@stringsync/splates 0.0.47 → 0.0.52

package/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env bun
 // @bun
 
-// main.ts
-import { basename as basename2 } from "node:path";
+// index.ts
+import { basename as basename2 } from "path";
 import {
   LEGACY,
   legacyWarnings,
@@ -12,49 +12,49 @@ import { assets } from "@stringsync/splates-server/server";
 import { NodeFs } from "webappwiz/system";
 
 // splates.ts
-import { DEFAULT_PORT as DEFAULT_PORT2 } from "@stringsync/splates-server";
 import { agents } from "@stringsync/splates-server/agents";
 import { attach } from "@stringsync/splates-server/artifacts";
-import { commaList as commaList4 } from "@stringsync/splates-server/comma-list";
-import { exits, fail as fail6 } from "@stringsync/splates-server/exit";
+import { commaList as commaList6 } from "@stringsync/splates-server/comma-list";
+import { refuseGroomer as refuseGroomer4 } from "@stringsync/splates-server/conversations";
+import { exits, fail as fail9 } from "@stringsync/splates-server/exit";
 import { DEFAULT_COUNT, log as showLog } from "@stringsync/splates-server/log";
 import { merge } from "@stringsync/splates-server/merge";
 import { portsLs } from "@stringsync/splates-server/ports";
 import { forget, init } from "@stringsync/splates-server/projects";
-import { repository as repository7 } from "@stringsync/splates-server/records";
+import {
+  MIGRATING,
+  MIGRATION_LIMIT,
+  migrateRecords,
+  repository as repository10
+} from "@stringsync/splates-server/records";
 import {
   newest,
+  recordsFirst,
   rosterOf as rosterOf2,
   runHeavy,
   seeded as seeded2,
-  serveDev,
   update
 } from "@stringsync/splates-server/server";
-import { addFactTodos } from "@stringsync/splates-server/stats";
+import { addFactTasks } from "@stringsync/splates-server/stats";
 import {
   add,
   checkpoint,
   claim,
   DEFAULT_TIMEOUT as DEFAULT_TIMEOUT3,
-  escalate,
   follow,
-  handoff,
   list,
   path,
   REMOVE_REASONS,
   recordRetry,
   remove,
-  reportToCaller,
   serveProject,
   show,
-  tell,
   untilAfter as untilAfter3,
   wait
 } from "@stringsync/splates-server/tasks";
-import { LOCAL_SLOTS } from "@stringsync/splates-server/workers";
-import { cli as cli12 } from "webappwiz/cmd";
+import { cli as cli15 } from "webappwiz/cmd";
 import { Duration as Duration3 } from "webappwiz/time";
-import { z as z13 } from "zod";
+import { z as z16 } from "zod";
 
 // artifact.ts
 import { basename, resolve } from "node:path";
@@ -71,6 +71,7 @@ import { cli } from "webappwiz/cmd";
 import { z as z2 } from "zod";
 
 // flags.ts
+import { BACKLOG_LANE } from "@stringsync/splates-server/board";
 import { commaList } from "@stringsync/splates-server/comma-list";
 import { SYSTEM_STORES } from "@stringsync/splates-server/creds";
 import { fail } from "@stringsync/splates-server/exit";
@@ -82,6 +83,7 @@ import {
 } from "@stringsync/splates-server/models";
 import { SLOT_POOL } from "@stringsync/splates-server/ports";
 import { rosterOf, seeded } from "@stringsync/splates-server/server";
+import { FsStorage } from "@stringsync/splates-server/storage";
 import { SavedTunnel } from "@stringsync/splates-server/tunnel";
 import { z } from "zod";
 var position = z.coerce.number().int().positive().optional();
@@ -112,17 +114,14 @@ async function effortIn(deps, agent, effort, data = {}) {
   return { effort: pickEffort(offered, agent, effort, data) };
 }
 function offeredOf({ ps, fs }) {
-  return new Offered(`${splatesHome(ps)}/offered.json`, { fs });
+  return new Offered(new FsStorage(splatesHome(ps), fs).document("offered.json"));
 }
 function slotTunnelsOf({
   ps,
   fs,
   secrets = SYSTEM_STORES
 }) {
-  return SLOT_POOL.map(({ word }) => new SavedTunnel(`${splatesHome(ps)}/slots/${word}/tunnel.json`, {
-    fs,
-    store: secrets.device
-  }));
+  return SLOT_POOL.map(({ word }) => SavedTunnel.in(new FsStorage(`${splatesHome(ps)}/slots/${word}`, fs), secrets.device));
 }
 function laneIn(raw) {
   const value = raw.trim();
@@ -135,19 +134,22 @@ function laneIn(raw) {
   if (value === "none") {
     return null;
   }
+  if (value === "backlog") {
+    return BACKLOG_LANE;
+  }
   const id = Number(value);
-  if (!Number.isInteger(id) || id <= 0) {
+  if (!Number.isInteger(id) || id < 0) {
     fail("usage", `'${value}' is not a lane: pass its number, new or none`, {
       lane: value
     });
   }
   return id;
 }
-function todoIds(raw) {
+function taskIds(raw) {
   return commaList(raw).map((value) => {
     const id = Number(value);
     if (!Number.isInteger(id) || id <= 0) {
-      fail("usage", `'${value}' is not a todo id`, { todo: value });
+      fail("usage", `'${value}' is not a task number`, { number: value });
     }
     return id;
   });
@@ -162,7 +164,7 @@ async function here({
 }
 
 // artifact.ts
-var splatesArtifact = cli("artifact").description("files your conversation made as its outputs, such as a screenshot, a recording or an HTML page: kept by name for the life of the conversation, whatever task it was made in, and listed on the `splates server` page beside its thread. A file that shows a question, an assumption or a demo step is no artifact: `splates attach` it. The conversation is $SPLATES_CONVERSATION, or --conversation <id> from an agent outside `splates server`");
+var splatesArtifact = cli("artifact").description("files your conversation made as its outputs, such as a screenshot, a recording or an HTML page: kept by name for the life of the conversation, whatever task it was made in, and listed on the `splates server` page beside its thread. A file that shows a question or a demo step is no artifact: `splates attach` it. The conversation is $SPLATES_CONVERSATION, or --conversation <id> from an agent outside `splates server`");
 var conversation = [
   "conversation",
   z2.string(),
@@ -232,6 +234,7 @@ splatesBudget.command("show").description("show each limit: what made workers sp
   dev: opts.dev,
   json: opts.json,
   log: ctx.log,
+  fs: ctx.fs,
   ps: ctx.ps,
   send: ctx.fetch
 }));
@@ -243,6 +246,7 @@ splatesBudget.command("set").description("set a limit, in dollars (dollars an ho
   dev: opts.dev,
   json: opts.json,
   log: ctx.log,
+  fs: ctx.fs,
   ps: ctx.ps,
   send: ctx.fetch
 }));
@@ -256,6 +260,7 @@ splatesBudget.command("raise").description("add dollars to a limit for a while,
   dev: opts.dev,
   json: opts.json,
   log: ctx.log,
+  fs: ctx.fs,
   ps: ctx.ps,
   send: ctx.fetch
 }));
@@ -264,143 +269,56 @@ splatesBudget.command("end").description("end a raise now, by the number `show`
   dev: opts.dev,
   json: opts.json,
   log: ctx.log,
+  fs: ctx.fs,
   ps: ctx.ps,
   send: ctx.fetch
 }));
 
-// coordinator.ts
-import {
-  CoordinatorBox,
-  keepCarriedCreds,
-  machineMove
-} from "@stringsync/splates-server/coordinator";
-import { SYSTEM_STORES as SYSTEM_STORES2 } from "@stringsync/splates-server/creds";
-import { fail as fail3 } from "@stringsync/splates-server/exit";
-import {
-  DEFAULT_PORT,
-  RUNNING
-} from "@stringsync/splates-server/server";
-import { cli as cli3 } from "webappwiz/cmd";
-import { z as z4 } from "zod";
-var splatesCoordinator = cli3("coordinator").description("the always-on box in your own Hetzner Cloud account that `splates server` moves onto, made through Pulumi with the token and state the Cloud workers setup readied: a CPX21 in Ashburn with Hetzner's daily backups, reached by SSH alone");
-splatesCoordinator.command("up").description("make the coordinator's box, or bring it to its program, with splates of this release installed for the user splates and an SSH key splates makes under ~/.splates/coordinator; run again, it changes only what is not so already. The box serves nothing until `splates coordinator move`").option("json", z4.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => {
-  ctx.log.info("making the coordinator's box; its first boot takes minutes");
-  print(ctx, await box(ctx).up(), opts.json);
-});
-splatesCoordinator.command("status").description("print the coordinator's box as its Pulumi stack has it").option("json", z4.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => {
-  const standing = await box(ctx).status();
-  if (standing === null) {
-    ctx.log.info(opts.json ? "null" : "no coordinator's box: `splates coordinator up` makes one");
-    return;
-  }
-  print(ctx, standing, opts.json);
-});
-splatesCoordinator.command("remove").description("destroy the coordinator's box and its backups, lifting the protection that keeps it from deletion first, and forget its stack; its SSH key stays. Anything only on the box is lost").action(async (_opts, ctx) => {
-  await box(ctx).remove();
-  ctx.log.info("removed the coordinator's box");
-});
-splatesCoordinator.command("move").description("move the coordinator onto its box, over SSH. First it checks what the move needs, brings the box's splates to this release, and gives each project a clone there with a deploy key of its own; until GitHub lets each key push trunk, it prints each key with where to add it, with write access, and exits `blocked`: add them and run it again. Then it asks every agent of this machine's `splates server` to checkpoint and stops it, carries the coordinator's records and creds to the box, starts `splates server` there for good under systemd, with the saved tunnel, and joins this machine to it as a worker, kept up by a LaunchAgent, where each task carries on in its worktree here. This machine's records go aside, kept, and its `splates` reaches the box from then on").option("dry-run", z4.boolean(), {
-  default: false,
-  description: "stop once the box is ready, before this machine's server stops or anything here changes"
-}).option("dev", z4.string(), {
-  default: `http://localhost:${DEFAULT_PORT}`,
-  description: "this machine's `splates server`, which the move stops"
-}).action(async (opts, ctx) => {
-  const moved = await machineMove({
-    ps: ctx.ps,
-    fs: ctx.fs,
-    log: ctx.log,
-    version: RUNNING,
-    dev: opts.dev,
-    stores: ctx.secrets ?? SYSTEM_STORES2,
-    ...ctx.fetch === undefined ? {} : { fetch: ctx.fetch }
-  }).run({ dryRun: opts["dry-run"] });
-  if (moved.status === "keys") {
-    fail3("blocked", [
-      'GitHub does not let these deploy keys push yet. Add each to its repository with "Allow write access" ticked, then move again:',
-      ...moved.keys.flatMap(({ slug, key, add }) => [
-        "",
-        `  ${slug}${add === null ? "" : `: ${add}`}`,
-        `  ${key}`
-      ])
-    ].join(`
-`), { keys: moved.keys });
-  }
-  if (moved.status === "ready") {
-    ctx.log.info(`the box is ready to coordinate ${moved.projects.join(", ")} through ${moved.host}: move again without --dry-run`);
-    return;
-  }
-  ctx.log.info([
-    `the coordinator runs on the box: https://${moved.host}`,
-    `this machine is its worker ${ctx.ps.hostname}, kept up by ${moved.worker}`,
-    `its own records are kept aside in ${moved.aside} and each project's .git/splates.moved`
-  ].join(`
-`));
-});
-splatesCoordinator.command("keep-creds").description("keep the creds `splates coordinator move` sends on stdin in this machine's stores, as the box does when the coordinator moves onto it").action(async (_opts, ctx) => {
-  const kept = await keepCarriedCreds({
-    stores: ctx.secrets ?? SYSTEM_STORES2,
-    sent: await Bun.stdin.text()
-  });
-  ctx.log.info(`kept ${kept} creds`);
-});
-function box(ctx) {
-  return new CoordinatorBox({ version: RUNNING, ps: ctx.ps, fs: ctx.fs });
-}
-function print(ctx, standing, json) {
-  if (json) {
-    ctx.log.info(JSON.stringify(standing));
-    return;
-  }
-  ctx.log.info([
-    `address:  ${standing.ipv4}`,
-    `server:   ${standing.serverId} (${standing.serverType} in ${standing.location})`,
-    `ssh:      ssh -i ${standing.key} root@${standing.ipv4}`
-  ].join(`
-`));
-}
-
 // creds.ts
-import { DEFAULT_TIMEOUT } from "@stringsync/splates-server/creds";
-import { fail as fail4 } from "@stringsync/splates-server/exit";
+import { DEFAULT_TIMEOUT, PROVIDERS } from "@stringsync/splates-server/creds";
+import { fail as fail3 } from "@stringsync/splates-server/exit";
 import { repository as repository2 } from "@stringsync/splates-server/records";
 import { untilAfter } from "@stringsync/splates-server/tasks";
-import { cli as cli4 } from "webappwiz/cmd";
+import { cli as cli3 } from "webappwiz/cmd";
 import { color } from "webappwiz/log";
 import { Duration } from "webappwiz/time";
-import { z as z5 } from "zod";
-var splatesCreds = cli4("creds").description("creds an agent needs a person for, such as an API token: request one saying what it is for, with instructions for getting it, which the Creds page of `splates server` shows for the person to paste, then wait for it; the value goes into the system's store (the macOS Keychain, Windows Credential Manager, a Linux secret service), never to the agent, and code reads it through webappwiz/creds");
-splatesCreds.command("request").use(repository2({ needs: "own" })).description("ask a person for a cred, saying why it is needed and what it will be used for, with markdown instructions for getting it; returns at once, and does nothing when the store already keeps it unless --replace; run from a worktree, it records the task asking").arg("name", z5.string(), {
+import { z as z4 } from "zod";
+var splatesCreds = cli3("creds").description("creds an agent needs a person for, such as an API token: request one saying what it is for, with instructions for getting it, which the Creds page of `splates server` shows for the person to paste, then wait for it; the value goes into the system's store (the macOS Keychain, Windows Credential Manager, a Linux secret service), never to the agent, and code reads it through webappwiz/creds");
+splatesCreds.command("request").use(repository2({ needs: "own" })).description("ask a person for a cred, saying why it is needed and what it will be used for, with markdown instructions for getting it; returns at once, and does nothing when the store already keeps it unless --replace; run from a worktree, it records the task asking").arg("name", z4.string(), {
   description: "what it is kept as, an environment variable's name"
-}).option("purpose", z5.string(), {
+}).option("purpose", z4.string(), {
   default: "",
   description: "why it is needed and what it will be used for, in a sentence the person reads before getting it"
-}).option("instructions", z5.string(), {
+}).option("instructions", z4.string(), {
   default: "",
   description: "how to get it, in markdown: where to go, what to pick, what to paste"
-}).option("device", z5.boolean(), {
+}).option("device", z4.boolean(), {
   default: false,
   description: "keep it for every project on this device, as for a person's own account, rather than this project alone"
-}).option("replace", z5.boolean(), {
+}).option("provider", z4.optional(z4.enum(PROVIDERS)), {
+  description: "who keeps it: `system`, the machine's own store, or `ssm`, AWS Parameter Store, where that is offered"
+}).option("replace", z4.boolean(), {
   default: false,
   description: "ask again although one is kept, since the kept one does not work; --purpose and --instructions left off are those of the last request"
 }).action(async (opts, ctx) => {
   const scope = opts.device ? "device" : "project";
+  const provider = opts.provider ?? "system";
   const request = await ctx.journal.record("creds request", null, async () => ctx.creds.request(opts.name, {
     scope,
+    provider,
     purpose: opts.purpose,
     instructions: opts.instructions,
     task: await here(ctx),
     replace: opts.replace
   }), (asked) => ({ name: opts.name, asked: asked !== null }));
   if (request === null) {
-    ctx.log.info(`${color.green("kept")} ${opts.name} in ${ctx.creds.label(scope)}: nothing to ask`);
+    ctx.log.info(`${color.green("kept")} ${opts.name} in ${ctx.creds.label(scope, provider)}: nothing to ask`);
     return;
   }
   ctx.log.info(`${color.yellow("requested")} ${opts.name}  ${color.dim(request.purpose)}`);
   ctx.log.error(`It shows on the Creds page of \`splates server\`. \`splates creds wait ${opts.name}\` until it is saved.`);
 });
-splatesCreds.command("wait").use(repository2({ needs: "own" })).description("block until a person saves the cred requested, or dismisses the request (`dismissed`); gives up with `timeout` rather than waiting forever").arg("name", z5.string(), { description: "the cred requested" }).option("timeout-secs", z5.coerce.number(), {
+splatesCreds.command("wait").use(repository2({ needs: "own" })).description("block until a person saves the cred requested, or dismisses the request (`dismissed`); gives up with `timeout` rather than waiting forever").arg("name", z4.string(), { description: "the cred requested" }).option("timeout-secs", z4.coerce.number(), {
   default: DEFAULT_TIMEOUT.secs,
   description: "how long to wait before giving up"
 }).action(async (opts, ctx) => {
@@ -408,12 +326,12 @@ splatesCreds.command("wait").use(repository2({ needs: "own" })).description("blo
   await ctx.journal.waiting("creds wait", null, { name: opts.name, until: untilAfter(timeout) }, async () => {
     const ended = await ctx.creds.wait(opts.name, { timeout });
     if (ended === "dismissed") {
-      fail4("dismissed", `${opts.name} was dismissed: carry on without it, or ask the person why`, { name: opts.name });
+      fail3("dismissed", `${opts.name} was dismissed: carry on without it, or ask the person why`, { name: opts.name });
     }
   });
   ctx.log.info(`${color.green("saved")} ${opts.name}`);
 });
-splatesCreds.command("list").use(repository2({ needs: "read" })).description("the creds requested and still open, with what each is for, and every cred the project's store and the device's keep, by name; never a value").option("json", z5.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => {
+splatesCreds.command("list").use(repository2({ needs: "read" })).description("the creds requested and still open, with what each is for, and every cred the project's store and the device's keep, by name; never a value").option("json", z4.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => {
   const open = (await ctx.creds.requests()).filter((each) => each.status === "open");
   const kept = await ctx.creds.kept();
   if (opts.json) {
@@ -427,15 +345,202 @@ splatesCreds.command("list").use(repository2({ needs: "read" })).description("th
     }
   }
   for (const each of kept) {
-    ctx.log.info(`${color.green("kept")}      ${each.name}  ${color.dim(each.scope)}${each.savedBy === null ? "" : color.dim(`  saved by ${each.savedBy}`)}`);
+    ctx.log.info(`${color.green("kept")}      ${each.name}  ${color.dim(`${each.provider} ${each.scope}`)}${each.savedBy === null ? "" : color.dim(`  saved by ${each.savedBy}`)}`);
   }
   if (open.length === 0 && kept.length === 0) {
     ctx.log.info(color.dim("no creds requested or kept"));
   }
 });
 
