diff --git a/docs/API.md b/docs/API.md
new file mode 100644
index 00000000..91493945
--- /dev/null
+++ b/docs/API.md
@@ -0,0 +1,104 @@
+# Task API (since 2.2, in progress)
+
+A REST API shaped like ClickUp API v2, for scripts and agents with a personal token (spec 213). **Audit status: re-verification pending.** The read endpoints are in; writes arrive before 2.2.0 is tagged, along with the OpenAPI document.
+
+## Read endpoints
+
+Paths after `api.prefix`. *Level* is the least a token needs; the person's access and where still apply.
+
+| Endpoint | Level | Notes |
+|---|---|---|
+| `GET /v2/user`, `GET /v2/team` | My tasks | A team lists no members |
+| `GET /v2/team/{team_id}/space`, `GET /v2/space/{id}` | My tasks | Spaces where reaches and whose plan holds the module |
+| `GET /v2/space/{id}/folder` | My tasks | Always `{"folders": []}`: every board is a folderless list |
+| `GET /v2/space/{id}/list`, `GET /v2/list/{id}` | My tasks | `task_count` counts only what the token may read; columns are `statuses` (first `open`, last `closed`, the rest `custom`) |
+| `GET /v2/list/{id}/task`, `GET /v2/team/{team_id}/task` | My tasks (its own) | 100 per page from `page=0`, `last_page`; `archived`, `subtasks`, `include_closed`, `statuses[]`, `assignees[]`, `tags[]`, `due_date_gt`/`_lt`, `date_created_*`, `date_updated_*`, `date_done_*`, `order_by` (`id`, `created`, `updated`, `due_date`), `reverse`, `include_markdown_description`; on a team also `space_ids[]`, `list_ids[]` |
+| `GET /v2/task/{id}` | My tasks (its own) | `include_subtasks`, `include_markdown_description` |
+| `GET /v2/task/{id}/comment` | My tasks (its own) | 25 per page, newest first; `start` and `start_id` of the oldest one shown give the next page |
+| `GET /v2/task/{id}/member` | Read | Everyone attached to the task |
+| `GET /v2/space/{id}/tag` | Read | Tags of the open tasks the token reaches |
+| `GET /v2/list/{id}/field` | Read | Custom fields a provider sync imported; none otherwise |
+| `GET /v2/team/{team_id}/time_entries` | My tasks | The host's time store answers; `start_date`, `end_date`, `assignee`, `task_id` |
+
+A malformed filter value is 400 `INPUT_002`. Unknown query parameters are ignored on reads. Each list answers in the same number of queries whatever the page holds (8 for a list's tasks, measured at 25 and 100 tasks), the tag filter included.
+
+**Cost per board.** A team's lists and tasks ask the host's access decision once per board the team reaches (`BOARD_ACCESS_CHECK`, in Beacon a voter), and the plan gate once per space. The bundle's own queries stay the same with 1 board or 10; the host's checks grow with the boards.
+
+**Time entries.** Without `task_id`, the bundle checks only the team: the host's time hook must keep to what the token's level and where reach, and to the people whose time the person may see. With `task_id`, the task goes through the guard first.
+
+**What a page shows of other tasks.** Subtasks, dependencies and links are shown only when the token may open the other task too. For *My tasks*, the checklist items of its own tasks are shown whoever created them, as it manages those checklists.
+
+## Differences from ClickUp (so far)
+
+- Ids are strings: the bundle's UUIDs, and the host's ids for people.
+- Dates are Unix milliseconds as strings, at the precision the database keeps (seconds).
+- No folders, group assignees, points, task URL or custom task id (`null` or empty).
+- Checklists are subtasks tagged `checklist:<name>`; a checklist's id encodes its task and name.
+- Tags have no colours (`tag_fg`, `tag_bg` are null).
+- `GET /v2/task/{id}/member` lists the task's members, not everyone who can open it.
+- Dependencies stay within a board; `Related` and `Duplicates` read as `linked_tasks`.
+- Task order defaults to `created` ascending; `reverse=true` flips it.
+
+## Off by default
+
+With `api.enabled: false` a host gets no route, service, listener, parameter or table.
+
+## What a host provides
+
+The bundle stores no tokens. `api.hooks.authenticator` is required with `enabled: true`; every other hook has a default, and every default denies.
+
+| `api.hooks.*` | Interface in `Nowo\TaskBoardBundle\Api\Hook` | Without it |
+|---|---|---|
+| `authenticator` | `TaskApiAuthenticatorInterface` | The container does not build |
+| `rate_limiter` | `TaskApiRateLimiterInterface` | Every request 429 |
+| `plan_gate` | `TaskApiPlanGateInterface` | 403 `PLAN_001` |
+| `workspace` | `TaskApiWorkspaceInterface` | No teams or spaces, every board 404 |
+| `users` | `TaskApiUsersInterface` | Nobody is known |
+| `time_entries` | `TaskApiTimeEntriesInterface` (list and log; tracked time is never deleted through the API) | 403 `TIME_001` |
+| `attachments` | `TaskApiAttachmentsInterface` | 403 `FILE_001` |
+| `idempotency_store` | `TaskApiIdempotencyStoreInterface` | The bundle's store, when writes arrive |
+
+A listener on `TaskBoardEvents::API_WRITE` (`TaskApiWriteEvent`) audits each write.
+
+## Firewall
+
+The API must sit behind a **stateless firewall** whose security user is the token's user, as the access checkers read the security token. `security: false` answers 500 `SERVER_001` on every request. For a bad token the firewall lets the request through with no user, and adds no redirecting `access_control` on the path: the bundle answers, so all refusals share one shape.
+
+```yaml
+nowo_task_board:
+    api:
+        enabled: true
+        prefix: /api/tasks
+        host_decides_access: true   # only with security.resource_scoping: false, when your listeners decide access
+        hooks:
+            authenticator: App\Api\TaskApiAuthenticator
+```
+
+The build refuses `security.allow_unauthenticated: true`, and `security.resource_scoping: false` without `host_decides_access: true`: both would open every board to every token.
+
+## Access
+
+Each request: level ∩ the person's access ∩ where. In this order, and the first failure answers:
+
+| Check | Answer |
+|---|---|
+| Out of reach: missing, outside where, no space for its tenant, no view access, for My tasks not its own | 404 `ACCESS_001`, always the same |
+| The tasks module is not in the plan | 403 `PLAN_001` |
+| The level may not | 403 `TOKEN_001` |
+| The person may not | 403 `ACCESS_002` |
+
+Levels are not a chain: *Read* changes nothing, while *My tasks* works on its own tasks. See `TaskApiCapability`.
+
+**Where.** `TaskApiWhere::limitedTo($tenantKeys, $boardIds)`: each entry grants on its own. A named tenant reaches all its boards; a named board is reached even when its tenant is not listed. Nothing else widens: the person's access, the workspace hook and the tenant check apply to it too.
+
+**Tenancy.** With `tenancy.enabled`, a board is reached only when the bundle's tenant resolver opens its tenant for the person (the slug being the key), as the UI asks of the tenant in its URL, whatever the workspace hook answers. A board without a tenant is not served then, as in the UI.
+
+**Notes for hosts.** The security-user check compares ids, not classes: a firewall user of another class with the same id would pass, so use one user class for the API's firewall. An `access_control` refusal on the API's path answers 403 `ACCESS_002`, not 401: add none there. A token whose user the access checker refuses answers 401 like a bad token and counts as a failed token.
+
+## Errors
+
+`{"err": "...", "ECODE": "..."}`, with `OAUTH_017` (401, no header), `OAUTH_019` (401, token not valid, one answer for every reason), `API_001` (404, the instance switch), `RATE_001` and `RATE_002` (429), and `SERVER_001` (500, no detail). Answers carry `X-RateLimit-Limit`, `-Remaining`, `-Reset` (Unix seconds) and `Cache-Control: no-store, private`. The credential is read only from the `Authorization` header, with or without `Bearer`, and never logged.
+
+## Known differences from the UI
+
+Task text is returned raw. A description or comment that embeds a host file (in Beacon, a `beacon-file:` image) shows an API reader the image's alt text and its UUID, which the UI hides from a viewer who may not open the file. The file's bytes stay behind the host's download check. Wiki and document references are not resolved in task text, so they show nothing more.
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 5ba2d088..06568da7 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -86,6 +86,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+Target: 2.2.0, spec 213 (Task API). Audit status: re-verification pending. Opt-in: with `api.enabled: false` (the default) no route, service, listener, parameter or table changes, and the UI's output stays as it was. See [API](API.md).
+
+### Added
+
+- **Task API, read endpoints.** Spaces, folders (none), lists, tasks with ClickUp's filters and 100 per page, a task, comments, members, tags, imported custom fields and time entries (through the host's time hook). Lists hold and count only what the token may read; each list answers in a fixed number of queries. See [API](API.md).
+- **Task API, skeleton (`api.*`).** `GET /v2/user`, `GET /v2/team` under `api.prefix`; the request pipeline (failed-token limit, authenticator, security user, rate limit), `Api\Security\TaskApiGuard` (level ∩ access ∩ where), `Api\TaskApiCapability`, one `{err, ECODE}` shape. Hooks in `Api\Hook`, where every default denies; event `TaskBoardEvents::API_WRITE`. The build refuses `security.allow_unauthenticated` and, without `api.host_decides_access`, `security.resource_scoping: false`.
+- `Service\TaskManager::restore()` and `archive()`, with their history; `restore()` asks the host's limit and throws `TaskReopenRefusedException` when it refuses.
+- `Service\TaskBoardEraser::eraseTask()`: one task and its subtasks, leaf-first through Doctrine, tracked time kept and detached. Needs the board's manage decision; a task that follows a provider, or has a subtask that does, is refused with `TaskLinkedToProviderException`. The files a sync stored for the subtree, kept after an unlink, are named in each `TaskErasedEvent` and their rows removed, so the host can delete them (audit IA-M1).
+- `Service\TaskBoardEditor::update()`: name and description of a board, the slug unchanged, `TaskBoardEvents::BOARD_UPDATED` (`BoardUpdatedEvent`).
+- `Service\TaskCommentPolicy`: who may write, edit and delete a comment.
+- `Validation\TaskConstraints`: the rules of the fields a write takes.
+- `Service\TaskDependencyManager::findBetween()`, `Dto\TaskFormData::fromTask()`.
+
+### Changed
+
+- `TaskBoardManageController` asks `TaskCommentPolicy` and `TaskManager::restore()`, and the write forms take their rules from `TaskConstraints`. Their output does not change: `tests/Functional/Characterization` pins it. Its `$syncLimits` argument stays in place but is deprecated and ignored: `TaskManager` holds the same limit (audit IA-I1).
+
 ## [2.1.1] - 2026-11-07
 
 Target: 2.1.1. Reported by Beacon on 2.0.2. No schema, configuration or permission change. Audit HZ (2026-11-07): Pass (good) / Low. See [UPGRADING](UPGRADING.md#to-211).
diff --git a/docs/CONFIGURATION.md b/docs/CONFIGURATION.md
index 2d3ff911..39da4755 100644
--- a/docs/CONFIGURATION.md
+++ b/docs/CONFIGURATION.md
@@ -6,6 +6,7 @@
 - [Database](#database)
 - [Routes](#routes)
   - [Why a route loader instead of `#[Route]` attributes (REQ-SF-004)](#why-a-route-loader-instead-of-route-attributes-req-sf-004)
+- [Task API (since 2.2)](#task-api-since-22)
 - [Security](#security)
   - [Firewall](#firewall)
   - [Access checker](#access-checker)
@@ -143,6 +144,10 @@ from this configuration, not declared with `#[Route]` attributes on `TaskBoardMa
 
 Route names, paths, methods and the prefix are unchanged by 1.21.
 
+## Task API (since 2.2)
+
+Off by default. `api.enabled`, `api.prefix`, `api.host_decides_access`, `api.quota_listener_required`, `api.max_body_bytes` and `api.hooks.*`: see [API](API.md).
+
 ## Security
 
 ### Firewall
diff --git a/docs/SECURITY.md b/docs/SECURITY.md
index 5346359b..4f615c84 100644
--- a/docs/SECURITY.md
+++ b/docs/SECURITY.md
@@ -12,6 +12,7 @@
 - [Task types, tag colours and descriptions (since 1.28.0)](#task-types-tag-colours-and-descriptions-since-1280)
 - [Task numbers and calendar (since 2.1)](#task-numbers-and-calendar-since-21)
 - [UiKit migration (2.0.0)](#uikit-migration-200)
+- [Shared write rules (2.2, re-verification pending)](#shared-write-rules-22-re-verification-pending)
 - [Logging and personal data](#logging-and-personal-data)
 - [Personal data in synced tasks (RGPD / LOPDGDD)](#personal-data-in-synced-tasks-rgpd--lopdgdd)
 - [Dependencies](#dependencies)
@@ -27,6 +28,7 @@
 | **Task forms** | Symfony forms for board/task creation and updates (title, description, links, members). |
 | **Configuration** | `nowo_task_board` YAML (routes, table prefix, access checker, team resolver). |
 | **Provider sync (since 1.23, opt-in)** | Server-side calls to a task provider's API with the host's token, file downloads from the provider's attachment hosts, remote text stored as Markdown. |
+| **Task API (since 2.2, opt-in)** | Stateless routes under `api.prefix`, off by default. Token authentication is the host's; `Api\Security\TaskApiRequestListener` and `TaskApiGuard` fail closed. Audit IA: a token whose user the access checker refuses counts as a failed token (L1); with tenancy the guard asks the bundle's tenant resolver too (L2); the security-user check compares ids, not classes, and an `access_control` refusal reads as 403 (I2, I3, documented in [API](API.md)). `TaskManager::archive()` dispatches no domain event, as no UI archive exists; the API's write audit is `API_WRITE` (I5). Audit status: re-verification pending. |
 | **TimeTrack bridge** | Optional. When TimeTrack is installed, task provider exposes trackable tasks; access gated by `TaskAccessGuard`. |
 
 ## Threats and mitigations
@@ -164,6 +166,10 @@ Both opt-in.
 - **Avatars.** Pictures now pass UiKit's `AvatarUrlPolicy`: https without userinfo, or a same-origin path.
 - **Subtask nodes.** Titles reach `tree` as text, escaped by the partial, and in `data-*` attributes through `nowo_ui_safe_attrs`.
 
+## Shared write rules (2.2, re-verification pending)
+
+Spec 213 gives the comment rules, the restore limit and the field constraints one home (`TaskCommentPolicy`, `TaskManager::restore()`, `TaskConstraints`), so a write path other than the forms cannot apply different ones. `TaskBoardEraser::eraseTask()` asks the board's manage decision itself, erases leaf-first so the `PreRemove` that keeps time runs for every subtask (`parent_id` is `ON DELETE CASCADE`, which would skip it), and refuses a task that follows a provider. After an unlink, the files a sync stored for the subtree are named in `TaskErasedEvent::$attachmentRefs` and their rows removed, on every database (audit IA-M1): the host deletes them, as for `deleteBoard()`. `tests/Functional/Characterization` pins the UI's output.
+
 ## Logging and personal data
 
 REQ-OBS-001 (since 1.21): every successful board / task write logs one `info` line, an invalid CSRF token one `warning`,
diff --git a/docs/UPGRADING.md b/docs/UPGRADING.md
index 4c469b9c..4706d55d 100644
--- a/docs/UPGRADING.md
+++ b/docs/UPGRADING.md
@@ -155,6 +155,10 @@ Hosting FrankenPHP with **kernel not reset** between requests: see [FRANKENPHP-W
 
 ## Unreleased
 
+Target: 2.2.0, spec 213. Audit status: re-verification pending. No schema or configuration change is needed, and the UI's output stays as it was. The Task API is off unless you set `api.enabled: true`: see [API](API.md).
+
+`TaskBoardManageController`'s `$syncLimits` argument is deprecated and ignored, kept in its place so positional arguments do not move: a restore asks the limit given to `TaskManager` (`$limits`), which the container wires from the same `sync.limit_checker`. A host that builds either by hand passes the limit to `TaskManager`.
+
 ## To 2.1.1
 
 From **2.1.0**:
diff --git a/docs/USAGE.md b/docs/USAGE.md
index 84153184..2226431b 100644
--- a/docs/USAGE.md
+++ b/docs/USAGE.md
@@ -30,6 +30,7 @@
   - [No inline styles](#no-inline-styles)
 - [Look and feel: ClickUp-like views, theming and icons (since 1.12)](#look-and-feel-clickup-like-views-theming-and-icons-since-112)
   - [Theming with design tokens](#theming-with-design-tokens)
+- [Task API (since 2.2)](#task-api-since-22)
 - [Host hooks (since 2.0.0)](#host-hooks-since-200)
   - [Icons](#icons)
   - [Inline new task](#inline-new-task)
@@ -76,6 +77,10 @@ Authenticated users open the manage UI (default `/tools/task-board`):
 | Log time | `task_time` | Since 1.15: minutes, day and note (POST + CSRF) |
 | Remove time entry | `task_time_remove` | Since 1.15 (POST + CSRF) |
 
+### Deleting and renaming outside the UI (since 2.2)
+
+The UI has no delete task or rename board. A host calling the services can: `TaskBoardEraser::eraseTask($task, $actor)` deletes a task and its subtasks and keeps tracked time, detached (a task that follows a provider is refused); `TaskBoardEditor::update($board, $name, $description, $actor)` keeps the slug and dispatches `BOARD_UPDATED`. Check access first with `TaskBoardResourceAccessChecker`, and validate with `Validation\TaskConstraints`, the rules the forms use.
+
 ## TimeTrack integration (optional)
 
 When TimeTrack is installed and configured with `nowo_task_board.task_provider`:
@@ -232,6 +237,10 @@ Overrides and demos must not reintroduce raw `<form>` / `<input>` / `<select>` /
 {{ form_end(advanceForm) }}
 ```
 
+## Task API (since 2.2)
+
+A REST API shaped like ClickUp's, off by default: see [API](API.md).
+
 ## Host hooks (since 2.0.0)
 
