@stringsync/splates 0.0.54 → 0.0.55

package/index.js

@@ -11,10 +11,44 @@ import {
 import { assets } from "@stringsync/splates-server/server";
 import { NodeFs } from "webappwiz/system";
 
+// handoff.ts
+import { existsSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+var devMounted = { value: false };
+var CHECKOUT_BIN = join("bin", "splates");
+var CHECKOUT_ENTRY = join("packages", "splates", "checkout.ts");
+function checkoutAbove(cwd) {
+  for (let dir = resolve(cwd);; dir = dirname(dir)) {
+    if (existsSync(join(dir, CHECKOUT_BIN)) && existsSync(join(dir, CHECKOUT_ENTRY))) {
+      return dir;
+    }
+    if (dirname(dir) === dir) {
+      return null;
+    }
+  }
+}
+async function handOffDev(argv, cwd) {
+  if (devMounted.value || argv[0] !== "dev") {
+    return null;
+  }
+  const checkout = checkoutAbove(cwd);
+  if (checkout === null) {
+    console.error("splates dev is only in a splates checkout, and this directory is in none: cd into one and run its bin/splates.");
+    return 1;
+  }
+  const proc = Bun.spawn([join(checkout, CHECKOUT_BIN), ...argv], {
+    cwd,
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit"
+  });
+  return await proc.exited;
+}
+
 // splates.ts
 import { agents } from "@stringsync/splates-server/agents";
 import { attach } from "@stringsync/splates-server/artifacts";
-import { commaList as commaList6 } from "@stringsync/splates-server/comma-list";
+import { commaList as commaList5 } from "@stringsync/splates-server/comma-list";
 import { refuseGroomer as refuseGroomer4 } from "@stringsync/splates-server/conversations";
 import { exits, fail as fail9 } from "@stringsync/splates-server/exit";
 import { DEFAULT_COUNT, log as showLog } from "@stringsync/splates-server/log";
@@ -52,12 +86,12 @@ import {
   untilAfter as untilAfter3,
   wait
 } from "@stringsync/splates-server/tasks";
-import { cli as cli15 } from "webappwiz/cmd";
+import { cli as cli16 } from "webappwiz/cmd";
 import { Duration as Duration3 } from "webappwiz/time";
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 
 // artifact.ts
-import { basename, resolve } from "node:path";
+import { basename, resolve as resolve2 } from "node:path";
 import {
   addArtifact,
   listArtifacts,
@@ -186,7 +220,7 @@ splatesArtifact.command("add").use(repository({ needs: "own" })).description("ke
   }
   const id = await conversationOf(ctx.service, opts.conversation);
   const files = await Promise.all(paths.map(async (given) => {
-    const path = resolve(ctx.ps.cwd(), given);
+    const path = resolve2(ctx.ps.cwd(), given);
     const bytes = await ctx.fs.readBytes(path).catch(() => null);
     if (bytes === null) {
       fail2("usage", `cannot read ${path}: nothing was changed`, {
@@ -222,14 +256,15 @@ import { cli as cli2 } from "webappwiz/cmd";
 import { z as z3 } from "zod";
 var DEV = {
   default: "",
-  description: "the `splates server` to ask, a URL such as http://localhost:4310; by default the one an agent runs under, from SPLATES_DEV"
+  description: "the `splates server` to ask, a URL such as http://localhost:4310; by default the one an agent runs under, from SPLATES_DEV. With none answering, this machine's own budget file is read and changed"
 };
 var JSON_OPTION = { default: false, description: "emit JSON" };
 var LIMIT = z3.enum(["hour", "day", "month"]);
+var SET_LIMIT = z3.enum(["hour", "day", "month", "runners"]);
 var LIMIT_ARG = {
   description: "hour, the rate cap on what made workers running at once cost an hour; day; or month"
 };
-var splatesBudget = cli2("budget").description("what the workers a `workerProvider` makes may cost, in dollars: a rate cap per hour on those running at once ($0.25/h by default), and limits on a day ($5) and a month ($75). Past the rate cap, or once a day's or month's limit is spent, no worker is made and the queue says why; reaching the day's or month's stops made workers, whose agents stop at their checkpoint. Each warns at 80%, 90% and 100% by Web Push and on the page's header. Spend is an estimate at each type's list price. Agents' own API spend is not counted here");
+var splatesBudget = cli2("budget").description("what the workers a `workerProvider` makes may cost, in dollars: a rate cap per hour on those running at once ($1/h by default), and limits on a day ($15) and a month ($200). Past the rate cap, or once a day's or month's limit is spent, no worker is made and the queue says why; reaching the day's or month's stops made workers, whose agents stop at their checkpoint. Each warns at 80%, 90% and 100% by Web Push and on the page's header. No more than 16 runners are up at once by default, those the server made and `splates run` made together, counted from the cloud's own list; past that the queue waits for one to free. Spend is an estimate at each type's list price. Agents' own API spend is not counted here");
 splatesBudget.command("show").description("show each limit: what made workers spent in its window, of how much, and what is left").option("dev", z3.string(), DEV).option("json", z3.boolean(), JSON_OPTION).action((opts, ctx) => showBudget({
   dev: opts.dev,
   json: opts.json,
@@ -238,8 +273,10 @@ splatesBudget.command("show").description("show each limit: what made workers sp
   ps: ctx.ps,
   send: ctx.fetch
 }));
-splatesBudget.command("set").description("set a limit, in dollars (dollars an hour for hour), then show the budget").arg("limit", LIMIT, LIMIT_ARG).arg("dollars", z3.string(), {
-  description: "like 5 or 0.25, or `default` to give it back to its default"
+splatesBudget.command("set").description("set a limit, in dollars (dollars an hour for hour, a count for runners), then show the budget").arg("limit", SET_LIMIT, {
+  description: `${LIMIT_ARG.description}; or runners, the most runners up at once in the account, whoever made them (16 by default)`
+}).arg("dollars", z3.string(), {
+  description: "like 5 or 0.25 (a whole number for runners, like 16), or `default` to give it back to its default"
 }).option("dev", z3.string(), DEV).option("json", z3.boolean(), JSON_OPTION).action((opts, ctx) => setBudget({
   limit: opts.limit,
   dollars: opts.dollars,
@@ -296,7 +333,7 @@ splatesCreds.command("request").use(repository2({ needs: "own" })).description("
   default: false,
   description: "keep it for every project on this device, as for a person's own account, rather than this project alone"
 }).option("provider", z4.optional(z4.enum(PROVIDERS)), {
-  description: "who keeps it: `system`, the machine's own store, or `ssm`, AWS Parameter Store, where that is offered"
+  description: "who keeps it: `system`, the machine's own store"
 }).option("replace", z4.boolean(), {
   default: false,
   description: "ask again although one is kept, since the kept one does not work; --purpose and --instructions left off are those of the last request"
@@ -670,262 +707,256 @@ splatesQueue.command("move").use(repository6({ needs: "tasks" })).description("m
   return queueMove(ctx, opts.id, opts.position);
 });
 
-// server.ts
-import {
-  BoxShell,
-  CoordinatorBox as CoordinatorBox2,
-  coordinatorMoved,
-  deployKey,
-  machineMove,
-  neededCreds
-} from "@stringsync/splates-server/coordinator";
+// replica.ts
+import { dirname as dirname2 } from "node:path";
+import { loadConfig as loadConfig2 } from "@stringsync/splates-server/config";
 import { SYSTEM_STORES as SYSTEM_STORES2 } from "@stringsync/splates-server/creds";
+import { fail as fail5 } from "@stringsync/splates-server/exit";
+import { Projects } from "@stringsync/splates-server/projects";
+import {
+  FORMAT,
+  ProjectHome,
+  repository as repository7
+} from "@stringsync/splates-server/records";
+import {
+  openReplica,
+  REPLICA_ACCESS_KEY,
+  REPLICA_SECRET_KEY,
+  Replicator,
+  restoreFromReplica,
+  statusLines
+} from "@stringsync/splates-server/replica";
+import { cli as cli8 } from "webappwiz/cmd";
+import { Credentials } from "webappwiz/creds";
+import { z as z9 } from "zod";
+var splatesReplica = cli8("replica").description("the copy of this project's records `splates server` keeps a few seconds behind every change, in the bucket or folder `replica` names in splates.config.ts");
+splatesReplica.command("status").use(repository7({ needs: "read" })).description("print where the replica is, when it last held every change, how many changes wait to reach it and since when, and why it is failing if it is; as of the server's last batch, so it reads the same with the server stopped").option("json", z9.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => {
+  const status = await Replicator.recorded(ctx.storage);
+  if (opts.json) {
+    ctx.log.info(JSON.stringify(status));
+    return;
+  }
+  ctx.log.info(statusLines(status, ctx.config.replica !== null, Date.now()).join(`
+`));
+});
+splatesReplica.command("restore").description("with `splates server` stopped, rebuild this project's records from the replica `replica` names in splates.config.ts, adopting its origin so the server started on them replicates on into it: how a server moves to another machine or comes back after its box is lost. Stops when the project already has records here, unless --force leaves them aside as state.db.moved. The roster and Auto pick rules are not in the replica; set them up again. A bucket's REPLICA_ACCESS_KEY and REPLICA_SECRET_KEY must be filled on this machine first").option("force", z9.boolean(), {
+  default: false,
+  description: "restore over the records here, leaving them aside"
+}).action(async (opts, ctx) => {
+  const root = await mainTree(ctx);
+  const projects = Projects.ofMachine(ctx);
+  const home = new ProjectHome(root, { ...ctx, projects });
+  const stores = ctx.secrets ?? SYSTEM_STORES2;
+  const credentials = new Credentials([
+    await stores.project(root),
+    stores.device
+  ]);
+  const config = await loadConfig2(root, { fs: ctx.fs });
+  if (config.replica === null) {
+    fail5("usage", "no replica: name one as `replica` in splates.config.ts first");
+  }
+  const replica = openReplica(config.replica, {
+    root,
+    fs: ctx.fs,
+    creds: {
+      credentials,
+      request: async () => {
+        throw new Error(`fill ${REPLICA_ACCESS_KEY} and ${REPLICA_SECRET_KEY} with \`wiz creds\` first`);
+      }
+    }
+  });
+  try {
+    const done = await restoreFromReplica(replica, {
+      target: home,
+      fs: ctx.fs,
+      format: FORMAT,
+      force: opts.force
+    });
+    ctx.log.info([
+      `restored ${done.values} record(s) and ${done.logs} log(s) from ${replica.name}, last caught up on ${done.host}`,
+      ...done.replaced === null ? [] : [`the records here went aside as ${done.replaced}`],
+      `project: ${root} (register its checkout with \`splates init\` if it is new on this machine)`,
+      "start `splates server` to serve it and replicate on"
+    ].join(`
+`));
+  } catch (error) {
+    fail5("usage", error instanceof Error ? error.message : String(error));
+  }
+});
+splatesReplica.command("retire").use(repository7({ needs: "own" })).description("after the server moved elsewhere (stop it and check `splates replica status` says caught up first), leave this project's records aside as state.db.moved, so a splates run here finds no stale records and says where the server went").arg("to", z9.string(), {
+  description: "where the server went, as `droplet.example.com`"
+}).action(async (opts, ctx) => {
+  const home = new ProjectHome(ctx.git.root, ctx);
+  ctx.dispose();
+  const aside = await home.moveAside(opts.to);
+  ctx.log.info(`records left aside as ${aside}; the server is at ${opts.to}`);
+});
+async function mainTree(ctx) {
+  const { exitCode, stdout } = await ctx.ps.spawnCapture([
+    "git",
+    "-C",
+    ctx.ps.cwd(),
+    "rev-parse",
+    "--path-format=absolute",
+    "--git-common-dir"
+  ]);
+  if (exitCode !== 0) {
+    fail5("usage", `not a git repository: ${ctx.ps.cwd()}`);
+  }
+  return dirname2(stdout.trim());
+}
+
+// runners.ts
+import { join as join2 } from "node:path";
+import { loadConfig as loadConfig3 } from "@stringsync/splates-server/config";
 import { fail as fail6 } from "@stringsync/splates-server/exit";
+import { splatesHome as splatesHome2 } from "@stringsync/splates-server/models";
 import {
-  DEFAULT_PORT,
-  RUNNING,
-  serveDev
+  REAPER_FILE,
+  withRunners
 } from "@stringsync/splates-server/server";