+// hook.ts
+import { commaList as commaList3 } from "@stringsync/splates-server/comma-list";
+import { fail as fail4 } from "@stringsync/splates-server/exit";
+import {
+  HookStore,
+  hookAdd,
+  hookEdit,
+  hookGardener,
+  hookGroomer,
+  hookList,
+  hookPause,
+  hookRemove,
+  lanesNamed,
+  stagesNamed,
+  TASK_EVENTS
+} from "@stringsync/splates-server/hooks";
+import { repository as repository3 } from "@stringsync/splates-server/records";
+import { cli as cli4 } from "webappwiz/cmd";
+import { z as z5 } from "zod";
+var splatesHook = cli4("hook").description(`automations: what runs on a task event (${TASK_EVENTS.join(", ")}), as \`splates server\` sees the journal take it, or on a schedule it keeps: an agent told of it; or a shell command. Kept for you in this project's .git/splates, never checked in, since an agent hook spends your tokens; splates.config.ts's \`on\` holds the shell commands a project checks in. None set, nothing runs. The page's Automations tab lists them with when each last ran and for what task`);
+splatesHook.command("list").use(repository3({ needs: "read" })).description("every automation set here, by number, with its trigger").option("json", z5.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => hookList({ hooks: storeOf(ctx), log: ctx.log }, { json: opts.json }));
+splatesHook.command("add").use(repository3({ needs: "tasks" })).description("run something on a task event, or on a schedule with `--every` or `--cron` in place of the event: `--agent <a> --prompt <words>` starts that agent in the main tree, told the event as `[SPLATES EVENT <event> #N]`, or a schedule as `[SPLATES SCHEDULE <number>]`, then your words; `--run <command>` runs it via `sh -c` in the main tree, with $SPLATES_EVENT (`schedule` for one), $SPLATES_TASKS and $SPLATES_TASK set. A schedule that came due while `splates server` was down runs once as it starts").arg("event", z5.string().optional(), {
+  description: "the task event, as task.created; none for a schedule"
+}).option("stage", z5.string(), {
+  default: "",
+  description: "only for tasks in these stages, comma separated: backlog, ready, queued, running"
+}).option("lane", z5.string(), {
+  default: "",
+  description: "only for tasks in these lanes, by number, comma separated"
+}).option("every", z5.string(), {
+  default: "",
+  description: "run every so often, as 30m, 2h or 1d"
+}).option("cron", z5.string(), {
+  default: "",
+  description: `run on a five-field cron line, in this machine's time, as "0 9 * * 1-5"`
+}).option("agent", z5.string(), {
+  default: "",
+  description: "the agent to run, as `splates agents` names it"
+}).option("model", z5.string(), {
+  default: "",
+  description: "its model (default: the agent's own)"
+}).option("effort", z5.string(), {
+  default: "",
+  description: "its thinking level (default: the agent's own)"
+}).option("prompt", z5.string(), {
+  default: "",
+  description: "what the agent is told after the event"
+}).option("run", z5.string(), {
+  default: "",
+  description: "a shell command to run"
+}).action(async (opts, ctx) => {
+  const pick = await assigneeIn(ctx, opts.agent, opts.model, opts.effort);
+  let hook;
+  if (opts.run !== "") {
+    if (pick != null || opts.prompt !== "") {
+      fail4("usage", "--run goes alone: a shell command runs no agent", {});
+    }
+    hook = { kind: "run", command: opts.run };
+  } else if (pick == null) {
+    fail4("usage", "say what runs: --agent with --prompt, or --run", {});
+  } else if (opts.prompt === "") {
+    fail4("usage", "an agent hook needs --prompt: what to tell it", {});
+  } else {
+    hook = { kind: "agent", prompt: opts.prompt, ...pick };
+  }
+  await hookAdd({ hooks: storeOf(ctx), log: ctx.log }, triggerOf(opts), hook);
+});
+splatesHook.command("edit").use(repository3({ needs: "tasks" })).description("change one of your automations, by its number in `splates hook list`, keeping its number, its pause and its last runs. Each flag changes only what it names, as `splates hook add` takes it: `--event`, `--every` or `--cron` sets what sets it off anew, `--stage` or `--lane` alone narrows its event again (`any` for no narrowing), `--prompt` or `--agent` changes what an agent is told or which agent, and `--run` makes it a shell command. The groomer changes through `splates hook groomer`").arg("id", z5.string(), { description: "its number in `splates hook list`" }).option("event", z5.string(), {
+  default: "",
+  description: "a task event to run on, as task.created, in place of what sets it off now"
+}).option("stage", z5.string(), {
+  default: "",
+  description: "only for tasks in these stages, comma separated, or `any`: backlog, ready, queued, running"
+}).option("lane", z5.string(), {
+  default: "",
+  description: "only for tasks in these lanes, by number, comma separated, or `any`"
+}).option("every", z5.string(), {
+  default: "",
+  description: "run every so often, as 30m, 2h or 1d"
+}).option("cron", z5.string(), {
+  default: "",
+  description: `run on a five-field cron line, in this machine's time, as "0 9 * * 1-5"`
+}).option("agent", z5.string(), {
+  default: "",
+  description: "the agent to run, as `splates agents` names it"
+}).option("model", z5.string(), {
+  default: "",
+  description: "its model, with --agent (default: the agent's own)"
+}).option("effort", z5.string(), {
+  default: "",
+  description: "its thinking level, with --agent (default: the agent's own)"
+}).option("prompt", z5.string(), {
+  default: "",
+  description: "what the agent is told after the event"
+}).option("run", z5.string(), {
+  default: "",
+  description: "a shell command to run in place of an agent"
+}).action(async (opts, ctx) => {
+  const { id, agent, model, effort, ...change } = opts;
+  const pick = await assigneeIn(ctx, agent, model, effort);
+  if (pick === null) {
+    fail4("usage", "an agent automation needs an agent: name one, or --run", {});
+  }
+  await hookEdit({ hooks: storeOf(ctx), log: ctx.log }, id, {
+    ...change,
+    ...pick === undefined ? {} : { pick }
+  });
+});
+splatesHook.command("remove").use(repository3({ needs: "tasks" })).description("take away an automation, by its number in `splates hook list`, or every one on an event").arg("id", z5.string(), {
+  description: "its number, or a task event, as task.created"
+}).action((opts, ctx) => hookRemove({ hooks: storeOf(ctx), log: ctx.log }, opts.id));
+splatesHook.command("pause").use(repository3({ needs: "tasks" })).description("stop an automation running, keeping it to resume").arg("id", z5.string(), { description: "its number in `splates hook list`" }).action((opts, ctx) => hookPause({ hooks: storeOf(ctx), log: ctx.log }, opts.id, true));
+splatesHook.command("resume").use(repository3({ needs: "tasks" })).description("let a paused automation run again").arg("id", z5.string(), { description: "its number in `splates hook list`" }).action((opts, ctx) => hookPause({ hooks: storeOf(ctx), log: ctx.log }, opts.id, false));
+splatesHook.command("groomer").use(repository3({ needs: "tasks" })).description("turn on the project's groomer, built-in automation `groomer`, or set the agent it runs as, as the Automations page does: on each task deferred to the backlog, and the backlog as `splates server` starts, a conversation of its own per run, archived as the run ends, organizes each task in order and marks it ready, never doing it. `--off` turns it off, retiring its conversations").option("agent", z5.string(), {
+  default: "",
+  description: "the agent it runs as, as `splates agents` names it"
+}).option("model", z5.string(), {
+  default: "",
+  description: "its model (default: the agent's own)"
+}).option("effort", z5.string(), {
+  default: "",
+  description: "its thinking level (default: the agent's own)"
+}).option("off", z5.boolean(), {
+  default: false,
+  description: "turn it off"
+}).action(async (opts, ctx) => {
+  const pick = await assigneeIn(ctx, opts.agent, opts.model, opts.effort);
+  if (opts.off === (pick != null)) {
+    fail4("usage", "say how it runs with --agent, or turn it off with --off", {});
+  }
+  await hookGroomer({ hooks: storeOf(ctx), log: ctx.log }, pick ?? null);
+});
+splatesHook.command("gardener").use(repository3({ needs: "tasks" })).description("turn on the notes gardener, built-in automation `notes-gardener`, or set the agent it runs as and its schedule, as the Automations page does: on each run, an agent reads each project note no open task names by its path, checks it against the code and the other notes, and drafts the fixes in one task, `notes-garden`: rewriting what went stale, merging notes that say one thing, splitting one that says several, settling a contradiction the code settles and sharpening descriptions, then asks you to review the change rather than merge it, asking about any contradiction the code does not settle. No run starts while `notes-garden` is open. Off by default, since each run reads code for every note on your tokens; it runs every 7d until you set `--every` or `--cron`. `--off` turns it off").option("agent", z5.string(), {
+  default: "",
+  description: "the agent it runs as, as `splates agents` names it"
+}).option("model", z5.string(), {
+  default: "",
+  description: "its model (default: the agent's own)"
+}).option("effort", z5.string(), {
+  default: "",
+  description: "its thinking level (default: the agent's own)"
+}).option("every", z5.string(), {
+  default: "",
+  description: "run every so often, as 1d (default: as it was, or 7d)"
+}).option("cron", z5.string(), {
+  default: "",
+  description: `run on a five-field cron line, in this machine's time, as "0 9 * * 1"`
+}).option("off", z5.boolean(), {
+  default: false,
+  description: "turn it off"
+}).action(async (opts, ctx) => {
+  const pick = await assigneeIn(ctx, opts.agent, opts.model, opts.effort);
+  if (opts.off === (pick != null)) {
+    fail4("usage", "say how it runs with --agent, or turn it off with --off", {});
+  }
+  await hookGardener({ hooks: storeOf(ctx), log: ctx.log }, pick ?? null, {
+    every: opts.every,
+    cron: opts.cron
+  });
+});
+function triggerOf(opts) {
+  const given = [opts.event, opts.every, opts.cron].filter((each) => each !== undefined && each !== "");
+  if (given.length !== 1) {
+    fail4("usage", "say what sets it off: a task event, --every or --cron, one of them", {});
+  }
+  if (opts.event === undefined || opts.event === "") {
+    if (opts.stage !== "" || opts.lane !== "") {
+      fail4("usage", "--stage and --lane narrow a task event, not a schedule", {});
+    }
+    return opts.every !== "" ? { every: opts.every } : { cron: opts.cron };
+  }
+  const filter = {};
+  if (opts.stage !== "") {
+    filter.stages = stagesNamed(commaList3(opts.stage));
+  }
+  if (opts.lane !== "") {
+    filter.lanes = lanesNamed(opts.lane);
+  }
+  const event = opts.event;
+  return Object.keys(filter).length === 0 ? { event } : { event, filter };
+}
+function storeOf(ctx) {
+  return new HookStore(ctx.storage);
+}
+
 // lane.ts
 import {
+  APPROVAL,
+  BACKLOG_LANE as BACKLOG_LANE2,
   laneAdd,
   laneList,
   laneRemove,
@@ -444,22 +549,27 @@ import {
   laneUpdated,
   recordLaneRemove
 } from "@stringsync/splates-server/board";
+import { refuseGroomer } from "@stringsync/splates-server/conversations";
 import { UNTRIAGED } from "@stringsync/splates-server/plans";
-import { repository as repository3 } from "@stringsync/splates-server/records";
+import { refuseAgentQueue } from "@stringsync/splates-server/queue";
+import { repository as repository4 } from "@stringsync/splates-server/records";
 import { cli as cli5 } from "webappwiz/cmd";
 import { z as z6 } from "zod";
-var splatesLane = cli5("lane").description("lanes: named runs of todos, landed top first; `[SPLATES LANE <n>]` from `splates server` starts an orchestrator on one, handing out each todo nothing holds back to an agent on the model it names, or doing it itself. A todo in no lane is untriaged, and `[SPLATES LANE untriaged]` starts one that places those in lanes first");
-splatesLane.command("list").use(repository3({ needs: "read" })).description("every lane: its name, its todos in order, the tasks on it, its next todo, and what blocks that in other lanes").option("json", z6.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => laneList(ctx, { json: opts.json }));
-splatesLane.command("show").use(repository3({ needs: "read" })).description("one lane step by step, and what its agent does next: start the next todo, or wait for the one blocking it in another lane to land first; `untriaged` lists the todos in no lane, to place in lanes").arg("lane", z6.union([
-  z6.literal(UNTRIAGED).transform(() => null),
-  z6.coerce.number().int().positive()
-], { error: "pass a lane's number, or untriaged" }), { description: "lane number, or `untriaged`" }).option("json", z6.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => laneShow(ctx, opts.lane, { json: opts.json }));
-splatesLane.command("add").use(repository3({ needs: "tasks" })).description("start an empty lane, after the others").arg("name", z6.string(), {
-  description: "what its todos are for, like `Licensing`"
+var laneNumber = z6.union([
+  z6.literal("backlog").transform(() => BACKLOG_LANE2),
+  z6.coerce.number().int().nonnegative()
+]);
+var splatesLane = cli5("lane").description("lanes: named groups of tasks, for you to see related work together on the board; queue one whole with `splates lane queue`. Backlog (lane 0) is permanent and holds unmatched deferred work. Untriaged is groomed into lanes and cannot be queued whole");
+splatesLane.command("list").use(repository4({ needs: "read" })).description("every lane: its name, its queued tasks in order, the started tasks on it, its next task, and what blocks that in other lanes").option("json", z6.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => laneList(ctx, { json: opts.json }));
+splatesLane.command("show").use(repository4({ needs: "read" })).description("one lane step by step, and what its agent does next: start the next task, or wait for the one blocking it in another lane to land first; `untriaged` lists the tasks in no lane, to place in lanes").arg("lane", z6.union([z6.literal(UNTRIAGED).transform(() => null), laneNumber], {
+  error: "pass a lane's number, backlog, or untriaged"
+}), { description: "lane number, `backlog`, or `untriaged`" }).option("json", z6.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => laneShow(ctx, opts.lane, { json: opts.json }));
+splatesLane.command("add").use(repository4({ needs: "tasks" })).description("start an empty lane, after the others").arg("name", z6.string(), {
+  description: "what its tasks are for, like `Licensing`"
 }).action(async (opts, ctx) => {
   await ctx.journal.record("lane add", null, () => laneAdd(ctx, opts.name), (lane) => ({ lane: lane.id, name: lane.name }));
 });
-splatesLane.command("update").use(repository3({ needs: "tasks" })).description("rename a lane, or move it among the others").arg("lane", z6.coerce.number().int().positive(), {
+splatesLane.command("update").use(repository4({ needs: "tasks" })).description("rename a lane, or move it among the others").arg("lane", laneNumber, {
   description: "lane number"
 }).option("name", z6.string().optional(), {
   description: "what it is called from now on"
@@ -469,9 +579,46 @@ splatesLane.command("update").use(repository3({ needs: "tasks" })).description("
   const change = { name: opts.name, position: opts.position };
   await ctx.journal.record("lane update", null, () => laneUpdate(ctx, opts.lane, change), (record) => laneUpdated(opts.lane, record, change));
 });
-splatesLane.command("remove").use(repository3({ needs: "tasks" })).description("remove a lane, putting its todos back with the untriaged ones; a lane whose last todo merges goes on its own").arg("lane", z6.coerce.number().int().positive(), {
+splatesLane.command("queue").use(repository4({ needs: "tasks" })).description("queue a lane whole: each of its tasks is queued as soon as nothing blocks it, now and as tasks land, until the lane is empty; a task you take out with `splates queue remove` stays out until you queue it again. Untriaged cannot be queued whole").arg("lane", laneNumber, {
+  description: "lane number"
+}).action(async (opts, ctx) => {
+  refuseAgentQueue(ctx.service, "lane queue");
+  await refuseGroomer(ctx.service, "lane queue");
+  const change = { queued: true };
+  await ctx.journal.record("lane update", null, () => laneUpdate(ctx, opts.lane, change), (record) => laneUpdated(opts.lane, record, change));
+});
+splatesLane.command("approve").use(repository4({ needs: "tasks" })).description("let a queued lane queue more tasks on its own: it stops when its budget is spent, which starts at its tasks then plus 5, and this adds 10 to what is left; refused from an agent").arg("lane", laneNumber, {
+  description: "lane number"
+}).action(async (opts, ctx) => {
+  refuseAgentQueue(ctx.service, "lane approve");
+  const change = { approve: APPROVAL };
+  await ctx.journal.record("lane update", null, () => laneUpdate(ctx, opts.lane, change), (record) => laneUpdated(opts.lane, record, change));
+});
+splatesLane.command("unqueue").use(repository4({ needs: "tasks" })).description("stop queueing a lane whole, taking out of the queue each of its tasks that has yet to start; those under way go on").arg("lane", laneNumber, {
+  description: "lane number"
+}).action(async (opts, ctx) => {
+  refuseAgentQueue(ctx.service, "lane unqueue");
+  const change = { queued: false };
+  await ctx.journal.record("lane update", null, () => laneUpdate(ctx, opts.lane, change), (record) => laneUpdated(opts.lane, record, change));
+});
+splatesLane.command("remove").use(repository4({ needs: "tasks" })).description("remove a lane and its tasks, kept to restore; a lane whose last task merges goes on its own; refused from an agent, which asks with a permission card").arg("lane", laneNumber, {
   description: "lane number"
-}).action((opts, ctx) => recordLaneRemove(ctx.journal, ctx.todos, opts.lane, () => laneRemove(ctx, opts.lane)));
+}).action((opts, ctx) => {
+  refuseAgentQueue(ctx.service, "lane remove");
+  return recordLaneRemove(ctx.journal, ctx.tasks, opts.lane, () => laneRemove(ctx, opts.lane));
+});
+
+// notes.ts
+import { loadConfig } from "@stringsync/splates-server/config";
+import { Notes } from "@stringsync/splates-server/notes";
+async function notes(ctx) {
+  const root = ctx.project === undefined ? (await ctx.git.run(ctx.ps.cwd(), "rev-parse", "--show-toplevel")).stdout.trim() : ctx.git.root;
+  const config = await loadConfig(root, { fs: ctx.fs, git: ctx.git });
+  const found = await new Notes(ctx.fs).list(root, config);
+  for (const note of found) {
+    ctx.log.info(note.description);
+  }
+}
 
