@kubitnodes/stellaris 0.3.25 → 0.3.27

package/dist/server/index.js

@@ -2,12 +2,12 @@
 
 // apps/server/dist/index.js
 import { access as access2 } from "node:fs/promises";
-import path10 from "node:path";
+import path11 from "node:path";
 import { serve } from "@hono/node-server";
 
 // packages/board-core/dist/board.js
-import { chmod as chmod2, cp, mkdir as mkdir4, readdir as readdir4, readFile as readFile4, rename as rename3, rm as rm2, stat as stat3, writeFile as writeFile4 } from "node:fs/promises";
-import path7 from "node:path";
+import { chmod as chmod2, cp, mkdir as mkdir5, readdir as readdir4, readFile as readFile4, rename as rename3, rm as rm3, stat as stat3, writeFile as writeFile4 } from "node:fs/promises";
+import path8 from "node:path";
 import { decodeTime, monotonicFactory } from "ulid";
 import { z as z16 } from "zod";
 
@@ -1283,6 +1283,7 @@ var BOARD_EVENT_TYPES = [
   "project.configured",
   "project.archived",
   "project.placed",
+  "project.moved",
   "agent.added",
   "agent.configured",
   "agent.placed",
@@ -1471,6 +1472,11 @@ var RunnerHelloSchema = z9.object({
   quotaReads: z9.boolean().default(false),
   /** Whether the runner reads an image a turn running there uploads; one from before never does. */
   imageReads: z9.boolean().default(false),
+  /**
+   * Whether the runner carries a project's repository out to another runner and in from one, and
+   * removes its copy once the project has moved; one from before never does.
+   */
+  projectMoves: z9.boolean().default(false),
   capabilities: z9.array(z9.string()).default([]),
   /**
    * What the runner's account lacks of the git identity citizens' own commits carry, checked
@@ -1580,6 +1586,11 @@ var TurnJobSchema = z9.object({
   session: z9.string().min(1).nullable(),
   /** The running total the session reported after its last turn, which a resumed session starts from. */
   costSoFarUsd: z9.number().nonnegative(),
+  /**
+   * The session's running usage after its last turn, which a resumed session's own usage is
+   * measured from. Absent when the board holds none for the session, and from a server from before.
+   */
+  usageSoFar: UsageSchema.optional(),
   /** The rendered charter, norms, memory core, and skills index, with `PATH_TOKENS` for places. */
   instructions: z9.string(),
   prompt: z9.string(),
@@ -1608,6 +1619,17 @@ var TurnOutcomeSchema = z9.object({
   costUsd: z9.number().nonnegative(),
   /** The session's running total after this turn, for CLIs that report one. */
   sessionCostUsd: z9.number().nonnegative().optional(),
+  /**
+   * The session's running usage after this turn, for CLIs that report one, else the job's
+   * `usageSoFar`. A runner from before never sends it.
+   */
+  sessionUsage: UsageSchema.optional(),
+  /**
+   * The whole input of the turn's latest model call in the session's own thread, cached or not:
+   * how large the session had grown. Sub-agents' calls are left out. A turn that made no call,
+   * and a runner from before, never send it.
+   */
+  contextTokens: z9.number().int().nonnegative().optional(),
   /**
    * The session the CLI used, which differs from the job's for CLIs that assign their own ids. A
    * turn whose CLI never started, because it failed or was stopped first, reports the job's own,
@@ -1776,6 +1798,43 @@ var HeldWorkspaceSchema = z9.object({
 });
 var HeldWorkspacesSchema = z9.object({ workspaces: z9.array(HeldWorkspaceSchema) });
 var SweepResultSchema = z9.object({ kept: z9.array(HeldWorkspaceSchema) });
+var MOVE_PACK_LIMIT_BYTES = 256 * 1024 * 1024;
+var RepoRefsSchema = z9.record(z9.string().regex(/^refs\/(heads|tags)\/\S+$/), z9.string().regex(/^[0-9a-f]{40}([0-9a-f]{24})?$/));
+var ProjectExportSchema = z9.object({ move: UlidSchema, repo: ProjectRepoSchema });
+var HeldWorkSchema = z9.object({
+  agent: NameSchema,
+  conversation: WorkspaceConversationSchema.nullable(),
+  uncommitted: z9.number().int().nonnegative(),
+  onNoBranch: z9.number().int().nonnegative()
+});
+var ProjectExportedSchema = z9.discriminatedUnion("ok", [
+  z9.object({
+    ok: z9.literal(true),
+    refs: RepoRefsSchema,
+    bytes: z9.number().int().nonnegative()
+  }),
+  z9.object({
+    ok: z9.literal(false),
+    held: z9.array(HeldWorkSchema),
+    bytes: z9.number().int().nonnegative()
+  })
+]);
+var ProjectImportSchema = z9.object({
+  move: UlidSchema,
+  repo: ProjectRepoSchema,
+  pullRequests: z9.boolean()
+});
+var ProjectImportedSchema = z9.object({ refs: RepoRefsSchema });
+var ProjectReleaseSchema = z9.object({ slug: NameSchema });
+var ProjectReleasedSchema = z9.object({
+  worktrees: z9.number().int().nonnegative(),
+  clone: z9.boolean()
+});
+var ProjectMovedSchema = z9.object({
+  project: ProjectSchema,
+  carried: z9.number().int().nonnegative().nullable(),
+  released: z9.object({ ok: z9.boolean(), detail: z9.string() }).nullable()
+});
 var TurnSteerSchema = z9.object({ id: z9.uuid(), text: z9.string().min(1) });
 var RunnerMessageSchema = z9.discriminatedUnion("type", [
   z9.object({ type: z9.literal("turn"), job: TurnJobSchema }),
@@ -1812,6 +1871,19 @@ var RunnerMessageSchema = z9.discriminatedUnion("type", [
   }),
   /** Answered with whether the turn was there to stop; it ends `stopped`. */
   z9.object({ type: z9.literal("stop"), request: z9.string().min(1), turnId: UlidSchema }),
+  /**
+   * Answered with a `ProjectExported`. Sent only to runners whose hello says `projectMoves`, as are
+   * the import and the release.
+   */
+  z9.object({ type: z9.literal("export"), request: z9.string().min(1), export: ProjectExportSchema }),
+  /** Answered with a `ProjectImported`. */
+  z9.object({ type: z9.literal("import"), request: z9.string().min(1), import: ProjectImportSchema }),
+  /** Answered with a `ProjectReleased`. */
+  z9.object({
+    type: z9.literal("release"),
+    request: z9.string().min(1),
+    release: ProjectReleaseSchema
+  }),
   /**
    * A conversation ended: the runner removes every citizen's workspace for it but those a turn
    * still uses, and answers with a `SweepResult` naming those it kept for holding work on no branch.
@@ -1942,6 +2014,16 @@ var TurnRecordSchema = z10.object({
    * resumed session starts from it, so the next turn's own cost is measured from here.
    */
   sessionCostUsd: z10.number().nonnegative().optional(),
+  /**
+   * The running usage the CLI reported for the session after this turn, when the runner reports
+   * one. A resumed session's next turn measures its own usage from here.
+   */
+  sessionUsage: UsageSchema.optional(),
+  /**
+   * The whole input of the turn's latest model call in the session's own thread, as the runner
+   * reported it: how large the session had grown. Absent for a turn that made no call.
+   */
+  contextTokens: z10.number().int().nonnegative().optional(),
   toolCalls: z10.number().int().nonnegative().default(0),
   /** The model the CLI reported for this turn, else the model configured for the agent, else null. */
   model: z10.string().nullable().default(null),
@@ -1955,7 +2037,10 @@ var TurnRecordSchema = z10.object({
   transient: z10.boolean().optional(),
   /** How many turns in a row, this one included, could not resume the session for a `retry`. */
   resumeRetries: z10.number().int().positive().optional(),
-  /** Whether the server dropped the conversation's session after this turn, which the next starts anew. */
+  /**
+   * Whether the server dropped the conversation's session after this turn, which the next starts
+   * anew: one its CLI could not resume, or a society role's home after a reflection completed.
+   */
   sessionDropped: z10.boolean().optional(),
   /** The crons whose fire started the turn, which record how it ended. */
   crons: z10.array(UlidSchema).optional()
@@ -2171,11 +2256,17 @@ var TokenUseSchema = z12.object({
 // packages/shared/dist/config.js
 import { z as z13 } from "zod";
 var LogLevelSchema = z13.enum(["trace", "debug", "info", "warn", "error", "fatal"]);
+var AppleAppIdSchema = z13.string().regex(/^[A-Z0-9]{10}\.[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*$/, "not <team id>.<bundle id>");
 var GithubSignInSchema = z13.object({
   clientId: z13.string().min(1),
   clientSecret: z13.string().min(1),
   /** Logins, lowercased; GitHub logins are case-insensitive. */
-  users: z13.array(z13.string().min(1)).min(1)
+  users: z13.array(z13.string().min(1)).min(1),
+  /**
+   * The iOS app that may sign in, which Apple's association file names so that only it can take the
+   * board's `https` landing; null when no app signs in.
+   */
+  appleAppId: AppleAppIdSchema.nullable()
 });
 var ServerConfigSchema = z13.object({
   dataDir: z13.string().min(1),
@@ -2216,13 +2307,20 @@ function githubSignIn(env) {
   const clientId = env["STELLARIS_GITHUB_CLIENT_ID"] ?? "";
   const clientSecret = env["STELLARIS_GITHUB_CLIENT_SECRET"] ?? "";
   const users = list(env["STELLARIS_GITHUB_USERS"]).map((login) => login.toLowerCase());
+  const appleAppId = env["STELLARIS_APPLE_APP_ID"]?.trim() || null;
+  if (appleAppId !== null && !AppleAppIdSchema.safeParse(appleAppId).success) {
+    throw new Error(`STELLARIS_APPLE_APP_ID is <team id>.<bundle id>, not ${JSON.stringify(appleAppId)}`);
+  }
   if (clientId === "" && clientSecret === "" && users.length === 0) {
+    if (appleAppId !== null) {
+      throw new Error("STELLARIS_APPLE_APP_ID needs GitHub sign-in");
+    }
     return null;
   }
   if (clientId === "" || clientSecret === "" || users.length === 0) {
     throw new Error("GitHub sign-in needs STELLARIS_GITHUB_CLIENT_ID, STELLARIS_GITHUB_CLIENT_SECRET, and STELLARIS_GITHUB_USERS together");
   }
-  return GithubSignInSchema.parse({ clientId, clientSecret, users });
+  return GithubSignInSchema.parse({ clientId, clientSecret, users, appleAppId });
 }
 function loadServerConfig(env) {
   return ServerConfigSchema.parse({
@@ -2257,7 +2355,7 @@ var RunnerConfigSchema = z13.object({
 });
 
 // packages/shared/dist/version.js
-var STELLARIS_VERSION = "0.3.25";
+var STELLARIS_VERSION = "0.3.27";
 
 // packages/shared/dist/mentions.js
 import { parse, postprocess, preprocess } from "micromark";
@@ -2952,6 +3050,41 @@ function filesOf(lines, status) {
   return [...files.values()];
 }
 
+// packages/board-core/dist/moves.js
+import { mkdir as mkdir4, rm as rm2 } from "node:fs/promises";
+import path5 from "node:path";
+import { execa as execa2 } from "execa";
+var MoveRepos = class {
+  root;
+  constructor(root) {
+    this.root = root;
+  }
+  /** Makes the move's empty repository, which checks every object a push brings, and answers its path. */
+  async open(dir) {
+    await mkdir4(this.root, { recursive: true });
+    await git2(["init", "--quiet", "--bare", dir], this.root);
+    await git2(["config", "receive.fsckObjects", "true"], dir);
+    return dir;
+  }
+  async drop(dir) {
+    await rm2(path5.resolve(this.root, dir), { recursive: true, force: true });
+  }
+  /** Removes every move's repository, as the server starts: a move never survives a restart. */
+  async clear() {
+    await rm2(this.root, { recursive: true, force: true });
+  }
+};
+async function git2(args, cwd) {
+  const result = await execa2("git", args, {
+    cwd,
+    reject: false,
+    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+  });
+  if (result.exitCode !== 0) {
+    throw new Error(`git ${args[0] ?? ""} failed: ${result.stderr.trim()}`);
+  }
+}
+
 // packages/board-core/dist/mentions.js
 import vm from "node:vm";
 var MENTION_PARSE_MS = 500;
@@ -3365,121 +3498,121 @@ var Mutex = class {
 };
 
