@kubitnodes/stellaris 0.3.26 → 0.4.0

package/dist/server/index.js

@@ -2,12 +2,11 @@
 
 // apps/server/dist/index.js
 import { access as access2 } from "node:fs/promises";
-import path10 from "node:path";
-import { serve } from "@hono/node-server";
+import path11 from "node:path";
 
 // packages/board-core/dist/board.js
-import { chmod as chmod2, cp, mkdir as mkdir4, readdir as readdir4, readFile as readFile4, rename as rename3, rm as rm2, stat as stat3, writeFile as writeFile4 } from "node:fs/promises";
-import path7 from "node:path";
+import { chmod as chmod2, cp, mkdir as mkdir5, readdir as readdir4, readFile as readFile4, rename as rename3, rm as rm3, stat as stat3, writeFile as writeFile4 } from "node:fs/promises";
+import path8 from "node:path";
 import { decodeTime, monotonicFactory } from "ulid";
 import { z as z16 } from "zod";
 
@@ -65,7 +64,8 @@ var VERB_NAMES = [
   "update_cron",
   "remove_cron",
   "remove_skill",
-  "upload_image"
+  "upload_image",
+  "read_image"
 ];
 var VerbNameSchema = z2.enum(VERB_NAMES);
 var CharterTriggerSchema = z2.enum(["user_post", "ops_event", "heartbeat"]);
@@ -95,6 +95,7 @@ var USER_NAME = "user";
 var MEMBER_VERBS = [
   "post_message",
   "upload_image",
+  "read_image",
   "read_inbox",
   "search",
   "open_thread",
@@ -226,7 +227,12 @@ var CronScheduleSchema = z3.union([
 var CronRunSchema = z3.object({
   turnId: UlidSchema,
   at: IsoDateTimeSchema,
-  outcome: z3.enum(["completed", "failed", "stopped"])
+  outcome: z3.enum(["completed", "failed", "stopped"]),
+  /**
+   * For a failed one, the first turn of the cron's citizen in its conversation that was shown the
+   * failure and completed, and when it ended.
+   */
+  caughtUp: z3.object({ turnId: UlidSchema, at: IsoDateTimeSchema }).optional()
 });
 var CronFrontmatterSchema = z3.object({
   id: UlidSchema,
@@ -273,6 +279,16 @@ function shortestGapMs(schedule, societyZone, after) {
   }
   return shortest;
 }
+function firesInTask(cron, task) {
+  return cron.scope === task.project && cron.thread === task.id;
+}
+function cronFailure(cron) {
+  return cron.lastRun?.outcome === "failed" && cron.lastRun.caughtUp === void 0 ? cron.lastRun : null;
+}
+function cronStoppedAt(cron) {
+  const times = [cron.paused?.at, cron.ended?.at, cronFailure(cron)?.at].filter((at) => at !== void 0);
+  return times.reduce((first, at) => first === null || Date.parse(at) < Date.parse(first) ? at : first, null);
+}
 function nextFire(cron, societyZone, floorMs = CRON_FLOOR_MS) {
   if (cron.ended !== void 0 || cron.paused !== void 0) {
     return null;
@@ -704,6 +720,7 @@ var MemberSchema = z5.object({
 });
 var RunnerOsSchema = z5.enum(["linux", "windows", "darwin"]);
 var GitIdentityPartSchema = z5.enum(["name", "email"]);
+var RunnerPauseSchema = z5.object({ at: IsoDateTimeSchema, by: NameSchema });
 var RunnerSchema = z5.object({
   name: NameSchema,
   os: RunnerOsSchema,
@@ -722,8 +739,25 @@ var RunnerSchema = z5.object({
    * Each CLI's plan quota as its login on this runner last reported it, from a turn's stream or a
    * read; absent until one has.
    */
-  quotas: z5.partialRecord(CliKindSchema, CliQuotaSchema).optional()
+  quotas: z5.partialRecord(CliKindSchema, CliQuotaSchema).optional(),
+  /** The user's pause of the whole runner: no turn starts on it until the user resumes it. */
+  paused: RunnerPauseSchema.optional(),
+  /**
+   * The user's pauses of single CLIs on the runner, each apart from the runner's own: no turn of
+   * that CLI starts on it until the user resumes it.
+   */
+  pausedClis: z5.partialRecord(CliKindSchema, RunnerPauseSchema).optional()
 });
+function runnerPause(runner, cli) {
+  return runner.paused ?? runner.pausedClis?.[cli];
+}
+function heldOn(runners2, runner, cli) {
+  if (runner === void 0 || cli === null) {
+    return false;
+  }
+  const record = runners2.find((each) => each.name === runner);
+  return record !== void 0 && runnerPause(record, cli) !== void 0;
+}
 var ProposalKindSchema = z5.enum([
   "role",
   "member",
@@ -1073,7 +1107,21 @@ function imageTypeOf(bytes) {
   return null;
 }
 var ImagePathSchema = z6.string().min(1).max(4096).refine((value) => !value.includes("\0"), { message: "a path with no NUL character" });
+var ImageNameSchema = z6.string().max(1024);
+function imageDescription(name) {
+  return name.replaceAll(/[[\]\\\r\n`]/g, "");
+}
 var IMAGE_SCHEME = "image:";
+var ImageRefSchema = z6.string().regex(/^(?:image:)?[0-9A-HJKMNP-TV-Z]{26}$/, "expected an image's id or image:<id>");
+function imageIdOf(ref) {
+  return ref.startsWith(IMAGE_SCHEME) ? ref.slice(IMAGE_SCHEME.length) : ref;
+}
+var ImageFileSchema = z6.object({
+  id: UlidSchema,
+  type: ImageTypeSchema,
+  size: z6.number().int().positive(),
+  path: ImagePathSchema
+});
 var UploadedImageSchema = z6.object({
   id: UlidSchema,
   type: ImageTypeSchema,
@@ -1238,6 +1286,10 @@ var VerbInputs = {
   upload_image: z7.object({
     /** The image file on the machine your turn runs on: absolute, or relative to your working directory. */
     path: ImagePathSchema
+  }),
+  read_image: z7.object({
+    /** The image's id, or its `image:<id>` address as a post shows it. */
+    image_id: ImageRefSchema
   })
 };
 var VERB_DESCRIPTIONS = {
@@ -1249,7 +1301,7 @@ var VERB_DESCRIPTIONS = {
   create_task: "Create a task in a project with its plan: stages of {name, role or agent, gate}. Without stages it gets one stage, work, that anyone in the project may take. File it in a channel of the project, such as a release's, or general by default; its thread opens there with it, under the task's id, for everything said about the work.",
   claim_task: "Hold the task's current stage. Claims are leases renewed by every turn that touches the task.",
   release_task: "Let go of the stage you hold so someone else can take it.",
-  update_task: "Move a task back to an earlier stage (the current stage's holder, the user, the steward, or the concierge; anyone else asks the concierge in the task's thread), abandon it, set the tasks it is blocked by (blocked_by: its stage wakes nobody until they have all ended), or link its pull request (pull_request: url, with the merge commit's merge_subject and merge_body), which a ghpr task needs before its last stage completes. A note is posted to the task's thread.",
+  update_task: "Move a task back to an earlier stage (the current stage's holder, the user, the steward, or the concierge; anyone else asks the concierge in the task's thread, with a mention), abandon it, set the tasks it is blocked by (blocked_by: its stage wakes nobody until they have all ended), or link its pull request (pull_request: url, with the merge commit's merge_subject and merge_body), which a ghpr task needs before its last stage completes. A note is posted to the task's thread.",
   get_task: "Read a task with its plan, its brief, and the messages of its thread.",
   subscribe: "Subscribe to a channel. Subscriptions feed your digest; they never wake you.",
   unsubscribe: "Unsubscribe from a channel.",
@@ -1272,7 +1324,8 @@ var VERB_DESCRIPTIONS = {
   update_cron: "Pause or resume a cron, or change its title, note, or schedule; resuming or rescheduling starts it afresh from now. Yours, or anyone's for the user, the steward, and the concierge.",
   remove_cron: "End a cron for good, with a reason. Yours, or anyone's for the user, the steward, and the concierge. A cron also ends with its conversation, and a one-time cron once it fires.",
   remove_skill: "Remove a skill from the society's skills, with a reason, when it is wrong, superseded, or no longer used: no skills index lists it from the next turn, and a notice in general says so with the reason. Its proposer's own copy stays in its home. Steward and user only; the board keeps its text aside for the user to restore.",
-  upload_image: "Upload an image file, such as a screenshot or a chart, from the machine your turn runs on: a PNG, JPEG, GIF, or WebP of at most 8 MB, in your worktree, your home, or the system temp folder. Returns its id and the markdown that shows it in a post, `![what it shows](image:<id>)`; write what it shows as the alt text."
+  upload_image: "Upload an image file, such as a screenshot or a chart, from the machine your turn runs on: a PNG, JPEG, GIF, or WebP of at most 8 MB, in your worktree, your home, or the system temp folder. Returns its id and the markdown that shows it in a post, `![what it shows](image:<id>)`; write what it shows as the alt text.",
+  read_image: "Open an image the board keeps, as a post shows it, `![what it shows](image:<id>)`, by its id: the board writes it to a file of this turn's own on the machine it runs on, removed when the turn ends, and returns its path, type, and size. Open the path with your file tools to see the image."
 };
 
 // packages/shared/dist/events.js
@@ -1283,6 +1336,7 @@ var BOARD_EVENT_TYPES = [
   "project.configured",
   "project.archived",
   "project.placed",
+  "project.moved",
   "agent.added",
   "agent.configured",
   "agent.placed",
@@ -1322,6 +1376,8 @@ var BOARD_EVENT_TYPES = [
   "user.token_rotated",
   "runner.changed",
   "runner.quota",
+  "runner.paused",
+  "runner.resumed",
   "ops.signal",
   "paused.changed",
   "wake.requested",
@@ -1471,6 +1527,16 @@ var RunnerHelloSchema = z9.object({
   quotaReads: z9.boolean().default(false),
   /** Whether the runner reads an image a turn running there uploads; one from before never does. */
   imageReads: z9.boolean().default(false),
+  /**
+   * Whether the runner writes an image the board sends for a turn running there to open, for
+   * `read_image`; one from before never does.
+   */
+  imageWrites: z9.boolean().default(false),
+  /**
+   * Whether the runner carries a project's repository out to another runner and in from one, and
+   * removes its copy once the project has moved; one from before never does.
+   */
+  projectMoves: z9.boolean().default(false),
   capabilities: z9.array(z9.string()).default([]),
   /**
    * What the runner's account lacks of the git identity citizens' own commits carry, checked
@@ -1580,8 +1646,19 @@ var TurnJobSchema = z9.object({
   session: z9.string().min(1).nullable(),
   /** The running total the session reported after its last turn, which a resumed session starts from. */
   costSoFarUsd: z9.number().nonnegative(),
+  /**
+   * The session's running usage after its last turn, which a resumed session's own usage is
+   * measured from. Absent when the board holds none for the session, and from a server from before.
+   */
+  usageSoFar: UsageSchema.optional(),
   /** The rendered charter, norms, memory core, and skills index, with `PATH_TOKENS` for places. */
   instructions: z9.string(),
+  /**
+   * The hash of `instructions` without the first turn's section (`instructionsHash` in
+   * `turn-host`): a warm process started on other instructions starts afresh, so a compaction in
+   * it puts back the current ones. Absent from a server from before, when the text is compared.
+   */
+  instructionsHash: z9.string().optional(),
   prompt: z9.string(),
   mcp: z9.object({ url: z9.string().min(1), token: z9.string().min(1) }),
   limits: z9.object({
@@ -1608,6 +1685,17 @@ var TurnOutcomeSchema = z9.object({
   costUsd: z9.number().nonnegative(),
   /** The session's running total after this turn, for CLIs that report one. */
   sessionCostUsd: z9.number().nonnegative().optional(),
+  /**
+   * The session's running usage after this turn, for CLIs that report one, else the job's
+   * `usageSoFar`. A runner from before never sends it.
+   */
+  sessionUsage: UsageSchema.optional(),
+  /**
+   * The whole input of the turn's latest model call in the session's own thread, cached or not:
+   * how large the session had grown. Sub-agents' calls are left out. A turn that made no call,
+   * and a runner from before, never send it.
+   */
+  contextTokens: z9.number().int().nonnegative().optional(),
   /**
    * The session the CLI used, which differs from the job's for CLIs that assign their own ids. A
    * turn whose CLI never started, because it failed or was stopped first, reports the job's own,
@@ -1755,6 +1843,13 @@ var TurnImageSchema = z9.discriminatedUnion("kind", [
   }),
   z9.object({ kind: z9.literal("refused"), why: ImageRefusalSchema, detail: z9.string() })
 ]);
+var TurnImageWriteSchema = z9.object({
+  turnId: UlidSchema,
+  id: UlidSchema,
+  type: ImageTypeSchema,
+  content: z9.string()
+});
+var TurnImageFileSchema = z9.object({ path: ImagePathSchema });
 var WorkspaceConversationSchema = z9.discriminatedUnion("kind", [
   z9.object({ kind: z9.literal("thread"), id: UlidSchema }),
   z9.object({ kind: z9.literal("channel"), scope: NameSchema, name: NameSchema }),
@@ -1776,6 +1871,49 @@ var HeldWorkspaceSchema = z9.object({
 });
 var HeldWorkspacesSchema = z9.object({ workspaces: z9.array(HeldWorkspaceSchema) });
 var SweepResultSchema = z9.object({ kept: z9.array(HeldWorkspaceSchema) });
+var MOVE_PACK_LIMIT_BYTES = 256 * 1024 * 1024;
+var MOVE_FLOOR_BYTES_PER_SECOND = 16 * 1024;
+function moveTransferMs(bytes) {
+  return 10 * 6e4 + Math.ceil(bytes / MOVE_FLOOR_BYTES_PER_SECOND) * 1e3;
+}
+var RepoRefsSchema = z9.record(z9.string().regex(/^refs\/(heads|tags)\/\S+$/), z9.string().regex(/^[0-9a-f]{40}([0-9a-f]{24})?$/));
+var ProjectExportSchema = z9.object({ move: UlidSchema, repo: ProjectRepoSchema });
+var HeldWorkSchema = z9.object({
+  agent: NameSchema,
+  conversation: WorkspaceConversationSchema.nullable(),
+  uncommitted: z9.number().int().nonnegative(),
+  onNoBranch: z9.number().int().nonnegative()
+});
+var ProjectExportedSchema = z9.discriminatedUnion("ok", [
+  z9.object({
+    ok: z9.literal(true),
+    refs: RepoRefsSchema,
+    bytes: z9.number().int().nonnegative()
+  }),
+  z9.object({
+    ok: z9.literal(false),
+    held: z9.array(HeldWorkSchema),
+    bytes: z9.number().int().nonnegative()
+  })
+]);
+var ProjectImportSchema = z9.object({
+  move: UlidSchema,
+  repo: ProjectRepoSchema,
+  pullRequests: z9.boolean(),
+  /** The packs' size the old runner measured, which the clone's clock is sized from; the cap if unsaid. */
+  bytes: z9.number().int().nonnegative().optional()
+});
+var ProjectImportedSchema = z9.object({ refs: RepoRefsSchema });
+var ProjectReleaseSchema = z9.object({ slug: NameSchema });
+var ProjectReleasedSchema = z9.object({
+  worktrees: z9.number().int().nonnegative(),
+  clone: z9.boolean()
+});
+var ProjectMovedSchema = z9.object({
+  project: ProjectSchema,
+  carried: z9.number().int().nonnegative().nullable(),
+  released: z9.object({ ok: z9.boolean(), detail: z9.string() }).nullable()
+});
 var TurnSteerSchema = z9.object({ id: z9.uuid(), text: z9.string().min(1) });
 var RunnerMessageSchema = z9.discriminatedUnion("type", [
   z9.object({ type: z9.literal("turn"), job: TurnJobSchema }),
@@ -1803,6 +1941,15 @@ var RunnerMessageSchema = z9.discriminatedUnion("type", [
    * whose hello says `imageReads`.
    */
   z9.object({ type: z9.literal("image"), request: z9.string().min(1), read: TurnImageReadSchema }),
+  /**
+   * Answered with a `TurnImageFile`, or null when the turn is not running there. Sent only to
+   * runners whose hello says `imageWrites`.
+   */
+  z9.object({
+    type: z9.literal("image_write"),
+    request: z9.string().min(1),
+    write: TurnImageWriteSchema
+  }),
   /** Answered with whether the CLI accepted it; that it took it comes as a `steered` event. */
   z9.object({
     type: z9.literal("steer"),
@@ -1812,6 +1959,19 @@ var RunnerMessageSchema = z9.discriminatedUnion("type", [
   }),
   /** Answered with whether the turn was there to stop; it ends `stopped`. */
   z9.object({ type: z9.literal("stop"), request: z9.string().min(1), turnId: UlidSchema }),
+  /**
+   * Answered with a `ProjectExported`. Sent only to runners whose hello says `projectMoves`, as are
+   * the import and the release.
+   */
+  z9.object({ type: z9.literal("export"), request: z9.string().min(1), export: ProjectExportSchema }),
+  /** Answered with a `ProjectImported`. */
+  z9.object({ type: z9.literal("import"), request: z9.string().min(1), import: ProjectImportSchema }),
+  /** Answered with a `ProjectReleased`. */
+  z9.object({
+    type: z9.literal("release"),
+    request: z9.string().min(1),
+    release: ProjectReleaseSchema
+  }),
   /**
    * A conversation ended: the runner removes every citizen's workspace for it but those a turn
    * still uses, and answers with a `SweepResult` naming those it kept for holding work on no branch.
@@ -1855,6 +2015,7 @@ var TriggerKindSchema = z10.enum([
   "closing",
   "cron"
 ]);
+var HeartbeatCauseSchema = z10.enum(["unread", "held", "waiting"]);
 var TriggerSchema = z10.object({
   kind: TriggerKindSchema,
   from: NameSchema.optional(),
@@ -1865,7 +2026,9 @@ var TriggerSchema = z10.object({
   /** The channel the waking message was posted in. */
   channel: ChannelRefSchema.optional(),
   /** The cron that came due, for a `cron` wake. */
-  cronId: UlidSchema.optional()
+  cronId: UlidSchema.optional(),
+  /** What a `heartbeat` woke for; absent on records from before the board kept it. */
+  heartbeat: HeartbeatCauseSchema.optional()
 });
 var TurnThreadSchema = z10.object({ id: UlidSchema, task: z10.boolean() });
 var TurnDispatchSchema = z10.object({
@@ -1942,6 +2105,22 @@ var TurnRecordSchema = z10.object({
    * resumed session starts from it, so the next turn's own cost is measured from here.
    */
   sessionCostUsd: z10.number().nonnegative().optional(),
+  /**
+   * The running usage the CLI reported for the session after this turn, when the runner reports
+   * one. A resumed session's next turn measures its own usage from here.
+   */
+  sessionUsage: UsageSchema.optional(),
+  /**
+   * The SHA-256 of the instructions the session holds after this turn, the first turn's section
+   * left out (`instructionsHash` in `turn-host`): those it began with, or the latest a prompt
+   * carried. Absent when the board does not know them, as for records from before it kept them.
+   */
+  sessionInstructionsHash: z10.string().optional(),
+  /**
+   * The whole input of the turn's latest model call in the session's own thread, as the runner
+   * reported it: how large the session had grown. Absent for a turn that made no call.
+   */
+  contextTokens: z10.number().int().nonnegative().optional(),
   toolCalls: z10.number().int().nonnegative().default(0),
   /** The model the CLI reported for this turn, else the model configured for the agent, else null. */
   model: z10.string().nullable().default(null),
@@ -1955,10 +2134,19 @@ var TurnRecordSchema = z10.object({
   transient: z10.boolean().optional(),
   /** How many turns in a row, this one included, could not resume the session for a `retry`. */
   resumeRetries: z10.number().int().positive().optional(),
-  /** Whether the server dropped the conversation's session after this turn, which the next starts anew. */
+  /**
+   * Whether the server dropped the conversation's session after this turn, which the next starts
+   * anew: one its CLI could not resume, or a society role's home after a reflection completed.
+   */
   sessionDropped: z10.boolean().optional(),
   /** The crons whose fire started the turn, which record how it ended. */
-  crons: z10.array(UlidSchema).optional()
+  crons: z10.array(UlidSchema).optional(),
+  /**
+   * The failed fires its prompt named: each of its citizen's crons in its conversation whose latest
+   * fire's turn failed with nothing catching it up (`cronFailure`), but those it carries, with that
+   * turn. Completing it catches each up.
+   */
+  cronFailures: z10.array(z10.object({ cron: UlidSchema, turnId: UlidSchema })).optional()
 });
 var RunningTurnSchema = z10.object({
   turnId: UlidSchema,
@@ -2000,6 +2188,8 @@ var TurnHistoryEntrySchema = z10.object({
   /** The project whose channels' conversation the turn was in, for a turn in the society scope. */
   place: NameSchema.optional(),
   trigger: z10.string(),
+  /** What a `heartbeat` woke for; absent on turns logged before the board kept it. */
+  heartbeat: HeartbeatCauseSchema.optional(),
   exitReason: z10.string().nullable(),
   costUsd: z10.number(),
   /** The tokens the turn used; absent for turns logged before turns recorded them. */
@@ -2073,7 +2263,7 @@ var METRICS_WINDOW_MS = {
   "7d": 7 * 24 * 36e5,
   all: null
 };
-var READ_VERBS = ["read_inbox", "search", "get_task"];
+var READ_VERBS = ["read_inbox", "search", "get_task", "read_image"];
 function isBoardAction(tool) {
   const verb = /^mcp__board__(.+)$/.exec(tool)?.[1];
   return verb !== void 0 && !READ_VERBS.some((read2) => read2 === verb);
@@ -2087,12 +2277,19 @@ var MetricsSchema = z12.object({
   /**
    * Finished turns that changed nothing on the board. Reflections are left out, since they write
    * memory, not the board; turns without a transcript are counted apart, their actions unknown.
+   * Heartbeats are split by what each woke for, and those recorded before the board kept it are a
+   * row without one.
    */
   idle: z12.object({
     turns: CountSchema,
     idle: CountSchema,
     unknown: CountSchema,
-    byTrigger: z12.array(z12.object({ trigger: z12.string(), turns: CountSchema, idle: CountSchema })),
+    byTrigger: z12.array(z12.object({
+      trigger: z12.string(),
+      heartbeat: HeartbeatCauseSchema.optional(),
+      turns: CountSchema,
+      idle: CountSchema
+    })),
     byAgent: z12.array(z12.object({
       agent: NameSchema,
       role: NameSchema.nullable(),
@@ -2171,11 +2368,17 @@ var TokenUseSchema = z12.object({
 // packages/shared/dist/config.js
 import { z as z13 } from "zod";
 var LogLevelSchema = z13.enum(["trace", "debug", "info", "warn", "error", "fatal"]);
+var AppleAppIdSchema = z13.string().regex(/^[A-Z0-9]{10}\.[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*$/, "not <team id>.<bundle id>");
 var GithubSignInSchema = z13.object({
   clientId: z13.string().min(1),
   clientSecret: z13.string().min(1),
   /** Logins, lowercased; GitHub logins are case-insensitive. */
-  users: z13.array(z13.string().min(1)).min(1)
+  users: z13.array(z13.string().min(1)).min(1),
+  /**
+   * The iOS app that may sign in, which Apple's association file names so that only it can take the
+   * board's `https` landing; null when no app signs in.
+   */
+  appleAppId: AppleAppIdSchema.nullable()
 });
 var ServerConfigSchema = z13.object({
   dataDir: z13.string().min(1),
@@ -2216,13 +2419,20 @@ function githubSignIn(env) {
   const clientId = env["STELLARIS_GITHUB_CLIENT_ID"] ?? "";
   const clientSecret = env["STELLARIS_GITHUB_CLIENT_SECRET"] ?? "";
   const users = list(env["STELLARIS_GITHUB_USERS"]).map((login) => login.toLowerCase());
+  const appleAppId = env["STELLARIS_APPLE_APP_ID"]?.trim() || null;
+  if (appleAppId !== null && !AppleAppIdSchema.safeParse(appleAppId).success) {
+    throw new Error(`STELLARIS_APPLE_APP_ID is <team id>.<bundle id>, not ${JSON.stringify(appleAppId)}`);
+  }
   if (clientId === "" && clientSecret === "" && users.length === 0) {
+    if (appleAppId !== null) {
+      throw new Error("STELLARIS_APPLE_APP_ID needs GitHub sign-in");
+    }
     return null;
   }
   if (clientId === "" || clientSecret === "" || users.length === 0) {
     throw new Error("GitHub sign-in needs STELLARIS_GITHUB_CLIENT_ID, STELLARIS_GITHUB_CLIENT_SECRET, and STELLARIS_GITHUB_USERS together");
   }
-  return GithubSignInSchema.parse({ clientId, clientSecret, users });
+  return GithubSignInSchema.parse({ clientId, clientSecret, users, appleAppId });
 }
 function loadServerConfig(env) {
   return ServerConfigSchema.parse({
@@ -2257,7 +2467,7 @@ var RunnerConfigSchema = z13.object({
 });
 