 // projects.ts
 import {
@@ -479,50 +626,288 @@ import {
   listReaches,
   REACHES
 } from "@stringsync/splates-server/projects";
-import { repository as repository4 } from "@stringsync/splates-server/records";
+import { repository as repository5 } from "@stringsync/splates-server/records";
 import { cli as cli6 } from "webappwiz/cmd";
 import { z as z7 } from "zod";
-var splatesProjects = cli6("projects").description("the other splates projects on this machine, and what agents of each may do in the others through splates: `read` their tasks, todos and lanes; add `todos` to their untriaged lane, as every project may until granted otherwise; or hand their `tasks` to agents and orchestrate them. Any repo command runs on another project as `splates --project <slug> <command>`, refused where it needs more than that project granted").fallback("list");
-splatesProjects.command("list").use(repository4({ needs: "read" })).description("print each other project: its slug, its root, what it may do here, and what this one may do there").option("json", z7.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => listReaches(ctx, { json: opts.json }));
-splatesProjects.command("grant").use(repository4({ needs: "own" })).description("let agents of another project do as much as `read`, `todos` or `tasks` here, each including those before it; the user's call, so an agent runs it only when the user asks it to").arg("project", z7.string(), { description: "the other project's slug" }).arg("reach", z7.enum(REACHES), {
-  description: "read, todos or tasks"
+var splatesProjects = cli6("projects").description("the other splates projects on this machine, and what agents of each may do in the others through splates: `read` their tasks and lanes; add tasks to their untriaged lane with `queue`, as every project may until granted otherwise; or run their queue, lanes and hooks with `tasks`. Any repo command runs on another project as `splates --project <slug> <command>`, refused where it needs more than that project granted").fallback("list");
+splatesProjects.command("list").use(repository5({ needs: "read" })).description("print each other project: its slug, its root, what it may do here, and what this one may do there").option("json", z7.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => listReaches(ctx, { json: opts.json }));
+splatesProjects.command("grant").use(repository5({ needs: "own" })).description("let agents of another project do as much as `read`, `queue` or `tasks` here, each including those before it; the user's call, so an agent runs it only when the user asks it to").arg("project", z7.string(), { description: "the other project's slug" }).arg("reach", z7.enum(REACHES), {
+  description: "read, queue or tasks"
 }).action((opts, ctx) => grantReach(ctx, opts.project, opts.reach));
 
 // queue.ts
-import { listQueue, moveQueued } from "@stringsync/splates-server/workers";
+import { tasksNamed } from "@stringsync/splates-server/board";
+import { refuseGroomer as refuseGroomer2 } from "@stringsync/splates-server/conversations";
+import {
+  queueAdd,
+  queueList,
+  queueMove,
+  queueRemove,
+  refuseAgentQueue as refuseAgentQueue2
+} from "@stringsync/splates-server/queue";
+import { repository as repository6 } from "@stringsync/splates-server/records";
 import { cli as cli7 } from "webappwiz/cmd";
 import { z as z8 } from "zod";
-var DEV2 = {
+var splatesQueue = cli7("queue").description("the queue: the tasks a worker of `splates server` starts as soon as it has a slot free, each after every task it is blocked by, otherwise in the order you set. Only you queue a task, from the backlog or groomed, and an agent asks you to with a queue card; one that names no model runs on the roster's first agent");
+splatesQueue.command("list").use(repository6({ needs: "read" })).description("the queue in the order workers start it, with each task's model and what it waits on: the open tasks it is blocked by, or those removed without merging").option("json", z8.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => queueList(ctx, { json: opts.json }));
+splatesQueue.command("add").use(repository6({ needs: "tasks" })).description("queue tasks for a worker to start once nothing they are blocked by is open; refused for one already under way").rest("ids", z8.coerce.number().int().positive(), {
+  description: "task numbers"
+}).action(async (opts, ctx) => {
+  refuseAgentQueue2(ctx.service, "queue add");
+  await refuseGroomer2(ctx.service, "queue add");
+  await ctx.journal.record("queue add", await here(ctx), () => queueAdd(ctx, opts.ids), (queued) => ({ tasks: tasksNamed(queued) }));
+});
+splatesQueue.command("remove").use(repository6({ needs: "tasks" })).description("take tasks out of the queue, back to ready when they name a model, else the backlog; the tasks stay").rest("ids", z8.coerce.number().int().positive(), {
+  description: "task numbers"
+}).action(async (opts, ctx) => {
+  refuseAgentQueue2(ctx.service, "queue remove");
+  await ctx.journal.record("queue remove", await here(ctx), () => queueRemove(ctx, opts.ids), (removed) => ({ tasks: tasksNamed(removed) }));
+});
+splatesQueue.command("move").use(repository6({ needs: "tasks" })).description("move a queued task to another place in the queue, from 1 for the next to start; what it is blocked by still goes first. Then lists the queue").arg("id", z8.coerce.number().int().positive(), { description: "task number" }).arg("position", z8.coerce.number().int().positive(), {
+  description: "where in the queue to put it, from 1"
+}).action(async (opts, ctx) => {
+  refuseAgentQueue2(ctx.service, "queue move");
+  return queueMove(ctx, opts.id, opts.position);
+});
+
+// server.ts
+import {
+  BoxShell,
+  CoordinatorBox as CoordinatorBox2,
+  coordinatorMoved,
+  deployKey,
+  machineMove,
+  neededCreds
+} from "@stringsync/splates-server/coordinator";
+import { SYSTEM_STORES as SYSTEM_STORES2 } from "@stringsync/splates-server/creds";
+import { fail as fail6 } from "@stringsync/splates-server/exit";
+import {
+  DEFAULT_PORT,
+  RUNNING,
+  serveDev
+} from "@stringsync/splates-server/server";
+import { LOCAL_SLOTS } from "@stringsync/splates-server/workers";
+import { cli as cli9 } from "webappwiz/cmd";
+import { z as z10 } from "zod";
+
+// infra.ts
+import { resolve as resolve2 } from "node:path";
+import { commaList as commaList4 } from "@stringsync/splates-server/comma-list";
+import {
+  ACCESS_ENVIRONMENT,
+  accessEnvironmentExists,
+  CoordinatorBox,
+  pulumiOrg,
+  writeInfraConfig
+} from "@stringsync/splates-server/coordinator";
+import { fail as fail5 } from "@stringsync/splates-server/exit";
+import { infraConfigure } from "@stringsync/splates-server/infra/configure";
+import { Projects } from "@stringsync/splates-server/projects";
+import { repository as repository7 } from "@stringsync/splates-server/records";
+import { savedTunnelOf } from "@stringsync/splates-server/server";
+import { FsStorage as FsStorage2 } from "@stringsync/splates-server/storage";
+import { cli as cli8 } from "webappwiz/cmd";
+import { z as z9 } from "zod";
+var splatesInfra = cli8("infra").description("the Pulumi project that makes everything the server's box needs in AWS, Cloudflare and GitHub, which `splates server deploy` then installs splates on");
+splatesInfra.command("init").use(repository7({ needs: "own" })).description("write a Pulumi project in <dir>, its program a dozen lines using the components of @stringsync/splates-server/infra, and the stack's config from the flags; run again, it writes only what is not so already and keeps values you changed. It fills the stack's config from what splates keeps (the projects, the saved tunnel, the Cloudflare ids, and each secret from the creds store), requesting on the Creds page any cred not kept and exiting `requested`; run again once saved. When the Pulumi ESC environment `coordinator-access` makes (splates/aws) is there, the stack imports it. It records the directory in ~/.splates/coordinator/infra.json, where `splates server deploy` finds the stack. Then `bun add @stringsync/splates-server @pulumi/pulumi @pulumi/aws @pulumi/awsx @pulumi/cloudflare @pulumi/github @pulumi/tls @pulumi/random` there and `pulumi up`").arg("dir", z9.string(), { description: "where the Pulumi project goes" }).option("stack", z9.string(), { default: "prod", description: "the stack" }).option("host", z9.string(), {
   default: "",
-  description: "the `splates server` to ask, a URL such as http://localhost:4310; by default the one an agent runs under, from SPLATES_DEV"
-};
-var splatesQueue = cli7("queue").description("the agents waiting for a slot on a worker of the running `splates server`: each one another agent started (with `splates add --agent`, or a lane's orchestrator handing out todos), started or resumed while every worker it can run on is full, waits here, first come, first served, and starts once a slot frees, as when an agent left idle 30 minutes stops; none is ever failed for waiting. An agent you start waits only while no worker it can run on is up, as with this machine's own removed or none on the platform its project requires");
-splatesQueue.command("list").description("list the agents waiting for a slot, first in line first: position, project, task, conversation, how long each has waited and why (no free slot, no worker up, or a platform no worker runs, as `needs macOS`)").option("dev", z8.string(), DEV2).option("json", z8.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => listQueue({
-  dev: opts.dev,
-  json: opts.json,
-  log: ctx.log,
-  ps: ctx.ps,
-  send: ctx.fetch
-}));
-splatesQueue.command("move").description("move an agent waiting for a slot to another place in line, from 1 for the next to start, then list the queue").arg("which", z8.string(), {
-  description: "the task it works, or its conversation's id"
-}).arg("position", z8.coerce.number().int(), {
-  description: "where in line to put it, from 1"
-}).option("dev", z8.string(), DEV2).option("json", z8.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => moveQueued({
-  which: opts.which,
-  position: opts.position,
-  dev: opts.dev,
-  json: opts.json,
-  log: ctx.log,
-  ps: ctx.ps,
-  send: ctx.fetch
-}));
+  description: "the public host name, as in splates.example.com; the saved tunnel's by default"
+}).option("email", z9.string(), {
+  default: "",
+  description: "the email address Access lets in; the tunnel's Access application's by default"
+}).option("region", z9.string(), {
+  default: "us-east-1",
+  description: "the AWS region"
+}).option("projects", z9.string(), {
+  default: "",
+  description: "comma-separated slug=owner/repo, each a project the box pushes trunk of; every project registered here with a GitHub origin by default"
+}).action(async (opts, ctx) => {
+  const listed = commaList4(opts.projects).map((entry) => {
+    const [slug, repository] = entry.split("=");
+    if (!slug || !repository?.includes("/")) {
+      fail5("usage", `--projects wants slug=owner/repo, not ${entry}`, {
+        entry
+      });
+    }
+    return { slug, repository };
+  });
+  const org = await pulumiOrg(ctx.ps);
+  const home = new CoordinatorBox({ ps: ctx.ps, fs: ctx.fs }).home;
+  const { written, todo } = await infraConfigure({
+    dir: opts.dir,
+    stack: opts.stack,
+    host: opts.host,
+    email: opts.email,
+    region: opts.region,
+    projects: listed.length === 0 ? null : listed,
+    registered: async () => (await Projects.in(new FsStorage2(home, ctx.fs), ctx.fs).list()).filter((project) => !project.gone),
+    creds: ctx.creds,
+    saved: savedTunnelOf(ctx),
+    ...org !== null && await accessEnvironmentExists(ctx.ps, org) ? { environment: ACCESS_ENVIRONMENT } : {},
+    fs: ctx.fs,
+    ps: ctx.ps,
+    log: ctx.log,
+    fetch: ctx.fetch
+  });
+  await writeInfraConfig(ctx.fs, home, {
+    dir: resolve2(opts.dir),
+    stack: opts.stack
+  });
+  ctx.log.info(written.length === 0 ? "already so: nothing written" : `wrote ${written.join(", ")}`);
+  for (const command of todo) {
+    ctx.log.info(`still to run in ${opts.dir}: ${command}`);
+  }
+});
+
+// server.ts
+var splatesServer = cli9("server").description("the splates server: run it on this machine, or deploy it to an always-on box in your own AWS account, which the Pulumi project `splates server infra init` writes makes, reached by SSH alone").fallback("run");
+splatesServer.command("run").description("serve every splates project on this machine as a web page, from wherever it is run: the page picks the project it shows, adds one by its path, running `splates init` there, and shows its queued and started tasks, where queued tasks can be added, updated, reordered or removed; it brings each project's records forward as it opens it. A server that crashes starts again after 2s, then 4s, 8s and 16s, and is left down after five crashes in a row that each came within a minute of its start").option("port", z10.coerce.number(), {
+  default: DEFAULT_PORT,
+  description: "port to listen on, or the next open one above it"
+}).option("allow-hosts", z10.string(), {
+  default: "",
+  description: "comma-separated host names the page may also be reached by, like a tunnel's; put Cloudflare Access in front of them with --access-team and --access-aud"
+}).option("access-team", z10.string(), {
+  default: "",
+  description: "the Cloudflare Access team in front of --allow-hosts, as in <team>.cloudflareaccess.com; with --access-aud, those hosts answer only to a verified Access token, and may then use conversations and terminals"
+}).option("access-aud", z10.string(), {
+  default: "",
+  description: "the AUD tag of that Access application"
+}).option("tunnel", z10.string(), {
+  default: "",
+  description: "the public host name of a tunnel to run, with cloudflared or the tunnel provider named by splates.config.ts in the repository it is run in, if any, which is allowed as a host too; refused without --access-team and --access-aud, so a tunnel never exposes the page unauthenticated. With none of the tunnel and Access flags, the tunnel `splates tunnel setup` saved runs, if any"
+}).option("tunnel-name", z10.string(), {
+  default: "",
+  description: "the named tunnel cloudflared runs for --tunnel, by default the one its own config names; not with a tunnel provider of splates.config.ts"
+}).option("ports-host", z10.string(), {
+  default: "",
+  description: "the wildcard base host to serve task ports under, saved for this machine so a bare `splates server` serves it too: each port a task's processes listen on opens at https://<task>-<port>.<base>, to whoever Cloudflare Access lets in, and is refused without Access; routing *.<base> here, its DNS and TLS, are yours. `none` forgets it, leaving each task port forwarded to a port on this machine's loopback alone"
+}).option("worker-slots", z10.coerce.number().int().min(1), {
+  default: LOCAL_SLOTS,
+  description: "how many agents that other agents started (with `splates add --agent`, or a lane's orchestrator handing out tasks) this machine's worker runs at once; past them, each new or resumed one waits in the queue, first come, first served, which `splates worker queue` shows and reorders. An agent you start runs at once on any worker up, taking no slot. Read as the server starts its worker, which a restart from the page leaves running"
+}).option("keepalive", z10.boolean(), {
+  default: false,
+  description: "keep a machine left to serve awake while the server runs: on macOS with `caffeinate`, on power or idle, though closing a laptop's lid still sleeps it; on Linux with a systemd-inhibit lock on sleep and idle, which the server serves on without, saying so, where systemd is missing or refuses it. Refused on other platforms"
+}).option("slot", z10.boolean(), {
+  default: false,
+  description: "serve this checkout's splates at https://<word>.<zone>, a slot of its own on the zone `splates tunnel setup` uses, behind the same Access policy, so several run side by side and a phone opens each by name: a task's worktree keeps its word, as fox, until the task merges or is removed, which stops its server; run again, it stops the tree's last server first. Refused in a splates repository's main tree, which every agent shares. A slot keeps its own projects in ~/.splates/slots/<word>, apart from yours, starting with a throwaway project there; not with the tunnel and Access flags"
+}).action((opts, ctx) => serveDev(ctx, opts));
+splatesServer.mount("infra", splatesInfra);
+splatesServer.command("deploy").description("deploy the server to the box its Pulumi stack made (`splates server infra init`, then `pulumi up`), over SSH, with splates of this release installed for the user splates. The SSH key and the host key come from the stack and the instance's console. It checks what the deploy needs, brings the box's splates to this release, and exits `blocked`, naming each, until the box's Parameter Store holds the creds the stack should have put there; then gives each project a clone there with its deploy key from Parameter Store. Then it asks every agent of this machine's `splates server` to checkpoint and stops it, carries the server's records (no creds: the box reads its own through its instance role) to the box, starts `splates server` there for good under systemd, and joins this machine to it as a worker, kept up by a LaunchAgent, where each task carries on in its worktree here. This machine's records go aside, kept, and its `splates` reaches the box from then on. Run again once the server runs on the box, it brings the box's splates to this release and restarts it there").option("dry-run", z10.boolean(), {
+  default: false,
+  description: "stop once the box is ready, before this machine's server stops or anything here changes; once the server runs on the box, change nothing"
+}).option("dev", z10.string(), {
+  default: `http://localhost:${DEFAULT_PORT}`,
+  description: "this machine's `splates server`, which the deploy stops"
+}).action(async (opts, ctx) => {
+  const moved = await machineMove({
+    ps: ctx.ps,
+    fs: ctx.fs,
+    log: ctx.log,
+    version: RUNNING,
+    dev: opts.dev,
+    stores: ctx.secrets ?? SYSTEM_STORES2,
+    ...ctx.fetch === undefined ? {} : { fetch: ctx.fetch }
+  }).run({ dryRun: opts["dry-run"] });
+  if (moved.status === "blocked") {
+    fail6("blocked", [
+      "The box's Parameter Store lacks these. Set each (the Pulumi stack makes them: `pulumi up`), then deploy again:",
+      ...moved.needs.map((name) => `  ${name}`)
+    ].join(`
+`), { needs: moved.needs });
+  }
+  if (moved.status === "deployed") {
+    ctx.log.info(`the server runs on the box at ${moved.ipv4}: deploy again without --dry-run to bring it to ${moved.version}`);
+    return;
+  }
+  if (moved.status === "updated") {
+    ctx.log.info(`the server on the box at ${moved.ipv4} runs ${moved.version} now`);
+    return;
+  }
+  if (moved.status === "ready") {
+    ctx.log.info(`the box is ready to serve ${moved.projects.join(", ")} through ${moved.host}: deploy again without --dry-run`);
+    return;
+  }
+  ctx.log.info([
+    `the server runs on the box: https://${moved.host}`,
+    `this machine is its worker ${ctx.ps.hostname}, kept up by ${moved.worker}`,
+    `its own records are kept aside in ${moved.aside} and each project's .git/splates.moved`
+  ].join(`
+`));
+});
+splatesServer.command("status").description("print where the server runs, here or deployed to its box, and the box as its cloud has it").option("json", z10.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => {
+  const deployed = await coordinatorMoved({
+    fs: ctx.fs,
+    ps: ctx.ps,
+    home: box(ctx).home
+  });
+  const standing = await box(ctx).status();
+  if (opts.json) {
+    ctx.log.info(JSON.stringify({ deployed, box: standing }));
+    return;
+  }
+  ctx.log.info([
+    `runs:     ${deployed ? "on the box" : "on this machine"}`,
+    ...standing === null ? [
+      "box:      none: `splates server infra init` writes the Pulumi project, `pulumi up` there makes it"
+    ] : [
+      `address:  ${standing.ipv4}`,
+      `instance: ${standing.instanceId} (role ${standing.roleName})`,
+      `host:     ${standing.host}`,
+      "ssh:      splates server ssh"
+    ]
+  ].join(`
+`));
+});
+splatesServer.command("ssh").description("open a root shell on the box over SSH, with the key its Pulumi stack made, or run the command given there").rest("command", z10.string(), {
+  description: "what to run on the box; by default a shell"
+}).passThroughOptions().action(async (opts, ctx) => {
+  const standing = await box(ctx).status();
+  if (standing === null) {
+    fail6("not_found", "no box: `splates server infra init` writes the Pulumi project, `pulumi up` there makes it");
+  }
+  const { exitCode } = await ctx.ps.spawn(shell(ctx, standing).login(opts.command));
+  ctx.ps.exit(exitCode);
+});
+splatesServer.command("destroy").description("say how to destroy the box: its Pulumi stack made it, so the stack unmakes it").action(async (_opts, ctx) => {
+  const infra = await box(ctx).infra();
+  fail6("usage", infra === null ? "no infra project here: run `pulumi destroy` in the one `splates server infra init` wrote" : `run \`pulumi destroy\` in ${infra.dir}, after lifting the termination protection (\`disableApiTermination\`) on the instance. Anything only on the box is lost`);
+});
+splatesServer.command("needs").description("kept for `splates server deploy`, which runs it on the box: print the name of each cred this box's store lacks of those the server needs, one per line").rest("roots", z10.string(), {
+  description: "each project's clone on this machine"
+}).action(async (opts, ctx) => {
+  const missing = await neededCreds(ctx.secrets ?? SYSTEM_STORES2, opts.roots);
+  for (const name of missing) {
+    ctx.log.info(name);
+  }
+});
+splatesServer.command("deploy-key").description("kept for `splates server deploy`, which runs it on the box: print the deploy key of the project whose clone is <root>").arg("root", z10.string(), {
+  description: "the project's clone on this machine"
+}).action(async (opts, ctx) => {
+  const key = await deployKey(ctx.secrets ?? SYSTEM_STORES2, opts.root);
+  if (key === undefined) {
+    fail6("not_found", `no deploy key kept for ${opts.root}`);
+  }
+  ctx.log.info(key);
+});
+function box(ctx) {
+  return new CoordinatorBox2({ ps: ctx.ps, fs: ctx.fs });
+}
+function shell(ctx, standing) {
+  return new BoxShell({
+    ps: ctx.ps,
+    ipv4: standing.ipv4,
+    key: standing.key,
+    knownHosts: `${box(ctx).home}/coordinator/known_hosts`
+  });
+}
 