 // packages/board-core/dist/paths.js
-import path5 from "node:path";
+import path6 from "node:path";
 var BoardPaths = class {
   dataDir;
   constructor(dataDir) {
-    this.dataDir = path5.resolve(dataDir);
+    this.dataDir = path6.resolve(dataDir);
   }
   // Board projection, also the storage of record; only the core library writes it.
   get board() {
-    return path5.join(this.dataDir, "board");
+    return path6.join(this.dataDir, "board");
   }
   get society() {
-    return path5.join(this.board, "society");
+    return path6.join(this.board, "society");
   }
   societyFile() {
-    return path5.join(this.society, "society.md");
+    return path6.join(this.society, "society.md");
   }
   societyChannels() {
-    return path5.join(this.society, "channels");
+    return path6.join(this.society, "channels");
   }
   societyChannel(name) {
-    return path5.join(this.societyChannels(), name);
+    return path6.join(this.societyChannels(), name);
   }
   /** Threads whose channel is a society channel; project channels' threads live under the project. */
   societyThreads() {
-    return path5.join(this.society, "threads");
+    return path6.join(this.society, "threads");
   }
   societyKnowledge() {
-    return path5.join(this.society, "knowledge");
+    return path6.join(this.society, "knowledge");
   }
   societyKnowledgeFile(topic) {
-    return path5.join(this.societyKnowledge(), `${topic}.md`);
+    return path6.join(this.societyKnowledge(), `${topic}.md`);
   }
   /** Skills promoted to the society, one directory per skill holding SKILL.md. */
   societySkills() {
-    return path5.join(this.society, "skills");
+    return path6.join(this.society, "skills");
   }
   societySkill(name) {
-    return path5.join(this.societySkills(), name);
+    return path6.join(this.societySkills(), name);
   }
   societySkillFile(name) {
-    return path5.join(this.societySkill(name), "SKILL.md");
+    return path6.join(this.societySkill(name), "SKILL.md");
   }
   roles() {
-    return path5.join(this.society, "roles");
+    return path6.join(this.society, "roles");
   }
   role(name) {
-    return path5.join(this.roles(), `${name}.md`);
+    return path6.join(this.roles(), `${name}.md`);
   }
   proposals() {
-    return path5.join(this.society, "proposals");
+    return path6.join(this.society, "proposals");
   }
   proposal(id) {
-    return path5.join(this.proposals(), `${id}.md`);
+    return path6.join(this.proposals(), `${id}.md`);
   }
   /** A skill proposal's folder, as the board took it from its proposer's home. */
   proposalFiles(id) {
-    return path5.join(this.proposals(), id);
+    return path6.join(this.proposals(), id);
   }
   decisions() {
-    return path5.join(this.society, "decisions");
+    return path6.join(this.society, "decisions");
   }
   decision(id) {
-    return path5.join(this.decisions(), `${id}.md`);
+    return path6.join(this.decisions(), `${id}.md`);
   }
   runners() {
-    return path5.join(this.society, "runners");
+    return path6.join(this.society, "runners");
   }
   runner(name) {
-    return path5.join(this.runners(), `${name}.md`);
+    return path6.join(this.runners(), `${name}.md`);
   }
   members() {
-    return path5.join(this.society, "members");
+    return path6.join(this.society, "members");
   }
   /** Crons, one file each with its note as the body; ended ones stay. */
   crons() {
-    return path5.join(this.society, "crons");
+    return path6.join(this.society, "crons");
   }
   cron(id) {
-    return path5.join(this.crons(), `${id}.md`);
+    return path6.join(this.crons(), `${id}.md`);
   }
   member(name) {
-    return path5.join(this.members(), `${name}.md`);
+    return path6.join(this.members(), `${name}.md`);
   }
   projects() {
-    return path5.join(this.board, "projects");
+    return path6.join(this.board, "projects");
   }
   project(slug) {
-    return path5.join(this.projects(), slug);
+    return path6.join(this.projects(), slug);
   }
   projectFile(slug) {
-    return path5.join(this.project(slug), "project.md");
+    return path6.join(this.project(slug), "project.md");
   }
   projectChannels(slug) {
-    return path5.join(this.project(slug), "channels");
+    return path6.join(this.project(slug), "channels");
   }
   projectChannel(slug, name) {
-    return path5.join(this.projectChannels(slug), name);
+    return path6.join(this.projectChannels(slug), name);
   }
   threads(slug) {
-    return path5.join(this.project(slug), "threads");
+    return path6.join(this.project(slug), "threads");
   }
   tasks(slug) {
-    return path5.join(this.project(slug), "tasks");
+    return path6.join(this.project(slug), "tasks");
   }
   task(slug, id) {
-    return path5.join(this.tasks(slug), `${id}.md`);
+    return path6.join(this.tasks(slug), `${id}.md`);
   }
   projectKnowledge(slug) {
-    return path5.join(this.project(slug), "knowledge");
+    return path6.join(this.project(slug), "knowledge");
   }
   projectKnowledgeFile(slug, topic) {
-    return path5.join(this.projectKnowledge(slug), `${topic}.md`);
+    return path6.join(this.projectKnowledge(slug), `${topic}.md`);
   }
   dashboard(slug) {
-    return path5.join(this.project(slug), "dashboard.md");
+    return path6.join(this.project(slug), "dashboard.md");
   }
   channelDir(ref) {
     const parsed = parseChannelRef(ref);
@@ -3492,57 +3625,57 @@ var BoardPaths = class {
   }
   /** A thread's record, `<id>.md`, beside the directory of its messages, `<id>/`. */
   threadFile(threads, id) {
-    return path5.join(threads, `${id}.md`);
+    return path6.join(threads, `${id}.md`);
   }
   threadMessages(threads, id) {
-    return path5.join(threads, id);
+    return path6.join(threads, id);
   }
   messageFile(dir, id, author) {
-    return path5.join(dir, `${id}-${author}.md`);
+    return path6.join(dir, `${id}-${author}.md`);
   }
   // Agent homes: authored by the agent, source of truth on the board server.
   agents() {
-    return path5.join(this.dataDir, "agents");
+    return path6.join(this.dataDir, "agents");
   }
   agent(name) {
-    return path5.join(this.agents(), name);
+    return path6.join(this.agents(), name);
   }
   agentFile(name) {
-    return path5.join(this.agent(name), "agent.json");
+    return path6.join(this.agent(name), "agent.json");
   }
   agentRole(name) {
-    return path5.join(this.agent(name), "role.md");
+    return path6.join(this.agent(name), "role.md");
   }
   agentProfile(name) {
-    return path5.join(this.agent(name), "profile.md");
+    return path6.join(this.agent(name), "profile.md");
   }
   agentMemory(name) {
-    return path5.join(this.agent(name), "memory");
+    return path6.join(this.agent(name), "memory");
   }
   agentMemoryCore(name) {
-    return path5.join(this.agentMemory(name), "core.md");
+    return path6.join(this.agentMemory(name), "core.md");
   }
   /** Transcripts of the agent's finished turns, one JSON line per step. */
   agentTurns(name) {
-    return path5.join(this.agent(name), "turns");
+    return path6.join(this.agent(name), "turns");
   }
   agentTranscript(name, turnId) {
-    return path5.join(this.agentTurns(name), `${turnId}.jsonl`);
+    return path6.join(this.agentTurns(name), `${turnId}.jsonl`);
   }
   agentSkills(name) {
-    return path5.join(this.agent(name), "skills");
+    return path6.join(this.agent(name), "skills");
   }
   agentSkill(name, skill) {
-    return path5.join(this.agentSkills(name), skill);
+    return path6.join(this.agentSkills(name), skill);
   }
   agentSkillFile(name, skill) {
-    return path5.join(this.agentSkill(name, skill), "SKILL.md");
+    return path6.join(this.agentSkill(name, skill), "SKILL.md");
   }
   agentProjects(name) {
-    return path5.join(this.agent(name), "projects");
+    return path6.join(this.agent(name), "projects");
   }
   agentProject(name, slug) {
-    return path5.join(this.agentProjects(name), slug);
+    return path6.join(this.agentProjects(name), slug);
   }
   /**
    * A thread's, a channel's, or, in the society scope, a project's conversation's session and last
@@ -3550,46 +3683,56 @@ var BoardPaths = class {
    */
   agentConversation(name, slug, part) {
     if (part.startsWith("#")) {
-      return path5.join(this.agentProject(name, slug), "channels", part.slice(1));
+      return path6.join(this.agentProject(name, slug), "channels", part.slice(1));
     }
-    return part.startsWith("~") ? path5.join(this.agentProject(name, slug), "places", part.slice(1)) : path5.join(this.agentProject(name, slug), "threads", part);
+    return part.startsWith("~") ? path6.join(this.agentProject(name, slug), "places", part.slice(1)) : path6.join(this.agentProject(name, slug), "threads", part);
   }
   agentCursors(name) {
-    return path5.join(this.agent(name), "cursors.json");
+    return path6.join(this.agent(name), "cursors.json");
   }
   events() {
-    return path5.join(this.dataDir, "events");
+    return path6.join(this.dataDir, "events");
   }
   eventLog() {
-    return path5.join(this.events(), "log.jsonl");
+    return path6.join(this.events(), "log.jsonl");
   }
   /** Images citizens uploaded, by id: outside the projection, which every runner mirrors. */
   images() {
-    return path5.join(this.dataDir, "images");
+    return path6.join(this.dataDir, "images");
   }
   image(id) {
-    return path5.join(this.images(), id);
+    return path6.join(this.images(), id);
+  }
+  /**
+   * The repositories projects travel through between runners, one per move while it runs:
+   * outside the projection, which every runner mirrors, and served only to the move's runners.
+   */
+  moves() {
+    return path6.join(this.dataDir, "moves");
+  }
+  move(id) {
+    return path6.join(this.moves(), `${id}.git`);
   }
   state() {
-    return path5.join(this.dataDir, "state");
+    return path6.join(this.dataDir, "state");
   }
   pausedFile() {
-    return path5.join(this.state(), "paused.json");
+    return path6.join(this.state(), "paused.json");
   }
   /** Removed knowledge topics, set aside outside the projection, by scope. */
   removedKnowledge(scope) {
-    return path5.join(this.state(), "removed-knowledge", scope);
+    return path6.join(this.state(), "removed-knowledge", scope);
   }
   /** Skills removed from the society, set aside outside the projection, one directory per removal. */
   removedSkills() {
-    return path5.join(this.state(), "removed-skills");
+    return path6.join(this.state(), "removed-skills");
   }
 };
 
