diff --git a/.agent/workflows/release.md b/.agent/workflows/release.md
index 87a8891..bdbe829 100644
--- a/.agent/workflows/release.md
+++ b/.agent/workflows/release.md
@@ -1,50 +1,10 @@
 ---
-description: Semantic release workflow for owilix
+description: Manual release workflow for owilix
 ---
 
 # Release Workflow
 
-## Semantic Versioning
-
-owilix uses [Python Semantic Release](https://python-semantic-release.readthedocs.io/) with Angular commit conventions.
-
-## Commit Message Format
-
-```
-<type>(<scope>): <subject>
-
-<body>
-
-<footer>
-```
-
-### Types
-
-| Type | Version Bump | Description |
-|------|--------------|-------------|
-| `feat` | Minor | New feature |
-| `fix` | Patch | Bug fix |
-| `perf` | Patch | Performance improvement |
-| `docs` | None | Documentation only |
-| `style` | None | Code style (formatting) |
-| `refactor` | None | Code refactoring |
-| `test` | None | Adding tests |
-| `chore` | None | Build/tooling changes |
-| `add` | Patch | Adding content |
-| `change` | Patch | Changing existing content |
-
-### Examples
-
-```bash
-# Minor version bump (0.24.0 → 0.25.0)
-git commit -m "feat(query): add graph federation support"
-
-# Patch version bump (0.24.0 → 0.24.1)
-git commit -m "fix(repository): correct metadata parsing for v2 schema"
-
-# No version change
-git commit -m "docs: update installation instructions"
-```
+owilix uses semantic versioning (`MAJOR.MINOR.PATCH`), but the release operation itself is manual and tag-driven.
 
 ## Release Process
 
@@ -58,20 +18,20 @@ git commit -m "docs: update installation instructions"
 
 ### 1. Manual Release Workflow
 
-The release process is manual. Semantic release is **NOT** used.
-
 1. **Update Version**:
-   - `owilix/_version.py`: `__version__ = "X.Y.Z"`
    - `pyproject.toml`: `version = "X.Y.Z"`
+   - `owilix/_version.py` (if present): `__version__ = "X.Y.Z"`
 
 2. **Update Changelog**:
-   - Manually add a section for `vX.Y.Z` in `CHANGELOG.md`.
+   - Add user-facing notes to `CHANGELOG.md` (`Unreleased` or `vX.Y.Z` section).
+   - Add engineering merge summary to `docs/changes.md` under `Unreleased`.
 
 3. **Commit & Tag**:
    ```bash
-   git add owilix/_version.py pyproject.toml CHANGELOG.md
+   git add pyproject.toml CHANGELOG.md docs/changes.md
+   # include owilix/_version.py when the file exists
    git commit -m "chore: release version X.Y.Z"
-   git tag vX.Y.Z
+   git tag -a vX.Y.Z -m "Release vX.Y.Z"
    git push origin main
    git push origin vX.Y.Z
    ```
@@ -108,10 +68,10 @@ If `uv lock` fails due to conflicting URLs (e.g. `py4lexis` vs `python-http-irod
 
 Version is tracked in:
 - `pyproject.toml:project.version`
-- `owilix/_version.py:__version__`
+- `owilix/_version.py:__version__` (if present)
 - `Readme.md` (version badge)
 
 ## Changelog
 
-- Auto-generated: `CHANGELOG.md` (by semantic-release)
-- Human-curated: `docs/changes.md` (for context and summaries)
+- User-facing: `CHANGELOG.md`
+- Human-curated engineering context: `docs/changes.md`
diff --git a/.gitignore b/.gitignore
index 4ad84a4..97235d2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -174,4 +174,4 @@ cython_debug/
 # some test data
 /.test/
 
-owilix_pipe_*
\ No newline at end of file
+owilix_pipe_*tmp
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4280a3d..4140d14 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,18 @@
 
 ## Unreleased
 
+### Features
+
+- **fsspec**: Improve multi-filesystem iRODS/HTTP integration and related CLI handling.
+
+### Tests
+
+- **fsspec**: Expand unit tests for multi-filesystem behavior.
+
+### Documentation
+
+- **docs**: Update configuration docs and development process guidance for backlog and merge tracking.
+
 ## v5.1.0 (2026-01-21)
 