-import { LOCAL_SLOTS } from "@stringsync/splates-server/workers";
+import {
+  DIRECT_IDLE,
+  NoRunner,
+  parseTimeout,
+  runnerServe,
+  sizeLabel
+} from "@stringsync/splates-server/workers";
 import { cli as cli9 } from "webappwiz/cmd";
+import { sleep } from "webappwiz/time";
 import { z as z10 } from "zod";
-
-// infra.ts
-import { resolve as resolve2 } from "node:path";
-import { commaList as commaList4 } from "@stringsync/splates-server/comma-list";
-import {
-  ACCESS_ENVIRONMENT,
-  accessEnvironmentExists,
-  CoordinatorBox,
-  pulumiOrg,
-  writeInfraConfig
-} from "@stringsync/splates-server/coordinator";
-import { fail as fail5 } from "@stringsync/splates-server/exit";
-import { infraConfigure } from "@stringsync/splates-server/infra/configure";
-import { secretsEnvironmentUrl } from "@stringsync/splates-server/infra/secrets";
-import { Projects } from "@stringsync/splates-server/projects";
-import { repository as repository7 } from "@stringsync/splates-server/records";
-import { savedTunnelOf } from "@stringsync/splates-server/server";
-import { FsStorage as FsStorage2 } from "@stringsync/splates-server/storage";
-import { cli as cli8 } from "webappwiz/cmd";
-import { z as z9 } from "zod";
-var splatesInfra = cli8("infra").description("the Pulumi project that makes everything the server's box needs in AWS, Cloudflare and GitHub, which `splates server deploy` then installs splates on");
-splatesInfra.command("init").use(repository7({ needs: "own" })).description("write a Pulumi project in <dir>, its program a dozen lines using the components of @stringsync/splates-server/infra, and the stack's config from the flags; run again, it writes only what is not so already and keeps values you changed. It fills the stack's config from what splates keeps (the projects, the saved tunnel, the Cloudflare ids). The secrets never pass through splates: it makes the Pulumi ESC environment splates/secrets with a placeholder for each (the Cloudflare token, a GitHub token per owner, the Anthropic key), which the stack imports and the user replaces on the Pulumi site; `splates setup` has a step for each saying how to get it. When the Pulumi ESC environment `coordinator-access` makes (splates/aws) is there, the stack imports it. It records the directory in ~/.splates/coordinator/infra.json, where `splates server deploy` finds the stack. Its runtime is bun, which runs the program's TypeScript itself. Commit the project but not Pulumi.<stack>.yaml, which holds your own accounts and ids and which the .gitignore it writes keeps out of git; init writes it again from what splates keeps. Then `bun add @stringsync/splates-server @pulumi/pulumi @pulumi/aws @pulumi/awsx @pulumi/cloudflare @pulumi/github @pulumi/tls @pulumi/random` there and `pulumi up`").arg("dir", z9.string(), { description: "where the Pulumi project goes" }).option("stack", z9.string(), { default: "prod", description: "the stack" }).option("host", z9.string(), {
-  default: "",
-  description: "the public host name, as in splates.example.com; the saved tunnel's by default"
-}).option("email", z9.string(), {
+var splatesRunners = cli9("runners").description(`the runners \`splates run\` makes for itself in the project's cloud (\`cloud\` in splates.config.ts) when \`splates server\` has none for it: each takes as many commands at once as fit in its CPUs and memory, another is made when none has room, within \`splates budget\`, and each is deleted once idle ${DIRECT_IDLE.mins} minutes`);
+splatesRunners.command("list").description("list them: name, size and price, the address Fly's proxy reaches them at, and busy, idle, or the machine's state").option("json", z10.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => {
+  const runners = await opened(ctx, (each) => each.list());
+  if (opts.json) {
+    ctx.log.info(JSON.stringify(runners));
+    return;
+  }
+  ctx.log.info(runners.length === 0 ? "no runner is up" : runners.map(runnerLine).join(`
+`));
+});
+splatesRunners.command("reap").description(`delete each runner idle ${DIRECT_IDLE.mins} minutes or more, every idle one once the budget's day or month is spent, and any that never booted; with --watch, again every so often for as long as any is up, which \`splates run\` leaves running behind it, one on this machine at a time, so none is left running unused`).option("watch", z10.string(), {
   default: "",
-  description: "the email address Access lets in; the tunnel's Access application's by default"
-}).option("region", z9.string(), {
-  default: "us-east-1",
-  description: "the AWS region"
-}).option("projects", z9.string(), {
+  description: "how long to wait before each look, as 10m or 90s, looking again for as long as any runner is up"
+}).option("idle", z10.string(), {
   default: "",
-  description: "comma-separated slug=owner/repo, each a project the box pushes trunk of; every project registered here with a GitHub origin by default"
+  description: `how long a runner must have stood idle, as 10m or 0s; ${DIRECT_IDLE.mins}m by default`
 }).action(async (opts, ctx) => {
-  const listed = commaList4(opts.projects).map((entry) => {
-    const [slug, repository] = entry.split("=");
-    if (!slug || !repository?.includes("/")) {
-      fail5("usage", `--projects wants slug=owner/repo, not ${entry}`, {
-        entry
-      });
-    }
-    return { slug, repository };
-  });
-  const org = await pulumiOrg(ctx.ps);
-  const home = new CoordinatorBox({ ps: ctx.ps, fs: ctx.fs }).home;
-  const { written, todo } = await infraConfigure({
-    dir: opts.dir,
-    stack: opts.stack,
-    host: opts.host,
-    email: opts.email,
-    region: opts.region,
-    projects: listed.length === 0 ? null : listed,
-    registered: async () => (await Projects.in(new FsStorage2(home, ctx.fs), ctx.fs).list()).filter((project) => !project.gone),
-    creds: ctx.creds,
-    saved: savedTunnelOf(ctx),
-    ...org !== null && await accessEnvironmentExists(ctx.ps, org) ? { environment: ACCESS_ENVIRONMENT } : {},
-    fs: ctx.fs,
-    ps: ctx.ps,
-    log: ctx.log,
-    fetch: ctx.fetch
-  });
-  await writeInfraConfig(ctx.fs, home, {
-    dir: resolve2(opts.dir),
-    stack: opts.stack
-  });
-  ctx.log.info(written.length === 0 ? "already so: nothing written" : `wrote ${written.join(", ")}`);
-  ctx.log.info(`Pulumi.${opts.stack}.yaml stays out of git: it holds your own accounts and ids, and init writes it again from what splates keeps`);
-  for (const command of todo) {
-    ctx.log.info(`still to run in ${opts.dir}: ${command}`);
+  const idle = opts.idle === "" ? DIRECT_IDLE : lengthOf(opts.idle);
+  if (opts.watch === "") {
+    const reaped = await opened(ctx, (each) => each.reap(idle));
+    ctx.log.info(reaped.length === 0 ? "nothing to reap" : reaped.map((line) => `deleted ${line}`).join(`
+`));
+    return;
+  }
+  if (!await watching(ctx)) {
+    return;
   }
-  if (org !== null) {
-    ctx.log.info(`paste each secret over its placeholder at ${secretsEnvironmentUrl(org)}: \`splates setup\` has a step for each saying how to get it`);
+  const every = lengthOf(opts.watch);
+  for (;; ) {
+    await sleep(every);
+    const left = await opened(ctx, async (each) => {
+      await each.reap(idle);
+      return (await each.list()).length;
+    });
+    if (left === 0) {
+      return;
+    }
   }
 });
+async function watching(ctx) {
+  const file = reaperFile(ctx);
+  const held = Number((await ctx.fs.read(file).catch(() => "")).trim());
+  if (Number.isInteger(held) && held > 0 && held !== process.pid && ctx.ps.alive(held)) {
+    return false;
+  }
+  await ctx.fs.write(file, String(process.pid));
+  return true;
+}
+async function opened(ctx, use) {
+  const { stdout, exitCode } = await ctx.ps.spawnCapture([
+    "git",
+    "rev-parse",
+    "--show-toplevel"
+  ]);
+  if (exitCode !== 0) {
+    fail6("usage", "run it in a splates project", {});
+  }
+  const { cloud } = await loadConfig3(stdout.trim(), { fs: ctx.fs });
+  if (cloud === null) {
+    fail6("no_runner", "this project names no `cloud` in splates.config.ts, so `splates run` makes no runners", {});
+  }
+  try {
+    return await withRunners(ctx, cloud, use);
+  } catch (error) {
+    if (error instanceof NoRunner) {
+      fail6("no_runner", error.message, {});
+    }
+    throw error;
+  }
+}
+function lengthOf(text) {
+  return parseTimeout(text) ?? fail6("usage", `${text} is no length of time: name one as 10m or 90s`, {});
+}
+function runnerLine(runner) {
+  const size = runner.size === null ? runner.type : sizeLabel(runner.size, ...runner.dollarsPerHour === null ? [] : [runner.dollarsPerHour]);
+  return `${runner.id}  ${size}  ${runner.address ?? "no address yet"}  ${runner.state}`;
+}
+function reaperFile(ctx) {
+  return join2(splatesHome2(ctx.ps), REAPER_FILE);
+}
+splatesRunners.command("serve").description("serve only job channels at /api/jobs over authenticated WebSockets; for the runner image, with SPLATES_RUNNER_SECRET from its hosting environment").option("port", z10.coerce.number().int().min(0).max(65535), {
+  default: 8080,
+  description: "HTTP port behind the hosting proxy"
+}).action(({ port }, { ps }) => runnerServe({ port, ps }));
 
 // server.ts
-var splatesServer = cli9("server").description("the splates server: run it on this machine, or deploy it to an always-on box in your own AWS account, which the Pulumi project `splates server infra init` writes makes, reached by SSH alone").fallback("run");
-splatesServer.command("run").description("serve every splates project on this machine as a web page, from wherever it is run: the page picks the project it shows, adds one by its path, running `splates init` there, and shows its queued and started tasks, where queued tasks can be added, updated, reordered or removed; it brings each project's records forward as it opens it. A server that crashes starts again after 2s, then 4s, 8s and 16s, and is left down after five crashes in a row that each came within a minute of its start").option("port", z10.coerce.number(), {
+import {
+  DEFAULT_PORT,
+  serveDev
+} from "@stringsync/splates-server/server";
+import { cli as cli10 } from "webappwiz/cmd";
+import { z as z11 } from "zod";
+var splatesServer = cli10("server").description("the splates server: run it on this machine").fallback("run");
+splatesServer.command("run").description("serve every splates project on this machine as a web page, from wherever it is run: the page picks the project it shows, adds one by its path, running `splates init` there, and shows its queued and started tasks, where queued tasks can be added, updated, reordered or removed; it brings each project's records forward as it opens it. A server that crashes starts again after 2s, then 4s, 8s and 16s, and is left down after five crashes in a row that each came within a minute of its start").option("port", z11.coerce.number(), {
   default: DEFAULT_PORT,
   description: "port to listen on, or the next open one above it"
-}).option("allow-hosts", z10.string(), {
+}).option("allow-hosts", z11.string(), {
   default: "",
   description: "comma-separated host names the page may also be reached by, like a tunnel's; put Cloudflare Access in front of them with --access-team and --access-aud"
-}).option("access-team", z10.string(), {
+}).option("access-team", z11.string(), {
   default: "",
   description: "the Cloudflare Access team in front of --allow-hosts, as in <team>.cloudflareaccess.com; with --access-aud, those hosts answer only to a verified Access token, and may then use conversations and terminals"
-}).option("access-aud", z10.string(), {
+}).option("access-aud", z11.string(), {
   default: "",
   description: "the AUD tag of that Access application"
-}).option("tunnel", z10.string(), {
+}).option("tunnel", z11.string(), {
   default: "",
   description: "the public host name of a tunnel to run, with cloudflared or the tunnel provider named by splates.config.ts in the repository it is run in, if any, which is allowed as a host too; refused without --access-team and --access-aud, so a tunnel never exposes the page unauthenticated. With none of the tunnel and Access flags, the tunnel `splates tunnel setup` saved runs, if any"
-}).option("tunnel-name", z10.string(), {
+}).option("tunnel-name", z11.string(), {
   default: "",