 // packages/board-core/dist/skill-folder.js
 import { constants } from "node:fs";
 import { lstat, open as open2, readdir as readdir3, readlink, realpath } from "node:fs/promises";
-import path6 from "node:path";
+import path7 from "node:path";
 var SKILL_TEXT_LIMIT_CHARS = 1e5;
 var SKILL_TEXT_LIMIT_BYTES = SKILL_TEXT_LIMIT_CHARS * 4;
 function skillFileText(bytes) {
@@ -3600,8 +3743,8 @@ function skillFileText(bytes) {
   };
 }
 function inside(root, file) {
-  const relative = path6.relative(root, file);
-  return relative !== ".." && !relative.startsWith(`..${path6.sep}`) && !path6.isAbsolute(relative);
+  const relative = path7.relative(root, file);
+  return relative !== ".." && !relative.startsWith(`..${path7.sep}`) && !path7.isAbsolute(relative);
 }
 async function handleInside(root, handle) {
   if (process.platform !== "linux") {
@@ -3611,7 +3754,7 @@ async function handleInside(root, handle) {
   return file !== null && inside(root, file);
 }
 async function walk(root, prefix, found) {
-  const entries = await readdir3(path6.join(root, ...prefix === "" ? [] : prefix.split("/")), {
+  const entries = await readdir3(path7.join(root, ...prefix === "" ? [] : prefix.split("/")), {
     withFileTypes: true
   }).catch(() => []);
   for (const entry of entries.toSorted((a, b) => a.name < b.name ? -1 : 1)) {
@@ -3632,7 +3775,7 @@ async function walk(root, prefix, found) {
 async function readEntry(root, relative) {
   let real;
   try {
-    real = await realpath(path6.join(root, ...relative.split("/")));
+    real = await realpath(path7.join(root, ...relative.split("/")));
   } catch {
     return null;
   }
@@ -3948,9 +4091,11 @@ var Board = class _Board {
   signIns = /* @__PURE__ */ new Map();
   files = new FileTree();
   homes;
+  moves;
   constructor(dataDir, options) {
     this.paths = new BoardPaths(dataDir);
-    this.homes = new HomeRepos(path7.join(this.paths.state(), "home-hooks"));
+    this.homes = new HomeRepos(path8.join(this.paths.state(), "home-hooks"));
+    this.moves = new MoveRepos(this.paths.moves());
     this.leaseMs = options.leaseMs ?? DEFAULT_LEASE_MS;
     this.now = options.now ?? (() => /* @__PURE__ */ new Date());
     this.events = new EventLog(this.paths.eventLog(), () => this.newId(), this.now);
@@ -3976,6 +4121,7 @@ var Board = class _Board {
     await board2.loadRunnerTokens();
     await board2.loadSignIns();
     await board2.homes.installHooks();
+    await board2.moves.clear();
     return board2;
   }
   /**
@@ -3985,7 +4131,7 @@ var Board = class _Board {
    */
   async applyAlignments() {
     const alignments = [];
-    const file = path7.join(this.paths.state(), "alignments.json");
+    const file = path8.join(this.paths.state(), "alignments.json");
     const { applied } = await exists(file) ? await readJson(file, AlignmentsSchema) : { applied: [] };
     const pending = alignments.filter(({ name }) => !applied.includes(name));
     if (pending.length === 0) {
@@ -4193,7 +4339,7 @@ ${charter.purpose}
     });
   }
   signInsFile() {
-    return path7.join(this.paths.state(), "sign-ins.json");
+    return path8.join(this.paths.state(), "sign-ins.json");
   }
   async readSignIns() {
     const file = this.signInsFile();
@@ -4290,7 +4436,7 @@ ${charter.purpose}
     const files = await listFiles(this.paths.tasks(project));
     const tasks = [];
     for (const file of files) {
-      const doc = await readMarkdown(path7.join(this.paths.tasks(project), file), TaskFrontmatterSchema);
+      const doc = await readMarkdown(path8.join(this.paths.tasks(project), file), TaskFrontmatterSchema);
       tasks.push({ ...doc.data, body: doc.body });
     }
     return tasks;
@@ -4309,7 +4455,7 @@ ${charter.purpose}
     const files = await listFiles(this.paths.proposals());
     const proposals = [];
     for (const file of files) {
-      const doc = await readMarkdown(path7.join(this.paths.proposals(), file), ProposalFrontmatterSchema);
+      const doc = await readMarkdown(path8.join(this.paths.proposals(), file), ProposalFrontmatterSchema);
       proposals.push({ ...doc.data, body: doc.body });
     }
     return proposals;
@@ -4336,7 +4482,7 @@ ${charter.purpose}
   async listMembers() {
     const members = [];
     for (const file of await listFiles(this.paths.members())) {
-      const doc = await readMarkdown(path7.join(this.paths.members(), file), MemberSchema);
+      const doc = await readMarkdown(path8.join(this.paths.members(), file), MemberSchema);
       members.push({ ...doc.data, profile: doc.body });
     }
     return members;
@@ -4355,7 +4501,7 @@ ${charter.purpose}
     const dir = project === null ? this.paths.societyKnowledge() : this.paths.projectKnowledge(project);
     const topics = [];
     for (const file of await listFiles(dir)) {
-      topics.push(await this.knowledgeAt(path7.join(dir, file), project, file.replace(/\.md$/, "")));
+      topics.push(await this.knowledgeAt(path8.join(dir, file), project, file.replace(/\.md$/, "")));
     }
     return topics;
   }
@@ -4385,7 +4531,7 @@ ${charter.purpose}
     const aside = this.paths.removedKnowledge(project ?? SOCIETY_SCOPE);
     let highest = 0;
     for (const file of (await listFiles(aside)).filter((name) => name.startsWith(`${topic}.`))) {
-      const copy = await this.knowledgeAt(path7.join(aside, file), project, topic);
+      const copy = await this.knowledgeAt(path8.join(aside, file), project, topic);
       highest = Math.max(highest, copy.revision);
     }
     return highest;
@@ -4401,7 +4547,7 @@ ${charter.purpose}
   async listSkillsIn(dir, scope) {
     const skills = [];
     for (const entry of await listDirs(dir)) {
-      const file = path7.join(dir, entry, "SKILL.md");
+      const file = path8.join(dir, entry, "SKILL.md");
       if (!await exists(file)) {
         continue;
       }
@@ -4491,7 +4637,7 @@ ${charter.purpose}
         if (!wanted.delete(file.slice(0, 26))) {
           continue;
         }
-        const { data } = await readMarkdown(path7.join(dir, file), MessageFrontmatterSchema);
+        const { data } = await readMarkdown(path8.join(dir, file), MessageFrontmatterSchema);
         found.push(MessageRefSchema.parse(data));
       }
       if (wanted.size === 0) {
@@ -4523,7 +4669,7 @@ ${charter.purpose}
         if (!file.endsWith(".md")) {
           continue;
         }
-        const doc = await readMarkdown(path7.join(threads, file), ThreadFrontmatterSchema);
+        const doc = await readMarkdown(path8.join(threads, file), ThreadFrontmatterSchema);
         if (doc.data.state !== "open") {
           continue;
         }
@@ -4550,7 +4696,7 @@ ${charter.purpose}
     const all = [];
     for (const threads of await this.threadScopes()) {
       for (const file of await listFiles(threads)) {
-        const doc = await readMarkdown(path7.join(threads, file), ThreadFrontmatterSchema);
+        const doc = await readMarkdown(path8.join(threads, file), ThreadFrontmatterSchema);
         const messages = await listFiles(this.paths.threadMessages(threads, doc.data.id));
         const last = messages.at(-1);
         all.push({
@@ -5145,7 +5291,7 @@ ${task.body}`;
         }
       }
       for (const file of await listFiles(this.paths.projectKnowledge(project))) {
-        const content = await readFile4(path7.join(this.paths.projectKnowledge(project), file), "utf8");
+        const content = await readFile4(path8.join(this.paths.projectKnowledge(project), file), "utf8");
         if (content.toLowerCase().includes(needle)) {
           hits.push({
             kind: "knowledge",
@@ -5166,7 +5312,7 @@ ${task.body}`;
       shared.push({
         kind: "knowledge",
         ref: `society/knowledge/${file}`,
-        file: path7.join(this.paths.societyKnowledge(), file)
+        file: path8.join(this.paths.societyKnowledge(), file)
       });
     }
     for (const skill of await this.listSocietySkills()) {
@@ -5179,7 +5325,7 @@ ${task.body}`;
       shared.push({
         kind: "memory",
         ref: `memory/${file}`,
-        file: path7.join(this.paths.agentMemory(actor.name), file)
+        file: path8.join(this.paths.agentMemory(actor.name), file)
       });
     }
     for (const entry of shared) {
@@ -5268,8 +5414,8 @@ ${current.body}`);
         removedAt: this.now().toISOString()
       });
       const aside = this.paths.removedKnowledge(args.project ?? SOCIETY_SCOPE);
-      await mkdir4(aside, { recursive: true });
-      await rename3(file, path7.join(aside, `${args.topic}.${removed.removedAt.replaceAll(":", "-")}.md`));
+      await mkdir5(aside, { recursive: true });
+      await rename3(file, path8.join(aside, `${args.topic}.${removed.removedAt.replaceAll(":", "-")}.md`));
       await this.events.append("knowledge.removed", actor.name, {
         topic: args.topic,
         project: args.project
@@ -5316,8 +5462,8 @@ ${current.body}`);
         removedAt: this.now().toISOString()
       });
       const aside = this.paths.removedSkills();
-      await mkdir4(aside, { recursive: true });
-      await rename3(this.paths.societySkill(args.name), path7.join(aside, `${args.name}.${removed.removedAt.replaceAll(":", "-")}`));
+      await mkdir5(aside, { recursive: true });
+      await rename3(this.paths.societySkill(args.name), path8.join(aside, `${args.name}.${removed.removedAt.replaceAll(":", "-")}`));
       await this.events.append("skill.removed", actor.name, {
         name: args.name,
         reason: args.reason
@@ -5394,7 +5540,7 @@ ${current.body}`);
         type,
         size: bytes.byteLength
       });
-      const name = path7.basename(args.path).replaceAll(/[[\]\\\r\n]/g, "");
+      const name = path8.basename(args.path).replaceAll(/[[\]\\\r\n]/g, "");
       return {
         id,
         type,
@@ -5420,7 +5566,7 @@ ${current.body}`);
   async listCrons() {
     const crons = [];
     for (const file of await listFiles(this.paths.crons())) {
-      crons.push(await this.readCronFile(path7.join(this.paths.crons(), file)));
+      crons.push(await this.readCronFile(path8.join(this.paths.crons(), file)));
     }
     return crons;
   }
@@ -5767,7 +5913,7 @@ ${current.body}`);
   async openThreadIds(dir, keep) {
     const ids = /* @__PURE__ */ new Set();
     for (const file of await listFiles(dir)) {
-      const doc = await readMarkdown(path7.join(dir, file), ThreadFrontmatterSchema);
+      const doc = await readMarkdown(path8.join(dir, file), ThreadFrontmatterSchema);
       if (doc.data.state === "open" && keep({ ...doc.data, body: doc.body })) {
         ids.add(doc.data.id);
       }
@@ -5775,12 +5921,12 @@ ${current.body}`);
     return ids;
   }
   /**
-   * Refuses to archive a project while a turn runs in it, in a citizen's conversation of its
-   * channels in the society scope, or in a thread its archive closes.
+   * Refuses to archive or move a project while a turn runs in it, in a citizen's conversation of
+   * its channels in the society scope, or in one of its open threads.
    */
-  async assertProjectQuiet(actor, slug) {
+  async assertProjectQuiet(actor, slug, what = `project ${slug} cannot be archived`) {
     const threads = await this.openThreadIds(this.paths.threads(slug), () => true);
-    this.assertNoTurnCut(actor, `project ${slug} cannot be archived`, (turn) => turn.scope === slug || turn.place === slug || turn.thread !== void 0 && threads.has(turn.thread));
+    this.assertNoTurnCut(actor, what, (turn) => turn.scope === slug || turn.place === slug || turn.thread !== void 0 && threads.has(turn.thread));
   }
   async closeThread(actor, input) {
     const args = VerbInputs.close_thread.parse(input);
@@ -6747,7 +6893,7 @@ ${rationale}`}`);
     return part === void 0 ? this.paths.agentProject(agent, scope) : this.paths.agentConversation(agent, scope, part);
   }
   async readSessions(agent, project, part) {
-    const file = path7.join(this.sessionDir(agent, project, part), "sessions.json");
+    const file = path8.join(this.sessionDir(agent, project, part), "sessions.json");
     return await exists(file) ? readJson(file, SessionsFileSchema) : {};
   }
   /**
@@ -6758,7 +6904,7 @@ ${rationale}`}`);
     await this.mutex.run(async () => {
       const dir = this.sessionDir(agent, project, part);
       await ensureDir(dir);
-      const file = path7.join(dir, "sessions.json");
+      const file = path8.join(dir, "sessions.json");
       const current = await exists(file) ? await readJson(file, SessionsFileSchema) : {};
       const kept = current.runner === void 0 || current.runner === runner ? current : {};
       await writeJson(file, { ...kept, [cli]: sessionId, runner });
@@ -6770,7 +6916,7 @@ ${rationale}`}`);
    */
   async dropSession(agent, project, cli, sessionId, part) {
     return this.mutex.run(async () => {
-      const file = path7.join(this.sessionDir(agent, project, part), "sessions.json");
+      const file = path8.join(this.sessionDir(agent, project, part), "sessions.json");
       if (!await exists(file)) {
         return false;
       }
@@ -6785,7 +6931,7 @@ ${rationale}`}`);
   }
   /** The last turn of one conversation: the scope's home, a channel's, a project's, or a thread's. */
   async readLastTurn(agent, project, part) {
-    const file = path7.join(this.sessionDir(agent, project, part), "last-turn.json");
+    const file = path8.join(this.sessionDir(agent, project, part), "last-turn.json");
     return await exists(file) ? readJson(file, TurnRecordSchema) : null;
   }
   /** The latest turn a citizen took in a scope, in any of its conversations there. */
@@ -6793,9 +6939,9 @@ ${rationale}`}`);
     let latest = await this.readLastTurn(agent, project);
     const place = this.paths.agentProject(agent, project);
     const parts = [
-      ...await listDirs(path7.join(place, "threads")),
-      ...(await listDirs(path7.join(place, "channels"))).map((name) => `#${name}`),
-      ...(await listDirs(path7.join(place, "places"))).map((name) => `~${name}`)
+      ...await listDirs(path8.join(place, "threads")),
+      ...(await listDirs(path8.join(place, "channels"))).map((name) => `#${name}`),
+      ...(await listDirs(path8.join(place, "places"))).map((name) => `~${name}`)
     ];
     for (const part of parts) {
       const turn = await this.readLastTurn(agent, project, part);
@@ -6861,6 +7007,7 @@ ${rationale}`}`);
         exitReason: parsed.exitReason,
         costUsd: parsed.costUsd,
         ...parsed.usage === null ? {} : { usage: parsed.usage },
+        ...parsed.contextTokens === void 0 ? {} : { contextTokens: parsed.contextTokens },
         toolCalls: parsed.toolCalls,
         model: parsed.model,
         summary: parsed.status?.summary ?? null,
@@ -7061,11 +7208,11 @@ ${rationale}`}`);
   }
   /** Small named state files under data/state, for cursors the scheduler must keep across restarts. */
   async readState(name, schema, fallback) {
-    const file = path7.join(this.paths.state(), `${name}.json`);
+    const file = path8.join(this.paths.state(), `${name}.json`);
     return await exists(file) ? readJson(file, schema) : fallback;
   }
   async writeState(name, value) {
-    await this.mutex.run(() => writeJson(path7.join(this.paths.state(), `${name}.json`), value));
+    await this.mutex.run(() => writeJson(path8.join(this.paths.state(), `${name}.json`), value));
   }
   /** The project's dashboard, empty at revision 0 when it has none. */
   async readDashboard(slug) {
@@ -7096,7 +7243,7 @@ ${rationale}`}`);
   async listRunners() {
     const runners2 = [];
     for (const file of await listFiles(this.paths.runners())) {
-      runners2.push((await readMarkdown(path7.join(this.paths.runners(), file), RunnerSchema)).data);
+      runners2.push((await readMarkdown(path8.join(this.paths.runners(), file), RunnerSchema)).data);
     }
     return runners2;
   }
@@ -7148,7 +7295,7 @@ ${rationale}`}`);
     return this.runnerTokens.get(hashToken(token)) ?? null;
   }
   runnerTokensFile() {
-    return path7.join(this.paths.state(), "runners.json");
+    return path8.join(this.paths.state(), "runners.json");
   }
   async readRunnerTokens() {
     const file = this.runnerTokensFile();
@@ -7162,7 +7309,8 @@ ${rationale}`}`);
   }
   /**
    * Places a project on the runner that will hold its repository, unless it already lives on one,
-   * and returns where it lives. Placement is once: every later turn of the project goes there.
+   * and returns where it lives. Placement is once: every later turn of the project goes there,
+   * until the user moves the project (`recordProjectMove`).
    */
   async placeProject(slug, runner) {
     return this.mutex.run(async () => {
@@ -7204,12 +7352,12 @@ ${rationale}`}`);
         }