 // setup.ts
 import { dirname } from "node:path";
 import { SYSTEM_STORES as SYSTEM_STORES3 } from "@stringsync/splates-server/creds";
+import { fail as fail7 } from "@stringsync/splates-server/exit";
 import { splatesHome as splatesHome2 } from "@stringsync/splates-server/models";
-import { Projects } from "@stringsync/splates-server/projects";
+import { Projects as Projects2 } from "@stringsync/splates-server/projects";
 import {
   SETUP_AREAS,
   Setup,
@@ -535,8 +920,28 @@ import {
 } from "@stringsync/splates-server/workers";
 import { color as color2 } from "webappwiz/log";
 async function setup(deps, opts) {
+  if (opts.step === "" && (opts.skip || opts.unskip || opts.undo)) {
+    fail7("usage", "--skip and --unskip name a step, --undo an area", {});
+  }
+  if (opts.undo && (opts.skip || opts.unskip)) {
+    fail7("usage", "--undo names an area, not a step to skip", {
+      area: opts.step
+    });
+  }
+  if (opts.skip && opts.unskip) {
+    fail7("usage", "--skip or --unskip, not both", { step: opts.step });
+  }
   const machine = await setupOf(deps);
   const { log } = deps;
+  if (opts.undo) {
+    const plan = await machine.undoPlan(opts.step);
+    if (opts.json) {
+      log.info(JSON.stringify(plan, null, 2));
+      return;
+    }
+    printUndo(log, plan);
+    return;
+  }
   if (opts.step !== "") {
     machine.step(opts.step);
     if (opts.skip) {
@@ -563,7 +968,7 @@ async function setup(deps, opts) {
 }
 async function setupOf(deps) {
   const { fs, ps, secrets = SYSTEM_STORES3, fetch } = deps;
-  const root = deps.project === undefined ? await repoRoot(ps) : (await Projects.ofMachine(deps).named(deps.project)).root;
+  const root = deps.project === undefined ? await repoRoot(ps) : (await Projects2.ofMachine(deps).named(deps.project)).root;
   return new Setup({
     fs,
     ps,
@@ -633,13 +1038,37 @@ function printStep(log, step) {
     log.info(`${color2.red("problem:")} ${step.problem}`);
   }
 }
+function printUndo(log, plan) {
+  log.info(`${color2.bold(`Undo ${plan.title}`)}  ${color2.dim(plan.area)}`);
+  if (plan.refused !== null) {
+    log.info(`${color2.red("refused:")} ${plan.refused}`);
+    return;
+  }
+  for (const step of plan.steps) {
+    const started = step.done ? "" : `  ${color2.yellow("started")}`;
+    log.info(`  ${step.title}  ${color2.dim(step.id)}${started}`);
+    for (const line of step.removes) {
+      log.info(`    removes  ${line}`);
+    }
+    for (const line of step.leaves) {
+      log.info(`    leaves   ${line}`);
+    }
+  }
+  for (const cred of plan.creds) {
+    log.info(cred.keptFor === null ? `  forgets ${cred.name}` : `  keeps   ${cred.name}  ${color2.dim(`${cred.keptFor} still uses it`)}`);
+  }
+  if (plan.confirm !== null) {
+    log.info(`  the page asks for ${plan.confirm} to be typed`);
+  }
+  log.info(color2.dim("the Setup page's Undo does it, after the user confirms"));
+}
 
 // slots.ts
 import { Slots } from "@stringsync/splates-server/ports";
-import { cli as cli8 } from "webappwiz/cmd";
-import { z as z9 } from "zod";
-var splatesSlots = cli8("slots").description("the words `splates server --slot` hands out on this machine, each held by the tree that claimed it: a task's worktree holds its word until the task merges or is removed, which stops its server and gives the word back");
-splatesSlots.command("list").description("print each claimed word, the tree holding it, its server's pid while one runs, and whether it is orphaned: its tree gone, or a splates repository's main tree, which every agent shares").option("json", z9.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => {
+import { cli as cli10 } from "webappwiz/cmd";
+import { z as z11 } from "zod";
+var splatesSlots = cli10("slots").description("the words `splates server --slot` hands out on this machine, each held by the tree that claimed it: a task's worktree holds its word until the task merges or is removed, which stops its server and gives the word back");
+splatesSlots.command("list").description("print each claimed word, the tree holding it, its server's pid while one runs, and whether it is orphaned: its tree gone, or a splates repository's main tree, which every agent shares").option("json", z11.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => {
   const held = await Slots.ofMachine(ctx).status();
   if (opts.json) {
     ctx.log.info(JSON.stringify(held.map(({ slot, tree, pid, orphaned }) => ({
@@ -671,190 +1100,222 @@ function heldLine({ slot, tree, pid, orphaned }) {
   return `${slot.word} ${slot.emoji}  ${tree}  ${server}${orphaned ? "  orphaned: `splates slots prune` frees it" : ""}`;
 }
 