 ```yaml
diff --git a/phpunit.xml.dist b/phpunit.xml.dist
index bf2e7e16..e850a0a6 100644
--- a/phpunit.xml.dist
+++ b/phpunit.xml.dist
@@ -6,8 +6,9 @@
          cacheDirectory=".phpunit.cache"
 >
     <php>
-        <!-- The functional suite boots one kernel per configuration and renders every page -->
-        <ini name="memory_limit" value="512M"/>
+        <!-- The functional suite boots one kernel per configuration and renders every page; the HTML coverage report needs
+             more on top (spec 213 went past 512M while writing it). -->
+        <ini name="memory_limit" value="1G"/>
         <!-- REQ-SF-005: fail on direct Symfony deprecations -->
         <env name="SYMFONY_DEPRECATIONS_HELPER" value="max[direct]=0"/>
         <!-- WebTestCase kernel (tests/Functional): the bundle on SQLite in memory, or TASK_BOARD_TEST_DATABASE_URL -->
diff --git a/src/Api/Controller/TaskApiIdentityController.php b/src/Api/Controller/TaskApiIdentityController.php
new file mode 100644
index 00000000..ac82ebe8
--- /dev/null
+++ b/src/Api/Controller/TaskApiIdentityController.php
@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Controller;
+
+use Nowo\TaskBoardBundle\Api\Operation\TaskApiReadOperations;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiRequestListener;
+use Nowo\TaskBoardBundle\Api\Serializer\TaskApiIdentitySerializer;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTeam;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+
+use function array_map;
+
+/**
+ * Since 2.2.0 (spec 213): `GET /v2/user` and `GET /v2/team`. Thin: every check is in the operation.
+ */
+final readonly class TaskApiIdentityController
+{
+    public function __construct(
+        private TaskApiReadOperations $operations,
+        private TaskApiIdentitySerializer $serializer,
+    ) {
+    }
+
+    public function user(Request $request): JsonResponse
+    {
+        return new JsonResponse(['user' => $this->serializer->user($this->operations->me($this->principal($request)))]);
+    }
+
+    public function teams(Request $request): JsonResponse
+    {
+        $teams = $this->operations->teams($this->principal($request));
+
+        return new JsonResponse(['teams' => array_map(fn (TaskApiTeam $team): array => $this->serializer->team($team), $teams)]);
+    }
+
+    private function principal(Request $request): TaskApiPrincipal
+    {
+        return TaskApiRequestListener::principalOf($request);
+    }
+}
diff --git a/src/Api/Controller/TaskApiReadController.php b/src/Api/Controller/TaskApiReadController.php
new file mode 100644
index 00000000..9bbe3b56
--- /dev/null
+++ b/src/Api/Controller/TaskApiReadController.php
@@ -0,0 +1,147 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Controller;
+
+use Nowo\TaskBoardBundle\Api\Operation\TaskApiReadOperations;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiRequestListener;
+use Nowo\TaskBoardBundle\Api\Serializer\TaskApiReadSerializer;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiSpace;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTaskFilter;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeQuery;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiUser;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncField;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+
+use function array_filter;
+use function array_map;
+use function array_values;
+use function explode;
+use function is_string;
+
+/**
+ * Since 2.2.0 (spec 213): the read endpoints. Thin: parse the request, call one operation, serialize.
+ */
+final readonly class TaskApiReadController
+{
+    public function __construct(
+        private TaskApiReadOperations $operations,
+        private TaskApiReadSerializer $serializer,
+    ) {
+    }
+
+    public function spaces(Request $request, string $teamId): JsonResponse
+    {
+        $spaces = $this->operations->spaces(TaskApiRequestListener::principalOf($request), $teamId);
+
+        return new JsonResponse(['spaces' => array_map(fn (TaskApiSpace $space): array => $this->serializer->space($space), $spaces)]);
+    }
+
+    public function space(Request $request, string $spaceId): JsonResponse
+    {
+        return new JsonResponse($this->serializer->space($this->operations->space(TaskApiRequestListener::principalOf($request), $spaceId)));
+    }
+
+    /** No folders: every board is a folderless list. */
+    public function folders(Request $request, string $spaceId): JsonResponse
+    {
+        $this->operations->space(TaskApiRequestListener::principalOf($request), $spaceId);
+
+        return new JsonResponse(['folders' => []]);
+    }
+
+    public function lists(Request $request, string $spaceId): JsonResponse
+    {
+        $list = $this->operations->boards(TaskApiRequestListener::principalOf($request), $spaceId);
+
+        return new JsonResponse(['lists' => array_map(fn (TaskBoard $board): array => $this->serializer->board($board, $list->space, $list->taskCounts[$board->getId()] ?? 0), $list->boards)]);
+    }
+
+    public function list(Request $request, string $listId): JsonResponse
+    {
+        $list = $this->operations->board(TaskApiRequestListener::principalOf($request), $listId);
+
+        return new JsonResponse($this->serializer->board($list->boards[0], $list->space, $list->taskCounts[$listId] ?? 0));
+    }
+
+    public function listTasks(Request $request, string $listId): JsonResponse
+    {
+        return new JsonResponse($this->serializer->taskPage($this->operations->tasks(TaskApiRequestListener::principalOf($request), $listId, TaskApiTaskFilter::fromQuery($request->query->all()))));
+    }
+
+    public function teamTasks(Request $request, string $teamId): JsonResponse
+    {
+        return new JsonResponse($this->serializer->taskPage($this->operations->teamTasks(TaskApiRequestListener::principalOf($request), $teamId, TaskApiTaskFilter::fromQuery($request->query->all()))));
+    }
+
+    public function task(Request $request, string $taskId): JsonResponse
+    {
+        $query = $request->query->all();
+        $page  = $this->operations->task(TaskApiRequestListener::principalOf($request), $taskId, TaskApiTaskFilter::flag($query, 'include_markdown_description'));
+        $task  = $this->serializer->task($page->tasks[0], $page);
+        if (TaskApiTaskFilter::flag($query, 'include_subtasks')) {
+            $task['subtasks'] = array_map(static fn ($subtask): array => ['id' => $subtask->getId(), 'name' => $subtask->getTitle()], $page->subtasks[$taskId] ?? []);
+        }
+
+        return new JsonResponse($task);
+    }
+
+    public function comments(Request $request, string $taskId): JsonResponse
+    {
+        $query   = $request->query->all();
+        $start   = isset($query['start']) ? TaskApiTaskFilter::milliseconds($query['start'], 'start') : null;
+        $startId = is_string($query['start_id'] ?? null) ? $query['start_id'] : null;
+        $page    = $this->operations->comments(TaskApiRequestListener::principalOf($request), $taskId, $start, $startId);
+
+        return new JsonResponse(['comments' => array_map(fn (TaskComment $comment): array => $this->serializer->comment($comment, $page->authors[$comment->getId()] ?? null), $page->comments)]);
+    }
+
+    public function members(Request $request, string $taskId): JsonResponse
+    {
+        $members = $this->operations->members(TaskApiRequestListener::principalOf($request), $taskId);
+
+        return new JsonResponse(['members' => array_map(fn (TaskApiUser $user): ?array => $this->serializer->user($user), $members)]);
+    }
+
+    public function tags(Request $request, string $spaceId): JsonResponse
+    {
+        $tags = $this->operations->spaceTags(TaskApiRequestListener::principalOf($request), $spaceId);
+
+        return new JsonResponse(['tags' => array_map(static fn (string $tag): array => ['name' => $tag, 'tag_fg' => null, 'tag_bg' => null], $tags)]);
+    }
+
+    public function fields(Request $request, string $listId): JsonResponse
+    {
+        $fields = $this->operations->boardFields(TaskApiRequestListener::principalOf($request), $listId);
+
+        return new JsonResponse(['fields' => array_map(fn (TaskSyncField $field): array => $this->serializer->field($field), $fields)]);
+    }
+
+    /**
+     * `start_date` and `end_date` in Unix milliseconds, `assignee` a comma-separated list of ids, `task_id`.
+     */
+    public function timeEntries(Request $request, string $teamId): JsonResponse
+    {
+        $query    = $request->query->all();
+        $assignee = $query['assignee'] ?? '';
+        if (!is_string($assignee)) {
+            throw new TaskApiRefusal(400, 'INPUT_002', 'Invalid assignee');
+        }
+        $taskId = $query['task_id'] ?? null;
+        $page   = $this->operations->timeEntries(TaskApiRequestListener::principalOf($request), new TaskApiTimeQuery(
+            teamId: $teamId,
+            from: isset($query['start_date']) ? TaskApiTaskFilter::milliseconds($query['start_date'], 'start_date') : null,
+            to: isset($query['end_date']) ? TaskApiTaskFilter::milliseconds($query['end_date'], 'end_date') : null,
+            assigneeIds: array_values(array_filter(explode(',', $assignee), static fn (string $id): bool => $id !== '')),
+            taskId: is_string($taskId) && $taskId !== '' ? $taskId : null,
+        ));
+
+        return new JsonResponse(['data' => array_map(fn (TaskApiTimeEntry $entry): array => $this->serializer->timeEntry($entry, $teamId), $page->entries)]);
+    }
+}
diff --git a/src/Api/Doctrine/JsonTextFunction.php b/src/Api/Doctrine/JsonTextFunction.php
new file mode 100644
index 00000000..9e81f7c5
--- /dev/null
+++ b/src/Api/Doctrine/JsonTextFunction.php
@@ -0,0 +1,45 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Doctrine;
+
+use Doctrine\DBAL\Platforms\AbstractMySQLPlatform;
+use Doctrine\DBAL\Platforms\PostgreSQLPlatform;
+use Doctrine\ORM\Query\AST\Functions\FunctionNode;
+use Doctrine\ORM\Query\AST\Node;
+use Doctrine\ORM\Query\Parser;
+use Doctrine\ORM\Query\SqlWalker;
+use Doctrine\ORM\Query\TokenType;
+
+/**
+ * Since 2.2.0 (spec 213, audit IA-L3): `NOWO_TB_JSON_TEXT(t.tags)`, a JSON column as text, so the tag filter runs in SQL with
+ * `LIKE` on every database: PostgreSQL's `json` has no `LIKE`, MySQL's `JSON` compares as text once cast. Registered only
+ * with `api.enabled`.
+ */
+final class JsonTextFunction extends FunctionNode
+{
+    public const NAME = 'NOWO_TB_JSON_TEXT';
+
+    private Node|string $field = '';
+
+    public function parse(Parser $parser): void
+    {
+        $parser->match(TokenType::T_IDENTIFIER);
+        $parser->match(TokenType::T_OPEN_PARENTHESIS);
+        $this->field = $parser->ArithmeticPrimary();
+        $parser->match(TokenType::T_CLOSE_PARENTHESIS);
+    }
+
+    public function getSql(SqlWalker $sqlWalker): string
+    {
+        $field    = $sqlWalker->walkArithmeticPrimary($this->field);
+        $platform = $sqlWalker->getConnection()->getDatabasePlatform();
+
+        return match (true) {
+            $platform instanceof PostgreSQLPlatform    => 'CAST(' . $field . ' AS TEXT)',
+            $platform instanceof AbstractMySQLPlatform => 'CAST(' . $field . ' AS CHAR)',
+            default                                    => $field,
+        };
+    }
+}
diff --git a/src/Api/Hook/DenyingTaskApiAttachments.php b/src/Api/Hook/DenyingTaskApiAttachments.php
new file mode 100644
index 00000000..358601ce
--- /dev/null
+++ b/src/Api/Hook/DenyingTaskApiAttachments.php
@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiAttachment;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Symfony\Component\HttpFoundation\File\UploadedFile;
+
+/**
+ * Since 2.2.0 (spec 213): the default: no uploads, until the host sets `api.hooks.attachments`.
+ */
+final readonly class DenyingTaskApiAttachments implements TaskApiAttachmentsInterface
+{
+    public function store(TaskApiPrincipal $principal, Task $task, UploadedFile $file): TaskApiAttachment
+    {
+        throw new TaskApiRefusal(403, 'FILE_001', 'Attachments are not available');
+    }
+}
diff --git a/src/Api/Hook/DenyingTaskApiPlanGate.php b/src/Api/Hook/DenyingTaskApiPlanGate.php
new file mode 100644
index 00000000..47980b9e
--- /dev/null
+++ b/src/Api/Hook/DenyingTaskApiPlanGate.php
@@ -0,0 +1,16 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+/**
+ * Since 2.2.0 (spec 213): the default gate: no plan holds the module until the host sets `api.hooks.plan_gate`.
+ */
+final readonly class DenyingTaskApiPlanGate implements TaskApiPlanGateInterface
+{
+    public function allowsTasks(object $user, ?string $tenantKey): bool
+    {
+        return false;
+    }
+}
diff --git a/src/Api/Hook/DenyingTaskApiRateLimiter.php b/src/Api/Hook/DenyingTaskApiRateLimiter.php
new file mode 100644
index 00000000..20e4ac7d
--- /dev/null
+++ b/src/Api/Hook/DenyingTaskApiRateLimiter.php
@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiRateLimitState;
+
+/**
+ * Since 2.2.0 (spec 213): the default limiter: nothing passes until the host sets `api.hooks.rate_limiter`.
+ */
+final readonly class DenyingTaskApiRateLimiter implements TaskApiRateLimiterInterface
+{
+    public function consume(TaskApiPrincipal $principal): TaskApiRateLimitState
+    {
+        return new TaskApiRateLimitState(false, 0, 0, 0);
+    }
+
+    public function failedTokenState(string $clientIp): TaskApiRateLimitState
+    {
+        return new TaskApiRateLimitState(false, 0, 0, 0);
+    }
+
+    public function registerFailedToken(string $clientIp): void
+    {
+    }
+}
diff --git a/src/Api/Hook/DenyingTaskApiTimeEntries.php b/src/Api/Hook/DenyingTaskApiTimeEntries.php
new file mode 100644
index 00000000..03bcca46
--- /dev/null
+++ b/src/Api/Hook/DenyingTaskApiTimeEntries.php
@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiNewTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimePage;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeQuery;
+use Nowo\TaskBoardBundle\Entity\Task;
+
+/**
+ * Since 2.2.0 (spec 213): the default time store: none, until the host sets `api.hooks.time_entries`.
+ */
+final readonly class DenyingTaskApiTimeEntries implements TaskApiTimeEntriesInterface
+{
+    public function list(TaskApiPrincipal $principal, TaskApiTimeQuery $query): TaskApiTimePage
+    {
+        throw $this->refusal();
+    }
+
+    public function log(TaskApiPrincipal $principal, ?Task $task, TaskApiNewTimeEntry $entry): TaskApiTimeEntry
+    {
+        throw $this->refusal();
+    }
+
+    private function refusal(): TaskApiRefusal
+    {
+        return new TaskApiRefusal(403, 'TIME_001', 'Time entries are not available');
+    }
+}
diff --git a/src/Api/Hook/EmptyTaskApiUsers.php b/src/Api/Hook/EmptyTaskApiUsers.php
new file mode 100644
index 00000000..eb3e1f16
--- /dev/null
+++ b/src/Api/Hook/EmptyTaskApiUsers.php
@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+
+/**
+ * Since 2.2.0 (spec 213): the default: nobody is known, until the host sets `api.hooks.users`.
+ */
+final readonly class EmptyTaskApiUsers implements TaskApiUsersInterface
+{
+    public function apiId(object $user): string
+    {
+        throw TaskApiRefusal::notFound();
+    }
+
+    public function find(string $apiId): ?object
+    {
+        return null;
+    }
+
+    public function profiles(array $users, TaskApiPrincipal $viewer): array
+    {
+        return [];
+    }
+}
diff --git a/src/Api/Hook/EmptyTaskApiWorkspace.php b/src/Api/Hook/EmptyTaskApiWorkspace.php
new file mode 100644
index 00000000..ee98bfb0
--- /dev/null
+++ b/src/Api/Hook/EmptyTaskApiWorkspace.php
@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiSpace;
+
+/**
+ * Since 2.2.0 (spec 213): the default workspace: nothing to reach, until the host sets `api.hooks.workspace`.
+ */
+final readonly class EmptyTaskApiWorkspace implements TaskApiWorkspaceInterface
+{
+    public function teams(TaskApiPrincipal $principal): array
+    {
+        return [];
+    }
+
+    public function spaces(TaskApiPrincipal $principal, string $teamId): array
+    {
+        return [];
+    }
+
+    public function space(TaskApiPrincipal $principal, string $spaceId): ?TaskApiSpace
+    {
+        return null;
+    }
+
+    public function spaceOfTenant(TaskApiPrincipal $principal, ?string $tenantKey): ?TaskApiSpace
+    {
+        return null;
+    }
+}
diff --git a/src/Api/Hook/TaskApiAttachmentsInterface.php b/src/Api/Hook/TaskApiAttachmentsInterface.php
new file mode 100644
index 00000000..74417987
--- /dev/null
+++ b/src/Api/Hook/TaskApiAttachmentsInterface.php
@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiAttachment;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Symfony\Component\HttpFoundation\File\UploadedFile;
+
+/**
+ * Since 2.2.0 (spec 213): stores a file for a task. All upload checks live here: content sniffing, plan storage, sizes
+ * (FR-014). Default: {@see DenyingTaskApiAttachments}, 403 `FILE_001`.
+ */
+interface TaskApiAttachmentsInterface
+{
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function store(TaskApiPrincipal $principal, Task $task, UploadedFile $file): TaskApiAttachment;
+}
diff --git a/src/Api/Hook/TaskApiAuthenticatorInterface.php b/src/Api/Hook/TaskApiAuthenticatorInterface.php
new file mode 100644
index 00000000..4e035936
--- /dev/null
+++ b/src/Api/Hook/TaskApiAuthenticatorInterface.php
@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiAuthFailure;
+use Nowo\TaskBoardBundle\Api\TaskApiCredential;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Symfony\Component\HttpFoundation\Request;
+
+/**
+ * Since 2.2.0 (spec 213): who a request is. The bundle stores no tokens. Called once per request, so a revoked or expired
+ * token, a disabled or erased account or a removed membership stops working at once. Required with `api.enabled`.
+ *
+ * {@see TaskApiCredential::fromRequest()} reads the credential. The API must sit behind a stateless
+ * firewall whose security user is the principal's user, as access checkers read the security token: otherwise it answers 500.
+ */
+interface TaskApiAuthenticatorInterface
+{
+    public function authenticate(Request $request): TaskApiPrincipal|TaskApiAuthFailure;
+}
diff --git a/src/Api/Hook/TaskApiIdempotencyStoreInterface.php b/src/Api/Hook/TaskApiIdempotencyStoreInterface.php
new file mode 100644
index 00000000..5309440b
--- /dev/null
+++ b/src/Api/Hook/TaskApiIdempotencyStoreInterface.php
@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiIdempotencyClaim;
+
+/**
+ * Since 2.2.0 (spec 213): where the first answer of a write with an `Idempotency-Key` is kept (FR-015). The first caller of
+ * a key wins, atomically. `$scope` is a hash of the token id and `$keyHash` of the key: no secret ever reaches a store.
+ */
+interface TaskApiIdempotencyStoreInterface
+{
+    public function claim(string $scope, string $keyHash, string $fingerprint, DateTimeImmutable $expiresAt): TaskApiIdempotencyClaim;
+
+    public function complete(string $scope, string $keyHash, int $status, string $body, ?string $tenantKey, ?string $boardId): void;
+
+    public function release(string $scope, string $keyHash): void;
+
+    /** A token revoked or an account erased: its stored answers hold task text. */
+    public function forget(string $scope): void;
+
+    public function purgeExpired(DateTimeImmutable $now): int;
+}
diff --git a/src/Api/Hook/TaskApiPlanGateInterface.php b/src/Api/Hook/TaskApiPlanGateInterface.php
new file mode 100644
index 00000000..a3d8f3bf
--- /dev/null
+++ b/src/Api/Hook/TaskApiPlanGateInterface.php
@@ -0,0 +1,16 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+/**
+ * Since 2.2.0 (spec 213): whether a plan holds the tasks module (FR-009). Default: {@see DenyingTaskApiPlanGate}, 403 `PLAN_001`.
+ */
+interface TaskApiPlanGateInterface
+{
+    /**
+     * The module on the account owning `$tenantKey`; null: on any account of the user (`GET /v2/user`, `/v2/team`).
+     */
+    public function allowsTasks(object $user, ?string $tenantKey): bool;
+}
diff --git a/src/Api/Hook/TaskApiRateLimiterInterface.php b/src/Api/Hook/TaskApiRateLimiterInterface.php
new file mode 100644
index 00000000..32aa46c0
--- /dev/null
+++ b/src/Api/Hook/TaskApiRateLimiterInterface.php
@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiRateLimitState;
+
+/**
+ * Since 2.2.0 (spec 213): the limits on the API: per token, and failed tokens per IP (FR-006).
+ * Default: {@see DenyingTaskApiRateLimiter}, every request 429.
+ */
+interface TaskApiRateLimiterInterface
+{
+    /** Counts one request of the token. */
+    public function consume(TaskApiPrincipal $principal): TaskApiRateLimitState;
+
+    /** Whether the IP may try a token; it counts nothing. */
+    public function failedTokenState(string $clientIp): TaskApiRateLimitState;
+
+    public function registerFailedToken(string $clientIp): void;
+}
diff --git a/src/Api/Hook/TaskApiTimeEntriesInterface.php b/src/Api/Hook/TaskApiTimeEntriesInterface.php
new file mode 100644
index 00000000..83dbec75
--- /dev/null
+++ b/src/Api/Hook/TaskApiTimeEntriesInterface.php
@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiNewTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimePage;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeQuery;
+use Nowo\TaskBoardBundle\Entity\Task;
+
+/**
+ * Since 2.2.0 (spec 213): the time store. There is no delete: `DELETE .../time_entries/{id}` always answers 403 and tracked
+ * time is never removed through the API (owner rule). Default: {@see DenyingTaskApiTimeEntries}, 403 `TIME_001`.
+ */
+interface TaskApiTimeEntriesInterface
+{
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function list(TaskApiPrincipal $principal, TaskApiTimeQuery $query): TaskApiTimePage;
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function log(TaskApiPrincipal $principal, ?Task $task, TaskApiNewTimeEntry $entry): TaskApiTimeEntry;
+}
diff --git a/src/Api/Hook/TaskApiUsersInterface.php b/src/Api/Hook/TaskApiUsersInterface.php
new file mode 100644
index 00000000..000ac23c
--- /dev/null
+++ b/src/Api/Hook/TaskApiUsersInterface.php
@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiUser;
+
+/**
+ * Since 2.2.0 (spec 213): how people read in the API. Ids are strings the host chooses. Default: {@see EmptyTaskApiUsers}.
+ */
+interface TaskApiUsersInterface
+{
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function apiId(object $user): string;
+
+    public function find(string $apiId): ?object;
+
+    /**
+     * What `$viewer` may see of each person, in one call per page (FR-010). A person left out is not shown.
+     *
+     * @param list<object> $users
+     *
+     * @return array<string, TaskApiUser> by API id
+     */
+    public function profiles(array $users, TaskApiPrincipal $viewer): array;
+}
diff --git a/src/Api/Hook/TaskApiWorkspaceInterface.php b/src/Api/Hook/TaskApiWorkspaceInterface.php
new file mode 100644
index 00000000..df483ce6
--- /dev/null
+++ b/src/Api/Hook/TaskApiWorkspaceInterface.php
@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Hook;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiSpace;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTeam;
+
+/**
+ * Since 2.2.0 (spec 213): how the host's accounts and tenants read as ClickUp's teams and spaces, for one person. A tenant
+ * the host does not answer for is out of reach. Default: {@see EmptyTaskApiWorkspace}, so every board answers 404.
+ */
+interface TaskApiWorkspaceInterface
+{
+    /**
+     * @return list<TaskApiTeam>
+     */
+    public function teams(TaskApiPrincipal $principal): array;
+
+    /**
+     * @return list<TaskApiSpace>
+     */
+    public function spaces(TaskApiPrincipal $principal, string $teamId): array;
+
+    public function space(TaskApiPrincipal $principal, string $spaceId): ?TaskApiSpace;
+
+    public function spaceOfTenant(TaskApiPrincipal $principal, ?string $tenantKey): ?TaskApiSpace;
+}
diff --git a/src/Api/Operation/TaskApiReadOperations.php b/src/Api/Operation/TaskApiReadOperations.php
new file mode 100644
index 00000000..00901871
--- /dev/null
+++ b/src/Api/Operation/TaskApiReadOperations.php
@@ -0,0 +1,402 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Operation;
+
+use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiPlanGateInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiTimeEntriesInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiUsersInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiWorkspaceInterface;
+use Nowo\TaskBoardBundle\Api\Repository\TaskApiQueryRepository;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiGuard;
+use Nowo\TaskBoardBundle\Api\TaskApiCapability;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiBoardList;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiCommentPage;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiSpace;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTaskFilter;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTaskPage;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTeam;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimePage;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeQuery;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiUser;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Entity\TaskDependency;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncField;
+
+use function array_filter;
+use function array_map;
+use function array_values;
+use function in_array;
+use function spl_object_id;
+use function str_starts_with;
+
+/**
+ * Since 2.2.0 (spec 213): what the API reads, without HTTP: each method takes the principal and applies every check, so
+ * an in-process caller gets exactly what a request would.
+ */
+final readonly class TaskApiReadOperations
+{
+    /** Comments per page, as ClickUp. */
+    public const COMMENTS_PER_PAGE = 25;
+
+    public function __construct(
+        private TaskApiPlanGateInterface $planGate,
+        private TaskApiWorkspaceInterface $workspace,
+        private TaskApiUsersInterface $users,
+        private TaskApiGuard $guard,
+        private TaskApiQueryRepository $queries,
+        private TaskApiTimeEntriesInterface $timeEntries,
+    ) {
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function me(TaskApiPrincipal $principal): TaskApiUser
+    {
+        $this->requireIdentity($principal);
+
+        return $this->users->profiles([$principal->user], $principal)[$this->users->apiId($principal->user)] ?? throw TaskApiRefusal::notFound();
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     *
+     * @return list<TaskApiTeam>
+     */
+    public function teams(TaskApiPrincipal $principal): array
+    {
+        $this->requireIdentity($principal);
+
+        return $this->workspace->teams($principal);
+    }
+
+    /**
+     * The spaces of one of the token's teams that where reaches and whose plan holds the module.
+     *
+     * @throws TaskApiRefusal
+     *
+     * @return list<TaskApiSpace>
+     */
+    public function spaces(TaskApiPrincipal $principal, string $teamId): array
+    {
+        $this->requireTeam($principal, $teamId);
+
+        return array_values(array_filter($this->workspace->spaces($principal, $teamId), fn (TaskApiSpace $space): bool => $this->guard->lists($principal, $space)));
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function space(TaskApiPrincipal $principal, string $spaceId): TaskApiSpace
+    {
+        return $this->guard->space($principal, $spaceId, TaskApiCapability::ReadOwn);
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function boards(TaskApiPrincipal $principal, string $spaceId): TaskApiBoardList
+    {
+        $space  = $this->guard->space($principal, $spaceId, TaskApiCapability::ReadOwn);
+        $boards = $this->guard->visibleBoards($principal, $space->tenantKey);
+
+        return new TaskApiBoardList($space, $boards, $this->queries->countByBoard($this->ids($boards), $this->owner($principal)));
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function board(TaskApiPrincipal $principal, string $boardId): TaskApiBoardList
+    {
+        $board = $this->guard->board($principal, $boardId, TaskApiCapability::ReadOwn);
+
+        return new TaskApiBoardList($this->spaceOf($principal, $board), [$board], $this->queries->countByBoard([$board->getId()], $this->owner($principal)));
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function tasks(TaskApiPrincipal $principal, string $boardId, TaskApiTaskFilter $filter): TaskApiTaskPage
+    {
+        $board = $this->guard->board($principal, $boardId, TaskApiCapability::ReadOwn);
+
+        return $this->page($principal, [$board], $filter);
+    }
+
+    /**
+     * Tasks across the boards of a team the token reaches; `space_ids[]` and `list_ids[]` narrow them.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function teamTasks(TaskApiPrincipal $principal, string $teamId, TaskApiTaskFilter $filter): TaskApiTaskPage
+    {
+        $boards = [];
+        foreach ($this->spaces($principal, $teamId) as $space) {
+            if ($filter->spaceIds !== [] && !in_array($space->id, $filter->spaceIds, true)) {
+                continue;
+            }
+            foreach ($this->guard->visibleBoards($principal, $space->tenantKey) as $board) {
+                if ($filter->listIds === [] || in_array($board->getId(), $filter->listIds, true)) {
+                    $boards[] = $board;
+                }
+            }
+        }
+
+        return $this->page($principal, $boards, $filter);
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function task(TaskApiPrincipal $principal, string $taskId, bool $markdown = false): TaskApiTaskPage
+    {
+        $task = $this->guard->task($principal, $taskId, TaskApiCapability::ReadOwn);
+
+        return $this->context($principal, $this->queries->load([$task->getId()]), true, $markdown);
+    }
+
+    /**
+     * Newest first, 25 per page; `$start` and `$startId` name the oldest comment of the previous page.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function comments(TaskApiPrincipal $principal, string $taskId, ?DateTimeImmutable $start, ?string $startId): TaskApiCommentPage
+    {
+        $task     = $this->guard->task($principal, $taskId, TaskApiCapability::ReadOwn);
+        $comments = $this->queries->comments($task, $start, $startId, self::COMMENTS_PER_PAGE);
+        $authors  = [];
+        $profiles = $this->profiles($principal, array_values(array_filter(array_map(static fn (TaskComment $comment): ?object => $comment->getAuthor(), $comments))));
+        foreach ($comments as $comment) {
+            $author = $comment->getAuthor();
+            $id     = $author === null ? null : $profiles['ids'][spl_object_id($author)] ?? null;
+            if ($id !== null && isset($profiles['profiles'][$id])) {
+                $authors[$comment->getId()] = $profiles['profiles'][$id];
+            }
+        }
+
+        return new TaskApiCommentPage($comments, $authors);
+    }
+
+    /**
+     * Everyone attached to the task, once, as the viewer may see them.
+     *
+     * @throws TaskApiRefusal
+     *
+     * @return list<TaskApiUser>
+     */
+    public function members(TaskApiPrincipal $principal, string $taskId): array
+    {
+        $task  = $this->guard->task($principal, $taskId, TaskApiCapability::ReadEverything);
+        $users = [];
+        foreach ($task->getMembers() as $member) {
+            $users[spl_object_id($member->getUser())] = $member->getUser();
+        }
+
+        return array_values($this->profiles($principal, array_values($users))['profiles']);
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     *
+     * @return list<string>
+     */
+    public function spaceTags(TaskApiPrincipal $principal, string $spaceId): array
+    {
+        $space = $this->guard->space($principal, $spaceId, TaskApiCapability::ReadEverything);
+
+        return $this->queries->tagsOf($this->ids($this->guard->visibleBoards($principal, $space->tenantKey)));
+    }
+
+    /**
+     * The fields a provider sync imported for the board; none without one.
+     *
+     * @throws TaskApiRefusal
+     *
+     * @return list<TaskSyncField>
+     */
+    public function boardFields(TaskApiPrincipal $principal, string $boardId): array
+    {
+        return $this->queries->fieldsOf($this->guard->board($principal, $boardId, TaskApiCapability::ReadEverything)->getId());
+    }
+
+    /**
+     * The host's time store decides whose time the token sees; a named task must be within reach first.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function timeEntries(TaskApiPrincipal $principal, TaskApiTimeQuery $query): TaskApiTimePage
+    {
+        $this->requireTeam($principal, $query->teamId);
+        if ($query->taskId !== null) {
+            $this->guard->task($principal, $query->taskId, TaskApiCapability::ReadOwn);
+        }
+
+        return $this->timeEntries->list($principal, $query);
+    }
+
+    /**
+     * @param list<TaskBoard> $boards already checked
+     *
+     * @throws TaskApiRefusal
+     */
+    private function page(TaskApiPrincipal $principal, array $boards, TaskApiTaskFilter $filter): TaskApiTaskPage
+    {
+        $assignees = [];
+        foreach ($filter->assigneeIds as $apiId) {
+            $user = $this->users->find($apiId);
+            if ($user !== null) {
+                $assignees[] = $user;
+            }
+        }
+        $result = $this->queries->taskPage($this->ids($boards), $filter, $assignees, $this->owner($principal));
+
+        return $this->context($principal, $result['tasks'], $result['lastPage'], $filter->markdown);
+    }
+
+    /**
+     * Everything the tasks are shown with, in a fixed number of queries and one call to each hook.
+     *
+     * @param list<Task> $tasks
+     */
+    private function context(TaskApiPrincipal $principal, array $tasks, bool $lastPage, bool $markdown): TaskApiTaskPage
+    {
+        $ids      = array_map(static fn (Task $task): string => $task->getId(), $tasks);
+        $subtasks = [];
+        foreach ($this->queries->subtasksOf($ids) as $subtask) {
+            // Audit IA-M2: only the subtasks the token may open; a checklist item of a task it reaches is part of that task
+            // (owner: My tasks manages the checklists of its own tasks).
+            if ($this->isChecklistItem($subtask) || $this->guard->canSeeTask($principal, $subtask)) {
+                $subtasks[(string) $subtask->getParent()?->getId()][] = $subtask;
+            }
+        }
+        // Audit IA-I7: a relation is shown only when the token may open the other task too.
+        $dependencies = array_values(array_filter($this->queries->dependenciesOf($ids), function (TaskDependency $dependency) use ($principal, $ids): bool {
+            foreach ([$dependency->getSourceTask(), $dependency->getTargetTask()] as $end) {
+                if (!in_array($end->getId(), $ids, true) && !$this->guard->canSeeTask($principal, $end)) {
+                    return false;
+                }
+            }
+
+            return true;
+        }));
+        $spaces = [];
+        $users  = [];
+        foreach ($tasks as $task) {
+            $board = $task->getBoard();
+            $spaces[$board->getId()] ??= $this->spaceOf($principal, $board);
+            $creator = $task->getCreator();
+            if ($creator !== null) {
+                $users[spl_object_id($creator)] = $creator;
+            }
+            foreach ([$task, ...$subtasks[$task->getId()] ?? []] as $shown) {
+                foreach ($shown->getMembers() as $member) {
+                    $users[spl_object_id($member->getUser())] = $member->getUser();
+                }
+            }
+        }
+        $profiles = $this->profiles($principal, array_values($users));
+
+        return new TaskApiTaskPage(
+            tasks: $tasks,
+            lastPage: $lastPage,
+            spaces: $spaces,
+            profiles: $profiles['profiles'],
+            userIds: $profiles['ids'],
+            dependencies: $dependencies,
+            subtasks: $subtasks,
+            manualMinutes: $this->queries->manualMinutesOf($ids),
+            fieldValues: $this->queries->fieldValuesOf($ids),
+            markdown: $markdown,
+        );
+    }
+
+    /**
+     * @param list<object> $users
+     *
+     * @return array{profiles: array<string, TaskApiUser>, ids: array<int, string>}
+     */
+    private function profiles(TaskApiPrincipal $principal, array $users): array
+    {
+        if ($users === []) {
+            return ['profiles' => [], 'ids' => []];
+        }
+        $profiles = $this->users->profiles($users, $principal);
+        $ids      = [];
+        foreach ($users as $user) {
+            try {
+                $ids[spl_object_id($user)] = $this->users->apiId($user);
+            } catch (TaskApiRefusal) {
+                // A person the host does not know is not shown.
+            }
+        }
+
+        return ['profiles' => $profiles, 'ids' => $ids];
+    }
+
+    private function isChecklistItem(Task $task): bool
+    {
+        foreach ($task->getTags() as $tag) {
+            if (str_starts_with($tag, 'checklist:')) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private function spaceOf(TaskApiPrincipal $principal, TaskBoard $board): TaskApiSpace
+    {
+        // The guard already asked the host for this tenant: a board without a space is out of reach.
+        return $this->workspace->spaceOfTenant($principal, $board->getTenantKey()) ?? throw TaskApiRefusal::notFound();
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    private function requireTeam(TaskApiPrincipal $principal, string $teamId): void
+    {
+        $this->requireIdentity($principal);
+        foreach ($this->workspace->teams($principal) as $team) {
+            if ($team->id === $teamId) {
+                return;
+            }
+        }
+
+        throw TaskApiRefusal::notFound();
+    }
+
+    /**
+     * Every level may read who it is, so only the plan is asked.
+     *
+     * @throws TaskApiRefusal
+     */
+    private function requireIdentity(TaskApiPrincipal $principal): void
+    {
+        if (!$this->planGate->allowsTasks($principal->user, null)) {
+            throw TaskApiRefusal::planRefused();
+        }
+    }
+
+    private function owner(TaskApiPrincipal $principal): ?object
+    {
+        return $principal->level === TaskApiLevel::MyTasks ? $principal->user : null;
+    }
+
+    /**
+     * @param list<TaskBoard> $boards
+     *
+     * @return list<string>
+     */
+    private function ids(array $boards): array
+    {
+        return array_map(static fn (TaskBoard $board): string => $board->getId(), $boards);
+    }
+}
diff --git a/src/Api/Repository/TaskApiQueryRepository.php b/src/Api/Repository/TaskApiQueryRepository.php
new file mode 100644
index 00000000..0b804e96
--- /dev/null
+++ b/src/Api/Repository/TaskApiQueryRepository.php
@@ -0,0 +1,416 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Repository;
+
+use DateTimeImmutable;
+use Doctrine\DBAL\Platforms\AbstractMySQLPlatform;
+use Doctrine\ORM\EntityManagerInterface;
+use Doctrine\ORM\QueryBuilder;
+use Nowo\TaskBoardBundle\Api\Doctrine\JsonTextFunction;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTaskFilter;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Entity\TaskDependency;
+use Nowo\TaskBoardBundle\Entity\TaskMember;
+use Nowo\TaskBoardBundle\Entity\TaskTimeEntry;
+use Nowo\TaskBoardBundle\Enum\TaskMemberRole;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncField;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncFieldValue;
+
+use function array_map;
+use function array_slice;
+use function array_values;
+use function count;
+use function implode;
+use function is_array;
+use function is_string;
+use function json_encode;
+use function mb_strtolower;
+use function strtr;
+
+use const JSON_UNESCAPED_SLASHES;
+use const JSON_UNESCAPED_UNICODE;
+
+/**
+ * Since 2.2.0 (spec 213): what the read API needs from the database, in a fixed number of queries per page whatever its
+ * size (FR-010). Filters run in SQL, so `last_page` and every count are those of what the token may read.
+ */
+final readonly class TaskApiQueryRepository
+{
+    private const ORDER_FIELDS = ['id' => 't.id', 'created' => 't.createdAt', 'updated' => 't.updatedAt', 'due_date' => 't.dueAt'];
+
+    public function __construct(
+        private EntityManagerInterface $entityManager,
+        private bool $syncEnabled = false,
+    ) {
+    }
+
+    /**
+     * One page of tasks of the given boards, with what serializing them needs.
+     *
+     * @param list<string> $boardIds boards already checked
+     * @param list<object> $assignees users the `assignees[]` filter names
+     * @param object|null $owner My tasks: only the tasks it created or is assigned
+     *
+     * @return array{tasks: list<Task>, lastPage: bool}
+     */
+    public function taskPage(array $boardIds, TaskApiTaskFilter $filter, array $assignees, ?object $owner): array
+    {
+        if ($boardIds === [] || ($filter->assigneeIds !== [] && $assignees === [])) {
+            return ['tasks' => [], 'lastPage' => true];
+        }
+        $qb        = $this->filtered($boardIds, $filter, $assignees, $owner);
+        $direction = $filter->reverse ? 'DESC' : 'ASC';
+        $qb->orderBy(self::ORDER_FIELDS[$filter->orderBy], $direction)->addOrderBy('t.id', $direction);
+        $offset = $filter->page * TaskApiTaskFilter::PAGE_SIZE;
+
+        /** @var list<array{id: string}> $rows */
+        $rows = $qb->select('t.id AS id')->setFirstResult($offset)->setMaxResults(TaskApiTaskFilter::PAGE_SIZE + 1)->getQuery()->getArrayResult();
+        $ids  = array_map(static fn (array $row): string => (string) $row['id'], $rows);
+
+        $lastPage = count($ids) <= TaskApiTaskFilter::PAGE_SIZE;
+        $ids      = array_slice($ids, 0, TaskApiTaskFilter::PAGE_SIZE);
+
+        return ['tasks' => $this->load($ids), 'lastPage' => $lastPage];
+    }
+
+    /**
+     * Open (not archived) tasks per board, as the token may count them.
+     *
+     * @param list<string> $boardIds
+     *
+     * @return array<string, int>
+     */
+    public function countByBoard(array $boardIds, ?object $owner): array
+    {
+        if ($boardIds === []) {
+            return [];
+        }
+        $qb = $this->entityManager->createQueryBuilder()
+            ->select('IDENTITY(t.board) AS board', 'COUNT(t.id) AS tasks')
+            ->from(Task::class, 't')
+            ->where('t.board IN (:boards)')
+            ->andWhere('t.archivedAt IS NULL')
+            ->setParameter('boards', $boardIds)
+            ->groupBy('t.board');
+        $this->onlyOwn($qb, $owner);
+        $counts = [];
+        /** @var list<array{board: string, tasks: int|string}> $rows */
+        $rows = $qb->getQuery()->getArrayResult();
+        foreach ($rows as $row) {
+            $counts[(string) $row['board']] = (int) $row['tasks'];
+        }
+
+        return $counts;
+    }
+
+    /**
+     * The tags used on the open tasks of the boards, sorted.
+     *
+     * @param list<string> $boardIds
+     *
+     * @return list<string>
+     */
+    public function tagsOf(array $boardIds): array
+    {
+        if ($boardIds === []) {
+            return [];
+        }
+        /** @var list<array{tags: mixed}> $rows */
+        $rows = $this->entityManager->createQueryBuilder()
+            ->select('t.tags AS tags')
+            ->from(Task::class, 't')
+            ->where('t.board IN (:boards)')
+            ->andWhere('t.archivedAt IS NULL')
+            ->setParameter('boards', $boardIds)
+            ->getQuery()
+            ->getArrayResult();
+        $tags = [];
+        foreach ($rows as $row) {
+            foreach (is_array($row['tags']) ? $row['tags'] : [] as $tag) {
+                if (is_string($tag) && $tag !== '') {
+                    $tags[mb_strtolower($tag)] = $tag;
+                }
+            }
+        }
+        ksort($tags);
+
+        return array_values($tags);
+    }
+
+    /**
+     * The dependencies touching the tasks, in one query.
+     *
+     * @param list<string> $taskIds
+     *
+     * @return list<TaskDependency>
+     */
+    public function dependenciesOf(array $taskIds): array
+    {
+        if ($taskIds === []) {
+            return [];
+        }
+        /** @var list<TaskDependency> $dependencies */
+        $dependencies = $this->entityManager->createQueryBuilder()
+            // Both ends with their members: whether the token may open the other end is asked of each (audit IA-I7).
+            ->select('d', 's', 'sm', 'su', 'e', 'em', 'eu')
+            ->from(TaskDependency::class, 'd')
+            ->join('d.sourceTask', 's')
+            ->leftJoin('s.members', 'sm')
+            ->leftJoin('sm.user', 'su')
+            ->join('d.targetTask', 'e')
+            ->leftJoin('e.members', 'em')
+            ->leftJoin('em.user', 'eu')
+            ->where('d.sourceTask IN (:tasks) OR d.targetTask IN (:tasks)')
+            ->setParameter('tasks', $taskIds)
+            ->getQuery()
+            ->getResult();
+
+        return $dependencies;
+    }
+
+    /**
+     * The subtasks of the tasks (checklist items among them), with their members.
+     *
+     * @param list<string> $taskIds
+     *
+     * @return list<Task>
+     */
+    public function subtasksOf(array $taskIds): array
+    {
+        if ($taskIds === []) {
+            return [];
+        }
+        /** @var list<Task> $subtasks */
+        $subtasks = $this->entityManager->createQueryBuilder()
+            ->select('t', 'm', 'u')
+            ->from(Task::class, 't')
+            ->leftJoin('t.members', 'm')
+            ->leftJoin('m.user', 'u')
+            ->where('t.parent IN (:parents)')
+            ->andWhere('t.archivedAt IS NULL')
+            ->setParameter('parents', $taskIds)
+            ->orderBy('t.position', 'ASC')
+            ->addOrderBy('t.id', 'ASC')
+            ->getQuery()
+            ->getResult();
+
+        return $subtasks;
+    }
+
+    /**
+     * Minutes logged by hand per task, in one query (the timers' time is on the task).
+     *
+     * @param list<string> $taskIds
+     *
+     * @return array<string, int>
+     */
+    public function manualMinutesOf(array $taskIds): array
+    {
+        if ($taskIds === []) {
+            return [];
+        }
+        /** @var list<array{task: string, minutes: int|string}> $rows */
+        $rows = $this->entityManager->createQueryBuilder()
+            ->select('IDENTITY(e.task) AS task', 'SUM(e.minutes) AS minutes')
+            ->from(TaskTimeEntry::class, 'e')
+            ->where('e.task IN (:tasks)')
+            ->setParameter('tasks', $taskIds)
+            ->groupBy('e.task')
+            ->getQuery()
+            ->getArrayResult();
+        $minutes = [];
+        foreach ($rows as $row) {
+            $minutes[(string) $row['task']] = (int) $row['minutes'];
+        }
+
+        return $minutes;
+    }
+
+    /**
+     * A page of a task's comments, newest first, older than (`$before`, `$beforeId`) when given. Deleted ones are left out.
+     *
+     * @return list<TaskComment>
+     */
+    public function comments(Task $task, ?DateTimeImmutable $before, ?string $beforeId, int $limit): array
+    {
+        $qb = $this->entityManager->createQueryBuilder()
+            ->select('c', 'a')
+            ->from(TaskComment::class, 'c')
+            ->leftJoin('c.author', 'a')
+            ->where('c.task = :task')
+            ->andWhere('c.deletedAt IS NULL')
+            ->setParameter('task', $task)
+            ->orderBy('c.createdAt', 'DESC')
+            ->addOrderBy('c.id', 'DESC')
+            ->setMaxResults($limit);
+        if ($before instanceof DateTimeImmutable) {
+            $qb->andWhere($beforeId !== null ? 'c.createdAt < :before OR (c.createdAt = :before AND c.id < :beforeId)' : 'c.createdAt < :before')
+                ->setParameter('before', $before);
+            if ($beforeId !== null) {
+                $qb->setParameter('beforeId', $beforeId);
+            }
+        }
+        /** @var list<TaskComment> $comments */
+        $comments = $qb->getQuery()->getResult();
+
+        return $comments;
+    }
+
+    /**
+     * The imported custom fields of a board (none without `sync.enabled`).
+     *
+     * @return list<TaskSyncField>
+     */
+    public function fieldsOf(string $boardId): array
+    {
+        if (!$this->syncEnabled) {
+            return [];
+        }
+        /** @var list<TaskSyncField> $fields */
+        $fields = $this->entityManager->createQueryBuilder()
+            ->select('f')
+            ->from(TaskSyncField::class, 'f')
+            ->where('f.board = :board')
+            ->setParameter('board', $boardId)
+            ->orderBy('f.position', 'ASC')
+            ->getQuery()
+            ->getResult();
+
+        return $fields;
+    }
+
+    /**
+     * The imported field values of the tasks, erased ones left out, by task id.
+     *
+     * @param list<string> $taskIds
+     *
+     * @return array<string, list<TaskSyncFieldValue>>
+     */
+    public function fieldValuesOf(array $taskIds): array
+    {
+        if (!$this->syncEnabled || $taskIds === []) {
+            return [];
+        }
+        /** @var list<TaskSyncFieldValue> $values */
+        $values = $this->entityManager->createQueryBuilder()
+            ->select('v', 'f')
+            ->from(TaskSyncFieldValue::class, 'v')
+            ->join('v.field', 'f')
+            ->where('v.task IN (:tasks)')
+            ->setParameter('tasks', $taskIds)
+            ->orderBy('f.position', 'ASC')
+            ->getQuery()
+            ->getResult();
+        $byTask = [];
+        foreach ($values as $value) {
+            if (!$value->isErased()) {
+                $byTask[$value->getTask()->getId()][] = $value;
+            }
+        }
+
+        return $byTask;
+    }
+
+    /**
+     * The tasks, in the order of `$ids`, with their creator, column, members and members' users.
+     *
+     * @param list<string> $ids
+     *
+     * @return list<Task>
+     */
+    public function load(array $ids): array
+    {
+        if ($ids === []) {
+            return [];
+        }
+        /** @var list<Task> $tasks */
+        $tasks = $this->entityManager->createQueryBuilder()
+            // The boards' columns too: each task shows its status among them, one query for all boards (audit IA-I8).
+            ->select('t', 'c', 'col', 'm', 'u', 'b', 'bc')
+            ->from(Task::class, 't')
+            ->join('t.board', 'b')
+            ->leftJoin('b.columns', 'bc')
+            ->leftJoin('t.creator', 'c')
+            ->leftJoin('t.column', 'col')
+            ->leftJoin('t.members', 'm')
+            ->leftJoin('m.user', 'u')
+            ->where('t.id IN (:ids)')
+            ->setParameter('ids', $ids)
+            ->getQuery()
+            ->getResult();
+        $byId = [];
+        foreach ($tasks as $task) {
+            $byId[$task->getId()] = $task;
+        }
+
+        $ordered = [];
+        foreach ($ids as $id) {
+            if (isset($byId[$id])) {
+                $ordered[] = $byId[$id];
+            }
+        }
+
+        return $ordered;
+    }
+
+    /**
+     * @param list<string> $boardIds
+     * @param list<object> $assignees
+     */
+    private function filtered(array $boardIds, TaskApiTaskFilter $filter, array $assignees, ?object $owner): QueryBuilder
+    {
+        $qb = $this->entityManager->createQueryBuilder()
+            ->from(Task::class, 't')
+            ->where('t.board IN (:boards)')
+            ->setParameter('boards', $boardIds);
+        $qb->andWhere($filter->archived ? 't.archivedAt IS NOT NULL' : 't.archivedAt IS NULL');
+        if (!$filter->subtasks) {
+            $qb->andWhere('t.parent IS NULL');
+        }
+        if (!$filter->includeClosed) {
+            $qb->andWhere('t.completedAt IS NULL');
+        }
+        if ($filter->tags !== []) {
+            // Audit IA-L3: in SQL, so the page and `last_page` cost what any filter costs. Tags are stored as a JSON list of
+            // strings: a quoted name matches one element exactly (case aside for ASCII).
+            $any = [];
+            // MySQL keeps JSON normalised (unicode and slashes unescaped); the others keep Doctrine's encoding.
+            $flags = $this->entityManager->getConnection()->getDatabasePlatform() instanceof AbstractMySQLPlatform ? JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES : 0;
+            foreach (array_values($filter->tags) as $index => $tag) {
+                $any[] = 'LOWER(' . JsonTextFunction::NAME . "(t.tags)) LIKE :tag{$index} ESCAPE '!'";
+                $qb->setParameter('tag' . $index, '%' . strtr(mb_strtolower((string) json_encode($tag, $flags)), ['!' => '!!', '%' => '!%', '_' => '!_']) . '%');
+            }
+            $qb->andWhere(implode(' OR ', $any));
+        }
+        if ($filter->statuses !== []) {
+            $qb->join('t.column', 'statusColumn')->andWhere('LOWER(statusColumn.name) IN (:statuses)')->setParameter('statuses', $filter->statuses);
+        }
+        if ($assignees !== []) {
+            $qb->andWhere('EXISTS (SELECT am.id FROM ' . TaskMember::class . ' am WHERE am.task = t AND am.memberRole = :assigneeRole AND am.user IN (:assignees))')
+                ->setParameter('assignees', $assignees)
+                ->setParameter('assigneeRole', TaskMemberRole::Assignee);
+        }
+        $columns = ['due_date' => 't.dueAt', 'date_created' => 't.createdAt', 'date_updated' => 't.updatedAt', 'date_done' => 't.completedAt'];
+        foreach ($filter->dates as $name => $date) {
+            $field = $columns[substr($name, 0, -3)];
+            $qb->andWhere($field . (str_ends_with($name, '_gt') ? ' > :' : ' < :') . $name)->setParameter($name, $date);
+        }
+        $this->onlyOwn($qb, $owner);
+
+        return $qb;
+    }
+
+    /** My tasks: created by the person, or assigned to them. Watching does not count. */
+    private function onlyOwn(QueryBuilder $qb, ?object $owner): void
+    {
+        if ($owner === null) {
+            return;
+        }
+        $qb->andWhere('t.creator = :owner OR EXISTS (SELECT om.id FROM ' . TaskMember::class . ' om WHERE om.task = t AND om.memberRole = :ownerRole AND om.user = :owner)')
+            ->setParameter('owner', $owner)
+            ->setParameter('ownerRole', TaskMemberRole::Assignee);
+    }
+}
diff --git a/src/Api/Security/TaskApiGuard.php b/src/Api/Security/TaskApiGuard.php
new file mode 100644
index 00000000..771741ff
--- /dev/null
+++ b/src/Api/Security/TaskApiGuard.php
@@ -0,0 +1,249 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Security;
+
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiPlanGateInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiWorkspaceInterface;
+use Nowo\TaskBoardBundle\Api\TaskApiCapability;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiSpace;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Enum\TaskMemberRole;
+use Nowo\TaskBoardBundle\Repository\TaskBoardRepositoryInterface;
+use Nowo\TaskBoardBundle\Repository\TaskRepositoryInterface;
+use Nowo\TaskBoardBundle\Security\TaskBoardResourceAccessChecker;
+use Nowo\TaskBoardBundle\Service\TaskCommentPolicy;
+use Nowo\TaskBoardBundle\Tenancy\TaskBoardTenant;
+use Nowo\TaskBoardBundle\Tenancy\TaskBoardTenantContext;
+use Stringable;
+
+use function array_filter;
+use function array_map;
+use function array_values;
+use function is_scalar;
+use function method_exists;
+
+/**
+ * Since 2.2.0 (spec 213): every id-based target of the API goes through here, on every request: level ∩ the person's access
+ * ∩ where, deny by default. In this order, and the first failure answers:
+ *
+ * 1. out of reach (missing, outside where, no space for its tenant, no view access, for My tasks not its own): 404, always the same;
+ * 2. the tasks module not in the plan: 403 `PLAN_001`;
+ * 3. the level may not: 403 `TOKEN_001`;
+ * 4. the person may not: 403 `ACCESS_002`.
+ */
+final readonly class TaskApiGuard
+{
+    public function __construct(
+        private TaskBoardRepositoryInterface $boards,
+        private TaskRepositoryInterface $tasks,
+        private TaskBoardResourceAccessChecker $access,
+        private TaskCommentPolicy $comments,
+        private TaskApiWorkspaceInterface $workspace,
+        private TaskApiPlanGateInterface $planGate,
+        // Audit IA-L2: with tenancy, the tenant check the UI makes through TaskBoardTenantContext::owns().
+        private ?TaskBoardTenantContext $tenantContext = null,
+    ) {
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function board(TaskApiPrincipal $principal, string $boardId, TaskApiCapability $capability): TaskBoard
+    {
+        $board = $this->boards->findById($boardId);
+        if (!$board instanceof TaskBoard || !$this->reachesBoard($principal, $board)) {
+            throw TaskApiRefusal::notFound();
+        }
+        $this->requirePlanAndLevel($principal, $board->getTenantKey(), $capability);
+
+        $allowed = match ($capability) {
+            TaskApiCapability::ReadOwn, TaskApiCapability::ReadEverything => true,
+            TaskApiCapability::EditTasks                                  => $this->access->canEditBoard($principal->user, $board),
+            TaskApiCapability::ManageBoards                               => $this->access->canManageBoard($principal->user, $board),
+            default                                                       => false, // asked of a task, not of a board
+        };
+        if (!$allowed) {
+            throw TaskApiRefusal::permissionRefused();
+        }
+
+        return $board;
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function task(TaskApiPrincipal $principal, string $taskId, TaskApiCapability $capability): Task
+    {
+        $task = $this->tasks->findById($taskId);
+        if (
+            !$task instanceof Task
+            || !$this->reachesBoard($principal, $task->getBoard())
+            || !$this->access->canViewTask($principal->user, $task)
+            || ($principal->level === TaskApiLevel::MyTasks && !$this->isOwn($principal->user, $task))
+        ) {
+            throw TaskApiRefusal::notFound();
+        }
+        $this->requirePlanAndLevel($principal, $task->getBoard()->getTenantKey(), $capability);
+
+        $allowed = match ($capability) {
+            TaskApiCapability::ReadOwn, TaskApiCapability::ReadEverything  => true,
+            TaskApiCapability::WorkOnTask, TaskApiCapability::EditTasks    => $this->access->canEditTask($principal->user, $task),
+            TaskApiCapability::Comment                                     => $this->comments->mayComment($principal->user, $task),
+            TaskApiCapability::DeleteTask, TaskApiCapability::ManageBoards => $this->access->canManageBoard($principal->user, $task->getBoard()),
+        };
+        if (!$allowed) {
+            throw TaskApiRefusal::permissionRefused();
+        }