         const relative = prefix === "" ? entry.name : `${prefix}/${entry.name}`;
         if (entry.isDirectory()) {
-          await walk2(path7.join(dir, entry.name), relative);
+          await walk2(path8.join(dir, entry.name), relative);
           continue;
         }
         const file = entry.isFile() ? conflictCopyOf(relative) : null;
         if (file !== null) {
-          const since = await this.homes.changedAt(home, relative) ?? (await stat3(path7.join(home, relative)).catch(() => null))?.mtime.toISOString();
+          const since = await this.homes.changedAt(home, relative) ?? (await stat3(path8.join(home, relative)).catch(() => null))?.mtime.toISOString();
           if (since !== void 0) {
             found.push({ path: relative, file, since });
           }
@@ -7283,6 +7431,74 @@ ${rationale}`}`);
       return next;
     });
   }
+  /**
+   * The board's half of moving a project to another runner, which only the user does, checked
+   * before anything travels and while the hub holds the project's turns: the project is active and
+   * lives on a runner other than `to`, which the board knows; no task there is landing, since its
+   * landing runs on the old runner; and no turn runs in the project. Tasks in play move with their
+   * branches, so the answer lists them for the capabilities the new runner must offer.
+   */
+  async prepareProjectMove(actor, slug, to) {
+    this.assertUser(actor, "only the user may move a project to another runner");
+    const runner = NameSchema.parse(to);
+    return this.mutex.run(async () => {
+      const project = await this.readActiveProject(slug);
+      const from = project.runner;
+      if (from === void 0) {
+        throw new BoardError("INVALID_STATE", `project ${slug} lives on no runner yet; its first turn places it`);
+      }
+      if (from === runner) {
+        throw new BoardError("INVALID_STATE", `project ${slug} already lives on ${runner}`);
+      }
+      await this.readRunner(runner);
+      const inPlay2 = (await this.listTasks(slug)).filter((task) => task.status === "open" || task.status === "claimed");
+      const landing = inPlay2.filter((task) => task.completing);
+      if (landing.length > 0) {
+        throw new BoardError("INVALID_STATE", `project ${slug} cannot be moved while ${landing.length} task(s) land on ${from} (${landing.map((task) => task.id).join(", ")}); move it once they have landed`);
+      }
+      await this.assertProjectQuiet(actor, slug, `project ${slug} cannot be moved`);
+      return { project: { ...project, runner: from }, inPlay: inPlay2 };
+    });
+  }
+  /**
+   * Records that a project moved, once its new runner holds every branch its old one had, or with
+   * nothing carried when the user moved it while the old runner was away: every later turn of
+   * the project goes to `to`. Refused when the project was archived or moved meanwhile.
+   */
+  async recordProjectMove(actor, move) {
+    this.assertUser(actor, "only the user may move a project to another runner");
+    return this.mutex.run(async () => {
+      const current = await this.readActiveProject(move.slug);
+      if (current.runner !== move.from) {
+        throw new BoardError("INVALID_STATE", `project ${move.slug} no longer lives on ${move.from}, so this move no longer applies`);
+      }
+      await this.readRunner(move.to);
+      const project = await this.updateProject(move.slug, (each) => ({ ...each, runner: move.to }));
+      await this.events.append("project.moved", actor.name, {
+        slug: move.slug,
+        from: move.from,
+        to: move.to,
+        carried: move.carried
+      });
+      return project;
+    });
+  }
+  /**
+   * Makes the repository a move carries a project through, for the server's git route to serve,
+   * and answers the move's id, which names it; `dropMoveRepo` removes it when the move ends.
+   */
+  async openMoveRepo() {
+    const id = this.newId();
+    await this.moves.open(this.paths.move(id));
+    return id;
+  }
+  async dropMoveRepo(id) {
+    await this.moves.drop(this.paths.move(UlidSchema.parse(id)));
+  }
+  /** Where the moves' repositories live, which the server's git route serves from. */
+  get moveRepos() {
+    return this.paths.moves();
+  }
   /** The projection a runner mirrors for its agents to read, by relative path, with hashes. */
   async boardManifest() {
     return this.files.manifest(this.paths.board, () => true);
@@ -7293,7 +7509,7 @@ ${rationale}`}`);
   async writeTurnRecord(record) {
     const dir = this.sessionDir(record.agent, record.project, conversationPart(record));
     await ensureDir(dir);
-    await writeJson(path7.join(dir, "last-turn.json"), record);
+    await writeJson(path8.join(dir, "last-turn.json"), record);
   }
   // ---------------------------------------------------------------------------------------------
   // Internals
@@ -7412,8 +7628,8 @@ Short, curated, loaded on every turn. Keep entries that change future behavior a
   async ensureAgentProject(name, slug) {
     const dir = this.paths.agentProject(name, slug);
     await ensureDir(dir);
-    if (!await exists(path7.join(dir, "sessions.json"))) {
-      await writeJson(path7.join(dir, "sessions.json"), {});
+    if (!await exists(path8.join(dir, "sessions.json"))) {
+      await writeJson(path8.join(dir, "sessions.json"), {});
     }
   }
   /**
@@ -7655,11 +7871,11 @@ Short, curated, loaded on every turn. Keep entries that change future behavior a
     const file = this.paths.societySkillFile(skill.name);
     const replaced = await exists(file);
     const taken = proposal.skillFiles;
-    const staged = path7.join(this.paths.proposalFiles(proposal.id), "SKILL.md");
+    const staged = path8.join(this.paths.proposalFiles(proposal.id), "SKILL.md");
     if (taken === void 0 || !await exists(staged)) {
       throw new BoardError("INVALID_STATE", `proposal ${proposal.id} holds no skill files`);
     }
-    await rm2(dir, { recursive: true, force: true });
+    await rm3(dir, { recursive: true, force: true });
     await cp(this.paths.proposalFiles(proposal.id), dir, { recursive: true });
     const { body } = await readLooseMarkdown(file);
     await writeMarkdown(file, {
@@ -7712,10 +7928,10 @@ Short, curated, loaded on every turn. Keep entries that change future behavior a
       return `the frontmatter of ${folder}/SKILL.md in ${proposal.proposedBy}'s home does not parse (${manual.error})`;
     }
     const dir = this.paths.proposalFiles(proposal.id);
-    await rm2(dir, { recursive: true, force: true });
+    await rm3(dir, { recursive: true, force: true });
     for (const entry of taken.files) {
-      const target = path7.join(dir, ...entry.path.split("/"));
-      await ensureDir(path7.dirname(target));
+      const target = path8.join(dir, ...entry.path.split("/"));
+      await ensureDir(path8.dirname(target));
       await writeFile4(target, contents.get(entry.path) ?? Buffer.alloc(0));
       await chmod2(target, entry.executable ? 493 : 420);
     }
@@ -7806,7 +8022,7 @@ Short, curated, loaded on every turn. Keep entries that change future behavior a
       if (!isSafeRelativePath(entry.path)) {
         continue;
       }
-      const bytes = await readFile4(path7.join(dir, ...entry.path.split("/"))).catch(() => null);
+      const bytes = await readFile4(path8.join(dir, ...entry.path.split("/"))).catch(() => null);
       files.push({
         ...entry,
         ...bytes === null ? { text: null, truncated: false } : skillFileText(bytes)
@@ -7955,7 +8171,7 @@ Short, curated, loaded on every turn. Keep entries that change future behavior a
     this.assertNoTurnCut(actor, `${ref} cannot be archived`, (turn) => turn.channel === channel && turn.scope === scope || turn.thread !== void 0 && closing.has(turn.thread));
     const threadsClosed = [];
     for (const file of await listFiles(threads)) {
-      const doc = await readMarkdown(path7.join(threads, file), ThreadFrontmatterSchema);
+      const doc = await readMarkdown(path8.join(threads, file), ThreadFrontmatterSchema);
       if (doc.data.channel !== ref || doc.data.state !== "open") {
         continue;
       }
@@ -8087,7 +8303,7 @@ ${charter.purpose}
     const threads = this.paths.threads(slug);
     const threadsClosed = [];
     for (const file of await listFiles(threads)) {
-      const doc = await readMarkdown(path7.join(threads, file), ThreadFrontmatterSchema);
+      const doc = await readMarkdown(path8.join(threads, file), ThreadFrontmatterSchema);
       if (doc.data.state !== "open") {
         continue;
       }
@@ -8162,10 +8378,10 @@ ${charter.purpose}
         ...project,
         members: project.members.filter((member) => member !== name)
       }));
-      const sessions = path7.join(this.paths.agentProject(name, slug), "sessions.json");
+      const sessions = path8.join(this.paths.agentProject(name, slug), "sessions.json");
       if (await exists(sessions)) {
         const archived = `sessions.archived.${ts.replace(/[:.]/g, "-")}.json`;
-        await rename3(sessions, path7.join(this.paths.agentProject(name, slug), archived));
+        await rename3(sessions, path8.join(this.paths.agentProject(name, slug), archived));
       }
     }
     this.tokenIndex.delete(current.tokenHash);
@@ -8506,7 +8722,7 @@ ${charter.purpose}
       if (since !== null && id <= since || upto !== void 0 && id > upto) {
         continue;
       }
-      const doc = await readMarkdown(path7.join(dir, file), MessageFrontmatterSchema);
+      const doc = await readMarkdown(path8.join(dir, file), MessageFrontmatterSchema);
       messages.push({ ...doc.data, body: doc.body });
     }
     return messages;
@@ -8634,6 +8850,7 @@ var DEFAULT_TIMINGS = Object.freeze({
   homeConflictMs: 24 * 36e5,
   scaleCooldownMs: 36e5,
   reflectionMs: 24 * 36e5,
+  sessionCapTokens: 3e5,
   transientRetryMs: [6e4, 3 * 6e4, 10 * 6e4]
 });
 var SchedulerTimingsSchema = z17.object({
@@ -8652,6 +8869,7 @@ var SchedulerTimingsSchema = z17.object({
   homeConflictMs: z17.number().positive(),
   scaleCooldownMs: z17.number().positive(),
   reflectionMs: z17.number().positive(),
+  sessionCapTokens: z17.number().int().positive(),
   transientRetryMs: z17.array(z17.number().positive())
 }).partial();
 function parseTimings(input) {
@@ -8694,7 +8912,12 @@ var StateSchema = z17.object({
   costSinceReport: z17.number().nonnegative().default(0),
   turnsSinceReport: z17.number().int().nonnegative().default(0),
   /** When each member last reflected, or was first seen; the cadence counts from here. */
-  lastReflection: z17.record(z17.string(), z17.string()).default({})
+  lastReflection: z17.record(z17.string(), z17.string()).default({}),
+  /**
+   * The home session each society member last asked for an early reflection for, once per
+   * session, and whether that reflection still waits to be queued.
+   */
+  earlyReflection: z17.record(z17.string(), z17.object({ session: z17.string(), due: z17.boolean() })).default({})
 });
 function messageOf(trigger) {
   return trigger.kind === "mention" || trigger.kind === "user_post" ? trigger.messageId : void 0;
@@ -9038,6 +9261,7 @@ var Scheduler = class {
         const cost = payload["costUsd"];
         this.state.costSinceReport += typeof cost === "number" ? cost : 0;
         this.state.turnsSinceReport += 1;
+        await this.checkSessionSize(event);
         return;
       }
       case "wake.requested": {
@@ -9766,9 +9990,44 @@ var Scheduler = class {
       item.dispatch = rest.length === 0 ? dispatch : { ...dispatch, crons: rest };
     }
   }
+  /**
+   * A society role's home session that a turn left at `sessionCapTokens` or more, by its latest
+   * model call, asks for a reflection ahead of the cadence, which `checkReflections` queues once
+   * none of the member's turns is queued or running; the reflection's end starts the home afresh
+   * (`TurnHost`), so its history goes only once a reflection saved what to keep. A session asks
+   * once, so a reflection that fails leaves the next to the cadence, and none asks while a
+   * reflection is queued or running.
+   */
+  async checkSessionSize(event) {
+    const { payload } = event;
+    const tokens = payload["contextTokens"];
+    const session = stringOf(payload["session"]);
+    if (typeof tokens !== "number" || tokens < this.timings.sessionCapTokens || session === null || payload["project"] !== SOCIETY_SCOPE || payload["thread"] !== void 0 || payload["channel"] !== void 0 || payload["place"] !== void 0 || payload["trigger"] === "reflection" || payload["sessionDropped"] === true) {
+      return;
+    }
+    const agent = await this.tryReadAgent(event.actor);
+    if (agent === null || agent.status !== "active") {
+      return;
+    }
+    const charter = await this.board.readRole(agent.role).catch(() => null);
+    if (charter === null || !charter.societyScope || !charter.reflects) {
+      return;
+    }
+    if (this.state.earlyReflection[agent.name]?.session === session) {
+      return;
+    }
+    const ofAgent = (key) => parseSessionKey(key)?.agent === agent.name;
+    const reflecting = [...this.pending].some(([key, item]) => ofAgent(key) && item.dispatch.trigger.kind === "reflection") || [...this.exclusive].some(([key, kind]) => ofAgent(key) && kind === "reflection");
+    if (reflecting) {
+      return;
+    }
+    this.state.earlyReflection[agent.name] = { session, due: true };
+    this.log.info({ agent: agent.name, contextTokens: tokens, cap: this.timings.sessionCapTokens }, "home session past the cap; a reflection is due");
+  }
   /**
    * Every `reflectionMs`, a member whose charter reflects takes a reflection turn in the scope of
-   * its latest working turn, unless it has not worked since its last reflection.
+   * its latest working turn, unless it has not worked since its last reflection; a society member
+   * whose home session passed the cap takes one in its home ahead of the cadence, which restarts it.
    */
   async checkReflections(now) {
     for (const agent of await this.board.listAgents()) {
@@ -9779,6 +10038,15 @@ var Scheduler = class {
       if (!charter.reflects) {
         continue;
       }
+      const early = this.state.earlyReflection[agent.name];
+      if (early?.due === true) {
+        if (!this.busy(agent.name)) {
+          this.state.lastReflection[agent.name] = iso(now);
+          this.state.earlyReflection[agent.name] = { ...early, due: false };
+          this.enqueue(agent.name, SOCIETY_SCOPE, { kind: "reflection", reason: "home session past the cap" }, now);
+        }
+        continue;
+      }
       const last = this.state.lastReflection[agent.name];
       if (last === void 0) {
         this.state.lastReflection[agent.name] = iso(now);
@@ -9792,8 +10060,7 @@ var Scheduler = class {
         this.state.lastReflection[agent.name] = iso(now);
         continue;
       }
-      const busy = [...this.pending.keys(), ...this.running.keys()].some((key) => parseSessionKey(key)?.agent === agent.name);
-      if (busy) {
+      if (this.busy(agent.name)) {
         continue;
       }
       this.state.lastReflection[agent.name] = iso(now);
@@ -9803,6 +10070,13 @@ var Scheduler = class {
       this.enqueue(agent.name, latest.scope, { kind: "reflection", reason: "scheduled reflection" }, now);
     }
   }
+  /**
+   * Whether a member has a turn queued or running anywhere, so a reflection waits for the next tick
+   * rather than merge into a working turn or run beside turns writing the memory it consolidates.
+   */
+  busy(agent) {
+    return [...this.pending.keys(), ...this.running.keys()].some((key) => parseSessionKey(key)?.agent === agent);
+  }
   /** The member's most recent turn that was not itself a reflection, with the scope it ran in. */
   async latestWorkingTurn(agent) {
     let latest = null;
@@ -10249,6 +10523,10 @@ var Scheduler = class {
         this.exclusive.set(key, "onboarding");
       } else if (dispatch.trigger.kind === "reflection") {
         this.exclusive.set(key, "reflection");
+        const early = this.state.earlyReflection[dispatch.agent];
+        if (early?.due === true) {
+          this.state.earlyReflection[dispatch.agent] = { ...early, due: false };
+        }
       }
     }
   }
@@ -10382,7 +10660,7 @@ var TURN_CONTRACT = [
