptest"
-	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -53,20 +53,9 @@ func TestSnapshotVersionsSuccessWithoutDocker(t *testing.T) {
 	require.True(t, called, "the single-pod endpoint should have been called")
 	assert.Equal(t, "/v1/cloudpods/my-baseline", path)
 
-	assert.Contains(t, stdout, "~ 3 versions")
-	for _, header := range []string{"VERSION", "CREATED", "LOCALSTACK", "SERVICES"} {
-		assert.Contains(t, stdout, header)
-	}
-	assert.NotContains(t, stdout, "DESCRIPTION", "the description column was dropped in favour of more service names")
-	assert.Contains(t, stdout, "2026-04-15 14:32 UTC")
-	assert.Contains(t, stdout, "s3, lambda")
-	assert.NotContains(t, stdout, "nightly baseline", "the description is no longer rendered")
-
-	// Newest first: version 3's row must precede version 1's.
-	assert.Less(t, strings.Index(stdout, "2026.06"), strings.Index(stdout, "2026.05"),
-		"versions should be listed newest first")
-	assert.Less(t, strings.Index(stdout, "2026.05"), strings.Index(stdout, "2026.04"),
-		"versions should be listed newest first")
+	// The snapshot pins column set (no DESCRIPTION), newest-first ordering,
+	// and that descriptions are no longer rendered.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestSnapshotVersionsFiltersDeletedVersions: the platform marks removed versions
@@ -88,10 +77,7 @@ func TestSnapshotVersionsFiltersDeletedVersions(t *testing.T) {
 	)
 	require.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
 
-	assert.Contains(t, stdout, "~ 2 versions", "the deleted version must not be counted")
-	assert.Contains(t, stdout, "keep-one")
-	assert.Contains(t, stdout, "keep-three")
-	assert.NotContains(t, stdout, "gone-two")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotVersionsSingleVersionUsesSingularNoun(t *testing.T) {
@@ -105,7 +91,7 @@ func TestSnapshotVersionsSingleVersionUsesSingularNoun(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:solo",
 	)
 	require.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
-	assert.Contains(t, stdout, "~ 1 version\n")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotVersionsEmptyHistory(t *testing.T) {
@@ -118,8 +104,8 @@ func TestSnapshotVersionsEmptyHistory(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:blank",
 	)
 	require.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
-	assert.Contains(t, stdout, "No versions found for 'pod:blank'")
-	assert.NotContains(t, stdout, "VERSION", "no table should be rendered")
+	// The snapshot pins that no table is rendered for an empty history.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestSnapshotVersionsNoDockerRequired proves the command reads the platform API
@@ -135,7 +121,7 @@ func TestSnapshotVersionsNoDockerRequired(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:my-baseline",
 	)
 	require.NoError(t, err, "lstk snapshot versions failed: %s", stderr)
-	assert.Contains(t, stdout, "~ 3 versions")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotVersionsRejectsLocalPath(t *testing.T) {
@@ -148,8 +134,7 @@ func TestSnapshotVersionsRejectsLocalPath(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "./my-snapshot",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, strings.ToLower(stderr), "local")
-	assert.Contains(t, stderr, "list versions of local snapshots")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // TestSnapshotVersionsRejectsS3Ref: S3 remotes are fully supported by
@@ -166,9 +151,7 @@ func TestSnapshotVersionsRejectsS3Ref(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "s3://bucket/prefix",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "only supported for Cloud Pods")
-	assert.Contains(t, stderr, "S3 remotes")
-	assert.NotContains(t, stderr, "coming soon")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // TestSnapshotVersionsOrasKeepsComingSoon: oras:// is unimplemented for every
@@ -184,7 +167,7 @@ func TestSnapshotVersionsOrasKeepsComingSoon(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "oras://registry/image",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "coming soon")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 // TestSnapshotShowPinnedVersion: show is read-only and the platform returns every
@@ -211,11 +194,9 @@ func TestSnapshotShowPinnedVersion(t *testing.T) {
 	)
 	require.NoError(t, err, "lstk snapshot show failed: %s", stderr)
 
