@gavin-hu/my-pi-agent 0.19.0 → 0.20.0

package/extensions/board/schema.ts

@@ -15,24 +15,33 @@ export const BoardParams = Type.Object({
 	action: Type.Union(
 		BOARD_ACTIONS.map((action) => Type.Literal(action)),
 		{
+			// The verbs and their meanings live in the tool description, built from
+			// `BOARD_ACTION_DOCS`; this says only what a caller needs to choose one.
 			description:
-				"`list` the board (optionally one card, one lane, a query, or the lead's rollup), `add` a card, " +
-				"`claim` one for this session, `release` it, `reclaim` it from whoever holds it, `move` it to " +
-				"another lane, `note` it, `plan` it (record the plan file being executed), `edit` what it says " +
-				"(title, paths, priority, what it waits for), or `drop` it.",
+				"`list` reads the board, or one card when `card` names it; every other verb changes it. The tool description says what each one does.",
 		},
 	),
 	card: Type.Optional(
-		Type.String({ description: 'The card id for one card, e.g. "4" or "#4". Used by every action but `list`/`add`.' }),
+		Type.String({
+			description:
+				'The card id for one card, e.g. "4" or "#4". `list` reads that card; every other action but `add` acts on it.',
+		}),
 	),
 	status: Type.Optional(
 		Type.Union(
 			CARD_STATUSES.map((status) => Type.Literal(status)),
 			{
-				description: "`list`: show only this lane. `move`: the lane to move to (not `todo` — use `release`).",
+				description:
+					"`list`: show only this lane, and not skip the `done` cards. `move`: the lane to move to (not `todo` — use `release`).",
 			},
 		),
 	),
+	blockedBy: Type.Optional(
+		Type.String({
+			description:
+				"`move` to `blocked`: what the card waits on — the decision a person has to make, one line, at most 200 characters.",
+		}),
+	),
 	title: Type.Optional(Type.String({ description: "`add` and `edit`: the feature's outcome, one line." })),
 	paths: Type.Optional(
 		Type.Array(Type.String(), {
@@ -64,7 +73,7 @@ export const BoardParams = Type.Object({
 	query: Type.Optional(
 		Type.String({
 			description:
-				"`list`: show only the cards whose title, path hint, or holder matches this text, case-insensitively.",
+				"`list`: show only the cards whose title, holder, path hint, plan, or a note's text matches this text, case-insensitively.",
 		}),
 	),
 	round: Type.Optional(
@@ -72,4 +81,10 @@ export const BoardParams = Type.Object({
 			description: "`list`: also return the lead's rollup — owners, unassigned, unplanned, blocked, idle.",
 		}),
 	),
+	archived: Type.Optional(
+		Type.Boolean({
+			description:
+				"`list`: read the archive instead of the board — the finished cards `archive` set aside, which no other read opens. `query` and `mine` narrow it; `status` and `round` do not apply to a pile that is out of the board.",
+		}),
+	),
 });

package/extensions/board/seat.ts

@@ -1,16 +1,15 @@
 /**
- * The seat: the name the page serves as, and the actor its writes are made as.
+ * The seat: the name the page serves as, and the actor it is shown as.
  *
  * A page outlives the session that opened it — a `/resume`, a rename, or a fresh
- * session taking the page over would otherwise change who a browser claim belongs to,
- * and a card claimed yesterday could no longer be released today. So the page is a
- * *seat* rather than a session: one fixed name, one fixed id derived from it, and the
- * same cards belong to it however many sessions have served it.
+ * session taking the page over would otherwise change who the page says it is. So the
+ * page is a *seat* rather than a session: one fixed name, one fixed id derived from it,
+ * and the same identity however many sessions have served it.
  *
- * The id is derived rather than minted so two sessions that serve the same seat are the
- * same actor — which is what a handover needs, and what makes the terminal a *different*
- * actor from the page: the board's own tools still write as the session, and `reclaim`
- * is how a lead takes back what the page holds.
+ * The page writes nothing, so the id decides no ownership: it is what the page's own
+ * roster and the `you` chip are read against, and it keeps a page's reads the same
+ * across a handover. The board's tools write as the session — which is why the label is
+ * shared with the session serving the page and the ids are not.
  */
 
 import type { Actor } from "../../lib/board/rules.ts";
@@ -22,7 +21,7 @@ export const DEFAULT_SEAT = "team-lead";
 /** The prefix of a page's actor id, so one is never mistaken for a session id. */
 export const SEAT_ID_PREFIX = "board:";
 