-// todo.ts
+// task.ts
 import {
   addedFacts,
   recordUpdate,
-  todoAdd,
-  todoList,
-  todoRelease,
-  todoRemove,
-  todoShow,
-  todosNamed,
-  todoTake,
-  todoUpdate
+  taskAdd,
+  taskList,
+  taskRemove,
+  taskShow,
+  tasksNamed as tasksNamed2,
+  taskUpdate
 } from "@stringsync/splates-server/board";
-import { commaList as commaList3 } from "@stringsync/splates-server/comma-list";
-import { fail as fail5 } from "@stringsync/splates-server/exit";
-import { repository as repository5 } from "@stringsync/splates-server/records";
+import { commaList as commaList5 } from "@stringsync/splates-server/comma-list";
+import { refuseGroomer as refuseGroomer3 } from "@stringsync/splates-server/conversations";
+import { fail as fail8 } from "@stringsync/splates-server/exit";
+import { repository as repository8 } from "@stringsync/splates-server/records";
 import {
   DEFAULT_TIMEOUT as DEFAULT_TIMEOUT2,
-  todoWait,
+  taskWait,
   untilAfter as untilAfter2
 } from "@stringsync/splates-server/tasks";
-import { cli as cli9 } from "webappwiz/cmd";
+import { cli as cli11 } from "webappwiz/cmd";
 import { Duration as Duration2 } from "webappwiz/time";
-import { z as z10 } from "zod";
-var splatesTodo = cli9("todo").description("defer work for later instead of growing the task you are in: `merge` recommends the next one when a task lands");
-splatesTodo.command("add").use(repository5({ needs: "todos" })).description("note something to do later and move on; run from a worktree, it records the task it came up in").arg("subject", z10.string(), { description: "what is left to do, in a line" }).arg("text", z10.string(), {
-  default: "",
-  description: "whatever more there is to say about it, in markdown"
-}).option("position", position, {
-  description: "where it goes in the list, 1 at the top, pushing those from there down (default: the bottom)"
-}).option("file", z10.string(), {
-  default: "",
-  description: "files to attach, comma separated: copied under .git/splates/todos/<id>/"
-}).option("blocked-by", z10.string(), {
-  default: "",
-  description: "ids of the todos blocking it, comma separated: each has to merge before this one starts"
-}).option("lane", z10.string(), {
-  default: "",
-  description: "the lane it goes in, at the bottom: a lane's number, or `new` for one of its own (default: none, untriaged)"
-}).option("agent", z10.string(), {
-  default: "",
-  description: "the agent on the roster (`splates agents`) that should work it, which Start on the `splates server` board offers first"
-}).option("model", z10.string(), {
-  default: "",
-  description: "with --agent: the model, by its id or name on the roster"
-}).option("effort", z10.string(), {
-  default: "",
-  description: "with --agent: the thinking level, one the agent offers (default: the agent's own)"
-}).action(async (opts, ctx) => {
-  if (ctx.elsewhere !== null && opts.lane !== "") {
-    fail5("not_granted", "a todo from another project goes in its untriaged lane, for whoever orchestrates it there to place: leave --lane off", { subject: opts.subject });
+import { z as z12 } from "zod";
+var splatesTask = cli11("task").description("the numbered tasks: defer work for later instead of growing the task you are in, and `splates add <slug> --task <n>` starts one; `merge` recommends the next one when a task lands. The person puts tasks in `splates queue`, for workers to start");
+async function projectFrom(ctx) {
+  if (ctx.elsewhere === null) {
+    return;
   }
-  const from = await here(ctx);
-  const assignee = await assigneeIn(ctx, opts.agent, opts.model, opts.effort);
-  const origin = ctx.elsewhere === null ? undefined : {
-    project: ctx.elsewhere,
-    task: ctx.project === undefined ? null : ctx.service.taskFor(await ctx.git.currentBranch(ctx.ps.cwd()))
-  };
-  await ctx.journal.record("todo add", from, () => todoAdd(ctx, opts.subject, from, {
-    text: opts.text,
-    position: opts.position,
-    files: commaList3(opts.file),
-    blockedBy: todoIds(opts["blocked-by"]),
-    lane: laneIn(opts.lane) ?? null,
-    assignee,
-    origin
-  }), addedFacts);
-});
-splatesTodo.command("list").use(repository5({ needs: "read" })).description("every todo, top of the list first, with the task it came from and the task that took it up").option("json", z10.boolean(), { default: false, description: "emit JSON" }).option("open", z10.boolean(), {
+  return (await ctx.projects.list()).find((each) => each.root === ctx.git.root)?.slug;
+}
+function adding(name, description, ready) {
+  splatesTask.command(name).use(repository8({ needs: "queue" })).description(description).arg("subject", z12.string(), {
+    description: "what is left to do, in a line"
+  }).arg("text", z12.string(), {
+    default: "",
+    description: "whatever more there is to say about it, in markdown"
+  }).option("slug", z12.string(), {
+    description: "a short name for the task that takes it (lowercase-with-dashes), naming its branch, worktree and conversation: a few words for what it changes, not the subject cut short"
+  }).option("position", position, {
+    description: "where it goes in the list, 1 at the top, pushing those from there down (default: the bottom)"
+  }).option("file", z12.string(), {
+    default: "",
+    description: "files to attach, comma separated: copied under .git/splates/tasks/<n>/"
+  }).option("blocked-by", z12.string(), {
+    default: "",
+    description: "numbers of the tasks blocking it, comma separated: each has to merge before this one starts"
+  }).option("lane", z12.string(), {
+    default: "",
+    description: "the lane it goes in, at the bottom: a lane's number, `backlog` for the permanent catch-all, or `new` for one of its own (default: none, untriaged)"
+  }).option("agent", z12.string(), {
+    default: "",
+    description: "the agent on the roster (`splates agents`) that should work it, which Start on the `splates server` board offers first"
+  }).option("model", z12.string(), {
+    default: "",
+    description: "with --agent: the model, by its id or name on the roster"
+  }).option("effort", z12.string(), {
+    default: "",
+    description: "with --agent: the thinking level, one the agent offers (default: the agent's own)"
+  }).action(async (opts, ctx) => {
+    if (ctx.elsewhere !== null && opts.lane !== "") {
+      fail8("not_granted", "a task from another project goes in its untriaged lane, for whoever orchestrates it there to place: leave --lane off", { subject: opts.subject });
+    }
+    const from = await here(ctx);
+    const assignee = await assigneeIn(ctx, opts.agent, opts.model, opts.effort);
+    const origin = ctx.elsewhere === null ? undefined : {
+      project: ctx.elsewhere,
+      task: ctx.project === undefined ? null : ctx.service.taskFor(await ctx.git.currentBranch(ctx.ps.cwd()))
+    };
+    const project = await projectFrom(ctx);
+    await ctx.journal.record("task add", from, () => taskAdd(ctx, opts.subject, from, {
+      slug: opts.slug,
+      text: opts.text,
+      position: opts.position,
+      files: commaList5(opts.file),
+      blockedBy: taskIds(opts["blocked-by"]),
+      lane: laneIn(opts.lane) ?? null,
+      assignee,
+      origin,
+      ready,
+      project
+    }), addedFacts);
+  });
+}
+adding("add", "queue a task to do later and move on, groomed, so it goes in ready: you checked no task already asks it, and linked what blocks it; run from a worktree, it records the task it came up in", true);
+adding("defer", "queue a task as it is, rough, in the backlog for whoever grooms it: to check for one that already asks it, link what blocks it, and mark it ready; run from a worktree, it records the task it came up in", false);
+splatesTask.command("list").use(repository8({ needs: "read" })).description("every queued task, top of the list first, with the task it came from and the started one that took it up").option("json", z12.boolean(), { default: false, description: "emit JSON" }).option("open", z12.boolean(), {
   default: false,
-  description: "only todos no task has taken up: the ones free to pick up"
-}).option("ready", z10.boolean(), {
+  description: "only tasks no started one has taken up: the ones free to pick up"
+}).option("ready", z12.boolean(), {
   default: false,
-  description: "only todos free to start now: nobody has taken them, and nothing blocking them is still open"
-}).action((opts, ctx) => todoList(ctx, {
+  description: "only tasks free to start now: none has taken them, and nothing blocking them is still open"
+}).action(async (opts, ctx) => taskList(ctx, {
   json: opts.json,
   open: opts.open,
-  ready: opts.ready
+  ready: opts.ready,
+  project: await projectFrom(ctx)
+}));
+splatesTask.command("show").use(repository8({ needs: "read" })).description("one task in full: where it stands, its files, and its detail").arg("id", z12.coerce.number().int().positive(), { description: "task number" }).option("json", z12.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => taskShow(ctx, opts.id, {
+  json: opts.json,
+  project: await projectFrom(ctx),
+  others: (await ctx.projects.list()).filter((project) => project.root !== ctx.git.root).map((project) => project.slug)
 }));
-splatesTodo.command("show").use(repository5({ needs: "read" })).description("one todo in full: where it stands, its files, and its detail").arg("id", z10.coerce.number().int().positive(), { description: "todo id" }).option("json", z10.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => todoShow(ctx, opts.id, { json: opts.json }));
-splatesTodo.command("update").use(repository5({ needs: "tasks" })).description("say what a todo is in other words, move it up or down the list, or attach and drop files; it keeps its id").arg("id", z10.coerce.number().int().positive(), { description: "todo id" }).arg("text", z10.string(), {
+splatesTask.command("update").use(repository8({ needs: "tasks" })).description("say what a queued task is in other words, move it up or down the list, or attach and drop files; it keeps its number").arg("id", z12.coerce.number().int().positive(), { description: "task number" }).arg("text", z12.string(), {
   default: "",
   description: "whatever more there is to say about it, in markdown; leave out to keep the detail"
-}).option("subject", z10.string(), {
+}).option("subject", z12.string(), {
   default: "",
   description: "what is left to do, in a line; leave out to keep it"
+}).option("slug", z12.string(), {
+  default: "",
+  description: "a new name for the task that takes it (lowercase-with-dashes); leave out to keep it"
 }).option("position", position, {
   description: "where to move it in the list, 1 at the top; the others close up around it"
-}).option("file", z10.string(), {
+}).option("file", z12.string(), {
   default: "",
   description: "files to attach, comma separated"
-}).option("remove-file", z10.string(), {
+}).option("remove-file", z12.string(), {
   default: "",
   description: "attached files to drop, comma separated, by path or stored name"
-}).option("blocked-by", z10.string(), {
+}).option("blocked-by", z12.string(), {
   default: "",
-  description: "ids of more todos blocking it, comma separated: each has to merge before this one starts; refused when that makes a loop"
-}).option("remove-blocked-by", z10.string(), {
+  description: "numbers of more tasks blocking it, comma separated: each has to merge before this one starts; refused when that makes a loop"
+}).option("remove-blocked-by", z12.string(), {
   default: "",
-  description: "ids of todos no longer blocking it, comma separated"
-}).option("lane", z10.string(), {
+  description: "numbers of tasks no longer blocking it, comma separated"
+}).option("lane", z12.string(), {
   default: "",
-  description: "move it to a lane, at the bottom: a lane's number, `new` for one of its own, or `none` to put it back with the untriaged"
-}).option("agent", z10.string(), {
+  description: "move it to a lane, at the bottom: a lane's number, `backlog` for the permanent catch-all, `new` for one of its own, or `none` for untriaged"
+}).option("agent", z12.string(), {
   default: "",
   description: "the agent on the roster (`splates agents`) that should work it, which Start on the `splates server` board offers first, or `none`"
-}).option("model", z10.string(), {
+}).option("model", z12.string(), {
   default: "",
   description: "with --agent: the model, by its id or name on the roster"
-}).option("effort", z10.string(), {
+}).option("effort", z12.string(), {
   default: "",
   description: "with --agent: the thinking level, one the agent offers (default: the agent's own)"
+}).option("ready", z12.boolean(), {
+  default: false,
+  description: "mark it groomed, moving it from the backlog to ready: no task already asks it, and what blocks it is linked"
+}).option("manual", z12.boolean(), {
+  default: false,
+  description: "queue it by hand only: a queued lane passes over it, and it starts once you `splates queue add` it"
+}).option("auto", z12.boolean(), {
+  default: false,
+  description: "let a queued lane queue it again, undoing --manual"
 }).action(async (opts, ctx) => {
+  if (opts.manual && opts.auto) {
+    fail8("usage", "pass --manual or --auto, not both", { number: opts.id });
+  }
+  await refuseGroomer3(ctx.service, "task update", await ctx.tasks.find(opts.id));
   const assignee = await assigneeIn(ctx, opts.agent, opts.model, opts.effort);
-  await recordUpdate(ctx.journal, ctx.todos, opts.id, () => todoUpdate(ctx, opts.id, {
+  await recordUpdate(ctx.journal, ctx.tasks, opts.id, () => taskUpdate(ctx, opts.id, {
     subject: opts.subject,
+    slug: opts.slug,
     text: opts.text,
     position: opts.position,
-    files: commaList3(opts.file),
-    removeFiles: commaList3(opts["remove-file"]),
-    blockedBy: todoIds(opts["blocked-by"]),
-    removeBlockedBy: todoIds(opts["remove-blocked-by"]),
+    files: commaList5(opts.file),
+    removeFiles: commaList5(opts["remove-file"]),
+    blockedBy: taskIds(opts["blocked-by"]),
+    removeBlockedBy: taskIds(opts["remove-blocked-by"]),
     lane: laneIn(opts.lane),
-    assignee
+    assignee,
+    ready: opts.ready,
+    manual: opts.manual ? true : opts.auto ? false : undefined
   }));
 });
-splatesTodo.command("take").use(repository5({ needs: "own" })).description("take up todos for the task whose worktree you are in, as when they turn out to be part of its work: merging removes them, removing the task puts them back").rest("ids", z10.coerce.number().int().positive(), {
-  description: "todo ids"
-}).action(async (opts, ctx) => {
-  const task = await here(ctx);
-  await ctx.journal.record("todo take", task, () => todoTake(ctx, opts.ids, task), (taken) => ({ todos: todosNamed(taken) }));
+splatesTask.command("remove").use(repository8({ needs: "tasks" })).description("drop a queued task that was done some other way or no longer applies").arg("id", z12.coerce.number().int().positive(), { description: "task number" }).action(async (opts, ctx) => {
+  await refuseGroomer3(ctx.service, "task remove", await ctx.tasks.find(opts.id));
+  await ctx.journal.record("task remove", null, () => taskRemove(ctx, opts.id), (removed) => ({ tasks: tasksNamed2([removed]) }));
 });
-splatesTodo.command("release").use(repository5({ needs: "own" })).description("put taken todos back on the list, as when a task lands without finishing them: `splates todo update` the leftover first; from a worktree, only its own task's").rest("ids", z10.coerce.number().int().positive(), {
-  description: "todo ids"
-}).action(async (opts, ctx) => {
-  const task = await here(ctx);
-  await ctx.journal.record("todo release", task, () => todoRelease(ctx, opts.ids, task), (released) => ({ todos: todosNamed(released) }));
-});
-splatesTodo.command("remove").use(repository5({ needs: "tasks" })).description("drop a todo that was done some other way or no longer applies").arg("id", z10.coerce.number().int().positive(), { description: "todo id" }).action((opts, ctx) => ctx.journal.record("todo remove", null, () => todoRemove(ctx, opts.id), (removed) => ({ todos: todosNamed([removed]) })));
-splatesTodo.command("wait").use(repository5({ needs: "read" })).description("block until a todo leaves the list, which it does when the task that took it merges: for a todo blocked by one another lane is on; ends early when that task is escalated, and gives up with `timeout`").arg("id", z10.coerce.number().int().positive(), { description: "todo id" }).option("timeout-secs", z10.coerce.number(), {
+splatesTask.command("wait").use(repository8({ needs: "read" })).description("block until a task leaves the queue, which it does when the task that took it merges: for a task blocked by one another lane is on; ends early when that task waits on a person to answer its questions, and gives up with `timeout`").arg("id", z12.coerce.number().int().positive(), { description: "task number" }).option("timeout-secs", z12.coerce.number(), {
   default: DEFAULT_TIMEOUT2.secs,
   description: "how long to wait before giving up"
 }).action(async (opts, ctx) => {
   const timeout = Duration2.secs(opts["timeout-secs"]);
-  const todo = (await ctx.todos.all()).find((each) => each.id === opts.id);
-  await ctx.journal.waiting("todo wait", null, {
-    todo: opts.id,
-    subject: todo?.subject ?? null,
+  const task = (await ctx.tasks.all()).find((each) => each.id === opts.id);
+  await ctx.journal.waiting("task wait", null, {
+    number: opts.id,
+    subject: task?.subject ?? null,
     until: untilAfter2(timeout)
-  }, () => todoWait(ctx, opts.id, { timeout }));
+  }, () => taskWait(ctx, opts.id, { timeout }));
 });
 
 // tunnel.ts
-import { repository as repository6 } from "@stringsync/splates-server/records";
-import { savedTunnelOf } from "@stringsync/splates-server/server";
+import { repository as repository9 } from "@stringsync/splates-server/records";
+import { savedTunnelOf as savedTunnelOf2 } from "@stringsync/splates-server/server";
 import {
   API_TOKEN,
   tunnelRemove,
   tunnelSetup
 } from "@stringsync/splates-server/tunnel";
-import { cli as cli10 } from "webappwiz/cmd";
-import { z as z11 } from "zod";
-var splatesTunnel = cli10("tunnel").description("reach `splates server` from elsewhere: a Cloudflare tunnel with Cloudflare Access in front, set up once per machine");
-splatesTunnel.command("setup").use(repository6({ needs: "own" })).description(`make a Cloudflare tunnel to \`splates server\`, the DNS record routing <host> to it, and an Access application letting in only --email, through the API with the token kept as the cred ${API_TOKEN}, then save them for this machine, so a bare \`splates server\` comes up tunneled; run again, it changes only what is not so already. Without that token it requests it on the Creds page of \`splates server\`, with how to make it, and exits \`requested\`: \`splates creds wait ${API_TOKEN}\`, then run it again`).arg("host", z11.string(), {
+import { cli as cli12 } from "webappwiz/cmd";
+import { z as z13 } from "zod";
+var splatesTunnel = cli12("tunnel").description("reach `splates server` from elsewhere: a Cloudflare tunnel with Cloudflare Access in front, set up once per machine");
+splatesTunnel.command("setup").use(repository9({ needs: "own" })).description(`make a Cloudflare tunnel to \`splates server\`, the DNS record routing <host> to it, and an Access application letting in only --email, through the API with the token kept as the cred ${API_TOKEN}, then save them for this machine, so a bare \`splates server\` comes up tunneled; run again, it changes only what is not so already. Without that token it requests it on the Creds page of \`splates server\`, with how to make it, and exits \`requested\`: \`splates creds wait ${API_TOKEN}\`, then run it again`).arg("host", z13.string(), {
   description: "the public host name, in a zone of the account, as in splates.example.com"
-}).option("email", z11.string(), {
+}).option("email", z13.string(), {
   default: "",
   description: "comma-separated email addresses Access lets in"
-}).option("name", z11.string(), {
+}).option("name", z13.string(), {
   default: "splates",
   description: "what the tunnel, the Access application and its policy are called"
-}).option("team", z11.string(), {
+}).option("team", z13.string(), {
   default: "",
   description: "the Zero Trust team to make, as in <team>.cloudflareaccess.com, when the account has none yet"
 }).action(async (opts, ctx) => ctx.journal.record("tunnel setup", null, async () => tunnelSetup({
   ...opts,
   creds: ctx.creds,
   task: await here(ctx),
-  saved: savedTunnelOf(ctx),
+  saved: savedTunnelOf2(ctx),
   log: ctx.log,
   fetch: ctx.fetch
 })));
-splatesTunnel.command("status").description("print the tunnel `splates tunnel setup` saved for this machine, which a bare `splates server` runs, and whether its token is in the system's secret store").option("json", z11.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => {
-  const saved = savedTunnelOf(ctx);
+splatesTunnel.command("status").description("print the tunnel `splates tunnel setup` saved for this machine, which a bare `splates server` runs, and whether its token is in the system's secret store").option("json", z13.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => {
+  const saved = savedTunnelOf2(ctx);
   const record = await saved.read();
   const token = record === null ? false : await saved.token() !== undefined;
   if (opts.json) {
@@ -874,8 +1335,8 @@ splatesTunnel.command("status").description("print the tunnel `splates tunnel se
   ].join(`
 `));
 });
-splatesTunnel.command("remove").use(repository6({ needs: "own" })).description(`delete what \`splates tunnel setup\` and \`splates server --slot\` made in Cloudflare by what they saved: each tunnel, the DNS record routing to it, the Access applications and their policy, then forget the saved files and the tunnels' tokens; the API token kept as ${API_TOKEN} stays. Run again after a failure, it finishes what is left`).action(async (_opts, ctx) => ctx.journal.record("tunnel remove", null, async () => tunnelRemove({
-  saved: savedTunnelOf(ctx),
+splatesTunnel.command("remove").use(repository9({ needs: "own" })).description(`delete what \`splates tunnel setup\` and \`splates server --slot\` made in Cloudflare by what they saved: each tunnel, the DNS record routing to it, the Access applications and their policy, then forget the saved files and the tunnels' tokens; the API token kept as ${API_TOKEN} stays. Run again after a failure, it finishes what is left`).action(async (_opts, ctx) => ctx.journal.record("tunnel remove", null, async () => tunnelRemove({
+  saved: savedTunnelOf2(ctx),
   slots: slotTunnelsOf(ctx),
   creds: ctx.creds,
   task: await here(ctx),
@@ -885,65 +1346,111 @@ splatesTunnel.command("remove").use(repository6({ needs: "own" })).description(`
 })));
 