   description: "the named tunnel cloudflared runs for --tunnel, by default the one its own config names; not with a tunnel provider of splates.config.ts"
-}).option("ports-host", z10.string(), {
+}).option("ports-host", z11.string(), {
   default: "",
   description: "the wildcard base host to serve task ports under, saved for this machine so a bare `splates server` serves it too: each port a task's processes listen on opens at https://<task>-<port>.<base>, to whoever Cloudflare Access lets in, and is refused without Access; routing *.<base> here, its DNS and TLS, are yours. `none` forgets it, leaving each task port forwarded to a port on this machine's loopback alone"
-}).option("worker-slots", z10.coerce.number().int().min(1), {
-  default: LOCAL_SLOTS,
-  description: "how many agents that other agents started (with `splates add --agent`, or a lane's orchestrator handing out tasks) this machine's worker runs at once; past them, each new or resumed one waits in the queue, first come, first served, which `splates worker queue` shows and reorders. An agent you start runs at once on any worker up, taking no slot. Read as the server starts its worker, which a restart from the page leaves running"
-}).option("keepalive", z10.boolean(), {
+}).option("keepalive", z11.boolean(), {
   default: false,
   description: "keep a machine left to serve awake while the server runs: on macOS with `caffeinate`, on power or idle, though closing a laptop's lid still sleeps it; on Linux with a systemd-inhibit lock on sleep and idle, which the server serves on without, saying so, where systemd is missing or refuses it. Refused on other platforms"
-}).option("slot", z10.boolean(), {
+}).option("slot", z11.boolean(), {
   default: false,
   description: "serve this checkout's splates at https://<word>.<zone>, a slot of its own on the zone `splates tunnel setup` uses, behind the same Access policy, so several run side by side and a phone opens each by name: a task's worktree keeps its word, as fox, until the task merges or is removed, which stops its server; run again, it stops the tree's last server first. Refused in a splates repository's main tree, which every agent shares. A slot keeps its own projects in ~/.splates/slots/<word>, apart from yours, starting with a throwaway project there; not with the tunnel and Access flags"
 }).action((opts, ctx) => serveDev(ctx, opts));
-splatesServer.mount("infra", splatesInfra);
-splatesServer.command("deploy").description("deploy the server to the box its Pulumi stack made (`splates server infra init`, then `pulumi up`), over SSH, with splates of this release installed for the user splates. The SSH key and the host key come from the stack and the instance's console. It checks what the deploy needs, brings the box's splates to this release, and exits `blocked`, naming each, until the box's Parameter Store holds the creds the stack should have put there; then gives each project a clone there with its deploy key from Parameter Store. Then it asks every agent of this machine's `splates server` to checkpoint and stops it, carries the server's records (no creds: the box reads its own through its instance role) to the box, starts `splates server` there for good under systemd, and joins this machine to it as a worker, kept up by a LaunchAgent, where each task carries on in its worktree here. This machine's records go aside, kept, and its `splates` reaches the box from then on. Run again once the server runs on the box, it brings the box's splates to this release and restarts it there").option("dry-run", z10.boolean(), {
-  default: false,
-  description: "stop once the box is ready, before this machine's server stops or anything here changes; once the server runs on the box, change nothing"
-}).option("dev", z10.string(), {
-  default: `http://localhost:${DEFAULT_PORT}`,
-  description: "this machine's `splates server`, which the deploy stops"
-}).action(async (opts, ctx) => {
-  const moved = await machineMove({
-    ps: ctx.ps,
-    fs: ctx.fs,
-    log: ctx.log,
-    version: RUNNING,
-    dev: opts.dev,
-    stores: ctx.secrets ?? SYSTEM_STORES2,
-    ...ctx.fetch === undefined ? {} : { fetch: ctx.fetch }
-  }).run({ dryRun: opts["dry-run"] });
-  if (moved.status === "blocked") {
-    fail6("blocked", [
-      "The box's Parameter Store lacks these. Set each (the Pulumi stack makes them: `pulumi up`), then deploy again:",
-      ...moved.needs.map((name) => `  ${name}`)
-    ].join(`
-`), { needs: moved.needs });
-  }
-  if (moved.status === "deployed") {
-    ctx.log.info(`the server runs on the box at ${moved.ipv4}: deploy again without --dry-run to bring it to ${moved.version}`);
-    return;
-  }
-  if (moved.status === "updated") {
-    ctx.log.info(`the server on the box at ${moved.ipv4} runs ${moved.version} now`);
-    return;
-  }
-  if (moved.status === "ready") {
-    ctx.log.info(`the box is ready to serve ${moved.projects.join(", ")} through ${moved.host}: deploy again without --dry-run`);
-    return;
-  }
-  ctx.log.info([
-    `the server runs on the box: https://${moved.host}`,
-    `this machine is its worker ${ctx.ps.hostname}, kept up by ${moved.worker}`,
-    `its own records are kept aside in ${moved.aside} and each project's .git/splates.moved`
-  ].join(`
-`));
-});
-splatesServer.command("status").description("print where the server runs, here or deployed to its box, and the box as its cloud has it").option("json", z10.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => {
-  const deployed = await coordinatorMoved({
-    fs: ctx.fs,
-    ps: ctx.ps,
-    home: box(ctx).home
-  });
-  const standing = await box(ctx).status();
-  if (opts.json) {
-    ctx.log.info(JSON.stringify({ deployed, box: standing }));
-    return;
-  }
-  ctx.log.info([
-    `runs:     ${deployed ? "on the box" : "on this machine"}`,
-    ...standing === null ? [
-      "box:      none: `splates server infra init` writes the Pulumi project, `pulumi up` there makes it"
-    ] : [
-      `address:  ${standing.ipv4}`,
-      `instance: ${standing.instanceId} (role ${standing.roleName})`,
-      `host:     ${standing.host}`,
-      "ssh:      splates server ssh"
-    ]
-  ].join(`
-`));
-});
-splatesServer.command("ssh").description("open a root shell on the box over SSH, with the key its Pulumi stack made, or run the command given there").rest("command", z10.string(), {
-  description: "what to run on the box; by default a shell"
-}).passThroughOptions().action(async (opts, ctx) => {
-  const standing = await box(ctx).status();
-  if (standing === null) {
-    fail6("not_found", "no box: `splates server infra init` writes the Pulumi project, `pulumi up` there makes it");
-  }
-  const { exitCode } = await ctx.ps.spawn(shell(ctx, standing).login(opts.command));
-  ctx.ps.exit(exitCode);
-});
-splatesServer.command("destroy").description("unmake the box and everything its Pulumi stack made (its role, snapshots, creds, tunnel and deploy keys), lifting the box's termination protection first: anything only on the box is lost. The stack and its config stay, so the setup's Make the box step, or `splates server deploy`, makes it again. Without --yes, says what it would destroy").option("yes", z10.boolean(), {
-  default: false,
-  description: "destroy without asking"
-}).action(async (opts, ctx) => {
-  const infra = await box(ctx).infra();
-  if (infra === null) {
-    fail6("not_found", "no infra project here: nothing to destroy, since `splates server infra init` has not written one");
-  }
-  const standing = await box(ctx).status();
-  const what = standing === null ? `what the stack in ${infra.dir} made` : `the box at ${standing.ipv4} (${standing.instanceId}) and everything the stack in ${infra.dir} made`;
-  if (!opts.yes) {
-    fail6("usage", `this destroys ${what}, and anything only on the box is lost: run again with --yes`, { dir: infra.dir, box: standing });
-  }
-  ctx.log.info(`Destroying ${what}, a few minutes…`);
-  await box(ctx).destroy();
-  ctx.log.info("Destroyed. The stack and its config stay for making it again.");
-});
-splatesServer.command("needs").description("kept for `splates server deploy`, which runs it on the box: print the name of each cred this box's store lacks of those the server needs, one per line").rest("roots", z10.string(), {
-  description: "each project's clone on this machine"
-}).action(async (opts, ctx) => {
-  const missing = await neededCreds(ctx.secrets ?? SYSTEM_STORES2, opts.roots);
-  for (const name of missing) {
-    ctx.log.info(name);
-  }
-});
-splatesServer.command("deploy-key").description("kept for `splates server deploy`, which runs it on the box: print the deploy key of the project whose clone is <root>").arg("root", z10.string(), {
-  description: "the project's clone on this machine"
-}).action(async (opts, ctx) => {
-  const key = await deployKey(ctx.secrets ?? SYSTEM_STORES2, opts.root);
-  if (key === undefined) {
-    fail6("not_found", `no deploy key kept for ${opts.root}`);
-  }
-  ctx.log.info(key);
-});
-function box(ctx) {
-  return new CoordinatorBox2({ ps: ctx.ps, fs: ctx.fs });
-}
-function shell(ctx, standing) {
-  return new BoxShell({
-    ps: ctx.ps,
-    ipv4: standing.ipv4,
-    key: standing.key,
-    knownHosts: `${box(ctx).home}/coordinator/known_hosts`
-  });
-}
 
 // setup.ts
-import { dirname } from "node:path";
+import { dirname as dirname3 } from "node:path";
 import { SYSTEM_STORES as SYSTEM_STORES3 } from "@stringsync/splates-server/creds";
 import { fail as fail7 } from "@stringsync/splates-server/exit";
-import { splatesHome as splatesHome2 } from "@stringsync/splates-server/models";
+import { splatesHome as splatesHome3 } from "@stringsync/splates-server/models";
 import { Projects as Projects2 } from "@stringsync/splates-server/projects";
+import {
+  openRepository
+} from "@stringsync/splates-server/records";
+import { Replicator as Replicator2 } from "@stringsync/splates-server/replica";
 import {
   SETUP_AREAS,
   Setup,
@@ -990,7 +1021,7 @@ async function setupOf(deps) {
   return new Setup({
     fs,
     ps,
-    home: splatesHome2(ps),
+    home: splatesHome3(ps),
     device: secrets.device,
     fetch,
     workers: deps.ps.env("SPLATES_DEV") ? () => fetchWorkers({ dev: "", log: deps.log, ps: deps.ps }) : undefined,
@@ -1002,9 +1033,20 @@ async function setupOf(deps) {
         ps: deps.ps
       })
     } : undefined,
-    project: root === null ? undefined : setupProjectAt(root, { fs, ps })
+    project: root === null ? undefined : setupProjectAt(root, { fs, ps }, {
+      replica: () => withRecords(deps, root, ({ storage }) => Replicator2.recorded(storage)),
+      kept: (name) => withRecords(deps, root, async ({ creds }) => await creds.credentials.get(name) !== undefined)
+    })
   }, SETUP_AREAS);
 }
+async function withRecords(deps, root, read) {
+  const records = await openRepository(deps, { at: root });
+  try {
+    return await read(records);
+  } finally {
+    records.dispose();
+  }
+}
 async function repoRoot(ps) {
   const { exitCode, stdout } = await ps.spawnCapture([
     "git",
@@ -1014,7 +1056,7 @@ async function repoRoot(ps) {
     "--path-format=absolute",
     "--git-common-dir"
   ]);
-  return exitCode === 0 ? dirname(stdout.trim()) : null;
+  return exitCode === 0 ? dirname3(stdout.trim()) : null;
 }
 var MARKS = {
   done: color2.green("✓"),
@@ -1091,10 +1133,10 @@ function printUndo(log, plan) {
 
 // slots.ts
 import { Slots } from "@stringsync/splates-server/ports";
-import { cli as cli10 } from "webappwiz/cmd";
-import { z as z11 } from "zod";
-var splatesSlots = cli10("slots").description("the words `splates server --slot` hands out on this machine, each held by the tree that claimed it: a task's worktree holds its word until the task merges or is removed, which stops its server and gives the word back");
-splatesSlots.command("list").description("print each claimed word, the tree holding it, its server's pid while one runs, and whether it is orphaned: its tree gone, or a splates repository's main tree, which every agent shares").option("json", z11.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => {
+import { cli as cli11 } from "webappwiz/cmd";
+import { z as z12 } from "zod";
+var splatesSlots = cli11("slots").description("the words `splates server --slot` hands out on this machine, each held by the tree that claimed it: a task's worktree holds its word until the task merges or is removed, which stops its server and gives the word back");