+
+        return $task;
+    }
+
+    /**
+     * Whether the token may open this task, without a word when it may not: for what a page shows of other tasks.
+     */
+    public function canSeeTask(TaskApiPrincipal $principal, Task $task): bool
+    {
+        return $this->reachesBoard($principal, $task->getBoard())
+            && $this->access->canViewTask($principal->user, $task)
+            && ($principal->level !== TaskApiLevel::MyTasks || $this->isOwn($principal->user, $task));
+    }
+
+    /**
+     * "My tasks" (spec): assigned to the person or created by them. Watching, reviewing or being a stakeholder does not count.
+     */
+    public function isOwn(object $user, Task $task): bool
+    {
+        if ($this->sameUser($user, $task->getCreator())) {
+            return true;
+        }
+        foreach ($task->getMembers() as $member) {
+            if ($member->getMemberRole() === TaskMemberRole::Assignee && $this->sameUser($user, $member->getUser())) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private function reachesBoard(TaskApiPrincipal $principal, TaskBoard $board): bool
+    {
+        return $principal->where->reachesBoard($board)
+            && $this->ownsTenant($principal->user, $board->getTenantKey())
+            && $this->workspace->spaceOfTenant($principal, $board->getTenantKey()) !== null
+            && $this->access->canViewBoard($principal->user, $board);
+    }
+
+    /**
+     * A space the token reaches: the host answers for it, and where names its tenant or one of its boards. Reads only.
+     *
+     * @throws TaskApiRefusal
+     */
+    public function space(TaskApiPrincipal $principal, string $spaceId, TaskApiCapability $capability): TaskApiSpace
+    {
+        $space = $this->workspace->space($principal, $spaceId);
+        if (!$space instanceof TaskApiSpace || !$this->touches($principal, $space)) {
+            throw TaskApiRefusal::notFound();
+        }
+        $this->requirePlanAndLevel($principal, $space->tenantKey, $capability);
+
+        return $space;
+    }
+
+    /**
+     * Whether a space of the host may be listed for the token: where names its tenant or one of its boards, and its plan holds
+     * the module. A list leaves the others out, without a word.
+     */
+    public function lists(TaskApiPrincipal $principal, TaskApiSpace $space): bool
+    {
+        return $this->touches($principal, $space) && $this->planGate->allowsTasks($principal->user, $space->tenantKey);
+    }
+
+    /**
+     * The active boards of a tenant the token reaches and the person may view, in the host's order.
+     *
+     * @return list<TaskBoard>
+     */
+    public function visibleBoards(TaskApiPrincipal $principal, ?string $tenantKey): array
+    {
+        $visible = [];
+        foreach ($this->boardsOfTenant($tenantKey) as $board) {
+            if ($principal->where->reachesBoard($board) && $this->ownsTenant($principal->user, $tenantKey) && $this->access->canViewBoard($principal->user, $board)) {
+                $visible[] = $board;
+            }
+        }
+
+        return $visible;
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    public function requireLevel(TaskApiPrincipal $principal, TaskApiCapability $capability): void
+    {
+        if (!$capability->allows($principal->level)) {
+            throw TaskApiRefusal::levelRefused();
+        }
+    }
+
+    private function touches(TaskApiPrincipal $principal, TaskApiSpace $space): bool
+    {
+        return $this->ownsTenant($principal->user, $space->tenantKey) && $principal->where->touchesTenant($space->tenantKey, array_map(static fn (TaskBoard $board): string => $board->getId(), $this->boardsOfTenant($space->tenantKey)));
+    }
+
+    /**
+     * @return list<TaskBoard>
+     */
+    private function boardsOfTenant(?string $tenantKey): array
+    {
+        if ($tenantKey !== null) {
+            return $this->boards->findActiveByTenant($tenantKey);
+        }
+
+        return array_values(array_filter($this->boards->findAllActive(), static fn (TaskBoard $board): bool => $board->getTenantKey() === null));
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    private function requirePlanAndLevel(TaskApiPrincipal $principal, ?string $tenantKey, TaskApiCapability $capability): void
+    {
+        if (!$this->planGate->allowsTasks($principal->user, $tenantKey)) {
+            throw TaskApiRefusal::planRefused();
+        }
+        $this->requireLevel($principal, $capability);
+    }
+
+    /**
+     * With tenancy, the bundle's own answer on the tenant, whatever the host's workspace says: the resolver must open the
+     * tenant whose slug is its key for this person, as the UI asks of the tenant in its URL. A board without a tenant is not
+     * served under tenancy, as in the UI.
+     */
+    private function ownsTenant(object $user, ?string $tenantKey): bool
+    {
+        if ($this->tenantContext?->isEnabled() !== true) {
+            return true;
+        }
+
+        return $tenantKey !== null && $this->tenantContext->tenantOfKey($tenantKey, $user) instanceof TaskBoardTenant;
+    }
+
+    private function sameUser(object $user, ?object $other): bool
+    {
+        if ($other === null) {
+            return false; // an erased account is nobody
+        }
+        if ($user === $other) {
+            return true;
+        }
+        $id      = method_exists($user, 'getId') ? $user->getId() : null;
+        $otherId = method_exists($other, 'getId') ? $other->getId() : null;
+
+        return (is_scalar($id) || $id instanceof Stringable) && (is_scalar($otherId) || $otherId instanceof Stringable) && (string) $id === (string) $otherId;
+    }
+}
diff --git a/src/Api/Security/TaskApiRequestListener.php b/src/Api/Security/TaskApiRequestListener.php
new file mode 100644
index 00000000..4e107113
--- /dev/null
+++ b/src/Api/Security/TaskApiRequestListener.php
@@ -0,0 +1,229 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Security;
+
+use LogicException;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiAuthenticatorInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiRateLimiterInterface;
+use Nowo\TaskBoardBundle\Api\TaskApiAuthFailure;
+use Nowo\TaskBoardBundle\Api\TaskApiCredential;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiRateLimitState;
+use Nowo\TaskBoardBundle\Security\TaskBoardAccessCheckerInterface;
+use Psr\Log\LoggerInterface;
+use Psr\Log\NullLogger;
+use Stringable;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+use Symfony\Component\HttpFoundation\JsonResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Event\ExceptionEvent;
+use Symfony\Component\HttpKernel\Event\RequestEvent;
+use Symfony\Component\HttpKernel\Event\ResponseEvent;
+use Symfony\Component\HttpKernel\Exception\HttpExceptionInterface;
+use Symfony\Component\HttpKernel\KernelEvents;
+use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+use Symfony\Component\Security\Core\Exception\AuthenticationException;
+use Throwable;
+
+use function in_array;
+use function is_scalar;
+use function method_exists;
+use function str_starts_with;
+
+/**
+ * Since 2.2.0 (spec 213): what every API request goes through before its controller, on the API's routes only, and the way
+ * every answer leaves. Below the firewall, so the security user is set. It fails closed: anything it cannot establish is a
+ * refusal, and the credential is never logged or echoed.
+ */
+final readonly class TaskApiRequestListener implements EventSubscriberInterface
+{
+    /** Route default marking the API's routes. */
+    public const ROUTE_FLAG = '_nowo_task_board_api';
+
+    private const PRINCIPAL = '_nowo_task_board_api_principal';
+
+    private const RATE_LIMIT = '_nowo_task_board_api_rate_limit';
+
+    public function __construct(
+        private TaskApiAuthenticatorInterface $authenticator,
+        private TaskApiRateLimiterInterface $rateLimiter,
+        private TaskBoardAccessCheckerInterface $accessChecker,
+        private TokenStorageInterface $tokenStorage,
+        private string $prefix,
+        private LoggerInterface $logger = new NullLogger(),
+    ) {
+    }
+
+    public static function getSubscribedEvents(): array
+    {
+        return [
+            // The firewall is at 8.
+            KernelEvents::REQUEST  => ['onRequest', 7],
+            KernelEvents::RESPONSE => 'onResponse',
+            // Before the firewall's own (1) and the kernel's error page.
+            KernelEvents::EXCEPTION => ['onException', 16],
+        ];
+    }
+
+    public static function principalOf(Request $request): TaskApiPrincipal
+    {
+        $principal = $request->attributes->get(self::PRINCIPAL);
+
+        return $principal instanceof TaskApiPrincipal ? $principal : throw new LogicException('Not an authenticated API request.');
+    }
+
+    public function onRequest(RequestEvent $event): void
+    {
+        $request = $event->getRequest();
+        if (!$event->isMainRequest() || !$request->attributes->getBoolean(self::ROUTE_FLAG)) {
+            return;
+        }
+
+        try {
+            $request->attributes->set(self::PRINCIPAL, $this->enter($request));
+        } catch (TaskApiRefusal $refusal) {
+            $event->setResponse($this->answer($refusal));
+        }
+    }
+
+    public function onResponse(ResponseEvent $event): void
+    {
+        $request = $event->getRequest();
+        if (!$event->isMainRequest() || !$this->isApiRequest($request)) {
+            return;
+        }
+        $response = $event->getResponse();
+        $response->headers->set('Cache-Control', 'no-store, private');
+        $state = $request->attributes->get(self::RATE_LIMIT);
+        if ($state instanceof TaskApiRateLimitState) {
+            $response->headers->set('X-RateLimit-Limit', (string) $state->limit);
+            $response->headers->set('X-RateLimit-Remaining', (string) $state->remaining);
+            $response->headers->set('X-RateLimit-Reset', (string) $state->resetAt);
+        }
+    }
+
+    public function onException(ExceptionEvent $event): void
+    {
+        if (!$event->isMainRequest() || !$this->isApiRequest($event->getRequest())) {
+            return;
+        }
+        $event->setResponse($this->answer($this->refusalFor($event->getThrowable())));
+    }
+
+    /**
+     * @throws TaskApiRefusal
+     */
+    private function enter(Request $request): TaskApiPrincipal
+    {
+        $clientIp = (string) $request->getClientIp();
+        $blocked  = $this->rateLimiter->failedTokenState($clientIp);
+        if (!$blocked->accepted) {
+            $request->attributes->set(self::RATE_LIMIT, $blocked);
+
+            throw new TaskApiRefusal(Response::HTTP_TOO_MANY_REQUESTS, 'RATE_002', 'Too many failed tokens');
+        }
+        if (TaskApiCredential::fromRequest($request) === null) {
+            throw new TaskApiRefusal(Response::HTTP_UNAUTHORIZED, 'OAUTH_017', 'Authorization header required');
+        }
+
+        $principal = $this->authenticator->authenticate($request);
+        if ($principal === TaskApiAuthFailure::ApiDisabled) {
+            throw new TaskApiRefusal(Response::HTTP_NOT_FOUND, 'API_001', 'Not found');
+        }
+        if ($principal === TaskApiAuthFailure::Invalid) {
+            $this->rateLimiter->registerFailedToken($clientIp);
+
+            throw $this->invalidToken();
+        }
+        $this->requireSecurityUser($principal);
+        if (!$this->accessChecker->canAccess($principal->user)) {
+            // Audit IA-L1: the same answer as a bad token, and counted as one, so it cannot drive the host's
+            // authenticator without limit.
+            $this->rateLimiter->registerFailedToken($clientIp);
+
+            throw $this->invalidToken();
+        }
+
+        $state = $this->rateLimiter->consume($principal);
+        $request->attributes->set(self::RATE_LIMIT, $state);
+        if (!$state->accepted) {
+            throw new TaskApiRefusal(Response::HTTP_TOO_MANY_REQUESTS, 'RATE_001', 'Rate limit reached');
+        }
+
+        return $principal;
+    }
+
+    /**
+     * Access checkers read the security token, so a principal the firewall does not stand behind would be judged as someone
+     * else, or as nobody.
+     *
+     * @throws TaskApiRefusal
+     */
+    private function requireSecurityUser(TaskApiPrincipal $principal): void
+    {
+        $securityUser = $this->tokenStorage->getToken()?->getUser();
+        if ($securityUser === $principal->user || ($securityUser !== null && $this->idOf($securityUser) !== null && $this->idOf($securityUser) === $this->idOf($principal->user))) {
+            return;
+        }
+        $this->logger->error('TaskBoard API: the security user is not the token\'s user. The API must sit behind a stateless firewall that authenticates the token.', ['bundle' => 'nowo_task_board']);
+
+        throw $this->serverError();
+    }
+
+    private function idOf(object $user): ?string
+    {
+        $id = method_exists($user, 'getId') ? $user->getId() : null;
+
+        return is_scalar($id) || $id instanceof Stringable ? (string) $id : null;
+    }
+
+    private function isApiRequest(Request $request): bool
+    {
+        if ($request->attributes->getBoolean(self::ROUTE_FLAG)) {
+            return true;
+        }
+
+        // No route matched: an unknown path under the prefix answers like the rest of the API.
+        return !$request->attributes->has('_route') && str_starts_with($request->getPathInfo() . '/', $this->prefix . '/');
+    }
+
+    private function refusalFor(Throwable $throwable): TaskApiRefusal
+    {
+        if ($throwable instanceof TaskApiRefusal) {
+            return $throwable;
+        }
+        if ($throwable instanceof HttpExceptionInterface && in_array($throwable->getStatusCode(), [Response::HTTP_NOT_FOUND, Response::HTTP_METHOD_NOT_ALLOWED], true)) {
+            return TaskApiRefusal::notFound();
+        }
+        if ($throwable instanceof AccessDeniedException) {
+            return TaskApiRefusal::permissionRefused();
+        }
+        if ($throwable instanceof AuthenticationException) {
+            return $this->invalidToken();
+        }
+        // The class only: a message may hold user data.
+        $this->logger->error('TaskBoard API: unexpected error.', ['bundle' => 'nowo_task_board', 'exception_class' => $throwable::class]);
+
+        return $this->serverError();
+    }
+
+    private function invalidToken(): TaskApiRefusal
+    {
+        return new TaskApiRefusal(Response::HTTP_UNAUTHORIZED, 'OAUTH_019', 'Token not valid');
+    }
+
+    private function serverError(): TaskApiRefusal
+    {
+        return new TaskApiRefusal(Response::HTTP_INTERNAL_SERVER_ERROR, 'SERVER_001', 'Server error');
+    }
+
+    private function answer(TaskApiRefusal $refusal): JsonResponse
+    {
+        return new JsonResponse(['err' => $refusal->getMessage(), 'ECODE' => $refusal->ecode], $refusal->status);
+    }
+}
diff --git a/src/Api/Serializer/TaskApiIdentitySerializer.php b/src/Api/Serializer/TaskApiIdentitySerializer.php
new file mode 100644
index 00000000..a8a26c8d
--- /dev/null
+++ b/src/Api/Serializer/TaskApiIdentitySerializer.php
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Serializer;
+
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTeam;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiUser;
+
+/**
+ * Since 2.2.0 (spec 213): identity in ClickUp's field names. A team lists no members in v1: a documented difference.
+ */
+final class TaskApiIdentitySerializer
+{
+    /**
+     * @return array<string, string|null>
+     */
+    public function user(TaskApiUser $user): array
+    {
+        return [
+            'id'             => $user->id,
+            'username'       => $user->username,
+            'email'          => $user->email,
+            'color'          => $user->color,
+            'profilePicture' => $user->profilePicture,
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function team(TaskApiTeam $team): array
+    {
+        return [
+            'id'      => $team->id,
+            'name'    => $team->name,
+            'color'   => $team->color,
+            'avatar'  => $team->avatar,
+            'members' => [],
+        ];
+    }
+}
diff --git a/src/Api/Serializer/TaskApiReadSerializer.php b/src/Api/Serializer/TaskApiReadSerializer.php
new file mode 100644
index 00000000..90a87484
--- /dev/null
+++ b/src/Api/Serializer/TaskApiReadSerializer.php
@@ -0,0 +1,383 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Serializer;
+
+use DateTimeInterface;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiSpace;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTaskPage;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiUser;
+use Nowo\TaskBoardBundle\Entity\BoardColumn;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Enum\TaskDependencyType;
+use Nowo\TaskBoardBundle\Enum\TaskMemberRole;
+use Nowo\TaskBoardBundle\Enum\TaskPriority;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncField;
+
+use function array_key_last;
+use function array_map;
+use function array_values;
+use function base64_encode;
+use function count;
+use function in_array;
+use function rtrim;
+use function str_starts_with;
+use function strtr;
+use function substr;
+
+/**
+ * Since 2.2.0 (spec 213): what the read API answers, in ClickUp API v2's field names. Dates are Unix milliseconds as strings,
+ * ids are the bundle's and the host's strings. Fields Beacon has no equivalent for are null or empty (docs/API.md).
+ */
+final class TaskApiReadSerializer
+{
+    /** ClickUp's priorities: id, name, colour. */
+    private const PRIORITIES = [
+        'urgent' => ['1', '#f50000'],
+        'high'   => ['2', '#f8ae00'],
+        'normal' => ['3', '#6fddff'],
+        'low'    => ['4', '#d8d8d8'],
+    ];
+
+    private const CHECKLIST_TAG = 'checklist:';
+
+    /** A board is a folderless list: its folder is hidden, as ClickUp shows those. */
+    private const HIDDEN_FOLDER = ['id' => null, 'name' => 'hidden', 'hidden' => true, 'access' => true];
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function space(TaskApiSpace $space): array
+    {
+        return [
+            'id'                 => $space->id,
+            'name'               => $space->name,
+            'private'            => false,
+            'archived'           => false,
+            'statuses'           => [],
+            'multiple_assignees' => true,
+            'features'           => [
+                'due_dates'          => ['enabled' => true],
+                'time_tracking'      => ['enabled' => true],
+                'tags'               => ['enabled' => true],
+                'time_estimates'     => ['enabled' => true],
+                'checklists'         => ['enabled' => true],
+                'dependency_warning' => ['enabled' => true],
+            ],
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function board(TaskBoard $board, TaskApiSpace $space, int $taskCount): array
+    {
+        return [
+            'id'                => $board->getId(),
+            'name'              => $board->getName(),
+            'orderindex'        => 0,
+            'content'           => (string) $board->getDescription(),
+            'status'            => null,
+            'priority'          => null,
+            'assignee'          => null,
+            'task_count'        => $taskCount,
+            'due_date'          => null,
+            'start_date'        => null,
+            'folder'            => self::HIDDEN_FOLDER,
+            'space'             => ['id' => $space->id, 'name' => $space->name, 'access' => true],
+            'archived'          => $board->isArchived(),
+            'override_statuses' => true,
+            'statuses'          => $this->statuses($board),
+        ];
+    }
+
+    /**
+     * The board's columns as statuses: the first is `open`, the last `closed` (its tasks are done), the rest `custom`.
+     *
+     * @return list<array<string, mixed>>
+     */
+    public function statuses(TaskBoard $board): array
+    {
+        $columns = array_values($board->getColumns()->toArray());
+
+        return array_map(fn (BoardColumn $column): array => $this->status($column, $columns), $columns);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function task(Task $task, TaskApiTaskPage $page): array
+    {
+        $board       = $task->getBoard();
+        $space       = $page->spaces[$board->getId()];
+        $columns     = array_values($board->getColumns()->toArray());
+        $column      = $task->getColumn();
+        $spent       = $task->getTotalTimeSeconds() * 1000 + ($page->manualMinutes[$task->getId()] ?? 0) * 60000;
+        $description = (string) $task->getDescription();
+
+        $data = [
+            'id'               => $task->getId(),
+            'custom_id'        => null,
+            'name'             => $task->getTitle(),
+            'text_content'     => $description,
+            'description'      => $description,
+            'status'           => $column instanceof BoardColumn ? $this->status($column, $columns) : null,
+            'orderindex'       => (string) $task->getPosition(),
+            'date_created'     => $this->ms($task->getCreatedAt()),
+            'date_updated'     => $this->ms($task->getUpdatedAt()),
+            'date_closed'      => $this->ms($task->getCompletedAt()),
+            'date_done'        => $this->ms($task->getCompletedAt()),
+            'archived'         => $task->isArchived(),
+            'creator'          => $this->user($page->profileOf($task->getCreator())),
+            'assignees'        => $this->members($task, $page, TaskMemberRole::Assignee),
+            'group_assignees'  => [],
+            'watchers'         => $this->members($task, $page, TaskMemberRole::Watcher),
+            'checklists'       => $this->checklists($task, $page),
+            'tags'             => array_map(static fn (string $tag): array => ['name' => $tag, 'tag_fg' => null, 'tag_bg' => null], $task->getTags()),
+            'parent'           => $task->getParent()?->getId(),
+            'top_level_parent' => null,
+            'priority'         => $this->priority($task->getPriority()),
+            'due_date'         => $this->ms($task->getDueAt()),
+            'start_date'       => $this->ms($task->getStartAt()),
+            'points'           => null,
+            'time_estimate'    => $task->getEstimatedMinutes() === null ? null : (string) ($task->getEstimatedMinutes() * 60000),
+            'time_spent'       => $spent,
+            'custom_fields'    => $this->fieldValues($task, $page),
+            'dependencies'     => $this->dependencies($task, $page, false),
+            'linked_tasks'     => $this->dependencies($task, $page, true),
+            'team_id'          => $space->teamId,
+            'url'              => null,
+            'list'             => ['id' => $board->getId(), 'name' => $board->getName(), 'access' => true],
+            'project'          => self::HIDDEN_FOLDER,
+            'folder'           => self::HIDDEN_FOLDER,
+            'space'            => ['id' => $space->id],
+        ];
+        if ($page->markdown) {
+            $data['markdown_description'] = $description;
+        }
+
+        return $data;
+    }
+
+    /**
+     * A page of tasks: `{tasks, last_page}`.
+     *
+     * @return array<string, mixed>
+     */
+    public function taskPage(TaskApiTaskPage $page): array
+    {
+        return ['tasks' => array_map(fn (Task $task): array => $this->task($task, $page), $page->tasks), 'last_page' => $page->lastPage];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function comment(TaskComment $comment, ?TaskApiUser $author): array
+    {
+        return [
+            'id'           => $comment->getId(),
+            'comment'      => [['text' => $comment->getBody()]],
+            'comment_text' => $comment->getBody(),
+            'user'         => $this->user($author),
+            'resolved'     => false,
+            'assignee'     => null,
+            'assigned_by'  => null,
+            'reactions'    => [],
+            'date'         => $this->ms($comment->getCreatedAt()),
+            'reply_count'  => 0,
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function field(TaskSyncField $field): array
+    {
+        return [
+            'id'               => $field->getId(),
+            'name'             => $field->getName(),
+            'type'             => $field->getRemoteType(),
+            'type_config'      => $field->getConfig() + ($field->getChoices() !== [] ? ['options' => $field->getChoices()] : []),
+            'date_created'     => $this->ms($field->getUpdatedAt()),
+            'hide_from_guests' => false,
+            'required'         => false,
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function timeEntry(TaskApiTimeEntry $entry, string $teamId): array
+    {
+        return [
+            'id'          => $entry->id,
+            'task'        => $entry->taskId === null ? null : ['id' => $entry->taskId],
+            'wid'         => $teamId,
+            'user'        => ['id' => $entry->userApiId],
+            'billable'    => false,
+            'start'       => $this->ms($entry->start),
+            'end'         => (string) ((int) $this->ms($entry->start) + $entry->durationSeconds * 1000),
+            'duration'    => (string) ($entry->durationSeconds * 1000),
+            'description' => (string) $entry->description,
+        ];
+    }
+
+    /**
+     * @return array<string, string|null>|null
+     */
+    public function user(?TaskApiUser $user): ?array
+    {
+        return $user === null ? null : [
+            'id'             => $user->id,
+            'username'       => $user->username,
+            'email'          => $user->email,
+            'color'          => $user->color,
+            'profilePicture' => $user->profilePicture,
+        ];
+    }
+
+    /**
+     * @param list<BoardColumn> $columns
+     *
+     * @return array<string, mixed>
+     */
+    private function status(BoardColumn $column, array $columns): array
+    {
+        $index = 0;
+        foreach ($columns as $position => $candidate) {
+            if ($candidate === $column) {
+                $index = $position;
+            }
+        }
+        $type = match (true) {
+            $index === array_key_last($columns) => 'closed',
+            $index === 0                        => 'open',
+            default                             => 'custom',
+        };
+
+        return ['id' => $column->getId(), 'status' => $column->getName(), 'color' => $column->getColor(), 'orderindex' => $index, 'type' => $type];
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    private function priority(TaskPriority $priority): array
+    {
+        [$id, $color] = self::PRIORITIES[$priority->value];
+
+        return ['id' => $id, 'priority' => $priority->value, 'color' => $color, 'orderindex' => $id];
+    }
+
+    /**
+     * @return list<array<string, string|null>>
+     */
+    private function members(Task $task, TaskApiTaskPage $page, TaskMemberRole $role): array
+    {
+        $members = [];
+        foreach ($task->getMembers() as $member) {
+            $profile = $member->getMemberRole() === $role ? $this->user($page->profileOf($member->getUser())) : null;
+            if ($profile !== null) {
+                $members[] = $profile;
+            }
+        }
+
+        return $members;
+    }
+
+    /**
+     * Checklist items are subtasks tagged `checklist:<name>` (as a provider sync imports them): one checklist per name.
+     *
+     * @return list<array<string, mixed>>
+     */
+    private function checklists(Task $task, TaskApiTaskPage $page): array
+    {
+        $checklists = [];
+        foreach ($page->subtasks[$task->getId()] ?? [] as $item) {
+            foreach ($item->getTags() as $tag) {
+                if (str_starts_with($tag, self::CHECKLIST_TAG)) {
+                    $checklists[substr($tag, 10)][] = $item;
+                }
+            }
+        }
+        $answer = [];
+        foreach ($checklists as $name => $items) {
+            $resolved = count(array_filter($items, static fn (Task $item): bool => $item->isCompleted()));
+            $answer[] = [
+                'id'         => self::checklistId($task->getId(), (string) $name),
+                'task_id'    => $task->getId(),
+                'name'       => (string) $name,
+                'orderindex' => (string) count($answer),
+                'resolved'   => $resolved,
+                'unresolved' => count($items) - $resolved,
+                'items'      => array_map(fn (Task $item): array => [
+                    'id'         => $item->getId(),
+                    'name'       => $item->getTitle(),
+                    'orderindex' => $item->getPosition(),
+                    'assignee'   => $this->members($item, $page, TaskMemberRole::Assignee)[0] ?? null,
+                    'resolved'   => $item->isCompleted(),
+                    'parent'     => null,
+                    'children'   => [],
+                ], $items),
+            ];
+        }
+
+        return $answer;
+    }
+
+    /** A checklist has no row of its own: its id names the task and the checklist's name. */
+    public static function checklistId(string $taskId, string $name): string
+    {
+        return 'cl_' . rtrim(strtr(base64_encode($taskId . '|' . $name), '+/', '-_'), '=');
+    }
+
+    /**
+     * @return list<array<string, mixed>>
+     */
+    private function fieldValues(Task $task, TaskApiTaskPage $page): array
+    {
+        return array_map(static fn ($value): array => [
+            'id'    => $value->getField()->getId(),
+            'name'  => $value->getField()->getName(),
+            'type'  => $value->getField()->getRemoteType(),
+            'value' => $value->getValue(),
+        ], $page->fieldValues[$task->getId()] ?? []);
+    }
+
+    /**
+     * ClickUp's dependencies (`task_id` waits on `depends_on`) or, for `$linked`, its links (related, duplicates).
+     *
+     * @return list<array<string, mixed>>
+     */
+    private function dependencies(Task $task, TaskApiTaskPage $page, bool $linked): array
+    {
+        $answer = [];
+        foreach ($page->dependencies as $dependency) {
+            $source = $dependency->getSourceTask()->getId();
+            $target = $dependency->getTargetTask()->getId();
+            if ($source !== $task->getId() && $target !== $task->getId()) {
+                continue;
+            }
+            $type = $dependency->getDependencyType();
+            if ($linked !== in_array($type, [TaskDependencyType::Related, TaskDependencyType::Duplicates], true)) {
+                continue;
+            }
+            if ($linked) {
+                $answer[] = ['task_id' => $task->getId(), 'link_id' => $source === $task->getId() ? $target : $source, 'date_created' => $this->ms($dependency->getCreatedAt())];
+                continue;
+            }
+            [$waiting, $on] = $type === TaskDependencyType::Blocks ? [$target, $source] : [$source, $target];
+            $answer[]       = ['task_id' => $waiting, 'depends_on' => $on, 'type' => $waiting === $task->getId() ? 1 : 0, 'date_created' => $this->ms($dependency->getCreatedAt())];
+        }
+
+        return $answer;
+    }
+
+    private function ms(?DateTimeInterface $date): ?string
+    {
+        return $date?->format('Uv');
+    }
+}
diff --git a/src/Api/TaskApiAuthFailure.php b/src/Api/TaskApiAuthFailure.php
new file mode 100644
index 00000000..6c809788
--- /dev/null
+++ b/src/Api/TaskApiAuthFailure.php
@@ -0,0 +1,15 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api;
+
+/**
+ * Since 2.2.0 (spec 213): why a request has no principal. `Invalid` is one answer for unknown, revoked, expired, disabled,
+ * erased: a client learns nothing about which. `ApiDisabled`: the host's instance switch.
+ */
+enum TaskApiAuthFailure
+{
+    case Invalid;
+    case ApiDisabled;
+}
diff --git a/src/Api/TaskApiCapability.php b/src/Api/TaskApiCapability.php
new file mode 100644
index 00000000..3124eb0f
--- /dev/null
+++ b/src/Api/TaskApiCapability.php
@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api;
+
+use function in_array;
+
+/**
+ * Since 2.2.0 (spec 213): what an operation asks of the token. Anything a level does not list here is denied.
+ */
+enum TaskApiCapability
+{
+    /** Boards, spaces, identity, and the tasks a level may read: for My tasks, its own. */
+    case ReadOwn;
+
+    /** Every task, comment, member and time entry the person sees. */
+    case ReadEverything;
+
+    /** On a task within reach: status, dates, description, checklists, own time. */
+    case WorkOnTask;
+
+    /** Comment on a task within reach. */
+    case Comment;
+
+    /** Create, edit, assign and move any task, tags, links, files. */
+    case EditTasks;
+
+    /** Delete a task. */
+    case DeleteTask;
+
+    /** Boards and columns: create, edit, delete. */
+    case ManageBoards;
+
+    public function allows(TaskApiLevel $level): bool
+    {
+        return match ($level) {
+            TaskApiLevel::MyTasks => in_array($this, [self::ReadOwn, self::WorkOnTask, self::Comment], true),
+            TaskApiLevel::Read    => in_array($this, [self::ReadOwn, self::ReadEverything], true),
+            TaskApiLevel::Tasks   => $this !== self::ManageBoards,
+            TaskApiLevel::Full    => true,
+        };
+    }
+}
diff --git a/src/Api/TaskApiCredential.php b/src/Api/TaskApiCredential.php
new file mode 100644
index 00000000..362d0bb0
--- /dev/null
+++ b/src/Api/TaskApiCredential.php
@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api;
+
+use Symfony\Component\HttpFoundation\Request;
+
+use function is_string;
+use function preg_replace;
+use function trim;
+
+/**
+ * Since 2.2.0 (spec 213): the credential of a request. The `Authorization` header only, with or without `Bearer`; never
+ * the query string, where it would reach logs (FR-002).
+ */
+final class TaskApiCredential
+{
+    public static function fromRequest(Request $request): ?string
+    {
+        $header = $request->headers->get('Authorization');
+        if (!is_string($header)) {
+            return null;
+        }
+        $credential = trim((string) preg_replace('/^Bearer(\s+|$)/i', '', trim($header)));
+
+        return $credential === '' ? null : $credential;
+    }
+}
diff --git a/src/Api/TaskApiLevel.php b/src/Api/TaskApiLevel.php
new file mode 100644
index 00000000..e373e56e
--- /dev/null
+++ b/src/Api/TaskApiLevel.php
@@ -0,0 +1,17 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api;
+
+/**
+ * Since 2.2.0 (spec 213): what a token may do. Not a chain: **Read** changes nothing and **My tasks** writes on its own
+ * tasks, so ask {@see TaskApiCapability::allows()}, never compare levels.
+ */
+enum TaskApiLevel: string
+{
+    case MyTasks = 'my_tasks';
+    case Read    = 'read';
+    case Tasks   = 'tasks';
+    case Full    = 'full';
+}
diff --git a/src/Api/TaskApiPrincipal.php b/src/Api/TaskApiPrincipal.php
new file mode 100644
index 00000000..25f47e86
--- /dev/null
+++ b/src/Api/TaskApiPrincipal.php
@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api;
+
+/**
+ * Since 2.2.0 (spec 213): who a request is, as the host's authenticator answers it, for this request only. It holds no
+ * secret: `$tokenId` is an opaque id.
+ */
+final readonly class TaskApiPrincipal
+{
+    public function __construct(
+        public object $user,
+        public TaskApiLevel $level,
+        public TaskApiWhere $where,
+        public string $tokenId,
+        public string $tokenName,
+    ) {
+    }
+}
diff --git a/src/Api/TaskApiRefusal.php b/src/Api/TaskApiRefusal.php
new file mode 100644
index 00000000..2576d09f
--- /dev/null
+++ b/src/Api/TaskApiRefusal.php
@@ -0,0 +1,39 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api;
+
+use RuntimeException;
+
+/**
+ * Since 2.2.0 (spec 213): a request refused, with what the client sees: `{"err": message, "ECODE": ecode}`. The message
+ * goes to the client as it is, so it names no id or person.
+ */
+final class TaskApiRefusal extends RuntimeException
+{
+    public function __construct(public readonly int $status, public readonly string $ecode, string $message)
+    {
+        parent::__construct($message);
+    }
+
+    public static function notFound(): self
+    {
+        return new self(404, 'ACCESS_001', 'Not found');
+    }
+
+    public static function levelRefused(): self
+    {
+        return new self(403, 'TOKEN_001', 'This token may not do this');
+    }
+
+    public static function permissionRefused(): self
+    {
+        return new self(403, 'ACCESS_002', 'You may not do this');
+    }
+
+    public static function planRefused(): self
+    {
+        return new self(403, 'PLAN_001', 'The tasks module is not in this plan');
+    }
+}
diff --git a/src/Api/TaskApiWhere.php b/src/Api/TaskApiWhere.php
new file mode 100644
index 00000000..0de14a55
--- /dev/null
+++ b/src/Api/TaskApiWhere.php
@@ -0,0 +1,90 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api;
+
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+
+use function in_array;
+
+/**
+ * Since 2.2.0 (spec 213): where a token reaches, as plain data the host builds on each request. Everything the person
+ * can reach, minus some tenants (an organization that forbids tokens), or a list of tenants and boards. The bundle does not
+ * know projects or organizations: the host turns them into tenant keys.
+ */
+final readonly class TaskApiWhere
+{
+    /**
+     * @param list<string> $exceptTenantKeys
+     * @param list<string> $tenantKeys
+     * @param list<string> $boardIds
+     */
+    private function __construct(
+        private bool $everything,
+        private array $exceptTenantKeys,
+        private array $tenantKeys,
+        private array $boardIds,
+    ) {
+    }
+
+    /**
+     * @param list<string> $exceptTenantKeys tenants the host removes
+     */
+    public static function everything(array $exceptTenantKeys = []): self
+    {
+        return new self(true, $exceptTenantKeys, [], []);
+    }
+
+    /**
+     * Each entry grants on its own: a named tenant reaches all its boards, and a named board is reached even when its tenant
+     * is not listed (audit IA-I4, as intended: a token for one board of a project names the board, not the project). The
+     * person's access, the host's workspace and the tenant check still apply to it.
+     *
+     * @param list<string> $tenantKeys
+     * @param list<string> $boardIds
+     */
+    public static function limitedTo(array $tenantKeys, array $boardIds): self
+    {
+        return new self(false, [], $tenantKeys, $boardIds);
+    }
+
+    public function reachesBoard(TaskBoard $board): bool
+    {
+        return $this->reachesTenant($board->getTenantKey()) || (!$this->everything && in_array($board->getId(), $this->boardIds, true));
+    }
+
+    /**
+     * The whole tenant: creating a board there needs this. A board without a tenant is reached only by everything.
+     */
+    public function reachesTenant(?string $tenantKey): bool
+    {
+        if ($this->everything) {
+            return $tenantKey === null || !in_array($tenantKey, $this->exceptTenantKeys, true);
+        }
+
+        return $tenantKey !== null && in_array($tenantKey, $this->tenantKeys, true);
+    }
+
+    /**
+     * Whether a space may be listed: the whole tenant, or one of the given boards of it.
+     *
+     * @param list<string> $boardIdsOfTenant
+     */
+    public function touchesTenant(?string $tenantKey, array $boardIdsOfTenant): bool
+    {
+        if ($this->reachesTenant($tenantKey)) {
+            return true;
+        }
+        if ($this->everything) {
+            return false;
+        }
+        foreach ($boardIdsOfTenant as $boardId) {
+            if (in_array($boardId, $this->boardIds, true)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}
diff --git a/src/Api/Value/TaskApiAttachment.php b/src/Api/Value/TaskApiAttachment.php
new file mode 100644
index 00000000..5f8da556
--- /dev/null
+++ b/src/Api/Value/TaskApiAttachment.php
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+/**
+ * Since 2.2.0 (spec 213): a file the host stored for a task.
+ */
+final readonly class TaskApiAttachment
+{
+    public function __construct(
+        public string $id,
+        public string $title,
+        public string $url,
+        public int $size,
+    ) {
+    }
+}
diff --git a/src/Api/Value/TaskApiBoardList.php b/src/Api/Value/TaskApiBoardList.php
new file mode 100644
index 00000000..a3dcdf9d
--- /dev/null
+++ b/src/Api/Value/TaskApiBoardList.php
@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+
+/**
+ * Since 2.2.0 (spec 213): boards of a space with the tasks the token may count in each.
+ */
+final readonly class TaskApiBoardList
+{
+    /**
+     * @param list<TaskBoard> $boards
+     * @param array<string, int> $taskCounts by board id
+     */
+    public function __construct(
+        public TaskApiSpace $space,
+        public array $boards,
+        public array $taskCounts,
+    ) {
+    }
+}
diff --git a/src/Api/Value/TaskApiCommentPage.php b/src/Api/Value/TaskApiCommentPage.php
new file mode 100644
index 00000000..1dd37486
--- /dev/null
+++ b/src/Api/Value/TaskApiCommentPage.php
@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+
+/**
+ * Since 2.2.0 (spec 213): a page of comments, newest first, with their authors as the viewer may see them.
+ */
+final readonly class TaskApiCommentPage
+{
+    /**
+     * @param list<TaskComment> $comments
+     * @param array<string, TaskApiUser> $authors by comment id
+     */
+    public function __construct(
+        public array $comments,
+        public array $authors,
+    ) {
+    }
+}
diff --git a/src/Api/Value/TaskApiIdempotencyClaim.php b/src/Api/Value/TaskApiIdempotencyClaim.php
new file mode 100644
index 00000000..049b6fe7
--- /dev/null
+++ b/src/Api/Value/TaskApiIdempotencyClaim.php
@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+/**
+ * Since 2.2.0 (spec 213): the answer to a claim; the first answer's data with {@see TaskApiIdempotencyOutcome::Completed}.
+ */
+final readonly class TaskApiIdempotencyClaim
+{
+    public function __construct(
+        public TaskApiIdempotencyOutcome $outcome,
+        public ?int $status = null,
+        public ?string $body = null,
+        public ?string $tenantKey = null,
+        public ?string $boardId = null,
+    ) {
+    }
+}
diff --git a/src/Api/Value/TaskApiIdempotencyOutcome.php b/src/Api/Value/TaskApiIdempotencyOutcome.php
new file mode 100644
index 00000000..549023e8
--- /dev/null
+++ b/src/Api/Value/TaskApiIdempotencyOutcome.php
@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+/**
+ * Since 2.2.0 (spec 213): what an idempotency store answers for a key.
+ */
+enum TaskApiIdempotencyOutcome
+{
+    /** The caller goes ahead and then completes or releases the claim. */
+    case Claimed;
+
+    /** The first attempt finished: `$status` and `$body` are its answer. */
+    case Completed;
+
+    /** The first attempt is still running. */
+    case InFlight;
+
+    /** The key was used for a different request. */
+    case Mismatch;
+}
diff --git a/src/Api/Value/TaskApiNewTimeEntry.php b/src/Api/Value/TaskApiNewTimeEntry.php
new file mode 100644
index 00000000..972cf56d
--- /dev/null
+++ b/src/Api/Value/TaskApiNewTimeEntry.php
@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+use DateTimeImmutable;
+
+/**
+ * Since 2.2.0 (spec 213): a time entry to log (`POST /v2/team/{team_id}/time_entries`).
+ */
+final readonly class TaskApiNewTimeEntry
+{
+    public function __construct(
+        public string $teamId,
+        public DateTimeImmutable $start,
+        public int $durationSeconds,
+        public ?string $description = null,
+    ) {
+    }
+}
diff --git a/src/Api/Value/TaskApiRateLimitState.php b/src/Api/Value/TaskApiRateLimitState.php
new file mode 100644
index 00000000..1579fc02
--- /dev/null
+++ b/src/Api/Value/TaskApiRateLimitState.php
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+/**
+ * Since 2.2.0 (spec 213): a host's answer on a rate limit. `$resetAt`: when the window resets, Unix seconds.
+ */
+final readonly class TaskApiRateLimitState
+{
+    public function __construct(
+        public bool $accepted,
+        public int $limit,
+        public int $remaining,
+        public int $resetAt,
+    ) {
+    }
+}
diff --git a/src/Api/Value/TaskApiSpace.php b/src/Api/Value/TaskApiSpace.php
new file mode 100644
index 00000000..f6ac5cdc
--- /dev/null
+++ b/src/Api/Value/TaskApiSpace.php
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+/**
+ * Since 2.2.0 (spec 213): a ClickUp space: a host's tenant of boards. `$tenantKey` null: boards without a tenant.
+ */
+final readonly class TaskApiSpace
+{
+    public function __construct(
+        public string $id,
+        public string $name,
+        public string $teamId,
+        public ?string $tenantKey,
+    ) {
+    }
+}
diff --git a/src/Api/Value/TaskApiTaskFilter.php b/src/Api/Value/TaskApiTaskFilter.php
new file mode 100644
index 00000000..6d8faab0
--- /dev/null
+++ b/src/Api/Value/TaskApiTaskFilter.php
@@ -0,0 +1,151 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+
+use function array_filter;
+use function array_map;
+use function array_values;
+use function ctype_digit;
+use function in_array;
+use function intdiv;
+use function is_array;
+use function is_string;
+use function mb_strtolower;
+use function preg_match;
+use function strtolower;
+
+/**
+ * Since 2.2.0 (spec 213): the filters of `GET /v2/list/{id}/task` and `GET /v2/team/{id}/task`, in ClickUp's names. Parameters
+ * it does not know are ignored on reads; a malformed value is a 400, never a silent "no filter".
+ */
+final readonly class TaskApiTaskFilter
+{
+    public const PAGE_SIZE = 100;
+
+    public const ORDERS = ['id', 'created', 'updated', 'due_date'];
+
+    /**
+     * @param list<string> $statuses lower-case column names
+     * @param list<string> $assigneeIds API ids
+     * @param list<string> $tags
+     * @param array<string, DateTimeImmutable> $dates `due_date_gt` and the like
+     * @param list<string> $spaceIds team endpoint only
+     * @param list<string> $listIds team endpoint only
+     */
+    public function __construct(
+        public int $page = 0,
+        public string $orderBy = 'created',
+        public bool $reverse = false,
+        public bool $subtasks = false,
+        public bool $includeClosed = false,
+        public bool $archived = false,
+        public array $statuses = [],
+        public array $assigneeIds = [],
+        public array $tags = [],
+        public array $dates = [],
+        public bool $markdown = false,
+        public array $spaceIds = [],
+        public array $listIds = [],
+    ) {
+    }
+
+    /**
+     * @param array<string, mixed> $query the request's query, as PHP parses `statuses[]=a&statuses[]=b`
+     *
+     * @throws TaskApiRefusal
+     */
+    public static function fromQuery(array $query): self
+    {
+        $page = $query['page'] ?? '0';
+        if (!is_string($page) || !ctype_digit($page) || (int) $page > 100000) {
+            throw self::invalid('page');
+        }
+        $orderBy = $query['order_by'] ?? 'created';
+        if (!is_string($orderBy) || !in_array($orderBy, self::ORDERS, true)) {
+            throw self::invalid('order_by');
+        }
+        $dates = [];
+        foreach (['due_date', 'date_created', 'date_updated', 'date_done'] as $field) {
+            foreach (['gt', 'lt'] as $side) {
+                $name = $field . '_' . $side;
+                if (isset($query[$name])) {
+                    $dates[$name] = self::milliseconds($query[$name], $name);
+                }
+            }
+        }
+
+        return new self(
+            page: (int) $page,
+            orderBy: $orderBy,
+            reverse: self::flag($query, 'reverse'),
+            subtasks: self::flag($query, 'subtasks'),
+            includeClosed: self::flag($query, 'include_closed'),
+            archived: self::flag($query, 'archived'),
+            statuses: array_map(static fn (string $status): string => mb_strtolower($status), self::list($query, 'statuses')),
+            assigneeIds: self::list($query, 'assignees'),
+            tags: array_map(static fn (string $tag): string => mb_strtolower($tag), self::list($query, 'tags')),
+            dates: $dates,
+            markdown: self::flag($query, 'include_markdown_description'),
+            spaceIds: self::list($query, 'space_ids'),
+            listIds: self::list($query, 'list_ids'),
+        );
+    }
+
+    /**
+     * @param array<string, mixed> $query
+     */
+    public static function flag(array $query, string $name): bool
+    {
+        $value = $query[$name] ?? null;
+        if ($value === null) {
+            return false;
+        }
+        if (!is_string($value) || !in_array(strtolower($value), ['true', 'false', '1', '0'], true)) {
+            throw self::invalid($name);
+        }
+
+        return in_array(strtolower($value), ['true', '1'], true);
+    }
+
+    /**
+     * Unix milliseconds, as ClickUp sends dates.
+     *
+     * @throws TaskApiRefusal
+     */
+    public static function milliseconds(mixed $value, string $name): DateTimeImmutable
+    {
+        if (!is_string($value) || preg_match('/^-?\d{1,15}$/D', $value) !== 1) {
+            throw self::invalid($name);
+        }
+
+        return new DateTimeImmutable('@' . intdiv((int) $value, 1000));
+    }
+
+    /**
+     * @param array<string, mixed> $query
+     *
+     * @return list<string>
+     */
+    private static function list(array $query, string $name): array
+    {
+        $value = $query[$name] ?? [];
+        if (is_string($value)) {
+            $value = [$value];
+        }
+        if (!is_array($value)) {
+            throw self::invalid($name);
+        }
+
+        return array_values(array_filter($value, static fn (mixed $item): bool => is_string($item) && $item !== ''));
+    }
+
+    private static function invalid(string $name): TaskApiRefusal
+    {
+        return new TaskApiRefusal(400, 'INPUT_002', 'Invalid ' . $name);
+    }
+}
diff --git a/src/Api/Value/TaskApiTaskPage.php b/src/Api/Value/TaskApiTaskPage.php
new file mode 100644
index 00000000..018a7a13
--- /dev/null
+++ b/src/Api/Value/TaskApiTaskPage.php
@@ -0,0 +1,50 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskDependency;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncFieldValue;
+
+/**
+ * Since 2.2.0 (spec 213): tasks a token may read, with everything needed to show them, loaded in a fixed number of queries.
+ */
+final readonly class TaskApiTaskPage
+{
+    /**
+     * @param list<Task> $tasks
+     * @param array<string, TaskApiSpace> $spaces by board id
+     * @param array<string, TaskApiUser> $profiles by API id, as the viewer may see them
+     * @param array<int, string> $userIds API id by `spl_object_id()` of each user shown
+     * @param list<TaskDependency> $dependencies
+     * @param array<string, list<Task>> $subtasks by parent id
+     * @param array<string, int> $manualMinutes by task id
+     * @param array<string, list<TaskSyncFieldValue>> $fieldValues by task id
+     */
+    public function __construct(
+        public array $tasks,
+        public bool $lastPage,
+        public array $spaces,
+        public array $profiles,
+        public array $userIds,
+        public array $dependencies,
+        public array $subtasks,
+        public array $manualMinutes,
+        public array $fieldValues,
+        public bool $markdown,
+    ) {
+    }
+
+    /** The profile of a user shown on the page, or null when the host leaves them out. */
+    public function profileOf(?object $user): ?TaskApiUser
+    {
+        if ($user === null) {
+            return null;
+        }
+        $id = $this->userIds[spl_object_id($user)] ?? null;
+
+        return $id === null ? null : ($this->profiles[$id] ?? null);
+    }
+}
diff --git a/src/Api/Value/TaskApiTeam.php b/src/Api/Value/TaskApiTeam.php
new file mode 100644
index 00000000..f851a9cc
--- /dev/null
+++ b/src/Api/Value/TaskApiTeam.php
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+/**
+ * Since 2.2.0 (spec 213): a ClickUp workspace: the host's account, personal or an organization.
+ */
+final readonly class TaskApiTeam
+{
+    public function __construct(
+        public string $id,
+        public string $name,
+        public ?string $color = null,
+        public ?string $avatar = null,
+    ) {
+    }
+}
diff --git a/src/Api/Value/TaskApiTimeEntry.php b/src/Api/Value/TaskApiTimeEntry.php
new file mode 100644
index 00000000..997d65a5
--- /dev/null
+++ b/src/Api/Value/TaskApiTimeEntry.php
@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+use DateTimeImmutable;
+
+/**
+ * Since 2.2.0 (spec 213): a time entry as the host's time store answers it.
+ */
+final readonly class TaskApiTimeEntry
+{
+    public function __construct(
+        public string $id,
+        public string $userApiId,
+        public DateTimeImmutable $start,
+        public int $durationSeconds,
+        public ?string $taskId = null,
+        public ?string $description = null,
+    ) {
+    }
+}
diff --git a/src/Api/Value/TaskApiTimePage.php b/src/Api/Value/TaskApiTimePage.php
new file mode 100644
index 00000000..a7e0d11f
--- /dev/null
+++ b/src/Api/Value/TaskApiTimePage.php
@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+/**
+ * Since 2.2.0 (spec 213): the entries of one filter.
+ */
+final readonly class TaskApiTimePage
+{
+    /**
+     * @param list<TaskApiTimeEntry> $entries
+     */
+    public function __construct(public array $entries)
+    {
+    }
+}
diff --git a/src/Api/Value/TaskApiTimeQuery.php b/src/Api/Value/TaskApiTimeQuery.php
new file mode 100644
index 00000000..25cd617f
--- /dev/null
+++ b/src/Api/Value/TaskApiTimeQuery.php
@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+use DateTimeImmutable;
+
+/**
+ * Since 2.2.0 (spec 213): a filter on the time entries of a team (`GET /v2/team/{team_id}/time_entries`).
+ */
+final readonly class TaskApiTimeQuery
+{
+    /**
+     * @param list<string> $assigneeIds API ids; empty: the token's own
+     */
+    public function __construct(
+        public string $teamId,
+        public ?DateTimeImmutable $from = null,
+        public ?DateTimeImmutable $to = null,
+        public array $assigneeIds = [],
+        public ?string $taskId = null,
+    ) {
+    }
+}
diff --git a/src/Api/Value/TaskApiUser.php b/src/Api/Value/TaskApiUser.php
new file mode 100644
index 00000000..fd98cf10
--- /dev/null
+++ b/src/Api/Value/TaskApiUser.php
@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Api\Value;
+
+/**
+ * Since 2.2.0 (spec 213): a person as a viewer may see them. A field the viewer may not see is null.
+ */
+final readonly class TaskApiUser
+{
+    public function __construct(
+        public string $id,
+        public string $username,
+        public ?string $email = null,
+        public ?string $color = null,
+        public ?string $profilePicture = null,
+    ) {
+    }
+}
diff --git a/src/Controller/TaskBoardManageController.php b/src/Controller/TaskBoardManageController.php
index 2a4de892..3903611c 100644
--- a/src/Controller/TaskBoardManageController.php
+++ b/src/Controller/TaskBoardManageController.php
@@ -80,6 +80,7 @@
 use Nowo\TaskBoardBundle\Service\TaskBoardQuota;
 use Nowo\TaskBoardBundle\Service\TaskCalendarBuilder;
 use Nowo\TaskBoardBundle\Service\TaskCommentManager;
+use Nowo\TaskBoardBundle\Service\TaskCommentPolicy;
 use Nowo\TaskBoardBundle\Service\TaskDependencyManager;
 use Nowo\TaskBoardBundle\Service\TaskGanttBuilder;
 use Nowo\TaskBoardBundle\Service\TaskLinkAttacher;
@@ -91,7 +92,6 @@
 use Nowo\TaskBoardBundle\Support\TaskTree;
 use Nowo\TaskBoardBundle\Support\UserIdResolver;
 use Nowo\TaskBoardBundle\Support\UserLabel;
-use Nowo\TaskBoardBundle\Sync\Hook\LimitRefusal;
 use Nowo\TaskBoardBundle\Sync\Hook\SyncLimitCheckerInterface;
 use Nowo\TaskBoardBundle\Tenancy\FirstBoardProvisionerInterface;
 use Nowo\TaskBoardBundle\Tenancy\TaskBoardTenant;
@@ -164,6 +164,7 @@ final class TaskBoardManageController extends AbstractController
      * @param list<string> $columnIcons `board.column_icons` (since 1.11)
      * @param int $maxTasks `board.max_tasks` (since 1.21): the most tasks a board, list, Gantt or task page loads
      */
+    // @phpstan-ignore constructor.unusedParameter ($syncLimits: deprecated, kept for positional callers, audit IA-I1)
     public function __construct(
         private readonly TaskBoardAccessCheckerInterface $accessChecker,
         private readonly TaskBoardRepositoryInterface $boardRepository,
@@ -204,8 +205,9 @@ public function __construct(
         // invalid board create (`board.create_dialog_header`).
         private readonly ?TaskBoardDefaultViewResolverInterface $defaultViewResolver = null,
         private readonly ?string $createDialogHeader = null,
-        // Since 1.27.0 (audit GW-L8): the host's limit of active tasks, asked when a task is restored (with `sync.enabled`).
-        private readonly ?SyncLimitCheckerInterface $syncLimits = null,
+        // Since 1.27.0, deprecated since 2.2.0 and ignored (audit IA-I1): kept in its place so positional arguments do not
+        // move. A restore asks `TaskManager`'s limit, which the container wires from the same `sync.limit_checker`.
+        ?SyncLimitCheckerInterface $syncLimits = null,
         // Since 1.30.0 (spec 211).
         private readonly ?BoardScopeProviderInterface $scopeProvider = null,
         /** @var array<string, mixed> */
@@ -764,13 +766,13 @@ public function restoreTask(string $taskId, Request $request): RedirectResponse
         $task = $this->findTask($taskId, $user, true);
         $this->denyUnlessValidCsrfForm($request, $this->csrfActionForm('task_board_task_restore'));
         // Since 1.29.0: a completed task is not an active task, so restoring it adds nothing to the limit.
-        if ($task->isArchived() && $this->syncLimits?->check($task->getBoard(), $task->isCompleted() ? 0 : 1, 0) instanceof LimitRefusal) {
+        try {
+            if ($this->taskManager->restore($task, $user)) {
+                $this->logWrite('task_restore', ['task_id' => $taskId]);
+                $this->addFlash('success', 'task_board.flash.task_restored');
+            }
+        } catch (TaskReopenRefusedException) {
             $this->addFlash('error', 'task_board.flash.task_restore_refused');
-        } elseif ($task->isArchived()) {
-            $task->restore();
-            $this->taskManager->recordRestored($task, $user);
-            $this->logWrite('task_restore', ['task_id' => $taskId]);
-            $this->addFlash('success', 'task_board.flash.task_restored');
         }
 