 // packages/shared/dist/version.js
-var STELLARIS_VERSION = "0.3.26";
+var STELLARIS_VERSION = "0.4.0";
 
 // packages/shared/dist/mentions.js
 import { parse, postprocess, preprocess } from "micromark";
@@ -2952,6 +3162,41 @@ function filesOf(lines, status) {
   return [...files.values()];
 }
 
+// packages/board-core/dist/moves.js
+import { mkdir as mkdir4, rm as rm2 } from "node:fs/promises";
+import path5 from "node:path";
+import { execa as execa2 } from "execa";
+var MoveRepos = class {
+  root;
+  constructor(root) {
+    this.root = root;
+  }
+  /** Makes the move's empty repository, which checks every object a push brings, and answers its path. */
+  async open(dir) {
+    await mkdir4(this.root, { recursive: true });
+    await git2(["init", "--quiet", "--bare", dir], this.root);
+    await git2(["config", "receive.fsckObjects", "true"], dir);
+    return dir;
+  }
+  async drop(dir) {
+    await rm2(path5.resolve(this.root, dir), { recursive: true, force: true });
+  }
+  /** Removes every move's repository, as the server starts: a move never survives a restart. */
+  async clear() {
+    await rm2(this.root, { recursive: true, force: true });
+  }
+};
+async function git2(args, cwd) {
+  const result = await execa2("git", args, {
+    cwd,
+    reject: false,
+    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+  });
+  if (result.exitCode !== 0) {
+    throw new Error(`git ${args[0] ?? ""} failed: ${result.stderr.trim()}`);
+  }
+}
+
 // packages/board-core/dist/mentions.js
 import vm from "node:vm";
 var MENTION_PARSE_MS = 500;
@@ -2986,7 +3231,8 @@ var TurnPayload = z14.object({
   thread: z14.string().optional(),
   channel: z14.string().optional(),
   place: z14.string().optional(),
-  trigger: z14.string()
+  trigger: z14.string(),
+  heartbeat: HeartbeatCauseSchema.optional().catch(void 0)
 });
 var TaskPayload = z14.object({
   taskId: z14.string(),
@@ -3086,13 +3332,12 @@ function computeMetrics(input) {
         const nothing = actions === 0 ? 1 : 0;
         turns2 += 1;
         idle += nothing;
-        for (const [rows, key] of [
-          [turnRows, turn.data.trigger],
-          [agentRows, event.actor]
-        ]) {
-          const row = rows.get(key) ?? { turns: 0, idle: 0 };
-          rows.set(key, { turns: row.turns + 1, idle: row.idle + nothing });
-        }
+        const { trigger, heartbeat } = turn.data;
+        const key = heartbeat === void 0 ? trigger : `${trigger}\0${heartbeat}`;
+        const row = turnRows.get(key) ?? { trigger, heartbeat, turns: 0, idle: 0 };
+        turnRows.set(key, { ...row, turns: row.turns + 1, idle: row.idle + nothing });
+        const own = agentRows.get(event.actor) ?? { turns: 0, idle: 0 };
+        agentRows.set(event.actor, { turns: own.turns + 1, idle: own.idle + nothing });
         break;
       }
       case "turn.started": {
@@ -3248,7 +3493,10 @@ function computeMetrics(input) {
       turns: turns2,
       idle,
       unknown,
-      byTrigger: [...turnRows].map(([trigger, row]) => ({ trigger, ...row })).toSorted((a, b) => b.idle - a.idle || b.turns - a.turns),
+      byTrigger: [...turnRows.values()].map(({ heartbeat, ...row }) => ({
+        ...row,
+        ...heartbeat === void 0 ? {} : { heartbeat }
+      })).toSorted((a, b) => b.idle - a.idle || b.turns - a.turns),
       byAgent: [...agentRows].map(([agent, row]) => ({ agent, role: citizens.get(agent)?.role ?? null, ...row })).toSorted((a, b) => b.idle - a.idle || b.turns - a.turns)
     },
     sentBack: {
@@ -3308,6 +3556,8 @@ var TurnHistoryPayloadSchema = z15.object({
   channel: NameSchema.optional(),
   place: NameSchema.optional(),
   trigger: z15.string().default("manual"),
+  // One a later board added reads as none, so the turn stays in the history.
+  heartbeat: HeartbeatCauseSchema.optional().catch(void 0),
   exitReason: z15.string().nullable().default(null),
   costUsd: z15.number().default(0),
   usage: UsageSchema.optional(),
@@ -3365,121 +3615,121 @@ var Mutex = class {
 };
 
 // packages/board-core/dist/paths.js
-import path5 from "node:path";
+import path6 from "node:path";
 var BoardPaths = class {
   dataDir;
   constructor(dataDir) {
-    this.dataDir = path5.resolve(dataDir);
+    this.dataDir = path6.resolve(dataDir);
   }
   // Board projection, also the storage of record; only the core library writes it.
   get board() {
-    return path5.join(this.dataDir, "board");
+    return path6.join(this.dataDir, "board");
   }
   get society() {
-    return path5.join(this.board, "society");
+    return path6.join(this.board, "society");
   }
   societyFile() {
-    return path5.join(this.society, "society.md");
+    return path6.join(this.society, "society.md");
   }
   societyChannels() {
-    return path5.join(this.society, "channels");
+    return path6.join(this.society, "channels");
   }
   societyChannel(name) {
-    return path5.join(this.societyChannels(), name);
+    return path6.join(this.societyChannels(), name);
   }
   /** Threads whose channel is a society channel; project channels' threads live under the project. */
   societyThreads() {
-    return path5.join(this.society, "threads");
+    return path6.join(this.society, "threads");
   }
   societyKnowledge() {
-    return path5.join(this.society, "knowledge");
+    return path6.join(this.society, "knowledge");
   }
   societyKnowledgeFile(topic) {
-    return path5.join(this.societyKnowledge(), `${topic}.md`);
+    return path6.join(this.societyKnowledge(), `${topic}.md`);
   }
   /** Skills promoted to the society, one directory per skill holding SKILL.md. */
   societySkills() {
-    return path5.join(this.society, "skills");
+    return path6.join(this.society, "skills");
   }
   societySkill(name) {
-    return path5.join(this.societySkills(), name);
+    return path6.join(this.societySkills(), name);
   }
   societySkillFile(name) {
-    return path5.join(this.societySkill(name), "SKILL.md");
+    return path6.join(this.societySkill(name), "SKILL.md");
   }
   roles() {
-    return path5.join(this.society, "roles");
+    return path6.join(this.society, "roles");
   }
   role(name) {
-    return path5.join(this.roles(), `${name}.md`);
+    return path6.join(this.roles(), `${name}.md`);
   }
   proposals() {
-    return path5.join(this.society, "proposals");
+    return path6.join(this.society, "proposals");
   }
   proposal(id) {
-    return path5.join(this.proposals(), `${id}.md`);
+    return path6.join(this.proposals(), `${id}.md`);
   }
   /** A skill proposal's folder, as the board took it from its proposer's home. */
   proposalFiles(id) {
-    return path5.join(this.proposals(), id);
+    return path6.join(this.proposals(), id);
   }
   decisions() {
-    return path5.join(this.society, "decisions");
+    return path6.join(this.society, "decisions");
   }
   decision(id) {
-    return path5.join(this.decisions(), `${id}.md`);
+    return path6.join(this.decisions(), `${id}.md`);
   }
   runners() {
-    return path5.join(this.society, "runners");
+    return path6.join(this.society, "runners");
   }
   runner(name) {
-    return path5.join(this.runners(), `${name}.md`);
+    return path6.join(this.runners(), `${name}.md`);
   }
   members() {
-    return path5.join(this.society, "members");
+    return path6.join(this.society, "members");
   }
   /** Crons, one file each with its note as the body; ended ones stay. */
   crons() {
-    return path5.join(this.society, "crons");
+    return path6.join(this.society, "crons");
   }
   cron(id) {
-    return path5.join(this.crons(), `${id}.md`);
+    return path6.join(this.crons(), `${id}.md`);
   }
   member(name) {
-    return path5.join(this.members(), `${name}.md`);
+    return path6.join(this.members(), `${name}.md`);
   }
   projects() {
-    return path5.join(this.board, "projects");
+    return path6.join(this.board, "projects");
   }
   project(slug) {
-    return path5.join(this.projects(), slug);
+    return path6.join(this.projects(), slug);
   }
   projectFile(slug) {
-    return path5.join(this.project(slug), "project.md");
+    return path6.join(this.project(slug), "project.md");
   }
   projectChannels(slug) {
-    return path5.join(this.project(slug), "channels");
+    return path6.join(this.project(slug), "channels");
   }
   projectChannel(slug, name) {
-    return path5.join(this.projectChannels(slug), name);
+    return path6.join(this.projectChannels(slug), name);
   }
   threads(slug) {
-    return path5.join(this.project(slug), "threads");
+    return path6.join(this.project(slug), "threads");
   }
   tasks(slug) {
-    return path5.join(this.project(slug), "tasks");
+    return path6.join(this.project(slug), "tasks");
   }
   task(slug, id) {
-    return path5.join(this.tasks(slug), `${id}.md`);
+    return path6.join(this.tasks(slug), `${id}.md`);
   }
   projectKnowledge(slug) {
-    return path5.join(this.project(slug), "knowledge");
+    return path6.join(this.project(slug), "knowledge");
   }
   projectKnowledgeFile(slug, topic) {
-    return path5.join(this.projectKnowledge(slug), `${topic}.md`);
+    return path6.join(this.projectKnowledge(slug), `${topic}.md`);
   }
   dashboard(slug) {
-    return path5.join(this.project(slug), "dashboard.md");
+    return path6.join(this.project(slug), "dashboard.md");
   }
   channelDir(ref) {
     const parsed = parseChannelRef(ref);
@@ -3492,57 +3742,57 @@ var BoardPaths = class {
   }
   /** A thread's record, `<id>.md`, beside the directory of its messages, `<id>/`. */
   threadFile(threads, id) {
-    return path5.join(threads, `${id}.md`);
+    return path6.join(threads, `${id}.md`);
   }
   threadMessages(threads, id) {
-    return path5.join(threads, id);
+    return path6.join(threads, id);
   }
   messageFile(dir, id, author) {
-    return path5.join(dir, `${id}-${author}.md`);
+    return path6.join(dir, `${id}-${author}.md`);
   }
   // Agent homes: authored by the agent, source of truth on the board server.
   agents() {
-    return path5.join(this.dataDir, "agents");
+    return path6.join(this.dataDir, "agents");
   }
   agent(name) {
-    return path5.join(this.agents(), name);
+    return path6.join(this.agents(), name);
   }
   agentFile(name) {
-    return path5.join(this.agent(name), "agent.json");
+    return path6.join(this.agent(name), "agent.json");
   }
   agentRole(name) {
-    return path5.join(this.agent(name), "role.md");
+    return path6.join(this.agent(name), "role.md");
   }
   agentProfile(name) {
-    return path5.join(this.agent(name), "profile.md");
+    return path6.join(this.agent(name), "profile.md");
   }
   agentMemory(name) {
-    return path5.join(this.agent(name), "memory");
+    return path6.join(this.agent(name), "memory");
   }
   agentMemoryCore(name) {
-    return path5.join(this.agentMemory(name), "core.md");
+    return path6.join(this.agentMemory(name), "core.md");
   }
   /** Transcripts of the agent's finished turns, one JSON line per step. */
   agentTurns(name) {
-    return path5.join(this.agent(name), "turns");
+    return path6.join(this.agent(name), "turns");
   }
   agentTranscript(name, turnId) {
-    return path5.join(this.agentTurns(name), `${turnId}.jsonl`);
+    return path6.join(this.agentTurns(name), `${turnId}.jsonl`);
   }
   agentSkills(name) {
-    return path5.join(this.agent(name), "skills");
+    return path6.join(this.agent(name), "skills");
   }
   agentSkill(name, skill) {
-    return path5.join(this.agentSkills(name), skill);
+    return path6.join(this.agentSkills(name), skill);
   }
   agentSkillFile(name, skill) {
-    return path5.join(this.agentSkill(name, skill), "SKILL.md");
+    return path6.join(this.agentSkill(name, skill), "SKILL.md");
   }
   agentProjects(name) {
-    return path5.join(this.agent(name), "projects");
+    return path6.join(this.agent(name), "projects");
   }
   agentProject(name, slug) {
-    return path5.join(this.agentProjects(name), slug);
+    return path6.join(this.agentProjects(name), slug);
   }
   /**
    * A thread's, a channel's, or, in the society scope, a project's conversation's session and last
@@ -3550,46 +3800,56 @@ var BoardPaths = class {
    */
   agentConversation(name, slug, part) {
     if (part.startsWith("#")) {
-      return path5.join(this.agentProject(name, slug), "channels", part.slice(1));
+      return path6.join(this.agentProject(name, slug), "channels", part.slice(1));
     }
-    return part.startsWith("~") ? path5.join(this.agentProject(name, slug), "places", part.slice(1)) : path5.join(this.agentProject(name, slug), "threads", part);
+    return part.startsWith("~") ? path6.join(this.agentProject(name, slug), "places", part.slice(1)) : path6.join(this.agentProject(name, slug), "threads", part);
   }
   agentCursors(name) {
-    return path5.join(this.agent(name), "cursors.json");
+    return path6.join(this.agent(name), "cursors.json");
   }
   events() {
-    return path5.join(this.dataDir, "events");
+    return path6.join(this.dataDir, "events");
   }
   eventLog() {
-    return path5.join(this.events(), "log.jsonl");
+    return path6.join(this.events(), "log.jsonl");
   }
   /** Images citizens uploaded, by id: outside the projection, which every runner mirrors. */
   images() {
-    return path5.join(this.dataDir, "images");
+    return path6.join(this.dataDir, "images");
   }
   image(id) {
-    return path5.join(this.images(), id);
+    return path6.join(this.images(), id);
+  }
+  /**
+   * The repositories projects travel through between runners, one per move while it runs:
+   * outside the projection, which every runner mirrors, and served only to the move's runners.
+   */
+  moves() {
+    return path6.join(this.dataDir, "moves");
+  }
+  move(id) {
+    return path6.join(this.moves(), `${id}.git`);
   }
   state() {
-    return path5.join(this.dataDir, "state");
+    return path6.join(this.dataDir, "state");
   }
   pausedFile() {
-    return path5.join(this.state(), "paused.json");
+    return path6.join(this.state(), "paused.json");
   }
   /** Removed knowledge topics, set aside outside the projection, by scope. */
   removedKnowledge(scope) {
-    return path5.join(this.state(), "removed-knowledge", scope);
+    return path6.join(this.state(), "removed-knowledge", scope);
   }
   /** Skills removed from the society, set aside outside the projection, one directory per removal. */
   removedSkills() {
-    return path5.join(this.state(), "removed-skills");
+    return path6.join(this.state(), "removed-skills");
   }
 };
 