+splatesSlots.command("list").description("print each claimed word, the tree holding it, its server's pid while one runs, and whether it is orphaned: its tree gone, or a splates repository's main tree, which every agent shares").option("json", z12.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => {
   const held = await Slots.ofMachine(ctx).status();
   if (opts.json) {
     ctx.log.info(JSON.stringify(held.map(({ slot, tree, pid, orphaned }) => ({
@@ -1137,7 +1179,7 @@ import {
   tasksNamed as tasksNamed2,
   taskUpdate
 } from "@stringsync/splates-server/board";
-import { commaList as commaList5 } from "@stringsync/splates-server/comma-list";
+import { commaList as commaList4 } from "@stringsync/splates-server/comma-list";
 import { refuseGroomer as refuseGroomer3 } from "@stringsync/splates-server/conversations";
 import { fail as fail8 } from "@stringsync/splates-server/exit";
 import { repository as repository8 } from "@stringsync/splates-server/records";
@@ -1146,10 +1188,10 @@ import {
   taskWait,
   untilAfter as untilAfter2
 } from "@stringsync/splates-server/tasks";
-import { cli as cli11 } from "webappwiz/cmd";
+import { cli as cli12 } from "webappwiz/cmd";
 import { Duration as Duration2 } from "webappwiz/time";
-import { z as z12 } from "zod";
-var splatesTask = cli11("task").description("the numbered tasks: defer work for later instead of growing the task you are in, and `splates add <slug> --task <n>` starts one; `merge` recommends the next one when a task lands. The person puts tasks in `splates queue`, for workers to start");
+import { z as z13 } from "zod";
+var splatesTask = cli12("task").description("the numbered tasks: defer work for later instead of growing the task you are in, and `splates add <slug> --task <n>` starts one; `merge` recommends the next one when a task lands. The person puts tasks in `splates queue`, for workers to start");
 async function projectFrom(ctx) {
   if (ctx.elsewhere === null) {
     return;
@@ -1157,31 +1199,29 @@ async function projectFrom(ctx) {
   return (await ctx.projects.list()).find((each) => each.root === ctx.git.root)?.slug;
 }
 function adding(name, description, ready) {
-  splatesTask.command(name).use(repository8({ needs: "queue" })).description(description).arg("subject", z12.string(), {
+  splatesTask.command(name).use(repository8({ needs: "queue" })).description(description).arg("subject", z13.string(), {
     description: "what is left to do, in a line"
-  }).arg("text", z12.string(), {
+  }).arg("text", z13.string(), {
     default: "",
     description: "whatever more there is to say about it, in markdown"
-  }).option("slug", z12.string(), {
+  }).option("slug", z13.string(), {
     description: "a short name for the task that takes it (lowercase-with-dashes), naming its branch, worktree and conversation: a few words for what it changes, not the subject cut short"
   }).option("position", position, {
     description: "where it goes in the list, 1 at the top, pushing those from there down (default: the bottom)"
-  }).option("file", z12.string(), {
-    default: "",
-    description: "files to attach, comma separated: copied under .git/splates/tasks/<n>/"
-  }).option("blocked-by", z12.string(), {
-    default: "",
-    description: "numbers of the tasks blocking it, comma separated: each has to merge before this one starts"
-  }).option("lane", z12.string(), {
+  }).repeated("file", z13.string(), {
+    description: "files to attach, comma separated or the flag repeated: copied under .git/splates/tasks/<n>/"
+  }).repeated("blocked-by", z13.string(), {
+    description: "numbers of the tasks blocking it, comma separated or the flag repeated: each has to merge before this one starts"
+  }).option("lane", z13.string(), {
     default: "",
     description: "the lane it goes in, at the bottom: a lane's number, `backlog` for the permanent catch-all, or `new` for one of its own (default: none, untriaged)"
-  }).option("agent", z12.string(), {
+  }).option("agent", z13.string(), {
     default: "",
     description: "the agent on the roster (`splates agents`) that should work it, which Start on the `splates server` board offers first"
-  }).option("model", z12.string(), {
+  }).option("model", z13.string(), {
     default: "",
     description: "with --agent: the model, by its id or name on the roster"
-  }).option("effort", z12.string(), {
+  }).option("effort", z13.string(), {
     default: "",
     description: "with --agent: the thinking level, one the agent offers (default: the agent's own)"
   }).action(async (opts, ctx) => {
@@ -1199,8 +1239,8 @@ function adding(name, description, ready) {
       slug: opts.slug,
       text: opts.text,
       position: opts.position,
-      files: commaList5(opts.file),
-      blockedBy: taskIds(opts["blocked-by"]),
+      files: commaList4(opts.file.join(",")),
+      blockedBy: taskIds(opts["blocked-by"].join(",")),
       lane: laneIn(opts.lane) ?? null,
       assignee,
       origin,
@@ -1211,10 +1251,10 @@ function adding(name, description, ready) {
 }
 adding("add", "queue a task to do later and move on, groomed, so it goes in ready: you checked no task already asks it, and linked what blocks it; run from a worktree, it records the task it came up in", true);
 adding("defer", "queue a task as it is, rough, in the backlog for whoever grooms it: to check for one that already asks it, link what blocks it, and mark it ready; run from a worktree, it records the task it came up in", false);
-splatesTask.command("list").use(repository8({ needs: "read" })).description("every queued task, top of the list first, with the task it came from and the started one that took it up").option("json", z12.boolean(), { default: false, description: "emit JSON" }).option("open", z12.boolean(), {
+splatesTask.command("list").use(repository8({ needs: "read" })).description("every queued task, top of the list first, with the task it came from and the started one that took it up").option("json", z13.boolean(), { default: false, description: "emit JSON" }).option("open", z13.boolean(), {
   default: false,
   description: "only tasks no started one has taken up: the ones free to pick up"
-}).option("ready", z12.boolean(), {
+}).option("ready", z13.boolean(), {
   default: false,
   description: "only tasks free to start now: none has taken them, and nothing blocking them is still open"
 }).action(async (opts, ctx) => taskList(ctx, {
@@ -1223,53 +1263,49 @@ splatesTask.command("list").use(repository8({ needs: "read" })).description("eve
   ready: opts.ready,
   project: await projectFrom(ctx)
 }));
-splatesTask.command("show").use(repository8({ needs: "read" })).description("one task in full: where it stands, its files, and its detail").arg("id", z12.coerce.number().int().positive(), { description: "task number" }).option("json", z12.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => taskShow(ctx, opts.id, {
+splatesTask.command("show").use(repository8({ needs: "read" })).description("one task in full: where it stands, its files, and its detail").arg("id", z13.coerce.number().int().positive(), { description: "task number" }).option("json", z13.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => taskShow(ctx, opts.id, {
   json: opts.json,
   project: await projectFrom(ctx),
   others: (await ctx.projects.list()).filter((project) => project.root !== ctx.git.root).map((project) => project.slug)
 }));
-splatesTask.command("update").use(repository8({ needs: "tasks" })).description("say what a queued task is in other words, move it up or down the list, or attach and drop files; it keeps its number").arg("id", z12.coerce.number().int().positive(), { description: "task number" }).arg("text", z12.string(), {
+splatesTask.command("update").use(repository8({ needs: "tasks" })).description("say what a queued task is in other words, move it up or down the list, or attach and drop files; it keeps its number").arg("id", z13.coerce.number().int().positive(), { description: "task number" }).arg("text", z13.string(), {
   default: "",
   description: "whatever more there is to say about it, in markdown; leave out to keep the detail"
-}).option("subject", z12.string(), {
+}).option("subject", z13.string(), {
   default: "",
   description: "what is left to do, in a line; leave out to keep it"
-}).option("slug", z12.string(), {
+}).option("slug", z13.string(), {
   default: "",
   description: "a new name for the task that takes it (lowercase-with-dashes); leave out to keep it"
 }).option("position", position, {
   description: "where to move it in the list, 1 at the top; the others close up around it"
-}).option("file", z12.string(), {
-  default: "",
-  description: "files to attach, comma separated"
-}).option("remove-file", z12.string(), {
-  default: "",
-  description: "attached files to drop, comma separated, by path or stored name"
-}).option("blocked-by", z12.string(), {
-  default: "",
-  description: "numbers of more tasks blocking it, comma separated: each has to merge before this one starts; refused when that makes a loop"
-}).option("remove-blocked-by", z12.string(), {
-  default: "",
-  description: "numbers of tasks no longer blocking it, comma separated"
-}).option("lane", z12.string(), {
+}).repeated("file", z13.string(), {
+  description: "files to attach, comma separated or the flag repeated"
+}).repeated("remove-file", z13.string(), {
+  description: "attached files to drop, comma separated or the flag repeated, by path or stored name"
+}).repeated("blocked-by", z13.string(), {
+  description: "numbers of more tasks blocking it, comma separated or the flag repeated: each has to merge before this one starts; refused when that makes a loop"
+}).repeated("remove-blocked-by", z13.string(), {
+  description: "numbers of tasks no longer blocking it, comma separated or the flag repeated"
+}).option("lane", z13.string(), {
   default: "",
   description: "move it to a lane, at the bottom: a lane's number, `backlog` for the permanent catch-all, `new` for one of its own, or `none` for untriaged"
-}).option("agent", z12.string(), {
+}).option("agent", z13.string(), {
   default: "",
   description: "the agent on the roster (`splates agents`) that should work it, which Start on the `splates server` board offers first, or `none`"
-}).option("model", z12.string(), {
+}).option("model", z13.string(), {
   default: "",
   description: "with --agent: the model, by its id or name on the roster"
-}).option("effort", z12.string(), {
+}).option("effort", z13.string(), {
   default: "",
   description: "with --agent: the thinking level, one the agent offers (default: the agent's own)"
-}).option("ready", z12.boolean(), {
+}).option("ready", z13.boolean(), {
   default: false,
   description: "mark it groomed, moving it from the backlog to ready: no task already asks it, and what blocks it is linked"
-}).option("manual", z12.boolean(), {
+}).option("manual", z13.boolean(), {
   default: false,
   description: "queue it by hand only: a queued lane passes over it, and it starts once you `splates queue add` it"
-}).option("auto", z12.boolean(), {
+}).option("auto", z13.boolean(), {
   default: false,
   description: "let a queued lane queue it again, undoing --manual"
 }).action(async (opts, ctx) => {
@@ -1283,21 +1319,21 @@ splatesTask.command("update").use(repository8({ needs: "tasks" })).description("
     slug: opts.slug,
     text: opts.text,
     position: opts.position,
-    files: commaList5(opts.file),
-    removeFiles: commaList5(opts["remove-file"]),
-    blockedBy: taskIds(opts["blocked-by"]),
-    removeBlockedBy: taskIds(opts["remove-blocked-by"]),
+    files: commaList4(opts.file.join(",")),
+    removeFiles: commaList4(opts["remove-file"].join(",")),
+    blockedBy: taskIds(opts["blocked-by"].join(",")),
+    removeBlockedBy: taskIds(opts["remove-blocked-by"].join(",")),
     lane: laneIn(opts.lane),
     assignee,
     ready: opts.ready,
     manual: opts.manual ? true : opts.auto ? false : undefined
   }));
 });
-splatesTask.command("remove").use(repository8({ needs: "tasks" })).description("drop a queued task that was done some other way or no longer applies").arg("id", z12.coerce.number().int().positive(), { description: "task number" }).action(async (opts, ctx) => {