         return $this->redirectToRoute($this->routes['list']['name'], ['boardId' => $task->getBoard()->getId()]);
@@ -1367,7 +1369,7 @@ public function editComment(string $taskId, string $commentId, Request $request)
         $task    = $this->findTask($taskId, $user);
         $manager = $this->commentManager ?? throw new NotFoundHttpException('Comments are not available.');
         $comment = $this->findComment($task, $commentId);
-        if (!TaskCommentManager::isAuthor($comment, $user) || !$this->canComment($user, $task)) {
+        if (!$this->commentPolicy()->mayEdit($user, $task, $comment)) {
             throw $this->createAccessDeniedException('Only the author edits a comment.');
         }
 
@@ -1438,15 +1440,19 @@ private function findComment(Task $task, string $commentId): TaskComment
         return $comment;
     }
 
+    private function commentPolicy(): TaskCommentPolicy
+    {
+        return new TaskCommentPolicy($this->resourceAccessChecker, $this->readersCanComment);
+    }
+
     private function canComment(UserInterface $user, Task $task): bool
     {
-        return $this->commentManager instanceof TaskCommentManager
-            && ($this->readersCanComment || $this->resourceAccessChecker->canEditTask($user, $task));
+        return $this->commentManager instanceof TaskCommentManager && $this->commentPolicy()->mayComment($user, $task);
     }
 
     private function canDeleteComment(UserInterface $user, Task $task, TaskComment $comment): bool
     {
-        return TaskCommentManager::isAuthor($comment, $user) || $this->resourceAccessChecker->canEditTask($user, $task);
+        return $this->commentPolicy()->mayDelete($user, $task, $comment);
     }
 
     /**
diff --git a/src/DependencyInjection/Configuration.php b/src/DependencyInjection/Configuration.php
index e8da85f4..816140c8 100644
--- a/src/DependencyInjection/Configuration.php
+++ b/src/DependencyInjection/Configuration.php
@@ -108,6 +108,44 @@ public function getConfigTreeBuilder(): TreeBuilder
                     ->setDeprecated('nowo-tech/task-board-bundle', '1.7', 'The "%node%" option at path "%path%" is deprecated and has no effect; configure the firewall and access_control in your security.yaml instead.')
                     ->defaultValue('main')
                 ->end()
+                ->arrayNode('api')
+                    ->info('Since 2.2.0 (spec 213): a REST API shaped like ClickUp API v2. Off: no route, service, listener or table. See docs/API.md.')
+                    ->addDefaultsIfNotSet()
+                    ->children()
+                        ->booleanNode('enabled')->defaultFalse()->end()
+                        ->scalarNode('prefix')
+                            ->defaultValue('/api/tasks')
+                            ->info('Base path of the API. Not affected by route_prefix or the tenant copies.')
+                            ->validate()
+                                ->ifTrue(static fn (mixed $prefix): bool => !is_string($prefix) || preg_match('#^(/[A-Za-z0-9._-]+)+$#D', $prefix) !== 1)
+                                ->thenInvalid('api.prefix must be a path such as /api/tasks, without a trailing slash.')
+                            ->end()
+                        ->end()
+                        ->booleanNode('host_decides_access')
+                            ->defaultFalse()
+                            ->info('With security.resource_scoping: false every board is open unless a listener denies it. true says the host has those listeners: without it the API refuses to build.')
+                        ->end()
+                        ->booleanNode('quota_listener_required')
+                            ->defaultTrue()
+                            ->info('Board and task creates through the API are refused unless a listener answers QUOTA_CHECK. false: a host with no plan limits.')
+                        ->end()
+                        ->integerNode('max_body_bytes')->defaultValue(1048576)->min(1024)->info('The largest JSON body.')->end()
+                        ->arrayNode('hooks')
+                            ->info('Service ids. Without them every default denies.')
+                            ->addDefaultsIfNotSet()
+                            ->children()
+                                ->scalarNode('authenticator')->defaultNull()->info('Required with enabled: Api\\Hook\\TaskApiAuthenticatorInterface.')->end()
+                                ->scalarNode('rate_limiter')->defaultNull()->info('Api\\Hook\\TaskApiRateLimiterInterface. null: every request 429.')->end()
+                                ->scalarNode('plan_gate')->defaultNull()->info('Api\\Hook\\TaskApiPlanGateInterface. null: 403 PLAN_001.')->end()
+                                ->scalarNode('workspace')->defaultNull()->info('Api\\Hook\\TaskApiWorkspaceInterface. null: every board 404.')->end()
+                                ->scalarNode('users')->defaultNull()->info('Api\\Hook\\TaskApiUsersInterface. null: nobody is known.')->end()
+                                ->scalarNode('time_entries')->defaultNull()->info('Api\\Hook\\TaskApiTimeEntriesInterface. null: 403 TIME_001.')->end()
+                                ->scalarNode('attachments')->defaultNull()->info('Api\\Hook\\TaskApiAttachmentsInterface. null: 403 FILE_001.')->end()
+                                ->scalarNode('idempotency_store')->defaultNull()->info('Api\\Hook\\TaskApiIdempotencyStoreInterface.')->end()
+                            ->end()
+                        ->end()
+                    ->end()
+                ->end()
                 ->arrayNode('security')
                     ->addDefaultsIfNotSet()
                     ->children()
diff --git a/src/DependencyInjection/TaskBoardExtension.php b/src/DependencyInjection/TaskBoardExtension.php
index dd1959b1..55cb4e48 100644
--- a/src/DependencyInjection/TaskBoardExtension.php
+++ b/src/DependencyInjection/TaskBoardExtension.php
@@ -6,6 +6,22 @@
 
 use LogicException;
 use Nowo\OutboundUrlGuardBundle\Guard\OutboundUrlGuard;
+use Nowo\TaskBoardBundle\Api\Doctrine\JsonTextFunction;
+use Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiAttachments;
+use Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiPlanGate;
+use Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiRateLimiter;
+use Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiTimeEntries;
+use Nowo\TaskBoardBundle\Api\Hook\EmptyTaskApiUsers;
+use Nowo\TaskBoardBundle\Api\Hook\EmptyTaskApiWorkspace;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiAttachmentsInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiAuthenticatorInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiIdempotencyStoreInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiPlanGateInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiRateLimiterInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiTimeEntriesInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiUsersInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiWorkspaceInterface;
+use Nowo\TaskBoardBundle\Api\Repository\TaskApiQueryRepository;
 use Nowo\TaskBoardBundle\Assignee\TaskAssigneeProviderInterface;
 use Nowo\TaskBoardBundle\Bridge\TimeTrack\ImportedTimeAggregatorListener;
 use Nowo\TaskBoardBundle\Bridge\TimeTrack\TaskBoardTaskProvider;
@@ -224,6 +240,46 @@ public function load(array $configs, ContainerBuilder $container): void
         $this->registerTaskNumbersAndCalendar($container, $loader, $config, $emName);
         $this->registerBoardCreation($container, $config['board']);
         $this->registerHostHooks($container, $config);
+        $this->registerApi($container, $loader, $config, $emName);
+    }
+
+    /**
+     * Since 2.2.0 (spec 213): `api.*`. With `enabled: false` nothing is registered: no route, service, listener or parameter.
+     *
+     * @param array<string, mixed> $config
+     */
+    private function registerApi(ContainerBuilder $container, YamlFileLoader $loader, array $config, string $emName): void
+    {
+        $api = $config['api'];
+        if (!$api['enabled']) {
+            return;
+        }
+        if (!is_string($api['hooks']['authenticator']) || $api['hooks']['authenticator'] === '') {
+            throw new LogicException('nowo_task_board.api.enabled needs api.hooks.authenticator: the service id of a Nowo\\TaskBoardBundle\\Api\\Hook\\TaskApiAuthenticatorInterface (the host keeps the tokens).');
+        }
+        if ($config['security']['allow_unauthenticated']) {
+            throw new LogicException('nowo_task_board.api.enabled cannot be used with security.allow_unauthenticated: every board would be open to every token.');
+        }
+        if (!$config['security']['resource_scoping'] && !$api['host_decides_access']) {
+            throw new LogicException('nowo_task_board.api.enabled with security.resource_scoping: false opens every board to every token unless listeners deny it. Set api.host_decides_access: true if yours do.');
+        }
+
+        $container->setParameter('nowo_task_board.api.prefix', $api['prefix']);
+        $container->setParameter('nowo_task_board.api.quota_listener_required', $api['quota_listener_required']);
+        $container->setParameter('nowo_task_board.api.max_body_bytes', $api['max_body_bytes']);
+        $loader->load('services_api.yaml');
+        $container->setAlias(TaskApiAuthenticatorInterface::class, $api['hooks']['authenticator']);
+        $container->setAlias(TaskApiRateLimiterInterface::class, $this->serviceOr($api['hooks']['rate_limiter'], DenyingTaskApiRateLimiter::class));
+        $container->setAlias(TaskApiPlanGateInterface::class, $this->serviceOr($api['hooks']['plan_gate'], DenyingTaskApiPlanGate::class));
+        $container->setAlias(TaskApiWorkspaceInterface::class, $this->serviceOr($api['hooks']['workspace'], EmptyTaskApiWorkspace::class));
+        $container->setAlias(TaskApiUsersInterface::class, $this->serviceOr($api['hooks']['users'], EmptyTaskApiUsers::class));
+        $container->setAlias(TaskApiTimeEntriesInterface::class, $this->serviceOr($api['hooks']['time_entries'], DenyingTaskApiTimeEntries::class));
+        $container->setAlias(TaskApiAttachmentsInterface::class, $this->serviceOr($api['hooks']['attachments'], DenyingTaskApiAttachments::class));
+        if (is_string($api['hooks']['idempotency_store']) && $api['hooks']['idempotency_store'] !== '') {
+            $container->setAlias(TaskApiIdempotencyStoreInterface::class, $api['hooks']['idempotency_store']);
+        }
+        $container->getDefinition(TaskBoardRouteLoader::class)->setArgument('$apiPrefix', $api['prefix']);
+        $container->getDefinition(TaskApiQueryRepository::class)->setArgument('$entityManager', new Reference(sprintf('doctrine.orm.%s_entity_manager', $emName)));
     }
 
     /**
@@ -417,9 +473,6 @@ private function registerSyncPeople(ContainerBuilder $container, array $sync): v
             ->setArgument('$fullSyncRereadsDetails', (bool) $sync['full_sync_rereads_details']);
         $container->getDefinition(SyncCustomFieldWriter::class)
             ->setArgument('$excludeTypes', $sync['custom_fields']['exclude_types']);
-        // Audit GW-L8: restoring a task by hand asks the host's limit too.
-        $container->getDefinition(TaskBoardManageController::class)
-            ->setArgument('$syncLimits', new Reference(SyncLimitCheckerInterface::class));
         $container->getDefinition(SyncTaskDetailsWriter::class)
             ->setArgument('$maxStatusCalls', (int) $sync['status_history']['max_calls_per_run']);
         $container->getDefinition(TaskBoardTwigExtension::class)
@@ -575,6 +628,11 @@ public function prepend(ContainerBuilder $container): void
             ]);
         }
 
+        // Since 2.2.0 (spec 213, audit IA-L3): the JSON-as-text function of the API's tag filter, only with api.enabled.
+        if ($container->hasExtension('doctrine') && $this->optionEnabled($container, 'api')) {
+            $container->prependExtensionConfig('doctrine', ['orm' => ['dql' => ['string_functions' => [JsonTextFunction::NAME => JsonTextFunction::class]]]]);
+        }
+
         // Since 2.1.0 (spec 214): the counter and the ledger are mapped only with task_numbers.enabled.
         if ($container->hasExtension('doctrine') && $this->optionEnabled($container, 'task_numbers')) {
             $container->prependExtensionConfig('doctrine', [
diff --git a/src/Dto/TaskFormData.php b/src/Dto/TaskFormData.php
index 5a0b2124..ba534f31 100644
--- a/src/Dto/TaskFormData.php
+++ b/src/Dto/TaskFormData.php
@@ -5,6 +5,7 @@
 namespace Nowo\TaskBoardBundle\Dto;
 
 use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Entity\Task;
 use Nowo\TaskBoardBundle\Enum\TaskPriority;
 
 /**
@@ -27,4 +28,22 @@ public function __construct(
         public ?DateTimeImmutable $startAt = null,
     ) {
     }
+
+    /**
+     * Since 2.2.0 (spec 213): the task as it stands, for a write that changes only some fields.
+     */
+    public static function fromTask(Task $task): self
+    {
+        return new self(
+            title: $task->getTitle(),
+            description: $task->getDescription(),
+            priority: $task->getPriority(),
+            columnId: $task->getColumn()?->getId(),
+            estimatedMinutes: $task->getEstimatedMinutes(),
+            dueAt: $task->getDueAt(),
+            tags: $task->getTags(),
+            color: $task->getColor(),
+            startAt: $task->getStartAt(),
+        );
+    }
 }
diff --git a/src/Event/BoardUpdatedEvent.php b/src/Event/BoardUpdatedEvent.php
new file mode 100644
index 00000000..9f601368
--- /dev/null
+++ b/src/Event/BoardUpdatedEvent.php
@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Event;
+
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Symfony\Contracts\EventDispatcher\Event;
+
+/**
+ * Since 2.2.0 (spec 213): a board was renamed or its description changed ({@see TaskBoardEvents::BOARD_UPDATED}).
+ */
+final class BoardUpdatedEvent extends Event
+{
+    /**
+     * @param list<string> $changed the fields that changed: `name`, `description`
+     */
+    public function __construct(
+        public readonly TaskBoard $board,
+        public readonly object $actor,
+        public readonly array $changed,
+    ) {
+    }
+}
diff --git a/src/Event/TaskApiWriteEvent.php b/src/Event/TaskApiWriteEvent.php
new file mode 100644
index 00000000..5c84633d
--- /dev/null
+++ b/src/Event/TaskApiWriteEvent.php
@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Event;
+
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Symfony\Contracts\EventDispatcher\Event;
+
+/**
+ * Since 2.2.0 (spec 213): one successful write through the API, after it was saved ({@see TaskBoardEvents::API_WRITE}), for
+ * the host's audit (FR-005). It holds ids and field names, never values, free text or a secret.
+ */
+final class TaskApiWriteEvent extends Event
+{
+    /**
+     * @param string $operation e.g. `task.update`, `board.delete`
+     * @param array<string, string> $targetIds other ids touched
+     * @param list<string> $changedFields field names only
+     */
+    public function __construct(
+        public readonly TaskApiPrincipal $principal,
+        public readonly string $operation,
+        public readonly ?string $tenantKey,
+        public readonly ?string $boardId,
+        public readonly ?string $taskId,
+        public readonly array $targetIds = [],
+        public readonly array $changedFields = [],
+    ) {
+    }
+}
diff --git a/src/Event/TaskBoardEvents.php b/src/Event/TaskBoardEvents.php
index 5c504700..6921e9d7 100644
--- a/src/Event/TaskBoardEvents.php
+++ b/src/Event/TaskBoardEvents.php
@@ -127,6 +127,12 @@ final class TaskBoardEvents
     /** Since 2.0.0: {@see TaskBoardQuotaCheckEvent}, before a board or tasks are written. */
     public const QUOTA_CHECK = 'nowo_task_board.quota_check';
 
+    /** Since 2.2.0 (spec 213): {@see BoardUpdatedEvent}. */
+    public const BOARD_UPDATED = 'nowo_task_board.board_updated';
+
+    /** Since 2.2.0 (spec 213): {@see TaskApiWriteEvent}, one per write through the API. */
+    public const API_WRITE = 'nowo_task_board.api_write';
+
     /** Since 1.28.0: {@see UnmatchedColumnsResolvedEvent}. */
     public const SYNC_UNMATCHED_COLUMNS_RESOLVED = 'nowo_task_board.sync_unmatched_columns_resolved';
 }
diff --git a/src/Exception/TaskLinkedToProviderException.php b/src/Exception/TaskLinkedToProviderException.php
new file mode 100644
index 00000000..9088fd98
--- /dev/null
+++ b/src/Exception/TaskLinkedToProviderException.php
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Exception;
+
+use RuntimeException;
+
+/**
+ * Since 2.2.0 (spec 213): a task that follows a provider, or has a subtask that does, is not erased on its own: the next
+ * sync would bring it back. Unlink the board first.
+ */
+final class TaskLinkedToProviderException extends RuntimeException
+{
+    public static function forTask(string $taskId): self
+    {
+        return new self('Task ' . $taskId . ' follows a provider.');
+    }
+}
diff --git a/src/Form/BoardColumnFormType.php b/src/Form/BoardColumnFormType.php
index aeb47708..837a30cc 100644
--- a/src/Form/BoardColumnFormType.php
+++ b/src/Form/BoardColumnFormType.php
@@ -8,14 +8,12 @@
 use Nowo\FormKitBundle\Form\FormOptionsTrait;
 use Nowo\TaskBoardBundle\Dto\BoardColumnFormData;
 use Nowo\TaskBoardBundle\TaskBoardBundle;
+use Nowo\TaskBoardBundle\Validation\TaskConstraints;
 use Symfony\Component\Form\AbstractType;
 use Symfony\Component\Form\Extension\Core\Type\ChoiceType;
 use Symfony\Component\Form\Extension\Core\Type\ColorType;
 use Symfony\Component\Form\FormBuilderInterface;
 use Symfony\Component\OptionsResolver\OptionsResolver;
-use Symfony\Component\Validator\Constraints\Length;
-use Symfony\Component\Validator\Constraints\NotBlank;
-use Symfony\Component\Validator\Constraints\Regex;
 
 use function strpos;
 use function substr;
@@ -28,7 +26,7 @@ final class BoardColumnFormType extends AbstractType
 {
     use FormOptionsTrait;
 
-    public const COLOR_PATTERN = '/^#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/D';
+    public const COLOR_PATTERN = TaskConstraints::COLOR_PATTERN;
 
     public function buildForm(FormBuilderInterface $builder, array $options): void
     {
@@ -36,14 +34,13 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
             // Since 1.21: an empty or missing name is a NotBlank error, not a TypeError on the DTO (string).
             'empty_data'  => '',
             'label'       => 'task_board.form.column.name',
-            'constraints' => [new NotBlank(), new Length(max: 128)],
+            'constraints' => TaskConstraints::columnName(),
             'attr'        => ['maxlength' => 128],
         ]);
         $this->addWithDefaults($builder, 'color', ColorType::class, [
-            'label'    => 'task_board.form.column.color',
-            'required' => false,
-            // Rendered inside style="…": hex colours only (#rgb, #rgba, #rrggbb, #rrggbbaa).
-            'constraints' => [new Regex(pattern: self::COLOR_PATTERN)],
+            'label'       => 'task_board.form.column.color',
+            'required'    => false,
+            'constraints' => TaskConstraints::columnColor(),
         ]);
 
         // Since 1.11: an icon picked from `board.column_icons` (no field when the list is empty).
diff --git a/src/Form/TaskBoardFormType.php b/src/Form/TaskBoardFormType.php
index ed8f0f90..e7b22565 100644
--- a/src/Form/TaskBoardFormType.php
+++ b/src/Form/TaskBoardFormType.php
@@ -8,8 +8,8 @@
 use Nowo\FormKitBundle\Form\FormOptionsTrait;
 use Nowo\TaskBoardBundle\Board\BoardScope;
 use Nowo\TaskBoardBundle\Dto\TaskBoardFormData;
-use Nowo\TaskBoardBundle\Support\BoardIcon;
 use Nowo\TaskBoardBundle\TaskBoardBundle;
+use Nowo\TaskBoardBundle\Validation\TaskConstraints;
 use Symfony\Component\Form\AbstractType;
 use Symfony\Component\Form\Extension\Core\Type\ChoiceType;
 use Symfony\Component\Form\Extension\Core\Type\FormType;
@@ -20,9 +20,7 @@
 use Symfony\Component\Form\FormInterface;
 use Symfony\Component\Form\FormView;
 use Symfony\Component\OptionsResolver\OptionsResolver;
-use Symfony\Component\Validator\Constraints\Length;
 use Symfony\Component\Validator\Constraints\NotBlank;
-use Symfony\Component\Validator\Constraints\Regex;
 
 use function array_filter;
 use function array_values;
@@ -48,17 +46,14 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
                 'help'        => 'task_board.form.board.icon_help',
                 'required'    => false,
                 'empty_data'  => null,
-                'constraints' => [
-                    new Length(max: BoardIcon::MAX_BYTES, countUnit: Length::COUNT_BYTES, maxMessage: $options['icon_too_long_message']),
-                    new Regex(pattern: BoardIcon::PATTERN, message: $options['icon_invalid_message']),
-                ],
+                'constraints' => TaskConstraints::boardIcon($options['icon_too_long_message'], $options['icon_invalid_message']),
             ] + $options['icon_form_options']);
         }
         $this->addText($builder, 'name', [
             // Since 1.21: an empty or missing name is a NotBlank error, not a TypeError on the DTO (string).
             'empty_data'  => '',
             'label'       => 'task_board.form.board.name',
-            'constraints' => [new NotBlank(), new Length(max: 255)],
+            'constraints' => TaskConstraints::boardName(),
             'attr'        => ['maxlength' => 255],
         ]);
         $this->addText($builder, 'slug', [
@@ -67,7 +62,7 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
             // Since 1.14.1: an empty slug is '' (the board creator derives it from the name), not null.
             'empty_data'  => '',
             'help'        => 'task_board.form.board.slug_help',
-            'constraints' => [new Length(max: 255)],
+            'constraints' => TaskConstraints::boardSlug(),
             'attr'        => ['maxlength' => 255],
         ]);
         // Since 1.30.0 (spec 211): `board.description_form_type` replaces the widget with no Twig override.
diff --git a/src/Form/TaskCommentFormType.php b/src/Form/TaskCommentFormType.php
index 9aba8346..c834e3e7 100644
--- a/src/Form/TaskCommentFormType.php
+++ b/src/Form/TaskCommentFormType.php
@@ -9,14 +9,13 @@
 use Nowo\TaskBoardBundle\Dto\TaskCommentFormData;
 use Nowo\TaskBoardBundle\Entity\TaskComment;
 use Nowo\TaskBoardBundle\TaskBoardBundle;
+use Nowo\TaskBoardBundle\Validation\TaskConstraints;
 use Override;
 use Symfony\Component\Form\AbstractType;
 use Symfony\Component\Form\Extension\Core\Type\HiddenType;
 use Symfony\Component\Form\Extension\Core\Type\TextareaType;
 use Symfony\Component\Form\FormBuilderInterface;
 use Symfony\Component\OptionsResolver\OptionsResolver;
-use Symfony\Component\Validator\Constraints\Length;
-use Symfony\Component\Validator\Constraints\NotBlank;
 
 /**
  * Since 1.16: a task comment — the text (the `nowo-task-board-mention` controller offers @mentions while typing) and
@@ -43,7 +42,7 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
                 'label'       => 'task_board.comment.body',
                 'label_attr'  => ['class' => 'nowo-task-sr-only'],
                 'empty_data'  => '',
-                'constraints' => [new NotBlank(), new Length(max: TaskComment::MAX_LENGTH)],
+                'constraints' => TaskConstraints::commentBody(),
                 'attr'        => [
                     'class'                             => 'form-control nowo-task-comment__input',
                     'rows'                              => 3,
diff --git a/src/Form/TaskFormType.php b/src/Form/TaskFormType.php
index 2a49f457..55fcf469 100644
--- a/src/Form/TaskFormType.php
+++ b/src/Form/TaskFormType.php
@@ -4,7 +4,6 @@
 
 namespace Nowo\TaskBoardBundle\Form;
 
-use DateTimeInterface;
 use Nowo\FormKitBundle\Attribute\FormKitConfig;
 use Nowo\FormKitBundle\Form\FormOptionsTrait;
 use Nowo\TagInputBundle\Form\TagType;
@@ -14,6 +13,7 @@
 use Nowo\TaskBoardBundle\Form\DataTransformer\MinutesToDurationTransformer;
 use Nowo\TaskBoardBundle\Form\DataTransformer\TagsToStringTransformer;
 use Nowo\TaskBoardBundle\TaskBoardBundle;
+use Nowo\TaskBoardBundle\Validation\TaskConstraints;
 use Nowo\TiptapEditorBundle\Form\TiptapEditorType;
 use Symfony\Component\Form\AbstractType;
 use Symfony\Component\Form\Extension\Core\Type\ColorType;
@@ -26,9 +26,6 @@
 use Symfony\Component\Form\FormInterface;
 use Symfony\Component\OptionsResolver\OptionsResolver;
 use Symfony\Component\Validator\Constraints\Callback;
-use Symfony\Component\Validator\Constraints\Length;
-use Symfony\Component\Validator\Constraints\NotBlank;
-use Symfony\Component\Validator\Constraints\Regex;
 use Symfony\Component\Validator\Context\ExecutionContextInterface;
 
 use function class_exists;
@@ -41,10 +38,10 @@ final class TaskFormType extends AbstractType
 {
     use FormOptionsTrait;
     /** Since 1.15: the longest title (task_board_tasks.title is VARCHAR(255)). */
-    public const TITLE_MAX = 255;
+    public const TITLE_MAX = TaskConstraints::TITLE_MAX;
 
     /** Since 1.14: a task colour is #rrggbb (the column holds 7 characters). */
-    public const COLOR_PATTERN = '/^#[0-9a-fA-F]{6}$/D';
+    public const COLOR_PATTERN = TaskConstraints::TASK_COLOR_PATTERN;
 
     public function buildForm(FormBuilderInterface $builder, array $options): void
     {
@@ -54,10 +51,9 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
 
         $this->addText($builder, 'title', [
             // Since 1.21: an empty or missing title is a NotBlank error, not a TypeError on the DTO (string).
-            'empty_data' => '',
-            'label'      => 'task_board.form.task.title',
-            // Since 1.15: the column is VARCHAR(255) — a longer title is a form error, not a database error.
-            'constraints' => [new NotBlank(), new Length(max: self::TITLE_MAX)],
+            'empty_data'  => '',
+            'label'       => 'task_board.form.task.title',
+            'constraints' => TaskConstraints::taskTitle(),
             'attr'        => ['maxlength' => self::TITLE_MAX],
         ]);
 
@@ -116,7 +112,7 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
                 'constraints'     => [new Callback(static function (mixed $startAt, ExecutionContextInterface $context): void {
                     $form  = $context->getObject();
                     $dueAt = $form instanceof FormInterface ? $form->getParent()?->get('dueAt')->getData() : null;
-                    if ($startAt instanceof DateTimeInterface && $dueAt instanceof DateTimeInterface && $startAt > $dueAt) {
+                    if (TaskConstraints::startsAfterDue($startAt, $dueAt)) {
                         $context->buildViolation('task_board.form.task.start_after_due')
                             ->setTranslationDomain('NowoTaskBoardBundle')
                             ->addViolation();
@@ -153,7 +149,7 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
             $this->addWithDefaults($builder, 'color', HiddenType::class, [
                 'label'       => 'task_board.form.task.color',
                 'required'    => false,
-                'constraints' => [new Regex(pattern: self::COLOR_PATTERN)],
+                'constraints' => TaskConstraints::taskColor(),
             ]);
             $this->addWithDefaults($builder, 'customColor', ColorType::class, [
                 'label'    => 'task_board.form.task.custom_color',
diff --git a/src/Form/TaskLinkFormType.php b/src/Form/TaskLinkFormType.php
index 90514732..d8a6a392 100644
--- a/src/Form/TaskLinkFormType.php
+++ b/src/Form/TaskLinkFormType.php
@@ -9,13 +9,11 @@
 use Nowo\TaskBoardBundle\Dto\TaskLinkFormData;
 use Nowo\TaskBoardBundle\Enum\TaskLinkType;
 use Nowo\TaskBoardBundle\TaskBoardBundle;
+use Nowo\TaskBoardBundle\Validation\TaskConstraints;
 use Symfony\Component\Form\AbstractType;
 use Symfony\Component\Form\Extension\Core\Type\EnumType;
 use Symfony\Component\Form\FormBuilderInterface;
 use Symfony\Component\OptionsResolver\OptionsResolver;
-use Symfony\Component\Validator\Constraints\Length;
-use Symfony\Component\Validator\Constraints\NotBlank;
-use Symfony\Component\Validator\Constraints\Url;
 
 /**
  * @extends AbstractType<TaskLinkFormData>
@@ -38,24 +36,19 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
             // Since 1.21: an empty or missing URL is a NotBlank error, not a TypeError on the DTO (string).
             'empty_data'  => '',
             'label'       => 'task_board.form.link.url',
-            'constraints' => [
-                new NotBlank(),
-                // Rendered as href: only http(s) — rejects javascript:, data:, vbscript:…
-                new Url(protocols: ['http', 'https'], requireTld: false),
-                new Length(max: 2048),
-            ],
-            'attr' => ['maxlength' => 2048],
+            'constraints' => TaskConstraints::linkUrl(),
+            'attr'        => ['maxlength' => 2048],
         ]);
         $this->addText($builder, 'label', [
             'label'       => 'task_board.form.link.label',
             'required'    => false,
-            'constraints' => [new Length(max: 255)],
+            'constraints' => TaskConstraints::linkLabel(),
             'attr'        => ['maxlength' => 255],
         ]);
         $this->addText($builder, 'externalId', [
             'label'       => 'task_board.form.link.external_id',
             'required'    => false,
-            'constraints' => [new Length(max: 128)],
+            'constraints' => TaskConstraints::linkExternalId(),
             'attr'        => ['maxlength' => 128],
             'help'        => 'task_board.form.link.external_id_help',
         ]);
diff --git a/src/Form/TaskTimeEntryFormType.php b/src/Form/TaskTimeEntryFormType.php
index 4de4e24d..cbaeb539 100644
--- a/src/Form/TaskTimeEntryFormType.php
+++ b/src/Form/TaskTimeEntryFormType.php
@@ -8,6 +8,7 @@
 use Nowo\FormKitBundle\Form\FormOptionsTrait;
 use Nowo\TaskBoardBundle\Dto\TaskTimeEntryFormData;
 use Nowo\TaskBoardBundle\TaskBoardBundle;
+use Nowo\TaskBoardBundle\Validation\TaskConstraints;
 use Override;
 use Symfony\Component\Form\AbstractType;
 use Symfony\Component\Form\Extension\Core\Type\DateType;
@@ -15,9 +16,6 @@
 use Symfony\Component\Form\Extension\Core\Type\TextType;
 use Symfony\Component\Form\FormBuilderInterface;
 use Symfony\Component\OptionsResolver\OptionsResolver;
-use Symfony\Component\Validator\Constraints\Length;
-use Symfony\Component\Validator\Constraints\NotNull;
-use Symfony\Component\Validator\Constraints\Range;
 
 /**
  * Since 1.15: the "Log time" dialog of the task detail — minutes spent, the day and an optional note.
@@ -30,7 +28,7 @@ final class TaskTimeEntryFormType extends AbstractType
     use FormOptionsTrait;
 
     /** At most a week of work in one entry. */
-    public const MAX_MINUTES = 10080;
+    public const MAX_MINUTES = TaskConstraints::MAX_MINUTES;
 
     /**
      * @param FormBuilderInterface<mixed> $builder
@@ -43,21 +41,21 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
             ->add('minutes', IntegerType::class, [
                 'label'       => 'task_board.time.form.minutes',
                 'help'        => 'task_board.time.form.minutes_help',
-                'constraints' => [new NotNull(), new Range(min: 1, max: self::MAX_MINUTES)],
+                'constraints' => TaskConstraints::timeMinutes(),
                 'attr'        => ['class' => 'form-control', 'min' => 1, 'max' => self::MAX_MINUTES, 'inputmode' => 'numeric'],
             ])
             ->add('loggedAt', DateType::class, [
                 'label'           => 'task_board.time.form.date',
                 'widget'          => 'single_text',
                 'input'           => 'datetime_immutable',
-                'constraints'     => [new NotNull()],
+                'constraints'     => TaskConstraints::timeLoggedAt(),
                 'invalid_message' => 'task_board.form.task.due_invalid',
                 'attr'            => ['class' => 'form-control'],
             ])
             ->add('note', TextType::class, [
                 'label'       => 'task_board.time.form.note',
                 'required'    => false,
-                'constraints' => [new Length(max: 512)],
+                'constraints' => TaskConstraints::timeNote(),
                 'attr'        => ['class' => 'form-control', 'maxlength' => 512],
             ]);
     }
diff --git a/src/Resources/config/services.yaml b/src/Resources/config/services.yaml
index 71516f49..50d5df09 100644
--- a/src/Resources/config/services.yaml
+++ b/src/Resources/config/services.yaml
@@ -15,6 +15,9 @@ services:
             - '../../Dto/'
             - '../../Event/'
             - '../../Enum/'
+            - '../../Validation/'
+            # Since 2.2.0 (spec 213): loaded only with `api.enabled` (services_api.yaml).
+            - '../../Api/'
             - '../../Exception/'
             - '../../ValueObject/'
             - '../../Import/Dto/'
@@ -176,6 +179,11 @@ services:
         arguments:
             $defaultColumns: '%nowo_task_board.board.default_columns%'
 
+    # Since 2.2.0 (spec 213): the rules of comments, for every write path.
+    Nowo\TaskBoardBundle\Service\TaskCommentPolicy:
+        arguments:
+            $readersCanComment: '%nowo_task_board.comments.readers_can_comment%'
+
     # Since 1.25: the erase cursor is signed with the application secret (audit FP-L3).
     Nowo\TaskBoardBundle\Service\TaskBoardEraser:
         arguments:
diff --git a/src/Resources/config/services_api.yaml b/src/Resources/config/services_api.yaml
new file mode 100644
index 00000000..90acb962
--- /dev/null
+++ b/src/Resources/config/services_api.yaml
@@ -0,0 +1,39 @@
+# Since 2.2.0 (spec 213): the Task API, loaded only with `api.enabled: true`.
+services:
+    _defaults:
+        autowire: true
+        autoconfigure: true
+        public: false
+
+    Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiRateLimiter: ~
+    Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiPlanGate: ~
+    Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiTimeEntries: ~
+    Nowo\TaskBoardBundle\Api\Hook\EmptyTaskApiWorkspace: ~
+    Nowo\TaskBoardBundle\Api\Hook\EmptyTaskApiUsers: ~
+    Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiAttachments: ~
+
+    Nowo\TaskBoardBundle\Api\Security\TaskApiRequestListener:
+        arguments:
+            $prefix: '%nowo_task_board.api.prefix%'
+
+    Nowo\TaskBoardBundle\Api\Serializer\TaskApiIdentitySerializer: ~
+    Nowo\TaskBoardBundle\Api\Serializer\TaskApiReadSerializer: ~
+
+    Nowo\TaskBoardBundle\Api\Repository\TaskApiQueryRepository:
+        arguments:
+            $syncEnabled: '%nowo_task_board.sync.enabled%'
+
+    # Public: any in-process caller reaches the operations and the guard without HTTP.
+    Nowo\TaskBoardBundle\Api\Security\TaskApiGuard:
+        public: true
+
+    Nowo\TaskBoardBundle\Api\Operation\TaskApiReadOperations:
+        public: true
+
+    Nowo\TaskBoardBundle\Api\Controller\TaskApiIdentityController:
+        public: true
+        tags: ['controller.service_arguments']
+
+    Nowo\TaskBoardBundle\Api\Controller\TaskApiReadController:
+        public: true
+        tags: ['controller.service_arguments']
diff --git a/src/Routing/TaskBoardRouteLoader.php b/src/Routing/TaskBoardRouteLoader.php
index 35eaca1e..6d046c8d 100644
--- a/src/Routing/TaskBoardRouteLoader.php
+++ b/src/Routing/TaskBoardRouteLoader.php
@@ -4,6 +4,9 @@
 
 namespace Nowo\TaskBoardBundle\Routing;
 
+use Nowo\TaskBoardBundle\Api\Controller\TaskApiIdentityController;
+use Nowo\TaskBoardBundle\Api\Controller\TaskApiReadController;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiRequestListener;
 use Nowo\TaskBoardBundle\Controller\TaskBoardConnectionController;
 use Nowo\TaskBoardBundle\Controller\TaskBoardManageController;
 use Symfony\Component\Config\Loader\Loader;
@@ -21,6 +24,25 @@
  */
 final class TaskBoardRouteLoader extends Loader
 {
+    /** Since 2.2.0 (spec 213): name => [path after `api.prefix`, controller, action]. */
+    private const API_ROUTES = [
+        'user'          => ['/v2/user', TaskApiIdentityController::class, 'user'],
+        'team'          => ['/v2/team', TaskApiIdentityController::class, 'teams'],
+        'spaces'        => ['/v2/team/{teamId}/space', TaskApiReadController::class, 'spaces'],
+        'team_tasks'    => ['/v2/team/{teamId}/task', TaskApiReadController::class, 'teamTasks'],
+        'time_entries'  => ['/v2/team/{teamId}/time_entries', TaskApiReadController::class, 'timeEntries'],
+        'space'         => ['/v2/space/{spaceId}', TaskApiReadController::class, 'space'],
+        'folders'       => ['/v2/space/{spaceId}/folder', TaskApiReadController::class, 'folders'],
+        'lists'         => ['/v2/space/{spaceId}/list', TaskApiReadController::class, 'lists'],
+        'space_tags'    => ['/v2/space/{spaceId}/tag', TaskApiReadController::class, 'tags'],
+        'list'          => ['/v2/list/{listId}', TaskApiReadController::class, 'list'],
+        'list_tasks'    => ['/v2/list/{listId}/task', TaskApiReadController::class, 'listTasks'],
+        'list_fields'   => ['/v2/list/{listId}/field', TaskApiReadController::class, 'fields'],
+        'task'          => ['/v2/task/{taskId}', TaskApiReadController::class, 'task'],
+        'task_comments' => ['/v2/task/{taskId}/comment', TaskApiReadController::class, 'comments'],
+        'task_members'  => ['/v2/task/{taskId}/member', TaskApiReadController::class, 'members'],
+    ];
+
     /** Default base path of the manage routes (routes.index.path). */
     private const DEFAULT_BASE = '/tools/task-board';
 
@@ -38,6 +60,8 @@ public function __construct(
         // Since 2.1.0 (spec 214): these routes exist only with their option, so a host's route lists stay as they are.
         private readonly bool $taskNumbersEnabled = false,
         private readonly bool $calendarEnabled = false,
+        // Since 2.2.0 (spec 213): the API's base path with `api.enabled`; null: no API route at all.
+        private readonly ?string $apiPrefix = null,
     ) {
     }
 
@@ -105,6 +129,7 @@ public function load(mixed $resource, ?string $type = null): RouteCollection
         }
 
         $this->addTenantCopies($collection);
+        $this->addApiRoutes($collection);
 
         return $collection;
     }
@@ -138,6 +163,29 @@ private function addRoute(RouteCollection $collection, string $key, string $acti
         );
     }
 
+    /**
+     * Since 2.2.0 (spec 213): stateless, one path per tenant-free resource: no `route_prefix` and no tenant copies. After the
+     * copies, which only read `routes`.
+     */
+    private function addApiRoutes(RouteCollection $collection): void
+    {
+        if ($this->apiPrefix === null) {
+            return;
+        }
+
+        foreach (self::API_ROUTES as $name => [$path, $controller, $action]) {
+            $collection->add('nowo_task_board_api_' . $name, new Route(
+                $this->apiPrefix . $path,
+                ['_controller' => $controller . '::' . $action, TaskApiRequestListener::ROUTE_FLAG => true, '_stateless' => true],
+                ['teamId' => '[^/]+', 'spaceId' => '[^/]+', 'listId' => '[^/]+', 'taskId' => '[^/]+'],
+                [],
+                '',
+                [],
+                ['GET'],
+            ));
+        }
+    }
+
     /**
      * `tenancy.tenant_paths`: every manage route once more per tenant path, with `{tenantSlug}` in its path.
      */
diff --git a/src/Service/TaskBoardEditor.php b/src/Service/TaskBoardEditor.php
new file mode 100644
index 00000000..fd97f1a4
--- /dev/null
+++ b/src/Service/TaskBoardEditor.php
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Service;
+
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Event\BoardUpdatedEvent;
+use Nowo\TaskBoardBundle\Event\TaskBoardEvents;
+use Nowo\TaskBoardBundle\Repository\TaskBoardRepositoryInterface;
+use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
+
+use function array_filter;
+use function array_keys;
+
+/**
+ * Since 2.2.0 (spec 213): renames a board and edits its description, with {@see TaskBoardEvents::BOARD_UPDATED} when
+ * something changed. The slug stays, as links to the board may hold it. The caller checks access and validates.
+ */
+final readonly class TaskBoardEditor
+{
+    public function __construct(
+        private TaskBoardRepositoryInterface $boardRepository,
+        private ?EventDispatcherInterface $eventDispatcher = null,
+    ) {
+    }
+
+    public function update(TaskBoard $board, string $name, ?string $description, object $actor): void
+    {
+        $changed = array_keys(array_filter([
+            'name'        => $board->getName() !== $name,
+            'description' => $board->getDescription() !== $description,
+        ]));
+        if ($changed === []) {
+            return;
+        }
+
+        $board->setName($name)->setDescription($description);
+        $this->boardRepository->save($board);
+        $this->eventDispatcher?->dispatch(new BoardUpdatedEvent($board, $actor, $changed), TaskBoardEvents::BOARD_UPDATED);
+    }
+}
diff --git a/src/Service/TaskBoardEraser.php b/src/Service/TaskBoardEraser.php
index 6d812a63..70a425e8 100644
--- a/src/Service/TaskBoardEraser.php
+++ b/src/Service/TaskBoardEraser.php
@@ -14,9 +14,11 @@
 use Nowo\TaskBoardBundle\Event\TaskBoardEvents;
 use Nowo\TaskBoardBundle\Event\TaskErasedEvent;
 use Nowo\TaskBoardBundle\Exception\InvalidEraseCursorException;
+use Nowo\TaskBoardBundle\Exception\TaskLinkedToProviderException;
 use Nowo\TaskBoardBundle\Security\EraseCursorSigner;
 use Nowo\TaskBoardBundle\Security\TaskBoardResourceAccessChecker;
 use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncAttachment;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncItem;
 use Nowo\TaskBoardBundle\Sync\TaskBoardSyncService;
 use Psr\Clock\ClockInterface;
 use Psr\Log\LoggerInterface;
@@ -31,6 +33,7 @@
 use function array_intersect_key;
 use function array_keys;
 use function array_map;
+use function array_merge;
 use function bin2hex;
 use function count;
 use function is_scalar;
@@ -111,6 +114,124 @@ public function deleteBoard(TaskBoard $board, object $actor, int $batchSize = 20
         return $this->erase($board, $actor, $batchSize, $cursor, true);
     }
 