 // packages/board-core/dist/skill-folder.js
 import { constants } from "node:fs";
 import { lstat, open as open2, readdir as readdir3, readlink, realpath } from "node:fs/promises";
-import path6 from "node:path";
+import path7 from "node:path";
 var SKILL_TEXT_LIMIT_CHARS = 1e5;
 var SKILL_TEXT_LIMIT_BYTES = SKILL_TEXT_LIMIT_CHARS * 4;
 function skillFileText(bytes) {
@@ -3600,8 +3860,8 @@ function skillFileText(bytes) {
   };
 }
 function inside(root, file) {
-  const relative = path6.relative(root, file);
-  return relative !== ".." && !relative.startsWith(`..${path6.sep}`) && !path6.isAbsolute(relative);
+  const relative = path7.relative(root, file);
+  return relative !== ".." && !relative.startsWith(`..${path7.sep}`) && !path7.isAbsolute(relative);
 }
 async function handleInside(root, handle) {
   if (process.platform !== "linux") {
@@ -3611,7 +3871,7 @@ async function handleInside(root, handle) {
   return file !== null && inside(root, file);
 }
 async function walk(root, prefix, found) {
-  const entries = await readdir3(path6.join(root, ...prefix === "" ? [] : prefix.split("/")), {
+  const entries = await readdir3(path7.join(root, ...prefix === "" ? [] : prefix.split("/")), {
     withFileTypes: true
   }).catch(() => []);
   for (const entry of entries.toSorted((a, b) => a.name < b.name ? -1 : 1)) {
@@ -3632,7 +3892,7 @@ async function walk(root, prefix, found) {
 async function readEntry(root, relative) {
   let real;
   try {
-    real = await realpath(path6.join(root, ...relative.split("/")));
+    real = await realpath(path7.join(root, ...relative.split("/")));
   } catch {
     return null;
   }
@@ -3723,7 +3983,10 @@ var SignInsSchema = z16.object({
     expiresAt: IsoDateTimeSchema
   })).default([])
 });
-var TurnStartPayloadSchema = z16.object({ turnId: UlidSchema });
+var TurnStartPayloadSchema = z16.object({
+  turnId: UlidSchema,
+  heartbeat: TurnHistoryPayloadSchema.shape.heartbeat
+});
 var CursorsSchema = z16.object({
   digest: z16.string().nullable(),
   scopes: z16.record(z16.string(), z16.string()).default({}),
@@ -3795,6 +4058,9 @@ function skillFolderOf(proposal) {
 function proposedFrom(origin, where) {
   return origin !== void 0 && origin.scope === where.scope && origin.thread === where.thread && origin.channel === where.channel && origin.place === where.place;
 }
+function latestLease(a, b) {
+  return a === null ? b : b === null || a >= b ? a : b;
+}
 function megabytes(bytes) {
   return (bytes / (1024 * 1024)).toFixed(1).replace(/\.0$/, "");
 }
@@ -3934,6 +4200,7 @@ var Board = class _Board {
   /** The turns in flight, which the server hosting them supplies; none until it does. */
   turnsInFlight = () => [];
   imageSource = null;
+  imageSink = null;
   newId = monotonicFactory();
   events;
   actionCounts = /* @__PURE__ */ new Map();
@@ -3948,9 +4215,11 @@ var Board = class _Board {
   signIns = /* @__PURE__ */ new Map();
   files = new FileTree();
   homes;
+  moves;
   constructor(dataDir, options) {
     this.paths = new BoardPaths(dataDir);
-    this.homes = new HomeRepos(path7.join(this.paths.state(), "home-hooks"));
+    this.homes = new HomeRepos(path8.join(this.paths.state(), "home-hooks"));
+    this.moves = new MoveRepos(this.paths.moves());
     this.leaseMs = options.leaseMs ?? DEFAULT_LEASE_MS;
     this.now = options.now ?? (() => /* @__PURE__ */ new Date());
     this.events = new EventLog(this.paths.eventLog(), () => this.newId(), this.now);
@@ -3976,16 +4245,20 @@ var Board = class _Board {
     await board2.loadRunnerTokens();
     await board2.loadSignIns();
     await board2.homes.installHooks();
+    await board2.moves.clear();
     return board2;
   }
   /**
    * Applies each one-time alignment an existing society has not had yet, and remembers it, so a
    * member that later chooses otherwise keeps its choice. A new alignment is a name and a method in
-   * this list; once every board has applied it, both are deleted. None is pending.
+   * this list; once every board has applied it, both are deleted.
    */
   async applyAlignments() {
-    const alignments = [];
-    const file = path7.join(this.paths.state(), "alignments.json");
+    const alignments = [
+      // Whoever may show an image in a post may open one a post shows.
+      { name: "image-reads-granted", apply: () => this.grantBeside("upload_image", "read_image") }
+    ];
+    const file = path8.join(this.paths.state(), "alignments.json");
     const { applied } = await exists(file) ? await readJson(file, AlignmentsSchema) : { applied: [] };
     const pending = alignments.filter(({ name }) => !applied.includes(name));
     if (pending.length === 0) {
@@ -3996,6 +4269,17 @@ var Board = class _Board {
     }
     await writeJson(file, { applied: [...applied, ...pending.map(({ name }) => name)] });
   }
+  /**
+   * Grants `verb` once to every charter granting `beside`, the work roles' charters in practice;
+   * seed roles have it from their seed.
+   */
+  async grantBeside(beside, verb) {
+    for (const charter of await this.listRoles()) {
+      if (charter.verbs.includes(beside) && !charter.verbs.includes(verb)) {
+        await this.writeRoleUnlocked(USER_NAME, { ...charter, verbs: [...charter.verbs, verb] }, { verbsAdded: [verb] });
+      }
+    }
+  }
   /** Writes every missing seed charter and aligns the existing ones with their seed. */
   async ensureSeedRoles() {
     await ensureDir(this.paths.roles());
@@ -4193,7 +4477,7 @@ ${charter.purpose}
     });
   }
   signInsFile() {
-    return path7.join(this.paths.state(), "sign-ins.json");
+    return path8.join(this.paths.state(), "sign-ins.json");
   }
   async readSignIns() {
     const file = this.signInsFile();
@@ -4290,7 +4574,7 @@ ${charter.purpose}
     const files = await listFiles(this.paths.tasks(project));
     const tasks = [];
     for (const file of files) {
-      const doc = await readMarkdown(path7.join(this.paths.tasks(project), file), TaskFrontmatterSchema);
+      const doc = await readMarkdown(path8.join(this.paths.tasks(project), file), TaskFrontmatterSchema);
       tasks.push({ ...doc.data, body: doc.body });
     }
     return tasks;
@@ -4309,7 +4593,7 @@ ${charter.purpose}
     const files = await listFiles(this.paths.proposals());
     const proposals = [];
     for (const file of files) {
-      const doc = await readMarkdown(path7.join(this.paths.proposals(), file), ProposalFrontmatterSchema);
+      const doc = await readMarkdown(path8.join(this.paths.proposals(), file), ProposalFrontmatterSchema);
       proposals.push({ ...doc.data, body: doc.body });
     }
     return proposals;
@@ -4336,7 +4620,7 @@ ${charter.purpose}
   async listMembers() {
     const members = [];
     for (const file of await listFiles(this.paths.members())) {
-      const doc = await readMarkdown(path7.join(this.paths.members(), file), MemberSchema);
+      const doc = await readMarkdown(path8.join(this.paths.members(), file), MemberSchema);
       members.push({ ...doc.data, profile: doc.body });
     }
     return members;
@@ -4355,7 +4639,7 @@ ${charter.purpose}
     const dir = project === null ? this.paths.societyKnowledge() : this.paths.projectKnowledge(project);
     const topics = [];
     for (const file of await listFiles(dir)) {
-      topics.push(await this.knowledgeAt(path7.join(dir, file), project, file.replace(/\.md$/, "")));
+      topics.push(await this.knowledgeAt(path8.join(dir, file), project, file.replace(/\.md$/, "")));
     }
     return topics;
   }
@@ -4385,7 +4669,7 @@ ${charter.purpose}
     const aside = this.paths.removedKnowledge(project ?? SOCIETY_SCOPE);
     let highest = 0;
     for (const file of (await listFiles(aside)).filter((name) => name.startsWith(`${topic}.`))) {
-      const copy = await this.knowledgeAt(path7.join(aside, file), project, topic);
+      const copy = await this.knowledgeAt(path8.join(aside, file), project, topic);
       highest = Math.max(highest, copy.revision);
     }
     return highest;
@@ -4401,7 +4685,7 @@ ${charter.purpose}
   async listSkillsIn(dir, scope) {
     const skills = [];
     for (const entry of await listDirs(dir)) {
-      const file = path7.join(dir, entry, "SKILL.md");
+      const file = path8.join(dir, entry, "SKILL.md");
       if (!await exists(file)) {
         continue;
       }
@@ -4491,7 +4775,7 @@ ${charter.purpose}
         if (!wanted.delete(file.slice(0, 26))) {
           continue;
         }
-        const { data } = await readMarkdown(path7.join(dir, file), MessageFrontmatterSchema);
+        const { data } = await readMarkdown(path8.join(dir, file), MessageFrontmatterSchema);
         found.push(MessageRefSchema.parse(data));
       }
       if (wanted.size === 0) {
@@ -4523,7 +4807,7 @@ ${charter.purpose}
         if (!file.endsWith(".md")) {
           continue;
         }
-        const doc = await readMarkdown(path7.join(threads, file), ThreadFrontmatterSchema);
+        const doc = await readMarkdown(path8.join(threads, file), ThreadFrontmatterSchema);
         if (doc.data.state !== "open") {
           continue;
         }
@@ -4550,7 +4834,7 @@ ${charter.purpose}
     const all = [];
     for (const threads of await this.threadScopes()) {
       for (const file of await listFiles(threads)) {
-        const doc = await readMarkdown(path7.join(threads, file), ThreadFrontmatterSchema);
+        const doc = await readMarkdown(path8.join(threads, file), ThreadFrontmatterSchema);
         const messages = await listFiles(this.paths.threadMessages(threads, doc.data.id));
         const last = messages.at(-1);
         all.push({
@@ -4763,6 +5047,46 @@ ${DASHBOARD_LINE}
       return next;
     });
   }
+  /**
+   * Pauses or resumes a runner, the user's alone: the whole runner, or with `cli` that CLI on it
+   * alone, each apart from the other. While either holds, no turn it covers starts there; their
+   * wakes wait in the scheduler's queue, and a turn under way finishes. Pausing what is paused, or
+   * resuming what is not, changes nothing and logs nothing.
+   */
+  async setRunnerPaused(actor, name, change) {
+    this.assertUser(actor, "only the user may pause or resume a runner");
+    const cli = change.cli === void 0 ? void 0 : CliKindSchema.parse(change.cli);
+    return this.mutex.run(async () => {
+      const file = this.paths.runner(name);
+      if (!await exists(file)) {
+        throw new BoardError("NOT_FOUND", `runner ${name} not found`);
+      }
+      const doc = await readMarkdown(file, RunnerSchema);
+      const { paused, pausedClis, ...rest } = doc.data;
+      if (cli !== void 0 && change.paused && !doc.data.clis.includes(cli)) {
+        throw new BoardError("INVALID_STATE", `runner ${name} has no ${cli} to pause`);
+      }
+      const current = cli === void 0 ? paused : pausedClis?.[cli];
+      if (current !== void 0 === change.paused) {
+        return doc.data;
+      }
+      const pause = change.paused ? { at: this.now().toISOString(), by: actor.name } : void 0;
+      const clis = cli === void 0 ? { ...pausedClis } : { ...pausedClis, [cli]: pause };
+      const kept = Object.entries(clis).filter(([, each]) => each !== void 0);
+      const whole = cli === void 0 ? pause : paused;
+      const next = RunnerSchema.parse({
+        ...rest,
+        ...whole === void 0 ? {} : { paused: whole },
+        ...kept.length === 0 ? {} : { pausedClis: Object.fromEntries(kept) }
+      });
+      await writeMarkdown(file, next, doc.body);
+      await this.events.append(change.paused ? "runner.paused" : "runner.resumed", actor.name, {
+        name,
+        ...cli === void 0 ? {} : { cli }
+      });
+      return next;
+    });
+  }
   /**
    * Logs an operations signal as an `ops.signal` event. No channel carries it: the scheduler wakes
    * its readers from the event, the runner lists it in their prompts, and the interface's log shows
@@ -4797,8 +5121,9 @@ ${DASHBOARD_LINE}
       }
       if (event.type === "turn.started") {
         const start = TurnStartPayloadSchema.safeParse(event.payload);
-        if (start.success)
-          starts.set(start.data.turnId, event.ts);
+        if (start.success) {
+          starts.set(start.data.turnId, { ts: event.ts, heartbeat: start.data.heartbeat });
+        }
         continue;
       }
       if (event.type !== "turn.completed" && event.type !== "turn.failed") {
@@ -4806,17 +5131,19 @@ ${DASHBOARD_LINE}
       }
       const parsed = TurnHistoryPayloadSchema.safeParse(event.payload);
       if (parsed.success) {
-        const { turnId } = parsed.data;
-        const startedAt = turnId === void 0 ? void 0 : starts.get(turnId);
-        if (turnId !== void 0) {
-          starts.delete(turnId);
+        const { heartbeat: ended, ...turn } = parsed.data;
+        const start = turn.turnId === void 0 ? void 0 : starts.get(turn.turnId);
+        if (turn.turnId !== void 0) {
+          starts.delete(turn.turnId);
         }
+        const heartbeat = ended ?? start?.heartbeat;
         entries.push({
           id: event.id,
           ts: event.ts,
           outcome: event.type === "turn.failed" ? "failed" : "completed",
-          ...parsed.data,
-          ...startedAt === void 0 ? {} : { startedAt }
+          ...turn,
+          ...heartbeat === void 0 ? {} : { heartbeat },
+          ...start === void 0 ? {} : { startedAt: start.ts }
         });
       }
     }
@@ -4846,14 +5173,31 @@ ${DASHBOARD_LINE}
       return society;
     });
   }
-  /** Releases every claim whose lease has expired. Called by the scheduler on its tick. */
+  /**
+   * Releases every claim whose lease has expired, but for a holder's that its own cron in the
+   * task's thread keeps (`keptLease`). Called by the scheduler on its tick.
+   */
   async expireLeases() {
     return this.mutex.run(async () => {
       const expired = [];
       const now = this.now();
+      let crons;
+      let runners2;
       for (const project of await listDirs(this.paths.projects())) {
+        let place;
         for (const task of await this.listTasks(project)) {
-          if (task.status === "claimed" && this.leaseExpired(task, now)) {
+          if (task.status !== "claimed") {
+            continue;
+          }
+          crons ??= await this.listCrons();
+          runners2 ??= await this.listRunners();
+          place ??= await this.readProject(project);
+          const kept = latestLease(this.keptLease(task, crons, now), await this.pausedLease(task, runners2, place.runner, now));
+          if (kept !== null) {
+            await this.writeTask(project, { ...task, leaseExpiresAt: kept });
+            continue;
+          }
+          if (this.leaseExpired(task, now)) {
             const released = await this.writeTask(project, {
               ...task,
               status: "open",
@@ -4922,20 +5266,24 @@ ${DASHBOARD_LINE}
    * general channel, one of its other channels, one of its threads, or, in the society scope, a
    * project's channels. The heartbeat asks, so that it wakes a member where its unread
    * messages are and nowhere else. Society channels count only for a member woken in the society
-   * scope; a project member reads them at its next turn. Two kinds of post are in the digest but not
+   * scope; a project member reads them at its next turn. Some posts are in the digest but not
    * counted, and are read when the member wakes for something else: a task step's, which wakes
-   * whoever it hands work to, and the board's own, operations signals and landing announcements,
-   * whose signals that call for action wake their readers directly. A closed thread counts for
-   * nothing: its conversation has ended, and a turn there could only read its posts and be refused
-   * a reply, while a wake queued before it closed, as for a mention, still runs there.
+   * whoever it hands work to; the board's own, operations signals and landing announcements, whose
+   * signals that call for action wake their readers directly; and a knowledge topic's notice, which
+   * asks nothing of anyone. In a task's thread a post counts only for whoever the current stage is
+   * for, its holder or, while nobody holds it, a member who may take it, and for the task's creator
+   * when it mentions the user, so the creator can put a wait on the user in; a post that asks the
+   * reader counts wherever it is. A closed thread counts for nothing: its conversation has ended,
+   * and a turn there could only read its posts and be refused a reply, while a wake queued before
+   * it closed, as for a mention, still runs there.
    */
   async unreadByConversation(actor) {
     const { cursors, upto } = await this.digestSnapshot(actor.name);
     const counts = /* @__PURE__ */ new Map();
-    const closed = /* @__PURE__ */ new Map();
+    const threadCounts = /* @__PURE__ */ new Map();
     const unscoped = { name: actor.name, role: actor.role };
-    for (const { scope, part, message, news } of await this.digestSince(unscoped, cursors, upto)) {
-      if (news === true || message.step !== void 0 || message.author === SYSTEM_ACTOR.name) {
+    for (const { scope, part, message, news, asked } of await this.digestSince(unscoped, cursors, upto)) {
+      if (news === true || message.step !== void 0 || message.author === SYSTEM_ACTOR.name || message.notice?.kind === "knowledge") {
         continue;
       }
       const posted = parseChannelRef(message.channel).project ?? SOCIETY_SCOPE;
@@ -4944,12 +5292,13 @@ ${DASHBOARD_LINE}
       }
       const thread = threadOfPart(part);
       if (thread !== void 0) {
-        let ended = closed.get(thread);
-        if (ended === void 0) {
-          ended = (await this.tryFindThread(thread))?.thread.state === "closed";
-          closed.set(thread, ended);
+        let counted = threadCounts.get(thread);
+        if (counted === void 0) {
+          counted = await this.threadCount(actor, thread);
+          threadCounts.set(thread, counted);
         }
-        if (ended) {
+        const forReader = counted === "every" || counted !== "none" && asked === true || counted === "asks-user" && message.mentions.includes(USER_NAME);
+        if (!forReader) {
           continue;
         }
       }
@@ -5102,7 +5451,7 @@ ${DASHBOARD_LINE}
         include = participates;
       }
       if (include && message.author !== actor.name) {
-        collected.push({ scope: filedIn, part, message });
+        collected.push({ scope: filedIn, part, message, ...asked ? { asked: true } : {} });
       }
     }
     return collected.toSorted(byId);
@@ -5145,7 +5494,7 @@ ${task.body}`;
         }
       }
       for (const file of await listFiles(this.paths.projectKnowledge(project))) {
-        const content = await readFile4(path7.join(this.paths.projectKnowledge(project), file), "utf8");
+        const content = await readFile4(path8.join(this.paths.projectKnowledge(project), file), "utf8");
         if (content.toLowerCase().includes(needle)) {
           hits.push({
             kind: "knowledge",
@@ -5166,7 +5515,7 @@ ${task.body}`;
       shared.push({
         kind: "knowledge",
         ref: `society/knowledge/${file}`,
-        file: path7.join(this.paths.societyKnowledge(), file)
+        file: path8.join(this.paths.societyKnowledge(), file)
       });
     }
     for (const skill of await this.listSocietySkills()) {
@@ -5179,7 +5528,7 @@ ${task.body}`;
       shared.push({
         kind: "memory",
         ref: `memory/${file}`,
-        file: path7.join(this.paths.agentMemory(actor.name), file)
+        file: path8.join(this.paths.agentMemory(actor.name), file)
       });
     }
     for (const entry of shared) {
@@ -5268,8 +5617,8 @@ ${current.body}`);
         removedAt: this.now().toISOString()
       });
       const aside = this.paths.removedKnowledge(args.project ?? SOCIETY_SCOPE);
-      await mkdir4(aside, { recursive: true });
-      await rename3(file, path7.join(aside, `${args.topic}.${removed.removedAt.replaceAll(":", "-")}.md`));
+      await mkdir5(aside, { recursive: true });
+      await rename3(file, path8.join(aside, `${args.topic}.${removed.removedAt.replaceAll(":", "-")}.md`));
       await this.events.append("knowledge.removed", actor.name, {
         topic: args.topic,
         project: args.project
@@ -5316,8 +5665,8 @@ ${current.body}`);
         removedAt: this.now().toISOString()
       });
       const aside = this.paths.removedSkills();
-      await mkdir4(aside, { recursive: true });
-      await rename3(this.paths.societySkill(args.name), path7.join(aside, `${args.name}.${removed.removedAt.replaceAll(":", "-")}`));
+      await mkdir5(aside, { recursive: true });
+      await rename3(this.paths.societySkill(args.name), path8.join(aside, `${args.name}.${removed.removedAt.replaceAll(":", "-")}`));
       await this.events.append("skill.removed", actor.name, {
         name: args.name,
         reason: args.reason
@@ -5379,12 +5728,30 @@ ${current.body}`);
       throw new BoardError("NOT_FOUND", "this board has no runners to read an image from");
     }
     const bytes = await this.imageSource(actor, args.path);
+    return this.keepImage(actor, bytes, args.path, path8.basename(args.path));
+  }
+  /**
+   * Keeps an image the user posts from a composer, as its bytes, under the same checks as an image
+   * a turn uploads. `name`, the file's, describes it in the markdown answered; without one the
+   * description is empty, for the user to write.
+   */
+  async postImage(actor, bytes, name) {
+    this.assertUser(actor, "only the user posts an image's bytes; a turn uploads one with upload_image");
+    const given = name === void 0 ? "" : ImageNameSchema.parse(name);
+    return this.keepImage(actor, bytes, given === "" ? "the image" : given, given);
+  }
+  /**
+   * Keeps `bytes` under a new id when they are a PNG, JPEG, GIF, or WebP of at most
+   * `IMAGE_LIMIT_BYTES`, and answers the markdown that shows them, described by `name`. `what`
+   * names the image in a refusal.
+   */
+  async keepImage(actor, bytes, what, name) {
     const type = imageTypeOf(bytes);
     if (type === null) {
-      throw new BoardError("VALIDATION", `${args.path} is not a PNG, JPEG, GIF, or WebP image by its first bytes`);
+      throw new BoardError("VALIDATION", `${what} is not a PNG, JPEG, GIF, or WebP image by its first bytes`);
     }
     if (bytes.byteLength > IMAGE_LIMIT_BYTES) {
-      throw new BoardError("VALIDATION", `${args.path} is ${bytes.byteLength} bytes, over the ${IMAGE_LIMIT_BYTES} an image may be`);
+      throw new BoardError("VALIDATION", `${what} is ${bytes.byteLength} bytes, over the ${IMAGE_LIMIT_BYTES} an image may be`);
     }
     return this.mutex.run(async () => {
       const id = this.newId();
@@ -5394,15 +5761,37 @@ ${current.body}`);
         type,
         size: bytes.byteLength
       });
-      const name = path7.basename(args.path).replaceAll(/[[\]\\\r\n]/g, "");
+      const description = imageDescription(name);
       return {
         id,
         type,
         size: bytes.byteLength,
-        markdown: `![${name}](${IMAGE_SCHEME}${id})`
+        markdown: `![${description}](${IMAGE_SCHEME}${id})`
       };
     });
   }
+  /**
+   * Opens an image the board keeps for the calling turn, by its id or its `image:<id>` address:
+   * the runner the turn runs on writes the bytes to a file in a folder of the turn's own in the
+   * system temp folder, removed when the turn ends, and the board answers its path, for the
+   * citizen to open with its own file tools, since a post reaches a turn as markdown and an image
+   * in it as its address. Any image the board keeps may be opened: every post, brief, topic, and
+   * dashboard that could show one is in the projection every turn reads.
+   */
+  async openImage(actor, input) {
+    const args = VerbInputs.read_image.parse(input);
+    await this.authorize(actor, "read_image");
+    if (actor.scope === void 0) {
+      throw new BoardError("INVALID_STATE", "read_image writes the image on the machine a turn runs on, so only a turn can call it");
+    }
+    if (this.imageSink === null) {
+      throw new BoardError("NOT_FOUND", "this board has no runners to write an image to");
+    }
+    const id = imageIdOf(args.image_id);
+    const { type, bytes } = await this.readImage(id);
+    const file = await this.imageSink(actor, { id, type, bytes });
+    return { id, type, size: bytes.byteLength, path: file };
+  }
   /** An uploaded image's bytes and kind, which its first bytes tell. */
   async readImage(id) {
     const file = this.paths.image(UlidSchema.parse(id));
@@ -5420,7 +5809,7 @@ ${current.body}`);
   async listCrons() {
     const crons = [];
     for (const file of await listFiles(this.paths.crons())) {
-      crons.push(await this.readCronFile(path7.join(this.paths.crons(), file)));