-/** The actor a page writes as: the seat, and an id derived from it. */
+/** The actor a page reads as: the seat, and an id derived from it. */
 export function pageActor(label: string = DEFAULT_SEAT): Actor {
 	const seat = normalizeLabel(label, DEFAULT_SEAT);
 	return { id: `${SEAT_ID_PREFIX}${seat.toLowerCase()}`, label: seat };

package/extensions/board/snapshot.ts

@@ -35,6 +35,7 @@ export async function viewOf(context: SnapshotContext): Promise<BoardView> {
 		cards: await context.store.list(),
 		now: context.now(),
 		bytes: await context.store.bytes(),
+		skipped: (await context.store.skipped()).length,
 		where: context.store.where(),
 		...(roster === undefined ? {} : { roster }),
 	});

package/extensions/board/tools.ts

@@ -20,17 +20,42 @@ import { type CardOp, holds } from "../../lib/board/rules.ts";
 import { buildRound } from "../../lib/board/round.ts";
 import type { BoardStore } from "../../lib/board/store.ts";
 import { messageOf } from "../../lib/errors.ts";
+import { revParse } from "../../lib/git/read.ts";
+import { strayField } from "../../lib/stray-fields.ts";
+import { createExecRunner } from "../../lib/git/runner.ts";
 import { failedResult, textResult } from "../../lib/tool-result.ts";
 import { reuseText, toolDetails } from "../../lib/tui/chrome.ts";
 import { callLine, detailsOrLine } from "../../lib/tui/tool.ts";
 import { formatRound } from "../../lib/board/round-text.ts";
-import { formatCard, formatCards, formatDropped } from "./format.ts";
+import {
+	archiveNote,
+	formatArchive,
+	formatArchived,
+	formatBoard,
+	formatCard,
+	formatDropped,
+	formatSkipped,
+} from "./format.ts";
 import { createTeamJoin, type TeamJoin } from "../../lib/session-tool.ts";
 import { BoardResult, collapsedLine, resultInput } from "./result.ts";
 import { createInput } from "./input.ts";
 import type { BoardSession } from "../../lib/board/session.ts";
 import { BoardParams } from "./schema.ts";
-import { BOARD_ACTIONS, BOARD_TOOL, type BoardAction, type BoardDetails, normalizeBoardAction } from "./types.ts";
+import {
+	ACTION_FIELDS,
+	BOARD_ACTION_DOCS,
+	BOARD_ACTIONS,
+	BOARD_MUTATING_ACTIONS,
+	BOARD_TOOL,
+	type BoardAction,
+	type BoardDetails,
+	normalizeBoardAction,
+} from "./types.ts";
+
+/** The verbs as one sentence, in `BOARD_ACTIONS` order; the table owns the words. */
+function verbHelp(): string {
+	return `${BOARD_ACTIONS.map((action) => `\`${action}\` ${BOARD_ACTION_DOCS[action]}`).join("; ")}.`;
+}
 
 /** The parameters as the schema validates them. */
 type BoardArgs = Static<typeof BoardParams>;
@@ -71,8 +96,18 @@ function refusal(action: BoardAction, me: BoardDetails["me"], message: string, c
 	});
 }
 
-/** The actions that need this session to be a teammate: everything but a read. */
-const MUTATING_ACTIONS = new Set<BoardAction>(BOARD_ACTIONS.filter((action) => action !== "list"));
+/**
+ * The commit at `cwd`'s `HEAD`, shortened, or nothing when there is none.
+ *
+ * A finished card records what closed it, and the commit is the one fact a repository can
+ * answer that the card cannot. A directory that is not a repository, or one with no
+ * commits, answers nothing — the move still happens, because finishing a card must not
+ * depend on git.
+ */
+async function headCommit(pi: ExtensionAPI, cwd: string): Promise<{ commit: string } | undefined> {
+	const id = await revParse(createExecRunner(pi), cwd, "HEAD");
+	return id === undefined ? undefined : { commit: id.slice(0, 7) };
+}
 