+splatesTask.command("remove").use(repository8({ needs: "tasks" })).description("drop a queued task that was done some other way or no longer applies").arg("id", z13.coerce.number().int().positive(), { description: "task number" }).action(async (opts, ctx) => {
   await refuseGroomer3(ctx.service, "task remove", await ctx.tasks.find(opts.id));
   await ctx.journal.record("task remove", null, () => taskRemove(ctx, opts.id), (removed) => ({ tasks: tasksNamed2([removed]) }));
 });
-splatesTask.command("wait").use(repository8({ needs: "read" })).description("block until a task leaves the queue, which it does when the task that took it merges: for a task blocked by one another lane is on; ends early when that task waits on a person to answer its questions, and gives up with `timeout`").arg("id", z12.coerce.number().int().positive(), { description: "task number" }).option("timeout-secs", z12.coerce.number(), {
+splatesTask.command("wait").use(repository8({ needs: "read" })).description("block until a task leaves the queue, which it does when the task that took it merges: for a task blocked by one another lane is on; ends early when that task waits on a person to answer its questions, and gives up with `timeout`").arg("id", z13.coerce.number().int().positive(), { description: "task number" }).option("timeout-secs", z13.coerce.number(), {
   default: DEFAULT_TIMEOUT2.secs,
   description: "how long to wait before giving up"
 }).action(async (opts, ctx) => {
@@ -1312,36 +1348,36 @@ splatesTask.command("wait").use(repository8({ needs: "read" })).description("blo
 
 // tunnel.ts
 import { repository as repository9 } from "@stringsync/splates-server/records";
-import { savedTunnelOf as savedTunnelOf2 } from "@stringsync/splates-server/server";
+import { savedTunnelOf } from "@stringsync/splates-server/server";
 import {
   API_TOKEN,
   tunnelRemove,
   tunnelSetup
 } from "@stringsync/splates-server/tunnel";
-import { cli as cli12 } from "webappwiz/cmd";
-import { z as z13 } from "zod";
-var splatesTunnel = cli12("tunnel").description("reach `splates server` from elsewhere: a Cloudflare tunnel with Cloudflare Access in front, set up once per machine");
-splatesTunnel.command("setup").use(repository9({ needs: "own" })).description(`make a Cloudflare tunnel to \`splates server\`, the DNS record routing <host> to it, and an Access application letting in only --email, through the API with the token kept as the cred ${API_TOKEN}, then save them for this machine, so a bare \`splates server\` comes up tunneled; run again, it changes only what is not so already. Without that token it requests it on the Creds page of \`splates server\`, with how to make it, and exits \`requested\`: \`splates creds wait ${API_TOKEN}\`, then run it again`).arg("host", z13.string(), {
+import { cli as cli13 } from "webappwiz/cmd";
+import { z as z14 } from "zod";
+var splatesTunnel = cli13("tunnel").description("reach `splates server` from elsewhere: a Cloudflare tunnel with Cloudflare Access in front, set up once per machine");
+splatesTunnel.command("setup").use(repository9({ needs: "own" })).description(`make a Cloudflare tunnel to \`splates server\`, the DNS record routing <host> to it, and an Access application letting in only --email, through the API with the token kept as the cred ${API_TOKEN}, then save them for this machine, so a bare \`splates server\` comes up tunneled; run again, it changes only what is not so already. Without that token it requests it on the Creds page of \`splates server\`, with how to make it, and exits \`requested\`: \`splates creds wait ${API_TOKEN}\`, then run it again`).arg("host", z14.string(), {
   description: "the public host name, in a zone of the account, as in splates.example.com"
-}).option("email", z13.string(), {
+}).option("email", z14.string(), {
   default: "",
   description: "comma-separated email addresses Access lets in"
-}).option("name", z13.string(), {
+}).option("name", z14.string(), {
   default: "splates",
   description: "what the tunnel, the Access application and its policy are called"
-}).option("team", z13.string(), {
+}).option("team", z14.string(), {
   default: "",
   description: "the Zero Trust team to make, as in <team>.cloudflareaccess.com, when the account has none yet"
 }).action(async (opts, ctx) => ctx.journal.record("tunnel setup", null, async () => tunnelSetup({
   ...opts,
   creds: ctx.creds,
   task: await here(ctx),
-  saved: savedTunnelOf2(ctx),
+  saved: savedTunnelOf(ctx),
   log: ctx.log,
   fetch: ctx.fetch
 })));
-splatesTunnel.command("status").description("print the tunnel `splates tunnel setup` saved for this machine, which a bare `splates server` runs, and whether its token is in the system's secret store").option("json", z13.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => {
-  const saved = savedTunnelOf2(ctx);
+splatesTunnel.command("status").description("print the tunnel `splates tunnel setup` saved for this machine, which a bare `splates server` runs, and whether its token is in the system's secret store").option("json", z14.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => {
+  const saved = savedTunnelOf(ctx);
   const record = await saved.read();
   const token = record === null ? false : await saved.token() !== undefined;
   if (opts.json) {
@@ -1362,7 +1398,7 @@ splatesTunnel.command("status").description("print the tunnel `splates tunnel se
 `));
 });
 splatesTunnel.command("remove").use(repository9({ needs: "own" })).description(`delete what \`splates tunnel setup\` and \`splates server --slot\` made in Cloudflare by what they saved: each tunnel, the DNS record routing to it, the Access applications and their policy, then forget the saved files and the tunnels' tokens; the API token kept as ${API_TOKEN} stays. Run again after a failure, it finishes what is left`).action(async (_opts, ctx) => ctx.journal.record("tunnel remove", null, async () => tunnelRemove({
-  saved: savedTunnelOf2(ctx),
+  saved: savedTunnelOf(ctx),
   slots: slotTunnelsOf(ctx),
   creds: ctx.creds,
   task: await here(ctx),
@@ -1372,7 +1408,7 @@ splatesTunnel.command("remove").use(repository9({ needs: "own" })).description(`
 })));
 
 // worker.ts
-import { splatesHome as splatesHome3 } from "@stringsync/splates-server/models";
+import { splatesHome as splatesHome4 } from "@stringsync/splates-server/models";
 import {
   addWorker,
   drainWorker,
@@ -1381,25 +1417,24 @@ import {
   removeWorker,
   setWorkerSlots,
   WORKER_JOIN,
-  wakeWorker,
   workerJoin,
   workerRecipe,
   workerRun
 } from "@stringsync/splates-server/workers";
-import { cli as cli14 } from "webappwiz/cmd";
+import { cli as cli15 } from "webappwiz/cmd";
 import { CompositeLogger } from "webappwiz/log";
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 
 // waiting.ts
 import { listQueue, moveQueued } from "@stringsync/splates-server/workers";
-import { cli as cli13 } from "webappwiz/cmd";
-import { z as z14 } from "zod";
+import { cli as cli14 } from "webappwiz/cmd";
+import { z as z15 } from "zod";
 var DEV2 = {
   default: "",
   description: "the `splates server` to ask, a URL such as http://localhost:4310; by default the one an agent runs under, from SPLATES_DEV"
 };
-var splatesWaiting = cli13("queue").description("the agents waiting for a slot on a worker of the running `splates server`: each one another agent started (with `splates add --agent`, or a lane's orchestrator handing out tasks), started or resumed while every worker it can run on is full, waits here, first come, first served, and starts once a slot frees, as when an agent left idle 30 minutes stops; none is ever failed for waiting. An agent you start waits only while no worker it can run on is up, as with this machine's own removed or none on the platform its project requires");
-splatesWaiting.command("list").description("list the agents waiting for a slot, first in line first: position, project, task, conversation, how long each has waited and why (no free slot, no worker up, or a platform no worker runs, as `needs macOS`)").option("dev", z14.string(), DEV2).option("json", z14.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => listQueue({
+var splatesWaiting = cli14("queue").description("the agents waiting for a slot on a worker of the running `splates server`: each one another agent started (with `splates add --agent`, or a lane's orchestrator handing out tasks), started or resumed while every worker it can run on is full, waits here, first come, first served, and starts once a slot frees, as when an agent left idle 30 minutes stops; none is ever failed for waiting. An agent you start waits only while no worker it can run on is up, as with this machine's own removed or none on the platform its project requires");
+splatesWaiting.command("list").description("list the agents waiting for a slot, first in line first: position, project, task, conversation, how long each has waited and why (no free slot, no worker up, or a platform no worker runs, as `needs macOS`)").option("dev", z15.string(), DEV2).option("json", z15.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => listQueue({
   dev: opts.dev,
   json: opts.json,
   log: ctx.log,
@@ -1407,11 +1442,11 @@ splatesWaiting.command("list").description("list the agents waiting for a slot,
   ps: ctx.ps,
   send: ctx.fetch
 }));
-splatesWaiting.command("move").description("move an agent waiting for a slot to another place in line, from 1 for the next to start, then list the queue").arg("which", z14.string(), {
+splatesWaiting.command("move").description("move an agent waiting for a slot to another place in line, from 1 for the next to start, then list the queue").arg("which", z15.string(), {
   description: "the task it works, or its conversation's id"
-}).arg("position", z14.coerce.number().int(), {
+}).arg("position", z15.coerce.number().int(), {
   description: "where in line to put it, from 1"
-}).option("dev", z14.string(), DEV2).option("json", z14.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => moveQueued({
+}).option("dev", z15.string(), DEV2).option("json", z15.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => moveQueued({
   which: opts.which,
   position: opts.position,
   dev: opts.dev,
@@ -1423,29 +1458,29 @@ splatesWaiting.command("move").description("move an agent waiting for a slot to
 }));
 
 // worker.ts
-var splatesWorker = cli14("worker").description("the machines that run tasks for `splates server`: each dials out to it and runs what it is given, agents, terminals and the git and process reads around them, on its own machine");
-splatesWorker.command("run").description("run a worker on this machine until stopped: it dials `splates server`, by default the one on this machine through a socket in ~/.splates only you may open, and dials again whenever the link drops, while what it runs carries on; it stops reading a process's output while the server is away too long, so nothing is lost. Once its agents have moved off it, a server on another build has it restart on that build, through `bunx @stringsync/splates@<build>`, as it does when it refuses this worker for another protocol; one that says no build has it exit `outdated`").option("server", z15.string(), {
+var splatesWorker = cli15("worker").description("the machines that run tasks for `splates server`: each dials out to it and runs what it is given, agents, terminals and the git and process reads around them, on its own machine");
+splatesWorker.command("run").description("run a worker on this machine until stopped: it dials `splates server`, by default the one on this machine through a socket in ~/.splates only you may open, and dials again whenever the link drops, while what it runs carries on; it stops reading a process's output while the server is away too long, so nothing is lost. Once its agents have moved off it, a server on another build has it restart on that build, through `bunx @stringsync/splates@<build>`, as it does when it refuses this worker for another protocol; one that says no build has it exit `outdated`").option("server", z16.string(), {
   default: "",
   description: "the `splates server` to dial: its URL, whose /api/workers it opens, or unix:<path>; by default this machine's"
-}).option("coordinator", z15.string(), {