 ### Features
diff --git a/docs/AI_DEVELOPMENT.md b/docs/AI_DEVELOPMENT.md
index 48b2b88..f407f0f 100644
--- a/docs/AI_DEVELOPMENT.md
+++ b/docs/AI_DEVELOPMENT.md
@@ -48,6 +48,20 @@ Epic (docs/epics.md)
 | [changes.md](changes.md) | Human-curated changelog |
 | [external/py4lexis.md](external/py4lexis.md) | py4lexis best practices |
 
+## Source of Truth
+
+To avoid drift between documents, use this ownership model:
+
+- Strategic backlog (planned and in-progress epics): `docs/epics.md`
+- Operational backlog for `main` execution details: `docs/branch/main.md`
+- Successful branch merges and notable technical outcomes: `docs/changes.md`
+- User/release-facing version notes: `CHANGELOG.md`
+
+When merging a branch:
+1. Move or close backlog items in `docs/epics.md`
+2. Add a merge summary in `docs/changes.md` under `Unreleased`
+3. If user-visible behavior changed, add an `Unreleased` entry in `CHANGELOG.md`
+
 ---
 
 ## Conventions
diff --git a/docs/branch/main.md b/docs/branch/main.md
index f4b6ebe..5d00984 100644
--- a/docs/branch/main.md
+++ b/docs/branch/main.md
@@ -66,6 +66,14 @@ This document tracks backlogs, TODOs, and next steps across all features.
 - [ ] Verify all query commands work (`less`, `sites`, `analyze`, etc.)
 - [ ] Optimize performance (parallel calls, async)
 
+### Security Hardening
+*From: deferred hardening analysis*
+
+- [ ] Review and prioritize items listed in `docs/hardening.md`
+- [ ] Split prioritized hardening work into actionable epics in `docs/epics.md`
+- [ ] Implement hardening changes in scoped feature branches
+- [ ] Add merge outcomes to `docs/changes.md` and release-relevant notes to `CHANGELOG.md`
+
 ---
 
 ## Next Steps
@@ -126,4 +134,4 @@ For any feature branch merge, ensure:
 
 - All branch-specific documentation has been moved to `docs/branch/done/` after feature completion
 - This main.md serves as the central tracking document for ongoing work
-- Review backlogs quarterly to prioritize next features
\ No newline at end of file
+- Review backlogs quarterly to prioritize next features
diff --git a/docs/changes.md b/docs/changes.md
index 107643f..1078866 100644
--- a/docs/changes.md
+++ b/docs/changes.md
@@ -24,6 +24,19 @@ Brief description of what was accomplished.
 
 ## Unreleased
 
+### multifs - 2026-02-17
+
+#### Multi-filesystem and CLI consistency updates
+
+**Summary**: Improved multi-filesystem behavior across CLI and manager flows, with corresponding tests and docs updates.
+
+**Changes**:
+- Extended HTTP-to-iRODS fsspec integration in `owilix/core/fsspec/http2irods.py`
+- Updated CLI and context/output handling in `owilix/cli/` modules
+- Updated manager/query flow integration in `owilix/core/manager/manager.py` and `owilix/core/tasks/query.py`
+- Expanded unit coverage in `tests/owilix/core/fsspec/test_core_fsspec_unit.py`
+- Updated dependency lock and configuration docs (`uv.lock`, `pyproject.toml`, `docs/source/config.md`)
+
 ### py4lexis4 - 2026-01-02
 
 #### Py4Lexis 5.x Migration Complete
diff --git a/docs/epics.md b/docs/epics.md
index 757ebf5..138d9b4 100644
--- a/docs/epics.md
+++ b/docs/epics.md
@@ -29,6 +29,7 @@ Planned epics not yet started:
 - **Async Query Optimization**: True async I/O implementation for query commands to improve performance (currently uses thread pools)
 - **Dataset Cleaning**: Tools for cleaning/validating datasets
 - **Overall Clean-up**: Code restructuring and cleanup
+- **Security Hardening**: Defer and track hardening tasks captured in `docs/hardening.md`
 
 ### ⚪ Deployment & Release Prep
 
diff --git a/docs/source/config.md b/docs/source/config.md
index 965f6f5..abbeba3 100644
--- a/docs/source/config.md
+++ b/docs/source/config.md
@@ -63,6 +63,16 @@ owi config get server-config user.name
 owi config version
 ```
 
+### Use Local Config Only
+
+By default, OWILIX merges in the latest server config on startup (remote repositories and defaults).
+You can disable that behavior per command with `--no-remote-config`.
+
+```bash
+owi --no-remote-config remote ls all
+owi --no-remote-config remote pull all/id=abc123
+```
+
 ### Modify Configuration
 
