@kikimoradev/kcloud 1.0.4 → 1.2.0

package/dist/main.js

@@ -518,7 +518,9 @@ const runCli = dispatcherOf(spec);
 //#endregion
 //#region ../../packages/contracts/src/patterns.ts
 const slugPattern = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;
+const uuidShapePattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 const hexColorPattern = /^#[0-9a-f]{6}$/;
+const logoHashPattern = /^[0-9a-f]{64}$/;
 const userCodePattern = /^[23456789BCDFGHJKLMNPQRSTVWXZ]{4}-[23456789BCDFGHJKLMNPQRSTVWXZ]{4}$/;
 const versionTagPattern = /^(?:0|[1-9]\d{0,8})\.(?:0|[1-9]\d{0,8})\.(?:0|[1-9]\d{0,8})$/;
 const effortLevelSchema = z.enum([
@@ -661,6 +663,22 @@ const credentialMetadataSchema = z.object({
 	checkedAt: z.iso.datetime().optional(),
 	failureReason: z.string().optional()
 }).meta({ id: "CredentialMetadata" });
+const usageWindowStatusSchema = z.enum([
+	"allowed",
+	"allowed_warning",
+	"rejected"
+]);
+const usageWindowSchema = z.object({
+	utilization: z.number().nonnegative(),
+	resetsAt: z.iso.datetime().nullable(),
+	status: usageWindowStatusSchema.nullable()
+}).meta({ id: "UsageWindow" });
+const subscriptionUsageSchema = z.object({
+	fiveHour: usageWindowSchema.nullable(),
+	sevenDay: usageWindowSchema.nullable(),
+	readAt: z.iso.datetime(),
+	stale: z.boolean()
+}).meta({ id: "SubscriptionUsage" });
 const credentialSchema = z.object({
 	id: idSchema,
 	projectId: idSchema,
@@ -671,6 +689,8 @@ const credentialSchema = z.object({
 	verification: verificationStatusSchema,
 	metadata: credentialMetadataSchema,
 	expiresAt: z.iso.datetime().nullable(),
+	expiresAtComputed: z.boolean(),
+	usage: subscriptionUsageSchema.nullable(),
 	createdAt: z.iso.datetime(),
 	updatedAt: z.iso.datetime()
 }).meta({ id: "Credential" });
@@ -739,6 +759,7 @@ const errorCodes = Object.keys({
 	"credential.in_use": "conflict",
 	"credential.kind_mismatch": "rule_violation",
 	"credential.rejected": "rule_violation",
+	"credential.usage_unavailable": "rule_violation",
 	"repository.not_found": "not_found",
 	"repository.already_registered": "conflict",
 	"repository.in_use": "conflict",
@@ -781,9 +802,13 @@ const errorCodes = Object.keys({
 	"runtime.monitor_draining": "conflict",
 	"runtime.monitor_limited": "conflict",
 	"runtime.monitor_check_unsupported": "rule_violation",
+	"runtime.task_deletion_unsupported": "rule_violation",
+	"task.not_found": "not_found",
+	"task.not_finished": "conflict",
 	"node.not_found": "not_found",
 	"node.name_taken": "conflict",
 	"node.offline": "rule_violation",
+	"node.outdated": "rule_violation",
 	"node.not_registered": "rule_violation",
 	"node.registration_invalid": "unauthenticated",
 	"node.registration_used": "conflict",
@@ -801,7 +826,6 @@ const errorCodes = Object.keys({
 	"node.size_unavailable": "rule_violation",
 	"node.size_not_larger": "rule_violation",
 	"node.region_unavailable": "rule_violation",
-	"node.import_refused": "rule_violation",
 	"provider.not_found": "not_found",
 	"provider.name_taken": "conflict",
 	"provider.in_use": "conflict",
@@ -815,20 +839,18 @@ const errorCodes = Object.keys({
 	"infrastructure.provider_error": "internal",
 	"infrastructure.operation_in_progress": "conflict",
 	"infrastructure.host_ops_disabled": "rule_violation",
-	"infrastructure.backups_unavailable": "rule_violation",
-	"infrastructure.maintenance_in_progress": "conflict",
-	"infrastructure.maintenance_not_in_progress": "conflict",
 	"backup.not_found": "not_found",
 	"backup.in_progress": "conflict",
 	"backup.unavailable": "rule_violation",
 	"backup.corrupt": "rule_violation",
 	"backup.undecryptable": "rule_violation",
-	"platform.version_unknown": "rule_violation",
-	"platform.same_version": "rule_violation",
-	"platform.image_unresolved": "rule_violation",
-	"platform.scripts_outdated": "rule_violation",
 	"volume.invalid_size": "rule_violation",
-	"notification.not_found": "not_found"
+	"notification.not_found": "not_found",
+	"logo.not_found": "not_found",
+	"logo.unreadable": "rule_violation",
+	"logo.too_small": "rule_violation",
+	"logo.too_large": "rule_violation",
+	"logo.type_mismatch": "rule_violation"
 });
 const errorCodeSchema = z.enum(errorCodes);
 const errorDetailsSchema = z.record(z.string(), z.union([
@@ -1211,11 +1233,6 @@ z.object({
 		sidecarsRunning: z.int().nonnegative(),
 		volumeBytes: z.int().nonnegative().nullable()
 	}),
-	sessionLogs: z.object({
-		prunedDirectories: z.int().nonnegative(),
-		lastPrunedAt: z.iso.datetime().nullable(),
-		failures: z.int().nonnegative()
-	}),
 	metrics: runtimeMetricsSchema,
 	deadLetters: z.array(deadLetterQueueSchema),
 	degradedAgents: z.array(degradedAgentSchema)
@@ -1235,10 +1252,16 @@ const agentEventSummarySchema = z.object({
 	durationMs: z.int().nullable(),
 	payload: z.record(z.string(), z.unknown())
 }).meta({ id: "AgentEventSummary" });
+const agentEventLimitSchema = z.coerce.number().int().min(1).max(500).default(200);
 z.object({
 	since: z.string().max(64).optional(),
-	limit: z.coerce.number().int().min(1).max(500).default(200)
+	limit: agentEventLimitSchema
 });
+z.object({
+	before: z.string().max(64).optional(),
+	limit: agentEventLimitSchema
+});
+pageSchema(agentEventSummarySchema).meta({ id: "LiveHistoryPage" });
 const taskStatuses = [
 	"pending",
 	"in_progress",
@@ -1247,6 +1270,13 @@ const taskStatuses = [
 	"cancelled"
 ];
 const taskStatusSchema = z.enum(taskStatuses);
+const finalTaskStatuses = [
+	"done",
+	"failed",
+	"cancelled"
+];
+const finalTaskStatusSchema = z.enum(finalTaskStatuses);
+const taskDeletionKikimoraVersion = "0.14.0";
 const maxTaskDescriptionLength = 4e3;
 const agentTaskSchema = z.object({
 	id: z.string(),
@@ -1262,15 +1292,31 @@ const agentTaskSchema = z.object({
 	startedAt: z.iso.datetime().nullable(),
 	finishedAt: z.iso.datetime().nullable()
 }).meta({ id: "AgentTask" });
+const agentTaskSourceSchema = z.enum(["worker", "projection"]);
+const agentTaskStaleReasonSchema = z.enum([
+	"unreachable",
+	"timeout",
+	"stopped"
+]).nullable();
+const taskCountsSchema = z.object({
+	pending: z.int().nonnegative(),
+	in_progress: z.int().nonnegative(),
+	done: z.int().nonnegative(),
+	failed: z.int().nonnegative(),
+	cancelled: z.int().nonnegative()
+}).meta({ id: "TaskCounts" });
 z.object({
 	items: z.array(agentTaskSchema),
-	source: z.enum(["worker", "projection"]),
-	staleReason: z.enum([
-		"unreachable",
-		"timeout",
-		"stopped"
-	]).nullable()
+	nextCursor: z.string().nullable(),
+	counts: taskCountsSchema.nullable(),
+	source: agentTaskSourceSchema,
+	staleReason: agentTaskStaleReasonSchema
 }).meta({ id: "AgentTaskList" });
+z.object({
+	task: agentTaskSchema,
+	source: agentTaskSourceSchema,
+	staleReason: agentTaskStaleReasonSchema
+}).meta({ id: "AgentTaskView" });
 z.object({
 	title: z.string().trim().min(1).max(200).optional(),
 	description: z.string().trim().min(1).max(maxTaskDescriptionLength)
@@ -1279,7 +1325,9 @@ z.object({
 	state: z.enum(["requested", "running"]),
 	cycle: z.int().nonnegative().nullable()
 }).meta({ id: "MonitorCheck" });
-z.object({ status: taskStatusSchema.optional() });
+cursorQuerySchema.extend({ status: taskStatusSchema.optional() });
+z.object({ status: finalTaskStatusSchema });
+z.object({ deleted: z.array(z.string()) }).meta({ id: "AgentTasksDeleted" });
 z.object({
 	id: idSchema,
 	taskId: z.string().min(1).max(128)
@@ -1407,17 +1455,21 @@ const memorySummarySchema = z.object({
 	sessionId: z.string().nullable(),
 	createdAt: z.iso.datetime()
 }).meta({ id: "MemorySummary" });
-z.object({
-	items: z.array(memorySummarySchema),
+const memoryOutcomes = ["succeeded", "failed"];
+const memoryOutcomeSchema = z.enum(memoryOutcomes);
+pageSchema(memorySummarySchema).extend({
 	source: z.enum(["worker", "unavailable"]),
 	staleReason: z.enum([
 		"unreachable",
 		"timeout",
 		"stopped"
-	]).nullable()
-}).meta({ id: "AgentMemoryList" });
+	]).nullable(),
+	truncated: z.boolean()
+}).meta({ id: "AgentMemoryPage" });
 z.object({
 	q: z.string().max(200).optional(),
+	outcome: memoryOutcomeSchema.optional(),
+	cursor: cursorSchema.optional(),
 	limit: z.coerce.number().int().min(1).max(100).default(20)
 });
 const costPointSchema = z.object({
@@ -1530,7 +1582,7 @@ z.object({
 	organizationId: idSchema,
 	accountId: idSchema
 });
-z.enum(["monitor", "executor"]);
+const sessionRoleSchema = z.enum(["monitor", "executor"]);
 const sessionSlotCountSchema = z.int().min(1).max(64);