+    /**
+     * Since 2.2.0 (spec 213): deletes one task and its subtasks, leaf-first through Doctrine (a database cascade on the
+     * parent would skip the `PreRemove` that keeps their time). Time is kept, detached. Returns how many were deleted.
+     *
+     * @throws AccessDeniedException when the actor may not manage the board
+     * @throws TaskLinkedToProviderException when the task or a subtask follows a provider: nothing is deleted
+     */
+    public function eraseTask(Task $task, object $actor): int
+    {
+        $board = $task->getBoard();
+        if (!$this->accessChecker->canManageBoard($actor, $board)) {
+            throw new AccessDeniedException('The task may not be erased.');
+        }
+        $levels = [[$task]];
+        while (($next = $this->subtasksOf($levels[array_key_last($levels)])) !== []) {
+            $levels[] = $next;
+        }
+        foreach ($levels as $level) {
+            $this->refuseLinked($level);
+        }
+        // Audit IA-M1: the files a sync stored outlive an unlink (GWd-M1), so the host learns of them here, or never.
+        $refs = $this->storedRefsOf(array_merge(...$levels));
+
+        $boardId = $board->getId();
+        $deleted = 0;
+        foreach (array_reverse($levels) as $level) {
+            foreach ($level as $erased) {
+                $this->eventDispatcher?->dispatch(new TaskErasedEvent($erased->getId(), $boardId, $erased->getTitle(), $refs[$erased->getId()] ?? [], count($erased->getTimeEntries())), TaskBoardEvents::TASK_ERASED);
+                $board->getTasks()->removeElement($erased);
+                $erased->getParent()?->getSubtasks()->removeElement($erased);
+                $this->entityManager->remove($erased);
+                ++$deleted;
+            }
+            $this->entityManager->flush();
+        }
+        $this->logger->info('TaskBoard task erased', ['bundle' => 'nowo_task_board', 'board_id' => $boardId, 'tasks' => $deleted]);
+
+        return $deleted;
+    }
+
+    /**
+     * @param list<Task> $tasks
+     *
+     * @return list<Task>
+     */
+    private function subtasksOf(array $tasks): array
+    {
+        /** @var list<Task> $subtasks */
+        $subtasks = $this->entityManager->createQueryBuilder()
+            ->select('t')
+            ->from(Task::class, 't')
+            ->where('t.parent IN (:parents)')
+            ->setParameter('parents', $tasks)
+            ->getQuery()
+            ->getResult();
+
+        return $subtasks;
+    }
+
+    /**
+     * The storage refs of the files a sync stored for the tasks, per task id, read and their rows removed (a database that
+     * does not enforce the foreign key would keep them, with nothing left to name them).
+     *
+     * @param list<Task> $tasks
+     *
+     * @return array<string, list<string>>
+     */
+    private function storedRefsOf(array $tasks): array
+    {
+        if (!$this->syncService instanceof TaskBoardSyncService) {
+            return [];
+        }
+        /** @var list<array{taskId: string, ref: string}> $rows */
+        $rows = $this->entityManager->createQueryBuilder()
+            ->select('IDENTITY(a.task) AS taskId', 'a.storedRef AS ref')
+            ->from(TaskSyncAttachment::class, 'a')
+            ->where('a.task IN (:tasks)')
+            ->setParameter('tasks', $tasks)
+            ->getQuery()
+            ->getArrayResult();
+        $refs = [];
+        foreach ($rows as $row) {
+            $refs[(string) $row['taskId']][] = (string) $row['ref'];
+        }
+        if ($refs !== []) {
+            $this->entityManager->createQueryBuilder()
+                ->delete(TaskSyncAttachment::class, 'a')
+                ->where('a.task IN (:tasks)')
+                ->setParameter('tasks', $tasks)
+                ->getQuery()
+                ->execute();
+        }
+
+        return $refs;
+    }
+
+    /**
+     * @param list<Task> $tasks
+     */
+    private function refuseLinked(array $tasks): void
+    {
+        if (!$this->syncService instanceof TaskBoardSyncService) {
+            return;
+        }
+        /** @var list<array{id: string}> $rows */
+        $rows = $this->entityManager->createQueryBuilder()
+            ->select('IDENTITY(i.task) AS id')
+            ->from(TaskSyncItem::class, 'i')
+            ->where('i.task IN (:tasks)')
+            ->setParameter('tasks', $tasks)
+            ->setMaxResults(1)
+            ->getQuery()
+            ->getArrayResult();
+        if (isset($rows[0])) {
+            throw TaskLinkedToProviderException::forTask((string) $rows[0]['id']);
+        }
+    }
+
     private function erase(TaskBoard $board, object $actor, int $batchSize, ?EraseCursor $cursor, bool $deleteBoard): EraseProgress
     {
         if (!$this->accessChecker->canManageBoard($actor, $board)) {
diff --git a/src/Service/TaskCommentPolicy.php b/src/Service/TaskCommentPolicy.php
new file mode 100644
index 00000000..a631ed3a
--- /dev/null
+++ b/src/Service/TaskCommentPolicy.php
@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Service;
+
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Security\TaskBoardResourceAccessChecker;
+
+/**
+ * Since 2.2.0 (spec 213): who may write, edit and delete a task's comments, for every write path. Readers comment unless
+ * `comments.readers_can_comment` is false; only the author edits; the author or an editor of the task deletes.
+ */
+final readonly class TaskCommentPolicy
+{
+    public function __construct(
+        private TaskBoardResourceAccessChecker $accessChecker,
+        private bool $readersCanComment,
+    ) {
+    }
+
+    public function mayComment(object $user, Task $task): bool
+    {
+        return $this->readersCanComment || $this->accessChecker->canEditTask($user, $task);
+    }
+
+    public function mayEdit(object $user, Task $task, TaskComment $comment): bool
+    {
+        return TaskCommentManager::isAuthor($comment, $user) && $this->mayComment($user, $task);
+    }
+
+    public function mayDelete(object $user, Task $task, TaskComment $comment): bool
+    {
+        return TaskCommentManager::isAuthor($comment, $user) || $this->accessChecker->canEditTask($user, $task);
+    }
+}
diff --git a/src/Service/TaskDependencyManager.php b/src/Service/TaskDependencyManager.php
index c658c515..60c3a56b 100644
--- a/src/Service/TaskDependencyManager.php
+++ b/src/Service/TaskDependencyManager.php
@@ -92,6 +92,23 @@ public function remove(Task $task, string $dependencyId, object $user): bool
         return false;
     }
 
+    /**
+     * Since 2.2.0 (spec 213): the dependencies joining the two tasks, in either direction.
+     *
+     * @return list<TaskDependency>
+     */
+    public function findBetween(Task $task, Task $other): array
+    {
+        $found = [];
+        foreach ([...$task->getOutgoingDependencies(), ...$task->getIncomingDependencies()] as $dependency) {
+            if ($dependency->getSourceTask()->getId() === $other->getId() || $dependency->getTargetTask()->getId() === $other->getId()) {
+                $found[] = $dependency;
+            }
+        }
+
+        return $found;
+    }
+
     /**
      * Every dependency of the given tasks, once.
      *
diff --git a/src/Service/TaskManager.php b/src/Service/TaskManager.php
index 29f2746c..aeed184b 100644
--- a/src/Service/TaskManager.php
+++ b/src/Service/TaskManager.php
@@ -446,6 +446,44 @@ private function nextPosition(TaskBoard $board, ?BoardColumn $column): int
         return $max + 1;
     }
 