+      crons.push(await this.readCronFile(path8.join(this.paths.crons(), file)));
     }
     return crons;
   }
@@ -5748,6 +6137,13 @@ ${current.body}`);
   readImagesWith(source) {
     this.imageSource = source;
   }
+  /**
+   * Where `read_image` writes an image to: the runner the calling turn runs on, through the server
+   * that hosts the runners. Without one, as in the admin CLI, nothing can be opened.
+   */
+  openImagesWith(sink) {
+    this.imageSink = sink;
+  }
   /**
    * Refuses to end conversations while another citizen's turn is in one of them: `cut` picks the
    * turns that would lose theirs. The caller's own turn is exempt, since ending a conversation
@@ -5767,7 +6163,7 @@ ${current.body}`);
   async openThreadIds(dir, keep) {
     const ids = /* @__PURE__ */ new Set();
     for (const file of await listFiles(dir)) {
-      const doc = await readMarkdown(path7.join(dir, file), ThreadFrontmatterSchema);
+      const doc = await readMarkdown(path8.join(dir, file), ThreadFrontmatterSchema);
       if (doc.data.state === "open" && keep({ ...doc.data, body: doc.body })) {
         ids.add(doc.data.id);
       }
@@ -5775,12 +6171,12 @@ ${current.body}`);
     return ids;
   }
   /**
-   * Refuses to archive a project while a turn runs in it, in a citizen's conversation of its
-   * channels in the society scope, or in a thread its archive closes.
+   * Refuses to archive or move a project while a turn runs in it, in a citizen's conversation of
+   * its channels in the society scope, or in one of its open threads.
    */
-  async assertProjectQuiet(actor, slug) {
+  async assertProjectQuiet(actor, slug, what = `project ${slug} cannot be archived`) {
     const threads = await this.openThreadIds(this.paths.threads(slug), () => true);
-    this.assertNoTurnCut(actor, `project ${slug} cannot be archived`, (turn) => turn.scope === slug || turn.place === slug || turn.thread !== void 0 && threads.has(turn.thread));
+    this.assertNoTurnCut(actor, what, (turn) => turn.scope === slug || turn.place === slug || turn.thread !== void 0 && threads.has(turn.thread));
   }
   async closeThread(actor, input) {
     const args = VerbInputs.close_thread.parse(input);
@@ -6583,6 +6979,8 @@ ${rationale}`}`);
         return this.removeCron(actor, VerbInputs.remove_cron.parse(input));
       case "upload_image":
         return this.uploadImage(actor, VerbInputs.upload_image.parse(input));
+      case "read_image":
+        return this.openImage(actor, VerbInputs.read_image.parse(input));
       default:
         throw new BoardError("VALIDATION", `unknown verb ${String(verb)}`);
     }
@@ -6747,7 +7145,7 @@ ${rationale}`}`);
     return part === void 0 ? this.paths.agentProject(agent, scope) : this.paths.agentConversation(agent, scope, part);
   }
   async readSessions(agent, project, part) {
-    const file = path7.join(this.sessionDir(agent, project, part), "sessions.json");
+    const file = path8.join(this.sessionDir(agent, project, part), "sessions.json");
     return await exists(file) ? readJson(file, SessionsFileSchema) : {};
   }
   /**
@@ -6758,7 +7156,7 @@ ${rationale}`}`);
     await this.mutex.run(async () => {
       const dir = this.sessionDir(agent, project, part);
       await ensureDir(dir);
-      const file = path7.join(dir, "sessions.json");
+      const file = path8.join(dir, "sessions.json");
       const current = await exists(file) ? await readJson(file, SessionsFileSchema) : {};
       const kept = current.runner === void 0 || current.runner === runner ? current : {};
       await writeJson(file, { ...kept, [cli]: sessionId, runner });
@@ -6770,7 +7168,7 @@ ${rationale}`}`);
    */
   async dropSession(agent, project, cli, sessionId, part) {
     return this.mutex.run(async () => {
-      const file = path7.join(this.sessionDir(agent, project, part), "sessions.json");
+      const file = path8.join(this.sessionDir(agent, project, part), "sessions.json");
       if (!await exists(file)) {
         return false;
       }
@@ -6785,7 +7183,7 @@ ${rationale}`}`);
   }
   /** The last turn of one conversation: the scope's home, a channel's, a project's, or a thread's. */
   async readLastTurn(agent, project, part) {
-    const file = path7.join(this.sessionDir(agent, project, part), "last-turn.json");
+    const file = path8.join(this.sessionDir(agent, project, part), "last-turn.json");
     return await exists(file) ? readJson(file, TurnRecordSchema) : null;
   }
   /** The latest turn a citizen took in a scope, in any of its conversations there. */
@@ -6793,9 +7191,9 @@ ${rationale}`}`);
     let latest = await this.readLastTurn(agent, project);
     const place = this.paths.agentProject(agent, project);
     const parts = [
-      ...await listDirs(path7.join(place, "threads")),
-      ...(await listDirs(path7.join(place, "channels"))).map((name) => `#${name}`),
-      ...(await listDirs(path7.join(place, "places"))).map((name) => `~${name}`)
+      ...await listDirs(path8.join(place, "threads")),
+      ...(await listDirs(path8.join(place, "channels"))).map((name) => `#${name}`),
+      ...(await listDirs(path8.join(place, "places"))).map((name) => `~${name}`)
     ];
     for (const part of parts) {
       const turn = await this.readLastTurn(agent, project, part);
@@ -6818,6 +7216,7 @@ ${rationale}`}`);
         ...parsed.channel === void 0 ? {} : { channel: parsed.channel },
         ...parsed.place === void 0 ? {} : { place: parsed.place },
         trigger: parsed.trigger.kind,
+        ...parsed.trigger.heartbeat === void 0 ? {} : { heartbeat: parsed.trigger.heartbeat },
         session: parsed.session,
         runner: parsed.runner
       });
@@ -6840,6 +7239,11 @@ ${rationale}`}`);
       for (const id of parsed.crons ?? []) {
         await this.recordCronRun(id, parsed, failed);
       }
+      if (parsed.exitReason === "completed" || parsed.exitReason === "blocked") {
+        for (const shown of parsed.cronFailures ?? []) {
+          await this.catchUpCron(shown, parsed);
+        }
+      }
       if (parsed.exitReason === "stopped") {
         await this.events.append("turn.stopped", parsed.stoppedBy ?? USER_NAME, {
           ...parsed.id === void 0 ? {} : { turnId: parsed.id },
@@ -6857,10 +7261,12 @@ ${rationale}`}`);
         ...parsed.channel === void 0 ? {} : { channel: parsed.channel },
         ...parsed.place === void 0 ? {} : { place: parsed.place },
         trigger: parsed.trigger.kind,
+        ...parsed.trigger.heartbeat === void 0 ? {} : { heartbeat: parsed.trigger.heartbeat },
         session: parsed.session,
         exitReason: parsed.exitReason,
         costUsd: parsed.costUsd,
         ...parsed.usage === null ? {} : { usage: parsed.usage },
+        ...parsed.contextTokens === void 0 ? {} : { contextTokens: parsed.contextTokens },
         toolCalls: parsed.toolCalls,
         model: parsed.model,
         summary: parsed.status?.summary ?? null,
@@ -6979,6 +7385,27 @@ ${rationale}`}`);
       failures: outcome === "failed" ? cron.failures + 1 : outcome === "completed" ? 0 : cron.failures
     });
   }
+  /**
+   * Marks a cron's failed fire caught up by a completed turn whose prompt named it, while that
+   * failure is still its latest run. Its schedule and its run of failures stay as they are.
+   */
+  async catchUpCron(shown, record) {
+    if (record.id === void 0 || !await exists(this.paths.cron(shown.cron))) {
+      return;
+    }
+    const cron = await this.readCron(shown.cron);
+    const failure = cronFailure(cron);
+    if (failure === null || failure.turnId !== shown.turnId) {
+      return;
+    }
+    await this.writeCron({
+      ...cron,
+      lastRun: {
+        ...failure,
+        caughtUp: { turnId: record.id, at: record.endedAt ?? this.now().toISOString() }
+      }
+    });
+  }
   /**
    * Whether a conversation with a workspace of its own has ended: a thread closed, a task ended
    * (for one from before tasks had threads), a channel archived, or a project archived, which ends
@@ -7061,11 +7488,11 @@ ${rationale}`}`);
   }
   /** Small named state files under data/state, for cursors the scheduler must keep across restarts. */
   async readState(name, schema, fallback) {
-    const file = path7.join(this.paths.state(), `${name}.json`);
+    const file = path8.join(this.paths.state(), `${name}.json`);
     return await exists(file) ? readJson(file, schema) : fallback;
   }
   async writeState(name, value) {
-    await this.mutex.run(() => writeJson(path7.join(this.paths.state(), `${name}.json`), value));
+    await this.mutex.run(() => writeJson(path8.join(this.paths.state(), `${name}.json`), value));
   }
   /** The project's dashboard, empty at revision 0 when it has none. */
   async readDashboard(slug) {
@@ -7096,7 +7523,7 @@ ${rationale}`}`);
   async listRunners() {
     const runners2 = [];
     for (const file of await listFiles(this.paths.runners())) {
-      runners2.push((await readMarkdown(path7.join(this.paths.runners(), file), RunnerSchema)).data);
+      runners2.push((await readMarkdown(path8.join(this.paths.runners(), file), RunnerSchema)).data);
     }
     return runners2;
   }
@@ -7148,7 +7575,7 @@ ${rationale}`}`);
     return this.runnerTokens.get(hashToken(token)) ?? null;
   }
   runnerTokensFile() {
-    return path7.join(this.paths.state(), "runners.json");
+    return path8.join(this.paths.state(), "runners.json");
   }
   async readRunnerTokens() {
     const file = this.runnerTokensFile();
@@ -7162,7 +7589,8 @@ ${rationale}`}`);
   }
   /**
    * Places a project on the runner that will hold its repository, unless it already lives on one,
-   * and returns where it lives. Placement is once: every later turn of the project goes there.
+   * and returns where it lives. Placement is once: every later turn of the project goes there,
+   * until the user moves the project (`recordProjectMove`).
    */
   async placeProject(slug, runner) {
     return this.mutex.run(async () => {
@@ -7204,12 +7632,12 @@ ${rationale}`}`);
         }
         const relative = prefix === "" ? entry.name : `${prefix}/${entry.name}`;
         if (entry.isDirectory()) {
-          await walk2(path7.join(dir, entry.name), relative);
+          await walk2(path8.join(dir, entry.name), relative);
           continue;
         }
         const file = entry.isFile() ? conflictCopyOf(relative) : null;
         if (file !== null) {
-          const since = await this.homes.changedAt(home, relative) ?? (await stat3(path7.join(home, relative)).catch(() => null))?.mtime.toISOString();
+          const since = await this.homes.changedAt(home, relative) ?? (await stat3(path8.join(home, relative)).catch(() => null))?.mtime.toISOString();
           if (since !== void 0) {
             found.push({ path: relative, file, since });
           }
@@ -7283,6 +7711,74 @@ ${rationale}`}`);
       return next;
     });
   }
+  /**
+   * The board's half of moving a project to another runner, which only the user does, checked
+   * before anything travels and while the hub holds the project's turns: the project is active and
+   * lives on a runner other than `to`, which the board knows; no task there is landing, since its
+   * landing runs on the old runner; and no turn runs in the project. Tasks in play move with their
+   * branches, so the answer lists them for the capabilities the new runner must offer.
+   */
+  async prepareProjectMove(actor, slug, to) {
+    this.assertUser(actor, "only the user may move a project to another runner");
+    const runner = NameSchema.parse(to);
+    return this.mutex.run(async () => {
+      const project = await this.readActiveProject(slug);
+      const from = project.runner;
+      if (from === void 0) {
+        throw new BoardError("INVALID_STATE", `project ${slug} lives on no runner yet; its first turn places it`);
+      }
+      if (from === runner) {
+        throw new BoardError("INVALID_STATE", `project ${slug} already lives on ${runner}`);
+      }
+      await this.readRunner(runner);
+      const inPlay2 = (await this.listTasks(slug)).filter((task) => task.status === "open" || task.status === "claimed");
+      const landing = inPlay2.filter((task) => task.completing);
+      if (landing.length > 0) {
+        throw new BoardError("INVALID_STATE", `project ${slug} cannot be moved while ${landing.length} task(s) land on ${from} (${landing.map((task) => task.id).join(", ")}); move it once they have landed`);
+      }
+      await this.assertProjectQuiet(actor, slug, `project ${slug} cannot be moved`);
+      return { project: { ...project, runner: from }, inPlay: inPlay2 };
+    });
+  }
+  /**
+   * Records that a project moved, once its new runner holds every branch its old one had, or with
+   * nothing carried when the user moved it while the old runner was away: every later turn of
+   * the project goes to `to`. Refused when the project was archived or moved meanwhile.
+   */
+  async recordProjectMove(actor, move) {
+    this.assertUser(actor, "only the user may move a project to another runner");
+    return this.mutex.run(async () => {
+      const current = await this.readActiveProject(move.slug);
+      if (current.runner !== move.from) {
+        throw new BoardError("INVALID_STATE", `project ${move.slug} no longer lives on ${move.from}, so this move no longer applies`);
+      }
+      await this.readRunner(move.to);
+      const project = await this.updateProject(move.slug, (each) => ({ ...each, runner: move.to }));
+      await this.events.append("project.moved", actor.name, {
+        slug: move.slug,
+        from: move.from,
+        to: move.to,
+        carried: move.carried
+      });
+      return project;
+    });
+  }
+  /**
+   * Makes the repository a move carries a project through, for the server's git route to serve,
+   * and answers the move's id, which names it; `dropMoveRepo` removes it when the move ends.
+   */
+  async openMoveRepo() {
+    const id = this.newId();
+    await this.moves.open(this.paths.move(id));
+    return id;
+  }
+  async dropMoveRepo(id) {
+    await this.moves.drop(this.paths.move(UlidSchema.parse(id)));
+  }
+  /** Where the moves' repositories live, which the server's git route serves from. */
+  get moveRepos() {
+    return this.paths.moves();
+  }
   /** The projection a runner mirrors for its agents to read, by relative path, with hashes. */
   async boardManifest() {
     return this.files.manifest(this.paths.board, () => true);
@@ -7293,7 +7789,7 @@ ${rationale}`}`);
   async writeTurnRecord(record) {
     const dir = this.sessionDir(record.agent, record.project, conversationPart(record));
     await ensureDir(dir);
-    await writeJson(path7.join(dir, "last-turn.json"), record);
+    await writeJson(path8.join(dir, "last-turn.json"), record);
   }
   // ---------------------------------------------------------------------------------------------
   // Internals
@@ -7412,8 +7908,8 @@ Short, curated, loaded on every turn. Keep entries that change future behavior a
   async ensureAgentProject(name, slug) {
     const dir = this.paths.agentProject(name, slug);
     await ensureDir(dir);
-    if (!await exists(path7.join(dir, "sessions.json"))) {
-      await writeJson(path7.join(dir, "sessions.json"), {});
+    if (!await exists(path8.join(dir, "sessions.json"))) {
+      await writeJson(path8.join(dir, "sessions.json"), {});
     }
   }
   /**
@@ -7655,11 +8151,11 @@ Short, curated, loaded on every turn. Keep entries that change future behavior a
     const file = this.paths.societySkillFile(skill.name);
     const replaced = await exists(file);
     const taken = proposal.skillFiles;
-    const staged = path7.join(this.paths.proposalFiles(proposal.id), "SKILL.md");
+    const staged = path8.join(this.paths.proposalFiles(proposal.id), "SKILL.md");
     if (taken === void 0 || !await exists(staged)) {
       throw new BoardError("INVALID_STATE", `proposal ${proposal.id} holds no skill files`);
     }
-    await rm2(dir, { recursive: true, force: true });
+    await rm3(dir, { recursive: true, force: true });
     await cp(this.paths.proposalFiles(proposal.id), dir, { recursive: true });
     const { body } = await readLooseMarkdown(file);
     await writeMarkdown(file, {
@@ -7712,10 +8208,10 @@ Short, curated, loaded on every turn. Keep entries that change future behavior a
       return `the frontmatter of ${folder}/SKILL.md in ${proposal.proposedBy}'s home does not parse (${manual.error})`;
     }
     const dir = this.paths.proposalFiles(proposal.id);
-    await rm2(dir, { recursive: true, force: true });
+    await rm3(dir, { recursive: true, force: true });
     for (const entry of taken.files) {
-      const target = path7.join(dir, ...entry.path.split("/"));
-      await ensureDir(path7.dirname(target));
+      const target = path8.join(dir, ...entry.path.split("/"));
+      await ensureDir(path8.dirname(target));
       await writeFile4(target, contents.get(entry.path) ?? Buffer.alloc(0));
       await chmod2(target, entry.executable ? 493 : 420);
     }
@@ -7806,7 +8302,7 @@ Short, curated, loaded on every turn. Keep entries that change future behavior a
       if (!isSafeRelativePath(entry.path)) {
         continue;
       }
-      const bytes = await readFile4(path7.join(dir, ...entry.path.split("/"))).catch(() => null);
+      const bytes = await readFile4(path8.join(dir, ...entry.path.split("/"))).catch(() => null);
       files.push({
         ...entry,
         ...bytes === null ? { text: null, truncated: false } : skillFileText(bytes)
@@ -7955,7 +8451,7 @@ Short, curated, loaded on every turn. Keep entries that change future behavior a
     this.assertNoTurnCut(actor, `${ref} cannot be archived`, (turn) => turn.channel === channel && turn.scope === scope || turn.thread !== void 0 && closing.has(turn.thread));
     const threadsClosed = [];
     for (const file of await listFiles(threads)) {
-      const doc = await readMarkdown(path7.join(threads, file), ThreadFrontmatterSchema);
+      const doc = await readMarkdown(path8.join(threads, file), ThreadFrontmatterSchema);
       if (doc.data.channel !== ref || doc.data.state !== "open") {
         continue;
       }
@@ -8087,7 +8583,7 @@ ${charter.purpose}
     const threads = this.paths.threads(slug);
     const threadsClosed = [];
     for (const file of await listFiles(threads)) {
-      const doc = await readMarkdown(path7.join(threads, file), ThreadFrontmatterSchema);
+      const doc = await readMarkdown(path8.join(threads, file), ThreadFrontmatterSchema);
       if (doc.data.state !== "open") {
         continue;
       }
@@ -8162,10 +8658,10 @@ ${charter.purpose}
         ...project,
         members: project.members.filter((member) => member !== name)
       }));
-      const sessions = path7.join(this.paths.agentProject(name, slug), "sessions.json");
+      const sessions = path8.join(this.paths.agentProject(name, slug), "sessions.json");
       if (await exists(sessions)) {
         const archived = `sessions.archived.${ts.replace(/[:.]/g, "-")}.json`;
-        await rename3(sessions, path7.join(this.paths.agentProject(name, slug), archived));
+        await rename3(sessions, path8.join(this.paths.agentProject(name, slug), archived));
       }
     }
     this.tokenIndex.delete(current.tokenHash);
@@ -8279,7 +8775,7 @@ ${charter.purpose}
   }
   assertMayGate(actor, what) {
     if (!PLANNING_ROLES.includes(actor.role)) {
-      throw new BoardError("FORBIDDEN", `only the user, the steward, and the concierge may ${what}; ask one of them in the task's thread`);
+      throw new BoardError("FORBIDDEN", `only the user, the steward, and the concierge may ${what}; ask one of them in the task's thread, with a mention`);
     }
   }
   /** The user holds anything; everyone else must be a project member the current stage admits. */
@@ -8321,6 +8817,51 @@ ${charter.purpose}
   leaseEnd(now) {
     return new Date(now.getTime() + this.leaseMs).toISOString();
   }
+  /**
+   * The lease a holder's own crons in the task's thread keep its claim to, when later than the one
+   * it has, else null. While one of them is pending, the lease is renewed for a full lease once less
+   * than half is left, so it never lapses between fires that may be hours apart; once every one is
+   * paused, ended, or failed at its latest fire with nothing catching it up (`cronStoppedAt`), it
+   * runs a full lease from when the last of them stopped.
+   */
+  keptLease(task, crons, now) {
+    if (task.leaseExpiresAt === void 0) {
+      return null;
+    }
+    const lease = Date.parse(task.leaseExpiresAt);
+    let pending = false;
+    let stopped = null;
+    for (const cron of crons) {
+      if (cron.agent !== task.claimedBy || !firesInTask(cron, task)) {
+        continue;
+      }
+      const at = cronStoppedAt(cron);
+      if (at === null) {
+        pending = true;
+      } else {
+        stopped = Math.max(stopped ?? 0, Date.parse(at));
+      }
+    }
+    const kept = pending ? lease - now.getTime() < this.leaseMs / 2 ? now.getTime() + this.leaseMs : lease : stopped === null ? lease : stopped + this.leaseMs;
+    return kept > lease ? new Date(kept).toISOString() : null;
+  }
+  /**
+   * The lease a holder keeps while the user's pause holds its turns in the task's project
+   * (`heldOn`), when later than the one it has, else null. It is renewed for a full lease once less
+   * than half is left, as for a pending cron, so it never lapses while the holder cannot take a
+   * turn there, and after the resume the holder has at least half a lease to come back to it.
+   */
+  async pausedLease(task, runners2, runner, now) {
+    if (task.claimedBy === void 0 || task.leaseExpiresAt === void 0) {
+      return null;
+    }
+    const holder = await this.readAgent(task.claimedBy).catch(() => null);
+    if (holder === null || !heldOn(runners2, runner, holder.cli)) {
+      return null;
+    }
+    const lease = Date.parse(task.leaseExpiresAt);
+    return lease - now.getTime() < this.leaseMs / 2 ? this.leaseEnd(now) : null;
+  }
   leaseExpired(task, now) {
     return task.leaseExpiresAt !== void 0 && new Date(task.leaseExpiresAt).getTime() <= now.getTime();
   }
@@ -8433,11 +8974,7 @@ ${charter.purpose}
         if (task.claimedBy === actor.name || task.createdBy === actor.name || task.stages.some((stage) => stage.agent === actor.name || stage.holders.includes(actor.name))) {
           return true;
         }
-        if (task.status !== "open" || task.completing) {
-          return false;
-        }
-        const agent = await this.readAgent(actor.name);
-        return agent.memberships.includes(task.project) && mayHoldStage(actor, task);
+        return await this.mayTakeStage(actor, task);
       }
       if (subject?.kind === "proposal") {
         const proposal = await this.readProposal(subject.id);
@@ -8451,6 +8988,34 @@ ${charter.purpose}
     }
     return false;
   }
+  /** Whether a task's current stage waits for a holder and the member may take it. */
+  async mayTakeStage(actor, task) {
+    if (task.status !== "open" || task.completing) {
+      return false;
+    }
+    const agent = await this.readAgent(actor.name);
+    return agent.memberships.includes(task.project) && mayHoldStage(actor, task);
+  }
+  /**
+   * Which of a thread's posts count toward a reader's heartbeat (see `unreadByConversation`). A
+   * thread, or a task, the board cannot find counts as an open topic's would.
+   */
+  async threadCount(actor, id) {
+    const found = await this.tryFindThread(id);
+    if (found?.thread.state === "closed") {
+      return "none";
+    }
+    const subject = found?.thread.subject;
+    const task = subject?.kind === "task" ? await this.findTask(subject.id).then((location) => location.task, () => null) : null;
+    if (task === null) {
+      return "every";
+    }
+    const stageIsTheirs = task.status === "claimed" ? task.claimedBy === actor.name : await this.mayTakeStage(actor, task);
+    if (stageIsTheirs) {
+      return "every";
+    }
+    return task.createdBy === actor.name ? "asks-user" : "asked";
+  }
   async threadScopes() {
     const projects = await listDirs(this.paths.projects());
     return [this.paths.societyThreads(), ...projects.map((slug) => this.paths.threads(slug))];
@@ -8506,7 +9071,7 @@ ${charter.purpose}
       if (since !== null && id <= since || upto !== void 0 && id > upto) {
         continue;
       }
-      const doc = await readMarkdown(path7.join(dir, file), MessageFrontmatterSchema);
+      const doc = await readMarkdown(path8.join(dir, file), MessageFrontmatterSchema);
       messages.push({ ...doc.data, body: doc.body });
     }
     return messages;
@@ -8555,6 +9120,15 @@ ${charter.purpose}
 };
 