 ```bash
@@ -291,4 +301,3 @@ remotes, locals_ = cfg.get_repositories(remote=["+backup-s3"])
 remotes, locals_ = cfg.get_repositories(remote=["backup-s3", "it4i"],
                                         local=["local"])
 ```
-
diff --git a/owilix/cli/__init__.py b/owilix/cli/__init__.py
index f47a93a..63a5379 100644
--- a/owilix/cli/__init__.py
+++ b/owilix/cli/__init__.py
@@ -68,6 +68,10 @@ def main(
         False, "-N", "--no-progress",
         help="Suppress progress bars globally"
     ),
+    no_remote_config: bool = typer.Option(
+        False, "--no-remote-config",
+        help="Disable server config updates and use local config as-is"
+    ),
 ):
     """
     OWILIX - Open Web Index Client
@@ -98,6 +102,7 @@ def main(
         no_progress=no_progress,
         autoyes=yes,
         loglevel=effective_loglevel,
+        no_remote_config=no_remote_config,
     )
     
     # Patch legacy progress bars if globally suppressed
diff --git a/owilix/cli/_common/context.py b/owilix/cli/_common/context.py
index 7cd6270..1ee25df 100644
--- a/owilix/cli/_common/context.py
+++ b/owilix/cli/_common/context.py
@@ -56,6 +56,7 @@ def create_context(
     fields: Optional[str] = None,
     autoyes: bool = False,
     loglevel: Optional[str] = None,
+    no_remote_config: bool = False,
 ) -> CLIContext:
     """
     Create a CLI context with initialized OWIlixManager.
@@ -84,7 +85,7 @@ def create_context(
     
     # Load configuration
     config_file = config_path or os.path.join(owi_path, "owilix.cfg")
-    config = OWIlixConfig(config_file)
+    config = OWIlixConfig(config_file, no_remote=no_remote_config)
     
     # Configure logging based on loglevel or verbose
     if loglevel and loglevel.upper() in ("DEBUG", "INFO", "WARNING", "ERROR"):
diff --git a/owilix/cli/_common/output.py b/owilix/cli/_common/output.py
index 81dd36e..4b620dd 100644
--- a/owilix/cli/_common/output.py
+++ b/owilix/cli/_common/output.py
@@ -186,7 +186,11 @@ class OutputWriter:
         if show_summary:
             total_size = sum(ds.metadata.get('totalSize', 0) or 0 for ds in datasets)
             total_files = sum(ds.metadata.get('fileCount', 0) or 0 for ds in datasets)
-            self.console.print(f"\n[bold]Summary:[/bold] {len(datasets)} datasets, {total_size/1e9:.1f} GB, {total_files:,} files")
+            total_objects = sum(ds.metadata.get('objectCount', 0) or 0 for ds in datasets)
+            self.console.print(
+                f"\n[bold]Summary:[/bold] {len(datasets)} datasets, {total_size/1e9:.1f} GB, "
+                f"{total_files:,} files, {total_objects:,} objects"
+            )
     
     def _write_datasets_short(self, datasets):
         """
@@ -339,7 +343,7 @@ class OutputWriter:
     
     def _write_datasets_markdown(self, datasets):
         """Markdown table format."""
-        headers = ["ID", "Title", "Collection", "DC", "Dates", "Size", "Files"]
+        headers = ["ID", "Title", "Collection", "DC", "Dates", "Size", "Files", "Objects"]
         self.console.print("| " + " | ".join(headers) + " |")
         self.console.print("|" + "|".join(["---"] * len(headers)) + "|")
         
@@ -351,8 +355,9 @@ class OutputWriter:
             start = str(d.metadata.startDate)[:10] if d.metadata.startDate else "?"
             size = f"{d.metadata.get('totalSize', 0) / 1e9:.1f}G"
             files = d.metadata.get('fileCount', 0) or 0
+            objects = d.metadata.get('objectCount', 0) or 0
             
-            row = [ds_id, title, coll, dc, start, size, str(files)]
+            row = [ds_id, title, coll, dc, start, size, str(files), str(objects)]
             self.console.print("| " + " | ".join(row) + " |")
     
     def _write_line(self, line: str):
diff --git a/owilix/cli/local.py b/owilix/cli/local.py
index 0652167..2a8952b 100644
--- a/owilix/cli/local.py
+++ b/owilix/cli/local.py
@@ -132,6 +132,7 @@ def ls(