 export function registerTools(pi: ExtensionAPI, runtime: BoardSession, deps: { team?: TeamJoin } = {}): void {
 	const team = deps.team ?? createTeamJoin(pi);
@@ -82,16 +117,9 @@ export function registerTools(pi: ExtensionAPI, runtime: BoardSession, deps: { t
 		description:
 			"The shared feature list for this repository: one card per feature, which any session reads and writes. " +
 			"A card carries the feature's outcome, the session that holds it, path hints, the plan it is executing, " +
-			"its priority, what it waits for, and its notes. `list` shows the board (`status` filters one lane, " +
-			"`mine` shows only what this session holds, `query` matches a title, a path hint, or a holder, `card` shows one card, `round` adds the lead's rollup " +
-			"of owners, unassigned, unplanned, blocked, and idle - the rollup always covers the whole board). `add` " +
-			"creates a `todo` card; `claim` takes one for this session; `release` gives it back; `reclaim` takes it " +
-			"from whoever holds it; `move` changes lane; `note` appends to its history; `plan` records the plan file " +
-			"being executed; `edit` fixes what the card says (title, paths, priority, and the cards it waits for); " +
-			"`drop` deletes a `todo`, a `done`, or one you hold. A card's steps do not belong on the board - they " +
-			"belong in the plan and in `todo`.",
-		promptSnippet:
-			"The shared feature list for this repository: list, add, claim, release, reclaim, move, note, plan, edit, drop.",
+			`its priority, what it waits for, and its notes. ${verbHelp()} A card's steps do not belong on the ` +
+			"board - they belong in the plan and in `todo`.",
+		promptSnippet: `The shared feature list for this repository: ${BOARD_ACTIONS.join(", ")}.`,
 		promptGuidelines: [
 			"Claim a card before working on it; release or finish it when you stop, and reclaim a card whose owner is gone.",
 			"Record the plan file with `board` action `plan` once the plan is approved, then execute it.",
@@ -117,11 +145,15 @@ export function registerTools(pi: ExtensionAPI, runtime: BoardSession, deps: { t
 			}
 			const me = runtime.who(ctx, ctx.cwd);
 			try {
+				// Before the join and the store: a refused call has done nothing, so it cannot
+				// have enlisted this session as a teammate on its way to the refusal.
+				const stray = strayField(action, args, ACTION_FIELDS);
+				if (stray !== undefined) return refusal(action, me, stray);
 				// Working a card makes this session a teammate, once: the board is the user's
 				// surface for the team, so nobody has to know the bus exists. A failed join is
 				// not a failed card write — the board works with no bus at all — and it is not
 				// marked, so the next write asks again.
-				if (MUTATING_ACTIONS.has(action) && !runtime.joined()) {
+				if (BOARD_MUTATING_ACTIONS.has(action) && !runtime.joined()) {
 					if ((await team.join(ctx)).ok) runtime.markJoined();
 				}
 				const store = await runtime.store(ctx.cwd);
@@ -147,7 +179,16 @@ export function registerTools(pi: ExtensionAPI, runtime: BoardSession, deps: { t
 								'move needs a target lane: "doing", "blocked", or "done". Use release to return a card to todo.',
 							);
 						}
-						return await mutate(store, action, me, now, args, { kind: "move", status });
+						// Only the lane that has something to say reads for it: a move to `done`
+						// records the commit that closed the card, and a board outside a
+						// repository simply has none to record.
+						const landed = status === "done" ? await headCommit(pi, ctx.cwd) : undefined;
+						return await mutate(store, action, me, now, args, {
+							kind: "move",
+							status,
+							...(args.blockedBy === undefined ? {} : { blockedBy: args.blockedBy }),
+							...(landed === undefined ? {} : { landed }),
+						});
 					}
 					case "note":
 						return await mutate(store, action, me, now, args, { kind: "note", text: args.text });
@@ -172,6 +213,8 @@ export function registerTools(pi: ExtensionAPI, runtime: BoardSession, deps: { t
 					}
 					case "drop":
 						return await dropCard(store, me, args, now);
+					case "archive":
+						return await archiveCards(store, me, args, now);
 				}
 			} catch (error) {
 				return refusal(action, me, messageOf(error));
@@ -204,7 +247,7 @@ export function registerTools(pi: ExtensionAPI, runtime: BoardSession, deps: { t
 	});
 }
 