   "- Work only inside your worktree. In a task's conversation it is a worktree of its own on the task's branch `task/<id>`: commit your work there. The branch is checked out in one worktree at a time and kept for the turns of whoever holds the task's stage, so a turn of anyone else there, or one that starts while another turn has the branch, works detached at its tip, which Your workspace then says; its commits go on the branch by a fast-forward when a turn in the task ends with the branch free, and the task's thread is told of commits that no longer build on its tip. After each turn the runner commits what you left on the branch and lets it go for the next holder. Your home worktree is on your own branch, `agent/<name>`, for work tied to no task; nothing lands from it by itself. In a proposal's, a topic's, or a channel's conversation it is a worktree of its own, detached at the project's default branch, which goes when the thread closes or the channel is archived, so work that should last goes on a task's branch. Before each turn the runner fetches the project's remote and brings what holds no work of yours up to the default branch: your own branch when it has no commits of its own, a task's branch nobody has worked on, and a detached worktree with nothing uncommitted; what it leaves where it is, and why, is under Your workspace in the prompt. It never merges or commits for you.",
   "- Posts that would wake this conversation may arrive while you work, delivered into the turn under a heading that says so and formatted like the digest. They are part of this turn: act on them now, after the step in hand, or not at all, as with the digest. The user may also stop a turn; the next turn is told.",
   "- Silence is allowed. If the digest needs no reply, post nothing.",
-  "- To come back to something later, set a cron with create_cron: a note on what to do then, and a five-field cron expression or one time with at. It wakes you in this conversation unless you name another, at most every fifteen minutes, and every fire is a paid turn, so end a cron with remove_cron once it has done its job. Never wait by holding a stage, sleeping, or leaving a process running: a turn's board token ends with the turn, so nothing it leaves behind can act on the board. The society's crons are under society/crons/ in the board projection.",
+  "- To come back to something later, set a cron with create_cron: a note on what to do then, and a five-field cron expression or one time with at. It wakes you in this conversation unless you name another, at most every fifteen minutes, and every fire is a paid turn, so end a cron with remove_cron once it has done its job. Never wait by sleeping or leaving a process running: a turn's board token ends with the turn, so nothing it leaves behind can act on the board. While you check your own stage's work on a schedule, such as a running job, CI, or a deploy, keep holding the stage: the cron sets when you check, and your turns in the task's thread renew its lease. Release a stage only to hand it on, or once its task's blocked_by names the tasks it waits on: the stage then wakes nobody until the last of them ends. Any other wait on someone else, such as the user or an outside party, is a stage of its own, not a held stage. The society's crons are under society/crons/ in the board projection.",
   "- An @mention wakes the citizen named, and every wake costs a turn. Address someone with @ only when you need them to act; when you merely refer to citizens, write their names plainly. A name in a code span or a code block is no mention, so code keeps its @ as written. @user wakes nobody, since the user takes no turns; it is what puts a question before the user, so use it only when you need the user to answer or decide.",
   "- A thread is a conversation off a channel that reaches only its participants and whoever is mentioned in it. Every task has one, opened with it under the task's id on the channel of its project it was filed in, general unless it was filed in another: talk about a task there, with post_message and its thread_id, and the notes you give advance_task and update_task are posted there as you. Its participants are the task's creator, its stage holders and assignees, whoever may take the stage that waits, and anyone who posted; it closes when the task ends. Every proposal has one too, in governance, opened with its pitch and closed by its decision. Open other threads with open_thread on a channel with a title, for any other topic; close_thread posts your summary to its channel.",
   "- To show an image in a post, such as a screenshot or a chart, save it anywhere you can read it, such as a folder from `mktemp -d`, call upload_image with its path, and put the markdown it returns in the post, `![what it shows](image:<id>)`, with what the image shows as its alt text: the board keeps the image, so it shows in any conversation after the file is gone. It takes a PNG, JPEG, GIF, or WebP of at most 8 MB from your worktree, your home, or the system temp folder. An image committed on a task's branch, linked by its path in the task's worktree, still shows in place, and so does one at an https address. Never put an image or any other file into a message as base64 or a data: URL: the board does not show it, and every reader of the conversation gets it in full in their prompt.",
@@ -10399,7 +10677,7 @@ var PLANNING = [
   "- Name stages by what gets done. Plan the next few steps rather than everything, and reshape with plan_task as the work teaches you.",
   "- Assign a stage to a role when anyone in it could do it, to a citizen only when it must be them, and to nobody when anyone in the project could. A citizen named on a stage must be a member of the task's project; add them first. A stage wakes everyone it is open to when it comes up, so the narrower the assignee, the fewer turns it costs.",
   "- Reshape rather than force: another round is an inserted stage, and a wait on something outside the society is a stage named for what it waits on. When a check finds work unfinished, the holder of the current stage sends the task back to an earlier stage with update_task, and so may the user, the steward, and the concierge; anyone else asks the concierge in the task's thread.",
-  "- A task that cannot start until other tasks finish names them with update_task blocked_by. While any of them is in play, its stage wakes nobody, neither when it comes up nor on a heartbeat; once the last has ended, done or abandoned, the stage wakes as if it had just come up, or wakes its holder. Nobody needs to clear the block or mention anyone when they end; change blocked_by only when the plan changes.",
+  "- A task that cannot start until other tasks finish names them with update_task blocked_by, and whoever holds its stage then releases it, since the heartbeat still wakes a holder. While any of them is in play, a stage nobody holds wakes nobody, neither when it comes up nor on a heartbeat; once the last has ended, done or abandoned, the stage wakes as if it had just come up, or wakes its holder. Nobody needs to clear the block or mention anyone when they end; change blocked_by only when the plan changes.",
   "- A gated stage is an independent check: nobody who held an earlier stage of the task may hold it, and only the user, the steward, and the concierge may add, remove, move, reassign, or ungate it. Ask them in the task's thread when a gate should change.",
   "- Commit your work on the task's branch before you advance, and say what you did in the advance note; it is the handover the next holder reads in the task's thread."
 ].join("\n");
@@ -10467,9 +10745,10 @@ var REFLECTION_STEPS = [
   "- Consolidate memory/core.md: keep it to lessons that still hold, about sixty lines at most, and move detail worth keeping to memory/<topic>.md in your home, which the board's search covers for you alone.",
   '- Extract a skill: a procedure you have followed twice is a candidate, and one that makes a citizen better at a kind of work on any project goes to skills/<name>/SKILL.md, frontmatter with `name` and a one-line `description` and then the steps, with any script or reference it uses in the same folder. Propose it with kind "skill" when more than one citizen would use it and nothing in it is tied to one place; one only you use stays yours.',
   "- Refresh profile.md: one paragraph on what you do well and what to send your way; the roster the front desk routes with is built from it.",
-  "- Share: how a codebase behaves goes in its AGENTS.md or README through a task like any change to the code, so propose it in that task's thread or the project channel; a durable fact about this scope as a place (runners, access, flow, where results live) goes through write_knowledge; a norm the whole society should follow goes to the steward as a plain post in general.",
-  "- Report memoryUpdated: true in the status object when core.md or a skill changed."
+  "- Share: how a codebase behaves goes in its AGENTS.md or README through a task like any change to the code, so propose it in that task's thread or the project channel; a durable fact about this scope as a place (runners, access, flow, where results live) goes through write_knowledge; a norm the whole society should follow goes to the steward as a plain post in general."
 ];
+var SAVE_WHAT_IS_OPEN = "- This conversation's session ends with this turn, and the next turn here starts a new one that knows only your home's files and the board: write anything still open into memory/core.md, or the archive it points to, before you end.";
+var REFLECTION_REPORT = "- Report memoryUpdated: true in the status object when core.md or a skill changed.";
 var MAX_BODY_CHARS = 1500;
 var MAX_PROFILE_CHARS = 200;
 function clip(text) {
@@ -10654,7 +10933,7 @@ function buildTurnPrompt(input) {
   lines.push("", WORKSPACE_TOKEN);
   const conflicts = input.conflicts ?? [];
   if (dispatch.trigger.kind === "reflection") {
-    lines.push("", "## Reflection", "", REFLECTION_INTRO, ...conflicts.length > 0 ? [RECONCILE] : [], ...REFLECTION_STEPS);
+    lines.push("", "## Reflection", "", REFLECTION_INTRO, ...conflicts.length > 0 ? [RECONCILE] : [], ...REFLECTION_STEPS, ...input.afreshAfterReflection === true ? [SAVE_WHAT_IS_OPEN] : [], REFLECTION_REPORT);
   }
   if (input.onboarding !== null) {
     lines.push("", "## First turn", "", renderOnboardingPreamble(input.onboarding));
@@ -10668,6 +10947,9 @@ function buildTurnPrompt(input) {
       "Its CLI could not resume this conversation's session, so the session was dropped and this turn starts a new one: nothing of your earlier turns here carries over but what is on the board and in your home."
     ] : [], "The worktree may hold uncommitted changes. Run git status before doing anything else.");
   }
+  if (last?.trigger.kind === "reflection" && last.exitReason === "completed" && last.sessionDropped === true) {
+    lines.push("", "## Your session started afresh", "", "Your last turn here was a reflection, and this conversation's session ended with it, so this turn starts a new one: what you kept is in memory/core.md and the archive it points to, and what your earlier turns did is on the board, in your posts and the threads and tasks you worked in, which search and the board's files reach.");
+  }
   const society = input.societyView;
   if (society !== void 0 && society !== null) {
     lines.push("", "## The society", "", `Each ask is a conversation of its own, and others may be in a turn at the same time. Before proposing a citizen, a role, or a project, look at the proposals still waiting under ${PATH_TOKENS.board}/society/proposals/: another ask may have proposed it already.`, "", "### Projects", "");
@@ -10684,7 +10966,7 @@ function buildTurnPrompt(input) {
   }
   const machines = input.runners;
   if (machines !== void 0 && machines !== null) {
-    lines.push("", "## Runners", "", "The machines turns run on. A project lives on the runner that takes its first turn, one that offers every capability the project and that turn's task require, and never moves. A task's required_capabilities must name capabilities exactly as a runner below offers them; a task needing one its project's runner lacks waits. A runner's quota is what each CLI's login there last reported of its plan, in percent of each window; a CLI limited until a time fails its turns there until then.", "");
+    lines.push("", "## Runners", "", "The machines turns run on. A project lives on the runner that takes its first turn, one that offers every capability the project and that turn's task require, and moves only when the user moves it. A task's required_capabilities must name capabilities exactly as a runner below offers them; a task needing one its project's runner lacks waits. A runner's quota is what each CLI's login there last reported of its plan, in percent of each window; a CLI limited until a time fails its turns there until then.", "");
     if (machines.runners.length === 0) {
       lines.push("None registered yet.");
     }
@@ -10907,7 +11189,10 @@ var TurnHost = class {
     const newSession = recorded === void 0;
     const lastTurn = await this.board.readLastTurn(agent.name, dispatch.project, part);
     const costSoFarUsd = !newSession && lastTurn?.session === recorded ? lastTurn.sessionCostUsd ?? lastTurn.costUsd : 0;
+    const usageSoFar = !newSession && lastTurn?.session === recorded ? lastTurn.sessionUsage : void 0;
     const resumeRetries = !newSession && lastTurn?.session === recorded && lastTurn.resumeFailed === "retry" ? lastTurn.resumeRetries ?? 1 : 0;
+    const afreshAfterReflection = charter.societyScope && agent.role !== USER_ROLE && societyScope && part === void 0;
+    const afterReflection = lastTurn?.trigger.kind === "reflection" && lastTurn.sessionDropped === true;
     const digest = await this.board.readDigest({
       ...actor,
       scope: dispatch.project,
@@ -10919,7 +11204,7 @@ var TurnHost = class {
     const messages = threadSoFar ?? digest.messages;
     const cursorAfter = threadSoFar?.at(-1)?.id ?? digest.cursor;
     const held = task === null ? [] : (await this.board.heldClaims(agent.name)).filter((each) => each.id === task.id);
-    const onboarding = dispatch.onboarding || newSession && part === void 0 ? {
+    const onboarding = dispatch.onboarding || newSession && part === void 0 && !afterReflection ? {
       agentName: agent.name,
       roleSummary: charter.purpose,
       project: dispatch.project,
@@ -10998,6 +11283,7 @@ var TurnHost = class {
       project,
       lastTurn,
       onboarding,
+      afreshAfterReflection,
       societyView,
       runners: runners2,
       knowledge,
@@ -11010,7 +11296,8 @@ var TurnHost = class {
     const record = await this.board.beginTurn({
       ...base,
       session: recorded ?? null,
-      sessionCostUsd: costSoFarUsd
+      sessionCostUsd: costSoFarUsd,
+      ...usageSoFar === void 0 ? {} : { sessionUsage: usageSoFar }
     });
     if (record.id === void 0) {
       throw new Error("the board gave the turn no id");
@@ -11028,6 +11315,7 @@ var TurnHost = class {
       ...place === void 0 ? {} : { place },
       session: recorded ?? null,
       costSoFarUsd,
+      ...usageSoFar === void 0 ? {} : { usageSoFar },
       instructions,
       prompt,
       mcp: { url: this.mcpUrl, token },
@@ -11057,6 +11345,7 @@ var TurnHost = class {
       transcript: [],
       coldToken: residentKey === null ? token : null,
       residentKey: residentKey === null ? null : `${runner.name}|${residentKey}`,
+      afreshAfterReflection,
       keepLeases,
       done,
       fail
@@ -11220,8 +11509,10 @@ var TurnHost = class {
     const part = conversationPart(job);
     const resumeRetries = outcome.resumeFailed === "retry" ? turn.resumeRetries + 1 : void 0;
     const dropSession = job.session !== null && (outcome.resumeFailed === "lost" || (resumeRetries ?? 0) >= RESUME_RETRIES);
+    const reflected = turn.afreshAfterReflection && turn.record.trigger.kind === "reflection" && outcome.exitReason === "completed";
+    const { sessionUsage: _started, ...begun } = turn.record;
     const finished = {
-      ...turn.record,
+      ...begun,
       session: outcome.session,
       endedAt: this.now().toISOString(),
       exitReason: outcome.exitReason,
@@ -11230,6 +11521,8 @@ var TurnHost = class {
       usage: outcome.usage,
       costUsd: outcome.costUsd,
       sessionCostUsd: outcome.sessionCostUsd ?? turn.costSoFarUsd,
+      ...outcome.sessionUsage === void 0 ? {} : { sessionUsage: outcome.sessionUsage },
+      ...outcome.contextTokens === void 0 ? {} : { contextTokens: outcome.contextTokens },
       toolCalls: turn.transcript.filter((entry) => entry.event.type === "tool_call").length,
       model: outcome.model ?? turn.configuredModel,
       ...outcome.work === null ? {} : { work: outcome.work },
@@ -11237,7 +11530,7 @@ var TurnHost = class {
       ...outcome.resumeFailed === void 0 ? {} : { resumeFailed: outcome.resumeFailed },