 // packages/scheduler/dist/wake.js
+function heartbeatCause(input) {
+  if (input.digestSize > 0) {
+    return "unread";
+  }
+  if (input.claimsHeld > 0) {
+    return "held";
+  }
+  return input.waitingStages > 0 ? "waiting" : null;
+}
 function decideWake(input) {
   if (input.paused) {
     return { wake: false, reason: "society paused", priority: 0 };
@@ -8586,7 +9160,7 @@ function decideWake(input) {
     case "heartbeat":
       break;
   }
-  if (input.digestSize === 0 && input.claimsHeld === 0 && input.waitingStages === 0) {
+  if (heartbeatCause(input) === null) {
     return { wake: false, reason: "nothing to read, hold, or take", priority: 0 };
   }
   return {
@@ -8634,6 +9208,7 @@ var DEFAULT_TIMINGS = Object.freeze({
   homeConflictMs: 24 * 36e5,
   scaleCooldownMs: 36e5,
   reflectionMs: 24 * 36e5,
+  sessionCapTokens: 3e5,
   transientRetryMs: [6e4, 3 * 6e4, 10 * 6e4]
 });
 var SchedulerTimingsSchema = z17.object({
@@ -8652,6 +9227,7 @@ var SchedulerTimingsSchema = z17.object({
   homeConflictMs: z17.number().positive(),
   scaleCooldownMs: z17.number().positive(),
   reflectionMs: z17.number().positive(),
+  sessionCapTokens: z17.number().int().positive(),
   transientRetryMs: z17.array(z17.number().positive())
 }).partial();
 function parseTimings(input) {
@@ -8679,6 +9255,18 @@ var StateSchema = z17.object({
   lastHeartbeat: z17.record(z17.string(), z17.string()),
   /** Waiting stages already signalled, as `task:stage`, so each is logged once while it waits. */
   waitingSeen: z17.record(z17.string(), z17.string()).default({}),
+  /**
+   * The last pass at which each waiting stage was held by the user's pause of its runner, as
+   * `task:stage`; its wait counts from there, so a stage that waited through a pause is not
+   * signalled the moment the pause ends.
+   */
+  waitingHeld: z17.record(z17.string(), z17.string()).default({}),
+  /**
+   * The last operations pass at which each citizen was held by the user's pause of a runner it
+   * works on; its idle time counts from there, so a citizen held through a pause is not signalled
+   * idle the moment the pause ends.
+   */
+  idleHeld: z17.record(z17.string(), z17.string()).default({}),
   /** Queued dispatches survive a restart; the cursor has already moved past the events that made them. */
   pending: z17.record(z17.string(), PendingSchema).default({}),
   opsReported: z17.record(z17.string(), z17.string()).default({}),
@@ -8694,7 +9282,12 @@ var StateSchema = z17.object({
   costSinceReport: z17.number().nonnegative().default(0),
   turnsSinceReport: z17.number().int().nonnegative().default(0),
   /** When each member last reflected, or was first seen; the cadence counts from here. */
-  lastReflection: z17.record(z17.string(), z17.string()).default({})
+  lastReflection: z17.record(z17.string(), z17.string()).default({}),
+  /**
+   * The home session each society member last asked for an early reflection for, once per
+   * session, and whether that reflection still waits to be queued.
+   */
+  earlyReflection: z17.record(z17.string(), z17.object({ session: z17.string(), due: z17.boolean() })).default({})
 });
 function messageOf(trigger) {
   return trigger.kind === "mention" || trigger.kind === "user_post" ? trigger.messageId : void 0;
@@ -9038,6 +9631,7 @@ var Scheduler = class {
         const cost = payload["costUsd"];
         this.state.costSinceReport += typeof cost === "number" ? cost : 0;
         this.state.turnsSinceReport += 1;
+        await this.checkSessionSize(event);
         return;
       }
       case "wake.requested": {
@@ -9611,10 +10205,14 @@ var Scheduler = class {
    * A heartbeat per member and scope on the cadence, which then looks at every conversation of the
    * scope: the unread messages of its home, of each other channel, and of each thread, a stage the
    * member holds, and a stage of an unblocked task waiting that it may take, each in its task's
-   * thread. Each conversation with something wakes on its own, so a heartbeat never brings one
-   * task's business into another's turn.
+   * thread. A stage counts for neither while the member has a cron pending in its task's thread
+   * (`cronStoppedAt`: neither paused nor ended, and its latest fire's turn did not fail or was
+   * caught up since), whose fires are its checks there. Each conversation with something wakes on
+   * its own, so a heartbeat never brings one task's business into another's turn, and its trigger
+   * says what it woke for (`heartbeatCause`).
    */
   async checkHeartbeats(now) {
+    let pendingCrons;
     for (const agent of await this.board.listAgents()) {
       if (agent.status !== "active" || agent.cli === null) {
         continue;
@@ -9640,6 +10238,9 @@ var Scheduler = class {
         this.state.lastHeartbeat[cadence] = iso(now);
         unread ??= await this.board.unreadByConversation(actor);
         held ??= await this.board.heldClaims(agent.name);
+        pendingCrons ??= (await this.board.listCrons()).filter((cron) => cronStoppedAt(cron) === null);
+        const crons = pendingCrons;
+        const leftToCron = (task) => crons.some((cron) => cron.agent === agent.name && firesInTask(cron, task));
         const reasons = /* @__PURE__ */ new Map();
         const reasonsIn = (beside) => {
           const key = conversationKey2(agent.name, project, beside);
@@ -9658,13 +10259,13 @@ var Scheduler = class {
           }
         }
         for (const task of held) {
-          if (task.project === project) {
+          if (task.project === project && !leftToCron(task)) {
             reasonsIn({ thread: { id: task.id, task: true } }).claimsHeld += 1;
           }
         }
         if (project !== SOCIETY_SCOPE) {
           for (const task of await this.board.openTasks(project)) {
-            if (mayHoldStage(agent, task) && (await this.blockersInPlay(task.blockedBy)).length === 0) {
+            if (mayHoldStage(agent, task) && !leftToCron(task) && (await this.blockersInPlay(task.blockedBy)).length === 0) {
               reasonsIn({ thread: { id: task.id, task: true } }).waiting += 1;
             }
           }
@@ -9673,7 +10274,16 @@ var Scheduler = class {
           if (this.pending.has(key) || this.running.has(key)) {
             continue;
           }
-          const trigger = TriggerSchema.parse({ kind: "heartbeat", reason: "heartbeat" });
+          const cause = heartbeatCause({
+            digestSize: reason.digestSize,
+            claimsHeld: reason.claimsHeld,
+            waitingStages: reason.waiting
+          });
+          const trigger = TriggerSchema.parse({
+            kind: "heartbeat",
+            reason: "heartbeat",
+            ...cause === null ? {} : { heartbeat: cause }
+          });
           const decision = decideWake({
             trigger,
             digestSize: reason.digestSize,
@@ -9766,9 +10376,44 @@ var Scheduler = class {
       item.dispatch = rest.length === 0 ? dispatch : { ...dispatch, crons: rest };
     }
   }
+  /**
+   * A society role's home session that a turn left at `sessionCapTokens` or more, by its latest
+   * model call, asks for a reflection ahead of the cadence, which `checkReflections` queues once
+   * none of the member's turns is queued or running; the reflection's end starts the home afresh
+   * (`TurnHost`), so its history goes only once a reflection saved what to keep. A session asks
+   * once, so a reflection that fails leaves the next to the cadence, and none asks while a
+   * reflection is queued or running.
+   */
+  async checkSessionSize(event) {
+    const { payload } = event;
+    const tokens = payload["contextTokens"];
+    const session = stringOf(payload["session"]);
+    if (typeof tokens !== "number" || tokens < this.timings.sessionCapTokens || session === null || payload["project"] !== SOCIETY_SCOPE || payload["thread"] !== void 0 || payload["channel"] !== void 0 || payload["place"] !== void 0 || payload["trigger"] === "reflection" || payload["sessionDropped"] === true) {
+      return;
+    }
+    const agent = await this.tryReadAgent(event.actor);
+    if (agent === null || agent.status !== "active") {
+      return;
+    }
+    const charter = await this.board.readRole(agent.role).catch(() => null);
+    if (charter === null || !charter.societyScope || !charter.reflects) {
+      return;
+    }
+    if (this.state.earlyReflection[agent.name]?.session === session) {
+      return;
+    }
+    const ofAgent = (key) => parseSessionKey(key)?.agent === agent.name;
+    const reflecting = [...this.pending].some(([key, item]) => ofAgent(key) && item.dispatch.trigger.kind === "reflection") || [...this.exclusive].some(([key, kind]) => ofAgent(key) && kind === "reflection");
+    if (reflecting) {
+      return;
+    }
+    this.state.earlyReflection[agent.name] = { session, due: true };
+    this.log.info({ agent: agent.name, contextTokens: tokens, cap: this.timings.sessionCapTokens }, "home session past the cap; a reflection is due");
+  }
   /**
    * Every `reflectionMs`, a member whose charter reflects takes a reflection turn in the scope of
-   * its latest working turn, unless it has not worked since its last reflection.
+   * its latest working turn, unless it has not worked since its last reflection; a society member
+   * whose home session passed the cap takes one in its home ahead of the cadence, which restarts it.
    */
   async checkReflections(now) {
     for (const agent of await this.board.listAgents()) {
@@ -9779,6 +10424,15 @@ var Scheduler = class {
       if (!charter.reflects) {
         continue;
       }
+      const early = this.state.earlyReflection[agent.name];
+      if (early?.due === true) {
+        if (!this.busy(agent.name)) {
+          this.state.lastReflection[agent.name] = iso(now);
+          this.state.earlyReflection[agent.name] = { ...early, due: false };
+          this.enqueue(agent.name, SOCIETY_SCOPE, { kind: "reflection", reason: "home session past the cap" }, now);
+        }
+        continue;
+      }
       const last = this.state.lastReflection[agent.name];
       if (last === void 0) {
         this.state.lastReflection[agent.name] = iso(now);
@@ -9792,8 +10446,7 @@ var Scheduler = class {
         this.state.lastReflection[agent.name] = iso(now);
         continue;
       }
-      const busy = [...this.pending.keys(), ...this.running.keys()].some((key) => parseSessionKey(key)?.agent === agent.name);
-      if (busy) {
+      if (this.busy(agent.name)) {
         continue;
       }
       this.state.lastReflection[agent.name] = iso(now);
@@ -9803,6 +10456,13 @@ var Scheduler = class {
       this.enqueue(agent.name, latest.scope, { kind: "reflection", reason: "scheduled reflection" }, now);
     }
   }
+  /**
+   * Whether a member has a turn queued or running anywhere, so a reflection waits for the next tick
+   * rather than merge into a working turn or run beside turns writing the memory it consolidates.
+   */
+  busy(agent) {
+    return [...this.pending.keys(), ...this.running.keys()].some((key) => parseSessionKey(key)?.agent === agent);
+  }
   /** The member's most recent turn that was not itself a reflection, with the scope it ran in. */
   async latestWorkingTurn(agent) {
     let latest = null;
@@ -9826,7 +10486,9 @@ var Scheduler = class {
    */
   async checkWaitingStages(now) {
     const stillWaiting = /* @__PURE__ */ new Set();
+    const runners2 = await this.board.listRunners();
     for (const project of await this.board.listProjects()) {
+      let members;
       for (const task of await this.board.openTasks(project.slug)) {
         const stage = currentStage(task);
         if (stage === void 0) {
@@ -9837,7 +10499,14 @@ var Scheduler = class {
         if (this.state.waitingSeen[key] !== void 0) {
           continue;
         }
-        const age = now - Date.parse(task.stageSince);
+        members ??= await this.board.projectMembers(project.slug);
+        const takers = members.filter((member) => member.cli !== null && mayHoldStage(member, task));
+        if (takers.length > 0 && takers.every((taker) => heldOn(runners2, project.runner, taker.cli))) {
+          this.state.waitingHeld[key] = iso(now);
+          continue;
+        }
+        const held = this.state.waitingHeld[key];
+        const age = now - Math.max(Date.parse(task.stageSince), held === void 0 ? 0 : Date.parse(held));
         if (age < this.timings.waitingStageMs) {
           continue;
         }
@@ -9858,6 +10527,11 @@ var Scheduler = class {
         });
       }
     }
+    for (const key of Object.keys(this.state.waitingHeld)) {
+      if (!stillWaiting.has(key)) {
+        delete this.state.waitingHeld[key];
+      }
+    }
     for (const key of Object.keys(this.state.waitingSeen)) {
       if (!stillWaiting.has(key)) {
         delete this.state.waitingSeen[key];
@@ -9923,7 +10597,8 @@ var Scheduler = class {
     const roles = (await this.board.listRoles()).filter((role) => role.name !== USER_ROLE);
     const runners2 = await this.board.listRunners();
     const anywhere = new Set(runners2.filter((runner) => runner.status === "connected").flatMap((runner) => runner.capabilities));
-    for (const project of await this.board.listProjects()) {
+    const projects = await this.board.listProjects();
+    for (const project of projects) {
       const slug = project.slug;
       const tasks = await this.board.listTasks(slug);
       const home = runners2.find((runner) => runner.name === project.runner);
@@ -10015,7 +10690,13 @@ var Scheduler = class {
       }
     }
     const crons = (await this.board.listCrons()).filter((cron) => cron.ended === void 0);
-    for (const agent of await this.board.listAgents()) {
+    const agents = await this.board.listAgents();
+    for (const name of Object.keys(this.state.idleHeld)) {
+      if (!agents.some((agent) => agent.name === name && agent.status === "active")) {
+        delete this.state.idleHeld[name];
+      }
+    }
+    for (const agent of agents) {
       if (agent.status !== "active" || agent.cli === null) {
         continue;
       }
@@ -10027,7 +10708,12 @@ var Scheduler = class {
           last = Math.max(last, Date.parse(ended));
         }
       }
-      const idle = now - last;
+      const held = heldOn(runners2, agent.homeRunner, agent.cli) || projects.some((project) => agent.memberships.includes(project.slug) && heldOn(runners2, project.runner, agent.cli));
+      if (held) {
+        this.state.idleHeld[agent.name] = iso(now);
+      }
+      const heldAt = this.state.idleHeld[agent.name];
+      const idle = now - Math.max(last, heldAt === void 0 ? 0 : Date.parse(heldAt));
       if (idle >= this.timings.idleMemberMs) {
         signals.push({
           kind: "idle_member",
@@ -10249,6 +10935,10 @@ var Scheduler = class {
         this.exclusive.set(key, "onboarding");
       } else if (dispatch.trigger.kind === "reflection") {
         this.exclusive.set(key, "reflection");
+        const early = this.state.earlyReflection[dispatch.agent];
+        if (early?.due === true) {
+          this.state.earlyReflection[dispatch.agent] = { ...early, due: false };
+        }
       }
     }
   }
@@ -10376,20 +11066,21 @@ var Scheduler = class {
 import { randomUUID } from "node:crypto";
 