-/** `list`: the board, one card, or the lead's rollup. */
+/** `list`: the board, one card, the lead's rollup, or the archive. */
 async function read(
 	store: BoardStore,
 	action: BoardAction,
@@ -212,13 +255,32 @@ async function read(
 	args: BoardArgs,
 	now: number,
 ): Promise<ReturnType<typeof textResult<BoardDetails>>> {
+	if (args.archived === true) return readArchive(store, action, me, args, now);
 	const cards = await store.list();
+	// Read once: a card file the reader refused is the difference between "not there"
+	// and "there, and this build cannot read it".
+	const skipped = await store.skipped();
+	// A directory listing, not a read: a listing says what it left aside without opening one.
+	const archived = await store.archivedCount();
 	if (args.card !== undefined) {
 		const id = normalizeCardId(args.card);
 		if (id === undefined) return refusal(action, me, `"${args.card}" is not a card id.`);
 		const card = cards.find((entry) => entry.id === id);
-		if (!card) return refusal(action, me, `${cardRef(id)} does not exist.`);
-		return textResult(formatCard(card, indexOf(cards)), { action, me, card });
+		if (!card) {
+			// Gone and set aside are different answers, and one read by id tells them apart.
+			if ((await store.read(id)) !== undefined) {
+				return refusal(action, me, `${cardRef(id)} is archived; pass archived: true to read it.`);
+			}
+			const unreadable = skipped.find((entry) => entry.id === id);
+			return refusal(
+				action,
+				me,
+				unreadable === undefined
+					? `${cardRef(id)} does not exist.`
+					: `${cardRef(id)} is there and this build cannot read it (${unreadable.file}: ${unreadable.why}).`,
+			);
+		}
+		return textResult(formatCard(card, indexOf(cards), now), { action, me, card });
 	}
 	const listed = cards.filter(
 		(card) =>
@@ -228,9 +290,65 @@ async function read(
 			// session could not release.
 			(args.mine !== true || holds(card, me)),
 	);
-	if (args.round !== true) return textResult(formatCards(listed), { action, me, cards: listed });
+	// A finished card is history rather than work, and nothing prunes it — this
+	// repository's own board is mostly finished cards — so a listing that names no lane
+	// leaves them out and says how many. A named lane, `card`, and `round` are unchanged;
+	// the rollup counts the whole board, which is what makes it a rollup.
+	const hiddenDone = args.status === undefined ? listed.filter((card) => card.status === "done").length : 0;
+	const shown = hiddenDone === 0 ? listed : listed.filter((card) => card.status !== "done");
+	if (args.round !== true) {
+		return textResult(formatBoard(shown, { hiddenDone, archived, skipped }), { action, me, cards: shown });
+	}
 	const round = buildRound(cards, now);
-	return textResult(formatRound(cards, round), { action, me, cards: listed, round });
+	// One line under the rollup, because a reader who cannot see a card file should know why,
+	// and one for the archive, because a rollup that silently left it out would be a board
+	// smaller than the one on disk.
+	const notes = [formatSkipped(skipped), archiveNote(archived)].filter((line) => line !== "");
+	const text = [formatRound(cards, round), ...notes].join("\n");
+	return textResult(text, { action, me, cards: listed, round });
+}
+
+/**
+ * `list archived: true`: the cards set aside, which no board read opens.
+ *
+ * A lane and a rollup are answers about the board, so asking for the archive with either
+ * is refused rather than quietly ignored: the pile is one thing, and every card in it is
+ * finished. A query and `mine` narrow it, because both are questions about a card.
+ */
+async function readArchive(
+	store: BoardStore,
+	action: BoardAction,
+	me: BoardDetails["me"],
+	args: BoardArgs,
+	now: number,
+): Promise<ReturnType<typeof textResult<BoardDetails>>> {
+	const wrong = (["status", "round"] as const).filter((field) => args[field] !== undefined);
+	if (wrong.length > 0) {
+		return refusal(
+			action,
+			me,
+			`archived does not read ${wrong.join(", ")}: the archive is one pile of finished cards, out of the board.`,
+		);
+	}
+	const pile = await store.archived();
+	if (args.card !== undefined) {
+		const id = normalizeCardId(args.card);
+		if (id === undefined) return refusal(action, me, `"${args.card}" is not a card id.`);
+		const card = pile.cards.find((entry) => entry.id === id);
+		if (!card) {
+			const onBoard = (await store.list()).some((entry) => entry.id === id);
+			return refusal(
+				action,
+				me,
+				onBoard ? `${cardRef(id)} is on the board, not in the archive.` : `${cardRef(id)} is not in the archive.`,
+			);
+		}
+		return textResult(formatCard(card, indexOf(pile.cards), now), { action, me, card });
+	}
+	const shown = pile.cards.filter(
+		(card) => (args.query === undefined || matchesQuery(card, args.query)) && (args.mine !== true || holds(card, me)),
+	);
+	return textResult(formatArchive(shown, pile.skipped), { action, me, cards: shown });
 }
 