 // worker.ts
+import { splatesHome as splatesHome3 } from "@stringsync/splates-server/models";
 import {
   addWorker,
   drainWorker,
+  FileLogger,
   listWorkers,
   removeWorker,
   setWorkerSlots,
+  WORKER_JOIN,
   wakeWorker,
   workerJoin,
   workerRecipe,
   workerRun
 } from "@stringsync/splates-server/workers";
-import { cli as cli11 } from "webappwiz/cmd";
-import { z as z12 } from "zod";
-var splatesWorker = cli11("worker").description("the machines that run tasks for `splates server`: each dials out to its coordinator and runs what it is given, agents, terminals and the git and process reads around them, on its own machine");
-splatesWorker.command("run").description("run a worker on this machine until stopped: it dials the coordinator, by default the `splates server` on this machine through a socket in ~/.splates only you may open, and dials again whenever the link drops, while what it runs carries on; it stops reading a process's output while the coordinator is away too long, so nothing is lost. Once its agents have moved off it, a coordinator on another build has it restart on that build, through `bunx @stringsync/splates@<build>`, as it does when it refuses this worker for another protocol; one that says no build has it exit `outdated`").option("coordinator", z12.string(), {
+import { cli as cli14 } from "webappwiz/cmd";
+import { CompositeLogger } from "webappwiz/log";
+import { z as z15 } from "zod";
+
+// waiting.ts
+import { listQueue, moveQueued } from "@stringsync/splates-server/workers";
+import { cli as cli13 } from "webappwiz/cmd";
+import { z as z14 } from "zod";
+var DEV2 = {
   default: "",
-  description: "the coordinator to dial: a `splates server` URL, whose /api/workers it opens, or unix:<path>; by default this machine's"
-}).option("slots", z12.coerce.number().int().min(0), {
+  description: "the `splates server` to ask, a URL such as http://localhost:4310; by default the one an agent runs under, from SPLATES_DEV"
+};
+var splatesWaiting = cli13("queue").description("the agents waiting for a slot on a worker of the running `splates server`: each one another agent started (with `splates add --agent`, or a lane's orchestrator handing out tasks), started or resumed while every worker it can run on is full, waits here, first come, first served, and starts once a slot frees, as when an agent left idle 30 minutes stops; none is ever failed for waiting. An agent you start waits only while no worker it can run on is up, as with this machine's own removed or none on the platform its project requires");
+splatesWaiting.command("list").description("list the agents waiting for a slot, first in line first: position, project, task, conversation, how long each has waited and why (no free slot, no worker up, or a platform no worker runs, as `needs macOS`)").option("dev", z14.string(), DEV2).option("json", z14.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => listQueue({
+  dev: opts.dev,
+  json: opts.json,
+  log: ctx.log,
+  fs: ctx.fs,
+  ps: ctx.ps,
+  send: ctx.fetch
+}));
+splatesWaiting.command("move").description("move an agent waiting for a slot to another place in line, from 1 for the next to start, then list the queue").arg("which", z14.string(), {
+  description: "the task it works, or its conversation's id"
+}).arg("position", z14.coerce.number().int(), {
+  description: "where in line to put it, from 1"
+}).option("dev", z14.string(), DEV2).option("json", z14.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => moveQueued({
+  which: opts.which,
+  position: opts.position,
+  dev: opts.dev,
+  json: opts.json,
+  log: ctx.log,
+  fs: ctx.fs,
+  ps: ctx.ps,
+  send: ctx.fetch
+}));
+
+// worker.ts
+var splatesWorker = cli14("worker").description("the machines that run tasks for `splates server`: each dials out to it and runs what it is given, agents, terminals and the git and process reads around them, on its own machine");
+splatesWorker.command("run").description("run a worker on this machine until stopped: it dials `splates server`, by default the one on this machine through a socket in ~/.splates only you may open, and dials again whenever the link drops, while what it runs carries on; it stops reading a process's output while the server is away too long, so nothing is lost. Once its agents have moved off it, a server on another build has it restart on that build, through `bunx @stringsync/splates@<build>`, as it does when it refuses this worker for another protocol; one that says no build has it exit `outdated`").option("server", z15.string(), {
+  default: "",
+  description: "the `splates server` to dial: its URL, whose /api/workers it opens, or unix:<path>; by default this machine's"
+}).option("coordinator", z15.string(), {
+  default: "",
+  description: "the old name for --server, still read for workers installed before it, and passed to a build older than it"
+}).option("slots", z15.coerce.number().int().min(0), {
   default: 0,
   description: "how many tasks this worker takes at once; by default one for each core and 4 GB of memory it has, whichever is fewer, as a VM such as WSL2 sees them"
-}).option("id", z12.string(), {
+}).option("id", z15.string(), {
   default: "",
-  description: "what the coordinator knows this worker by, kept across restarts so it picks up where it was; by default the machine's host name"
-}).option("join", z12.string(), {
+  description: "what the server knows this worker by, kept across restarts so it picks up where it was; by default the id it joined as, kept beside its key, else the machine's host name"
+}).option("join", z15.string(), {
   default: "",
-  description: "a join token from `splates worker add` on the coordinator, spent to join it before dialing; the key it answers is kept in this machine's system store, or read from SPLATES_WORKER_KEY on one without"
-}).option("ephemeral", z12.boolean(), {
+  description: "a join token from `splates worker add` on the server, spent to join it before dialing; the key it answers is kept in this machine's system store, or read from SPLATES_WORKER_KEY on one without"
+}).option("ephemeral", z15.boolean(), {
   default: false,
   description: "keep the key --join answers in memory alone, for a machine destroyed rather than restarted, as one a worker provider makes"
-}).option("key-file", z12.boolean(), {
+}).option("key-file", z15.boolean(), {
   default: false,
   description: "keep the key --join answers in ~/.splates/worker.env, which only this user may read, rather than the system store, for a machine whose store is locked or missing at boot, as WSL's is with no one signed in; read it from there on each run after"
-}).option("quiet", z12.boolean(), {
+}).option("quiet", z15.boolean(), {
   default: false,
-  description: "say only what went wrong, not each time it joins or loses its coordinator, as the worker `splates server` starts beside itself does"
+  description: "say only what went wrong, not each time it joins or loses its server, as the worker `splates server` starts beside itself does; all of it still goes to worker.log in ~/.splates, the one before it kept as worker.log.1"
 }).action((opts, ctx) => workerRun({
-  coordinator: opts.coordinator,
+  coordinator: opts.server || opts.coordinator,
   slots: opts.slots,
   id: opts.id,
-  join: opts.join,
+  join: opts.join || ctx.ps.env(WORKER_JOIN) || "",
   ephemeral: opts.ephemeral,
   keyFile: opts["key-file"],
-  log: opts.quiet ? { info: () => {}, error: (...said) => ctx.log.error(...said) } : ctx.log,
+  log: opts.quiet ? quietLog(ctx) : ctx.log,
   ps: ctx.ps,
   fs: ctx.fs
 }));
-splatesWorker.command("join").description("spend a join token from `splates worker add` and keep the key it answers, as `splates worker run --join` does, then exit, for an installer that leaves running the worker to a service").option("coordinator", z12.string(), {
-  description: "the coordinator to join: its `splates server` URL"
-}).option("join", z12.string(), {
-  description: "the join token `splates worker add` printed there"
-}).option("id", z12.string(), {
-  default: "",
-  description: "what the coordinator knows this worker by; by default the machine's host name"
-}).option("key-file", z12.boolean(), {
+splatesWorker.command("join").description("spend a join token from `splates worker add` and keep the key it answers, as `splates worker run --join` does, then exit, for an installer that leaves running the worker to a service").option("server", z15.string(), {
+  default: "",
+  description: "the `splates server` to join: its URL"
+}).option("coordinator", z15.string(), {
+  default: "",
+  description: "the old name for --server"
+}).option("join", z15.string(), {
+  default: "",
+  description: "the join token `splates worker add` printed there; by default read from SPLATES_WORKER_JOIN, which keeps it out of the process list other users of the machine can read"
+}).option("id", z15.string(), {
+  default: "",
+  description: "what the server knows this worker by, kept beside its key so a change of host name leaves it the same; by default the machine's host name"
+}).option("key-file", z15.boolean(), {
   default: false,
   description: "keep the key in ~/.splates/worker.env, which only this user may read, rather than the system store, for `splates worker run --key-file` to read"
 }).action((opts, ctx) => workerJoin({
-  coordinator: opts.coordinator,
-  join: opts.join,
+  coordinator: opts.server || opts.coordinator,
+  join: opts.join || ctx.ps.env(WORKER_JOIN) || "",
   id: opts.id,
   keyFile: opts["key-file"],
   log: ctx.log,
@@ -951,13 +1458,14 @@ splatesWorker.command("join").description("spend a join token from `splates work
   fs: ctx.fs
 }));
 splatesWorker.command("recipe").description("print the shell script, run as root on a fresh Debian or Ubuntu machine, that installs what a Linux worker needs: bun, git, the shared browser and this build of splates, for the user `splates`. It is what a provider's snapshot is built from, and what the Windows installer runs in WSL").action((_opts, ctx) => workerRecipe({ log: ctx.log }));
-splatesWorker.command("list").description("list the workers the running `splates server` has: kind (local over its socket, registered otherwise), platform, build, protocol, slots used and total, health with when it was last heard, tasks and $/hour, then any it refused for speaking another protocol").option("dev", z12.string(), {
+splatesWorker.command("list").description("list the workers the running `splates server` has: kind (local over its socket, registered otherwise), platform, build, protocol, slots used and total, health with when it was last heard, tasks and $/hour, then any it refused for speaking another protocol").option("dev", z15.string(), {
   default: "",
   description: "the `splates server` to ask, a URL such as http://localhost:4310; by default the one an agent runs under, from SPLATES_DEV"
-}).option("json", z12.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => listWorkers({
+}).option("json", z15.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => listWorkers({
   dev: opts.dev,
   json: opts.json,
   log: ctx.log,
+  fs: ctx.fs,
   ps: ctx.ps,
   send: ctx.fetch
 }));
@@ -965,71 +1473,84 @@ var dev = {
   default: "",
   description: "the `splates server` to ask, a URL such as http://localhost:4310; by default the one an agent runs under, from SPLATES_DEV"
 };
-splatesWorker.command("add").description("add a worker to the running `splates server`: prints a join token, single use and good for 15 minutes, for `splates worker run --join <token>` on the machine to join, which gets a key of its own that `splates worker remove` revokes; with --local N, makes this machine's own worker run N agents at once and take new ones again, adding it back if it was removed; with --provider, has the `workerProvider` in splates.config.ts make one, booted from the snapshot splates builds for it, which joins on its own and whose machine `splates worker remove` destroys").option("local", z12.coerce.number().int().min(0), {
+splatesWorker.command("add").description("add a worker to the running `splates server`: prints a join token, single use and good for 15 minutes, for `splates worker run --join <token>` on the machine to join, which gets a key of its own that `splates worker remove` revokes; with --local N, makes this machine's own worker run N agents at once and take new ones again, adding it back if it was removed; with --provider, has the `workerProvider` in splates.config.ts make one, booted from the snapshot splates builds for it, which joins on its own and whose machine `splates worker remove` destroys").option("local", z15.coerce.number().int().min(0), {
   default: 0,
   description: "this machine's own worker, with this many slots"
-}).option("provider", z12.boolean(), {
+}).option("provider", z15.boolean(), {
   default: false,
   description: "have the server's worker provider make the worker, of its cheapest type unless --type says"
-}).option("type", z12.string(), {
+}).option("type", z15.string(), {
   default: "",
   description: "the worker provider's type to make, as it names it; implies --provider"
-}).option("dev", z12.string(), dev).action((opts, ctx) => addWorker({
+}).option("dev", z15.string(), dev).action((opts, ctx) => addWorker({
   local: opts.local,
   provider: opts.provider,
   type: opts.type,
   dev: opts.dev,
   log: ctx.log,
+  fs: ctx.fs,
   ps: ctx.ps,
   send: ctx.fetch
 }));
-splatesWorker.command("drain").description("take no new agents on a worker, letting those on it run to their end, but for one asking you something in a task, which saves its task and lets its slot go, its question kept for you to answer and carry it on elsewhere; --undo takes new ones again").arg("id", z12.string(), {
+splatesWorker.command("drain").description("take no new agents on a worker, letting those on it run to their end, but for one asking you something in a task, which saves its task and lets its slot go, its question kept for you to answer and carry it on elsewhere; --undo takes new ones again").arg("id", z15.string(), {
   description: "the worker, as `splates worker list` names it"
-}).option("undo", z12.boolean(), {
+}).option("undo", z15.boolean(), {
   default: false,
   description: "take new agents again"
-}).option("dev", z12.string(), dev).action((opts, ctx) => drainWorker({
+}).option("dev", z15.string(), dev).action((opts, ctx) => drainWorker({
   id: opts.id,
   undo: opts.undo,
   dev: opts.dev,
   log: ctx.log,
+  fs: ctx.fs,
   ps: ctx.ps,
   send: ctx.fetch
 }));
-splatesWorker.command("wake").description("wake a worker asleep at home, a Windows PC that joined in WSL2: a worker awake on its network sends the Wake-on-LAN packet. Placement wakes one by itself when agents queue, before making a worker").arg("id", z12.string(), {
+splatesWorker.command("wake").description("wake a worker asleep at home, a Windows PC that joined in WSL2: a worker awake on its network sends the Wake-on-LAN packet. Placement wakes one by itself when agents queue, before making a worker").arg("id", z15.string(), {
   description: "the worker, as `splates worker list` names it"
-}).option("dev", z12.string(), dev).action((opts, ctx) => wakeWorker({
+}).option("dev", z15.string(), dev).action((opts, ctx) => wakeWorker({
   id: opts.id,
   dev: opts.dev,
   log: ctx.log,
+  fs: ctx.fs,
   ps: ctx.ps,
   send: ctx.fetch
 }));
-splatesWorker.command("slots").description("set how many agents a worker runs at once, from now on, over what it started with").arg("id", z12.string(), {
+splatesWorker.command("slots").description("set how many agents a worker runs at once, from now on, over what it started with").arg("id", z15.string(), {
   description: "the worker, as `splates worker list` names it"
-}).arg("slots", z12.coerce.number().int().min(1), {
+}).arg("slots", z15.coerce.number().int().min(1), {
   description: "how many at once"
-}).option("dev", z12.string(), dev).action((opts, ctx) => setWorkerSlots({
+}).option("dev", z15.string(), dev).action((opts, ctx) => setWorkerSlots({
   id: opts.id,
   slots: opts.slots,
   dev: opts.dev,
   log: ctx.log,
+  fs: ctx.fs,
   ps: ctx.ps,
   send: ctx.fetch
 }));
-splatesWorker.command("remove").description("remove a worker, revoking its key: one with agents on it drains and is removed once they end; --force ends them now, frees their slots, and places each again on another worker, to carry on its task from the checkpoint it last pushed. This machine's own worker, `local`, stops taking agents, its agents running to their end, and leaves this machine only coordinating until `splates worker add --local <slots>`; it takes no --force").arg("id", z12.string(), {
+splatesWorker.command("remove").description("remove a worker, revoking its key: one with agents on it drains and is removed once they end; --force ends them now, frees their slots, and places each again on another worker, to carry on its task from the checkpoint it last pushed. This machine's own worker, `local`, stops taking agents, its agents running to their end, and leaves this machine only coordinating until `splates worker add --local <slots>`; it takes no --force").arg("id", z15.string(), {
   description: "the worker, as `splates worker list` names it"
-}).option("force", z12.boolean(), {
+}).option("force", z15.boolean(), {
   default: false,
   description: "end the agents on it now rather than wait for them"
-}).option("dev", z12.string(), dev).action((opts, ctx) => removeWorker({
+}).option("dev", z15.string(), dev).action((opts, ctx) => removeWorker({
   id: opts.id,
   force: opts.force,
   dev: opts.dev,
   log: ctx.log,
+  fs: ctx.fs,
   ps: ctx.ps,
   send: ctx.fetch
 }));
+splatesWorker.mount("queue", splatesWaiting);
+function quietLog(ctx) {
+  const file = new FileLogger(ctx.fs, `${splatesHome3(ctx.ps)}/worker.log`);
+  return new CompositeLogger([
+    { info: () => {}, error: (...said) => ctx.log.error(...said) },
+    file
+  ]);
+}
 