       ...outcome.transient === true ? { transient: true } : {},
       ...resumeRetries === void 0 ? {} : { resumeRetries },
-      ...dropSession ? { sessionDropped: true } : {}
+      ...dropSession || reflected ? { sessionDropped: true } : {}
     };
     const ended = await this.conversationEnded(job);
     const closing = turn.record.trigger.kind === "closing";
@@ -11255,6 +11548,11 @@ var TurnHost = class {
           resumeFailed: outcome.resumeFailed,
           resumeRetries
         }, "dropped a session its CLI could not resume");
+      } else if (reflected) {
+        if (job.session !== null) {
+          await this.board.dropSession(job.agent, job.scope, job.cli, job.session, part);
+        }
+        this.log.info({ agent: job.agent, project: job.scope, session: outcome.session }, "dropped a home session after its reflection");
       } else if (outcome.session !== null && outcome.session !== job.session) {
         await this.board.writeSession(job.agent, job.scope, job.cli, outcome.session, turn.runner, part);
       }
@@ -11550,6 +11848,8 @@ var RunnerProtocolError = class extends Error {
 };
 var RunnerAwayError = class extends Error {
 };
+var MoveSourceAwayError = class extends Error {
+};
 var SILENT2 = { info() {
 }, warn() {
 }, error() {
@@ -11582,6 +11882,12 @@ var RunnerHub = class {
   /** Disconnects being recorded, which `close` waits for. */
   detaching = /* @__PURE__ */ new Set();
   runnerListeners = /* @__PURE__ */ new Set();
+  /** The project being moved, by slug: none of its turns is placed and nothing lands there until it ends. */
+  moving = /* @__PURE__ */ new Map();
+  /** Turns of each project placed on a runner and not yet opened, which the board cannot see yet. */
+  starting = /* @__PURE__ */ new Map();
+  /** Moves started since the hub did, so a placement that a move overtook gives its turn back. */
+  moveStarts = 0;
   constructor(options) {
     this.board = options.board;
     this.host = options.host;
@@ -11853,6 +12159,7 @@ var RunnerHub = class {
     return accepted ? "sent" : "refused";
   }
   async assign(dispatch) {
+    const starts = this.moveStarts;
     const agent = await this.board.readAgent(dispatch.agent).catch(() => null);
     if (agent === null) {
       return { refused: `no agent ${dispatch.agent}` };
@@ -11869,6 +12176,9 @@ var RunnerHub = class {
     if (dispatch.project === SOCIETY_SCOPE) {
       chosen = await this.pinnedSeat(agent.name, agent.homeRunner, cli, free);
     } else {
+      if (this.moving.has(dispatch.project)) {
+        return null;
+      }
       const project = await this.board.readProject(dispatch.project);
       let home = project.runner;
       if (home === void 0) {
@@ -11895,7 +12205,13 @@ var RunnerHub = class {
     if (chosen === void 0) {
       return null;
     }
+    if (dispatch.project !== SOCIETY_SCOPE && (this.moving.has(dispatch.project) || this.moveStarts !== starts)) {
+      return null;
+    }
     chosen.inUse += 1;
+    if (dispatch.project !== SOCIETY_SCOPE) {
+      this.starting.set(dispatch.project, (this.starting.get(dispatch.project) ?? 0) + 1);
+    }
     return { runner: chosen.name };
   }
   async runTurn(dispatch, assignment) {
@@ -11904,11 +12220,23 @@ var RunnerHub = class {
     }
     const seat = this.seats.get(assignment.runner);
     let turnId = null;
+    let placed = dispatch.project !== SOCIETY_SCOPE;
+    const opening = () => {
+      if (placed) {
+        placed = false;
+        const left = (this.starting.get(dispatch.project) ?? 1) - 1;
+        if (left > 0) {
+          this.starting.set(dispatch.project, left);
+        } else {
+          this.starting.delete(dispatch.project);
+        }
+      }
+    };
     try {
       if (seat === void 0) {
         return await this.host.refuseTurn(dispatch, assignment.runner, "the runner is gone");
       }
-      const opened = await this.host.openTurn(dispatch, this.seatView(seat));
+      const opened = await this.host.openTurn(dispatch, this.seatView(seat)).finally(opening);
       if ("failed" in opened) {
         return opened.failed;
       }
@@ -11920,6 +12248,7 @@ var RunnerHub = class {
       turnId = opened.job.turnId;
       return await opened.ended;
     } finally {
+      opening();
       if (seat !== void 0) {
         seat.inUse = Math.max(0, seat.inUse - 1);
         if (turnId !== null) {
@@ -11952,6 +12281,9 @@ var RunnerHub = class {
       });
       return "done";
     }
+    if (this.moving.has(project)) {
+      return "deferred";
+    }
     let outcome = { ok: true, detail: "nothing to land, since the task left no branch" };
     if (record.runner !== void 0) {
       const seat = this.seats.get(record.runner);
@@ -12004,6 +12336,9 @@ var RunnerHub = class {
     if (task.status !== "abandoned" || task.onDone !== "ghpr" || pull === void 0 || pull.closed !== void 0) {
       return "done";
     }
+    if (this.moving.has(project)) {
+      return "deferred";
+    }
     const record = await this.board.readProject(project);
     let outcome = {
       ok: false,
@@ -12036,16 +12371,171 @@ var RunnerHub = class {
     });
     return "done";
   }
+  /**
+   * Moves a project to another runner, which only the user does, carrying every branch and tag of
+   * its repository: the project's turns, landings, and pull-request closes wait while it runs.
+   * The old runner pushes to a repository on the server once no worktree of the project holds work
+   * no branch does, the new runner clones it, and the board records the new runner only once that
+   * runner holds every branch and tag at the commit the old one had; until then the project works
+   * where it was. The server's repository goes as the move ends, and the old runner then removes
+   * its copy. With the old runner away nothing can travel, so the move goes ahead only when the
+   * user says `withoutBranches`, and the branches stay there.
+   */
+  async moveProject(actor, slug, to, options = {}) {
+    const under = [...this.moving.keys()];
+    if (under.length > 0) {
+      throw new BoardError("INVALID_STATE", `a move of ${under.join(", ")} is under way; try again once it ends`);
+    }
+    const move = { id: null, from: null, to, phase: "checking" };
+    this.moving.set(slug, move);
+    this.moveStarts += 1;
+    let source;
+    let moved;
+    try {
+      if ((this.starting.get(slug) ?? 0) > 0) {
+        throw new BoardError("INVALID_STATE", `a turn of ${slug} is starting; try again once it has started and ended`);
+      }
+      const { project, inPlay: inPlay2 } = await this.board.prepareProjectMove(actor, slug, to);
+      const from = project.runner;
+      move.from = from;
+      const target = this.seats.get(to);
+      if (target === void 0 || target.send === null) {
+        throw new BoardError("INVALID_STATE", `runner ${to} is not connected`);
+      }
+      await this.assertCanHost(target, project, inPlay2);
+      source = this.seats.get(from);
+      if (source === void 0 || source.send === null) {
+        if (options.withoutBranches !== true) {
+          throw new MoveSourceAwayError(sourceAwayMessage(project, from, to, inPlay2));
+        }
+        move.phase = "recording";
+        const recorded2 = await this.board.recordProjectMove(actor, {
+          slug,
+          from,
+          to,
+          carried: null
+        });
+        this.log.info({ project: slug, from, to }, "project moved without its branches");
+        return { project: recorded2, carried: null, released: null };
+      }
+      if (options.withoutBranches === true) {
+        throw new BoardError("INVALID_STATE", `runner ${from}, where ${slug} lives, is connected, so the move carries its branches`);
+      }
+      if (!source.hello.projectMoves) {
+        throw new BoardError("INVALID_STATE", `runner ${from}, where ${slug} lives, cannot carry a project yet; upgrade it`);
+      }
+      const repo = projectRepo(project);
+      move.id = await this.board.openMoveRepo();
+      const id = move.id;
+      move.phase = "export";
+      const exported = ProjectExportedSchema.parse(await this.request(source, (request) => ({
+        type: "export",
+        request,
+        export: { move: id, repo }
+      })).catch((error) => {
+        throw new BoardError("INVALID_STATE", `${from} could not send ${slug}: ${describe(error)}`);
+      }));
+      if (!exported.ok) {
+        throw new BoardError("INVALID_STATE", exported.held.length === 0 ? `${slug}'s repository on ${from} is ${mebibytes(exported.bytes)}, more than a move carries (${mebibytes(MOVE_PACK_LIMIT_BYTES)})` : `${slug} cannot be moved while work no branch holds sits in its worktrees on ${from}: ${exported.held.map(heldLine).join("; ")}. Have each citizen commit it or clear it, then move again`);
+      }
+      move.phase = "import";
+      const imported = ProjectImportedSchema.parse(await this.request(target, (request) => ({
+        type: "import",
+        request,
+        import: { move: id, repo, pullRequests: project.onDone === "ghpr" }
+      })).catch((error) => {
+        throw new BoardError("INVALID_STATE", `${to} could not take ${slug}: ${describe(error)}`);
+      }));
+      move.phase = "recording";
+      const differ = differentRefs(exported.refs, imported.refs);
+      if (differ.length > 0) {
+        await this.releaseOn(target, slug);
+        throw new BoardError("INVALID_STATE", `${slug} arrived on ${to} unlike it left ${from} (${differ.slice(0, 5).join(", ")}${differ.length > 5 ? ", \u2026" : ""}); it stays on ${from}`);
+      }
+      const carried = Object.keys(exported.refs).length;
+      const recorded = await this.board.recordProjectMove(actor, { slug, from, to, carried }).catch(async (error) => {
+        await this.releaseOn(target, slug);
+        throw error;
+      });
+      this.log.info({ project: slug, from, to, carried }, "project moved");
+      moved = { project: recorded, carried };
+    } finally {
+      this.moving.delete(slug);
+      if (move.id !== null) {
+        const id = move.id;
+        await this.board.dropMoveRepo(id).catch((error) => {
+          this.log.warn({ move: id, error: String(error) }, "could not remove a move's repository");
+        });
+      }
+    }
+    return { ...moved, released: await this.releaseOn(source, slug) };
+  }
+  /**
+   * Whether a runner may reach a move's repository on the server: the old runner to push while it
+   * exports, the new one to fetch while it imports. `unknown` for a move that is not under way.
+   */
+  moveAccess(runner, id, push) {
+    const move = [...this.moving.values()].find((each) => each.id !== null && each.id === id);
+    if (move === void 0) {
+      return "unknown";
+    }
+    const allowed = push ? move.phase === "export" && runner === move.from : move.phase === "import" && runner === move.to;
+    return allowed ? "allowed" : "refused";
+  }
+  /** Refuses a runner that cannot take a project's turns: its members' CLIs, the capabilities, a git identity. */
+  async assertCanHost(seat, project, inPlay2) {
+    if (!seat.hello.projectMoves) {
+      throw new BoardError("INVALID_STATE", `runner ${seat.name} cannot take a project yet; upgrade it`);
+    }
+    const lacking = [];
+    for (const name of project.members) {
+      const agent = await this.board.readAgent(name).catch(() => null);
+      if (agent !== null && agent.status === "active" && agent.cli !== null && !seat.hello.clis.includes(agent.cli)) {
+        lacking.push(`${agent.cli} for ${agent.name}`);
+      }
+    }
+    const needs = /* @__PURE__ */ new Set([
+      ...project.requiredCapabilities,
+      ...inPlay2.flatMap((task) => task.requiredCapabilities)
+    ]);
+    const missing = [...needs].filter((each) => !seat.hello.capabilities.includes(each));
+    if (missing.length > 0) {
+      lacking.push(`the ${missing.length === 1 ? "capability" : "capabilities"} ${missing.join(", ")}`);
+    }
+    const identity = seat.hello.gitIdentityMissing ?? [];
+    if (identity.length > 0) {
+      lacking.push(`a git ${identity.join(" and ")} for citizens' commits`);
+    }
+    if (lacking.length > 0) {
+      throw new BoardError("INVALID_STATE", `runner ${seat.name} cannot take ${project.slug}: it lacks ${lacking.join("; ")}`);
+    }
+  }
+  /** Asks a runner to remove its copy of a project that lives elsewhere now; how that went, never a throw. */
+  async releaseOn(seat, slug) {
+    if (seat === void 0) {
+      return null;
+    }
+    try {
+      const released = ProjectReleasedSchema.parse(await this.request(seat, (request) => ({ type: "release", request, release: { slug } }), SWEEP_TIMEOUT_MS));
+      return {
+        ok: true,
+        detail: `${seat.name} removed ${released.worktrees} worktree(s)${released.clone ? " and its clone" : ""}`
+      };
+    } catch (error) {
+      this.log.warn({ runner: seat.name, project: slug, error: String(error) }, "could not release a project");
+      return { ok: false, detail: `${seat.name} kept its copy of ${slug}: ${describe(error)}` };
+    }
+  }
   /**
    * One path on a branch of a project's repository, read on the runner the project lives on.
    * NOT_FOUND when the project has no runner yet or the branch or the path does not exist, and
    * `RunnerAwayError` while its runner is away.
    */
-  async readBranch(project, branch, path11) {
+  async readBranch(project, branch, path12) {
     const { seat, repo } = await this.projectSeat(project, "branchReads", "read files");
-    const file = BranchFileSchema.nullable().parse(await this.request(seat, (request) => ({ type: "file", request, read: { repo, branch, path: path11 } }), FILE_TIMEOUT_MS));
+    const file = BranchFileSchema.nullable().parse(await this.request(seat, (request) => ({ type: "file", request, read: { repo, branch, path: path12 } }), FILE_TIMEOUT_MS));
     if (file === null) {
-      throw new BoardError("NOT_FOUND", `${branch} has no ${path11 === "" ? "commit" : path11}`);
+      throw new BoardError("NOT_FOUND", `${branch} has no ${path12 === "" ? "commit" : path12}`);
     }
     return file;
   }
@@ -12065,11 +12555,11 @@ var RunnerHub = class {
    * What a branch of a project's repository did to one file since it left the default branch, read
    * on the runner the project lives on, with the same refusals as `branchChanges`.
    */
-  async branchDiff(project, branch, path11) {
+  async branchDiff(project, branch, path12) {
     const { seat, repo } = await this.projectSeat(project, "branchChanges", "list changes");
-    const diff = BranchFileDiffSchema.nullable().parse(await this.request(seat, (request) => ({ type: "diff", request, read: { repo, branch, path: path11 } }), FILE_TIMEOUT_MS));
+    const diff = BranchFileDiffSchema.nullable().parse(await this.request(seat, (request) => ({ type: "diff", request, read: { repo, branch, path: path12 } }), FILE_TIMEOUT_MS));
     if (diff === null) {
-      throw new BoardError("NOT_FOUND", `${branch} did not change ${path11}`);
+      throw new BoardError("NOT_FOUND", `${branch} did not change ${path12}`);
     }
     return diff;
   }
@@ -12306,6 +12796,32 @@ var RunnerHub = class {
     });
   }
 };
+function describe(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function mebibytes(bytes) {
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MiB`;
+}
+function heldLine(held) {
+  const where = held.conversation === null ? "its own worktree" : held.conversation.kind === "thread" ? `thread ${held.conversation.id}` : held.conversation.kind === "channel" ? `channel ${held.conversation.name}` : `the channels of ${held.conversation.project}`;
+  const parts = [
+    held.uncommitted > 0 ? `${held.uncommitted} uncommitted file(s)` : "",
+    held.onNoBranch > 0 ? `${held.onNoBranch} commit(s) on no branch` : ""
+  ].filter((part) => part !== "");
+  return `${held.agent}, ${where}: ${parts.join(" and ")}`;
+}
+function differentRefs(left, right) {
+  const names = /* @__PURE__ */ new Set([...Object.keys(left), ...Object.keys(right)]);
+  return [...names].filter((name) => left[name] !== right[name]).toSorted();
+}
+function sourceAwayMessage(project, from, to, inPlay2) {
+  const stays = [
+    "its local branches and worktrees",
+    project.repo === null ? `its whole history, since ${project.slug} has no remote (${to} would start an empty repository)` : "",
+    inPlay2.length === 0 ? "" : `the work of ${inPlay2.length} task(s) in play (${inPlay2.map((task) => task.id).join(", ")})`
+  ].filter((part) => part !== "");
+  return `runner ${from}, where ${project.slug} lives, is not connected, so nothing can travel. Staying on ${from}: ${stays.join("; ")}. Move it without them to go ahead`;
+}
 