 const sessionQueueEntrySchema = z.object({
 	agentId: idSchema,
@@ -1539,8 +1591,21 @@ const sessionQueueEntrySchema = z.object({
 	projectName: z.string().nullable(),
 	position: z.int().positive(),
 	since: z.iso.datetime(),
-	taskId: z.string().nullable()
+	taskId: z.string().nullable(),
+	taskTitle: z.string().nullable(),
+	readable: z.boolean()
 }).meta({ id: "SessionQueueEntry" });
+const sessionHolderSchema = z.object({
+	agentId: idSchema,
+	agentName: z.string().nullable(),
+	projectId: idSchema.nullable(),
+	projectName: z.string().nullable(),
+	since: z.iso.datetime().nullable(),
+	taskId: z.string().nullable(),
+	taskTitle: z.string().nullable(),
+	readable: z.boolean(),
+	pid: z.int().positive().nullable()
+}).meta({ id: "SessionHolder" });
 const sessionPoolSchema = z.object({
 	slots: sessionSlotCountSchema.nullable(),
 	effective: z.int().nonnegative(),
@@ -1567,6 +1632,12 @@ const agentAdmissionSchema = z.object({
 	monitor: agentAdmissionStateSchema.nullable(),
 	executor: agentAdmissionStateSchema.nullable()
 }).meta({ id: "AgentAdmission" });
+const admissionHoldSchema = z.object({
+	pools: z.array(sessionRoleSchema),
+	sessions: z.int().nonnegative(),
+	target: z.string().nullable(),
+	updating: z.boolean()
+}).meta({ id: "AdmissionHold" });
 const nodeStateSchema = z.enum([
 	"pending",
 	"online",
@@ -1641,6 +1712,7 @@ const nodePoolSchema = z.object({
 	slots: z.int().nonnegative(),
 	inUse: z.int().nonnegative(),
 	waiting: z.array(sessionQueueEntrySchema),
+	holders: z.array(sessionHolderSchema).nullable(),
 	usage: poolUsageSchema.nullable()
 }).meta({ id: "NodePool" });
 const nodePoolsSchema = z.object({
@@ -1726,6 +1798,7 @@ const nodeUpdateSchema = z.object({
 	target: z.string().nullable(),
 	sessions: z.int().nonnegative(),
 	since: z.iso.datetime().nullable(),
+	held: z.array(sessionRoleSchema),
 	last: z.object({
 		outcome: z.enum([
 			"updated",
@@ -1860,16 +1933,26 @@ const splitFits = (split, host) => {
 	return overflow.cpus <= 0 && overflow.memoryMb <= 0;
 };
 //#endregion
+//#region ../../packages/contracts/src/appearance.ts
+const colorSchema = z.string().regex(hexColorPattern);
+const logoMaxBytes = 524288;
+const logoHashSchema = z.string().regex(logoHashPattern);
+z.instanceof(Uint8Array).meta({ description: "The bytes of a PNG, JPEG or WebP image." });
+z.instanceof(Uint8Array).meta({ description: "The bytes of the WebP image." });
+z.object({ v: logoHashSchema.optional() });
+//#endregion
 //#region ../../packages/contracts/src/identity.ts
 const emailSchema = z.email().max(254);
 const passwordSchema = z.string().min(12).max(128);
 const userStatusSchema = z.enum(["active", "disabled"]);
 const organizationNameSchema = z.string().trim().min(2).max(80);
-const organizationSlugSchema = z.string().regex(slugPattern);
+const organizationSlugSchema = z.string().regex(slugPattern).refine((slug) => !uuidShapePattern.test(slug));
 const organizationSchema = z.object({
 	id: idSchema,
 	name: z.string(),
 	slug: organizationSlugSchema,
+	color: colorSchema,
+	logoHash: logoHashSchema.nullable(),
 	createdAt: z.iso.datetime()
 }).meta({ id: "Organization" });
 z.object({ items: z.array(organizationSchema) }).meta({ id: "OrganizationList" });
@@ -1927,6 +2010,11 @@ z.object({
 		initialPassword: passwordSchema.optional()
 	}).optional()
 }).meta({ id: "CreateOrganizationBody" });
+const updateOrganizationBodySchema = z.object({
+	name: organizationNameSchema,
+	slug: organizationSlugSchema,
+	color: colorSchema
+}).meta({ id: "UpdateOrganizationBody" });
 z.object({ temporaryPassword: z.string() }).meta({ id: "TemporaryPassword" });
 z.object({ items: z.array(userSchema) }).meta({ id: "UserList" });
 z.object({ id: idSchema });
@@ -1995,6 +2083,9 @@ const auditActionSchema = z.enum([
 	"platform.bootstrapped",
 	"organization.created",
 	"organization.renamed",
+	"organization.updated",
+	"organization.logo_set",
+	"organization.logo_removed",
 	"user.created",
 	"user.role_changed",
 	"user.disabled",
@@ -2008,6 +2099,8 @@ const auditActionSchema = z.enum([
 	"token.revoked",
 	"project.created",
 	"project.updated",
+	"project.logo_set",
+	"project.logo_removed",
 	"project.member_added",
 	"project.member_role_changed",
 	"project.member_removed",
@@ -2030,6 +2123,7 @@ const auditActionSchema = z.enum([
 	"agent.action",
 	"agent.backup_requested",
 	"agent.restored",
+	"agent.tasks_deleted",
 	"platform.settings_updated",
 	"runtime.sessions_updated",
 	"platform.upgrade_requested",
@@ -2115,7 +2209,6 @@ pageSchema(auditEntrySchema).meta({ id: "AuditPage" });
 //#endregion
 //#region ../../packages/contracts/src/projects.ts
 const slugSchema = z.string().regex(slugPattern);
-const colorSchema = z.string().regex(hexColorPattern);
 const projectSchema = z.object({
 	id: idSchema,
 	organizationId: idSchema,
@@ -2123,6 +2216,7 @@ const projectSchema = z.object({
 	slug: slugSchema,
 	description: z.string(),
 	color: colorSchema,
+	logoHash: logoHashSchema.nullable(),
 	dockerAllowed: z.boolean(),
 	memberCount: z.int().nonnegative(),
 	createdAt: z.iso.datetime(),
@@ -2551,6 +2645,7 @@ const agentRuntimeSchema = z.object({
 	stopMode: agentStopModeSchema.nullable(),
 	stopDeadlineAt: z.iso.datetime().nullable(),
 	admission: agentAdmissionSchema.nullable(),
+	admissionHold: admissionHoldSchema.nullable(),
 	poolLimit: poolLimitSchema.nullable()
 }).meta({ id: "AgentRuntime" });
 const agentListItemSchema = z.object({
@@ -2899,19 +2994,6 @@ const nodeVolumesSchema = z.discriminatedUnion("source", [z.object({
 	source: z.literal("ok"),
 	items: z.array(nodeVolumeSchema)
 }), unavailableBecause(["not_configured"])]).meta({ id: "NodeVolumes" });
-const dropletSizeSchema = z.object({
-	slug: z.string(),
-	vcpus: z.int().positive(),
-	memoryMb: z.int().positive(),
-	diskGb: z.int().positive(),
-	priceMonthly: z.number().nonnegative(),
-	command: z.string()
-}).meta({ id: "DropletSize" });
-const nodeSizesSchema = z.discriminatedUnion("source", [z.object({
-	source: z.literal("ok"),
-	items: z.array(dropletSizeSchema)
-}), unavailableBecause(providerUnavailableReasons)]).meta({ id: "NodeSizes" });
-const capacityForecastSchema = z.object({ byDisk: z.int().nonnegative().nullable() }).meta({ id: "CapacityForecast" });
 z.object({
 	droplet: nodeDropletSchema,
 	volumes: nodeVolumesSchema,
@@ -2920,23 +3002,16 @@ z.object({
 		data: storageReadingSchema,
 		agents: storageReadingSchema
 	}),
-	sizes: nodeSizesSchema,
 	platform: z.object({
 		version: z.string(),
 		instance: z.string(),
 		scriptsVersion: z.string(),
 		dockerVersion: z.string().nullable(),
 		dockerRootDir: z.string().nullable()
-	}),
-	maintenance: z.object({
-		quiescedAt: instantSchema$1.nullable(),
-		pending: z.array(idSchema)
-	}),
-	capacity: capacityForecastSchema
+	})
 }).meta({ id: "PlatformNode" });
 z.object({ role: volumeRoleSchema });
 z.object({ sizeGb: z.int().positive() }).meta({ id: "ResizeVolumeBody" });
-z.object({ agents: z.int().nonnegative() }).meta({ id: "QuiesceResult" });
 const requesterSchema = z.object({
 	userId: idSchema,
 	label: z.string().nullable()
@@ -3040,22 +3115,17 @@ const registryUnavailableSchema = z.object({
 	detail: z.string().nullable()
 }).meta({ id: "RegistryUnavailable" });
 const hostOperationsAvailabilities = ["enabled", "disabled"];
-const backupsAvailabilities = ["enabled", "unavailable"];
 const installedImageSchema = z.string().regex(pinnedPlatformImagePattern).nullable();
 z.object({
 	version: z.string(),
+	environment: z.string().nullable(),
 	apiImage: installedImageSchema,
 	webImage: installedImageSchema,
 	nodeImage: installedImageSchema,
 	latest: z.string().nullable(),
 	latestError: registryUnavailableSchema.nullable(),
-	versions: z.array(z.string()),
-	upgradeable: z.boolean(),
-	scriptsVersion: z.string(),
-	expectedScriptsVersion: z.string(),
 	imagePrefix: z.string(),
 	hostOperations: z.enum(hostOperationsAvailabilities),
-	backups: z.enum(backupsAvailabilities),
 	operations: z.array(hostOperationSchema)
 }).meta({ id: "Platform" });
 const keyVersionSchema = z.int().positive();
@@ -3078,7 +3148,6 @@ z.object({
 	versions: z.array(masterKeyVersionSchema),
 	rotationPending: z.boolean()
 }).meta({ id: "MasterKey" });
-z.object({ version: z.string().regex(versionTagPattern) }).meta({ id: "UpgradePlatformBody" });
 const metricsRangeSchema = z.enum([