                     "endDate": str(ds.metadata.endDate) if ds.metadata.endDate else None,
                     "size": ds.metadata.get('totalSize'),
                     "fileCount": ds.metadata.get('fileCount'),
+                    "objectCount": ds.metadata.get('objectCount'),
                     "access": getattr(ds, 'access', None),
                 }
                 for ds in datasets_list
@@ -351,4 +352,3 @@ def export(
     if not result.success:
         cli_ctx.console.print(f"[red]Export failed: {result.msg}[/red]")
         raise typer.Exit(code=1)
-
diff --git a/owilix/cli/plugin.py b/owilix/cli/plugin.py
index 46f5299..f72f390 100644
--- a/owilix/cli/plugin.py
+++ b/owilix/cli/plugin.py
@@ -4,6 +4,7 @@ Plugin Commands - Typer CLI for loading and executing external plugins.
 This enables dynamic loading of plugin classes that extend BaseCommand.
 """
 import importlib
+import ast
 from typing import List, Optional
 import typer
 
@@ -53,7 +54,7 @@ def run_plugin(
                     key, value = arg.split('=', 1)
                     # Try to parse as Python literals
                     try:
-                        cmd_kwargs[key] = eval(value)
+                        cmd_kwargs[key] = ast.literal_eval(value)
                     except:
                         cmd_kwargs[key] = value
                 else:
diff --git a/owilix/core/fsspec/__init__.py b/owilix/core/fsspec/__init__.py
index 664afc0..9b0db49 100644
--- a/owilix/core/fsspec/__init__.py
+++ b/owilix/core/fsspec/__init__.py
@@ -7,6 +7,6 @@ Exports:
     - Http2IrodsFileSystem: fsspec filesystem for iRODS HTTP API
 """
 
-from owilix.core.fsspec.http2irods import Http2IrodsFileSystem
+from owilix.core.fsspec.http2irods import Http2IrodsFileSystem, ZoneRoutingFileSystem
 
-__all__ = ["Http2IrodsFileSystem"]
+__all__ = ["Http2IrodsFileSystem", "ZoneRoutingFileSystem"]
diff --git a/owilix/core/fsspec/http2irods.py b/owilix/core/fsspec/http2irods.py
index 8e9c280..6b8a71f 100644
--- a/owilix/core/fsspec/http2irods.py
+++ b/owilix/core/fsspec/http2irods.py
@@ -673,3 +673,132 @@ class Http2IrodsFile(AbstractBufferedFile):
             Bytes from the requested range
         """
         return self.fs._read_range(self.path, start, end)
+
+
+class _RoutingDataObjects:
+    def __init__(self, router):
+        self._router = router
+
+    def write(self, data, lpath: str = None, **kwargs):
+        if not lpath:
+            raise ValueError("lpath is required for routed write operations")
+        fs, path = self._router._fs_for_path(lpath)
+        return fs.data_objects.write(data, lpath=path, **kwargs)
+
+    def __getattr__(self, name: str):
+        fs = self._router._get_fs_for_zone(self._router.default_zone)
+        return getattr(fs.data_objects, name)
+
+
+class ZoneRoutingFileSystem(fsspec.AbstractFileSystem):
+    """
+    Routes iRODS filesystem operations to a per-zone Http2IrodsFileSystem.
+    """
+
+    protocol = "http2irods+zones"
+
+    def __init__(
+        self,
+        get_fs_for_zone,
+        default_zone: str,
+        known_zones: Optional[List[str]] = None,
+        **kwargs
+    ):
+        super().__init__(**kwargs)
+        self._get_fs_for_zone = get_fs_for_zone
+        self._default_zone = default_zone
+        self._known_zones = set(known_zones) if known_zones else None
+        self._warned_unknown_zones = set()
+        self.data_objects = _RoutingDataObjects(self)
+
+    @property
+    def fsid(self):
+        return "http2irods+zones"
+
+    @property
+    def default_zone(self) -> str:
+        return self._default_zone
+
+    def _normalize_path(self, path: str | None) -> str | None:
+        if path is None:
+            return None
+        stripped = self._strip_protocol(path)
+        if stripped == "":
+            return stripped
+        return "/" + stripped.lstrip("/")
+
+    def _resolve_zone(self, path: str | None, zone: str | None = None) -> str:
+        if zone:
+            return zone
+        normalized = self._normalize_path(path)
+        if normalized:
+            parts = normalized.lstrip("/").split("/", 1)
+            if parts and parts[0]:
+                candidate = parts[0]
+                if self._known_zones is None or candidate in self._known_zones:
+                    return candidate
+                if candidate not in self._warned_unknown_zones:
+                    logger.warning(
+                        "Zone '%s' not in known zones; using it anyway. Add it to config.zones to "
+                        "set a custom api_url/location_name.",
+                        candidate,
+                    )
+                    self._warned_unknown_zones.add(candidate)
+                return candidate
+        return self._default_zone
+
+    def _fs_for_path(self, path: str, zone: str | None = None):
+        normalized = self._normalize_path(path)
+        resolved_zone = self._resolve_zone(normalized, zone=zone)
+        return self._get_fs_for_zone(resolved_zone), normalized
+
+    def exists(self, path: str) -> bool:
+        fs, normalized = self._fs_for_path(path)
+        return fs.exists(normalized)
+
+    def isdir(self, path: str) -> bool:
+        fs, normalized = self._fs_for_path(path)
+        return fs.isdir(normalized)
+
+    def info(self, path: str, **kwargs):
+        fs, normalized = self._fs_for_path(path)
+        return fs.info(normalized, **kwargs)
+
+    def modified(self, path: str, **kwargs):
+        fs, normalized = self._fs_for_path(path)
+        return fs.modified(normalized, **kwargs)
+
+    def ls(self, path: str, detail: bool = False, **kwargs):
+        fs, normalized = self._fs_for_path(path)
+        return fs.ls(normalized, detail=detail, **kwargs)
+
+    def find(self, path: str, **kwargs):
+        fs, normalized = self._fs_for_path(path)
+        return fs.find(normalized, **kwargs)
+
+    def glob(self, path: str, **kwargs):
+        fs, normalized = self._fs_for_path(path)
+        return fs.glob(normalized, **kwargs)
+
+    def _open(self, path: str, mode: str = "rb", **kwargs):
+        fs, normalized = self._fs_for_path(path)
+        return fs.open(normalized, mode=mode, **kwargs)
+
+    def open(self, path: str, mode: str = "rb", **kwargs):
+        return self._open(path, mode=mode, **kwargs)
+
+    def makedirs(self, path: str, **kwargs):
+        fs, normalized = self._fs_for_path(path)
+        return fs.makedirs(normalized, **kwargs)
+
+    def rm(self, path: str, **kwargs):
+        fs, normalized = self._fs_for_path(path)
+        return fs.rm(normalized, **kwargs)
+
+    def put(self, lpath: str, rpath: str, **kwargs):
+        fs, normalized = self._fs_for_path(rpath)
+        return fs.put(lpath, normalized, **kwargs)
+
+    def get(self, rpath: str, lpath: str, **kwargs):
+        fs, normalized = self._fs_for_path(rpath)
+        return fs.get(normalized, lpath, **kwargs)
diff --git a/owilix/core/manager/manager.py b/owilix/core/manager/manager.py
index b901466..8360105 100644
--- a/owilix/core/manager/manager.py
+++ b/owilix/core/manager/manager.py
@@ -453,9 +453,23 @@ class OWIlixConfig:
                     logger.warning(f"Client v{__version__} >= max v{max_client}. Server config may be outdated.")
             
             if "repositories" in server_config and "config" in server_config["repositories"]:
-                for repo in server_config["repositories"]["config"].keys():
-                    local_config.setdefault("repositories", {}).setdefault("config", {})[repo] = \
-                        server_config["repositories"]["config"][repo]
+                local_repos = local_config.setdefault("repositories", {}).setdefault("config", {})
+
+                def _merge_repo_config(server_repo: Dict[str, Any], local_repo: Dict[str, Any]) -> Dict[str, Any]:
+                    merged = dict(server_repo or {})
+                    for key, value in (local_repo or {}).items():
+                        if key == "options" and isinstance(value, dict):
+                            base_options = merged.get("options", {})
+                            if not isinstance(base_options, dict):
+                                base_options = {}
+                            merged["options"] = {**base_options, **value}
+                        else:
+                            merged[key] = value
+                    return merged
+
+                for repo, server_repo in server_config["repositories"]["config"].items():
+                    local_repo = local_repos.get(repo, {})
+                    local_repos[repo] = _merge_repo_config(server_repo, local_repo)
             
             if "server-config" in server_config:
                 local_config["server-config"] = server_config["server-config"]
diff --git a/owilix/core/tasks/query.py b/owilix/core/tasks/query.py
index c8e94ec..3a77c12 100644
--- a/owilix/core/tasks/query.py
+++ b/owilix/core/tasks/query.py
@@ -3,6 +3,8 @@ Core query tasks.
 Generic and specific query logic for OWIlix.
 """
 import importlib
+import ast
+import json
 import sys
 from pathlib import Path
 from typing import Optional, Dict, List, Any, Callable
diff --git a/pyproject.toml b/pyproject.toml
index e55595b..f0267cd 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -37,6 +37,7 @@ dependencies = [
   "s3fs>=2024.12.0",
   "url-normalize>=2.2.1",
   "ciff-toolkit>=0.1.1",
+  "tldextract>=5.0.0",
   "python-http-irods-client @ git+https://opencode.it4i.eu/lexis-platform/data/python-http-irods-client.git@1.1.2",
 ]
 
diff --git a/tests/owilix/core/fsspec/test_core_fsspec_unit.py b/tests/owilix/core/fsspec/test_core_fsspec_unit.py
index f353762..1963a57 100644
--- a/tests/owilix/core/fsspec/test_core_fsspec_unit.py
+++ b/tests/owilix/core/fsspec/test_core_fsspec_unit.py
@@ -13,7 +13,7 @@ import os
 # Add the source to path to import directly without going through core/__init__.py
 sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__)))))))
 
-from owilix.core.fsspec.http2irods import Http2IrodsFileSystem, Http2IrodsFile
+from owilix.core.fsspec.http2irods import Http2IrodsFileSystem, Http2IrodsFile, ZoneRoutingFileSystem
 
 
 class TestHttp2IrodsFileSystem:
@@ -208,3 +208,125 @@ class TestHttp2IrodsFile:
         
         mock_fs._read_range.assert_called_once_with("/zone/file.txt", 0, 100)
         assert result == b"test content"
+
+
+class TestZoneRoutingFileSystem:
+    """Tests for ZoneRoutingFileSystem routing behavior."""
+
+    class DummyFS:
+        def __init__(self, name):
+            self.name = name
+            self.calls = []
+            self.data_objects = self
+
+        def write(self, data, lpath=None, **kwargs):
+            self.calls.append(("write", lpath))
+            return {"status_code": 200}
+
+        def exists(self, path):
+            self.calls.append(("exists", path))
+            return True
+
+        def open(self, path, mode="rb", **kwargs):
+            self.calls.append(("open", path, mode))
+            return "opened"
+
+        def info(self, path, **kwargs):
+            self.calls.append(("info", path))
+            return {"name": path}
+
+        def modified(self, path, **kwargs):
+            self.calls.append(("modified", path))
+            return 123
+
+    def test_routes_by_zone_prefix(self):
+        fs_a = self.DummyFS("zoneA")
+        fs_b = self.DummyFS("zoneB")
+        fs_map = {"zoneA": fs_a, "zoneB": fs_b}
+
+        def get_fs_for_zone(zone):
+            return fs_map[zone]
+
+        router = ZoneRoutingFileSystem(
+            get_fs_for_zone=get_fs_for_zone,
+            default_zone="zoneA",
+            known_zones=["zoneA", "zoneB"],
+        )
+
+        router.exists("/zoneB/public/data")
+        router.open("/zoneA/public/file.txt")