+    /**
+     * Since 2.2.0 (spec 213): makes an archived task active again, asking the host's limit when it adds an active task (a
+     * completed one adds nothing). False when the task is not archived.
+     *
+     * @throws TaskReopenRefusedException when the host's limit refuses it: nothing changes
+     */
+    public function restore(Task $task, object $user): bool
+    {
+        if (!$task->isArchived()) {
+            return false;
+        }
+        $refusal = $this->limits?->check($task->getBoard(), $task->isCompleted() ? 0 : 1, 0);
+        if ($refusal instanceof LimitRefusal) {
+            throw new TaskReopenRefusedException($refusal);
+        }
+
+        $task->restore();
+        $this->recordRestored($task, $user);
+
+        return true;
+    }
+
+    /**
+     * Since 2.2.0 (spec 213): archives a task by hand, with its history. False when it already is.
+     */
+    public function archive(Task $task, object $user): bool
+    {
+        if ($task->isArchived()) {
+            return false;
+        }
+
+        $task->archive();
+        $this->changeRecorder->record($task, $user, TaskChangeType::Archived, null, 'manual');
+        $this->taskRepository->save($task);
+
+        return true;
+    }
+
     /**
      * Since 1.23: records and saves a restored task.
      */
diff --git a/src/Validation/TaskConstraints.php b/src/Validation/TaskConstraints.php
new file mode 100644
index 00000000..8ca36d84
--- /dev/null
+++ b/src/Validation/TaskConstraints.php
@@ -0,0 +1,147 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Validation;
+
+use DateTimeInterface;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Support\BoardIcon;
+use Symfony\Component\Validator\Constraint;
+use Symfony\Component\Validator\Constraints\Length;
+use Symfony\Component\Validator\Constraints\NotBlank;
+use Symfony\Component\Validator\Constraints\NotNull;
+use Symfony\Component\Validator\Constraints\Range;
+use Symfony\Component\Validator\Constraints\Regex;
+use Symfony\Component\Validator\Constraints\Url;
+
+/**
+ * Since 2.2.0 (spec 213): the rules of the fields a write takes, in one place, so that a write that does not go through
+ * a form cannot store what the form refuses (a title over the column's size, a `javascript:` link, a colour that breaks
+ * out of `style="…"`). The form types use these and only add their labels and widgets.
+ */
+final class TaskConstraints
+{
+    /** The `task_board_tasks.title` column. */
+    public const TITLE_MAX = 255;
+
+    /** Rendered inside style="…": hex colours only (#rgb, #rgba, #rrggbb, #rrggbbaa). */
+    public const COLOR_PATTERN = '/^#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/D';
+
+    /** A task colour is #rrggbb (the column holds 7 characters). */
+    public const TASK_COLOR_PATTERN = '/^#[0-9a-fA-F]{6}$/D';
+
+    /** At most a week of work in one time entry. */
+    public const MAX_MINUTES = 10080;
+
+    public const COLUMN_NAME_MAX = 128;
+
+    public const NOTE_MAX = 512;
+
+    public const URL_MAX = 2048;
+
+    public const LABEL_MAX = 255;
+
+    public const EXTERNAL_ID_MAX = 128;
+
+    public const BOARD_TEXT_MAX = 255;
+
+    /** @return list<Constraint> */
+    public static function taskTitle(): array
+    {
+        // Since 1.15: the column is VARCHAR(255) — a longer title is an error, not a database error.
+        return [new NotBlank(), new Length(max: self::TITLE_MAX)];
+    }
+
+    /** @return list<Constraint> */
+    public static function taskColor(): array
+    {
+        return [new Regex(pattern: self::TASK_COLOR_PATTERN)];
+    }
+
+    /** @return list<Constraint> */
+    public static function boardName(): array
+    {
+        return [new NotBlank(), new Length(max: self::BOARD_TEXT_MAX)];
+    }
+
+    /** @return list<Constraint> */
+    public static function boardSlug(): array
+    {
+        return [new Length(max: self::BOARD_TEXT_MAX)];
+    }
+
+    /** @return list<Constraint> */
+    public static function boardIcon(string $tooLongMessage, string $invalidMessage): array
+    {
+        return [
+            new Length(max: BoardIcon::MAX_BYTES, countUnit: Length::COUNT_BYTES, maxMessage: $tooLongMessage),
+            new Regex(pattern: BoardIcon::PATTERN, message: $invalidMessage),
+        ];
+    }
+
+    /** @return list<Constraint> */
+    public static function columnName(): array
+    {
+        return [new NotBlank(), new Length(max: self::COLUMN_NAME_MAX)];
+    }
+
+    /** @return list<Constraint> */
+    public static function columnColor(): array
+    {
+        return [new Regex(pattern: self::COLOR_PATTERN)];
+    }
+
+    /** @return list<Constraint> */
+    public static function commentBody(): array
+    {
+        return [new NotBlank(), new Length(max: TaskComment::MAX_LENGTH)];
+    }
+
+    /** @return list<Constraint> */
+    public static function timeMinutes(): array
+    {
+        return [new NotNull(), new Range(min: 1, max: self::MAX_MINUTES)];
+    }
+
+    /** @return list<Constraint> */
+    public static function timeLoggedAt(): array
+    {
+        return [new NotNull()];
+    }
+
+    /** @return list<Constraint> */
+    public static function timeNote(): array
+    {
+        return [new Length(max: self::NOTE_MAX)];
+    }
+
+    /** @return list<Constraint> */
+    public static function linkUrl(): array
+    {
+        return [
+            new NotBlank(),
+            // Rendered as href: only http(s) — rejects javascript:, data:, vbscript:…
+            new Url(protocols: ['http', 'https'], requireTld: false),
+            new Length(max: self::URL_MAX),
+        ];
+    }
+
+    /** @return list<Constraint> */
+    public static function linkLabel(): array
+    {
+        return [new Length(max: self::LABEL_MAX)];
+    }
+
+    /** @return list<Constraint> */
+    public static function linkExternalId(): array
+    {
+        return [new Length(max: self::EXTERNAL_ID_MAX)];
+    }
+
+    /** The rule of a task's dates: a start after the due date is an error. Either may be absent. */
+    public static function startsAfterDue(mixed $startAt, mixed $dueAt): bool
+    {
+        return $startAt instanceof DateTimeInterface && $dueAt instanceof DateTimeInterface && $startAt > $dueAt;
+    }
+}
diff --git a/tests/Functional/Api/ApiGuardTest.php b/tests/Functional/Api/ApiGuardTest.php
new file mode 100644
index 00000000..2c1b7dc4
--- /dev/null
+++ b/tests/Functional/Api/ApiGuardTest.php
@@ -0,0 +1,229 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use Nowo\TaskBoardBundle\Api\Security\TaskApiGuard;
+use Nowo\TaskBoardBundle\Api\TaskApiCapability;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\TaskApiWhere;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Entity\TaskMember;
+use Nowo\TaskBoardBundle\Enum\TaskMemberRole;
+use Nowo\TaskBoardBundle\Event\BoardAccessCheckEvent;
+use Nowo\TaskBoardBundle\Event\TaskAccessCheckEvent;
+use Nowo\TaskBoardBundle\Event\TaskBoardEvents;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+use Nowo\TaskBoardBundle\Tests\Functional\App\Entity\AppUser;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+
+/**
+ * Spec 213: level ∩ the person's access ∩ where, on every id-based target; every denial asserted.
+ */
+final class ApiGuardTest extends ApiTestCase
+{
+    private const TENANT = 'tenant-a';
+
+    private TaskBoard $board;
+
+    private Task $task;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        ApiTestHost::$tenants = [self::TENANT];
+        $this->board          = $this->board(tenantKey: self::TENANT);
+        $this->task           = $this->task($this->board, 'Owned by the owner');
+    }
+
+    public function testAMissingTargetIsNotFound(): void
+    {
+        $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->board($this->principal(), 'nothing', TaskApiCapability::ReadOwn));
+        $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->task($this->principal(), 'nothing', TaskApiCapability::ReadOwn));
+    }
+
+    public function testOutsideWhereIsNotFoundWhateverTheLevel(): void
+    {
+        $other = TaskApiWhere::limitedTo(['tenant-b'], ['another-board']);
+        foreach (TaskApiLevel::cases() as $level) {
+            $principal = $this->principal($level, $other);
+            $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->board($principal, $this->board->getId(), TaskApiCapability::ReadOwn));
+            $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->task($principal, $this->task->getId(), TaskApiCapability::ReadOwn));
+        }
+    }
+
+    public function testATenantTheHostForbidsIsNotFound(): void
+    {
+        $principal = $this->principal(where: TaskApiWhere::everything([self::TENANT]));
+
+        $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->board($principal, $this->board->getId(), TaskApiCapability::ReadOwn));
+    }
+
+    public function testNamingABoardOrItsTenantInWhereReachesIt(): void
+    {
+        foreach ([TaskApiWhere::limitedTo([self::TENANT], []), TaskApiWhere::limitedTo([], [$this->board->getId()])] as $where) {
+            self::assertSame($this->board->getId(), $this->guard()->board($this->principal(where: $where), $this->board->getId(), TaskApiCapability::ReadOwn)->getId());
+        }
+    }
+
+    public function testATenantWithoutASpaceIsNotFound(): void
+    {
+        ApiTestHost::$tenants = [];
+
+        $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->board($this->principal(), $this->board->getId(), TaskApiCapability::ReadOwn));
+    }
+
+    public function testNoViewAccessIsNotFoundAndARemovedMemberStopsAtOnce(): void
+    {
+        $principal = $this->principal();
+        self::assertSame($this->board->getId(), $this->guard()->board($principal, $this->board->getId(), TaskApiCapability::ReadOwn)->getId());
+
+        // The next request: the host's listener no longer lets them in.
+        $this->dispatcher()->addListener(TaskBoardEvents::BOARD_ACCESS_CHECK, static function (BoardAccessCheckEvent $event): void {
+            $event->deny();
+        });
+
+        $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->board($principal, $this->board->getId(), TaskApiCapability::ReadOwn));
+        $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->task($principal, $this->task->getId(), TaskApiCapability::ReadOwn));
+    }
+
+    public function testATaskTheHostDeniesIsNotFound(): void
+    {
+        $this->dispatcher()->addListener(TaskBoardEvents::TASK_ACCESS_CHECK, static function (TaskAccessCheckEvent $event): void {
+            $event->deny();
+        });
+
+        $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->task($this->principal(), $this->task->getId(), TaskApiCapability::ReadOwn));
+    }
+
+    public function testMyTasksSeesOnlyWhatItCreatedOrIsAssigned(): void
+    {
+        $other     = $this->user('other@example.com');
+        $principal = new TaskApiPrincipal($other, TaskApiLevel::MyTasks, TaskApiWhere::everything(), 'id', 'name');
+
+        $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->task($principal, $this->task->getId(), TaskApiCapability::ReadOwn));
+
+        // Watching does not count.
+        $this->member($this->task, $other, TaskMemberRole::Watcher);
+        $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->task($principal, $this->task->getId(), TaskApiCapability::ReadOwn));
+
+        $this->member($this->task, $other, TaskMemberRole::Assignee);
+        self::assertSame($this->task->getId(), $this->guard()->task($principal, $this->task->getId(), TaskApiCapability::ReadOwn)->getId());
+
+        // Their own task, created by them.
+        $mine = new Task(board: $this->board, title: 'Mine', creator: $other);
+        $this->em->persist($mine);
+        $this->em->flush();
+        self::assertSame($mine->getId(), $this->guard()->task($principal, $mine->getId(), TaskApiCapability::WorkOnTask)->getId());
+    }
+
+    public function testAReadTokenSeesAnothersTaskAndAnErasedCreatorIsNobody(): void
+    {
+        $other = $this->user('other@example.com');
+        self::assertSame($this->task->getId(), $this->guard()->task(new TaskApiPrincipal($other, TaskApiLevel::Read, TaskApiWhere::everything(), 'id', 'name'), $this->task->getId(), TaskApiCapability::ReadEverything)->getId());
+
+        self::assertFalse($this->guard()->isOwn($other, new Task(board: $this->board, title: 'Orphan', creator: null)));
+        self::assertTrue($this->guard()->isOwn($this->owner, new Task(board: $this->board, title: 'Same object', creator: $this->owner)));
+        self::assertFalse($this->guard()->isOwn(new class {}, new Task(board: $this->board, title: 'No ids', creator: $this->owner)));
+    }
+
+    public function testAPlanWithoutTheModuleIsARefusalOnlyForWhatCanBeSeen(): void
+    {
+        ApiTestHost::$planRefusesTenants = [self::TENANT];
+
+        $this->assertDenied(403, 'PLAN_001', fn () => $this->guard()->board($this->principal(), $this->board->getId(), TaskApiCapability::ReadOwn));
+        $this->assertDenied(403, 'PLAN_001', fn () => $this->guard()->task($this->principal(), $this->task->getId(), TaskApiCapability::ReadOwn));
+
+        // Out of reach comes first.
+        $outside = $this->principal(where: TaskApiWhere::limitedTo([], []));
+        $this->assertDenied(404, 'ACCESS_001', fn () => $this->guard()->board($outside, $this->board->getId(), TaskApiCapability::ReadOwn));
+    }
+
+    public function testALevelThatMayNotIsARefusalForWhatItCanSee(): void
+    {
+        $read = $this->principal(TaskApiLevel::Read);
+        $this->assertDenied(403, 'TOKEN_001', fn () => $this->guard()->task($read, $this->task->getId(), TaskApiCapability::WorkOnTask));
+        $this->assertDenied(403, 'TOKEN_001', fn () => $this->guard()->task($read, $this->task->getId(), TaskApiCapability::Comment));
+        $this->assertDenied(403, 'TOKEN_001', fn () => $this->guard()->board($read, $this->board->getId(), TaskApiCapability::EditTasks));
+
+        $mine = $this->principal(TaskApiLevel::MyTasks);
+        $this->assertDenied(403, 'TOKEN_001', fn () => $this->guard()->task($mine, $this->task->getId(), TaskApiCapability::EditTasks));
+        $this->assertDenied(403, 'TOKEN_001', fn () => $this->guard()->task($mine, $this->task->getId(), TaskApiCapability::ReadEverything));
+        $this->assertDenied(403, 'TOKEN_001', fn () => $this->guard()->board($mine, $this->board->getId(), TaskApiCapability::EditTasks));
+
+        $tasks = $this->principal(TaskApiLevel::Tasks);
+        $this->assertDenied(403, 'TOKEN_001', fn () => $this->guard()->board($tasks, $this->board->getId(), TaskApiCapability::ManageBoards));
+        self::assertSame($this->task->getId(), $this->guard()->task($tasks, $this->task->getId(), TaskApiCapability::DeleteTask)->getId());
+    }
+
+    public function testAReadOnlyPersonIsARefusalWhateverTheToken(): void
+    {
+        $this->dispatcher()->addListener(TaskBoardEvents::BOARD_ACCESS_CHECK, static function (BoardAccessCheckEvent $event): void {
+            if ($event->getAction() === BoardAccessCheckEvent::ACTION_VIEW) {
+                $event->grant();
+                $event->markReadOnly();
+            } else {
+                $event->deny();
+            }
+        });
+        $full = $this->principal();
+
+        self::assertSame($this->board->getId(), $this->guard()->board($full, $this->board->getId(), TaskApiCapability::ReadEverything)->getId());
+        $this->assertDenied(403, 'ACCESS_002', fn () => $this->guard()->board($full, $this->board->getId(), TaskApiCapability::EditTasks));
+        $this->assertDenied(403, 'ACCESS_002', fn () => $this->guard()->board($full, $this->board->getId(), TaskApiCapability::ManageBoards));
+        $this->assertDenied(403, 'ACCESS_002', fn () => $this->guard()->task($full, $this->task->getId(), TaskApiCapability::WorkOnTask));
+        $this->assertDenied(403, 'ACCESS_002', fn () => $this->guard()->task($full, $this->task->getId(), TaskApiCapability::EditTasks));
+        $this->assertDenied(403, 'ACCESS_002', fn () => $this->guard()->task($full, $this->task->getId(), TaskApiCapability::DeleteTask));
+        $this->assertDenied(403, 'ACCESS_002', fn () => $this->guard()->task($full, $this->task->getId(), TaskApiCapability::ManageBoards));
+        // readers_can_comment is on by default.
+        self::assertSame($this->task->getId(), $this->guard()->task($full, $this->task->getId(), TaskApiCapability::Comment)->getId());
+    }
+
+    public function testACapabilityOfATaskIsNotGrantedOnABoard(): void
+    {
+        foreach ([TaskApiCapability::WorkOnTask, TaskApiCapability::Comment, TaskApiCapability::DeleteTask] as $capability) {
+            $this->assertDenied(403, 'ACCESS_002', fn () => $this->guard()->board($this->principal(), $this->board->getId(), $capability));
+        }
+    }
+
+    private function principal(TaskApiLevel $level = TaskApiLevel::Full, ?TaskApiWhere $where = null): TaskApiPrincipal
+    {
+        return new TaskApiPrincipal($this->owner, $level, $where ?? TaskApiWhere::everything(), 'id', 'name');
+    }
+
+    private function member(Task $task, AppUser $user, TaskMemberRole $role): void
+    {
+        $task->addMember(new TaskMember(task: $task, user: $user, memberRole: $role));
+        $this->em->flush();
+    }
+
+    private function assertDenied(int $status, string $ecode, callable $call): void
+    {
+        try {
+            $call();
+            self::fail('TaskApiRefusal ' . $ecode . ' expected');
+        } catch (TaskApiRefusal $refusal) {
+            self::assertSame([$status, $ecode], [$refusal->status, $refusal->ecode]);
+        }
+    }
+
+    private function guard(): TaskApiGuard
+    {
+        $guard = self::getContainer()->get(TaskApiGuard::class);
+        self::assertInstanceOf(TaskApiGuard::class, $guard);
+
+        return $guard;
+    }
+
+    private function dispatcher(): EventDispatcherInterface
+    {
+        $dispatcher = self::getContainer()->get('event_dispatcher');
+        self::assertInstanceOf(EventDispatcherInterface::class, $dispatcher);
+
+        return $dispatcher;
+    }
+}
diff --git a/tests/Functional/Api/ApiOffHostTest.php b/tests/Functional/Api/ApiOffHostTest.php
new file mode 100644
index 00000000..639300d5
--- /dev/null
+++ b/tests/Functional/Api/ApiOffHostTest.php
@@ -0,0 +1,109 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use Doctrine\ORM\Mapping\ClassMetadata;
+use Doctrine\ORM\Tools\SchemaTool;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiGuard;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiRequestListener;
+use Nowo\TaskBoardBundle\Tests\Functional\FunctionalTestCase;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+use Symfony\Component\Routing\RouterInterface;
+
+use function array_filter;
+use function array_map;
+use function get_debug_type;
+use function is_array;
+use function sort;
+use function str_contains;
+
+/**
+ * Spec 213, the opt-in rule: with `api.enabled: false` a host gets no route, no service it did not have, no listener and no
+ * required schema, and the API's hooks may be set without any of that changing.
+ */
+final class ApiOffHostTest extends FunctionalTestCase
+{
+    private const API_NAMESPACE = 'Nowo\\TaskBoardBundle\\Api\\';
+
+    public function testNoRouteExists(): void
+    {
+        $routes = $this->router()->getRouteCollection()->all();
+
+        foreach ($routes as $name => $route) {
+            self::assertFalse(str_contains($name, '_api_'), $name);
+            self::assertFalse($route->hasDefault(TaskApiRequestListener::ROUTE_FLAG), $name);
+            self::assertFalse(str_contains($route->getPath(), '/v2/'), $route->getPath());
+        }
+    }
+
+    public function testThePathAnswersWhatAnUnknownPathAnswers(): void
+    {
+        $this->client->request('GET', '/api/tasks/v2/user', [], [], ['HTTP_AUTHORIZATION' => 'bt_placeholder']);
+
+        self::assertResponseStatusCodeSame(404);
+        self::assertStringNotContainsString('application/json', (string) $this->client->getResponse()->headers->get('Content-Type'));
+        self::assertFalse($this->client->getResponse()->headers->has('X-RateLimit-Limit'));
+    }
+
+    public function testNoServiceOfTheApiExists(): void
+    {
+        $container = self::getContainer();
+        foreach ($this->serviceIds($container) as $id) {
+            self::assertFalse(str_contains($id, self::API_NAMESPACE), $id);
+            self::assertFalse(str_contains($id, 'nowo_task_board.api'), $id);
+        }
+        self::assertFalse($container->has(TaskApiGuard::class));
+        self::assertFalse($container->has(TaskApiRequestListener::class));
+    }
+
+    public function testNoParameterOfTheApiExists(): void
+    {
+        self::assertFalse(self::getContainer()->hasParameter('nowo_task_board.api.prefix'));
+    }
+
+    public function testNoListenerOfTheApiIsSubscribed(): void
+    {
+        $dispatcher = self::getContainer()->get('event_dispatcher');
+        self::assertInstanceOf(EventDispatcherInterface::class, $dispatcher);
+        foreach ($dispatcher->getListeners() as $event => $listeners) {
+            foreach ($listeners as $listener) {
+                $class = is_array($listener) ? get_debug_type($listener[0]) : get_debug_type($listener);
+                self::assertFalse(str_contains($class, self::API_NAMESPACE), $class . ' on ' . $event);
+            }
+        }
+    }
+
+    public function testNoTableOfTheApiIsRequired(): void
+    {
+        /** @var list<ClassMetadata<object>> $metadata */
+        $metadata = $this->em->getMetadataFactory()->getAllMetadata();
+        foreach ($metadata as $class) {
+            self::assertFalse(str_contains($class->getName(), self::API_NAMESPACE), $class->getName());
+            self::assertFalse(str_contains($class->getTableName(), 'api'), $class->getTableName());
+        }
+        self::assertSame([], array_filter((new SchemaTool($this->em))->getUpdateSchemaSql($metadata), static fn (string $sql): bool => str_contains($sql, 'api')));
+    }
+
+    /**
+     * @return list<string>
+     */
+    private function serviceIds(ContainerInterface $container): array
+    {
+        self::assertTrue(method_exists($container, 'getServiceIds'));
+        $ids = array_map('strval', $container->getServiceIds());
+        sort($ids);
+
+        return $ids;
+    }
+
+    private function router(): RouterInterface
+    {
+        $router = self::getContainer()->get('router');
+        self::assertInstanceOf(RouterInterface::class, $router);
+
+        return $router;
+    }
+}
diff --git a/tests/Functional/Api/ApiPipelineTest.php b/tests/Functional/Api/ApiPipelineTest.php
new file mode 100644
index 00000000..762a0b7b
--- /dev/null
+++ b/tests/Functional/Api/ApiPipelineTest.php
@@ -0,0 +1,299 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiKernel;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+use PHPUnit\Framework\Attributes\DataProvider;
+use RuntimeException;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+use Symfony\Component\HttpFoundation\Exception\BadRequestException;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Event\ControllerEvent;
+use Symfony\Component\HttpKernel\Exception\ServiceUnavailableHttpException;
+use Symfony\Component\HttpKernel\KernelEvents;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+use Symfony\Component\Security\Core\Exception\BadCredentialsException;
+use Throwable;
+
+use function json_encode;
+
+/**
+ * Spec 213: what every API request goes through, and the way every answer leaves. Refusals share one shape.
+ */
+final class ApiPipelineTest extends ApiTestCase
+{
+    public function testAKnownTokenReadsItsIdentityWithTheRateHeaders(): void
+    {
+        $this->issueToken();
+
+        $this->get('/api/tasks/v2/user');
+
+        self::assertResponseIsSuccessful();
+        self::assertSame(['user' => [
+            'id'             => 'uuid-' . $this->owner->getId(),
+            'username'       => 'owner@example.com',
+            'email'          => 'owner@example.com',
+            'color'          => null,
+            'profilePicture' => null,
+        ]], $this->json());
+        $headers = $this->client->getResponse()->headers;
+        self::assertSame('100', $headers->get('X-RateLimit-Limit'));
+        self::assertSame('99', $headers->get('X-RateLimit-Remaining'));
+        self::assertSame('1790000000', $headers->get('X-RateLimit-Reset'));
+        self::assertStringContainsString('no-store', (string) $headers->get('Cache-Control'));
+        self::assertStringContainsString('private', (string) $headers->get('Cache-Control'));
+        self::assertSame(1, ApiTestHost::$consumed);
+    }
+
+    public function testTheBearerFormWorksToo(): void
+    {
+        $this->issueToken();
+
+        $this->get('/api/tasks/v2/user', 'Bearer ' . self::TOKEN);
+
+        self::assertResponseIsSuccessful();
+    }
+
+    public function testTeamsAnswerInClickUpsShape(): void
+    {
+        $this->issueToken(TaskApiLevel::MyTasks);
+
+        $this->get('/api/tasks/v2/team');
+
+        self::assertResponseIsSuccessful();
+        self::assertSame(['teams' => [
+            ['id' => 'team-1', 'name' => 'Personal', 'color' => '#000000', 'avatar' => 'https://example.com/a.png', 'members' => []],
+            ['id' => 'team-2', 'name' => 'Acme', 'color' => null, 'avatar' => null, 'members' => []],
+        ]], $this->json());
+    }
+
+    public function testNoCredentialIsNotAFailedToken(): void
+    {
+        $this->get('/api/tasks/v2/user', null);
+
+        $this->assertRefused(401, 'OAUTH_017');
+        self::assertSame([], ApiTestHost::$failedIps);
+    }
+
+    public function testAnEmptyHeaderIsNoCredential(): void
+    {
+        $this->get('/api/tasks/v2/user', 'Bearer   ');
+
+        $this->assertRefused(401, 'OAUTH_017');
+    }
+
+    public function testACredentialInTheQueryStringIsIgnored(): void
+    {
+        $this->issueToken();
+
+        $this->get('/api/tasks/v2/user?token=' . self::TOKEN . '&access_token=' . self::TOKEN . '&Authorization=' . self::TOKEN, null);
+
+        $this->assertRefused(401, 'OAUTH_017');
+    }
+
+    public function testAnUnknownTokenIsAFailedToken(): void
+    {
+        $this->get('/api/tasks/v2/user', 'bt_unknown');
+
+        $this->assertRefused(401, 'OAUTH_019');
+        self::assertSame(['127.0.0.1'], ApiTestHost::$failedIps);
+        self::assertSame(0, ApiTestHost::$consumed);
+    }
+
+    public function testAnIpOverTheFailedTokenLimitIsRefusedEvenWithAGoodToken(): void
+    {
+        $this->issueToken();
+        ApiTestHost::$ipLimitAccepts = false;
+
+        $this->get('/api/tasks/v2/user');
+
+        $this->assertRefused(429, 'RATE_002');
+        self::assertSame('1790000060', $this->client->getResponse()->headers->get('X-RateLimit-Reset'));
+        self::assertSame(0, ApiTestHost::$consumed);
+    }
+
+    public function testATokenOverItsLimitIs429WithTheHeaders(): void
+    {
+        $this->issueToken();
+        ApiTestHost::$tokenLimitAccepts = false;
+
+        $this->get('/api/tasks/v2/user');
+
+        $this->assertRefused(429, 'RATE_001');
+        self::assertSame('0', $this->client->getResponse()->headers->get('X-RateLimit-Remaining'));
+    }
+
+    public function testTheInstanceSwitchAnswers404(): void
+    {
+        $this->issueToken();
+        ApiTestHost::$apiDisabled = true;
+
+        $this->get('/api/tasks/v2/user');
+
+        $this->assertRefused(404, 'API_001');
+        self::assertSame([], ApiTestHost::$failedIps);
+    }
+
+    public function testAUserTheAccessCheckerRefusesIsNotLetIn(): void
+    {
+        $this->user('guest@example.com', ['ROLE_GUEST']);
+        $this->issueToken(email: 'guest@example.com');
+
+        $this->get('/api/tasks/v2/user');
+
+        $this->assertRefused(401, 'OAUTH_019');
+        self::assertSame(0, ApiTestHost::$consumed);
+    }
+
+    public function testATokenWhoseUserIsRefusedCountsAsAFailedToken(): void
+    {
+        // Audit IA-L1 (the auditor's proof, turned): the same 401 as a bad token, and throttled as one.
+        $this->user('guest@example.com', ['ROLE_GUEST']);
+        $this->issueToken(email: 'guest@example.com');
+
+        for ($i = 0; $i < 3; ++$i) {
+            $this->get('/api/tasks/v2/user');
+            $this->assertRefused(401, 'OAUTH_019');
+        }
+
+        self::assertSame(['127.0.0.1', '127.0.0.1', '127.0.0.1'], ApiTestHost::$failedIps);
+        self::assertSame(0, ApiTestHost::$consumed);
+    }
+
+    public function testAPrincipalTheFirewallDoesNotStandBehindFailsClosed(): void
+    {
+        $other = $this->user('other@example.com');
+        $this->issueToken();
+        ApiTestHost::$forcedUser = $other;
+
+        $this->get('/api/tasks/v2/user');
+
+        $this->assertRefused(500, 'SERVER_001');
+        self::assertCount(1, array_filter($this->logger()->records, static fn (array $record): bool => $record['level'] === 'error' && str_contains((string) $record['message'], 'security user')));
+    }
+
+    public function testAPlanWithoutTheModuleIsRefusedOnIdentity(): void
+    {
+        $this->issueToken();
+        ApiTestHost::$planAllows = false;
+
+        foreach (['user', 'team'] as $path) {
+            $this->get('/api/tasks/v2/' . $path);
+            $this->assertRefused(403, 'PLAN_001');
+        }
+    }
+
+    public function testAPersonTheHostDoesNotProfileIsNotFound(): void
+    {
+        $this->issueToken();
+
+        ApiTestHost::$profilesEmpty = true;
+
+        $this->get('/api/tasks/v2/user');
+
+        $this->assertRefused(404, 'ACCESS_001');
+    }
+
+    public function testUnknownPathsAndMethodsUnderThePrefixAnswerInTheSameShape(): void
+    {
+        $this->issueToken();
+
+        $this->get('/api/tasks/v2/nothing');
+        $this->assertRefused(404, 'ACCESS_001');
+        $this->get('/api/tasks');
+        $this->assertRefused(404, 'ACCESS_001');
+        $this->client->request('POST', '/api/tasks/v2/user', [], [], ['HTTP_AUTHORIZATION' => self::TOKEN]);
+        $this->assertRefused(404, 'ACCESS_001');
+    }
+
+    public function testAPathOutsideThePrefixIsNotTheApis(): void
+    {
+        $this->get('/api/tasksandmore');
+
+        self::assertResponseStatusCodeSame(404);
+        self::assertStringNotContainsString('application/json', (string) $this->client->getResponse()->headers->get('Content-Type'));
+    }
+
+    /**
+     * @return iterable<string, array{0: Throwable, 1: int, 2: string}>
+     */
+    public static function failures(): iterable
+    {
+        yield 'a refusal' => [new TaskApiRefusal(409, 'LIST_001', 'Last column'), 409, 'LIST_001'];
+        yield 'access denied' => [new AccessDeniedException(), 403, 'ACCESS_002'];
+        yield 'bad credentials' => [new BadCredentialsException(), 401, 'OAUTH_019'];
+        yield 'any other HTTP error' => [new ServiceUnavailableHttpException(), 500, 'SERVER_001'];
+        yield 'a bad request' => [new BadRequestException('secret detail'), 500, 'SERVER_001'];
+        yield 'a crash' => [new RuntimeException('secret detail'), 500, 'SERVER_001'];
+    }
+
+    #[DataProvider('failures')]
+    public function testAFailureInAControllerLeavesAsARefusalWithoutItsMessage(Throwable $failure, int $status, string $ecode): void
+    {
+        $this->issueToken();
+        $this->withListener(KernelEvents::CONTROLLER, static function () use ($failure): void {
+            throw $failure;
+        });
+
+        $this->get('/api/tasks/v2/user');
+
+        $this->assertRefused($status, $ecode);
+        self::assertStringNotContainsString('secret detail', (string) $this->client->getResponse()->getContent());
+    }
+
+    public function testTheCredentialReachesNoLogNoAnswerAndNoSession(): void
+    {
+        $this->issueToken();
+        $this->get('/api/tasks/v2/user');
+        $good = (string) $this->client->getResponse()->getContent();
+        $this->get('/api/tasks/v2/user', 'bt_unknown_secret_value');
+        $bad = (string) $this->client->getResponse()->getContent();
+
+        $logged = (string) json_encode($this->logger()->records);
+        foreach ([self::TOKEN, 'bt_unknown_secret_value'] as $secret) {
+            self::assertStringNotContainsString($secret, $logged);
+            self::assertStringNotContainsString($secret, $good);
+            self::assertStringNotContainsString($secret, $bad);
+        }
+        self::assertFalse($this->client->getResponse()->headers->has('Set-Cookie'), 'stateless');
+    }
+
+    public function testASubRequestDoesNotEnterThePipeline(): void
+    {
+        $this->issueToken();
+        $kernel = self::$kernel;
+        self::assertInstanceOf(ApiKernel::class, $kernel);
+        $request = Request::create('/api/tasks/v2/user');
+        $request->headers->set('Authorization', self::TOKEN);
+
+        $this->withListener(KernelEvents::CONTROLLER, static function (ControllerEvent $event) use ($kernel): void {
+            if ($event->isMainRequest()) {
+                // An API route without the pipeline has no principal, and the error is the host's page.
+                $response = $kernel->handle(Request::create('/api/tasks/v2/user'), $kernel::SUB_REQUEST);
+                self::assertSame(500, $response->getStatusCode());
+                self::assertFalse($response->headers->has('X-RateLimit-Limit'));
+            }
+        });
+
+        $response = $kernel->handle($request);
+        self::assertSame(200, $response->getStatusCode());
+        self::assertSame(1, ApiTestHost::$consumed);
+    }
+
+    private function withListener(string $event, callable $listener): void
+    {
+        $dispatcher = $this->service('event_dispatcher');
+        self::assertInstanceOf(EventDispatcherInterface::class, $dispatcher);
+        $dispatcher->addListener($event, $listener);
+    }
+
+    private function service(string $id): mixed
+    {
+        return self::getContainer()->get($id);
+    }
+}
diff --git a/tests/Functional/Api/ApiQueryBudgetTest.php b/tests/Functional/Api/ApiQueryBudgetTest.php
new file mode 100644
index 00000000..d026ec9f
--- /dev/null
+++ b/tests/Functional/Api/ApiQueryBudgetTest.php
@@ -0,0 +1,154 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Entity\TaskDependency;
+use Nowo\TaskBoardBundle\Entity\TaskMember;
+use Nowo\TaskBoardBundle\Entity\TaskTimeEntry;
+use Nowo\TaskBoardBundle\Enum\TaskDependencyType;
+use Nowo\TaskBoardBundle\Enum\TaskMemberRole;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+use PHPUnit\Framework\Attributes\DataProvider;
+use Symfony\Bridge\Doctrine\Middleware\Debug\DebugDataHolder;
+
+use function count;
+use function sprintf;
+
+use const STDERR;
+
+/**
+ * Spec 213 SC-003 and FR-010: a list costs the same number of queries with 25 tasks as with 100, each task with members,
+ * subtasks, a dependency, time and a comment. The budget counts every query of the request, the user's included.
+ */
+final class ApiQueryBudgetTest extends ApiTestCase
+{
+    /** The most queries a list endpoint may make, whatever the page holds. */
+    private const BUDGET = 12;
+
+    /**
+     * @return iterable<string, array{0: string}>
+     */
+    public static function endpoints(): iterable
+    {
+        yield 'list tasks' => ['/api/tasks/v2/list/{board}/task?subtasks=true&include_closed=true'];
+        yield 'team tasks' => ['/api/tasks/v2/team/team-1/task?subtasks=true'];
+        yield 'list tasks for my tasks' => ['my:/api/tasks/v2/list/{board}/task'];
+        yield 'lists of a space' => ['/api/tasks/v2/space/space-tenant-a/list'];
+        yield 'tags of a space' => ['/api/tasks/v2/space/space-tenant-a/tag'];
+        yield 'comments' => ['/api/tasks/v2/task/{first}/comment'];
+        yield 'list tasks by tag' => ['/api/tasks/v2/list/{board}/task?tags[]=tag-1&subtasks=true'];
+        yield 'team tasks by tag' => ['/api/tasks/v2/team/team-1/task?tags[]=tag-2'];
+    }
+
+    #[DataProvider('endpoints')]
+    public function testTheSameQueriesFor25And100Tasks(string $endpoint): void
+    {
+        $small = $this->queriesFor($endpoint, 25);
+        $large = $this->queriesFor($endpoint, 100);
+
+        self::assertSame($small, $large, 'no query per task');
+        self::assertLessThanOrEqual(self::BUDGET, $large);
+        fwrite(STDERR, sprintf("\n[budget] %s: %d queries at 25 tasks, %d at 100\n", $endpoint, $small, $large));
+    }
+
+    /**
+     * Audit IA-I8: each board a team request reaches costs its access decision (an event, in the host often a voter), not a
+     * query of the bundle's: the same queries with 1 board as with 10.
+     */
+    public function testTeamTasksCostTheSameQueriesForOneBoardOrTen(): void
+    {
+        $one = $this->teamQueriesFor(1);
+        $ten = $this->teamQueriesFor(10);
+
+        self::assertSame($one, $ten);
+        fwrite(STDERR, sprintf("\n[budget] team tasks: %d queries with 1 board, %d with 10\n", $one, $ten));
+    }
+
+    private function teamQueriesFor(int $boards): int
+    {
+        self::ensureKernelShutdown();
+        $this->setUp();
+        ApiTestHost::$tenants = ['tenant-a'];
+        for ($i = 0; $i < $boards; ++$i) {
+            $this->seed($this->board('Board ' . $i, tenantKey: 'tenant-a'), 3);
+        }
+        $this->issueToken();
+        $this->em->clear();
+
+        return $this->counted('/api/tasks/v2/team/team-1/task?subtasks=true');
+    }
+
+    private function counted(string $path): int
+    {
+        $holder = self::getContainer()->get('doctrine.debug_data_holder');
+        self::assertInstanceOf(DebugDataHolder::class, $holder);
+        $holder->reset();
+        $this->get($path);
+        self::assertResponseIsSuccessful();
+        $count = 0;
+        foreach ($holder->getData() as $queries) {
+            $count += count($queries);
+        }
+
+        return $count;
+    }
+
+    private function queriesFor(string $endpoint, int $tasks): int
+    {
+        self::ensureKernelShutdown();
+        $this->setUp();
+        ApiTestHost::$tenants = ['tenant-a'];
+        $board                = $this->board('Board', tenantKey: 'tenant-a');
+        $first                = $this->seed($board, $tasks);
+        $level                = str_starts_with($endpoint, 'my:') ? TaskApiLevel::MyTasks : TaskApiLevel::Full;
+        $this->issueToken($level);
+        $this->em->clear();
+        $path = strtr((string) preg_replace('/^my:/', '', $endpoint), ['{board}' => $board->getId(), '{first}' => $first]);
+
+        $holder = self::getContainer()->get('doctrine.debug_data_holder');
+        self::assertInstanceOf(DebugDataHolder::class, $holder);
+        $holder->reset();
+        $this->get($path);
+        self::assertResponseIsSuccessful();
+        $count = 0;
+        foreach ($holder->getData() as $queries) {
+            $count += count($queries);
+        }
+
+        return $count;
+    }
+
+    private function seed(TaskBoard $board, int $count): string
+    {
+        $colleague = $this->user('colleague-' . $count . '-' . $board->getId() . '@example.com');
+        $previous  = null;
+        $first     = null;
+        for ($i = 0; $i < $count; ++$i) {
+            $task = new Task(board: $board, title: 'Task ' . $i, creator: $this->owner, column: $board->getColumns()->get($i % 3), position: $i, tags: ['tag-' . ($i % 5)]);
+            $task->addMember(new TaskMember(task: $task, user: $colleague, memberRole: TaskMemberRole::Assignee));
+            $task->addMember(new TaskMember(task: $task, user: $this->owner, memberRole: TaskMemberRole::Watcher));
+            $this->em->persist($task);
+            $this->em->persist(new Task(board: $board, title: 'Item ' . $i, creator: $this->owner, parent: $task, tags: ['checklist:Steps']));
+            $this->em->persist(new TaskTimeEntry($task, $this->owner, 15, new DateTimeImmutable('2026-11-01')));
+            $this->em->persist(new TaskComment($task, $colleague, 'Comment ' . $i));
+            if ($previous instanceof Task) {
+                $this->em->persist(new TaskDependency($previous, $task, TaskDependencyType::Blocks));
+            }
+            $previous = $task;
+            $first ??= $task;
+        }
+        for ($i = 0; $i < $count; ++$i) {
+            $this->em->persist(new TaskComment($first, $colleague, 'On the first ' . $i));
+        }
+        $this->em->flush();
+
+        return $first->getId();
+    }
+}
diff --git a/tests/Functional/Api/ApiReadEndpointsTest.php b/tests/Functional/Api/ApiReadEndpointsTest.php
new file mode 100644
index 00000000..191889ae
--- /dev/null
+++ b/tests/Functional/Api/ApiReadEndpointsTest.php
@@ -0,0 +1,454 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Api\Serializer\TaskApiReadSerializer;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Entity\TaskDependency;
+use Nowo\TaskBoardBundle\Entity\TaskMember;
+use Nowo\TaskBoardBundle\Entity\TaskTimeEntry;
+use Nowo\TaskBoardBundle\Enum\TaskDependencyType;
+use Nowo\TaskBoardBundle\Enum\TaskMemberRole;
+use Nowo\TaskBoardBundle\Enum\TaskPriority;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+use Nowo\TaskBoardBundle\Tests\Functional\App\Entity\AppUser;
+
+use function count;
+
+/**
+ * Spec 213 S3: what each read endpoint answers, in ClickUp's shape, and its filters.
+ */
+final class ApiReadEndpointsTest extends ApiTestCase
+{
+    private TaskBoard $roadmap;
+
+    private AppUser $colleague;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        ApiTestHost::$tenants = ['tenant-a', 'tenant-b'];
+        $this->colleague      = $this->user('colleague@example.com');
+        $this->roadmap        = $this->board('Roadmap', tenantKey: 'tenant-a');
+        $this->issueToken();
+    }
+
+    public function testATeamListsItsSpacesAndAnotherTeamNone(): void
+    {
+        $this->get('/api/tasks/v2/team/team-1/space');
+        self::assertResponseIsSuccessful();
+        self::assertSame(['space-tenant-a', 'space-tenant-b'], $this->idsOf('spaces'));
+
+        $this->get('/api/tasks/v2/team/team-2/space');
+        self::assertSame([], $this->listOf('spaces'));
+
+        $this->get('/api/tasks/v2/team/team-9/space');
+        $this->assertRefused(404, 'ACCESS_001');
+    }
+
+    public function testASpaceAndItsFolders(): void
+    {
+        $this->get('/api/tasks/v2/space/space-tenant-a');
+        self::assertResponseIsSuccessful();
+        self::assertSame('space-tenant-a', $this->json()['id']);
+        self::assertSame('Space tenant-a', $this->json()['name']);
+        self::assertFalse($this->json()['private']);
+
+        $this->get('/api/tasks/v2/space/space-tenant-a/folder');
+        self::assertSame(['folders' => []], $this->json());
+
+        $this->get('/api/tasks/v2/space/space-nothing');
+        $this->assertRefused(404, 'ACCESS_001');
+    }
+
+    public function testListsCountOpenTasksAndShowColumnsAsStatuses(): void
+    {
+        $this->task($this->roadmap, 'Open');
+        $this->task($this->roadmap, 'Also open');
+        $this->em->persist((new Task(board: $this->roadmap, title: 'Archived', creator: $this->owner))->archive());
+        $this->em->flush();
+        $this->board('Elsewhere', tenantKey: 'tenant-b');
+
+        $this->get('/api/tasks/v2/space/space-tenant-a/list');
+
+        self::assertResponseIsSuccessful();
+        $lists = $this->listOf('lists');
+        self::assertCount(1, $lists);
+        self::assertSame($this->roadmap->getId(), $lists[0]['id']);
+        self::assertSame(2, $lists[0]['task_count']);
+        self::assertSame(['id' => 'space-tenant-a', 'name' => 'Space tenant-a', 'access' => true], $lists[0]['space']);
+        self::assertSame(['To do' => 'open', 'Doing' => 'custom', 'Done' => 'closed'], array_column($lists[0]['statuses'], 'type', 'status'));
+
+        $this->get('/api/tasks/v2/list/' . $this->roadmap->getId());
+        self::assertSame($lists[0], $this->json());
+    }
+
+    public function testATaskInClickUpsShape(): void
+    {
+        $task = $this->task($this->roadmap, 'Ship the API', 1);
+        $task->setDescription('**Bold** text')->setPriority(TaskPriority::High)->setTags(['api', 'v2'])->setDueAt(new DateTimeImmutable('@1790000000'))->setEstimatedMinutes(90);
+        $task->addMember(new TaskMember(task: $task, user: $this->colleague, memberRole: TaskMemberRole::Assignee));
+        $task->addMember(new TaskMember(task: $task, user: $this->owner, memberRole: TaskMemberRole::Watcher));
+        $blocker = $this->task($this->roadmap, 'Blocker');
+        $related = $this->task($this->roadmap, 'Related');
+        $this->em->persist(new TaskDependency($blocker, $task, TaskDependencyType::Blocks));
+        $this->em->persist(new TaskDependency($task, $related, TaskDependencyType::Related));
+        $item = new Task(board: $this->roadmap, title: 'Write the docs', creator: $this->owner, parent: $task, tags: ['checklist:Release']);
+        $this->em->persist($item->markCompleted());
+        $this->em->persist(new Task(board: $this->roadmap, title: 'Test it', creator: $this->owner, parent: $task, position: 1, tags: ['checklist:Release']));
+        $this->em->persist(new Task(board: $this->roadmap, title: 'A plain subtask', creator: $this->owner, parent: $task));
+        $this->em->persist(new TaskTimeEntry($task, $this->owner, 30, new DateTimeImmutable('2026-11-01')));
+        $this->em->flush();
+
+        $this->get('/api/tasks/v2/task/' . $task->getId() . '?include_markdown_description=true&include_subtasks=true');
+
+        self::assertResponseIsSuccessful();
+        $json = $this->json();
+        self::assertSame($task->getId(), $json['id']);
+        self::assertSame('Ship the API', $json['name']);
+        self::assertSame('**Bold** text', $json['description']);
+        self::assertSame('**Bold** text', $json['markdown_description']);
+        self::assertSame(['id' => $this->roadmap->getColumns()->get(1)?->getId(), 'status' => 'Doing', 'color' => null, 'orderindex' => 1, 'type' => 'custom'], $json['status']);
+        self::assertSame(['id' => '2', 'priority' => 'high', 'color' => '#f8ae00', 'orderindex' => '2'], $json['priority']);
+        self::assertSame('1790000000000', $json['due_date']);
+        self::assertSame('5400000', $json['time_estimate']);
+        self::assertSame(1800000, $json['time_spent']);
+        self::assertSame([['name' => 'api', 'tag_fg' => null, 'tag_bg' => null], ['name' => 'v2', 'tag_fg' => null, 'tag_bg' => null]], $json['tags']);
+        self::assertSame('uuid-' . $this->owner->getId(), $json['creator']['id']);
+        self::assertSame(['uuid-' . $this->colleague->getId()], array_column($json['assignees'], 'id'));
+        self::assertSame(['uuid-' . $this->owner->getId()], array_column($json['watchers'], 'id'));
+        self::assertSame([['task_id' => $task->getId(), 'depends_on' => $blocker->getId(), 'type' => 1]], array_map(static fn (array $d): array => array_diff_key($d, ['date_created' => 0]), $json['dependencies']));
+        self::assertSame([$related->getId()], array_column($json['linked_tasks'], 'link_id'));
+        self::assertCount(1, $json['checklists']);
+        self::assertSame(TaskApiReadSerializer::checklistId($task->getId(), 'Release'), $json['checklists'][0]['id']);
+        self::assertSame(['Release', 1, 1], [$json['checklists'][0]['name'], $json['checklists'][0]['resolved'], $json['checklists'][0]['unresolved']]);
+        self::assertSame(['Write the docs', 'Test it'], array_column($json['checklists'][0]['items'], 'name'));
+        self::assertCount(3, $json['subtasks']);
+        self::assertSame(['id' => $this->roadmap->getId(), 'name' => 'Roadmap', 'access' => true], $json['list']);
+        self::assertSame(['id' => 'space-tenant-a'], $json['space']);
+        self::assertSame('team-1', $json['team_id']);
+        self::assertSame([], $json['custom_fields']);
+
+        // The task it blocks sees the other side.
+        $this->get('/api/tasks/v2/task/' . $blocker->getId());
+        self::assertSame(0, $this->json()['dependencies'][0]['type']);
+        self::assertArrayNotHasKey('markdown_description', $this->json());
+    }
+
+    public function testListTasksFilters(): void
+    {
+        $done = $this->task($this->roadmap, 'Done', 2);
+        $done->markCompleted();
+        $doing = $this->task($this->roadmap, 'Doing it', 1);
+        $doing->setTags(['Urgent'])->setDueAt(new DateTimeImmutable('@1800000000'));
+        $doing->addMember(new TaskMember(task: $doing, user: $this->colleague, memberRole: TaskMemberRole::Assignee));
+        $todo = $this->task($this->roadmap, 'To do');
+        $sub  = $this->task($this->roadmap, 'Sub', parent: $todo);
+        $this->em->persist($archived = (new Task(board: $this->roadmap, title: 'Archived', creator: $this->owner))->archive());
+        $this->em->flush();
+        $base = '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task';
+
+        $this->get($base);
+        self::assertEqualsCanonicalizing([$doing->getId(), $todo->getId()], $this->idsOf('tasks'), 'open, top-level, not archived');
+        self::assertTrue($this->json()['last_page']);
+
+        $this->get($base . '?include_closed=true&subtasks=true');
+        self::assertEqualsCanonicalizing([$done->getId(), $doing->getId(), $todo->getId(), $sub->getId()], $this->idsOf('tasks'));
+
+        $this->get($base . '?archived=true');
+        self::assertSame([$archived->getId()], $this->idsOf('tasks'));
+
+        $this->get($base . '?statuses[]=DOING');
+        self::assertSame([$doing->getId()], $this->idsOf('tasks'));
+
+        $this->get($base . '?assignees[]=uuid-' . $this->colleague->getId());
+        self::assertSame([$doing->getId()], $this->idsOf('tasks'));
+
+        $this->get($base . '?assignees[]=nobody');
+        self::assertSame([], $this->idsOf('tasks'));
+
+        $this->get($base . '?tags[]=urgent');
+        self::assertSame([$doing->getId()], $this->idsOf('tasks'));
+
+        $this->get($base . '?due_date_gt=1790000000000');
+        self::assertSame([$doing->getId()], $this->idsOf('tasks'));
+
+        $this->get($base . '?due_date_lt=1790000000000');
+        self::assertSame([], $this->idsOf('tasks'));
+
+        $this->get($base . '?order_by=id');
+        $ids = $this->idsOf('tasks');
+        $this->get($base . '?order_by=id&reverse=true');
+        self::assertSame(array_reverse($ids), $this->idsOf('tasks'));
+
+        foreach (['page=x', 'page=-1', 'order_by=title', 'reverse=maybe', 'due_date_gt=soon', 'statuses=x&statuses[a][]=1'] as $bad) {
+            $this->get($base . '?' . $bad);
+            if ($bad === 'statuses=x&statuses[a][]=1') {
+                self::assertResponseIsSuccessful('a nested value is no status');
+                continue;
+            }
+            $this->assertRefused(400, 'INPUT_002');
+        }
+
+        $this->get($base . '?statuses=Doing');
+        self::assertSame([$doing->getId()], $this->idsOf('tasks'), 'a single value is a list of one');
+        $this->get($base . '?statuses=Doing&tags=nothing');
+        self::assertSame([], $this->idsOf('tasks'));
+        $this->get($base . '?assignees=x&tags[]=urgent&tags[]=');
+        self::assertSame([], $this->idsOf('tasks'));
+    }
+
+    public function testAHundredPerPage(): void
+    {
+        for ($i = 0; $i < 101; ++$i) {
+            $this->em->persist(new Task(board: $this->roadmap, title: 'Task ' . $i, creator: $this->owner, position: $i));
+        }
+        $this->em->flush();
+        $base = '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task';
+
+        $this->get($base);
+        self::assertCount(100, $this->listOf('tasks'));
+        self::assertFalse($this->json()['last_page']);
+        $first = $this->idsOf('tasks');
+
+        $this->get($base . '?page=1');
+        self::assertCount(1, $this->listOf('tasks'));
+        self::assertTrue($this->json()['last_page']);
+        self::assertNotContains($this->idsOf('tasks')[0], $first);
+
+        $this->get($base . '?page=1&tags[]=nothing');
+        self::assertSame([], $this->listOf('tasks'));
+    }
+
+    public function testTeamTasksAcrossBoardsNarrowedBySpaceAndList(): void
+    {
+        $here      = $this->task($this->roadmap, 'Here');
+        $elsewhere = $this->board('Elsewhere', tenantKey: 'tenant-b');
+        $there     = $this->task($elsewhere, 'There');
+
+        $this->get('/api/tasks/v2/team/team-1/task');
+        self::assertEqualsCanonicalizing([$here->getId(), $there->getId()], $this->idsOf('tasks'));
+
+        $this->get('/api/tasks/v2/team/team-1/task?space_ids[]=space-tenant-b');
+        self::assertSame([$there->getId()], $this->idsOf('tasks'));
+
+        $this->get('/api/tasks/v2/team/team-1/task?list_ids[]=' . $this->roadmap->getId());
+        self::assertSame([$here->getId()], $this->idsOf('tasks'));
+
+        $this->get('/api/tasks/v2/team/team-2/task');
+        self::assertSame([], $this->idsOf('tasks'));
+    }
+
+    public function testCommentsNewestFirstTwentyFivePerPageWithoutDeletedOnes(): void
+    {
+        $task = $this->task($this->roadmap, 'Discussed');
+        for ($i = 0; $i < 27; ++$i) {
+            $this->em->persist(new TaskComment($task, $this->colleague, 'Comment ' . $i));
+        }
+        $this->em->persist((new TaskComment($task, $this->owner, 'Gone'))->markDeleted());
+        $this->em->persist(new TaskComment($task, null, 'Erased author'));
+        $this->em->flush();
+        $base = '/api/tasks/v2/task/' . $task->getId() . '/comment';
+
+        $this->get($base);
+        $first = $this->listOf('comments');
+        self::assertCount(25, $first);
+        self::assertNotContains('Gone', array_column($first, 'comment_text'));
+        $oldest = $first[24];
+
+        $this->get($base . '?start=' . $oldest['date'] . '&start_id=' . $oldest['id']);
+        $second = $this->listOf('comments');
+        self::assertCount(3, $second);
+        self::assertSame([], array_intersect(array_column($first, 'id'), array_column($second, 'id')));
+        $all = [...$first, ...$second];
+        self::assertSame(1, count(array_filter($all, static fn (array $comment): bool => $comment['user'] === null)), 'an erased author is nobody');
+        self::assertSame([['text' => $all[0]['comment_text']]], $all[0]['comment']);
+
+        $this->get($base . '?start=' . $oldest['date']);
+        self::assertResponseIsSuccessful();
+        $this->get($base . '?start=yesterday');
+        $this->assertRefused(400, 'INPUT_002');
+    }
+
+    public function testMembersTagsFieldsAndTime(): void
+    {
+        $task = $this->task($this->roadmap, 'Staffed');
+        $task->setTags(['b', 'A', 'a']);
+        $task->addMember(new TaskMember(task: $task, user: $this->colleague, memberRole: TaskMemberRole::Assignee));
+        $task->addMember(new TaskMember(task: $task, user: $this->colleague, memberRole: TaskMemberRole::Watcher));
+        $this->em->flush();
+
+        $this->get('/api/tasks/v2/task/' . $task->getId() . '/member');
+        self::assertSame(['uuid-' . $this->colleague->getId()], $this->idsOf('members'));
+
+        $this->get('/api/tasks/v2/space/space-tenant-a/tag');
+        self::assertSame(['a', 'b'], array_column($this->listOf('tags'), 'name'));
+        $this->get('/api/tasks/v2/space/space-tenant-b/tag');
+        self::assertSame([], $this->listOf('tags'));
+
+        $this->get('/api/tasks/v2/list/' . $this->roadmap->getId() . '/field');
+        self::assertSame(['fields' => []], $this->json());
+
+        $this->get('/api/tasks/v2/team/team-1/time_entries?start_date=1789000000000&end_date=1791000000000&assignee=a,,b&task_id=' . $task->getId());
+        self::assertResponseIsSuccessful();
+        self::assertSame([[
+            'id'          => 'entry-1',
+            'task'        => ['id' => $task->getId()],
+            'wid'         => 'team-1',
+            'user'        => ['id' => 'uuid-' . $this->owner->getId()],
+            'billable'    => false,
+            'start'       => '1790000000000',
+            'end'         => '1790003600000',
+            'duration'    => '3600000',
+            'description' => 'Review',
+        ]], $this->listOf('data'));
+        $query = ApiTestHost::$timeQueries[0];
+        self::assertSame(['a', 'b'], $query->assigneeIds);
+        self::assertSame(1789000000, $query->from?->getTimestamp());
+        self::assertSame(1791000000, $query->to?->getTimestamp());
+
+        $this->get('/api/tasks/v2/team/team-1/time_entries');
+        self::assertNull(ApiTestHost::$timeQueries[1]->taskId);
+        self::assertNull($this->listOf('data')[0]['task']);
+        $this->get('/api/tasks/v2/team/team-1/time_entries?assignee[]=a');
+        $this->assertRefused(400, 'INPUT_002');