 	"1h",
 	"24h",
@@ -3159,24 +3228,6 @@ z.object({
 }).meta({ id: "AgentMetrics" });
 z.object({ range: metricsRangeSchema });
 z.object({ range: agentMetricsRangeSchema });
-z.object({
-	nodeId: idSchema,
-	agentId: idSchema
-});
-z.object({ agentIds: z.array(idSchema).min(1).max(500) });
-z.object({ occupied: z.array(idSchema) });
-z.object({ offset: z.coerce.number().int().nonnegative() });
-z.object({ bytes: z.int().nonnegative() });
-z.object({
-	bytes: z.int().nonnegative(),
-	sha256: z.string().regex(/^[0-9a-f]{64}$/u)
-});
-z.object({
-	bytes: z.int().nonnegative(),
-	files: z.int().nonnegative(),
-	memoryCheck: z.string()
-});
-z.object({ removed: z.boolean() });
 const notificationKindSchema = z.enum([
 	"credential.verification_failed",
 	"credential.expiring",
@@ -3332,6 +3383,7 @@ const detailsOf$1 = (body) => {
 	const parsed = errorBodySchema.safeParse(body);
 	return parsed.success ? parsed.data.details ?? {} : {};
 };
+const hintText = (hint, details) => typeof hint === "string" ? hint : hint(details);
 //#endregion
 //#region src/client/api.ts
 const defaultTimeoutMs = 3e4;
@@ -3388,7 +3440,7 @@ const createApi = ({ origin, token, fetch = globalThis.fetch, timeoutMs = defaul
 const refused = (action, { error, response }, hints) => {
 	const failure = new ApiError(response.status, codeOf(error), action, detailsOf$1(error));
 	const hint = failure.code === null ? void 0 : hints[failure.code];
-	return hint === void 0 ? failure : new CliError(failure.message, hint, { cause: failure });
+	return hint === void 0 ? failure : new CliError(failure.message, hintText(hint, failure.details), { cause: failure });
 };
 const dataOf = (action, answer, hints = {}) => {
 	if (answer.data === void 0) throw refused(action, answer, hints);
@@ -3760,7 +3812,7 @@ const createLoginCommand = (adaptersOf) => defineCommand({
 	}
 });
 const authorizeInBrowser = async ({ adapters, api, origin, prompt }) => {
-	const started = dataOf("start the sign-in", await api.POST("/auth/cli/authorize", { body: { clientName: adapters.clientName() } }), { "infrastructure.not_configured": `${origin} has no administrator yet; the instance is seeded during kcloud-admin init.` });
+	const started = dataOf("start the sign-in", await api.POST("/auth/cli/authorize", { body: { clientName: adapters.clientName() } }), { "infrastructure.not_configured": `${origin} has no administrator yet; the platform is seeded during pnpm platform bootstrap.` });
 	prompt.note([
 		`Code    ${started.userCode}`,
 		`Address ${started.verificationUri}`,
@@ -4207,10 +4259,15 @@ const runOf = async (adaptersOf, { settings, context }) => {
 //#region src/commands/agents/shared.ts
 const agentOption = { project: { type: "string" } };
 const agentUsage = [["--project <name>", "the project of the agent, when the agent is named alone"]];
+const actionsAfterPause = /* @__PURE__ */ new Set([
+	"update",
+	"restart",
+	"resume"
+]);
 const agentHints = {
 	"agent.not_found": "kcloud agents list --project <name> shows the agents.",
 	"project.not_found": "kcloud projects list shows the projects you are a member of.",
-	"agent.invalid_transition": "kcloud agents show <agent> lists the actions it takes now.",
+	"agent.invalid_transition": ({ state, action }) => state === "pausing" && actionsAfterPause.has(String(action)) ? "The agent finishes its current session before it pauses; the action goes through once kcloud agents show <agent> says paused." : "kcloud agents show <agent> lists the actions it takes now.",
 	"agent.busy": "The agent is working on another action; try again in a moment.",
 	"concurrency.conflict": "Someone changed the agent meanwhile; read it again and retry.",
 	"agent.node_unsuitable": "The node lacks a capability the agent requires; kcloud nodes show <node> lists what it offers.",
@@ -4438,12 +4495,39 @@ const enforcementText = ({ state, reason }) => {
 		case "unsupported": return `The node holds no pool to a limit: ${reason === null ? "it cannot" : unsupportedReasons[reason] ?? reason}.`;
 	}
 };
-const memoryOf = (pool) => {
+const memoryOf$1 = (pool) => {
 	if (pool.usage === null) return "-";
 	const { memoryBytes, memoryMaxBytes } = pool.usage;
 	return memoryMaxBytes === null ? bytesOf(memoryBytes) : `${bytesOf(memoryBytes)} of ${bytesOf(memoryMaxBytes)}`;
 };
 const roles = ["monitor", "executor"];
+const workOf = (role, { taskId, taskTitle, readable }) => {
+	if (readable === false) return "another project";
+	if (taskId === null) return role === "monitor" ? "monitor cycle" : "-";
+	return taskTitle == null ? taskId : `${taskId} ${taskTitle}`;
+};
+const holdersOf = (pools) => {
+	if (roles.every((role) => pools[role].holders == null)) return null;
+	const held = roles.flatMap((role) => (pools[role].holders ?? []).map((holder) => [
+		role,
+		holder.projectName ?? "-",
+		holder.agentName ?? holder.agentId,
+		workOf(role, holder),
+		holder.since ?? "-",
+		holder.pid == null ? "-" : String(holder.pid)
+	]));
+	return held.length === 0 ? "No session holds a slot." : renderTable([
+		{ header: "HOLDS" },
+		{ header: "PROJECT" },
+		{ header: "AGENT" },
+		{ header: "WORK" },
+		{ header: "SINCE" },
+		{
+			header: "PID",
+			align: "right"
+		}
+	], held);
+};
 const queueOf = (pools) => {
 	const waiting = roles.flatMap((role) => pools[role].waiting.map((entry) => [
 		role,
@@ -4451,7 +4535,7 @@ const queueOf = (pools) => {
 		entry.projectName ?? "-",
 		entry.agentName ?? entry.agentId,
 		entry.since,
-		entry.taskId ?? "-"
+		workOf(role, entry)
 	]));
 	return waiting.length === 0 ? "No session waits for a slot." : renderTable([
 		{ header: "WAITS FOR" },
@@ -4462,37 +4546,41 @@ const queueOf = (pools) => {
 		{ header: "PROJECT" },
 		{ header: "AGENT" },
 		{ header: "SINCE" },
-		{ header: "TASK" }
+		{ header: "WORK" }
 	], waiting);
 };
-const poolsText = (pools) => [
-	enforcementText(pools.enforcement),
-	renderTable([
-		{ header: "POOL" },
-		{ header: "SLOTS IN USE" },
-		{
-			header: "CPU IN USE",
-			align: "right"
-		},
-		{ header: "MEMORY IN USE" },
-		{
-			header: "MEMORY KILLS",
-			align: "right"
-		}
-	], roles.map((role) => {
-		const pool = pools[role];
-		const cpus = pool.usage?.cpus ?? null;
-		return [
-			role,
-			`${pool.inUse} of ${pool.slots}`,
-			cpus === null ? "-" : cpus.toFixed(2),
-			memoryOf(pool),
-			pool.usage === null ? "-" : String(pool.usage.memoryKills)
-		];
-	})),
-	"",
-	queueOf(pools)
-].join("\n");
+const poolsText = (pools) => {
+	const holders = holdersOf(pools);
+	return [
+		enforcementText(pools.enforcement),
+		renderTable([
+			{ header: "POOL" },
+			{ header: "SLOTS IN USE" },
+			{
+				header: "CPU IN USE",
+				align: "right"
+			},
+			{ header: "MEMORY IN USE" },
+			{
+				header: "MEMORY KILLS",
+				align: "right"
+			}
+		], roles.map((role) => {
+			const pool = pools[role];
+			const cpus = pool.usage?.cpus ?? null;
+			return [
+				role,
+				`${pool.inUse} of ${pool.slots}`,
+				cpus === null ? "-" : cpus.toFixed(2),
+				memoryOf$1(pool),
+				pool.usage === null ? "-" : String(pool.usage.memoryKills)
+			];
+		})),
+		...holders === null ? [] : ["", holders],
+		"",
+		queueOf(pools)
+	].join("\n");
+};
 //#endregion
 //#region src/commands/agents/plan.ts
 const agentPlanOf = (agent) => ({
@@ -4672,6 +4760,15 @@ const admissionRowsOf = (agent) => {
 	const { admission } = agent.runtime;
 	return admission === null ? [] : [["monitor slot", slotOf(admission.monitor)], ["executor slot", slotOf(admission.executor)]];
 };
+const admissionHoldRowsOf = ({ runtime }) => {
+	const hold = runtime.admissionHold;
+	if (hold == null) return [];
+	if (hold.updating) return [["admissions", `held while the node updates to ${hold.target ?? "-"}`]];
+	const all = hold.pools.includes("monitor");
+	const noun = all ? "session" : "executor session";
+	const waits = `${String(hold.sessions)} ${noun}${hold.sessions === 1 ? "" : "s"}`;
+	return [["admissions", `${all ? "held" : "executor held"} for the node update to ${hold.target ?? "-"}, waiting for ${waits}`]];
+};
 const poolLimitRowsOf = ({ runtime }) => runtime.poolLimit === null ? [] : [["pool limit", poolLimitText(runtime.poolLimit)]];
 const detailsOf = (agent) => [
 	renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
@@ -4690,6 +4787,7 @@ const detailsOf = (agent) => [
 		["container", agent.runtime.containerId ?? "none"],