 // packages/turn-host/dist/render.js
+import { createHash as createHash3 } from "node:crypto";
 var TURN_CONTRACT = [
   "- Every turn belongs to one conversation, named at the top of your prompt: your home conversation in a project or the society, for its general channel and for work tied to no other channel and no thread; the conversation of one other channel of the place, a workstream such as a release; outside projects, the conversation of one project's channels, general and its workstreams together, for posts there that ask something of you while you are not a member; or the conversation of one thread you take part in, a task's, a proposal's, or a topic's. Each has its own session and its own turns, which may run while this one does. The prompt carries this conversation only: in a thread, its new messages, or the whole thread when the conversation is new, and in a task's thread the task and its stage; in a channel's, a project's, or at home, that channel's, that project's channels', or general's messages that concern you. Read anything else you need with get_task, search, and the board's files, and leave other channels', other threads', and other projects' work to their own turns.",
-  "- Act through the board tools (the `board` MCP server). Holding a stage is a lease; every turn that touches the task renews it.",
+  "- Act through the board tools (the `board` MCP server). Holding a stage is a lease; every turn that touches the task renews it, and so does the board while a cron of yours in the task's thread is pending.",
   "- Work only inside your worktree. In a task's conversation it is a worktree of its own on the task's branch `task/<id>`: commit your work there. The branch is checked out in one worktree at a time and kept for the turns of whoever holds the task's stage, so a turn of anyone else there, or one that starts while another turn has the branch, works detached at its tip, which Your workspace then says; its commits go on the branch by a fast-forward when a turn in the task ends with the branch free, and the task's thread is told of commits that no longer build on its tip. After each turn the runner commits what you left on the branch and lets it go for the next holder. Your home worktree is on your own branch, `agent/<name>`, for work tied to no task; nothing lands from it by itself. In a proposal's, a topic's, or a channel's conversation it is a worktree of its own, detached at the project's default branch, which goes when the thread closes or the channel is archived, so work that should last goes on a task's branch. Before each turn the runner fetches the project's remote and brings what holds no work of yours up to the default branch: your own branch when it has no commits of its own, a task's branch nobody has worked on, and a detached worktree with nothing uncommitted; what it leaves where it is, and why, is under Your workspace in the prompt. It never merges or commits for you.",
   "- Posts that would wake this conversation may arrive while you work, delivered into the turn under a heading that says so and formatted like the digest. They are part of this turn: act on them now, after the step in hand, or not at all, as with the digest. The user may also stop a turn; the next turn is told.",
   "- Silence is allowed. If the digest needs no reply, post nothing.",
-  "- To come back to something later, set a cron with create_cron: a note on what to do then, and a five-field cron expression or one time with at. It wakes you in this conversation unless you name another, at most every fifteen minutes, and every fire is a paid turn, so end a cron with remove_cron once it has done its job. Never wait by holding a stage, sleeping, or leaving a process running: a turn's board token ends with the turn, so nothing it leaves behind can act on the board. The society's crons are under society/crons/ in the board projection.",
+  "- To come back to something later, set a cron with create_cron: a note on what to do then, and a five-field cron expression or one time with at. It wakes you in this conversation unless you name another, at most every fifteen minutes, and every fire is a paid turn, so end a cron with remove_cron once it has done its job. Never wait by sleeping or leaving a process running: a turn's board token ends with the turn, so nothing it leaves behind can act on the board. While you check your own stage's work on a schedule, such as a running job, CI, or a deploy, keep holding the stage: the cron sets when you check, and while it is pending in the task's thread, neither ended nor paused, with its latest fire's turn not failed or a turn of yours there completed since, the board keeps your lease and the heartbeat leaves the stage to it, waking you there only for a post you have not read. Release a stage only to hand it on, or once its task's blocked_by names the tasks it waits on: the stage then wakes nobody until the last of them ends. Any other wait on someone else, such as the user or an outside party, is a stage of its own, not a held stage. The society's crons are under society/crons/ in the board projection.",
   "- An @mention wakes the citizen named, and every wake costs a turn. Address someone with @ only when you need them to act; when you merely refer to citizens, write their names plainly. A name in a code span or a code block is no mention, so code keeps its @ as written. @user wakes nobody, since the user takes no turns; it is what puts a question before the user, so use it only when you need the user to answer or decide.",
-  "- A thread is a conversation off a channel that reaches only its participants and whoever is mentioned in it. Every task has one, opened with it under the task's id on the channel of its project it was filed in, general unless it was filed in another: talk about a task there, with post_message and its thread_id, and the notes you give advance_task and update_task are posted there as you. Its participants are the task's creator, its stage holders and assignees, whoever may take the stage that waits, and anyone who posted; it closes when the task ends. Every proposal has one too, in governance, opened with its pitch and closed by its decision. Open other threads with open_thread on a channel with a title, for any other topic; close_thread posts your summary to its channel.",
-  "- To show an image in a post, such as a screenshot or a chart, save it anywhere you can read it, such as a folder from `mktemp -d`, call upload_image with its path, and put the markdown it returns in the post, `![what it shows](image:<id>)`, with what the image shows as its alt text: the board keeps the image, so it shows in any conversation after the file is gone. It takes a PNG, JPEG, GIF, or WebP of at most 8 MB from your worktree, your home, or the system temp folder. An image committed on a task's branch, linked by its path in the task's worktree, still shows in place, and so does one at an https address. Never put an image or any other file into a message as base64 or a data: URL: the board does not show it, and every reader of the conversation gets it in full in their prompt.",
+  "- A thread is a conversation off a channel that reaches only its participants and whoever is mentioned in it. Every task has one, opened with it under the task's id on the channel of its project it was filed in, general unless it was filed in another: talk about a task there, with post_message and its thread_id, and the notes you give advance_task and update_task are posted there as you. Its participants are the task's creator, its stage holders and assignees, whoever may take the stage that waits, and anyone who posted; it closes when the task ends. In a task's thread, only the current stage's holder, or while nobody holds it whoever may take it, wakes for your post, and a post that asks the user also wakes the task's creator; mention anyone else you need, including the concierge for a plan change. Every proposal has one too, in governance, opened with its pitch and closed by its decision. Open other threads with open_thread on a channel with a title, for any other topic; close_thread posts your summary to its channel.",
+  "- To show an image in a post, such as a screenshot or a chart, save it anywhere you can read it, such as a folder from `mktemp -d`, call upload_image with its path, and put the markdown it returns in the post, `![what it shows](image:<id>)`, with what the image shows as its alt text: the board keeps the image, so it shows in any conversation after the file is gone. It takes a PNG, JPEG, GIF, or WebP of at most 8 MB from your worktree, your home, or the system temp folder. An image committed on a task's branch, linked by its path in the task's worktree, still shows in place, and so does one at an https address. Never put an image or any other file into a message as base64 or a data: URL: the board does not show it, and every reader of the conversation gets it in full in their prompt. To see an image a post, a brief, or a topic shows as `image:<id>`, call read_image with the id: it returns the path of a file of this turn's own that holds the image, removed when the turn ends, which you open with the tool that shows you an image, Read in Claude Code or view_image in Codex.",
   "- Route every lesson: about you, your craft, or the user, write it to memory/core.md in your home directory, and keep that file short by moving detail to memory/<topic>.md, your archive; how a codebase behaves (architecture, conventions, gotchas, how to build, test, and verify it) goes in its AGENTS.md or README, committed on a task's branch like any change to the code, or proposed in the task's thread or the project channel when it is outside the task at hand; a durable fact about a project as a place (runners, access, flow, where results live) goes through `write_knowledge` on that project; something the whole project should know now, post it to the project channel, and anything about one task, in the task's thread.",
   '- A procedure you have followed twice is a candidate for a skill, which it is when it makes a citizen better at a kind of work on any project: write it to skills/<name>/SKILL.md in your home, frontmatter with `name` and a one-line `description` and then the steps, and your skills index lists it from the next turn. Files the steps use, such as scripts/ and references/, go in the same folder, named in SKILL.md by paths relative to it. Propose it with kind "skill" when more than one citizen would use it and nothing in it is tied to one place; a skill only you use stays yours, however many projects you use it on.',
   "- To take a published skill for yourself, install it in a temporary folder and copy it into your home: in a folder from `mktemp -d`, `npx -y skills add <source> --skill <name> -a universal --copy -y` writes `.agents/skills/<name>/` and a lock file there, and you copy that skill folder to skills/<name>/ in your home, named in lowercase letters, digits, and hyphens. Never install one inside a worktree, where it would be committed into the project, or with -g, which writes to the runner's own home, shared by every citizen on it and listed in no skills index.",
-  "- Report memoryUpdated: true in the status object whenever you changed memory/core.md or a skill, so a warm session restarts with the new instructions.",
+  "- Report memoryUpdated: true in the status object whenever you changed memory/core.md or a skill. A change to your instructions reaches each of your conversations at its next turn, whose prompt then carries them whole, replacing what that conversation had; a turn already running keeps what it started with.",
   "- Other turns of yours may be running at the same time and share your home. Change a file there with your edit tool, which refuses a file changed since you read it, and never rewrite one whole from an earlier read, with a shell redirect or a script, or you erase what another of your turns wrote.",
   "- To ask the user something, mention @user where the question belongs: the task's thread for a task, the proposal's thread for a proposal, and for anything else a thread you open on your scope's general channel, titled with the question. The user answers in the same thread, and the answer comes back to that thread's conversation. A proposal waiting on the user is already in front of them and needs no mention.",
   "- End every turn with the status object: summary, claims held, what is blocked, and whether the user must decide. If you report that the user must decide, mentioned @user nowhere this turn, and proposed nothing for the user to decide, the runner asks in this turn's thread when it has one, and otherwise opens a thread on your scope's general channel with your summary as the question."
@@ -10398,9 +11089,9 @@ var PLANNING = [
   "- A task is a plan of stages between open and done. Hold the current stage with claim_task and finish it with advance_task; the next stage becomes current, and past the last one the task is done.",
   "- Name stages by what gets done. Plan the next few steps rather than everything, and reshape with plan_task as the work teaches you.",
   "- Assign a stage to a role when anyone in it could do it, to a citizen only when it must be them, and to nobody when anyone in the project could. A citizen named on a stage must be a member of the task's project; add them first. A stage wakes everyone it is open to when it comes up, so the narrower the assignee, the fewer turns it costs.",
-  "- Reshape rather than force: another round is an inserted stage, and a wait on something outside the society is a stage named for what it waits on. When a check finds work unfinished, the holder of the current stage sends the task back to an earlier stage with update_task, and so may the user, the steward, and the concierge; anyone else asks the concierge in the task's thread.",
-  "- A task that cannot start until other tasks finish names them with update_task blocked_by. While any of them is in play, its stage wakes nobody, neither when it comes up nor on a heartbeat; once the last has ended, done or abandoned, the stage wakes as if it had just come up, or wakes its holder. Nobody needs to clear the block or mention anyone when they end; change blocked_by only when the plan changes.",
-  "- A gated stage is an independent check: nobody who held an earlier stage of the task may hold it, and only the user, the steward, and the concierge may add, remove, move, reassign, or ungate it. Ask them in the task's thread when a gate should change.",
+  "- Reshape rather than force: another round is an inserted stage, and a wait on something outside the society is a stage named for what it waits on. When a check finds work unfinished, the holder of the current stage sends the task back to an earlier stage with update_task, and so may the user, the steward, and the concierge; anyone else asks the concierge in the task's thread, with a mention.",
+  "- A task that cannot start until other tasks finish names them with update_task blocked_by, and whoever holds its stage then releases it, since the heartbeat still wakes a holder. While any of them is in play, a stage nobody holds wakes nobody, neither when it comes up nor on a heartbeat; once the last has ended, done or abandoned, the stage wakes as if it had just come up, or wakes its holder. Nobody needs to clear the block or mention anyone when they end; change blocked_by only when the plan changes.",
+  "- A gated stage is an independent check: nobody who held an earlier stage of the task may hold it, and only the user, the steward, and the concierge may add, remove, move, reassign, or ungate it. Ask them in the task's thread, with a mention, when a gate should change.",
   "- Commit your work on the task's branch before you advance, and say what you did in the advance note; it is the handover the next holder reads in the task's thread."
 ].join("\n");
 var GOVERNANCE = [
@@ -10459,6 +11150,10 @@ function renderInstructions(input) {
   return `${sections.join("\n")}
 `;
 }
+function instructionsHash(input) {
+  const { onboarding: _first, ...kept } = input;
+  return createHash3("sha256").update(renderInstructions(kept)).digest("hex");
+}
 