+        $this->get('/api/tasks/v2/team/team-1/time_entries?task_id=nothing');
+        $this->assertRefused(404, 'ACCESS_001');
+    }
+
+    public function testAProfileTheHostLeavesOutIsNotShown(): void
+    {
+        $task = $this->task($this->roadmap, 'Private people');
+        $task->addMember(new TaskMember(task: $task, user: $this->colleague, memberRole: TaskMemberRole::Assignee));
+        $this->em->flush();
+        ApiTestHost::$profilesEmpty = true;
+
+        $this->get('/api/tasks/v2/task/' . $task->getId());
+        self::assertNull($this->json()['creator']);
+        self::assertSame([], $this->json()['assignees']);
+    }
+
+    public function testSomeoneTheHostDoesNotKnowAndAnErasedCreatorAreNobody(): void
+    {
+        $task = $this->task($this->roadmap, 'Known');
+        $task->addMember(new TaskMember(task: $task, user: $this->colleague, memberRole: TaskMemberRole::Assignee));
+        $this->em->persist(new Task(board: $this->roadmap, title: 'Orphan', creator: null));
+        $this->em->flush();
+        ApiTestHost::$unknownEmails = ['colleague@example.com'];
+
+        $this->get('/api/tasks/v2/list/' . $this->roadmap->getId() . '/task');
+
+        $tasks = array_column($this->listOf('tasks'), null, 'name');
+        self::assertSame([], $tasks['Known']['assignees']);
+        self::assertSame('uuid-' . $this->owner->getId(), $tasks['Known']['creator']['id']);
+        self::assertNull($tasks['Orphan']['creator']);
+    }
+
+    public function testBoardsWithoutATenantFormTheirOwnSpace(): void
+    {
+        ApiTestHost::$tenants = [null];
+        $loose                = $this->board('No tenant');
+
+        $this->get('/api/tasks/v2/space/space-none/list');
+
+        self::assertSame([$loose->getId()], $this->idsOf('lists'));
+    }
+
+    public function testMyTasksSeesOnlyItsSubtasksAndTheChecklistItemsOfItsTask(): void
+    {
+        // Audit IA-M2 (the auditor's proof, turned), and the owner's exception for checklist items.
+        $own    = $this->task($this->roadmap, 'Own parent');
+        $hidden = new Task(board: $this->roadmap, title: 'Colleague secret subtask', creator: $this->colleague, parent: $own);
+        $item   = new Task(board: $this->roadmap, title: 'Colleague checklist item', creator: $this->colleague, parent: $own, tags: ['checklist:Steps']);
+        $this->em->persist($hidden);
+        $this->em->persist($item);
+        $this->em->flush();
+        $this->issueToken(TaskApiLevel::MyTasks);
+
+        $this->get('/api/tasks/v2/task/' . $hidden->getId());
+        $this->assertRefused(404, 'ACCESS_001');
+        $this->get('/api/tasks/v2/task/' . $own->getId() . '?include_subtasks=true');
+        self::assertResponseIsSuccessful();
+        self::assertStringNotContainsString('Colleague secret subtask', (string) $this->client->getResponse()->getContent());
+        self::assertSame(['Colleague checklist item'], array_column($this->json()['subtasks'], 'name'));
+        self::assertSame(['Colleague checklist item'], array_column($this->json()['checklists'][0]['items'], 'name'));
+
+        $this->issueToken(TaskApiLevel::Read);
+        $this->get('/api/tasks/v2/task/' . $own->getId() . '?include_subtasks=true');
+        self::assertCount(2, $this->json()['subtasks'], 'a Read token sees every subtask');
+    }
+
+    public function testARelationToATaskTheTokenCannotOpenIsLeftOut(): void
+    {
+        // Audit IA-I7.
+        $own    = $this->task($this->roadmap, 'Own');
+        $theirs = new Task(board: $this->roadmap, title: 'Theirs', creator: $this->colleague);
+        $mine   = $this->task($this->roadmap, 'Also mine');
+        $this->em->persist($theirs);
+        $this->em->persist(new TaskDependency($theirs, $own, TaskDependencyType::Blocks));
+        $this->em->persist(new TaskDependency($own, $mine, TaskDependencyType::Related));
+        $this->em->persist(new TaskDependency($own, $theirs, TaskDependencyType::Related));
+        $this->em->flush();
+
+        $this->issueToken(TaskApiLevel::MyTasks);
+        $this->get('/api/tasks/v2/task/' . $own->getId());
+        self::assertSame([], $this->json()['dependencies']);
+        self::assertSame([$mine->getId()], array_column($this->json()['linked_tasks'], 'link_id'));
+        self::assertStringNotContainsString($theirs->getId(), (string) $this->client->getResponse()->getContent());
+
+        $this->issueToken(TaskApiLevel::Read);
+        $this->get('/api/tasks/v2/task/' . $own->getId());
+        self::assertCount(1, $this->json()['dependencies']);
+        self::assertCount(2, $this->json()['linked_tasks']);
+    }
+
+    public function testTheTagFilterMatchesWholeTagsCaseAside(): void
+    {
+        $a = $this->task($this->roadmap, 'A');
+        $a->setTags(['Front-end', '50%_done']);
+        $b = $this->task($this->roadmap, 'B');
+        $b->setTags(['front']);
+        $c = $this->task($this->roadmap, 'C');
+        $c->setTags(['niño', 'ops/infra']);
+        $this->em->flush();
+        $base = '/api/tasks/v2/list/' . $this->roadmap->getId() . '/task?tags[]=';
+
+        $this->get($base . 'FRONT-END');
+        self::assertSame(['A'], array_column($this->listOf('tasks'), 'name'));
+        $this->get($base . 'front');
+        self::assertSame(['B'], array_column($this->listOf('tasks'), 'name'), 'no partial match');
+        $this->get($base . '50%25_done');
+        self::assertSame(['A'], array_column($this->listOf('tasks'), 'name'), 'wildcards are literal');
+        $this->get($base . '50x_done');
+        self::assertSame([], $this->listOf('tasks'));
+        $this->get($base . 'niño');
+        self::assertSame(['C'], array_column($this->listOf('tasks'), 'name'));
+        $this->get($base . 'ops/infra');
+        self::assertSame(['C'], array_column($this->listOf('tasks'), 'name'));
+        $this->get($base . 'front&tags[]=niño');
+        self::assertEqualsCanonicalizing(['B', 'C'], array_column($this->listOf('tasks'), 'name'), 'any of the tags');
+    }
+
+    public function testAMyTasksTokenCountsOnlyItsOwn(): void
+    {
+        $this->task($this->roadmap, 'Mine');
+        $theirs   = new Task(board: $this->roadmap, title: 'Theirs', creator: $this->colleague);
+        $assigned = new Task(board: $this->roadmap, title: 'Assigned to me', creator: $this->colleague);
+        $assigned->addMember(new TaskMember(task: $assigned, user: $this->owner, memberRole: TaskMemberRole::Assignee));
+        $this->em->persist($theirs);
+        $this->em->persist($assigned);
+        $this->em->flush();
+        $this->issueToken(TaskApiLevel::MyTasks);
+
+        $this->get('/api/tasks/v2/list/' . $this->roadmap->getId());
+        self::assertSame(2, $this->json()['task_count']);
+        $this->get('/api/tasks/v2/list/' . $this->roadmap->getId() . '/task');
+        self::assertEqualsCanonicalizing(['Mine', 'Assigned to me'], array_column($this->listOf('tasks'), 'name'));
+    }
+}
diff --git a/tests/Functional/Api/ApiReadMatrixTest.php b/tests/Functional/Api/ApiReadMatrixTest.php
new file mode 100644
index 00000000..b3cd9ee3
--- /dev/null
+++ b/tests/Functional/Api/ApiReadMatrixTest.php
@@ -0,0 +1,237 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiWhere;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Event\BoardAccessCheckEvent;
+use Nowo\TaskBoardBundle\Event\TaskBoardEvents;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+
+use function in_array;
+use function json_encode;
+use function sprintf;
+use function str_contains;
+
+/**
+ * Spec 213 SC-001, read half: every read endpoint × the four levels × own task, another's task, another project, a board
+ * outside where, a removed member, a revoked or expired token, the plan without the module. Every answer is asserted, and a
+ * list never shows what the token may not read.
+ */
+final class ApiReadMatrixTest extends ApiTestCase
+{
+    /** Endpoints that ask more than the level's own reads. */
+    private const READ_EVERYTHING = ['tags', 'fields', 'members own'];
+
+    /** Endpoints of a team: they answer with what remains, never 404 for a case of where. */
+    private const TEAM_LEVEL = ['team spaces', 'team tasks', 'time'];
+
+    private TaskBoard $roadmap;
+
+    private TaskBoard $sideBoard;
+
+    private Task $own;
+
+    private Task $others;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        ApiTestHost::$tenants = ['tenant-a', 'tenant-b'];
+        $colleague            = $this->user('colleague@example.com');
+        $this->roadmap        = $this->board('Roadmap', tenantKey: 'tenant-a');
+        $this->sideBoard      = $this->board('Side', tenantKey: 'tenant-a');
+        $this->board('Other project', tenantKey: 'tenant-b');
+        $this->own    = $this->task($this->roadmap, 'Own');
+        $this->others = new Task(board: $this->roadmap, title: 'Others', creator: $colleague);
+        $this->em->persist($this->others);
+        $this->em->flush();
+    }
+
+    public function testEachLevelWithinReach(): void
+    {
+        foreach (TaskApiLevel::cases() as $level) {
+            $this->issueToken($level);
+            foreach ($this->endpoints() as $name => $path) {
+                $this->get($path);
+                $mine = $level === TaskApiLevel::MyTasks;
+                match (true) {
+                    $mine && str_contains($name, 'other')                 => $this->assertRefused(404, 'ACCESS_001'),
+                    $mine && in_array($name, self::READ_EVERYTHING, true) => $this->assertRefused(403, 'TOKEN_001'),
+                    default                                               => self::assertResponseIsSuccessful($level->value . ' ' . $name),
+                };
+            }
+            // Lists hold what the level reads, and counts count only that.
+            $this->get('/api/tasks/v2/list/' . $this->roadmap->getId() . '/task');
+            self::assertSame($mine ? ['Own'] : ['Own', 'Others'], $this->sortedNames(), $level->value);
+            $this->get('/api/tasks/v2/team/team-1/task');
+            self::assertSame($mine ? ['Own'] : ['Own', 'Others'], $this->sortedNames(), $level->value);
+            $this->get('/api/tasks/v2/space/space-tenant-a/list');
+            self::assertSame($mine ? 1 : 2, $this->taskCountOf($this->roadmap), $level->value);
+        }
+    }
+
+    public function testAnotherProjectIsOutOfReachWhateverTheLevel(): void
+    {
+        foreach (TaskApiLevel::cases() as $level) {
+            $this->issueToken($level, TaskApiWhere::limitedTo(['tenant-b'], []));
+            foreach ($this->endpoints() as $name => $path) {
+                $this->get($path);
+                if (in_array($name, self::TEAM_LEVEL, true)) {
+                    self::assertResponseIsSuccessful($level->value . ' ' . $name);
+                    $this->assertShowsNothingOf('tenant-a', $name);
+                    continue;
+                }
+                $this->assertRefused(404, 'ACCESS_001');
+            }
+        }
+    }
+
+    public function testABoardOutsideWhereIsOutOfReachAndItsSpaceShowsOnlyTheNamedBoard(): void
+    {
+        foreach (TaskApiLevel::cases() as $level) {
+            $this->issueToken($level, TaskApiWhere::limitedTo([], [$this->sideBoard->getId()]));
+            foreach ($this->endpoints() as $name => $path) {
+                $this->get($path);
+                $onSpace = str_contains($path, '/space/');
+                match (true) {
+                    in_array($name, self::TEAM_LEVEL, true)                          => self::assertResponseIsSuccessful($name),
+                    $onSpace && $level === TaskApiLevel::MyTasks && $name === 'tags' => $this->assertRefused(403, 'TOKEN_001'),
+                    $onSpace                                                         => self::assertResponseIsSuccessful($name),
+                    default                                                          => $this->assertRefused(404, 'ACCESS_001'),
+                };
+            }
+            $this->get('/api/tasks/v2/space/space-tenant-a/list');
+            self::assertSame([$this->sideBoard->getId()], $this->idsOf('lists'));
+            $this->get('/api/tasks/v2/team/team-1/task');
+            self::assertSame([], $this->listOf('tasks'));
+            $this->get('/api/tasks/v2/team/team-1/space');
+            self::assertSame(['space-tenant-a'], $this->idsOf('spaces'));
+        }
+    }
+
+    public function testARemovedMemberReachesNothingOnTheNextRequest(): void
+    {
+        $this->issueToken();
+        $this->get('/api/tasks/v2/task/' . $this->own->getId());
+        self::assertResponseIsSuccessful();
+
+        $dispatcher = self::getContainer()->get('event_dispatcher');
+        self::assertInstanceOf(EventDispatcherInterface::class, $dispatcher);
+        $dispatcher->addListener(TaskBoardEvents::BOARD_ACCESS_CHECK, static function (BoardAccessCheckEvent $event): void {
+            $event->deny();
+        });
+
+        foreach (TaskApiLevel::cases() as $level) {
+            $this->issueToken($level);
+            foreach ($this->endpoints() as $name => $path) {
+                $this->get($path);
+                if (in_array($name, self::TEAM_LEVEL, true) || in_array($name, ['space', 'folders', 'lists'], true) || ($name === 'tags' && $level !== TaskApiLevel::MyTasks)) {
+                    self::assertResponseIsSuccessful($name);
+                    $this->assertShowsNothingOf('Roadmap', $name);
+                    continue;
+                }
+                $name === 'tags' ? $this->assertRefused(403, 'TOKEN_001') : $this->assertRefused(404, 'ACCESS_001');
+            }
+        }
+    }
+
+    public function testARevokedOrExpiredTokenIsRefusedEverywhere(): void
+    {
+        // The host's authenticator answers Invalid for both: the bundle cannot tell them apart, nor can the client.
+        foreach ($this->endpoints() as $path) {
+            $this->get($path, 'bt_revoked_placeholder');
+            $this->assertRefused(401, 'OAUTH_019');
+        }
+    }
+
+    public function testAPlanWithoutTheModuleForTheProject(): void
+    {
+        ApiTestHost::$planRefusesTenants = ['tenant-a'];
+        foreach (TaskApiLevel::cases() as $level) {
+            $this->issueToken($level);
+            foreach ($this->endpoints() as $name => $path) {
+                $this->get($path);
+                match (true) {
+                    in_array($name, self::TEAM_LEVEL, true)                          => self::assertResponseIsSuccessful($name),
+                    $level === TaskApiLevel::MyTasks && str_contains($name, 'other') => $this->assertRefused(404, 'ACCESS_001'),
+                    default                                                          => $this->assertRefused(403, 'PLAN_001'),
+                };
+            }
+            $this->get('/api/tasks/v2/team/team-1/space');
+            self::assertSame(['space-tenant-b'], $this->idsOf('spaces'));
+            $this->get('/api/tasks/v2/team/team-1/task');
+            self::assertSame([], $this->listOf('tasks'));
+        }
+    }
+
+    public function testAPlanWithoutTheModuleAnywhere(): void
+    {
+        ApiTestHost::$planAllows = false;
+        $this->issueToken();
+        foreach ($this->endpoints() as $name => $path) {
+            $this->get($path);
+            $this->assertRefused(403, 'PLAN_001');
+        }
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    private function endpoints(): array
+    {
+        $board = $this->roadmap->getId();
+
+        return [
+            'team spaces'    => '/api/tasks/v2/team/team-1/space',
+            'space'          => '/api/tasks/v2/space/space-tenant-a',
+            'folders'        => '/api/tasks/v2/space/space-tenant-a/folder',
+            'lists'          => '/api/tasks/v2/space/space-tenant-a/list',
+            'tags'           => '/api/tasks/v2/space/space-tenant-a/tag',
+            'list'           => '/api/tasks/v2/list/' . $board,
+            'list tasks'     => '/api/tasks/v2/list/' . $board . '/task',
+            'fields'         => '/api/tasks/v2/list/' . $board . '/field',
+            'team tasks'     => '/api/tasks/v2/team/team-1/task',
+            'task own'       => '/api/tasks/v2/task/' . $this->own->getId(),
+            'task other'     => '/api/tasks/v2/task/' . $this->others->getId(),
+            'comments own'   => '/api/tasks/v2/task/' . $this->own->getId() . '/comment',
+            'comments other' => '/api/tasks/v2/task/' . $this->others->getId() . '/comment',
+            'members own'    => '/api/tasks/v2/task/' . $this->own->getId() . '/member',
+            'members other'  => '/api/tasks/v2/task/' . $this->others->getId() . '/member',
+            'time'           => '/api/tasks/v2/team/team-1/time_entries',
+        ];
+    }
+
+    private function assertShowsNothingOf(string $needle, string $name): void
+    {
+        $body = (string) json_encode($this->json());
+        self::assertFalse(str_contains($body, $needle) || str_contains($body, $this->roadmap->getId()), sprintf('%s shows %s', $name, $needle));
+    }
+
+    /**
+     * @return list<string>
+     */
+    private function sortedNames(): array
+    {
+        $names = array_column($this->listOf('tasks'), 'name');
+        sort($names);
+
+        return array_reverse($names);
+    }
+
+    private function taskCountOf(TaskBoard $board): int
+    {
+        foreach ($this->listOf('lists') as $list) {
+            if ($list['id'] === $board->getId()) {
+                return (int) $list['task_count'];
+            }
+        }
+
+        return -1;
+    }
+}
diff --git a/tests/Functional/Api/ApiSyncFieldsTest.php b/tests/Functional/Api/ApiSyncFieldsTest.php
new file mode 100644
index 00000000..6d07cd8e
--- /dev/null
+++ b/tests/Functional/Api/ApiSyncFieldsTest.php
@@ -0,0 +1,52 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncField;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncFieldValue;
+use Nowo\TaskBoardBundle\Sync\Field\SyncFieldType;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+use Nowo\TaskBoardBundle\Tests\Functional\Sync\SyncFunctionalTestCase;
+
+/**
+ * Spec 213 (Q-O3): a board's custom fields are those a provider sync imported, read-only; an erased value is not shown.
+ */
+final class ApiSyncFieldsTest extends ApiTestCase
+{
+    protected function setUp(): void
+    {
+        static::$hostConfig = SyncFunctionalTestCase::SYNC_CONFIG;
+        parent::setUp();
+    }
+
+    public function testImportedFieldsAndValues(): void
+    {
+        ApiTestHost::$tenants = ['tenant-a'];
+        $board                = $this->board(tenantKey: 'tenant-a');
+        $task                 = $this->task($board, 'Synced');
+        $now                  = new DateTimeImmutable('@1790000000');
+        $field                = new TaskSyncField($board, 'clickup', 'cf-1', $now);
+        $field->define('Story points', SyncFieldType::Number, 'number', [], ['precision' => 0], 0, $now);
+        $choice = new TaskSyncField($board, 'clickup', 'cf-2', $now);
+        $choice->define('Stage', SyncFieldType::Text, 'drop_down', [['id' => 'o1', 'name' => 'Alpha', 'color' => null]], [], 1, $now);
+        $erased = new TaskSyncFieldValue($choice, $task, 'o1', 'Alpha', $now);
+        $erased->erase('record', $now);
+        foreach ([$field, $choice, new TaskSyncFieldValue($field, $task, 8, '8', $now), $erased] as $entity) {
+            $this->em->persist($entity);
+        }
+        $this->em->flush();
+        $this->issueToken();
+
+        $this->get('/api/tasks/v2/list/' . $board->getId() . '/field');
+        self::assertSame([
+            ['id' => $field->getId(), 'name' => 'Story points', 'type' => 'number', 'type_config' => ['precision' => 0], 'date_created' => '1790000000000', 'hide_from_guests' => false, 'required' => false],
+            ['id' => $choice->getId(), 'name' => 'Stage', 'type' => 'drop_down', 'type_config' => ['options' => [['id' => 'o1', 'name' => 'Alpha', 'color' => null]]], 'date_created' => '1790000000000', 'hide_from_guests' => false, 'required' => false],
+        ], $this->listOf('fields'));
+
+        $this->get('/api/tasks/v2/task/' . $task->getId());
+        self::assertSame([['id' => $field->getId(), 'name' => 'Story points', 'type' => 'number', 'value' => 8]], $this->json()['custom_fields']);
+    }
+}
diff --git a/tests/Functional/Api/ApiTenancyTest.php b/tests/Functional/Api/ApiTenancyTest.php
new file mode 100644
index 00000000..4c63cd7f
--- /dev/null
+++ b/tests/Functional/Api/ApiTenancyTest.php
@@ -0,0 +1,83 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use Nowo\TaskBoardBundle\Api\Security\TaskApiGuard;
+use Nowo\TaskBoardBundle\Api\TaskApiCapability;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\TaskApiWhere;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ScriptedTenantResolver;
+
+/**
+ * Audit IA-L2: with tenancy the guard asks the bundle's tenant resolver, as the UI does, so a host whose workspace hook is
+ * too permissive does not open another tenant's boards.
+ */
+final class ApiTenancyTest extends ApiTestCase
+{
+    protected function setUp(): void
+    {
+        static::$hostConfig = ['tenancy' => [
+            'enabled'      => true,
+            'resolver'     => 'app.tenant_resolver',
+            'tenant_paths' => [['path' => '/t/{tenantSlug}', 'name_prefix' => 't_']],
+        ]];
+        ScriptedTenantResolver::$open = ['mine'];
+        parent::setUp();
+        // A permissive workspace: it answers for every tenant the test names.
+        ApiTestHost::$tenants = ['mine', 'theirs', null];
+    }
+
+    protected function tearDown(): void
+    {
+        ScriptedTenantResolver::$open = [];
+        parent::tearDown();
+    }
+
+    public function testATenantTheResolverRefusesIsOutOfReachEvenIfTheWorkspaceAnswersForIt(): void
+    {
+        $mine      = $this->board('Mine', tenantKey: 'mine');
+        $theirs    = $this->board('Theirs', tenantKey: 'theirs');
+        $loose     = $this->board('Loose');
+        $theirTask = $this->task($theirs, 'Their task');
+        $principal = new TaskApiPrincipal($this->owner, TaskApiLevel::Full, TaskApiWhere::everything(), 'id', 'name');
+
+        self::assertSame($mine->getId(), $this->guard()->board($principal, $mine->getId(), TaskApiCapability::ReadOwn)->getId());
+        foreach ([fn () => $this->guard()->board($principal, $theirs->getId(), TaskApiCapability::ReadOwn), fn () => $this->guard()->task($principal, $theirTask->getId(), TaskApiCapability::ReadOwn), fn () => $this->guard()->board($principal, $loose->getId(), TaskApiCapability::ReadOwn)] as $call) {
+            try {
+                $call();
+                self::fail('404 expected');
+            } catch (TaskApiRefusal $refusal) {
+                self::assertSame('ACCESS_001', $refusal->ecode);
+            }
+        }
+    }
+
+    public function testSpacesAndTeamListsLeaveOutWhatTheResolverRefuses(): void
+    {
+        $mine = $this->task($this->board('Mine', tenantKey: 'mine'), 'Mine');
+        $this->task($this->board('Theirs', tenantKey: 'theirs'), 'Theirs');
+        $this->issueToken();
+
+        $this->get('/api/tasks/v2/team/team-1/space');
+        self::assertSame(['space-mine'], $this->idsOf('spaces'));
+        $this->get('/api/tasks/v2/team/team-1/task');
+        self::assertSame([$mine->getId()], $this->idsOf('tasks'));
+        foreach (['/api/tasks/v2/space/space-theirs', '/api/tasks/v2/space/space-theirs/list', '/api/tasks/v2/space/space-none'] as $path) {
+            $this->get($path);
+            $this->assertRefused(404, 'ACCESS_001');
+        }
+    }
+
+    private function guard(): TaskApiGuard
+    {
+        $guard = self::getContainer()->get(TaskApiGuard::class);
+        self::assertInstanceOf(TaskApiGuard::class, $guard);
+
+        return $guard;
+    }
+}
diff --git a/tests/Functional/Api/ApiTestCase.php b/tests/Functional/Api/ApiTestCase.php
new file mode 100644
index 00000000..9a1accf4
--- /dev/null
+++ b/tests/Functional/Api/ApiTestCase.php
@@ -0,0 +1,104 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiWhere;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiKernel;
+use Nowo\TaskBoardBundle\Tests\Functional\Api\App\ApiTestHost;
+use Nowo\TaskBoardBundle\Tests\Functional\FunctionalTestCase;
+use Symfony\Component\HttpKernel\KernelInterface;
+
+use function json_decode;
+
+/**
+ * The bundle on {@see ApiKernel}, every hook scripted through {@see ApiTestHost}.
+ */
+abstract class ApiTestCase extends FunctionalTestCase
+{
+    /** A placeholder, in the host's format. */
+    protected const TOKEN = 'bt_placeholder_token';
+
+    /** @var array<string, mixed> */
+    protected static array $api = [];
+
+    /** @var array<string, mixed> */
+    protected static array $hostConfig = [];
+
+    protected static bool $withFirewall = true;
+
+    protected static function createKernel(array $options = []): KernelInterface
+    {
+        return new ApiKernel(static::$api, static::$hostConfig, static::$withFirewall);
+    }
+
+    protected function setUp(): void
+    {
+        ApiTestHost::reset();
+        parent::setUp();
+    }
+
+    protected function tearDown(): void
+    {
+        static::$api          = [];
+        static::$hostConfig   = [];
+        static::$withFirewall = true;
+        ApiTestHost::reset();
+        parent::tearDown();
+    }
+
+    protected function issueToken(TaskApiLevel $level = TaskApiLevel::Full, ?TaskApiWhere $where = null, string $email = 'owner@example.com', string $token = self::TOKEN): void
+    {
+        ApiTestHost::$tokens[$token] = ['email' => $email, 'level' => $level, 'where' => $where ?? TaskApiWhere::everything()];
+    }
+
+    /**
+     * @param array<string, string> $server
+     */
+    protected function get(string $path, ?string $authorization = self::TOKEN, array $server = []): void
+    {
+        if ($authorization !== null) {
+            $server['HTTP_AUTHORIZATION'] = $authorization;
+        }
+        $this->client->request('GET', $path, [], [], $server);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    protected function json(): array
+    {
+        $decoded = json_decode((string) $this->client->getResponse()->getContent(), true);
+        self::assertIsArray($decoded);
+
+        return $decoded;
+    }
+
+    /**
+     * @return list<array<string, mixed>>
+     */
+    protected function listOf(string $key): array
+    {
+        $list = $this->json()[$key] ?? null;
+        self::assertIsArray($list);
+
+        return array_values($list);
+    }
+
+    /**
+     * @return list<string>
+     */
+    protected function idsOf(string $key): array
+    {
+        return array_map(static fn (array $item): string => (string) $item['id'], $this->listOf($key));
+    }
+
+    protected function assertRefused(int $status, string $ecode): void
+    {
+        self::assertResponseStatusCodeSame($status);
+        self::assertSame($ecode, $this->json()['ECODE'] ?? null);
+        self::assertSame(['err', 'ECODE'], array_keys($this->json()));
+    }
+}
diff --git a/tests/Functional/Api/ApiWithoutFirewallTest.php b/tests/Functional/Api/ApiWithoutFirewallTest.php
new file mode 100644
index 00000000..1aa0fdef
--- /dev/null
+++ b/tests/Functional/Api/ApiWithoutFirewallTest.php
@@ -0,0 +1,26 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api;
+
+/**
+ * Spec 213: a host that left the API out of its firewall: the checkers would judge nobody, so it answers 500 and opens nothing.
+ */
+final class ApiWithoutFirewallTest extends ApiTestCase
+{
+    protected function setUp(): void
+    {
+        static::$withFirewall = false;
+        parent::setUp();
+    }
+
+    public function testNothingIsAnsweredWithoutTheSecurityUser(): void
+    {
+        $this->issueToken();
+
+        $this->get('/api/tasks/v2/user');
+
+        $this->assertRefused(500, 'SERVER_001');
+    }
+}
diff --git a/tests/Functional/Api/App/ApiFirewallAuthenticator.php b/tests/Functional/Api/App/ApiFirewallAuthenticator.php
new file mode 100644
index 00000000..c5383cb1
--- /dev/null
+++ b/tests/Functional/Api/App/ApiFirewallAuthenticator.php
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api\App;
+
+use Nowo\TaskBoardBundle\Api\TaskApiCredential;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Exception\AuthenticationException;
+use Symfony\Component\Security\Http\Authenticator\AbstractAuthenticator;
+use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
+use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
+use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;
+
+/**
+ * A host's stateless firewall: it sets the security user for a known token and lets anything else through with no user,
+ * so the bundle answers every refusal in one shape.
+ */
+final class ApiFirewallAuthenticator extends AbstractAuthenticator
+{
+    public function supports(Request $request): ?bool
+    {
+        return isset(ApiTestHost::$tokens[(string) TaskApiCredential::fromRequest($request)]);
+    }
+
+    public function authenticate(Request $request): Passport
+    {
+        return new SelfValidatingPassport(new UserBadge(ApiTestHost::$tokens[(string) TaskApiCredential::fromRequest($request)]['email']));
+    }
+
+    public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
+    {
+        return null;
+    }
+
+    public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response
+    {
+        return null;
+    }
+}
diff --git a/tests/Functional/Api/App/ApiKernel.php b/tests/Functional/Api/App/ApiKernel.php
new file mode 100644
index 00000000..49054ea8
--- /dev/null
+++ b/tests/Functional/Api/App/ApiKernel.php
@@ -0,0 +1,153 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api\App;
+
+use Doctrine\Bundle\DoctrineBundle\DependencyInjection\Configuration as DoctrineConfiguration;
+use Doctrine\Bundle\DoctrineBundle\DoctrineBundle;
+use Nowo\FormKitBundle\NowoFormKitBundle;
+use Nowo\TaskBoardBundle\TaskBoardBundle;
+use Nowo\TaskBoardBundle\Tests\Functional\App\Entity\AppUser;
+use Nowo\TaskBoardBundle\Tests\Functional\App\FunctionalKernel;
+use Nowo\TaskBoardBundle\Tests\Functional\App\RecordingAttachmentStorage;
+use Nowo\TaskBoardBundle\Tests\Functional\App\RecordingLogger;
+use Nowo\TaskBoardBundle\Tests\Functional\App\TestCredentialResolver;
+use Nowo\TaskBoardBundle\Tests\Functional\App\TestSyncLimitChecker;
+use Nowo\UiKitBundle\NowoUiKitBundle;
+use Symfony\Bundle\FrameworkBundle\FrameworkBundle;
+use Symfony\Bundle\FrameworkBundle\Kernel\MicroKernelTrait;
+use Symfony\Bundle\SecurityBundle\SecurityBundle;
+use Symfony\Bundle\TwigBundle\TwigBundle;
+use Symfony\Component\Config\Definition\ArrayNode;
+use Symfony\Component\Config\Definition\BaseNode;
+use Symfony\Component\DependencyInjection\Loader\Configurator\ContainerConfigurator;
+use Symfony\Component\HttpKernel\Kernel;
+use Symfony\Component\Routing\Loader\Configurator\RoutingConfigurator;
+use Twig\Extra\TwigExtraBundle\TwigExtraBundle;
+
+use function md5;
+use function serialize;
+use function sys_get_temp_dir;
+
+use const PHP_VERSION_ID;
+
+/**
+ * Host kernel of the API tests: the bundle with `api.enabled` and a stateless firewall on the API's prefix. `$withFirewall`
+ * false: the host forgot it, and the API must fail closed.
+ */
+final class ApiKernel extends Kernel
+{
+    use MicroKernelTrait;
+
+    /**
+     * @param array<string, mixed> $api `nowo_task_board.api`, merged over a complete set of hooks
+     * @param array<string, mixed> $taskBoard the rest of `nowo_task_board`
+     */
+    public function __construct(private readonly array $api = [], private readonly array $taskBoard = [], private readonly bool $withFirewall = true)
+    {
+        parent::__construct('test', true);
+    }
+
+    public function registerBundles(): iterable
+    {
+        yield new FrameworkBundle();
+        yield new DoctrineBundle();
+        yield new TwigBundle();
+        yield new TwigExtraBundle();
+        yield new SecurityBundle();
+        yield new NowoUiKitBundle();
+        yield new NowoFormKitBundle();
+        yield new TaskBoardBundle();
+    }
+
+    public function getProjectDir(): string
+    {
+        return __DIR__ . '/../../App';
+    }
+
+    public function getCacheDir(): string
+    {
+        return sys_get_temp_dir() . '/nowo-task-board-api/' . md5(serialize([$this->api, $this->taskBoard, $this->withFirewall, FunctionalKernel::databaseUrl()])) . '/cache';
+    }
+
+    public function getLogDir(): string
+    {
+        return sys_get_temp_dir() . '/nowo-task-board-api/log';
+    }
+
+    private function configureContainer(ContainerConfigurator $container): void
+    {
+        $container->extension('framework', [
+            'secret'               => 'functional-test',
+            'test'                 => true,
+            'http_method_override' => false,
+            'csrf_protection'      => true,
+            'form'                 => ['csrf_protection' => true],
+            'session'              => ['storage_factory_id' => 'session.storage.factory.mock_file'],
+            'property_info'        => ['with_constructor_extractor' => true],
+            'router'               => ['utf8' => true],
+            'assets'               => true,
+            'default_locale'       => 'en',
+        ]);
+        $services = $container->services();
+        $services->set('logger', RecordingLogger::class)->public();
+        $services->set('app.api_host', ApiTestHost::class)->autowire()->public();
+        $services->set('app.api_firewall', ApiFirewallAuthenticator::class);
+        $services->set('app.tenant_resolver', ScriptedTenantResolver::class);
+        $container->extension('doctrine', [
+            'dbal' => ['url' => FunctionalKernel::databaseUrl()],
+            'orm'  => [
+                'auto_mapping' => true,
+                'mappings'     => ['FunctionalApp' => [
+                    'type'      => 'attribute',
+                    'is_bundle' => false,
+                    'dir'       => __DIR__ . '/../../App/Entity',
+                    'prefix'    => 'Nowo\\TaskBoardBundle\\Tests\\Functional\\App\\Entity',
+                ]],
+            ] + $this->nativeLazyObjects(),
+        ]);
+        $container->extension('security', [
+            'providers' => ['app' => ['entity' => ['class' => AppUser::class, 'property' => 'email']]],
+            'firewalls' => ($this->withFirewall ? ['task_api' => ['pattern' => '^/api/', 'stateless' => true, 'provider' => 'app', 'custom_authenticators' => ['app.api_firewall']]] : [])
+                + ['main' => ['lazy' => true, 'provider' => 'app']],
+        ]);
+        $container->extension('twig', ['strict_variables' => true]);
+        // Like Beacon: no resource scoping, the host's listeners decide (one configuration, so one container, for most tests).
+        $container->extension('nowo_task_board', ['user_class' => AppUser::class, 'security' => ['resource_scoping' => false], 'api' => $this->api + ['enabled' => true, 'host_decides_access' => true, 'hooks' => [
+            'authenticator' => 'app.api_host',
+            'rate_limiter'  => 'app.api_host',
+            'plan_gate'     => 'app.api_host',
+            'workspace'     => 'app.api_host',
+            'users'         => 'app.api_host',
+            'time_entries'  => 'app.api_host',
+        ]]] + $this->taskBoard);
+        if (($this->taskBoard['sync']['enabled'] ?? false) === true) {
+            // The host side of a provider sync, for the imported custom fields.
+            $services->set('app.sync_credentials', TestCredentialResolver::class)->public();
+            $services->set('app.sync_storage', RecordingAttachmentStorage::class)->public();
+            $services->set('app.sync_limits', TestSyncLimitChecker::class)->public();
+        }
+    }
+
+    /**
+     * @return array<string, bool>
+     */
+    private function nativeLazyObjects(): array
+    {
+        if (PHP_VERSION_ID < 80400) {
+            return [];
+        }
+
+        $root = (new DoctrineConfiguration(false))->getConfigTreeBuilder()->buildTree();
+        $orm  = $root instanceof ArrayNode ? ($root->getChildren()['orm'] ?? null) : null;
+        $node = $orm instanceof ArrayNode ? ($orm->getChildren()['enable_native_lazy_objects'] ?? null) : null;
+
+        return $node instanceof BaseNode && !$node->isDeprecated() ? ['enable_native_lazy_objects' => true] : [];
+    }
+
+    private function configureRoutes(RoutingConfigurator $routes): void
+    {
+        $routes->import('.', 'nowo_task_board');
+    }
+}
diff --git a/tests/Functional/Api/App/ApiTestHost.php b/tests/Functional/Api/App/ApiTestHost.php
new file mode 100644
index 00000000..c6a1a902
--- /dev/null
+++ b/tests/Functional/Api/App/ApiTestHost.php
@@ -0,0 +1,205 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api\App;
+
+use DateTimeImmutable;
+use Doctrine\ORM\EntityManagerInterface;
+use LogicException;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiAuthenticatorInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiPlanGateInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiRateLimiterInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiTimeEntriesInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiUsersInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiWorkspaceInterface;
+use Nowo\TaskBoardBundle\Api\TaskApiAuthFailure;
+use Nowo\TaskBoardBundle\Api\TaskApiCredential;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\TaskApiWhere;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiNewTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiRateLimitState;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiSpace;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTeam;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimePage;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeQuery;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiUser;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Tests\Functional\App\Entity\AppUser;
+use Symfony\Component\HttpFoundation\Request;
+
+use function array_map;
+use function in_array;
+
+/**
+ * The host side of the API in the tests: one scriptable object behind every hook. Its state is static, as a test sets it
+ * before the kernel handles the request.
+ */
+final class ApiTestHost implements TaskApiAuthenticatorInterface, TaskApiRateLimiterInterface, TaskApiPlanGateInterface, TaskApiWorkspaceInterface, TaskApiUsersInterface, TaskApiTimeEntriesInterface
+{
+    /** @var array<string, array{email: string, level: TaskApiLevel, where: TaskApiWhere}> */
+    public static array $tokens = [];
+
+    public static bool $apiDisabled = false;
+
+    public static bool $tokenLimitAccepts = true;
+
+    public static bool $ipLimitAccepts = true;
+
+    /** @var list<string> */
+    public static array $failedIps = [];
+
+    public static int $consumed = 0;
+
+    public static bool $planAllows = true;
+
+    /** @var list<string> tenants the plan refuses */
+    public static array $planRefusesTenants = [];
+
+    /** @var list<string|null> tenants the person reaches */
+    public static array $tenants = [];
+
+    public static bool $profilesEmpty = false;
+
+    /** @var list<string> people the host does not know */
+    public static array $unknownEmails = [];
+
+    /** @var list<TaskApiTimeQuery> */
+    public static array $timeQueries = [];
+
+    /** A principal the firewall does not stand behind. */
+    public static ?object $forcedUser = null;
+
+    public function __construct(private readonly EntityManagerInterface $entityManager)
+    {
+    }
+
+    public static function reset(): void
+    {
+        self::$tokens             = [];
+        self::$apiDisabled        = false;
+        self::$tokenLimitAccepts  = true;
+        self::$ipLimitAccepts     = true;
+        self::$failedIps          = [];
+        self::$consumed           = 0;
+        self::$planAllows         = true;
+        self::$planRefusesTenants = [];
+        self::$tenants            = [];
+        self::$forcedUser         = null;
+        self::$profilesEmpty      = false;
+        self::$timeQueries        = [];
+        self::$unknownEmails      = [];
+    }
+
+    public function authenticate(Request $request): TaskApiPrincipal|TaskApiAuthFailure
+    {
+        if (self::$apiDisabled) {
+            return TaskApiAuthFailure::ApiDisabled;
+        }
+        $token = self::$tokens[(string) TaskApiCredential::fromRequest($request)] ?? null;
+        if ($token === null) {
+            return TaskApiAuthFailure::Invalid;
+        }
+        $user = self::$forcedUser ?? $this->entityManager->getRepository(AppUser::class)->findOneBy(['email' => $token['email']]);
+        if ($user === null) {
+            return TaskApiAuthFailure::Invalid;
+        }
+
+        return new TaskApiPrincipal($user, $token['level'], $token['where'], 'token-id', 'token name');
+    }
+
+    public function consume(TaskApiPrincipal $principal): TaskApiRateLimitState
+    {
+        ++self::$consumed;
+
+        return new TaskApiRateLimitState(self::$tokenLimitAccepts, 100, self::$tokenLimitAccepts ? 99 : 0, 1_790_000_000);
+    }
+
+    public function failedTokenState(string $clientIp): TaskApiRateLimitState
+    {
+        return new TaskApiRateLimitState(self::$ipLimitAccepts, 10, self::$ipLimitAccepts ? 10 : 0, 1_790_000_060);
+    }
+
+    public function registerFailedToken(string $clientIp): void
+    {
+        self::$failedIps[] = $clientIp;
+    }
+
+    public function allowsTasks(object $user, ?string $tenantKey): bool
+    {
+        return self::$planAllows && !in_array($tenantKey, self::$planRefusesTenants, true);
+    }
+
+    public function teams(TaskApiPrincipal $principal): array
+    {
+        return [new TaskApiTeam('team-1', 'Personal', '#000000', 'https://example.com/a.png'), new TaskApiTeam('team-2', 'Acme')];
+    }
+
+    /** Every tenant the person reaches is a space of team-1; team-2 has none. */
+    public function spaces(TaskApiPrincipal $principal, string $teamId): array
+    {
+        return $teamId === 'team-1' ? array_map(self::spaceOf(...), self::$tenants) : [];
+    }
+
+    public function space(TaskApiPrincipal $principal, string $spaceId): ?TaskApiSpace
+    {
+        foreach (self::$tenants as $tenant) {
+            if (self::spaceOf($tenant)->id === $spaceId) {
+                return self::spaceOf($tenant);
+            }
+        }
+
+        return null;
+    }
+
+    public function spaceOfTenant(TaskApiPrincipal $principal, ?string $tenantKey): ?TaskApiSpace
+    {
+        return in_array($tenantKey, self::$tenants, true) ? self::spaceOf($tenantKey) : null;
+    }
+
+    public static function spaceOf(?string $tenantKey): TaskApiSpace
+    {
+        return new TaskApiSpace('space-' . ($tenantKey ?? 'none'), 'Space ' . ($tenantKey ?? 'none'), 'team-1', $tenantKey);
+    }
+
+    public function list(TaskApiPrincipal $principal, TaskApiTimeQuery $query): TaskApiTimePage
+    {
+        self::$timeQueries[] = $query;
+
+        return new TaskApiTimePage([new TaskApiTimeEntry('entry-1', $this->apiId($principal->user), new DateTimeImmutable('@1790000000'), 3600, $query->taskId, 'Review')]);
+    }
+
+    public function log(TaskApiPrincipal $principal, ?Task $task, TaskApiNewTimeEntry $entry): TaskApiTimeEntry
+    {
+        throw new LogicException('Not in the read tests.');
+    }
+
+    public function apiId(object $user): string
+    {
+        if ($user instanceof AppUser && in_array($user->getEmail(), self::$unknownEmails, true)) {
+            throw TaskApiRefusal::notFound();
+        }
+
+        return $user instanceof AppUser ? 'uuid-' . $user->getId() : 'unknown';
+    }
+
+    public function find(string $apiId): ?object
+    {
+        return str_starts_with($apiId, 'uuid-') ? $this->entityManager->find(AppUser::class, (int) substr($apiId, 5)) : null;
+    }
+
+    public function profiles(array $users, TaskApiPrincipal $viewer): array
+    {
+        $profiles = [];
+        foreach (self::$profilesEmpty ? [] : $users as $user) {
+            if ($user instanceof AppUser && !in_array($user->getEmail(), self::$unknownEmails, true)) {
+                $profiles[$this->apiId($user)] = new TaskApiUser($this->apiId($user), $user->getEmail(), $user->getEmail());
+            }
+        }
+
+        return $profiles;
+    }
+}
diff --git a/tests/Functional/Api/App/ScriptedTenantResolver.php b/tests/Functional/Api/App/ScriptedTenantResolver.php
new file mode 100644
index 00000000..053f77ef
--- /dev/null
+++ b/tests/Functional/Api/App/ScriptedTenantResolver.php
@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Api\App;
+
+use Nowo\TaskBoardBundle\Tenancy\TaskBoardTenant;
+use Nowo\TaskBoardBundle\Tenancy\TaskBoardTenantResolverInterface;
+
+use function in_array;
+
+/**
+ * A host's tenant resolver: it opens only the tenants a test lists, whatever the API's workspace hook says.
+ */
+final class ScriptedTenantResolver implements TaskBoardTenantResolverInterface
+{
+    /** @var list<string> */
+    public static array $open = [];
+
+    public function resolve(string $tenantSlug, object $user): ?TaskBoardTenant
+    {
+        return in_array($tenantSlug, self::$open, true) ? new TaskBoardTenant($tenantSlug, $tenantSlug, $tenantSlug) : null;
+    }
+}
diff --git a/tests/Functional/Characterization/CapturesUiOutput.php b/tests/Functional/Characterization/CapturesUiOutput.php
new file mode 100644
index 00000000..be173c12
--- /dev/null
+++ b/tests/Functional/Characterization/CapturesUiOutput.php
@@ -0,0 +1,75 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Characterization;
+
+use Symfony\Component\HttpFoundation\Session\FlashBagAwareSessionInterface;
+
+use function array_filter;
+use function array_map;
+use function array_values;
+use function file_put_contents;
+use function getenv;
+use function is_dir;
+use function is_string;
+use function mkdir;
+use function preg_replace;
+
+/**
+ * Spec 213 S0: what a UI write answers, read back the same way before and after the code behind it moves. With
+ * TASK_BOARD_CHARACTERIZE_DIR set, each named page is also written there with its ids and dates masked, so two checkouts
+ * sharing one vendor can be compared byte by byte (no golden file in the repository: markup differs across the CI matrix).
+ */
+trait CapturesUiOutput
+{
+    /**
+     * @return array{status: int, location: ?string, flashes: array<string, list<string>>, writes: list<string>, refused: list<string>}
+     */
+    private function captured(): array
+    {
+        $response = $this->client->getResponse();
+        $session  = $this->client->getRequest()->getSession();
+        self::assertInstanceOf(FlashBagAwareSessionInterface::class, $session);
+        $records                 = $this->logger()->records;
+        $this->logger()->records = [];
+        // Read and gone, so the next request's flashes stand alone.
+        $flashes = $session->getFlashBag()->all();
+        $session->save();
+
+        return [
+            'status'   => $response->getStatusCode(),
+            'location' => $response->headers->get('Location'),
+            'flashes'  => $flashes,
+            'writes'   => $this->logged($records, 'TaskBoard write: {action}', 'action'),
+            'refused'  => $this->logged($records, 'TaskBoard write refused: {reason}', 'reason'),
+        ];
+    }
+
+    /**
+     * @param list<array{level: mixed, message: mixed, context: array<string, mixed>}> $records
+     *
+     * @return list<string>
+     */
+    private function logged(array $records, string $message, string $key): array
+    {
+        $matching = array_filter($records, static fn (array $record): bool => $record['message'] === $message);
+
+        return array_values(array_map(static fn (array $record): string => (string) $record['context'][$key], $matching));
+    }
+
+    private function dumpBody(string $name): void
+    {
+        $directory = getenv('TASK_BOARD_CHARACTERIZE_DIR');
+        if (!is_string($directory) || $directory === '') {
+            return;
+        }
+        if (!is_dir($directory)) {
+            mkdir($directory, 0o777, true);
+        }
+        $body = (string) $this->client->getResponse()->getContent();
+        $body = (string) preg_replace('/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/', '{uuid}', $body);
+        $body = (string) preg_replace('/\d{4}-\d{2}-\d{2}([ T]\d{2}:\d{2}(:\d{2})?)?/', '{date}', $body);
+        file_put_contents($directory . '/' . $name . '.html', $body);
+    }
+}
diff --git a/tests/Functional/Characterization/UiCommentsCharacterizationTest.php b/tests/Functional/Characterization/UiCommentsCharacterizationTest.php
new file mode 100644
index 00000000..538e5b1f
--- /dev/null
+++ b/tests/Functional/Characterization/UiCommentsCharacterizationTest.php
@@ -0,0 +1,282 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Characterization;
+
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Event\TaskAccessCheckEvent;
+use Nowo\TaskBoardBundle\Event\TaskBoardEvents;
+use Nowo\TaskBoardBundle\Event\TaskCommentEvent;
+use Nowo\TaskBoardBundle\Event\TaskMentionEvent;
+use Nowo\TaskBoardBundle\Tests\Functional\App\Entity\AppUser;
+use Nowo\TaskBoardBundle\Tests\Functional\App\PredictableCsrfTokenManager;
+use Nowo\TaskBoardBundle\Tests\Functional\FunctionalTestCase;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+
+use function json_encode;
+use function str_contains;
+
+/**
+ * Spec 213 S0: the comment routes' output, pinned before their rules move out of the controller. Must not change.
+ */
+final class UiCommentsCharacterizationTest extends FunctionalTestCase
+{
+    use CapturesUiOutput;
+
+    private const BASE = '/tools/task-board/task/';
+
+    private AppUser $reader;
+
+    private Task $work;
+
+    /** @var list<string> */
+    private array $events = [];
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->reader = $this->user('reader@example.com');
+        $this->work   = $this->task($this->board(), 'Work');
+        $dispatcher   = self::getContainer()->get('event_dispatcher');
+        self::assertInstanceOf(EventDispatcherInterface::class, $dispatcher);
+        // The reader may read the task and not edit it, as a host's listener decides it.
+        $readerId = $this->reader->getId();
+        $dispatcher->addListener(TaskBoardEvents::TASK_ACCESS_CHECK, static function (TaskAccessCheckEvent $event) use ($readerId): void {
+            $subject = $event->getSubject();
+            if ($subject instanceof AppUser && $subject->getId() === $readerId) {
+                $event->grant();
+                $event->markReadOnly();
+            }
+        });
+        $dispatcher->addListener(TaskBoardEvents::TASK_COMMENT, function (TaskCommentEvent $event): void {
+            $this->events[] = 'comment:' . $event->getAction();
+        });
+        $dispatcher->addListener(TaskBoardEvents::TASK_MENTION, function (TaskMentionEvent $event): void {
+            $this->events[] = 'mention';
+        });
+        $this->logger()->records = [];
+    }
+
+    public function testAReaderAddsACommentAndTheMentionedPersonIsNamed(): void
+    {
+        $this->login($this->reader);
+
+        $this->comment('Hi @owner@example.com', [['id' => (string) $this->owner->getId(), 'label' => 'owner@example.com']]);
+
+        self::assertSame([
+            'status'   => 302,
+            'location' => self::BASE . $this->work->getId(),
+            'flashes'  => ['success' => ['Comment added.']],
+            'writes'   => ['task_comment'],
+            'refused'  => [],
+        ], $this->captured());
+        self::assertSame(['comment:created', 'mention'], $this->events);
+        $stored = $this->onlyComment();
+        self::assertSame('Hi @owner@example.com', $stored->getBody());
+        self::assertSame([(string) $this->owner->getId()], $stored->getMentionedIds());
+    }
+
+    public function testAnEmptyCommentIsRefusedWithAFlash(): void
+    {
+        $this->login($this->reader);
+
+        $this->comment('');
+
+        self::assertSame([
+            'status'   => 302,
+            'location' => self::BASE . $this->work->getId(),
+            'flashes'  => ['error' => ['The comment was not saved: write between 1 and 5000 characters.']],
+            'writes'   => [],
+            'refused'  => [],
+        ], $this->captured());
+        self::assertSame([], $this->events);
+    }
+
+    public function testAForgedTokenOnACommentIs403AndLogged(): void
+    {
+        $this->login($this->reader);
+
+        $this->client->request('POST', self::BASE . $this->work->getId() . '/comment', ['task_comment' => ['body' => 'x', 'mentions' => '[]', '_token' => 'forged']]);
+
+        $captured = $this->captured();
+        self::assertSame(403, $captured['status']);
+        self::assertSame(['csrf_invalid'], $captured['refused']);
+        self::assertSame([], $captured['writes']);
+        self::assertSame([], $this->events);
+    }
+
+    public function testReadersAreRefusedWhenTheOptionIsOffAndEditorsAreNot(): void
+    {
+        self::$taskBoardConfig = ['comments' => ['readers_can_comment' => false]];
+        self::ensureKernelShutdown();
+        $this->events = [];
+        $this->setUp();
+        $this->login($this->reader);
+
+        $this->comment('Reader');
+        self::assertSame(403, $this->captured()['status']);
+
+        $this->login($this->owner);
+        $this->comment('Editor');
+        self::assertSame(['task_comment'], $this->captured()['writes']);
+        self::assertSame('Editor', $this->onlyComment()->getBody());
+    }
+
+    public function testOnlyTheAuthorEditsAndOnlyNewMentionsAreNotified(): void
+    {
+        $this->login($this->reader);
+        $mention = [['id' => (string) $this->owner->getId(), 'label' => 'owner@example.com']];
+        $this->comment('Hi @owner@example.com', $mention);
+        $this->captured();
+        $this->events = [];
+        $comment      = $this->onlyComment();
+
+        $this->client->request('POST', $this->commentUrl($comment), ['task_comment' => ['body' => 'Still @owner@example.com', 'mentions' => json_encode($mention), '_token' => PredictableCsrfTokenManager::value('task_comment')]]);
+        self::assertSame([
+            'status'   => 302,
+            'location' => self::BASE . $this->work->getId(),
+            'flashes'  => ['success' => ['Comment updated.']],
+            'writes'   => ['task_comment_edit'],
+            'refused'  => [],
+        ], $this->captured());
+        self::assertSame(['comment:edited'], $this->events);
+
+        $this->login($this->owner);
+        $this->client->request('POST', $this->commentUrl($comment), ['task_comment' => ['body' => 'Hijack', 'mentions' => '[]', '_token' => PredictableCsrfTokenManager::value('task_comment')]]);
+        self::assertSame(403, $this->captured()['status']);
+        self::assertSame('Still @owner@example.com', $this->onlyComment()->getBody());
+    }
+
+    public function testTheAuthorOrAnEditorDeletesAndNobodyElse(): void
+    {
+        $other = $this->user('other@example.com');
+        $this->login($this->owner);
+        $this->comment('By the owner');
+        $this->captured();
+        $comment      = $this->onlyComment();
+        $this->events = [];
+
+        // A reader who did not write it.
+        $this->login($this->reader);
+        $this->client->request('POST', $this->commentUrl($comment) . '/delete', ['_token' => PredictableCsrfTokenManager::value('task_board_task_comment_delete')]);
+        self::assertSame(403, $this->captured()['status']);
+        self::assertFalse($this->onlyComment()->isDeleted());
+
+        // Someone with no access at all to the task.
+        $this->login($other);
+        $this->client->request('POST', $this->commentUrl($comment) . '/delete', ['_token' => PredictableCsrfTokenManager::value('task_board_task_comment_delete')]);
+        self::assertSame(403, $this->captured()['status']);
+
+        // The author; no event is dispatched for a deletion.
+        $this->login($this->owner);
+        $this->client->request('POST', $this->commentUrl($comment) . '/delete', ['_token' => PredictableCsrfTokenManager::value('task_board_task_comment_delete')]);
+        self::assertSame([
+            'status'   => 302,
+            'location' => self::BASE . $this->work->getId(),
+            'flashes'  => ['success' => ['Comment deleted.']],
+            'writes'   => ['task_comment_delete'],
+            'refused'  => [],
+        ], $this->captured());
+        self::assertSame([], $this->events);
+        self::assertTrue($this->onlyComment()->isDeleted());