 		["health", agent.runtime.health],
 		...admissionRowsOf(agent),
+		...admissionHoldRowsOf(agent),
 		...poolLimitRowsOf(agent),
 		["pending", agent.restartRequired ? agent.restartReasons.join(", ") : "-"],
 		["actions", agent.availableActions.join(", ")],
@@ -5025,29 +5123,29 @@ const lifecycleCommands = (adaptersOf) => agentActions.map((action) => defineCom
 }));
 //#endregion
 //#region src/client/pages.ts
-const windowOf = (limit, all, fallback = 50) => {
+const windowOf = (limit, all, fallback = 50, largest = 200) => {
 	if (limit === void 0) return {
 		limit: fallback,
 		all
 	};
 	const size = Number(limit);
-	if (!/^[0-9]+$/u.test(limit) || size < 1 || size > 200) throw new UsageError(`--limit ${limit} is not a whole number from 1 to 200.`);
+	if (!/^[0-9]+$/u.test(limit) || size < 1 || size > largest) throw new UsageError(`--limit ${limit} is not a whole number from 1 to ${largest}.`);
 	return {
 		limit: size,
 		all
 	};
 };
-const collect = async (page, { limit, all }) => {
-	const first = await page(null, Math.min(limit, 200));
+const collect = async (page, { limit, all }, largest = 200) => {
+	const first = await page(null, Math.min(limit, largest));
 	if (!all) return first;
 	const items = [...first.items];
-	let cursor = first.nextCursor;
-	while (cursor !== null) {
-		const next = await page(cursor, 200);
-		items.push(...next.items);
-		cursor = next.nextCursor;
+	let last = first;
+	while (last.nextCursor !== null) {
+		last = await page(last.nextCursor, largest);
+		items.push(...last.items);
 	}
 	return {
+		...last,
 		items,
 		nextCursor: null
 	};
@@ -5094,6 +5192,43 @@ const transcriptOf = async (api, agentId, sessionId, all) => collect(async (curs
 	limit: 200,
 	all
 });
+const memoryOf = (api, agentId, { query, outcome }, window) => collect(async (cursor, limit) => dataOf("search what the agent remembers", await api.GET("/agents/{id}/memory", { params: {
+	path: { id: agentId },
+	query: {
+		limit,
+		...query === void 0 ? {} : { q: query },
+		...outcome === void 0 ? {} : { outcome },
+		...cursor === null ? {} : { cursor }
+	}
+} }), agentHints), window, 100);
+const memoryReasons = {
+	stopped: "the agent is not running",
+	unreachable: "the agent did not answer on its control socket",
+	timeout: "the agent did not answer in time"
+};
+const unreadReasonOf = (page) => page.staleReason === null ? "the agent did not answer" : memoryReasons[page.staleReason];
+const memoryText = (page) => {
+	const unread = page.source === "unavailable";
+	if (unread && page.items.length === 0) return `The memory cannot be read: ${unreadReasonOf(page)}.`;
+	if (page.items.length === 0) return "The agent remembers nothing that matches.";
+	return [
+		renderTable([
+			{ header: "WHEN" },
+			{ header: "OUTCOME" },
+			{ header: "TASK" },
+			{ header: "TITLE" },
+			{ header: "HEADLINE" }
+		], page.items.map((summary) => [
+			summary.createdAt,
+			summary.ok ? "ok" : "failed",
+			summary.taskId,
+			summary.title,
+			summary.headline
+		])),
+		...unread ? ["", `The rest of the memory cannot be read: ${unreadReasonOf(page)}.`] : [],
+		...page.truncated ? ["", `The agent returns at most 100 summaries, so the list may miss older ones.`] : []
+	].join("\n");
+};
 const observabilityCommands = (adaptersOf) => [
 	defineCommand({
 		name: "sessions",
@@ -5169,7 +5304,9 @@ const observabilityCommands = (adaptersOf) => [
 			const run = await runOf(adaptersOf, invocation);
 			const agentId = await agentFrom(run, invocation.positionals[0], invocation.values.project);
 			const page = await transcriptOf(run.api, agentId, invocation.positionals[1] ?? "", invocation.values.all);
-			return printed(run, page.items, (entries) => entries.length === 0 ? "The session left no transcript." : entries.map((entry) => JSON.stringify(entry)).join("\n"));
+			const code = printed(run, page.items, (entries) => entries.length === 0 ? "The session left no transcript." : entries.map((entry) => JSON.stringify(entry)).join("\n"));
+			if (page.nextCursor !== null && !run.settings.json) run.context.terminal.error("More entries follow; --all prints the whole session.");
+			return code;
 		}
 	}),
 	defineCommand({
@@ -5305,44 +5442,35 @@ const observabilityCommands = (adaptersOf) => [
 	defineCommand({
 		name: "memory",
 		summary: "Search what an agent remembers of its tasks.",
-		usage: "agents memory <agent> [--project <name>] [--query <text>] [--limit <n>]",
+		usage: "agents memory <agent> [--project <name>] [--query <text>] [--outcome <outcome>] [--limit <n>] [--all]",
 		optionsUsage: [
 			...agentUsage,
 			["--query <text>", "only the summaries that match this text"],
-			["--limit <n>", "how many summaries (default: 20)"]
+			["--outcome <outcome>", `only the summaries of one outcome: ${memoryOutcomes.join(", ")}`],
+			["--limit <n>", `how many summaries (default: 20)`],
+			allUsage
 		],
 		options: {
 			...agentOption,
+			...pageOptions,
 			query: { type: "string" },
-			limit: { type: "string" }
+			outcome: { type: "string" }
 		},
 		positionals: {
 			min: 1,
 			max: 1
 		},
 		run: async (invocation) => {
+			const { values } = invocation;
 			const run = await runOf(adaptersOf, invocation);
-			const agentId = await agentFrom(run, invocation.positionals[0], invocation.values.project);
-			const { limit } = windowOf(invocation.values.limit, false, 20);
-			const search = invocation.values.query;
-			const listed = dataOf("search what the agent remembers", await run.api.GET("/agents/{id}/memory", { params: {
-				path: { id: agentId },
-				query: {
-					limit,
-					...search === void 0 ? {} : { q: search }
-				}
-			} }), agentHints);
-			return printed(run, listed, (shown) => shown.items.length === 0 ? "The agent remembers nothing that matches." : renderTable([
-				{ header: "WHEN" },
-				{ header: "OUTCOME" },
-				{ header: "TITLE" },
-				{ header: "HEADLINE" }
-			], shown.items.map((summary) => [
-				summary.createdAt,
-				summary.ok ? "ok" : "failed",
-				summary.title,
-				summary.headline
-			])));
+			const agentId = await agentFrom(run, invocation.positionals[0], values.project);
+			const outcome = memoryOutcomes.find((candidate) => candidate === values.outcome);
+			if (values.outcome !== void 0 && outcome === void 0) throw new UsageError(`--outcome ${values.outcome} is not an outcome of a summary.`, `The outcomes are ${memoryOutcomes.join(", ")}.`);
+			const page = await memoryOf(run.api, agentId, {
+				query: values.query,
+				outcome
+			}, windowOf(values.limit, values.all, 20, 100));
+			return printed(run, page, memoryText);
 		}
 	})
 ];
@@ -5511,42 +5639,67 @@ const streamOptions = {
 		default: false
 	},
 	since: { type: "string" },
+	before: { type: "string" },
 	limit: { type: "string" }
 };
 const streamUsage = [
 	...agentUsage,
 	["-f, --follow", "keep the stream open instead of leaving when the output stops"],
 	["--since <id>", "start after this event instead of at the start of the buffer"],
-	["--limit <n>", "how many events to replay before the live ones"]
+	["--limit <n>", "how many events to replay before the live ones, or the page size with --before"]
 ];
-const lineOf = (frame) => {
-	const parsed = agentEventSummarySchema.safeParse(frame.data);
-	if (!parsed.success) return JSON.stringify(frame.data);
+const beforeUsage = ["--before <id>", "print the stored output before this event and leave, oldest first"];
+const linePrinter = (json) => (data) => {
+	if (json) return JSON.stringify(data);
+	const parsed = agentEventSummarySchema.safeParse(data);
+	if (!parsed.success) return JSON.stringify(data);
 	const event = parsed.data;
 	const text = "text" in event.payload && typeof event.payload.text === "string" ? event.payload.text : JSON.stringify(event.payload);
 	return `${event.ts} ${event.level.padEnd(5)} ${event.agentRole ?? "-"} ${event.event} ${text}`;
 };
+const earlierOutput = async (session, agentId, before, limit) => dataOf("read the earlier output of the agent", await session.api.GET("/agents/{id}/live/history", { params: {
+	path: { id: agentId },
+	query: {
+		before,
+		...limit === void 0 ? {} : { limit: Number(limit) }
+	}
+} }), agentHints);
+const olderPageCommand = (reference, project, cursor, limit) => [
+	"kcloud agents logs",
+	reference,
+	...project === void 0 ? [] : ["--project", project],
+	"--before",
+	cursor,
+	...limit === void 0 ? [] : ["--limit", limit]