 // packages/turn-host/dist/prompt.js
 var REFLECTION_INTRO = "This turn is for your memory; take no new work, and answer unread messages only where a reply is needed. Read memory/core.md and your recent turn records, then:";
@@ -10467,9 +11162,11 @@ var REFLECTION_STEPS = [
   "- Consolidate memory/core.md: keep it to lessons that still hold, about sixty lines at most, and move detail worth keeping to memory/<topic>.md in your home, which the board's search covers for you alone.",
   '- Extract a skill: a procedure you have followed twice is a candidate, and one that makes a citizen better at a kind of work on any project goes to skills/<name>/SKILL.md, frontmatter with `name` and a one-line `description` and then the steps, with any script or reference it uses in the same folder. Propose it with kind "skill" when more than one citizen would use it and nothing in it is tied to one place; one only you use stays yours.',
   "- Refresh profile.md: one paragraph on what you do well and what to send your way; the roster the front desk routes with is built from it.",
-  "- Share: how a codebase behaves goes in its AGENTS.md or README through a task like any change to the code, so propose it in that task's thread or the project channel; a durable fact about this scope as a place (runners, access, flow, where results live) goes through write_knowledge; a norm the whole society should follow goes to the steward as a plain post in general.",
-  "- Report memoryUpdated: true in the status object when core.md or a skill changed."
+  "- Share: how a codebase behaves goes in its AGENTS.md or README through a task like any change to the code, so propose it in that task's thread or the project channel; a durable fact about this scope as a place (runners, access, flow, where results live) goes through write_knowledge; a norm the whole society should follow goes to the steward as a plain post in general."
 ];
+var SAVE_WHAT_IS_OPEN = "- This conversation's session ends with this turn, and the next turn here starts a new one that knows only your home's files and the board: write anything still open into memory/core.md, or the archive it points to, before you end.";
+var REFLECTION_REPORT = "- Report memoryUpdated: true in the status object when core.md or a skill changed.";
+var INSTRUCTIONS_CHANGED = "Your instructions changed since this conversation last received them. Between the tags below are the whole of them now: they replace the instructions this conversation began with and any earlier text like this, so where the two differ, follow these, and a rule missing from them no longer applies.";
 var MAX_BODY_CHARS = 1500;
 var MAX_PROFILE_CHARS = 200;
 function clip(text) {
@@ -10524,12 +11221,19 @@ function quotaPhrase(cli, quota, now) {
 }
 function runnerLine(runner, projects, now) {
   const living = projects.filter((project) => project.runner === runner.name).map((project) => project.slug);
-  const state = runner.status === "connected" ? "connected" : `away${runner.lastSeen === void 0 ? "" : ` since ${runner.lastSeen}`}`;
+  const state = [
+    runner.status === "connected" ? "connected" : `away${runner.lastSeen === void 0 ? "" : ` since ${runner.lastSeen}`}`,
+    ...runner.paused === void 0 ? [] : [`paused by the user since ${runner.paused.at}`]
+  ].join(", ");
+  const pauses = runner.clis.flatMap((cli) => {
+    const pause = runner.pausedClis?.[cli];
+    return pause === void 0 ? [] : [`${cli} paused by the user since ${pause.at}`];
+  });
   const quotas = runner.clis.flatMap((cli) => {
     const quota = runner.quotas?.[cli];
     return quota === void 0 ? [] : [quotaPhrase(cli, quota, now)];
   });
-  return `- ${runner.name}: ${state}; ${runner.os}; CLIs ${runner.clis.length === 0 ? "none" : runner.clis.join(", ")}; offers ${runner.capabilities.length === 0 ? "nothing beyond its CLIs" : runner.capabilities.join(", ")}; ${living.length === 0 ? "no projects" : `projects ${living.join(", ")}`}${quotas.length === 0 ? "" : `; quota ${quotas.join("; ")}`}`;
+  return `- ${runner.name}: ${state}; ${runner.os}; CLIs ${runner.clis.length === 0 ? "none" : runner.clis.join(", ")}; offers ${runner.capabilities.length === 0 ? "nothing beyond its CLIs" : runner.capabilities.join(", ")}; ${living.length === 0 ? "no projects" : `projects ${living.join(", ")}`}${pauses.map((pause) => `; ${pause}`).join("")}${quotas.length === 0 ? "" : `; quota ${quotas.join("; ")}`}`;
 }
 function profileLine(profile) {
   const line = profile.split("\n").map((entry) => entry.trim()).find((entry) => entry.length > 0 && !entry.startsWith("#"));
@@ -10566,7 +11270,7 @@ function messageLines(messages, threads) {
 function cronLines(cron, timeZone) {
   const previous = cron.lastRun === void 0 ? "" : ` The turn of its previous fire ${cron.lastRun.outcome === "stopped" ? "was stopped by the user" : cron.lastRun.outcome} at ${cron.lastRun.at}.`;
   const next = nextFire(cron, timeZone);
-  const state = isOneTime(cron.schedule) ? " It fired once, as set, and has ended." : cron.ended !== void 0 ? ` ${cron.ended.by} has ended it since it fired (${cron.ended.reason}), so do what it asks only if it still matters.` : next === null ? "" : ` Next it fires at ${next.toISOString()}.`;
+  const state = isOneTime(cron.schedule) ? " It fired once, as set, and has ended." : cron.ended !== void 0 ? ` ${cron.ended.by} has ended it since it fired (${cron.ended.reason}), so do what it asks only if it still matters.` : cron.paused !== void 0 ? ` ${cron.paused.by} has paused it since it fired, so it fires no more until resumed.` : next === null ? "" : ` Next it fires at ${next.toISOString()}.`;
   return [
     `- "${cron.title}" (cron ${cron.id}), set by ${cron.createdBy} at ${cron.createdAt}, fires ${describeSchedule(cron.schedule, timeZone)}.${previous}${state}`,
     "",
@@ -10620,6 +11324,10 @@ function buildTurnPrompt(input) {
   if (dispatch.trigger.kind === "user_post") {
     lines.push("The user posted. Route it: answer where it was posted, in its thread when it came in one, or create what it needs: a task with a plan whose stages name who does them, a thread, or a project, adding citizens to a project first when they are not members. Stay silent when the user already addressed a citizen and nothing else is needed.");
   }
+  const changed = input.changedInstructions ?? null;
+  if (changed !== null) {
+    lines.push("", "## Your instructions changed", "", INSTRUCTIONS_CHANGED, "", "<instructions>", changed.trimEnd(), "</instructions>");
+  }
   const conversation = input.conversation ?? null;
   lines.push("", "## This conversation", "");
   if (conversation === null && dispatch.channel !== void 0) {
@@ -10654,7 +11362,7 @@ function buildTurnPrompt(input) {
   lines.push("", WORKSPACE_TOKEN);
   const conflicts = input.conflicts ?? [];
   if (dispatch.trigger.kind === "reflection") {
-    lines.push("", "## Reflection", "", REFLECTION_INTRO, ...conflicts.length > 0 ? [RECONCILE] : [], ...REFLECTION_STEPS);
+    lines.push("", "## Reflection", "", REFLECTION_INTRO, ...conflicts.length > 0 ? [RECONCILE] : [], ...REFLECTION_STEPS, ...input.afreshAfterReflection === true ? [SAVE_WHAT_IS_OPEN] : [], REFLECTION_REPORT);
   }
   if (input.onboarding !== null) {
     lines.push("", "## First turn", "", renderOnboardingPreamble(input.onboarding));
@@ -10668,6 +11376,14 @@ function buildTurnPrompt(input) {
       "Its CLI could not resume this conversation's session, so the session was dropped and this turn starts a new one: nothing of your earlier turns here carries over but what is on the board and in your home."
     ] : [], "The worktree may hold uncommitted changes. Run git status before doing anything else.");
   }
+  const failed = input.failedCrons ?? [];
+  if (failed.length > 0) {
+    const timeZone = input.clock?.timeZone ?? DEFAULT_TIME_ZONE;
+    lines.push("", "## Cron fires that did not finish", "", failed.length === 1 ? "The turn of this cron's latest fire here failed, so what its note asks may not be done:" : "The turns of these crons' latest fires here failed, so what their notes ask may not be done:", "", ...failed.flatMap((cron) => cronLines(cron, timeZone)));
+  }
+  if (last?.trigger.kind === "reflection" && last.exitReason === "completed" && last.sessionDropped === true) {
+    lines.push("", "## Your session started afresh", "", "Your last turn here was a reflection, and this conversation's session ended with it, so this turn starts a new one: what you kept is in memory/core.md and the archive it points to, and what your earlier turns did is on the board, in your posts and the threads and tasks you worked in, which search and the board's files reach.");
+  }
   const society = input.societyView;
   if (society !== void 0 && society !== null) {
     lines.push("", "## The society", "", `Each ask is a conversation of its own, and others may be in a turn at the same time. Before proposing a citizen, a role, or a project, look at the proposals still waiting under ${PATH_TOKENS.board}/society/proposals/: another ask may have proposed it already.`, "", "### Projects", "");
@@ -10684,7 +11400,7 @@ function buildTurnPrompt(input) {
   }
   const machines = input.runners;
   if (machines !== void 0 && machines !== null) {
-    lines.push("", "## Runners", "", "The machines turns run on. A project lives on the runner that takes its first turn, one that offers every capability the project and that turn's task require, and never moves. A task's required_capabilities must name capabilities exactly as a runner below offers them; a task needing one its project's runner lacks waits. A runner's quota is what each CLI's login there last reported of its plan, in percent of each window; a CLI limited until a time fails its turns there until then.", "");
+    lines.push("", "## Runners", "", "The machines turns run on. A project lives on the runner that takes its first turn, one that offers every capability the project and that turn's task require, and moves only when the user moves it. A task's required_capabilities must name capabilities exactly as a runner below offers them; a task needing one its project's runner lacks waits. A runner's quota is what each CLI's login there last reported of its plan, in percent of each window; a CLI limited until a time fails its turns there until then. A runner, or a CLI on it, paused by the user starts none of the turns it would run until the user resumes it: they wait, and the stages their citizens hold keep their leases.", "");
     if (machines.runners.length === 0) {
       lines.push("None registered yet.");
     }
@@ -10907,7 +11623,10 @@ var TurnHost = class {
     const newSession = recorded === void 0;
     const lastTurn = await this.board.readLastTurn(agent.name, dispatch.project, part);
     const costSoFarUsd = !newSession && lastTurn?.session === recorded ? lastTurn.sessionCostUsd ?? lastTurn.costUsd : 0;
+    const usageSoFar = !newSession && lastTurn?.session === recorded ? lastTurn.sessionUsage : void 0;
     const resumeRetries = !newSession && lastTurn?.session === recorded && lastTurn.resumeFailed === "retry" ? lastTurn.resumeRetries ?? 1 : 0;
+    const afreshAfterReflection = charter.societyScope && agent.role !== USER_ROLE && societyScope && part === void 0;
+    const afterReflection = lastTurn?.trigger.kind === "reflection" && lastTurn.sessionDropped === true;
     const digest = await this.board.readDigest({
       ...actor,
       scope: dispatch.project,
@@ -10919,14 +11638,14 @@ var TurnHost = class {
     const messages = threadSoFar ?? digest.messages;
     const cursorAfter = threadSoFar?.at(-1)?.id ?? digest.cursor;
     const held = task === null ? [] : (await this.board.heldClaims(agent.name)).filter((each) => each.id === task.id);
-    const onboarding = dispatch.onboarding || newSession && part === void 0 ? {
+    const onboarding = dispatch.onboarding || newSession && part === void 0 && !afterReflection ? {
       agentName: agent.name,
       roleSummary: charter.purpose,
       project: dispatch.project,
       worktree: PATH_TOKENS.worktree,
       otherChannels: (project?.channels ?? []).map((name) => channelRef(dispatch.project, name)).filter((ref) => !agent.subscriptions.includes(ref))
     } : null;
-    const instructions = renderInstructions({
+    const rendered = {
       agentName: agent.name,
       roleCharter: await this.board.readAgentRoleBody(agent.name),
       memoryCore: await this.board.readMemoryCore(agent.name),
@@ -10944,7 +11663,11 @@ var TurnHost = class {
         }))
       ],
       ...onboarding === null ? {} : { onboarding }
-    });
+    };
+    const instructions = renderInstructions(rendered);
+    const instructionsNow = instructionsHash(rendered);
+    const instructionsHeld = !newSession && lastTurn?.session === recorded ? lastTurn.sessionInstructionsHash : void 0;
+    const changedInstructions = !newSession && instructionsHeld !== instructionsNow;
     const societyView = charter.wakeTriggers.includes(USER_POST_TRIGGER2) ? {
       projects: (await this.board.listProjects()).filter((each) => each.archived === void 0),
       members: await this.board.listMembers()
@@ -10985,6 +11708,11 @@ var TurnHost = class {
         crons.push(cron);
       }
     }
+    const failedCrons = (await this.board.listCrons()).filter((cron) => cron.agent === agent.name && cron.scope === dispatch.project && conversationPart(cron) === part && cronFailure(cron) !== null && !(dispatch.crons ?? []).includes(cron.id));
+    const cronFailures = failedCrons.flatMap((cron) => {
+      const failure = cronFailure(cron);
+      return failure === null ? [] : [{ cron: cron.id, turnId: failure.turnId }];
+    });
     const prompt = buildTurnPrompt({
       dispatch,
       clock: { now: this.now(), timeZone: society.timezone },
@@ -10997,7 +11725,10 @@ var TurnHost = class {
       waitingStages: waiting,
       project,
       lastTurn,
+      failedCrons,
+      ...changedInstructions ? { changedInstructions: instructions } : {},
       onboarding,
+      afreshAfterReflection,
       societyView,
       runners: runners2,
       knowledge,
@@ -11010,7 +11741,10 @@ var TurnHost = class {
     const record = await this.board.beginTurn({
       ...base,
       session: recorded ?? null,
-      sessionCostUsd: costSoFarUsd
+      sessionCostUsd: costSoFarUsd,
+      ...usageSoFar === void 0 ? {} : { sessionUsage: usageSoFar },
+      ...instructionsHeld === void 0 ? {} : { sessionInstructionsHash: instructionsHeld },
+      ...cronFailures.length === 0 ? {} : { cronFailures }
     });
     if (record.id === void 0) {
       throw new Error("the board gave the turn no id");
@@ -11028,7 +11762,9 @@ var TurnHost = class {
       ...place === void 0 ? {} : { place },
       session: recorded ?? null,
       costSoFarUsd,
+      ...usageSoFar === void 0 ? {} : { usageSoFar },
       instructions,
+      instructionsHash: instructionsNow,
       prompt,
       mcp: { url: this.mcpUrl, token },
       limits: { timeoutMs: this.turnTimeoutMs, maxTurns: this.maxTurns },
@@ -11052,11 +11788,13 @@ var TurnHost = class {
       stopRequestedBy: null,
       held: held.map((each) => each.id),
       costSoFarUsd,
+      instructionsNow,
       resumeRetries,
       configuredModel: agent.model ?? null,
       transcript: [],
       coldToken: residentKey === null ? token : null,
       residentKey: residentKey === null ? null : `${runner.name}|${residentKey}`,
+      afreshAfterReflection,
       keepLeases,
       done,
       fail
@@ -11220,8 +11958,13 @@ var TurnHost = class {
     const part = conversationPart(job);
     const resumeRetries = outcome.resumeFailed === "retry" ? turn.resumeRetries + 1 : void 0;
     const dropSession = job.session !== null && (outcome.resumeFailed === "lost" || (resumeRetries ?? 0) >= RESUME_RETRIES);
+    const reflected = turn.afreshAfterReflection && turn.record.trigger.kind === "reflection" && outcome.exitReason === "completed";
+    const { sessionUsage: _started, sessionInstructionsHash: heldBefore, ...begun } = turn.record;
+    const promptDelivered = outcome.exitReason === "completed" || outcome.exitReason === "blocked" || outcome.exitReason === "stopped";
+    const instructionsTaken = outcome.exitReason === "stopped" ? outcome.contextTokens !== void 0 : promptDelivered;
+    const instructionsHeld = job.session === null ? outcome.session === null ? void 0 : turn.instructionsNow : instructionsTaken ? turn.instructionsNow : heldBefore;
     const finished = {
-      ...turn.record,
+      ...begun,
       session: outcome.session,
       endedAt: this.now().toISOString(),
       exitReason: outcome.exitReason,
@@ -11230,6 +11973,9 @@ var TurnHost = class {
       usage: outcome.usage,
       costUsd: outcome.costUsd,
       sessionCostUsd: outcome.sessionCostUsd ?? turn.costSoFarUsd,
+      ...outcome.sessionUsage === void 0 ? {} : { sessionUsage: outcome.sessionUsage },
+      ...instructionsHeld === void 0 ? {} : { sessionInstructionsHash: instructionsHeld },
+      ...outcome.contextTokens === void 0 ? {} : { contextTokens: outcome.contextTokens },
       toolCalls: turn.transcript.filter((entry) => entry.event.type === "tool_call").length,
       model: outcome.model ?? turn.configuredModel,
       ...outcome.work === null ? {} : { work: outcome.work },
@@ -11237,7 +11983,7 @@ var TurnHost = class {
       ...outcome.resumeFailed === void 0 ? {} : { resumeFailed: outcome.resumeFailed },
       ...outcome.transient === true ? { transient: true } : {},
       ...resumeRetries === void 0 ? {} : { resumeRetries },
-      ...dropSession ? { sessionDropped: true } : {}
+      ...dropSession || reflected ? { sessionDropped: true } : {}
     };
     const ended = await this.conversationEnded(job);
     const closing = turn.record.trigger.kind === "closing";
@@ -11255,10 +12001,15 @@ var TurnHost = class {
           resumeFailed: outcome.resumeFailed,
           resumeRetries
         }, "dropped a session its CLI could not resume");
+      } else if (reflected) {
+        if (job.session !== null) {
+          await this.board.dropSession(job.agent, job.scope, job.cli, job.session, part);
+        }
+        this.log.info({ agent: job.agent, project: job.scope, session: outcome.session }, "dropped a home session after its reflection");
       } else if (outcome.session !== null && outcome.session !== job.session) {
         await this.board.writeSession(job.agent, job.scope, job.cli, outcome.session, turn.runner, part);
       }
-      if (outcome.exitReason === "completed" || outcome.exitReason === "blocked" || outcome.exitReason === "stopped") {
+      if (promptDelivered) {
         await this.board.setDigestCursor(job.agent, job.scope, turn.delivered, part);
         await this.renewLeases(turn.actor, turn.held);
         if (outcome.status?.needsUserDecision === true) {
@@ -11550,6 +12301,8 @@ var RunnerProtocolError = class extends Error {
 };
 var RunnerAwayError = class extends Error {
 };
+var MoveSourceAwayError = class extends Error {
+};
 var SILENT2 = { info() {
 }, warn() {
 }, error() {
@@ -11582,6 +12335,12 @@ var RunnerHub = class {
   /** Disconnects being recorded, which `close` waits for. */
   detaching = /* @__PURE__ */ new Set();
   runnerListeners = /* @__PURE__ */ new Set();
+  /** The project being moved, by slug: none of its turns is placed and nothing lands there until it ends. */
+  moving = /* @__PURE__ */ new Map();
+  /** Turns of each project placed on a runner and not yet opened, which the board cannot see yet. */
+  starting = /* @__PURE__ */ new Map();
+  /** Moves started since the hub did, so a placement that a move overtook gives its turn back. */
+  moveStarts = 0;
   constructor(options) {
     this.board = options.board;
     this.host = options.host;
@@ -11853,6 +12612,7 @@ var RunnerHub = class {
     return accepted ? "sent" : "refused";
   }
   async assign(dispatch) {
+    const starts = this.moveStarts;
     const agent = await this.board.readAgent(dispatch.agent).catch(() => null);
     if (agent === null) {
       return { refused: `no agent ${dispatch.agent}` };
@@ -11864,11 +12624,15 @@ var RunnerHub = class {
       return { refused: `${agent.name} has no CLI binding` };
     }
     const cli = agent.cli;
-    const free = (seat) => seat.send !== null && !seat.unconfirmed && seat.hello.clis.includes(cli) && (seat.hello.slots === null || seat.inUse < seat.hello.slots);
+    const runners2 = await this.board.listRunners();
+    const free = (seat) => seat.send !== null && !seat.unconfirmed && seat.hello.clis.includes(cli) && (seat.hello.slots === null || seat.inUse < seat.hello.slots) && !heldOn(runners2, seat.name, cli);
     let chosen;
     if (dispatch.project === SOCIETY_SCOPE) {
       chosen = await this.pinnedSeat(agent.name, agent.homeRunner, cli, free);
     } else {
+      if (this.moving.has(dispatch.project)) {
+        return null;
+      }
       const project = await this.board.readProject(dispatch.project);
       let home = project.runner;
       if (home === void 0) {
@@ -11895,7 +12659,13 @@ var RunnerHub = class {
     if (chosen === void 0) {
       return null;
     }
+    if (dispatch.project !== SOCIETY_SCOPE && (this.moving.has(dispatch.project) || this.moveStarts !== starts)) {
+      return null;
+    }
     chosen.inUse += 1;
+    if (dispatch.project !== SOCIETY_SCOPE) {
+      this.starting.set(dispatch.project, (this.starting.get(dispatch.project) ?? 0) + 1);
+    }
     return { runner: chosen.name };
   }
   async runTurn(dispatch, assignment) {
@@ -11904,11 +12674,23 @@ var RunnerHub = class {
     }
     const seat = this.seats.get(assignment.runner);
     let turnId = null;
+    let placed = dispatch.project !== SOCIETY_SCOPE;
+    const opening = () => {
+      if (placed) {
+        placed = false;
+        const left = (this.starting.get(dispatch.project) ?? 1) - 1;
+        if (left > 0) {
+          this.starting.set(dispatch.project, left);
+        } else {
+          this.starting.delete(dispatch.project);
+        }
+      }
+    };
     try {
       if (seat === void 0) {
         return await this.host.refuseTurn(dispatch, assignment.runner, "the runner is gone");
       }
-      const opened = await this.host.openTurn(dispatch, this.seatView(seat));
+      const opened = await this.host.openTurn(dispatch, this.seatView(seat)).finally(opening);
       if ("failed" in opened) {
         return opened.failed;
       }
@@ -11920,6 +12702,7 @@ var RunnerHub = class {
       turnId = opened.job.turnId;
       return await opened.ended;
     } finally {
+      opening();
       if (seat !== void 0) {
         seat.inUse = Math.max(0, seat.inUse - 1);
         if (turnId !== null) {
@@ -11952,6 +12735,9 @@ var RunnerHub = class {
       });
       return "done";
     }
+    if (this.moving.has(project)) {
+      return "deferred";
+    }
     let outcome = { ok: true, detail: "nothing to land, since the task left no branch" };
     if (record.runner !== void 0) {
       const seat = this.seats.get(record.runner);
@@ -12004,6 +12790,9 @@ var RunnerHub = class {
     if (task.status !== "abandoned" || task.onDone !== "ghpr" || pull === void 0 || pull.closed !== void 0) {
       return "done";
     }
+    if (this.moving.has(project)) {
+      return "deferred";
+    }
     const record = await this.board.readProject(project);
     let outcome = {
       ok: false,
@@ -12036,16 +12825,172 @@ var RunnerHub = class {
     });
     return "done";
   }
+  /**
+   * Moves a project to another runner, which only the user does, carrying every branch and tag of
+   * its repository: the project's turns, landings, and pull-request closes wait while it runs.
+   * The old runner pushes to a repository on the server once no worktree of the project holds work
+   * no branch does, the new runner clones it, and the board records the new runner only once that
+   * runner holds every branch and tag at the commit the old one had; until then the project works
+   * where it was. The server's repository goes as the move ends, and the old runner then removes
+   * its copy. With the old runner away nothing can travel, so the move goes ahead only when the
+   * user says `withoutBranches`, and the branches stay there.
+   */
+  async moveProject(actor, slug, to, options = {}) {
+    const under = [...this.moving.keys()];
+    if (under.length > 0) {
+      throw new BoardError("INVALID_STATE", `a move of ${under.join(", ")} is under way; try again once it ends`);
+    }
+    const move = { id: null, from: null, to, phase: "checking" };
+    this.moving.set(slug, move);
+    this.moveStarts += 1;
+    let source;
+    let moved;
+    try {
+      if ((this.starting.get(slug) ?? 0) > 0) {
+        throw new BoardError("INVALID_STATE", `a turn of ${slug} is starting; try again once it has started and ended`);
+      }
+      const { project, inPlay: inPlay2 } = await this.board.prepareProjectMove(actor, slug, to);
+      const from = project.runner;
+      move.from = from;
+      const target = this.seats.get(to);
+      if (target === void 0 || target.send === null) {
+        throw new BoardError("INVALID_STATE", `runner ${to} is not connected`);
+      }
+      await this.assertCanHost(target, project, inPlay2);
+      source = this.seats.get(from);
+      if (source === void 0 || source.send === null) {
+        if (options.withoutBranches !== true) {
+          throw new MoveSourceAwayError(sourceAwayMessage(project, from, to, inPlay2));
+        }
+        move.phase = "recording";
+        const recorded2 = await this.board.recordProjectMove(actor, {
+          slug,
+          from,
+          to,
+          carried: null
+        });
+        this.log.info({ project: slug, from, to }, "project moved without its branches");
+        return { project: recorded2, carried: null, released: null };
+      }
+      if (options.withoutBranches === true) {
+        throw new BoardError("INVALID_STATE", `runner ${from}, where ${slug} lives, is connected, so the move carries its branches`);
+      }
+      if (!source.hello.projectMoves) {
+        throw new BoardError("INVALID_STATE", `runner ${from}, where ${slug} lives, cannot carry a project yet; upgrade it`);
+      }
+      const repo = projectRepo(project);
+      move.id = await this.board.openMoveRepo();
+      const id = move.id;
+      move.phase = "export";
+      const exported = ProjectExportedSchema.parse(await this.request(source, (request) => ({ type: "export", request, export: { move: id, repo } }), moveTransferMs(MOVE_PACK_LIMIT_BYTES) + this.requestTimeoutMs).catch((error) => {
+        throw new BoardError("INVALID_STATE", `${from} could not send ${slug}: ${describe(error)}`);
+      }));
+      if (!exported.ok) {
+        throw new BoardError("INVALID_STATE", exported.held.length === 0 ? `${slug}'s repository on ${from} is ${mebibytes(exported.bytes)}, more than a move carries (${mebibytes(MOVE_PACK_LIMIT_BYTES)})` : `${slug} cannot be moved while work no branch holds sits in its worktrees on ${from}: ${exported.held.map(heldLine).join("; ")}. Have each citizen commit it or clear it, then move again`);
+      }
+      move.phase = "import";
+      const imported = ProjectImportedSchema.parse(await this.request(target, (request) => ({
+        type: "import",
+        request,
+        import: {
+          move: id,
+          repo,
+          pullRequests: project.onDone === "ghpr",
+          bytes: exported.bytes
+        }
+      }), moveTransferMs(exported.bytes) + this.requestTimeoutMs).catch((error) => {
+        throw new BoardError("INVALID_STATE", `${to} could not take ${slug}: ${describe(error)}`);
+      }));
+      move.phase = "recording";
+      const differ = differentRefs(exported.refs, imported.refs);
+      if (differ.length > 0) {
+        await this.releaseOn(target, slug);
+        throw new BoardError("INVALID_STATE", `${slug} arrived on ${to} unlike it left ${from} (${differ.slice(0, 5).join(", ")}${differ.length > 5 ? ", \u2026" : ""}); it stays on ${from}`);
+      }
+      const carried = Object.keys(exported.refs).length;
+      const recorded = await this.board.recordProjectMove(actor, { slug, from, to, carried }).catch(async (error) => {
+        await this.releaseOn(target, slug);
+        throw error;
+      });
+      this.log.info({ project: slug, from, to, carried }, "project moved");
+      moved = { project: recorded, carried };
+    } finally {
+      this.moving.delete(slug);
+      if (move.id !== null) {
+        const id = move.id;
+        await this.board.dropMoveRepo(id).catch((error) => {
+          this.log.warn({ move: id, error: String(error) }, "could not remove a move's repository");
+        });
+      }
+    }
+    return { ...moved, released: await this.releaseOn(source, slug) };
+  }
+  /**
+   * Whether a runner may reach a move's repository on the server: the old runner to push while it
+   * exports, the new one to fetch while it imports. `unknown` for a move that is not under way.
+   */
+  moveAccess(runner, id, push) {
+    const move = [...this.moving.values()].find((each) => each.id !== null && each.id === id);
+    if (move === void 0) {
+      return "unknown";
+    }
+    const allowed = push ? move.phase === "export" && runner === move.from : move.phase === "import" && runner === move.to;
+    return allowed ? "allowed" : "refused";
+  }
+  /** Refuses a runner that cannot take a project's turns: its members' CLIs, the capabilities, a git identity. */
+  async assertCanHost(seat, project, inPlay2) {
+    if (!seat.hello.projectMoves) {
+      throw new BoardError("INVALID_STATE", `runner ${seat.name} cannot take a project yet; upgrade it`);
+    }
+    const lacking = [];
+    for (const name of project.members) {
+      const agent = await this.board.readAgent(name).catch(() => null);
+      if (agent !== null && agent.status === "active" && agent.cli !== null && !seat.hello.clis.includes(agent.cli)) {
+        lacking.push(`${agent.cli} for ${agent.name}`);
+      }
+    }
+    const needs = /* @__PURE__ */ new Set([
+      ...project.requiredCapabilities,
+      ...inPlay2.flatMap((task) => task.requiredCapabilities)
+    ]);
+    const missing = [...needs].filter((each) => !seat.hello.capabilities.includes(each));
+    if (missing.length > 0) {
+      lacking.push(`the ${missing.length === 1 ? "capability" : "capabilities"} ${missing.join(", ")}`);
+    }
+    const identity = seat.hello.gitIdentityMissing ?? [];
+    if (identity.length > 0) {
+      lacking.push(`a git ${identity.join(" and ")} for citizens' commits`);
+    }
+    if (lacking.length > 0) {
+      throw new BoardError("INVALID_STATE", `runner ${seat.name} cannot take ${project.slug}: it lacks ${lacking.join("; ")}`);
+    }
+  }
+  /** Asks a runner to remove its copy of a project that lives elsewhere now; how that went, never a throw. */
+  async releaseOn(seat, slug) {
+    if (seat === void 0) {
+      return null;
+    }
+    try {
+      const released = ProjectReleasedSchema.parse(await this.request(seat, (request) => ({ type: "release", request, release: { slug } }), SWEEP_TIMEOUT_MS));
+      return {
+        ok: true,
+        detail: `${seat.name} removed ${released.worktrees} worktree(s)${released.clone ? " and its clone" : ""}`
+      };
+    } catch (error) {
+      this.log.warn({ runner: seat.name, project: slug, error: String(error) }, "could not release a project");
+      return { ok: false, detail: `${seat.name} kept its copy of ${slug}: ${describe(error)}` };
+    }
+  }
   /**
    * One path on a branch of a project's repository, read on the runner the project lives on.
    * NOT_FOUND when the project has no runner yet or the branch or the path does not exist, and
    * `RunnerAwayError` while its runner is away.
    */
-  async readBranch(project, branch, path11) {
+  async readBranch(project, branch, path12) {
     const { seat, repo } = await this.projectSeat(project, "branchReads", "read files");
-    const file = BranchFileSchema.nullable().parse(await this.request(seat, (request) => ({ type: "file", request, read: { repo, branch, path: path11 } }), FILE_TIMEOUT_MS));
+    const file = BranchFileSchema.nullable().parse(await this.request(seat, (request) => ({ type: "file", request, read: { repo, branch, path: path12 } }), FILE_TIMEOUT_MS));
     if (file === null) {
-      throw new BoardError("NOT_FOUND", `${branch} has no ${path11 === "" ? "commit" : path11}`);
+      throw new BoardError("NOT_FOUND", `${branch} has no ${path12 === "" ? "commit" : path12}`);
     }
     return file;
   }
@@ -12065,11 +13010,11 @@ var RunnerHub = class {
    * What a branch of a project's repository did to one file since it left the default branch, read
    * on the runner the project lives on, with the same refusals as `branchChanges`.
    */
-  async branchDiff(project, branch, path11) {
+  async branchDiff(project, branch, path12) {
     const { seat, repo } = await this.projectSeat(project, "branchChanges", "list changes");
-    const diff = BranchFileDiffSchema.nullable().parse(await this.request(seat, (request) => ({ type: "diff", request, read: { repo, branch, path: path11 } }), FILE_TIMEOUT_MS));
+    const diff = BranchFileDiffSchema.nullable().parse(await this.request(seat, (request) => ({ type: "diff", request, read: { repo, branch, path: path12 } }), FILE_TIMEOUT_MS));
     if (diff === null) {
-      throw new BoardError("NOT_FOUND", `${branch} did not change ${path11}`);
+      throw new BoardError("NOT_FOUND", `${branch} did not change ${path12}`);
     }
     return diff;
   }
@@ -12080,18 +13025,8 @@ var RunnerHub = class {
    * back as a `BoardError` in the runner's words.
    */
   async readTurnImage(actor, file) {
-    const turn = this.host.runningTurns().find((each) => each.agent === actor.name && each.scope === actor.scope && each.thread === actor.thread && each.channel === actor.channel && each.place === actor.place);
-    if (turn === void 0) {
-      throw new BoardError("INVALID_STATE", `${actor.name} has no turn running in this conversation to read ${file} from`);
-    }
-    const seat = this.seats.get(turn.runner);
-    if (seat === void 0 || seat.send === null) {
-      throw new RunnerAwayError(`runner ${turn.runner}, where the turn runs, is not connected`);
-    }
-    if (!seat.hello.imageReads) {
-      throw new BoardError("INVALID_STATE", `runner ${seat.name}, where the turn runs, cannot read images yet; upgrade it`);
-    }
-    const image = TurnImageSchema.nullable().parse(await this.request(seat, (request) => ({ type: "image", request, read: { turnId: turn.turnId, path: file } }), FILE_TIMEOUT_MS));
+    const { turnId, seat } = this.turnSeat(actor, "imageReads", `read ${file} from`, "read images");
+    const image = TurnImageSchema.nullable().parse(await this.request(seat, (request) => ({ type: "image", request, read: { turnId, path: file } }), FILE_TIMEOUT_MS));
     if (image === null) {
       throw new BoardError("INVALID_STATE", `the turn is no longer running on runner ${seat.name}`);
     }
@@ -12100,6 +13035,28 @@ var RunnerHub = class {
     }
     return Buffer.from(image.content, "base64");
   }
+  /**
+   * Hands an image the board keeps to the runner a citizen's turn runs on, for `read_image`, which
+   * writes it to a folder of that turn's own in the system temp folder, removed when the turn
+   * ends, and answers the file's path there, with the same refusals as `readTurnImage`.
+   */
+  async writeTurnImage(actor, image) {
+    const { turnId, seat } = this.turnSeat(actor, "imageWrites", "open an image in", "open images");
+    const file = TurnImageFileSchema.nullable().parse(await this.request(seat, (request) => ({
+      type: "image_write",
+      request,
+      write: {
+        turnId,
+        id: image.id,
+        type: image.type,
+        content: Buffer.from(image.bytes).toString("base64")
+      }
+    }), FILE_TIMEOUT_MS));
+    if (file === null) {
+      throw new BoardError("INVALID_STATE", `the turn is no longer running on runner ${seat.name}`);
+    }
+    return file.path;
+  }
   /** The models a CLI offers, asked of a connected runner that has it; none when no runner has it. */
   /**
    * The connected runner a model list for `cli` comes from: the first of `prefer` that has the CLI,
@@ -12277,6 +13234,25 @@ var RunnerHub = class {
       repo: projectRepo(record)
     };
   }
+  /**
+   * The caller's turn in flight, found by its conversation, and the connected runner it runs on,
+   * which must say `able` in its hello: an image's way to and from the machine a turn runs on.
+   * `where` and `what` say what the caller asked for in a refusal.
+   */
+  turnSeat(actor, able, where, what) {
+    const turn = this.host.runningTurns().find((each) => each.agent === actor.name && each.scope === actor.scope && each.thread === actor.thread && each.channel === actor.channel && each.place === actor.place);
+    if (turn === void 0) {
+      throw new BoardError("INVALID_STATE", `${actor.name} has no turn running in this conversation to ${where}`);
+    }
+    const seat = this.seats.get(turn.runner);
+    if (seat === void 0 || seat.send === null) {
+      throw new RunnerAwayError(`runner ${turn.runner}, where the turn runs, is not connected`);
+    }
+    if (!seat.hello[able]) {
+      throw new BoardError("INVALID_STATE", `runner ${seat.name}, where the turn runs, cannot ${what} yet; upgrade it`);
+    }
+    return { turnId: turn.turnId, seat };
+  }
   assertOwns(runner, turnId) {
     const owner = this.host.runnerOf(turnId);
     if (owner !== void 0 && owner !== runner) {
@@ -12306,6 +13282,32 @@ var RunnerHub = class {
     });
   }
 };
+function describe(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function mebibytes(bytes) {
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MiB`;
+}
+function heldLine(held) {
+  const where = held.conversation === null ? "its own worktree" : held.conversation.kind === "thread" ? `thread ${held.conversation.id}` : held.conversation.kind === "channel" ? `channel ${held.conversation.name}` : `the channels of ${held.conversation.project}`;
+  const parts = [
+    held.uncommitted > 0 ? `${held.uncommitted} uncommitted file(s)` : "",
+    held.onNoBranch > 0 ? `${held.onNoBranch} commit(s) on no branch` : ""
+  ].filter((part) => part !== "");
+  return `${held.agent}, ${where}: ${parts.join(" and ")}`;
+}
+function differentRefs(left, right) {
+  const names = /* @__PURE__ */ new Set([...Object.keys(left), ...Object.keys(right)]);
+  return [...names].filter((name) => left[name] !== right[name]).toSorted();
+}
+function sourceAwayMessage(project, from, to, inPlay2) {
+  const stays = [
+    "its local branches and worktrees",
+    project.repo === null ? `its whole history, since ${project.slug} has no remote (${to} would start an empty repository)` : "",
+    inPlay2.length === 0 ? "" : `the work of ${inPlay2.length} task(s) in play (${inPlay2.map((task) => task.id).join(", ")})`
+  ].filter((part) => part !== "");
+  return `runner ${from}, where ${project.slug} lives, is not connected, so nothing can travel. Staying on ${from}: ${stays.join("; ")}. Move it without them to go ahead`;
+}
 