 /** `add`: the only action that creates a card. */
@@ -263,6 +381,53 @@ async function mutate(
 	return textResult(formatCard(result.card), { action, me, card: result.card });
 }
 
+/**
+ * `archive`: a finished card leaves the board without being destroyed.
+ *
+ * One card, or — with no card named — every finished card, because clearing a board is
+ * the errand and a lead should not have to run sixty calls to do it. Each move is its own
+ * compare-and-set, so a sweep is best-effort: it reports what it actually set aside.
+ */
+async function archiveCards(
+	store: BoardStore,
+	me: BoardDetails["me"],
+	args: BoardArgs,
+	now: number,
+): Promise<ReturnType<typeof textResult<BoardDetails>>> {
+	if (args.card !== undefined) {
+		const id = normalizeCardId(args.card);
+		if (id === undefined) return refusal("archive", me, `"${args.card}" is not a card id.`);
+		const result = await store.mutate(id, { kind: "archive" }, me, now);
+		if (!result.ok) return refusal("archive", me, result.error, result.card);
+		// Asked twice is one state, not an error: the card is where the caller wanted it.
+		if (!result.changed) return textResult(`${cardRef(id)} is already archived.`, { action: "archive", me });
+		return textResult(formatArchived([id]), { action: "archive", me, card: result.card, archived: [id] });
+	}
+	const finished = (await store.list()).filter((card) => card.status === "done");
+	const moved: string[] = [];
+	const failed: Array<{ card: string; error: string }> = [];
+	for (const card of finished) {
+		const result = await store.mutate(card.id, { kind: "archive" }, me, now);
+		if (result.ok && result.changed) moved.push(card.id);
+		// A sweep is best-effort, and a card that changed underneath it is the one thing it
+		// cannot report by silence: "every finished card" must not read as fewer, unexplained.
+		else if (!result.ok) failed.push({ card: card.id, error: result.error });
+	}
+	if (moved.length === 0 && failed.length === 0) {
+		return textResult("No finished cards to archive.", { action: "archive", me });
+	}
+	const text = [
+		...(moved.length === 0 ? [] : [formatArchived(moved)]),
+		...failed.map((entry) => `${cardRef(entry.card)} was not archived (${entry.error})`),
+	].join(" · ");
+	return textResult(text, {
+		action: "archive",
+		me,
+		...(moved.length === 0 ? {} : { archived: moved }),
+		...(failed.length === 0 ? {} : { failed }),
+	});
+}
+
 /** `drop`: the card and its notes leave together, so the report is the id. */
 async function dropCard(
 	store: BoardStore,

package/extensions/board/transport/router.ts

@@ -2,14 +2,14 @@
  * The board page's router: one request in, one response out, and every policy the
  * served surface obeys decided here.
  *
- * The page can read and it can write, so it is checked the way `plan`'s review page
- * is: a token in the URL, the `Host` allowlist, an origin check on every
- * state-changing method, and a JSON body. The guards themselves are `lib/http`'s —
- * this module only decides the order and the sentences.
+ * The page reads. It cannot change a card, so what is left to decide is the `Host`
+ * allowlist, the token in the URL, and which reads exist — a method that would write is
+ * refused by the method list before a handler is reached. The guards themselves are
+ * `lib/http`'s — this module only decides the order and the sentences.
  *
- * Nothing here knows what a board is. The snapshot arrives as `view()`, a write as
- * `write()`, and the document as `page()`, all supplied by `page.ts`, so this file
- * can be tested with a fake store and no server.
+ * Nothing here knows what a board is. The snapshot arrives as `view()` and the document
+ * as `page()`, both supplied by `page.ts`, so this file can be tested with a fake store
+ * and no server.
  */
 