+].join(" ");
 const streamCommands = (adaptersOf) => [{
 	name: "logs",
 	path: "/agents/{id}/live",
 	summary: "Print what the agent is writing, and keep printing with --follow.",
-	resumable: false
+	resumable: false,
+	pagesBack: true
 }, {
 	name: "events",
 	path: "/agents/{id}/events",
 	summary: "Print the stored events of the agent, and keep printing with --follow.",
-	resumable: true
-}].map(({ name, path, summary, resumable }) => defineCommand({
+	resumable: true,
+	pagesBack: false
+}].map(({ name, path, summary, resumable, pagesBack }) => defineCommand({
 	name,
 	summary,
-	usage: `agents ${name} <agent> [--project <name>] [--follow] [--since <id>] [--limit <n>]`,
-	optionsUsage: streamUsage,
+	usage: pagesBack ? `agents ${name} <agent> [--project <name>] [--follow] [--since <id>] [--before <id>] [--limit <n>]` : `agents ${name} <agent> [--project <name>] [--follow] [--since <id>] [--limit <n>]`,
+	optionsUsage: pagesBack ? [...streamUsage, beforeUsage] : streamUsage,
 	options: streamOptions,
 	positionals: {
 		min: 1,
 		max: 1
 	},
 	run: async ({ values, positionals, settings, context }) => {
+		const before = values.before;
+		if (before !== void 0 && !pagesBack) throw new UsageError("--before reads the output of kcloud agents logs alone.");
+		if (before !== void 0 && (values.follow || values.since !== void 0)) throw new UsageError("--before reads earlier output; leave out --follow and --since.");
+		const limit = values.limit;
+		if (limit !== void 0 && !/^[0-9]+$/u.test(limit)) throw new UsageError(`--limit ${limit} is not a whole number.`);
 		const adapters = adaptersOf(context);
 		const session = await openSession({
 			settings,
@@ -5555,8 +5708,17 @@ const streamCommands = (adaptersOf) => [{
 		});
 		const reference = positionals[0] ?? "";
 		const agentId = await resolveAgentId(session, reference, values.project);
-		const limit = values.limit;
-		if (limit !== void 0 && !/^[0-9]+$/u.test(limit)) throw new UsageError(`--limit ${limit} is not a whole number.`);
+		const lineOf = linePrinter(settings.json);
+		if (before !== void 0) {
+			const page = await earlierOutput(session, agentId, before, limit);
+			if (settings.json) {
+				context.terminal.line(JSON.stringify(page));
+				return exitCodes.ok;
+			}
+			for (const event of page.items) context.terminal.line(lineOf(event));
+			context.terminal.error(context.terminal.errorStyles.dim(page.nextCursor === null ? "The stored output begins here." : `older: ${olderPageCommand(reference, values.project, page.nextCursor, limit)}`));
+			return exitCodes.ok;
+		}
 		await streamFrames({
 			origin: session.origin,
 			token: session.token,
@@ -5575,7 +5737,7 @@ const streamCommands = (adaptersOf) => [{
 			},
 			onFrame: (frame) => {
 				if (frame.event === "agent.state") return;
-				context.terminal.line(settings.json ? JSON.stringify(frame.data) : lineOf(frame));
+				context.terminal.line(lineOf(frame.data));
 			}
 		});
 		return exitCodes.ok;
@@ -5585,7 +5747,10 @@ const streamCommands = (adaptersOf) => [{
 //#region src/commands/agents/tasks.ts
 const taskHints = {
 	...agentHints,
-	"runtime.control_unreachable": "The worker is not answering; kcloud agents show <agent> tells whether it runs."
+	"runtime.control_unreachable": "The worker is not answering; kcloud agents show <agent> tells whether it runs.",
+	"task.not_found": "kcloud agents tasks list <agent> shows the tasks of the agent.",
+	"task.not_finished": "Only done, failed and cancelled tasks can be deleted; kcloud agents tasks cancel <agent> <task> cancels a pending one.",
+	"runtime.task_deletion_unsupported": `Move the agent to Kikimora ${taskDeletionKikimoraVersion} or newer with kcloud agents set, then kcloud agents update.`
 };
 const tasksCommand = (adaptersOf) => defineGroup({
 	name: "tasks",
@@ -5595,11 +5760,21 @@ const tasksCommand = (adaptersOf) => defineGroup({
 		defineCommand({
 			name: "list",
 			summary: "List the tasks of an agent.",
-			usage: "agents tasks list <agent> [--project <name>] [--status <status>]",
-			optionsUsage: [...agentUsage, ["--status <status>", `one of ${taskStatuses.join(", ")}`]],
+			usage: "agents tasks list <agent> [--project <name>] [--status <status>] [--limit <n>] [--all]",
+			optionsUsage: [
+				...agentUsage,
+				["--status <status>", `one of ${taskStatuses.join(", ")}`],
+				["--limit <n>", `how many tasks, newest first (default: 50)`],
+				["--all", "follow the cursor to the end instead of one page"]
+			],
 			options: {
 				...agentOption,
-				status: { type: "string" }
+				status: { type: "string" },
+				limit: { type: "string" },
+				all: {
+					type: "boolean",
+					default: false
+				}
 			},
 			positionals: {
 				min: 1,
@@ -5611,10 +5786,14 @@ const tasksCommand = (adaptersOf) => defineGroup({
 				const given = invocation.values.status;
 				const status = taskStatuses.find((candidate) => candidate === given);
 				if (given !== void 0 && status === void 0) throw new UsageError(`--status ${given} is not a status of a task.`, `The statuses are ${taskStatuses.join(", ")}.`);
-				const listed = dataOf("list the tasks of the agent", await run.api.GET("/agents/{id}/tasks", { params: {
+				const listed = await collect(async (cursor, limit) => dataOf("list the tasks of the agent", await run.api.GET("/agents/{id}/tasks", { params: {
 					path: { id: agentId },
-					...status === void 0 ? {} : { query: { status } }
-				} }), taskHints);
+					query: {
+						limit,
+						...cursor === null ? {} : { cursor },
+						...status === void 0 ? {} : { status }
+					}
+				} }), taskHints), windowOf(invocation.values.limit, invocation.values.all));
 				return printed(run, listed, (page) => page.items.length === 0 ? "The agent has no task in its queue." : renderTable([
 					{ header: "STATUS" },
 					{ header: "TITLE" },
@@ -5627,12 +5806,42 @@ const tasksCommand = (adaptersOf) => defineGroup({
 				], page.items.map((task) => [
 					task.status,
 					task.title,
-					`${String(task.attempt)}/${String(task.maxAttempts)}`,
+					task.attempt === null ? "-" : task.maxAttempts === null ? String(task.attempt) : `${String(task.attempt)}/${String(task.maxAttempts)}`,
 					task.costUsd === null ? "-" : task.costUsd.toFixed(2),
 					task.id
 				])));
 			}
 		}),
+		defineCommand({
+			name: "show",
+			summary: "Show one task of an agent with its description and error.",
+			usage: "agents tasks show <agent> <task> [--project <name>]",
+			optionsUsage: agentUsage,
+			options: agentOption,
+			positionals: {
+				min: 2,
+				max: 2
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const agentId = await agentFrom(run, invocation.positionals[0], invocation.values.project);
+				const taskId = invocation.positionals[1] ?? "";
+				const view = dataOf("read the task", await run.api.GET("/agents/{id}/tasks/{taskId}", { params: { path: {
+					id: agentId,
+					taskId
+				} } }), taskHints);
+				return printed(run, view, ({ task }) => [
+					`${task.title} (${task.id})`,
+					`status   ${task.status}`,
+					`attempt  ${task.attempt === null ? "-" : String(task.attempt)}${task.maxAttempts === null ? "" : `/${String(task.maxAttempts)}`}`,
+					`created  ${task.createdAt ?? "-"}`,
+					`started  ${task.startedAt ?? "-"}`,
+					`finished ${task.finishedAt ?? "-"}`,
+					...task.error === null ? [] : [`error    ${task.error}`],
+					...task.description === null ? [] : ["", task.description]
+				].join("\n"));
+			}
+		}),
 		defineCommand({
 			name: "add",
 			summary: "Put a task in the queue of an agent.",
@@ -5712,9 +5921,50 @@ const tasksCommand = (adaptersOf) => defineGroup({
 				} } }), taskHints);
 				return said(run, `Cancelled the task ${taskId}.`);
 			}
+		}),
+		defineCommand({
+			name: "delete",
+			summary: "Delete a finished task, or every task of one final status.",
+			usage: "agents tasks delete <agent> <task> [--project <name>] | agents tasks delete <agent> --status <status> [--project <name>]",
+			optionsUsage: [...agentUsage, ["--status <status>", `one of ${finalTaskStatuses.join(", ")}`]],
+			options: {
+				...agentOption,
+				status: { type: "string" }
+			},
+			positionals: {
+				min: 1,
+				max: 2
+			},
+			run: async (invocation) => {
+				const taskId = invocation.positionals[1];
+				const given = invocation.values.status;