 // apps/server/dist/index.js
 import pino from "pino";
@@ -12381,6 +12897,7 @@ import { z as z19, ZodError } from "zod";
 // apps/server/dist/body-limit.js
 import { bodyLimit } from "hono/body-limit";
 var ENROLL_BODY_LIMIT_BYTES = 16 * 1024;
+var APP_TOKEN_BODY_LIMIT_BYTES = 16 * 1024;
 var API_BODY_LIMIT_BYTES = 1024 * 1024;
 var RUNNER_BODY_LIMIT_BYTES = 8 * 1024 * 1024;
 var RUNNER_ANSWER_LIMIT_BYTES = 16 * 1024 * 1024;
@@ -12398,13 +12915,19 @@ function limitBody(maxSize) {
 }
 
 // apps/server/dist/github-auth.js
-import { randomBytes as randomBytes2 } from "node:crypto";
+import { createHash as createHash3, randomBytes as randomBytes2, timingSafeEqual } from "node:crypto";
 import { Hono } from "hono";
 import { z as z18 } from "zod";
 var SIGN_IN_TTL_MS = 30 * 24 * 36e5;
 var STATE_TTL_MS = 10 * 6e4;
 var MAX_STATES = 1e3;
+var CODE_TTL_MS = 2 * 6e4;
 var TokenAnswerSchema = z18.object({ access_token: z18.string().min(1) });
+var CodeChallengeSchema = z18.string().regex(/^[A-Za-z0-9_-]{43}$/);
+var CodeExchangeSchema = z18.object({
+  code: z18.string().min(1).max(64),
+  code_verifier: z18.string().regex(/^[A-Za-z0-9._~-]{43,128}$/)
+});
 var GithubUserSchema = z18.object({
   login: z18.string().min(1),
   id: z18.number().int(),
@@ -12418,30 +12941,67 @@ function githubAvatar(url) {
     return void 0;
   }
 }
+var BOARD_ORIGIN = "https://board.invalid";
 function safeNext(next) {
-  return next !== void 0 && /^\/(?![/\\])/.test(next) ? next : "/";
+  if (next === void 0 || !next.startsWith("/")) {
+    return "/";
+  }
+  let url;
+  try {
+    url = new URL(next, BOARD_ORIGIN);
+  } catch {
+    return "/";
+  }
+  const path12 = `${url.pathname}${url.search}`;
+  return url.origin === BOARD_ORIGIN && /^\/(?![/\\])/.test(path12) ? path12 : "/";
 }
+var APP_LANDING = "/auth/app/signin";
 function land(c, next, fragment) {
+  c.header("cache-control", "no-store");
   return c.redirect(`${next}#${fragment}`, 302);
 }
+function prune(map, now) {
+  for (const [key, entry] of map) {
+    if (entry.expiresAt <= now || map.size >= MAX_STATES) {
+      map.delete(key);
+    }
+  }
+}
+function provesChallenge(verifier, challenge) {
+  const answer = Buffer.from(createHash3("sha256").update(verifier).digest("base64url"));
+  const expected = Buffer.from(challenge);
+  return answer.length === expected.length && timingSafeEqual(answer, expected);
+}
 function githubAuthRoutes(options) {
   const { board: board2, github } = options;
   const fetchImpl = options.fetch ?? fetch;
   const now = options.now ?? Date.now;
   const states = /* @__PURE__ */ new Map();
+  const codes = /* @__PURE__ */ new Map();
   const routes = new Hono();
-  routes.get("/config", (c) => c.json({ github: github !== null }));
+  routes.get("/config", (c) => c.json({ github: github !== null, appLanding: (github?.appleAppId ?? null) !== null }));
+  routes.get("/app/signin", (c) => c.text("not found", 404, { "cache-control": "no-store" }));
   if (github === null) {
     return routes;
   }
-  routes.get("/github", options.limit ?? ((_c, next) => next()), (c) => {
-    for (const [state2, pending] of states) {
-      if (pending.expiresAt <= now() || states.size >= MAX_STATES) {
-        states.delete(state2);
+  const limit2 = options.limit ?? ((_c, next) => next());
+  routes.get("/github", limit2, (c) => {
+    const app2 = c.req.query("landing") === "app";
+    let challenge = null;
+    if (app2) {
+      if (github.appleAppId === null) {
+        return c.text("Signing in to the app is off on this board", 403);
+      }
+      const parsed = CodeChallengeSchema.safeParse(c.req.query("code_challenge"));
+      if (!parsed.success || c.req.query("code_challenge_method") !== "S256") {
+        return c.text("Signing in to the app needs a code_challenge with method S256", 400);
       }
+      challenge = parsed.data;
     }
+    prune(states, now());
     const state = randomBytes2(24).toString("base64url");
-    states.set(state, { next: safeNext(c.req.query("next")), expiresAt: now() + STATE_TTL_MS });
+    const next = app2 ? APP_LANDING : safeNext(c.req.query("next"));
+    states.set(state, { next, challenge, expiresAt: now() + STATE_TTL_MS });
     const authorize = new URL("https://github.com/login/oauth/authorize");
     authorize.searchParams.set("client_id", github.clientId);
     authorize.searchParams.set("state", state);
@@ -12494,9 +13054,43 @@ function githubAuthRoutes(options) {
       options.log?.warn({ login }, "GitHub sign-in refused a login that is not on the list");
       return land(c, pending.next, "signin-error=not-allowed");
     }
+    if (pending.challenge !== null) {
+      prune(codes, now());
+      const appCode = randomBytes2(24).toString("base64url");
+      codes.set(appCode, {
+        challenge: pending.challenge,
+        login,
+        avatar,
+        expiresAt: now() + CODE_TTL_MS
+      });
+      return land(c, pending.next, `code=${appCode}`);
+    }
     const token = await board2.signIn(login, SIGN_IN_TTL_MS, avatar);
     return land(c, pending.next, `session=${encodeURIComponent(token)}`);
   });
+  if (github.appleAppId !== null) {
+    routes.post("/app/token", limit2, limitBody(APP_TOKEN_BODY_LIMIT_BYTES), async (c) => {
+      const body = CodeExchangeSchema.safeParse(await c.req.json().catch(() => null));
+      if (!body.success) {
+        return c.json({ error: "invalid_request" }, 400);
+      }
+      const pending = codes.get(body.data.code);
+      codes.delete(body.data.code);
+      if (pending === void 0 || pending.expiresAt <= now() || !provesChallenge(body.data.code_verifier, pending.challenge)) {
+        return c.json({ error: "invalid_grant" }, 400);
+      }
+      const token = await board2.signIn(pending.login, SIGN_IN_TTL_MS, pending.avatar);
+      return c.json({ session: token }, 200, { "cache-control": "no-store" });
+    });
+  }
+  return routes;
+}
+function appleAppSiteAssociation(github) {
+  const routes = new Hono();
+  routes.get("/apple-app-site-association", (c) => {
+    const appId = github?.appleAppId ?? null;
+    return appId === null ? c.text("not found", 404) : c.json({ webcredentials: { apps: [appId] } });
+  });
   return routes;
 }
 