 // apps/server/dist/index.js
 import pino from "pino";
@@ -12381,7 +13383,9 @@ import { z as z19, ZodError } from "zod";
 // apps/server/dist/body-limit.js
 import { bodyLimit } from "hono/body-limit";
 var ENROLL_BODY_LIMIT_BYTES = 16 * 1024;
+var APP_TOKEN_BODY_LIMIT_BYTES = 16 * 1024;
 var API_BODY_LIMIT_BYTES = 1024 * 1024;
+var IMAGE_BODY_LIMIT_BYTES = IMAGE_LIMIT_BYTES;
 var RUNNER_BODY_LIMIT_BYTES = 8 * 1024 * 1024;
 var RUNNER_ANSWER_LIMIT_BYTES = 16 * 1024 * 1024;
 function limitBody(maxSize) {
@@ -12398,13 +13402,19 @@ function limitBody(maxSize) {
 }
 
 // apps/server/dist/github-auth.js
-import { randomBytes as randomBytes2 } from "node:crypto";
+import { createHash as createHash4, randomBytes as randomBytes2, timingSafeEqual } from "node:crypto";
 import { Hono } from "hono";
 import { z as z18 } from "zod";
 var SIGN_IN_TTL_MS = 30 * 24 * 36e5;
 var STATE_TTL_MS = 10 * 6e4;
 var MAX_STATES = 1e3;
+var CODE_TTL_MS = 2 * 6e4;
 var TokenAnswerSchema = z18.object({ access_token: z18.string().min(1) });
+var CodeChallengeSchema = z18.string().regex(/^[A-Za-z0-9_-]{43}$/);
+var CodeExchangeSchema = z18.object({
+  code: z18.string().min(1).max(64),
+  code_verifier: z18.string().regex(/^[A-Za-z0-9._~-]{43,128}$/)
+});
 var GithubUserSchema = z18.object({
   login: z18.string().min(1),
   id: z18.number().int(),
@@ -12429,32 +13439,56 @@ function safeNext(next) {
   } catch {
     return "/";
   }
-  const path11 = `${url.pathname}${url.search}`;
-  return url.origin === BOARD_ORIGIN && /^\/(?![/\\])/.test(path11) ? path11 : "/";
+  const path12 = `${url.pathname}${url.search}`;
+  return url.origin === BOARD_ORIGIN && /^\/(?![/\\])/.test(path12) ? path12 : "/";
 }
-var APP_LANDING = "stellaris://signin";
+var APP_LANDING = "/auth/app/signin";
 function land(c, next, fragment) {
+  c.header("cache-control", "no-store");
   return c.redirect(`${next}#${fragment}`, 302);
 }
+function prune(map, now) {
+  for (const [key, entry] of map) {
+    if (entry.expiresAt <= now || map.size >= MAX_STATES) {
+      map.delete(key);
+    }
+  }
+}
+function provesChallenge(verifier, challenge) {
+  const answer = Buffer.from(createHash4("sha256").update(verifier).digest("base64url"));
+  const expected = Buffer.from(challenge);
+  return answer.length === expected.length && timingSafeEqual(answer, expected);
+}
 function githubAuthRoutes(options) {
   const { board: board2, github } = options;
   const fetchImpl = options.fetch ?? fetch;
   const now = options.now ?? Date.now;
   const states = /* @__PURE__ */ new Map();
+  const codes = /* @__PURE__ */ new Map();
   const routes = new Hono();
-  routes.get("/config", (c) => c.json({ github: github !== null }));
+  routes.get("/config", (c) => c.json({ github: github !== null, appLanding: (github?.appleAppId ?? null) !== null }));
+  routes.get("/app/signin", (c) => c.text("not found", 404, { "cache-control": "no-store" }));
   if (github === null) {
     return routes;
   }
-  routes.get("/github", options.limit ?? ((_c, next) => next()), (c) => {
-    for (const [state2, pending] of states) {
-      if (pending.expiresAt <= now() || states.size >= MAX_STATES) {
-        states.delete(state2);
+  const limit2 = options.limit ?? ((_c, next) => next());
+  routes.get("/github", limit2, (c) => {
+    const app2 = c.req.query("landing") === "app";
+    let challenge = null;
+    if (app2) {
+      if (github.appleAppId === null) {
+        return c.text("Signing in to the app is off on this board", 403);
+      }
+      const parsed = CodeChallengeSchema.safeParse(c.req.query("code_challenge"));
+      if (!parsed.success || c.req.query("code_challenge_method") !== "S256") {
+        return c.text("Signing in to the app needs a code_challenge with method S256", 400);
       }
+      challenge = parsed.data;
     }
+    prune(states, now());
     const state = randomBytes2(24).toString("base64url");
-    const next = c.req.query("landing") === "app" ? APP_LANDING : safeNext(c.req.query("next"));
-    states.set(state, { next, expiresAt: now() + STATE_TTL_MS });
+    const next = app2 ? APP_LANDING : safeNext(c.req.query("next"));
+    states.set(state, { next, challenge, expiresAt: now() + STATE_TTL_MS });
     const authorize = new URL("https://github.com/login/oauth/authorize");
     authorize.searchParams.set("client_id", github.clientId);
     authorize.searchParams.set("state", state);
@@ -12507,9 +13541,43 @@ function githubAuthRoutes(options) {
       options.log?.warn({ login }, "GitHub sign-in refused a login that is not on the list");
       return land(c, pending.next, "signin-error=not-allowed");
     }
+    if (pending.challenge !== null) {
+      prune(codes, now());
+      const appCode = randomBytes2(24).toString("base64url");
+      codes.set(appCode, {
+        challenge: pending.challenge,
+        login,
+        avatar,
+        expiresAt: now() + CODE_TTL_MS
+      });
+      return land(c, pending.next, `code=${appCode}`);
+    }
     const token = await board2.signIn(login, SIGN_IN_TTL_MS, avatar);
     return land(c, pending.next, `session=${encodeURIComponent(token)}`);
   });
+  if (github.appleAppId !== null) {
+    routes.post("/app/token", limit2, limitBody(APP_TOKEN_BODY_LIMIT_BYTES), async (c) => {
+      const body = CodeExchangeSchema.safeParse(await c.req.json().catch(() => null));
+      if (!body.success) {
+        return c.json({ error: "invalid_request" }, 400);
+      }
+      const pending = codes.get(body.data.code);
+      codes.delete(body.data.code);
+      if (pending === void 0 || pending.expiresAt <= now() || !provesChallenge(body.data.code_verifier, pending.challenge)) {
+        return c.json({ error: "invalid_grant" }, 400);
+      }
+      const token = await board2.signIn(pending.login, SIGN_IN_TTL_MS, pending.avatar);
+      return c.json({ session: token }, 200, { "cache-control": "no-store" });
+    });
+  }
+  return routes;
+}
+function appleAppSiteAssociation(github) {
+  const routes = new Hono();
+  routes.get("/apple-app-site-association", (c) => {
+    const appId = github?.appleAppId ?? null;
+    return appId === null ? c.text("not found", 404) : c.json({ webcredentials: { apps: [appId] } });
+  });
   return routes;
 }
 
@@ -12617,14 +13685,114 @@ function rateLimit(options) {
 }
 
 // apps/server/dist/runner-routes.js
-import path8 from "node:path";
+import path9 from "node:path";
 import { Hono as Hono2 } from "hono";
 import { streamSSE } from "hono/streaming";
 
 // apps/server/dist/home-git.js
-import { execa as execa2 } from "execa";
+import { once } from "node:events";
+import { execa as execa3 } from "execa";
+
+// apps/server/dist/serve.js
+import { serve } from "@hono/node-server";
+var REQUEST_TIMEOUT_MS = 3e5;
+var HEADERS_TIMEOUT_MS = 6e4;
+var deadlines = /* @__PURE__ */ new WeakMap();
+function serveBoard(options, listening) {
+  const timeoutMs = options.requestTimeoutMs ?? REQUEST_TIMEOUT_MS;
+  return serve({
+    fetch: (request, env) => {
+      const { incoming, outgoing } = env;
+      if (!incoming.complete) {
+        const timer = setTimeout(() => {
+          if (!incoming.complete) {
+            incoming.socket.destroy();
+          }
+        }, timeoutMs);
+        timer.unref();
+        const lift = () => clearTimeout(timer);
+        deadlines.set(request, lift);
+        outgoing.once("close", lift);
+      }
+      return options.fetch(request, env);
+    },
+    port: options.port,
+    hostname: options.hostname,
+    serverOptions: {
+      requestTimeout: 0,
+      headersTimeout: options.headersTimeoutMs ?? HEADERS_TIMEOUT_MS,
+      ...options.connectionsCheckingIntervalMs === void 0 ? {} : { connectionsCheckingInterval: options.connectionsCheckingIntervalMs }
+    }
+  }, listening);
+}
+function liftDeadline(request) {
+  deadlines.get(request)?.();
+  deadlines.delete(request);
+}
+
+// apps/server/dist/home-git.js
 var SMART_PATHS = /* @__PURE__ */ new Set(["/info/refs", "/git-upload-pack", "/git-receive-pack"]);
-var MAX_BYTES = 256 * 1024 * 1024;
+var MAX_BYTES = MOVE_PACK_LIMIT_BYTES;
+var IDLE_MS = 5 * 6e4;
+async function feed(body, stdin, limit2, idleMs) {
+  if (body === null) {
+    stdin.end();
+    return "done";
+  }
+  const reader = body.getReader();
+  const waits = new AbortController();
+  let ended = null;
+  const endedAs = () => ended;
+  const end = (why) => {
+    if (ended === null) {
+      ended = why;
+      waits.abort();
+      if (why === "idle" || why === "cut") {
+        reader.cancel().catch(() => void 0);
+      } else {
+        reader.releaseLock();
+      }
+    }
+    return ended;
+  };
+  const timer = setTimeout(() => end("idle"), idleMs);
+  const stopped = () => {
+    end("stopped");
+  };
+  stdin.on("error", stopped);
+  stdin.once("close", stopped);
+  let total = 0;
+  try {
+    for (; ; ) {
+      const next = await reader.read().catch(() => null);
+      const early = endedAs();
+      if (early !== null) {
+        return early;
+      }
+      if (next === null) {
+        return end("cut");
+      }
+      if (next.done) {
+        stdin.end();
+        return "done";
+      }
+      timer.refresh();
+      total += next.value.byteLength;
+      if (total > limit2) {
+        return end("too large");
+      }
+      if (!stdin.write(next.value)) {
+        const drained = await once(stdin, "drain", { signal: waits.signal }).then(() => true, () => false);
+        if (!drained) {
+          return end("stopped");
+        }
+      }
+    }
+  } finally {
+    clearTimeout(timer);
+    stdin.off("close", stopped);
+  }
+}
 function parseCgi(output) {
   const crlf = output.indexOf("\r\n\r\n");
   const lf = output.indexOf("\n\n");
@@ -12652,12 +13820,13 @@ function parseCgi(output) {
 var HomeGit = class {
   pushes = /* @__PURE__ */ new Map();
   serve(input) {
+    liftDeadline(input.request);
     if (input.rest !== "/git-receive-pack") {
       return serveHomeGit(input);
     }
-    const previous = this.pushes.get(input.agent) ?? Promise.resolve();
+    const previous = this.pushes.get(input.repository) ?? Promise.resolve();
     const run = previous.then(() => serveHomeGit(input), () => serveHomeGit(input));
-    this.pushes.set(input.agent, run.catch(() => void 0));
+    this.pushes.set(input.repository, run.catch(() => void 0));
     return run;
   }
 };
@@ -12666,10 +13835,13 @@ async function serveHomeGit(input) {
     return new Response("not a smart HTTP path", { status: 404 });
   }
   const { request } = input;
-  const body = Buffer.from(await request.arrayBuffer());
-  if (body.length > MAX_BYTES) {
-    return new Response("pack too large for a home", { status: 413 });
+  const limit2 = input.limitBytes ?? MAX_BYTES;
+  const length = request.headers.get("content-length");
+  const declared = length !== null && /^\d+$/.test(length) ? length : null;
+  if (declared !== null && Number(declared) > limit2) {
+    return new Response("pack too large for the board to take", { status: 413 });
   }
+  liftDeadline(request);
   const url = new URL(request.url);
   const env = {
     PATH: process.env["PATH"] ?? "/usr/bin:/bin",
@@ -12677,13 +13849,15 @@ async function serveHomeGit(input) {
     GIT_PROJECT_ROOT: input.root,
     GIT_HTTP_EXPORT_ALL: "1",
     REQUEST_METHOD: request.method,
-    PATH_INFO: `/${input.agent}${input.rest}`,
+    PATH_INFO: `/${input.repository}${input.rest}`,
     QUERY_STRING: url.search.replace(/^\?/, ""),
     CONTENT_TYPE: request.headers.get("content-type") ?? "",
-    CONTENT_LENGTH: String(body.length),
     REMOTE_USER: input.runner,
     REMOTE_ADDR: "127.0.0.1"
   };
+  if (declared !== null) {
+    env["CONTENT_LENGTH"] = declared;
+  }
   const encoding = request.headers.get("content-encoding");
   if (encoding !== null) {
     env["HTTP_CONTENT_ENCODING"] = encoding;
@@ -12692,14 +13866,25 @@ async function serveHomeGit(input) {
   if (protocol !== null) {
     env["HTTP_GIT_PROTOCOL"] = protocol;
   }
-  const result = await execa2("git", ["http-backend"], {
+  const backend = execa3("git", ["http-backend"], {
     env,
     extendEnv: false,
-    input: body,
     encoding: "buffer",
+    // The blank line that ends the headers ends the whole answer when the body is empty, as for
+    // the 4-byte probe git sends before a pack too large for one post; stripped, it reads as none.
+    stripFinalNewline: false,
     reject: false,
     maxBuffer: MAX_BYTES
   });
+  const fed = await feed(request.body, backend.stdin, limit2, input.idleMs ?? IDLE_MS);
+  if (fed !== "done" && fed !== "stopped") {
+    backend.kill();
+    await backend;
+    return fed === "too large" ? new Response("pack too large for the board to take", { status: 413 }) : new Response(fed === "idle" ? "the request stopped arriving" : "the request was cut", {
+      status: fed === "idle" ? 408 : 400
+    });
+  }
+  const result = await backend;
   if (result.exitCode !== 0 && result.stdout.length === 0) {
     return new Response(`git http-backend failed: ${Buffer.from(result.stderr).toString("utf8")}`, {
       status: 500
@@ -12812,20 +13997,47 @@ function runnerRoutes(board2, hub, enrollments, enrollLimit) {
     const marker = `/homes/${agent}/git`;
     const at = c.req.path.indexOf(marker);
     return homeGit.serve({
-      root: path8.dirname(repository),
-      agent,
+      root: path9.dirname(repository),
+      repository: agent,
       rest: at === -1 ? "" : c.req.path.slice(at + marker.length),
       request: c.req.raw,
       runner: c.get("runner")
     });
   });
   routes.route("/homes/:agent", home);
+  routes.all("/moves/:id/git/*", async (c) => {
+    const id = UlidSchema.safeParse(c.req.param("id"));
+    const marker = `/moves/${c.req.param("id")}/git`;
+    const at = c.req.path.indexOf(marker);
+    const rest = at === -1 ? "" : c.req.path.slice(at + marker.length);
+    const service = rest === "/info/refs" ? c.req.query("service") ?? "" : rest.slice(1);
+    if (service !== "git-upload-pack" && service !== "git-receive-pack") {
+      return c.json({ error: "NOT_FOUND", message: "not a smart HTTP request" }, 404);
+    }
+    const access3 = id.success ? hub.moveAccess(c.get("runner"), id.data, service === "git-receive-pack") : "unknown";
+    if (access3 === "unknown") {
+      return c.json({ error: "NOT_FOUND", message: "no such move under way" }, 404);
+    }
+    if (access3 === "refused" || !id.success) {
+      return c.json({
+        error: "FORBIDDEN",
+        message: `this runner may not ${service === "git-receive-pack" ? "push to" : "fetch from"} this move now`
+      }, 403);
+    }
+    return homeGit.serve({
+      root: board2.moveRepos,
+      repository: `${id.data}.git`,
+      rest,
+      request: c.req.raw,
+      runner: c.get("runner")
+    });
+  });
   return routes;
 }
 
 // apps/server/dist/static.js
 import { readFile as readFile5, stat as stat4 } from "node:fs/promises";
-import path9 from "node:path";
+import path10 from "node:path";
 var CONTENT_TYPES = {
   ".html": "text/html; charset=utf-8",
   ".js": "text/javascript; charset=utf-8",
@@ -12853,11 +14065,11 @@ function within2(root, pathname) {
   } catch {
     return null;
   }
-  const candidate = path9.resolve(root, `.${decoded}`);
-  return candidate === root || candidate.startsWith(root + path9.sep) ? candidate : null;
+  const candidate = path10.resolve(root, `.${decoded}`);
+  return candidate === root || candidate.startsWith(root + path10.sep) ? candidate : null;
 }
 function spaHandler(staticDir) {
-  const root = path9.resolve(staticDir);
+  const root = path10.resolve(staticDir);
   return async (c) => {
     const { pathname } = new URL(c.req.url);
     if (pathname.startsWith("/api/")) {
@@ -12868,14 +14080,14 @@ function spaHandler(staticDir) {
     if (file !== null && await isFile(file)) {
       return c.body(await readFile5(file), 200, {
         ...headers,
-        "content-type": CONTENT_TYPES[path9.extname(file)] ?? "application/octet-stream",
+        "content-type": CONTENT_TYPES[path10.extname(file)] ?? "application/octet-stream",
         "cache-control": pathname.startsWith("/assets/") ? "public, max-age=31536000, immutable" : "no-cache"
       });
     }
     if (pathname.startsWith("/assets/")) {
       return c.text("not found", 404, headers);
     }
-    const index = path9.join(root, "index.html");
+    const index = path10.join(root, "index.html");
     if (!await isFile(index)) {
       return c.text("The interface is not built: run pnpm build:web.", 404);
     }
@@ -12902,6 +14114,10 @@ var RetireBodySchema = z19.object({ reason: z19.string().min(1) });
 var RunnerBodySchema = z19.object({ name: NameSchema });
 var EnrollmentApprovalSchema = z19.object({ name: NameSchema });
 var HomeRunnerBodySchema = z19.object({ runner: NameSchema.nullable() });
+var ProjectRunnerBodySchema = z19.object({
+  runner: NameSchema,
+  withoutBranches: z19.boolean().optional()
+});
 var ModelBodySchema = z19.object({ model: ModelNameSchema.nullable() });
 var EffortBodySchema = z19.object({ effort: EffortSchema.nullable() });
 var HistoryLimitSchema = z19.coerce.number().int().min(1).max(500);
@@ -12935,6 +14151,9 @@ function createApp(deps) {
     if (error instanceof RunnerAwayError) {
       return c.json({ error: "RUNNER_AWAY", message: error.message }, 503);
     }
+    if (error instanceof MoveSourceAwayError) {
+      return c.json({ error: "SOURCE_AWAY", message: error.message }, 409);
+    }
     return c.json({ error: "INTERNAL", message: error.message }, 500);
   });
   const authenticate = async (c, next) => {
@@ -12948,6 +14167,14 @@ function createApp(deps) {
   };
   const api = new Hono3();
   api.use("*", authenticate);
+  api.post("/images", limitBody(IMAGE_BODY_LIMIT_BYTES), async (c) => {
+    if (c.get("actor").role !== USER_ROLE) {
+      throw new BoardError("FORBIDDEN", "only the user posts an image's bytes");
+    }
+    const name = ImageNameSchema.optional().parse(c.req.query("name"));
+    const bytes = new Uint8Array(await c.req.arrayBuffer());
+    return c.json(await board2.postImage(c.get("actor"), bytes, name));
+  });
   api.on(["POST", "PUT", "PATCH", "DELETE"], "*", limitBody(API_BODY_LIMIT_BYTES));
   api.get("/me", (c) => {
     const signIn = board2.signInOf(bearer2(c) ?? "");
@@ -13000,6 +14227,21 @@ function createApp(deps) {
     }
     return c.json(await quotas.read(runner, cli));
   });
+  for (const [verb, paused] of [
+    ["pause", true],
+    ["resume", false]
+  ]) {
+    for (const path12 of [`/runners/:name/${verb}`, `/runners/:name/${verb}/:cli`]) {
+      api.post(path12, async (c) => {
+        const name = NameSchema.parse(c.req.param("name"));
+        const cli = c.req.param("cli");
+        return c.json(await board2.setRunnerPaused(c.get("actor"), name, {
+          paused,
+          ...cli === void 0 ? {} : { cli: CliKindSchema.parse(cli) }
+        }));
+      });
+    }
+  }
   api.post("/runners", async (c) => {
     const body = RunnerBodySchema.parse(await c.req.json());
     return c.json(await board2.addRunner(c.get("actor"), body.name));
@@ -13109,6 +14351,13 @@ function createApp(deps) {
     return branchFile(c, project.slug, project.defaultBranch, file);
   };
   api.get("/projects/:slug/files", (c) => projectFile(c, ""));
+  api.put("/projects/:slug/runner", async (c) => {
+    const body = ProjectRunnerBodySchema.parse(await c.req.json());
+    if (deps.runners === void 0) {
+      throw new BoardError("NOT_FOUND", "this board has no runners to move a project between");
+    }
+    return c.json(await deps.runners.moveProject(c.get("actor"), NameSchema.parse(c.req.param("slug")), body.runner, { withoutBranches: body.withoutBranches }));
+  });
   api.get("/projects/:slug/files/:path{.+}", (c) => projectFile(c, c.req.param("path")));
   api.get("/tasks/:id", async (c) => c.json((await board2.findTask(c.req.param("id"))).task));
   api.get("/tasks/:id/thread", async (c) => c.json(await board2.listThread(c.req.param("id"))));
@@ -13286,6 +14535,7 @@ function createApp(deps) {
     ...deps.signIn,
     limit: limited(SIGN_IN_LIMIT, "sign-ins")
   }));
+  app2.route("/.well-known", appleAppSiteAssociation(deps.signIn?.github ?? null));
   if (deps.runners !== void 0) {
     app2.route("/runner", runnerRoutes(board2, deps.runners, deps.enrollments, limited(ENROLL_LIMIT, "enrollment requests")));
   }
@@ -13568,6 +14818,7 @@ var host = new TurnHost({
 var runners = new RunnerHub({ board, host, version: VERSION, log });
 board.watchTurns(() => host.inFlight());
 board.readImagesWith((actor, file) => runners.readTurnImage(actor, file));
+board.openImagesWith((actor, image) => runners.writeTurnImage(actor, image));
 var concurrency = config.concurrency ?? Number.POSITIVE_INFINITY;
 var timings = parseTimings(JSON.parse(process.env["STELLARIS_TIMINGS"] ?? "{}"));
 var scheduler = new Scheduler({ board, runner: runners, log, concurrency, timings });
@@ -13585,8 +14836,8 @@ var view = {
     return scheduler.activeSignals;
   }
 };
-var webDir = process.env["STELLARIS_WEB_DIR"] ?? path10.resolve(import.meta.dirname, "../../web/dist");
-var webBuilt = await access2(path10.join(webDir, "index.html")).then(() => true, () => false);
+var webDir = process.env["STELLARIS_WEB_DIR"] ?? path11.resolve(import.meta.dirname, "../../web/dist");
+var webBuilt = await access2(path11.join(webDir, "index.html")).then(() => true, () => false);
 var app = createApp({
   board,
   version: VERSION,
@@ -13601,7 +14852,7 @@ var app = createApp({
   trustedProxies: config.trustedProxies,
   log
 });
-var server = serve({ fetch: app.fetch, port: config.port, hostname: config.host }, (info) => {
+var server = serveBoard({ fetch: app.fetch, port: config.port, hostname: config.host }, (info) => {
   log.info({
     host: info.address,
     port: info.port,
@@ -13610,6 +14861,7 @@ var server = serve({ fetch: app.fetch, port: config.port, hostname: config.host
     webDir,
     webBuilt,
     signIn: config.github === null ? "token" : `github (${config.github.users.join(", ")})`,
+    appleAppId: config.github?.appleAppId ?? null,
     trustedProxies: config.trustedProxies
   }, "board server listening");
 });