One-install Elasticsearch 9.4 front door over ten bounded domain packs and nine operating workflows. It admits 739 of 826 official method/path operations: all 659 generally available, 25 beta, and 55 experimental operations with buildable static REST transport. It excludes 78 GET-with-body aliases and 9 HEAD aliases because the current binding deliberately strips GET bodies and has no HEAD method; every excluded alias has an admitted POST, PUT, or GET companion on the same path, so no documented feature family is lost. Eight admitted bulk and multi-search variants use literal body_raw NDJSON. The two inference streaming endpoints request text/event-stream and return buffered raw SSE text after completion; this adapter does not expose incremental chunks. Enroll an Authorization-header connection at the target deployment origin, for example https://example.es.io, and store the complete ApiKey <encoded>, Bearer <token>, or Basic <base64> value. Reads are uncached; search, document, security, connector, Watcher, Transform, ingest, Logstash, synonyms, ML, inference, beta, and experimental reads are marked sensitive-read. Every mutation is grant-off and approval-gated with its complete payload bound to the target. Bundled chat workflows expose only operational metadata reads, no workflow renders credentials or arbitrary indexed documents, and no arbitrary Elasticsearch document is misrepresented as a task, note, or project Source.