+
+        assert ("exists", "/zoneB/public/data") in fs_b.calls
+        assert ("open", "/zoneA/public/file.txt", "rb") in fs_a.calls
+
+    def test_routes_to_default_zone(self):
+        fs_default = self.DummyFS("default")
+        fs_other = self.DummyFS("other")
+        fs_map = {"default": fs_default, "other": fs_other}
+
+        def get_fs_for_zone(zone):
+            return fs_map[zone]
+
+        router = ZoneRoutingFileSystem(
+            get_fs_for_zone=get_fs_for_zone,
+            default_zone="default",
+            known_zones=["default", "other"],
+        )
+
+        router.info("/unknownzone/public/item")
+        router.exists("relative/path")
+
+        assert ("info", "/unknownzone/public/item") in fs_default.calls
+        assert ("exists", "/relative/path") in fs_default.calls
+
+    def test_data_objects_write_routes_by_path(self):
+        fs_a = self.DummyFS("zoneA")
+        fs_b = self.DummyFS("zoneB")
+        fs_map = {"zoneA": fs_a, "zoneB": fs_b}
+
+        def get_fs_for_zone(zone):
+            return fs_map[zone]
+
+        router = ZoneRoutingFileSystem(
+            get_fs_for_zone=get_fs_for_zone,
+            default_zone="zoneA",
+            known_zones=["zoneA", "zoneB"],
+        )
+
+        router.data_objects.write(b"data", lpath="/zoneB/public/file.txt")
+
+        assert ("write", "/zoneB/public/file.txt") in fs_b.calls
+
+    def test_routes_strip_protocol(self):
+        fs_a = self.DummyFS("zoneA")
+        fs_b = self.DummyFS("zoneB")
+        fs_map = {"zoneA": fs_a, "zoneB": fs_b}
+
+        def get_fs_for_zone(zone):
+            return fs_map[zone]
+
+        router = ZoneRoutingFileSystem(
+            get_fs_for_zone=get_fs_for_zone,
+            default_zone="zoneA",
+            known_zones=["zoneA", "zoneB"],
+        )
+
+        router.exists("http2irods+zones:///zoneB/public/data")
+
+        assert ("exists", "/zoneB/public/data") in fs_b.calls
+
+    def test_modified_delegates(self):
+        fs_a = self.DummyFS("zoneA")
+        fs_map = {"zoneA": fs_a}
+
+        def get_fs_for_zone(zone):
+            return fs_map[zone]
+
+        router = ZoneRoutingFileSystem(
+            get_fs_for_zone=get_fs_for_zone,
+            default_zone="zoneA",
+            known_zones=["zoneA"],
+        )
+
+        assert router.modified("/zoneA/public/item") == 123
+        assert ("modified", "/zoneA/public/item") in fs_a.calls
diff --git a/uv.lock b/uv.lock
index 688e376..2731ed6 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,5 +1,5 @@
 version = 1
-revision = 3
+revision = 2
 requires-python = "==3.11.*"
 
 [[package]]
@@ -654,6 +654,7 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/1f/cb/48e964c452ca2b92175a9b2dca037a553036cb053ba69e284650ce755f13/greenlet-3.3.0-cp311-cp311-macosx_11_0_universal2.whl", hash = "sha256:e29f3018580e8412d6aaf5641bb7745d38c85228dacf51a73bd4e26ddf2a6a8e", size = 274908, upload-time = "2025-12-04T14:23:26.435Z" },
     { url = "https://files.pythonhosted.org/packages/28/da/38d7bff4d0277b594ec557f479d65272a893f1f2a716cad91efeb8680953/greenlet-3.3.0-cp311-cp311-manylinux_2_24_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a687205fb22794e838f947e2194c0566d3812966b41c78709554aa883183fb62", size = 577113, upload-time = "2025-12-04T14:50:05.493Z" },
     { url = "https://files.pythonhosted.org/packages/3c/f2/89c5eb0faddc3ff014f1c04467d67dee0d1d334ab81fadbf3744847f8a8a/greenlet-3.3.0-cp311-cp311-manylinux_2_24_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:4243050a88ba61842186cb9e63c7dfa677ec146160b0efd73b855a3d9c7fcf32", size = 590338, upload-time = "2025-12-04T14:57:41.136Z" },
+    { url = "https://files.pythonhosted.org/packages/80/d7/db0a5085035d05134f8c089643da2b44cc9b80647c39e93129c5ef170d8f/greenlet-3.3.0-cp311-cp311-manylinux_2_24_s390x.manylinux_2_28_s390x.whl", hash = "sha256:670d0f94cd302d81796e37299bcd04b95d62403883b24225c6b5271466612f45", size = 601098, upload-time = "2025-12-04T15:07:11.898Z" },