-	assert.Contains(t, stdout, "the first one")
-	assert.Contains(t, stdout, "2026.04")
-	assert.Contains(t, stdout, "1.0 KB")
-	assert.NotContains(t, stdout, "the latest one", "the pinned version's metadata must win")
-	assert.NotContains(t, stdout, "2026.06")
+	// Snapshot of version 1's card: the pinned version's metadata must win
+	// over the latest version's.
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotShowVersionNotFound(t *testing.T) {
@@ -229,9 +210,7 @@ func TestSnapshotShowVersionNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "show", "pod:my-baseline:99",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Version 99 of 'pod:my-baseline' not found")
-	assert.Contains(t, stdout, "The highest available version is 3.")
-	assert.Contains(t, stdout, "lstk snapshot versions pod:my-baseline")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // TestSnapshotVersionsRejectsVersionSuffix: this command lists every version, so
@@ -246,7 +225,7 @@ func TestSnapshotVersionsRejectsVersionSuffix(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:my-baseline:3",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "drop the ':3'")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotVersionsRejectsInvalidPodName(t *testing.T) {
@@ -259,7 +238,7 @@ func TestSnapshotVersionsRejectsInvalidPodName(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:release.v1",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "invalid pod name")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestSnapshotVersionsNotFound(t *testing.T) {
@@ -275,8 +254,7 @@ func TestSnapshotVersionsNotFound(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:missing",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "not found")
-	assert.Contains(t, stdout, "lstk snapshot list")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestSnapshotVersionsRequiresAuthToken(t *testing.T) {
@@ -291,6 +269,5 @@ func TestSnapshotVersionsRequiresAuthToken(t *testing.T) {
 		"--non-interactive", "snapshot", "versions", "pod:my-baseline",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "Authentication required")
-	assert.Contains(t, stdout, "lstk login")
+	snap.Match(t, sanitizeOutput(stdout))
 }
diff --git a/test/integration/start_snapshot_test.go b/test/integration/start_snapshot_test.go
index 26bc6986..09be82b9 100644
--- a/test/integration/start_snapshot_test.go
+++ b/test/integration/start_snapshot_test.go
@@ -5,6 +5,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -21,7 +22,7 @@ func TestStartSnapshotConflictingFlags(t *testing.T) {
 		"--non-interactive", "start", "--snapshot", "pod:my-baseline", "--no-snapshot",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "cannot be used together")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestStartSnapshotInvalidPodName(t *testing.T) {
@@ -33,7 +34,7 @@ func TestStartSnapshotInvalidPodName(t *testing.T) {
 		"--non-interactive", "start", "--snapshot", "pod:bad.name",
 	)
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stderr, "invalid pod name")
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestStartSnapshotLocalFileNotFound(t *testing.T) {
diff --git a/test/integration/start_test.go b/test/integration/start_test.go
index 49ea60d4..488b1f80 100644
--- a/test/integration/start_test.go
+++ b/test/integration/start_test.go
@@ -18,6 +18,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/api/types/network"
 	"github.com/moby/moby/client"
@@ -803,7 +804,7 @@ expose_ports = ["53/sctp"]
 
 	_, stderr, err := runLstk(t, testContext(t), "", testEnvWithHome(t.TempDir(), ""), "--config", configFile, "status")
 	require.Error(t, err)
-	assert.Contains(t, stderr, `protocol must be "tcp" or "udp"`)
+	snap.Match(t, sanitizeOutput(stderr))
 }
 
 func TestStartCommandSetsUpContainerCorrectly(t *testing.T) {
diff --git a/test/integration/status_test.go b/test/integration/status_test.go
index 6ec8f056..2ffd1e68 100644
--- a/test/integration/status_test.go
+++ b/test/integration/status_test.go
@@ -17,6 +17,7 @@ import (
 	"github.com/aws/aws-sdk-go-v2/credentials"
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/aws/aws-sdk-go-v2/service/sqs"
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/moby/moby/client"
 	"github.com/stretchr/testify/assert"
@@ -32,9 +33,7 @@ func TestStatusCommandFailsWhenNotRunning(t *testing.T) {
 	stdout, _, err := runLstk(t, testContext(t), "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "status")
 	require.Error(t, err, "expected lstk status to fail when emulator not running")
 	requireExitCode(t, 1, err)
-	assert.Contains(t, stdout, "is not running")
-	assert.Contains(t, stdout, "Start LocalStack:")
-	assert.Contains(t, stdout, "See help:")
+	snap.Match(t, sanitizeOutput(stdout))
 	assertCommandTelemetry(t, events, "status", 1)
 }
 