+				if (taskId === void 0 === (given === void 0)) throw new UsageError("agents tasks delete needs either a task or --status, not both.", "kcloud agents tasks delete <agent> <task> deletes one task.");
+				const status = finalTaskStatuses.find((candidate) => candidate === given);
+				if (given !== void 0 && status === void 0) throw new UsageError(`--status ${given} is not a final status of a task.`, `Only ${finalTaskStatuses.join(", ")} tasks can be deleted.`);
+				const run = await runOf(adaptersOf, invocation);
+				const agentId = await agentFrom(run, invocation.positionals[0], invocation.values.project);
+				await confirmed({
+					prompt: run.prompt,
+					settings: run.settings,
+					question: status === void 0 ? `Delete the task ${taskId ?? ""}?` : `Delete every ${status} task of the agent?${status === "done" ? " The monitor may report them again." : ""}`
+				});
+				const answer = dataOf("delete the tasks", status === void 0 ? await run.api.DELETE("/agents/{id}/tasks/{taskId}", { params: { path: {
+					id: agentId,
+					taskId: taskId ?? ""
+				} } }) : await run.api.DELETE("/agents/{id}/tasks", { params: {
+					path: { id: agentId },
+					query: { status }
+				} }), taskHints);
+				return printed(run, answer, ({ deleted }) => deletedSummary(deleted.length, status ?? null, taskId ?? null));
+			}
 		})
 	]
 });
+const deletedSummary = (count, status, taskId) => {
+	if (status === null) return `Deleted the task ${taskId ?? ""}.`;
+	if (count === 0) return `The agent has no ${status} task.`;
+	return `Deleted ${String(count)} ${status} ${count === 1 ? "task" : "tasks"}.`;
+};
 const descriptionOf = async (run, given) => {
 	if (given === "-") {
 		const chunks = [];
@@ -5794,25 +6044,59 @@ const secretUsage = [
 //#region src/commands/credentials.ts
 const projectOption$2 = { project: { type: "string" } };
 const projectUsage$2 = [["--project <name>", "the project the credential belongs to, by slug, name or id"]];
+const usageUnavailable = "Only a Claude Code OAuth token reports the usage of a subscription.";
 const credentialHints = {
 	"project.not_found": "kcloud projects list shows the projects you are a member of.",
 	"credential.not_found": "kcloud credentials list --project <name> shows them.",
 	"credential.label_taken": "Another credential of the project already has that label.",
-	"credential.in_use": "Point the agents at another credential first."
+	"credential.in_use": "Point the agents at another credential first.",
+	"credential.usage_unavailable": usageUnavailable
+};
+const percent = 100;
+const notApplicable = "-";
+const usedOf = (window) => window === null ? notApplicable : `${String(Math.round(window.utilization * percent))}%`;
+const shareOf = (window) => window?.status === "rejected" ? "limit" : usedOf(window);
+const usageSummaryOf = ({ kind, usage }) => {
+	if (kind !== "claude_oauth_token") return notApplicable;
+	if (usage === null) return "no data";
+	const summary = `5h ${shareOf(usage.fiveHour)} 7d ${shareOf(usage.sevenDay)}`;
+	return usage.stale ? `${summary} (stale)` : summary;
+};
+const usageReportOf = (credential) => {
+	const { usage } = credential;
+	if (usage === null) return `No usage of ${credential.label} was read yet.`;
+	const windows = [["5h", usage.fiveHour], ["7d", usage.sevenDay]];
+	return `${renderTable([
+		{ header: "WINDOW" },
+		{ header: "USED" },
+		{ header: "STATUS" },
+		{ header: "RESETS" }
+	], windows.map(([name, window]) => [
+		name,
+		usedOf(window),
+		window?.status ?? notApplicable,
+		window?.resetsAt ?? notApplicable
+	]))}\n${usage.stale ? `Read at ${usage.readAt}; the latest reading failed.` : `Read at ${usage.readAt}.`}`;
+};
+const isoDateLength = 10;
+const expiryOf = ({ expiresAt, expiresAtComputed }) => {
+	if (expiresAt === null) return "never";
+	return expiresAtComputed ? `about ${expiresAt.slice(0, isoDateLength)}` : expiresAt;
 };
 const projectFrom$2 = async (run, given) => {
 	if (given === void 0) throw new UsageError("This command needs a project.", "Pass --project <name>; kcloud projects list shows them.");
 	return resolveProjectId(run, given);
 };
 const credentialsOf = async (api, projectId) => dataOf("list the credentials of the project", await api.GET("/projects/{id}/credentials", { params: { path: { id: projectId } } }), credentialHints).items;
-const resolveCredentialId = async (api, projectId, reference) => {
+const resolveCredential = async (api, projectId, reference) => {
 	const credentials = await credentialsOf(api, projectId);
 	const found = credentials.filter((credential) => credential.id === reference || credential.label === reference);
 	const [first] = found;
 	if (first === void 0) throw new CliError(`The project has no credential ${reference}.`, credentials.length === 0 ? "kcloud credentials add makes one." : `Its credentials are ${credentials.map(({ label }) => label).join(", ")}.`);
 	if (found.length > 1) throw new CliError(`${reference} names ${found.length} credentials of the project.`, "Name it by its id instead.");
-	return first.id;
+	return first;
 };
+const resolveCredentialId = async (api, projectId, reference) => (await resolveCredential(api, projectId, reference)).id;
 const createCredentialsCommand = (adaptersOf) => defineGroup({
 	name: "credentials",
 	summary: "The Claude and GitHub credentials of a project.",
@@ -5838,13 +6122,15 @@ const createCredentialsCommand = (adaptersOf) => defineGroup({
 					{ header: "FINGERPRINT" },
 					{ header: "VERIFIED" },
 					{ header: "EXPIRES" },
+					{ header: "USAGE" },
 					{ header: "ID" }
 				], credentials.map((credential) => [
 					credential.label,
 					credential.kind,
 					credential.fingerprint,
 					credential.verification,
-					credential.expiresAt ?? "never",
+					expiryOf(credential),
+					usageSummaryOf(credential),
 					credential.id
 				])));
 			}
@@ -5990,6 +6276,34 @@ const createCredentialsCommand = (adaptersOf) => defineGroup({
 				return said(run, `The instance is verifying ${credentialId}; kcloud credentials list shows the answer.`);
 			}
 		}),
+		defineCommand({
+			name: "usage",
+			summary: "Show the usage of the Claude subscription behind a Claude Code OAuth token.",
+			usage: "credentials usage <credential> --project <name> [--refresh]",
+			optionsUsage: [...projectUsage$2, ["--refresh", "read it from Anthropic now; within 30 seconds the last reading"]],
+			options: {
+				...projectOption$2,
+				refresh: {
+					type: "boolean",
+					default: false
+				}
+			},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const projectId = await projectFrom$2(run, invocation.values.project);
+				const stored = await resolveCredential(run.api, projectId, invocation.positionals[0] ?? "");
+				if (stored.kind !== "claude_oauth_token") throw new CliError(`${stored.label} is a ${stored.kind}, which reports no usage.`, usageUnavailable);
+				const credential = invocation.values.refresh ? dataOf("read the usage of the credential", await run.api.POST("/projects/{id}/credentials/{credentialId}/usage", { params: { path: {
+					id: projectId,
+					credentialId: stored.id
+				} } }), credentialHints) : stored;
+				return printed(run, credential, usageReportOf);
+			}
+		}),
 		defineCommand({
 			name: "delete",
 			summary: "Delete a credential no agent uses.",
@@ -6851,19 +7165,31 @@ const credentialTools = [
 	}),
 	defineTool({
 		name: "credential_update",
-		title: "Rename or verify a credential",
-		description: "rename gives a credential a new label; verify asks the instance to check it against its service, and credentials_list shows the answer.",
-		operations: ["renameCredential", "verifyCredential"],
+		title: "Rename, verify or read the usage of a credential",
+		description: "rename gives a credential a new label; verify asks the instance to check it against its service, and credentials_list shows the answer; refresh_usage reads the usage of the Claude subscription behind a Claude Code OAuth token now, or answers the last reading within 30 seconds of the previous one.",
+		operations: [
+			"renameCredential",
+			"verifyCredential",
+			"refreshCredentialUsage"
+		],
 		safety: "write",
 		input: z.object({
 			project: projectField,
 			credential: credentialField$1,
-			action: z.enum(["rename", "verify"]),
+			action: z.enum([
+				"rename",
+				"verify",
+				"refresh_usage"
+			]),
 			label: z.string().trim().min(1).optional().describe("The new label, for rename.")