 // splates.ts
 function projectArgs(argv) {
@@ -1045,9 +1566,16 @@ function projectArgs(argv) {
   }
   return { argv };
 }
-var splates = cli12("splates").use(exits());
-splates.command("init").use(repository7({ creates: true, needs: "own" })).description("make this repository a splates project: set up its records under .git/splates when it has none, install the splates skill of this release with `bunx skills add`, and register it in ~/.splates/projects.json, so `splates server` serves it beside every other; run again, it changes only what is not so already").action((_opts, ctx) => init(ctx));
-splates.command("update").use(repository7({ needs: "own" })).description("bring this repository up to the newest splates on npm: run `update` on that release when it is newer than this one, which installs its splates skill with `bunx skills add` over the copy there, leaving one that links to your own; commit what changed").action(async (_opts, ctx) => {
+var splates = cli15("splates").use(exits());
+splates.command("notes").use(repository10({ needs: "read" })).description("print each project note's frontmatter description, one per line; notesDir in splates.config.ts defaults to notes; an absent directory prints nothing").action((_opts, ctx) => notes(ctx));
+splates.command("init").use(repository10({ creates: true, needs: "own" })).description("make this repository a splates project: set up its records under .git/splates when it has none, install the splates skill of this release with `bunx skills add`, and register it in ~/.splates/projects.json, so `splates server` serves it beside every other; run again, it changes only what is not so already").action((_opts, ctx) => init(ctx));
+splates.command("migrate").description(`move this repository's records under .git/splates to this splates's format, as \`splates server\` does as it starts: backed up first, the steps run with ${MIGRATION_LIMIT.human()} to finish, and the backup put back if one fails or runs over, with why kept in .git/splates-migration.json; it tries again past a failure kept there, which the server and every other command leave alone. Run it only while no older \`splates server\` serves the repository, which would refuse the records once moved; \`splates update\` restarts one first`).action(async (_opts, ctx) => {
+  const format = await migrateRecords(ctx);
+  if (ctx.ps.env(MIGRATING) === undefined) {
+    ctx.log.info(`splates's records are in format ${format}`);
+  }
+});
+splates.command("update").use(recordsFirst()).use(repository10({ needs: "own" })).description("bring this repository up to the newest splates on npm: run `update` on that release when it is newer than this one, which moves the records under .git/splates to its format, as `splates migrate` does, unless an older `splates server` serves the repository, which it asks to restart onto that release once its agents have checkpointed, migrating them as it starts; then installs its splates skill with `bunx skills add` over the copy there, leaving one that links to your own; commit what changed").action(async (_opts, ctx) => {
   const code = await update({
     root: ctx.git.root,
     fs: ctx.fs,
@@ -1059,7 +1587,7 @@ splates.command("update").use(repository7({ needs: "own" })).description("bring
     ctx.ps.exit(code);
   }
 });
-splates.command("heavy").description("run a heavy command (a full test run, an install) in one of this machine's heavy-job slots, waiting for one to come free first, so agents testing at once queue rather than run out of memory; `SPLATES_HEAVY_JOBS` sets how many run at once, 2 by default").rest("command", z13.string(), {
+splates.command("heavy").description("run a heavy command (a full test run, an install) in one of this machine's heavy-job slots, waiting for one to come free first, so agents testing at once queue rather than run out of memory; `SPLATES_HEAVY_JOBS` sets how many run at once, 2 by default").rest("command", z16.string(), {
   description: "the command and its arguments, after `--`"
 }).action(async (opts, ctx) => {
   const code = await runHeavy(ctx, opts.command);
@@ -1067,61 +1595,66 @@ splates.command("heavy").description("run a heavy command (a full test run, an i
     ctx.ps.exit(code);
   }
 });
-splates.command("forget").use(repository7({ needs: "own" })).description("take this repository off ~/.splates/projects.json, so `splates server` no longer offers it; its records stay, and `splates init` brings it back").action((_opts, ctx) => forget(ctx));
-splates.command("add").use(repository7({ needs: "tasks" })).description("start a new task: create branch task/<task>, a worktree at ../<repo>-splates.noindex/<task> and a state record").arg("task", z13.string(), { description: "task name (lowercase-with-dashes)" }).option("base", z13.string(), {
+splates.command("forget").use(repository10({ needs: "own" })).description("take this repository off ~/.splates/projects.json, so `splates server` no longer offers it; its records stay, and `splates init` brings it back").action((_opts, ctx) => forget(ctx));
+splates.command("add").use(repository10({ needs: "tasks" })).description("start a task: a new one, or with --task one from the queue; create branch task/<slug>, a worktree at ../<repo>-splates.noindex/<slug> and a state record").arg("slug", z16.string(), {
+  description: "the task's name, for its branch and worktree (lowercase-with-dashes)"
+}).option("base", z16.string(), {
   default: "",
   description: "branch this task starts from and merges onto (default: trunk); `task/<other>` stacks this task on that one and lands the work in its worktree"
-}).option("todo", z13.string(), {
+}).option("task", z16.string(), {
   default: "",
-  description: "take up these todos, comma separated: their words become the plan's Goal, merging removes them, and removing the task puts them back"
-}).option("goal", z13.string(), {
+  description: "start this queued task by number: its words become the plan's Goal, merging removes it, and removing this task puts it back where it was"
+}).option("goal", z16.string(), {
   default: "",
-  description: "one or two lines on what done means, written under `## Goal` in the task's SPLATES.md; required unless --todo seeds the Goal"
-}).option("agent", z13.string(), {
+  description: "one or two lines on what done means, written under `## Goal` in the task's SPLATES.md; required unless --task seeds the Goal"
+}).option("agent", z16.string(), {
   default: "",
-  description: "hand the task to an agent on the roster (`splates agents`), which `splates server` starts in the worktree, told to claim it; the conversation you run this from stays where it is"
-}).option("model", z13.string(), {
+  description: "how `splates server`'s queue hands the task to an agent on the roster (`splates agents`), which it starts in the worktree; refused from an agent, which starts no agents and queues work with `splates task add` instead"
+}).option("model", z16.string(), {
   default: "",
   description: "with --agent: the model it works on, by its id or name on the roster (default: the agent's own)"
-}).option("effort", z13.string(), {
+}).option("effort", z16.string(), {
   default: "",
   description: "with --agent: the thinking level it works at, one the agent offers (default: the agent's own)"
-}).option("prompt", z13.string(), {
+}).option("prompt", z16.string(), {
   default: "",
-  description: "with --agent: what to tell the agent beyond claiming the task, such as a part's instructions"
-}).option("over-capacity", z13.boolean(), {
-  default: false,
-  description: "with --agent: hand it out though you have as many tasks out to agents as agentsPerAgent (splates.config.ts) allows; only when the person explicitly asked for more at once"
+  description: "with --agent: what to tell the agent beyond claiming the task"
+}).option("held", z16.string(), {
+  default: "",
+  description: "with --agent: the conversation `splates server`'s queue held for the queued task, which takes the task rather than a new one"
 }).action(async (opts, ctx) => {
-  if (opts.agent === "" && (opts.model !== "" || opts.effort !== "" || opts.prompt !== "" || opts["over-capacity"])) {
-    fail6("usage", "--model, --effort, --prompt and --over-capacity go with --agent", { task: opts.task });
+  await refuseGroomer4(ctx.service, "add");
+  if (opts.agent === "" && (opts.model !== "" || opts.effort !== "" || opts.prompt !== "" || opts.held !== "")) {
+    fail9("usage", "--model, --effort, --prompt and --held go with --agent", {
+      task: opts.slug
+    });
   }
-  if (opts.goal.trim() === "" && opts.todo === "") {
-    fail6("usage", `say what done means: \`splates add ${opts.task} --goal "<one or two lines>"\`, or take todos with --todo`, { task: opts.task });
+  if (opts.goal.trim() === "" && opts.task === "") {
+    fail9("usage", `say what done means: \`splates add ${opts.slug} --goal "<one or two lines>"\`, or start queued tasks with --task`, { task: opts.slug });
   }
   const dispatch = opts.agent === "" ? undefined : {
     agent: opts.agent,
     ...opts.model === "" ? {} : { model: opts.model },
     ...await effortIn(ctx, opts.agent, opts.effort, {
-      task: opts.task
+      task: opts.slug
     }),
-    ...opts.prompt === "" ? {} : { prompt: opts.prompt }
+    ...opts.prompt === "" ? {} : { prompt: opts.prompt },
+    ...opts.held === "" ? {} : { held: opts.held }
   };
   const agents = dispatch === undefined ? [] : await seeded2(rosterOf2(ctx));
-  const all = await ctx.todos.all();
-  const subjects = todoIds(opts.todo).flatMap((id) => all.find((todo) => todo.id === id)?.subject ?? []);
-  await ctx.journal.record("add", opts.task, () => add(ctx, opts.task, {
+  const all = await ctx.tasks.all();
+  const subjects = taskIds(opts.task).flatMap((id) => all.find((each) => each.id === id)?.subject ?? []);
+  await ctx.journal.record("add", opts.slug, () => add(ctx, opts.slug, {
     base: opts.base || undefined,
-    todos: todoIds(opts.todo),
+    tasks: taskIds(opts.task),
     goal: opts.goal.trim() || undefined,
     dispatch,
     agents,
     away: ctx.elsewhere !== null,
-    overCapacity: opts["over-capacity"],
-    onTree: dispatch === undefined ? () => follow(ctx, opts.task, { base: opts.base || undefined }) : undefined
+    onTree: dispatch === undefined ? () => follow(ctx, opts.slug, { base: opts.base || undefined }) : undefined
   }), {
     base: opts.base || ctx.config.trunk,
-    todos: todoIds(opts.todo),
+    tasks: taskIds(opts.task),
     goal: opts.goal.trim() || null,
     subjects,
     agent: dispatch?.agent ?? null,
@@ -1131,85 +1664,56 @@ splates.command("add").use(repository7({ needs: "tasks" })).description("start a
     await serveProject(ctx);
   }
 });
-splates.command("claim").use(repository7({ needs: "own" })).description("resume an existing task: take ownership of its worktree and print its path, status and any half-finished rebase; an escalated task goes back to working; refuses while another agent holds the lease, but takes a stale one silently, so `splates show` first if the tree may not be abandoned").arg("task", z13.string(), { description: "task name" }).action(async (opts, ctx) => {
+splates.command("claim").use(repository10({ needs: "own" })).description("resume an existing task: take ownership of its worktree and print its path, status and any half-finished rebase; refuses while another agent holds the lease, but takes a stale one silently, so `splates show` first if the tree may not be abandoned").arg("task", z16.string(), { description: "task name" }).action(async (opts, ctx) => {
   await ctx.journal.record("claim", opts.task, () => claim(ctx, opts.task), (claimed) => claimed);
   await follow(ctx, opts.task);
 });
-splates.command("merge").use(repository7({ needs: "own" })).description("land this worktree's branch on its base (trunk unless created with --base): rebase onto it, run tests on the rebased code, fast-forward it in whichever worktree has it checked out, then discard the worktree, branch and record (linear history, never a merge commit, no flag to skip tests); requires committed work, refusing a dirty worktree").action(async (_opts, ctx) => {
+splates.command("merge").use(repository10({ needs: "own" })).description("land this worktree's branch on its base (trunk unless created with --base): rebase onto it, run tests on the rebased code, fast-forward it in whichever worktree has it checked out, then discard the worktree, branch and record (linear history, never a merge commit, no flag to skip tests); requires committed work, refusing a dirty worktree").option("message", z16.string(), {
+  default: "",
+  description: "squash the task's commits into one with this message before landing, saying what the base gains in at least 5 characters"
+}).action(async (opts, ctx) => {
+  await refuseGroomer4(ctx.service, "merge");
   const task = await here(ctx);
-  const landing = task === null ? null : await ctx.service.find(task);
   const facts = {};
-  await ctx.journal.record("merge", task, () => merge(ctx, ctx.ps.cwd(), facts), facts);
+  await ctx.journal.record("merge", task, () => merge(ctx, ctx.ps.cwd(), facts, { message: opts.message }), facts);
   if (task !== null) {
-    await addFactTodos(ctx, task).catch((error) => ctx.log.error(`could not add todos for what the merge found: ${error}`));
+    await addFactTasks(ctx, task).catch((error) => ctx.log.error(`could not queue tasks for what the merge found: ${error}`));
     await follow(ctx, null, { from: task });
   }
-  if (landing !== null) {
-    await reportToCaller(ctx, landing);
-  }
 });
-splates.command("remove").use(repository7({ needs: "tasks" })).description("discard a task: worktree, branch and state file; cheap and encouraged, since redoing a task against current trunk often beats a hard rebase").arg("task", z13.string(), { description: "task name" }).option("force", z13.boolean(), {
+splates.command("remove").use(repository10({ needs: "tasks" })).description("discard a task: worktree, branch and state file; cheap and encouraged, since redoing a task against current trunk often beats a hard rebase").arg("task", z16.string(), { description: "task name" }).option("force", z16.boolean(), {
   default: false,
   description: "discard even when another agent holds the lease"
-}).option("reason", z13.optional(z13.enum(REMOVE_REASONS)), {
-  description: "why, for the Stats page: nothing (nothing to change), moot (no longer needed), superseded (done some other way), redo (better redone against current trunk)"
+}).option("reason", z16.optional(z16.enum(REMOVE_REASONS)), {
+  description: "why, for the Stats page: nothing (nothing to change), moot (no longer needed), superseded (done some other way), redo (better redone against current trunk), blocked (set aside until what it waits on lands, so back on the list)"
 }).action(async (opts, ctx) => {
-  const removing = await ctx.service.find(opts.task);
   await ctx.journal.record("remove", opts.task, () => remove(ctx, opts.task, { force: opts.force, reason: opts.reason }), ({ released }) => ({ why: opts.reason ?? null, released }));
   await follow(ctx, null, { from: opts.task });
-  await reportToCaller(ctx, removing);
 });
-splates.command("list").use(repository7({ needs: "read" })).description("list every task: name, status, lease (held: an agent is on it now; stale: gone quiet, normal for a task mid-edit; none), commits ahead of trunk, age").option("json", z13.boolean(), { default: false, description: "emit JSON" }).option("files", z13.boolean(), {
+splates.command("list").use(repository10({ needs: "read" })).description("list every started task: its number, name, status, lease (held: an agent is on it now; stale: gone quiet, normal for a task mid-edit; none), commits ahead of trunk, age; `splates task list` lists the queue").option("json", z16.boolean(), { default: false, description: "emit JSON" }).option("files", z16.boolean(), {
   default: false,
   description: "add each task's Goal and changed files (committed or not), to check for overlap before starting"
 }).action((opts, ctx) => list(ctx, { json: opts.json, files: opts.files }));
-splates.command("show").use(repository7({ needs: "read" })).description("read one task without touching it: everything `list` shows for it, plus the SPLATES.md its agent left at the worktree root; takes no lease, so it cannot knock that agent off its own tree").arg("task", z13.string(), { description: "task name" }).option("json", z13.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => show(ctx, opts.task, { json: opts.json }));
-splates.command("wait").use(repository7({ needs: "read" })).description("block until a task stops moving: escalated, or gone (merged or removed), or broken; takes no lease, and gives up with `timeout` rather than waiting forever").arg("task", z13.string(), { description: "task name" }).option("timeout-secs", z13.coerce.number(), {
+splates.command("show").use(repository10({ needs: "read" })).description("read one task without touching it: everything `list` shows for it, plus the SPLATES.md its agent left at the worktree root; takes no lease, so it cannot knock that agent off its own tree; for a task no longer live, the newest finished one of that name: how it ended, its base, the commit it landed as, its conversation and the SPLATES.md it ended on").arg("task", z16.string(), { description: "task name" }).option("json", z16.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => show(ctx, opts.task, { json: opts.json }));
+splates.command("wait").use(repository10({ needs: "read" })).description("block until a task stops moving: waiting on a person to answer its questions, or gone (merged or removed), or broken; takes no lease, and gives up with `timeout` rather than waiting forever").arg("task", z16.string(), { description: "task name" }).option("timeout-secs", z16.coerce.number(), {
   default: DEFAULT_TIMEOUT3.secs,
   description: "how long to wait before giving up"
 }).action((opts, ctx) => {
   const timeout = Duration3.secs(opts["timeout-secs"]);
   return ctx.journal.waiting("wait", opts.task, { until: untilAfter3(timeout) }, () => wait(ctx, opts.task, { timeout }));
 });
-splates.command("log").use(repository7({ needs: "read" })).description("show what has been done here recently: one line per add, claim, merge, remove, escalate, retry, todo and more, with how it ended; outlives the tasks themselves").option("count", z13.coerce.number(), {
+splates.command("log").use(repository10({ needs: "read" })).description("show what has been done here recently: one line per add, claim, merge, remove, retry, queued task and more, with how it ended; outlives the tasks themselves").option("count", z16.coerce.number(), {