@@ -71,6 +70,9 @@ func TestStatusCommandShowsResourcesWhenRunning(t *testing.T) {
 	stdout, stderr, err := runLstk(t, ctx, "", env.With(env.AnalyticsEndpoint, analyticsSrv.URL), "status")
 	require.NoError(t, err, "lstk status failed: %s", stderr)
 	requireExitCode(t, 0, err)
+	// Not a snapshot: this test needs a real auth token and a live emulator,
+	// so a committed snapshot could not be regenerated by most contributors
+	// (and the resources table layout varies with the emulator image).
 	assert.Contains(t, stdout, "running")
 	assert.Contains(t, stdout, "SERVICE")
 	assert.Contains(t, stdout, "RESOURCE")
diff --git a/test/integration/terraform_cmd_test.go b/test/integration/terraform_cmd_test.go
index 3e6f620e..255ae223 100644
--- a/test/integration/terraform_cmd_test.go
+++ b/test/integration/terraform_cmd_test.go
@@ -6,6 +6,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -63,7 +64,7 @@ func TestTerraformForwardsArgs(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "version")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ARGS:version")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestTerraformAliasTF(t *testing.T) {
@@ -73,7 +74,7 @@ func TestTerraformAliasTF(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "tf", "version")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ARGS:version")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // LSTK_TF_CMD selects the binary to invoke (e.g. OpenTofu). A stub named `tofu`
@@ -86,7 +87,7 @@ func TestTerraformHonorsLstkTfCmd(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "version")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "TOFU:version")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestTerraformPropagatesExitCode(t *testing.T) {
@@ -96,7 +97,7 @@ func TestTerraformPropagatesExitCode(t *testing.T) {
 
 	_, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "validate")
 	require.Error(t, err)
-	assert.Contains(t, stderr, "simulated failure")
+	snap.Match(t, sanitizeOutput(stderr))
 	requireExitCode(t, 5, err)
 }
 
@@ -107,10 +108,10 @@ func TestTerraformMissingBinary(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "version")
 	require.Error(t, err)
-	combined := stderr + stdout
-	assert.Contains(t, combined, "not found in PATH")
-	assert.Contains(t, combined, "Install Terraform CLI:")
-	assert.Contains(t, combined, "https://developer.hashicorp.com/terraform/cli")
+	// The snapshots pin the full missing-binary error card, install hint
+	// included.
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.3 — fmt/validate/version/init run without generating an override and without
@@ -129,10 +130,9 @@ func TestTerraformUnproxiedSkipsOverride(t *testing.T) {
 				"terraform", "--region", "us-west-2", "--account", "111111111111", sub)
 			require.NoError(t, err, "stderr: %s", stderr)
 
-			assert.Contains(t, stdout, "ARGS:"+sub)
-			// lstk-specific flags must not be forwarded to terraform.
-			assert.NotContains(t, stdout, "--region")
-			assert.NotContains(t, stdout, "--account")
+			// The snapshot pins the forwarded args: lstk-specific flags
+			// (--region/--account) must not be forwarded to terraform.
+			snap.Match(t, sanitizeOutput(stdout))
 			// No override file generated.
 			assert.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 		})
@@ -156,7 +156,7 @@ func TestTerraformHelpSkipsOverride(t *testing.T) {
 			stdout, stderr, err := runLstk(t, testContext(t), workDir, e, cmdArgs...)
 			require.NoError(t, err, "stderr: %s", stderr)
 
-			assert.Contains(t, stdout, "ARGS:"+strings.Join(args, " "))
+			snap.Match(t, sanitizeOutput(stdout))
 			assert.NoFileExists(t, filepath.Join(workDir, tfOverrideFile))
 		})
 	}
@@ -172,7 +172,8 @@ func TestTerraformInvalidAccountRejected(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"terraform", "--account", "12345", "plan")
 	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "12-digit")
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestTerraformMissingFlagValue(t *testing.T) {
@@ -182,7 +183,8 @@ func TestTerraformMissingFlagValue(t *testing.T) {
 
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e, "terraform", "--region")
 	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "--region requires a value")
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.7 — positional rules. Flags after the action are forwarded verbatim (use an
@@ -196,7 +198,7 @@ func TestTerraformFlagsAfterActionAreForwarded(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"terraform", "version", "--region", "us-west-2")
 	require.NoError(t, err, "stderr: %s", stderr)
-	assert.Contains(t, stdout, "ARGS:version --region us-west-2")
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 func TestTerraformFlagBeforeSubcommandRejected(t *testing.T) {
@@ -207,7 +209,8 @@ func TestTerraformFlagBeforeSubcommandRejected(t *testing.T) {
 	stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), e,
 		"--account", "111111111111", "terraform", "version")
 	require.Error(t, err)
-	assert.Contains(t, stderr+stdout, "must appear after the terraform subcommand")
+	snap.Match(t, sanitizeOutput(stderr))
+	snap.Match(t, sanitizeOutput(stdout))
 }
 