+}).option("coordinator", z16.string(), {
   default: "",
   description: "the old name for --server, still read for workers installed before it, and passed to a build older than it"
-}).option("slots", z15.coerce.number().int().min(0), {
+}).option("slots", z16.coerce.number().int().min(0), {
   default: 0,
   description: "how many tasks this worker takes at once; by default one for each core and 4 GB of memory it has, whichever is fewer, as a VM such as WSL2 sees them"
-}).option("id", z15.string(), {
+}).option("id", z16.string(), {
   default: "",
   description: "what the server knows this worker by, kept across restarts so it picks up where it was; by default the id it joined as, kept beside its key, else the machine's host name"
-}).option("join", z15.string(), {
+}).option("join", z16.string(), {
   default: "",
   description: "a join token from `splates worker add` on the server, spent to join it before dialing; the key it answers is kept in this machine's system store, or read from SPLATES_WORKER_KEY on one without"
-}).option("ephemeral", z15.boolean(), {
+}).option("ephemeral", z16.boolean(), {
   default: false,
   description: "keep the key --join answers in memory alone, for a machine destroyed rather than restarted, as one a worker provider makes"
-}).option("key-file", z15.boolean(), {
+}).option("key-file", z16.boolean(), {
   default: false,
   description: "keep the key --join answers in ~/.splates/worker.env, which only this user may read, rather than the system store, for a machine whose store is locked or missing at boot, as WSL's is with no one signed in; read it from there on each run after"
-}).option("quiet", z15.boolean(), {
+}).option("quiet", z16.boolean(), {
   default: false,
   description: "say only what went wrong, not each time it joins or loses its server, as the worker `splates server` starts beside itself does; all of it still goes to worker.log in ~/.splates, the one before it kept as worker.log.1"
 }).action((opts, ctx) => workerRun({
@@ -1459,19 +1494,19 @@ splatesWorker.command("run").description("run a worker on this machine until sto
   ps: ctx.ps,
   fs: ctx.fs
 }));
-splatesWorker.command("join").description("spend a join token from `splates worker add` and keep the key it answers, as `splates worker run --join` does, then exit, for an installer that leaves running the worker to a service").option("server", z15.string(), {
+splatesWorker.command("join").description("spend a join token from `splates worker add` and keep the key it answers, as `splates worker run --join` does, then exit, for an installer that leaves running the worker to a service").option("server", z16.string(), {
   default: "",
   description: "the `splates server` to join: its URL"
-}).option("coordinator", z15.string(), {
+}).option("coordinator", z16.string(), {
   default: "",
   description: "the old name for --server"
-}).option("join", z15.string(), {
+}).option("join", z16.string(), {
   default: "",
   description: "the join token `splates worker add` printed there; by default read from SPLATES_WORKER_JOIN, which keeps it out of the process list other users of the machine can read"
-}).option("id", z15.string(), {
+}).option("id", z16.string(), {
   default: "",
   description: "what the server knows this worker by, kept beside its key so a change of host name leaves it the same; by default the machine's host name"
-}).option("key-file", z15.boolean(), {
+}).option("key-file", z16.boolean(), {
   default: false,
   description: "keep the key in ~/.splates/worker.env, which only this user may read, rather than the system store, for `splates worker run --key-file` to read"
 }).action((opts, ctx) => workerJoin({
@@ -1484,10 +1519,10 @@ splatesWorker.command("join").description("spend a join token from `splates work
   fs: ctx.fs
 }));
 splatesWorker.command("recipe").description("print the shell script, run as root on a fresh Debian or Ubuntu machine, that installs what a Linux worker needs: bun, git, the shared browser and this build of splates, for the user `splates`. It is what a provider's snapshot is built from, and what the Windows installer runs in WSL").action((_opts, ctx) => workerRecipe({ log: ctx.log }));
-splatesWorker.command("list").description("list the workers the running `splates server` has: kind (local over its socket, registered otherwise), platform, build, protocol, slots used and total, health with when it was last heard, tasks and $/hour, then any it refused for speaking another protocol").option("dev", z15.string(), {
+splatesWorker.command("list").description("list the workers the running `splates server` has: kind (local over its socket, registered otherwise), platform, build, protocol, slots used and total, health with when it was last heard, tasks and $/hour, then any it refused for speaking another protocol").option("dev", z16.string(), {
   default: "",
   description: "the `splates server` to ask, a URL such as http://localhost:4310; by default the one an agent runs under, from SPLATES_DEV"
-}).option("json", z15.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => listWorkers({
+}).option("json", z16.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => listWorkers({
   dev: opts.dev,
   json: opts.json,
   log: ctx.log,
@@ -1499,16 +1534,16 @@ var dev = {
   default: "",
   description: "the `splates server` to ask, a URL such as http://localhost:4310; by default the one an agent runs under, from SPLATES_DEV"
 };
-splatesWorker.command("add").description("add a worker to the running `splates server`: prints a join token, single use and good for 15 minutes, for `splates worker run --join <token>` on the machine to join, which gets a key of its own that `splates worker remove` revokes; with --local N, makes this machine's own worker run N agents at once and take new ones again, adding it back if it was removed; with --provider, has the `workerProvider` in splates.config.ts make one, booted from the snapshot splates builds for it, which joins on its own and whose machine `splates worker remove` destroys").option("local", z15.coerce.number().int().min(0), {
+splatesWorker.command("add").description("add a worker to the running `splates server`: prints a join token, single use and good for 15 minutes, for `splates worker run --join <token>` on the machine to join, which gets a key of its own that `splates worker remove` revokes; with --local N, makes this machine's own worker run N agents at once and take new ones again, adding it back if it was removed; with --provider, has the `workerProvider` in splates.config.ts make one, booted from the snapshot splates builds for it, which joins on its own and whose machine `splates worker remove` destroys").option("local", z16.coerce.number().int().min(0), {
   default: 0,
   description: "this machine's own worker, with this many slots"
-}).option("provider", z15.boolean(), {
+}).option("provider", z16.boolean(), {
   default: false,
   description: "have the server's worker provider make the worker, of its cheapest type unless --type says"
-}).option("type", z15.string(), {
+}).option("type", z16.string(), {
   default: "",
   description: "the worker provider's type to make, as it names it; implies --provider"
-}).option("dev", z15.string(), dev).action((opts, ctx) => addWorker({
+}).option("dev", z16.string(), dev).action((opts, ctx) => addWorker({
   local: opts.local,
   provider: opts.provider,
   type: opts.type,
@@ -1518,12 +1553,12 @@ splatesWorker.command("add").description("add a worker to the running `splates s
   ps: ctx.ps,
   send: ctx.fetch
 }));
-splatesWorker.command("drain").description("take no new agents on a worker, letting those on it run to their end, but for one asking you something in a task, which saves its task and lets its slot go, its question kept for you to answer and carry it on elsewhere; --undo takes new ones again").arg("id", z15.string(), {
+splatesWorker.command("drain").description("take no new agents on a worker, letting those on it run to their end, but for one asking you something in a task, which saves its task and lets its slot go, its question kept for you to answer and carry it on elsewhere; --undo takes new ones again").arg("id", z16.string(), {
   description: "the worker, as `splates worker list` names it"
-}).option("undo", z15.boolean(), {
+}).option("undo", z16.boolean(), {
   default: false,
   description: "take new agents again"
-}).option("dev", z15.string(), dev).action((opts, ctx) => drainWorker({
+}).option("dev", z16.string(), dev).action((opts, ctx) => drainWorker({
   id: opts.id,
   undo: opts.undo,
   dev: opts.dev,
@@ -1532,21 +1567,11 @@ splatesWorker.command("drain").description("take no new agents on a worker, lett
   ps: ctx.ps,
   send: ctx.fetch
 }));
-splatesWorker.command("wake").description("wake a worker asleep at home, a Windows PC that joined in WSL2: a worker awake on its network sends the Wake-on-LAN packet. Placement wakes one by itself when agents queue, before making a worker").arg("id", z15.string(), {
-  description: "the worker, as `splates worker list` names it"
-}).option("dev", z15.string(), dev).action((opts, ctx) => wakeWorker({
-  id: opts.id,
-  dev: opts.dev,
-  log: ctx.log,
-  fs: ctx.fs,
-  ps: ctx.ps,
-  send: ctx.fetch
-}));
-splatesWorker.command("slots").description("set how many agents a worker runs at once, from now on, over what it started with").arg("id", z15.string(), {
+splatesWorker.command("slots").description("set how many agents a worker runs at once, from now on, over what it started with").arg("id", z16.string(), {
   description: "the worker, as `splates worker list` names it"
-}).arg("slots", z15.coerce.number().int().min(1), {
+}).arg("slots", z16.coerce.number().int().min(1), {
   description: "how many at once"
-}).option("dev", z15.string(), dev).action((opts, ctx) => setWorkerSlots({
+}).option("dev", z16.string(), dev).action((opts, ctx) => setWorkerSlots({
   id: opts.id,
   slots: opts.slots,
   dev: opts.dev,
@@ -1555,12 +1580,12 @@ splatesWorker.command("slots").description("set how many agents a worker runs at
   ps: ctx.ps,
   send: ctx.fetch
 }));
-splatesWorker.command("remove").description("remove a worker, revoking its key: one with agents on it drains and is removed once they end; --force ends them now, frees their slots, and places each again on another worker, to carry on its task from the checkpoint it last pushed. This machine's own worker, `local`, stops taking agents, its agents running to their end, and leaves this machine only coordinating until `splates worker add --local <slots>`; it takes no --force").arg("id", z15.string(), {
+splatesWorker.command("remove").description("remove a worker, revoking its key: one with agents on it drains and is removed once they end; --force ends them now, frees their slots, and places each again on another worker, to carry on its task from the checkpoint it last pushed. This machine's own worker, `local`, stops taking agents, its agents running to their end, and leaves this machine only coordinating until `splates worker add --local <slots>`; it takes no --force").arg("id", z16.string(), {
   description: "the worker, as `splates worker list` names it"
-}).option("force", z15.boolean(), {
+}).option("force", z16.boolean(), {
   default: false,
   description: "end the agents on it now rather than wait for them"
-}).option("dev", z15.string(), dev).action((opts, ctx) => removeWorker({
+}).option("dev", z16.string(), dev).action((opts, ctx) => removeWorker({
   id: opts.id,
   force: opts.force,
   dev: opts.dev,
@@ -1571,7 +1596,7 @@ splatesWorker.command("remove").description("remove a worker, revoking its key:
 }));
 splatesWorker.mount("queue", splatesWaiting);
 function quietLog(ctx) {
-  const file = new FileLogger(ctx.fs, `${splatesHome3(ctx.ps)}/worker.log`);
+  const file = new FileLogger(ctx.fs, `${splatesHome4(ctx.ps)}/worker.log`);
   return new CompositeLogger([
     { info: () => {}, error: (...said) => ctx.log.error(...said) },
     file
@@ -1592,7 +1617,7 @@ function projectArgs(argv) {
   }
   return { argv };
 }
-var splates = cli15("splates").use(exits());
+var splates = cli16("splates").use(exits());