   default: DEFAULT_COUNT,
   description: "how many entries to show"
-}).option("json", z13.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => showLog(ctx, { count: opts.count, json: opts.json }));
-splates.command("server").description("serve every splates project on this machine as a web page, from wherever it is run: the page picks the project it shows, adds one by its path, running `splates init` there, and shows its todos and tasks, where todos can be added, updated, reordered or removed; it brings each project's records forward as it opens it").option("port", z13.coerce.number(), {
-  default: DEFAULT_PORT2,
-  description: "port to listen on, or the next open one above it"
-}).option("allow-hosts", z13.string(), {
-  default: "",
-  description: "comma-separated host names the page may also be reached by, like a tunnel's; put Cloudflare Access in front of them with --access-team and --access-aud"
-}).option("access-team", z13.string(), {
-  default: "",
-  description: "the Cloudflare Access team in front of --allow-hosts, as in <team>.cloudflareaccess.com; with --access-aud, those hosts answer only to a verified Access token, and may then use conversations and terminals"
-}).option("access-aud", z13.string(), {
-  default: "",
-  description: "the AUD tag of that Access application"
-}).option("tunnel", z13.string(), {
-  default: "",
-  description: "the public host name of a tunnel to run, with cloudflared or the tunnel provider named by splates.config.ts in the repository it is run in, if any, which is allowed as a host too; refused without --access-team and --access-aud, so a tunnel never exposes the page unauthenticated. With none of the tunnel and Access flags, the tunnel `splates tunnel setup` saved runs, if any"
-}).option("tunnel-name", z13.string(), {
-  default: "",
-  description: "the named tunnel cloudflared runs for --tunnel, by default the one its own config names; not with a tunnel provider of splates.config.ts"
-}).option("ports-host", z13.string(), {
-  default: "",
-  description: "the wildcard base host to serve task ports under, saved for this machine so a bare `splates server` serves it too: each port a task's processes listen on opens at https://<task>-<port>.<base>, to whoever Cloudflare Access lets in, and is refused without Access; routing *.<base> here, its DNS and TLS, are yours. `none` forgets it, leaving each task port forwarded to a port on this machine's loopback alone"
-}).option("worker-slots", z13.coerce.number().int().min(1), {
-  default: LOCAL_SLOTS,
-  description: "how many agents that other agents started (with `splates add --agent`, or a lane's orchestrator handing out todos) this machine's worker runs at once; past them, each new or resumed one waits in the queue, first come, first served, which `splates queue` shows and reorders. An agent you start runs at once on any worker up, taking no slot. Read as the server starts its worker, which a restart from the page leaves running"
-}).option("slot", z13.boolean(), {
-  default: false,
-  description: "serve this checkout's splates at https://<word>.<zone>, a slot of its own on the zone `splates tunnel setup` uses, behind the same Access policy, so several run side by side and a phone opens each by name: a task's worktree keeps its word, as fox, until the task merges or is removed, which stops its server; run again, it stops the tree's last server first. Refused in a splates repository's main tree, which every agent shares. A slot keeps its own projects in ~/.splates/slots/<word>, apart from yours, starting with a throwaway project there; not with the tunnel and Access flags"
-}).action((opts, ctx) => serveDev(ctx, opts));
-splates.command("ports").description("list the ports tasks serve, found by the running `splates server` as an editor finds ports to forward: each port a process in a task's worktree, or under its agent, listens on, with its link through the ports host `splates server --ports-host` saved, behind Cloudflare Access, and its link on this machine, which on a worker whose coordinator runs elsewhere only that worker's own ports have; give the user both").arg("task", z13.string(), {
+}).option("json", z16.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => showLog(ctx, { count: opts.count, json: opts.json }));
+splates.mount("server", splatesServer);
+splates.command("ports").description("list the ports tasks serve, found by the running `splates server` as an editor finds ports to forward: each port a process in a task's worktree, or under its agent, listens on, with its link through the ports host `splates server --ports-host` saved, behind Cloudflare Access, and its link on this machine, which on a worker whose server runs elsewhere only that worker's own ports have; give the user both").arg("task", z16.string(), {
   default: "",
   description: "only this task's ports; every task's by default"
-}).option("dev", z13.string(), {
+}).option("dev", z16.string(), {
   default: "",
   description: "the `splates server` to ask, a URL such as http://localhost:4310; by default the one an agent runs under, from SPLATES_DEV, else the coordinator this machine's worker relays to, else this machine's on its default port"
-}).option("json", z13.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => portsLs({
+}).option("json", z16.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => portsLs({
   task: opts.task,
   dev: opts.dev,
   json: opts.json,
@@ -1218,118 +1722,55 @@ splates.command("ports").description("list the ports tasks serve, found by the r
   ps: ctx.ps,
   send: ctx.fetch
 }));
-splates.command("agents").description("print the roster of agents splates can start, kept for every project in ~/.splates/agents.json: each agent's launch command and models, with what each model is good at and what it costs, and the thinking levels `--effort` takes, as the agent offered them when last started, for choosing whom to delegate to; writes the defaults (Claude, Codex) there first when there is none, and `splates server` starts conversations with those it lists").option("json", z13.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => agents({
+splates.command("agents").description("print the roster of agents splates can start, kept for every project in ~/.splates/agents.json: each agent's launch command and models, with what each model is good at and what it costs, and the thinking levels `--effort` takes, as the agent offered them when last started, for choosing whom to delegate to; writes the defaults (Claude, Codex) there first when there is none, and `splates server` starts conversations with those it lists").option("json", z16.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => agents({
   roster: rosterOf2(ctx),
   offered: await offeredOf(ctx).all(),
   log: ctx.log
 }, { json: opts.json }));
-splates.command("setup").description("set splates up on this machine, one step at a time: with no step, each area's steps, checked from real state, and the one to do next; with a step, why it matters, the one thing the user does and what the agent does. Skips are kept in ~/.splates/setup.json, so a skipped step stops asking").arg("step", z13.string(), {
+splates.command("setup").description("set splates up on this machine, one step at a time: with no step, each area's steps, checked from real state, and the one to do next; with a step, why it matters, the one thing the user does and what the agent does. Skips are kept in ~/.splates/setup.json, so a skipped step stops asking").arg("step", z16.string(), {
   default: "",
   description: "a step's id; omit for every area's progress"
-}).option("json", z13.boolean(), { default: false, description: "emit JSON" }).option("skip", z13.boolean(), {
+}).option("json", z16.boolean(), { default: false, description: "emit JSON" }).option("skip", z16.boolean(), {
   default: false,
   description: "with a step: stop asking for it"
-}).option("unskip", z13.boolean(), {
+}).option("unskip", z16.boolean(), {
   default: false,
   description: "with a step: ask for it again"
-}).action(async (opts, ctx) => {
-  if (opts.step === "" && (opts.skip || opts.unskip)) {
-    fail6("usage", "--skip and --unskip name a step", {});
-  }
-  if (opts.skip && opts.unskip) {
-    fail6("usage", "--skip or --unskip, not both", { step: opts.step });
-  }
-  await setup(ctx, opts);
-});
-splates.command("path").use(repository7({ needs: "read" })).description("print a task's worktree path, or the main tree with no task; names another agent's tree without taking its lease").arg("task", z13.string(), {
+}).option("undo", z16.boolean(), {
+  default: false,
+  description: "with an area's id in place of a step: print what undoing it would remove, the creds it forgets and keeps, and what only the user can remove; the Setup page's Undo does it, after the user confirms"
+}).action((opts, ctx) => setup(ctx, opts));
+splates.command("path").use(repository10({ needs: "read" })).description("print a task's worktree path, or the main tree with no task; names another agent's tree without taking its lease").arg("task", z16.string(), {
   default: "",
   description: "task name; omit for the main tree"
 }).action((opts, ctx) => path(ctx, opts.task || undefined));
-splates.command("checkpoint").use(repository7({ needs: "own" })).description("save this task to the central remote (`remote` in splates.config.ts) before a stop: commit what is uncommitted as a `WIP: checkpoint` commit, to squash before merging, and push the branch as `splates/<task>`, so a worker that dies loses nothing; with no remote configured, leaves the tree as it is").action(async (_opts, ctx) => {
+splates.command("checkpoint").use(repository10({ needs: "own" })).description("save this task to the central remote (`remote` in splates.config.ts) before a stop: commit what is uncommitted as a `WIP: checkpoint` commit, to squash before merging, and push the branch as `splates/<task>`, so a worker that dies loses nothing; with no remote configured, leaves the tree as it is").action(async (_opts, ctx) => {
   await checkpoint(ctx, ctx.ps.cwd());
 });
-splates.command("escalate").use(repository7({ needs: "own" })).description("hand this task to a human and stop: records the reason, drops the lease and leaves the worktree exactly as it is; use instead of resolving a genuine conflict badly just to finish").arg("reason", z13.string(), {
-  description: "why this needs a human; with --review, what to look at before approving"
-}).option("task", z13.string(), {
-  default: "",
-  description: "task name, when run outside its worktree"
-}).option("review", z13.boolean(), {
-  default: false,
-  description: "ask a person to approve merging, the reason saying what to look at, approved in chat; refused until the task is ready to merge, with every question under ## Blocked and step under ## Next checked"
-}).action(async (opts, ctx) => {
-  const task = opts.task || await here(ctx);
-  await ctx.journal.record("escalate", task, () => escalate(ctx, opts.reason, ctx.ps.cwd(), {
-    task: opts.task || undefined,
-    review: opts.review
-  }), (facts) => facts);
-  if (task !== null) {
-    await reportToCaller(ctx, await ctx.service.find(task));
-  }
-});
-splates.command("tell").use(repository7({ needs: "tasks" })).description("say something in the conversation of the agent a task was handed to with `splates add --agent` or `splates handoff --relay`, as the user would: how an orchestrator wakes an agent that sits idle, stops it for a change of plans, or passes on what its lane taught it, and how a relaying agent passes on the user's answers; only the conversation that handed the task out may").arg("task", z13.string(), { description: "task name" }).arg("text", z13.string(), { description: "what to say, as markdown" }).option("stop", z13.boolean(), {
-  default: false,
-  description: "stop the turn the agent is running first, as the user's Stop does, then say text: for a change of plans"
-}).action((opts, ctx) => ctx.journal.record("tell", opts.task, () => tell(ctx, opts.task, opts.text, { stop: opts.stop }), (to) => ({ to })));
-splates.command("handoff").use(repository7({ needs: "own" })).description("hand the task you are at work on to another agent on the roster (`splates agents`), which `splates server` starts in its worktree, told `[SPLATES HANDOFF <task>]` to claim it and carry on from its SPLATES.md; it answers to the user as you did, or with --relay to you, and this conversation leaves the task, though a lane's orchestrator that started you goes on hearing of it; refused to an agent that answers to another conversation, and for a task another conversation is at work on").arg("task", z13.string(), { description: "task name" }).option("agent", z13.string(), {
-  description: "the agent on the roster to hand it to"
-}).option("model", z13.string(), {
-  default: "",
-  description: "the model it works on, by its id or name on the roster (default: the agent's own)"
-}).option("effort", z13.string(), {
-  default: "",
-  description: "the thinking level it works at, one the agent offers (default: the agent's own)"
-}).option("prompt", z13.string(), {
-  default: "",
-  description: "what to tell the agent beyond taking the task over, such as why it is handed on"
-}).option("relay", z13.boolean(), {
-  default: false,
-  description: "for work you judged another model fits better: the agent answers to you rather than the user, reporting back with `[SPLATES REPORT <task>]` and told what the user says with `splates tell`; needs `splates server`"
-}).action(async (opts, ctx) => {
-  const agents = await seeded2(rosterOf2(ctx));
-  const effort = await effortIn(ctx, opts.agent, opts.effort, {
-    task: opts.task
-  });
-  await ctx.journal.record("handoff", opts.task, () => handoff(ctx, opts.task, {
-    agent: opts.agent,
-    ...opts.model === "" ? {} : { model: opts.model },
-    ...effort,
-    ...opts.prompt === "" ? {} : { prompt: opts.prompt }
-  }, agents, { relay: opts.relay }), (picked) => ({
-    agent: picked.agent,
-    model: picked.model ?? null,
-    relay: opts.relay
-  }));
-  await follow(ctx, null, { from: opts.task });
-});
-splates.command("attach").use(repository7({ needs: "own" })).description("store screenshots and recordings for this task's questions to show: prints the path each was stored at, under .git/splates, which the `splates server` page shows inline; from a conversation (its $SPLATES_CONVERSATION, or --conversation) they stay with it past the task, otherwise they go when the task merges or is removed, and a task holds at most attachmentCapacity bytes; with no files, lists what it holds. A file the user will come back for on its own is an artifact instead (`splates artifact add`)").arg("files", z13.string(), {
+splates.command("attach").use(repository10({ needs: "own" })).description("store screenshots and recordings for this task's questions to show: prints the path each was stored at, under .git/splates, which the `splates server` page shows inline; from a conversation (its $SPLATES_CONVERSATION, or --conversation) they stay with it past the task, otherwise they go when the task merges or is removed; those the task's final SPLATES.md shows are copied to keep with its finished record. A task holds at most attachmentCapacity bytes; with no files, lists what it holds. A file the user will come back for on its own is an artifact instead (`splates artifact add`)").arg("files", z16.string(), {
   default: "",
   description: "files to store, comma separated"
-}).option("task", z13.string(), {
+}).option("task", z16.string(), {
   default: "",
   description: "task name, when run outside its worktree"
-}).option("remove", z13.string(), {
+}).option("remove", z16.string(), {
   default: "",
   description: "files it holds to drop first, comma separated, by path or stored name"
-}).option("conversation", z13.string(), {
+}).option("conversation", z16.string(), {
   default: "",
   description: "conversation to keep the files with, when $SPLATES_CONVERSATION is not set"
-}).action(async (opts, ctx) => ctx.journal.record("attach", opts.task || await here(ctx), () => attach(ctx, commaList4(opts.files), ctx.ps.cwd(), {
+}).action(async (opts, ctx) => ctx.journal.record("attach", opts.task || await here(ctx), () => attach(ctx, commaList6(opts.files), ctx.ps.cwd(), {
   task: opts.task || undefined,
-  remove: commaList4(opts.remove),
+  remove: commaList6(opts.remove),
   conversation: opts.conversation || undefined
-}), (stored) => ({ stored, removed: commaList4(opts.remove) })));
-splates.command("retry").use(repository7({ needs: "own" })).description("give an escalated task another mergeRetryCount merge attempts and put it back to working; the way out of `budget_exhausted` that is not remove and redo, and only from escalated, so a human has seen the tree first").arg("task", z13.string(), { description: "task name" }).action((opts, ctx) => recordRetry(ctx, opts.task));
-splates.mount("artifact", splatesArtifact).mount("todo", splatesTodo).mount("lane", splatesLane).mount("projects", splatesProjects).mount("creds", splatesCreds).mount("tunnel", splatesTunnel).mount("slots", splatesSlots).mount("worker", splatesWorker).mount("queue", splatesQueue).mount("budget", splatesBudget).mount("coordinator", splatesCoordinator);
-
-// main.ts
-async function main() {
-  if (basename2(process.argv[1] ?? "") === LEGACY) {
-    legacyWarnings.once(LEGACY, "splates");
-  }
-  const ps = systemPs();
-  const { project, argv } = projectArgs(ps.args);
-  await splates.run({ fs: new NodeFs, ps, assets, project }, argv);
-}
+}), (stored) => ({ stored, removed: commaList6(opts.remove) })));
+splates.command("retry").use(repository10({ needs: "own" })).description("give a task that spent its merge attempts another mergeRetryCount of them; the way out of `budget_exhausted` that is not remove and redo, for a person to run once they have seen the tree").arg("task", z16.string(), { description: "task name" }).action((opts, ctx) => recordRetry(ctx, opts.task));
+splates.mount("artifact", splatesArtifact).mount("task", splatesTask).mount("lane", splatesLane).mount("projects", splatesProjects).mount("creds", splatesCreds).mount("tunnel", splatesTunnel).mount("slots", splatesSlots).mount("worker", splatesWorker).mount("queue", splatesQueue).mount("hook", splatesHook).mount("budget", splatesBudget);
 
 // index.ts
-await main();
+if (basename2(process.argv[1] ?? "") === LEGACY) {
+  legacyWarnings.once(LEGACY, "splates");
+}
+var ps = systemPs();
+var { project, argv } = projectArgs(ps.args);
+await splates.run({ fs: new NodeFs, ps, assets, project }, argv);