 // 7.2 — proxied command with no running emulator fails with "not running" and
@@ -275,10 +278,9 @@ func TestTerraformDryRunGeneratesOverride(t *testing.T) {
 	require.FileExists(t, overridePath)
 	content, err := os.ReadFile(overridePath)
 	require.NoError(t, err)
-	assert.Contains(t, string(content), `region = "us-west-2"`)
-	assert.Contains(t, string(content), `access_key = "111111111111"`)
-	assert.Contains(t, string(content), "endpoints {")
-	assert.Contains(t, string(content), "s3 =")
+	// The snapshot pins the full generated override: resolved region and
+	// account encoded, plus the complete endpoints block (host masked).
+	snap.Match(t, sanitizeOutput(string(content)))
 }
 
 // 7.5 — a pre-existing override file (not created by lstk) causes a clear
diff --git a/test/integration/update_test.go b/test/integration/update_test.go
index 1190401a..b85722aa 100644
--- a/test/integration/update_test.go
+++ b/test/integration/update_test.go
@@ -21,6 +21,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -537,13 +538,12 @@ func TestUpdateBinaryMockGitHubHappyPath(t *testing.T) {
 	outStr := string(out)
 	require.NoError(t, err, "lstk update failed: %s", outStr)
 	requireExitCode(t, 0, err)
-	assert.Contains(t, outStr, "Update available: 0.0.1 → v0.0.2", "should detect the mock release")
-	assert.Contains(t, outStr, "Downloading and verifying update", "should take the binary download path")
-	assert.Contains(t, outStr, "Updated to v0.0.2", "should complete the update")
+	// The snapshot pins the full check → download/verify → updated sequence.
+	snap.Match(t, sanitizeOutput(outStr))
 
 	verOut, err := exec.CommandContext(ctx, oldBinary, "--version").CombinedOutput()
 	require.NoError(t, err)
-	assert.Contains(t, string(verOut), "0.0.2", "binary should be replaced with the mock release")
+	snap.Match(t, sanitizeOutput(string(verOut)))
 
 	leftovers, err := filepath.Glob(filepath.Join(filepath.Dir(oldBinary), "lstk-update-*"))
 	require.NoError(t, err)
@@ -597,7 +597,7 @@ func TestUpdateBinaryMockGitHubChecksumMismatch(t *testing.T) {
 
 	verOut, err := exec.CommandContext(ctx, oldBinary, "--version").CombinedOutput()
 	require.NoError(t, err, "original binary should still run")
-	assert.Contains(t, string(verOut), "0.0.1", "binary must not be replaced on checksum mismatch")
+	snap.Match(t, sanitizeOutput(string(verOut)))
 
 	leftovers, err := filepath.Glob(filepath.Join(filepath.Dir(oldBinary), "lstk-update-*"))
 	require.NoError(t, err)
@@ -635,7 +635,7 @@ func TestUpdateBinaryMockGitHubMissingChecksums(t *testing.T) {
 
 	verOut, err := exec.CommandContext(ctx, oldBinary, "--version").CombinedOutput()
 	require.NoError(t, err, "original binary should still run")
-	assert.Contains(t, string(verOut), "0.0.1", "binary must not be replaced without a verifiable manifest")
+	snap.Match(t, sanitizeOutput(string(verOut)))
 
 	leftovers, err := filepath.Glob(filepath.Join(filepath.Dir(oldBinary), "lstk-update-*"))
 	require.NoError(t, err)
diff --git a/test/integration/volume_test.go b/test/integration/volume_test.go
index eb5d4ea6..99d5e485 100644
--- a/test/integration/volume_test.go
+++ b/test/integration/volume_test.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/localstack/lstk/internal/snap"
 	"github.com/localstack/lstk/test/integration/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -154,7 +155,7 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 		require.Error(t, err)
 		requireExitCode(t, 1, err)
 
-		assert.Contains(t, stderr, "--force")
+		snap.Match(t, sanitizeOutput(stderr))
 	})
 
 	t.Run("handles nonexistent volume directory", func(t *testing.T) {
@@ -197,7 +198,7 @@ volume = "` + escapeTomlPath(volumeDir) + `"
 		_, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "--non-interactive", "volume", "clear", "--force", "--type", "snowflake")
 		require.Error(t, err)
 		requireExitCode(t, 1, err)
-		assert.Contains(t, stderr, "not found")
+		snap.Match(t, sanitizeOutput(stderr))
 
 		// Correct type should succeed
 		stdout, stderr, err := runLstk(t, testContext(t), t.TempDir(), testEnvWithHome(t.TempDir(), ""), "--config", configFile, "--non-interactive", "volume", "clear", "--force", "--type", "aws")