 splates.command("notes").use(repository10({ needs: "read" })).description("print each project note's frontmatter description, one per line; notesDir in splates.config.ts defaults to notes; an absent directory prints nothing").action((_opts, ctx) => notes(ctx));
 splates.command("init").use(repository10({ creates: true, needs: "own" })).description("make this repository a splates project: set up its records under .git/splates when it has none, install the splates skill of this release with `bunx skills add`, and register it in ~/.splates/projects.json, so `splates server` serves it beside every other; run again, it changes only what is not so already").action((_opts, ctx) => init(ctx));
 splates.command("migrate").description(`move this repository's records under .git/splates to this splates's format, as \`splates server\` does as it starts: backed up first, the steps run with ${MIGRATION_LIMIT.human()} to finish, and the backup put back if one fails or runs over, with why kept in .git/splates-migration.json; it tries again past a failure kept there, which the server and every other command leave alone. Run it only while no older \`splates server\` serves the repository, which would refuse the records once moved; \`splates update\` restarts one first`).action(async (_opts, ctx) => {
@@ -1613,39 +1638,51 @@ splates.command("update").use(recordsFirst()).use(repository10({ needs: "own" })
     ctx.ps.exit(code);
   }
 });
-splates.command("heavy").description("run a heavy command (a full test run, an install) in one of this machine's heavy-job slots, waiting for one to come free first, so agents testing at once queue rather than run out of memory; `SPLATES_HEAVY_JOBS` sets how many run at once, 2 by default").rest("command", z16.string(), {
+splates.command("run").description("run a command that needs a machine of its own (a full test run, an install) on a runner, in a checkout of this worktree as it stands, uncommitted edits included, its output streamed back and its exit code yours: one that has joined `splates server` when it has one, else, in a project whose splates.config.ts names a `cloud`, one `splates run` makes there itself, server or no server (`splates runners`), refusing with `no_runner` rather than run here when none can be had, as without the cloud's token or past `splates budget`. A project that names no cloud runs it here, in one of this machine's heavy-job slots, waiting for one to come free first, so agents testing at once queue rather than run out of memory; `SPLATES_HEAVY_JOBS` sets how many run at once, 1 by default. Run on a runner, it changes nothing here: files it writes stay there").option("cpus", z17.coerce.number().positive().optional(), {
+  description: "the CPUs it asks of a runner, which takes as many commands at once as fit; the project's `job` in splates.config.ts, else 4, by default"
+}).option("memory", z17.string(), {
+  default: "",
+  description: "the memory it asks of a runner, as 8GB or 512MB; the project's `job` in splates.config.ts, else 8GB, by default"
+}).option("timeout", z17.string(), {
+  default: "",
+  description: "how long it may run, as 30m, 90s or 2h, before it is killed and exits 124, so a hung command holds no runner or slot; the project's `job.timeout` in splates.config.ts, else 30m, by default"
+}).rest("command", z17.string(), {
   description: "the command and its arguments, after `--`"
 }).action(async (opts, ctx) => {
-  const code = await runHeavy(ctx, opts.command);
+  const code = await runHeavy(ctx, opts.command, undefined, {
+    ...opts.cpus === undefined ? {} : { cpus: opts.cpus },
+    memory: opts.memory,
+    timeout: opts.timeout
+  });
   if (code !== 0) {
     ctx.ps.exit(code);
   }
 });
 splates.command("forget").use(repository10({ needs: "own" })).description("take this repository off ~/.splates/projects.json, so `splates server` no longer offers it; its records stay, and `splates init` brings it back").action((_opts, ctx) => forget(ctx));
-splates.command("add").use(repository10({ needs: "tasks" })).description("start a task: a new one, or with --task one from the queue; create branch task/<slug>, a worktree at ../<repo>-splates.noindex/<slug> and a state record").arg("slug", z16.string(), {
+splates.command("add").use(repository10({ needs: "tasks" })).description("start a task: a new one, or with --task one from the queue; create branch task/<slug>, a worktree at ../<repo>-splates.noindex/<slug> and a state record").arg("slug", z17.string(), {
   description: "the task's name, for its branch and worktree (lowercase-with-dashes)"
-}).option("base", z16.string(), {
+}).option("base", z17.string(), {
   default: "",
   description: "branch this task starts from and merges onto (default: trunk); `task/<other>` stacks this task on that one and lands the work in its worktree"
-}).option("task", z16.string(), {
+}).option("task", z17.string(), {
   default: "",
   description: "start this queued task by number: its words become the plan's Goal, merging removes it, and removing this task puts it back where it was"
-}).option("goal", z16.string(), {
+}).option("goal", z17.string(), {
   default: "",
   description: "one or two lines on what done means, written under `## Goal` in the task's SPLATES.md; required unless --task seeds the Goal"
-}).option("agent", z16.string(), {
+}).option("agent", z17.string(), {
   default: "",
   description: "how `splates server`'s queue hands the task to an agent on the roster (`splates agents`), which it starts in the worktree; refused from an agent, which starts no agents and queues work with `splates task add` instead"
-}).option("model", z16.string(), {
+}).option("model", z17.string(), {
   default: "",
   description: "with --agent: the model it works on, by its id or name on the roster (default: the agent's own)"
-}).option("effort", z16.string(), {
+}).option("effort", z17.string(), {
   default: "",
   description: "with --agent: the thinking level it works at, one the agent offers (default: the agent's own)"
-}).option("prompt", z16.string(), {
+}).option("prompt", z17.string(), {
   default: "",
   description: "with --agent: what to tell the agent beyond claiming the task"
-}).option("held", z16.string(), {
+}).option("held", z17.string(), {
   default: "",
   description: "with --agent: the conversation `splates server`'s queue held for the queued task, which takes the task rather than a new one"
 }).action(async (opts, ctx) => {
@@ -1690,108 +1727,109 @@ splates.command("add").use(repository10({ needs: "tasks" })).description("start
     await serveProject(ctx);
   }
 });
-splates.command("claim").use(repository10({ needs: "own" })).description("resume an existing task: take ownership of its worktree and print its path, status and any half-finished rebase; refuses while another agent holds the lease, but takes a stale one silently, so `splates show` first if the tree may not be abandoned").arg("task", z16.string(), { description: "task name" }).action(async (opts, ctx) => {
+splates.command("claim").use(repository10({ needs: "own" })).description("resume an existing task: take ownership of its worktree and print its path, status and any half-finished rebase; refuses while another agent holds the lease, but takes a stale one silently, so `splates show` first if the tree may not be abandoned").arg("task", z17.string(), { description: "task name" }).action(async (opts, ctx) => {
   await ctx.journal.record("claim", opts.task, () => claim(ctx, opts.task), (claimed) => claimed);
   await follow(ctx, opts.task);
 });
-splates.command("merge").use(repository10({ needs: "own" })).description("land this worktree's branch on its base (trunk unless created with --base): rebase onto it, run tests on the rebased code, fast-forward it in whichever worktree has it checked out, then discard the worktree, branch and record (linear history, never a merge commit, no flag to skip tests); requires committed work, refusing a dirty worktree").option("message", z16.string(), {
+splates.command("merge").use(repository10({ needs: "own" })).description("land this worktree's branch on its base (trunk unless created with --base): rebase onto it, run tests on the rebased code, fast-forward it in whichever worktree has it checked out, then discard the worktree, branch and record (linear history, never a merge commit, no flag to skip tests); requires committed work, refusing a dirty worktree").option("message", z17.string(), {
   default: "",
   description: "squash the task's commits into one with this message before landing, saying what the base gains in at least 5 characters"
 }).action(async (opts, ctx) => {
   await refuseGroomer4(ctx.service, "merge");
   const task = await here(ctx);
   const facts = {};
-  await ctx.journal.record("merge", task, () => merge(ctx, ctx.ps.cwd(), facts, { message: opts.message }), facts);
+  await ctx.journal.record("merge", task, () => merge({ ...ctx, send: ctx.fetch }, ctx.ps.cwd(), facts, {
+    message: opts.message
+  }), facts);
   if (task !== null) {
     await addFactTasks(ctx, task).catch((error) => ctx.log.error(`could not queue tasks for what the merge found: ${error}`));
     await follow(ctx, null, { from: task });
   }
 });
-splates.command("remove").use(repository10({ needs: "tasks" })).description("discard a task: worktree, branch and state file; cheap and encouraged, since redoing a task against current trunk often beats a hard rebase").arg("task", z16.string(), { description: "task name" }).option("force", z16.boolean(), {
+splates.command("remove").use(repository10({ needs: "tasks" })).description("discard a task: worktree, branch and state file; cheap and encouraged, since redoing a task against current trunk often beats a hard rebase").arg("task", z17.string(), { description: "task name" }).option("force", z17.boolean(), {
   default: false,
   description: "discard even when another agent holds the lease"
-}).option("reason", z16.optional(z16.enum(REMOVE_REASONS)), {
+}).option("reason", z17.optional(z17.enum(REMOVE_REASONS)), {
   description: "why, for the Stats page: nothing (nothing to change), moot (no longer needed), superseded (done some other way), redo (better redone against current trunk), blocked (set aside until what it waits on lands, so back on the list)"
 }).action(async (opts, ctx) => {
   await ctx.journal.record("remove", opts.task, () => remove(ctx, opts.task, { force: opts.force, reason: opts.reason }), ({ released }) => ({ why: opts.reason ?? null, released }));
   await follow(ctx, null, { from: opts.task });
 });
-splates.command("list").use(repository10({ needs: "read" })).description("list every started task: its number, name, status, lease (held: an agent is on it now; stale: gone quiet, normal for a task mid-edit; none), commits ahead of trunk, age; `splates task list` lists the queue").option("json", z16.boolean(), { default: false, description: "emit JSON" }).option("files", z16.boolean(), {
+splates.command("list").use(repository10({ needs: "read" })).description("list every started task: its number, name, status, lease (held: an agent is on it now; stale: gone quiet, normal for a task mid-edit; none), commits ahead of trunk, age; `splates task list` lists the queue").option("json", z17.boolean(), { default: false, description: "emit JSON" }).option("files", z17.boolean(), {
   default: false,
   description: "add each task's Goal and changed files (committed or not), to check for overlap before starting"
 }).action((opts, ctx) => list(ctx, { json: opts.json, files: opts.files }));
-splates.command("show").use(repository10({ needs: "read" })).description("read one task without touching it: everything `list` shows for it, plus the SPLATES.md its agent left at the worktree root; takes no lease, so it cannot knock that agent off its own tree; for a task no longer live, the newest finished one of that name: how it ended, its base, the commit it landed as, its conversation and the SPLATES.md it ended on").arg("task", z16.string(), { description: "task name" }).option("json", z16.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => show(ctx, opts.task, { json: opts.json }));
-splates.command("wait").use(repository10({ needs: "read" })).description("block until a task stops moving: waiting on a person to answer its questions, or gone (merged or removed), or broken; takes no lease, and gives up with `timeout` rather than waiting forever").arg("task", z16.string(), { description: "task name" }).option("timeout-secs", z16.coerce.number(), {