 import {
@@ -18,72 +18,48 @@ import {
 	jsonError,
 	jsonResponse,
 	pageHeaders,
-	PAGE_METHODS,
 	parseRequestUrl,
-	postOnly,
-	requireJsonBody,
 	scriptHeaders,
 	type ServeResponse,
 } from "../../../lib/http/index.ts";
 import type { BoardView } from "../../../lib/board/view.ts";
-import type { Card } from "../../../lib/board/card.ts";
 import { THEME_JS, THEME_JS_PATH } from "../../../lib/web/index.ts";
 import type { PageView } from "../view/page.ts";
 
-/** The methods this surface serves: reads, writes, and the one deletion. */
-const METHODS: readonly string[] = [...PAGE_METHODS, "DELETE"];
-
 /**
- * What a credential may do on this page.
+ * The methods this surface serves: the two reads and the stream.
  *
- * A page can be opened by the session that serves it and by a teammate watching it, and
- * the two carry different tokens: `write` may change a card, `view` may only read. The
- * split is a value here and not a boolean threaded through the page, so a route asks one
- * function instead of remembering which token it was given.
+ * `PAGE_METHODS` also carries `POST`, because a page that writes needs it. This one does
+ * not, so a write is refused by the envelope — before the token is even read — and the
+ * `Allow` header says the truth about what a browser can do here.
  */
-export type Authority = "write" | "view";
-
-/** The verbs a card route accepts, in the order the page uses them. */
-const CARD_VERBS = ["claim", "release", "reclaim", "assign", "move", "note", "plan", "edit"] as const;
-
-/** One card verb. */
-export type CardVerb = (typeof CARD_VERBS)[number];
-
-/** One write the page asks for, already routed but not yet applied. */
-export type PageWrite =
-	| { kind: "add"; body: Record<string, unknown> }
-	| { kind: "drop"; id: string }
-	| { kind: CardVerb; id: string; body: Record<string, unknown> };
-
-/** What a write did, or why it was refused with the status the page shows. */
-export type PageResult = { ok: true; card: Card } | { ok: false; status: number; error: string; card?: Card };
+const METHODS: readonly string[] = ["GET", "HEAD"];
 
 /** Everything the router needs from the running page. */
 export interface BoardRouterContext {
-	/** What the request's token may do here, or undefined when it is not a token of this page. */
-	authority: (given: string | null) => Authority | undefined;
+	/** Whether a token is this page's. */
+	read: (given: string | null) => boolean;
 	/** The names this server answers to. */
 	hosts: () => readonly string[];
-	/** The document for one tab, as the authority that asked for it may see it. */
-	page: (view: PageView, authority: Authority) => Promise<string>;
+	/** The document for one tab. */
+	page: (view: PageView) => Promise<string>;
 	/** The client script. */
 	script: string;
 	/** The snapshot the page renders, and the body of `/api/board`. */
 	view: () => Promise<BoardView>;
-	/** Apply one write as the serving session. */
-	write: (request: PageWrite) => Promise<PageResult>;
 }
 
+/** The cheap liveness route: a probe reads this, and never the snapshot. */
+export const PING_PATH = "/api/ping";
+
 /**
- * Handle one request. `method`, `rawUrl`, and `headers` are the raw HTTP values;
- * `body` is the request body, which is only non-empty when the server caps it.
+ * Handle one request. `method`, `rawUrl`, and `headers` are the raw HTTP values.
  */
 export async function handleBoardRequest(
 	ctx: BoardRouterContext,
 	method: string,
 	rawUrl: string,
 	headers: Record<string, string | string[] | undefined> = {},
-	body = "",
 ): Promise<ServeResponse> {
 	const envelope = envelopeRefusal({ method, headers, hosts: ctx.hosts(), allowed: METHODS });
 	if (envelope) return envelope;
@@ -92,81 +68,24 @@ export async function handleBoardRequest(
 	if (!parsed) return jsonError(400, "Malformed request URL.");
 	const { pathname, search } = parsed;
 