+
+        // Deleted: not found, for edit and delete alike.
+        $this->client->request('POST', $this->commentUrl($comment) . '/delete', ['_token' => PredictableCsrfTokenManager::value('task_board_task_comment_delete')]);
+        self::assertSame(404, $this->captured()['status']);
+    }
+
+    public function testAReaderDeletesTheirOwnComment(): void
+    {
+        $this->login($this->reader);
+        $this->comment('Mine');
+        $this->captured();
+
+        $this->client->request('POST', $this->commentUrl($this->onlyComment()) . '/delete', ['_token' => PredictableCsrfTokenManager::value('task_board_task_comment_delete')]);
+
+        self::assertSame(['task_comment_delete'], $this->captured()['writes']);
+        self::assertTrue($this->onlyComment()->isDeleted());
+    }
+
+    public function testAPanelWriteAnswersTheFragmentWithTheViewersControls(): void
+    {
+        $this->login($this->reader);
+
+        $this->client->xmlHttpRequest('POST', self::BASE . $this->work->getId() . '/comment', ['task_comment' => ['body' => 'From the panel', 'mentions' => '[]', '_token' => PredictableCsrfTokenManager::value('task_comment')]]);
+
+        $captured = $this->captured();
+        self::assertSame(200, $captured['status']);
+        self::assertNull($captured['location']);
+        self::assertSame(['task_comment'], $captured['writes']);
+        $this->dumpBody('comment-panel-reader');
+        $comment = $this->onlyComment();
+        $page    = (string) $this->client->getResponse()->getContent();
+        self::assertStringNotContainsString('<html', $page);
+        self::assertStringContainsString('From the panel', $page);
+        self::assertStringContainsString($this->commentUrl($comment), $page, 'the author can edit');
+        self::assertStringContainsString($this->commentUrl($comment) . '/delete', $page, 'the author can delete');
+    }
+
+    public function testTheTaskPageShowsEachViewerTheirControls(): void
+    {
+        $this->login($this->owner);
+        $this->comment('By the owner');
+        $this->captured();
+        $comment = $this->onlyComment();
+
+        $this->client->request('GET', self::BASE . $this->work->getId());
+        self::assertResponseIsSuccessful();
+        $this->dumpBody('task-page-editor');
+        $editor = (string) $this->client->getResponse()->getContent();
+        self::assertStringContainsString($this->commentUrl($comment) . '"', $editor, 'the author edits');
+        self::assertStringContainsString($this->commentUrl($comment) . '/delete', $editor);
+        self::assertStringContainsString(self::BASE . $this->work->getId() . '/comment"', $editor, 'the box');
+
+        $this->login($this->reader);
+        $this->client->request('GET', self::BASE . $this->work->getId());
+        self::assertResponseIsSuccessful();
+        $this->dumpBody('task-page-reader');
+        $reader = (string) $this->client->getResponse()->getContent();
+        self::assertFalse(str_contains($reader, $this->commentUrl($comment) . '"'), 'not the author: no edit form');
+        self::assertFalse(str_contains($reader, $this->commentUrl($comment) . '/delete'), 'not an editor: no delete');
+        self::assertStringContainsString(self::BASE . $this->work->getId() . '/comment"', $reader, 'readers comment by default');
+    }
+
+    public function testTheTaskPageHidesTheBoxFromReadersWhenTheOptionIsOff(): void
+    {
+        self::$taskBoardConfig = ['comments' => ['readers_can_comment' => false]];
+        self::ensureKernelShutdown();
+        $this->events = [];
+        $this->setUp();
+        $this->login($this->reader);
+
+        $this->client->request('GET', self::BASE . $this->work->getId());
+
+        self::assertResponseIsSuccessful();
+        $this->dumpBody('task-page-reader-option-off');
+        self::assertStringNotContainsString(self::BASE . $this->work->getId() . '/comment"', (string) $this->client->getResponse()->getContent());
+    }
+
+    /**
+     * @param list<array{id: string, label: string}> $mentions
+     */
+    private function comment(string $body, array $mentions = []): void
+    {
+        $this->client->request('POST', self::BASE . $this->work->getId() . '/comment', ['task_comment' => ['body' => $body, 'mentions' => json_encode($mentions), '_token' => PredictableCsrfTokenManager::value('task_comment')]]);
+    }
+
+    private function commentUrl(TaskComment $comment): string
+    {
+        return self::BASE . $this->work->getId() . '/comment/' . $comment->getId();
+    }
+
+    private function onlyComment(): TaskComment
+    {
+        $this->em->clear();
+        $comments = $this->em->getRepository(TaskComment::class)->findAll();
+        self::assertCount(1, $comments);
+
+        return $comments[0];
+    }
+}
diff --git a/tests/Functional/Characterization/UiFormsCharacterizationTest.php b/tests/Functional/Characterization/UiFormsCharacterizationTest.php
new file mode 100644
index 00000000..20852a6b
--- /dev/null
+++ b/tests/Functional/Characterization/UiFormsCharacterizationTest.php
@@ -0,0 +1,182 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Characterization;
+
+use Nowo\TaskBoardBundle\Dto\TaskFormData;
+use Nowo\TaskBoardBundle\Entity\BoardColumn;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Entity\TaskLink;
+use Nowo\TaskBoardBundle\Form\BoardColumnFormType;
+use Nowo\TaskBoardBundle\Form\TaskBoardFormType;
+use Nowo\TaskBoardBundle\Form\TaskCommentFormType;
+use Nowo\TaskBoardBundle\Form\TaskFormType;
+use Nowo\TaskBoardBundle\Form\TaskLinkFormType;
+use Nowo\TaskBoardBundle\Form\TaskTimeEntryFormType;
+use Nowo\TaskBoardBundle\Support\BoardIcon;
+use Nowo\TaskBoardBundle\Tests\Functional\App\PredictableCsrfTokenManager;
+use Nowo\TaskBoardBundle\Tests\Functional\FunctionalTestCase;
+use PHPUnit\Framework\Attributes\DataProvider;
+use Symfony\Component\Form\FormFactoryInterface;
+use Symfony\Component\Form\FormInterface;
+use Symfony\Component\Validator\Constraint;
+use Symfony\Component\Validator\Constraints\Callback;
+use Symfony\Component\Validator\Constraints\Length;
+use Symfony\Component\Validator\Constraints\NotBlank;
+use Symfony\Component\Validator\Constraints\NotNull;
+use Symfony\Component\Validator\Constraints\Range;
+use Symfony\Component\Validator\Constraints\Regex;
+use Symfony\Component\Validator\Constraints\Url;
+
+use function array_keys;
+use function array_values;
+use function count;
+use function str_repeat;
+
+/**
+ * Spec 213 S0: the validation the six write forms apply, pinned before their constraints get a shared home. A form that
+ * lost or relaxed a rule would fail here, and with it a stored title over the column's size or a `javascript:` link.
+ */
+final class UiFormsCharacterizationTest extends FunctionalTestCase
+{
+    use CapturesUiOutput;
+
+    /**
+     * @return iterable<string, array{0: class-string, 1: array<string, mixed>, 2: array<string, list<array<string, mixed>>>}>
+     */
+    public static function forms(): iterable
+    {
+        yield 'task' => [TaskFormType::class, ['column_choices' => []], [
+            'title'   => [['class' => NotBlank::class], ['class' => Length::class, 'max' => 255]],
+            'startAt' => [['class' => Callback::class]],
+        ]];
+        yield 'board' => [TaskBoardFormType::class, ['icon_field' => true, 'icon_too_long_message' => 'long', 'icon_invalid_message' => 'invalid'], [
+            'name' => [['class' => NotBlank::class], ['class' => Length::class, 'max' => 255]],
+            'slug' => [['class' => Length::class, 'max' => 255]],
+            'icon' => [
+                ['class' => Length::class, 'max' => BoardIcon::MAX_BYTES, 'countUnit' => Length::COUNT_BYTES, 'maxMessage' => 'long'],
+                ['class' => Regex::class, 'pattern' => BoardIcon::PATTERN, 'message' => 'invalid'],
+            ],
+        ]];
+        yield 'column' => [BoardColumnFormType::class, [], [
+            'name'  => [['class' => NotBlank::class], ['class' => Length::class, 'max' => 128]],
+            'color' => [['class' => Regex::class, 'pattern' => BoardColumnFormType::COLOR_PATTERN]],
+        ]];
+        yield 'comment' => [TaskCommentFormType::class, [], [
+            'body' => [['class' => NotBlank::class], ['class' => Length::class, 'max' => TaskComment::MAX_LENGTH]],
+        ]];
+        yield 'time' => [TaskTimeEntryFormType::class, [], [
+            'minutes'  => [['class' => NotNull::class], ['class' => Range::class, 'min' => 1, 'max' => TaskTimeEntryFormType::MAX_MINUTES]],
+            'loggedAt' => [['class' => NotNull::class]],
+            'note'     => [['class' => Length::class, 'max' => 512]],
+        ]];
+        yield 'link' => [TaskLinkFormType::class, [], [
+            'url' => [
+                ['class' => NotBlank::class],
+                ['class' => Url::class, 'protocols' => ['http', 'https'], 'requireTld' => false],
+                ['class' => Length::class, 'max' => 2048],
+            ],
+            'label'      => [['class' => Length::class, 'max' => 255]],
+            'externalId' => [['class' => Length::class, 'max' => 128]],
+        ]];
+    }
+
+    /**
+     * @param class-string $type
+     * @param array<string, mixed> $options
+     * @param array<string, list<array<string, mixed>>> $expected
+     */
+    #[DataProvider('forms')]
+    public function testAFormKeepsItsConstraints(string $type, array $options, array $expected): void
+    {
+        $factory = self::getContainer()->get('form.factory');
+        self::assertInstanceOf(FormFactoryInterface::class, $factory);
+        $form = $factory->create($type, null, $options);
+
+        foreach ($expected as $field => $constraints) {
+            self::assertSame($constraints, $this->described($form->get($field), $constraints), $field);
+        }
+    }
+
+    public function testATitleOverTheColumnSizeIsAFlashAndNothingIsStored(): void
+    {
+        $board  = $this->board();
+        $column = $board->getColumns()->first();
+        self::assertInstanceOf(BoardColumn::class, $column);
+        $this->login($this->owner);
+        $this->logger()->records = [];
+
+        $this->client->request('POST', '/tools/task-board/board/' . $board->getId() . '/create', ['task_form' => ['title' => str_repeat('x', 256), 'columnId' => $column->getId(), '_token' => PredictableCsrfTokenManager::value('task_form')]]);
+
+        $captured = $this->captured();
+        self::assertSame(302, $captured['status']);
+        self::assertSame([], $captured['writes']);
+        self::assertCount(1, $captured['flashes']['error'] ?? []);
+        self::assertSame([], $this->em->getRepository(Task::class)->findBy(['board' => $board]));
+    }
+
+    public function testAJavascriptLinkIsNotStored(): void
+    {
+        $task = $this->task($this->board(), 'Linked');
+        $this->login($this->owner);
+        $this->logger()->records = [];
+
+        $this->client->request('POST', '/tools/task-board/task/' . $task->getId() . '/link', ['task_link_form' => ['linkType' => 'url', 'url' => 'javascript:alert(1)', '_token' => PredictableCsrfTokenManager::value('task_link_form')]]);
+
+        self::assertSame([], $this->captured()['writes']);
+        self::assertSame([], $this->em->getRepository(TaskLink::class)->findBy(['task' => $task]));
+    }
+
+    public function testAStartAfterTheDueDateIsAFormError(): void
+    {
+        $factory = self::getContainer()->get('form.factory');
+        self::assertInstanceOf(FormFactoryInterface::class, $factory);
+        $form = $factory->create(TaskFormType::class, new TaskFormData(), ['column_choices' => [], 'csrf_protection' => false, 'rich_description' => false, 'tag_input' => false]);
+
+        $form->submit(['title' => 'Dates', 'priority' => 'normal', 'startAt' => '2026-11-07', 'dueAt' => '2026-11-06']);
+
+        self::assertFalse($form->isValid());
+        self::assertSame(1, $form->get('startAt')->getErrors()->count());
+    }
+
+    public function testTheBoardPagesRenderTheirForms(): void
+    {
+        $board = $this->board();
+        $task  = $this->task($board, 'Rendered');
+        $this->login($this->owner);
+
+        foreach (['board' => '/board/' . $board->getId(), 'list' => '/board/' . $board->getId() . '/list', 'index' => '', 'task' => '/task/' . $task->getId(), 'import' => '/board/' . $board->getId() . '/import'] as $name => $path) {
+            $this->client->request('GET', '/tools/task-board' . $path);
+            self::assertResponseIsSuccessful($name);
+            $this->dumpBody('page-' . $name);
+        }
+    }
+
+    /**
+     * @param FormInterface<mixed> $field
+     * @param list<array<string, mixed>> $expected what to read of each constraint
+     *
+     * @return list<array<string, mixed>>
+     */
+    private function described(FormInterface $field, array $expected): array
+    {
+        $constraints = $field->getConfig()->getOption('constraints');
+        self::assertIsArray($constraints);
+        self::assertCount(count($expected), $constraints);
+        $described = [];
+        foreach (array_values($constraints) as $index => $constraint) {
+            self::assertInstanceOf(Constraint::class, $constraint);
+            $row = ['class' => $constraint::class];
+            foreach (array_keys($expected[$index]) as $property) {
+                if ($property !== 'class') {
+                    $row[$property] = $constraint->{$property};
+                }
+            }
+            $described[] = $row;
+        }
+
+        return $described;
+    }
+}
diff --git a/tests/Functional/Characterization/UiRestoreCharacterizationTest.php b/tests/Functional/Characterization/UiRestoreCharacterizationTest.php
new file mode 100644
index 00000000..d6a59389
--- /dev/null
+++ b/tests/Functional/Characterization/UiRestoreCharacterizationTest.php
@@ -0,0 +1,135 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Characterization;
+
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Entity\TaskChangeHistory;
+use Nowo\TaskBoardBundle\Enum\TaskChangeType;
+use Nowo\TaskBoardBundle\Tests\Functional\App\PredictableCsrfTokenManager;
+use Nowo\TaskBoardBundle\Tests\Functional\App\TestSyncLimitChecker;
+use Nowo\TaskBoardBundle\Tests\Functional\Sync\SyncFunctionalTestCase;
+
+/**
+ * Spec 213 S0: the restore route's output with the host's limit wired, pinned before the rule moves to the service.
+ */
+final class UiRestoreCharacterizationTest extends SyncFunctionalTestCase
+{
+    use CapturesUiOutput;
+
+    private const BASE = '/tools/task-board/';
+
+    public function testAnArchivedTaskIsRestoredAndRecorded(): void
+    {
+        $board = $this->board();
+        $task  = $this->archived($board, 'Back');
+        $this->login($this->owner);
+        $this->logger()->records = [];
+
+        $this->restore($task);
+
+        self::assertSame([
+            'status'   => 302,
+            'location' => self::BASE . 'board/' . $board->getId() . '/list',
+            'flashes'  => ['success' => ['The task was restored.']],
+            'writes'   => ['task_restore'],
+            'refused'  => [],
+        ], $this->captured());
+        self::assertSame([[1, 0]], TestSyncLimitChecker::$calls);
+        $this->em->clear();
+        $reloaded = $this->em->find(Task::class, $task->getId());
+        self::assertInstanceOf(Task::class, $reloaded);
+        self::assertFalse($reloaded->isArchived());
+        $history = $this->em->getRepository(TaskChangeHistory::class)->findBy(['task' => $reloaded, 'changeType' => TaskChangeType::Restored]);
+        self::assertCount(1, $history);
+        self::assertSame('manual', $history[0]->getNewValue());
+    }
+
+    public function testACompletedTaskAsksTheLimitForNothing(): void
+    {
+        $board = $this->board();
+        $task  = $this->archived($board, 'Done', completed: true);
+        $this->login($this->owner);
+
+        $this->restore($task);
+
+        self::assertSame([[0, 0]], TestSyncLimitChecker::$calls);
+        self::assertSame(['task_restore'], $this->captured()['writes']);
+    }
+
+    public function testARefusedRestoreChangesNothingAndSaysSo(): void
+    {
+        $board = $this->board();
+        $task  = $this->archived($board, 'Over the limit');
+        $this->login($this->owner);
+        $this->logger()->records           = [];
+        TestSyncLimitChecker::$refuseTasks = true;
+
+        $this->restore($task);
+
+        self::assertSame([
+            'status'   => 302,
+            'location' => self::BASE . 'board/' . $board->getId() . '/list',
+            'flashes'  => ['error' => ['The task was not restored: the limit of active tasks was reached.']],
+            'writes'   => [],
+            'refused'  => [],
+        ], $this->captured());
+        $this->em->clear();
+        self::assertTrue($this->em->find(Task::class, $task->getId())?->isArchived());
+        self::assertSame([], $this->em->getRepository(TaskChangeHistory::class)->findBy(['changeType' => TaskChangeType::Restored]));
+    }
+
+    public function testATaskThatIsNotArchivedIsLeftAloneWithoutAskingTheLimit(): void
+    {
+        $board = $this->board();
+        $task  = $this->task($board, 'Active');
+        $this->login($this->owner);
+        $this->logger()->records = [];
+
+        $this->restore($task);
+
+        self::assertSame([
+            'status'   => 302,
+            'location' => self::BASE . 'board/' . $board->getId() . '/list',
+            'flashes'  => [],
+            'writes'   => [],
+            'refused'  => [],
+        ], $this->captured());
+        self::assertSame([], TestSyncLimitChecker::$calls);
+    }
+
+    public function testAForgedTokenIsRefusedBeforeAnything(): void
+    {
+        $board = $this->board();
+        $task  = $this->archived($board, 'Stays');
+        $this->login($this->owner);
+        $this->logger()->records = [];
+
+        $this->client->request('POST', self::BASE . 'task/' . $task->getId() . '/restore', ['_token' => 'forged']);
+
+        $captured = $this->captured();
+        self::assertSame(403, $captured['status']);
+        self::assertSame(['csrf_invalid'], $captured['refused']);
+        self::assertSame([], TestSyncLimitChecker::$calls);
+    }
+
+    private function archived(TaskBoard $board, string $title, bool $completed = false): Task
+    {
+        $task = new Task(board: $board, title: $title, creator: $this->owner, column: $board->getColumns()->first() ?: null);
+        if ($completed) {
+            $task->markCompleted();
+        }
+        $task->archive();
+        $this->em->persist($task);
+        $this->em->flush();
+
+        return $task;
+    }
+
+    private function restore(Task $task): void
+    {
+        $this->client->request('POST', self::BASE . 'task/' . $task->getId() . '/restore', ['_token' => PredictableCsrfTokenManager::value('task_board_task_restore')]);
+    }
+}
diff --git a/tests/Functional/SharedWriteServicesTest.php b/tests/Functional/SharedWriteServicesTest.php
new file mode 100644
index 00000000..998a0945
--- /dev/null
+++ b/tests/Functional/SharedWriteServicesTest.php
@@ -0,0 +1,212 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional;
+
+use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Dto\TaskFormData;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskChangeHistory;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Entity\TaskTimeEntry;
+use Nowo\TaskBoardBundle\Enum\TaskChangeType;
+use Nowo\TaskBoardBundle\Enum\TaskDependencyType;
+use Nowo\TaskBoardBundle\Enum\TaskPriority;
+use Nowo\TaskBoardBundle\Event\BoardAccessCheckEvent;
+use Nowo\TaskBoardBundle\Event\BoardUpdatedEvent;
+use Nowo\TaskBoardBundle\Event\TaskAccessCheckEvent;
+use Nowo\TaskBoardBundle\Event\TaskBoardEvents;
+use Nowo\TaskBoardBundle\Event\TaskErasedEvent;
+use Nowo\TaskBoardBundle\Repository\TaskBoardRepositoryInterface;
+use Nowo\TaskBoardBundle\Security\TaskBoardResourceAccessChecker;
+use Nowo\TaskBoardBundle\Service\TaskBoardEditor;
+use Nowo\TaskBoardBundle\Service\TaskBoardEraser;
+use Nowo\TaskBoardBundle\Service\TaskCommentPolicy;
+use Nowo\TaskBoardBundle\Service\TaskDependencyManager;
+use Nowo\TaskBoardBundle\Service\TaskManager;
+use Nowo\TaskBoardBundle\Service\TaskTimeLogger;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+/**
+ * Since 2.2.0 (spec 213): the services other write paths share with the UI, or that the UI does not have yet.
+ */
+final class SharedWriteServicesTest extends FunctionalTestCase
+{
+    public function testEraseTaskRemovesTheSubtreeLeafFirstAndKeepsEveryMinute(): void
+    {
+        $board      = $this->board();
+        $parent     = $this->task($board, 'Parent');
+        $child      = $this->task($board, 'Child', parent: $parent);
+        $grandchild = $this->task($board, 'Grandchild', parent: $child);
+        $sibling    = $this->task($board, 'Sibling');
+        $logger     = $this->service(TaskTimeLogger::class);
+        $onChild    = $logger->log($child, $this->owner, 30, new DateTimeImmutable('2026-11-04'))->getId();
+        $onLeaf     = $logger->log($grandchild, $this->owner, 15, new DateTimeImmutable('2026-11-04'))->getId();
+        $erased     = [];
+        $this->dispatcher()->addListener(TaskBoardEvents::TASK_ERASED, static function (TaskErasedEvent $event) use (&$erased): void {
+            $erased[$event->title] = $event->manualTimeEntries;
+        });
+        $siblingId = $sibling->getId();
+
+        self::assertSame(3, $this->eraser()->eraseTask($parent, $this->owner));
+
+        self::assertSame(['Grandchild' => 1, 'Child' => 1, 'Parent' => 0], $erased);
+        $this->em->clear();
+        self::assertSame(1, $this->em->getRepository(Task::class)->count([]));
+        self::assertInstanceOf(Task::class, $this->em->find(Task::class, $siblingId));
+        foreach ([$onChild => [30, 'Child'], $onLeaf => [15, 'Grandchild']] as $id => [$minutes, $title]) {
+            $entry = $this->em->find(TaskTimeEntry::class, $id);
+            self::assertInstanceOf(TaskTimeEntry::class, $entry, 'tracked time is never deleted');
+            self::assertTrue($entry->isDetached());
+            self::assertSame($minutes, $entry->getMinutes());
+            self::assertSame($title, $entry->getTaskTitleSnapshot());
+        }
+    }
+
+    public function testEraseTaskNeedsTheBoardManageDecision(): void
+    {
+        $task = $this->task($this->board(), 'Stays');
+        $this->dispatcher()->addListener(TaskBoardEvents::BOARD_ACCESS_CHECK, static function (BoardAccessCheckEvent $event): void {
+            if ($event->getAction() === BoardAccessCheckEvent::ACTION_MANAGE) {
+                $event->deny();
+            }
+        });
+
+        try {
+            $this->eraser()->eraseTask($task, $this->owner);
+            self::fail('AccessDeniedException expected');
+        } catch (AccessDeniedException) {
+        }
+
+        $this->em->clear();
+        self::assertInstanceOf(Task::class, $this->em->find(Task::class, $task->getId()));
+    }
+
+    public function testRestoreAndArchiveRecordTheirHistoryAndAreIdempotent(): void
+    {
+        $task    = $this->task($this->board(), 'Back and forth');
+        $manager = $this->service(TaskManager::class);
+
+        self::assertFalse($manager->restore($task, $this->owner), 'not archived');
+        self::assertTrue($manager->archive($task, $this->owner));
+        self::assertTrue($task->isArchived());
+        self::assertFalse($manager->archive($task, $this->owner), 'already archived');
+        self::assertTrue($manager->restore($task, $this->owner));
+        self::assertFalse($task->isArchived());
+
+        $this->em->clear();
+        $history = $this->em->getRepository(TaskChangeHistory::class);
+        self::assertCount(1, $history->findBy(['changeType' => TaskChangeType::Archived, 'newValue' => 'manual']));
+        self::assertCount(1, $history->findBy(['changeType' => TaskChangeType::Restored, 'newValue' => 'manual']));
+    }
+
+    public function testTheCommentPolicyAnswersEachRole(): void
+    {
+        $task     = $this->task($this->board(), 'Discussed');
+        $reader   = $this->user('reader@example.com');
+        $readerId = $reader->getId();
+        $this->dispatcher()->addListener(TaskBoardEvents::TASK_ACCESS_CHECK, static function (TaskAccessCheckEvent $event) use ($readerId): void {
+            $subject = $event->getSubject();
+            if (method_exists($subject, 'getId') && $subject->getId() === $readerId) {
+                $event->grant();
+                $event->markReadOnly();
+            }
+        });
+        $checker  = $this->service(TaskBoardResourceAccessChecker::class);
+        $open     = new TaskCommentPolicy($checker, true);
+        $closed   = new TaskCommentPolicy($checker, false);
+        $byReader = new TaskComment($task, $reader, 'Mine');
+        $byOwner  = new TaskComment($task, $this->owner, 'Theirs');
+
+        self::assertTrue($open->mayComment($reader, $task));
+        self::assertFalse($closed->mayComment($reader, $task));
+        self::assertTrue($closed->mayComment($this->owner, $task), 'an editor always may');
+
+        self::assertTrue($open->mayEdit($reader, $task, $byReader));
+        self::assertFalse($closed->mayEdit($reader, $task, $byReader), 'the author, while they may comment');
+        self::assertFalse($open->mayEdit($this->owner, $task, $byReader), 'an editor does not edit someone else');
+
+        self::assertTrue($closed->mayDelete($reader, $task, $byReader), 'the author deletes');
+        self::assertFalse($open->mayDelete($reader, $task, $byOwner));
+        self::assertTrue($open->mayDelete($this->owner, $task, $byReader), 'an editor deletes');
+    }
+
+    public function testTheBoardEditorChangesWhatChangedAndKeepsTheSlug(): void
+    {
+        $board  = $this->board();
+        $slug   = $board->getSlug();
+        $events = [];
+        $editor = new TaskBoardEditor($this->service(TaskBoardRepositoryInterface::class), $this->dispatcher());
+        $this->dispatcher()->addListener(TaskBoardEvents::BOARD_UPDATED, static function (BoardUpdatedEvent $event) use (&$events): void {
+            $events[] = $event->changed;
+        });
+
+        $editor->update($board, 'Renamed', null, $this->owner);
+        $editor->update($board, 'Renamed', 'Now with text', $this->owner);
+        $editor->update($board, 'Renamed', 'Now with text', $this->owner);
+
+        self::assertSame([['name'], ['description']], $events);
+        $this->em->clear();
+        $saved = $this->service(TaskBoardRepositoryInterface::class)->findById($board->getId());
+        self::assertSame('Renamed', $saved?->getName());
+        self::assertSame('Now with text', $saved?->getDescription());
+        self::assertSame($slug, $saved?->getSlug());
+    }
+
+    public function testFindBetweenSeesBothDirectionsAndNothingElse(): void
+    {
+        $board   = $this->board();
+        $a       = $this->task($board, 'A');
+        $b       = $this->task($board, 'B');
+        $c       = $this->task($board, 'C');
+        $manager = $this->service(TaskDependencyManager::class);
+        $edge    = $manager->add($a, $b, TaskDependencyType::Blocks, $this->owner);
+
+        self::assertSame([$edge->getId()], array_map(static fn ($d): string => $d->getId(), $manager->findBetween($a, $b)));
+        self::assertSame([$edge->getId()], array_map(static fn ($d): string => $d->getId(), $manager->findBetween($b, $a)));
+        self::assertSame([], $manager->findBetween($a, $c));
+    }
+
+    public function testFormDataOfATaskIsTheTaskAsItStands(): void
+    {
+        $task = $this->task($this->board(), 'Full');
+        $due  = new DateTimeImmutable('2026-12-01');
+        $task->setDescription('Text')->setPriority(TaskPriority::High)->setEstimatedMinutes(90)->setDueAt($due)->setTags(['api'])->setColor('#a1b2c3')->setStartAt($due);
+
+        $data = TaskFormData::fromTask($task);
+
+        self::assertSame('Full', $data->title);
+        self::assertSame('Text', $data->description);
+        self::assertSame(TaskPriority::High, $data->priority);
+        self::assertSame($task->getColumn()?->getId(), $data->columnId);
+        self::assertSame(90, $data->estimatedMinutes);
+        self::assertSame($due, $data->dueAt);
+        self::assertSame(['api'], $data->tags);
+        self::assertSame('#a1b2c3', $data->color);
+        self::assertSame($due, $data->startAt);
+    }
+
+    private function eraser(): TaskBoardEraser
+    {
+        return $this->service('app.board_eraser');
+    }
+
+    private function dispatcher(): EventDispatcherInterface
+    {
+        return $this->service('event_dispatcher');
+    }
+
+    /**
+     * @template T of object
+     *
+     * @param class-string<T>|string $id
+     *
+     * @return ($id is class-string<T> ? T : mixed)
+     */
+    private function service(string $id): mixed
+    {
+        return self::getContainer()->get($id);
+    }
+}
diff --git a/tests/Functional/Sync/SyncEraseTaskRefsTest.php b/tests/Functional/Sync/SyncEraseTaskRefsTest.php
new file mode 100644
index 00000000..79b9aa81
--- /dev/null
+++ b/tests/Functional/Sync/SyncEraseTaskRefsTest.php
@@ -0,0 +1,64 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Sync;
+
+use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Event\TaskBoardEvents;
+use Nowo\TaskBoardBundle\Event\TaskErasedEvent;
+use Nowo\TaskBoardBundle\Service\TaskBoardEraser;
+use Nowo\TaskBoardBundle\Sync\Entity\TaskSyncAttachment;
+use Nowo\TaskBoardBundle\Sync\Provider\RemoteAttachment;
+use Nowo\TaskBoardBundle\Tests\Functional\App\FixtureHttpClient;
+use Nowo\TaskBoardBundle\Tests\Functional\App\RecordingAttachmentStorage;
+use Symfony\Component\HttpClient\Response\MockResponse;
+
+use function array_keys;
+
+/**
+ * Since 2.2.0, audit IA-M1 (proof test by the auditor): a task erased after its board was unlinked still names the files the
+ * sync stored, as deleteBoard() does since GWd-M1, and leaves no row behind on any database.
+ */
+final class SyncEraseTaskRefsTest extends SyncPeopleFunctionalTestCase
+{
+    private const PDF = "%PDF-1.4\n%\xE2\xE3\xCF\xD3\n1 0 obj<<>>endobj\ntrailer<<>>\n%%EOF";
+
+    public function testEraseTaskAfterUnlinkNamesTheStoredFiles(): void
+    {
+        $board                        = $this->board();
+        FixtureHttpClient::$responder = static fn (): MockResponse => new MockResponse(self::PDF, ['http_code' => 200]);
+        $this->put($this->remote('t1', 'Has file', attachments: [new RemoteAttachment('att1', 'own.pdf', 30, 'application/pdf', 'https://t000.p.clickup-attachments.com/att1/own.pdf', new DateTimeImmutable('@1790000000'))]));
+        $this->sync($board);
+        self::assertSame(1, $this->rows(TaskSyncAttachment::class));
+
+        $this->service()->unlink($this->freshBoard($board), $this->owner);
+        $this->em->clear();
+        $this->refreshOwner();
+        self::assertSame(1, $this->rows(TaskSyncAttachment::class), 'row outlives the unlink (GWd-M1)');
+
+        $refs = [];
+        $this->dispatcher()->addListener(TaskBoardEvents::TASK_ERASED, static function (TaskErasedEvent $event) use (&$refs): void {
+            $refs = [...$refs, ...$event->attachmentRefs];
+        });
+        $eraser = self::getContainer()->get('app.board_eraser');
+        self::assertInstanceOf(TaskBoardEraser::class, $eraser);
+        $task = $this->em->getRepository(Task::class)->findOneBy(['title' => 'Has file']);
+        self::assertInstanceOf(Task::class, $task);
+        self::assertSame(1, $eraser->eraseTask($task, $this->owner));
+
+        self::assertCount(1, $refs, 'the host learns of the stored file');
+        self::assertSame(array_keys(RecordingAttachmentStorage::$files), $refs);
+        $this->em->clear();
+        self::assertSame(0, $this->rows(TaskSyncAttachment::class), 'no orphaned row, whatever the database enforces');
+
+        // Named once: a later deletion of the board has nothing more to name.
+        $later = [];
+        $this->dispatcher()->addListener(TaskBoardEvents::TASK_ERASED, static function (TaskErasedEvent $event) use (&$later): void {
+            $later = [...$later, ...$event->attachmentRefs];
+        });
+        $eraser->deleteBoard($this->freshBoard($board), $this->owner);
+        self::assertSame([], $later);
+    }
+}
diff --git a/tests/Functional/Sync/SyncEraseTaskTest.php b/tests/Functional/Sync/SyncEraseTaskTest.php
new file mode 100644
index 00000000..5d53756d
--- /dev/null
+++ b/tests/Functional/Sync/SyncEraseTaskTest.php
@@ -0,0 +1,47 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Functional\Sync;
+
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Exception\TaskLinkedToProviderException;
+use Nowo\TaskBoardBundle\Service\TaskBoardEraser;
+
+use function array_map;
+use function sort;
+
+/**
+ * Since 2.2.0 (spec 213): a task that follows a provider is not erased on its own, as the next sync would bring it back.
+ */
+final class SyncEraseTaskTest extends SyncFunctionalTestCase
+{
+    public function testASyncedTaskIsNotErasedOnItsOwnNorIsItsParent(): void
+    {
+        $board = $this->board();
+        $this->put($this->remote('s1', 'Synced', 1));
+        $this->sync($board);
+        $fresh  = $this->freshBoard($board);
+        $local  = $this->task($fresh, 'Local');
+        $parent = $this->task($fresh, 'Local parent');
+        $synced = $this->taskTitled('Synced');
+        $synced->setParent($parent);
+        $this->em->flush();
+        $eraser = self::getContainer()->get('app.board_eraser');
+        self::assertInstanceOf(TaskBoardEraser::class, $eraser);
+
+        foreach ([$synced, $parent] as $refused) {
+            try {
+                $eraser->eraseTask($refused, $this->owner);
+                self::fail('TaskLinkedToProviderException expected');
+            } catch (TaskLinkedToProviderException) {
+            }
+        }
+        self::assertSame(1, $eraser->eraseTask($local, $this->owner), 'a local task on a linked board goes');
+
+        $this->em->clear();
+        $titles = array_map(static fn (Task $task): string => $task->getTitle(), $this->em->getRepository(Task::class)->findAll());
+        sort($titles);
+        self::assertSame(['Local parent', 'Synced'], $titles);
+    }
+}
diff --git a/tests/Unit/Api/TaskApiExtensionTest.php b/tests/Unit/Api/TaskApiExtensionTest.php
new file mode 100644
index 00000000..c39f17c8
--- /dev/null
+++ b/tests/Unit/Api/TaskApiExtensionTest.php
@@ -0,0 +1,126 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Unit\Api;
+
+use LogicException;
+use Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiPlanGate;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiIdempotencyStoreInterface;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiPlanGateInterface;
+use Nowo\TaskBoardBundle\DependencyInjection\TaskBoardExtension;
+use Nowo\TaskBoardBundle\Routing\TaskBoardRouteLoader;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+use stdClass;
+use Symfony\Component\Config\Definition\Exception\InvalidConfigurationException;
+use Symfony\Component\DependencyInjection\ContainerBuilder;
+
+/**
+ * Spec 213: a host that would open boards by accident does not get a container.
+ */
+final class TaskApiExtensionTest extends TestCase
+{
+    public function testEnabledWithoutAnAuthenticatorStopsTheBuild(): void
+    {
+        $this->expectException(LogicException::class);
+        $this->expectExceptionMessage('api.hooks.authenticator');
+
+        $this->load(['api' => ['enabled' => true]]);
+    }
+
+    public function testAnEmptyAuthenticatorStopsTheBuildToo(): void
+    {
+        $this->expectException(LogicException::class);
+
+        $this->load(['api' => ['enabled' => true, 'hooks' => ['authenticator' => '']]]);
+    }
+
+    public function testEnabledWithAllowUnauthenticatedStopsTheBuild(): void
+    {
+        $this->expectException(LogicException::class);
+        $this->expectExceptionMessage('allow_unauthenticated');
+
+        $this->load(['api' => ['enabled' => true, 'hooks' => ['authenticator' => 'app.auth']], 'security' => ['allow_unauthenticated' => true]]);
+    }
+
+    public function testNoScopingNeedsTheHostToSaySoItDecides(): void
+    {
+        try {
+            $this->load(['api' => ['enabled' => true, 'hooks' => ['authenticator' => 'app.auth']], 'security' => ['resource_scoping' => false]]);
+            self::fail('LogicException expected');
+        } catch (LogicException $exception) {
+            self::assertStringContainsString('host_decides_access', $exception->getMessage());
+        }
+
+        $container = $this->load(['api' => ['enabled' => true, 'host_decides_access' => true, 'hooks' => ['authenticator' => 'app.auth']], 'security' => ['resource_scoping' => false]]);
+        self::assertSame('/api/tasks', $container->getParameter('nowo_task_board.api.prefix'));
+    }
+
+    public function testUnsetHooksAreTheDeniersAndSetOnesAreTheHosts(): void
+    {
+        $defaults = $this->load(['api' => ['enabled' => true, 'hooks' => ['authenticator' => 'app.auth']]]);
+        self::assertSame(DenyingTaskApiPlanGate::class, (string) $defaults->getAlias(TaskApiPlanGateInterface::class));
+        self::assertFalse($defaults->hasAlias(TaskApiIdempotencyStoreInterface::class));
+
+        $hosts = $this->load(['api' => ['enabled' => true, 'hooks' => ['authenticator' => 'app.auth', 'plan_gate' => 'app.plan', 'idempotency_store' => 'app.store']]]);
+        self::assertSame('app.plan', (string) $hosts->getAlias(TaskApiPlanGateInterface::class));
+        self::assertSame('app.store', (string) $hosts->getAlias(TaskApiIdempotencyStoreInterface::class));
+    }
+
+    /**
+     * @return iterable<string, array{0: mixed}>
+     */
+    public static function badPrefixes(): iterable
+    {
+        yield 'no slash' => ['api/tasks'];
+        yield 'trailing slash' => ['/api/tasks/'];
+        yield 'root' => ['/'];
+        yield 'a variable' => ['/api/{tenant}'];
+        yield 'not a string' => [true];
+    }
+
+    #[DataProvider('badPrefixes')]
+    public function testABadPrefixIsAConfigurationError(mixed $prefix): void
+    {
+        $this->expectException(InvalidConfigurationException::class);
+
+        $this->load(['api' => ['prefix' => $prefix]]);
+    }
+
+    public function testOffRegistersNothingEvenWithHooksSet(): void
+    {
+        $container = $this->load(['api' => ['enabled' => false, 'hooks' => ['authenticator' => 'app.auth']]]);
+
+        self::assertFalse($container->hasParameter('nowo_task_board.api.prefix'));
+        foreach ([...array_keys($container->getDefinitions()), ...array_keys($container->getAliases())] as $id) {
+            self::assertStringNotContainsString('TaskBoardBundle\\Api\\', $id);
+        }
+    }
+
+    public function testSettingTheOptionOffEqualsNotSettingIt(): void
+    {
+        $unset = $this->load([]);
+        $off   = $this->load(['api' => ['enabled' => false, 'prefix' => '/elsewhere', 'hooks' => ['authenticator' => 'app.auth', 'rate_limiter' => 'app.limiter']]]);
+
+        self::assertSame(array_keys($unset->getDefinitions()), array_keys($off->getDefinitions()));
+        self::assertSame(array_keys($unset->getAliases()), array_keys($off->getAliases()));
+        self::assertSame($unset->getParameterBag()->all(), $off->getParameterBag()->all());
+        self::assertEquals($unset->getDefinition(TaskBoardRouteLoader::class)->getArguments(), $off->getDefinition(TaskBoardRouteLoader::class)->getArguments());
+    }
+
+    /**
+     * @param array<string, mixed> $config
+     */
+    private function load(array $config): ContainerBuilder
+    {
+        $container = new ContainerBuilder();
+        $container->setParameter('kernel.project_dir', __DIR__);
+        $container->setParameter('kernel.bundles', ['SecurityBundle' => stdClass::class]);
+        $container->setParameter('kernel.debug', false);
+        $container->setParameter('kernel.environment', 'test');
+        (new TaskBoardExtension())->load([['user_class' => stdClass::class] + $config], $container);
+
+        return $container;
+    }
+}
diff --git a/tests/Unit/Api/TaskApiValuesTest.php b/tests/Unit/Api/TaskApiValuesTest.php
new file mode 100644
index 00000000..6c13aed4
--- /dev/null
+++ b/tests/Unit/Api/TaskApiValuesTest.php
@@ -0,0 +1,201 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Unit\Api;
+
+use DateTimeImmutable;
+use LogicException;
+use Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiAttachments;
+use Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiPlanGate;
+use Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiRateLimiter;
+use Nowo\TaskBoardBundle\Api\Hook\DenyingTaskApiTimeEntries;
+use Nowo\TaskBoardBundle\Api\Hook\EmptyTaskApiUsers;
+use Nowo\TaskBoardBundle\Api\Hook\EmptyTaskApiWorkspace;
+use Nowo\TaskBoardBundle\Api\Hook\TaskApiTimeEntriesInterface;
+use Nowo\TaskBoardBundle\Api\Security\TaskApiRequestListener;
+use Nowo\TaskBoardBundle\Api\TaskApiCapability;
+use Nowo\TaskBoardBundle\Api\TaskApiCredential;
+use Nowo\TaskBoardBundle\Api\TaskApiLevel;
+use Nowo\TaskBoardBundle\Api\TaskApiPrincipal;
+use Nowo\TaskBoardBundle\Api\TaskApiRefusal;
+use Nowo\TaskBoardBundle\Api\TaskApiWhere;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiAttachment;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiIdempotencyClaim;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiIdempotencyOutcome;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiNewTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTaskFilter;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeEntry;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimePage;
+use Nowo\TaskBoardBundle\Api\Value\TaskApiTimeQuery;
+use Nowo\TaskBoardBundle\Entity\Task;
+use Nowo\TaskBoardBundle\Entity\TaskBoard;
+use Nowo\TaskBoardBundle\Event\TaskApiWriteEvent;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+use ReflectionClass;
+use stdClass;
+use Symfony\Component\HttpFoundation\File\UploadedFile;
+use Symfony\Component\HttpFoundation\Request;
+
+use function in_array;
+
+/**
+ * Spec 213: the capability table, where, the credential, and that every default denies.
+ */
+final class TaskApiValuesTest extends TestCase
+{
+    /**
+     * The whole table of the contract: anything not listed is denied.
+     *
+     * @return iterable<string, array{0: TaskApiLevel, 1: list<TaskApiCapability>}>
+     */
+    public static function levels(): iterable
+    {
+        yield 'my tasks' => [TaskApiLevel::MyTasks, [TaskApiCapability::ReadOwn, TaskApiCapability::WorkOnTask, TaskApiCapability::Comment]];
+        yield 'read writes nothing, not even its own' => [TaskApiLevel::Read, [TaskApiCapability::ReadOwn, TaskApiCapability::ReadEverything]];
+        yield 'tasks' => [TaskApiLevel::Tasks, [TaskApiCapability::ReadOwn, TaskApiCapability::ReadEverything, TaskApiCapability::WorkOnTask, TaskApiCapability::Comment, TaskApiCapability::EditTasks, TaskApiCapability::DeleteTask]];
+        yield 'full' => [TaskApiLevel::Full, TaskApiCapability::cases()];
+    }
+
+    /**
+     * @param list<TaskApiCapability> $allowed
+     */
+    #[DataProvider('levels')]
+    public function testALevelMayExactlyWhatTheTableSays(TaskApiLevel $level, array $allowed): void
+    {
+        foreach (TaskApiCapability::cases() as $capability) {
+            self::assertSame(in_array($capability, $allowed, true), $capability->allows($level), $level->value . ' ' . $capability->name);
+        }
+    }
+
+    public function testWhereEverythingLeavesOutOnlyWhatTheHostRemoves(): void
+    {
+        $where = TaskApiWhere::everything(['forbidden']);
+
+        self::assertTrue($where->reachesBoard($this->board('open')));
+        self::assertTrue($where->reachesBoard($this->board(null)));
+        self::assertFalse($where->reachesBoard($this->board('forbidden')));
+        self::assertTrue($where->reachesTenant(null));
+        self::assertFalse($where->reachesTenant('forbidden'));
+        self::assertTrue($where->touchesTenant('open', []));
+        self::assertFalse($where->touchesTenant('forbidden', ['any-board']));
+    }
+
+    public function testWhereLimitedReachesOnlyWhatItNames(): void
+    {
+        $named = $this->board('other');
+        $where = TaskApiWhere::limitedTo(['tenant'], [$named->getId()]);
+
+        self::assertTrue($where->reachesBoard($this->board('tenant')));
+        self::assertTrue($where->reachesBoard($named));
+        self::assertFalse($where->reachesBoard($this->board('other')));
+        self::assertFalse($where->reachesBoard($this->board(null)));
+        self::assertTrue($where->reachesTenant('tenant'));
+        self::assertFalse($where->reachesTenant('other'), 'one board of it does not reach the whole tenant');
+        self::assertFalse($where->reachesTenant(null));
+        self::assertTrue($where->touchesTenant('tenant', []));
+        self::assertTrue($where->touchesTenant('other', ['unrelated', $named->getId()]));
+        self::assertFalse($where->touchesTenant('other', ['unrelated']));
+        self::assertFalse(TaskApiWhere::limitedTo([], [])->reachesBoard($named));
+    }
+
+    public function testTheCredentialIsTheHeaderAndNothingElse(): void
+    {
+        self::assertSame('bt_x', TaskApiCredential::fromRequest($this->withHeader('bt_x')));
+        self::assertSame('bt_x', TaskApiCredential::fromRequest($this->withHeader('Bearer bt_x')));
+        self::assertSame('bt_x', TaskApiCredential::fromRequest($this->withHeader('bearer   bt_x ')));
+        self::assertNull(TaskApiCredential::fromRequest($this->withHeader('Bearer ')));
+        self::assertNull(TaskApiCredential::fromRequest($this->withHeader('')));
+        self::assertNull(TaskApiCredential::fromRequest(Request::create('/?token=bt_x&access_token=bt_x&Authorization=bt_x')));
+    }
+
+    public function testEveryDefaultDenies(): void
+    {
+        $principal = new TaskApiPrincipal(new stdClass(), TaskApiLevel::Full, TaskApiWhere::everything(), 'id', 'name');
+
+        $limiter = new DenyingTaskApiRateLimiter();
+        self::assertFalse($limiter->consume($principal)->accepted);
+        self::assertFalse($limiter->failedTokenState('127.0.0.1')->accepted);
+        $limiter->registerFailedToken('127.0.0.1');
+
+        self::assertFalse((new DenyingTaskApiPlanGate())->allowsTasks(new stdClass(), null));
+        self::assertFalse((new DenyingTaskApiPlanGate())->allowsTasks(new stdClass(), 'tenant'));
+
+        $workspace = new EmptyTaskApiWorkspace();
+        self::assertSame([], $workspace->teams($principal));
+        self::assertSame([], $workspace->spaces($principal, 'team'));
+        self::assertNull($workspace->space($principal, 'space'));
+        self::assertNull($workspace->spaceOfTenant($principal, 'tenant'));
+
+        $users = new EmptyTaskApiUsers();
+        self::assertNull($users->find('id'));
+        self::assertSame([], $users->profiles([new stdClass()], $principal));
+        $this->assertRefused(404, 'ACCESS_001', static fn () => $users->apiId(new stdClass()));
+
+        $time = new DenyingTaskApiTimeEntries();
+        $this->assertRefused(403, 'TIME_001', static fn () => $time->list($principal, new TaskApiTimeQuery('team')));
+        $this->assertRefused(403, 'TIME_001', static fn () => $time->log($principal, null, new TaskApiNewTimeEntry('team', new DateTimeImmutable(), 60)));
+
+        $board = new TaskBoard('Board', 'board', null);
+        $file  = new UploadedFile(__FILE__, 'a.txt', null, null, true);
+        $this->assertRefused(403, 'FILE_001', static fn () => (new DenyingTaskApiAttachments())->store($principal, new Task(board: $board, title: 'T', creator: null), $file));
+    }
+
+    public function testTheTimeHookHasNoDelete(): void
+    {
+        self::assertFalse((new ReflectionClass(TaskApiTimeEntriesInterface::class))->hasMethod('delete'), 'owner: tracked time is never deleted through the API');
+    }
+
+    public function testValuesCarryWhatTheyAreGiven(): void
+    {
+        $start = new DateTimeImmutable('2026-11-07');
+        $entry = new TaskApiTimeEntry('id', 'user', $start, 60, 'task', 'note');
+        self::assertSame([$entry], (new TaskApiTimePage([$entry]))->entries);
+        self::assertSame('https://example.com/f', (new TaskApiAttachment('id', 'f', 'https://example.com/f', 3))->url);
+        $claim = new TaskApiIdempotencyClaim(TaskApiIdempotencyOutcome::Completed, 200, '{}', 'tenant', 'board');
+        self::assertSame(200, $claim->status);
+
+        $principal = new TaskApiPrincipal(new stdClass(), TaskApiLevel::Tasks, TaskApiWhere::everything(), 'id', 'name');
+        $event     = new TaskApiWriteEvent($principal, 'task.update', 'tenant', 'board', 'task', ['other' => 'x'], ['name']);
+        self::assertSame(['name'], $event->changedFields);
+    }
+
+    public function testAFilterValueOfTheWrongTypeIsRefused(): void
+    {
+        $this->assertRefused(400, 'INPUT_002', static fn () => TaskApiTaskFilter::fromQuery(['statuses' => 5]));
+        self::assertSame(['open'], TaskApiTaskFilter::fromQuery(['statuses' => 'Open'])->statuses);
+    }
+
+    public function testAControllerOutsideThePipelineHasNoPrincipal(): void
+    {
+        $this->expectException(LogicException::class);
+        TaskApiRequestListener::principalOf(Request::create('/'));
+    }
+
+    private function board(?string $tenantKey): TaskBoard
+    {
+        $board = new TaskBoard('Board', 'board', null);
+        $board->setTenantKey($tenantKey);
+
+        return $board;
+    }
+
+    private function withHeader(string $value): Request
+    {
+        $request = Request::create('/');
+        $request->headers->set('Authorization', $value);
+
+        return $request;
+    }
+
+    private function assertRefused(int $status, string $ecode, callable $call): void
+    {
+        try {
+            $call();
+            self::fail('TaskApiRefusal expected');
+        } catch (TaskApiRefusal $refusal) {
+            self::assertSame([$status, $ecode], [$refusal->status, $refusal->ecode]);
+        }
+    }
+}
diff --git a/tests/Unit/Controller/TaskBoardManageControllerSignatureTest.php b/tests/Unit/Controller/TaskBoardManageControllerSignatureTest.php
new file mode 100644
index 00000000..e1b06b0e
--- /dev/null
+++ b/tests/Unit/Controller/TaskBoardManageControllerSignatureTest.php
@@ -0,0 +1,39 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Unit\Controller;
+
+use Nowo\TaskBoardBundle\Controller\TaskBoardManageController;
+use PHPUnit\Framework\TestCase;
+use ReflectionMethod;
+use ReflectionParameter;
+
+use function array_map;
+use function array_slice;
+use function count;
+
+/**
+ * Audit IA-I1: a minor release keeps the controller's constructor as 2.1 had it, so a host passing arguments by position
+ * or by name is not broken. New arguments go at the end.
+ */
+final class TaskBoardManageControllerSignatureTest extends TestCase
+{
+    /** The constructor of 2.1.0, in order. */
+    private const SINCE_2_1 = [
+        'accessChecker', 'boardRepository', 'taskRepository', 'boardCreator', 'columnManager', 'taskManager', 'linkAttacher',
+        'memberAssigner', 'ganttBuilder', 'importOrchestrator', 'translator', 'routes', 'templates', 'userClass', 'dashboardRoute',
+        'resourceAccessChecker', 'tenantContext', 'topLevelOnly', 'columnSetManager', 'columnIcons', 'dependencyManager',
+        'timeLogger', 'weekStartResolver', 'commentManager', 'commentRepository', 'mentionCandidates', 'readersCanComment',
+        'maxTasks', 'clock', 'logger', 'avatars', 'defaultViewResolver', 'createDialogHeader', 'syncLimits', 'scopeProvider',
+        'boardFormOptions', 'quota', 'openSingleBoard', 'firstBoardProvisioner', 'pages', 'taskNumbers', 'taskNumberScope',
+        'calendarBuilder', 'calendarEnabled',
+    ];
+
+    public function testTheConstructorKeepsEveryArgumentOf21InItsPlace(): void
+    {
+        $names = array_map(static fn (ReflectionParameter $parameter): string => $parameter->getName(), (new ReflectionMethod(TaskBoardManageController::class, '__construct'))->getParameters());
+
+        self::assertSame(self::SINCE_2_1, array_slice($names, 0, count(self::SINCE_2_1)));
+    }
+}
diff --git a/tests/Unit/Validation/TaskConstraintsTest.php b/tests/Unit/Validation/TaskConstraintsTest.php
new file mode 100644
index 00000000..68c1d4b6
--- /dev/null
+++ b/tests/Unit/Validation/TaskConstraintsTest.php
@@ -0,0 +1,80 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Nowo\TaskBoardBundle\Tests\Unit\Validation;
+
+use DateTimeImmutable;
+use Nowo\TaskBoardBundle\Entity\TaskComment;
+use Nowo\TaskBoardBundle\Validation\TaskConstraints;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Validator\Constraint;
+use Symfony\Component\Validator\Validation;
+
+use function str_repeat;
+
+/**
+ * Since 2.2.0 (spec 213): the rules outside a form refuse what the forms refuse.
+ */
+final class TaskConstraintsTest extends TestCase
+{
+    /**
+     * @return iterable<string, array{0: list<Constraint>, 1: mixed, 2: bool}>
+     */
+    public static function values(): iterable
+    {
+        yield 'title' => [TaskConstraints::taskTitle(), 'Write the spec', true];
+        yield 'title empty' => [TaskConstraints::taskTitle(), '', false];
+        yield 'title too long' => [TaskConstraints::taskTitle(), str_repeat('x', 256), false];
+        yield 'task colour' => [TaskConstraints::taskColor(), '#a1b2c3', true];
+        yield 'task colour short form' => [TaskConstraints::taskColor(), '#abc', false];
+        yield 'task colour breaking out' => [TaskConstraints::taskColor(), '#a1b2c3;x:y', false];
+        yield 'board name' => [TaskConstraints::boardName(), 'Roadmap', true];
+        yield 'board name empty' => [TaskConstraints::boardName(), '', false];
+        yield 'board slug too long' => [TaskConstraints::boardSlug(), str_repeat('x', 256), false];
+        yield 'icon' => [TaskConstraints::boardIcon('long', 'invalid'), "\u{1F680}", true];
+        yield 'icon text' => [TaskConstraints::boardIcon('long', 'invalid'), 'rocket', false];
+        yield 'column name' => [TaskConstraints::columnName(), 'Review', true];
+        yield 'column name too long' => [TaskConstraints::columnName(), str_repeat('x', 129), false];
+        yield 'column colour' => [TaskConstraints::columnColor(), '#abc', true];
+        yield 'column colour script' => [TaskConstraints::columnColor(), 'red;background:url(x)', false];
+        yield 'comment' => [TaskConstraints::commentBody(), 'Hello', true];
+        yield 'comment too long' => [TaskConstraints::commentBody(), str_repeat('x', TaskComment::MAX_LENGTH + 1), false];
+        yield 'minutes' => [TaskConstraints::timeMinutes(), 45, true];
+        yield 'minutes zero' => [TaskConstraints::timeMinutes(), 0, false];
+        yield 'minutes over a week' => [TaskConstraints::timeMinutes(), TaskConstraints::MAX_MINUTES + 1, false];
+        yield 'minutes missing' => [TaskConstraints::timeMinutes(), null, false];
+        yield 'logged at missing' => [TaskConstraints::timeLoggedAt(), null, false];
+        yield 'note too long' => [TaskConstraints::timeNote(), str_repeat('x', 513), false];
+        yield 'link' => [TaskConstraints::linkUrl(), 'https://example.com/spec', true];
+        yield 'link without a tld' => [TaskConstraints::linkUrl(), 'http://intranet/spec', true];
+        yield 'link javascript' => [TaskConstraints::linkUrl(), 'javascript:alert(1)', false];
+        yield 'link data' => [TaskConstraints::linkUrl(), 'data:text/html,x', false];
+        yield 'link label too long' => [TaskConstraints::linkLabel(), str_repeat('x', 256), false];
+        yield 'link external id too long' => [TaskConstraints::linkExternalId(), str_repeat('x', 129), false];
+    }
+
+    /**
+     * @param list<Constraint> $constraints
+     */
+    #[DataProvider('values')]
+    public function testARuleAcceptsOrRefuses(array $constraints, mixed $value, bool $valid): void
+    {
+        $violations = Validation::createValidator()->validate($value, $constraints);
+
+        self::assertSame($valid, $violations->count() === 0);
+    }
+
+    public function testAStartAfterTheDueDateIsTheOnlyDateError(): void
+    {
+        $early = new DateTimeImmutable('2026-11-06');
+        $late  = new DateTimeImmutable('2026-11-07');
+
+        self::assertTrue(TaskConstraints::startsAfterDue($late, $early));
+        self::assertFalse(TaskConstraints::startsAfterDue($early, $late));
+        self::assertFalse(TaskConstraints::startsAfterDue($early, $early));
+        self::assertFalse(TaskConstraints::startsAfterDue(null, $early));
+        self::assertFalse(TaskConstraints::startsAfterDue($early, null));
+    }
+}