+splates.command("show").use(repository10({ needs: "read" })).description("read one task without touching it: everything `list` shows for it, plus the SPLATES.md its agent left at the worktree root; takes no lease, so it cannot knock that agent off its own tree; for a task no longer live, the newest finished one of that name: how it ended, its base, the commit it landed as, its conversation and the SPLATES.md it ended on").arg("task", z17.string(), { description: "task name" }).option("json", z17.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => show(ctx, opts.task, { json: opts.json }));
+splates.command("wait").use(repository10({ needs: "read" })).description("block until a task stops moving: waiting on a person to answer its questions, or gone (merged or removed), or broken; takes no lease, and gives up with `timeout` rather than waiting forever").arg("task", z17.string(), { description: "task name" }).option("timeout-secs", z17.coerce.number(), {
   default: DEFAULT_TIMEOUT3.secs,
   description: "how long to wait before giving up"
 }).action((opts, ctx) => {
   const timeout = Duration3.secs(opts["timeout-secs"]);
   return ctx.journal.waiting("wait", opts.task, { until: untilAfter3(timeout) }, () => wait(ctx, opts.task, { timeout }));
 });
-splates.command("log").use(repository10({ needs: "read" })).description("show what has been done here recently: one line per add, claim, merge, remove, retry, queued task and more, with how it ended; outlives the tasks themselves").option("count", z16.coerce.number(), {
+splates.command("log").use(repository10({ needs: "read" })).description("show what has been done here recently: one line per add, claim, merge, remove, retry, queued task and more, with how it ended; outlives the tasks themselves").option("count", z17.coerce.number(), {
   default: DEFAULT_COUNT,
   description: "how many entries to show"
-}).option("json", z16.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => showLog(ctx, { count: opts.count, json: opts.json }));
+}).option("json", z17.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => showLog(ctx, { count: opts.count, json: opts.json }));
 splates.mount("server", splatesServer);
-splates.command("ports").description("list the ports tasks serve, found by the running `splates server` as an editor finds ports to forward: each port a process in a task's worktree, or under its agent, listens on, with its link through the ports host `splates server --ports-host` saved, behind Cloudflare Access, and its link on this machine, which on a worker whose server runs elsewhere only that worker's own ports have; give the user both").arg("task", z16.string(), {
+splates.command("ports").description("list the ports tasks serve, found by the running `splates server` as an editor finds ports to forward: each port a process in a task's worktree, or under its agent, listens on, with its link through the ports host `splates server --ports-host` saved, behind Cloudflare Access, and its link on this machine; give the user both").arg("task", z17.string(), {
   default: "",
   description: "only this task's ports; every task's by default"
-}).option("dev", z16.string(), {
+}).option("dev", z17.string(), {
   default: "",
-  description: "the `splates server` to ask, a URL such as http://localhost:4310; by default the one an agent runs under, from SPLATES_DEV, else the coordinator this machine's worker relays to, else this machine's on its default port"
-}).option("json", z16.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => portsLs({
+  description: "the `splates server` to ask, a URL such as http://localhost:4310; by default the one an agent runs under, from SPLATES_DEV, else this machine's on its default port"
+}).option("json", z17.boolean(), { default: false, description: "emit JSON" }).action((opts, ctx) => portsLs({
   task: opts.task,
   dev: opts.dev,
   json: opts.json,
   log: ctx.log,
-  fs: ctx.fs,
   ps: ctx.ps,
   send: ctx.fetch
 }));
-splates.command("agents").description("print the roster of agents splates can start, kept for every project in ~/.splates/agents.json: each agent's launch command and models, with what each model is good at and what it costs, and the thinking levels `--effort` takes, as the agent offered them when last started, for choosing whom to delegate to; writes the defaults (Claude, Codex) there first when there is none, and `splates server` starts conversations with those it lists").option("json", z16.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => agents({
+splates.command("agents").description("print the roster of agents splates can start, kept for every project in ~/.splates/agents.json: each agent's launch command and models, with what each model is good at and what it costs, and the thinking levels `--effort` takes, as the agent offered them when last started, for choosing whom to delegate to; writes the defaults (Claude, Codex) there first when there is none, and `splates server` starts conversations with those it lists").option("json", z17.boolean(), { default: false, description: "emit JSON" }).action(async (opts, ctx) => agents({
   roster: rosterOf2(ctx),
   offered: await offeredOf(ctx).all(),
   log: ctx.log
 }, { json: opts.json }));
-splates.command("setup").description("set splates up on this machine, one step at a time: with no step, each area's steps, checked from real state, and the one to do next; with a step, why it matters, the one thing the user does and what the agent does. Skips are kept in ~/.splates/setup.json, so a skipped step stops asking").arg("step", z16.string(), {
+splates.command("setup").description("set splates up on this machine, one step at a time: with no step, each area's steps, checked from real state, and the one to do next; with a step, why it matters, the one thing the user does and what the agent does. Skips are kept in ~/.splates/setup.json, so a skipped step stops asking").arg("step", z17.string(), {
   default: "",
   description: "a step's id; omit for every area's progress"
-}).option("json", z16.boolean(), { default: false, description: "emit JSON" }).option("skip", z16.boolean(), {
+}).option("json", z17.boolean(), { default: false, description: "emit JSON" }).option("skip", z17.boolean(), {
   default: false,
   description: "with a step: stop asking for it"
-}).option("unskip", z16.boolean(), {
+}).option("unskip", z17.boolean(), {
   default: false,
   description: "with a step: ask for it again"
-}).option("undo", z16.boolean(), {
+}).option("undo", z17.boolean(), {
   default: false,
   description: "with an area's id in place of a step: print what undoing it would remove, the creds it forgets and keeps, and what only the user can remove; the Setup page's Undo does it, after the user confirms"
 }).action((opts, ctx) => setup(ctx, opts));
-splates.command("path").use(repository10({ needs: "read" })).description("print a task's worktree path, or the main tree with no task; names another agent's tree without taking its lease").arg("task", z16.string(), {
+splates.command("path").use(repository10({ needs: "read" })).description("print a task's worktree path, or the main tree with no task; names another agent's tree without taking its lease").arg("task", z17.string(), {
   default: "",
   description: "task name; omit for the main tree"
 }).action((opts, ctx) => path(ctx, opts.task || undefined));
 splates.command("checkpoint").use(repository10({ needs: "own" })).description("save this task to the central remote (`remote` in splates.config.ts) before a stop: commit what is uncommitted as a `WIP: checkpoint` commit, to squash before merging, and push the branch as `splates/<task>`, so a worker that dies loses nothing; with no remote configured, leaves the tree as it is").action(async (_opts, ctx) => {
   await checkpoint(ctx, ctx.ps.cwd());
 });
-splates.command("attach").use(repository10({ needs: "own" })).description("store screenshots and recordings for this task's questions to show: prints the path each was stored at, under .git/splates, which the `splates server` page shows inline; from a conversation (its $SPLATES_CONVERSATION, or --conversation) they stay with it past the task, otherwise they go when the task merges or is removed; those the task's final SPLATES.md shows are copied to keep with its finished record. A task holds at most attachmentCapacity bytes; with no files, lists what it holds. A file the user will come back for on its own is an artifact instead (`splates artifact add`)").arg("files", z16.string(), {
+splates.command("attach").use(repository10({ needs: "own" })).description("store screenshots and recordings for this task's questions to show: prints the path each was stored at, under .git/splates, which the `splates server` page shows inline; from a conversation (its $SPLATES_CONVERSATION, or --conversation) they stay with it past the task, otherwise they go when the task merges or is removed; those the task's final SPLATES.md shows are copied to keep with its finished record. A task holds at most attachmentCapacity bytes; with no files, lists what it holds. A file the user will come back for on its own is an artifact instead (`splates artifact add`)").arg("files", z17.string(), {
   default: "",
   description: "files to store, comma separated"
-}).option("task", z16.string(), {
+}).option("task", z17.string(), {
   default: "",
   description: "task name, when run outside its worktree"
-}).option("remove", z16.string(), {
+}).option("remove", z17.string(), {
   default: "",
   description: "files it holds to drop first, comma separated, by path or stored name"
-}).option("conversation", z16.string(), {
+}).option("conversation", z17.string(), {
   default: "",
   description: "conversation to keep the files with, when $SPLATES_CONVERSATION is not set"
-}).action(async (opts, ctx) => ctx.journal.record("attach", opts.task || await here(ctx), () => attach(ctx, commaList6(opts.files), ctx.ps.cwd(), {
+}).action(async (opts, ctx) => ctx.journal.record("attach", opts.task || await here(ctx), () => attach(ctx, commaList5(opts.files), ctx.ps.cwd(), {
   task: opts.task || undefined,
-  remove: commaList6(opts.remove),
+  remove: commaList5(opts.remove),
   conversation: opts.conversation || undefined
-}), (stored) => ({ stored, removed: commaList6(opts.remove) })));
-splates.command("retry").use(repository10({ needs: "own" })).description("give a task that spent its merge attempts another mergeRetryCount of them; the way out of `budget_exhausted` that is not remove and redo, for a person to run once they have seen the tree").arg("task", z16.string(), { description: "task name" }).action((opts, ctx) => recordRetry(ctx, opts.task));
-splates.mount("artifact", splatesArtifact).mount("task", splatesTask).mount("lane", splatesLane).mount("projects", splatesProjects).mount("creds", splatesCreds).mount("tunnel", splatesTunnel).mount("slots", splatesSlots).mount("worker", splatesWorker).mount("queue", splatesQueue).mount("hook", splatesHook).mount("budget", splatesBudget);
+}), (stored) => ({ stored, removed: commaList5(opts.remove) })));
+splates.command("retry").use(repository10({ needs: "own" })).description("give a task that spent its merge attempts another mergeRetryCount of them; the way out of `budget_exhausted` that is not remove and redo, for a person to run once they have seen the tree").arg("task", z17.string(), { description: "task name" }).action((opts, ctx) => recordRetry(ctx, opts.task));
+splates.mount("artifact", splatesArtifact).mount("task", splatesTask).mount("lane", splatesLane).mount("projects", splatesProjects).mount("creds", splatesCreds).mount("tunnel", splatesTunnel).mount("slots", splatesSlots).mount("worker", splatesWorker).mount("runners", splatesRunners).mount("queue", splatesQueue).mount("hook", splatesHook).mount("budget", splatesBudget).mount("replica", splatesReplica);
 
 // index.ts
 if (basename2(process.argv[1] ?? "") === LEGACY) {
@@ -1799,4 +1837,8 @@ if (basename2(process.argv[1] ?? "") === LEGACY) {
 }
 var ps = systemPs();
 var { project, argv } = projectArgs(ps.args);
+var handedOff = await handOffDev(argv, ps.cwd());
+if (handedOff !== null) {
+  process.exit(handedOff);
+}
 await splates.run({ fs: new NodeFs, ps, assets, project }, argv);