 		}),
 		run: async ({ project, credential, action, label }, run) => {
 			const projectId = await projectIdOf(run, project);
 			const credentialId = await resolveCredentialId(run.api, projectId, credential);
+			if (action === "refresh_usage") return dataOf("read the usage of the credential", await run.api.POST("/projects/{id}/credentials/{credentialId}/usage", { params: { path: {
+				id: projectId,
+				credentialId
+			} } }), credentialHints);
 			if (action === "verify") {
 				doneWith("verify the credential", await run.api.POST("/projects/{id}/credentials/{credentialId}/verify", { params: { path: {
 					id: projectId,
@@ -7204,19 +7530,40 @@ const observabilityTools = [
 	defineTool({
 		name: "agent_memory_search",
 		title: "Search the memory of an agent",
-		description: "Search what an agent remembers of the tasks it finished.",
+		description: "Search what an agent remembers of the tasks it finished, newest first, one page or every summary with all.",
 		operations: ["searchAgentMemory"],
 		safety: "read",
 		input: z.object({
 			...agentFields,
 			query: z.string().max(200).optional(),
-			limit: z.int().min(1).max(100).default(20)
+			outcome: memoryOutcomeSchema.optional().describe("Only the summaries of tasks that succeeded or failed."),
+			limit: z.int().min(1).max(100).default(20),
+			all: pageFields.all
+		}),
+		run: async ({ query, outcome, limit, all, ...reference }, run) => memoryOf(run.api, await agentIdOf(run, reference), {
+			query,
+			outcome
+		}, {
+			limit,
+			all
+		})
+	}),
+	defineTool({
+		name: "agent_earlier_output",
+		title: "Read the earlier output of an agent",
+		description: "Read what an agent wrote before an event, oldest first: the newest page without before. Pass nextCursor as before to read the page before that; null means the stored output begins here.",
+		operations: ["listAgentLiveHistory"],
+		safety: "read",
+		input: z.object({
+			...agentFields,
+			before: z.string().trim().min(1).max(64).optional().describe("End the page before this event id."),
+			limit: z.int().min(1).max(500).optional().describe("How many events to read.")
 		}),
-		run: async ({ query, limit, ...reference }, run) => dataOf("search what the agent remembers", await run.api.GET("/agents/{id}/memory", { params: {
+		run: async ({ before, limit, ...reference }, run) => dataOf("read the earlier output of the agent", await run.api.GET("/agents/{id}/live/history", { params: {
 			path: { id: await agentIdOf(run, reference) },
 			query: {
-				limit,
-				...query === void 0 ? {} : { q: query }
+				...before === void 0 ? {} : { before },
+				...limit === void 0 ? {} : { limit }
 			}
 		} }), agentHints)
 	}),
@@ -7264,6 +7611,70 @@ const observabilityTools = [
 	})
 ];
 //#endregion
+//#region src/commands/logo.ts
+const logoOptions = {
+	logo: { type: "string" },
+	"no-logo": {
+		type: "boolean",
+		default: false
+	}
+};
+const logoUsage = [["--logo <path>", "show a PNG, JPEG or WebP image instead of the color, at most 512 KB and 2048 px on a side"], ["--no-logo", "remove the logo and show the color again"]];
+const logoHints = {
+	"logo.unreadable": "The file has to be a PNG, JPEG or WebP image.",
+	"logo.too_small": "The image needs at least 64 pixels on each side.",
+	"logo.too_large": "The image may have at most 2048 pixels on a side."
+};
+const startsWith = (bytes, prefix, at = 0) => prefix.every((byte, index) => bytes[at + index] === byte);
+const ascii = (text) => Array.from(text, (letter) => letter.charCodeAt(0));
+const signatures = [
+	{
+		contentType: "image/png",
+		matches: (bytes) => startsWith(bytes, [
+			137,
+			...ascii("PNG\r\n"),
+			26,
+			10
+		])
+	},
+	{
+		contentType: "image/jpeg",
+		matches: (bytes) => startsWith(bytes, [
+			255,
+			216,
+			255
+		])
+	},
+	{
+		contentType: "image/webp",
+		matches: (bytes) => startsWith(bytes, ascii("RIFF")) && startsWith(bytes, ascii("WEBP"), 8)
+	}
+];
+const isLogoChange = (change) => change.logo !== void 0 || change["no-logo"] === true;
+const logoFileOf = async (workingDirectory, file) => {
+	const path = resolve(workingDirectory, file);
+	const bytes = await readFile(path).catch(() => {
+		throw new CliError(`${path} could not be read.`);
+	});
+	if (bytes.byteLength > 524288) throw new UsageError(`${file} holds ${String(Math.ceil(bytes.byteLength / 1024))} KB, and a logo at most ${String(logoMaxBytes / 1024)} KB.`);
+	const contentType = signatures.find(({ matches }) => matches(bytes))?.contentType;
+	if (contentType === void 0) throw new UsageError(`${file} is not a PNG, JPEG or WebP image.`);
+	return {
+		bytes,
+		contentType
+	};
+};
+const logoActionOf = async (workingDirectory, change) => {
+	if (change.logo !== void 0 && change["no-logo"] === true) throw new UsageError("--logo and --no-logo exclude each other.");
+	if (change.logo !== void 0) return logoFileOf(workingDirectory, change.logo);
+	return change["no-logo"] === true ? "remove" : null;
+};
+const logoUpload = ({ bytes, contentType }) => ({
+	body: bytes,
+	bodySerializer: (body) => body,
+	headers: { "content-type": contentType }
+});
+//#endregion
 //#region src/commands/roles.ts
 const roleOption = { role: { type: "string" } };
 const roleUsage = ["--role <role>", "admin or member"];
@@ -7573,6 +7984,48 @@ const costsText = (costs, { from, to }, slugs) => [
 	"",
 	`${costs.totalCostUsd.toFixed(2)} over ${costs.totalRuns} runs and ${costs.sessions} sessions.`
 ].join("\n");
+const organizationChangeHints = {
+	...organizationHints,
+	"organization.slug_taken": "Another organization already uses that slug.",
+	"organization.invalid_slug": "A slug holds lowercase letters, digits and hyphens.",
+	"auth.forbidden": "Only an admin of the organization changes it.",
+	...logoHints
+};
+const followSlug = async (homeDirectory, origin, before, after) => {
+	const store = await readInstanceStore(homeDirectory);
+	const stored = store.instances[origin];
+	if (stored?.organization !== before.slug) return;
+	await writeInstanceStore(homeDirectory, withInstance(store, origin, {
+		...stored,
+		organization: after.slug
+	}));
+};
+const updatedOrganization = async (api, current, fields) => {
+	if ([
+		fields.name,
+		fields.slug,
+		fields.color
+	].every((field) => field === void 0)) return current;
+	const body = {
+		name: fields.name ?? current.name,
+		slug: fields.slug ?? current.slug,
+		color: fields.color ?? current.color
+	};
+	validated(updateOrganizationBodySchema, body, "a change to an organization");
+	return dataOf("change the organization", await api.PATCH("/organizations/{organizationId}", {
+		params: { path: { organizationId: current.id } },
+		body
+	}), organizationChangeHints);
+};
+const withLogo = async (api, organization, logo) => {
+	const params = { path: { organizationId: organization.id } };
+	if (logo === null) return organization;
+	if (logo === "remove") return dataOf("remove the logo of the organization", await api.DELETE("/organizations/{organizationId}/logo", { params }), organizationChangeHints);
+	return dataOf("set the logo of the organization", await api.PUT("/organizations/{organizationId}/logo", {
+		params,
+		...logoUpload(logo)
+	}), organizationChangeHints);
+};
 const createOrgsCommand = (adaptersOf) => defineGroup({
 	name: "orgs",
 	summary: "The organizations you can see, and the one kcloud acts in.",
@@ -7657,11 +8110,52 @@ const createOrgsCommand = (adaptersOf) => defineGroup({
 				return printed(run, organization, (shown) => renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
 					["name", shown.name],
 					["slug", shown.slug],
+					["color", shown.color],
+					["logo", shown.logoHash ?? "-"],
 					["created", shown.createdAt],
 					["id", shown.id]
 				]));
 			}
 		}),
+		defineCommand({
+			name: "set",
+			summary: "Change the name, slug, color or logo of an organization.",
+			usage: "orgs set [<organization>] [--name <name>] [--slug <slug>] [--color <#rrggbb>] [--logo <path> | --no-logo]",
+			optionsUsage: [
+				["--name <name>", "the new name"],
+				["--slug <slug>", "the new slug; scripts and --org that name the old one stop finding it"],
+				["--color <#rrggbb>", "the color of the organization in the panel"],
+				...logoUsage
+			],
+			options: {
+				name: { type: "string" },
+				slug: { type: "string" },
+				color: { type: "string" },
+				...logoOptions
+			},
+			positionals: {
+				min: 0,
+				max: 1
+			},
+			run: async (invocation) => {
+				const { values } = invocation;
+				if ([
+					values.name,
+					values.slug,
+					values.color
+				].every((value) => value === void 0) && !isLogoChange(values)) throw new UsageError("orgs set needs --name, --slug, --color, --logo or --no-logo.");
+				const logo = await logoActionOf(invocation.context.workingDirectory, values);
+				const run = await runOf(adaptersOf, invocation);
+				const current = await organizationOrInUse(run, invocation.positionals[0]);
+				const updated = await updatedOrganization(run.api, current, values);
+				if (updated.slug !== current.slug) {
+					await followSlug(run.context.homeDirectory, run.origin, current, updated);
+					run.context.terminal.error(run.context.terminal.errorStyles.warning(`warning Scripts that pass --org ${current.slug} or set ${organizationVariable}=${current.slug} need ${updated.slug} now.`));
+				}
+				const organization = await withLogo(run.api, updated, logo);
+				return printed(run, organization, (shown) => `Changed ${shown.name} (${shown.slug}).`);
+			}
+		}),
 		defineCommand({
 			name: "costs",
 			summary: "Show what the organization spent, by day and by project.",
@@ -7726,6 +8220,20 @@ const organizationTools = [
 			return dataOf("describe the organization", await run.api.GET("/organizations/{organizationId}", { params: { path: { organizationId: id } } }), organizationHints);
 		}
 	}),
+	defineTool({
+		name: "organization_update",
+		title: "Change an organization",
+		description: "Change the name or color of an organization, by default the one this server acts in. A field left out keeps its value. A new slug is set with kcloud orgs set or in the panel.",
+		operations: ["listOrganizations", "updateOrganization"],
+		safety: "write",
+		idempotent: true,
+		input: z.object({
+			organization: z.string().trim().min(1).optional().describe("The organization, by its slug, its name or its id."),
+			name: organizationNameSchema.optional(),
+			color: colorSchema.optional().describe("The color in the panel, as #rrggbb.")