     { url = "https://files.pythonhosted.org/packages/dc/a6/e959a127b630a58e23529972dbc868c107f9d583b5a9f878fb858c46bc1a/greenlet-3.3.0-cp311-cp311-manylinux_2_24_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6cb3a8ec3db4a3b0eb8a3c25436c2d49e3505821802074969db017b87bc6a948", size = 590206, upload-time = "2025-12-04T14:26:01.254Z" },
     { url = "https://files.pythonhosted.org/packages/48/60/29035719feb91798693023608447283b266b12efc576ed013dd9442364bb/greenlet-3.3.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:2de5a0b09eab81fc6a382791b995b1ccf2b172a9fec934747a7a23d2ff291794", size = 1550668, upload-time = "2025-12-04T15:04:22.439Z" },
     { url = "https://files.pythonhosted.org/packages/0a/5f/783a23754b691bfa86bd72c3033aa107490deac9b2ef190837b860996c9f/greenlet-3.3.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:4449a736606bd30f27f8e1ff4678ee193bc47f6ca810d705981cfffd6ce0d8c5", size = 1615483, upload-time = "2025-12-04T14:27:28.083Z" },
@@ -1187,6 +1188,7 @@ dependencies = [
     { name = "rich" },
     { name = "s3fs" },
     { name = "tabulate" },
+    { name = "tldextract" },
     { name = "tqdm" },
     { name = "typer" },
     { name = "url-normalize" },
@@ -1259,6 +1261,7 @@ requires-dist = [
     { name = "rich", specifier = ">=13.7.0" },
     { name = "s3fs", specifier = ">=2024.12.0" },
     { name = "tabulate", specifier = ">=0.9.0" },
+    { name = "tldextract", specifier = ">=5.0.0" },
     { name = "tqdm", specifier = ">=4.66.2" },
     { name = "typer", specifier = ">=0.13.1" },
     { name = "url-normalize", specifier = ">=2.2.1" },
@@ -1933,6 +1936,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/1e/db/4254e3eabe8020b458f1a747140d32277ec7a271daf1d235b70dc0b4e6e3/requests-2.32.5-py3-none-any.whl", hash = "sha256:2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6", size = 64738, upload-time = "2025-08-18T20:46:00.542Z" },
 ]
 
+[[package]]
+name = "requests-file"
+version = "3.0.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "requests" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/3c/f8/5dc70102e4d337063452c82e1f0d95e39abfe67aa222ed8a5ddeb9df8de8/requests_file-3.0.1.tar.gz", hash = "sha256:f14243d7796c588f3521bd423c5dea2ee4cc730e54a3cac9574d78aca1272576", size = 6967, upload-time = "2025-10-20T18:56:42.279Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e1/d5/de8f089119205a09da657ed4784c584ede8381a0ce6821212a6d4ca47054/requests_file-3.0.1-py2.py3-none-any.whl", hash = "sha256:d0f5eb94353986d998f80ac63c7f146a307728be051d4d1cd390dbdb59c10fa2", size = 4514, upload-time = "2025-10-20T18:56:41.184Z" },
+]
+
 [[package]]
 name = "requests-toolbelt"
 version = "1.0.0"
@@ -2284,6 +2299,21 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/78/17/853354204e1ca022d6b7d011ca7f3206c4f8faa3cc743e92609b49c1d83f/tinydb-4.8.2-py3-none-any.whl", hash = "sha256:f97030ee5cbc91eeadd1d7af07ab0e48ceb04aa63d4a983adbaca4cba16e86c3", size = 24888, upload-time = "2024-10-12T15:23:59.833Z" },
 ]
 
+[[package]]
+name = "tldextract"
+version = "5.3.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "filelock" },
+    { name = "idna" },
+    { name = "requests" },
+    { name = "requests-file" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/65/7b/644fbbb49564a6cb124a8582013315a41148dba2f72209bba14a84242bf0/tldextract-5.3.1.tar.gz", hash = "sha256:a72756ca170b2510315076383ea2993478f7da6f897eef1f4a5400735d5057fb", size = 126105, upload-time = "2025-12-28T23:58:05.532Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/6d/42/0e49d6d0aac449ca71952ec5bae764af009754fcb2e76a5cc097543747b3/tldextract-5.3.1-py3-none-any.whl", hash = "sha256:6bfe36d518de569c572062b788e16a659ccaceffc486d243af0484e8ecf432d9", size = 105886, upload-time = "2025-12-28T23:58:04.071Z" },
+]
+
 [[package]]
 name = "tokenizers"
 version = "0.22.2"