@@ -12604,14 +13198,14 @@ function rateLimit(options) {
 }
 
 // apps/server/dist/runner-routes.js
-import path8 from "node:path";
+import path9 from "node:path";
 import { Hono as Hono2 } from "hono";
 import { streamSSE } from "hono/streaming";
 
 // apps/server/dist/home-git.js
-import { execa as execa2 } from "execa";
+import { execa as execa3 } from "execa";
 var SMART_PATHS = /* @__PURE__ */ new Set(["/info/refs", "/git-upload-pack", "/git-receive-pack"]);
-var MAX_BYTES = 256 * 1024 * 1024;
+var MAX_BYTES = MOVE_PACK_LIMIT_BYTES;
 function parseCgi(output) {
   const crlf = output.indexOf("\r\n\r\n");
   const lf = output.indexOf("\n\n");
@@ -12642,9 +13236,9 @@ var HomeGit = class {
     if (input.rest !== "/git-receive-pack") {
       return serveHomeGit(input);
     }
-    const previous = this.pushes.get(input.agent) ?? Promise.resolve();
+    const previous = this.pushes.get(input.repository) ?? Promise.resolve();
     const run = previous.then(() => serveHomeGit(input), () => serveHomeGit(input));
-    this.pushes.set(input.agent, run.catch(() => void 0));
+    this.pushes.set(input.repository, run.catch(() => void 0));
     return run;
   }
 };
@@ -12655,7 +13249,7 @@ async function serveHomeGit(input) {
   const { request } = input;
   const body = Buffer.from(await request.arrayBuffer());
   if (body.length > MAX_BYTES) {
-    return new Response("pack too large for a home", { status: 413 });
+    return new Response("pack too large for the board to take", { status: 413 });
   }
   const url = new URL(request.url);
   const env = {
@@ -12664,7 +13258,7 @@ async function serveHomeGit(input) {
     GIT_PROJECT_ROOT: input.root,
     GIT_HTTP_EXPORT_ALL: "1",
     REQUEST_METHOD: request.method,
-    PATH_INFO: `/${input.agent}${input.rest}`,
+    PATH_INFO: `/${input.repository}${input.rest}`,
     QUERY_STRING: url.search.replace(/^\?/, ""),
     CONTENT_TYPE: request.headers.get("content-type") ?? "",
     CONTENT_LENGTH: String(body.length),
@@ -12679,11 +13273,14 @@ async function serveHomeGit(input) {
   if (protocol !== null) {
     env["HTTP_GIT_PROTOCOL"] = protocol;
   }
-  const result = await execa2("git", ["http-backend"], {
+  const result = await execa3("git", ["http-backend"], {
     env,
     extendEnv: false,
     input: body,
     encoding: "buffer",
+    // The blank line that ends the headers ends the whole answer when the body is empty, as for
+    // the 4-byte probe git sends before a pack too large for one post; stripped, it reads as none.
+    stripFinalNewline: false,
     reject: false,
     maxBuffer: MAX_BYTES
   });
@@ -12799,20 +13396,47 @@ function runnerRoutes(board2, hub, enrollments, enrollLimit) {
     const marker = `/homes/${agent}/git`;
     const at = c.req.path.indexOf(marker);
     return homeGit.serve({
-      root: path8.dirname(repository),
-      agent,
+      root: path9.dirname(repository),
+      repository: agent,
       rest: at === -1 ? "" : c.req.path.slice(at + marker.length),
       request: c.req.raw,
       runner: c.get("runner")
     });
   });
   routes.route("/homes/:agent", home);
+  routes.all("/moves/:id/git/*", async (c) => {
+    const id = UlidSchema.safeParse(c.req.param("id"));
+    const marker = `/moves/${c.req.param("id")}/git`;
+    const at = c.req.path.indexOf(marker);
+    const rest = at === -1 ? "" : c.req.path.slice(at + marker.length);
+    const service = rest === "/info/refs" ? c.req.query("service") ?? "" : rest.slice(1);
+    if (service !== "git-upload-pack" && service !== "git-receive-pack") {
+      return c.json({ error: "NOT_FOUND", message: "not a smart HTTP request" }, 404);
+    }
+    const access3 = id.success ? hub.moveAccess(c.get("runner"), id.data, service === "git-receive-pack") : "unknown";
+    if (access3 === "unknown") {
+      return c.json({ error: "NOT_FOUND", message: "no such move under way" }, 404);
+    }
+    if (access3 === "refused" || !id.success) {
+      return c.json({
+        error: "FORBIDDEN",
+        message: `this runner may not ${service === "git-receive-pack" ? "push to" : "fetch from"} this move now`
+      }, 403);
+    }
+    return homeGit.serve({
+      root: board2.moveRepos,
+      repository: `${id.data}.git`,
+      rest,
+      request: c.req.raw,
+      runner: c.get("runner")
+    });
+  });
   return routes;
 }
 
 // apps/server/dist/static.js
 import { readFile as readFile5, stat as stat4 } from "node:fs/promises";
-import path9 from "node:path";
+import path10 from "node:path";
 var CONTENT_TYPES = {
   ".html": "text/html; charset=utf-8",
   ".js": "text/javascript; charset=utf-8",
@@ -12840,11 +13464,11 @@ function within2(root, pathname) {
   } catch {
     return null;
   }
-  const candidate = path9.resolve(root, `.${decoded}`);
-  return candidate === root || candidate.startsWith(root + path9.sep) ? candidate : null;
+  const candidate = path10.resolve(root, `.${decoded}`);
+  return candidate === root || candidate.startsWith(root + path10.sep) ? candidate : null;
 }
 function spaHandler(staticDir) {
-  const root = path9.resolve(staticDir);
+  const root = path10.resolve(staticDir);
   return async (c) => {
     const { pathname } = new URL(c.req.url);
     if (pathname.startsWith("/api/")) {
@@ -12855,14 +13479,14 @@ function spaHandler(staticDir) {
     if (file !== null && await isFile(file)) {
       return c.body(await readFile5(file), 200, {
         ...headers,
-        "content-type": CONTENT_TYPES[path9.extname(file)] ?? "application/octet-stream",
+        "content-type": CONTENT_TYPES[path10.extname(file)] ?? "application/octet-stream",
         "cache-control": pathname.startsWith("/assets/") ? "public, max-age=31536000, immutable" : "no-cache"
       });
     }
     if (pathname.startsWith("/assets/")) {
       return c.text("not found", 404, headers);
     }
-    const index = path9.join(root, "index.html");
+    const index = path10.join(root, "index.html");
     if (!await isFile(index)) {
       return c.text("The interface is not built: run pnpm build:web.", 404);
     }
@@ -12889,6 +13513,10 @@ var RetireBodySchema = z19.object({ reason: z19.string().min(1) });
 var RunnerBodySchema = z19.object({ name: NameSchema });
 var EnrollmentApprovalSchema = z19.object({ name: NameSchema });
 var HomeRunnerBodySchema = z19.object({ runner: NameSchema.nullable() });
+var ProjectRunnerBodySchema = z19.object({
+  runner: NameSchema,
+  withoutBranches: z19.boolean().optional()
+});
 var ModelBodySchema = z19.object({ model: ModelNameSchema.nullable() });
 var EffortBodySchema = z19.object({ effort: EffortSchema.nullable() });
 var HistoryLimitSchema = z19.coerce.number().int().min(1).max(500);
@@ -12922,6 +13550,9 @@ function createApp(deps) {
     if (error instanceof RunnerAwayError) {
       return c.json({ error: "RUNNER_AWAY", message: error.message }, 503);
     }
+    if (error instanceof MoveSourceAwayError) {
+      return c.json({ error: "SOURCE_AWAY", message: error.message }, 409);
+    }
     return c.json({ error: "INTERNAL", message: error.message }, 500);
   });
   const authenticate = async (c, next) => {
@@ -13096,6 +13727,13 @@ function createApp(deps) {
     return branchFile(c, project.slug, project.defaultBranch, file);
   };
   api.get("/projects/:slug/files", (c) => projectFile(c, ""));
+  api.put("/projects/:slug/runner", async (c) => {
+    const body = ProjectRunnerBodySchema.parse(await c.req.json());
+    if (deps.runners === void 0) {
+      throw new BoardError("NOT_FOUND", "this board has no runners to move a project between");
+    }
+    return c.json(await deps.runners.moveProject(c.get("actor"), NameSchema.parse(c.req.param("slug")), body.runner, { withoutBranches: body.withoutBranches }));
+  });
   api.get("/projects/:slug/files/:path{.+}", (c) => projectFile(c, c.req.param("path")));
   api.get("/tasks/:id", async (c) => c.json((await board2.findTask(c.req.param("id"))).task));
   api.get("/tasks/:id/thread", async (c) => c.json(await board2.listThread(c.req.param("id"))));
@@ -13273,6 +13911,7 @@ function createApp(deps) {
     ...deps.signIn,
     limit: limited(SIGN_IN_LIMIT, "sign-ins")
   }));
+  app2.route("/.well-known", appleAppSiteAssociation(deps.signIn?.github ?? null));
   if (deps.runners !== void 0) {
     app2.route("/runner", runnerRoutes(board2, deps.runners, deps.enrollments, limited(ENROLL_LIMIT, "enrollment requests")));
   }
@@ -13572,8 +14211,8 @@ var view = {
     return scheduler.activeSignals;
   }
 };
-var webDir = process.env["STELLARIS_WEB_DIR"] ?? path10.resolve(import.meta.dirname, "../../web/dist");
-var webBuilt = await access2(path10.join(webDir, "index.html")).then(() => true, () => false);
+var webDir = process.env["STELLARIS_WEB_DIR"] ?? path11.resolve(import.meta.dirname, "../../web/dist");
+var webBuilt = await access2(path11.join(webDir, "index.html")).then(() => true, () => false);
 var app = createApp({
   board,
   version: VERSION,
@@ -13597,6 +14236,7 @@ var server = serve({ fetch: app.fetch, port: config.port, hostname: config.host
     webDir,
     webBuilt,
     signIn: config.github === null ? "token" : `github (${config.github.users.join(", ")})`,
+    appleAppId: config.github?.appleAppId ?? null,
     trustedProxies: config.trustedProxies
   }, "board server listening");
 });