-	if (pathname === "/favicon.ico") return { status: 204, headers: { "Cache-Control": "no-store" } };
 	if (pathname === THEME_JS_PATH) return { status: 200, headers: scriptHeaders(), body: THEME_JS };
 	if (pathname === "/app.js") return { status: 200, headers: scriptHeaders(), body: ctx.script };
 
-	const authority = ctx.authority(search.get("token"));
-	if (authority === undefined) return jsonError(403, "Invalid or missing token.");
+	if (!ctx.read(search.get("token"))) return jsonError(403, "Invalid or missing token.");
 
+	// The liveness answer, and nothing else: a session deciding whether this page is alive
+	// must not pay for the snapshot, which is a store read and a roster read on the same
+	// event loop the probe is racing.
+	if (pathname === PING_PATH) return jsonResponse(200, { ok: true });
 	if (pathname === "/api/board") return jsonResponse(200, await ctx.view());
 	if (pathname === "/" || pathname === "/index.html") {
-		const view = viewOf(search.get("view"));
-		return { status: 200, headers: pageHeaders(), body: await ctx.page(view, authority) };
+		return { status: 200, headers: pageHeaders(), body: await ctx.page(viewOf(search.get("view"))) };
 	}
 	if (pathname === "/events") return { status: 200, headers: eventHeaders(), stream: true };
-
-	// Everything below changes a card, so a credential that may only read stops here.
-	const readOnly = writeGuard(authority);
-	if (readOnly) return readOnly;
-
-	if (pathname === "/api/cards") {
-		const methodRefusal = postOnly(method, "add a card");
-		if (methodRefusal) return methodRefusal;
-		const jsonRefusal = requireJsonBody(headers["content-type"]);
-		if (jsonRefusal) return jsonRefusal;
-		const parsedBody = parseBody(body);
-		if (!parsedBody) return jsonError(400, "The request body must be a JSON object.");
-		return writeAnswer(await ctx.write({ kind: "add", body: parsedBody }));
-	}
-
-	const route = /^\/api\/cards\/([^/]+)(?:\/([^/]+))?$/.exec(pathname);
-	if (!route) return jsonError(404, "That page does not exist.");
-	const id = decodeURIComponent(route[1] ?? "");
-	const verb = route[2];
-
-	if (verb === undefined) {
-		if (method.toUpperCase() !== "DELETE") return jsonError(405, "Use DELETE to drop a card.");
-		return writeAnswer(await ctx.write({ kind: "drop", id }));
-	}
-	if (!CARD_VERBS.includes(verb as CardVerb)) return jsonError(404, "That card action does not exist.");
-	const methodRefusal = postOnly(method, verb);
-	if (methodRefusal) return methodRefusal;
-	const jsonRefusal = requireJsonBody(headers["content-type"]);
-	if (jsonRefusal) return jsonRefusal;
-	const parsedBody = parseBody(body);
-	if (!parsedBody) return jsonError(400, "The request body must be a JSON object.");
-	return writeAnswer(await ctx.write({ kind: verb as CardVerb, id, body: parsedBody }));
-}
-
-/** The 403 for a credential that may read this page but not change it. */
-function writeGuard(authority: Authority): ServeResponse | undefined {
-	if (authority === "write") return undefined;
-	return jsonError(403, "This page is read-only for a viewer.");
+	return jsonError(404, "That page does not exist.");
 }
 
 /** The tab a `?view=` names; anything else is the board. */
 function viewOf(raw: string | null): PageView {
 	return raw === "team" ? "team" : "board";
 }
-
-/** A request body as an object, or undefined when it is not one. */
-function parseBody(body: string): Record<string, unknown> | undefined {
-	let parsed: unknown;
-	try {
-		parsed = JSON.parse(body);
-	} catch {
-		return undefined;
-	}
-	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return undefined;
-	return parsed as Record<string, unknown>;
-}
-
-/** A write's answer: the card, or the refusal and the card it left alone. */
-function writeAnswer(result: PageResult): ServeResponse {
-	if (result.ok) return jsonResponse(200, { card: result.card });
-	return jsonResponse(
-		result.status,
-		result.card === undefined ? { error: result.error } : { error: result.error, card: result.card },
-	);
-}