+		}),
+		run: async ({ organization, ...change }, run) => updatedOrganization(run.api, await organizationOrInUse(run, organization), change)
+	}),
 	defineTool({
 		name: "organization_costs",
 		title: "Show what the organization spent",
@@ -8255,19 +8763,37 @@ const createdProject = async (scope, name, { slug, description, color }) => {
 		organization
 	};
 };
-const changedProject = async (api, id, change) => {
-	const current = await projectOf(api, id);
-	const body = {
-		name: change.name ?? current.name,
-		slug: change.slug ?? current.slug,
-		description: change.description ?? current.description,
-		color: change.color ?? current.color
-	};
-	validated(updateProjectBodySchema, body, "a change to a project");
-	return dataOf("change the project", await api.PATCH("/projects/{id}", {
-		params: { path: { id } },
-		body
-	}), projectHint);
+const logoHint = {
+	...projectHint,
+	...logoHints
+};
+const changedProject = async (api, id, change, logo = null) => {
+	const params = { path: { id } };
+	let project = await projectOf(api, id);
+	if ([
+		change.name,
+		change.slug,
+		change.description,
+		change.color
+	].some((field) => field !== void 0)) {
+		const body = {
+			name: change.name ?? project.name,
+			slug: change.slug ?? project.slug,
+			description: change.description ?? project.description,
+			color: change.color ?? project.color
+		};
+		validated(updateProjectBodySchema, body, "a change to a project");
+		project = dataOf("change the project", await api.PATCH("/projects/{id}", {
+			params,
+			body
+		}), projectHint);
+	}
+	if (logo !== null && logo !== "remove") project = dataOf("set the logo of the project", await api.PUT("/projects/{id}/logo", {
+		params,
+		...logoUpload(logo)
+	}), logoHint);
+	if (logo === "remove") project = dataOf("remove the logo of the project", await api.DELETE("/projects/{id}/logo", { params }), logoHint);
+	return project;
 };
 const deleteProject = async (api, id) => {
 	doneWith("delete the project", await api.DELETE("/projects/{id}", { params: { path: { id } } }), projectHint);
@@ -8326,6 +8852,7 @@ const createProjectsCommand = (adaptersOf) => defineGroup({
 					["slug", shown.slug],
 					["description", shown.description === "" ? "-" : shown.description],
 					["color", shown.color],
+					["logo", shown.logoHash ?? "-"],
 					["docker", shown.dockerAllowed ? "allowed" : "not allowed"],
 					["members", String(shown.memberCount)],
 					["created", shown.createdAt],
@@ -8351,12 +8878,17 @@ const createProjectsCommand = (adaptersOf) => defineGroup({
 		}),
 		defineCommand({
 			name: "update",
-			summary: "Change the name, slug, description or color of a project.",
-			usage: "projects update <project> [--name <name>] [--slug <slug>] [--description <text>] [--color <#rrggbb>]",
-			optionsUsage: [["--name <name>", "the new name"], ...fieldUsage],
+			summary: "Change the name, slug, description, color or logo of a project.",
+			usage: "projects update <project> [--name <name>] [--slug <slug>] [--description <text>] [--color <#rrggbb>] [--logo <path> | --no-logo]",
+			optionsUsage: [
+				["--name <name>", "the new name"],
+				...fieldUsage,
+				...logoUsage
+			],
 			options: {
 				name: { type: "string" },
-				...fieldOptions
+				...fieldOptions,
+				...logoOptions
 			},
 			positionals: {
 				min: 1,
@@ -8369,10 +8901,11 @@ const createProjectsCommand = (adaptersOf) => defineGroup({
 					values.slug,
 					values.description,
 					values.color
-				].every((value) => value === void 0)) throw new UsageError("projects update needs --name, --slug, --description or --color.");
+				].every((value) => value === void 0) && !isLogoChange(values)) throw new UsageError("projects update needs --name, --slug, --description, --color, --logo or --no-logo.");
+				const logo = await logoActionOf(invocation.context.workingDirectory, values);
 				const run = await runOf(adaptersOf, invocation);
 				const id = await resolveProjectId(run, invocation.positionals[0] ?? "");
-				const project = await changedProject(run.api, id, values);
+				const project = await changedProject(run.api, id, values, logo);
 				return printed(run, project, (shown) => `Changed ${shown.name} (${shown.slug}).`);
 			}
 		}),
@@ -8919,17 +9452,40 @@ const taskTools = [
 	defineTool({
 		name: "agent_tasks_list",
 		title: "List the tasks of an agent",
-		description: "List the task queue of an agent, with the status, attempts and cost of each task.",
+		description: "List the task queue of an agent, newest first, with the status, attempts and cost of each task.",
 		operations: ["listAgentTasks"],
 		safety: "read",
 		input: z.object({
 			...agentFields,
+			...pageFields,
 			status: z.enum(taskStatuses).optional()
 		}),
-		run: async ({ status, ...reference }, run) => dataOf("list the tasks of the agent", await run.api.GET("/agents/{id}/tasks", { params: {
-			path: { id: await agentIdOf(run, reference) },
-			...status === void 0 ? {} : { query: { status } }
-		} }), taskHints)
+		run: async ({ status, limit, all, ...reference }, run) => {
+			const agentId = await agentIdOf(run, reference);
+			return collect(async (cursor, size) => dataOf("list the tasks of the agent", await run.api.GET("/agents/{id}/tasks", { params: {
+				path: { id: agentId },
+				query: {
+					limit: size,
+					...cursor === null ? {} : { cursor },
+					...status === void 0 ? {} : { status }
+				}
+			} }), taskHints), windowOfPage({
+				limit,
+				all
+			}));
+		}
+	}),
+	defineTool({
+		name: "agent_task_show",
+		title: "Show a task",
+		description: "Read one task of an agent with its description, status, attempts, cost and error.",
+		operations: ["getAgentTask"],
+		safety: "read",
+		input: z.object(taskFields),
+		run: async ({ task, ...reference }, run) => dataOf("read the task", await run.api.GET("/agents/{id}/tasks/{taskId}", { params: { path: {
+			id: await agentIdOf(run, reference),
+			taskId: task
+		} } }), taskHints)
 	}),
 	defineTool({
 		name: "agent_task_add",
@@ -8979,6 +9535,33 @@ const taskTools = [
 			} } }), taskHints);
 			return { cancelled: task };
 		}
+	}),
+	defineTool({
+		name: "agent_task_delete",
+		title: "Delete a task",
+		description: "Delete a done, failed or cancelled task of an agent. A monitor may report a deleted done task again.",
+		operations: ["deleteAgentTask"],
+		safety: "destructive",
+		input: z.object(taskFields),
+		run: async ({ task, ...reference }, run) => dataOf("delete the task", await run.api.DELETE("/agents/{id}/tasks/{taskId}", { params: { path: {
+			id: await agentIdOf(run, reference),
+			taskId: task
+		} } }), taskHints)
+	}),
+	defineTool({
+		name: "agent_tasks_delete",
+		title: "Delete the tasks of a status",
+		description: "Delete every task of an agent with one final status: done, failed or cancelled. A monitor may report a deleted done task again.",
+		operations: ["deleteAgentTasks"],
+		safety: "destructive",
+		input: z.object({
+			...agentFields,
+			status: z.enum(finalTaskStatuses)
+		}),
+		run: async ({ status, ...reference }, run) => dataOf("delete the tasks", await run.api.DELETE("/agents/{id}/tasks", { params: {
+			path: { id: await agentIdOf(run, reference) },
+			query: { status }
+		} }), taskHints)
 	})
 ];
 //#endregion
@@ -9110,11 +9693,13 @@ const runtimeRowsOf = (runtime) => [
 	["agents", `${runtime.reconcile.agentsActive} active, ${runtime.reconcile.agentsQueued} queued`],
 	["log readers", String(runtime.ingest.readers)]
 ];
+const sessionsText = (count, noun) => `${String(count)} ${noun}${count === 1 ? "" : "s"}`;
+const heldPoolsOf = ({ held = [] }) => held;
 const updateOf = ({ update }) => {
 	if (update === null) return "not reported";
 	switch (update.state) {
 		case "current": return "current";
-		case "waiting": return `waits for ${String(update.sessions)} ${update.sessions === 1 ? "session" : "sessions"} to end before ${update.target ?? "-"}`;
+		case "waiting": return heldPoolsOf(update).includes("monitor") ? `admissions held for ${update.target ?? "-"}, waits for ${sessionsText(update.sessions, "session")}` : `executor admissions held for ${update.target ?? "-"}, waits for ${sessionsText(update.sessions, "executor session")}; monitors go on until the executor pool is empty`;
 		case "updating": return `updating to ${update.target ?? "-"}`;
 		case "failed": return `failed to reach ${update.target ?? "-"}, runs its previous version`;
 		case "unmanaged": return "updated with its platform";